Platform Engineering, Apple + Google AI, and Cybersecurity Risks | TSG Ep. 963

Platform engineering on the eve of CubeCon. We'll be back in a minute. Hello everybody, and welcome to the latest edition of a Textron gang.

We're got a awesome lineup as usual. We got Gina Rosenthal, Jack Poller, Wiki, Wang, Andy, man, and we're gonna have a conversation about a lot of different things today, all of which are top of mind for folks. But as I mentioned early on, we are at the first day, or at least the pre-first day of CubeCon, there's gonna be a lot of folks hanging out in Atlanta all week long.

And today there is this platform engineering session going on, which apparently is jam packed. 0, which is essentially all about how AI will be applied to platform engineering. But Gina, I know you looked at this article, and I know you've kind of talked about with this in the past, but I'd love to get your take a little bit on how real is platform engineering in your mind?

What is this thing? 'cause it's a little still, shall we say, amorphous? Well, I think platform engineering is a good idea.

And I think this article, there were, uh, there were some very interesting, uh, there's a very interesting section about from scripts to systems. So platform engineering is this idea where everything can be run from code and you can build your, ultimately the hope and dream is your ops and your development teams are gonna work together because they have this platform that the engineers can just, um, say what they want their test system to look like or what they want their development system to look like. And so instead of doing it on their laptops or some system under their desk, it's all being cooled with real world, real world scenarios and the little test beds or being built with, like, it's gonna look in production and they go crazy.

Then they check it into the, to the, um, the CI systems. And then everything just works as it should just by itself. And the, the premise of this idea is that we've gone from scripts back in the old ancient days when I was assistant man and we're gonna now get to this AI native intelligent insight that's gonna be step three.

And I, the, the, the, the problem with this article with me was, it just kind of didn't give a lot of examples of how that works and what's going on. That was the first problem I had. I love the idea of thinking about, you know, automation first, that everything should be turned into code.

And that can, and I think that is a fa fabulous idea. That is not a new idea. That is something we were, I was doing back when I was assistant man for Soliris and Red Hat.

We did kickstart and jumpstart scripts and with some arcane, horribly hard to understand language and you just hoped nothing in the, um, hardware side changed too much that you'd have to go back into that language and, and fill it out. Now you have all of these great ways to develop these scripts. You've got all sorts of great systems.

You've got companies that are doing infrastructure of code and doing the hard work of figuring out the, the hardware intricacies for you so that you can have this continuously, um, updated system. So they think we're at the self-service stage, which is step two and standardization, which that's the hard part. That is the super hard part, especially if you're dealing with bare metal or you're dealing with a cloud that might decide to change something out of the blue on you and, and mess all your systems up.

Part I really had a problem with though was the AI native, what are we calling ai? I mean, this is like an AI thing to me more than a platform engineering thing. What is ai?

Because the things that we need to look for drift in scripts that we need to help, uh, have, have a way to inventory all of the servers you have available, or VMs you have available already you're working with. Um, and to see where the problems are. That's, if it's anything, it's what they call narrow ai, which is what we've always called machine learning and deep learning.

So it's not, we're not looking at some brand new thing that's gonna automatically learn and do all the things and put the icing on a cake once that happens. If you've never had to deal with the intricacies of hardware, even on a cloud, the differences between things and software versions, um, then you, how do you learn where's our next gen coming from? How are they gonna ever know how to do things if we don't remember that all this changes?

That's what makes it really hard. And while it would be great to say AI does it, I don't think you, I don't think the author really maybe thought about what ai, I would love to have seen some examples of what she thought that was. So that was my thought.

But I, I love the idea of it because it sucked doing it the old way. So I'm hoping it's getting better for people. You know, Gina, one thing you mentioned was, you know, arcane languages.

And I think the, the premise and promise of LLM integration, whether you call that native or not, is the ability to put a natural language interface on, uh, what we're doing with computer configurations and, you know, the, the infrastructure configuration, the ability for us to be able to say, Hey, I want this server to have this many instances, and to be able to talk to that machine in English language is a very useful, uh, capability. And I think that will help us in the long run. Getting there is the really challenging part and I think that's your right to, to sort of raise that.

It's how do we do that and what does that really look Like? Yeah. And is This just an elaborate effort to get rid of scripts?

