The Pomp Podcast - #579 Joshua Steinman on Preventing Ransomware Attacks In Future

Episode Date: June 11, 2021

Joshua Steinman is a former National Security Council staff member and current startup founder. In this conversation, we discuss the National Security Council, the narrative world, centralization, authority organizations, credentialism, ransomware, bug bounties, and industrial control systems.  ======================= Did you know nearly 338 million dollars worth of NFTs were sent last year? And in 2021 that number is growing faster than ever. Looking to make your first NFT? Check out NEAR’s fast, scalable, low-cost, open-source platform. Learn why NEAR is the infrastructure for innovation at near.org  ======================= Cosmos is building the Internet of Blockchains, marking a new era of interoperability, scalability, and usability. The free flow of assets and data between blockchains with bridges to Ethereum and Bitcoin will unleash the potential of DeFi, NFTs, and much more. Dive into Cosmos at cosmos.network/pomp  ======================= OKEx is a world-leading cryptocurrency spot and derivatives exchange that offers some of the most diverse and sophisticated trading products and crypto finance tools on the market. Trusted by millions of users globally, we believe that cryptocurrency will reshape our money and society, enabling more financial inclusion with alternative tools and methods for wealth creation.

What's up, everyone? This is Anthony Pompliano. Most of you know me as Pomp. You're listening to the Pomp Podcast, simply the best podcast out there. Now let's kick this thing off. Joshua Steinman is a former National Security Council staff member and current startup founder. In this conversation, we discuss the National Security Council, the narrative world, centralization, authority organizations, credentialism, ransomware, bug bounties, and industrial control systems. I found this conversation fascinating and I hope you do as well. Before we get into this episode though, I want to quickly talk about our sponsors. First up is OKEx. Crypto moves fast and many crypto-focused companies can't keep up.

Crypto exchanges that cut through the noise are the ones that give you access wherever you are in the world to the cutting-edge projects emerging in this new asset class. If you're looking for an industry leader that gives you access to a huge variety of crypto assets, tools, and services, I'd recommend OKEx. As we all know, Bitcoin and other crypto prices can be volatile. If riding these price waves isn't your thing, OKEx also lets you earn passive income with your crypto. Earn is OKEx's portal to crypto earning opportunities, giving you easy access to DeFi earning protocols without the network fees, as well as other lending and saving opportunities where you can earn high rates of interest on your crypto. Check out the latest high-yield

crypto earning options on OKEx. Earn. Open an account today at OKEx.com slash POMP. Again, OKEx.com slash POMP. Next up is Cosmos. Cosmos is building the internet of blockchains, making a new era of interoperability, scalability, and usability. The free flow of assets and data between blockchains with bridges to Ethereum and Bitcoin will unleash the potential of DeFi, nfts and much much more dive into cosmos today at cosmos.network slash pomp again cosmos.network slash pomp internet of blockchains marking a new era of interoperability scalability and usability next but not least is near near is an open source platform that accelerates the development of decentralized applications overcoming high fees and slow speeds with its fast scalable low cost

and climate-neutral blockchain protocol. This is why NEAR was recently awarded the climate-neutral product label from South Pole. One transaction on NEAR consumes about 1,300x less carbon than a similar transaction on other chains. Learn why NEAR is the infrastructure for innovation at NEAR.org, N-E-A-R.O-R-G today, NEAR.org. Go check it out and let me know what you think.

All right, let's get into this episode with Joshua. I hope you guys enjoy this one. Anthony Pompliano runs Pomp Investments. All views of him and the guests on his podcast are solely their opinions and do not reflect the opinions of Pomp Investments. You should not treat any opinion expressed by Pomp or his guests as a specific inducement to make a particular investment or follow a particular strategy, but only as an expression of his personal opinion. This podcast is for informational purposes only. all right guys bang bang i've got josh here thanks so much for doing this man

thanks pop it's great to be here and uh great to be in miami yeah for sure uh you are a former navy officer and you served in the national security council uh let's just start first with military experience like what'd you do in the military and then what got you interested in going on to the National Security Council? Yeah, I did a lot of Middle East sort of Intel Ops work. I got recruited out of college to join interesting corners of the Navy and did two tours in Iraq. And then when I wasn't deployed, I was working on tech policy. So helped stand up the Defense Innovation Unit, which is the DoD's embassy-based kind of function in Silicon Valley. And this was like an outpost. I think I'm going to mess this up, but there was a

uh, maybe the secretary of defense, Ash Carter. Yeah. Is that right? Yeah. That's right. When I was working at Facebook in 2014 or 2015, uh, he came out there and he met some people at Facebook, most of the veterans. Uh, and there was kind of a big effort to set this up, right? Yeah. So I wrote a bunch of, uh, white papers back in 2013, just talking about how this was a big challenge that we had to figure out how to work with Silicon Valley with startups, uh, shorten that time between innovative technologies coming to market and the Department of Defense using them. And so there were a bunch of people involved. I was just one of them. But yeah, by 2015, we stood up that effort full time. Very cool. And then National Security Council, what exactly is that? I think

people hear it, but they're just like, all right, explain. Yeah, yeah. It's very hard to explain because you have to have a lot of knowledge of the details of how the U.S. government works. But you can think of it as like a traffic cop for national security decision-making processes. So anytime there's a really complex decision that needs to be made, if the president doesn't want to make it, the president can delegate it down or take a recommendation from specific members of the cabinet like the Secretary of Defense, the Secretary of Treasury, Secretary of Energy, the director of the Central Intelligence Agency, and a bunch of other folks, the president could say, hey, what do you think about X?

