all right and you are live
i'm going to drop and the floor is your
circle
so i'm utterly delighted to join you all
and share with you a
concept that we call useful fiction or
sometimes called
fictional intelligence basically what it
is is a
blend of non-fiction research and
analysis
with narrative with storytelling and in
particular
this is a project that we did with the
cyber solarium commission
uh that many of you are probably
familiar with this is the uh bipartisan
commission that was tasked to
think through both the future of cyber
threats but also u.s government cyber
security strategy how do we handle it
and we were asked to help
generate out a vision of
the key themes from their report but
packaged through scenario
and it actually was the introduction to
the report itself so think of it
as a vignette but also it can do an
executive summary
and um it goes as follows
a warning from tomorrow by peter singer
and august cole
you spend your whole career on capitol
hill hoping for an
office with a window then when you
finally get it
all you want to do is look away they set
up our emergency off site for essential
senate staff and vacant offices once
belonging to one of the contractors that
lobbied us
before they all went badly up last year
the offices are in a high rise in roslyn
with a literal million dollar view
looking across the potomac river
you can see past the national mall and
the monuments
all the way into downtown dc
and it just breaks your heart the
rainbow of colors in the window paints
how everything went
so wrong so fast the water in the
potomac
still has that red tent from when the
treatment plants upstream were hacked
their automated systems tricked into
flushing out the wrong mix of chemicals
by comparison the water in the lincoln
memorial reflecting pool
has a purple glint to it they've pumped
out the flood
waters that covered washington's
low-lying areas after the region's
reservoirs were hit
in a cascade of sensor hacks but the
surge left behind an
oily sludge that will linger for who
knows how long
that's what you get from deciding in the
18th century to put your capital city in
low-lying swampland
and then in the 21st century wiring up
all its infrastructure to an
insecure network all around the mall you
can see the black smudges of the
delivery drones and the air taxis that
were remotely hijacked to crash into the
crowds of innocents like fiery meteors
and in the opening spaces and parks
beyond tiny dots of bright colors smear
together like some tragic pointless
painting
these are the camping tents and
makeshift shelters of the refugees
who fled the toxic railroad accident
caused by the control system failure in
baltimore
fema says it's safe to go back now that
the chemical cloud is dissipated
but with all the churn and disinfo on
social media
no one knows who or what to trust last
night
the orange of their campfires was like a
vigil of the obstinate
waiting for everything to just return to
the way it was
but it won't a knock on the door
shakes me out of it it's a legislative
director checking back in
she's anxious because the boss promised
that we get a draft of the bill out
tonight to all the other committees that
touch on cyber security
no cars are online and nobody wants to
risk the metro after what happened on
the blue line
that will mean hours of walking from
office to office
at least the irony of backpacking around
paper printouts of new cyber security
cyber security laws will be lost on no
one
i tell her that i'll get it done and
turn back to wordsmithing the preamble
i mostly mine the language from old
legislation that someone just like me
wrote after the 9 11 attacks
i know some online troll or talking head
on the news will end up calling it lazy
but it's the closest anyone can think of
as a parallel
of course with all the servers down our
poor
intern had to run a paper copy from the
library of congress
it reads as follows whereas
for as long as the united states has
been a nation that invented and then
became dependent on the internet
it has faced online threats and whereas
these threats grew in scale and
frequency we grew too accustomed to
digital interference in our society
economy and even elections and whereas
ai and automation change these networks
from use
not just for communications but to
connect and
operate the things that run our physical
world
and whereas a new type of vulnerability
thus emerged
where software could be not just a means
of theft
but a weapon of mess disruption and even
physical destruction
and whereas our government and industry
failed to keep pace with this change of
technology and threat
being ill-organized and ill-prepared and
whereas these vulnerabilities have just
been exploited
in extraordinary acts of treacherous
violence that caused
massive loss of life and effectively
held the nation hostage
and whereas such acts continue to pose a
threat to the national security and very
way of life of the united states now
therefore be it resolved by the senate
and house of representatives of the
united states of america and congress
assembled
that the government of the united states
must
must what what can we really do