I mean, are we wrapping buzzwords around buzzwords just to kind of kill the scripts? Well, yes, because we're in it and we're, we're talking about software and vendors and stuff, so absolutely. Uh, you know, this is what we do.

But look, I actually think this, I I I, I do agree with Gina on one point and I disagree on quite a lot, uh, but I agree that, look, this is essentially an ML thing. I think this is not really an ai. Are we talking a gentech?

Maybe we're talking a little bit about LLM. Look, I actually worked on this at Splunk like a hundred years ago, right? Uh, we'll partner with Puppet.

Puppet does automated provisioning and configuration management and stuff, uh, typically out of the older world, but, you know, Nova under the cloud regime. And we prototyped this idea of intelligent machine to machine deployments. Um, is that a gen?

I mean, we were using machine learning to understand the known knowns of a configured environment, you know, so going out using Puppet, do I be able to understand what's happening effectively maintaining this idea of a dynamic CMDB? Yes, I said the C word. Um, and using that as an LLM to then plan and automate the deployment, the configuration, the scale up, the scale out, right?

And then the deprovisioning. Um, I actually think this is a super opportunity. A lot of operations, I've talked about this before, is unknown unknowns when problems occur, troubleshooting, that's where you need the smarts to do the hard work and the thinking.

But you know what? Deployment and configuration management, that's where we have a lot of known knowns. We have things like golden images, we have things like LL uh, like uh, CDBs.

We have scripts that define how code, how infrastructure is deployed in our infrastructure as code. Um, so we actually have a bunch of known knowns. I think this is potentially a really positive way to get out of the configuration management business as humans and be able to use these, you know, machine learning on the pipe to understand what is a good configuration, what is running a good, a known good environment with high performance and being able to like, uh, uh, uh, Jack said, you know, talk LNLP, Hey Siri, uh, fire me up a gold image.

So 'cause I wanna run an AI workload, boom, we are there. I dunno. Yeah, it is a little bit future forward.

Um, and yes, we are trying to sell a bag of goods when it comes to this future forward notion of platform engineering. But look, I actually think this one could be real. No, I totally agree with you.

So don't, don't get me wrong, right, because I've worked on, you know, I've worked in the old school, I haven't had the privilege of having to assist admin, a new school kind of thing. But my point is, is, is we've, and this has always been my point, we are a computer scientist and we have had this spectrum of things that hasn't started. I mean, you're, that was like crazy blow your mind stuff 10 years ago to me.

But back when we were doing, just even doing jumpstart and kickstart the beginnings of this, um, that your problem that you solved solves so many problems we had with the developers, right? So like the, the promise of being able to say developer, I have the, a developer has a user case, he doesn't know what it's gonna run on, or she doesn't know what it's gonna run on. If they can declaratively say, Hey, I wanna, like you said, you know, I wanna build an ag, ag agentic, um, platform.

They can, that that could be done automatically. I think the problem I have is feeling like this is something humans never could have accomplished. That, excuse me, that we're using AI to do it.

One sec. I'll start that over. So I think the problem is that, um, we're acting like this isn't a continuum from where we've come from.

We, we need to recognize that we need to recognize it's not ai. We need to start call, stop calling ML and a and, um, deep learning things. Ai, there are products that have those, um, capabilities in them already.

So my point is, let's, when we talk, start talking about this and hopefully when we get, when, you know, hopefully Atlanta will see this, you know, this week we need to see some examples of how you've built this in already. What does this look like? Instead of just this, oh, it sure would be nice if we had these three, can't define three stages without giving some proof behind it.

That's kind of my point too. Mm-hmm. Wiki, I'd get your opinion here because the one thing, and I don't hear a lot about when I hear the phrase platform engineering is security, compliance or any of those Fun things.

Yeah. So I think the key cons, uh, insights is, uh, the team can't stand on a single two right? Anymore 'cause it's so complicated.

Now they do need a governance and uh, uh, observability layer that can spend different frameworks and plots. So I think ai, LLM, that ability can make it happen, right? So in this year in RSA or this year, I actually see a lot of different AI too can make it happen.

A lot of company make the AI or LL um, elements in their tools to help in this area, which is fascinating. Yeah. Andy, I can't figure the following out.

Is platform engineering something apart and distinct from DevOps? Is it the evolution of DevOps or is it just kinda really a DevOps mulligan and we're just doing this over again with a different kinda spin on it? Oh mate.

