Cyber Privateers Policy Sparks Security Debate

Hey everybody, happy Friday, and welcome to the Techstrong gang. And well, we got a lot going on today with a little help from the government and security, because there's just all these topics that are out there, including, well, are we bringing back Captain Kidd? I'll explain later.

But let me introduce the gang members today. We have Jon Swartz. How you doing, buddy?

I'm good. Good to see you. Good to see you.

Jack Poller, how are things? Things are great. Thank you.

It's Friday. All right. There you have it.

Drew Gutstein, how you doing, buddy? Hey there. Happy almost weekend, everyone.

We're close. Excellent. Tracy Ragan is back from her adventures overseas.

How are you, Tracy? Doing great, thank you. You decided to come back, so that's good, because a lot of people, they get to see certain countries like Ireland and they don't come back.

So I'm just- Yeah, it was hard. It was hard. Especially leaving Dún Laoghaire.

I really liked it there. All right, there you go. And Jeff Reich, how you doing, my friend?

Or Rich, sorry. I'm doing well. Happy Creamsicle Day.

Yeah. So a creamsicle, just whimsical, or is there a plan behind the creamsicle? Oh, no, I'm certain the Creamsicle Lobby created National Creamsicle Day.

Had I known, I would've handed them out, but I'm not sure how I would make that work, but it's a thought anyway. All right. I'm going to jump right into today's topics, because, well, the president has signed another one of his famous executive orders, and this one basically says that we're going to line up a few companies that have been trusted and vetted, and they are going to be authorized to go after cybercriminals.

This is not necessarily a new idea. We've had privateers forever as we can remember. The English used to hand out these little marquees and send off people to go fight pirates and rival ships from different countries, including the famous Captain Kidd, who at least started out as a privateer before he became a pirate and then wound up on the wrong end of a yardarm.

But, also as it turns out that during the American Revolution, the Founding Fathers, they didn't have much of a navy, so they commissioned all kinds of privateers operating out of mainly New England. And those guys were accused of being more interested in just plundering boats than they were in anything called Liberty. But that's another story for another day.

But Jack, you're looking at this stuff. We've been kicking this issue around now, I think, within the cybersecurity community now for years. And we even talked a little bit about it on a gang a couple of days ago.

But what's your take here? Because I got one half of the world telling me it's long overdue, and I got the other half of the world telling me these are acts of war and we're going to be in trouble. Yeah, and I think that is the real distinction.

It is very clear that there are both regular cybercriminal gangs and what we call nation-state actors. And unfortunately, those two groups are not mutually exclusive. In fact, there's a lot of people who their day job is a cybercriminal and their night job is a nation-state actor, or the other way around.

They work for the government and they do bad things, and then they say, "Hey, I got all these great skills and I'm stealing money on behalf of my government. " Right? Yeah.

They're called entrepreneurs, right? Yes, exactly. And to that point, when you go and look at our cyber defense industry and all of the major companies that are involved in this, that have research groups that go and research all the big attacks that they happen and who's responsible for them and try to do attribution, they actually have very specific naming conventions for nation-state actors.

So one company uses animal names and anything like Fancy Bear and whatever is associated with ... So bear is associated with Russia, panda with China, and they've got another one for North Korea, et cetera. So it's very common that there are nation-states that are attacking both the US government and private companies, right?

And so we have a very good defense industry that we've set up, and I'm part of this, and there are some 4,000-plus cybersecurity companies out there working to protect organizations. But the question is, is defense enough, or do we want to go on the offense? Because maybe if we have a good enough offense, we can stop it instead of just being reactive to it.

We can be a little bit more proactive. So there are a lot of different opinions on this, a lot of different views on this. As you alluded to, the US government and our Founding Fathers were aware that the government wouldn't always have the capabilities on their own to attack our attackers.

And so in the Constitution, we allow for Congress to create letters of marque and reprisal specifically to enable privateer organizations. And so what the president- I don't think this one went through Congress, though. So this didn't come from Congress, but even without Congress, we have a very long history of the military paying private organizations, part of the military, private military contractors, we call them now.