Like, should we go do this really complex, risky thing? If they want to get recommendations, they can delegate down to their deputies. And if those people want recommendations, they can delegate down to subject matter experts inside those departments and agencies. At every step of that decision-making and recommendation process, the National Security council staff writes the decision memos, organizes the meetings, writes the recommendation memos that come out of those meetings and runs those meeting processes. And so it sounds like you're sort of doing a lot of paperwork. What it ends up being is that NSC staff end up coordinating

most national security decisions and actions and strategies that the president wants to execute. And how much of this is like for discussion purposes, right? So the president or somebody else who's high ranking, they want to better be informed or kind of solicit feedback. They come to the National Security Council. There's a bunch of discussion. There's a bunch of kind of information shared. And then really, it's not an organization. It sounds like that kind of has a vote, right? And it's like, yes, no. And there's an action taken. It's more so an information-gathering exercise and that discussion that informs the decision-maker, and the decision-maker still is the one who makes the decision. So it's actually both. Okay. The president can delegate down and say, hey, you make this decision. At the same time, in fact, there are a bunch of, like, votes. Interesting.

And so sometimes it'll be like, hey, the Secretary of Energy and the Secretary of Defense recommend that you take course of action A. and then like the head of CIA and, you know, the head of Homeland Security believe you should go for, you know, decision B. And then you'll like write up that memo and take it to the president and be like, what do you want to do, A or B? And so in many cases, yeah, there are like big fights that happen. And then in many other cases, you're right. It's just advisory. And the president will ask those members of the cabinet and on the National Security Council, hey, give me some recommendations, how should we proceed here? But it really is up to the president. So each president gets to sort of craft a national security council that they want. And you were supposed to focus on

cyber for the most part? Yeah. So cyber, supply chain, telecom. And then when we had to do crypto things, and it was mostly at the end, I handled that as well. Got it. And so just talk a little bit about some of the things that people were talking about. When you think of national security, right? You think a lot about kind of direct action in combat, or you think of the CIA, the military, right? Like that's the national security. But when you hear cyber or you hear supply chain, you hear cryptocurrency, like that's not what most people think from a national security standpoint. So like, what are those conversations like? What are the topics that people cared about? How informed are people on some of these topics? You have to remember that

when you're a member of the cabinet, when you're the secretary of defense, when you're the secretary of the Department of Homeland Security, in many cases, you may be a subject matter expert in one area, but you're overseeing these organizations that are incredibly complex. And the selection bias for people that end up getting to those types of places is often that they've proven their chops as a subject matter expert, and then they've moved into some kind of management. And so in many cases, these people are being asked to decide topics that maybe up until a few weeks before that meeting actually happens, they haven't really touched. And so it's the job of the NSC staff and then the staffers at those departments and agencies to get those, and they're called

principals, to get those principals ready for that meeting, to make sure that they're getting all the intelligence briefings, all the background briefings that they're going to need in order to then come into that room and make that decision. And then sometimes those people are just so jam-packed. They're doing so much from a day-to-day basis that like, and this is what the NSC staff ends up doing, they'll get a two-page briefing memo on the drive over to the White house and they'll read that and then they'll walk into the room and they'll have to have that conversation. And that's why the NSC staff plays a really critical part in many administrations because instead of just bringing people into a room and like the cabinet, the national security

cabinet, which is also known as the national security council, you can imagine they come into a room and someone says, Bitcoin, what do you think? And then a bunch of people start talking. Instead, what the NSC staff tries to do is narrow down those discussions to like a single point of contention. And so in many cases, you have long processes for like months, in some cases years, where people are literally trying to figure out what's the thing we need to decide? What's the thing that maybe only the president can decide? And then you have those conversations at increasingly senior levels so that when it does eventually get to the president or when it gets to the actual National Security Council, the actual cabinet members that advise the president on foreign

policy. They have very specific things that they're discussing. Yeah. And what seems so fascinating about this is something like cryptocurrency is probably not very well understood, right? So you need staff members who are doing education. Then they're identifying like, hey, here's all the things we all agree on, right? Like this asset exists, right? This asset is, you know, worth X dollars, like, you know, whatever. But then there is obviously the lesser known the topic, probably the more there is that is either disagreeable or decisions that need to be made. And maybe let's use the unhosted wallet. That was probably the most public thing that I think the National Security Council was involved in. At the end of the last administration,

basically there was rumors. I don't know if there was actually any kind of regulation proposed, but it was spoken about of regulating these unhosted wallets. So talk through using that as an example of like where the National Security Council plays and then like how you saw that situation unfold. This is a perfect example. So what happened was that the Department of Treasury was debating issuing a rule, a regulation, and something was released. And so the job of the NSC in a situation like that is to circulate amongst the decision makers, hey, here's the piece of paper that this agency is thinking about putting out. And then if other people have equities in that topic, the meeting is where they can air those concerns. And so while, you know, I won't

get into the specifics of the, and there was a meeting, and I was the person in that meeting as the staffer that was trying to organize that meeting and get people on the same page. This is what the discussion is going to be. So won't talk about what happened in that meeting. But at the same time, it's that process of like getting people together, making sure that they're all on the same page, they understand. And there was a proposed rule that came out very late. And so So that's the thing that resulted from that meeting that the Department of Treasury was considering. And so that's what an NSC process looks like.

You have a department that's thinking about doing something that's well within their sort of legal remit to do issue regulations. That's what these departments and agencies do. But then when it runs into potential conflicts with other departments and agencies, the NSC basically acts as that traffic cop and is like, OK, you want to do X. This other department has a concern about why. So how are we going to sort of find either a compromise or maybe there's not going to be a compromise. And when everybody comes together and we break down the issues, we take it up to the president. The president's going to say, actually, we're going to go 100% in this direction as opposed to this other direction. Got it. And so this seems to be the exact opposite of where like cryptocurrencies, decentralization, etc. are, right? It's a very centralized hierarchical structure. I know you've spent a lot of time thinking about and kind of, you know, really trying to understand this shift from what I'll call it the narrative driven world to something that is more kind of mathematically based, something that is much more focused on incentive systems and coordination governance in a decentralized manner. And so from a narrative-driven world, it really feels like small groups of people, right, is kind of the first example.