Oh, you put me on the spot with that one. Look it, uh, DevOps, as we know, DevOps is fractured into all sorts of commercial opportunities and platform engineering is absolutely one of them. Look, this kinda actually comes out of the idea of a Spotify model.

So not actually DevOps. This is not about collaboration, communication, communication and integration of teams. This is about having a service department, um, which is okay and I dunno that I love it.

Um, the, you know, the idea of platform engineering definitely comes out of DevOps. It comes out of infrastructure as code. It comes out of the idea that developers aren't actually operations, they don't actually do provisioning configuration management and we shouldn't ask them to.

So the, I think it does come out of DevOps in that devs have asked ops to do a job for them, which is build environments that are gonna work and scale and, you know, ideally be predefined to be secure and all these sorts of things. But ultimately, yeah, I dunno, I don't know that I love this. Um, I think having an expert team to sort of replace the golden image team with a dynamic, uh, on demand provisioning team, I don't think it, it, it breaks down barriers.

I don't think it breaks down walls. I really like it from an automation perspective. And if I was a developer who could just click a button and go, boom, there's my environment, I'd be super happy.

Uh, but I think it does take some of the collaboration out and I think it does sort of work against some of those good principles of DevOps that we've worked towards for so long. That idea of collaboration, that everyone's on the same team, that we're all working together to get this software out the door. Uh, I don't know that it's positive that way.

Uh, Gina, do you think that we have an opportunity here to maybe finally bridge the divide between the classic IT admins and the DevOps engineers and maybe we'll all link arms and sing Kumbaya together? What do you say? Oh, man, why?

That's Andy's question. Uh, you know, I hadn't thought about what Andy just said that, um, this, uh, this I idea that a developer could just declaratively state what the environment should be, might not be a good thing because it keeps the developer separated from the ops people. And it, it does get rid of those that one of those DevOps principles.

And I kind of think that's probably true because I think we've got, we, and I think we go in stages with this as, as the hardware matures and the hardware is able to do more things for the software, and I think we're probably in that stage, we're probably gonna be in that stage for another couple of years. Um, where you don't, you as an ops person, the reaction might be too over, not over secure, but to, to keep that away from the developers. Let them just run fast, give 'em what they need, and this is a way to do that.

And so maybe that takes away, so I, I'm not sure, but I, I do think that that's not a good thing on the ops side because it's much better, um, to work with your developers and understand what they're needing and what they're gonna declaratively call. So it's already there. So not having to deal with each other is probably in the long run, not a good thing.

I got that from you, Andy. Thank you. There you go.

Jack, help me out here. So software engineers will have their own AI agents. They may have, I don't know, each member of the team will have, let's just say arguably 10 developers will have their own AI agents and they'll probably have 10 of those.

And then we'll have a bunch of AI agents that are assigned a particular task on behalf of the A on behalf of the team. And this all sounds wonderful and of course something will fit in the middle of that to Bri provide some orchestration. But as I continue to think about it, just the overall complexity of managing that may be beyond the cognitive capabilities of our mere humans.

0? Because once I get past, I don't know, 20 agents, can I really manage that? Well, we love, uh, specialization in it.

And so I think you're now gonna see the rise of, you know, we have this thing we call AI ops, but you're not gonna say see AI platform engineering whose job it is going to be to maintain, build, and maintain the AI platform that helps the platform engineers build and maintain the platform on which our apps actually run. And at some point, the specialization is gonna be a little bit crazy, right? Where we're gonna have people whose only job it is is to just, you know, tweak one button so that somebody else can tweak a button so somebody else can tweak a button.

So eventually we can run something somewhere. Uh, you know, I think, you know, the counter argument to that of course is that the, you know, as I said before, you know, a AI and LLM gives you the opportunity to use a natural language interface. Uh, AI in general gives you the, uh, opportunity to abstract away a lot of the drudgery and complexity of the day-to-day things so that we are no longer, I mean, if you think about what is, uh, uh, infrastructure as code, it means it's taking away the need for an infrastructure person, whether they're a developer or an operations person to log into every individual machine and type individual commands to configure that machine, right?

