Inside Modern Cyber Warfare: The Invisible Battles Happening Every Day | Chris Kubecka

Hi, everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

It’s a pleasure to be here with you.

And I have an awesome guest who I really admire has been a fantastic mentor and global leader in policy and advising and critical infrastructure.

So welcome to the podcast.

Chris, do you want to give the audience a little bit of your origin story background before we get into some of the nitty gritty of the world politics and cybersecurity challenges that we have around the world?

I have an origin story.

Oh, this is interesting.

Ooh, I feel like Batman.

Ooh.

So it all started when my parents were.

No, no, it did start.

My parents were divorced, and my mother just loved to teach me everything about her work.

Computers, computer science, networking, you name it.

And then as a kid, I decided I would explore, and I explored too much.

And I broke into the FBI and Department of justice without knowing it, by the way.

I did not have intent, but that’s okay.

Anyway, so after I could use a computer again at the age of 18, voila, I was in the Air Force doing all sorts of lovely jubbly things.

And from there, I learned to hack land, space, CN Air in a nice ethical way, or against enemies, but in a nice way.

That’s always.

It’s always interesting.

I mean, you’ve had a very interesting and exciting career going from the Air Force and then getting into a lot of the critical infrastructure side of things.

You did a lot of work on the Saudi Aramco and critical infrastructure, especially when there was lots of major cyber attacks happening around that time.

So if you want to give a little bit about kind of, you know, the experience around then and the transition you had during that time, certainly.

So it’s.

When most people, they get a corporate job, they might be, I don’t know, an executive, junior executive, whatever you’re thinking, oh, this is going to be easy and cush.

But, no, not with Saudi Aramco because their threat profile is rocket launches against their infrastructure and weaponized drones.

So when we think about, oh, all of the drone wars that have been going on between Ukraine and Russia, actually, a precursor was Azerbaijan in Armenia, but even before that, the Iranians had been giving the Houthis, et cetera, all of their favorite club, weaponized drones.

So Iran’s been developing weaponized drones and surveillance drones for much longer than most people think, unless you’re familiar with the Middle East.

So the threat profile for Saudi Aramco is executives getting assassination attempts, so.

Or board members.

There are tanks There are rocket launchers at the compounds and that’s for a reason.

The buildings are laid out so in case one gets blown up, you can still keep operations going in another building.

So it’s a very different type of aspect of cybersecurity that most people in say, computer science don’t have to deal with.

Unless you are, say, an amateur lock picker.

And I’m looking at my lock picks up there, but you have to deal with these things.

And then on top of that, they had just sold the largest fleet of ships called Velo, but yet they were still monitoring it.

And I was on a crisis team with the most Scottish guy ever.

His name was Donald McJonald and he had like the thickest Scottish brogue.

Right.

And him and I, we would have to monitor the Velo fleet in case he got hit by pirates.

So in between your regular viruses, massive cyber warfare by the Iranians or whoever else, you know, and you know, pirates and, you know, joint ventures connected with nuclear facilities in South Korea, rockets, drones,.

Which kind of, kind of reminds me of what’s happening.

It’s only at the last couple of years we’ve seen a switch from.

We still, on occasion we, we do get the, the very digitalization, you know, the cyber attacks, DDoS attacks and phishing and ransomware, you know, they’re very common things that you’re used to.

But in the last couple of years it’s changed quite significantly to the point where it started really with GPS jamming.

GPS jamming has been a massive challenge.

If you go close to the border, you’ll find that your GPS will, will not function.

It doesn’t work at all.

So using navigation zone and even I remember just last year that Finnair started a flight from Helsinki to Tartu and that inaugural flight had to turn around because Tartar airport didn’t have.

They used and depended on GPS for landing the flights.

And of course GPS jamming occurred and they had to cancel and turn the flight around because it didn’t have gps, alternative to gps.

So GPS has been a massive challenge, especially when you go closer to the border or around that area, it just doesn’t work.

And then in the last couple of years, of course it’s been the ghost ships and the anchors dragging across the Baltic Sea and that’s now create a lot more challenges.

So, you know, first of all it was the energy cables because between Estonia and Finland we share energy grid between the Baltics and Nordics.

And now in the, even the last couple of months it’s been the data cables.

So it’s turned really around that it’s more, you know, the sabotage and espionage, whether it being trying to plug into those cables to get the data in transit or to just destroy the infrastructure.