Two is heavy, heavy credentialism, right, of I went to a certain school, I worked at a certain place, I've got a certain level of wealth, I've got a certain position within the government, etc. Sure. So why do you kind of see or you believe after having spent so much time right in this kind of hierarchical world that we are shifting away from it, that we are going to end up in this more like decentralized world? I think that what we've seen over the past 20 years and really accelerated over the past 10 years and five years is that what the internet is delivering on is this promise of the decentralized world. And whether that was the election of 2016, whether that's the development of blockchain-centric technologies, whether it's Bitcoin or Ethereum or other things like that, erbit networks that can allow people to enjoy some of the tools that we've come to expect from the internet in a decentralized way. I think that this is the direction, this is just from my experience, where things are going. And the reason is because they're more resilient. I think that they allow people to see the benefits of their efforts. And so with, you know, unlike previously where if you wanted to be someone and, you know, Pomp, you've got this great podcast with hundreds of thousands of listeners and you've got an amazing email list that nearly 200,000 people read every day.

if you wanted to reach that type of an audience 10 years ago, 20 years ago, 30 years ago, essentially you would have had to run multiple, oh, nevermind your investment fund, right? Where you get to decide how to deploy capital. You would have probably had to live three separate, completely separate lives, one in an investment bank or a private equity firm or something like that, one at a big newspaper, and then another on a radio station. And certainly there are some people in New York City that are able to do things like that. But the internet allows you to do it much more, right? And so, you know, the past 20 or 30 years, and I'm really preaching to the choir here, I know. But the past 20 or 30 years saw people build platforms that allowed people like

you, to some extent, people like me start to build out those types of audiences. But those people were still sort of charging a little bit of rent. And so as we move towards more decentralized platforms. I just think that people are going to migrate towards the lowest friction environments and low friction environments are things like Bitcoin. There are things like Erbit, there are things like Ethereum, et cetera. And really what we're seeing is this breakdown of the narrative, right? And the narrative being you went to a certain school, you worked at a certain place, therefore you must have all the answers, right? And I think that the internet, as you've described, has kind of exposed some of that of your hero is still human, right? They

still put their pants on one leg at a time, like the whole nine yards. But also, I think that there's been a number of events from the war on terror to the global financial crisis to the pandemic and plenty in between where people just lose a little bit of trust, right? A little bit of faith. And it's not always some massive degradation of that trust or faith, but it's just a little bit here and there and here and there. And then if you kind of zoom out, you look over the last 20 years, you're like, oh, wow, we've come really, really far in that loss of trust and faith in these institutions. Slowly and then quickly. Yeah. And so from a credentialism standpoint, does it just not matter at all? Is it, oh, no, wait, maybe like the top 1% of

credentials will still matter forever. How do you think about, you know, where we are with credentials and kind of how that'll evolve over time? I think it's sort of a yes and kind of a scenario. You're still going to have, you know, the importance of people going to these, in many cases, great schools, great organizations. Think about it from the perspective of the Facebook PM, right? Like, you know, when I was back in Silicon Valley in startup world, being a Facebook PM meant that you'd gone through, you know, a little bit of formal training and then a lot of on the job rigor. And it meant that no matter who you were, if you had that title, people would take you very seriously as a product person. And I think that that shows two sides of the coin. Like

one, there's an expectation of rigor. And so you have programs like Austin, Allred running Lambda School, where you have anyone can come in, they can apply and they can go through a training program and they come out and there's an expectation of rigor. What's that person going to be able to do? At the same time, it was like it was Facebook, Facebook PM. OK, I got it. This person must be a rock star. And so I think that you're going to have those two kind of worlds. But, you know, as those pies get bigger, there are going to be folks that like aren't Facebook PMs, but they're going to have built themselves some massive audience or they're going to have a reputation that's derived because you can look at their commits on GitHub. You can see contributions

they've made on Stack Overflow. And you're going to be like, wow, this person's a legit developer. They really know C++. They've contributed to these code bases, et cetera. And then at the same time, you're going to have folks where you're going to have that organizational patina. Again, they're a Facebook PM. They're going to go interview at a startup. And they're always going to have that gravitas because of that environment they came out of. And I just think that both these things are going to increase or at least be able to coexist. But I think it's the first one. It's that independent world that people can like make their own way in without having to go through these established organizations that I think we're really seeing the growth of.

Yeah. When you start to think about the impact on the centralized entities, right? There's some things like, let's say a company or a business, right? I think we've now see decentralized versions. Remote work in some way is, it's still a centralized company. There's still a CEO from a structure, but you're decentralizing the actual physical presence, right? And so we're getting some of the degradation again. But what about like the government, right? In terms of, is there decentralization happening within like, you know, the US government? Is there decentralization happening within some of the more legacy types of institutions, maybe that aren't doing remote work? Just what is that impact as this trend becomes more pervasive, the tools become much

more prevalent? Do you see anything happening there? I think it's a huge opportunity for the United States government to think through how it structures itself to accomplish the missions that the American people expect it to accomplish. I've heard stories on both sides of this wall over the past 18 months, where as government workers have been asked to stay home and not come into the office, I've seen folks have come and told me about, oh, X got much more efficient. And then in many cases, oh, it's no longer that efficient. And I think that what we're going to end up seeing, and just given my experience in the military and then on NSC, I think it'll take a while. But as we have more tools that allow folks to understand like what, and this is what

that decentralized world offers is objective measures of efficiency. I think that if we can start to, if the United States government can start to focus on those, I think you'll see a lot of improvement, but I think it's going to take a while. Yeah. Authority organizations are another piece of this, right? Where you can decentralize the actual entities themselves, but also there's almost this maybe lack of importance on a lot of these authority organizations. Some of it's demographics. So younger people always have just kind of thumbed their nose at some sort of authority, whether it was their parents or a school or something else.

