Techstrong Gang – May 8, 2025

Hey everyone. Maybe not a great time to be in the money laundering business in Cambodia. You are watching Textron Gang.

Hi everyone, it's Alan Shimel. Welcome to another TechOne gang. And happy Thursday to you.

We have a delightful panel. Did I say delightful? Yes.

I said delightful panel today. Let me introduce you to them quickly 'cause we got a lot to talk about. Still out in Las Vegas, behind his blackout curtains.

He won't tell us if he's been down at the tables at all or not, but he has been covering stories. He's our Silicon Valley expert, John Schwartz. Hey John.

How are you man? I'm good. Hi, everybody.

Yes, I'm pursed on the 25th floor of the Venetian overlooking the Wind Hotel. And, um, can't wait to go home, I'm sure. Well, you know, there is that three day Vegas rule.

Thanks, John. All right, moving from John. We're gonna head north, not all the way north, just to maybe Ohio North for our tech strong ai, uh, and tech Strong IT editor, Sona Saha.

Sona, welcome. It's great to see you. Hi, Alan.

Hello everyone. Thank you. Thank you.

All righty. And then heading to the true north, the man in the Maple Leaf here is our strong and free. Yep.

Strong and free, uh, shark, elbows out our, uh, security cyber person, Chris Blas. Hey, Chris, how are you? I Am delightful, apparently.

Good. Glad to be here. Glad to have you on.

And then, moving from Chris, we, he running the anchor lap in this four by 100. Uh, he's our chief content officer. Uh, he's not in Harrison, New York, though.

He's actually down at a Nutanix, Nutanix, uh, conference. Our Chief Content Officer, Mike Ard. I'm in Washington dc otherwise known as Chaos Central.

Happy to be here with you guys. Let's not even go there. Um, so, so Mike, it looks like the, our Vaunted Treasury Department has sprung into action.

Uh, we found that evidently a Cambodian base group ban ban. We won. I, I bene, I pre, I believe that's how it's pronounced.

If I, if I got it wrong, I apologize. Don't take my foe away. Uh, but Ben, we won.

And, uh, there were laundering $4 billion of North Korean money. Now, $4 billion is an awful lot of money in Cambodia. I, I gotta tell you, I am reminded about 12 years ago, I taught a security class in Singapore, cybersecurity class with regional banks from all over the region.

Vietnam, Cambodia, Singapore, uh, Malaysia, new Guinea, Papua New Guinea, others. And I asked two, what kind of firewalls did you have? Everyone raised their hand and told me what kind of firewall they had except the Bank of Cambodia.

I said, what kind of firewall do you have? You didn't raise your hand. They said, we don't have a firewall.

I said, well, why, why don't you have a firewall? He said, well, we really don't have that much money. Oh, it was, it was a revelation to me.

So $4 billion is something like the GDP of the whole company, Mike. How the heck were they hiding this? Alright, so as I understand it, this is really an online exchange set up by a bunch of Chinese folks who based it in Cambodia.

So that's where the funding and the money comes from. And we were talking last week about this whole push by the UN to identify countries that are helping with this online scamming. And if you read that whole report, you'll find these guys mentioned that prominently as kind of one of the exchanges that everybody's using to launder their money.

And now the United States Treasury Department is trying to make a case for disconnecting these folks from the US financial system so that you can't launder money. I'm not quite clear if that's gonna work or if it, if this is something we should just be doing more broadly. But Chris, you followed this whole space, and I've long argued that a lot of the cybersecurity stuff, at least the defenses is really a financial crime.

But is this gonna work and do we need more of it? I just wanted, you know, take a moment to say, yeehaw, go team for good old law enforcement. Right?

To be clear, you know, this is s this is crime, corruption, bad operations. You know, it, it is, it's good to see it taken to note, you know, period. Done.

However it gets there, and it's, I I think it highlights an issue near and dear to my heart. org and the forum for incident Response and security teams is, has grown up from the days of US cert back in the late 1980s. And having a national cert and having that sort of infrastructure is a good sign of, uh, the fact that you may be a, a, a kind of nation where organizations can exist like banks and enterprise inside of, and deal with the outside wor world in some sort of, uh, stable fashion.