Instead, we have a, a a, a level of indirection and a higher level language. We can talk about how we want things to look and let something, let a machine do the complex, you know, minutia of configuring every little bit and bite. And if we can then abstract that out one level, maybe we can do away with some of the platform engineers and some of the DevOps engineers and some of the AI ops engineers because we've automated enough of this that we've, the underlying infrastructure is complex, but the management of it is simplified.

I hope, I hate how right you are about this stuff, Jack. Um, I hate to think that you are right, but I think you are right. We're gonna have agents, running agents and you know, this, this actually does come back to something that Gina pointed out and that's the skill issue.

And the more we have this embedded in platform engineering, this expertise and the more complicated the environment gets and the, the more we seed that knowledge to the LLM or whatever agent or AI it might be, where is the knowledge gonna come from when we need to do something new and different? You know, the, the golden images or the infrastructure as code definitions that we've got today are not gonna get us to where we need to be tomorrow. Who then figures that out.

So yeah, I think, I actually think you're right Jack, and I hate that you're right. 'cause we're gonna, you know, to Jean's point just atrophy a lot of knowledge into those systems. So the thing is too, based to just, sorry to, but based on Jack, what you said about the, the, the agents managing agents, does that mean we'll have to have a specialized section of the CMDB to accept tickets from all these agents and disperse them properly?

I think so too. 0 version, right? Which is where you simply automated what humans do.

But the real, the the right way to do all of this is to rethink it and say, how does you know a clean sheet of paper? How does it look if you had a clean sheet of paper? And what would machine to machine communication look like to, to make these things happen?

Take the human out of the loop and do it the right way the first time. Yeah, I just wanna say like, uh, I just talked to somebody, uh, this week talking about how to how they manage the agent identity or like code agent as part of the thing, right? It it's kind of interesting like, uh, agent and agent used to talk together, but people still need to be in the loop.

Yeah. Make it happen. Yeah.

Well folks, I don't know whether you believe in platform engineering or not, but I will tell you that people who have platform engineering certificates and things like that seem to be making about 20 to 25% more than your average DevOps engineer does. So get yourself a certificate whether you believe in it or not, because well, you get yourself a raise, we'll be back in a minute. You've earned it.

The spotlight, the responsibility, the weight of teams, companies, and entire industries fall on your shoulders, lives depend on your decisions, your home life included, that work your protected physically and digitally. Nothing gets through your team without a fight. But in a globally connected world, everyone sees you, including those who mean to cause you and your organization harm.

And now home your sanctuary attackers see an opportunity, your digital front door is wide open. And what compromises your home can breach your boardroom. Because the devil's greatest trick isn't targeting your workplace firewall.

It's convincing you that your personal life isn't at risk. Black clerk, digital executive protection, defending the new attack surface your personal life. All right folks, we're back and we're shifting gears a little bit.

There's been reports that Apple plans to have some sort of deal with Google to embed Google's ai Gemini models into Siri, which, you know, a lot of folks are talking about. But Wiki, I'd like to get your opinion on this. And of course I'm a little biased.

I I use Google, I have Android phones and I kind of looked at this and shrugged and said, well, if Apple's gonna use Google, why don't I just use my phone in the first place? 'cause it's the same AI model, so why am I gonna get a different phone to go talk to a different model? I don't know.

But what's your take on what's going on here? I actually, I wanna talk from two perspective, right? First of all, like Google and Apple, they have collaboration for a long time, right?

From the search side, Google still need to pay, uh, apple to put their search into the Apple phone. So it's not new. They have a collaboration.

So that, and second thing, I think, uh, apple actually play very, very smart. Um, you know, like all those big hats, they put lot of money into the GPO and try to get all the chips, um, and spend a lot of money, right? Um, but Apple, they, I feel like they're very calm.

They, they, they always waste their pace, right? They, they choose very smart to how they spend their money on the info or other thing. So, uh, it's not bad if they have some, they leverage what our Google has already and to enhance their LML capability, right?

So like I, I do talk with somebody, uh, early this year in my podcast, uh, when they talk about their LLM, they used to, uh, really wanna have their own model. Uh, but their, their prediction is if they have their own model, their delivery will be in 2027. But at the time when OpenAI suddenly, uh, said, okay, we have that API and they can quickly plug in and then make their, their, their product happen within two, 2025, right?