But it does feel like there's a societal shift underway here, right, where many of the organizations that we used to put incredible credence in what they said and what they did, now maybe they're still important, but they're just not as important. and the trend is not working in their favor. Is that your read on this? Yeah, I think that one of the most important things that we're gonna see is that organizations that allow for some measure of clarity around the data

that they're using to make judgments about the world and about their business process, I think that those are gonna be organizations that are gonna be very successful. And so people's skepticism, and we can talk about that, but it exists, right? people are skeptical, maybe they're increasingly skeptical. And the more raw data that we can and potentially cryptographically verify as real, that will allow people to essentially build their own

models on top of models, both in their own mind, and then maybe models out, you know, in the digital world. And they can say like, look, we can all agree on some set of facts. Maybe we don't agree on the conclusions that we draw from them, but we can agree on a set of facts. I think the more we and drive organizations towards creating immutable facts. I shouldn't even say creating. Recognizing, publishing immutable facts that allow people to then think about those and come to judgment on those. I think that's where I'd like to see things go. Yeah. One of the areas that the National Security Council is probably thinking about a lot right now is this whole idea of ransomware and central points of failure. And as we get into more and more of a decentralized world,

I think that some of these will go away, but we've recently seen a number of kind of cyber attacks, right? Something that was right in your wheelhouse. Maybe let's just start with like, what is ransomware and like how have the types of attacks evolved over the last few years? Yeah. Ransomware is when a malicious actor installs a malicious piece of code on your computer or on your maybe cloud server and in some way, shape or form takes over or locks you out of that system. And so it can take many forms. There are famous ransomware attacks that have happened in the past four or five years. But core of what happens is like, hey, I can no longer log into my computer. And then the attacker that did that sends me an email and

says, hey, if you want access to this, you have to pay a ransom. And so we've seen this all over the world. There's a famous attack in 2017, NotPetya and WannaCry. These are two massive campaigns that were undertaken that locked out hundreds of thousands, maybe millions of users from their computers and asked people to pay cryptocurrency to various accounts in order to unlock their machines. And so what are they doing? They're simply just locking you out of the machine and they're saying, hey, you can't get back in until you pay? Yeah, that's right. How do you pay if you can't get in the machine is that a problem yeah maybe you use some other computer or something like that in some cases uh and we have to go back maybe we can put some

stuff in the show notes but those attacks actually even if you paid the ransom didn't unlock those machines it's really challenging because again you're dealing with an anonymous internet-based malicious actor and you don't even know what their purpose is some of these ransomware attacks that have spread around the world have been targeted very narrowly, but then they've spread all over the world, you know, possibly, you know, by mistake, or maybe it wasn't intended to do so. But, you know, in many cases, these things are uncontrollable. I mean, they're digital viruses, right? That's right. They have a virality to them that whether intended or not can spread very quickly, right? Yeah. The world became much

more familiar with virality over the last year or so. Talk a little bit about the recent ones in the United States. So there was this one in Tampa. There was something around like beef. I think there was a pipeline attack. Are they all kind of similar in nature, but just targeting different types of infrastructure? Or how do you kind of categorize them? Yeah. So ransomware has been around for a while. And I think what we're seeing now is it is expanding in terms of the scope. And so what it used to be was, hey, maybe someone would lock you out of a computer or maybe they'd lock you out of a network or something like that. But over the past really 30 years, we've started to put computers into industrial control systems.

So you mentioned a few big industrial systems like Tampa Bay Water Treatment Facility, a series of meatpacking plants around the world, a brewery, the Molson Coors Brewery was hit by, I believe it was hit by ransomware a few months ago as well. And then obviously you had the Colonial Pipeline attack where by all reports what happened was that the accounting systems at that company were hit by ransomware. And so there's this change happening where, and the Tampa situation is the only one that I'm aware of so far, where there was an actual attempt, and that was not ransomware by the but there was an attempt to dial in over the internet and change some of the operating

parameters of that water treatment facility. And so on the ransomware side, what you have is people that are dialing into computers, locking a user out. And then in this other situation in Tampa, you have a malicious actor trying to log into that system and change the operating parameters. Now, I think that in some way, some of these trends are going to converge. And what's going to end up happening is they're going to have these massive industrial infrastructures where the attacks, they may or may not go after the computers that the humans are using, but they'll go after the computers that are actually governing the process that makes the thing that generates the capital for that undertaking. And so it's like, sure, you could go after the CEO's laptop, but if that CEO is the CEO of a giant meat processing facility and that actual equipment that's processing the meat all of a sudden doesn't operate, that's a real problem. Yeah. So it's almost like getting into the CEO's computer.

Maybe you can get some ransom or whatever. But if all of a sudden you shut down the operations of the business, and essentially what you're trying to do is you're trying to get to the most critical piece of infrastructure. And if you take that out, then all of a sudden you got everyone's attention. Exactly. And not only is it a problem in the short term, but that equipment is super expensive, right? It's a big capital expenditure. It costs a ton of cash. And if you have to replace that, I mean, you're going to really hit a company's bottom line.

most of these are asking for dollars cryptocurrencies some other form of compensation yeah usually it's crypto um and then i'm sure there are other examples that i don't have but obviously crypto is really easy for these folks to ask for and then because the crypto is sent in a public ledger uh is it pretty easy to track down where it goes from there is there a way to basically use that to like catch who these people are do they usually not get caught like kind of What's the maybe like the law enforcement angle of this? I mean, that's a really interesting part, which is that, you know, the many of these currencies, Bitcoin, especially the the chain is, you know, people can see who owns what

coins. And so, yeah, in many cases, they are asking for Bitcoin. And while I can't get into how law enforcement or the intelligence community goes after folks that are doing these types of illegal activities and they are illegal. Yeah. I mean, that is one thing that is, you know, somewhat good. Uh, it's not a sort of bearer bond or something where you can just sort of walk away with it. And a few years later, um, you know, use it or redeem it. Got it. Um, these industrial control systems, I think most people, uh, would think of, Oh, the, you know, meat processing plant or, uh,

