Hacked - The Man Who Was There For Cybersecurity's Strangest Moments — Mikko Hyppönen

Episode Date: August 1, 2026

The first PC virus. The fastest-spreading malware the internet has ever seen. The Manhattan Project moment for cyberweapons. He was there for all of it. We sat down with Mikko Hyppönen — the man behind Hyppönen's Law: if it's smart, it's vulnerable — to talk through 30 years at the center of cybersecurity's biggest moments, and why he just left it all behind for a new fight. Watching on video? Here’s our goofy faces. Give it a watch since he brought the real gear with him and bear with us as we navigate a new editing flow. Hacked is presented by NordLayer. NordLayer is a network security platform for modern teams. NordLayer gives companies centralized control over who can access their systems, keeps every connection fast and encrypted, and requires no additional hardware or complex infrastructure. nordlayer.com/hackedpodcast   Learn more about your ad choices. Visit podcastchoices.com/adchoices

Do you have any advice for people trying to have laws named after themselves? Because I keep trying and no one will use mine. I guess it's similar to the question I was asked. I think by some student years ago, like, Miko, how does one become a global cybersecurity expert? That was the question. And the answer is very simple. This works in any field. You just pick a field, then you work in the field forever, and eventually everybody will believe you're an expert.

That's what I've done. That's my advice. For the last 30-plus years, Miko Hupinen has studied and lived and breathed all of the malicious stuff that people do with technology. And time and time again, he has kept turning up at the center of these remarkable stories. Yeah, these stories that we cover on our podcast, he's every story you're about to talk about, we made an episode about, and we talked about. And we talked about Miko in those stories. When the first PC virus ever written showed up on computers in Finland in 1986, Biko was there.

And then 25 years later, he tracks down the two brothers that wrote it to Lahore, Pakistan, using the floppy disk that it got to Finland on. In 2000, when a piece of malware called I Love You spread from zero computers to 10 million computers in a single day, one of the fastest, moving outbreaks the internet had ever seen, he was there. And then the big one, what he described as the Oppenheimer moment for cybersecurity, when Stuxnet was uncovered in 2010, code built by a government not to, like, steal information and to physically destroy centrifuges inside of an Iranian nuclear facility, Miko was one of the

first people to like pull it apart and understand what the world was actually looking at. And then, twist two years ago, he leaves digital security for an entirely different battlefield, drones, defending against them, probably given to the fact that he lives two hours from Finland's border with Russia. Yeah, Helsinki is really close to Russia, and he's from Helsinki. He brought stuff from the battlefield to our conversation. If you're watching this on video right now, he shows on camera, combat. drones that aren't flying by radio but are tethered by like a hair thin fiber optic cable to the pilot. And then we talk about what comes after that cable, drones that don't need a wire or radio

or even a pilot piloting them. Miko's spoken, I think, of a number of times on TED. I think he's a multi-ted talk speaker. A very interesting person, you know, very diverse background, self-taught, really interesting guy. I love the interview. great depths of knowledge in multiple fields. Just great, great episode.

I hope you guys enjoy it. If you're interested in learning about technology and security and all the strange things people do with tech, there's a lot in this conversation with you. Murphy has a law. Moor has a law. And since 2016, so does he. Hoopinanin's Law.

Whenever a device is called smart, it's vulnerable. This was a fascinating conversation, Scott. We're excited to bring it to you, brought to you, of course, by our title sponsor, Norlair, the network security platform, from modern teams. We'll tell you about them more later. Without any further ado, Scott.

Let's do it. Let's get into it. Our conversation with Miko Hoopening here on Hacked. Well, you know what? Why don't we start with, I'm curious to start with brain. We've told that story in the show where I love that story. Why don't you, if you don't mind, take us through that. So when I started analyzing malware in 1991, there were so few viruses and worms in existence

that I simply collected them all. I had a full collection of every single malware in existence. Well, PC malware. I'm certain there were some mainframe cases or Commodore 64 viruses I didn't have. But all the PC viruses, there were less than 200 of them at the time. I had all of those. And then I reversed engineered and decoded

and analyzed every single one of them. So I had full expertise to the whole problem of PC viruses. which you could still do back then. Of course, today it would be kind of hard to collect all the malware because there's so many. But one of the viruses that I analyzed in the beginning of my career was Brain.A, which is considered to be the first PC virus in history. And Brain is surprisingly advanced to be the first PC virus.

For example, it's a stealth virus, which means if you have an infected computer and you try to analyze the mouth, it's going to hide itself. It's going to detect that you're trying to analyze it and show you clean code instead of infected code, which was pretty neat. But the real game changer that really allowed me to later find the authors of brain was that they had left clues inside the malware code. And when we speak about brain, we speak about viruses spreading on five and quarter inch floppy inside the boot sector, the first sector on a floppy. So I had loaded an infected floppy into my test computer,

loaded the boot sector from the floppy to a hex editor and I was going through the code and I found these texts, ASCII text, Basit and Amjad, which are first names. And then Alama Igbal town, which is a street in Lahore, Pakistan. And then years later, we were tracking down the history of malware and I suggested inside Fsecure where I was working at the time

that you know I could probably find the guys who wrote the first PC virus since we have clues about where they used to be and we decided to do that so I traveled to package and I followed all these clues and I did end up finding Basit and Amjad I met the guys I spoke with them I left my original infected floppy with them in Lahore

in Pakistan, which is where it is still today. And the wildest thing about the whole case is that they were still at the same address. They were still at Alama Igbal Town in Lahore, Pakistan after all these years. As far as I know, they're still there today. You didn't take the urge to get them to autograph your infected floppy, the little collector's item? It would have been fun, but I think it was better to take the piece of malware back home and leave it with the boys. where it started. Dave kind of, I remember, I watched that documentary of you going back.

It's great. They've maintained that they weren't being malicious or anything. They wanted to, I think the line was they wanted to expose how insecure early PCs were. Like, you went there, you were part of this. Like, did you believe them? Yeah, I do. And I still stay in touch with the younger brother. He's roughly my age.

So we exchange emails regularly. We have to remember, these guys are not criminal. they broke no laws. Because clearly this wasn't illegal in 1986 when they wrote Brain.com. How could it be illegal? Because nobody had written PC viruses before. They didn't do more malware

or hacking or any of that. These guys were businessmen and their background was in mainframe programming and that's why they were so surprised and as they said themselves, horrified about this insecure PC architecture where anybody could do anything. There were no user accounts

and you could just, create malware and to prove their point, they did it. That's what they told me and I believe them. It's interesting to think about, like in 2026 to think about a virus like that spreading on a floppy disk. It's so foreign to today. Like that, if I remember Wright ended up in Antarctica. No, brain never went to Antarctica form.a did, which was something we found a little bit later, another bootsector virus spreading on floppy disks.

