Cybersecurity today.
Would like to thank Meter for their support in bringing you This podcast
Meter delivers a complete networking stack, wired, wireless, and cellular
in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Welcome to Cybersecurity Today on the weekend.
We have a great guest for you today and a rare treat in that my friend
David Shipley is actually coming in for this interview as well.
Our guest, though, that you don't know, is Neil Bisson Nil.
Welcome.
Thanks.
Thanks for having me on, guys.
Really excited to be here.
Can you tell us a little bit about yourself, Neil?
just for the audience who doesn't know you, just a little bit of background
and then I'll reveal why that's so important for this discussion.
Great.
yeah, so I am a retired intelligence officer with the Canadian
Security Intelligence Service.
I retired in 2020 and, after I retired, I realized that, there's still a lot of work
to be done when it comes to understanding National Security Intelligence collection
here in Canada and the importance of that.
So I took it upon myself to, start the Global Intelligence Knowledge
Network, which is basically a digitally based company that, gives me an
opportunity to speak to the media about issues relating to everything
from cybersecurity, cyber espionage, to intelligence collection, terrorism,
all that interesting stuff that, we see on the news from time to time.
So I'm, I've been doing that since then.
And, 2023, I, decided to, I wanted to.
See a little bit more about how the cyber side of things is interacting
with, national security intelligence.
And I took a IBM course for, cybersecurity analyst and that got me a little bit
more into understanding what some of the vulnerabilities that we're seeing
on the digital plane as well as on, just our own national security issues.
For those who are wondering what this has to do with cybersecurity, I think you've
started to make that bridge and that there's a lot of work that we talk about
nation states And how they're involved.
And that's one of the things I want to talk to you about today,
this discussion is to give us some sort of perspective on this.
We, and the problem is we get the news, like it comes at us, piece by piece.
And it's really difficult to get a full picture of what's happening.
I think people this news comes at them like out of a fire hose.
Need a little perspective.
So just wanna back up and talk a little bit about that.
Can you talk about your perspective, uh, as, um, as An intelligence
officer and how you see the world.
Can you share that picture with us as to what, when you think
about the world in terms of nation states, what are you thinking about?
Yeah, so I started my, career with the federal government in
the late eighties, early nineties.
And at that time, it was.
Telecommunications and, the internet.
it was just burgeoning back then.
now everyone's life is basically somehow connected to either social media or, the
way that we interact with one another.
The way that we communicate with one another, the way that we, basically
talk about our own interests.
It's all out there, it's all on the internet now.
And that has changed fundamentally the way intelligence organizations
look at collecting information and targeting individuals that they want
to collect further information from.
So one of the big concerns that I think everyone should be aware of is the
fact that the more that you're putting out there, if, foreign intelligence.
State actor or even a non-state actor who's being utilized by a foreign state
is looking to garner that information.
Whether you're working for a tech company, whether you're working for the
military, whether you're working for a government department, all of that stuff
helps them comprise, a plan for how they would approach you, whether it's
digitally or whether it's, face to face.
back in the day when, we're talking a little bit more old school
espionage, we would try to find as much information about an individual,
compile that and then come up with a plausible reason for us to make a meet
or some sort of contact with them.
Nowadays, it's so much easier to do that because as I said, we all live digitally.
It's a lot easier for us to reach out to someone, whether it be with
a business interest, whether it be through, if they're on a dating app.
It's just so much easier to do that than it is logistically to try to
figure out, okay, how am I gonna make a connection with this person?
And what's interesting is, this idea of big data being available, both
what, what we traditionally call open source intelligence, but also if you
look at what China's biggest raids on North American information, whether
it's the Anthem Healthcare breach, you got health information on US
government employees And other things, the Marriot attacks, where they knew
where people were staying, where they were going, and all the other breaches.
All this is being funneled into a data set.
One can imagine analysis because in, in the exposure I've had to
the world that you live in, Neil, like you, you're looking for those
motivational levers when you have that first conversation with somebody,
is this someone that's, ego-driven?
Are they money motivated?
is a little bit of cash gonna help give them, decide to give up
their administrative credentials to a tech company so you can get
that intellectual property out.
are there other motivators which are as old as time itself in terms
of relationships and Russia's been particularly good about using those,
to great effect over multiple decades.
So you take this information, you know a lot about Jim, Neil and David, what
buttons might work, why you would wanna talk to them and pitches you can make.
one could imagine now we've got a spy DPT or two running around in
various intelligent agencies, giving suggestions of how can I flip Neil?
if I, were you trying to flip Neil?
I would talk about the Blue Jays and maybe he's interested in some
tickets for, I know we're after the season, but we're all so cheap.
we'd sell out our country for Blue Jays tickets at one.
Listen, you would be shocked what people will sell out.
people will give up their passwords for a chocolate pie.
that's true.
It's true.
Yeah.
yeah.
not asking Neil to, to spill any tea, although we'd love to have any tea.
but that's just kinda my take on it is this big data problem, whether it's.