And as we go into this, I should have looked, I don't know if there's a good, uh, Cambodia insert, obviously, if, if so, they got some work to do. Um, but, uh, you know, this is, this is the, this is the international policy side of cybersecurity, you know, SWIFT codes and bank, the, the financial banking system. These aren't cybersecurity things.

These are international relations. And in today's environment, you know, I just feel good to be able to, you know, cheerlead something that's, that's going on. I don't know the, the causality of the decision, um, to take this action, but I agree with the action.

I agree too. And, and let's let, there's, there's a country we haven't mentioned. They're on the scroll, the ticker scroll underneath, that's really the culprit here, and that's North Korea.

I don't care who they're supplying drones weapons or, or, or packaged meat as people to go be gristmill for the Ukrainians to shoot at. They are an axis of evil country who perhaps 20 to 30% of their GDP is recognized by financial hacking, and the Chinese give them air cover. But it's the North Koreans who are the ones doing a lot of this hacking, and they appear to be the ones that are really behind this particular takedown.

Well, right. You know, the, it, you know, it's, it's easy to blame, you know, the actor in this case, you know, the, the, the one that's been shut down the banks in, in bank in, uh, Cambodia. But, you know, in, in many, in a, you know, purely, you know, strategic defensive, you know, offensive, you know, uh, um, uh, frame, you have to see them as the victim, right?

They're doing this because someone made them too. Some other actor, you know, actually caused it. And I have had a long interest in, in smaller, smaller countries and their progress.

And it's, you know, and it doesn't, it's not as perhaps philanthropic as it sounds. I think there are things we can do as security professionals in smaller jurisdictions that are hard to do in bigger ones just because, you know, there's smaller and simpler to work with. Um, and in, you know, the, the, the classic example of this Yemen, I went to Yemen during the, the Arab Spring.

That little moment of peace they had between dictatorship and the Houthis Mercy and trying to establish a Yemeni cert. And the argument being that right now, if I see an IP address coming from Yemen, and I work in the, uh, it center anywhere to say de I don't know if that's good. There's no cert, there's no structure, there's no order.

You know, therefore, you can't have the economic opportunities. I give a talk at the University of Ana to the group of, of young folks who had overthrown their dictatorship, you know, and trying to lay out this path of opportunity for them where they could engage with the rest of the world in, in a way that is not being exploited by external fa uh, players with the money. And it's exactly what we see happening in this case, again.

So, again, blame blame, you know, we can blame the, the Cambodia itself blame the bank, but the responsibility lays in in those who exploited them for their own purposes. Agreed. North Korea, Yes, Vernon, Keep your eye.

You gotta keep your eyes on the, on on where that problem lies, right? It's, it's, we see it over and over again. I've seen it firsthand personally there.

They're, they are a blight in the world, community of, of nations. And if we weren't in such a dysfunctional, dystopian reality right now, I think the the rest of the world would do something about it. Anyway, anybody else on, on, on the, on this particular topic?

Otherwise, let's take a break and come to come back and talk about some human verification. All right. You're watching tech strung gang.

All right, folks, we're back. And we're talking now about, well, something I never thought I'd actually see, but apparently in a retail store, you can go get your retina validated to ensure that you are human. I thought we were supposed to validate the machines, but maybe we need to validate the people.

John, I know that you looked at this, but um, Alan, um, let's start with you on this one. But, you know, what's your take on this? Is this the wave of the future or is this just some oddball thing being led by our friends over at the open AI founding team there?

Look, I, I don't think this is so far out. I I do this every time I get on an airplane now, right? I'm clear.

And I don't do the fingerprint. I do the retina scan. They've got new machines, they're really handy dandy, nice machines, and it takes like three seconds to do.

I'm sitting here right now dealing with a friend's company who unfortunately was the victim of a breach that led to a wire of over $800,000 being done. And they're trying to get that money. And it was done because one party received one email purporting to be an email from someone saying, I, I'm changing my banking information.

Here's the new wire information. And this other party went and f went, excuse my language, went and sent $800,000 plus based upon that one email. Anything we could do to verify and cut out this kind of fraud is well worth it.

And more power to Sam Altman and o and open ai. I assume they'll be doing this in a not-for-profit way, since they've decided not to leave the not-for-profit. Um, but I, I don't see, I mean, what's the, what's a big deal here?