no matter what legislation we pass now
after everything that's happened
we're too late
in 2021 i mean critical infrastructure
is having all these challenges
and somebody still can't hop on without
being on mute um
so i was just joking not to start things
off on a somber note but
of course that was the the fictional
story that you put for the cyberspace
solarium commission as you noted um so
let's let's step back
right you you mentioned this concept of
fictional intelligence
which is using story storytelling
to help educate and bring around
understanding awareness and change
part of what we're trying to do here at
the village how did you first get into
that
so the background to it is in many ways
august cole and i stumbled upon it in a
project called
um ghost fleet and uh it was
a combination of a techno thriller novel
it looked at what a war between the us
and china and russia
might look like but um we were both
non-fiction guys uh you know i have
written non-fiction books on
on cyber security and more recent
weaponization of social media
teach classes on it at graduate school
level um
in turn august had been the defense beat
reporter for wall street journal
so when we were building this novel we
couldn't help ourselves
and actually conducted years of research
and
showed it in in the book um so it was a
novel
but with i think 27 pages of research
endnotes and the rule
in it as we built it was you couldn't
just dream it up you couldn't do like
you know
related to cyber security where someone
goes you know click and clap
we're in no you had to have the citation
of
here's the threat intelligence report
here's where this type of attack
actually happened out in the wild
often um the u.s conducted against
someone else
and then hey maybe someone might do it
back against us and
um the combination of the two of this
non-fiction and narrative fused together
really took off uh it obviously sold
really well
um but that package and it's sometimes
called thicken
or also you might think of it as useful
fiction is what we also call it
um it proved to be the most influential
work of our careers
i testified to congress i think four
times on it
um three different government
investigations were launched
to essentially fix things that we had
identified
inside our novel um gave briefings on
its real world lessons everywhere from
the white house situation room
to the nobel institute to cyber command
in nsa
um to the deck of an aircraft carrier
name it and so
it just struck us that uh this
combination had had great power
and it again it's it's the fusion
that matters um a techno thriller
science fiction you know i love them but
they're like a milkshake
they're entertaining um they're not
designed to be
good for you in turn um a
a powerpoint briefing a white paper
a trend report that's like handing
someone you know
uh a fistful of vitamins and say take it
um
and you know most people will be like i
don't want it or i'll ignore it
um useful fiction it's what i did to my
kids this morning
it's a breakfast smoothie so you're
sneaking the good stuff
into that package of a story
um so the the value cell of it
is um one they're more likely to read it
um two the science not to get wonky with
you but the science shows
that um they're more likely to it's more
likely to stick with them
uh when you read a white paper
when you you listen to a powerpoint
whatever two parts of your brain
light up when you get that same
information package and story
four parts of your brain light up and
then one of the other really
cool things about it is um good story
hits with emotion and as everyone from a
you know
sales person to a politician know
emotion is what drives the sale
and so that example that we did for um
the cyber salary permission it was
targeted not just to capture the key
themes you know what critical
infrastructure threats might look like
in the future
but it was also trying to connect to an
emotion of their target audience which
was
you don't want to experience this
simulated this synthetic experience as
character like you
a congressional staffer was their target
audience they
feel regret do you want to feel that too
oh read this report put this legislation
into action
you won't have that negative experience
so
those are some of the value propositions
of the idea and it's been awesome since
then
um you know we've done it with congress
we've done them for corporations um
we're doing a project right now
for um the british government and the
u.s marine corps
it the concept has really taken off it's
been a lot of fun
so how did you get tied into the
cyberspace solarium commission is that
something where they recognize the value
of this based on
what you and august had done previously
and said we want that to help
get more impact with when this report
comes out yeah they
they um actually approached uh on that
and
uh you know it was it was it was awesome
it was um it really
how to put it um the best kind of
projects are the ones
that are important and
intrinsically interesting which is a
nice way of saying fun
um and so you know the slam commission
obviously hugely
critical but also to try and pull back
and go okay