It's openly and freely available or just taken?
yeah, like wholesale B and e Thieves, They're using it to great effect.
I need to take a step back.
You guys are two steps ahead of me.
I used to read Mad Magazine.
I saw Spy versus Spy Comics.
I know that Nations spy on each other, but When did this become a business thing?
Oh, it was always business.
you go back to the great power battles, and trying to achieve
technological advantage.
you can bet.
that Moscow was doing their best to steal every bit of Silicon Valley
insight during the microchip races and things that were happening on that
technology side, whether it was defense or civilian application, other things.
And you look at China, when you have a five year economic plan, you can literally
create a shopping list of all the things you need to have and what priority you
need according to your central planning.
it was always about money over ideology.
'cause it takes money to run ideology.
At least, that's my take.
if you look at it traditionally, technological advancements,
Really were based on military power at one time, right?
everything used to trickle down from the military into private industry.
And then at one point in our history that shifted, Whereas now
private industry had gotten to the point, and I think the internet
was a big catalyst for that, right?
even at that time it was, the idea was, okay, we need a system that we could
easily share ideas and information with.
And even that was almost like from a military perspective, but then it
blossomed and you've got companies like Microsoft and Apple and, Google
and all of these other companies that are amalgamating huge amounts
of information and being used by government departments, by military.
And then that is just basically expanding out and out and the
ripple effect that you're seeing.
So it gets to the point where state and non-state actors realize that, Hey,
listen, if we wanna make some sort of a profit of information or profit of money,
we need to start getting into this first,
How are we, how do we have a military advantage over the rest of the
world, and how can we ensure that our influence continues And all of
those things can be based upon, is it.
What's the next, technological advancement gonna be?
Are people gonna be buying more EVs?
Okay, we'll make E EVs cheaper, but if we steal the information from another
company on how to build those EVs makes it a lot easier for us to do that.
And that's just a simple example, but all of the companies out there right now that
are privatized, even if you look at it from the perspective of space exploration.
You've got SpaceX, you've got, I can't remember off the top of my head what
Bezos is working on, it's project, but it's got a different name now
they're calling it Leo, I think.
I'm not sure.
Oh, okay.
if you look at it from the perspective of, at one time it was military and
state secre, they wanted to get, now our adversaries are realizing that
really if you wanna have an, effect on someone else's economy, if you want
to influence what's happening, yeah.
Politically we want to do certain things and we want to be involved
in the diaspora communities.
But when it comes to the technological advantage, that's
what really helps us out.
And China's a good example of that.
they've always looked at it from the perspective of.
We can build it better.
If we just steal the technology and, reverse engineer it, then we have to worry
about trying to, make a relationship with another government or another company.
and we've seen that and was there a time in Canada, like you've got
the classic Nortel example, right?
Nortel was rated for its best, most innovative technologies, and
those miraculously showed up in, a number of Chinese companies.
Literally the documentation was copy and pasted, and the impact on that.
just recently hydro, just recently, hydro Quebec, same situation, right?
Yeah.
You've got an individual working for Hydro Quebec who is, on trial
at this moment for secrets that he's provided to the Chinese government.
Because Canadians are used to doing, okay, we're gonna fix this
problem, we're gonna figure this out.
And because we have such a huge country and we have to make sure
that IT infrastructure works.
throughout such a large land mass, we have made technological innovations and
exactly what you're saying, like going back to Nortel, we were making some
incredible advancements at that time too.
You go back to the Avro Arrow, we were making advancements in, aerospace, but
another country will come along and say, instead of trying to talk to Canada or
Canadian government or this company, let's just take IP and use it ourselves.
and it's not just rating the private sector like Canada's
National Research Council.
I know this is it feels like now I'm talking about decades
ago, but it was, 10 years ago.
the NRC, which is responsible for funding billions of dollars worth
of research across the country.
Public and private sector research partnerships, had the cookie jar
completely cleaned out by the Chinese.
Yeah.
And afterwards they signed a, we won't hack you agreement.
of course, it's like when I was a kid, I didn't go check the
cookie jarre after I rated it.
'cause mom hadn't made any more cookies.
I promise Mom, I'm not gonna write the cookie jar today.
yeah.
'cause there's no cookies.
They're back.
And what's been interesting is, there was a report from, either CSE or C. So CSC
being Canada's version of the NSA and Cs a's being our combination of C-I-A-F-B-I,
mandate just for American listeners, that talked about that, the increase in
nation chain activity targeting Canada's private sector businesses via cloud
attacks to go and get, 'cause the NRC cookie JRR was getting filled back up.
Maybe it had been locked down a little bit tighter this time, and
so they just moved to the next area.
and this has just been about secrets and intellectual property.
That's not even half of what we're seeing out there now.
Neil, what, from your perspective, because you were an intelligence agent at what
point did you start to think, oh, wait a minute, I'm thinking way more corporately
now than I was maybe government?