a water facility for a water company, but they also are like the electrical grid in a major city, right like it seems like that's a pretty similar type of thing and if all of a sudden you can take over the electrical grid shut down electricity in the city like maybe mass chaos doesn't happen immediately but you know you only have to go a couple of hours if not a day or two and you're gonna have mass chaos yeah it's a big issue and uh there are a lot uh there are there's a lot of attention that's being paid to it so uh the new administration has done some great things on this topic. They've got some new orders out, some new instructions. We did a lot of work on this as well, trying to shore up and secure those systems. It's something that a lot of people are paying

attention to, not only in the government, but then you've got great companies outside of the government that are building amazing technologies to try and prevent these types of attacks from happening or find them and very quickly remediate them once they have. Is the electrical grid the most important? Is it nuclear reactor, you know, energy plants? Like, and some of this you may not be able to talk about, but just like what types of things are like the really big things that everyone knows that's in this world? Like, hey, we got to protect, you know, A, B, and C. There's a lot of important stuff out there and a lot of it's connected to the internet. And so I think that one way to sort of judge this is you look to see where the government is spending time

trying to buy down risk. And so sort of nerd out for a minute, you can look at some regulations that have been put out by the Department of Energy. And they have been for many years talking about the cybersecurity of the electrical grid. And in fact, there are a bunch of requirements there where if you're operating on that grid, you have to do certain things from a security standpoint. And I think that what is going to end up happening over the next few years is more and more of those types of regulations will come out for critical infrastructure sectors of which uh there are many as like officially defined by government uh government documents so energy is one like what are some of the energy is one you can think of chemicals as well it's

like the chemical industry then you could think of like uh pipelines you could think about transportation um but uh yeah there's a ton right i mean think about it everyday life like if you had to unpack um if you had to unpack everything that you do on a day-to-day basis and ask like how many times does that process that allowed me to do that thing touch the internet i don't even know how you do i live on the internet yeah literally yeah your your house your security system your car the gas that filled it you know the supply chain that allowed that you know automotive company to make that thing i mean jeez so this is uh i'm just thinking of this so bear with me if this is a ridiculous uh question example but uh we're talking about these kind of

control systems and um i forget what movie or tv show or whatever but i've seen it the example multiple times where somebody puts like a pacemaker yeah right and then it gets hacked and then there's all sorts of issues with that uh in some crazy way like that's the control system for the human body and it's connected to the internet right no very small portion of people have them and it's real though, a lot of these pacemakers have Bluetooth, you know, transmitters in them and are running firmware. And like, how often are you going to update the firmware on someone's pacemaker? Right. And the FDA pays attention to this, but it's a huge issue. Medical devices. I mean, we could go down a rabbit hole here, but you're absolutely right.

And is there a concern there that like, I guess, remotely somebody could affect like all pacemakers from a certain manufacturer or is it more so uh what i'll consider like uh the targeting of an individual i know that you have a pacemaker if i get within proximity it can pick up the bluetooth then that's the bigger problem it's a weird world we're getting into and i imagine that probably you've got a bunch of these types of things that not only people are thinking about today but are going to be challenges tomorrow yeah it's uh it's fascinating when you start to think of just like what are the things connected to the internet that we would not want to be affected yeah it's a lot all right i want to talk about uh kind of how we fix some of these problems

um both short-term and long-term solutions uh to do that maybe let's talk about uh this tampa situation um there's a water treatment facility yep that basically the control system gets hacked uh with ransomware or not with ransomware it was just someone literally dialed in okay and tried to change the mixture of the chemicals that were treating the water oh so not even like pay me just like like basically i'm a non-economic actor right and i'm just gonna like screw with you yep how do they get in there i don't know if you know or not and then like what are the ways that we can basically solve that short and long term so there are a lot of best practices that have been put out that government puts out the private industry puts out

a lot of it has to do with like how you protect and segment those types of systems how you conduct maintenance on them like are you updating them regularly how are you attaching new computers into the networks that are governing those systems honestly and you know you'll know this from your time in the military and from my time in the military as well like the basics get you very far and this is not new you know my predecessor said this my successor talks about this all the time on the NSC, where if you are, if you have basic hygiene, if you are structuring your networks in like a reasonable way, like, hey, you know, maybe we shouldn't raw connect the computer that's controlling the mixture of chemicals that are, you know, going into the

water supply of 20,000, you know, Floridians right to the internet, things like that. You can protect that, the low hanging fruit, and you can protect yourself against those sort of like drive-by types of attacks. I think first of all, obviously you have to go and protect these types of systems by using best practices. And then as you move up that chain, like once you've done the basics, you can start to do more elaborate things. You can monitor the networks, monitor the endpoints. You can start to think about looking at the standard behavior of like that water treatment equipment. You can start to set parameters like, hey, if you see it move out of like this baseline, let someone know. Almost like an alert system that, hey, we might not be

able to prevent everything, but the next best thing to prevention is like immediately knowing. Exactly. And so what you have today across this environment is people building companies that are sending alerts one at a time, maybe on one set of equipment or another. And over time, what we're going to see is people are going to start to looking, looking at all of those alerts. And then they're going to start to use big machine learning algorithms. And they're going to start to figure out like, what does normal behavior look like? What does abnormal behavior look like? And that's, that's where we're going. So, you know, you have a very almost manual environment today. And I don't mean manual because there are, there is a lot of digital instrumentation. Many of the

companies that make this equipment, you know, Siemens, Rockwell, ABB, General Electric. I mean, they're highly digitized. But the point is, is that in many cases, you're not able to take a look at the entire infrastructure all at once. And so over time, I think you're going to see instrumentation that happens on top. People start to build out models of what's normal behavior out to however many sigmas of average behavior. Like, hey, in 99,000 situations, this looks normal to us here's like the one scenario that looks abnormal that's where i think we're going yeah it feels like um some of this is very obvious but a lot of the nuance and the things are probably the most valuable are not very obvious to those who uh don't understand the problems don't

understand kind of how uh kind of complex these control systems are right something as simple as just hey we should monitor and if it goes without outside of some band like let us know okay it sense when you start getting into the actual like ph levels of the water right super complex super nuanced and so i guess is it the belief that like you're going to get vertical specific type solutions right so like somebody's going to go build whether it's a company a government whoever okay here's the security apparatus and software for uh water treatment plants and then a completely different team will go and do it again for electrical grid or whatever or do you think that there's going to be more kind of horizontal software built where it's just, it doesn't matter