Which is a huge jump and huge saving from their side. I think Apple is kind of like doing the same thing. They try to leverage the capability Google model has and spend less money from their side while at the same time they try to deliver the best product.

I think it's very smart. This is my opinion. Yeah.

Jack, what's your take here? Because on the one, some folks would say it's a bit of a black eye to Apple because they're leaning on Google for AI after talking up their own Apple initiatives for a while. But to wiki's point, maybe, you know, these things are compatible with each other and you know, better sooner than later.

My understanding is that this is theoretically a, uh, sort of a stop gap measure. I think as Wiki was saying that, that Apple needs something. Now, what I don't understand from Apple's perspective is what is the value of owning your own LLM model?

And, you know, apple likes to control its own destiny, but does having a model that's not Gemini and that's not, uh, open AI's model and somebody else's model, what value does that bring to Apple in the long run? And is it worth the ROI of, I don't know what's cost now for them to do it? 10 billion, $20 billion to build a model, right?

2 trillion parameter model. So it's five times as big almost. And you know, in terms of the amount of knowledge it has and can consume and, and manipulate.

So I just don't understand what Apple gets from having their own model. And I think chasing that is a fool's errand. Uh, 'cause uh, people always talk about where's the future direction for the AI or LLM because of the energy resource, uh, strengths, uh, we tend to see like it's more at the age end, right?

Which is like a small language model. I think it's still have a value if Apple can keep their own model, uh, towards, to like a smaller size model, um, specifically to support age technology. So I think this is some part point I can add.

Yeah, Andy, I gotta tell you, and this is kind of similar to what we just talked about in the previous thing, but I'm a little worried that at some point in the future, my AI agent is gonna be talking to your AI agent and they're gonna negotiate something, then the next thing you know, I'm gonna be meeting you and Timbuktu because our AI agents set up this meeting. How are we gonna manage all this and kind of keep some level of control around? I don't know, mate, if, if my Outlook calendar will only handle time zones perfectly, then I think would be great.

Uh, but no, look, i i, it it is gonna be, uh, an agent to agent. Well, machine to machine is something that I know, uh, colleagues of mine, people like Dennis er at EMA who's retired now, um, the, the, uh, research emeritus, uh, has been talking about machine to machine for a long time. And it, this comes out of older technologies.

You know, everything old is new again, you know, my thesis, it process automation and robotic process automation combined with intelligence and library knowledge becomes, you know, agentic AI in a lot of ways. So yes, this is, this is absolutely gonna be the case, but that think, that's actually part of why this is a good deal for Apple because this is not a case of ag agentic ai. This is not a case of advanced intelligence and becoming a differentiator for their platform.

You know, you think about things like Gemini, Claude or, or Anthropic and you think about corporate use cases and you know, understanding what is my customer buying patterns and you know, what, what other offers could I make to get someone out of that mode into this mode and stop churn that's not this right on device AI for Apple is like, uh, take a picture of my grandson or delete my ex from this photo. Or, um, um, answer question. Why do cowboys wear chats?

I don't know. Um, this is what on device AI is for Apple. Is it gonna really differentiate them to have their own model with a trillion, uh, of vectors?

Or can they get away with Alaw and anthropic a Gemini? I think that's really smart because it's, yeah, we are gonna get to where you are going agents to agents, machine to machine. This is absolutely gonna be a thing and that's its own problem.

But this is very much about grandma trying to, uh, uh, get her phone to work properly. And I think Apple intelligence has been missing in action, a total dud. Um, and as WY said, you know, Google and Apple, this is a partnership already.

The enemy of my enemy is my friend, and they both want to see Microsoft not succeed, right? So this idea of being a slow follower with core competency differentiate everywhere else, like Wiki said, on the experience on the device, on the software, on the walled garden. Is AI gonna make the difference for 'em?

I don't think so. So yeah, I think this is actually pretty interesting. I don't know.

I'm a little bit worried about, you know, someday my father-in-law's gonna call me up and he is gonna say, Hey, can you come pick me up? And I'm gonna say, where are you? And he is gonna say, I don't know, but it says in the, in somewhere in the South Bronx, and I'm gonna have to go drive down there and get 'em because the phone sent 'em there.

It's true. I mean, people just, this is true already, right? People just follow their GPS blindly and turn into canals and, and down one way streets and all sorts of things.

