Nicole Perlroth: Cybersecurity and the Weapons of Cyberwar

Lex Fridman (01:31.220)

That's called a zero day because the minute it's discovered,

Nicole Perlroth (01:34.340)

engineers have had zero days to fix it.

Lex Fridman (01:37.720)

If I can study that zero day,

Nicole Perlroth (01:40.880)

I could potentially write a program to exploit it.

Lex Fridman (01:44.900)

And that program would be called a zero day exploit.

Lex Fridman (01:48.820)

And for iOS, the dream is that you craft a zero day exploit

Lex Fridman (01:54.260)

that can remotely exploit someone else's iPhone

Nicole Perlroth (01:57.340)

without them ever knowing about it.

Lex Fridman (01:59.900)

And you can capture their location,

Nicole Perlroth (02:01.860)

you can capture their contacts

Lex Fridman (02:04.960)

that record their telephone calls,

Nicole Perlroth (02:06.820)

record their camera without them knowing about it.

Lex Fridman (02:09.580)

Basically, you can put an invisible ankle bracelet

Nicole Perlroth (02:13.200)

on someone without them knowing.

Lex Fridman (02:15.020)

And you can see why that capability,

Nicole Perlroth (02:17.180)

that zero day exploit would have immense value

Lex Fridman (02:20.460)

for a spy agency or a government

Nicole Perlroth (02:23.700)

that wants to monitor its critics or dissidents.

Lex Fridman (02:27.660)

And so there's a very lucrative market now

Nicole Perlroth (02:30.560)

for zero day exploits.

Lex Fridman (02:32.060)

So you said a few things there.

Nicole Perlroth (02:33.420)

One is iOS, why iOS, which operating system,

Lex Fridman (02:37.640)

which one is the sexier thing to try to get to

Lex Fridman (02:40.180)

or the most impactful thing?

Lex Fridman (02:42.700)

And the other thing you mentioned is remote

Nicole Perlroth (02:45.460)

versus like having to actually come

Lex Fridman (02:47.720)

in physical contact with it.

Lex Fridman (02:49.300)

Is that the distinction?

Lex Fridman (02:50.860)

So iPhone exploits have just been

Nicole Perlroth (02:54.500)

a government's number one priority.

Lex Fridman (02:58.240)

Recently, actually the price

Nicole Perlroth (03:00.580)

of an Android remote zero day exploit,

Lex Fridman (03:03.500)

something that can get you into Android phones

Nicole Perlroth (03:06.540)

is actually higher.

Lex Fridman (03:08.100)

The value of that is now higher on this underground market

Nicole Perlroth (03:10.960)

for zero day exploits than an iPhone iOS exploit.

Lex Fridman (03:15.360)

So things are changing.

Lex Fridman (03:16.700)

So there's probably more Android devices,

Lex Fridman (03:20.040)

so that's why it's better.

Lex Fridman (03:21.740)

But then the iPhone side,

Lex Fridman (03:24.380)

so I'm an Android person,

Nicole Perlroth (03:26.160)

because I'm a man of the people.

Lex Fridman (03:28.300)

But it seems like all the elites use iPhone,

Nicole Perlroth (03:31.140)

all the people at nice dinner parties.

Lex Fridman (03:33.020)

So is that the reason that the more powerful people

Lex Fridman (03:37.260)

use iPhones, is that why?

Lex Fridman (03:38.780)

I don't think so.

Nicole Perlroth (03:39.780)

I actually, so it was about two years ago

Lex Fridman (03:42.460)

that the prices flipped.

Nicole Perlroth (03:43.660)

It used to be that if you could craft

Lex Fridman (03:46.740)

a remote zero click exploit for iOS,

Nicole Perlroth (03:53.340)

then that was about as good as it gets.

Lex Fridman (03:55.420)

You could sell that to a zero day broker for $2 million.

Nicole Perlroth (04:01.740)

The caveat is you can never tell anyone about it,

Lex Fridman (04:04.700)

because the minute you tell someone about it,

Nicole Perlroth (04:07.180)

Apple learns about it,

Lex Fridman (04:08.880)

they patch it in that $2.5 million investment

Nicole Perlroth (04:12.540)

that that zero day broker just made goes to dust.

Lex Fridman (04:16.100)

So a couple of years ago,

Lex Fridman (04:18.980)

and don't quote me on the prices,

Lex Fridman (04:20.780)

but an Android zero click remote exploit

Nicole Perlroth (04:25.900)

for the first time topped the iOS.

Lex Fridman (04:29.020)

And actually a lot of people's read on that

Nicole Perlroth (04:32.180)

was that it might be a sign

Lex Fridman (04:35.860)

that Apple security was falling,

Lex Fridman (04:40.260)

and that it might actually be easier

Lex Fridman (04:43.060)

to find an iOS zero day exploit

Nicole Perlroth (04:46.700)

than find an Android zero day exploit.

Lex Fridman (04:48.940)

The other thing is market share.

Nicole Perlroth (04:51.140)

There are just more people around the world that use Android.

Lex Fridman (04:54.700)

And a lot of governments that are paying top dollar

Nicole Perlroth (04:58.540)

for zero day exploits these days

Lex Fridman (05:01.320)

are deep pocketed governments in the Gulf

Nicole Perlroth (05:05.260)

that wanna use these exploits

Lex Fridman (05:06.940)

to monitor their own citizens, monitor their critics.

Lex Fridman (05:10.780)

And so it's not necessarily

Lex Fridman (05:12.380)

that they're trying to find elites,

Nicole Perlroth (05:14.620)

it's that they wanna find out who these people are

Lex Fridman (05:17.260)

that are criticizing them

Nicole Perlroth (05:18.500)

or perhaps planning the next Arab Spring.

Lex Fridman (05:21.180)

So in your experience,

Nicole Perlroth (05:23.260)

are most of these attacks targeted

Lex Fridman (05:24.940)

to cover a large population,

Nicole Perlroth (05:26.500)

or is there attacks that are targeted

Lex Fridman (05:29.100)

towards specific individuals?

Lex Fridman (05:31.300)

So I think it's both.

Lex Fridman (05:32.740)

Some of the zero day exploits that have fetched top dollar

Nicole Perlroth (05:36.980)

that I've heard of in my reporting in the United States

Lex Fridman (05:39.340)

were highly targeted.

Nicole Perlroth (05:41.260)

There was a potential terrorist attack.

Lex Fridman (05:43.640)

They wanted to get into this person's phone.

Nicole Perlroth (05:45.460)

It had to be done in the next 24 hours.

Lex Fridman (05:48.060)

They approached hackers and say, we'll pay you

Nicole Perlroth (05:50.860)

X millions of dollars if you can do this.

Lex Fridman (05:53.780)

But then you look at,

Nicole Perlroth (05:55.820)

when we've discovered iOS zero day exploits in the wild,

Lex Fridman (06:00.740)

some of them have been targeting large populations

Nicole Perlroth (06:03.660)

like Uyghurs.

Lex Fridman (06:05.240)

So a couple of years ago,

Nicole Perlroth (06:07.060)

there was a watering hole attack.

Lex Fridman (06:10.260)

Okay, what's a watering hole attack?

Nicole Perlroth (06:12.140)

There's a website,

Lex Fridman (06:13.260)

it was actually had information aimed at Uyghurs

Lex Fridman (06:17.860)

and you could access it all over the world.

Lex Fridman (06:20.960)

And if you visited this website,

Nicole Perlroth (06:24.140)

it would drop an iOS zero day exploit onto your phone.

Lex Fridman (06:29.140)

And so anyone that visited this website

Nicole Perlroth (06:32.220)

that was about Uyghurs anywhere,

Lex Fridman (06:34.460)

I mean, Uyghurs, Uyghurs living abroad,

Nicole Perlroth (06:37.400)

basically the Uyghur diaspora would have gotten infected

Lex Fridman (06:42.060)

with this zero day exploit.

Lex Fridman (06:43.940)

So in that case, they were targeting huge swaths

Lex Fridman (06:49.200)

of this one population or people interested

Nicole Perlroth (06:51.720)

in this one population, basically in real time.

Lex Fridman (06:54.780)

So who are these attackers?

Nicole Perlroth (06:59.340)

From the individual level to the group level,

Lex Fridman (07:02.660)

psychologically speaking, what's their motivation?

Lex Fridman (07:05.180)

Is it purely money?

Lex Fridman (07:07.420)

Is it the challenge?

Lex Fridman (07:09.220)

Are they malevolent?

Lex Fridman (07:10.620)

Is it power?

Nicole Perlroth (07:12.220)

These are big philosophical human questions, I guess.

Lex Fridman (07:15.460)

So these are the questions I set out to answer for my book.

Lex Fridman (07:20.380)

I wanted to know, are these people that are just after money?

Lex Fridman (07:26.900)

If they're just after money, how do they sleep at night?

Nicole Perlroth (07:29.680)

Not knowing whether that zero day exploit

Lex Fridman (07:31.900)

they just sold to a broker is being used

Nicole Perlroth (07:34.720)

to basically make someone's life a living hell.

Lex Fridman (07:38.140)

And what I found was there's kind of this long sorted history

Nicole Perlroth (07:41.820)

to this question.

Lex Fridman (07:43.660)

It started out in the 80s and 90s

Nicole Perlroth (07:46.900)

when hackers were just finding holes and bugs and software

Lex Fridman (07:51.180)

for curiosity's sake, really as a hobby.

Lex Fridman (07:54.340)

And some of them would go to the tech companies

Lex Fridman (07:56.780)

like Microsoft or Sun Microsystems at the time or Oracle.

Lex Fridman (08:01.740)

And they'd say, hey, I just found this zero day

Lex Fridman (08:04.500)

in your software and I can use it to break into NASA.

Lex Fridman (08:08.100)

And the general response at the time wasn't,

Lex Fridman (08:11.180)

thank you so much for pointing out this flaw

Lex Fridman (08:13.940)

and our software, we'll get it fixed as soon as possible.

Lex Fridman (08:17.260)

It was, don't ever poke around our software ever again

Nicole Perlroth (08:21.220)

or we'll stick our general counsel on you.

Lex Fridman (08:24.180)

And that was really sort of the common thread for years.

Lex Fridman (08:30.380)

And so hackers who set out to do the right thing

Lex Fridman (08:34.420)

were basically told to shut up

Lex Fridman (08:37.640)

and stop doing what you're doing.

Lex Fridman (08:40.140)

And what happened next was they basically started trading

Nicole Perlroth (08:44.900)

this information online.

Lex Fridman (08:46.220)

Now, when you go back and interview people

Nicole Perlroth (08:48.180)

from those early days, they all tell a very similar story,

Lex Fridman (08:53.020)

which is they're curious, they're tinkerers.

Nicole Perlroth (08:57.520)

They remind me of like the kid down the block

Lex Fridman (08:59.740)

that was constantly poking around the hood of his dad's car.

Nicole Perlroth (09:03.780)

They just couldn't help themselves.

Lex Fridman (09:06.140)

They wanted to figure out how a system is designed

Lex Fridman (09:09.500)

and how they could potentially exploit it

Lex Fridman (09:11.900)

for some other purpose.

Nicole Perlroth (09:13.120)

It doesn't have to be good or bad.

Lex Fridman (09:15.820)

But they were basically kind of beat down for so long

Nicole Perlroth (09:20.660)

by these big tech companies

Lex Fridman (09:22.980)

that they started just silently trading them

Nicole Perlroth (09:26.640)

with other hackers.

Lex Fridman (09:28.100)

And that's how you got these really heated debates

Nicole Perlroth (09:32.660)

in the 90s about disclosure.

Lex Fridman (09:35.780)

Should you just dump these things online

Nicole Perlroth (09:38.200)

because any script kitty can pick them up

Lex Fridman (09:40.360)

and use it for all kinds of mischief.

Lex Fridman (09:43.540)

But don't you wanna just stick a middle finger

Lex Fridman (09:46.140)

to all these companies

Nicole Perlroth (09:47.300)

that are basically threatening you all the time.

Lex Fridman (09:50.060)

So there was this really interesting dynamic at play.

Lex Fridman (09:53.620)

And what I learned in the course of doing my book

Lex Fridman (09:57.100)

was that government agencies and their contractors

Nicole Perlroth (10:01.740)

sort of tapped into that frustration and that resentment.

Lex Fridman (10:06.020)

And they started quietly reaching out to hackers

Nicole Perlroth (10:09.140)

on these forums.

Lex Fridman (10:11.120)

And they said, hey, you know that zero day

Nicole Perlroth (10:13.860)

you just dropped online,

Lex Fridman (10:14.940)

could you come up with something custom for me?

Lex Fridman (10:17.980)

And I'll pay you six figures for it

Lex Fridman (10:20.060)

so long as you shut up and never tell anyone

Nicole Perlroth (10:22.280)

that I paid you for this.

Lex Fridman (10:24.740)

And that's what happened.

Lex Fridman (10:27.060)

So throughout the 90s,

Lex Fridman (10:28.420)

there was a bunch of boutique contractors

Nicole Perlroth (10:31.460)

that started reaching out to hackers on these forums

Lex Fridman (10:34.680)

and saying, hey, I'll pay you six figures

Nicole Perlroth (10:37.340)

for that bug you were trying to get Microsoft

Lex Fridman (10:39.640)

to fix for free.

Lex Fridman (10:41.420)

And sort of so began or so catalyzed this market

Lex Fridman (10:45.560)

where governments and their intermediaries

Nicole Perlroth (10:48.020)

started reaching out to these hackers

Lex Fridman (10:50.420)

and buying their bugs for free.

Lex Fridman (10:53.060)

And in those early days,

Lex Fridman (10:54.180)

I think a lot of it was just for quiet counterintelligence,

Nicole Perlroth (10:57.620)

traditional espionage.

Lex Fridman (11:00.040)

But as we started baking the software,

Nicole Perlroth (11:04.260)

Windows software, Schneider Electric,

Lex Fridman (11:07.060)

Siemens industrial software into our nuclear plants

Lex Fridman (11:11.300)

and our factories and our power grid

Lex Fridman (11:14.940)

and our petrochemical facilities and our pipelines,

Nicole Perlroth (11:18.700)

those same zero days came to be just as valuable

Lex Fridman (11:22.060)

for sabotage and war planning.

Nicole Perlroth (11:25.120)

Does the fact that the market sprung up

Lex Fridman (11:27.220)

and you can now make a lot of money

Nicole Perlroth (11:28.480)

change the nature of the attackers that came to the table

Lex Fridman (11:31.820)

or grow the number of attackers?

Nicole Perlroth (11:34.500)

I mean, what is, I guess,

Lex Fridman (11:35.700)

you told the psychology of the hackers in the 90s,

Lex Fridman (11:40.540)

what is the culture today and where is it heading?

Lex Fridman (11:43.980)

So I think there are people who will tell you

Nicole Perlroth (11:47.100)

they would never sell a zero day

Lex Fridman (11:49.060)

to a zero day broker or a government.

Nicole Perlroth (11:52.060)

One, because they don't know how it's gonna get used

Lex Fridman (11:54.540)

when they throw it over the fence.

Nicole Perlroth (11:56.340)

Most of these get rolled into classified programs

Lex Fridman (11:58.780)

and you don't know how they get used.

Nicole Perlroth (12:01.260)

If you sell it to a zero day broker,

Lex Fridman (12:02.700)

you don't even know which nation state might use it

Nicole Perlroth (12:06.900)

or potentially which criminal group might use it

Lex Fridman (12:09.300)

if you sell it on the dark web.

Nicole Perlroth (12:11.380)

The other thing that they say is that

Lex Fridman (12:15.400)

they wanna be able to sleep at night.

Lex Fridman (12:17.980)

And they lose a lot of sleep

Lex Fridman (12:19.900)

if they found out their zero day was being used

Nicole Perlroth (12:22.140)

to make a dissident's life living hell.

Lex Fridman (12:25.980)

But there are a lot of people, good people,

Nicole Perlroth (12:28.500)

who also say, no, this is not my problem.

Lex Fridman (12:32.620)

This is the technology company's problem.

Nicole Perlroth (12:35.380)

If they weren't writing new bugs

Lex Fridman (12:37.020)

into their software every day,

Nicole Perlroth (12:39.160)

then there wouldn't be a market.

Lex Fridman (12:41.060)

Then there wouldn't be a problem.

Lex Fridman (12:42.860)

But they continue to write bugs

Lex Fridman (12:44.780)

into their software all the time

Lex Fridman (12:46.180)

and they continue to profit off that software.

Lex Fridman (12:48.300)

So why shouldn't I profit off my labor too?

Lex Fridman (12:53.540)

And one of the things that has happened,

Lex Fridman (12:55.740)

which is I think a positive development

Nicole Perlroth (12:57.980)

over the last 10 years, are bug bounty programs.

Lex Fridman (13:02.260)

Companies like Google and Facebook

Lex Fridman (13:05.020)

and then Microsoft and finally Apple,

Lex Fridman (13:07.460)

which resisted it for a really long time,

Nicole Perlroth (13:10.180)

have said, okay, we are gonna shift our perspective

Lex Fridman (13:14.780)

about hackers.

Nicole Perlroth (13:15.700)

We're no longer going to treat them as the enemy here.

Lex Fridman (13:18.960)

We're going to start paying them

Nicole Perlroth (13:20.340)

for what it's essentially free quality assurance.

Lex Fridman (13:23.800)

And we're gonna pay them good money in some cases,

Nicole Perlroth (13:26.800)

six figures in some cases.

Lex Fridman (13:28.900)

We're never gonna be able to bid against a zero day broker

Nicole Perlroth (13:32.380)

who sells to government agencies.

Lex Fridman (13:34.740)

But we can reward them and hopefully get to that bug earlier

Nicole Perlroth (13:38.900)

where we can neutralize it

Lex Fridman (13:40.980)

so that they don't have to spend another year

Nicole Perlroth (13:43.060)

developing the zero day exploit.

Lex Fridman (13:44.760)

And in that way, we can keep our software more secure.

Lex Fridman (13:48.180)

But every week I get messages from some hacker that says,

Lex Fridman (13:53.060)

you know, I tried to see this zero day exploit

Nicole Perlroth (13:55.940)

that was just found in the wild,

Lex Fridman (13:58.020)

being used by this nation state.

Nicole Perlroth (14:00.380)

I tried to tell Microsoft about this two years ago

Lex Fridman (14:04.560)

and they were gonna pay me peanuts so it never got fixed.

Nicole Perlroth (14:08.900)

There are all sorts of those stories that can continue on.

Lex Fridman (14:12.700)

And I think just generally,

Nicole Perlroth (14:16.700)

hackers are not very good at diplomacy.

Lex Fridman (14:19.860)

They tend to be pretty snipey, technical crowd.

Lex Fridman (14:24.620)

And very philosophical in my experience.

Lex Fridman (14:28.220)

But diplomacy is not their strong suit.

Nicole Perlroth (14:31.860)

Oh, there almost has to be a broker

Lex Fridman (14:33.660)

between companies and hackers.

Nicole Perlroth (14:35.940)

We can translate effectively,

Lex Fridman (14:37.980)

just like you have a zero day broker

Nicole Perlroth (14:39.540)

between governments and hackers.

Lex Fridman (14:41.740)

You have to speak their language.

Nicole Perlroth (14:43.100)

Yeah, and there have been some of those companies

Lex Fridman (14:45.900)

who've risen up to meet that demand.

Lex Fridman (14:47.780)

And HackerOne is one of them.

Lex Fridman (14:50.340)

Bugcrowd is another.

Nicole Perlroth (14:52.440)

Cynak has an interesting model, so that's a company

Lex Fridman (14:55.180)

that you pay for a private bug bounty program essentially.

Lex Fridman (14:59.900)

So you pay this company, they tap hackers all over the world

Lex Fridman (15:04.460)

to come hack your software, hack your system.

Lex Fridman (15:07.580)

And then they'll quietly tell you what they found.

Lex Fridman (15:10.840)

And I think that's a really positive development.

Lex Fridman (15:13.740)

And actually, the Department of Defense

Lex Fridman (15:16.300)

hired all three of those companies I just mentioned

Nicole Perlroth (15:20.480)

to help secure their systems.

Lex Fridman (15:22.020)

Now I think they're still a little timid

Nicole Perlroth (15:24.180)

in terms of letting those hackers

Lex Fridman (15:25.820)

into the really sensitive, high side classified stuff.

Lex Fridman (15:30.300)

But you know, baby steps.

Lex Fridman (15:33.100)

Just to understand what you were saying,

Nicole Perlroth (15:34.740)

you think it's impossible for companies

Lex Fridman (15:37.780)

to financially compete with the zero day brokers,

Nicole Perlroth (15:40.540)

with governments.

Lex Fridman (15:42.020)

So like the defense can't outpay the hackers?

Nicole Perlroth (15:47.740)

It's interesting, they shouldn't outpay them.

Lex Fridman (15:51.860)

Because what would happen

Nicole Perlroth (15:53.900)

if they started offering $2.5 million at Apple

Lex Fridman (15:59.220)

for any zero day exploit

Nicole Perlroth (16:02.300)

that governments would pay that much for,

Lex Fridman (16:04.700)

is their own engineers would say,

Lex Fridman (16:06.340)

why the hell am I working for less than that

Lex Fridman (16:10.280)

and doing my nine to five every day?

Lex Fridman (16:12.400)

So you would create a perverse incentive.

Lex Fridman (16:14.700)

And I didn't think about that until I started this research

Lex Fridman (16:18.480)

and I realized, okay, yeah, that makes sense.

Lex Fridman (16:20.500)

You don't want to incentivize offense so much

Nicole Perlroth (16:25.300)

that it's to your own detriment.

Lex Fridman (16:27.260)

And so I think what they have though,

Lex Fridman (16:29.540)

what the companies have on government agencies,

Lex Fridman (16:32.660)

is if they pay you, you get to talk about it.

Nicole Perlroth (16:36.140)

You know, you get the street cred.

Lex Fridman (16:38.180)

You get to brag about the fact you just found

Nicole Perlroth (16:41.260)

that $2.5 million, you know, iOS zero day

Lex Fridman (16:45.340)

that no one else did.

Lex Fridman (16:47.100)

And if you sell it to a broker,

Lex Fridman (16:48.780)

you never get to talk about it.

