And now, please give a warm welcome to founder of Mandiant, co-founder, and general partner of Holistic Ventures, Kevin Mandia, and Pulitzer Prize-winning cybersecurity journalist and author Nicole Perlroth.
Good morning. Today I'm here with Nicole Perlroth, who has about 28 minutes of things to say to you, and so I'm going to jump right in. I hope that you've all listened to her podcast, but I'm hoping she can break it down because in the eight episodes of her "To Catch a Thief" podcast, I felt like I was, or my people were, the folks that were on the front lines of many of the cases that Nicole talked about. But at the same time, she had a depth as to why the breaches were happening that we simply didn't have as folks that were showing up to do the forensics to figure out what happened and what to do about it. So, Nicole, question one, because the voice of God did such a great job doing our intro, I didn't even share a background. And question one is this: Why are the Chinese hacking us?
So, first, I just want to say this is the second time Kevin and I have done a similar fireside chat where we both come assuming we're interviewing the other person. So I will have lots of questions for Kevin as well, but I got to go first.
So, you know, it was very interesting. So, you know, I covered cybersecurity at the New York Times for over a decade, and the Chinese threat was the one that I felt like I lived and breathed. And it started really with Aurora in many ways, but I always say my Harvard Business School education in cybersecurity was when we were hacked at the New York Times by APT1, which Kevin later let us tell the story in the pages of the New York Times. But why were they hacking us? I mean, in those days, it was very much about intellectual property theft. And the reason, in part, I went back to do this podcast is I don't think we ever really told that story very well, and I don't think we did a good job of sort of telling the long tail of that story. But, you know, essentially this was a shortcut. You know, why not shortcut this entire system, steal our IP, copycat it, subsidize it, roll it into global markets, and basically dominate. You know, first it was Huawei, but the Huawei model was so successful that they started replicating it across every industry. And I just felt like we never really told the human story behind that IP theft.
But the other reason I went back to do the podcast is because of this pivot into critical infrastructure. And since I left the New York Times in 2021, every week I would open the New York Times and hope someone would do a deep dive on the pre-positioning that we were seeing. And I never really saw that story. And I really didn't think anyone gave a great explanation as to why they were doing the pre-positioning they were doing. And so I went back, and what I think, but I want to hear Kevin's take on this as well, is that there are various theories. One of which is mutually assured digital destruction, that maybe we're all just in each other's critical infrastructure now, daring someone else to pull the trigger. I think maybe that's true. I think some of it is Taiwan. You know, if China were to make a move on Taiwan, what better way to diminish our appetite here in the United States to come to Taiwan's support than potentially just holding the threat over our infrastructure, flickering off the lights here or there, shutting down water, etc., etc. We talk a little bit about the everything, everywhere, all at once cyber attack, and we're certainly seeing that the targeting is across all of these different aspects of critical infrastructure, from telecom all the way to aviation and high-speed rail and water and utilities. But I think really in going back and studying this, it's more about the psychological lever that they could pull. You know, what I always say is, we couldn't live without TikTok here in the United States for more than a day. What appetite are we going to have to go support an island 7,000 miles away if we can't get access to clean water and power? I think that's what they're banking on. I don't know. I'd be very interested to hear your own take on this.
So the final motivator for you to do "To Catch a Thief" was the fact that there's, you know, Volt Typhoon, Salt Typhoon, and all the typhoons starting to hit what we would call civilian infrastructure. But take me back to the IP stuff. Like, what I learned from your podcast that I didn't study in computer science and I did not learn responding to breaches. What's the history that contributed to China doing this? Like, what happened in the 60s, the 70s, the 80s? Because what surprised me the most was I felt culturally this was from the top down since Xi Jinping was elected in, what was it, 2012. It was a top-down directive: 'Hey, steal stuff,' you know. So, can you give us a little bit of background that you learned from Jim Lewis and the others?