It's, I, you know, it's a little bit dystopian to me. I mean, just the, the kind of the phrasing or the, the way it was positioned. Do they, they refer to this proof of human technology that they're using this So proof of humanity, it's the technology that offers you proof of human.

Lemme tell you About any event. Go ahead. I mean, there, this, this orb is, this is gadget trying to figure out to verify our humanness by scanning our eyeballs.

The only reason I, the reason why I am a little bit creeped out by this is that this has been tried before. It's been around for a couple of years. And it's, it caused some issues though.

I mean, it, this is my, my whole story about real idea and how I, I'm resisting it as long as I can. It's just like I, the idea of, of somebody storing so much information of me in the event of a security breach, like what happened in Kenya with the same service that led to usernames and passwords stolen. Same thing happened in Spain and Hong Kong.

That's, that's, I mean, that's my only pause. Um, you're right, Alan. I mean, every time I, when I, we flew down here, I had to do the camera like I always do.

So they, they have photo id, their cameras everywhere. We live in that type of culture now. So I guess this is just another layer of, of verification so that we're, we're not, uh, taken advantage of by someone, uh, our AI pretending to be a human and, and trying to rip us off.

So I have mixed feelings about it. IJ it just, I, I just, the, the tech industry to me is just got his hand so deep in inside of our personal information. This goes back, Larry Ellison talked about this type of concept years ago with a kind of a, a voter, a a an ID card and, and the technology wasn't quite there yet.

So anyway, that's, that's kind of how I feel about it. Mixed feelings. Um, I think the goal here is to create a biometric ID network, uh, which is called the world, uh, which will help separate out humans from humanoids, especially for banking, government services, and apparently dating apps too, where the human or AI problem is becoming more common.

Uh, but there is a catch. Um, so like John mentioned, uh, that there is, uh, this thing has been around a while, and then it says that that biometric data is deleted and what remains is an anonymized, uh, cryptographic key. Uh, but the question many people are raising is if that information is stolen, how hard would it be to impersonate people online?

Um, 'cause uh, prior to this, I was launched in Kenya and Argentina, uh, but they were halted over the same privacy and security concerns. So the company world has ties to cryptocurrencies, right? So this app includes a digital wallet that gives us access to decentralized finance and cryptocurrencies.

So, And also everybody who enrolls gets a world coin, which, uh, is the cryptocurrency, which is worth like, uh, under a dollar I think today. So those who signed up, uh, in the inaugural event, uh, were rewarded about 150 crypto tokens. So, So Chris, if there was a, if there was a government out there that was gonna use this for nefarious purposes, what would they be doing?

What might that look like? Everything. I, I think we, we had to, we had to pause for a minute though, and, and, and appreciate the, the, the humor and the irony in this, in the world where memes have developed to a, to a high level of sophistication, you know, that I am, you know, prove you're not a robot.

Like, and now we're literally talking about you physically trying to prove you're not a robot. And we know we can't even do it on the screen. Uh, which is funny.

And yeah, and, and you know, as you look out through the rest of the century in the next century personhood and you know, you know, what is a digital person, you know, you know, and even though that's, that's sort of over the horizon of, from here, we need to think about these things. 'cause the systems we built today will, will inform those. But you know, the, the, the short answer to your question goes back to what I said in the last segment.

7. This is, we haven't built a, an internet yet. This is not it.

We're not using it. And this is a perfect example of, of one of my favorite things that we have not addressed identity yet on the internet, like at all, right? I mean, we kind of have, I mean, we have conferences and we have technologies and companies, and we've also have billions of dollars.

But it is a perfect example. You know, that, that, and, and John, you're, uh, and Alan, you know, this, the story with the email, we haven't even got the business process in place where some human can say, oh, that's not enough authorization for me to send $800,000 in a wire know. So impersonating that human with, with, with an ai, um, is kind of beside the point.

You know, we haven't got the systemic process together, but it's these sorts of things that drive us down the path because our jury rigged, hacked together, redneck, you know, duct tape, uh, system breaks right here. It's fragile. It is fragile.

You have to make the change at point on You. You know, you start cutting things like CSA and doing some of the things we're doing. You need, you need, we need leadership to put together the system of tomorrow in security.