Lex Fridman (16:50.100)

And I think that really does eat at people.

Lex Fridman (16:53.180)

Can I ask you a big philosophical question

Lex Fridman (16:55.100)

about human nature here?

Lex Fridman (16:57.300)

So if you have, I mean, what you've seen,

Nicole Perlroth (17:00.780)

if a human being has a zero day,

Lex Fridman (17:03.420)

they found a zero day vulnerability that can hack into,

Lex Fridman (17:09.300)

I don't know, what's the worst thing you can hack into?

Lex Fridman (17:11.980)

Something that could launch nuclear weapons.

Nicole Perlroth (17:14.900)

Which percentage of the people in the world

Lex Fridman (17:16.980)

that have the skill would not share that with anyone,

Lex Fridman (17:20.620)

with any bad party?

Lex Fridman (17:23.420)

I guess how many people are completely devoid

Lex Fridman (17:27.740)

of ethical concerns in your sense?

Lex Fridman (17:31.740)

So my belief is all the ultra competent people

Nicole Perlroth (17:36.340)

or very, very high percentage of ultra competent people

Lex Fridman (17:39.580)

are also ethical people.

Nicole Perlroth (17:41.540)

That's been my experience.

Lex Fridman (17:42.940)

But then again, my experience is narrow.

Lex Fridman (17:45.860)

What's your experience been like?

Lex Fridman (17:48.500)

So this was another question I wanted to answer.

Nicole Perlroth (17:53.620)

Who are these people who would sell a zero day exploit

Lex Fridman (17:57.740)

that would neutralize a Schneider Electric safety lock

Lex Fridman (18:01.420)

at a petrochemical plant?

Lex Fridman (18:03.100)

Basically the last thing you would need to neutralize

Nicole Perlroth (18:05.380)

before you trigger some kind of explosion.

Lex Fridman (18:07.980)

Who would sell that?

Lex Fridman (18:11.300)

And I got my answer,

Lex Fridman (18:14.140)

well, the answer was different.

Nicole Perlroth (18:16.740)

A lot of people said, I would never even look there

Lex Fridman (18:19.820)

because I don't even wanna know.

Nicole Perlroth (18:21.020)

I don't even wanna have that capability.

Lex Fridman (18:22.980)

I don't even wanna have to make that decision

Nicole Perlroth (18:26.540)

about whether I'm gonna profit off of that knowledge.

Lex Fridman (18:29.900)

I went down to Argentina

Lex Fridman (18:31.780)

and this whole kind of moral calculus I had in my head

Lex Fridman (18:36.940)

was completely flipped around.

Lex Fridman (18:39.220)

So just to back up for a moment.

Lex Fridman (18:41.580)

So Argentina actually is a real hacker's paradise.

Nicole Perlroth (18:47.500)

People grew up in Argentina and I went down there,

Lex Fridman (18:50.740)

I guess I was there around 2015, 2016,

Lex Fridman (18:54.180)

but you still couldn't get an iPhone.

Lex Fridman (18:57.420)

They didn't have Amazon Prime.

Nicole Perlroth (18:58.860)

You couldn't get access to any of the apps

Lex Fridman (19:00.780)

we all take for granted.

Nicole Perlroth (19:02.540)

To get those things in Argentina as a kid,

Lex Fridman (19:05.220)

you have to find a way to hack them.

Lex Fridman (19:07.540)

And the whole culture is really like a hacker culture.

Lex Fridman (19:12.020)

They say it's really like a MacGyver culture.

Nicole Perlroth (19:15.220)

You have to figure out how to break into something

Lex Fridman (19:17.540)

with wire and tape.

Lex Fridman (19:19.420)

And that means that there are a lot of really good hackers

Lex Fridman (19:24.380)

in Argentina who specialize in developing zero to exploits.

Lex Fridman (19:30.500)

And I went down to this Argentina conference

Lex Fridman (19:33.980)

called Echo Party.

Lex Fridman (19:35.700)

And I asked the organizer, okay, can you introduce me

Lex Fridman (19:39.420)

to someone who's selling zero to exploits to governments?

Lex Fridman (19:43.020)

And he was like, just throw a stone.

Lex Fridman (19:46.340)

Throw a stone anywhere and you're gonna hit someone.

Lex Fridman (19:48.860)

And all over this conference, you saw these guys

Lex Fridman (19:52.100)

who were clearly from these Gulf States

Nicole Perlroth (19:54.060)

who only spoke Arabic.

Lex Fridman (19:55.620)

What are they doing at a young hacking conference

Lex Fridman (19:59.300)

in Buenos Aires?

Lex Fridman (1:00:02.100)

in a really seamless way because it doesn't matter

Nicole Perlroth (1:00:05.680)

if you have the perfect security solution

Lex Fridman (1:00:07.580)

if no one uses it.

Nicole Perlroth (1:00:08.420)

I mean, when I started at the times

Lex Fridman (1:00:10.380)

when I was trying to be really good

Nicole Perlroth (1:00:12.220)

about protecting sources,

Lex Fridman (1:00:14.900)

I was trying to use PGP encryption

Lex Fridman (1:00:17.740)

and it's like, it didn't work.

Lex Fridman (1:00:19.820)

The number of mistakes I would probably make

Nicole Perlroth (1:00:22.420)

just trying to email someone with PGP just wasn't worth it.

Lex Fridman (1:00:27.100)

And then Signal came along and Signal made it wicker.

Nicole Perlroth (1:00:32.500)

They made it a lot easier

Lex Fridman (1:00:34.700)

to send someone an encrypted text message.

Lex Fridman (1:00:37.020)

So we have to start investing in creative minds,

Lex Fridman (1:00:43.240)

in good security design.

Nicole Perlroth (1:00:45.420)

I really think that's the hack that's gonna get us

Lex Fridman (1:00:48.020)

out of where we are today.

Lex Fridman (1:00:50.100)

What about social engineering?

Lex Fridman (1:00:52.460)

Do you worry about this sort of hacking people?

Nicole Perlroth (1:00:57.800)

Yes, I mean, this is the worst nightmare

Lex Fridman (1:01:00.940)

of every chief information security officer out there.

Nicole Perlroth (1:01:04.200)

Social engineering, we work from home now.

Lex Fridman (1:01:10.100)

I saw this woman posted online about how her husband,

Nicole Perlroth (1:01:15.600)

it went viral today,

Lex Fridman (1:01:16.780)

but it was her husband had this problem at work.

Nicole Perlroth (1:01:20.020)

They hired a guy named John

Lex Fridman (1:01:22.460)

and now the guy that shows up for work every day

Nicole Perlroth (1:01:26.060)

doesn't act like John.

Lex Fridman (1:01:29.620)

I mean, think about that.

Nicole Perlroth (1:01:31.060)

Like think about the potential for social engineering

Lex Fridman (1:01:34.000)

in that context.

Nicole Perlroth (1:01:35.780)

You apply for a job and you put on a pretty face,

Lex Fridman (1:01:38.940)

you hire an actor or something,

Lex Fridman (1:01:40.380)

and then you just get inside the organization

Lex Fridman (1:01:42.660)

and get access to all that organization's data.

Nicole Perlroth (1:01:45.700)

A couple of years ago,

Lex Fridman (1:01:47.420)

Saudi Arabia planted spies inside Twitter.

Lex Fridman (1:01:51.420)

Why?

Lex Fridman (1:01:52.260)

Probably because they were trying to figure out

Nicole Perlroth (1:01:54.460)

who these people were

Lex Fridman (1:01:55.380)

who were criticizing the regime on Twitter.

Nicole Perlroth (1:01:58.220)

They couldn't do it with a hack from the outside,

Lex Fridman (1:02:00.020)

so why not plant people on the inside?

Lex Fridman (1:02:02.260)

And that's like the worst nightmare.

Lex Fridman (1:02:04.540)

And it also, unfortunately, creates all kinds of xenophobia

Nicole Perlroth (1:02:09.780)

at a lot of these organizations.

Lex Fridman (1:02:11.340)

I mean, if you're gonna have to take that into consideration,

Nicole Perlroth (1:02:14.780)

then organizations are gonna start looking

Lex Fridman (1:02:16.700)

really skeptically and suspiciously

Nicole Perlroth (1:02:19.420)

at someone who applies for that job from China.

Lex Fridman (1:02:23.020)

And we've seen that go really badly

Nicole Perlroth (1:02:25.760)

at places like the Department of Commerce,

Lex Fridman (1:02:28.540)

where they basically accuse people of being spies

Nicole Perlroth (1:02:31.180)

that aren't spies.

Lex Fridman (1:02:32.020)

So it is the hardest problem to solve,

Lex Fridman (1:02:35.380)

and it's never been harder to solve

Lex Fridman (1:02:37.380)

than right at this very moment

Nicole Perlroth (1:02:39.180)

when there's so much pressure for companies

Lex Fridman (1:02:41.320)

to let people work remotely.

Nicole Perlroth (1:02:43.940)

That's actually why I'm single.

Lex Fridman (1:02:45.520)

I'm suspicious that China and Russia,

Nicole Perlroth (1:02:48.420)

every time I meet somebody,

Lex Fridman (1:02:49.700)

are trying to plant and get insider information,

Lex Fridman (1:02:52.980)

so I'm very, very suspicious.

Lex Fridman (1:02:54.740)

I keep putting the touring test in front, no.

Nicole Perlroth (1:02:57.620)

No, I have a friend who worked inside NSA

Lex Fridman (1:03:02.700)

and was one of their top hackers,

Lex Fridman (1:03:04.840)

and he's like, every time I go to Russia,

Lex Fridman (1:03:08.540)

I get hit on by these 10s.

Lex Fridman (1:03:10.820)

And I come home, my friends are like,

Lex Fridman (1:03:12.240)

I'm sorry, you're not a 10.

Nicole Perlroth (1:03:13.780)

Like, it's a common story.

Lex Fridman (1:03:17.020)

I mean, it's difficult to trust humans

Nicole Perlroth (1:03:20.940)

in this day and age online.

Lex Fridman (1:03:23.340)

So we're working remotely, that's one thing,

Lex Fridman (1:03:27.460)

but just interacting with people on the internet,

Lex Fridman (1:03:31.620)

sounds ridiculous, but because of this podcast in part,

Nicole Perlroth (1:03:35.300)

I've gotten to meet some incredible people,

Lex Fridman (1:03:37.920)

but it makes you nervous to trust folks,

Lex Fridman (1:03:43.300)

and I don't know how to solve that problem.

Lex Fridman (1:03:48.100)

So I'm talking with Mark Zuckerberg,

Nicole Perlroth (1:03:51.460)

who dreams about creating the metaverse.

Lex Fridman (1:03:55.540)

What do you do about that world

Lex Fridman (1:03:56.820)

where more and more our lives is in the digital sphere?

Lex Fridman (1:04:01.460)

Like, one way to phrase it is,

Nicole Perlroth (1:04:05.300)

most of our meaningful experiences at some point

Lex Fridman (1:04:10.060)

will be online, like falling in love, getting a job,

Nicole Perlroth (1:04:15.780)

or experiencing a moment of happiness with a friend,

Lex Fridman (1:04:19.860)

with a new friend made online, all of those things.

Nicole Perlroth (1:04:23.060)

Like, more and more, the fun we do,

Lex Fridman (1:04:25.500)

the things that make us love life will happen online,

Lex Fridman (1:04:28.940)

and if those things have an avatar that's digital,

Lex Fridman (1:04:32.940)

that's like a way to hack into people's minds,

Nicole Perlroth (1:04:35.820)

whether it's with AI or kind of troll farms

Lex Fridman (1:04:39.500)

or something like that.

Nicole Perlroth (1:04:40.940)

I don't know if there's a way to protect against that.

Lex Fridman (1:04:43.340)

That might fundamentally rely on our faith

Nicole Perlroth (1:04:49.420)

in how good human nature is.

Lex Fridman (1:04:51.940)

So if most people are good, we're going to be okay,

Lex Fridman (1:04:54.900)

but if people will tend towards manipulation

Lex Fridman (1:04:59.220)

and malevolent behavior in search of power,

Nicole Perlroth (1:05:03.300)

then we're screwed.

Lex Fridman (1:05:05.540)

So I don't know if you can comment

Nicole Perlroth (1:05:07.860)

on how to keep the metaverse secure.

Lex Fridman (1:05:10.380)

Yeah, I mean, all I thought about

Nicole Perlroth (1:05:13.660)

when you were talking just now was my three year old son.

Lex Fridman (1:05:16.700)

Yeah.

Lex Fridman (1:05:19.540)

He asked me the other day, what's the internet, mom?

Lex Fridman (1:05:22.500)

And I just almost wanted to cry.

Nicole Perlroth (1:05:25.300)

You know, I don't want that for him.

Lex Fridman (1:05:29.500)

I don't want all of his most meaningful experiences

Nicole Perlroth (1:05:32.420)

to be online.

Lex Fridman (1:05:33.260)

You know, by the time that happens,

Lex Fridman (1:05:36.900)

how do you know that person's human,

Lex Fridman (1:05:39.540)

that avatar's human?

Nicole Perlroth (1:05:41.540)

You know, I believe in free speech.

Lex Fridman (1:05:42.860)

I don't believe in free speech for robots and bots.

Lex Fridman (1:05:46.740)

And like, look what just happened over the last six years.

Lex Fridman (1:05:51.660)

You know, we had bots pretending

Nicole Perlroth (1:05:53.860)

to be Black Lives Matter activists

Lex Fridman (1:05:56.860)

just to sow some division,

Nicole Perlroth (1:05:59.300)

or, you know, Texas secessionists,

Lex Fridman (1:06:01.700)

or, you know, organizing anti Hillary protests,

Nicole Perlroth (1:06:06.580)

or just to sow more division,

Lex Fridman (1:06:08.980)

to tie us up in our own politics

Lex Fridman (1:06:12.420)

so that we're so paralyzed we can't get anything done.

Lex Fridman (1:06:15.660)

We can't make any progress

Lex Fridman (1:06:17.220)

and we definitely can't handle our adversaries

Lex Fridman (1:06:19.940)

and their longterm thinking.

Nicole Perlroth (1:06:22.980)

It really scares me.

Lex Fridman (1:06:25.260)

And here's where I just come back to.

Nicole Perlroth (1:06:28.300)

Just because we can create the metaverse,

Lex Fridman (1:06:32.220)

you know, just because it sounds like the next logical step

Nicole Perlroth (1:06:36.380)

in our digital revolution,

Lex Fridman (1:06:39.860)

do I really want my child's most significant moments

Lex Fridman (1:06:43.940)

to be online?

Lex Fridman (1:06:45.540)

They weren't for me, you know?

Lex Fridman (1:06:47.940)

So maybe I'm just stuck in that old school thinking,

Lex Fridman (1:06:51.940)

or maybe I've seen too much.

Lex Fridman (1:06:54.580)

And I'm really sick of being

Lex Fridman (1:06:58.420)

the guinea pig parent generation for these things.

Nicole Perlroth (1:07:01.740)

I mean, it's hard enough with screen time.

Lex Fridman (1:07:04.380)

Like thinking about how to manage the metaverse as a parent

Nicole Perlroth (1:07:10.260)

to a young boy, like I can't even let my head go there.

Lex Fridman (1:07:13.660)

That's so terrifying for me.

Lex Fridman (1:07:16.300)

But we've never stopped any new technology

Lex Fridman (1:07:21.300)

just because it introduces risks.

Nicole Perlroth (1:07:23.980)

We've always said, okay, the promise of this technology

Lex Fridman (1:07:27.860)

means we should keep going, keep pressing ahead.

Nicole Perlroth (1:07:31.700)

We just need to figure out new ways to manage that risk.

Lex Fridman (1:07:35.500)

And you know, that's the blockchain right now.

Nicole Perlroth (1:07:39.900)

Like when I was covering all of these ransomware attacks,

Lex Fridman (1:07:44.820)

I thought, okay, this is gonna be it for cryptocurrency.

Nicole Perlroth (1:07:48.660)

You know, governments are gonna put the kibosh down.

Lex Fridman (1:07:51.380)

They're gonna put the hammer down and say enough is enough.

Nicole Perlroth (1:07:54.380)

Like we have to put this genie back in the bottle

Lex Fridman (1:07:56.900)

because it's enabled ransomware.

Nicole Perlroth (1:07:58.540)

I mean, five years ago, they would hijack your PC

Lex Fridman (1:08:02.700)

and they'd say, go to the local pharmacy,

Nicole Perlroth (1:08:05.500)

get a eGift card and tell us what the pin is.

Lex Fridman (1:08:08.340)

And then we'll get your $200.

Nicole Perlroth (1:08:10.420)

Now it's pay us, you know, five Bitcoin.

Lex Fridman (1:08:13.420)

And so there's no doubt cryptocurrencies

Nicole Perlroth (1:08:16.140)

enabled ransomware attacks,

Lex Fridman (1:08:17.820)

but after the Colonial Pipeline ransom was seized,

Nicole Perlroth (1:08:22.540)

because if you remember, the FBI was actually able to go in

Lex Fridman (1:08:25.700)

and claw some of it back from DarkSide,

Nicole Perlroth (1:08:28.100)

which was the ransomware group that hid it.

Lex Fridman (1:08:31.140)

And I spoke to these guys at TRM Labs.

Lex Fridman (1:08:34.060)

So they're one of these blockchain intelligence companies.

Lex Fridman (1:08:37.460)

And a lot of people that work there

Nicole Perlroth (1:08:38.660)

used to work at the treasury.

Lex Fridman (1:08:40.860)

And what they said to me was,

Nicole Perlroth (1:08:42.140)

yeah, cryptocurrency has enabled ransomware,

Lex Fridman (1:08:46.420)

but to track down that ransom payment would have taken,

Nicole Perlroth (1:08:52.100)

you know, if we were dealing with fiat currency,

Lex Fridman (1:08:54.780)

would have taken us years to get to that one bank account

Nicole Perlroth (1:08:58.340)

or belonging to that one front company in the Seychelles.

Lex Fridman (1:09:01.500)

And now thanks to the blockchain,

Nicole Perlroth (1:09:04.060)

we can track the movement of those funds in real time.

Lex Fridman (1:09:08.340)

And you know what?

Nicole Perlroth (1:09:09.500)

You know, these payments are not as anonymous

Lex Fridman (1:09:11.980)

as people think.

Nicole Perlroth (1:09:13.300)

Like we still can use our old hacking ways and zero days

Lex Fridman (1:09:16.660)

and, you know, old school intelligence methods

Nicole Perlroth (1:09:19.540)

to find out who owns that private wallet

Lex Fridman (1:09:21.780)

and how to get to it.

Lex Fridman (1:09:23.460)

So it's a curse in some ways and that it's an enabler,

Lex Fridman (1:09:27.620)

but it's also a blessing.

Lex Fridman (1:09:29.420)

And they said that same thing to me

Lex Fridman (1:09:31.220)

that I just said to you.

Nicole Perlroth (1:09:32.060)

They said, we've never shut down a promising new technology

Lex Fridman (1:09:37.460)

because it introduced risk.

Nicole Perlroth (1:09:39.140)

We just figured out how to manage that risk.

Lex Fridman (1:09:42.660)

And I think that's where the conversation

Nicole Perlroth (1:09:44.380)

unfortunately has to go,

Lex Fridman (1:09:45.820)

is how do we in the metaverse use technology to fix things?

Lex Fridman (1:09:53.580)

So maybe we'll finally be able to, not finally,

Lex Fridman (1:09:56.980)

but figure out a way to solve the identity problem

Nicole Perlroth (1:10:00.940)

on the internet, meaning like a blue check mark

Lex Fridman (1:10:03.380)

for actual human and connect it to identity

Nicole Perlroth (1:10:06.940)

or like a fingerprint so you can prove your you.

Lex Fridman (1:10:11.340)

And yet do it in a way that doesn't involve the company

Nicole Perlroth (1:10:15.740)

having all your data.

Lex Fridman (1:10:17.540)

So giving you, allowing you to maintain control

Nicole Perlroth (1:10:20.740)

over your data, or if you don't,

Lex Fridman (1:10:23.780)

then there's a complete transparency

Nicole Perlroth (1:10:25.940)

of how that data is being used, all those kinds of things.

Lex Fridman (1:10:28.860)

And maybe as you educate more and more people,

Nicole Perlroth (1:10:32.900)

they would demand in a capitalist society

Lex Fridman (1:10:36.060)

that the companies that they give their data to

Nicole Perlroth (1:10:38.420)

will respect that data.

Lex Fridman (1:10:40.980)

Yeah, I mean, there is this company,

Lex Fridman (1:10:43.580)

and I hope they succeed, their name's PII Ono, Piano.

Lex Fridman (1:10:48.500)

And they wanna create a vault for your personal information

Nicole Perlroth (1:10:52.140)

inside every organization.

Lex Fridman (1:10:54.380)

And ultimately, if I'm gonna call Delta Airlines

Nicole Perlroth (1:10:57.940)

to book a flight,

Lex Fridman (1:10:59.380)

they don't need to know my social security number.

Nicole Perlroth (1:11:02.420)

They don't need to know my birth date.

Lex Fridman (1:11:05.460)

They're just gonna send me a one time token to my phone.

Nicole Perlroth (1:11:08.860)

My phone's gonna say, or my Fido key is gonna say,

Lex Fridman (1:11:11.700)

yep, it's her.

Lex Fridman (1:11:13.460)

And then we're gonna talk about my identity like a token,

Lex Fridman (1:11:16.820)

some random token.

Nicole Perlroth (1:11:17.660)

They don't need to know exactly who I am.

Lex Fridman (1:11:20.060)

They just need to know the system trust that I am,

Nicole Perlroth (1:11:23.780)

who I say I am, but they don't get access to my PII data.

Lex Fridman (1:11:27.900)

They don't get access to my social security number,

Nicole Perlroth (1:11:30.340)

my location, or the fact I'm a Times journalist.

Lex Fridman (1:11:34.780)

I think that's the way the world's gonna go.

Nicole Perlroth (1:11:37.380)

We have, enough is enough on sort of

Lex Fridman (1:11:40.780)

losing our personal information everywhere,

Nicole Perlroth (1:11:44.100)

letting data marketing companies track our every move.