And I think it's not that far-fetched to think about the spreading speeds of these floppy-based viruses. Because, I mean, if you think about biological viruses, like the flu or COVID or anything, that's exactly the same spreading speed that these early viruses had. They required people to travel. A new flu strain, it takes months to go around the world because people need to travel and spread it manually. Same thing with these floppy-based viruses. is you have to take the floppy to another city, to another country. And that's how it eventually ends up on weird places like Antarctica, which really did happen.

I think January marked the 40th anniversary of your brain, if I'm not mistaken. Yes, I think you're right. So it's been a while. It's the speed, the propagation speed is really interesting because, you know, you go from months to propagate on a floppy boot sector virus to worms spreading across, the internet doubling in seconds and milliseconds, the propagation speeds really becomes a function of the medium that they're able to transport on. What's the, what medium are you kind of watching today? What do you think is of interest? Well, we've broken the speed record for

malware outbreaks over the years ago. I don't think we're going to have new records there anymore. The reason being that today's landscape for malware attacks is so very, different. Viruses like brain or later email worms or webworms or whatever you remember from the history of malware cases. For years and years, it was just kids riding viruses for fun and they were competing with who makes the most destructive malware or whose malware spread the furthest or fastest. That all changed when money entered the picture around 20 years ago. Money making organized online crime gangs. They're not competing about who makes the biggest headlines or who's the fastest.

They want to make money. They want to stay below the horizon. And if their malware spreads so quickly that it ends up on CNN News, then they failed. They don't want to do that. So they on purpose try to keep the malware outbreaks below the horizon and they control and throttle the spreading speed. So I think Slammer, Slammer worm of 2000 and two, I'm remembering, probably still holds the record for infecting most devices in fastest time because it scanned the whole IPV4 address space in less than 20 minutes, infecting every single computer it could infect, which is pretty neat. Was Slammer or Slammer was the MSSQL one, right? That was the one that...

Yeah, that's the one. Yeah, I remember that one. Closely followed by Slapper, which was infecting Linux services. I forget which vulnerability it was. But yeah, Slamer was infecting Microsoft SQL. Yeah, I remember it had a neat thing too, where when it penetrated into an intranet, it would then scan the entire intranet looking for other services. So it was just like mass replication.

Sure, sure. It ended up infecting nuclear power plants in the United States. Yeah. I mean, you said something interesting there. I just want to pull on. You have other stories I want to talk about, but if it ends up on CNN, it failed. And that's super intuitive, you know, you're trying to have something quietly, secretly spread.

You don't want it to get a bunch of publicity. Why then do you think so many cybercic crime groups do tend to almost engage in PR? They seem to want people to know who they are. They have a brand name. They have a gang name. talk about that tension between like privacy seems intuitive but why does so many seem to want to be famous? Well, there's two different things. They don't want their outbreaks to be detected too early and that's what happens if you, if it's too fast, if it's too noisy. So you compare these web worms or email worms from from yesterday years, which really did go to CNN because they were so so violent in their spreading speeds or some newer cases which became huge.

news items. They were typically ransomware cases which got out of control and they were spreading faster than the creator's thought because they were using some kind of vulnerability which was too successful and they weren't throttling the spreading speeds. For example, not Petja or Wanna Cry would be examples of those. But you're right. They do maintain websites. They have a brand. They talk to media. They put out releases. But that That's a different thing. That's not really about trying to put focus on their outbreaks. It's trying to create a brand that the victims would be scared of. This is exactly the same reason why real world organized crime groups maintain brands. Think about motorcycle gangs or, you know, Kosa Nostra or Yakuza or Tragad. They all have a brand, a scary brand. They have a brand that is someone you don't want to mess with. They're scary. that's the kind of reputation these ransomware gangs want to maintain

and at the same time maintain a brand that these are someone you can do business with like if you pay the ransom and they promise to return your files and they promise not to leak the stolen data and promise to tell you how they got in they will deliver on their promise

now it's not always true there's ransomware gangs or extortion scams today which actually don't follow up. But from business point of view, it does make sense to fulfill your promises if you want to be in this business for years and years. And some of these gangs

have been in ransom of our business for more than five years. You need to be reputable enough that you can trust that if you pay the ransom that you'll get your files back. But at the same time, you need to be afraid of them enough that if you don't pay, you understand that you're about

to be punished. That's right. Yeah. I mean, speaking of ransomware, can you tell us a little bit about Vestamo? We've talked about that story before, and I know you've talked about it publicly. Can you take us through that a little bit? The Vastamo extortion incident in Finland still today is the single biggest crime in the history of our country when you look at the number of victims. Completely unusual case. Technically, it wasn't ransomware because nothing was encrypted. the system was simply hacked and the patient database belonging to a psychotherapy center was stolen after this breach of their network system. They had built this Vastamo. Vastamo was the name of the private psychotherapy center, which went bankrupt because of this hack. And they had built their own IT environment. And we know that at least two different attackers were in their network over

extended periods of time looking at patient data. And this is a prime example of the kind of explosive data or really damaging data that can leak. Because when you go to a psychotherapy center, you discuss the most private things you can imagine. And that remains damaging forever, for years, for decades. Some of the people in the leagues, and they were tens of thousands of persons in the League. Some of these were children who were, you know, going through traumatic debriefings or divorces or abuse. Their reports are there as well. And they are in the dark web right now. They've been there and they will be there because that's the way dark web works. And the center was extorted by the attacker to pay a ransom in Bitcoin, which they declined to do. And then the attacker started leaking these patient records. One

patient at a time, then he screwed up. He had written a script to leak 100 a day, which then actually had a buck in it, and he ended up leaking all of them, which meant that he couldn't extort the place anymore because all of it had already been leaked. The only good thing about the whole incident is that the person behind it was caught and has been sentenced. as we are recording this he was put yesterday on the international wanted list because he sat in the Finnish jail for a year and a half then he was released to wait the continuation of the trial

and now they tried to find him again to put him back to jail we hope they will be able to find him he's on the run right now Well, he was actually communicating with authorities, I believe, over email or phone yesterday, but he's not telling where he is. We don't think he's in Finland. Wow. Wasn't there an interesting twist in the story where he tried to ransom the agency and then they failed to pay

and then didn't he go after the individual patients asking for individual ransoms? You're right. And that rarely happens. There's very few cases that I know of where, I mean, there's plenty of cases where hospitals or medical systems or similar cases have been attacked, but typically they don't go after individual patients. I know of three or four cases where something like this has been done before. And the other cases that I know of are plastic surgery centers where individuals have been contacted with photos of their operations,

pay as money or will leak your photos. But, I mean, that's bad. but it's nowhere near as bad as psychotherapy reports. Yeah, absolutely. Do you think that the reason, like just given how sensitive that is, is that why he went after it? Like he was kind of a teenage hacker gang type figure. Does he go after Vostomo just because of the sheer sensitivity of what they had?