Or did that actually happen?
for me the shift was like when I was working as an intelligence
officer, Canadian Security Intelligence Service focuses on
national security threats to Canada.
So that breaks down into basically four components.
You're looking at terrorism, espionage, foreign interference, and sabotage.
So we were looking at nation states or actors, whether they be groups or
individuals like, terrorist groups and individuals that are affiliated
to these terrorist organizations.
What are their threats to Canada and what are they doing to try to, cause
problems for, Canada threatening our, our livelihood, re-reading our lives?
Now what we were looking at from that perspective at that time was,
okay, what about the corporations?
How are they being infiltrated?
Because there's always that understanding that, private industry
has to, be responsible for themselves and are they being targeted?
If you don't look at it, you don't see it.
So when you're focused on, like I said, those poor categories, you're not looking
at it from a private industry perspective, but take a look at the microbiology lab
in Winnipeg, and the information that was stolen from there, like what we have to
get to the point that, Canadians in the Canadian government understands, is that
what's happening in the corporate and private industry world, what's happening
with research and development is just as important as a terrorist entity trying
to, perpetrate an attack in Canada.
Why is it just as important?
Because if you're dealing with a foreign state that is willing
to use a biological weapon.
Then if the information is being stolen from Canada and used against another
country or used to make the next superbug, what are we gonna do about that?
And the private industries are really the linchpin.
they're that, almost like that more vulnerable, soft target now.
and the reason the areas where, you know, when I think about the
future, right now, we are leaders still in artificial intelligence.
We've got some great AI companies, we've got leaders in quantum, the development
of quantum computing plus, leaders in trying to develop host quantum,
secure cryptographic communications and, great examples of that happening
with the Canadian telecommunications companies like TELUS and others.
so we've got lots of cookies that are Oh yeah.
Stealing.
and our show covers both the US and Canada.
There's a huge amount that's there.
But I wanna just back, I just wanna extract it just a little more because
when we started introducing you, you said, oh, and I took a cybersecurity course.
And I'm not being critical, but it, made my heart go, 'cause I went, what?
Wasn't that something you always had to take?
If our security operation is not studying cybersecurity It's it's like
sending the police out and saying that thing on your, in your holster.
You could take when you retire, you can study that.
for me, man, it's because I'm a cyber, I'm a I'm an industrial guy.
Yeah, I hear you From a, from, from that perspective, I can
see why you're saying that.
But if you look at kind of the mandate of each one of our organizations, David,
you had mentioned, the communication security adoption of Canada CSE.
They are more focused on what's happening in relationships to, communications
and intercepting those communications and trying to understand what that
means through those interceptions.
Because it's not just the interception of the communication, it's also
the technology that's being used to infiltrate, Canadian telecommunications.
And where our adversaries and our enemies are trying to get that information from.
Now, as an intelligence officer, my job was to be more of a face-to-face,
having the conversation, making the contact, and then getting the
individual, let's say he works in cyber.
Getting that individual comfortable enough to say, Hey, listen, whatever
group organization you're working for, you realize that they're probably doing things
that are not advantageous to Canada.
we'd really like you to help us out on this.
How can we talk about making this work?
So on one side we're CSC, you've got them understanding the metadata and trying to
get the information from that perspective.
But my job, my role as an intelligence officer was to, basically get the
individual on board to become a human source so that not only do we have the
information, but now I may actually have some opportunity to task and direct this
individual to provide more or do more.
So the crossover of those skills.
And that's equally important.
and by the way, if you're listening to this, we're bringing you back
for an entire show on how to use those, the things that you
learn, as an intelligence officer.
And how you can use those for, social engineering.
But I wanna focus on this.
So can we back up just another piece and for the audience that's out there
who are the players that are out there and what are they doing right now?
start with who the players are, because I think they affect
both the US and Canada directly.
I hear about.
North Korea.
I hear about Russia, I hear about China.
I'm not sure which one's more important.
I'm not sure who's doing what, who are the players in cybersecurity
attacking, or at least that are threatening cybersecurity right now?
Yeah, so the big players, as they would be in intelligence are China,
Russia, Iran, and North Korea.
And they've all shown a capacity to infiltrate and to extract information
or use information for their own means.
So the interesting thing is if you look at China, China is trying to
grab as much information as they can about every individual, in North
America and in the western world.
The Equifax attack by Stone Panda.
That took 145 million individuals information, and now basically the Chinese
government has that and they're probably churning it through, hundreds of different
databases to try to get a profile of every individual that they possibly can.
they may be interested in what they're doing in five or 10 or 15.
Same as TikTok by grabbing as much information on 10, 12, 13, 14 year
olds in the next 5, 6, 7, 8, 10 years, when they've actually got it into
the working world, they can use that information and hopefully they've
been continuing to monitor what these individuals went up to, and it makes
it easier for them to reach out to them either digitally or have some sort of
contact with them and get information.