Yeah, I mean, the fast-forward history is, you know, Mao basically depleted a lot of the engineering and scientific research that China had done. And by the time that period was over, China was so far behind Western nations and also its neighbors and Japan, etc., that they decided that they needed to basically make catching up a priority. And they decided to do this pretty systematically through joint ventures, right? They said, you can come into China as long as you only maintain 49% ownership and we take 51% ownership, we're happy to go into this joint venture. But what we started seeing, and this was a really hard story to tell even now, even this many years later, because no one wants to talk, because in many cases a lot of organizations still have business in China. But back then, they would enter into these joint ventures. And I actually, for the podcast, interviewed a guy named John Bedbrook, who was in charge of basically biotech at DuPont Pioneer in those days, and they wanted to bring hybrid rice to China. So they went over to China. They entered into this joint venture. This is all before sort of the commercialization of the internet. And they bring all their seedlings with them. They bring all of their R&D from soy and corn, and they go over and they train up an entire generation, really, of scientists in how to go about pursuing these clinical trials for hybrid rice. And every time they needed to get a new experiment approved, they would have to go get a permit. And the government would approve the permit. And they invested maybe something like $30 million in this project. But really what they were bringing over was sort of billions of dollars worth of their R&D. And everything's going swimmingly until the day the permits stop getting approved and all of these Chinese engineers and scientists that they've trained up leave, and then they open up a space across the street, literally, and they basically take everything that they had gotten from DuPont Pioneer and they just start copying it and rolling it out into markets. And when John was telling me this story, you know, the natural human inclination is to say, 'Well, why didn't you go fight back? You know, why don't you sue them? Why didn't you do all these things?' And I thought that was actually the most interesting part of this whole story, which was, well, hybrid rice was one of the smaller projects that DuPont had going on at that point. We didn't really want to rock the boat too much. So the word from on high was just say nothing, you know, we'll swallow the loss. But every business that had entered into this joint venture was basically experiencing the same story. And then came the internet. And then they could basically just hack the IP almost for free. You know, it didn't cost much to do this. And they were incredibly brazen about it. You know, usually they were doing it through spear phishing. And as you said when I interviewed you for the podcast, you called them almost like the most polite hackers in cyberspace because they basically would announce themselves when they were there. So what I thought was very interesting was to go back and sort of tell that earlier story about the joint ventures. And the reason they were doing this is just because they had to catch up. And either their choices were spend decades and millions, potentially billions of dollars on R&D, or you just go steal it. And they chose the latter. And then with the internet, it just started picking up at a frequency that I thought Americans really, really had no conception of. And that's why I went back to tell that story.
Well, and in the podcast that all of you have listened to, there was a story by somebody that also said they put cameras in their offices in China, and every time they would leave for the day, they would see folks come in and dig through everything, right? Copy everything down and then leave. So that's fascinating to me. That's like the non-cyber aspect of the story that I never got to witness or understand because every time I responded to a breach, I mean, I think every day of my career since 1995, myself or someone I've worked with has been responding to a breach out of China, but we never really asked why. We just responded to them. So, anyway, it's been a good 30-year run.
What was the breach? You know, we'll start questions now. What was the breach that you thought, okay, you know, we're in a whole different world now? They just took the crown jewels of X. You know, what was the one that you thought, oh dear, we're in trouble?