It's one of the things, Chris, I missed you at RSA this year, but, you know, RSAC conference, RSAC company is trying to fill that vacuum of leadership that we were getting. So You want a sense of, you want a sense of irony, Ellen, when we were out in San Francisco at RSAC, the day that Christie Nome was basically talking about CSA and the destruction of it, or dismantling of it, let's say, was when they were rolling out this, this technology in San Francisco, and they're gonna be rolling it out in five other cities. So it's all happening at the same time.

So I'm glad. Well, I thought you told, I thought you were gonna say she went down to the floor looking for the puppies. Uh, yeah, that was, um, that was one of the great segments.

Yeah. Let, lemme pause at this though. Is it gonna be feasible for a government to decide to issue a subpoena to the folks running this program?

And then they're gonna determine that, um, you know, Solana is a threat to humanity here. You know, 'cause she looks very dangerous and then, you know, we'll just disconnect her from all the internet services out there because we'll have her retinal eggs I scan and that'll be that. Well, yes, but you know, this goes again, back, like back to the last segment, you know, countries, you know, evolution happens at the international scale as well, and what's going on with policy management and implementation inside the United States, let's say that politely, um, is what it's, but the rest of the world is still here, right?

So if, if the US population, US federal government or whatnot, you know, can or cannot do certain things like provide leadership on these topics in this time, others probably will. Right? And, and, uh, because if, again, the answer to your question is yes, you know, if if there's a jurisdiction in, in a country, you know, that'll, that'll, that allows, you know, a government to make those sort of choices that's entirely technically and legally and logistically possible in the longer term.

I think what we'll, what we'll find out one way or the other is how competitive a country like that is with all the other ones around it. Because I would posit that that sort of policy is restrictive to productivity, trade freedom, life happiness and everything else. And that doesn't tend to work out well in the long term.

Agreed. Agreed. Look, we'll, we'll, you know, Chris, as you say, I think we got bigger fish to fry, but this is, you know, technology marching on.

And John, I I hope you got your real id. Otherwise, it's a long walk from Las Vegas to San Francisco. I got my pass, I got my passport.

All right, so evidently that'll do. That'll do. Yeah.

I hope. All right. You're watching Text gang.

Let's come back and we're gonna talk about, uh, AI Agent Command Center. Sounds like something outta Maxwell Smart. You're watching Textron Gang.

Join Cruise Con Virtual on May 22nd, 2025 for breakthrough strategies to address advanced threat intelligence, proactive incident response, exclusive bonus material and regulatory adaptation here from our keynote speaker, Admiral Michael S. Rogers, former director of the National Security Agencies, and an outstanding lineup of industry experts as they navigate emerging threats, the core principles of crisis management and the evolution of CISO Leadership. Register now for free.

Hey folks, we're back and we're gonna return to the topic of AI agents because, well, ServiceNow, similar to a conversation we had yesterday, has a command center for AI agents. And it seems to be, it's all about orchestration. We're starting to hear this theme over and over again, but we have John on the scene.

But, so let's just go right to John and say, what's going on with ServiceNow and ai agent management Orchestration is the word. I think IBM mentioned that, well, probably as well, I think, um, this, this was a major theme at, uh, ServiceNow's Knowledge 25 conference, which is in Vegas. So they're, they're, they're kind of falling into a pattern.

Um, ServiceNow announced something called an AI control tower, which is a centralized, as you said, Mike, centralized command center for any ServiceNow and third party AI agent Mullin workflow on a single unified platform. Um, what's interesting is, um, and again, I'm gonna add some context to this because they're announcing a ton of AI related partnerships, including one with IBM nvidia. Oh, by the way, y'all, y'all, I have a, I have a quick quiz for you.

There was a special guest at the end of the 90 minute keynote, keynote yesterday. Guess who it was? You only get one guest special guest, Jen Justin Wang from Nvidia in a leather coat.

Oh, geez. I mean, it's like, it's, it's basically Nvidia and ServiceNow are the same company. They're almost want to position you into believing that they are in the same parallel paths.

And in a, in a sense too, there's a little bit more bravado from Bill McDermott, which is saying a lot because he has a lot of self-confidence, and he was kind of feeling as though its, and I I mentioned to a couple of the, the ServiceNow executives, the fact that they're doing things so quickly and whether companies that are moving slowly are a competitive disadvantage. And I meant in particular, IBM, and they said, no doubts say they didn't even hesitate. They also spent a fair amount of time bashing CRM and, and it was a thinly veiled swipe of sales.