Now when you look, so this are just movies that people are actually
studying people 10 years in advance of when they make the approach.
you can say a lot of horrible things about authoritarian regime, but the
one thing that you've gotta give them credit for is that they can make
decisions for what's going to happen over the next 5, 10, 15, 20 years.
They're not concerned about what the next government coming in is gonna do because
there is no other government coming in.
They're not worried about, reaching out to their constituency to find
out what the issues are for them.
It's their decisions that are being made, right?
The decisions of that authoritarian regime is, listen, we're gonna make
sure that we infiltrate influence and do what we want to the rest of
the world in the next 15 or 20 years.
And if that means we have to overtake their critical infrastructure, if
that means that we have to steal all their ip, if that means we have
to get into their own political systems, we're going to do that.
And that's what their priority is.
So you've got that from China, and then you're looking at Russia who's looking
at it from a military perspective, right?
they're still involved in the conflict in Ukraine.
They're looking at, okay, what's happening in Europe?
What's happening in North America?
How can we ensure that they don't get the idea that they
want to continue to help Ukraine?
Or how can we.
Cause some sort of, disruption within their system.
So they question their own government and we've seen a lot
of sabotage attacks happening.
But those sabotage attacks are, being coordinated with individuals
that are working in the cyber world to find out, okay, where
are the, supply chain, weaknesses?
How can we overcome these weaknesses?
you've got China, you've got Russia.
Iran is always concerned about their dissidents and they're concerned
about their own nuclear program.
So they're gonna try to infiltrate anything that deals with defense.
They're gonna try to get ahold of information from IP from.
We talked about, rocket companies like, space exploration, and now you, you
mentioned it yourself, David, Canada is really getting big into AI and
we're trying to push that envelope.
Iran would be looking at Canadian companies that are startups and
the aerospace industry and being like, okay, we want to get in there.
We want to find out what they're doing.
So and it's interesting because the service speaking of startups,
so CSIS had a great alert out to Canadian startups, and this would
apply to American startups as well.
It's hey, these contests where they invite you to China?
Maybe not such a good idea.
Yeah.
for these potential investments, which you're gonna disclose all
of your deepest secrets and where you're at, and potentially Get
money and investment this way.
Yeah.
Which is, interesting that they decided to go loud as part of that it, it is
worth noting, Jim, the George, was it the, the guy behind Game US owns, George.
You're on your own buddy.
Yeah.
Sorry.
Yeah.
George R. Martin, has this famous quote that no one's the
villain in their own story.
and for us, the absence of cyber digital evil is, Russia, China,
North Korea, sometimes Iran.
but we do it, we pioneered it.
The United States started this by tapping Cisco routers back in
the day, being shipped to Moscow.
the whole reason we're so wired about Huawei networking gears.
'cause we did it first.
Now they may be doing it more and better than us, but But, we.
I had a chance to meet members of the intelligence committee from the United
States, and remember that awkward moment when Snowden leaks were happening and
there was the, one guy was sent out.
I just met him.
He was the official apology tour for the CIA, going to, Angela
Merkel and others saying, we're really sorry we spied on your phone.
because allies do it to each other.
Israel spies on everybody, for their own national interests.
what's interesting sometimes for me is the countries we never hear about.
I had some really interesting conversations back when,
particularly Canada was having a very tense time with India.
we made a series of geopolitical choices to get in a fight.
Hilariously have our Prime Ministers plane break down after we start the
fight in India, which was super awkward.
there's no red carpet.
can we get some spare parts, for but where I'm going with this is
we don't talk enough about India.
everyone I read on the intelligence assessments on India's cyber capabilities,
they're very condescending and I'm like,
Wait a second.
This country has more engineers than some countries have populations.
and they're incredibly hardworking and incredibly smart.
And I think you're being incredibly dumb to ignore, India's potential into 21st
century in building up these capacities.
So yes, a lot of their attention is spent on Pakistan as two nuclear armed countries
that like to spark off, would spend their time, but that don't mean they can't.
and when we were getting tents in Canada.
We have a lot of offshore software development in India.
And so one of the goals for Indian intelligence, like Neil was saying,
would be develop assets inside their own, companies that may potentially want to put
code back doors, other things, these are This is a form of power projection now.
we talk about the players, it's everybody.
And, Canada, we got caught in Snowden hacking Brazil's phone.
So during trade negotiations.
Awkward.
and I was very proud of our spies 'cause we're really good at, we had a really good
track record of hacking mobile devices.
Cool stuff.
but we had our hand on the cookie jar too.
As much as I will China for stealing our stuff, we do it to others.
Yeah.
so we've got these companies.
And now, my sense is it's gone beyond information and I first encountered
this as a telco consultant way back, and I was an African, I was meeting
guys from Huawei and realizing, who Huawei is, building the telephone
infrastructure for the world right now.
And David, you talk about Nortel.
So we know, and I think most of us are aware that Huawei devices are
intricately meshed into most of the telecommunications networks.
I think a lot of people think they've been pulled outta the Western networks.