So I started responding to breaches in 1995. So there's quite a few of those because I think we lived through numerous shift changes. I still remember the first breach that I saw. From '93 to '98 for me, it was Unix on Unix. So I still remember the first time I saw like an APT breach against a Windows NT machine and me thinking, oh, this is going to be interesting. I didn't even know how to see what processors were running on a Windows machine other than Task Manager, and it was real easy to not show up there. You couldn't figure out what was listening on ports on Windows in 1998 very easily. So I remember that shift change. I'm giving you the evasive answer because I think back to it. There were numerous times in my career where I went, 'Whoa, this has changed.' I remember the first time I saw the loss of email, and I remember going, 'Okay, that's going to be a problem.' You know, somebody's taken email from somebody else. That seemed real to me. First destructive attack was another shift change. I can say in 2004, when I started Mandiant, there's a shift change that surprised me a little bit. I'd responded from 1996-ish onwards for the military, but in 2004 I started Mandiant, and very shortly after we started, I remember responding to a breach in the private sector. I'm like, these are the guys I saw when I was in the military, and they were coming out of China. That was another one where I was like, uh-oh, they're starting to hit the defense industrial base in '04. So the landscape has shifted. In '98, in 2003, when China started hitting the commercial sector with what I would consider military-grade offense. 2014-15, we start to see destructive attacks and no risk or repercussions to doing them. You get a shift change with digital currency and the ability to extort people anonymously, you know, starts around 2017. You get client-side attacks in 2003. Skip that one. So now, if you're following me chronologically, I just leaped backwards. But hacking humans was new in '93 to '98. If you're hacking, you just scan for open ports and services running and find an exploit against those services. Right around 2000, 2001, maybe it might have been a little earlier, you start the spear phishing stuff, the client-side attacks that will never go away for the rest of our lives. And then I think you get things like even a shift change with Scattered Spider, where, you know, EDR gets potent enough and our anti-malware defenses get good enough, and we're trying to do good patch management. Now we have people hacking our help desks and helping the people that are, you know, hacking the people that we want to have help people. And so that's annoying. And then obviously what you really wanted me to say is, and then wait a minute, China's hacking civilian infrastructure, but for no reason. You know, I can tell you a bigger one for me might have been in 2015 catching Russia hacking, meaning Russian, what I would consider the Russian government hacking universities that were anti-Putin. Because prior to that, every time I saw Russian government intrusions, it really was about security. And then all of a sudden, it was about something else. To me, that was a big inside baseball change, or nobody else cared. And I'm like, 'Oh my god, the Russians have changed their tactics.' But to me, I don't think I'm as surprised, Nicole, as you might be that the Chinese are hitting civilian infrastructure. I don't know why. I just, I'm not surprised by it.
One thing that's just interesting sitting on stage with Kevin is, in all of these breaches, I would show up and people would have their bug spray ready, just praying I would leave them alone. Kevin would show up and they'd be like, open arms, like, 'Get in here.'
And if Nicole's number would show up on my phone, I'd be like hitting the button as fast as I could to not answer.
What was the breach that you can talk about, maybe you can't say the name, where you walked into the building and you looked at the people and you looked at how the people were doing and it was as bad as it gets in terms of the human toll, you know?
Okay, there's a lot of ways to answer this question. Sometimes it's on the victim. What I've noticed, and I don't know if it would be a negative or not, some breaches you respond to day one, you recognize there's not going to be a lot of sleep for the next few days, and you start seeing teams get pretty haggard as they respond. You see the pizza boxes literally piling up in the war rooms. There's been a couple where I've looked around at the security operators that were all good at what they did, yet they got sucker punched in cyber, and I could tell they were all going to leave their jobs afterwards. You know, that was the best way to say it. I remember going, man, they don't deserve what the press is saying, or their leadership doesn't deserve it. And we're fighting a good fight. I always use the same analogy. I don't know how to update it, but I mean, we are playing defense and nothing else in cyber right now, and we're up against Wayne Gretzky penalty shots. I mean, sooner or later, no matter how good you are, you have that day where you're like, whoa, we lost. You know, attacker has a foothold, and we have a contested environment now. I mean, I think great security companies have contested environments, and great companies with great security programs do. And it sometimes has, and I never can guess the public reaction to a breach. You know, one of the first questions we get when we respond sometimes, a CEO will say, 'Hey, Mandiant, you know, when we go public about this, what's the response going to be?' I just go, you know, I don't know. And that response does have negative impact. So, I know that's not the answer you're looking for. There are some specifics where the impact of the breach was palpable walking the halls. You could see it on the faces of the people. And your heart goes out to them. You feel a pit in your stomach the same way they do as they go through it. And then, by the way, I had my own breach. That didn't feel great, you know. So I forgot about that one. That was, you know, but for what I went through in reality, I've seen customers go through harder situations than what I went through in 2020 with the SolarWinds inspector. So, not the answer you're looking for, specifics, but I just, I can tell you this. If you're with somebody that, you know, you hate to see somebody get personally, like their email gets leaked to the public or something like that. You just see them and you just realize that's just, that's a tough thing for them to go through.