Lex Fridman (1:11:48.900)

They don't need to know who I am.

Nicole Perlroth (1:11:51.020)

Okay, I get it.

Lex Fridman (1:11:52.500)

We're stuck in this world where the internet runs on ads.

Lex Fridman (1:11:57.460)

So ads are not gonna go away,

Lex Fridman (1:11:59.940)

but they don't need to know I'm Nicole Perlora.

Nicole Perlroth (1:12:03.020)

They can know that I am token number, you know,

Lex Fridman (1:12:06.580)

X567.

Lex Fridman (1:12:08.660)

And they can let you know what they know

Lex Fridman (1:12:11.020)

and give you control about removing the things they know.

Nicole Perlroth (1:12:14.020)

Yeah, right to be forgotten.

Lex Fridman (1:12:15.820)

To me, you should be able to walk away

Nicole Perlroth (1:12:17.940)

with a single press of a button.

Lex Fridman (1:12:20.260)

And I also believe that most people,

Nicole Perlroth (1:12:22.060)

given the choice to walk away, won't walk away.

Lex Fridman (1:12:25.220)

They'll just feel better about having the option

Nicole Perlroth (1:12:28.540)

to walk away when they understand the trade offs.

Lex Fridman (1:12:30.700)

If you walk away, you're not gonna get

Nicole Perlroth (1:12:32.560)

some of the personalized experiences

Lex Fridman (1:12:34.140)

that you would otherwise get,

Nicole Perlroth (1:12:35.980)

like a personalized feed and all those kinds of things.

Lex Fridman (1:12:38.580)

But the freedom to walk away is,

Nicole Perlroth (1:12:43.280)

I think, really powerful.

Lex Fridman (1:12:44.220)

And obviously, what you're saying,

Nicole Perlroth (1:12:45.460)

it's definitely, there's all of these HTML forms

Lex Fridman (1:12:48.620)

where you have to enter your phone number and email

Lex Fridman (1:12:51.220)

and private information from Delta, every single airline.

Lex Fridman (1:12:55.780)

New York Times.

Nicole Perlroth (1:12:58.860)

I have so many opinions on this.

Lex Fridman (1:13:00.580)

Just the friction and the sign up

Lex Fridman (1:13:03.420)

and all of those kinds of things.

Lex Fridman (1:13:04.840)

I should be able to, this has to do with everything.

Nicole Perlroth (1:13:07.200)

This has to do with payment, too.

Lex Fridman (1:13:09.820)

Payment should be trivial.

Nicole Perlroth (1:13:11.780)

It should be one click,

Lex Fridman (1:13:13.220)

and one click to unsubscribe and subscribe,

Lex Fridman (1:13:16.980)

and one click to provide all of your information

Lex Fridman (1:13:19.540)

that's necessary for the subscription service,

Nicole Perlroth (1:13:21.700)

for the transaction service, whatever that is,

Lex Fridman (1:13:24.140)

getting a ticket, as opposed to,

Nicole Perlroth (1:13:25.940)

I have all of these fake phone numbers and emails

Lex Fridman (1:13:28.140)

that I use in Alta Sign Up,

Nicole Perlroth (1:13:29.380)

because you never know if one site is hacked,

Lex Fridman (1:13:34.320)

then it's just going to propagate to everything else.

Nicole Perlroth (1:13:37.560)

Yeah.

Lex Fridman (1:13:38.780)

And there's low hanging fruit,

Lex Fridman (1:13:41.080)

and I hope Congress does something.

Lex Fridman (1:13:44.420)

And frankly, I think it's negligent they haven't

Nicole Perlroth (1:13:46.620)

on the fact that elderly people are getting spammed to death

Lex Fridman (1:13:51.980)

on their phones these days with fake car warranty scams.

Lex Fridman (1:13:56.460)

And I mean, my dad was in the hospital last year,

Lex Fridman (1:13:59.500)

and I was in the hospital room, and his phone kept buzzing,

Lex Fridman (1:14:02.060)

and I look at it, and it's just spam attack after spam attack,

Lex Fridman (1:14:08.220)

people nonstop calling about his freaking car warranty,

Lex Fridman (1:14:13.180)

why they're trying to get his social security number,

Lex Fridman (1:14:15.980)

they're trying to get his PII,

Nicole Perlroth (1:14:17.660)

they're trying to get this information.

Lex Fridman (1:14:19.860)

We need to figure out how to put those people

Nicole Perlroth (1:14:24.020)

in jail for life, and we need to figure out

Lex Fridman (1:14:28.700)

why in the hell we are being required

Nicole Perlroth (1:14:32.500)

or asked to hand over our social security number

Lex Fridman (1:14:36.980)

and our home address and our passport,

Nicole Perlroth (1:14:39.900)

all of that information to every retailer who asks.

Lex Fridman (1:14:43.320)

I mean, that's insanity.

Lex Fridman (1:14:46.300)

And there's no question they're not protecting it

Lex Fridman (1:14:49.740)

because it keeps showing up in spam or identity theft

Nicole Perlroth (1:14:55.060)

or credit card theft or worse.

Lex Fridman (1:14:57.060)

Well, spam is getting better, and maybe I need to,

Nicole Perlroth (1:15:00.200)

as a side note, make a public announcement.

Lex Fridman (1:15:02.580)

Please clip this out, which is if you get an email

Nicole Perlroth (1:15:07.360)

or a message from Lex Friedman saying how much

Lex Fridman (1:15:12.380)

I, Lex, appreciate you and love you and so on,

Lex Fridman (1:15:16.900)

and please connect with me on my WhatsApp number

Lex Fridman (1:15:19.640)

and I will give you Bitcoin or something like that,

Nicole Perlroth (1:15:23.420)

please do not click.

Lex Fridman (1:15:25.020)

And I'm aware that there's a lot of this going on,

Nicole Perlroth (1:15:29.040)

a very large amount.

Lex Fridman (1:15:30.120)

I can't do anything about it.

Nicole Perlroth (1:15:32.180)

This is on every single platform.

Lex Fridman (1:15:33.800)

It's happening more and more and more,

Nicole Perlroth (1:15:36.020)

which I've been recently informed that they're not emailing.

Lex Fridman (1:15:40.960)

So it's cross platform.

Nicole Perlroth (1:15:42.920)

They're taking people's, they're somehow,

Lex Fridman (1:15:46.060)

this is fascinating to me because they are taking people

Nicole Perlroth (1:15:50.500)

who comment on various social platforms

Lex Fridman (1:15:53.860)

and they somehow reverse engineer.

Nicole Perlroth (1:15:56.060)

They figure out what their email is

Lex Fridman (1:15:57.780)

and they send an email to that person saying,

Nicole Perlroth (1:16:00.780)

from Lex Friedman, and it's like a heartfelt email

Lex Fridman (1:16:04.060)

with links.

Nicole Perlroth (1:16:05.180)

It's fascinating because it's cross platform now.

Lex Fridman (1:16:07.460)

It's not just a spam bot that's messaging

Lex Fridman (1:16:11.060)

and a comment that's in a reply.

Lex Fridman (1:16:13.500)

They are saying, okay, this person cares

Nicole Perlroth (1:16:16.420)

about this other person on social media.

Lex Fridman (1:16:18.520)

So I'm going to find another channel,

Nicole Perlroth (1:16:20.460)

which in their mind probably increases

Lex Fridman (1:16:22.660)

and it does the likelihood that they'll get the people

Nicole Perlroth (1:16:26.880)

to click and they do.

Lex Fridman (1:16:28.980)

I don't know what to do about that.

Nicole Perlroth (1:16:30.180)

It makes me really, really sad,

Lex Fridman (1:16:32.180)

especially with podcasting.

Nicole Perlroth (1:16:33.740)

There's an intimacy that people feel connected

Lex Fridman (1:16:36.780)

and they get really excited.

Nicole Perlroth (1:16:37.820)

Okay, cool, I wanna talk to Lex.

Lex Fridman (1:16:40.480)

And they click.

Lex Fridman (1:16:45.400)

And I get angry at the people that do this.

Lex Fridman (1:16:50.960)

I mean, it's like the John that gets hired,

Nicole Perlroth (1:16:55.800)

the fake employee.

Lex Fridman (1:16:57.260)

I mean, I don't know what to do about that.

Nicole Perlroth (1:16:58.520)

I mean, I suppose the solution is education.

Lex Fridman (1:17:02.200)

It's telling people to be skeptical

Nicole Perlroth (1:17:04.880)

on the stuff they click.

Lex Fridman (1:17:07.020)

That balance with the technology solution

Nicole Perlroth (1:17:09.520)

of creating maybe like two factor authentication

Lex Fridman (1:17:14.080)

and maybe helping identify things

Nicole Perlroth (1:17:17.840)

that are likely to be spam, I don't know.

Lex Fridman (1:17:20.320)

But then the machine learning there is tricky

Nicole Perlroth (1:17:21.960)

because you don't wanna add a lot of extra friction

Lex Fridman (1:17:25.240)

that just annoys people because they'll turn it off.

Lex Fridman (1:17:28.160)

Because you have the accept cookies thing, right?

Lex Fridman (1:17:30.680)

That everybody has to click on now,

Lex Fridman (1:17:32.400)

so now they completely ignore the accept cookies.

Lex Fridman (1:17:34.920)

This is very difficult to find that frictionless security.

Nicole Perlroth (1:17:42.200)

You mentioned Snowden.

Lex Fridman (1:17:43.760)

You've talked about looking through the NSA documents

Nicole Perlroth (1:17:48.320)

he leaked and doing the hard work of that.

Lex Fridman (1:17:51.980)

What do you make of Edward Snowden?

Lex Fridman (1:17:54.480)

What have you learned from those documents?

Lex Fridman (1:17:56.680)

What do you think of him?

Nicole Perlroth (1:18:00.680)

In the long arc of history,

Lex Fridman (1:18:02.400)

is Edward Snowden a hero or a villain?

Nicole Perlroth (1:18:05.480)

I think he's neither.

Lex Fridman (1:18:07.480)

I have really complicated feelings about Edward Snowden.

Nicole Perlroth (1:18:12.880)

On the one hand, I'm a journalist at heart

Lex Fridman (1:18:15.740)

and more transparency is good.

Lex Fridman (1:18:19.560)

And I'm grateful for the conversations

Lex Fridman (1:18:22.560)

that we had in the post Snowden era

Nicole Perlroth (1:18:26.180)

about the limits to surveillance

Lex Fridman (1:18:29.600)

and how critical privacy is.

Lex Fridman (1:18:33.080)

And when you have no transparency

Lex Fridman (1:18:35.600)

and you don't really know in that case

Lex Fridman (1:18:38.040)

what our secret courts were doing,

Lex Fridman (1:18:41.760)

how can you truly believe that our country

Lex Fridman (1:18:45.640)

is taking our civil liberties seriously?

Lex Fridman (1:18:48.900)

So on the one hand, I'm grateful

Nicole Perlroth (1:18:51.280)

that he cracked open these debates.

Lex Fridman (1:18:54.900)

On the other hand, when I walked into the storage closet

Nicole Perlroth (1:19:02.980)

of classified NSA secrets,

Lex Fridman (1:19:05.900)

I had just spent two years

Nicole Perlroth (1:19:09.460)

covering Chinese cyber espionage almost every day.

Lex Fridman (1:19:14.220)

And the sort of advancement of Russian attacks

Nicole Perlroth (1:19:19.380)

that were just getting worse and worse and more destructive.

Lex Fridman (1:19:23.180)

And there were no limits to Chinese cyber espionage

Lex Fridman (1:19:27.380)

and Chinese surveillance of its own citizens.

Lex Fridman (1:19:30.660)

And there seemed to be no limit

Nicole Perlroth (1:19:32.800)

to what Russia was willing to do in terms of cyber attacks

Lex Fridman (1:19:37.240)

and also in some cases assassinating journalists.

Lex Fridman (1:19:41.260)

So when I walked into that room,

Lex Fridman (1:19:43.980)

there was a part of me quite honestly

Nicole Perlroth (1:19:46.700)

that was relieved to know that the NSA

Lex Fridman (1:19:50.000)

was as good as I hoped they were.

Lex Fridman (1:19:53.500)

And we weren't using that knowledge to,

Lex Fridman (1:19:58.420)

as far as I know, assassinate journalists.

Nicole Perlroth (1:20:03.260)

We weren't using our access

Lex Fridman (1:20:06.240)

to take out pharmaceutical companies.

Nicole Perlroth (1:20:11.000)

For the most part, we were using it for traditional espionage.

Lex Fridman (1:20:15.580)

Now, that set of documents also set me

Nicole Perlroth (1:20:18.860)

on the journey of my book because to me,

Lex Fridman (1:20:22.020)

the American people's reaction to the Snowden documents

Nicole Perlroth (1:20:26.060)

was a little bit misplaced.

Lex Fridman (1:20:28.860)

They were upset

Nicole Perlroth (1:20:29.860)

about the phone call metadata collection program.

Lex Fridman (1:20:33.980)

Angela Merkel, I think rightfully was upset

Nicole Perlroth (1:20:36.340)

that we were hacking her cell phone.

Lex Fridman (1:20:39.340)

But in sort of the spy eat spy world,

Nicole Perlroth (1:20:42.540)

hacking world leaders cell phones

Lex Fridman (1:20:44.320)

is pretty much what most spy agencies do.

Lex Fridman (1:20:47.300)

And there wasn't a lot that I saw in those documents

Lex Fridman (1:20:51.580)

that was beyond what I thought a spy agency does.

Lex Fridman (1:20:56.580)

And I think if there was another 9 11 tomorrow,

Lex Fridman (1:21:01.000)

God forbid, we would all say, how did the NSA miss this?

Lex Fridman (1:21:05.740)

Why weren't they spying on those terrorists?

Lex Fridman (1:21:07.900)

Why weren't they spying on those world leaders?

Lex Fridman (1:21:10.780)

And there's some of that too.

Lex Fridman (1:21:13.140)

But I think that there was great damage done

Nicole Perlroth (1:21:17.740)

to the US's reputation.

Lex Fridman (1:21:22.900)

I think we really lost our halo

Nicole Perlroth (1:21:26.640)

in terms of a protector of civil liberties.

Lex Fridman (1:21:30.460)

And I think a lot of what was reported

Nicole Perlroth (1:21:33.680)

was unfortunately reported in a vacuum.

Lex Fridman (1:21:36.980)

That was my biggest gripe that we were always reporting,

Nicole Perlroth (1:21:41.980)

the NSA has this program and here's what it does.

Lex Fridman (1:21:45.200)

And the NSA is in Angela Merkel's cell phone

Lex Fridman (1:21:48.680)

and the NSA can do this.

Lex Fridman (1:21:50.760)

And no one was saying, and by the way,

Nicole Perlroth (1:21:57.040)

China has been hacking into our pipelines

Lex Fridman (1:22:00.220)

and they've been making off

Nicole Perlroth (1:22:01.480)

with all of our intellectual property.

Lex Fridman (1:22:04.120)

And Russia has been hacking into our energy infrastructure

Lex Fridman (1:22:07.600)

and they've been using the same methods to spy on track.

Lex Fridman (1:22:11.340)

And in many cases, kill their own journalists.

Lex Fridman (1:22:13.960)

And the Saudis have been doing this

Lex Fridman (1:22:15.780)

to their own critics and dissidents.

Lex Fridman (1:22:17.340)

And so you can't talk about any of these countries

Lex Fridman (1:22:21.240)

in isolation.

Nicole Perlroth (1:22:22.760)

It is really like spy out there.

Lex Fridman (1:22:25.880)

And so I just have complicated feelings.

Lex Fridman (1:22:29.080)

And the other thing is, and I'm sorry,

Lex Fridman (1:22:30.920)

this is a little bit of a tangent,

Lex Fridman (1:22:32.040)

but the amount of documents that we had,

Lex Fridman (1:22:37.600)

like thousands of documents,

Nicole Perlroth (1:22:39.840)

most of which were just crap,

Lex Fridman (1:22:41.920)

but had people's names on them.

Nicole Perlroth (1:22:46.560)

Part of me wishes that those documents

Lex Fridman (1:22:48.940)

had been released in a much more targeted, limited way.

Nicole Perlroth (1:22:53.040)

It's just a lot of it just felt like a PowerPoint

Lex Fridman (1:22:56.400)

that was taken out of context.

Lex Fridman (1:23:00.320)

And you just sort of wish

Lex Fridman (1:23:03.040)

that there had been a little bit more thought

Nicole Perlroth (1:23:05.920)

into what was released.

Lex Fridman (1:23:07.760)

Because I think a lot of the impact from someone

Nicole Perlroth (1:23:10.120)

was just the volume of the reporting.

Lex Fridman (1:23:13.420)

But I think based on what I saw personally,

Nicole Perlroth (1:23:18.480)

there was a lot of stuff that I just,

Lex Fridman (1:23:20.400)

I don't know why that particular thing got released.

Lex Fridman (1:23:24.140)

As a whistleblower, what's a better way to do it?

Lex Fridman (1:23:26.800)

Because I mean, there's fear,

Nicole Perlroth (1:23:28.160)

it takes a lot of effort to do a more targeted release.

Lex Fridman (1:23:33.840)

If there's proper channels,

Nicole Perlroth (1:23:35.000)

you're afraid that those channels will be manipulated

Lex Fridman (1:23:38.240)

by who do you trust.

Lex Fridman (1:23:41.160)

What's a better way to do this, do you think?

Lex Fridman (1:23:43.560)

As a journalist, this is almost like a journalistic question.

Nicole Perlroth (1:23:46.600)

Reveal some fundamental flaw in the system

Lex Fridman (1:23:49.620)

without destroying the system.

Nicole Perlroth (1:23:50.840)

I bring up, again, Mark Zuckerberg and Metta,

Lex Fridman (1:23:54.840)

there was a whistleblower

Nicole Perlroth (1:23:57.720)

that came out about Instagram internal studies.

Lex Fridman (1:24:02.080)

And I also torn about how to feel about that whistleblower.

Nicole Perlroth (1:24:06.960)

Because from a company perspective, that's an open culture.

Lex Fridman (1:24:11.760)

How can you operate successfully

Nicole Perlroth (1:24:13.800)

if you have an open culture

Lex Fridman (1:24:14.880)

where any one whistleblower can come out,

Nicole Perlroth (1:24:17.900)

out of context, take a study,

Lex Fridman (1:24:19.360)

whether it represents a larger context or not,

Lex Fridman (1:24:22.720)

and the press eats it up.

Lex Fridman (1:24:25.400)

And then that creates a narrative

Nicole Perlroth (1:24:27.960)

that is just like with the NSA,

Lex Fridman (1:24:30.240)

you said it's out of context, very targeted,

Nicole Perlroth (1:24:33.800)

to where, well, Facebook is evil, clearly,

Lex Fridman (1:24:36.720)

because of this one leak.

Nicole Perlroth (1:24:38.860)

It's really hard to know what to do there,

Lex Fridman (1:24:40.520)

because we're now in a society

Nicole Perlroth (1:24:42.040)

that's deeply distrust institutions.

Lex Fridman (1:24:44.320)

And so narratives by whistleblowers make that whistleblower

Lex Fridman (1:24:49.120)

and their forthcoming book very popular.

Lex Fridman (1:24:52.240)

And so there's a huge incentive

Nicole Perlroth (1:24:54.080)

to take stuff out of context and to tell stories

Lex Fridman (1:24:56.800)

that don't represent the full context, the full truth.

Nicole Perlroth (1:25:01.360)

It's hard to know what to do with that,

Lex Fridman (1:25:03.120)

because then that forces Facebook and Meta and governments

Nicole Perlroth (1:25:06.940)

to be much more conservative, much more secretive.

Lex Fridman (1:25:10.640)

It's like a race to the bottom, I don't know.

Nicole Perlroth (1:25:14.600)

I don't know if you can comment on any of that,

Lex Fridman (1:25:16.280)

how to be a whistleblower ethically and properly.

Nicole Perlroth (1:25:20.760)

I don't know, I mean, these are hard questions.

Lex Fridman (1:25:23.400)

And even for myself, in some ways,

Nicole Perlroth (1:25:27.240)

I think of my book as sort of blowing the whistle

Lex Fridman (1:25:31.720)

on the underground zero day market.

Lex Fridman (1:25:33.960)

But it's not like I was in the market myself.

Lex Fridman (1:25:38.840)

It's not like I had access to classified data

Nicole Perlroth (1:25:41.440)

when I was reporting out that book.

Lex Fridman (1:25:44.320)

As I say in the book, listen,

Nicole Perlroth (1:25:46.800)

I'm just trying to scrape the surface here,

Lex Fridman (1:25:49.500)

so we can have these conversations before it's too late.

Lex Fridman (1:25:53.000)

And I'm sure there's plenty in there

Lex Fridman (1:25:57.080)

that someone who's US intelligence agencies

Nicole Perlroth (1:26:01.760)

preeminent zero day broker probably

Lex Fridman (1:26:04.080)

has some voodoo doll of me out there.

Lex Fridman (1:26:05.940)

And you're never gonna get it 100%.

Lex Fridman (1:26:11.880)

But I really applaud whistleblowers

Nicole Perlroth (1:26:14.880)

like the whistleblower who blew the whistle

Lex Fridman (1:26:19.040)

on the Trump call with Zelensky.

Nicole Perlroth (1:26:22.320)

I mean, people needed to know about that,

Lex Fridman (1:26:25.320)

that we were basically, in some ways,

Nicole Perlroth (1:26:27.840)

blackmailing an ally to try to influence an election.

Lex Fridman (1:26:33.800)

I mean, they went through the proper channels.

Lex Fridman (1:26:37.280)

They weren't trying to profit off of it, right?

Lex Fridman (1:26:39.480)

There was no book that came out afterwards

Nicole Perlroth (1:26:42.120)

from that whistleblower.

Lex Fridman (1:26:44.100)

That whistleblower's not like,

Nicole Perlroth (1:26:46.800)

they went through the channels.

Lex Fridman (1:26:47.920)

They're not living in Moscow, let's put it that way.

Nicole Perlroth (1:26:51.160)

Can I ask you a question, you mentioned NSA,

Lex Fridman (1:26:53.000)

one of the things that showed

Nicole Perlroth (1:26:56.240)

is they're pretty good at what they do.