Germany would disagree.
and many other countries as well still have these devices.
But those are, that's one place of where they, we've infiltrated.
But I've heard stories of, and I don't know how true they are,
but you get the news on them.
Oh, I think I have an idea of how true they're, but that.
Most of the infrastructure, the critical infrastructure that
we have has been infiltrated.
how deep are these intelligence agencies in our corporate and our
physical structures right now?
it's the, the worst kept secret out there, that cozy bear and stone
panda and salt typhoon, and all of these other APT's are actually
working on behalf of the government, but they're working as contractors.
So a lot of these governments, the Russian government doesn't care if
they're stealing Bitcoin or if they're involved in ransomware or some of these
other things, as long as they're getting them the information that they want.
And really it's, a symbiotic relationship because.
These foreign governments are not going to start looking into the actions of these
hacking group because they're essentially working on their behalf as well.
So you've got that happening now, you take that in consideration with how
far they're going to go into critical infrastructure and then provide the
information back to their foreign state countries that they're working for.
we all know that sometimes it can be years before a company or a
department or an organization even knows they've been infiltrated.
And the unfortunate thing is at that point in time, it's too late.
if something decides to happen, if they wanna probe and find out,
okay, we're gonna shut down part of Southwestern Ontario's electrical
grid for the next four, eight hours, just to see if it works.
look at Russia and what they were doing to Estonia with their financial.
you could, if you went to Estonia and you tried to get
money out of a bank, forget it.
It wasn't gonna happen.
And they were just doing that essentially just to mess with them to say, Hey,
listen, when we want to, we'll shut your lights off when we want to.
We'll shut your water off when we want to.
We'll shut your money off and what are you gonna do about that?
we haven't gotten to that point yet because we're still dealing with
the issue of, okay, at what point does it become a military attack?
At what point do you involve yourselves in shutting off?
And how do we attribute it to you?
Because if you've got Salt, typhoon or some other organization that's a
hacking group and the government, of China says, they don't work for us.
We don't know what you're talking about.
at what point do we, we have to connect the dots and basically make
the argument to say, guess what?
You are funding Stone Panda.
You are funding salt Typhoon, and we're gonna do something about this.
Yeah.
And what's interesting here, so I spent the weekend, I watched, the new Netflix,
Kate Bigelow movie, house of Dynamite, which is talking about the modern kind
of nuclear era we're in and runs you through a very uncomfortable situation
of a, a nuclear strike on the United States and all the things that people
are trying to struggle and deal with.
And one of the interesting points about that movie is they missed who fired it.
The satellite didn't show where the myth, they only caught it once the
missile was on the upwards trajectory.
And so they had no attribution.
and that causes significant issues as you try and with us, that's cyber.
You have no idea who launched the, massive crippling attack on the West coast.
you have suspicions.
And, and you gotta remember too, is that depending on the country,
their policy response is not necessarily to respond proportionally.
you look at the US playbook, is that a significant enough cyber
event could response result in a kinetic response or higher?
and Israel, set the tone for this with, one of its raids on, Hamas.
before the most recent war, they, they took out a floor, one of the buildings.
Where Hamas software devs had built a really clever spying, app.
It was made as a soccer app and it was targeting IDF soldiers.
And what happens when they installed this soccer app, it was ping in all
their troop deployments and locations.
brilliant.
Great.
Like you gotta give them points for operational audacity.
But the response to that particular intrusion was, we're gonna wipe
out this whole team that's that this is where it gets messy.
but you, to your question, like how deep is China in anything that's
critical infrastructure and has a Cisco router has had a bad time?
In the last couple of years, because our infrastructure is fundamentally insecure.
The motivations aren't there to properly lock it down.
And, our intelligence agencies up until the last few years in Canada were a
little bit tied in terms of how much cooperation they could actually do.
CSE could engage through the cyber center if there was voluntary interest.
They wanted to engage proactively, let us know what was happening.
They would get involved.
CSIS really had its hands tied until the changes, as result of all the foreign
interference and spying stuff in Canada.
We had some major legislative changes, and I was witness to, CSIS
stepping up and doing some really great work with the private sector.
So we're starting to see those linkages happen.
and I don't believe it's just a cynical check the box.
We could say we've consulted with the private sector.
there's been some decent non-classified conversations, but it's bad out there.
and the challenge is that.
Canada, we lack the legislative tools to force critical infrastructure
and particularly things like energy transmission where we almost had a
pipeline go kaboom on orders from the GRU because a bunch of script
kitties got in and said, hey, do you want us to try and make this go?
And then just a couple weeks ago in Canada, we had an alert from our
intelligence agencies that four different critical infrastructure, everything
from water treatment to a grain silo plant, which I did not realize how
dangerous grain silo plants can be.
But those things can go boom too.
that people were in there messing with the controls.
and they were described as, but back to Neil's point sweetest
words in any kind of nation states toolkits, plausible deniability.
And that gets us back to our house of dynamite problem.