this is i mean i have to go what was it
it was a um i'm looking real quickly 182
page report
okay how do you take the goodness within
that 182 page report
boil down its key themes
some of its key recommendations or even
buried within that story
uh for example there's a little off in
reference to um
public private there's another often
reference to
too many committees touching on cyber
security and sort of the frustration
that staffer feels so basically
it's it's like a riddle how do we take
those themes and boil it down into a
story and so you know we pull it down in
this story of
a of a staffer you know trying to figure
out how to write legislation the day
after
the the equivalent of a massive
um level of a critical infrastructure
attack like we haven't yet experienced
but
people like you and i um you know who
work on the also the research i go look
these are real world threats whether
it's water systems hacks
you'll notice there's no part of it
that's the the lazy
um oh the power grid might go down i
mean that is a real threat but we go
beyond that because that's one of the
key
issues that we see looming is um it lays
out again you know it might be water
systems it might be transportation
networks it might be
when we say water systems there's
different types there is
the chemical levels there's the the um
reservoir systems that
that control the water level and rivers
um you know we can go
there's uh gps hacks against um aerial
systems
all of that's going to get a lot more
interesting when it comes to greater use
of
um drones and delivery or the like so it
was basically this
riddle of how do we capture that tell
that
story in a way that also links to
emotion
i'll give you another fun example of one
that we did um
that i was with a um a corporation
um we were trying to figure out um for
c-suite leaders uh how do you convey
you know the experience of um why they
ought to act uh
to protect networks you know as everyone
knows it's it's
not everyone is as people in the
industry know
um you know it's often not how are we
convinced to see so
the risk it's how do i convince the ceo
and the board and the chief financial
officer and it can't just be well the
network might get hacked that
they're aware of that and so we we
created a scenario which was their
nightmare scenario and it's um the day
it's a couple of days after a breach a
ransomware incident going back to
predicting the future and we've seen a
lot more of these recently
um but it's not you know the nightmare
scenario for the ceo is not oh
my company might get hacked um the story
is set um as a
ceo is sitting in row 27
of a commercial flight so they're in the
the worst of coach class
as they have to fly to washington to
testify to congress about
the breach so for them it's then you'll
remember the
the um executives a couple years back
who got caught you know in their private
jet so now they have to fly commercial
and so it's this experience of what is
my the
it's not network getting hacked it's how
will i personally have to deal with it
and i'm gonna have to fly coach
and my board's angry at me and i'm gonna
be yelled at by a bunch of members of
congress that i just have to sit and
take it
and so it's again setting up that this
is why you need to act
um not just oh the network might get
breached how do we connect it to a scene
and emotion that they care about
so i'm guessing that you you didn't have
a background
deep in industrial control systems prior
to a lot of this research
and i think that's kind of an
interesting thing because there's such a
depth of technology
um and when we talk about critical
infrastructure wow that sounds like a
simple two words put together
the fact that that's 16 different ssas
and the
various technologies it gets a lot more
complex so how do you approach the
research process to get
technically smart enough so as you said
you are well you're not
pedaling the vitamins that you're at
least staying true to
the nutritional formula yeah that's
that's a great question
and it it you know it's it's how to put
it um
to continue that uh there's a recipe
right you know so making a good smoothie
there's an actual recipe to it to get
the nutrients and the taste side
um so a lot of this was uh
drawn from the work that we did for a
more recent product called burn-in
uh which uh you and i actually got to
chat um
a a while back um burn in was
a it's a book um that's a package of
useful fiction
um it's a story that that follows a hunt
for a terrorist who's
going after uh iot um
about ten years out and
um so we get to see uh
what are the different ways that we're
going to be using iot and more broadly
as we weave in greater amounts of
automation and ai because
to me that there's a common it's not
just that we're moving to an internet of
things
it's it's an intelligent uh network
um but we are seeing all sorts of
vulnerabilities baked into it
and we it opens up new um both threat
actors and types of attack and that's
what burn in was capturing
um now uh the research for it
took about three years and it involved
everything from um you know pulling up
uh threat intelligence reports and and
actually
you know presentations that are you know
