Kevin Mandia - Cybersecurity Expert Hunting the World's Most Dangerous Hackers | SRS #328

Sean, thank you, man.

I'm ready.

It's a weird world. You know, I've walked the halls of a lot of the headlines people read in cyber security, and the press never really gets it. You know, nobody really understands what it's like to be a victim of a cyber crime. You know, whether it be someone hacking you to steal all your corporate secrets or extorting you, you know, and yeah, hey, you got to serve a higher purpose. Mine's always been, you know, the phone rings, I answer it, and it's a CEO on the other side saying, 'Hey, you know, we're getting ransomed, and damn it, we're not paying it.' And my response is always like, 'Hey, man, we're not paying it.' You know, let's show up. But it's a... Sean, let's see if we can make this interesting for everybody, you know, because I remember a judge, I testified once in a case, and the judge is like, 'This stuff's so cool. I can't wait till there's like an NCIS show on it or something like that.' I'm like, man, if you could see the war room in a cyber case, just really quiet. Looks like your back room right there with those guys in it. You know what I mean? Everybody's clicking on a computer going clickety clacky. There's nothing to see. But you can see the emotional changes in the victims. You know what I mean? You see it on their faces. So, we'll make it real.

You know, there's nothing... here's bad. You're an executive at a company and somebody breaks in and your email gets released. It's now Google searchable. Every, you know, you're at, let's say you're at a Fortune 100, Fortune 500 company and or your photos get released, you know, things like that. Your private thoughts get released. I've seen, I've been in the room with executives when their email got posted. Nobody ever should have to go through that. I just... it's just a terrible thing to see. Even I get physiologically like I can't eat and I'm like, man, this is bad. So, I think that's the worst thing. It personally impacts people. It gets exaggerated. The press does search your emails. They do write articles about people. And it's happened to actors, you know, their photos get stolen. It happens to kids. Like during our interview today, it's going to happen to some 20-year-old college kid, you know, or their photos get stolen. Nobody should ever go through that stuff. So to me, those are the ones that hurt the most. Companies survive them. You know, you get back up and running, you get your operations running, you get over the reputational hits that happen sometimes. I just feel for the people that, you know, go through losing their email.

No, the intrusions are all different, right? It depends on who's doing it. You know, you have the modern nations, China and Russia, Iran, North Korea. North Korea hacks for money. Take them out. But China hacks for espionage, you know. So if they break into your company, they'll break into the defense industrial base. They'll break into any company doing business in China and they steal emails, they steal things, communications, but they don't post it online, Sean. They don't extort you. They follow rules of engagement that whatever their doctrine is, they follow it. But it's not destructive. They don't change your data. They're kind of like the polite hackers. But criminals, it's gotten hard. I mean, because they want to monetize any breach they've got. So they pull on every thread to monetize it, right? They'll... if the Shawn Ryan Show got compromised, what they would try to do to you is steal your emails, steal things that matter to you and say, 'We're going to share it with the world unless you pay us $5 million, $10 million.' And those are the ones that are, you know, you're always making the least bad of 10 decisions, you know. So, shortest answer: people hack for espionage and security, securing a nation. People maybe even hack, you know, espionage to me supports diplomacy. And then people hack for criminal reasons. And then probably there's a third. They just hack for the game of it. You know, the attractive nuisance of it. And I don't really respond to too many of those. I don't know.

Oh, it depends. Meaning it's already happened. Yeah, it is. I've never said pay the ransom or don't pay the ransom. I've never said that, but I've been in the room and people think about it and I've sat there going, 'Man, I think I'd pay this one.' Like if you're a hospital, somebody breaks in and they've encrypted every machine so they're unusable and they say, 'For $10 million, we're going to hand you back a key to unlock all your machines again.' You got two options. You're either getting every doctor in a room saying, 'What surgeries can we do? Which surgeries can we not do?' Or you're evacuating patients or you're diverting ambulances or you're paying a ransom. In that situation, I'd never opine, but boy, if I said, 'Oh, I get it.' You know, I'd pay that one and get back online. So, I've seen people pay extortions and pay ransoms. And the difference is a ransom is to like get a key to decrypt your things. Like, people will ransom and say, 'I've hacked into your network. I've shut down 10,000 machines for 10 million bucks. I'll turn them back on for you.' And that one, you know, if lives are at stake or you want to protect the privacy. The second, the extortion is I've hacked in, I've stolen emails, I've stolen client data, I've hacked the law firm, and I've taken your briefs. Those extortions are really painful. It's 'I will release the data unless you pay me.' And I see people pay it because you're protecting your customers or you're protecting people in general. So hospitals will pay, law firms would pay. Yeah, it's a tough decision and luckily I've never had to make that decision. I hope I never have to.

Well, exactly. Like they're only capable of one bad thing, right? And then they're done. And you don't... the reality though is usually if you're getting extorted, it's highly probable whoever's extorting you is in a safe harbor like Russia. I've not... others have written that they've seen Chinese actors do this. I have personally never seen a Chinese actor extort a company or even ransom a company. So I think culturally the Chinese really don't do this. It comes out of Russia. And the good news is this. If somebody in Russia hacks company A in the United States, extorts them, and company A pays that extortion, let's say they paid $20 million in Bitcoin, an anonymous currency, and then they still leak the data. The reality is people just stop paying the ransom. So, I actually think there's a governance over in Russia of, 'Oh, if you get paid, you don't post because otherwise people will stop paying and they've got a good racket going.' So, it's been my observation when people pay, the vast majority of the time the data does not leak. There are exceptions, Sean. It's rare. I can count the exceptions on a single hand. And there's probably over a thousand times we've responded to these things.

Every day. Every single... during this call. During, I mean, this interview, it'll happen to somebody. Can you believe that? During our interview, an 80-year-old American woman will probably lose 200 grand of her life savings. During our interview, a company will get compromised and probably extorted for 5 to $10 million. It is happening at a rate, and this is not a fear, uncertainty, and doubt thing. Nobody knows the rate. So then you go to the government and say, 'Well, how much money is getting paid in Bitcoin every year to Russian organized crime?' It's in the billions of dollars. Billions. Like the lowest estimates are billions. So all we know is the lowest bounds. But as I sit here today, people I've worked with are definitely responding to extortion cases and trying to figure out. And there'll be a new one today. A big one. And they're handled quietly and discreetly or sometimes they're front page news. You never really know what... Yeah. And then... Yeah. Exactly. And I sit there and say, 'Hey, let's...' Yeah. By the time we get that phone call, Sean, like that there's been a breach, there's been an extortion. It's tough. You know, there's nothing you can do about it except work through it.

So, that's a great question. I, you know, first we lived in... well, he's a Texan now, right? So he lives outside of Austin, but when he moved to Woodside, California, he has a place there. And so we met there and in general it's a small community, you know what people are doing and he and I just knew of each other, you know, I knew what he had done with Palantir, he knew I was the cyber person and just over time you get, you know, if something happened and he would give me a call, 'Hey, listen, we got a company that needs this or a company that needs that.' And you know, I've been in the cyber security domain for 34 years, sooner or later you're either good at it or you're not doing it. You know, I like to think I'm still pretty good at it. So, that's kind of it. You know, when people need... when people had a computer intrusion, we had a unique... My company kind of responded to every breach that mattered and so I think I'm on speed dial for a lot of these folks and probably Londale. I'm on his speed dial when something bad happened somewhere. Yeah. I'm the emergency room doctor for cyber security incidents.

Why not? You know, when you get into offensive cyber, the cyber domain's been contested my whole life. Your whole life, Sean. Literally. I mean, it's something that people that are faceless, nameless, and have no risk and repercussions can rob people, hack people, extort people, steal information, and they can do it from 10,000 miles away, you know. And so when we started, you know, Armadin, the whole thing was we want to support the United States government. Like the cyber domain is contested. Let's at least win when it is contested. During times of peace, it's contested. Imagine during a time of war what it might look like, you know? So, yeah, getting In-Q-Tel involved to me it just felt like the right thing to do. You want to service the intelligence organizations and the military.

I don't think we did. I don't know how you knew that. It wasn't the first one I would have listed because now you know you try to do business in Germany, they'd be like, 'Oh, the US government's inside of Armadin.' And they're not. It's just you want to support the war fighter. You want to support our intelligence agencies and you want to believe, you know, America can be the beacon on the hill still. So...

Well, you know, it's funny that we're talking In-Q-Tel because the latest Dan Brown book, In-Q-Tel are the bad guys in true story. They're the bad guys. Somehow, it's been my career like I'm biased. I believe in the institutions of the US government. You know, I served in the military. People can... every institution can have its downsides and upsides, but you look at the missions of what we try to do. We try to do the right thing, you know, and it's the fastest way to bring capability to the intelligence agencies and to the military is through In-Q-Tel sometimes. And I believe in what we're doing and I want to make sure the American war fighter has the advantage in the cyber domain. That simple. Do they have covenants? I'm sure they do. You know, did I sit here and memorize them for your show? No. I do know they, you know, they'll attend the board meetings when we have them. And as an entrepreneur, you'll learn if you haven't yet. Man, board meetings can be long. And I've been the operator at board meetings. I'm trying to push these things off as long as I can. You know, let's start them when... when finally we will start board meetings. That's the problem. I was unfunded the first time. So, I didn't have board meetings for the first seven years of Mandiant. But now I've done funding and I'm like, should I be doing a board meeting yet? And I'm just going to sit quietly now. Someone will listen to the show and say, 'Okay, Mandia, I have a board meeting.' I'm not going to really schedule until someone's begging for them. You know, but I'm sure In-Q-Tel will show up and the others will show up, but we are so early on. What's the value in a board meeting? You know, it's... they think there's value. What are you doing with our money? For me, it's let us prove ourselves and let's get some things done first. So, I'm not sure I need a 90-day cadence yet. Although, I probably just spoke my mind and I'll have one in two weeks now.

Oh, thanks. And I got you a couple. Thank you. Oh, thank you.

And I'm the guy that... True story, it's in Southall right now in the hotel. There's a little white bag on my table with your gift in it. So, I'm going to send you something as well. And I apologize. I didn't bring it with me. I was so eager to get here. I ran out to the car without it.