if you're the water treatment plant or you're the electrical grid, so many of the components are similar and therefore you can actually get software that is more applicable rather than just one vertical. I think you're going to see the one and then the other. I think you're going to see the stuff being built for specific industries. In fact, it's happening now. And then over time, you're going to have people build out that additional layer of software that's going to essentially be much more of a swiss army knife and uh and even that's happening now got it uh let's talk about bitcoin before we stop i expected this yeah uh what just what are your thoughts on bitcoin in general let's just start there and this is you personally this is not anything anywhere

you've worked or anything yep uh i'm a big believer in decentralized systems i'm a big believer in decentralized stores of value decentralized compute and i think as many people are observing And this past weekend here in Miami has showed, you know, there's a certain degree of inevitability around this, if only because people are looking for ways in which they can preserve that which they've earned themselves. And then even, you know, getting away from specifically Bitcoin, but other cryptocurrencies like go out and earn and demonstrate and build value. Yeah. When you think about that asset, and let's say that it's going to coexist with a bunch of other assets, is there a national security component to this of embracing it or not embracing it? Is there an economic? Is there some sort of societal implication that really kind of interests you? Or do you think it's just the complexity of all these different disciplines

and that's really where your interest lies. My thesis is a lot around the decentralization of so much of our society that as I think about that thesis, Bitcoin, cryptocurrencies, distributed compute, they just really fit into that worldview of where I think technology is going over the next 15 and 20 years. And whatever personal value judgments I may have on that trend, And really, it doesn't matter. I do think that this is just happening. Inevitable. I mean, we saw a country literally say, yeah, El Salvador, say that they were going to, I think, consider there's a law that they're going to try and pass. But, you know, I think more of that's going to start happening, especially as, you know, we've seen a lot of central banks deal with the past few years with monetary policies that like average folks may not have really understood. But maybe if they knew and some do, maybe they don't agree with it and they're going to vote with their pocketbooks. I forget what the quote is, but I think maybe Henry Ford says, you know, if people understood how money worked, there'd be riots in the street before morning.

right like it's pretty uh uh not a new phenomenon right but that's one of the things that i think is really interesting about this is uh if you go all the way back in history this is a story as old as time it just happens that now we've got digital platforms uh like twitter and and uh various other platforms that just kind of expose it faster into wider audiences etc yeah super weird I wrote a paper back in college on the Indian subcontinent and like the 18th century and the British and same story. You had small principalities that were devaluing their currency and it caused a lot of upheaval on the Indian subcontinent.

And there are precedents throughout history where these types of things have happened. And I just think that, you know, uh, it's something that we have to pay attention to. I, um, I also think a lot about, uh, one of my favorite documentaries ever, uh, is the men who built America and, uh, it's the history channel, right? And they've got, uh, Rockefeller and Carnegie and just all of them. And I forget, uh, who did it, but at one point there was essentially, uh, a war over the equity of maybe it was like Carnegie steel, right? And whatever the business was, let's say it was just for kind of illustration purpose.

Let's say it was Carnegie Steel. Carnegie all of a sudden then went and said, wait a minute, you're buying up stock. And you just start to print more and more stock certificates, right? Like physically print them to then dilute the adversarial action of somebody buying up a stock, trying to get any controlling stake. And I think about that happened all the time until investors got smart. I said, wait a second, we're going to create an anti-dilution clause. You cannot kind of maliciously dilute me without, you know, these protections. We don't have that with the currency. We literally have that with equities, but we don't have that with currencies. And it's not

a US dollar thing. Like that is just the structure of currencies around the world, right? A hundred plus currencies around the world. They're all the structure of the exact same. And so it's a very unique thing that I think currencies specifically get a treatment that maybe other types of assets don't get, whether because they're physical in nature, right? Because they're really hard to produce. Or there's, you know, investor protections that, you know, just don't allow for it, right? Yeah, I think this just goes back to a comment that I made earlier, which is like, what can we do? What can organizations of authority do? And it's like, publish clear sets of facts, let people decide. And so again, okay, we're conducting our lives

denominated in US dollars. And, you know, people aren't thinking about that. And as they start to realize that that's what they're doing, I think, you know, they may start to wonder, you know, what are some other structures that could be used? And, you know, maybe they'll come to some other conclusions about how they want to do that, how they want to store their wealth, how they want to spend their wealth. Yeah. It's a fascinating world. Yeah. The whole move from centralization to decentralization, I think, is inevitable. to some degree uh there will be a spectrum of uh types of decentralization again you may have a hierarchical structure at a company but you get remote work all that and i think one of the pieces

uh that we don't think a lot about right you have experience that most of us don't which is how do those centralized entities that um it's nearly impossible to see a government for example becoming decentralized right how do they navigate this world and some of it may just be there at a level where it doesn't matter right i always joke and say uh higher education probably in trouble right from a long you know trend perspective ivy league schools probably gonna be the last ones left right like they're the they're the ones who probably don't have to worry so much about the disruption it's the you know tier two or tier three school in the middle of nowhere that like writing's on the wall you know you probably should be figuring out how to disrupt yourself now