Salesforce, Salesforce obviously. So they, they're, they're positioning AI control towers as, uh, it optimizes AI investments and ensures seamless integration into your enterprise strategies. They, um, they card it out a number of, of, uh, companies that are gonna be using, including the n hhl, Optiv Visa, Wells Fargo.

So this is their moment to shine right now. I think they're throwing elbows more so now than they have in the last couple years. Uh, it's, it's interesting to see because they, they've almost want to position themselves as an early leader.

And I, I wonder sometimes the, the value of the wisdom of doing that, because they're gonna have to hold up to that point. One of the one stat I will finish with that they mentioned that is very interesting. They, they, um, cited Gartner, which found that 4% of CIOs think their data is AI ready, and 60% of AI projects will fail because data isn't ready.

So as part of that, they're gonna be announcing, uh, an acquisition of a company called Data World, and they're gonna be announcing some workflow, uh, data network as well, which they did on Wednesday. So again, a ServiceNow is, uh, all, all, everything for everybody, or at least that's what they want us to believe. So here's my take.

No wonder they took a swipe at Salesforce, because Salesforce also wants to be the AI control center. You know, when you look at the cloud, native world, Docker came out with containers and, and man, it exploded, but it wasn't, and everybody recognized you needed a container control center, an orchestrator, as they called it. And a lot of people threw their hat in the ring, but it wasn't till the community in the, in the market solidified around Kubernetes that you truly had a cloud native ecosystem and a cloud native movement.

I think we have a very similar juncture here. Yes. All of these agents that we're gonna have, whether they're ephemeral, ephemeral or, or permanent, or, or what have you, we're gonna need orchestrators and managers for the agents who gets to be that manager.

Is it Salesforce? Right? Because they clearly have thrown their hat in, and they were a lot earlier than ServiceNow.

Is it ServiceNow? Is it IBM? Is it some company we haven't heard of yet?

Right. But clearly everyone recognizes that being the ser the agentic ai, uh, orchestrator, you know, is where the money is. Chris, you had your hand up.

Yeah. And, uh, you know, so in advising a company, I was trying to think of a way to say this anonymously, but I'll sort of say it out loud for, for, uh, uh, PR transparency and conflict of interest. So I've been advising a company called Radian, uh, that, that is, has a new tool using AI for, uh, risk and compliance and regulatory things.

And I was going through a, with a financial, uh, just observing as I, as I do the demo and this exact topic, right? You know, we're not talking about I have an ai, I am an enter. No, you have lots of AI things going on across all sorts of business components, how they relate to each other.

You know, this, this, you know, you and John, you said anything I have to say about, uh, uh, about ServiceNow and this year rent, you know, the a I don't, I don't know who's gonna win that big thing, but it has to be done. You know, the amount of business value, security value, whatever you want, you, you can get, you know, in these large enterprises, as you understand, yes, you're understanding the, the relationships across ai, orent ai or however you want to wanna call it across your enterprise, but you're understanding your enterprise. And I just, and, and again, I I, uh, I'm biased right now because I'm advising a company.

I've got an interest in this. I'm keep trying to error check myself. Maybe I'm missing something.

Maybe it's not all that. Maybe it's not that, but I think it is, you know, the ability, you know, so yeah, the ServiceNow's and the big players grabbing that control tower spot, now it's seen the time. You know, there was a, an interesting thing that, so I was talking to, uh, Amanda Jocelyn, who's the, she's like a muckety muck who runs AI products at, at ServiceNow.

And one of the things she mentioned about the command center I thought was interesting is all these AI agents, so I was asking her about, about the efficiency of the ai ai agents, and she acknowledged that some are going to be more, um, talented than others. Like in a workforce, there's some employees who outperform others. And she says the command center would have the ability to identify the AI agents that weren't as efficient as others and pluck them out and replace them with someone else.

So basically like fire them and replace them. And they also mentioned this idea of super, the super agent, which we're hearing more and more of, um, that that is in a sense the manager of the agents. So it's kind of evolving.

I, the one question I always want to ask these guys is, okay, ultimately the human oversees the agents. Is there gonna be a time within the next couple of years where humans report to agents? And whenever I ask that question, they immediately either shut down or they change the topic.