Lex Fridman (1:27:00.340)

Again, this is a touchy subject, I suppose,

Lex Fridman (1:27:03.520)

but there's a lot of conspiracy theories

Lex Fridman (1:27:06.300)

about intelligence agencies.

Nicole Perlroth (1:27:08.040)

From your understanding of intelligence agencies,

Lex Fridman (1:27:11.200)

the CIA, NSA, and the equivalent of in other countries,

Nicole Perlroth (1:27:16.940)

are they, one question, this could be a dangerous question,

Lex Fridman (1:27:20.040)

are they competent, are they good at what they do?

Lex Fridman (1:27:24.740)

And two, are they malevolent in any way?

Lex Fridman (1:27:30.600)

Sort of, I recently had a conversation

Nicole Perlroth (1:27:32.680)

about tobacco companies.

Lex Fridman (1:27:35.180)

They kind of see their customers as dupes,

Nicole Perlroth (1:27:39.560)

like they can just play games with people.

Lex Fridman (1:27:43.320)

Conspiracy theories tell that similar story

Nicole Perlroth (1:27:46.440)

about intelligence agencies,

Lex Fridman (1:27:48.540)

that they're interested in manipulating the populace

Nicole Perlroth (1:27:51.680)

for whatever ends the powerful,

Lex Fridman (1:27:54.920)

in dark rooms, cigarette smoke, cigar smoke filled rooms.

Lex Fridman (1:28:03.260)

What's your sense?

Lex Fridman (1:28:04.620)

Do these conspiracy theories have any truth to them?

Nicole Perlroth (1:28:11.400)

Or are intelligence agencies, for the most part,

Lex Fridman (1:28:14.440)

good for society?

Nicole Perlroth (1:28:15.720)

Okay, well, that's an easy one.

Lex Fridman (1:28:18.640)

Is it?

Nicole Perlroth (1:28:19.480)

No, I think it depends which intelligence agency.

Lex Fridman (1:28:23.720)

Think about the Mossad.

Nicole Perlroth (1:28:25.800)

They're killing every Iranian nuclear scientist they can

Lex Fridman (1:28:32.700)

over the years, but have they delayed the time horizon

Lex Fridman (1:28:38.720)

before Iran gets the bomb?

Lex Fridman (1:28:40.520)

Yeah.

Nicole Perlroth (1:28:41.360)

Have they probably staved off terror attacks

Lex Fridman (1:28:45.840)

on their own citizens?

Nicole Perlroth (1:28:46.820)

Yeah.

Lex Fridman (1:28:48.680)

You know, none of these, intelligence is intelligence.

Nicole Perlroth (1:28:53.320)

You know, you can't just say like they're malevolent

Lex Fridman (1:28:56.400)

or they're heroes.

Nicole Perlroth (1:28:58.840)

You know, everyone I have met in this space

Lex Fridman (1:29:03.680)

is not like the pound your chest patriot

Nicole Perlroth (1:29:07.440)

that you see on the beach on the 4th of July.

Lex Fridman (1:29:11.560)

A lot of them have complicated feelings

Nicole Perlroth (1:29:15.200)

about their former employers.

Lex Fridman (1:29:17.720)

Well, at least at the NSA reminded me

Nicole Perlroth (1:29:20.520)

to do what we were accused of doing after Snowden,

Lex Fridman (1:29:25.880)

to spy on Americans.

Nicole Perlroth (1:29:28.800)

You have no idea the amount of red tape and paperwork

Lex Fridman (1:29:33.800)

and bureaucracy it would have taken to do

Lex Fridman (1:29:38.320)

what everyone thinks that we were supposedly doing.

Lex Fridman (1:29:42.500)

But then, you know, we find out in the course

Nicole Perlroth (1:29:45.600)

of the Snowden reporting about a program called Lovin',

Lex Fridman (1:29:49.480)

where a couple of the NSA analysts were using their access

Nicole Perlroth (1:29:53.040)

to spy on their ex girlfriends.

Lex Fridman (1:29:55.380)

So, you know, there's an exception to every case.

Nicole Perlroth (1:29:59.300)

Generally, I will probably get, you know,

Lex Fridman (1:30:05.020)

accused of my Western bias here again,

Lex Fridman (1:30:07.580)

but I think you can almost barely compare

Lex Fridman (1:30:15.060)

some of these Western intelligence agencies

Nicole Perlroth (1:30:17.260)

to China, for instance.

Lex Fridman (1:30:19.980)

And the surveillance that they're deploying on the Uyghurs

Nicole Perlroth (1:30:26.020)

to the level they're deploying it.

Lex Fridman (1:30:28.940)

And the surveillance they're starting to export abroad

Nicole Perlroth (1:30:32.100)

with some of the programs,

Lex Fridman (1:30:33.180)

like the watering hole attack I mentioned earlier,

Nicole Perlroth (1:30:35.500)

where it's not just hitting the Uyghurs inside China,

Lex Fridman (1:30:38.980)

it's hitting anyone interested

Nicole Perlroth (1:30:40.340)

in the Uyghur plight outside China.

Lex Fridman (1:30:42.060)

I mean, it could be an American high school student

Nicole Perlroth (1:30:44.580)

writing a paper on the Uyghurs.

Lex Fridman (1:30:46.540)

They wanna spy on that person too.

Nicole Perlroth (1:30:49.100)

You know, there's no rules in China

Lex Fridman (1:30:51.740)

really limiting the extent of that surveillance.

Lex Fridman (1:30:55.460)

And we all better pay attention to what's happening

Lex Fridman (1:30:59.340)

with the Uyghurs because just as Ukraine has been to Russia

Nicole Perlroth (1:31:04.060)

in terms of a test kitchen for its cyber attacks,

Lex Fridman (1:31:08.240)

the Uyghurs are China's test kitchen for surveillance.

Lex Fridman (1:31:12.900)

And there's no doubt in my mind

Lex Fridman (1:31:15.300)

that they're testing them on the Uyghurs.

Nicole Perlroth (1:31:17.660)

Uyghurs are their Petri dish,

Lex Fridman (1:31:19.140)

and eventually they will export

Nicole Perlroth (1:31:21.220)

that level of surveillance overseas.

Lex Fridman (1:31:23.880)

I mean, in 2015,

Nicole Perlroth (1:31:27.360)

Obama and Xi Jinping reached a deal

Lex Fridman (1:31:31.700)

where basically the White House said,

Nicole Perlroth (1:31:34.540)

you better cut it out on intellectual property theft.

Lex Fridman (1:31:38.620)

And so they made this agreement

Nicole Perlroth (1:31:40.140)

that they would not hack each other for commercial benefit.

Lex Fridman (1:31:43.620)

And for a period of about 18 months,

Nicole Perlroth (1:31:45.700)

we saw this huge drop off in Chinese cyber attacks

Lex Fridman (1:31:49.060)

on American companies.

Lex Fridman (1:31:50.820)

But some of them continued.

Lex Fridman (1:31:53.080)

Where did they continue?

Nicole Perlroth (1:31:54.300)

They continued on aviation companies,

Lex Fridman (1:31:58.420)

on hospitality companies like Marriott.

Lex Fridman (1:32:02.000)

Why?

Lex Fridman (1:32:02.900)

Because that was still considered fair game to China.

Nicole Perlroth (1:32:05.740)

It wasn't IP theft they were after.

Lex Fridman (1:32:07.420)

They wanted to know who was staying in this city

Nicole Perlroth (1:32:11.860)

at this time when Chinese citizens were staying there

Lex Fridman (1:32:15.020)

so they could cross match for counterintelligence

Nicole Perlroth (1:32:17.440)

who might be a likely Chinese spy.

Lex Fridman (1:32:20.220)

I'm sure we're doing some of that too.

Nicole Perlroth (1:32:22.720)

Counterintelligence is counterintelligence.

Lex Fridman (1:32:24.780)

It's considered fair game.

Lex Fridman (1:32:27.460)

But where I think it gets evil

Lex Fridman (1:32:30.420)

is when you use it for censorship,

Nicole Perlroth (1:32:34.220)

to suppress any dissent,

Lex Fridman (1:32:37.300)

to do what I've seen the UAE do to its citizens

Nicole Perlroth (1:32:41.780)

where people who've gone on Twitter

Lex Fridman (1:32:44.180)

just to advocate for better voting rights,

Nicole Perlroth (1:32:47.580)

more enfranchisement,

Lex Fridman (1:32:49.360)

suddenly find their passports confiscated.

Nicole Perlroth (1:32:53.500)

You know, I talked to one critic, Ahmed Mansour,

Lex Fridman (1:32:57.340)

and he told me,

Nicole Perlroth (1:32:58.700)

you know, you might find yourself a terrorist,

Lex Fridman (1:33:01.060)

labeled a terrorist one day,

Nicole Perlroth (1:33:02.420)

you don't even know how to operate a gun.

Lex Fridman (1:33:04.700)

I mean, he had been beaten up

Nicole Perlroth (1:33:06.520)

every time he tried to go somewhere.

Lex Fridman (1:33:07.980)

His passport had been confiscated.

Nicole Perlroth (1:33:09.660)

By that point, it turned out

Lex Fridman (1:33:10.600)

they'd already hacked into his phone

Lex Fridman (1:33:12.100)

so they were listening to us talking.

Lex Fridman (1:33:14.160)

They'd hacked into his baby monitor

Lex Fridman (1:33:16.300)

so they're spying on his child.

Lex Fridman (1:33:18.900)

And they stole his car.

Lex Fridman (1:33:22.340)

And then they created a new law

Lex Fridman (1:33:24.680)

that you couldn't criticize the ruling family

Nicole Perlroth (1:33:27.780)

or the ruling party on Twitter.

Lex Fridman (1:33:29.380)

And he's been in solitary confinement every day since

Nicole Perlroth (1:33:32.720)

on hunger strike.

Lex Fridman (1:33:34.180)

So that's evil, you know, that's evil.

Lex Fridman (1:33:37.760)

And we still, we don't do that here.

Lex Fridman (1:33:40.200)

You know, we have rules here.

Nicole Perlroth (1:33:42.060)

We don't cross that line.

Lex Fridman (1:33:44.500)

So yeah, in some cases, like I won't go to Dubai.

Nicole Perlroth (1:33:48.540)

You know, I won't go to Abu Dhabi.

Lex Fridman (1:33:49.980)

If I ever want to go to the Maldives,

Nicole Perlroth (1:33:51.580)

like too bad, like most of the flights go through Dubai.

Lex Fridman (1:33:54.860)

So there's some lines we're not willing to cross.

Lex Fridman (1:33:57.140)

But then again, just like you said,

Lex Fridman (1:33:58.940)

there's individuals within NSA, within CIA,

Lex Fridman (1:34:02.660)

and they may have power.

Lex Fridman (1:34:05.780)

And to me, there's levels of evil.

Nicole Perlroth (1:34:07.860)

To me personally, this is the stuff of conspiracy theories,

Lex Fridman (1:34:11.300)

is the things you've mentioned as evil

Nicole Perlroth (1:34:13.880)

are more direct attacks.

Lex Fridman (1:34:16.140)

But there's also psychological warfare.

Lex Fridman (1:34:19.140)

So blackmail.

Lex Fridman (1:34:20.800)

So what does spying allow you to do?

Nicole Perlroth (1:34:25.580)

Allow you to collect information

Lex Fridman (1:34:27.820)

if you have something that's embarrassing.

Nicole Perlroth (1:34:30.140)

Or if you have like Jeffrey Epstein conspiracy theories,

Lex Fridman (1:34:33.580)

active, what is it, manufacture of embarrassing things.

Lex Fridman (1:34:38.460)

And then use blackmail to manipulate the population

Lex Fridman (1:34:41.080)

or all the powerful people involved.

Nicole Perlroth (1:34:42.860)

It troubles me deeply that MIT allowed somebody

Lex Fridman (1:34:45.820)

like Jeffrey Epstein in their midst,

Nicole Perlroth (1:34:48.580)

especially some of the scientists I admire

Lex Fridman (1:34:51.620)

that they would hang out with that person at all.

Lex Fridman (1:34:54.260)

And so I'll talk about it sometimes.

Lex Fridman (1:34:59.020)

And then a lot of people tell me,

Nicole Perlroth (1:35:00.260)

well, obviously Jeffrey Epstein is a front for intelligence.

Lex Fridman (1:35:04.340)

And I just, I struggle to see that level of competence

Lex Fridman (1:35:09.640)

and malevolence.

Lex Fridman (1:35:10.720)

But, you know, who the hell am I?

Lex Fridman (1:35:17.200)

And I guess I was trying to get to that point.

Lex Fridman (1:35:21.200)

You said that there's bureaucracy and so on,

Nicole Perlroth (1:35:23.000)

which makes some of these things very difficult.

Lex Fridman (1:35:25.740)

I wonder how much malevolence,

Lex Fridman (1:35:27.440)

how much competence there is in these institutions.

Lex Fridman (1:35:31.640)

Like how far, this takes us back to the hacking question.

Lex Fridman (1:35:34.880)

How far are people willing to go if they have the power?

Lex Fridman (1:35:39.880)

This has to do with social engineering.

Nicole Perlroth (1:35:41.720)

This has to do with hacking.

Lex Fridman (1:35:42.800)

This has to do with manipulating people,

Nicole Perlroth (1:35:45.440)

attacking people, doing evil onto people,

Lex Fridman (1:35:47.360)

psychological warfare and stuff like that.

Nicole Perlroth (1:35:50.280)

I don't know.

Lex Fridman (1:35:51.500)

I believe that most people are good.

Lex Fridman (1:35:54.860)

And I don't think that's possible in a free society.

Lex Fridman (1:35:59.400)

There's something that happens

Nicole Perlroth (1:36:00.460)

when you have a centralized government

Lex Fridman (1:36:02.560)

where power corrupts over time

Lex Fridman (1:36:05.600)

and you start surveillance programs

Lex Fridman (1:36:08.880)

kind of, it's like a slippery slope

Nicole Perlroth (1:36:12.120)

that over time starts to both use fear

Lex Fridman (1:36:16.680)

and direct manipulation to control the populace.

Lex Fridman (1:36:20.060)

But in a free society, I just,

Lex Fridman (1:36:23.680)

it's difficult for me to imagine

Nicole Perlroth (1:36:25.120)

that you can have like somebody like a Jeffrey Epstein

Lex Fridman (1:36:27.720)

in the front for intelligence.

Nicole Perlroth (1:36:29.400)

I don't know what I'm asking you, but I'm just,

Lex Fridman (1:36:34.780)

I have a hope that for the most part,

Nicole Perlroth (1:36:36.960)

intelligence agencies are trying to do good

Lex Fridman (1:36:39.880)

and are actually doing good for the world

Nicole Perlroth (1:36:43.360)

when you view it in the full context

Lex Fridman (1:36:45.720)

of the complexities of the world.

Lex Fridman (1:36:51.640)

But then again, if they're not, would we know?

Lex Fridman (1:36:55.200)

That's why Edward Snowden might be a good thing.

Nicole Perlroth (1:36:58.400)

Let me ask you on a personal question.

Lex Fridman (1:37:00.520)

You have investigated some of the most powerful

Nicole Perlroth (1:37:02.480)

organizations and people in the world

Lex Fridman (1:37:04.520)

of cyber warfare, cyber security.

Nicole Perlroth (1:37:07.620)

Are you ever afraid for your own life,

Lex Fridman (1:37:09.600)

your own wellbeing, digital or physical?

Nicole Perlroth (1:37:13.240)

I mean, I've had my moments.

Lex Fridman (1:37:15.520)

You know, I've had our security team at the times

Nicole Perlroth (1:37:20.080)

called me at one point and said,

Lex Fridman (1:37:21.960)

someone's on the dark web offering good money

Nicole Perlroth (1:37:25.800)

to anyone who can hack your phone or your laptop.

Lex Fridman (1:37:30.080)

I describe in my book how when I was at that

Nicole Perlroth (1:37:33.000)

hacking conference in Argentina and I came back

Lex Fridman (1:37:35.240)

and I brought a burner laptop with me,

Lex Fridman (1:37:38.680)

but I'd kept it in the safe anyway

Lex Fridman (1:37:40.760)

and it didn't have anything on it,

Lex Fridman (1:37:42.480)

but someone had broken in and it was moved.

Lex Fridman (1:37:46.640)

You know, I've had all sorts of sort of scary moments.

Lex Fridman (1:37:52.760)

And then I've had moments where I think I went

Lex Fridman (1:37:55.520)

just way too far into the paranoid side.

Nicole Perlroth (1:37:58.920)

I mean, I remember writing about the Times hack by China

Lex Fridman (1:38:04.600)

and I just covered a number of Chinese cyber attacks

Nicole Perlroth (1:38:07.460)

where they'd gotten into the thermostat

Lex Fridman (1:38:10.080)

at someone's corporate apartment

Lex Fridman (1:38:11.600)

and they'd gotten into all sorts of stuff.

Lex Fridman (1:38:15.820)

And I was living by myself.

Nicole Perlroth (1:38:17.760)

I was single in San Francisco and my cable box

Lex Fridman (1:38:23.000)

on my television started making some weird noises

Nicole Perlroth (1:38:25.560)

in the middle of the night.

Lex Fridman (1:38:26.960)

And I got up and I ripped it out of the wall

Lex Fridman (1:38:29.680)

and I think I said something like embarrassing,

Lex Fridman (1:38:32.080)

like, fuck you China, you know.

Lex Fridman (1:38:33.760)

And then I went back to bed and I woke up

Lex Fridman (1:38:39.320)

and it's like beautiful morning light.

Nicole Perlroth (1:38:41.640)

I mean, I'll never forget it.

Lex Fridman (1:38:42.560)

Like this is like glimmering morning light

Nicole Perlroth (1:38:44.600)

is shining on my cable box, which has now been ripped out

Lex Fridman (1:38:48.120)

and is sitting on my floor and like the morning light.

Lex Fridman (1:38:50.640)

And I was just like, no, no, no,

Lex Fridman (1:38:53.840)

like I'm not going down that road.

Nicole Perlroth (1:38:56.920)

Like you basically, I came to a fork in the road

Lex Fridman (1:39:03.400)

where I could either go full tinfoil hat,

Nicole Perlroth (1:39:06.120)

go live off the grid, never have a car with navigation,

Lex Fridman (1:39:10.040)

never use Google maps, never own an iPhone,

Nicole Perlroth (1:39:12.480)

never order diapers off Amazon, you know, create an alias

Lex Fridman (1:39:17.480)

or I could just do the best I can

Lex Fridman (1:39:22.240)

and live in this new digital world we're living in.

Lex Fridman (1:39:26.040)

And what does that look like for me?

Lex Fridman (1:39:28.080)

I mean, what are my crown jewels?

Lex Fridman (1:39:30.760)

This is what I tell people, what are your crown jewels?

Nicole Perlroth (1:39:32.760)

Cause just focus on that.

Lex Fridman (1:39:34.200)

You can't protect everything,

Lex Fridman (1:39:35.620)

but you can protect your crown jewels.

Lex Fridman (1:39:37.480)

For me, for the longest time,

Nicole Perlroth (1:39:39.000)

my crown jewels were my sources.

Lex Fridman (1:39:42.320)

I was nothing without my sources.

Lex Fridman (1:39:44.520)

So I had some sources, I would meet the same dim sum place

Lex Fridman (1:39:49.420)

or maybe it was a different restaurant on the same date,

Nicole Perlroth (1:39:53.760)

you know, every quarter and we would never drive there.

Lex Fridman (1:39:59.040)

We would never Uber there.

Nicole Perlroth (1:40:00.360)

We wouldn't bring any devices.

Lex Fridman (1:40:02.040)

I could bring a pencil and a notepad.

Lex Fridman (1:40:05.000)

And if someone wasn't in town,

Lex Fridman (1:40:07.160)

like there were a couple of times where I'd show up

Lex Fridman (1:40:09.120)

and the source never came,

Lex Fridman (1:40:11.120)

but we never communicated digitally.

Lex Fridman (1:40:14.000)

And those were the links I was willing to go

Lex Fridman (1:40:16.440)

to protect that source, but you can't do it for everyone.

Lex Fridman (1:40:19.520)

So for everyone else, you know, it was signal,

Lex Fridman (1:40:22.300)

using two factor authentication,

Nicole Perlroth (1:40:24.520)

you know, keeping my devices up to date,

Lex Fridman (1:40:26.960)

not clicking on phishing emails, using a password manager,

Nicole Perlroth (1:40:30.640)

all the things that we know we're supposed to do.

Lex Fridman (1:40:34.480)

And that's what I tell everyone, like don't go crazy

Nicole Perlroth (1:40:37.320)

because then that's like the ultimate hack.

Lex Fridman (1:40:39.280)

Then they've hacked your mind, whoever they is for you.

Lex Fridman (1:40:43.620)

But just do the best you can.

Lex Fridman (1:40:45.200)

Now, my whole risk model changed when I had a kid.

Nicole Perlroth (1:40:50.200)

You know, now it's, oh God, you know,

Lex Fridman (1:40:54.720)

if anyone threatened my family, God help them.

Lex Fridman (1:40:59.960)

But it changes you.

Lex Fridman (1:41:07.520)

And, you know, unfortunately there are some things,

Nicole Perlroth (1:41:12.340)

like I was really scared to go deep on,

Lex Fridman (1:41:15.000)

like Russian cyber crime, you know, like Putin himself,

Nicole Perlroth (1:41:19.540)

you know, and it's interesting.

Lex Fridman (1:41:21.240)

Like I have a mentor who's an incredible person

Nicole Perlroth (1:41:24.600)

who was the Times Moscow Bureau Chief during the Cold War.

Lex Fridman (1:41:29.560)

And after I wrote a series of stories

Nicole Perlroth (1:41:32.040)

about Chinese cyber espionage, he took me out to lunch.

Lex Fridman (1:41:35.040)

And he told me that when he was living in Moscow,

Nicole Perlroth (1:41:37.960)

he would drop his kids off at preschool

Lex Fridman (1:41:40.100)

when they were my son's age now.

Lex Fridman (1:41:42.640)

And the KGB would follow him

Lex Fridman (1:41:44.800)

and they would make a really like loud show of it.