You'll get it. And it's weird. So now one of the things I had to learn throughout my career is how does software read, write, store, and delete data? What's the app really do? You know, so we'll end up kind of reversing it. You know, we'll kind of try to figure that out. But I think you're right to be paranoid, you know what I mean? It is a strange world where, you know, the digital exhaust we leave behind is way higher than people think. Every time you browse the web, you know, whether you say, 'Hey, I want cookies or don't want cookies,' you're getting them. You know, we had a company come in and pitch us on a... we got a cookie tracker and I'm like, you know, we didn't invest in it, but we went out and just tested their software during, you know, while the entrepreneur was pitching us on, 'Hey, listen, this is what happens.' And we went to a medical site that everybody uses. And when we connected to it, Sean, of course, we got the prompt, do you want to accept cookies or not? We're like, hell no. We got a bunch. We got over 900 cookies just by doing one search on one site about a specific disease. And those cookies come onto your hard drive. And then when you go to other sites, you're letting like a marketing company know or you're letting a PR firm know or in this case, we looked at all the cookies and one of them was like we were sending our IP address and the sites we were visiting to somewhere in Russia. And so this whole... Yeah. Like everybody, we have a whole generation, by the way, that's probably waiving the right to privacy by posting everything on, you know, Facebook, you know, Meta. And but I get it. You know, it's right like if I had to give one privacy tip, use iOS devices. Use Apple. Really? Yeah. Totally. It just... if you look at, by the way, simplest metric in the world on, hey, what's really secure? Look at the payout. So somebody has a zero-click exploit for the iOS phone. It's in some places it's $20 million, you know, and Apple itself, I think you can get four to six million on the bug bounty program. Like if you find a zero-click, someone just, 'Hey, that looks interesting.' They don't touch anything. iOS is hard to compromise and they really... anyone who's on offense and can compromise it, it'll probably be a modern nation and they're really coming after you. But that doesn't mean it's undoable. So I love the fact that you picked iOS as the platform. I think it's right. Thank you. And I think more and more people probably should think, where's my data going? Who's getting it?

Well, they probably were compromised in some way. The interesting thing about Apple, my whole career, Apple's never called and said, 'Hey, can you respond to a breach here?' So, and there's a couple... like if I went through the whole Fortune 100, there might be eight of them that didn't hire us to respond to a breach and that's it. And Apple's one of them. And they've always... there's a couple places, you know, Goldman's one. You know, they have usually homogeneous networks, very similar, lots of tight controls. If anything does happen, they detect it quickly and respond quickly. And Apple's always struck me as one of those companies that's pretty damn good at security, you know? I mean, it's good to hear. Yeah. Yeah. It's just there's something different about them. I mean, think about what they did with the iOS. They closed it. It's not like you can just write an app and do it. You've got to use their libraries, their APIs, and publish it their way. You know, no one really jailbreaks the iOS phone to put whatever they want on it. So if you... for the most part you almost have to hack yourself to hack your iPhone. You know, a window should pop up, 'Hey, this software is unsafe,' and you have to go, 'I'll take it,' you know, got... and hit it. So except for the rarest of cases, is you're really targeted by like a foreign intelligence service. That's about the only way I think you're going to see a phone get popped. Okay. Yeah. Okay. That's good to know. Yeah. No, it's a good selection. So... thank you. Thank you. You nailed it. Right on. Well, let's... so let's... I want to do a full-blown life story. All right, I'm ready. Where'd you grow up? Where'd I grow up? Formative years Pittsburgh, Pennsylvania during like the crappiest decades of living in Pittsburgh. So, yeah, we're winning Super Bowls. That's about the only thing we're winning. You know, not a bad thing. 70s and 80s, every steel mill closing down. You know, I still remember probably 1983, '84 coming home from school. My dad... I, you know, dawned on me my dad never sat at the kitchen table unless he was eating and I came home from school one day and a) he was home, b) he was sitting at the kitchen table and then it hit me something's different and he lost his job, you know what I mean? And I remember in an instant, you know, non-verbal communication could say it all sometimes. I instantly thought, man, he'd pick cancer over this, you know what I mean? And so Pittsburgh was a rough place to grow up and I spent, you know, the late 70s and early 80s there and then moved away from there and I went back to there and I still remember when we left it going, 'Man, I don't ever want to go back there.' And then 3 years later, my dad's like, 'Hey, we're heading back.' So anyway, formative years Pittsburgh, great people, tough town. I think if you lived in Pittsburgh from 1970 to 1985, all you saw is, you know, tough place. Yeah. Probably like Detroit, you know what I mean? Sister city Detroit. I feel for that place. Yeah. What were you into as a kid? Football, right? It's Pittsburgh, you know, football, baseball, basketball. I was the youngest of four boys. I think that matters. You know, you got somebody... you got to live with Alice Cooper fan and your older brother. You know, you learn about rock music. You know, I was 10 years younger than my oldest brother. So I got a real education on music early. Everybody played football. Everybody, you know, didn't matter where, you know, it's you go in the backyard and pummel each other. You had to, you know, so it was football, baseball, basketball and then you go to entertainment, it was like Magnum PI, Quincy shows, you probably don't know what I mean. Oh no, I know Magnum PI. You got Fresh Prince of Bel-Air, I got you know, Quincy the... but you get it. It was, you know, Pittsburgh was a black and white city, you know, you move away from that and you get to see color, but in Pittsburgh what I meant by that, it's just it was gray, it was like it felt like it was always winter, you know, and in hindsight you don't know it till you leave it and look back on it, it was a depressed state. Like the people were all struggling, you know, period, you know, and I was in one of the nicer towns. But I think I was into sports, you know, and then I had a father who was old school, right? Old school is, 'Hey son, get A's.' What that meant is get A's or I'll kick your ass. Get A's or life's going to get real hard for you. I mean, I didn't want to find out what the alternative was. I found out was no shot. Well, you know it then, right? I mean, my dad had a set of rules that if you broke them, you did get hit. And it was fast. I always was like, 'How does this large man move so quickly?' You know, but he was consistent about it. You know, people are like, 'Hey, corporal punishment is bad.' For me, at the youngest of four boys, I think it was necessary in a way. You know what I mean? Like we were probably going to be pretty... My dad liked order, quiet, clean, and I don't think you would get that naturally without some enforcement, you know, and at the edge as they say. And my dad had that. So I knew every time when I was going to be disciplined, it never surprised me other than how fast he could move to do it, you know. And by the way, it would have done no good to run because that would have just made it worse. You know, you just got to stand there and take it. And it wasn't like he beat me. It was just, you know, he had a discipline to it. And so, you know, going back to the original question, what I was into is probably the same every teenage boy in Pittsburgh is into sports, except I was a Vikings fan for some damn reason. Yeah. Right on. I haven't figured that one out. So, how did... how did you... were you into cyber security by the time you joined the Air Force? No, it didn't even exist. So, I get in the Air Force in '93, but you know, I graduated college in '92, and back then there was a little bit of a lag. You know, we had the Clinton years. There was a lot of RIFs going on and you could do ROTC and never actually get orders, you know. So, it was an interesting time for the military. It was time of peace for the most part. We had done Kuwait in the, you know, 1990, Desert Storm. So, I graduated college in '92, but I grew up, you know, I thought Magnum PI was cool. You know, he's former military. He was, you know, he solved cases. I always felt like you got to have a mission bigger than self. You got to, you know, want to contribute to society. And I grew up a forensic fan. And I mentioned Quincy earlier. I used to watch Quincy going, 'Hey man, let's solve cases.' I did computer science in college from '88 to '92 because I grew up with Pong. I still remember the first Pong game, Nintendo. Wow. In television, the Odyssey by Magnavox. Like I grew up with the whole Atari 2600. You grow up with these games and that kind of gets you into computers. So, by the time 1980 or 1981, I'm 10 or 11 years old. My Christmas present was the TRS-80 Color Computer. Like, other kids are asking for, I don't know, Stretch Armstrong and Rock 'Em Sock 'Em Robots. And I'm like, 'Hey man, can I get a computer?' And my dad, my mom, my grandparents all pitched in and bought me like this $700 Christmas present, which back then is like, are you kidding? That's like better than a car back then, actually, Sean. So, in hindsight, I should probably be more thankful. So 1980, '81, I get my first computer and even though I'm playing football, baseball, basketball, running track and out pummeling people, and I'd come in and be like, 'Hey man, I like this computer crap.' You know, so I kind of grew up with the computer. I got computer science ROTC at a small school in Pennsylvania called Lafayette College where I went all out. I took a pencil, filled out the common application, applied to one school, got in and went there. There was none of this 20 schools, 10 schools. I had like no plan B. I was applied to Lafayette. Did ROTC at Lafayette and did computer science. And I got stationed at the Pentagon in 1993. And the way I got into cyber security was I got stationed at the Pentagon, was six second lieutenants. And we were all waiting in line to go in to see an O-6, a colonel, full bird Air Force colonel. We were stationed at what was called the Seventh Communications Group. And we're all, you know, chicken [__] out in the hallway. Who wants to go first? What do people want to do? And I like to tell you there's this elaborate plan for me to go into cyber security. But what really happened is I went first. I was like, I'll go meet the colonel. I'll go figure this crap out. So, I just get first in line and I go in and the O-6 behind the desk gives me... and literally there's the whole thing. You go in, you know, stand at attention, go to at ease and wait. And he lays out five options for my next couple years. Here's what your assignment can be. So, I actually had a choice. And all the choices were bad. And it was the weirdest thing. Sean, right at the end of it, I still remember it. He was like, 'Oh, oh, when we have one slot left, one job left to do computer security.' That's what he called it. And I remember thinking all five options prior to that were horrible. Like, it would have sentenced me to death. It was like job control, language, mainframe programming in the basement of the Pentagon. When he said there was one slot left, I'm a sucker for 'there's only one left,' you know? And so I'm like, I'll take that. There's only one left. That's valuable. And you know, in hindsight I backed it into... you know, it ends up playing out very well. I loved forensics. I ended up getting a master's in forensic science at GW on my own time while serving. And computer security worked like immediately. I had this job doing computer security and what it was is who's accessing what. And about a year into me doing that job, it was 1993, the Air Force put eyes on the network for the first time. You... for the first time ever we started watching what are people doing on the network. So I kind of got to grow up with computer security. You know, we started watching people. The Department of Energy created a tool called the Automated Security Incident Measurement Tool. Interesting. It's free. And we deployed it at the Pentagon and for the first time ever we could see what are people doing, like what files are they transferring and what commands are they doing and where are they logging into? And when we lit it up right away we recognized, wait, we're not the only ones on this network, you know what I mean? Who are these other people on it? And so by 1995 I cross-trained into the Air Force Office of Special Investigations from computer security to do computer intrusion investigations. The military was starting to use the internet, you know, from '93 onwards. So we had to start figuring out who the hell's on our networks and what the hell are they up to? Who was on the networks? First one I ran into was China. Literally go all the way back to I think it was summer '95, might have been summer of '96. One of those summers we, you know, at that point we had the Air Force Computer Emergency Response Team. The Air Force had one. I don't think the Army had one yet. I don't think the Navy had one yet. And then the government had one called USERT out of Carnegie Mellon University in Pittsburgh. And so maybe there's something in the water in Pittsburgh to get you into this stuff. But I remember there was a West Coast university. I'm in the Air Force Office of Special Investigations and our ASI boxes showed something like 20 Air Force bases were logged into from one university. What the hell's going on? Like no university should be logging into that many, you know, Wright-Patterson Air Force Base, Oak Ridge, Lawrence Livermore, Los Alamos. Oh [__]. Wright-Patterson, all of them. And they were... and so I flew out to the university and at that time frame I'm in the United States military. I go to this university and I'm like, do you mind if I monitor all traffic to and from this machine? Now everybody listening to this will be like, the government watches everything. We really didn't back then. I had to brief the judge advocate general. Hey, this is what I want to do. And to the Air Force's credit, if we did what we would call a wiretap and there was nothing fruitful in it, oh, it got killed fast. Like you had to have fruitful real results or JAG was going to be like, stop it, get out. There was a great control to not wantonly watch. But the university allowed consent. Still like that? I don't know. You know, I often wonder if the military is the same as when I grew up. Maybe a topic for later because to me... but then it absolutely was. I remember going, man, I need to tap this because someone's coming from somewhere in the world into this system and then from there to all these military installations. So I got consent to monitor. To the college's or the university's credit, they were like, 'Yeah, go ahead and do it.' And then the way I did taps back then, I just ran software on the machine itself, you know, it was a Unix machine and I watched all incoming traffic. And the first day, I'll never forget this, Sean. Summer of '95 or '96, it was when I was two. The very first day I did the tap, somebody was logging. This is how you go one hop back every time. Like when somebody hacked you, we'd only know the first like IP address or first address they came from. But in computers, you can connect to connect to connect to connect and they're called hop points. And everybody obfuscates where they're really sitting. If you're sitting in Russia and hacking, you know, the Pentagon, you're not going straight from RU to Pentagon. You're going from RU to the UK to China to, you know, wherever you want. Usually... how do you pick those? They compromise them first. Like if you're on offense, you have a network that you use to launch your attacks. And for the most part, you almost have a team that maintains that compromised infrastructure for you. So if I'm a foreign intelligence service, I have a team that maintains access on all these intermittent sites, not my real targets, just sites like universities and businesses. And it's called a non-attributive network of victim...