Like, did he know what he was getting into? We don't really know. There's different theories. One theory could simply be that the guy who was, sentenced for the case. Maybe it was passed, the information about the hack was passed on to him because it was a Finnish hack. Much of the information was in Finnish language. So he would be able to figure out better what's the data about and what to do with the data. But we don't know. And he's never commented about this himself. It wasn't hard to get into this service at all. They had exposed a database server with a blank password on public internet. So a lot of people found it. How he did. ended up with this Finnish guy's hands, we don't exactly know. But it could simply be that someone else pointed it at him because he was a Finn. Right.

Could have been a crime of opportunity rather than a crime of intent. Earlier you brought up a nuclear facility, so I'll pivot us a little bit here, Stuxnet. Can you tell us the story of Stuxnet? Today, when you think about big words like cyber war or cyber weapons, it's pretty everyday occurrence nowadays. There's a war in Europe right now where cyber attacks are happening regularly.

But before Stocknet, which was 2010, it wasn't nearly as common. I mean, we had seen espionage and spying being done by governments. That started around 2003. The first case I worked with was in 2003, and that was the Chinese. But we hadn't seen operandi. operational attacks, attacks which would actually destroy things or potentially be lethal.

And that's what Stuxnet really changed. And Stuxnet was a highly unusual case. It didn't resemble any malware we had ever seen. We got the original sample in June 2010 from a small cybersecurity company out of Belarus, who had been operating in Iran. And they ran into something they couldn't decode and they shared the sample with the international malware research community. And we all started looking at the sample. And it didn't look like malware.

It looked more like an installer for some kind of factory automation software. It wasn't encrypted. It wasn't packed. It wasn't obfuscated. Normal malware would look like that. This was huge, unpacked, uncompressed scripts, programming languages. we had never seen before. Lateralogic files for Siemens S7 PLCs and weird stuff. But when we were looking at the Windows part of it, it had a zero day, a zero day that it used

to infect Windows computers. Whenever you plugged in a USB flash drive, it had a Windows vulnerability exploded through the PIF file extension. When Windows would try to render the icon for this PIF file, it would actually crash. And they would execute a piece of code from within the file. And this zero day was a work of beauty. It would work on every version of Windows. We had everything from Windows, Windows NT all the way to Windows. Where were we in 2010?

All the way. Everything in Windows version was vulnerable to that vulnerability. And then when we were digging deeper, it wasn't the only zero day. They were three, was it four different zero days? Yeah, four. in single piece of malware, which we had never, ever seen before. And the work to decode Stuxnet was so large, no company could do it by themselves. So we set up this mailing list, which had international researchers from competing cybersecurity companies.

We had me and a couple of our guys from F-Secure, and people from McAfee, from Symantec, from Computer Associates. Even Kaspersky was there. They were still part of the international community. at the time. And slowly but surely we decoded different parts of it and guys started learning the lateral logic language to figure out what's it trying to do on these Siemens S-7s and we started buying these PLCs so we could infect them and figure out how it all works. It took forever. But eventually we did figure it out and we did make the assessment that, you know, clearly this is governmental. Clearly this is not criminals. Like who would spend

years writing something like this, invest millions, have four different zero days in a single piece of malware. It's going to be governmental. And then the question is, okay, what's the target? And I still remember one of the researchers at Computer Associates in Australia, he was the first one to make the call. He emailed the mailing list saying that, you know, it's got to be the Americans targeting the Iranian nuclear enrichment program, which turned out to be the case, USA, NSA, together with, Israelis were behind it, as we know now. But it was really paranoid summer where we were like a little bit worried and scared about what we found.

And I've said it before that if, I mean, there's a time before Stuxnet and time after Stuxnet, just like there's a time before the first nuclear weapon and time after the first nuclear weapon. If physicists lost their innocence in 1945 with the first nuclear weapon, then, then computer scientists lost their innocence in 2010 with Stuxnet. Yeah, I always find this story fascinating just because of the amount of Ode's used in the payload to deliver it. It really tells who, like, who would have been behind it, just given the complexity and severity of it. The, did you guys ever find out if it actually, it did hit the Iranian enrichers, didn't it?

Like, it actually made its way. It did, yes. And it destroyed centrifuges. It delayed their enrichment process significantly. We still don't know, but it could have killed people. It's one of the, or maybe the first case where the software attack on physical systems clearly had the potential of killing people. Because when these centrifuges spin, they spin at the speed of sound,

enriching uranium gas into uranium. And when you start to change their spinning speeds, they start to vibrate and they explode violently. If there's anybody close to them, it is lethal. And we still today don't know if anybody died. I guess by now we probably would know if somebody died. But at least it had the potential and the people behind it, they had to know that this might kill people. And they launched it anyway. And I actually visited physically the National Security Agency in Fort Meade, Maryland, two, three years before this.

I'm guessing 2008. I was there for a day for a completely unrelated project. And I still remember meeting all these researchers and coders and developers throughout the day. Dozens of people who I spoke with, none of them introduced themselves, none of them gave me. their card. And later on, I realized that they probably did meet people who were working on Stuxnet at the time when I was there. Yeah.

Wow. One thing I found interesting about it is that it, uh, wasn't it replacing the operational control center screens so that everything looked fine? Like if you were in the control room, like it had, it had, knew how to obfuscate itself while also at the same time destroying it. Like it was very, very well thought out and well rounded pieces of. Sure. just like in the movies.

Exactly. Exactly. Like in the movies. It's exactly. It didn't intercept CCTV and like play back the same video.

But close. It was recording network traffic and playing back the old traffic while it was changing these spinning speeds of the centrifuge.

So he really was trying to make it look normal to the people monitoring the operations and it did succeed. It was running for a very long time and the Iranians

couldn't figure out what was going wrong. They were clearly aware that something is going wrong, but they couldn't figure out what it was. And we know that people were fired from the Iranian nuclear enrichment facilities for failing to do their work or maybe even worse. And the reason wasn't that they couldn't do their work. The reason was Stuxnet. Yeah. Interesting.