And that's anywhere from supplying human bodies to supplying equipment and human bodies to operate them, or both, right? And we do that in a variety of different ways, not only on the physical side, but on the intelligence side. There are private military contractors.

There's also CIA contractors that are responsible for defensive and offensive intelligence gathering overseas and with our adversaries. I think the real question here is not Can the US do it? I believe we can do it legally.

The question in my mind really is should we do it and what happens to private companies that do this? And then what's their liability and what's their reputa-- And there's a lot of reputational risk more, in my opinion, than there is actual liability. I think that if your government is paying you to do this stuff, they're going to end up backing you in some way or another.

But there is a reputational risk of if you do something and get it wrong, and you're a defensive organization, you're helping all these organizations defending their environments. Now all of a sudden you're on the offense and you do something that ends up taking out or damaging one of your own clients that you're defending. Now what happens to you as an organization?

And so I think it's a very big murky area. Well, it gets more interesting, though, because if we look back in history when England commissioned privateers, well, so did the Dutch and so did the Spanish and so did everybody else. " And we can imagine that other countries are equally outraged when maybe, I don't know, sometimes US espionage people are breaking into stuff.

I don't know. Drew, what do you think? Is this just going to descend into some chaos?

Yeah, probably more chaos. We're pretty much there already. But I think what's sort of scary about this arrangement is, A, we don't know who the companies are, and B, what does the license allow them to do?

We already have cyber offensive capabilities in the US. Our law enforcement, our defense industries, they do this. So it kind of begs the question is why would a private company want to do this, too?

Now, in other countries where attacks are kind of aimed at us, this isn't directly funded, licensed companies. There's a ecosystem that you can coax, you can prod, you can buy essentially, just by paying for ads, and create the environment where people want to do these attacks because it makes money for them. So are people going to be making money from this and where are they going to make that money from?

Is the US actually paying these companies to do this? I don't think that's the case. It's very, very murky.

And I think it is almost hard to believe that this will be used in a beneficial way, right? The way this is set up is intentionally opaque. I don't like it.

Well, Warren, you wrote the story, but- Yeah. What I was going to mention, without taking sides, I got a lot of reactions. So typically what I'll do when I think a story's going to get a lot of reaction and I want commentaries, I'll go on LinkedIn.

I got flooded with comments, mainly from security companies who seem to be willing to do this, or they were in support of it. And I'll tell you kind of to summarize what they were saying. Basically, what many of them said was this idea or this concept, no matter what you think about it, highlights what red teams have recognized for years.

That if you're scanning for weaknesses, that isn't a strategy, and neither is waiting for permission to act on what you find. And they also mentioned to me, and there was some data to back up their concerns, this escalating cyber threats targeting American citizens and critical infrastructure. And one that stood out to me was national security incidents such as foreign state-backed cyber attacks against more than 30 US water systems, which I believe we're going to talk about in segment C or the third segment.

And also the amount of money lost. So in a sense, I was surprised by how proactive and how virulent the comments were. And we had a debate about this a couple of days ago, and I know, Alan, we were talking about the debate versus cyber war versus terrorism.

How do we couch this? So that was the reaction I got. I think it's important to note that it was uniformly almost the same response.

Yeah. I'm not sure, but I believe if you look in Lenin's critique for terrorism, it wasn't just about killing people, it was just quite literally about scaring and paralyzing folks. So you can argue that stealing grandma's money and is terrifying her with a purpose of creating havoc.

But I don't know. It's a fine line. But Jeff, what's your thoughts here?

You've been floating in and out of this whole security space for a long time. You want to bring another perspective here? Oh, I'd be happy to.

Thank you. First of all, Drew, I think I agree with your assessment. Jack, you ended yours with saying it's getting murky, and I think we could take part of that word out.

These are mercs. All right? If this were a kinetic implementation, they would be mercenaries.