machines. At least this is how other nations do it against the United States. And then they have their operators use that infrastructure. And that's exactly what we ran into in this case. I did this tap out of West Coast University. The very first morning I go in and like download the files to look at what happened. Somebody came directly from Beijing into West Coast University using the account of a Chinese foreign national. I went to this college but I had since graduated and logged into 37 or so military installations and each login was somewhat haunting. They used a user ID like S Ryan and then a passphrase. Then the next one they would go to like Wright Pat and go John J. Smith and the right passphrase. They were validating accounts at all these different places and I had the right choke point to see all the traffic. They came to this one machine, logged into Wright Pat, logged out, logged into Los Alamos, logged out, logged into Los Alamos, logged out, Wright Pat. Keep going down the list. And they never fat-fingered the passphrase. They got in every time. And I remember thinking, how do we fix this? Like, you can't call 37 bases. Who do you call? They were hitting Army. They were hitting Air Force. They had, you know, the Marine Corps. They hit us all.

Yeah. It's just the protocol listed off there. Yeah. And it was just the defense research and engineering network is essentially what these guys are in. And the unfortunate reality in hacking, or fortunate if you're the offense, like if I break into the Pentagon, it's just a matter of time before I break into all the other military installations. If you break into an Ivy League school, you're going to end up being able to hack all the Ivy Leagues because that's just where the traffic goes. That's where the information is shared. And that's what happened here. I don't know where they originally broke into. But it was extensive and that was in the '90s. So, and I remember there was no one to call. Like that case went on for like 10 years. I mean, it had code names and classified names and it just kept going. There was nowhere. I was a first lieutenant at the time. I mean, what do I do? Call the base like, hello operator, I need the cybersecurity guy. There wasn't, there was no way to remediate it that simple. So instead what we ended up doing is running an operation largely run by the military jointly with the FBI and we did counterintelligence. We just watched it. And then we found the Russians for me every day. Let's just shortcut it. It's 2026. My first incident response is 1995. So it's been 31 years. I would say every day of my 31 years we've been responding to an intrusion out of China somewhere on the planet every single day.

And by the way, not just one, way more than that. So they have mass, they have just the scale that they can operate at that's pretty high. And then probably the Russian SVR had counterforensics earlier, so they would go dark on us. And back in my day, Sean, if I responded as an Air Force special agent, what was amazing to me, if I responded to Russia, every time we caught them, they just went away. They were like, "Ah, you got us. We're going to go away for now." And it was almost like rules of engagement. If they got caught spying, they just went away. And you can tell when someone's monitoring what you're doing. You can find the tools we use or you can see that we're starting to remediate and clean up around you or we shut off the account that you're using or we change passphrases. And the Russians never let us observe them, period. Literally from 1995, 1996, anytime I responded to a Russian-based intrusion, they were super stealthy. That did change right around 2015 where they got louder and probably they stretched their mission too much to do counterforensics and counter surveillance and stuff, but they had a 20-year run where we'd have them in our sights and lose them. And I went years not finding them. Like literally, we're like, we know they're out there because that's their day job. You know what I mean? They're paid to hack us. You know, they show up every day, badge into a building and do it, but most of those cases probably got classified and I was on the outside by then. But they were really hard to find. China was more like a tank through a cornfield. I mean, they were just like they didn't care if we saw them. They didn't do counterforensics. They didn't change the data. They didn't extort. They didn't do anything. They just stole everything. You know.

You know, for the vast majority of my 31 years responding, Russia was better.

Yeah. Their operators really didn't like getting caught, you know. And here's an example. Like I think China just had so many people, Sean. Like I just said the other day I knew a lot about religion because I took art history. I feel like I know a lot about the Chinese culture just by responding to intrusions. They definitely threw people at it. And here's an example. If a Russian hacked your machine, what they would do is they would bring their own way to search your machine. They would hack your computer. Then they'd upload a file that would search everything on your machine looking for specific keywords, whatever they're after. Or they'd just grab your email. And even when they grabbed email, they would minimize it. They'd grab like the last month's worth or something like that. They were always very precision strike. If a Chinese operator got on your machine alphabetically, file by file and directory by directory, they'd look through your machine because they had, and I thought about it, they have human capital. There's eight hours in the day. There'd be an operator on a keyboard going, I'm on Sean's machine. Let me just look at this file. And literally, they almost did it alphabetically. The second thing I noticed is early in my career, the SVR would always steal. The Foreign Intelligence Service out of Russia, the SVR, would always steal specific files responsive to what they wanted. They were just real good at that. The Chinese would just compress a whole directory and steal it. Like if you ever use like ZIP or something like that, they would say, "Oh, this directory called documents looks interesting. I'm going to take the whole thing." So I could actually tell who the operators were just by the data theft. I'd be like, "That was Russia. They took 32 files. That was China. They took three terabytes, you know, of everything." Because China would even steal operating system files that were the same on every machine. But it's just they had operators that would go, "That was an interesting directory. I'll take everything in it. That was an interesting directory. I'll take everything there." I'm sure they had a unit that was more precise, more stealthy. Every nation does. But China took front seat in 2020. You know, every year at the end of, so from 2004 to 2025, I worked at Mandiant, you know, my company, and at the end of every year I'd be like, "Hey guys, brief me on the coolest cases we got." And for the most part, I got involved in those during the year. It was in 2020 where I saw the Chinese government break in using what's called a zero-day attack. There's no patch to it. Similar like when we were talking earlier about Stuxnet. Zero days are attacks that work against an application and you can't stop them. They will simply work. And the goal of a hacker is to get remote access to your machine. So I can be 10,000 miles away and get to your phone or 10,000 miles away and get to your server or desktop. And then it's usually I want your email or I want your files that you've created. I want reports that you're writing about our supreme leader or whatever it might be. And in 2020, the most expensive offensive attack was done by China. They used multiples of zero days to break into a defense industrial-based company. And everything they did that was special, like everything they did had to be custom-crafted for that environment. And that is, in my whole career, that is very, very rare and China did it. So I'd say China's number one now for scale, scope, and sophistication. And then China decided to get stealthy in 2020 as well. They weren't prior to that. They decided to, from a forensic standpoint, leave fingerprints. Wow. And Russia went the other way by the way. Russia is now like we found them, you know. And I think Russia with conflict and everything, they're just operating at such a scale and scope that they can't, they don't have enough operators to clean up after themselves. And it's very manual to clean up after yourself. It is not, it takes a human intelligence on a keyboard to say I don't want to leave a trace on this machine so I have to edit the log file, take myself out, you know. So the counterforensics of Russia is down a notch or two right now.

Yeah, I think we were the first ones to do it.