Put it this way, uh, just because Apple is getting Gemini is not gonna make humans more intelligent. Well, the oth the other thing about it is that's a little worrisome, is one of the main drawbacks to LLMs is the data that it has been historically trained on. And that is the Internet's wise, wonderful world that is absolutely discriminatory towards women, people of color, people, uh, that are, um, disenfranchised.

So that's kind of the worry thing. 'cause I thought Apple was one of the places you could trust to have trained their model and to kept some of that out. This is just kinda like what I've heard.

I don't use Apple either. I use Google, which is a whole different story that you try to keep up on and it's impossible to, but if, if you know that those models have been trained that way, um, then, then how sure are we that the, that, that, that doesn't creep in to the Apple model, is that same tort types of kind of hidden biases that are in the, in the data, because that's how our, our history has been. So, um, I think that's a concern to think about.

I may, I wonder if that's why they're going so slow to do their own thing. I tell you what I would love to see though, because you know, my household is a split one, right? Half the house is on Apple and the other half is on Android.

Wouldn't it be wonderful if this AI stuff made it easier for us to communicate with each other on our phones across different apps? So then that way I don't have to sit there and get my wife telling me that I should get on, you know, the Apple video conferencing platform so she can call me better or more easily, or we don't have to use WhatsApp as an intermediary. Is that gonna be possible?

What do you say, WY? I should say everything will is possible, right? You never know.

So something cannot avoidable. So, well, that's it. We, we, we will wait to find out, Jack, last question.

Will people switch from phones based on the AI experience or are we pretty much having this kind of Coke versus Pepsi thing and everybody's already decided and it's just a question of what capabilities are gonna come in, but it's not gonna change anybody's mind? Oh, I think people are much more passionate about Apple versus, uh, everybody else than Coke versus Pepsi. And there are, there are people who say, you'll get my Apple device out of my cold dead fingers, right?

They're not switching no matter what. I know people who have actually said they won't join a company because they couldn't have an Apple device. They wanted another, you know, they want their Apple MacBook and their Apple phone, and if the company makes 'em use a Windows box, they're not going there.

So I mean, we're way past that point. All right. I billions will be spent trying to convince people to switch, but I think most people have already made up their minds, and I don't think we're gonna see a whole lot of people going, oh wait, that AI experience is so much better.

I'm gonna give up my phone and switch everything out because that, I'm just jealous of that ai, I don't see it happening. Yeah, like I I Apple device a lot, right? Like no matter what kind of a large language model they are, they're, they're try to move.

Um, sorry, I don't think that it will change my, uh, habit to use Apple. So, and my Apple fan, sorry. All right, well folks, I'm gonna leave it there, but I'm pretty sure we're gonna enjoy the fight.

Whether you switch or not, we'll be back in a minute. Discover Techron group, the epicenter of tech innovation. We are your go-to for reaching IT leaders and practitioners worldwide.

Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more. Join our satisfied clients, let's revolutionize your tech journey.

Contact us today and tell your story to the world in most powerful way with Textron Group. All right, folks, we're back with our final block of the show. And Jack Poller has an interesting story up on Security Boulevard talking about why in Israel they're sending cars back that remain in China.

Jack, is this gonna become a global phenomenon or what's going on here? Uh, well, yes, it actually is. And I, I thought this was gonna be just, you know, because rightly so, Israel is very paranoid, but it turns out they're not the only paranoid country in the world.

And Denmark had the same problem, the same discovery with electronic, sorry, electric buses that they bought from China. So let's first talk about Israel, and we can talk about Denmark in Israel, they, uh, have banned 700 plus cars that were, uh, imported from China that they were leasing to senior officers in the military. Their first step a couple of months ago was to ban the cars from going on base on military basis because the cars are equipped with cameras and microphones and uh, and cellular connections, and they weren't sure what was going on.

They, so they started to investigate those cars and they decided that the systems were complex enough that they could not guarantee that sensitive data was not being sent back to China and or that people couldn't hack into the cars to get access to the cameras, microphones and the data. So from a military perspective, there's a very big operational security. If you know that the cars are associated with senior military officers and you can at the very least track their locations, then you know where the military officers are theoretically, and that's a big, uh, operational security and a big risk.