So let's now call it what it is. Plus, we don't know the rules of engagement, which I think brings up the concern Drew mentioned. And John, I think that's where you're getting some of that response.

Without the right rules of engagement, we don't know. If they're signed and engaged with a million-dollar bond, really? But if they're signed to engage as representing the US government, without the right rules of engagement, they could easily commit an act of war and not necessarily know it.

And if you go back to the Blackwater incident, when with that? In Where they shot a bunch of civilians. And I'm not saying this is exactly the same.

I'm trying to think how long. It was 10 years ago at least, I think. And they ended up, there were some convictions, and then there was a mess around that.

I think we run the risk of running down the same exact road here. And just because it's cyber doesn't mean you can't have a kinetic impact. And I also wonder about these private firms that cooperate, or the coalition of the willing.

They become a target. And they lack nation state immunity and defensive shields, so they're carrying a substantial reputational, physical, and legal exposure. They are.

Tracy, what're you feeling on all of this? You've been overseas out of the whole country. You come back, and you get hit with this.

This is a d*****s idea. That's about how I feel about it. First of all, we are woefully under-prepared to start a cyber war, and it feels very uncomfortable to me for this kind of IP.

We'll be basically paying these companies to build very destructive software that is not owned by the US government. It's now owned by private companies. And criminal minds just make very dangerous bedfellows.

Mm-hmm. So, the Trump administration's been talking about a cyber force, and bringing this kind of technology through the private companies, just like they do for Space Force or any of the military branches. It seems to me that would've been a much better way to go.

But to enable small companies to build this kind of technology and own it, certainly they're going to use it. And who's to say they're not going to use it against, as has already been stated, private individuals and US companies that they want to steal from? What's going to stop them from doing that?

So this could create a forever cyber war that we are not prepared for yet. We can't even figure out how to fix simple vulnerabilities right now, and 50% of those, according to IBM's Data Breach report, are targeted to the public sector. So- Mm-hmm ...

if we don't have our defensive strategy down well, is it really time for us to start an offensive strategy that we have no way of controlling, and there's no accountability for it? So, in essence, the way I see it, we're asking these privateers to start a war that we may not be prepared to win. Jack, do you have any understanding of how this will actually be managed?

Because if we use their privateer model, you would commission a bunch of guys, they'd hop on a boat, they'd go capture some other boat, and they would keep everything that was on that boat for themselves, and maybe give the government 10% for their trouble. So now, am I going to have a bunch of so-called, as Jeff pointed out, mercs that are going to identify, quote-unquote, targets and when they go after them for their ransomware ill-gotten gains, will they keep those gains or a percentage of them for themselves? My understanding is that the federal government is going to.

It's not run as a military operation, it's being run as a legal operation, so it's under the auspices of the DOJ, Department of Justice. And that targets will either be selected by DOJ or approved by DOJ, and they have to have a plan before they take any action. And there's- That doesn't make me feel better.

That makes me feel worse. Yeah. Then there's two separate questions there, right?

It's- Yeah. The DOJ is a mess right now. Why would you give them any- It's a cartoon DOJ.

This is even worse, really, Jack. Right. So like I said, that's my understanding of how it's supposed to work.

Whether it will work well or poorly, I think there's a consensus here that it would be poorly. I'm not sure I would disagree with that. But I will say just one thing, which is there is an argument being made, and I'm on the fence on this one or not, whether we are starting a war or whether we're playing catch up to an already existing war.

And that we have been ... It's like nation state attacks against the US and against critical US infrastructure, something we're getting into in the next couple of segments, are not new. This has been going on for a very, very long time.

And so again, like I said, a lot of people are making the argument that we're not starting a war. " So because- Yeah, so that's a really good reason to get rid of CISA and NIST right now. I was going to say that.

It's like- Come on. Isn't this a consequence of eviscerating CISA? Exactly.

It was like we had teams that had brilliant minds. I knew some of them. Brilliant minds that are now working for...