You brought up this comparison of Stuxnet to a nuclear weapon, this before and after kind of thing. And I've heard you talk about that before. like a cyber weapon has a much shorter shelf life than a missile or a bomb or any kind of physical weapon. You can't throw a giant parade and run it down the street in the way that you can with certain type of weapons. Like you've now worked kind of in both spaces. How do you think of cyber weapons versus physical technological weapons? Yeah, it is important to realize that cyber weapons suck in deterrents. they really don't give you

one of the most powerful features of weapons which is that when your enemy knows what you have they are less likely to attack you I live two hours away from the Russian border Finland has been maintaining a very capable army for decades because we are living next to a very large

and very unpredictable neighbor which we have fought before both of my grandfathers fought the Russians in the Second World War. And when you're in a situation like this, of course, then you have to have a very large artillery, very large amount of trained people, and you have to have your bomb shelters in order, things like that. So what you're trying to do is deterrence,

make it clear that the enemy that they shouldn't come knocking. It wouldn't be easy to attack us. And that's what you get with artillery and fighter jets and tanks and drone capabilities today. Where's cyber? Cyber is missing from this picture because you can show your capabilities and how many F-30 fines you have

or how many aircraft carriers you have. And you can go to Wikipedia and it's going to list the basic capabilities of physical armies regardless of the country. But they say nothing about the cyber capabilities. How do you show it? If you have a military parade, it's easy to show your missiles. How do you show your cyber troops?

Yeah, USB keys a little bit less impressive when you're carrying it through a street. Yep, that's the thing. And then when you play this thought through, what you have with cyber weapons is that you have expensive weapons, that you have to build and maintain, which have a short shelf life. they expire because they target certain systems, which might be in use today, but they won't be in use in five or ten or 15 years. And even if the systems are in use, the vulnerabilities that you're exploiting, they could have been patched. Maybe somebody found them and reported them and fixed them, and then you have to, you know, start from scratch. So you have expensive weapons which have no deterrence power and a short shelf life.

That's a pretty bad combination compared to traditional weapons. And that's one of the challenges we have with cyber weapons. This episode is brought to you by our title sponsor, Nordlayer. The reality of running a modern team, your people are working from different devices, different locations, different networks, and most businesses have no real visibility into what that looks like from a security standpoint. Nordlayer is a network security platform that fixes that. It gives you centralized control over who can access your company's systems,

lets you grant or revoke access in seconds, and it keeps every connection fast, and encrypted, does all that without any additional hardware or complex infrastructure. You can verify users by identity and device, block malicious sites, risky domains, and stay compliant without slowing anyone down. It's built for the way teams actually work now. Check it out at Nordlayer.com slash hacked podcast. That's Nordlayer.com slash hacked podcast, and thank you again to Nordlayer for their support. Well, this is an interesting pivot because, you know, you spent most of your career, all of your career mostly, until very recently in the cyber side of that, carrying the USB key through the streets. And now you're on the other side of it.

The, I've been fascinated with the Ukraine-Russia conflict, just how it's redefining the stage of war, you know, the, the progress and the, just the differences that are coming from the introduction of drones. and autonomous vehicles. And I know that's what you're into now. I'm not sure how much you want to talk about it, but I'd love to jump into it with you because it is fascinating to see how much warfare is changing in real time in front of us. Yep, it is changing.

And you're right. I did a career shift in the summer of 2025. So after 34 years of working in cybersecurity, or working for cybersecurity companies, I switched and now I'm working for a defense contractor, a local company called Sensor Fusion, where we built drone detection and drone defense systems. Now, obviously, I haven't left cyber completely. I still follow cyber very closely, and obviously we have cyber things to worry about inside a Finnish defense contractor as well,

but I'm not working in the industry anymore. And the reason why I make the shift is very, very clear. war. There's a war which isn't for me a far away for a war in a foreign land. It's right there. It's not far from me at all. And they're fighting Russia which is right next as I mentioned. And if you think about

like what defines the Russia-Ukraine war, it's not cyber. Like cyber clearly has an element there. There's been plenty of attacks. But if something defines this war, it's drones. This is the first drone war.

And we've seen the same playbook play out, and it's playing out as we record this in Middle East, where United States for the first time used one way attack drones against their enemy in Iran. In fact, sending drones of Iranian Shahid drones to Iran, which must have been weird for the Iranians once they've figured out what they're sending to them. Yeah. Yeah. The whole like the drone infrastructure going on in Ukraine, the Brave One marketplace, the way that they're prioritizing military targeting, like just the entire, I don't want to call it gamification, but it's hard not to of like the of the of the theater of war is it's just it's I don't know. I haven't lived through any major, major wars and like obviously we're a lot farther away than Helsinki. So it's hard to be as in touch with it.

but it just seems fascinating the way that internationally the community is responding. I know America is prioritizing these like new defense style contractors similar to probably what you guys are doing. You know, putting up fabrication facilities able to produce drones at a mass volume versus, you know, the classic. We build an F-35 every year and shove it in a hanger somewhere and hope nobody bombs it. So why don't you give us a little breakdown of what you guys are doing at, sense of fusion? That's what it's called? Sure. Sure. So the company is 11 years old. We do nothing else than drone defense or counter UAS. That's the term you see a lot. So UAS unmanned aerial systems and we fight them. So we don't build lethal power. We're not making weapons. We're building defensive systems which detect drones and then are able to disable drones one way or another. And drones, I guess for many people,

the first thing that comes to mind when you say drones, they think about quadcopters or something small you can buy from a shop and operate. And clearly, these are drones. But at the very same time, there's marine drones, ground drones, underwater drones. There's winged drones which can fly thousands of miles. So it's pretty wide range of different things. The only common thing between them is that they're unmanned. So if it's unmanned, it's a drone.

that's as we defined it. So I guess you could even claim that if you have a Tesla on full auto and you take a human out of it, I guess that would be a drone as well. But maybe that's a little bit different. So we try to detect these. Clearly the focus has been in flying drones, but it doesn't really matter in the sense that if there's a control mechanism that we can detect, we can use that to figure out where the drone is, where the pilot is,

and how to shut down the operations. Big part of drones are controlled with radio. That's the easiest and most obvious link. So the company started from detecting radio waves. And those of you who are actually watching this on the video, I can show you what these things look like. They look like this. So this is one of ours.

This is called eFense. It's a software-defined radio running Linux inside, rugged, so it operates underwater. and in snow and in freezing rain and in scorching hot environments, as you might have in different battlefields. You hook that thing up to an antenna and a laptop, and you end up with a map, sort of like Google Maps, which shows you location of the sensors

and then location of the drones, where the drones are, what's the direction, what's the height, what's the speed, and where the pilots are. And obviously knowing the location of the pilots, which we can't always tell. But in many cases, we can. That's very valuable information.

Clearly very valuable in battlefields, but also valuable in civilian context. So, for example, if you think about these disruptions we've seen at airports because of who fly their DJI drones to close to the airport, the air traffic control, they don't really care where exactly the drone is. They care where the pilot is, or they can send the cops, to the pilot to stock whatever he's doing. And that's the kind of thing we can provide with these kind of radio-based detectors.