Nicole Perlroth (1:41:48.280)

You know, they'd tail him, they'd, you know, honk,

Lex Fridman (1:41:51.360)

they'd just be, make a ruckus.

Lex Fridman (1:41:55.240)

And he said, you know what, they never actually did anything

Lex Fridman (1:41:57.640)

but they wanted me to know that they were following me

Lex Fridman (1:42:00.760)

and I operated accordingly.

Lex Fridman (1:42:03.000)

And he says, that's how you should operate

Nicole Perlroth (1:42:05.840)

in the digital world.

Lex Fridman (1:42:08.200)

Know that there are probably people following you.

Nicole Perlroth (1:42:11.660)

Sometimes they'll make a little bit of noise.

Lex Fridman (1:42:14.400)

But one thing you need to know is that

Nicole Perlroth (1:42:17.540)

while you're at the New York Times,

Lex Fridman (1:42:18.620)

you have a little bit of an invisible shield on you.

Nicole Perlroth (1:42:21.360)

You know, if something were to happen to you,

Lex Fridman (1:42:23.660)

that would be a really big deal.

Nicole Perlroth (1:42:25.080)

That would be an international incident.

Lex Fridman (1:42:27.000)

So I kind of carried that invisible shield with me

Nicole Perlroth (1:42:29.900)

for years.

Lex Fridman (1:42:31.540)

And then Jamal Khashoggi happened.

Lex Fridman (1:42:34.360)

And that destroyed my vision of my invisible shield.

Lex Fridman (1:42:38.480)

You know, sure, you know, he was a Saudi

Lex Fridman (1:42:41.980)

but he was a Washington Post columnist.

Lex Fridman (1:42:44.820)

You know, for the most part,

Nicole Perlroth (1:42:46.160)

he was living in the United States.

Lex Fridman (1:42:47.320)

He was a journalist.

Lex Fridman (1:42:49.240)

And for them to do what they did to him,

Lex Fridman (1:42:52.820)

pretty much in the open and get away with it,

Lex Fridman (1:42:57.320)

and for the United States to let them get away with it

Lex Fridman (1:43:01.080)

because we wanted to preserve diplomatic relations

Nicole Perlroth (1:43:04.660)

with the Saudis,

Lex Fridman (1:43:06.040)

that really threw my worldview upside down.

Nicole Perlroth (1:43:10.500)

And, you know, I think that sent a message

Lex Fridman (1:43:13.740)

to a lot of countries

Nicole Perlroth (1:43:15.580)

that it was sort of open season on journalists.

Lex Fridman (1:43:19.500)

And to me, that was one of the most destructive things

Nicole Perlroth (1:43:22.960)

that happened under the previous administration.

Lex Fridman (1:43:27.360)

And, you know, I don't really know

Lex Fridman (1:43:30.240)

what to think of my invisible shield anymore.

Lex Fridman (1:43:32.280)

Like you said, that really worries me

Nicole Perlroth (1:43:33.700)

on the journalism side that people would be afraid

Lex Fridman (1:43:36.420)

to dig deep on fascinating topics.

Nicole Perlroth (1:43:41.080)

And, you know, I have my own,

Lex Fridman (1:43:47.160)

part of the reason, like I would love to have kids,

Nicole Perlroth (1:43:50.160)

I would love to have a family.

Lex Fridman (1:43:52.700)

Part of the reason I'm a little bit afraid,

Nicole Perlroth (1:43:56.680)

there's many ways to phrase this,

Lex Fridman (1:43:57.940)

but the loss of freedom in the way of doing

Nicole Perlroth (1:44:02.480)

all the crazy shit that I naturally do,

Lex Fridman (1:44:04.980)

which I would say the ethic of journalism

Nicole Perlroth (1:44:07.900)

is kind of not, is doing crazy shit

Lex Fridman (1:44:09.900)

without really thinking about it.

Nicole Perlroth (1:44:11.160)

This is letting your curiosity

Lex Fridman (1:44:14.360)

really allow you to be free and explore.

Nicole Perlroth (1:44:18.460)

It's, I mean, whether it's stupidity or fearlessness,

Lex Fridman (1:44:22.040)

whatever it is, that's what great journalism is.

Lex Fridman (1:44:25.240)

And all the concerns about security risks

Lex Fridman (1:44:30.180)

have made me like become a better person.

Nicole Perlroth (1:44:32.760)

The way I approach it is just make sure

Lex Fridman (1:44:35.600)

you don't have anything to hide.

Nicole Perlroth (1:44:37.280)

I know this is not a thing.

Lex Fridman (1:44:38.960)

This is not a, this is not an approach to security.

Nicole Perlroth (1:44:41.860)

I'm just, this is like a motivational speech or something.

Lex Fridman (1:44:44.920)

It's just like, if you can lose,

Nicole Perlroth (1:44:47.320)

you can be hacked at any moment.

Lex Fridman (1:44:49.220)

Just don't be a douchebag secretly.

Nicole Perlroth (1:44:52.120)

Just be like a good person.

Lex Fridman (1:44:54.400)

Because then, I see this actually

Nicole Perlroth (1:44:56.680)

with social media in general.

Lex Fridman (1:45:00.120)

Just present yourself in the most authentic way possible,

Nicole Perlroth (1:45:03.840)

meaning be the same person online as you are privately.

Lex Fridman (1:45:06.880)

Have nothing to hide.

Nicole Perlroth (1:45:08.080)

That's one, not the only, but one of the ways

Lex Fridman (1:45:11.800)

to achieve security.

Nicole Perlroth (1:45:14.440)

Maybe I'm totally wrong on this,

Lex Fridman (1:45:15.820)

but don't be secretly weird.

Nicole Perlroth (1:45:19.520)

If you're weird, be publicly weird

Lex Fridman (1:45:21.860)

so it's impossible to blackmail you.

Nicole Perlroth (1:45:24.300)

That's my approach to security.

Lex Fridman (1:45:25.440)

Yeah, well, they call it

Nicole Perlroth (1:45:26.600)

the New York Times front page phenomenon.

Lex Fridman (1:45:29.920)

Don't put anything in email or I guess social media

Nicole Perlroth (1:45:32.720)

these days that you wouldn't want to read

Lex Fridman (1:45:35.800)

on the front page of the New York Times.

Lex Fridman (1:45:37.920)

And that works, but sometimes I even get carried,

Lex Fridman (1:45:41.620)

I mean, I have not as many followers as you,

Lex Fridman (1:45:45.560)

but a lot of followers,

Lex Fridman (1:45:47.080)

and sometimes even I get carried away.

Nicole Perlroth (1:45:49.080)

Just be emotional and stuff and say something.

Lex Fridman (1:45:51.280)

Yeah, I mean, just the cortisol response on Twitter.

Nicole Perlroth (1:45:57.320)

Twitter is basically designed to elicit those responses.

Lex Fridman (1:46:01.600)

I mean, every day I turn on my computer,

Nicole Perlroth (1:46:04.720)

I look at my phone, I look at what's trending on Twitter,

Lex Fridman (1:46:07.760)

and it's like, what are the topics

Lex Fridman (1:46:10.080)

that are gonna make people the most angry today?

Lex Fridman (1:46:13.740)

You know?

Lex Fridman (1:46:14.580)

And you know, it's easy to get carried away,

Lex Fridman (1:46:19.160)

but it's also just, that sucks too,

Nicole Perlroth (1:46:22.320)

that you have to be constantly censoring yourself.

Lex Fridman (1:46:25.280)

And maybe it's for the better.

Nicole Perlroth (1:46:26.620)

Maybe you can't be a secret asshole,

Lex Fridman (1:46:29.480)

and we can put that in the good bucket.

Lex Fridman (1:46:31.360)

But at the same time, you know,

Lex Fridman (1:46:33.700)

there is a danger to that other voice,

Nicole Perlroth (1:46:39.160)

to creativity, you know, to being weird.

Lex Fridman (1:46:43.060)

There's a danger to that little whispered voice

Lex Fridman (1:46:45.600)

that's like, well, how would people read that?

Lex Fridman (1:46:48.840)

You know, how could that be manipulated?

Lex Fridman (1:46:51.160)

How could that be used against you?

Lex Fridman (1:46:53.520)

And that stifles creativity and innovation and free thought.

Lex Fridman (1:47:00.280)

And you know, that is on a very micro level.

Lex Fridman (1:47:06.840)

And that's something I think about a lot.

Lex Fridman (1:47:08.920)

And that's actually something that Tim Cook

Lex Fridman (1:47:11.600)

has talked about a lot,

Lex Fridman (1:47:13.200)

and why he has said he goes full force on privacy

Lex Fridman (1:47:17.640)

is it's just that little voice

Nicole Perlroth (1:47:20.960)

that is at some level censoring you.

Lex Fridman (1:47:24.840)

And what is sort of the long term impact

Lex Fridman (1:47:28.280)

of that little voice over time?

Lex Fridman (1:47:31.000)

I think there's a ways, I think that self censorship

Nicole Perlroth (1:47:35.200)

is an attack factor that there's solutions to.

Lex Fridman (1:47:37.680)

The way I'm really inspired by Elon Musk,

Nicole Perlroth (1:47:40.160)

the solution to that is just be privately

Lex Fridman (1:47:43.720)

and publicly the same person and be ridiculous.

Nicole Perlroth (1:47:46.800)

Embrace the full weirdness and show it more and more.

Lex Fridman (1:47:49.760)

So, you know, that's memes that has like ridiculous humor.

Lex Fridman (1:47:54.080)

And I think, and if there is something

Lex Fridman (1:47:57.860)

you really wanna hide, deeply consider

Nicole Perlroth (1:48:00.940)

if that you wanna be that.

Lex Fridman (1:48:03.560)

Like, why are you hiding it?

Lex Fridman (1:48:05.280)

What exactly are you afraid of?

Lex Fridman (1:48:07.400)

Because I think my hopeful vision for the internet

Nicole Perlroth (1:48:10.640)

is the internet loves authenticity.

Lex Fridman (1:48:13.320)

They wanna see you weird, so be that and like live that fully

Nicole Perlroth (1:48:18.260)

because I think that gray area

Lex Fridman (1:48:20.240)

where you're kind of censoring yourself,

Nicole Perlroth (1:48:22.400)

that's where the destruction is.

Lex Fridman (1:48:25.120)

You have to go all the way, step over, be weird.

Lex Fridman (1:48:28.760)

And then it feels, it can be painful

Lex Fridman (1:48:31.040)

because people can attack you and so on, but just ride it.

Nicole Perlroth (1:48:33.680)

I mean, that's just like a skill

Lex Fridman (1:48:35.960)

on the social psychological level

Nicole Perlroth (1:48:38.080)

that ends up being an approach to security,

Lex Fridman (1:48:42.080)

which is like remove the attack vector

Nicole Perlroth (1:48:45.080)

of having private information

Lex Fridman (1:48:46.960)

by being your full weird self publicly.

Lex Fridman (1:48:51.640)

What advice would you give to young folks today,

Lex Fridman (1:48:55.840)

you know, operating in this complicated space

Nicole Perlroth (1:49:00.680)

about how to have a successful life,

Lex Fridman (1:49:02.520)

a life they can be proud of,

Lex Fridman (1:49:03.960)

a career they can be proud of?

Lex Fridman (1:49:07.640)

Maybe somebody in high school and college

Nicole Perlroth (1:49:09.480)

thinking about what they're going to do.

Lex Fridman (1:49:11.600)

Be a hacker, you know, if you have any interest,

Nicole Perlroth (1:49:15.120)

become a hacker and apply yourself to defense, you know.

Lex Fridman (1:49:19.960)

Every time, like we do have

Nicole Perlroth (1:49:21.800)

these amazing scholarship programs, for instance,

Lex Fridman (1:49:24.620)

where, you know, they find you early,

Nicole Perlroth (1:49:26.640)

they'll pay your college as long as you commit

Lex Fridman (1:49:30.040)

to some kind of federal commitment

Nicole Perlroth (1:49:32.000)

to sort of help federal agencies with cybersecurity.

Lex Fridman (1:49:35.320)

And where does everyone wanna go every year

Lex Fridman (1:49:37.880)

from the scholarship program?

Lex Fridman (1:49:39.100)

They wanna go work at the NSA or Cyber Command, you know.

Nicole Perlroth (1:49:42.240)

They wanna go work on offense.

Lex Fridman (1:49:44.240)

They wanna go do the sexy stuff.

Nicole Perlroth (1:49:46.240)

It's really hard to get people to work on defense.

Lex Fridman (1:49:49.940)

It's just, it's always been more fun

Nicole Perlroth (1:49:51.800)

to be a pirate than be in the Coast Guard, you know.

Lex Fridman (1:49:54.560)

And so we have a huge deficit

Nicole Perlroth (1:49:59.160)

when it comes to filling those roles.

Lex Fridman (1:50:01.320)

There's 3.5 million unfilled cybersecurity positions

Nicole Perlroth (1:50:06.600)

around the world.

Lex Fridman (1:50:08.000)

I mean, talk about job security,

Nicole Perlroth (1:50:09.680)

like be a hacker and work on cybersecurity.

Lex Fridman (1:50:12.760)

You will always have a job.

Lex Fridman (1:50:15.300)

And we're actually at a huge deficit

Lex Fridman (1:50:18.600)

and disadvantage as a free market economy

Nicole Perlroth (1:50:22.200)

because we can't match cybersecurity salaries

Lex Fridman (1:50:26.800)

at Palantir or Facebook or Google or Microsoft.

Lex Fridman (1:50:30.060)

And so it's really hard for the United States

Lex Fridman (1:50:32.480)

to fill those roles.

Nicole Perlroth (1:50:33.840)

And, you know, other countries have had this work around

Lex Fridman (1:50:38.400)

where they basically have forced conscription on some level.

Nicole Perlroth (1:50:41.460)

You know, China tells people,

Lex Fridman (1:50:43.720)

like you do whatever you're gonna do during the day,

Nicole Perlroth (1:50:46.840)

work at Alibaba.

Lex Fridman (1:50:48.520)

You know, if you need to do some ransomware, okay.

Lex Fridman (1:50:51.340)

But the minute we tap you on the shoulder

Lex Fridman (1:50:53.960)

and ask you to come do this sensitive operation for us,

Nicole Perlroth (1:50:57.160)

the answer is yes.

Lex Fridman (1:50:59.180)

You know, same with Russia.

Nicole Perlroth (1:51:00.820)

You know, a couple of years ago when Yahoo was hacked

Lex Fridman (1:51:03.640)

and they laid it all out in an indictment,

Nicole Perlroth (1:51:05.680)

it came down to two cyber criminals

Lex Fridman (1:51:07.680)

and two guys from the FSB.

Nicole Perlroth (1:51:09.560)

Cyber criminals were allowed to have their fun,

Lex Fridman (1:51:12.160)

but the minute they came across the username and password

Nicole Perlroth (1:51:14.860)

for someone's personal Yahoo account

Lex Fridman (1:51:16.740)

that worked at the White House or the State Department

Nicole Perlroth (1:51:19.440)

or military, they were expected to pass that over to the FSB.

Lex Fridman (1:51:23.640)

So we don't do that here.

Lex Fridman (1:51:24.960)

And it's even worse on defense.

Lex Fridman (1:51:27.400)

We really can't fill these positions.

Nicole Perlroth (1:51:29.880)

So, you know, if you are a hacker,

Lex Fridman (1:51:33.040)

if you're interested in code,

Nicole Perlroth (1:51:34.800)

if you're a tinker, you know, learn how to hack.

Lex Fridman (1:51:39.920)

There are all sorts of amazing hacking competitions

Nicole Perlroth (1:51:42.720)

you can do through the SANS org, for example, S A N S.

Lex Fridman (1:51:48.560)

And then use those skills for good.

Nicole Perlroth (1:51:50.880)

You know, neuter the bugs in that code

Lex Fridman (1:51:53.500)

that get used by autocratic regimes

Nicole Perlroth (1:51:56.300)

to make people's life, you know, a living prison.

Lex Fridman (1:52:00.140)

You know, plug those holes.

Nicole Perlroth (1:52:01.680)

You know, defend industrial systems,

Lex Fridman (1:52:03.720)

defend our water treatment facilities

Nicole Perlroth (1:52:06.000)

from hacks where people are trying to come in

Lex Fridman (1:52:07.820)

and poison the water.

Nicole Perlroth (1:52:09.500)

You know, that I think is just an amazing,

Lex Fridman (1:52:14.160)

it's an amazing job on so many levels.

Nicole Perlroth (1:52:16.280)

It's intellectually stimulating.

Lex Fridman (1:52:19.680)

You can tell yourself you're serving your country.

Nicole Perlroth (1:52:22.920)

You can tell yourself you're saving lives

Lex Fridman (1:52:24.680)

and keeping people safe.

Lex Fridman (1:52:26.160)

And you'll always have amazing job security.

Lex Fridman (1:52:28.480)

And if you need to go get that job that pays you,

Nicole Perlroth (1:52:31.000)

you know, 2 million bucks a year, you can do that too.

Lex Fridman (1:52:33.560)

And you can have a public profile,

Nicole Perlroth (1:52:34.880)

more so of a public profile, you can be a public rockstar.

Lex Fridman (1:52:38.800)

I mean, it's the same thing as sort of the military.

Nicole Perlroth (1:52:42.720)

There's a lot of,

Lex Fridman (1:52:46.520)

there's a lot of well known sort of people

Nicole Perlroth (1:52:49.980)

commenting on the fact that veterans

Lex Fridman (1:52:51.700)

are not treated as well as they should be.

Lex Fridman (1:52:54.040)

But it's still the fact that soldiers

Lex Fridman (1:52:56.120)

are deeply respected for defending the country,

Nicole Perlroth (1:53:00.380)

the freedoms, the ideals that we stand for.

Lex Fridman (1:53:02.840)

And in the same way, I mean, in some ways,

Nicole Perlroth (1:53:05.480)

the cybersecurity defense are the soldiers of the future.

Lex Fridman (1:53:09.040)

Yeah, and you know what's interesting,

Nicole Perlroth (1:53:10.760)

I mean, in cybersecurity, the difference is,

Lex Fridman (1:53:14.160)

oftentimes you see the more interesting threats

Nicole Perlroth (1:53:17.200)

in the private sector, because that's where the attacks come.

Lex Fridman (1:53:20.380)

You know, when cyber criminals

Lex Fridman (1:53:22.520)

and nation state adversaries come for the United States,

Lex Fridman (1:53:25.600)

they don't go directly for Cyber Command or the NSA.

Nicole Perlroth (1:53:29.080)

You know, they go for banks, they go for Google,

Lex Fridman (1:53:32.960)

they go for Microsoft, they go for critical infrastructure.

Lex Fridman (1:53:36.680)

And so those companies, those private sector companies

Lex Fridman (1:53:39.600)

get to see some of the most advanced,

Nicole Perlroth (1:53:41.840)

sophisticated attacks out there.

Lex Fridman (1:53:45.720)

And you know, if you're working at FireEye

Lex Fridman (1:53:48.600)

and you're calling out the SolarWinds attack, for instance,

Lex Fridman (1:53:51.580)

I mean, you just saved God knows how many systems

Nicole Perlroth (1:53:56.120)

from, you know, that compromise turning into something

Lex Fridman (1:53:59.960)

that more closely resembles sabotage.

Nicole Perlroth (1:54:03.680)

So, you know, go be a hacker, or go be a journalist.

Lex Fridman (1:54:08.960)

So you wrote the book,

Nicole Perlroth (1:54:13.020)

This Is How They Tell Me The World Ends,

Lex Fridman (1:54:15.840)

as we've been talking about,

Nicole Perlroth (1:54:17.520)

of course, referring to cyber war, cybersecurity.

Lex Fridman (1:54:21.720)

What gives you hope about the future of our world

Lex Fridman (1:54:25.320)

if it doesn't end?

Lex Fridman (1:54:26.640)

How will it not end?

Nicole Perlroth (1:54:31.520)

That's a good question.

Lex Fridman (1:54:32.800)

I mean, I have to have hope, right?

Nicole Perlroth (1:54:34.560)

Because I have a kid and I have another on the way,

Lex Fridman (1:54:37.360)

and if I didn't have hope, I wouldn't be having kids.

Lex Fridman (1:54:42.160)

But it's a scary time to be having kids.

Lex Fridman (1:54:46.520)

And you know, it's like pandemic, climate change,

Nicole Perlroth (1:54:50.600)

disinformation, increasingly advanced, perhaps deadly

Lex Fridman (1:54:55.640)

cyber attacks.

Lex Fridman (1:54:57.740)

What gives me hope is that I share your worldview

Lex Fridman (1:55:01.480)

that I think people are fundamentally good.

Lex Fridman (1:55:04.960)

And sometimes, and this is why the metaverse

Lex Fridman (1:55:07.600)

scares me to death, but when I'm reminded of that

Nicole Perlroth (1:55:10.780)

is not online.

Lex Fridman (1:55:13.080)

Like online, I get the opposite.

Nicole Perlroth (1:55:15.160)

You know, you start to lose hope and humanity

Lex Fridman (1:55:17.380)

when you're on Twitter half your day.

Nicole Perlroth (1:55:19.300)

It's like when I go to the grocery store

Lex Fridman (1:55:22.600)

or I go on a hike or like someone smiles at me

Nicole Perlroth (1:55:27.360)

or you know, or someone just says something nice.

Lex Fridman (1:55:31.160)

You know, people are fundamentally good.

Nicole Perlroth (1:55:33.280)

We just don't hear from those people enough.

Lex Fridman (1:55:37.080)

And my hope is, I just think our current political climate,

Nicole Perlroth (1:55:42.880)

like we've hit rock bottom.

Lex Fridman (1:55:44.880)

This is as bad as it gets.

Nicole Perlroth (1:55:46.640)

We can't do anything.

Lex Fridman (1:55:47.840)

Don't jinx it.

Lex Fridman (1:55:49.760)

But I think it's a generational thing.

Lex Fridman (1:55:51.960)

You know, I think baby boomers, like it's time to move along.

Nicole Perlroth (1:55:57.120)

I think it's time for a new generation to come in.

Lex Fridman (1:56:01.100)

And I actually have a lot of hope when I look at you.