One of them went to Europe. She's working for the EU. We got rid of those people that could do this.

The style note I'll add is he did this on the wrong day. He should've done it on September 19th, which is International Talk Like a Pirate Day. Wow.

Geez. But is this really privateers? Because if it's coming under the auspices of the DOJ, it sounds like a posse to me.

It's basically, I'm getting a bunch of guys together, throwing them on a horse with a sheriff, and away we go. Yeah, but they're going to find somebody, not go attack somebody. Well...

We're talking about creating small companies who are being given license to go out and attack something or somebody. Well, what did the old movies say? Wanted dead or alive?

That was a license to attack. It is a little crazy. But- I don't think that worked very well, Jack, just to say.

I'm not saying it did. Just that there's some history there. But Drew, let me ask you this.

Back in the day at least, and maybe we got better at this, but it was really hard to determine what the source of an attack was in the first place because it was moving through these very complicated networks. Are we getting any better at that, or is there a high probability we'll accuse somebody of doing something, and we won't have the right evidence to support it anyway? So assuming that evidence even comes into the picture here, right?

Because I don't know if that's actually even required. It is hard to identify nation state actors or which groups are behind attacks. Like Jack was saying, they're generally put into regional buckets.

But I think what I'm thinking of is less the sort of like Iran going and attacking things. It's more of what was happening back in 2016 with the Cambridge Analytica and the PSYOPs and things like that, that those companies were running. This isn't going to be just going after cyber criminals.

That's a very loosely defined term, right? I think that this is going to make us a lot less safe, not more safe. I can't see any reason why this would be done for a good reason.

Well, folks, I'm going to leave it there because we'll probably come back to this topic again in the near future once somebody starts explaining how this might all actually play out. But it's dangerous times out there and a lot of difficult decisions are being made, and a lot of them are, shall we say, colored by politics more than rational thought. So, make your own assessments from here.

But I'm going to shift a gear to another topic that also requires some opinion of your own to make. But, as we've talked about in a previous show, the Trump administration has created an API through Truth Social, through which people can gain access to a presidential tweet before the public sees it. And the idea here is, I guess, that maybe they're going to act on that information within a few seconds on Wall Street.

I think it only takes a few seconds to execute a trade, maybe even less, based on what data comes in through this API feed. John, I'd love your opinion on it, but I want to ask you something. So, other people will do this if this stands.

So am I going to see governors, senators, prime ministers? Everywhere in the world, there's going to be somebody who has influence over a market, is going to create an API, that's going to create access to licensed information that nominally belongs to the public. And, is this going to be the new standard?

And if so, does that not just create all-out chaos? It creates all... Yeah.

It's like monetizing public policy communications. So, The Intercept and Freedom of the Press Foundation are suing the White House over this millisecond early access, which costs $60,000 to $100,000 a month. And we have two senators, Schiff and Warren, who want the SEC to investigate, although I see that going nowhere.

The idea is that selling preferential millisecond early access to presidential posts violates the First and Fifth Amendments. And to me, this whole thing is insane that it even started. But, why not, I guess?

So these presidential announcements, and Trump does a lot of them, they shape national policy, foreign relations, public law. So these, in a sense, I think these belong to the public domain and should be accessible to most citizens. But in a sense, they're being monetized, which I think is going to create this unprecedented conflict of interest and fairness of financial markets.

If you can afford early access and influence, you're in great shape. But if you can't, good luck to you. And I think about this in the context of some of the things that Trump has said in terms of Truth Social, in terms of policy around tariffs, executive orders, trade policy.

This is crazy. This is chaos. Right.

Jeff, why would any everyday investor participate in a Wall Street market that they can tell is going to be fundamentally rigged? Because there's going to be people who are essentially insiders with access to a Truth Social API. Maybe they already do have access in Mar-a-Lago.

But I'm sure there's tons of insider trading. But at some point, this just kind of breaks down the whole sense of trust that our markets are built on, no? Oh, I think that's spot on.