But it at the same time opens up this game of cat and mouse. The better we are in detecting these things, the faster they will evolve. They will start to use new kind of protocols, new frequencies, frequency hopping, encrypted protocols, or go out of radio completely, which is one of the things we've seen. in the battle peels. Let me show you this. Again, for those of you watching video. This is what a fiber optic module for a drone looks like.

So the basic idea is that a drone would fly and carry something like this beneath it. And what's it leaving behind itself is this very, very thin line of fiber optic, which is sort of like a hair or a fishing line. It's glass inside with a silicon wrapping on top of it. And the module I have right here, this is like six miles of the fiber optic. It just flies and leaves it behind it, lying on the ground. It's undetectable of radio. That's the benefit.

But in all other ways, it's much worse as a drone. There's tons of extra weight. It's harder to fly and direct. And as soon as you fly over a road, the next car will cut the wire and you will lose the drone. So it has its benefits, but it also has its downsides. I was going to say fiber optics are notoriously brittle, making a 30 kilometer. It's actually, it's fairly durable, but if you want to cut it, you just make a knot and pull. And you end up with a broken fiber and it's gone.

And then once you're able to detect. drones, then you end up with the next state, which is to defend against drones. For radio control drones, you jam the radio waves, and that's what we do. We have different kind of jammers. We know the frequencies they use. We have higher power than what they're using for the transmission themselves, so we can overpower the frequencies and cut the connection between the drone and the pilot. For hobbies, drones, that means typically that they return home.

For military drones carrying explosives, they don't return home because they carry Explosives, you don't want them back. They typically just crash where they lose the connection with the... They might stay on... If it's a quadcopter or an octocopter, it might stay still until it starts run out of battery and then it will just crash and explode wherever it might be. And for the larger drones, the plane-like drones, Shah Heads or Russian gerons or those,

those are typically then taken down with other drones. We speak about interceptive drones. Ukraine has been the innovator with intercepted drones. And we have very good contacts with the military of Ukraine. We have an office in Kiev ourselves. And the numbers we are hearing from the operators in Ukraine is that they are, I mean, majority, somewhere between 50 to 80 percent of the long-range drones, long from Russians are shut down with intercepted drones.

and intercept drones again for those with the video they look like this so this is this is what we mean so this is a rocket-like drone in this case with four

electric motors this reaches speeds the speed record we have for this is 388 kilometers an hour I'm trying to convert to miles hold on you use kilometers in Canada yeah we're Canadian we're okay

but our listeners are largely American let's say like 200ish 200 is my estimate as well. So the idea is that it flies faster than the wing drone that is trying to catch. Then we have two cameras right here. So it locks to the engine, the heat source, and crashes into it breaking the propeller of the motor that the large drone is using, taking it down. And this has been proven to work by the Ukrainians for a couple of years now. and this one that I just showed you is made by us at SensorFusion.

So we are building solutions like this as well. A quick word from Nordlare. Right now they're running their summer sale with new customers getting up to 20% off annual plans through August 31st. Why is it matter? Threats are never out of office. When your team is traveling, logging into work accounts from hotels, airports, you know, conference Wi-Fi,

the risk of your business access being intercepted or exposed goes way, app. That's the window fishing attacks and unauthorized logins. It's what they're waiting for. Nordlayer is a network security platform that keeps your team protected wherever work happens. It encrypts every connection and gives you control over who can access that and flags unusual activity across your network, all without any hardware set up. Use the code NL Summer 26 at checkout or go to Nordlayer.com slash hacked podcast. That's code NL Summer 26 at checkout

or go to nordlair.com slash hacked podcast. If you want a $3,000 a month payday for life, what would you feel free to do? Maybe take a long weekend, every weekend, or try a bunch of new hobbies. Would you feel free to upgrade and listen ad-free? Don't worry, we get it.

Every $20 ticket could win you $3,000 a month for life and supports life-saving cancer research at the Princess Margaret. Feel free to buy your payday for life ticket today. Raffle number 155-2194. Please play responsibly. Every company says AI will make employees more productive, but most employees are still stuck waiting on IT,

waiting for app access, waiting for password resets, waiting for someone to fix laptop issues so they can get back to work. That operational drag, it adds up fast, and IT teams are overwhelmed trying to keep up. Serval was built to automate that work. You describe what you want automated in plainly. English and Serval builds it for you. No complicated workflow builders, no consultants, just faster support, and fewer tickets slowing everyone down.

Serval enables IT teams to build automations using plain English instead of drag and drop workflow builders. Platform is designed to eliminate repetitive tickets so IT can focus on strategic work instead of constant firefighting. Unlike traditional automation tools, Serval doesn't require consultants or long implementation cycles. Serval positions IT is the AI-powered operational backbone of the company, not just a support function. The company guarantees customers can automate 50% of IT tickets and backs it up with a free four-week pilot. Learn more or start a free four-week pilot at Serval.com slash hacked. That's S-E-R-V-A-L-com slash hacked. Serval.com slash hacked.

Now streaming on Disney Plus, the Hulu or Original series Furious follows FBI agent Alice Black, played by Emmy Rossum, on the hunt for a mysterious and calculating serial killer. Both walk their own paths toward justice, and as their lives start to intertwine, the line between right and wrong begins to blur. New episodes week over week. Watch the Hulu original series Furious, now streaming only on Hulu on Disney Plus. So much of the kind of technical problem that sounds like you're solving is disrupting a

connection between a pilot and a drone. There's radio, let's jam it. There's a line. Let's find a way to cut it. Is where this is going is there's no connection between the pilot and the drone? They pick their own targets. They make those decisions to attack on their own. Like how far off is that? It's not far off at all. Theoretically doable already today. There's some isolated examples of it happening, but not in large scale yet. But clearly, that's the direction that we're headed and nobody likes it. Nobody likes the idea of killer robots

making the kill decision on their own, but that's the direction where we're going. And it's pretty obvious really. Like if you think about the problem from the point of view of the attacker, like you have a pilot holding some kind of remote control and you have a drone.

The weak link is the link. Whether it's radio, controlled or fiber controlled or anything. So the obvious solution is to remove the link and just have the thing make everything by itself. You give drone a mission. Go behind the lines. Figure out what's happening. Look at the different targets. Decide what to do with the targets. If you decide to kill a target, then go and kill the target. And another way to define that is indeed a killer robot. And that's unfortunately closer and closer. The thing that might be limiting it a little bit right now is the computing power needed to have that level of intelligence on a drone. This small quadcopter I keep showing to you here. This is a hobbyist drone, a DGI drone with a battery which weighs 81 grams.