Well, so I made it. I mean, that's kind of what. Yeah. So I had a master's in forensic science. So you can think about all these intrusions I'm responding to are like crime scenes. Like, what are the fingerprints left behind by the intruders? Well, it's the malicious code they run. It's the commands they execute. It's the encryption algorithms they use. It's the type of files they steal. It's the type of targets they even compromise. And so, with my forensic science background, I created a thing called an indicator of compromise. I'd worked enough cases where we're like, we got to call the fingerprints something, so the indicators, and we started just bucketizing them. So we'd respond to company A and be like, "Oh, the attack came from here. They use this software." And as we bucketized or cataloged the evidence, we started just seeing the same people over and over. They use the same custom code to break in. Like I'll give you a weird one. Like if you break into, the two dominant operating systems are Unix-based operating systems, Unix and Windows, and Mac is a Unix derivative. You know, in Windows, if you break in, you do what's called a directory command. I've broken in. I want to see what's on your hard drive. I'll do dir and just kind of look at what's on there. And the Russians when they break in, they do a directory listing of everything on your drive and that's all they do. It's really smart. It's like great recon. They don't even poke around. Sometimes they break in and go, "Just show me a map of everything on the machine." They download the map and five days later come back and just take what they wanted. The Chinese would break in, show me everything, and then go through it alphabetically with a human just sitting there 10,000 miles away looking at every single file and doing it. So we even cataloged in Unix that dir command is called ls for list. And we would catalog did they do an ls- option or ls-la. Different operators typed it differently and we could even get down to the speed at which they typed. I mean, we were tracking on a lot of cases. We had up to 650 criteria we would track, but only like 10 mattered. Long story made short, we just took the fingerprints of each group. And it turns out the Chinese did great training and the Russians did great training. So they were actually really consistent. You know, the commands they typed. If you're a kid and you break into a machine, you just get undisciplined. You start going, I'll check out this directory and then randomly this directory and then randomly this and I'll look over here and I'll do this and they're all over the place. It looks like a monkey fight at the zoo, right? And then you responded yes and it's just all economics. They did a directory listing and left. That's it. Gone. Kids don't do that. Foreign intelligence services do that because they're going to come back in after they've looked at the file listing and just by names alone they know what they want or even the apps they want to steal. And at the time I started responding to intrusions in '95, we didn't export our supercomputers. So all our modeling and simulation of modern weapon systems were done on supercomputers. The Cray C90, the Origin 2000, the front nodes to all these supercomputers were what we would respond to. The Chinese and Russians would hack these things and literally they would run our modeling and simulation on our systems, but export the output all the way back to China and Russia. Isn't that amazing? So one of the first cases I ever did with Russia, they were literally running, they were stealing stuff and they were running the modeling and simulation of a certain system we were creating, unclassified though, but they were exporting the display right to their desktop. So they were just sitting back watching, oh, there's the model and this is how it looks. They were literally stealing it that way in '95. So again though, those fingerprints, that's just an example. Fingerprints, the commands they type, how fast they type, the malware they use, who they target and how they operate. At my company, Mandiant, we started creating these dossiers basically. And we were boring. We didn't know what to call them. We didn't name the groups like, you know, this is fluffy snuggle duck and this group's called, you know, whatever bad rabbit. We just called them integers. APT, advanced persistent threat one was China. It actually was PLA Unit 61398. And we just named them integers and now we're up to I don't know 50 something and that's where we have definite attribution like we can get you to the building they're coming out of, you know. So when we started this we had maybe 40 groups in the first eight years that we had fingerprinted, only 40 different fingerprints for every cyber crime. Now we're into I don't know 6,000.

Oh, by the time, I mean it was one, me, and then we grew it to about...

No, no, no. I started it, right? But we were about, by the time we're labeling groups APT 1, 2, 3, or 350, 350 people all ex-government. Like at one point, Mandiant, it was 500 people and I'd say 350 came from the US military.

Oh, just the intel.

Oh, in the Air Force. When you were a special agent, when I was doing that, there was 13 of us. I think we doubled it to 26. Yeah. It kept doubling. And you know, cyber was new in 1995 when I was in the Air Force doing this. And so they kept doubling the teams. Now I bet it's hundreds and hundreds. Like if you're a special agent in the FBI today and you're not digitally forensically educated, you're not very useful. I mean, you have to know how networks function, how every case has digital evidence now. Counterintelligence, crime, especially languages. I don't know how you can be an agent today investigating anything without understanding digital forensics, you know. So small team, 13, 14 of us, massively grew even while I was doing. We were called computer crime investigators and we did the, and the FBI had a thing called the CART team. I don't even remember what that stands for, but it was like computer forensics stuff. And all I can tell you is we were always, no matter what, it was almost like we had a sticking line where we're always six months behind. No matter what the case was, we were six months behind on the forensics, you know. It was like because it was real hard to keep up with all the digital evidence piling up.

February 2013 released a 76-page report publicly naming PLA Unit 61398 operating from a 12-story building in Shanghai's Pudong district. Yeah. As the source of espionage against 141 US organizations across 20 industries. Unprecedented. Yeah. Stole technology blueprints, manufacturing processes, test results, business plans, and executives' contact lists. Yeah. How did you, I mean, huh. Well, this is, yeah. This is all you. Yeah. But I think the government knew, you know, so this was 2013. The backstory on that is I start Mandiant in 2004 and I had a premise. Let's respond to every breach that matters because in the cyber domain prior to Mandiant, here was the intelligence model in cyber. It was McAfee, Symantec antivirus. You've probably heard of them, right? McAfee, Symantec. You'd run antivirus on your machine. If antivirus missed a bad file, a malicious file that was stealing your stuff, the only way Symantec and McAfee got smarter is you would be like, "Hey man, you missed this malware, so I'm going to submit it to you so you detect it next time." Well, here's the problem. My mother's never going to find malware on her system. And Sean, you're never going to find it either, unless you read an 800-page book I wrote that would bore the hell out of you. You know, it's hard to find this crap. It's ridiculous. So I decided we need a new intelligence model in cyber. Let's learn from all the red teams out there, the offense from Russia, China, the criminal element, North Korea. Let's respond to every breach that matters and learn from it and build the defenses because I thought antivirus, and I hate to say it, thinking Symantec and McAfee was securing you at that time was like believing in the Easter Bunny. I mean it literally was so easy to evade. I was actually talking to one of your guys earlier and we were talking about he even experimented with offensive cyber and could evade AV because all you had to do is encrypt or compress your executable, put it on your machine and when it executed it would decrypt itself, meaning it had no signature. So AV would miss it. So long story made short, we needed a new model in cyber. How do we build better defense? Well, let's actually get in the ring with the offense. Look at what the hell they're doing. So I think I was the first company ever started with, "We're going to respond to every breach that matters." And I got to be honest with you, I didn't know if breaches would go on forever. But I had that phrase, I think I made my first website, and you're an entrepreneur, so you know, there is no website team. I had to make my own website back in 2004. And I literally wrote on the website, the first phrase was you cannot solely rely on preventive measures. And that was boring. So I went with security breaches are inevitable. No one believed it. I think the only reason Mandiant was successful is I had a premise security breaches are inevitable. We'll respond to everyone that happens so that we can build a better defense against them. First knowledge, first mover knowledge on what the bad guys are really doing to circumvent defense. Nobody believed that premise. So we had no competition. So every damn major breach my phone rang. I still don't know how the hell my number got out there, but we had to be good at it. And then everybody recommended us and breaches took off. In 2004 when I started a company, every election year both sides have a problem. I can tell you that right now. So in 2004 you get to respond. If you respond to Pepsi, you don't respond to Coke. If you respond at the RNC, you don't respond at the DNC. But those things are heavily targeted. But in 2004 when I started Mandiant, right in the summer of 2004, we were only like, I started a company February. By June or July, we're nine people in a basement in Old Town Alexandria and we get a phone call from the defense industrial base and we couldn't respond to it. We're already fully pegged responding to a breach somewhere else because it was an election year. But it was Honeywell and I guess I can say that now because that was 22 years ago. They were the first ones I saw where the Chinese government that I was responding to in the military just went, I'm going to shoot the headlight over here and hit Honeywell now. Then they go through the whole DIB. They go after Lockheed Martin. They go after Boeing. They go after Rolls-Royce. They go after UTX and Raytheon. And it was considered fair game. All of them, well, you know, they are heavily attacked in the cyber domain every day by China. Fair game. Contractors are coming for you. And these companies have like, what's funny, people would be like, man, the banks have great security. Well, in cyber, the best security I ever saw at one point in time was Lockheed Martin. I mean, what they did on defense was, I mean, all the defense contractors, trust me, they do everything they can to secure their stuff, but they also have these joint projects that are, you know, a bunch of mad professors getting together. But in 2004, 2005, I saw the military of China suddenly expand scope and go after our defense industrial base and that was right when Mandiant started. So all those companies hired us and we would respond and I remember I would brief, this is a guy in Beijing doing this and or you know, it was the beginning of it. You know, that's when we realized China's all over our networks. I guess I always knew it. Mil felt fair game. I think nobody really expected them in China to suddenly say, "Hey, let's hit .com." And then they went way down .com. They like, if you were a law firm, if you were an accounting firm, if you were doing business in China in any capacity, they had guys in uniform hack you. So they don't separate economic dominance from military dominance in China probably. You know, they hack, we would hack on offense as a country for security purposes and defense purposes. China hacks for economics. So, and then since then, Sean, everything went public. General Alexander, when he's running the NSA, largest theft of IP in human history, you know, to the credit, Chinese didn't damage anything. They didn't delete stuff. In my whole career of responding to the Chinese threat actor, I only saw like one operator delete the logs once. You know what I mean? They leave everything there. But they got way more surreptitious lately. So yeah. And since 1995 till now, China's heavily targeted our defense industrial base.

Well, I think you know a lot of folks think when a nation targets you, you should be able to withstand it. But I've always thought like the analogy I use, well, I'll use this one. You were a SEAL. If a SEAL wants to rob the Lego store at the mall, they're going to evade Paul Blart, the mall cop, and rob the store. You know what I mean? No problem. When you have the Chinese government trying to hack you and you're a company, you will lose over time. There is nothing, I don't think it's reasonable for the American people to think any company can withstand a foreign intelligence service trying to break in in cyber domain. It's not. And so I remember early on every victim company wouldn't tell anybody, you know, but it became because you'd say it and then you'd have pundits on the hill go, "Hey, what irresponsibility to let the Chinese hack you. Are you kidding?" It's like your grandmother in an ultimate fighting championship. It's simply an unfair fight. And it still is today. Even for the companies that do everything they can in cybersecurity, you really don't want to come under the lens of the SVR and the MSS when they decide to go on offense. It's a tough thing to do. So what, yeah. So we had like eight, that's why we went public in 2013. I mean I just told you in 2004 the first company I saw China go, "Hey, we're going after" was Honeywell. I just, I hate saying that out loud. I don't know if I've ever said that publicly, but with this amount of separation, they can live with it. They, and used man, you know, the thermostat company, but they also make, you know, helicopters and dashboards and like they're a defense contractor, but they all had the Chinese come for them and it's a sucker punch at that time frame. There's no, actually true story, Sean, there was no defense for how China was breaking in back then. It didn't exist. We had no software to detect it really. You could just log in. You could just do things. There was no reasonable way to defend yourself in the cyber domain against the nation back then.

Just dawned on me just now.