Nicole Perlroth (1:56:06.000)

I'm sort of like this, I guess they call me

Lex Fridman (1:56:08.800)

a geriatric millennial or a young gen X.

Lex Fridman (1:56:12.080)

But like we have this unique responsibility

Lex Fridman (1:56:14.460)

because I grew up without the internet

Lex Fridman (1:56:17.560)

and without social media, but I'm native to it.

Lex Fridman (1:56:20.960)

So I know the good and I know the bad.

Lex Fridman (1:56:25.280)

And that's true on so many different things.

Lex Fridman (1:56:28.240)

You know, I grew up without climate change anxiety

Lex Fridman (1:56:32.060)

and now I'm feeling it and I know it's not a given.

Lex Fridman (1:56:34.860)

We don't have to just resign ourselves to climate change.

Nicole Perlroth (1:56:39.760)

You know, same with disinformation.

Lex Fridman (1:56:41.200)

And I think a lot of the problems we face today

Nicole Perlroth (1:56:44.080)

have just exposed the sort of inertia

Lex Fridman (1:56:47.640)

that there has been on so many of these issues.

Lex Fridman (1:56:49.960)

And I really think it's a generational shift

Lex Fridman (1:56:52.880)

that has to happen.

Lex Fridman (1:56:54.500)

And I think this next generation is gonna come in

Lex Fridman (1:56:57.620)

and say like, we're not doing business

Nicole Perlroth (1:56:59.520)

like you guys did it anymore.

Lex Fridman (1:57:00.960)

You know, we're not just gonna like rape

Lex Fridman (1:57:02.480)

and pillage the earth and try and turn everyone

Lex Fridman (1:57:05.280)

against each other and play dirty tricks

Lex Fridman (1:57:07.800)

and let lobbyists dictate what we do

Lex Fridman (1:57:11.440)

or don't do as a country anymore.

Lex Fridman (1:57:14.040)

And that's really where I see the hope.

Lex Fridman (1:57:16.480)

It feels like there's a lot of low hanging fruit

Nicole Perlroth (1:57:19.160)

for young minds to step up and create solutions and lead.

Lex Fridman (1:57:23.760)

So whenever like politicians or leaders that are older,

Nicole Perlroth (1:57:30.600)

like you said, are acting shitty, I see that as a positive.

Lex Fridman (1:57:34.120)

They're inspiring a large number of young people

Nicole Perlroth (1:57:38.100)

to replace them.

Lex Fridman (1:57:39.640)

And so I think you're right, there's going to be,

Nicole Perlroth (1:57:42.560)

it's almost like you need people to act shitty

Lex Fridman (1:57:45.160)

to remind them, oh, wow, we need good leaders.

Nicole Perlroth (1:57:47.860)

We need great creators and builders and entrepreneurs

Lex Fridman (1:57:51.360)

and scientists and engineers and journalists.

Nicole Perlroth (1:57:54.120)

You know, all the discussions about how the journalism

Lex Fridman (1:57:56.560)

is quote unquote broken and so on,

Nicole Perlroth (1:57:58.640)

that's just an inspiration for new institutions to rise up

Lex Fridman (1:58:02.080)

that do journalism better,

Nicole Perlroth (1:58:03.760)

new journalists to step up and do journalism better.

Lex Fridman (1:58:06.320)

So I, and I've been constantly,

Nicole Perlroth (1:58:08.640)

when I talk to young people, I'm constantly impressed

Lex Fridman (1:58:11.760)

by the ones that dream to build solutions.

Lex Fridman (1:58:16.440)

And so that's ultimately why I put the hope.

Lex Fridman (1:58:21.320)

But the world is a messy place,

Nicole Perlroth (1:58:23.160)

like we've been talking about, it's a scary place.

Lex Fridman (1:58:27.760)

Yeah, and I think you hit something,

Nicole Perlroth (1:58:29.720)

hit on something earlier, which is authenticity.

Lex Fridman (1:58:33.120)

Like no one is going to rise above that is plastic anymore.

Nicole Perlroth (1:58:40.080)

You know, people are craving authenticity.

Lex Fridman (1:58:43.120)

You know, the benefit of the internet is it's really hard

Nicole Perlroth (1:58:46.540)

to hide who you are on every single platform.

Lex Fridman (1:58:49.980)

You know, on some level it's gonna come out

Nicole Perlroth (1:58:51.840)

who you really are.

Lex Fridman (1:58:53.480)

And so you hope that, you know,

Nicole Perlroth (1:58:57.420)

by the time my kids are grown,

Lex Fridman (1:58:59.280)

like no one's gonna care if they made one mistake online,

Lex Fridman (1:59:04.120)

so long as they're authentic, you know?

Lex Fridman (1:59:07.040)

And I used to worry about this.

Nicole Perlroth (1:59:09.600)

My nephew was born the day I graduated from college.

Lex Fridman (1:59:13.280)

And I just always, you know, he's like born into Facebook.

Lex Fridman (1:59:17.760)

And I just think like, how is a kid like that

Lex Fridman (1:59:21.000)

ever gonna be president of the United States of America?

Nicole Perlroth (1:59:24.040)

Because if Facebook had been around when I was in college,

Lex Fridman (1:59:27.740)

you know, like Jesus, you know,

Lex Fridman (1:59:31.480)

how are those kids are gonna ever be president?

Lex Fridman (1:59:34.240)

There's gonna be some photo of them at some point

Nicole Perlroth (1:59:37.480)

making some mistake, and that's gonna be all over for them.

Lex Fridman (1:59:41.760)

And now I take that back.

Nicole Perlroth (1:59:43.100)

Now it's like, no, everyone's gonna make mistakes.

Lex Fridman (1:59:46.700)

There's gonna be a picture for everyone.

Lex Fridman (1:59:49.400)

And we're all gonna have to come and grow up

Lex Fridman (1:59:53.020)

to the view that as humans, we're gonna make huge mistakes.

Lex Fridman (1:59:56.480)

And hopefully they're not so big

Lex Fridman (1:59:58.120)

that they're gonna ruin the rest of your life.

Lex Fridman (20:01.060)

And so I went out to lunch with kind of this godfather

Lex Fridman (20:05.100)

of the hacking scene there.

Lex Fridman (20:07.260)

And I asked this really dumb question

Lex Fridman (20:10.180)

and I'm still embarrassed about how I phrased it.

Lex Fridman (20:13.100)

But I said, so will these guys only sell

Lex Fridman (20:16.540)

these zero to exploits to good Western governments?

Lex Fridman (20:20.300)

And he said, Nicole, last time I checked,

Lex Fridman (20:22.300)

the United States wasn't a good Western government.

Nicole Perlroth (20:25.820)

The last country that bombed another country

Lex Fridman (20:28.180)

into oblivion wasn't China or Iran,

Nicole Perlroth (20:31.820)

it was the United States.

Lex Fridman (20:33.540)

So if we're gonna go by your whole moral calculus,

Nicole Perlroth (20:36.700)

just know that we have a very different calculus down here

Lex Fridman (20:39.580)

and we'd actually rather sell to Iran or Russia

Nicole Perlroth (20:44.180)

or China maybe than the United States.

Lex Fridman (20:46.580)

And that just blew me away.

Nicole Perlroth (20:48.820)

Like, wow, he's like, we'll just sell

Lex Fridman (20:51.820)

to whoever brings us the biggest bag of cash.

Lex Fridman (20:53.900)

Have you checked into our inflation situation recently?

Lex Fridman (20:57.900)

So I had some of those like reality checks along the way.

Nicole Perlroth (21:02.500)

We tend to think of things as is this moral,

Lex Fridman (21:05.980)

is this ethical, especially as journalists.

Lex Fridman (21:08.780)

And we kind of sit on our high horse sometimes

Lex Fridman (21:11.020)

and write about a lot of things

Nicole Perlroth (21:13.640)

that seem to push the moral bounds.

Lex Fridman (21:16.360)

But in this market, which is essentially

Nicole Perlroth (21:18.700)

an underground market that the one rule is like fight club.

Lex Fridman (21:22.820)

No one talks about fight club.

Nicole Perlroth (21:24.420)

First rule of the zero day market,

Lex Fridman (21:25.920)

nobody talks about the zero day market on both sides

Nicole Perlroth (21:29.200)

because the hacker doesn't wanna lose

Lex Fridman (21:30.900)

their $2.5 million bounty.

Lex Fridman (21:33.900)

And governments roll these into classified programs

Lex Fridman (21:36.840)

and they don't want anyone to know what they have.

Lex Fridman (21:39.160)

So no one talks about this thing.

Lex Fridman (21:41.180)

And when you're operating in the dark like that,

Nicole Perlroth (21:43.820)

it's really easy to put aside your morals sometimes.

Lex Fridman (21:48.500)

Can I, as a small tangent, ask you, by way of advice,

Nicole Perlroth (21:52.020)

you must have done some incredible interviews.

Lex Fridman (21:55.540)

And you've also spoken about how serious

Nicole Perlroth (21:58.280)

you take protecting your sources.

Lex Fridman (22:01.420)

If you were to give me advice for interviewing

Nicole Perlroth (22:04.420)

when you're recording on mic with a video camera,

Lex Fridman (22:10.220)

how is it possible to get into this world?

Lex Fridman (22:13.060)

Like is it basically impossible?

Lex Fridman (22:16.080)

So you've spoken with a few people,

Lex Fridman (22:19.020)

what is it like the godfather of cyber war, cyber security?

Lex Fridman (22:23.300)

So people that are already out.

Lex Fridman (22:25.220)

And they still have to be pretty brave to speak publicly.

Lex Fridman (22:29.820)

But is it virtually impossible to really talk to anybody

Lex Fridman (22:32.700)

who is a current hacker?

Lex Fridman (22:34.580)

Are you always like 10, 20 years behind?

Nicole Perlroth (22:37.700)

It's a good question.

Lex Fridman (22:38.700)

And this is why I'm a print journalist.

Lex Fridman (22:41.900)

But when I've seen people do it,

Lex Fridman (22:45.900)

it's always the guy who's behind the shadows,

Nicole Perlroth (22:49.220)

whose voice has been altered.

Lex Fridman (22:51.780)

When they've gotten someone on camera,

Nicole Perlroth (22:53.380)

that's usually how they do it.

Lex Fridman (22:56.740)

Very, very few people talk in this space.

Lex Fridman (22:58.980)

And there's actually a pretty well known case study

Lex Fridman (23:02.020)

in why you don't talk publicly in this space

Lex Fridman (23:04.420)

and you don't get photographed.

Lex Fridman (23:05.860)

And that's the gruck.

Lex Fridman (23:07.380)

So the gruck is or was this zero day broker,

Lex Fridman (23:12.060)

South African guy, lives in Thailand.

Lex Fridman (23:15.220)

And right when I was starting on this subject

Lex Fridman (23:18.840)

at the New York Times, he'd given an interview to Forbes.

Lex Fridman (23:22.680)

And he talked about being a zero day broker.

Lex Fridman (23:25.540)

And he even posed next to this giant duffel bag

Nicole Perlroth (23:29.140)

filled with cash, ostensibly.

Lex Fridman (23:31.700)

And later he would say he was speaking off the record.

Nicole Perlroth (23:35.460)

He didn't understand the rules of the game.

Lex Fridman (23:38.000)

But what I heard from people who did business with him

Nicole Perlroth (23:41.000)

was that the minute that that story came out,

Lex Fridman (23:43.080)

he became PNG'd.

Nicole Perlroth (23:45.280)

No one did business with him.

Lex Fridman (23:47.540)

His business plummeted by at least half.

Nicole Perlroth (23:50.060)

No one wants to do business with anyone

Lex Fridman (23:52.100)

who's going to get on camera and talk

Nicole Perlroth (23:54.180)

about how they're selling zero days to governments.

Lex Fridman (23:58.180)

It puts you at danger.

Lex Fridman (23:59.700)

And I did hear that he got some visits

Lex Fridman (24:01.620)

from some security folks.

Lex Fridman (24:04.020)

And that's another thing for these people to consider.

Lex Fridman (24:06.940)

If they have those zero day exploits at their disposal,

Nicole Perlroth (24:12.300)

they become a huge target for nation states

Lex Fridman (24:16.400)

all over the world.

Nicole Perlroth (24:18.460)

Talk about having perfect opsec.

Lex Fridman (24:20.780)

You better have some perfect opsec

Nicole Perlroth (24:23.540)

if people know that you have access to those zero day

Lex Fridman (24:26.300)

exploits.

Nicole Perlroth (24:27.860)

Which sucks because, I mean, transparency here

Lex Fridman (24:33.500)

would be really powerful for educating the world

Lex Fridman (24:36.380)

and also inspiring other engineers to do good.

Lex Fridman (24:40.100)

It just feels like when you operate in the shadows,

Nicole Perlroth (24:43.820)

it doesn't help us move in the positive direction in terms

Lex Fridman (24:46.720)

of getting more people on the defense side

Nicole Perlroth (24:48.900)

versus on the attack side.

Lex Fridman (24:50.620)

But of course, what can you do?

Nicole Perlroth (24:52.060)

I mean, the best you can possibly do

Lex Fridman (24:53.660)

is have great journalists, just like you did,

Nicole Perlroth (24:57.060)

interview and write books about it,

Lex Fridman (24:58.900)

and integrate the information you get

Nicole Perlroth (25:01.020)

while hiding the sources.

Lex Fridman (25:02.900)

Yeah, and I think what HackerOne has told me was, OK,

Nicole Perlroth (25:07.860)

let's just put away the people that

Lex Fridman (25:09.340)

are finding and developing zero day exploits all day long.

Nicole Perlroth (25:13.980)

Let's put that aside.

Lex Fridman (25:15.540)

What about however many millions of programmers

Nicole Perlroth (25:19.620)

all over the world who've never even heard of a zero day

Lex Fridman (25:22.340)

exploit?

Lex Fridman (25:23.300)

Why not tap into them and say, hey, we'll

Lex Fridman (25:26.620)

start paying you if you can find a bug in United Airlines

Lex Fridman (25:31.540)

software or in Schneider Electric or in Ford or Tesla?

Lex Fridman (25:36.900)

And I think that is a really smart approach.

Nicole Perlroth (25:39.940)

Let's go find this untapped army of programmers

Lex Fridman (25:43.900)

to neutralize these bugs before the people who will continue

Nicole Perlroth (25:47.780)

to sell these to governments can find them and exploit them.

Lex Fridman (25:50.820)

OK, I have to ask you about this.

Nicole Perlroth (25:53.180)

From a personal side, it's funny enough,

Lex Fridman (25:55.740)

after we agreed to talk, I've gotten,

Nicole Perlroth (25:59.260)

for the first time in my life, was a victim of a cyber attack.

Lex Fridman (26:06.380)

So this is ransomware.

Nicole Perlroth (26:07.500)

It's called Deadbolt.

Lex Fridman (26:08.540)

People can look it up.

Nicole Perlroth (26:10.020)

I have a QNAP device for basically kind

Lex Fridman (26:14.140)

of coldish storage.

Lex Fridman (26:15.580)

So it's about 60 terabytes with 50 terabytes of data on it

Lex Fridman (26:20.300)

in RAID 5.

Lex Fridman (26:21.700)

And apparently, about 4,000 to 5,000 QNAP devices

Lex Fridman (26:27.100)

were hacked and taken over with this ransomware.

Lex Fridman (26:30.660)

And what ransomware does there is it goes file by file,

Lex Fridman (26:35.580)

almost all the files on the QNAP storage device,

Lex Fridman (26:39.060)

and encrypts them.

Lex Fridman (26:40.420)

And then there's this very eloquently and politely

Nicole Perlroth (26:43.660)

written page that pops up, describes what happened.

Lex Fridman (26:48.300)

All your files have been encrypted.

Nicole Perlroth (26:50.020)

This includes but is not limited to photos, documents,

Lex Fridman (26:52.580)

and spreadsheets.

Lex Fridman (26:53.780)

Why me?

Lex Fridman (26:56.180)

This is a lot of people commented

Nicole Perlroth (26:57.940)

about how friendly and eloquent this is.

Lex Fridman (27:00.740)

And I have to commend them.

Nicole Perlroth (27:01.780)

It is, and it's pretty user friendly.

Lex Fridman (27:05.980)

Why me?

Nicole Perlroth (27:06.580)

This is not a personal attack.

Lex Fridman (27:08.060)

You have been targeted because of the inadequate security

Nicole Perlroth (27:10.980)

provided by your vendor, QNAP.

Lex Fridman (27:15.100)

What now?

Nicole Perlroth (27:16.380)

You can make a payment of exactly 0.03 Bitcoin,

Lex Fridman (27:19.780)

which is about $1,000, to the following address.

Nicole Perlroth (27:23.380)

Once the payment has been made, we'll

Lex Fridman (27:25.020)

follow up with transaction to the same address,

Nicole Perlroth (27:27.500)

blah, blah, blah.

Lex Fridman (27:28.580)

They give you instructions of what happens next,

Lex Fridman (27:31.500)

and they'll give you a decryption key

Lex Fridman (27:32.940)

that you can then use.

Lex Fridman (27:34.620)

And then there's another message for QNAP that says,

Lex Fridman (27:38.860)

all your affected customers have been targeted using

Nicole Perlroth (27:41.220)

a zero day vulnerability in your product.

Lex Fridman (27:43.860)

We offer you two options to mitigate this and future damage.

Nicole Perlroth (27:48.380)

One, make a Bitcoin payment of 5 Bitcoin

Lex Fridman (27:51.700)

to the following address, and that

Nicole Perlroth (27:54.260)

will reveal to QNAP the, I'm summarizing things here,

Lex Fridman (27:58.460)

what the actual vulnerability is.

Nicole Perlroth (28:00.180)

Or you can make a Bitcoin payment of 50 Bitcoin

Lex Fridman (28:03.860)

to get a master decryption key for all your customers.

Nicole Perlroth (28:06.980)

50 Bitcoin is about $1.8 million.

Lex Fridman (28:10.260)

OK.

Lex Fridman (28:11.900)

So first of all, on a personal level, this one hurt for me.

Lex Fridman (28:18.100)

There's, I mean, I learned a lot because I wasn't,

Nicole Perlroth (28:22.140)

for the most part, backing up much of that data

Lex Fridman (28:26.980)

because I thought I can afford to lose that data.

Nicole Perlroth (28:30.820)

It's not horrible.

Lex Fridman (28:32.500)

I mean, I think you've spoken about the crown jewels,

Nicole Perlroth (28:35.900)

like making sure there's things you really protect.

Lex Fridman (28:38.380)

And I have, you know, I'm very conscious,

Nicole Perlroth (28:42.380)

security wise, on the crown jewels.

Lex Fridman (28:45.060)

But there's a bunch of stuff, like, you know,

Nicole Perlroth (28:48.060)

personal videos that are not, like,

Lex Fridman (28:49.900)

I don't have anything creepy, but just, like,

Nicole Perlroth (28:51.900)

fun things I did that because they're very large or 4K

Lex Fridman (28:55.420)

or something like that, I kept them on there,

Nicole Perlroth (28:57.340)

thinking RAID 5 will protect it.

Lex Fridman (28:59.700)

You know, just I lost a bunch of stuff, including raw footage

Nicole Perlroth (29:05.100)

from interviews and all that kind of stuff.

Lex Fridman (29:08.300)

So it's painful.

Lex Fridman (29:09.540)

And I'm sure there's a lot of painful stuff

Lex Fridman (29:11.660)

like that for the 4,000 to 5,000 people that use QNAP.

Lex Fridman (29:15.540)

And there's a lot of interesting ethical questions here.

Lex Fridman (29:18.420)

Do you pay them?

Lex Fridman (29:20.620)

Does QNAP pay them?

Lex Fridman (29:23.220)

Do the individuals pay them, especially when

Lex Fridman (29:26.260)

you don't know if it's going to work or not?

Lex Fridman (29:29.020)

Do you wait?

Lex Fridman (29:30.220)

So QNAP said that, please don't pay them.

Lex Fridman (29:35.860)

We're working very hard day and night to solve this.

Nicole Perlroth (29:41.980)

It's so philosophically interesting to me

Lex Fridman (29:44.060)

because I also project onto them thinking,

Lex Fridman (29:46.500)

what is their motivation?

Lex Fridman (29:48.220)

Because the way they phrased it, on purpose, perhaps,

Lex Fridman (29:51.900)

but I'm not sure if that actually reflects their real motivation,

Lex Fridman (29:54.820)

is maybe they're trying to help themselves sleep at night,

Nicole Perlroth (29:59.220)

basically saying, this is not about you.

Lex Fridman (2:00:00.680)

But we're gonna have to come around to this view

Nicole Perlroth (2:00:02.980)

that we're all human.

Lex Fridman (2:00:04.520)

And we're gonna have to be a little bit more forgiving

Lex Fridman (2:00:07.280)

and a little bit more tolerant when people mess up.

Lex Fridman (2:00:10.160)

And we're gonna have to be a little bit more humble

Nicole Perlroth (2:00:12.080)

when we do, and like keep moving forward.

Lex Fridman (2:00:15.600)

Otherwise you can't like cancel everyone, you know?

Nicole Perlroth (2:00:18.640)

Nicole, this is an incredible, hopeful conversation.

Lex Fridman (2:00:21.680)

Also, one that reveals that in the shadows

Nicole Perlroth (2:00:28.000)

there's a lot of challenges to be solved.

Lex Fridman (2:00:30.200)

So I really appreciate that you took on

Nicole Perlroth (2:00:32.320)

this really difficult subject with your book.

Lex Fridman (2:00:34.280)

That's journalism at its best.

Lex Fridman (2:00:35.840)

So I'm really grateful that you took the risk

Lex Fridman (2:00:38.680)

that you took that on,

Lex Fridman (2:00:40.200)

and that you plugged the cable box back in.

Lex Fridman (2:00:42.600)

That means you have hope.

Lex Fridman (2:00:43.800)

And thank you so much for spending

Lex Fridman (2:00:46.560)

your valuable time with me today.

Nicole Perlroth (2:00:47.920)

Thank you, thanks for having me.

Lex Fridman (2:00:49.880)

Thanks for listening to this conversation

Nicole Perlroth (2:00:52.240)

with Nicole Perlroth.