Basically nothing. And I can fly half an hour with something like this, which is one of the reasons these things have been. such a success story. Why drones became a thing. Battery technology became so good that you can actually fly extended periods of time with a very light battery. Now, imagine that you want to put a Nvidia G300 here. It by itself is pretty heavy. Then imagine the power consumption. You would need a huge battery. I mean, you couldn't fly it. So what I'm saying is that you can't make it that intelligent and fly it yet. Clearly, power, power.

consumption is going to get better, batteries will get better, it's going to fly eventually. But my guess is that if this killer robot revolution is to start, it's highly likely to start from ground drones and marine drones, which don't have a weight limit. Well, there's an economic challenge there too, because if you're making a, like currently if you're making a $500 drone, something, I'm picking a dollar figure out of midair, but something affordable to reproduce at mass scale and then you're shoving a $4,000 chip inside of it. All of a sudden, the economics of the situation changed significantly. But so the, we've talked about like internet of things, home security cameras that run local

models on them for detecting like, is that a person or is that a dog or is that an ice cream truck? And it seems like that would be a part of this is having a system that can on the fly determine, what am I looking at? Is that my target? Is that a person? Is that a car? Is that a tree? On the defensive side, if that shift happens, that shift that no one wants to happen,

and I hope it doesn't happen. But if that shift happens, how do you defend against it? Let me just first underline the fact that this image recognition part, it's already happening. It's not like full-blown intelligence yet. It's not making the kill decision on its own yet. But for example, the long-range drones that the Ukrainians are flying to hit, the oil refineries in Russia, they already have image recognition for, I mean, they fly close enough. And then there's so much GPS and GNS is jamming and spoofing that they no longer rely on the

coordinates that they're following. And then they just look around with cameras and detect that's an oil refiner. And they hit it. The downside of that is that there's been two Ukrainian drones so far that we know of, which have hit oil refineries or old depositories, which were not Russian. So, you know, there was two of them in Latvia right next to Russian border, which were hit by Ukrainians, by accident. Because the camera system recognized them for what they were, and they were spoofed to be on the wrong position. So our analysis is that the reason why these two depositors of oil were hit by Ukrainians was a mistake from the camera recognition system.

But to answer your question on how do you fight AI, full AI, flying drones, since you can't rely on radio, because there's no radio, since you can't cut the fiber since there's no fiber, then you use everything else. You use radars, especially radars equipped to detect really small things. Normal radars are focused on planes and missiles. Different kind of short-range radars are able to detect drones. The main challenge there is birds.

Bloc off birds look in radars very, very similar to. So that's a challenge. But that's one thing. Radars, that's one thing. Cameras, another thing. We are working ourselves on event camera technology, which is capable of detecting really tiny objects from far away in very poor lighting conditions. And we've trained our models to detect different kinds of drones.

And we can even detect individual spins of a propeller with these event cameras. So we can figure out which direction it's going now. and where it's going to turn soon because we can see that one of the propellers is slowing down, things like that. So cameras, that's one thing. Then acoustic. All drums make some of these are powered by electric motors. Some of them are powered with gas engines.

Regardless of that, they all make noise. So we already have a database of different drone noises. And if you have multiple microphones recording at the same time, you can do triangulation, you can figure out where the noise is coming from, what's the height, what's the speed, have the direction. And the point here is you have different sensors and then you fuse these sensors together and you end up with a picture. That's what you call sensor fusion and that's where the name of our company comes from. So you're almost creating a bunch of inputs and then running them through a neural net or AI to determine whether it's a valid signal or not. Makes sense.

Yep. Makes sense. But it is a game of cut and mouse and it does remind my previous career with hunting malware or hunting online attackers. There's tons of similarities. Obviously differences as well. But the idea that you're trying to detect

something that doesn't want to get detected and then when you find it and you analyze it and you create detection and you ship an update, then when it realizes that, hey, I'm now getting detected, then it changes. And then you have to start, you need a new sample and then you have to start the analysis again.

The difference is that instead of getting binaries or EXC files to analyze what we get are typically IQ samples, which is recorded radio traffic from the battlefield or visual or acoustic samples, and then you build detections for that. But we do ship update regularly. So, for example, the airfence system has been updated 275 times during the Ukraine war. which is more than once a week, which is pretty frequent, not as frequent as an antivirus, which gets updated many times a day, but, you know, close enough. And exactly in the same way as an EDR or an antivirus, which hasn't been updated for a year,

it's not very useful anymore. Same thing here. If you have an old drone detection system which hasn't been updated, well, it will detect civilian drones because they don't change much, but it won't detect new military drones. the uh just just to hang there on for a second on tempo you know coming from the cyber side you know antivirus is sure they update every day but i feel like a lot of them are kind of copycat clones of a specific uh system same with malware you know maybe there's a really big you know break in how a malware is launched and how it penetrates every couple months maybe and then you see it kind of used in a variety

of malwheres how have you noticed the tempo difference between an active war and people evolving and innovating in real time versus what you saw in your cyber days. Well, it is pretty frantic on the drone side as well, but we have to remember that this is hardware. So hardware change is slower. You have to get the parts from somewhere. You have to get the radios from somewhere. There might be limitations on the frequencies you can operate in. So they can't change the drones as drastically as you could change software. But they are changing and they are reacting to whatever you're doing. So it is changing and the stakes are much higher.

Like, what's the worst that's going to happen if your malware gets detected? I don't know. What's the worst that happens if your drone gets detected? Your military operation fails and people might die. So it's a different game, different stakes. But the one thing that from my point of view, which hasn't changed, the enemy in many cases hasn't changed. Most of my life, I've been analyzing Russian malware.

I know I'm analyzing Russian drone. To speak about that, do you guys do any remote exploits of the drones? Do you have the ability to take control of them? Is that something you want to talk about? I'm not sure where we're crossing the line between industry secrets and good stories here. Sure. I'll talk about it. No, no.

This is actually something you regularly see drone defense companies. There's lots of drone defense companies. Many companies claim that, yeah, we can take over the drone and flight wherever we want. Yeah, doable has been done. Nobody's doing it with current systems, not even current common hobbyist systems. So, for example, the DGI, which is by far the largest drone manufacturer in the world, this Chinese system. Their protocol they used, the Ocusin protocol is end-to-end encrypted. It's not that trivial to take over these anymore.

It used to be something you could do with hobbyist drones. Nobody's doing this with military drones. The closest you have are GNSS jamming or even better GNSS boofing. So you send wrong location information at the same frequencies as it's really coming from the satellites, whether it's GPS or Galileo or Glunas satellites. And it's really easy to overpower the single coming from the satellites because they're 20,000 kilometers high. They're really far away. So if you have something closer, they can easily send much stronger signal and you can change the location information.