Back then you're more tactical. Yeah. You know, well, that's why we went public. You know, we had Mike Rogers, a congressman from Michigan. We had a congressman from Maryland. They wanted to do, they wanted to make it so you could share when you've been compromised, like stop hiding the fact that we're all in this together. They wanted to have more of team ball, like team America. So we decided let's help the US government with like some information sharing that when you're hacked and you know it you can share that information and not get condemned by the government for doing it. You know, you kind of got a safe harbor. And so we recognized two things kind of, there's like eight reasons why we went public with this report. I'll give you three of them. First, Mandiant at the time were a bunch of ex-US soldiers and we were like screw China for doing this. You know what I mean? So I wasn't going to be able to stop going public. My team wrote this. I was just a face on it, but we knew it was China from 2004 onwards. So it took us nine years before we finally just said, "Hey man, let's just tell the world what the hell's going on here." Second, you could feel the government, the government knew about this, but they didn't know what to do about it. And at least, you know, the House Intelligence Committee was like, "Let's pass a law that allows people to share information so we can defend each other." And then the third thing was the CEOs were like, "What the hell?" You know, I would sit down with the CEOs of these companies. They're like, "We're doing a joint project with China. Why the hell are they hacking and stealing all this crap?" And you know, the companies knew, hey, it's on us to defend ourselves. But they also at some point in time, I remember thinking hopefully maybe if we just bring it up, the heads of state would actually come up with, hey, let's knock this crap off. You can hack us for espionage, but don't hack, you know, Disney because they're trying to open Disney China or don't hack, you know, whatever soft drink company or somebody else because they're trying to do some bottling in China. It was time to have dialogue. So we did go live in 2013 and do that. It just so happens that on the day that Obama was going to meet with Xi Jinping to talk about some cyber stuff in optimistic sounding Sunnylands, California in 2013, that was when Snowden leaked and that stole the show. So I've never, you know, I've always believed since 2004 when I first started responding as a private company to these intrusions that neither China nor the United States really wants a whole cyber conflict. You know what I mean? Neither nation really wants it. And that at least that's two nations that can come to the table and probably have a dialogue and come up with rules of engagement. I don't know if you can do that with Russia. Too much criminal element. I don't think you can do that with North Korea and I don't think you can do it with Iran. But China is the one place where I've seen them follow rules. We have to infer the rules, Sean, when we respond. But China follows rules and etiquette when they hack. Still, their operators are predictable.

It would be hard to say what they didn't. You know, that's the reality. I mean, and that's why General Alexander, you read the testimony from the director of the NSA, largest IP theft in history, Admiral Rogers after him, General Nakasone, all of them kind of allude to China's kind of taken a ton. Now, there was a dialogue after that report. Here's what's amazing. At Mandiant, what we were doing is we were kind of monitoring victim networks, meaning we saw traffic coming in and out with consent. And the whole defense industrial base was working together by then. They started a whole consortium where Raytheon and Lockheed and Boeing, they all work together to figure out what's kind of doing, how do we thwart this. So they do play team ball now and it's actually pretty organized. But I remember at the time going, we're seeing over 70 companies a month compromised by China right now just in our little network of watching what they do. After we went public with that report it went down to zero for a while. So I think they noticed we changed behavior or some say, well maybe just lost vision on them because when we wrote that report one of the things we didn't kind of say in the report is we provided that trace evidence, the fingerprints, we provided over 5,000 fingerprints of this is their infrastructure they're using to hack us. This is the malware they're using. So all the defense companies that make software to stop it, we could just stop them. So we kind of burned their infrastructure. We burned their methods, their TTPs or tools, tactics, and procedures were fried. So we fried it. So they had to go away anyway and recreate all that stuff. But again, going from anywhere from 10 to 70 companies hacked a month, just in what we could see, and I could tell we probably saw less than 1% of what they were doing. We'll never know. Did we see 80% or 2%, it was probably closer to two, down to zero for a few months, and then it starts creeping back up again.

Flag officer's email. I always hated that stuff, you know, because you get to see what contracts matter, what weapon systems matter. I'd never read those emails, you know. I didn't want to know, you know, but when you see a communication of a high-level official get stolen, I've always felt, oh man, like there's unvarnished truth in that period. Like no matter what we're trying to posture publicly, you really, you've got the backdoor story in China as to what we're thinking and how we're going to arbitrate. And I think I just, that was the first time I ever saw it was in the mid-'90s that China got flag officer's email, just instinctually went, man, that's bad. First off the good news, most flag officers didn't really use email back then, but what did you put in it? You thought it was private, you know, and I just felt I didn't like that. SIPRNet email? No, no, I've never seen a SIPRNet breach, you know, not that it's got to be physical separation. I've heard rumors of it. I've never been involved in one and I don't know, I personally don't think it's happened, but probably a physical security issue if there's a SIPRNet breach, someone got to a SIPRNet terminal, you know. Do they get blueprints to weapons? Yeah, the problem we've got as a nation is we're so damn open, you know, in academia everything that becomes classified somewhere was unclassified first for the most part. You know, how it's used and who's using it and where they're using it usually is classified, but we have this, you know, you look at University of Illinois or Urbana-Champaign, LSU, Penn State, all these great American universities, Harvard, MIT, I can name them all. Almost all of them, Berkeley, they're all doing work with the government. And you want to, like the easiest thing to compromise on offense as a university, period. So go do it and go look at the programs and you're probably, I mean, I'm giving the playbook, but the Chinese already knew the playbook. The students, I mean, we have a bunch of Chinese foreign nationals at the schools. That's a challenge. And you know, somebody once came to me, Sean, and they said, hey man, if you were working at a company in another country and Uncle Sam came to you and said, can you just take this for us, would you do it? I went, yeah, you know, I'll do that for Uncle Sam. I'll do that for US government. You know, so now I'm unemployable in any foreign company. That's what's happening here. You know, with all the, you know, we went with this global economy and we said, "Come work here and we'll take your best and brightest." The problem is where are their families and who are they truly loyal to? So I actually felt, man, you know, the compromises occurred because you can do it from 10,000 miles away and there's no risk to it. But I actually felt, and I remember for years working with the defense industrial base, we always thought to ourselves, if we lock down the cyber door, are we just going to have an HR problem? Are we going to be hiring the scientist that steals everything? And most people would rather have a cyber problem than personnel working at their company stealing their stuff, you know? So it's a tough man when you're heavily targeted like the DIB is, defense industrial base. It's a complex place to secure. Wow. Looks like in that time frame, IP theft by China was an estimated 300 billion and 1.2 million American jobs per year impacted. Yeah. I mean, there's no question like they won in solar power, right? Do you think they hacked the solar power companies? Probably. Probably every damn one of them. You know, everybody makes fun of, you know, the space shuttles all look the same. Well, how do they get it? You know, the least risky way to spy, cyber, and probably the most comprehensive because when you spy, you want comms, you want the communication, right? Did they ever, China ever confirm that they did it? No. When we went live, certain quotes you remember your whole life. I'll probably get this one wrong, but when we went live, you know, we went live because we did that report in conjunction with the New York Times, by the way, deciding that they were going to go live because they had their reporters compromised. They had a reporter named Mike Barbaro over in China and the Chinese were stealing his email. And you know, when we wrote that report, by the way, I remember it was like a movie in a way. I remember getting on the phone with David Sanger who wrote the article from New York Times. But all of our press were compromised. They were going after Washington Post. They were going after New York Times. They were going after USA Today. They were going after all the press because China wants to see what are you going to publish about us before you publish it. I don't know why, but they do that especially if you have a bureau in China. And I just remember getting on a call and on the other side it's like, "Hey, it's Barbaro, you know," and the New York Times wanted to verify PLA Unit 61398. So we gave him an address and I think Barbaro went and checked it out and went, "Oh man, it's like a whole bunch of noodle shops and then there's this NSA-looking thing with antennas everywhere right in the middle of them all and a bunch of dudes in uniform going in every day." We had it right because we used Google Earth, Sean. We saw the building get built. Isn't that insane? We just watched it grow, you know, on Google and we went, "Okay, that's where they're doing it from. We figured out you, me." We figured it out in a couple ways. Every once in a while, and you got to look every day to find it because a lot of evidence will pop up and disappear. We were finding resumes by Chinese students that were transferring schools or going for jobs. We had Mandarin-speaking folks who would translate these resumes. This was before you could just use Google Translator and just read everything in English. So we had to hire our own translators and we were translating resumes and we kept hearing about this PLA Unit 61398 and what people did there. And when you read the bullets, you know, you transferred from Chinese character set to English, it was basically like, you know, we hack for a living. We get our orders, we hack those companies. That was it. And we knew where they were. But the New York Times went public at the same time frame about their compromise and they were the first ones really, one of the first victims. Google was another first victim. Google's so big when they were hacked by China, they just told everybody and they actually withdrew doing business in China. They were just like, "Ah, this isn't worth it." You know, because China does hack to learn about the Chinese dissident here and what they're doing. So bottom line, you know, whenever there's ideological conflict, you're going to see cyber activity. And we have plenty of that right now.

Oh, yeah. Yeah. Speaking of China, people in Polymarket could say there is a 93% chance that China will not invade Taiwan by the end of 2026. Only 7% say that they will. What do you think?

Been talking about this for a while. I think the deadline's 2027, right?

And this is Kevin Mandia anecdotal, you know, dad from California thinking about it. Unofficial, I don't think they need to invade it. I think just population growth alone. You never know the will of a nation. Like Ukraine surprised me how hard they're fighting back. You know, I didn't go over to Ukraine. I didn't know the Ukrainian people. I didn't know their will to be independent. I didn't know if they had the leadership for it. And I think like many Americans when the invasion happened in what, February of '22, I remember thinking, well, that's going to take three days and look where we're at, right? I mean, this is unbelievable. But then I apply that, I don't know what Taiwan would do either, but it's different. It just feels like we never acknowledged it as a standalone nation, you know? I think no one really recognizes there's only 12 countries in the world that recognize it as its own nation. And so think about it culturally how tight it is, you know. And then I think population-wise, I've always just guessed, Sean, like look at Singapore, like I think it's 30 to 40% Chinese foreign nationals. Like how long's it survive? You just look at population growth. At what point is there just a majority? So I think China could just win. Everybody says the population in China is going down. I'd be fascinated if we looked globally. Is the population of the Chinese culture going down? I doubt it. So I just think that that's a...

Tough one. I don't know. I'm the wrong guy to ask. I just go on gut alone. They might be winning without having to fight.

And I mean, basically in a nutshell, it's a SCOP to convince the Taiwanese people that they still belong to China. Well, and then I just don't know — throughout history, have they been offensive and warlike? You know what I mean? I just think they probably win through if everybody says that their culture has a longer-term view of things. Okay. Well, the longer-term view is over time we'll just win Taiwan over ideologically.