Disregard.

So cyber attacks have definitely.

It’s evolved into your point, you know, physical side.

And drones is definitely now one of the big top areas that we need to be prepared for.

I always say that, you know, we’re not, we’re not just protecting computer systems.

And I love Mikko’s mention about that.

We’re not protecting the digital society.

So we’re almost like the, you know, we’re the digital Marvel heroes.

And I admire even, even with Mikko changing direction as well, moving into more the drone security side of things.

So, so what’s your.

You’ve had a lot of experience in this, you know, around the political side and the global side.

What experiences have you had when it comes from drones, but now with a lot of different mechanisms for disrupting the digital world that we live in?

Well, it’s been a very dynamic digital battlefield.

Late last year, I don’t know, a few months ago, filming of this, I had the pleasure and opportunity of being put on stage next to the head of the Cyber Authority of Ukraine and then on the other side next to the head of the DNSC of Romania to basically represent the ethical hackers which are aiding Ukraine.

And during that time, here I am on stage and it’s a very public thing, right?

I was undergoing a Russian smear campaign by a false inflated German expert who runs a think tank with dubious funding after I just released an exclusive on Sofia University in Bulgaria.

Professors meeting up like a secret cabal to vote in some guy without credentials to be a professor.

And he too had a think tank, a Eurasian center, which is code word for foreign policy of Russia.

Anytime you hear Eurasian.

And it was a surreal experience because it’s been almost four years since the escalation.

And there I was on stage with this storm going all around me and knowing that the year previous, the conference I was at, we had to change locations because one of the speakers within two hours of her speaking at that conference, the Russian government had deep faked her to say that she was a secret CIA agent or some, you know, bogus whatever, right?

And you’re just like, how did I get here?

I wanted the beautiful house, I wanted the nice husband.

Wait a second, I’m in the middle of hybrid warfare, right?

Oh, yeah.

And then D site had come out with an article, a full thing about me speaking about hybrid Warfare, all at the same time.

And you’re like, huh, Is this real?

It’s real.

And you’re like, I don’t want it to be real, but it’s real.

And all of the stuff that goes on where you’re dealing with very nervous diplomats, like, right now, because the us, as per the current administration, when they came into power, they decided that certain countries were not the biggest threat.

Fine.

That’s their prerogative.

That’s not the case in the Baltics.

Right.

And because of that, and because of an article that came out, a statement from the US Government a few days ago, basically saying, we’re going to concentrate on our internal stuff, world, you’re on your own.

But I’d already been hearing diplomats going, oh, no.

The US had been doing all of these diplomatic services in the background, and now they’re like, yo, bye, Mic, drop out the door.

And in the middle of such chaos.

And it’s been very interesting.

It’s a shame it’s real, or it would be a really good TV series, but it’s real.

And I’m finding there are some countries that really, really want to work together, break some of those old barriers, baggage from our grandparents type of thing, and then other countries are still too entitled or thinking about the grandparents and who killed the grandparents, whatever, you know, but in order to look at the threat, if we’re going to survive this, we.

We gotta, like, work together.

Because Uncle.

Uncle Sam.

Yeah.

After Trump became president, the 45th president, I was with an organization.

We were running the eu, NATO cyber warfare exercises down in Brussels.

And for our devastating scenario, Dead Canary, we wrote a letter from President Trump, you know, good morning, blah, blah, blah.

And it was all about massive cyber attacks that were killing people across Europe and the uk.

He goes, you know, oh, you know, so sorry to hear about these massive cyber attacks.

This is a terrible thing that’s happening to Europe.

However, when I was last at NATO headquarters, I told them no, I begged them to put more money into defense.

Because, you see, now is the time for Europe to stand on its two feet.

American blood will not be spilled.

And what’s funny is I heard very, very similar, almost haunting rhetoric from, I think it was Rubio and another person in the cabinet of the Trump administration.

And you’re like, it’s really now time for Europe to stand on its own two feet.

So it’s.

It’s interesting times.

I feel like I should write a book, War and Peace,.

Version two, the digital.

The Digital era.

Right.

It’s interesting because I read a book last year.

It was interesting to read it now because it was, it was published maybe about three years ago.

It was a book by Ano Bradford called Digital Empires.