We had, someone from, one of the US groups that works with smaller
organizations all around in terms of their water plants and things like that.
And these, according to them, the attacks were just constant and that most
of these plants could be controlled.
And when you think about it, we don't think about these
dangers, grain elevators.
I grew up near a grain elevator.
a huge explosion waiting to happen.
If the ventilation goes down.
Yeah.
if you look at water treatment plants, these are all automated.
They release chemicals into the water that we get 15 minutes later.
Most of our major cities.
And if those were ever played with in a way you could do serious damage.
and we saw that in one small town in Ontario, the water treatment
plant stops working and a lot of the population gets sick very quickly.
Nevermind the chemicals that they could dump in.
so we're fundamentally weak in our infrastructure, if I'm hearing
you correctly, we're fundamentally weak in our corporations.
Every government is playing.
David added another one.
The Israelis, we like to ignore them because they're providing
the spying equipment that our own governments are using on us.
I'll use that, that tired phrase.
Do your own research.
the apple phone spying that governments can use and all of that.
It's all Israeli technology.
And I don't know how much Canada's bought, I know how much the US has
bought because they are, they're now using that effectively for facial
recognition and for spying on people on their phones, whomever they want.
and actually, citizen Lab at the University of Toronto has done some
phenomenal work into the NSO group, the Pegasus Malware and all that fun stuff.
to Jim's point, it's all there.
and you know what I, in terms of the norms, I'm okay with
countries spying on each other.
because in, in some ways, that is a steam release valve.
What are they thinking?
What are they doing?
All right, great.
you're not, you don't feel we're gonna give you the straight answer
and you need to go look behind the sheets and see what's going on.
Fine.
And, protect your intellectual property.
It's your job to put your goalie in front and wave.
What I don't like is this, expansion of the game.
And North Korea doing this the most where they're violating international
norms around espionage and now it's monetization and it's pre-positioning
for infrastructure disruption.
And it's the weaponization of intelligence and turning this, okay,
we got in, we've got persistence.
Okay, now we're gonna potentially be able to sabotage and shut down
critical infrastructure, et cetera.
That's when we're crossing a line now between the Great
game and the House of Dynamite.
I don't know how we have an adult conversation 'cause I don't think
we have functional multilateral international organizations anymore.
guys like we need a Geneva Convention 2.0 that says, No, you're not
allowed to be in a hospital.
You're not allowed to be in a power plant.
You're not allowed to be in a water plant.
Period.
Full stop.
that is a violation of international norms and you're a pariah and
sanctioned and cutoff or whatever the hell we can do short of war.
But we've gotta put some boundaries on this stuff.
I'll just go back to some of the stuff that you guys were talking about.
one of the biggest turning points I think, just in the last
25 years was Stuxnet, right?
You're looking at, state, on state, attack that happened through, cyber technology.
And it was, it goes back to what you were talking about too, is what
are the motivations we talked about, intelligence, getting close to a human
source or recruiting someone because you understand what their motivations are.
And you guys both brought this up, is that if you look at Israel's a
good example, what is motivation?
what is Israel's biggest motivation to ensure that they can maintain what they
have and they are basically surrounded in their minds by enemies on all side, right?
So they're gonna take technology and they're gonna use it against.
Anyone and everyone to try to ensure that they maintain what they have and
that they keep their military capacity capable of the most capable as possible.
So that means that if you're dealing with them and you're a private industry
co company, and you're dealing with a company that's spaced out of Israel, more
than likely anything that they provide to you will somehow have malware on it.
It's gonna infiltrate your system like, this is what we have to do,
this is what we have to do for our companies as well as our governments,
is come to the realization.
You gotta know what the motivations are.
If you're dealing with any company in China, that company is partially
owned by the Chinese government.
you've gotta keep that in mind.
The thing that makes me crazy, and I'm just gonna relate it back to corporate
world work, there's a couple things that make me crazy in this, but one
of them is I've got a whole government that I pay taxes to and there's a bigger
government to the south of me where a lot of people pay a lot of taxes
to, and people tell me, we shouldn't have Huawei equipment or we shouldn't
have this equipment or all this stuff.
Isn't there some lab somewhere where they pull this stuff in and say, Hey,
wait a minute, this stuff that's coming to you from China, from it's always
like we make these announcements on our show that you are supposed to watch for
this and you've got some guy, he's a security officer for a company, maybe
even a mid-sized one, four or five people, or I don't know, a dozen people
were reporting to him or her, and we're supposed to defend you against China.
This is insane.
apocalypse Now, right?
it's like we're all sitting on the beach with Kilgore and it's like surf's up, man.
I love the smell of cyber in the morning.
so let's just be real for a second.
It is insane.
Part of it is, Neil talked about you need to understand motivation, but
the other part understanding what's going on with bureaucracies, you need
to understand what happens when you have a critical lack of imagination.
when people are just so focused on staying in their lane, in their policy directive.