GPS isn't signing the location information in any way. You can just send whatever information you want. Galileo, which is the EU competitor to GPS, they have the capability of signing the location information, but GPS doesn't. So it's easy to make a drone believe it's in the wrong place. But again, it becomes a game of cat and mouse. We are just looking at some of the crashed Russian drones, which have crashed into Ukraine, and we've got some of the parts to our labs in Finland. They had eight different GNSS receivers on them. So they were locking into different satellites. They were trying to figure out if they are sending the same signal or different signals so they know there's jamming or spoofing going on.

And as it comes to exploiting these things, that is something we are looking at, not to take over the drones, but to just defend against the drones. So it's fascinating how much easier it is to do hacking of drones as opposed to hacking computers. What I mean here is that if you're doing a red teaming exercise and you need to break into somewhere and you find a server running some custom. software and you find a vulnerability, you find, you know, a buffer over for, something classic, or, you know, whatever, SQL problems. In computers, that would be the very first step. Then you would have to create an exploit and somehow get your code running and then you would have to do the lateral movement and all of that.

With drones, if you find an exploitable buck, that's it. Game over. You can crash the computer of the drone. you will crash the drone. It's not going to fly without the computer. So we don't need to do anything. If you are able to crash the system with any kind of exploit, that's it. And we do that.

That's so much easier for now. It's going to change. But for now, it's a pretty different ballgame. I feel like this is relevant to both the autonomous drones and your autonomous drone conversation and your history and security is, Like you've talked about when we reach a point where we can simulate the human brain, humans become the second most intelligent species on the planet. And you've talked about this idea of that being a basic evolutionary mistake. You've also talked about AI adoption, cybersecurity at this point as being basically mandatory.

Like you kind of need to be using it to be kept up. How do you think about building and using that thing that might be a basic evolutionary mistake? it's not like we would have any choice. Right. Right now in 2026, if you're not using generative AI, what the hell are you doing? The whole world is changing.

These tools are so powerful, so useful. Certainly you could turn your back to AI, but then you probably could turn your back onto all technologies that we've ever seen and just go and live in the woods. And nobody wants to do that. I don't want to do that. But we have to be honest with ourselves, the stakes with the upsides and the downsides with generative AI, those stakes are higher than ever before. If we get this revolution right, we will end up with a superhuman intelligence, which will solve all of our problems.

If we get this wrong, we will end up with the situation where we are no longer calling the shots on our own planet. I mean, it reminds me of your law about, you know, smart devices and yet the scale and the stakes of it seems so much higher now than before. Like, do you do you have a way of thinking about it? Like, do you have a law for AI, sort of a quick shorthand for how you talk to people about it? Are you guys programmers? I am. We're the last generation of programmers. Future generations will no longer.

longer program. We represent the last people on the planet who were programmers. Programmers of the future, they will only prompt and they will very quickly lose the idea of what it even meant to create systems by hand. And eventually, programmers will look at things like Linux kernel, just the way we look at things like the pyramids in Egypt, wondering how old are hell did they ever build it. Yeah, 100%. I was chatting recently with a professor from a university

teaching computer science and she told me that already today freshmen in computer science are asking questions about the basic building blocks of the internet like the protocols, HTTP and SMTP, asking questions like, hey, did somebody

really write all these lines by hand? Like every single line. Well, yes. Yes, we did. They became standards. They evolved over decades of like refinement. Yeah, it is, I will say like as a programmer, who doesn't do it as much as a career anymore, but it was a big hobbyist since I was a kid.

I actually have the same origin story as you, bypassing serial IDs in games, changing the code. I did the exact same stuff as a kid. The crimes have expired by now. The crimes have expired, yeah, we're okay. But the, it's so the efficacy of the AIs and using them now. Like, it's different.

Like I said it on X the other day. It's like for the first time ever, I actually feel like a software engineer instead of a software developer. Because now I'm spending all my time at the architecture level and the process thing. And no, I want to plug in architecture for this subsystem. And, you know, discussing the architectural and engineering. decisions rather than, you know, here's what I'm going to do and then I'm going to sit down and build the house myself. You know, I'm not nailing up the boards. It's like I, for the first time ever, I feel like we've transitioned to an engineer from a builder. And it's happening

surprisingly quickly. I mean, we've been waiting for this revolution for decades. I read about AI already in the 1980s and we were promised this, this great future, which is really now happening. for real. It's quite insane. And I think the best example of how fast things in computer security are changing is that I was doing a talk

in the Australian Cyber Security Conference in Melbourne three years ago. And on stage and this is, I mean, GPT, 3, chat GPT had been out for a year. And I was on on stage speaking about how these things are

evolving and getting better and better and picking up human languages. I was explaining how they already, like both Claude and GPD were now speaking Finnish, which is one of the most difficult languages on the planet, and not just writing it, but like speaking, I can chat, speak with the thing, and it speaks better Finnish than

I do, which is remarkable. And then I said on stay, now they're going to pick up programming languages. They already have rudimentary idea. They're not very good yet, but they're getting better. And when they get good enough, they will be able to find zero days. We will have AI systems which will find zero days.

Three different guys throughout the conference came to me after my talk to tell me that I'm full of shit. Yeah, Micko, nice talk and usually you make sense. But these things, they're not going to find zero days. Like, what are you on about?

Do you have any idea how hard it is to find a zero day? And look at where we are today. How many zero days have been found with these systems? Thousands? Oh, yeah. Well, there's so many that we don't even know about, right? That's right. What's the, I can't remember the name of it, Wings, something, where Anthropic gave Fable access,

or Mythos access to all those companies. And there's just all these CVEs being posted, backdated, being like we found all these these and like we've patched hundreds of bugs. And they were all security issues, but, you know, they've been patched for a month now because we've had access to these systems that are just rooting through and finding them and fixing them. Yeah, it's a wild ride. You talked about that moment of like a loss of innocence for scientists and engineers as the nuke. The loss of innocence for cybersecurity professionals being Stuxnet.

If you had to imagine the loss of innocence moment for this era of like AI and generative tools, what do you think that's going to be? Was it zero days or is it something we haven't seen yet? It's got to be AGI. Like when we everybody, when all of us will agree that now these. things are more intelligent than we are. That's got to be that moment. And it's kind of hard.

Maybe we've already passed it. Like, how do you draw the line? And it's interesting when you think about it from his historic perspective. I mentioned that I first read about artificial intelligence when I was a teenager in 1980s. I actually have the magazine, which in 1983 wrote about artificial intelligence. It's a popular science mag in Finland. And this magazine from 33 years ago, hold on, 40.

43 years ago. They got a lot of things right. They were talking about how in the future, like books won't be on paper anymore. They're going to be data by default, like e-books or whatever, and PDFs. They could see that in 1983. Obviously, everything was still on paper.