Um, so that's sort of one risk that was identified. So Israel's response was basically saying, we're taking those cars back from the senior military and we're just not going to allow anybody in the Israeli military to use cars from these companies. But I think it's actually a larger problem in general because if you look at most modern cars now they have a cellular connection and they can do an over the air update.

So you can't, even if you inspect a car software that's embedded in it, then it can be updated. So you have to keep track of all of that. Denmark sort of looked at that and said, well, we have the same problem with Chinese buses now.

They're not concerned about the operational espionage portion of it. They're concerned that somebody, either the Chinese government or a hacker could come in to their electronic vehicles and basically turn 'em off and then they wouldn't be able to use them. And there's, you know, this is, uh, very small countries, but reliant on public transportation.

So their first response was to, they pulled, uh, three of their bus models into a cave that was basically essentially like a Faraday cage so underground so that no radio signals can go in or out. And they were trying to figure out what the buses were communicating. And based on what they found, they decided their first response was to pull the sim cards to prevent those buses from communicating to the rest of the world.

And they said, any updates that come in, they're going to inspect the updates before they get applied to the buses. So There's a couple of different ways to look at it. It's a cybersecurity risk.

It's a, um, it's a potential denial of service risk. There's a hacker risk. The hackers can come in and, you know, the, the, the big scare where it's here around the thing that it's Chinese, but if you think about it, it's all, it's basically all the modern vehicles.

If you look at a Tesla that comes in, a Tesla has, you know, five, six cameras that are recording 24 by seven, right? And is can, you know, and the Tesla headquarters can get access to that data at any time. So there's a big security risk here of who can get access to that data.

And essentially these things are rolling, motorized spy vehicles is one way to look at it. Andy, will this go the other way To Jack's point. So, you know, United States, we sell cars overseas and some countries may decide that we too are injecting things into there and it can become, uh, an issue where everybody just says, I'm only buying cars made in my country.

Yeah, absolutely. And I probably should to a large degree, especially with, uh, sensitive environments, not just military, uh, but also infrastructure and other things that might be at risk. Uh, you know, and again, it doesn't need to be nation states.

These could, it could be about nefarious actors taking control. We've seen, for example, various, uh, cars being able to be packed in remote controlled, you know, literally being able to crash you on the freeway. Um, it doesn't have to be some sort of James Bond secret squirrel thing, planting a secret listening device and all this just to, you know, just to leak some sensitive data.

Jack's spot on all of these cars have got this ability, and it's not just over the air updates, it's GPS, it's back based telemetry for things like, you know, diagnostics remote start and stop a remote takeover. Look, Tesla's already bricked cars that have failed on their repayment plan. Um, do you think if, if our president comes out to Tesla and says, can you tell me where so and so is driving?

Yeah. We've seen this also, by the way, with Uber many years ago, using telemetry to, for nefarious purposes in that case, tracking, uh, journalists that were critical of them. You know, this doesn't have to even be a nation state problem.

And yeah. Is if, if, if the US government needs to hack into a Ford or a General Motors car that's made here to find out where someone is, and by the way, we've seen this with things like, uh, GPS devices on watches, soldiers going running off base in Afghanistan. I think it was, were giving up their location 'cause they had Strava, the running tracking app connected to their GPS watches.

This is not an Israel story, this is not a China story. This is just a modern connectivity story. But I do think you're right, Mike, the, this is gonna be a give, give pause to a lot of nation states who are thinking, well, what if America takes over my buses or cars?

You know, this is absolutely not limited to these two or three nation states. Mm-hmm. Wiki, every morning I get up and it's cold here in New York.

So I get out my little mobile app and I get the car turned on and I get, you know, defrost going and the whole thing. So the car is kind of toasty warm when I get into it. Is that now gonna have to include a security scan before I get in it?

What do you think? Uh, theoretically, right? From professional perspective, I think from the data perspective, they do need to have some like encryption for your, like driving data to protect where you go, right?

And your identity or something. Um, for like, but if you see the, the other interesting facts here, uh, actually in Israel, that company that that Chinese car company, right, is a best seller for September, actually compared to other car company. So I think I respect their, their innovation and the quality they have there.

Um, but I should say like not only for car, right? Other iot d wise, it's very hard to standardize internationally. This is very, very true point.

'cause there are, there are so many different, um, protocols or so many different models try to standardize it. So I do respect like a different country has like different thinking. Yeah, that's my Gina.