Yeah. There's a reason they're way out of it. They don't need to go to — I think they're winning. So it's like if you're going like this up and to the right, why go to war? It's heading in the direction you want. That's just my gut though, and I haven't read enough on it and I should. But I even looked at, you know, I was very interested in our war or whatever we're calling it with Iran. You know, what would China's response be? And it just doesn't seem very aggressive. It's almost like, hey, whatever's happening has happened. They feel like they're not even in the scene. They've exited stage left for now. And I just feel like a country that's prepping for war might want to exert a little more muscle than that.

Yeah, maybe. Oh, good point. Well, and I do know the longer this goes on, the more pissed off everybody's going to get at us.

So there's evidence that shows it. But if you want to be a global power, I still feel like we're one of the only nations that can project force remotely. You know, I've heard we may not — depending on who you listen to — we may not be able to project on two fronts anymore. And I've always felt we were always built to at least do two wars at once. That may not be the case, but China's building for something, right? And you always think back to when we sent our whatever beautiful white ships around the world with Teddy Roosevelt or whenever you carry a big stick. And I wonder when China's going to do that, if they're already doing it. I think they're probably already doing it in parts of the world. But we'll see if they do it globally someday.

You know, I'm never a leaker. You know, I get it that the dialogue needed to happen, but I mean, I'm the wrong guy to ask. It is a weird sense that I've had my whole life. I got to probably — and maybe as I get older I'm less trustworthy — but I believed in the institution of the NSA and still do, and I've known the leaders there. Nobody is trying to do the wrong thing. I really don't believe it. And you know, there's tons of inspection there. I would almost argue we inspect so much we almost hamstring ourselves, you know. And so I'm in the pro — I don't know if I'm probably in a minority camp. I trust the NSA to do the right thing. I really do. And again, I've walked the halls there and I believe in the people and the mission. And I think you should never — there had — you would like to think there was another path he could have taken if that was his fight. And I still believed in — you know, they looked at the violations done. I can't remember the exact code that came out of the — you know, I think they called it the Patriot Act for a while. But you know, there was a huge investigation into what were the procedures and who were the people. And they even had people from — I mean, they had left liberals, they had right-wing, they had everybody, and it really came back a nothingburger, from the extent at least from my understanding of it, as to what we were really doing. So I don't know. To me, a spy is a spy. I still believe that you can whistleblow appropriately, but I could be wrong, Sean. I would be fascinated by your opinion. If I were sitting in that building, I'd never have done it. But you know, maybe I'm a weaker person. Maybe it takes — the dialogue is good to have all the time, right? The checks and balances. That's why we had the press and freedom of the press, you know, to keep the government in check. You know, I still think marketing companies probably know way more about us than the government ever could.

Yeah. But marketing companies won't break down your door and take your assets. You know what I mean? So we don't worry about them as much. Right. So I do believe in checks and balances, and the government's got to get called out whether appropriately or inappropriately. It's always a good check. Right. No matter what.

If unchecked over time, doesn't it automatically go there? I mean, that's just a theory I've always had, is that it is a good thing to have healthy debate no matter what spawned it, right? Whether it was — so even my opinion on Snowden, whether positive or negative, it's a great conversation to have all the time, you know? So that was kind of my take at the time. I just wish — what I don't know and what probably nobody in the general public knows is what were the downside problems that that created. I'm certain there were certain lives that became real complicated due to those leaks, you know.

Oh, yeah. When you expose a 61398 — 6138 — you know, even when I went live with that, I didn't know the five digits right away. You know, I remember being on like 60 Minutes, I'm like 6243, you know what I mean? It's like you worry about those damn things, and as I get older, I forget it. But yeah, when we did that story, David Sanger kind of — and Nicole Perlroth from the New York Times — it kind of coincided with the New York Times being compromised by the Chinese government. That's a little weird. And they decided to go live with it. And we decided, well, let's go with who did it and what they've been doing. That's the PLA Unit 61398 thing. And it was Sanger's idea, Nicole's idea. Let's just put this on the front page. And I remember like the day before — I don't know where — every once in a while I think I'm an expert when I don't know [__]. You know what I mean? So I'm literally on the phone with Sanger and I'm thinking I know his job better than him. He's like, 'This is going to be a big deal.' I'm like, 'No, it's not, Dave. You're wrong. Nobody gives a damn about hacking. I've been doing this for 20 years. No one's ever cared.' And they still don't. I go into work the next morning and I get in — I still remember my lights weren't even on in my office yet. And I go in, it's out, you know, in Alexandria, Virginia. It's about 7:20 in the morning and it's live. We're on, you know, it's like February 13th of 2013. We're the front page and I don't even remember what the headline said. And what's weird too — you're an entrepreneur, you know — it's like no matter how good yesterday was, the only thing that matters is tomorrow. I already been — I'm done. We're fine. We're on the front page. Who gives a [__]? We're off. Let's get our workday done. And all of a sudden, my cell phone rings and I answer it and it's my now ex-wife. And her exact words were, 'What the [__] did you do?' And I went — and immediately, because I'm a guy, I'm like, 'What left-field thing am I in trouble for now?' Like I didn't know why she was saying it. And I'm like, 'What are you talking about?' You know, I probably got defensive, like, 'What the hell are you talking about? I didn't do anything.' You know, she's like, 'Turn on your TV.' And I have a TV right in my office. I turn it on and I'm not even kidding. The very first scene I saw is the building. I recognize the building in the background. It's PLA 61398's headquarters. And it was like a dude in a taxi going, 'Drive away, drive away.' And I look at the bottom, it's like, you know, or Mandiant report and all that. I'm like, 'Oh crap, what did I do?' Like, I didn't even know. We didn't think about — people were like, 'This is a marketing drill.' Really? No, it wasn't. It was a bunch of former US soldiers saying, 'Screw this. It's Chinese New Year. Let's get the report out. Let's burn their infrastructure. Burn their operation. Give our government a tool so the government doesn't have to point the finger at China. We'll do it for them and let's just see what happens.' And we dialed that report back. We actually had the names of a few of the soldiers. Like, we knew who they were. And we pulled — I remember I edited those things out. I'm like, 'No, we're not going to put that in there.' Because I didn't know what would happen to these guys for getting caught. But anyway, I ended up that day doing about 13 interviews or something like that. And by the way, with no staff — like nobody's handing me power bars, nobody's coordinating. I think, you know, I just ran around trying to get out the truth of it. Because what's weird is if I didn't go out and do those, Sean, those interviews, someone would make crap up or say something. And we were in the ring. Like, you know, we were in the ring. We knew exactly what China was doing. So I just felt, let's be the voice of reason on this one and get it out there. Nobody had even heard of 61398 before.

FISA court stuff. No. What's happening?

You know what I would tell the viewer — just like in my view, at a time when I was in the US government and in law enforcement, I never ever saw, witnessed, or knew about unchecked surveillance, period. And I feel that's healthy skepticism for folks to have. I personally never saw it and never executed it. In fact, it was hard for me to get the ability to do it. You really did have to go talk to judges. You really had process. So FISA is foreign intelligence kind of taps, right? And to me, US law protects US citizens, and I think a lot of times we forget that, you know. And so, you know, bottom line, it's good for the viewer to know that I never ever witnessed or saw what I would consider unchecked government —

And there's still a FISA court that they're watching. Not just anybody from any foreigner — a foreign state actor that is already under investigation. And there's a FISA court and that's all classified stuff and you go and present to a special FISA judge and you get your ability to go do it. I had to get approval for consent monitoring. Like literally, people were like, 'You can monitor.' I'd be like, 'No, I actually can't. I got to ask, you know, my JAG if I can go do that.' So people could have asked us to come in to monitor and we wouldn't have been allowed to do it, you know. And in cyber at the time, some people did. You know, like if the government knows more about what the bad guys are doing on offense than anybody else, why not let the government help protect the defense industrial base, or why not let them protect the banks or protect a hospital? And we can't do that as a nation because of the separation between the two. So it just — I think I would rest assured, I've never seen of and I don't know of, and I'm in DC all the time, you know. No, there's nobody — it's not unchecked, you know. It's not — not for my —

Thank you. I'll just jump right in then for you. Imagine, Sean, you're sitting at work one day. I had about 4,000 employees. I was the CEO of a public company called FireEye. And I looked down on my schedule. I'd just done an all-hands with 4,000 employees where I told them — and it was fall of 2020. So it's during COVID and I'm doing weekly calls during COVID because you want to keep the wheels on the bus and we have 25-year-olds in Alexandria, Virginia living by themselves and their parents won't even see them because they're so afraid of the damn, you know, of COVID. So I'm doing weekly all-hands, guest speakers. I felt like I was doing a Kevin Mandia show every Wednesday. I'd do it twice just to keep people in the ring together and entertained almost because I had a lot of folks struggling during COVID to stay motivated and stay human. Late COVID, you know, so it's November of 2020. I do my all-hands where Blackstone did a $400 million investment in my company so I could split it, you know, so I could split my company and sell off the more mature portion of my portfolio and carve Mandiant out to be a standalone company. Blackstone gave me the air cover to do it. So I do the announcement to the whole company. I hang up the all-hands, you know, meaning Zoom call, and I look down on my calendar and it says that my chief information security officer wants to talk to me at one o'clock and it's a Friday. It's 12:57 and I'm not kidding. I'm about to go downstairs and grab a beer. You know, I'm like, man, this has been a long week. I just did a $400 million raise. I just wrote my presentation. It's pre-AI. I had to write all my own speeches, you know, no help. And I don't know, half the company's going to be like, wait, am I going to be in the part of the company he sells or in the part of the company he keeps? And we were still kind of figuring out which students go right and left. And it was complex and it was something that had to be done in a public market. I see this invite. I get on the phone at one and man, I should have known it was going to be bad news. You know what I mean? Chief information security officer really wants to talk to the CEO. I get on the call and one of the first — and I'm getting a briefing from one of our IT guys who ended up moving into the security operations center and he's telling me that somebody is logged into our network. And the very next thing they did after they logged in is they dumped all their user accounts and passphrases from a Microsoft tool called Active Directory. So in other words, that's like somebody broke into the hotel and the first thing they do when they broke into the Marriott is they didn't grab the room key that just opened up room 101. They grabbed the room key that opens up every room. They had the master key. You don't get the master key the first time you break into the hotel. You know what I mean? So luckily I'm a CEO that's responded to breaches his whole career because when I get that news, I literally go call a board meeting. This is the one. This is the one I'm worried about. And even my sister was like, 'Call a board meeting. What the hell are you doing?' And I'm like, 'I think this is Russia.' Like, they're accessing our network the way we do. That's perfect offense. Access the network that you're targeting the same way the employees access it using their accounts. And that's what whoever this was did. So 10 minutes into my briefing, my heart sank. I'm like, 'Well, I'm not getting that beer today.' And honestly, every day, Sean, I remember going — I got the board together a couple hours later and I think I gave him like the Sully speech landing a plane on the Hudson. I just said, 'Brace for impact, man. This is going to go from bad to worse. We're a cybersecurity company. Someone's in our network. They got all the keys. They've got all their accounts.'