Why would someone invest in a corrupt system? Because this is corruption. The word hasn't come up yet in a discussion, but I'm not sure if we can call it anything else.

If you give me a lot of money, I'll give you early access, and that access is going to influence markets and communities and defense and then infrastructure. How can we be in a point where you have to buy that information early? It bothers me.

The people are going to profit, are the hedge funds and the high-frequency trading firms. Yeah. They're going to profit off of public policy changes before ordinary investors, which is mostly everybody else.

Mm-hmm. Tracy, you didn't think much of the previous policy, so what about this one? I am not surprised by what he's done.

We do have a mob boss running the country. This is criminal. And it also brings up a different conversation.

Who really owns that data? Is it public data So, is a post on LinkedIn something that LinkedIn owns? And does Trump really own his own post on Truth Social and can he sell it?

Because he owns Truth Social, so in his mind, it's his data to sell. But what we're saying is it's not. It's public information.

So if he continues with this, it's going to very drastically change what it means to put information out on a social post, regardless where it's at. Who owns that information? There's a fine- And we're having that discussion in AI anyway, right?

Yeah. But this is just ugly criminal stuff that we're looking more and more like a Russia every day. Let's just put it that way.

And that's maybe the goal. Jack, walk me through this. I think there's a fine line here that somebody's trying to cut.

I don't know how successful they will be, but I guess the president, if he shares that, has immunity. But if I shared it with somebody, I didn't tell them to act on it. So is the liability here going to be whether I actually acted on the information I got through the API or am I just kind of getting a little bit of a heads up that I can do something after it goes public?

But there's that, I don't know, 20 seconds that exists between when I get informed via the API and when Truth Social posts it. But if I don't act on it, am I still liable? Not liable?

What do you think? I think it's the actor, so the one acting on the information that is acting illegally in this case. Now, this is separate from the First Amendment argument, which just happens to be there because he's the president.

But if he wasn't the president, this would still be illegal for people to act on this information, because it's materially non-public information. If you trade when you're in possession of material non-public information, you are inside trading. Right?

Now, like you said, a couple seconds. A couple seconds is an eternity in this space. We're talking about less than milliseconds, right?

And so there's this weird sort of gray area of is this actually public yet? When does it become public? And so you're taking advantage of this sort of loophole, I guess.

But it doesn't stop it from being insider trading, right? Even if it's just a millisecond ahead of everybody else. But the DOJ's not going to do anything about it.

Well, the SEC would have to do it, and they're not going to. And they're not either. They're not either.

Well, so I will say that I agree with Jon Swartz, that his adjective is, I think, appropriate. This is insane. However, that being said, I think that there is a historical precedent here, not with the president, but with Congress, that has exempted themselves from insider trading.

And if the legislative branch can do insider trading, then why shouldn't the executive branch be able to do the same and to take advantage of it in the exact same way? And I don't agree with that, but you have to look and say the Congress itself and the people whining, complaining about Trump doing this, do it themselves. Jack, if I can, I don't think it is the same, because the legislatures receive the information and perform insider trading, which they made legal.

Oh, you don't think they talk among themselves about what they're going to say publicly and not publicly and when- Oh, no. Absolutely ... and take advantage of that?

Yeah. Well, ab- Oh, they're allowed, and they do that, and they're allowed to do that, so. But they don't sell it.

That's the difference. They don't have to sell it to take advantage of it. He's taking advantage of it, of the availability of information.

He's taking advantage of insider information in his own way. The Congress does it a different... The mechanism might be different, but it's still effectively, as Drew said, it's still effectively an insider trading.

He's providing a community where certain groups of people have information that is not publicly available that he and they can take advantage of the same way Congress does, and they have already exempted themselves from the law that says you can't do that. I see your point. Yeah.

But there's still already an insider trading law that we do not enforce, right? Well, but wait. But again, that insider trading law- Unless you're Martha Stewart ...

doesn't apply to any member of Congress. There's 535 people for whom that does not apply. Mm-hmm.