Lex Fridman (2:00:53.680)

To support this podcast,

Nicole Perlroth (2:00:54.920)

please check out our sponsors in the description.

Lex Fridman (2:00:57.720)

And now let me leave you with some words

Nicole Perlroth (2:01:00.080)

from Nicole herself.

Lex Fridman (2:01:01.800)

Here we are, entrusting our entire digital lives,

Nicole Perlroth (2:01:05.640)

passwords, texts, love letters, banking records,

Lex Fridman (2:01:09.040)

health records, credit cards, sources,

Lex Fridman (2:01:10.860)

and deepest thoughts to this mystery box

Lex Fridman (2:01:14.040)

whose inner circuitry most of us would never vet.

Nicole Perlroth (2:01:17.780)

Run by code written in a language most of us

Lex Fridman (2:01:20.740)

will never fully understand.

Nicole Perlroth (2:01:22.400)

Thank you for listening and hope to see you next time.

Lex Fridman (30:01.260)

This is about the company with the vulnerabilities.

Nicole Perlroth (30:04.300)

Just like you mentioned, this is the justification they have.

Lex Fridman (30:07.260)

But they're hurting real people.

Nicole Perlroth (30:09.500)

They hurt me.

Lex Fridman (30:10.460)

But I'm sure there's a few others that are really hurt.

Lex Fridman (30:14.460)

And the zero day factor is a big one.

Lex Fridman (30:18.540)

Their QNAP right now is trying to figure out

Lex Fridman (30:22.260)

what the hell is wrong with their system that would let this in.

Lex Fridman (30:25.500)

And even if they pay, if they still don't know where the zero

Nicole Perlroth (30:30.140)

day is, what's to say that they won't just hit them again

Lex Fridman (30:32.700)

and hit you again?

Lex Fridman (30:34.220)

So that really complicates things.

Lex Fridman (30:36.500)

And that is a huge advancement for ransomware.

Nicole Perlroth (30:40.860)

It's really only been, I think, in the last 18 months

Lex Fridman (30:44.700)

that we've ever really seen ransomware exploit zero days

Nicole Perlroth (30:48.380)

to pull these off.

Lex Fridman (30:49.220)

Usually, 80% of them, I think the data shows 80% of them

Nicole Perlroth (30:54.700)

come down to a lack of two factor authentication.

Lex Fridman (30:58.420)

So when someone gets hit by a ransomware attack,

Nicole Perlroth (31:01.380)

they don't have two factor authentication on.

Lex Fridman (31:04.340)

Their employees were using stupid passwords.

Nicole Perlroth (31:07.580)

You can mitigate that in the future.

Lex Fridman (31:09.660)

This one, they don't know.

Nicole Perlroth (31:10.820)

They probably don't know.

Lex Fridman (31:11.780)

Yeah.

Lex Fridman (31:12.260)

And I guess it's zero click because I

Lex Fridman (31:14.500)

didn't have to do anything.

Nicole Perlroth (31:16.180)

The only thing, well, here's the thing.

Lex Fridman (31:21.780)

I did basics of I put it behind a firewall.

Nicole Perlroth (31:26.180)

I followed instructions.

Lex Fridman (31:27.900)

But I didn't really pay attention.

Lex Fridman (31:30.300)

So maybe there's a misconfiguration of some sort

Lex Fridman (31:34.180)

that's easy to make.

Nicole Perlroth (31:36.220)

It's difficult. We have a personal NAS.

Lex Fridman (31:40.100)

So I'm not willing to say that I did

Nicole Perlroth (31:43.900)

everything I possibly could.

Lex Fridman (31:47.100)

But I did a lot of reasonable stuff.

Lex Fridman (31:49.780)

And they still hit it with zero clicks.

Lex Fridman (31:51.500)

I didn't have to do anything.

Nicole Perlroth (31:52.500)

Yeah, well, it's like a zero day.

Lex Fridman (31:54.100)

And it's a supply chain attack.

Nicole Perlroth (31:56.980)

You're getting hit from your supplier.

Lex Fridman (31:59.220)

You're getting hit because of your vendor.

Lex Fridman (32:01.700)

And it's also a new thing for ransomware groups

Lex Fridman (32:04.260)

to go to the individuals to pressure them to pay.

Nicole Perlroth (32:07.620)

There was this really interesting case.

Lex Fridman (32:09.860)

I think it was in Norway where there was a mental health

Nicole Perlroth (32:13.660)

clinic that got hit.

Lex Fridman (32:16.140)

And the cybercriminals were going to the patients

Nicole Perlroth (32:18.900)

themselves to say, pay this, or we're

Lex Fridman (32:22.020)

going to release your psychiatric records.

Nicole Perlroth (32:25.420)

I mean, talk about hell.

Lex Fridman (32:28.180)

In terms of whether to pay, that is on the cheaper

Nicole Perlroth (32:31.980)

end of the spectrum.

Lex Fridman (32:33.660)

From the individual or from the company?

Nicole Perlroth (32:35.540)

Both.

Lex Fridman (32:36.660)

We've seen, for instance, there was an Apple supplier in Taiwan.

Nicole Perlroth (32:42.980)

They got hit.

Lex Fridman (32:43.940)

And the ransom demand was $50 million.

Nicole Perlroth (32:47.300)

I'm surprised it's only $1.8 million.

Lex Fridman (32:49.420)

I'm sure it's going to go up.

Lex Fridman (32:52.100)

And it's hard.

Lex Fridman (32:53.300)

There's obviously governments, and maybe in this case,

Nicole Perlroth (32:57.060)

the company are going to tell you,

Lex Fridman (32:58.860)

we recommend you don't pay or please don't pay.

Lex Fridman (33:02.060)

But the reality on the ground is that some businesses

Lex Fridman (33:06.300)

can't operate.

Nicole Perlroth (33:07.940)

Some countries can't function.

Lex Fridman (33:09.620)

I mean, the underreported storyline of Colonial Pipeline

Nicole Perlroth (33:15.860)

was after the company got hit and took

Lex Fridman (33:19.740)

the preemptive step of shutting down the pipeline

Nicole Perlroth (33:22.140)

because their billing systems were frozen,

Lex Fridman (33:24.180)

they couldn't charge customers downstream.

Nicole Perlroth (33:27.500)

My colleague David Zanger and I got our hands

Lex Fridman (33:30.140)

on a classified assessment that said that as a country,

Nicole Perlroth (33:35.740)

we could have only afforded two to three more days

Lex Fridman (33:38.500)

of Colonial Pipeline being down.

Lex Fridman (33:40.620)

And it was really interesting.

Lex Fridman (33:42.020)

I thought it was the gas and the jet fuel, but it wasn't.

Nicole Perlroth (33:45.660)

We were sort of prepared for that.

Lex Fridman (33:47.420)

It was the diesel.

Nicole Perlroth (33:48.980)

Without the diesel, the refineries couldn't function,

Lex Fridman (33:52.220)

and it would have totally screwed up the economy.

Lex Fridman (33:54.900)

And so there was almost this national security

Lex Fridman (33:59.500)

economic impetus for them to pay this ransom.

Lex Fridman (34:04.500)

And the other one I always think about is Baltimore.

Lex Fridman (34:07.180)

When the city of Baltimore got hit,

Nicole Perlroth (34:09.060)

I think the initial ransom demand

Lex Fridman (34:11.420)

was something around $76,000.

Nicole Perlroth (34:13.860)

It may have even started smaller than that.

Lex Fridman (34:16.820)

And Baltimore stood its ground and didn't pay.

Lex Fridman (34:20.020)

But ultimately, the cost to remediate was $18 million.

Lex Fridman (34:25.140)

That's a lot for the city of Baltimore.

Nicole Perlroth (34:26.780)

That's money that could have gone to public school education

Lex Fridman (34:29.620)

and roads and public health.

Lex Fridman (34:32.500)

And instead, it just went to rebuilding these systems

Lex Fridman (34:35.740)

from scratch.

Lex Fridman (34:36.340)

And so a lot of residents in Baltimore

Lex Fridman (34:38.820)

were like, why the hell didn't you pay the $76,000?

Lex Fridman (34:43.540)

So it's not obvious.

Lex Fridman (34:46.020)

It's easy to say, don't pay.

Lex Fridman (34:48.140)

Because why?

Lex Fridman (34:48.740)

You're funding their R&D for the next go round.

Lex Fridman (34:52.940)

But it's too often, it's too complicated.

Lex Fridman (34:56.980)

So on the individual level, just like the way

Nicole Perlroth (35:00.460)

I feel personally from this attack,

Lex Fridman (35:03.300)

have you talked to people that were kind of victims

Nicole Perlroth (35:05.300)

in the same way I was, but maybe more dramatic ways or so on,

Lex Fridman (35:09.700)

in the same way that violence hurts people?

Lex Fridman (35:13.340)

How much does this hurt people in your sense

Lex Fridman (35:15.260)

and the way you researched it?

Nicole Perlroth (35:16.700)

The worst ransomware attack I've covered on a personal level

Lex Fridman (35:23.060)

was an attack on a hospital in Vermont.

Lex Fridman (35:28.020)

And you think of this as like, OK,

Lex Fridman (35:30.420)

it's hitting their IT networks.

Nicole Perlroth (35:31.780)

They should still be able to treat patients.

Lex Fridman (35:34.660)

But it turns out that cancer patients

Nicole Perlroth (35:37.380)

couldn't get their chemo anymore.

Lex Fridman (35:39.260)

Because the protocol of who gets what is very complicated.

Lex Fridman (35:43.020)

And without it, nurses and doctors couldn't access it.

Lex Fridman (35:47.100)

So they were turning chemo patients away,

Nicole Perlroth (35:50.500)

cancer patients away.

Lex Fridman (35:52.180)

One nurse told us, I don't know why people

Nicole Perlroth (35:55.660)

aren't screaming about this, that the only thing I've

Lex Fridman (35:58.380)

seen that even compares to what we're

Nicole Perlroth (36:00.100)

seeing at this hospital right now

Lex Fridman (36:02.060)

was when I worked in the burn unit

Nicole Perlroth (36:04.460)

after the Boston Marathon bombing.

Lex Fridman (36:06.980)

They really put it in these super dramatic terms.

Lex Fridman (36:10.540)

And last year there was a report in the Wall Street Journal

Lex Fridman (36:15.020)

where they attributed an infant death to a ransomware attack

Nicole Perlroth (36:20.700)

because a mom came in and whatever device

Lex Fridman (36:25.220)

they were using to monitor the fetus

Nicole Perlroth (36:28.460)

wasn't working because of the ransomware attack.

Lex Fridman (36:30.780)

And so they attributed this infant death

Nicole Perlroth (36:33.580)

to the ransomware attack.

Lex Fridman (36:34.660)

Now on a bigger scale but less personal,

Nicole Perlroth (36:39.100)

when there was the NotPetya attack.

Lex Fridman (36:41.300)

So this was an attack by Russia on Ukraine

Nicole Perlroth (36:46.980)

that came at them through a supplier, a tax software

Lex Fridman (36:51.420)

company in that case, that didn't just

Nicole Perlroth (36:53.860)

hit any government agency or business in Ukraine

Lex Fridman (36:57.820)

that used this tax software.

Nicole Perlroth (36:59.660)

It actually hit any business all over the world that

Lex Fridman (37:02.780)

had even a single employee working remotely in Ukraine.

Lex Fridman (37:07.340)

So it hit Maersk, the shipping company, hit Pfizer,

Lex Fridman (37:10.980)

hit FedEx, but the one I will never forget is Merck.

Nicole Perlroth (37:14.580)

It paralyzed Merck's factories.

Lex Fridman (37:17.740)

I mean, it really created an existential crisis

Nicole Perlroth (37:20.260)

for the company.

Lex Fridman (37:21.620)

Merck had to tap into the CDC's emergency supplies

Nicole Perlroth (37:25.380)

of the Gardasil vaccine that year

Lex Fridman (37:27.780)

because their whole vaccine production line had been

Nicole Perlroth (37:30.220)

paralyzed in that attack.

Lex Fridman (37:32.140)

Imagine if that was going to happen right now

Nicole Perlroth (37:36.020)

to Pfizer or Moderna or Johnson and Johnson.

Lex Fridman (37:39.820)

Imagine.

Nicole Perlroth (37:41.220)

I mean, that would really create a global cyber terrorist

Lex Fridman (37:46.100)

attack, essentially.

Lex Fridman (37:47.260)

And that's almost unintentional.

Lex Fridman (37:49.340)

I thought for a long time, I always

Nicole Perlroth (37:51.740)

labeled it as collateral damage.

Lex Fridman (37:54.860)

But actually, just today, there was a really impressive threat

Nicole Perlroth (37:59.780)

researcher at Cisco, which has this threat intelligence

Lex Fridman (38:04.260)

division called Talos, who said, stop calling it

Nicole Perlroth (38:07.220)

collateral damage.

Lex Fridman (38:08.940)

They could see who was going to get hit before they

Nicole Perlroth (38:12.900)

deployed that malware.

Lex Fridman (38:15.580)

It wasn't collateral damage.

Nicole Perlroth (38:17.940)

It was intentional.

Lex Fridman (38:19.060)

They meant to hit any business that did business with Ukraine.

Nicole Perlroth (38:23.180)

It was to send a message to them, too.

Lex Fridman (38:26.300)

So I don't know if that's accurate.

Nicole Perlroth (38:28.660)

I always thought of it as sort of the sloppy collateral

Lex Fridman (38:31.500)

damage, but it definitely made me think.

Lex Fridman (38:34.820)

So how much of this between states

Lex Fridman (38:37.020)

is going to be a part of war, these kinds of attacks

Nicole Perlroth (38:42.980)

on Ukraine between Russia and US, Russia and China,

Lex Fridman (38:48.700)

China and US?

Nicole Perlroth (38:51.100)

Let's look at China and US.

Lex Fridman (38:53.260)

Do you think China and US are going

Nicole Perlroth (38:56.860)

to escalate something that would be called a war purely

Lex Fridman (39:01.740)

in the space of cyber?

Nicole Perlroth (39:04.260)

I believe any geopolitical conflict from now on

Lex Fridman (39:12.260)

is guaranteed to have some cyber element to it.

Nicole Perlroth (39:17.260)

The Department of Justice recently

Lex Fridman (39:19.180)

declassified a report that said China has been hacking

Nicole Perlroth (39:21.740)

into our pipelines, and it's not for intellectual property

Lex Fridman (39:24.340)

theft.

Nicole Perlroth (39:25.300)

It's to get a foothold so that if things escalate in Taiwan,

Lex Fridman (39:29.180)

for example, they are where they need

Nicole Perlroth (39:31.460)

to be to shut our pipelines down.

Lex Fridman (39:33.260)

And we just got a little glimpse of what

Nicole Perlroth (39:35.260)

that looked like with Colonial Pipeline and the panic buying

Lex Fridman (39:39.340)

and the jet fuel shortages and that assessment I just

Nicole Perlroth (39:42.460)

mentioned about the diesel.

Lex Fridman (39:44.580)

So they're there.

Nicole Perlroth (39:47.180)

They've gotten there.

Lex Fridman (39:49.260)

Anytime I read a report about new aggression from fighter

Nicole Perlroth (39:54.260)

jets, Chinese fighter jets in Taiwan,

Lex Fridman (39:57.020)

or what's happening right now with Russia's buildup

Nicole Perlroth (40:00.580)

on the Ukraine border, or India, Pakistan,

Lex Fridman (40:04.540)

I'm always looking at it through a cyber lens.

Lex Fridman (40:07.420)

And it really bothers me that other people aren't,

Lex Fridman (40:11.420)

because there is no way that these governments

Lex Fridman (40:15.500)

and these nation states are not going

Lex Fridman (40:17.780)

to use their access to gain some advantage in those conflicts.

Lex Fridman (40:23.660)

And I'm now in a position where I'm

Lex Fridman (40:27.780)

an advisor to the Cybersecurity Infrastructure Security

Nicole Perlroth (40:32.180)

Agency at DHS.

Lex Fridman (40:33.740)

So I'm not saying anything classified here.

Lex Fridman (40:37.500)

But I just think that it's really important

Lex Fridman (40:41.140)

to understand just generally what the collateral damage

Nicole Perlroth (40:45.980)

could be for American businesses and critical infrastructure

Lex Fridman (40:49.900)

in any of these escalated conflicts around the world.

Nicole Perlroth (40:54.020)

Because just generally, our adversaries

Lex Fridman (40:57.860)

have learned that they might never

Nicole Perlroth (41:01.300)

be able to match us in terms of our traditional military

Lex Fridman (41:04.620)

spending on traditional weapons and fighter jets.

Lex Fridman (41:08.020)

But we have a very soft underbelly

Lex Fridman (41:10.820)

when it comes to cyber.

Nicole Perlroth (41:12.860)

80% or more of America's critical infrastructure,

Lex Fridman (41:17.380)

so pipelines, power grid, nuclear plants, water systems,

Nicole Perlroth (41:23.460)

is owned and operated by the private sector.

Lex Fridman (41:26.740)

And for the most part, there is nothing out there legislating

Nicole Perlroth (41:31.540)

that those companies share the fact they've been breached.

Lex Fridman (41:35.660)

They don't even have to tell the government they've been hit.

Nicole Perlroth (41:38.660)

There's nothing mandating that they even

Lex Fridman (41:40.460)

meet a bare minimum standard of cybersecurity.

Lex Fridman (41:44.740)

And that's it.

Lex Fridman (41:46.620)

So even when there are these attacks, most of the time,

Nicole Perlroth (41:49.380)

we don't even know about it.

Lex Fridman (41:51.380)

So that is, if you were going to design a system

Nicole Perlroth (41:54.260)

to be as blind and vulnerable as possible,

Lex Fridman (41:57.940)

that's pretty good.

Nicole Perlroth (42:00.580)

That's what it looks like is what we have here

Lex Fridman (42:02.620)

in the United States.

Lex Fridman (42:04.340)

And everyone here is just operating like,

Lex Fridman (42:08.340)

let's just keep hooking up everything for convenience.

Nicole Perlroth (42:12.140)

Software eats the world.

Lex Fridman (42:14.740)

Let's just keep going for cost, for convenience sake,

Nicole Perlroth (42:18.580)

just because we can.

Lex Fridman (42:20.660)

And when you study these issues and you study these attacks

Lex Fridman (42:24.340)

and you study the advancement and the uptick in frequency

Lex Fridman (42:29.340)

and the lower barrier to entry that we see every single year,

Nicole Perlroth (42:34.660)

you realize just how dumb software eats world is.

Lex Fridman (42:39.740)

And no one has ever stopped to pause and think,

Lex Fridman (42:43.100)

should we be hooking up these systems to the internet?

Lex Fridman (42:47.940)

They've just been saying, can we?

Nicole Perlroth (42:49.700)

Let's do it.

Lex Fridman (42:51.140)

And that's a real problem.

Lex Fridman (42:52.460)

And just in the last year, we've seen a record number

Lex Fridman (42:55.740)

of zero day attacks.

Nicole Perlroth (42:56.860)

I think there were 80 last year, which

Lex Fridman (42:59.220)

is probably more than double what it was in 2019.

Nicole Perlroth (43:03.140)

A lot of those were nation states.

Lex Fridman (43:06.940)

We live in a world with a lot of geopolitical hot points

Nicole Perlroth (43:10.300)

right now.

Lex Fridman (43:11.500)

And where those geopolitical hot points are

Nicole Perlroth (43:15.060)

are places where countries have been investing heavily

Lex Fridman (43:19.060)

in offensive cyber tools.

Nicole Perlroth (43:21.660)

If you're a nation state, the goal

Lex Fridman (43:25.300)

would be to maximize the footprint of zero day,

Nicole Perlroth (43:29.380)

like super secret zero day that nobody is aware of.

Lex Fridman (43:33.260)

And whenever war is initiated, the huge negative effects

Nicole Perlroth (43:37.420)

of shutting down infrastructure or any kind of zero day

Lex Fridman (43:39.900)

is the chaos it creates.

Lex Fridman (43:41.780)

So if you just, there's a certain threshold

Lex Fridman (43:43.540)

when you create the chaos.

Nicole Perlroth (43:45.260)

The market's plummeted.

Lex Fridman (43:46.460)

Just everything goes to hell.

Nicole Perlroth (43:51.020)

I mean, it's not just zero days.

Lex Fridman (43:52.860)

We make it so easy for threat actors.

Nicole Perlroth (43:56.660)

I mean, we're not using two factor authentication.

Lex Fridman (44:00.420)

We're not patching.

Nicole Perlroth (44:02.700)

There was the shell shock vulnerability

Lex Fridman (44:04.860)

that was discovered a couple of years ago.

Nicole Perlroth (44:08.220)

It's still being exploited because so many people

Lex Fridman (44:11.220)

haven't fixed it.

Lex Fridman (44:13.900)

So the zero days are really the sexy stuff.

Lex Fridman (44:17.060)

And what really drew me to the zero day market

Nicole Perlroth (44:19.700)

was the moral calculus we talked about, particularly

Lex Fridman (44:24.460)

from the US government's point of view.

Lex Fridman (44:26.740)

How do they justify leaving these systems so vulnerable

Lex Fridman (44:31.980)

when we use them here and we're baking

Nicole Perlroth (44:34.940)

more of our critical infrastructure

Lex Fridman (44:36.580)

with this vulnerable software?

Nicole Perlroth (44:38.620)

It's not like we're using one set of technology

Lex Fridman (44:41.580)

and Russia is using another and China is using this.

Nicole Perlroth (44:43.740)

We're all using the same technology.

Lex Fridman (44:45.980)

So when you find a zero day in Windows,

Nicole Perlroth (44:49.020)

you're not just leaving it open so you can spy on Russia

Lex Fridman (44:52.340)

or implant yourself in the Russian grid.

Nicole Perlroth (44:54.540)

You're leaving Americans vulnerable too.

Lex Fridman (44:58.820)

But zero days are like, that is the secret sauce.

Nicole Perlroth (45:02.180)

That's the superpower.

Lex Fridman (45:04.980)

And I always say every country now,

Nicole Perlroth (45:07.900)

with the exception of Antarctica,

Lex Fridman (45:09.380)

someone added the Vatican to my list,

Nicole Perlroth (45:11.900)

is trying to find offensive hacking tools and zero days

Lex Fridman (45:16.700)

to make them work.