They don't wanna talk about it, but I think it's inevitable. And I, this, this whole thing is just kind of cascading in so many interesting directions. Um, they care more about productivity and lowering their labor costs and operational costs.

But I, I, I think this, it's, it's, it's interesting to see where it goes and how enterprises, uh, start using this. Well, And that's such an interesting litmus trip. I mean, you know, we, you could mark that in in the, you know, what's the analogy, you know, geology, right?

You know, there's this particular stratum right now where those spending the money and making the decisions to deploy that don't wanna address that issue. 'cause I'll address you for that. Yes.

So assume, yes, now let's start thinking about how we live in that world or don't, um, because now's the time to start figuring that out because it's, it's tapping now, you know, agents are telling, you know, AI is telling humans what to do today. So the part that's going to be tricky though is I can see how agents will automate a task for me. Great.

Um, but let's say I have a set of agents and I optimize them to go do something, AKA buy this at the lowest cost, and the other organization has a set of AI agents that says, you know, sell this at the highest margin possible. Then these two things will meet somewhere in Eve, they're, and cancel each other out, and, and they're gonna phone home to us humans to sort it out. So I, I think that there's a, a lot of opportunities for these agents, but I don't know how smart they ultimately can get when we start putting agents versus agents together.

And with diametrically opposed missions, You need iron, iron to get it sharp, right? Yeah. Again, the short answer there is not very smart, right?

They are not very smart. You know, start a conversation with your favorite AI with chat and GPT about itself, right? You know, this, it's just, it's an echo of all we're talking about right now.

And these sort of things was echoes of information off the internet, which is lovely, and it's very handy and very useful. And we start applying them in enterprise environments. Yeah.

It'll, it'll echo our enterprise back to us. Uh, but the, these are not humans. They don't even claim to be humans.

They themselves, right? They're, they, They're not the droids you're looking for, right? They're Not devoids we're looking for No.

So, so as they, you know, as they tell me to do things as a human, yeah, I, I get to say, Hey, you're absolutely right. No, I'm toing it because I'm the bloody human and you're wrong. 'cause they are wrong a lot.

And, and the other thing that ServiceNow and Salesforce needs to be concerned about is, so they provide a lot of services that the agents will invoke, but the only thing I'm gonna need on the front end is an AI agent. So basically all these things in the backend become headless services. So am I really gonna know that there's a Service now or Salesforce, or will I care, or will it all just wind up being, you know, a bunch of internet services that we're calling, but they're unbranded and I might just swap 'em out as needed whenever I feel like it.

So like, what's the point of being them? Well, I I think it's because of the agents of tomorrow, not the agents of today. That sounds like a good, that's a good segue to our minority report, right?

The agents of tomorrow. Um, I I think it's the promise of what these things can do eventually, but not necessarily, you know, the relatively simple ones we're seeing today. Yeah.

The one thing, uh, Nvidia in, uh, ServiceNow, they're, they're co-developing a, a, a reasoning agent with a, an incredibly long, complicated name. But you know, they're moving in that direction. Uh, you're right, they'll get smarter.

I mean, the speed at which they're, they're moving. Um, I wouldn't discount what the, the abilities, what they can do. But again, what it comes down to is, and I asked, uh, there's, there's a guy I I talked to who does, who's in charge of sales to enterprises at ServiceNow, and he says at this point, there are so many announcements and so such differentiation between them and there's such a muddled market that the, the vast number of customers they talk to are overwhelmed.

And, um, and terrified. Yeah. Doubt.

They don't know what to do. Look, this is, this is gonna develop. Someone will be the Kubernetes here.

I don't know who, when or what, but there will be anyway, I just wanna Apologize for my agents. They're being unreasonable today and I'll speak to them later. You are not responsible for your agents.

Well, you are, but that's agency law. Um, I think that's gonna call a, a wrap on this version of Text Drawing Gang at a time. Hey, we've got another great day of TechOne tv.

I think we have a tech field day going on, right? Mobility. My friend Jennifer, uh, Manila is out there as one of the delegates and she's one of the smartest wireless security people I know.

So really happy for that check. Check that out here on TechOne tv. We'll be back tomorrow with another gang episode.

Until then, this is Alan Shimo. We're out.