And so it feels like governments are similar to the Ivy League schools where just they're going to be the last ones from a centralization standpoint that have to worry about some of this. I think that, you know, in many cases, governments have been this like dominant power paradigm that we've lived with for – humanity has lived with for thousands of years. And so on some level, there is a need, right? There's, you know, collective defense. There's, you know, propagation of law and order. And so as I think about like what the future of these types of power structures looks and feels like, you know, I think to some like great sci-fi authors that have been talking about these types of things for years. Neil Stevenson with The Baroque Cycle and Cryptonomicon and other books in that vein, thinking about how do those types of organizations evolve? How do governments evolve? What are going to be the things that peoples are going to demand, ask of their governments to do? And I just think that decentralization offers really interesting potential futures. And so, look, it's going to be

it's going to be a brave new world. Yeah. What are you most excited about with crypto kind of moving forward? Is there like one or two things that you're like, hey, when this happens, that'll be really big or something that you're specifically kind of watching? Yeah. On the security side, Bology Srinivasan put out a really interesting tweet storm a few days ago talking about the future of security, talking about bug bounties and things like that. And just as an example, a bunch of friends and I have a small little group chat that we run. And we just started talking about the mechanics of what it's going to look like when we can build these, what now seem like very novel security systems. And one fact sort of stood out at me, which was

that, you know, right now, due to the complexity of blockchain technologies, there's sort of like a limit as to what types of file sizes can usefully be stored on chain. And that that in and of itself is sort of like a bounding condition around like what we can actually do from a security perspective. Because right now, a lot of security technology relies on a lot of information flowing across a system. And it was this moment where I think, at least in this little chat, a bunch of us and, you know, there's some crypto people in there, there's some security people, some venture people in there. And, you know, my reaction, I put this in the chat, is that, you know, this must be what it felt like 20 years ago when people were looking at the internet.

And they were like, oh, yeah, of course, at some point, there will be like high def, full motion video live streaming from like you know uh device a to device b over the telecom network and we're just now getting there like you know 17 18 19 years later where you have like 4g lte 5g technology and yeah now you can get like live stream 1080p on your on your phone um and so thinking about like the the useful file sizes that can be you know deployed or utilized over these you know, distributed systems right now, I think we're going to need to see the same type of growth that we've seen over the past 20 years in terms of like ability to handle complexity, file sizes, transmission rates, things like that. But like we'll end up getting there. Like biology's vision

is absolutely one type of future scenario where, and what he envisions is software being published on-chain and people who identify weaknesses in that software through whatever, and nobody's created these oracles yet, but it's like you'd build oracles that would validate that this person, this researcher had found a weakness in the system and then immediately was essentially paid out a bounty for identifying that weakness. And then people can see, oh, the team that's maintaining this um you know this protocol has fixed the weakness that was identified and all that happening very quickly in near real time and i think that that's like a definite possibility but it's going to take a while yeah it's um it's very interesting how the world gets rewired when

you take what is probably the core mechanism which is centralization uh because we've pursued efficiency low cost you know the corporation itself right is uh kind of the the ultimate manifestation of centralization um and then you start to unbundle it again yeah right if you kind of think there were no multinational corporations you know uh thousands of years ago for the most part it was a bunch of merchants all over the place right they're all local businesses and then you got that centralization and are we about to go through the unbundling I don't know. I don't think anyone actually knows exactly how this plays out.

But it seems like we're probably more likely to head that direction than not. Yeah, no, I think you're right. And I'd be remiss if I didn't mention one of my favorite people writing on this topic, entrepreneur in his own right, very successful, Jordan Hall. And we can put some links to some of his writings in the show notes as well. But Jordan's been writing really interesting stuff for many years on what might the implications of these things be. And again, I think offers compelling visions of the future.

Yeah, that's awesome. Before I let you go, three questions for you. Then you get to ask me one. What's the most important book you've ever read? Cryptonomicon. Why? It tells a story of what happens when information transforms from one state to another. And I think that's in some way, shape, or form what's happening now.

Interesting. And so Cryptonomicon is these like, for those folks that haven't read it, first of all, they should read it. But it's these two stories told, one during the Second World War, and it's kind of sci-fi, Neal Stephenson, Second World War, and then this like, and he wrote it in advance, you know, before, I think he wrote it in like 90, in the late 90s. But then he tells the story of the emergence of a cryptocurrency in like early 2000s. And the characters in both timelines are like the children of the Second World War timeline. There's great military stuff in there as well. But in the Second World War timeline, they're talking about this transformation of information. They're talking about cryptography, code breaking, and how information has been transformed from like physical stuff into like digital stuff. And they're discovering like what does that actually mean, right?

They're like listening for submarines. They're listening for encoded messages. And they're turning that back into sort of like, you know, human usable information from digital information back into like physical information. And then that same book in that second timeline, they're taking money and they're turning it into a digital concept. And so in both timelines, Stevenson is talking about what does it mean for the transformation of the form of information? And in one case, it's like raw information, intelligence information, military information. In the other, it's like information about value. And so I've read Cryptonomicon, I think, five times at this point. And it's just one of those books that like, you know, it's really well written.

It's super exciting, especially for a military guy. And I love it. That's an awesome suggestion. No one's suggested that one yet. Second question comes from our friends at 8sleep. I sleep on their thermoregulated bed. I used to sleep like five, six hours. I'm like eight now. I've literally, uh, got the notification on my phone today. I slept nine

hours and 40 minutes last night, which, uh, life changing to say the least. Uh, what's your sleep schedule like and how's that evolved over time? Yeah. So, um, I, you know, back when I was in the military, it was like five, six hours, you know, like going really hard. And then, um, yeah, in the past four years I've, I've tried to transition over to like sleep more. And, uh, I've definitely been looking at the eight sleep mattress. So, uh, yeah, the, uh, the, uh, the influence campaigns working off, uh, tell Mateo I'm signing up as soon as I move out of DC in the next few weeks. As, uh, as Mateo has known, I started asking this question on here and, uh, he started

laughing. He was like, dude, like one out of every three people that already own one. Right. I was like, wow. Uh, I think it's just something in the tech community, right? like there's a product that uh the user experience like works for them yeah all right i gotta i gotta do one of those uh you know they've got those bungalows that they're renting out so like that'll be the that'll be the kicker that is uh that is definitely the way to go try before you buy yeah

uh third question is aliens are you a believer or a non-believer agnostic at this point i think that uh were you a previous non-believer and recent information has made you agnostic i mean look you've got the law of large numbers and the universe is a big place. So I think you can come to your own conclusions about that. Obviously, there's a lot of excitement today about videos that people are showing and stuff. And I guess just from my personal experience, I haven't seen anything definitive that's been in public. And at the same time, one of the things that I just kept telling myself no matter what job I was in is like you don't understand reality. You're only striving to understand reality. And it's like