Lex Fridman (45:17.500)

And those that don't have the skills

Lex Fridman (45:20.620)

now have this market that they can tap into,

Nicole Perlroth (45:23.460)

where $2.5 million, that's chump change

Lex Fridman (45:26.380)

for a lot of these nation states.

Nicole Perlroth (45:27.900)

It's a hell of a lot less than trying

Lex Fridman (45:29.820)

to build the next fighter jet.

Lex Fridman (45:32.940)

But yeah, the goal is chaos.

Lex Fridman (45:34.460)

I mean, why did Russia turn off the lights twice in Ukraine?

Nicole Perlroth (45:39.620)

I think part of it is chaos.

Lex Fridman (45:42.700)

I think part of it is to sow the seeds of doubt

Nicole Perlroth (45:46.220)

in their current government.

Lex Fridman (45:47.920)

Your government can't even keep your lights on.

Lex Fridman (45:50.380)

Why are you sticking with them?

Lex Fridman (45:52.760)

Come over here and we'll keep your lights on at least.

Nicole Perlroth (45:56.340)

There's like a little bit of that.

Lex Fridman (45:58.300)

Nuclear weapons seems to have helped prevent nuclear war.

Nicole Perlroth (46:04.620)

Is it possible that we have so many vulnerabilities

Lex Fridman (46:08.260)

and so many attack vectors on each other

Nicole Perlroth (46:11.260)

that you will kind of achieve the same kind of equilibrium

Lex Fridman (46:15.220)

like mutually shared destruction?

Nicole Perlroth (46:17.740)

Yeah.

Lex Fridman (46:18.700)

That's one hopeful solution to this.

Lex Fridman (46:20.700)

Do you have any hope for this particular solution?

Lex Fridman (46:23.760)

You know, nuclear analogies always tend to fall apart

Nicole Perlroth (46:26.480)

when it comes to cyber,

Lex Fridman (46:27.500)

mainly because you don't need fissile material.

Nicole Perlroth (46:30.940)

You know, you just need a laptop and the skills

Lex Fridman (46:33.260)

and you're in the game.

Lex Fridman (46:34.580)

So it's a really low barrier to entry.

Lex Fridman (46:38.180)

The other thing is attribution is harder.

Lex Fridman (46:40.900)

And we've seen countries muck around with attribution.

Lex Fridman (46:44.260)

We've seen, you know, nation states piggyback

Nicole Perlroth (46:47.100)

on other countries spy operations and just sit there

Lex Fridman (46:50.020)

and siphon out whatever they're getting.

Nicole Perlroth (46:53.340)

We learned some of that from the Snowden documents.

Lex Fridman (46:56.120)

We've seen Russia hack into Iran's command

Lex Fridman (46:58.860)

and control attack servers.

Lex Fridman (47:01.340)

We've seen them hit a Saudi petrochemical plant

Nicole Perlroth (47:05.380)

where they did neutralize the safety locks at the plant

Lex Fridman (47:08.140)

and everyone assumed that it was Iran,

Nicole Perlroth (47:10.120)

given Iran had been targeting Saudi oil companies forever.

Lex Fridman (47:13.600)

But nope, it turned out that it was

Nicole Perlroth (47:15.180)

a graduate research institute outside Moscow.

Lex Fridman (47:17.720)

So you see countries kind of playing around

Nicole Perlroth (47:20.220)

with attribution.

Lex Fridman (47:21.060)

Why?

Nicole Perlroth (47:22.220)

I think because they think, okay, if I do this,

Lex Fridman (47:25.340)

like how am I gonna cover up that it came from me

Nicole Perlroth (47:27.760)

because I don't wanna risk the response.

Lex Fridman (47:30.840)

So people are sort of dancing around this.

Nicole Perlroth (47:33.140)

It's just in a very different way.

Lex Fridman (47:34.940)

And, you know, at the times I'd covered the Chinese hacks

Nicole Perlroth (47:39.580)

of infrastructure companies like pipelines.

Lex Fridman (47:42.820)

I'd covered the Russian probes of nuclear plants.

Nicole Perlroth (47:46.100)

I'd covered the Russian attacks on the Ukraine grid.

Lex Fridman (47:50.060)

And then in 2018, my colleague David Sanger and I

Nicole Perlroth (47:53.820)

covered the fact that US Cyber Command

Lex Fridman (47:57.100)

had been hacking into the Russian grid

Lex Fridman (47:59.580)

and making a pretty loud show of it.

Lex Fridman (48:02.180)

And when we went to the National Security Council,

Nicole Perlroth (48:05.220)

because that's what journalists do

Lex Fridman (48:06.780)

before they publish a story,

Nicole Perlroth (48:08.080)

they give the other side a chance to respond,

Lex Fridman (48:11.380)

I assumed we would be in for that really awkward,

Nicole Perlroth (48:14.460)

painful conversation where they would say,

Lex Fridman (48:17.060)

you will have blood on your hands if you publish this story.

Lex Fridman (48:20.260)

And instead they gave us the opposite answer.

Lex Fridman (48:22.940)

They said, we have no problem

Nicole Perlroth (48:25.100)

with you publishing this story.

Lex Fridman (48:27.140)

Why?

Nicole Perlroth (48:28.020)

Well, they didn't say it out loud,

Lex Fridman (48:29.340)

but it was pretty obvious they wanted Russia to know

Nicole Perlroth (48:33.120)

that we're hacking into their power grid too,

Lex Fridman (48:35.300)

and they better think twice before they do to us

Lex Fridman (48:38.420)

what they had done to Ukraine.

Lex Fridman (48:40.180)

So yeah, you know, we have stumbled into this new era

Nicole Perlroth (48:44.620)

of mutually assured digital destruction.

Lex Fridman (48:47.740)

I think another sort of quasi norm we've stumbled into

Nicole Perlroth (48:54.500)

is proportional responses.

Lex Fridman (48:57.660)

There's this idea that if you get hit,

Nicole Perlroth (49:00.540)

you're allowed to respond proportionally

Lex Fridman (49:03.480)

at a time and place of your choosing.

Nicole Perlroth (49:05.780)

That is how the language always goes.

Lex Fridman (49:08.420)

That's what Obama said after North Korea hit Sony.

Nicole Perlroth (49:12.880)

We will respond at a time and place of our choosing.

Lex Fridman (49:15.640)

But no one really knows like what that response looks like.

Lex Fridman (49:21.100)

And so what you see a lot of the time

Lex Fridman (49:22.740)

are just these like, just short of war attacks.

Nicole Perlroth (49:27.140)

You know, Russia turned off the power in Ukraine,

Lex Fridman (49:29.300)

but it wasn't like it stayed off for a week.

Nicole Perlroth (49:31.840)

You know, it stayed off for a number of hours.

Lex Fridman (49:34.800)

You know, NotPetya hit those companies pretty hard,

Lex Fridman (49:39.620)

but no one died, you know?

Lex Fridman (49:41.340)

And the question is, what's gonna happen when someone dies?

Lex Fridman (49:44.520)

And can a nation state masquerade as a cyber criminal group,

Lex Fridman (49:49.780)

as a ransomware group?

Lex Fridman (49:51.580)

And that's what really complicates

Lex Fridman (49:53.500)

coming to some sort of digital Geneva convention.

Nicole Perlroth (49:57.140)

Like there's been a push from Brad Smith at Microsoft.

Lex Fridman (50:01.140)

We need a digital Geneva convention.

Lex Fridman (50:03.660)

And on its face, it sounds like a no brainer.

Lex Fridman (50:06.060)

Yeah, why wouldn't we all agree to stop hacking

Nicole Perlroth (50:08.880)

into each other's civilian hospital systems,

Lex Fridman (50:11.140)

elections, power grid, pipelines?

Lex Fridman (50:15.580)

But when you talk to people in the West,

Lex Fridman (50:19.780)

officials in the West, they'll say, we would never,

Nicole Perlroth (50:22.460)

we'd love to agree to it, but we'd never do it

Lex Fridman (50:25.540)

when you're dealing with Xi or Putin or Kim Jong Un.

Nicole Perlroth (50:30.580)

Because a lot of times, they outsource these operations

Lex Fridman (50:35.280)

to cyber criminals.

Nicole Perlroth (50:37.100)

In China, we see a lot of these attacks

Lex Fridman (50:39.120)

come from this loose satellite network of private citizens

Nicole Perlroth (50:43.100)

that work at the behest of the Ministry of State Security.

Lex Fridman (50:46.720)

So how do you come to some sort of state to state agreement

Nicole Perlroth (50:51.380)

when you're dealing with transnational actors

Lex Fridman (50:55.740)

and cyber criminals, where it's really hard to pin down

Nicole Perlroth (50:59.180)

whether that person was acting alone

Lex Fridman (51:01.700)

or whether they were acting at the behest of the MSS

Nicole Perlroth (51:05.020)

or the FSB.

Lex Fridman (51:06.600)

And a couple of years ago, I remember,

Nicole Perlroth (51:09.480)

can't remember if it was before or after NotPetya,

Lex Fridman (51:11.780)

but Putin said, hackers are like artists

Nicole Perlroth (51:14.780)

who wake up in the morning in a good mood and start painting.

Lex Fridman (51:18.140)

In other words, I have no say over what they do or don't do.

Lex Fridman (51:21.420)

So how do you come to some kind of norm

Lex Fridman (51:24.340)

when that's how he's talking about these issues

Lex Fridman (51:26.940)

and he's just decimated Merck and Pfizer

Lex Fridman (51:30.180)

and another however many thousand companies?

Nicole Perlroth (51:34.220)

That is the fundamental difference between nuclear weapons

Lex Fridman (51:37.620)

and cyber attacks is the attribution

Nicole Perlroth (51:40.420)

or one of the fundamental differences.

Lex Fridman (51:42.580)

If you can fix one thing in the world

Nicole Perlroth (51:45.220)

in terms of cybersecurity

Lex Fridman (51:47.220)

that would make the world a better place,

Lex Fridman (51:48.980)

what would you fix?

Lex Fridman (51:51.160)

So you're not allowed to fix like authoritarian regimes

Lex Fridman (51:54.140)

and you can't.

Lex Fridman (51:55.460)

You have to keep that,

Nicole Perlroth (51:57.980)

you have to keep human nature as it is.

Lex Fridman (52:00.620)

In terms of on the security side, technologically speaking,

Nicole Perlroth (52:05.100)

you mentioned there's no regulation

Lex Fridman (52:06.540)

on companies in United States.

Lex Fridman (52:10.020)

What if you could just fix with the snap of a finger,

Lex Fridman (52:14.860)

what would you fix?

Nicole Perlroth (52:15.740)

Two factor authentication, multifactor authentication.

Lex Fridman (52:19.840)

It's ridiculous how many of these attacks come in

Nicole Perlroth (52:24.780)

because someone didn't turn on multifactor authentication.

Lex Fridman (52:27.640)

I mean, Colonial Pipeline, okay?

Nicole Perlroth (52:30.740)

They took down the biggest conduit

Lex Fridman (52:34.300)

for gas, jet fuel and diesel

Lex Fridman (52:35.860)

to the East Coast of the United States of America, how?

Lex Fridman (52:39.180)

Because they forgot to deactivate an old employee account

Nicole Perlroth (52:42.180)

whose password had been traded on the dark web

Lex Fridman (52:44.700)

and they'd never turned on two factor authentication.

Nicole Perlroth (52:48.020)

This water treatment facility outside Florida

Lex Fridman (52:50.140)

was hacked last year.

Lex Fridman (52:51.700)

How did it happen?

Lex Fridman (52:53.220)

They were using Windows XP from like a decade ago

Nicole Perlroth (52:56.500)

that can't even get patches if you want it to

Lex Fridman (52:59.300)

and they didn't have two factor authentication.

Nicole Perlroth (53:01.700)

Time and time again,

Lex Fridman (53:02.700)

if they just switched on two factor authentication,

Nicole Perlroth (53:06.740)

some of these attacks wouldn't have been possible.

Lex Fridman (53:08.340)

Now, if I could snap my fingers,

Nicole Perlroth (53:10.080)

that's the thing I would do right now.

Lex Fridman (53:11.780)

But of course, this is a cat and mouse game

Lex Fridman (53:15.100)

and then the attackers onto the next thing.

Lex Fridman (53:17.560)

But I think right now that is like bar none.

Nicole Perlroth (53:21.700)

That is just, that is the easiest, simplest way

Lex Fridman (53:24.660)

to deflect the most attacks.

Lex Fridman (53:25.900)

And the name of the game right now isn't perfect security.

Lex Fridman (53:29.780)

Perfect security is impossible.

Nicole Perlroth (53:32.220)

They will always find a way in.

Lex Fridman (53:34.340)

The name of the game right now

Nicole Perlroth (53:35.460)

is make yourself a little bit harder to attack

Lex Fridman (53:39.060)

than your competitor than anyone else out there

Lex Fridman (53:41.480)

so that they just give up and move along.

Lex Fridman (53:44.320)

And maybe if you are a target

Nicole Perlroth (53:46.540)

for an advanced nation state or the SVR,

Lex Fridman (53:51.500)

you're gonna get hacked no matter what.

Lex Fridman (53:53.860)

But you can make cyber criminal groups deadbolt, is it?

Lex Fridman (53:57.740)

You can make their jobs a lot harder

Nicole Perlroth (54:00.780)

simply by doing the bare basics.

Lex Fridman (54:03.180)

And the other thing is stop reusing your passwords.

Lex Fridman (54:05.260)

But if I only get one, then two factor authentication.

Lex Fridman (54:08.060)

So what is two factor authentication?

Nicole Perlroth (54:10.460)

Factor one is what, logging in with a password.

Lex Fridman (54:13.260)

And factor two is like have another device

Nicole Perlroth (54:15.900)

or another channel through which you can confirm,

Lex Fridman (54:18.420)

yeah, that's me.

Nicole Perlroth (54:19.500)

Yes, usually this happens through some kind of text.

Lex Fridman (54:23.700)

You get your one time code from Bank of America

Nicole Perlroth (54:26.740)

or from Google.

Lex Fridman (54:28.700)

The better way to do it is spend $20

Nicole Perlroth (54:31.460)

buying yourself a Fido key on Amazon.

Lex Fridman (54:34.260)

That's a hardware device.

Lex Fridman (54:36.100)

And if you don't have that hardware device with you,

Lex Fridman (54:39.500)

then you're not gonna get in.

Lex Fridman (54:41.300)

And the whole goal is, I mean, basically,

Lex Fridman (54:43.820)

my first half of my decade at The Times

Nicole Perlroth (54:46.060)

was spent covering like the copy.

Lex Fridman (54:49.100)

It was like Home Depot got breached,

Nicole Perlroth (54:51.380)

News at 11, Target, Neumann Marcus,

Lex Fridman (54:54.420)

like who wasn't hacked over the course of those five years?

Lex Fridman (54:58.420)

And a lot of those companies that got hacked,

Lex Fridman (55:01.100)

what did hackers take?

Nicole Perlroth (55:02.220)

They took the credentials, they took the passwords.

Lex Fridman (55:05.500)

They can make a pretty penny selling them on the dark web

Lex Fridman (55:08.820)

and people reuse their passwords.

Lex Fridman (55:11.540)

So you get one from God knows who, I don't know,

Nicole Perlroth (55:15.580)

LastPass, worst case example, actually LastPass.

Lex Fridman (55:19.340)

But you get one and then you go test it

Nicole Perlroth (55:21.860)

on their email account.

Lex Fridman (55:23.420)

And you go test it on their brokerage account

Lex Fridman (55:25.580)

and you test it on their cold storage account.

Lex Fridman (55:28.620)

That's how it works.

Lex Fridman (55:29.580)

But if you have multi factor authentication,

Lex Fridman (55:32.900)

then they can't get in

Nicole Perlroth (55:34.500)

because they might have your password,

Lex Fridman (55:36.740)

but they don't have your phone,

Nicole Perlroth (55:38.060)

they don't have your Fido key.

Lex Fridman (55:41.180)

So you keep them out.

Lex Fridman (55:42.700)

And I get a lot of alerts that tell me

Lex Fridman (55:46.540)

someone is trying to get into your Instagram account

Nicole Perlroth (55:49.820)

or your Twitter account or your email account.

Lex Fridman (55:52.060)

And I don't worry because I use multi factor authentication.

Nicole Perlroth (55:55.820)

They can try all day.

Lex Fridman (55:58.380)

Okay, I worry a little bit, but it's the simplest thing to do

Lex Fridman (56:03.820)

and we don't even do it.

Lex Fridman (56:05.060)

Well, there's an interface aspect to it

Nicole Perlroth (56:06.860)

because it's pretty annoying if it's implemented poorly.

Lex Fridman (56:11.420)

So actually bad implementation

Nicole Perlroth (56:13.060)

of two factor authentication, not just bad,

Lex Fridman (56:16.420)

but just something that adds friction

Nicole Perlroth (56:19.060)

is a security vulnerability, I guess,

Lex Fridman (56:21.380)

because it's really annoying.

Nicole Perlroth (56:23.500)

Like I think MIT for a while had two factor authentication.

Lex Fridman (56:27.620)

It was really annoying.

Nicole Perlroth (56:28.580)

I just, like the number of times it pings you,

Lex Fridman (56:33.020)

like it asks to reauthenticate across multiple subdomains.

Nicole Perlroth (56:39.300)

Like it just feels like a pain.

Lex Fridman (56:42.780)

I don't know what the right balance there.

Nicole Perlroth (56:44.140)

Yeah, it feels like friction in our frictionless society.

Lex Fridman (56:48.700)

It feels like friction, it's annoying.

Nicole Perlroth (56:51.060)

That's security's biggest problem, it's annoying.

Lex Fridman (56:54.540)

We need the Steve Jobs of security to come along

Lex Fridman (56:57.900)

and we need to make it painless.

Lex Fridman (56:59.620)

And actually on that point,

Nicole Perlroth (57:02.100)

Apple has probably done more for security than anyone else

Lex Fridman (57:07.340)

simply by introducing biometric authentication,

Nicole Perlroth (57:10.900)

first with the fingerprint and then with face ID.

Lex Fridman (57:13.660)

And it's not perfect, but if you think just eight years ago,

Nicole Perlroth (57:17.460)

everyone was running around with either no passcode

Lex Fridman (57:20.420)

and optional passcode or four digit passcode on their phone

Nicole Perlroth (57:23.580)

that anyone, think of what you can get

Lex Fridman (57:26.140)

when you get someone's iPhone, if you steal someone's iPhone

Lex Fridman (57:29.100)

and props to them for introducing the fingerprint

Lex Fridman (57:32.620)

and face ID.

Lex Fridman (57:33.660)

And again, it wasn't perfect, but it was a huge step forward.

Lex Fridman (57:36.980)

Now it's time to make another huge step forward.

Nicole Perlroth (57:41.140)

I wanna see the password die.

Lex Fridman (57:42.900)

I mean, it's gotten us as far as it was ever gonna get us.

Lex Fridman (57:46.900)

And I hope whatever we come up with next

Lex Fridman (57:49.580)

is not gonna be annoying, is gonna be seamless.

Nicole Perlroth (57:52.380)

When I was at Google, that's what we worked on is,

Lex Fridman (57:55.060)

and there's a lot of ways to call it

Nicole Perlroth (57:57.060)

active authentication, passive authentication.

Lex Fridman (57:59.900)

So basically you use biometric data,

Nicole Perlroth (58:02.500)

not just like a fingerprint, but everything from your body

Lex Fridman (58:05.980)

to identify who you are, like movement patterns.

Lex Fridman (58:09.140)

So it basically create a lot of layers of protection

Lex Fridman (58:12.700)

where it's very difficult to fake,

Nicole Perlroth (58:15.460)

including like face unlock, checking that it's your actual

Lex Fridman (58:20.580)

face, like the liveness tests.

Lex Fridman (58:23.020)

So like from video, so unlocking it with video,

Lex Fridman (58:26.220)

voice, the way you move the phone,

Nicole Perlroth (58:31.020)

the way you take it out of the pocket, that kind of thing.

Lex Fridman (58:33.220)

All of those factors.

Nicole Perlroth (58:34.980)

It's a really hard problem though.

Lex Fridman (58:37.300)

And ultimately, it's very difficult to beat the password

Nicole Perlroth (58:42.020)

in terms of security.

Lex Fridman (58:43.540)

Well, there's a company that I actually will call out

Lex Fridman (58:46.140)

and that's Abnormal Security.

Lex Fridman (58:48.180)

So they work on email attacks.

Lex Fridman (58:51.420)

And it was started by a couple of guys who were doing,

Lex Fridman (58:56.620)

I think, ad tech at Twitter.

Lex Fridman (58:59.340)

So ad technology now, like it's a joke

Lex Fridman (59:02.500)

how much they know about us.

Nicole Perlroth (59:03.980)

You always hear the conspiracy theories that

Lex Fridman (59:06.580)

you saw someone's shoes and next thing you know,

Nicole Perlroth (59:08.940)

it's on your phone.

Lex Fridman (59:10.380)

It's amazing what they know about you.

Lex Fridman (59:13.660)

And they're basically taking that

Lex Fridman (59:16.660)

and they're applying it to attacks.

Lex Fridman (59:19.700)

So they're saying, okay, if you're,

Lex Fridman (59:22.740)

this is what your email patterns are.

Nicole Perlroth (59:24.940)

It might be different for you and me

Lex Fridman (59:26.360)

because we're emailing strangers all the time.

Lex Fridman (59:29.660)

But for most people,

Lex Fridman (59:30.980)

their email patterns are pretty predictable.

Lex Fridman (59:33.900)

And if something strays from that pattern, that's abnormal

Lex Fridman (59:38.380)

and they'll block it, they'll investigate it.

Lex Fridman (59:41.740)

And that's great.

Lex Fridman (59:43.920)

Let's start using that kind of targeted ad technology

Nicole Perlroth (59:48.640)

to protect people.

Lex Fridman (59:50.540)

And yeah, I mean, it's not gonna get us away

Nicole Perlroth (59:52.980)

from the password and using multifactor authentication,

Lex Fridman (59:56.300)

but the technology is out there

Lex Fridman (59:59.980)

and we just have to figure out how to use it