And certainly, the- You know- Yeah. Anyway You're like- Let's let Drew have a swing at this one. Yeah.

Thanks. I was going to say that certainly the companies buying this information are the ones that are holding the liability. They are the ones not allowed to trade.

And Truth Social is not trading in the market on this, presumably. So they're just getting a fee, right? And it's the people who are making the investments and profiting off that early information that are breaking the law.

I think there's a good case that even distributing this information in that way is probably illegal, too. Mm-hmm. But it's very hard to kind of crack that time window argument, because no matter what, there's always going to be some people who get it before others.

Mm-hmm. So, yeah, I think we would need new legislation that would have to specifically go after this kind of arrangement, because private entities can do this, too. You don't have to be the president to move markets.

Right. Well, I want to clarify something, though. Well, I want to clarify something.

Hold on. Jack, I think you said that Congress can do insider trading. That is not true.

They try to keep Congress from doing any kind of trading. Right? But what they said was Congress can still trade stocks, and they're still responsible if they do insider trading.

So if they learn something and they go trade on it before it's public information, they can be held accountable for that. So they're not immune to insider trading. What was they were trying to do is stop them completely from trading stocks at all while in office.

Yeah. Because they do insider trading that nobody does anything about. So we mentioned yesterday, I think Allan mentioned the number of investments the White House, this government has in tech companies.

I don't want to layer that on top of everything else. It makes this even more nefarious in a certain sense. Right?

So we're influencing, we have influence peddling, and then also these companies are benefiting directly under certain circumstances. And I think we're going to probably see some more of that as AI data centers start being built out, and all this money's being thrown into this AI hype cycle. It's just leading to just a big slough.

Also, if I'm paying like 10 grand a month or 100 grand a month, whatever it is, how do I know that I'm getting the data first? There's no way to tell. Well, I still think it goes back to who- I'm not getting the data first, because someone has that data before they give it to me.

I still think we're opening up questions about who owns the data in the first place. If he should be able to sell it. Right.

Just because he's saying that he can because he owns the company. I think we've got to move on, but I'm just going to point out one small thing to what Jack was pointing out. It seems like every one of our public servants magically winds up being richer as they leave office than they went into office.

Thank you. So something wrong here, one way or another. Yeah, you know what?

I'm going to agree with that. Can I just sort of... Because I'm thinking about a certain politician that's based out here who has stakes in every significant tech stock that took off in the last couple of years.

Wow. They are just the most luckiest investor ever. Smartest investors.

Brilliant. Brilliant. There you go.

All right. I'm going to shift a gear here, but talk a little bit more about government and security. And we touched on this a week or so ago when the initial attacks came, but since then, we have seen that these attacks, they're probes or whatever you want to call them, that they trace back to Iran against our water systems here in the US, were across multiple states, and that led to some actual conversation, at least in Congress, about maybe some legislation to shore up the security of these things.

And we've talked about it on this show and everywhere else that our infrastructure from a security perspective is not all that strong. Jeff, is there progress here and frankly, did we just get lucky, or were we somehow other smart? So I'm going to start by taking a refreshing drink of water.

Thank you. So I worked in the oil industry in the previous century, I'll say it that way, and we used industrial control systems or ICS. All right?

They were vulnerable, but in the beginning, they were not on a network, so you had to physically go to it to fiddle with it and make it do something that the owner didn't intend to have happen. Then we created local networks, and then they all got on the internet, so every engineer can change those ICSs. Those are what run all of the water and wastewater systems.

And for the most part, even though there's been some advances, most of them are still as vulnerable as they were 30 years ago, and that's actually the issue we have here. I've been with InfraGard a few decades now, and when you look at all the critical infrastructures, water and wastewater is one of them. And we've been saying from day one, ICS systems have to be completely overhauled and probably replaced to offer more security, and it hasn't happened.

Some organizations, some communities, some states put some firewalls and perimeters around them, but the vulnerability is still there. " I don't know the number, but I'm certain there's at least hundreds of thousands of ICS devices within the US. Even if that legislation passes, right now, we're probably five to seven years away from being able to have ICS devices that we can trust.