Then they said that, you know, one day we're going to have a hard drive, which is going to be so big, you can fit all the books and all the papers, all the scientific research, mankind's knowledge, on a single hard drive, which is what we have today. We just call it the cloud. And then they imagine that we're going to have a computer which has a CPU, which is so fast, can read all the books and learn. Well, we got GPUs, but, you know, close enough. They really got these things right. The thing they got wrong is, How do you measure the intelligence? How can you tell that it's smarter than a man? Because the same magazine that describes that if all of this would happen, we would get this super brain, superhuman intelligence, and we would know that it would be more intelligent than a man

when it would beat the best chess player in the world. That's what they'd like. And of course that happened already in 1990s. So maybe that's the hard part. Like where do you draw the line? When do we know? We're number two. Yeah, I feel like we're all holding on to critical thinking as our last gasp.

And the second that we get AGI and it starts taking over critical thought, then it'll be the... Yeah, and creativity, art. I think that's another thing. I have a personal problem with AI created art, which we all see all the time. we've had now top 10 songs in more than 10 different countries which have been made with Suno or Udio where no human did nothing and movies are going to be done by including Hollywood movies will be done by AI

from start to finish and all kinds of art including poetry will be done better by machines and the problem I have with this is that I hate this idea I hate the idea that the best composers and best poets on the planet will be machines. And I can't explain to myself why I hate the idea. Like, what's the problem for me? Why do I feel so offended by the idea that the best poet will be a machine?

I have no illusions that this wouldn't happen. It's going to happen. The best poet will be a machine. Why do I hate it? The only explanation I have is that I'm a huge, So I prefer humans. And that's not a very good explanation, is it? I could throw a theory out. It's only a theory, though, that the art has always been a way to express the human condition. And if you're a robot making art about the human condition, it doesn't feel as sincere, I guess.

Sucks, but it's going to happen. It is. Yeah, it's kind of a question of what art is for in a weird way. Because if it's what you said, Scott, that it's to see that there's someone else having an experience of the world that's some way recognizable to me. But just different enough that I want to understand it. When you see a piece of art that makes you think you're experiencing it and then you find out it was produced by something that didn't have that ghost in the machine, it feels like you've been kind of betrayed or tricked by this thing that's worked really well your entire life. How would you even know that it was done by a machine? If you don't know, it's done by a machine, it's more.

human, more touching, has more meaning. It's a deeper thing than done by any human. Then the machine is superior, whether we know it or not. Sucks. It sucks. Okay. Miko, I really appreciate you chatting with us. Earlier, you nodded to a story about want to cry and Bitcoin.

So for all this, I want to bring it back to just a good old-fashioned story. Can you tell us that tale to sign us off? So when Wanakri went around the world in 2017, he was asking for Bitcoin ransom from everybody who got infected. We know now it was the North Korean government. This was their very first Bitcoin ransomware attempt. It didn't work very well, but it caused massive amount of damage, especially in United Kingdom, because the National Health Service, the NHS in UK, was hit by Wanakry. So on the evening of the Wanna Cry outbreak, I get a phone call from UK.

It's the BBC. I chat with a journalist for an hour explaining exactly how it worked and why he was trying to do and why it caused all this damage and how it was trying to collect ransom and how does Bitcoin and blockchain work, all of that. At the end of the call, the journalist asks if I could come over to London the next day so we could shoot something for BBC to explain to people what's going to. going on with the NHS and I promised to take the morning flight. And then we talk about what to show on camera because it's hard to illustrate all these

cyber attacks and blockchain and these. And I suggest that I know I could take some physical bitcoins with me, you know, real coins because I happened to have them. I used to, I bought a stack of Kazaskiu's coin when they were $40 a piece. Congratulations. Unfortunately, I ended up selling them too early, but I had them at the time. So I suggested that I just bring some coins so I can show them on screen. And she was really excited about that.

She said, yeah, sure, come over and bring some coins. Why don't you bring several? So I fly over the next morning with the first flight to Heathrow carrying one five Bitcoin coin, one Bitcoin coin and one zero. And one Bitcoin coin on me. So I had six to one bitcoins. As I landed, I walked through the passport check to customs, and then I walk to the red line on customs. And there's a guy.

And I go to the guy and I explain that, hello, I'm entering United Kingdom, carrying more than 10,000 pound worth of monetary units. And he was like, okay, good. You have to report that. What do you have? I said, well, I have Bitcoin. And his space changes. And he's like,

okay, let me get a guy. And he goes and comes back with another guy who understands something about Bitcoin. And he's like, okay, 6.1 Bitcoin. he does the conversion that's around 15,000 pounds at the time. Yep, you have to report it. So where do you have the bitcoins? Are they on your phone?

Are they on your computer? And I said, nope, I have physical bitcoins on me in my wallet. And he's like, hmm, physical bitcoins. Let me get a guy. He goes away, comes back with the third guy. And the third guy, he's already mad from the beginning. He doesn't know what to do with me. He's like paging back and forth.

And he's like, hmm, physical bitcoins. And then he asks me that Mr. Hipponen, these 6.1 physical bitcoins that you are trying to enter the United Kingdom with, did you report them in Helsinki when you left for United Kingdom? And I tell him, nope, I didn't.

And he's like, excellent. You may go. Please go. And they just threw me out. He threw you out. He didn't let you into the country or let you in? he let me in he didn't know what to do with me because but he didn't know he now knew that no one else knew about them either so it's easier just to just disappear please there wasn't a fourth guy they didn't bring out a fourth guy no no and i wouldn't repeat this this rehearse either thank you so much for taking the time to talk with those that was a lot of fun yeah appreciate it it was a lot of fun jordan don't you think really interesting guy love the stories love the show and tell Yeah, we've never had props on this show before because we've never had a camera on before.

If you're watching this. Hello. This is what we look like. Jarring face reveal. Darring face reveals. Thank you for joining us on the show. And thank you again to Miko for showing up and chatting with us. And again, a big thanks to Nordlaer for their sponsorship of hacked.

Check them out in Nordlayer.com slash hack podcast. That was a fun one. It was. We'll see you guys soon. Catch you in the next one. Ready to take your investing knowledge to pro-level. This is Fidelity Connects, your daily edge in the markets.

Get deep insights on real-time market topics that may impact your investment portfolio. Listen to Fidelity Connects on Spotify today and power your next move tomorrow. Hey, y'all, it's Kelly Clarkson with Wayfair. Ever order furniture online and wonder, what if? Like, what if it doesn't hold up? That sofa was four days old.

You should have ordered from Wayfair. With Wayfair, there's no what-if. Just style you love and quality you can trust. Visit wayfair.ca.