No. At least — yeah, yeah, let me just — October 2019, Russian SVR hackers inject malicious code into the SolarWinds Orion update used by 300,000 customers. March 2020, the backdoor goes live. US Treasury, State, Homeland Security, and the Pentagon compromised for over a year before anyone noticed. December 8th, 2020, Mandiant discovers Mandiant itself has been hacked. Red team tools stolen. Goes public. Yep. With your company blog the same day against most legal and PR advice. Yeah, because well, we found out beforehand. We went live as soon as we could, but here's what held up us going live even faster is — so Friday I get the briefing Friday afternoon. Sunday I just already scheduled a board meeting for Sunday afternoon and luckily I did the job of computer forensics. How did people break in? It was always what happened, what to do about it. That was my job for every day of my career, you know, what happened, what to do about it. In every computer investigation and then sometimes who did it. And on this one, I just felt right away it was the SVR. Just my gut went, okay, this is a problem. On that Sunday, three days or two days after I knew we were probably compromised, I would get an update every day and it just got worse every day. I'm like, man, I hope they don't get to our secret server that has all our passphrases. Like an hour later, a guy would call, 'Hey, we just did forensics on the secret server. They've got it.' You know, I'd be like, 'Oh, I hope they don't grab some of our email.' Day one, I called our best email investigator and said, 'Hey, I'm pulling you off the job and you got to go look at our email that's stored at Microsoft.' He called me back exactly 47 minutes later with, 'We got a problem.' You know, so if we didn't know to look, Sean, we'd never have looked. But we knew to look, so we did. And we started noticing, why is our backup account backing up our email all the time? It's not backing up our email. They were using our backup account to log in and steal our emails, you know. And so I just went, 'Oh, this is going to get ugly.' Sunday night, I call a frontline responder for a pep talk. We're working around the clock. And I can tell you, day one, even as an incident response company, I didn't think my team was taking it serious enough. I'm like, 'Guys, this is the one. This is the one we're worried about.' By day three, everything was changing. The team went, 'Yeah, this is the one we got to worry about.' [__] You know, and so I call a frontline guy Sunday night. He's working around the clock. And I just happened to be talking to him and he goes, 'Yeah, they stole our red team tools. These are tools that we use to be surreptitious and break into our customers, you know, kind of simulate the offense, simulate the bad guys.' And the minute we lost them, I was like, 'Well, can we stop them? Can we stop our own red team tools?' And the answer was we couldn't. We made software to stop bad guys. The unfortunate reality is we had created all this offensive stuff that our defensive platform couldn't even stop. And I'm like, I can't go live with that. You know, we got to fix this. To the credit of Microsoft, to the credit of CrowdStrike, to the credit of Palo Alto Networks, we didn't have anywhere for me to go in the government. Really, I went to the NSA because it's a damn lonely world when you're compromised. Day one, by the way, I called the NSA and I told them, 'Hey, listen. We're burned. Don't email us. Don't talk to my guys. Don't email my guys. I have no idea how bad this is, but it's going to go from bad to worse.' And it did. And to their credit, they were a great ally. Second, we immediately started reversing our own red team tools to figure out how to detect them. And then I called the CEOs of these companies like, 'Hey, Nash, could you please have Palo Alto Networks help us out?' Before we ever went public, Sean, we were working inside the community and to the credit — these are companies that competed with us. They helped me. Thank God. Wow. You know, I was like, 'Hey, George at Crowd, can you please?' We were giving them the rule set to stop our cyber weapons just in case the Russians used them. They've never used them that we're aware of, but they sure as hell learned a lot from it. And boy was I scared. Like the whole time I was like, I'm going to be the reason the internet goes down. I'm going to be the reason, you know, all hell breaks loose. So I was in a race to go public no matter what. Catholic guilt, call it the right thing to do. I remember I got so much unsolicited advice during this intrusion from employees and the board that I remember two things distinctly. One, every time I was advising a CEO during their own intrusion, I would tell them this is your day job now. You got to get through the crisis. So I remember my own voice in my head of what I told other people. Now I had to live by my own advice. It was a little weird that almost was like, you know, bipolar. I was telling myself how to handle my own incident, period. You know, coaching myself the same words I told other people. But we were in a race to go live right away. And I was so worried the Russians would use what they took to their credit. And thankfully, they didn't. And I think I didn't think we were alone because the SVR always has multiple victims. It's not like they have one company at once. But I could feel when I went out to the community — it starts NSA to me. I go right to them. 'Hey man, we got something new and novel. We don't know what the hell we're dealing with. You want to defend the military first.' We do have — and then they go to Five Eyes with, 'We got something new and novel.' And it kind of percolates through and it does no good to go public right away because all you're going to do is scare the hell out of everybody and there's nothing they can do about it. So we did get Microsoft's help. Thank God they showed up in a big way. Turns out they were compromised by the same people. CrowdStrike showed up in a big way. Palo Alto Networks, Fortinet, all the cybersecurity companies kind of rallied, but it was all informal. And even today, Sean, if we knew a cyber attack was coming, there's no way for the nation to go shields up with coordination. The way you do it is you call the vendors personally and go, 'Hey, you know, we got something new and novel and we need help.' I had to protect America from the very tools we had, you know. So we did it. And I'll never forget, to my board's credit too, I went into a board meeting. This was December 8th when I went public. There was no legal obligation to go public about the breach. We didn't violate anything. We didn't lose any covered data by statute. And the lawyer is a great guy, incredible lawyer, and he gave the whole board a presentation on you have no legal obligation to go public. And I had like five pages of notes and I was ready to fight my board with, 'I'm going public anyway, god damn it, and here's why.' They rolled over in 10 seconds. It was the easiest board meeting I ever had was conveying the news to the public. And by the way, here's what happens when you're hacked and you know it and you tell the world. Market cap goes down by 20% for us. We get sued right away by shareholders and you're considered negligent. And I even had a phone call — and then you're calling all your customers and I've lived this with a lot of folks. I called one money center bank and the guy on the other end who I've known for 20 years is like, 'Man, how did you let this happen? How did you let your company get compromised?' And I remember saying internally, don't lose your [__]. And I just went, let this happen. And I lost my [__]. I didn't let it happen. Nobody lets it happen. We have a modern nation with incredibly smart people coming after America. We're going to lose. We can't throw a perfect game every day. I was so pissed off because let it happen. Every day we woke up — I spent every Friday, Sean — the downside to my job is every Friday I'd get a threatening email from a ransomware actor and they were real people and they'd say, 'We're going to hack you this weekend.' And the reason why is because we were preventing payouts. We'd respond to an intrusion, bottle it up so fast that companies didn't feel they needed to pay the ransom. So they would threaten us and they did break into us and we'd have to play this whack-a-mole game with them before they could do anything. We made our own security software. We could program it any way we wanted and we can't even stop the criminal element. That's how asymmetric this fight is. Wow. So I remember every weekend — anytime my lawyer called, my heart rate would go to 130 no matter what, you know what I mean? Yeah. You had the phone ring certain times you was like, oh [__]. I had it every weekend. And then when this — and then so during SolarWinds, I think part of that side of me came out. I didn't let this happen. Nobody lets this happen. We're getting sucker-punched here. We're giving Wayne Gretzky unlimited shots on goal. I mean, the puck's going to get in the net sooner or later for God's sakes, you know, and that's what we're doing. So I remember just — you've had those moments where you're like, don't lose your [__]. Don't lose your [__]. And then you lose it anyway. I had that one about every other day. You got it. That was one of those, you know, the don't do it, don't do it. And then I didn't let this happen. But SolarWinds for me was a — you learn under crisis whether you gain weight or lose weight. I lose weight. And it's weird because it's not like you're bleeding out in Afghanistan. That's what I kept telling the team. This is a cyber intrusion. We're still healthy, you know. But what I've learned is when your credibility gets attacked or your competence gets attacked, it is — I personally don't respond well to it, you know. Like every time I got a subpoena as a public company CEO, I didn't do anything wrong. But you read the first paragraph and I just get this energy like, f this. I didn't do this, you know. I got that during SolarWinds. A lot of energy to prove we're not incompetent. We're good people that got, you know, just lost that day to a foreign intelligence service that really kicked our ass.

In my experience, the Russians always had an etiquette where I've never really seen them take the top person's email. It's almost like they're like, 'Hey man, don't take the secretary's email. Just take all the people that report to them.' You know what I mean? True story. I've always felt that. It's always the emails, huh? Yeah, it is. Because everything's there. They took email and they took from us our red team tools. I think it was source code for some of the victims. It was emails for some of the victims. It was methodologies. A lot of it was how do we detect them, find them, and what do we know about them? You know, to their credit, they did a lot of keyword searches. You know, so we could see what they're looking for. That's a gold mine for us. I've never seen China do — well, that's not true. I have seen the Chinese recently do keyword searches and that's a gold mine for us because you know what they're interested in. Keyword search means they hack into the machine and they say find any document that has the word secret in it or, you know, Hegseth in it or whatever the hell it is. You know, they pick their words and they go. The Russians did that on us. So I could tell you exactly what they were after — our red team tools. I mean, they were absolutely after —

Yeah. So you know, there's — here's the reality. There was a whole idea once by a company that started and they since pivoted where they were like, we're going to make a bunch of fake stuff. So when the Chinese steal it all, they won't know what's real and what's fake. Well, here's the problem. Even companies don't know the last version of something. We have bad enough document control and email control on our own [__], let alone this fake them out or head fake or code names. And I did protective services when I was in the Air Force. I'd augment the Secret Service. I can tell you we did do code names then because the radios were probably not even encrypted. There were these big bricks we wore. And I remember the very first thing that ever happened and I don't know if it was for show just to scare the 27-year-old Air Force guy, but it was like Raven 1 to Raven 3. And the response was, 'I'm Raven One, you dipshit.' 'No, I'm Raven One.' And we argued about who was Raven One or something. You know what I mean? So, you know, you use code names, you got to change them all the time. And I don't think it's going to work. So there I don't know of any real obfuscation. You encrypt and you try to keep your communications out of plain view from the Chinese. So, but SolarWinds was something that — it was a supply chain hack on where SolarWinds was a company that we all use for kind of controlling our infrastructure and I feel bad for them in a way, you know. I mean, imagine this. I had to call them. We found an implant in their published code. That's no different than like Microsoft getting hacked and you get the next update of Microsoft and it's a backdoor for the SVR to steal all your email. Or you're on your phone and you download an app and like, well, thank God I updated my app and the update itself signed by SolarWinds had a backdoor in it that the Russians now had a menu of who do we want to hack today? Well, we have a choice of at the time 18,042 companies had downloaded the new version with the backdoor. So they had a menu of 18,042 companies and to the Russian SVR's credit, they didn't hit everybody. They could have literally shut us all down. Just delete everything. You know, if it was a destructive attack, well, there's a whole lot of data deleted right now and that's it. What they did was very precision-based real espionage. You know, they went in, took what they wanted.