every time I thought I understood something or like a person's motivation or like I think this person did this thing behind the scenes. And then once you actually get there, you realize that like reality is much more complex, right? Like whether it's like crazy advanced technologies that people are working on or whether it's just like weird, um, you know, camera angles, like, uh, I, I haven't seen anything yet. Um, but what I, what I do know is there's like a lot of strange stuff that happens in the world. Like some of it, uh, I imagine is done by government. Some of it's done by individuals. And, um, I'm just more in that, in that mindset where I just think when I see something that people are saying is this really fantastic thing, I just think, you know, there's

probably a bunch of other explanations for what we're seeing and instead of giving myself that really quick like answer like oh it must be x i just think well you know there are a bunch of things that it could be i always go back to they may exist well they probably exist but they're too far away for us to ever come in contact with right we should have the technology they don't technology whatever but also too is the definition of alien right like ufo doesn't mean alien right to uh uh we didn't understand gravity at one point now we do right so like that type of stuff right um but also uh it could just be like an insect in the ocean right like you know or just i don't know watch videos of trees time lapsing or like plants over like time lapsing and like they shake they do

this they do that and you're like wow that's super freaking weird you know people who listen to podcast a lot i've heard me talk about this you do you see the cephalopod intelligence test no oh man so a cephalopods like a like some kind of fish or whatever yeah i'm not an expert on cephalopods but uh they gave it an intelligence test uh-huh and it had like a higher intelligence like a young child and you're just like okay yeah like octopuses that are like shooting out the light bulbs in there i mean you've seen those videos yeah you're just like man that thing's freaking smart yeah yeah so i don't know uh what one question you have for me to finish up yeah where uh where do you think is going to be the first western country that's going to adopt

cryptocurrency on a day-to-day basis like this el salvador situation like a developed nation yeah um estonia switzerland you can see those two i mean they just tend to be more forward kind of thinking yeah um i think that singapore is interesting i don't know i think i put them in the developed world right obviously and uh it could go either way with them um so i think those are like three the big one's gonna be um you know russia china yeah they come out and say like that that gets more i think a little bit into the national security stuff yeah uh but obviously russia and they both have frankly been talking publicly about de-dollarizing for a while and and you know so kind of would fit that trend uh but i haven't given up hope on the united states

yeah like miami coin do uh yeah so like i think that um i don't think the federal government is going to go and like the treasury or the federal reserves can be like we have a great idea let's buy bitcoin and put it on the balance sheet right like i don't think that that's going to happen uh next right maybe it happens you know at some point but but not next what i do think though is very real and obviously uh mayor of miami francis swore has been working on it a couple other places i know that are thinking about it and working on it is cities or states doing it and um i'm not the best person to kind of go through all the nuances of this but uh there's a lot of people in the bitcoin world who have written about kind of reintroducing the idea of we live

in a republic made up of 50 different states laboratory of democracy and the competition actually is playing out a little bit right now yep and so all of a sudden you could see competition and economic incentives and all the stuff taking over and then each politician is competing over who's more pro-bitcoin and you know there's a senator with laser eyes there's a congressman with laser eyes there's now a president of a country with laser eyes uh there's a mayor with laser eyes like does that make laser eyes the like bar for progress no but that's a pretty high you know uh kind of step to take if you are sympathetic to uh the asset and what is actually the most fascinating to me is how much of it is sympathetic to a financial asset versus

the ideals and ethos that are kind of uh intertwined with the asset i think it's actually more the ladder yeah right is somebody thinks sure the asset is great whatever but it's the ideas of freedom and democracy and decentralization and kind of innovation and entrepreneurship like that's the stuff that i'm really interested in and so i want to align myself with that audience and so that's a much different thing than just like hey let's all go buy bitcoin yeah right um which uh they're gonna do too right but uh we'll see it's an interesting thought process of like does a city your state do it again uh does a city or state buy bitcoin put on their balance sheet before a developed nation does it i don't know yeah right like it could go either way yeah so i think that

alone just the fact that we're like oh it could go either way is a pretty big uh kind of revelation compared to most people just think like the united states federal government or another country's you know central bank states are good enough yeah awesome where can we send people to uh to find you on the internet so i'm blogging on my post uh national security council life uh thinking about security industrial control system cyber security and then uh random thoughts at uh steinman.substack.com okay and then i'm on twitter and uh put the link in the in the show notes it's our dangerous men i got it back in 2009 our are it's a you know uh it's a quote from a book really yeah yeah Lawrence of Arabia.

You know, I was like a Middle Eastern guy for like 15 years. I was Al-Qaeda back before it was cool. What is the quote? Do you have it memorized? Yeah, yeah. But it's like, it's kind of worn out at this point. Oh, okay. I don't even want to, yeah.

All right. But it's about people that imagine what the world could be. The dreamers of the day are dangerous men for they can, you know, essentially like make things, make their dreams reality. And it's this line from Seven Pillars of Wisdom from lawrence and it's describing you know how he's thinking about um you know taking on this grand challenge of fighting the ottomans in the middle east with like maybe 300 dudes

and he freaking did it i think the u.s military understanding of a normal like everyday infantryman i think you're supposed to believe that you've got the upper hand when it's one of you verse the three of the enemy and then as you get you know kind of maybe ranger regiments is like one of five you know one verse five and i remember reading a statistic one time it was like one one to ten or one to twelve for you know our most elite forces and just thinking about like that's crazy yeah three hundred versus a couple thousand it might have been more but i mean it was right tens of thousands yeah exactly yeah whole different world right and uh yeah it's and hand-to-hand combat yeah well you know no air support or yeah yeah maybe a biplane like every

few weeks yeah all right man well listen thank you so much for doing this yeah thanks for having me hope everyone uh goes and subscribes to the sub stack and we'll have to do it again in the future. Bang, bang, right?