So I'm not saying it's all doom and gloom, but it's going to take more than that, and we need to get something in front of it, and we can't ignore it anymore because it's more than water and wastewater. This is really the same issue that happened with Colonial Pipeline. So these ICS systems are out there, and Jack, I know you've been poking around on this topic for a while, but we know that they're a problem.

Why don't they get replaced? It seems like common sense. Well, I'm glad that Jeff brought up Colonial Pipeline because I was going to talk about that, and let's just put it this way, that was early 21st century as opposed to late 20th century that Jeff was talking about.

But yeah, it's a very simple equation. It's dollars. Right?

These things run. They are very, very robust systems, and nobody wants to screw around with something that's currently running for fear that it won't run when you replace it, or fix it, or change it in any way, shape, or form. It's why they don't even get patched because nobody wants to take a system offline and risk The catastrophic event that you're trying to prevent, causing it while fixing it.

" It's like, "Oh, look, there's a water supply problem. " It's not a water system problem, it's not an EPA problem. It's a cybersecurity problem across critical infrastructure, as Jeff said.

It's oil and gas distribution, it's water distribution, it's sewer distribution, it's electrical distribution. We're spending a fortune now to put a whole bunch of windmills out across... You go where Jeff is in Texas, it's like miles and miles of windmills.

And every single one of those is connected over a wireless connection to a control station somewhere that turns them on, turns them off, makes them run, points them into the wind. Right? When it's too windy, puts a brake on it.

Well, if somebody gets in there, hacks that, a lot of physical damage can happen. We saw that with the Stuxnet attack that hacked Iran's industrial ICS systems running their centrifuges and destroyed them. So it's a big cybersecurity problem on critical infrastructure, not a water system problem.

And I wish we would take the bigger picture look at this. Right. But Drew, to his point, these systems, especially the water systems, some are owned by companies, but a lot of these public infrastructure things are semi-public private partnerships owned by a local community.

And the guy running the water system, he might be, for grins, we'll just call him Joe Bob, but I don't think Joe Bob knows squat about security. So, who's actually going to take care of this stuff? Yeah, I wish I knew.

You would need an army at this point. I think there's a couple of things that are really kind of funny about this. One, the impacts are largely mitigated just through manual operation.

Right? It's almost like they were low tech enough to still be able to work. Maybe if they were a little bit more high tech, then they would just completely fail.

But there's been a lot of money poured into this stuff over the years, and none of it's really made a dent. I've been waiting for this to happen, too. All the conversations or all the statements that the administration's been making about attacking Iranian infrastructure, I was assuming that that's because they don't need bombs to destroy our infrastructure.

They can target it. We need to go there. Right?

That's a big imbalance. And so I think this is part of the regime applying pressure, and I'm wondering if they held back because there were a lot of breaches, but not a ton of damage. So I think we're seeing more, and I think it'll be very closely tied to what's happening in the war right now and where they are in terms of ceasefires and whatnot.

Jack, do we know that for sure it was the Iranians? Because it could've been just a bunch of people working for companies that sell bottled water, and they have a vested interest in this conversation. I don't know.

Well, I don't know for sure that it's Iran, but I bet there are 20 companies right now that are salivating at the prospect of the DOJ paying them to go after Iran. This is true. " Well, Jeff, I think there are probably, of the 45,400, 4,500 cybersecurity companies, there are a couple of hundred that are called red team penetration testing companies.

That's what they do. Right? But it's all about the dollars when it comes down to it.

Yep. Maybe instead of doing some insider trading from Trump, we could fund this activity instead. So my problem with this is that the EPA is being asked to work with CISA and NIST, which we know are gutted, to create new standards for critical infrastructure.

We already have a lot of standards. And we have CMM levels, that they could require municipalities. Even the small water municipalities could achieve CMM requirements.