So if your policy directive as, CRTC and as, industry,
Canada, and others is cheapest.
Internet costs for Canadians as possible.
Then when telecommunications providers are working and negotiating with the
regulator for, okay, we're gonna, we're gonna buy the cheapest equipment available
that's got the highest quality, which China was turning out with Huawei.
No one cared about the national security implications of that
to the extent they cared.
They set up a little lab and they tried to do some assurance and everything
else, but they just tried to make themselves feel okay about the decision,
like the lack of imagination that we could be in a hostile situation.
Because when we were making those decisions about Huawei, we were trying to
orient more of our trade towards China.
We were doing a great sort of warming of all those things, and then for some
absolutely insane reason, we decided to, to grab the daughter of a senior executive
for China's version of Apple, which okay.
Gotta remind you guys, China's really sensitive about insults for reasons
3000 years of history and other things.
So when you insult the company, that literally means Huawei China forward,
and you throw her in detention in Canada, you're gonna provoke a response.
And so we get into a fight with the world's largest economy
and all of a sudden back into or second largest economy.
Back in our intelligence communities, we're like, oh, maybe it's not such a
good idea that all our telecommunications equipment is now influenced by
someone who's actively hostile to us.
there was that aspect of it, but there's also the aspect of it that all
of our five Eyes partners had come to the realization that using Huawei as
a, backbone infrastructure for your telecommunications is a bad idea.
this is one of those things that, because of the five eyes, if you're gonna go ahead
and put yourself in a position where you become the vulnerable point, then you.
there's gonna be a major issue.
you guys have talked about this on the show time and time again, you have
those individuals that are in place that are talking about security, but
they're always going to be trumped, no pun intended, by those individuals
that are more concerned about profit.
just look at the Canadian government and how we've gone from, okay, India
is, affecting our diaspora community.
There are, assassinations happening.
the Indian government is involved to, oh, the G seven,
I'm going to invite Modi there.
Or, all the issues that we had with the two Michaels, as you mentioned with, the
Huawei situation and how we know that on a regular basis China is trying to influence
and infiltrate, Canadian, cyberspace.
but yet our prime minister still goes there and says, Hey, listen, we want
to turn a corner here because why Economically Canada is looking at itself
saying, what's more important that we make sure that we get more money
and that we start doing more trade?
Or are we more concerned about our national security issues?
So these are always gonna be conflicting if we were to lock out everyone who
spied on us, there would be the G one.
Yeah.
north Korea's internet is perhaps not the model that we're advocating for here.
And again, I would go back and say I'm cool with a certain amount of spying.
I get it.
It's the game.
I am not cool when we cross the line between spying and sabotage.
and the problem is that the wires, the digital infrastructure, the
highway to do this is the same road.
it's a matter of intentionality at that point.
And that's that.
how do you control for that?
the problem with that mindset though, David, is that all intelligence is
for the future purpose of potential sabotage you can't differentiate
between the two because the whole idea of spying on another state, another
individual, is that there may be a point down the road that I need to
take action and I wanna be able to be, have the advantage to take that action.
it's nice to think that, It's okay if we spy on each other as long as we just,
catch these little secrets Really, at the end of the day, it's how do I ensure that
my company, my group, my organization, my country, has the advantage?
Yeah, no.
Yeah.
And we make a big thing about the, the fact that we have elections every four
years and we can't plan, I'd be happy if our government was looking a year out.
honestly, right now I'd be thrilled right now, if we went to that, we have to wrap
unfortunately, because there's only so much I can edit this down, but there's
only so much i, I can do in an hour.
I think we're gonna end up with three episodes, because
I think there's more to this.
But I wanna leave our audience who's listening to this with at
least some ideas of, we've gone into the air and we've talked about
the groups that are out there.
We've talked about some of the threats that are out there.
If I'm a person running.
A cybersecurity area right now, I know one of the things I should be doing,
I should be watching who I'm hiring and as a contractor, because that
I failed to believe that the North Koreans are the only people doing this.
They're making money doing it, but I think everybody's doing it.
And David put a, a great, uh, piece of advice out there for anyone.
And that is if you can have a remote contractor and it's worth that to you and
you have any information worth anything, you might wanna bring them in for their
first week at least to meet with people and work side by side with people.
And if they ask what this key does on the keyboard, you might
not want to continue with them.
Or if they have to make a phone call every time you ask a question,
you might wanna say, maybe this person doesn't have these skills.
And I'm being facetious.
But I'm just saying get to know.
we talk about know your client, know your employee.
What are the other things from a cybersecurity point of view, that
good intelligence thinking would do for us in protecting ourselves?
I think one of the most important things is just paying more attention.
The information that's coming at us is coming at us at a fire hose pace,
and you've got to have individuals within your organization, whether
you're a small, medium, or large corporation that's dealing with ip.
You have to have somebody in there who can take the time to start pulling that apart.
Because every vulnerability that is discovered in another
company, is a vulnerability that your company itself might face.