Absolutely. Yeah. I remember I went to the Senate Intelligence Committee. I said this was a sniper shot, not a spray and pray. They went right at the 50-some. I'm aware of about 50 or so companies or US government agencies they went after.

They still don't fully exist. Yeah. There's no national-level breach disclosure law that I'm aware of that is useful or helpful in any way, shape, or form. The problem we had is the privacy laws — the privacy zealots got there first and said if you're hacked and you know it and you lose like your personal data, Sean, then we got to tell, you know, 48 state governments or whatever it is now — it's probably all 50. And so there were things to protect American citizens when you lost their email or their date of birth or their social security number or their bank account number or private bank account number. It's called covered data and that's great, but what covers the Chinese going in and just stealing all your IP? Nothing. There's no disclosure law required. And the problem with that is no company gets better from it. Like if company A is hacked today and the Chinese use all new and novel techniques to break in, no one's learning from it, you know. So if they can go to one place and say, listen, we've broken into — even if I hate to say it, I was even a proponent of if it's defense industrial base or critical infrastructure, hell, let the best in government show up and help because then we can go shields up, learn the tools, tactics, and procedures that were successful at company A and they should be the only victim to that breach, period. And then you just kind of create a better — you have to have a learning system as a nation. We haven't built a learning system where we learn from everyone's compromise and we all get bolstered from, you know, all the breaches we responded to. Like just — I could just pick any of them. Hell, it's every single brand you can name. But if you get compromised today, wouldn't you feel good about, well, at least nobody else has to go through this, you know what I mean? So I think if we get compromised, I would immediately say, here's the TTPs used against us. Here it's — and it better be a new novel attack. I don't want anything that pre-exists to work against us and we got to get it out there to make sure we're the only victim. We got to do that. It's no different than, you know, neighborhood watch. You see an [__] robbing a house, you better tell everybody in the neighborhood, you know, and they drive this car and they're doing this. We need that as a nation and we could do better there. We're in a neighborhood where people are getting robbed and no one's telling you they're driving a white van and there's their plate numbers and three dudes in the van. We need it.

Yes. The challenge is that every time you go public, no matter what, there's never really a safe harbor for you. So unfortunately, and I can never guess, when you're hacked and you know it and you tell the government, I've never been sure what the government's response would be and I can never tell the public's response. Example would be like when Target was breached, you know, they lost credit card numbers and they overcommunicated and they had great people, great talent, but people lost their job over that breach, which happened in really 200 — the end of 2013, beginning of 2014. Almost the exact same breach happens at Home Depot and nothing happened. Public wasn't in an uproar or anything, but there's something about this Target breach that it just got a lot of attention. It was during Christmas time, it's holidays, it was the front damn page every day. And then Home Depot, same thing happens, someone hacks, steals credit data and does stuff and Home Depot will say, well, we handled it better. There wasn't that big a difference in the handling of it. It's just the public responded different, you know. And maybe there's a few minor tweaks here and there between those responses. But I never know. And so a lot of times companies get hacked and they do disclose and then they still have to show up and testify in front of the government and you'll have a senator from, you know, Oregon say, 'Well, how come you don't have firewalls?' And you'd be like, 'Dude, firewalls don't do a damn thing.' Like, are you kidding? That's not even a padlock in cyberspace, you know. It's — you just get held to account no matter what.

Well, I can tell you I found out and you know, with a lot of these you never know how much is still under litigation or not. But the upside for me is you always get to see the leadership and you

Get to learn from them. So for me, Sean, kind of like you doing the show, I get to show up and talk to the CEO and I just feel like Colonial had great leadership, you know, just like unflappable calm. Yep. Here's what we got to do. Uh, but whenever there's a cyber attack, like when somebody ransoms you, they break in and they encrypt your hard drive, it's not like you know what's going on. Machines start to just go dark. They just shut down. And some of them shut down after 30 minutes, some 3 minutes, some 50 minutes. And if you imagine being in a control room and all of a sudden, hey, my machine doesn't work. Hey, my machine's not working. Hey, I'm going down.

You have no idea what the hell's going on. And you don't know if there's a physical threat. You don't know if someone cut an electric wire. You like non-cyber people have different responses. And I feel like whether it's Sony Pictures had to deal with something like this. Um, so many companies have, you know, different defense firms had to deal with it and uh then Colonial Pipeline. The way that one came to me is um I think we were responding on a Friday and somehow someway my young frontline responders didn't see this as a national security issue. So, I never got the update. My phone rings from somebody who works in the government and literally they open up. It's 8:00 in the morning. I'm just waking up to go to the gym. Um, which means that's a late morning. And I get a call from someone I know in the government. They're like, "Hey, are you responding to Colonial Pipeline?" And I don't want to act like I don't know. So, I have to say, "Well, let me check. You know, I'll get back to you." And uh actually, it was weirder than that. I think he called and said, "Is it true the Iranians hacked the pipeline?" or something like that. And I'm like, "What are you talking about?" And then I was like, "Let me go check." I call my front and by the way, I'm thinking Colonial Pipeline. They make faucets or something. You know what I mean? So, I don't even know who the hell they are. So, I get on the phone with my guys. Sure enough, we're responding. And then I hear what they do and I'm lecturing my frontline nerd because these guys are so into cyber security. They're like, "All right, you've been breached. What happened? What to do about it?" They never thought to escalate. Hey, man. 40 something percent of the US fuel on the East Coast is going to be not transmitted. I got a call from the government on that first. And that does happen for me every once in a while. I've had that happen maybe at least three times in my life. I learned we're responding to a breach because someone from the White House called me, you know. Uh but on this one, I got a call from somebody at an agency and then I looked in and it was definitely not Iranians right out of the gates who knew who it was. And that's based on again, we're cataloging forensic evidence at every breach we respond to. So we can go into like a Colonial Pipeline, look at the evidence, and plus they said who they were. Makes a lot easier. And they wanted to get paid. So you know who you're paying. You can um pull the evidence out and just match it and marry it up. So, we're pretty confident with who they were. But on that one, it's just an example of many of them where uh first there's always a fog of war. You have no idea what's happening. Um if you're a hospital and stuff starts going down, a lot of hospitals will be like physically secure the hospital. Like you call security and say guard all the exits because you don't know if there's someone on the inside doing it. You know, it's a weird uncontrollable moment, but I've seen incredible leadership and I did attend a lot of the calls of Colonial where you do your daily briefs and they were just they did they show that you plan ahead like do the plan that you wrote when you weren't under duress and that's exactly what they execute. That's the best way to say it. They had already kind of said, "Hey, if something like this happens, here's what we're going to do." And they just pulled out that playbook and did it. And it works because it keeps everybody calm because there is nothing. It is a weird thing when you're hacked and you know it. You know, I've lived it where I'm like, man, I wonder if they're stealing my email right now. You know what the hell's in that? Nobody knows what's in their email. So, uh, Colonial Pipeline again though, just all of these, whether it's Colonial Pipeline, hospital, cell company, every one of them, it's a full sprint the whole time, no matter what. Like you show up and our job is always physically impactful, Sean. Like when we show up, we have to figure out what happened, what to do about it. We're not really sleeping. Like you show up and you're just triaging and working around the clock. Um and uh it's it's uh Colonial was no different. Like some of these intrusions, we we did United Healthcare. I mean, can do you remember what happened to them? I think it was last year. Yeah.

Somebody hacked United Healthcare and ransomed them and people couldn't get their drugs at pharmacies. People literally worked themselves into hospital visits. I'm not making that up. Where people literally worked around the clock till like one guy didn't show up at a meeting. They had to go find him and he was like passed out on the ground. They had to hospitalize him. You know what I mean? So these things are uh absolute races. Um Colonial the upside they had is, you know, they're not they don't have a competitor. You know what I mean? You just got to get it right. They didn't and and I think what they had is the constant like it's everything like when you it's a political issue. You got to get oil and gas. So I think they probably you know I'm not aware of it but my gut is they felt an incredible immense pressure to get back up and running. You know and most companies do. Healthcare did. Yeah. Way harder than people think.

You know, I you never to me, yeah, you never opine whether people should pay or not. Obviously, here's what I will tell you. I've never met a CEO who wanted to pay. Not like it was never the default answer, but you certainly see the logic in paying that one, right? I do. Four million. Yeah, I would have paid. I I've gone through the hypothetical of what would I have paid to keep my legal counsel's email from getting posted. Now I'm advertising to the bad guys, but I would pay to not read the the amount of lawsuits you get as a public company CEO if your general counsel's emails online. It's amazing. I mean, reporters read it. They write articles on this stuff, you know. It's uh it's um it's a tough situation.

Uh well do some reading on uh yes as you answered modern nations do and uh you know both of all our cell companies have a there are certain industries that you need to withstand military grade attacks or modern nations attacking them or cell companies or phone companies are definitely one of them. They are fair game for espionage every day. Uh last year there was widely publicized breach in AT&T Verizon. It was in 2024 and 25 and the advice from the FBI was and this is pretty telling. Hey, use Signal. Are you [__] me? No. Meaning texts are in the clear and texts can be found and um and cell companies are fair game and and in reality they are so valuable to espionage most likely that uh if you're on offense against us you're trying to place people there you're trying to hack them you're trying to do anything you can to make sure you maintain access uh to the data from those companies.