So do we really need more is my question. Direction over basic controls and remote access and credentials and configuration management and incidence response and segmentation are really already handled in the CMM levels that any company who wants to do work with the federal government has to achieve, even if they're small like ours. And the irony of this is Pete Heggseth just announced that if you are trying to do work with the federal government and you're not at CMM level two, then don't worry about it.

You don't have to be there. Which is great on one side, but bad on the other. But the point being is I don't know if more standards is going to fix the problem.

There should be money going out to these smaller cities and towns that will help them at least get up to CMM level one. So I just question having more standards when the standards that are already out there should apply across industries, critical or not. So I just hate more standards, and CISA and NIST don't have the time to write them.

They are completely consumed right now with trying to do something even more critical, which is AI standards. And there's not a big team there. Tracy, there's this little thing called copy/paste.

If they could just take the standards we have- Yes ... and copy/paste EPA's label on it, it takes an hour. We're done, right?

We're done. Right. We're done.

That's it. And give them some funding to do it. Yeah.

Copyright says you can't do that anymore. No, wait a minute. Oh, you need the watermark.

Here's the thing, Jack. So Who's really supposed to pay for this? Because we talk about handing out money, but if the municipality owns the water system, is not the municipality responsible for securing their water system on behalf of its residents?

And then why is this a federal problem? Where is the thing that should pay for this at the end of the day? Because I think, I'm all for helping out cities with federal taxes, but at the same time, somebody's got to pay for something sometime.

I said it's all about the dollars, and I think Tracy and I are arguing that at the very least, if the federal government is going to spend money on this activity, let's have them spend it in a meaningful way rather than generating yet another ream of paper. And you know it's actually going to be printed on paper somewhere at some point, right? Oh, yes.

And this ties back to our first conversation, right? So why on earth if we're asking, we're saying as a kind of a direction, "Let's go hit them hard. " Why would we do that when we're so ill-prepared to protect our own?

We do not have the defense mechanisms that we need to start this war, and that's kind of what my point was in the beginning. I feel like somebody's not looking at the whole situation holistically, but these two policies should be in line with each other. Yeah.

And Tracy, you're right on, and Jack, I completely agree with you as well. We don't often do that or always do that, but I'm glad we do. And Mike, to answer your question, the reason the federal government should be concerned about it, because the federal government defined water and wastewater as a critical infrastructure, as a federal critical infrastructure, which means they required themselves to be concerned with it.

There are 16 of them, and the federal government is responsible not for fixing every single one, but ensuring the right things are done, to Tracy's point. Go do the right thing. And the funding's going to come from citizens anyways.

Plus, if you have a small municipality, when they started their water system, they had no idea they were going to have to... They can't increase taxes. That's not going to work.

Mm-hmm. I will also point out that should the water system fail, it will be declared a federal emergency, and therefore, the federal government will end up owning the bucket, owning it anyway and paying for it, so... So why don't we just nationalize the water systems from the beginning and start this whole process from, we're going to just run this as a global network of water systems, and we're going to have the best minds manage it.

Drew, what do you say? I feel like we tried that already. Didn't we have one utility company, and then they broke them all up or something?

But look, this is public infrastructure, right? It's not pretty, sewers and whatnot. All kinds of nimbyism.

No one wants to pay for it. I think it's good that the federal government wants to provide funds for this. I can't imagine them distributing that very well, as previous rounds of funding like this usually just don't move the needle.

But I think on the positive side, our wildly inconsistent utilities have that effect of making them harder to attack holistically. So, maybe keep it low-tech for a little while. Until we figure out how to maybe actually defend it.

Hey, I want to thank everybody for sharing their insights, as always. We're out of time. I would just say, though, perhaps you will never look at that glass of water the same again.

Just saying. And think twice before you drink anything these days, whether it's water or beer or liquor or whatever, because, well, who the hell knows where it's been? Hey, everybody, thanks for watching the latest show.

Please stay tuned for the rerun of the Techstrong TV lineup, and we'll see you all Monday.