Should I sell the car and call an Uber? Would that be better? Depends on where you live.

I, that's another argument, a whole different thing. Um, but I, I think what's missing too, like I, I think everybody is talking about the, the holistic ways it could be problems, but even down to the smallest thing, if you have an ex that's trying to track you or wants to do something bad or trap you, if you've got, uh, people go on strike and just, or wanna be on strike, so they disconnect, they log in and disconnect everybody system. It's incredible.

I know they always have a car hacking village at Defcon. How many, um, s systems are actually running electronic systems, communication systems are running within just your normal Ford car, right? So there's, there's almost like, I'm not sure how much of a responsibility the car are taking for those systems, um, to let people know.

I know I've never gotten anything from Ford that says, Hey, you should, you know, make sure you don't do this and this, that information is just kind of going off into the ether, I believe. So how do you, there are, it seems like there should be a way to contain your personal data on the car that you paid your money for to your personal vehicle, um, and to be able to be notified if something has gone awry. But even as I'm saying that, like, who's gonna understand that?

I definitely don't wanna teach all my family about that. Like what is the system since this is a, you know, it it's the nation state thing is a big deal, but the nation states have their own armies and whoever they have working on that, you know, technically. So they've got very smart professional people, probably the smartest in their nations working on com, you know, protecting that sector.

But you know, what happens if there's, you know, worst case scenario, there's a way to hijack a whole city because you can turn the cars against each other or you can, you know, you can shut 'em all down and how can you protect yourself against just the common normal things of your X track and everywhere you go, 'cause he hacked into your tire network. So mm-hmm. You know, Jack, We talked about foreign governments here, but you know, the, my local government may not always have my best interest at hearts either, right?

Because it could be that, um, you know, they wanna track whether I'm gonna go vote on Tuesday, where's my car, and send me a message telling me the polling place is closed. So, uh, Or, or who you're voting for, right? Depending on who you think you're, they think you're voting for, they may say, you know, let's disable all the cars of this group of people so they can't get to the polling place.

So that way we get more votes of our people, right? There's the, but yes, and, and I look at this as, as the greater story is that for many, many years we've, we've waved a hand around, uh, we've done a lot of hand waving around it and industrial control, so I, sorry, ot, uh, iot and industrial control system security. And from an enterprise perspective, we basically said, okay, the, the short, quick, easy way to deal with that is we put them on an isolated network.

There's a, you know, and they're sort of separated and it's essentially the version microsegmentation of a large scale for IOT devices. But the reality is that almost everything we have these days is an IOT device. If it's got a radio in it, it's you, it's not on a separate network that you can isolate and somehow control.

If it's got a cellular network in it, you have no ability to, to understand what it's communicating to whom. And it's a bidirectional communication. So if somebody, if you can send messages into the device, a bad person can send messages in and take it, you know, and take it over.

If you can send data out, you can send data out that you don't want it to send out. So, you know, I mean, and this is not a new problem. I remember, you know, 25, 30 years ago when camera when, uh, um, cell phone makers started adding cameras in to cell phones and, uh, you would go into a manufacturing facility or a chip fab, the first thing they would do is say, all phones in the bucket here.

You can't take a phone that has a camera with it into this facility. 'cause we don't want any pictures here, right? So, I mean, but that, that was easy because we could confiscate the phone.

Now you, you know, what do you say, strip naked. We take every single electronic device off, you know, you have your rings and you know, your, your watches and all the other stuff that we have that, you know, everything's got a radio in it, even Bluetooth, right? So the how do you, you know, we have a big problem that we've sort of, like I said, we've done a lot of hand waving around and that's sort of, I don't know, I guess I'm putting the red flag out there and saying, wake up, pay attention to this a little bit, Right?

I think we'll reached that point where to a certain degree, in every country we live in a surveillance, uh, let me try that again. All right. I think we've reached the point where, to a certain degree in almost every country we live in a surveillance state, whether we like it or not, it's now a question on what we're willing to tolerate or not tolerate.

But as everybody just pointed out, maybe it's good to have a healthy dose of paranoia. Hey, I wanna thanks our guests for sharing their knowledge and insights today. I wanna thank you all for watching today's show.

It was great. And please stay tuned to the rest of the text drawing TV lineup. It's gonna be equally awesome.

And we'll see you all again tomorrow.