at places like a defcon
of folks showing off what they've been
able
to to to do uh showing some of the
vulnerabilities that are out there
in addition um interviews interviews
with experts from across you know
everything you know
so if you want to know about um water
systems vulnerabilities
there are extensive threat reports on it
but i also did interviews with both
um uh analyst at cyber security
companies
all the way up to um executives and one
of the interesting things
about that was and it hit when you were
talking about multiple different sectors
it's basically got into um talking about
why the cyber security industry was
drawn to market and provide more
services
to some parts of critical infrastructure
than others
there is to put it bluntly sort of a
market structure
that makes some types of markets more
profitable
than others um water is an area
where um if you look at the structure of
the industry
it's a lot of um mom and pop size
companies
they're not large regional companies
it's either mom and pop size
private companies for the most part and
or
a local county city or even
town water authority and the structure
of that means that
oh and on top of that the regulatory
agency for it
up until recently not interested in
cyber security its focus is on pollution
so there wasn't a lot of kind of
attention steering the way if you look
at for example
a parallel like um you know set aside
banking where all the incentives are
aligned to cyber security
um in terms of you know there's the the
monetary value is very clear
um power industry you know there you've
got everything from there's been more
attention paid to it to
larger companies that have larger
budgets and the like
and so you get that from interviewing
the cyber security companies why are
they not spending much on it why are you
not marketing as much to them
to the other side of it um i interviewed
water systems engineers
the people that literally designed the
water networks for major cities
like washington dc which is where um the
story is set
so you know and you get when you talk to
people and
you know you'll have a lot of this and
and um you know networking and
conferences like you get you know sort
of the formal answer and then you get
the stories that people tell over drinks
right
you'll never believe what we did or
you'll never believe what we saw
and so that's where you know we get the
the goodness that's where we get the
real world ideas is from
either real world experts or real
world reports um a different way of
putting it is we we call it the no
vaporware rule there there can't be
anything that's sort of just
drawn out of vaporware either you know a
technology that doesn't exist or
something that's purely imagination
safe you know again i love my sci-fi
um but if it's so far out in the future
so vaporware it's not as useful
and that's also i think the frustration
a lot of people in the cyber security
field have towards um depictions and pop
culture
is you know like i said it's either you
know it um
it's like clicking clock i'm in you know
or
it's um the people in it are not
realistic right you know i mean
i i like mr robot but you know
everybody in the field is not like that
uh yeah so uh where you were talking
about where it comes to money this is
something that we've talked about a lot
here
is that um in a regulated industry
of which a lot of critical
infrastructure has different forms of
regulation which
when we're talking about regulation it
doesn't just mean security it also means
that rate basis
i can charge more for electricity than i
can for water
my ability to spend that money back in
increasing a you know pushing a rate
cost to customers
has to go through a public utilities
commission for approval
and so that restricts drives a lot of
those kinds of changes
to what can be done uh and with of
course
2021 was like the year of industrial
control system hacks
um you don't have to predict the future
when the future keeps happening every
other week
we started with you know with solar
winds which had a
large impact we had the florida water
hack around the the super bowl
um the irony of that one is that exact
same hack is what we've been
demonstrating here physically in the ics
village
for several years and there's the and
thank you very much is one of the key
scenarios we don't want to plot spoil
burn in but was one of the key scenarios
in it
and again you had the florida one but
the florida one
um you had earlier the attempted
one on the israeli water networks and so
you know when people like
how did you predict this how did you
depict this like the information is
out there um it's more about putting it
together
uh it's you know connecting the dots and
then you have you know what we were
talking about earlier
which is that so much um
particularly in the cyber security field
is
not how do i explain
this new thing it's how do i
explain it in a way that my target
audience
will take it in will understand it
how do i get and hold their attention
how do i put it in manners that they're
more likely to act upon so it's it's
it's the communication piece of it
that's often more of the challenge i
mean it's
very rare to think of um