And what you want to do is you want to have people that can recognize
that and then they can apply it.
What, like for me, when I do my global intelligence knowledge, weekly wrap up, I
go through, a week's worth of intelligence information that's open and I try to.
Explain this to people that why does this affect your day-to-day?
Why does it affect your career?
Why does it accept your affect, your, safety?
Why does it affect the sovereignty of your country?
Because, states are like businesses.
They have a business plan.
Okay, we're gonna attack this way.
We're gonna infiltrate this way.
We're gonna do it this way.
'cause that's what they're used to.
It's human nature.
And if you can become aware of that, you can build the defenses
you need to counteract it.
I would add from my side, first of all, to what Neil was saying, you
may not believe in DPR K's interest in your business, but they sure do
have an interest in your business.
and no one from Washington or Ottawa is automatically magically waving a
wand protecting you right now from all the nation state threats that exist.
No one's doing that for you.
You have to protect yourself.
we are in a new era.
It's more akin to the feudal era where, you know, those who are powerful
governments, large corporations live in the castles and the rest
of us surfs out in the village, getting rated by the Vikings.
and, you've gotta build up your own defenses.
That being said.
I'm seeing greater willingness and greater interest from our intelligence agencies,
not just in Canada, but also in the us.
You've got, CISA for critical infrastructure.
You've got the FBI, secret Service and others, there are
folks who will pick up the phone.
you see something weird happening in your rural water utility, your,
telecommunications company, your hospital.
There are people who care and want to know about this, and that's the only way
we're gonna get a handle on it, is by people talking about it and sharing it.
you're not bad because you get hacked by the Chinese.
To Jim's point, like good luck offending yourself against a cyber army that's
larger than most countries military.
we gotta get better at working together.
And I think we gotta have these conversations because, just
to bring it all the way back, if you're dealing with cyber.
You don't take the time to think about the motivations of why someone would
attack you and how they're criminal groups, nation states, and others.
You're not defending, you're just reacting.
Great.
and I wanna thank you, Neil, because I think sometimes I think about this when we
put the podcast shows together, trying to get the information out there for people.
And I sometimes wonder if we're admiring the problem.
I honestly do, we talk about these things and I, my hope was that
if it wasn't schadenfreude that this happened to somebody else and
not you, it was this idea that, hey, this is happening out there.
You might wanna start to think about it.
'cause it may start you thinking about.
How you protect yourself better.
And I think that's, our legitimate interest.
we try to also cover specific attacks when they're ones that people might
have gone by them, but I think we all drink through a fire hose.
And I'm gonna do a little bit of a commercial.
Yours is called a Global Intelligence Podcast, Neil.
Yeah, it's a Global Intelligence Weekly wrap up.
So I do it every week, and I take information from around, the world on
headlines because the same way that China's attacking the Philippines is
also the same technique that they're going to try to do for other countries.
So it's trying to get it out there to have people realize that,
intelligence is a global business.
it's good for you to be aware in Canada or in United States or in
Europe, these techniques that are being done by the Russians, by the
Chinese, by the Iranians, they're also happening in your own backyard.
You might not be cognizant of it because it just hasn't hit the news
yet, but you should be aware of it.
So we'll put a link to Neil's, podcast.
if you're listening to this show and you want to just keep up on these things,
it's a really accessible podcast.
And, if you're in the US it's gonna have more of a Canadian focus.
Of course, if you're listening to this show and you're in the US you'd realize
it has a bit of a Canadian focus anyway.
But these are universal themes across, we have listeners across the globe
who come in and tune in because
there are no borders in cybersecurity, unfortunately.
No, there're not, Yeah.
thank you very much.
My guest today has been, David Shipley.
Of course, he is not really a guest.
he'll be back with the news on Monday.
Neil Bisson, who has the Global Intelligence Podcast, and a, and
I'm getting, I'm botching the name, but you know what I'm talking about.
There'll be a link, I call it the Global Intelligence Podcast when I'm watching it.
good enough.
thank you guys, appreciate it.
And, we're on for another episode at least, and we're gonna talk
about some of the things next week that Neil will bring to us as an
intelligence officer and how those things contribute to, our psychological
attacks and social engineering.
And David will be back for that too, who's our resident social
engineering, expert and phishing expert.
so we're looking forward to that.
we'll catch you next week.
And David, you're back on the news on Monday morning.
Thanks guys.
Thanks.
Awesome.
And finally, once again, we'd like to thank Meter for their support
in bringing you this podcast.
, Meter delivers full stack networking infrastructure, wired, wireless,
and cellular to leading enterprises and working with their partners.
Meter designs, deploys and manages everything required to get performant,
reliable and secure connectivity in a space they design the hardware.
The firmware, build the software, manage deployments and run support.
It's a single integrated solution that scales from branch offices,
warehouses, and large campuses, all the way to data centers.
You can book a demo at me.com/cst.
That's METE r.com/cst.
I'm your host, Jim Love.
Thanks for listening.