CYBERWARCON Keynote

So when John reached out to me, he said, "Would you keynote this event?" I said, "Of course, I'll do anything for you, John. What should I talk about?" He's like, "Oh, you can talk about anything." And I thought, "Maybe I should apologize." So I kind of created a big problem, and what I wanted to do in this keynote is ask for your help to solve it. So this is going to be a 20-25 minute mea culpa here. So, I started this problem in 2010, right around the time when I met John during Operation Aurora. And I basically went on a two-year tour of dosing the world with cute names of operations that I was revealing: Night Dragon, Shady RAT, 10 Days of Rain, Aurora obviously. And arguably this started even before me with GhostNet, a great work that was done by Citizen Lab a year prior in 2009. And I quickly realized that this was kind of getting out of hand.

First of all, there were so many operations that naming operations really didn't make any sense. You wanted to name threat actors, not operations. And I thought, well, why don't we create a standardized naming scheme, right? And I came up with this naming convention, which was borrowed in part from something that was happening in the government, but basically a two-word name for the threat actor groups. The second part would be an animal name, as you're familiar with pandas, bears, etc. And the first one would be a descriptive adjective that would describe the group itself that's affiliated with that particular nation state. And, you know, this was the 2011 timeframe. I thought there are four major threat actors: China, Russia, Iran, North Korea. They have a few intel military agencies. This ain't going to be too bad, right? Well, there's a big problem. And then before we even get to the state of today, things got pretty weird because we got to 2016. And a lot of things happened in 2016, but this was one of them. I want to play for you.