any you know major cyber security
incident that we had not had a series of
them beforehand that were smaller
or they were demoed at a conference or
whatever
the information was out there we just
weren't weren't willing or able to act
on and that might be true for a nation
definitely the case for corporations
right
so if you could give us any insights or
share um
what's kind of the next project or um
anything around that you're allowed to
talk about
yeah so um august and i august cole and
i turned it into a business
uh we were having so much fun
doing these you know kind of one-off
stories
um and we realized that the demand
was there you know so if there's one
group that's like we've got this
strategy report but we can't get people
to
read the key ideas of it um they're not
the only
group in the world that has that
challenge um we also
have been doing uh training courses with
um different groups on how do you do
forecasting
how do you do communication and that
came out of the air force approach
justin said
it was the air force blue horizons their
futures team
they um they said you know don't don't
create the scenarios and and we just
want to
we you all have predicted well teach us
how and so we put today a two day course
for them and so basically you know
um essentially what happened is we
looked around and said
hold it clearly this group is not the
only one that has strategy reports that
people won't read or trend reports that
they need to
hold attention or the air force is
clearly not the only group in the world
that's wrestling with how do we do
forecasting well
and so after we had a couple of these
one-offs we're like let's turn it into a
business and um we've been doing more
and more of them
we've done with everyone from um as i
mentioned private corporations to
to nato we're in the middle of um one
right now
with uh the marine corps and a different
one the british government
and they've been you know going back to
what we're talking about before uh
they've been fun um they hopefully have
a great deal of impact actually we know
they have a great deal of impact we've
got
the numbers to prove it but um more
important they're just
it's been it's been intrinsically
interesting uh it's also been fun for me
to sort of learn how to be a small
businessman
on the side uh so that that's been an
interesting experience
so with all of the stories that you've
written what's the one thing that still
keeps you up at night
um
uh oh my kids um but no i
the bio side um you know we fear
what we don't understand
and i'm able to you know kind of wrap my
head around
um you know
the iot infrastructure
um the
the bio side as we've put it um
we've lived when i say bio i mean bio
threats um
engineered diseases you know it's been
the last year and a half has been bad
enough
um and we've and it's been bad enough
because we've seen
the um kind of deliberate uh
spread of disinformation around it um
of you know everything from you know
what can you do in masking the vaccines
to um the willful
kind of ignorance of it so i i how to
put it
i guess i'm not expressing this well the
bio terrorism side keeps me up at night
even both because i'm i'm i don't
well understand the biologic side as
much as i do the physics
etc but the second is the experience
that we've had and the pandemic
um makes me you know kind of more
worried about
it because you know it goes to like the
reason why none of the zombie movies
would work anymore because you know
essentially
you'd have a bunch of people walking up
to the zombies saying i don't think
you're real
or what or like you know i'm not gonna
run away from the zombie
it's my choice you know whatever like
that's what we
we're living right now with corona and
so this is a disease
that is awful it has been has not been
the type that might be engineered when
you think about you know
what might be in the hands of a bio
terrorist five ten years out
particularly
as it moves into um the dna to the
genomic side of things so
that's what spooks me um uh
yeah um i hope i you know
hope hopefully that part stays in the
realm of fiction
let's hope it stays in the realm of
fiction and clearly george romero's
career would have gone a different way
in the alternate universe you just
described yeah
the internet really um ruined you know
whether it was the the you know the day
of the dead or dawn of the dead i mean
you know i i love those movies but
um i just don't think the the plot would
survive the world of
um facebook and twitter and instagram
you know think how it would warp
everything in those stories
um uh any final words
uh as we kick off defcon 29 here with
the ics village
no it's just i really appreciate the
opportunity to join you
um and i also appreciate the incredible
work that people have done over the
years
um in the village and the like i mean
it's it's
it's helped me individually as someone
as a researcher as an
analyst as a professor but it's also
served the wider world i mean it has had
a
real positive effect and so i'm just
like to be able to talk to you
and kind of join that cohort and may
defcon 30 be
hopefully safely available in person for
all of us next year
indeed