And it talks about, you know, the world and digital empires where it’s about China being state driven, European being rights driven for, you know, citizens in the US being economic driven driven.

It’s a very interesting because to your point that what changed a lot the last year definitely is that the switch where it was more about an alliance and that that and that it was about intellectual property and it was about ethics and everything being kind of the rule of law globally.

What seems to be now driving a lot of decision making.

It’s the economic side of things, purely financial, which means everything else, alliances, transparency, cooperation, all goes out the window if you’re not making money out of the whole thing.

And immediately I think it really impacts because that means that yes, you know, Russia and China are definitely not, you know, not seen as.

I think it’s more China from an economic perspective rather than a digital perspective as being as, you know, seen as the challenger.

And it’s really interesting that I find that it’s, it’s very, it’s changing the whole dynamics of the world very quickly and rapidly from trade to cooperation to data sharing to stability.

And it’s really connected to, you know what I’ve seen a lot of, a lot of organizations which were critical to the industry that we work in, in the security and cyberspace, the likes of CISA and things like CVEs that are now all, you know, from a resource perspective getting very challenging.

Do we have the people in there to really make those critical decisions?

Me being based in Estonia, we have had those incidents multiple times over the years.

Ukraine’s been going through it many times in the last couple of years as well, to the point where that you get so much disruption that we have to work together in the digital world.

In a physical world you can choose how you do things and trade and whatever, but in the digital world there is no realistically borders.

It’s all connected, interconnected and there’s many ways to communicate.

And for me I think the only way that we can reduce where cyber criminals or mercenaries or malicious operators can work from is cooperation.

But my concern is those corporations are starting to fail right now and disappear.

Which means that more places we will likely see a massive increase or a spike in cybercrime malicious attacks into more damaging that not just about from a financial perspective because we’re seeing in the last year more kinetic types of attacks that it could start to damage the way we live and the society in general.

Have you seen, I mean, what’s, what’s your perspective on that?

Is the alliances and the cooperation?

I think it’s getting stronger in some areas.

I think definitely between European and Canada and Asia, some Asian countries, there’s strength or relationships happening there.

And maybe some countries are stepping up to being the leaders in that area.

I think some are, I think some are now realizing, whether by shock or necessity, that these types of things are going to happen.

But at the same time, then you’ve got still such an interesting difference of opinion even inside Europe.

And one of my best examples is Denmark and Sweden.

Their concept of privacy is no privacy.

So last year Denmark had the rotating every six months EU presidency thing and they had been trying to quietly push EU jet control in conjunction with the Swedes and the private security firm out of Sweden that is privately funded with no listing of their board members whatsoever.

Not suspicious at all.

And they currently use the system in Sweden and it’s got about a 20% false positive rate, meaning 20% of the people hauled in are arrested for having child pornography and their entire lives ruined and their families broken up.

Because as you’re going to, what is, you know, is your wife going to look at you the same?

And then a year later they’re like, oh, yeah, so sorry our software messed up.

It’s miscalculated and didn’t under.

I mean, especially if you’re using AI, it’s, it’s so, so many inaccuracies, right?

It’s so many inaccuracies, right?

We’re not there yet.

Right.

So they’ve been pushing you chat control both through the front door and now through the back door.

Now that they don’t have the presidency with the statement of, you know, basically the Danish EU president at the time said, you know, privacy is dead.

But the problem is we’re still kind of broken up with this idea of what is privacy.

And here the EU has such a strong EU gdpr.

What is cybersecurity?

Well, privacy actually comes into play with that.

Right.

We’re in the middle of a hybrid warfare, so maybe we should keep things more private.

But there seems to be a disconnect with some of the countries of what those ideas are.

Right.

Ethics are different everywhere.

The idea of privacy is different everywhere.

Right.

I live in the Netherlands.

They like to keep their curtains open even when they’re changing.

I’m like, no, no.

All my Curtains are closed.

So, you know, I know I don’t quite fit in to this, but we also have to understand and get on the same page that even though we might have different ideas in peace time and wartime, the same information can absolutely turn into poison for us.

So we have to plan for that.

We have to absolutely be more cohesive because the big plan is to break us up and make us, you know, fight amongst each other instead of the real issues.

And I’m seeing a lot more cohesiveness when it comes to the Baltics and the Balkans right now.

They are cooperating big time.

Big time.

But they’re still kind of like dragging in some of the Western countries where they’re still not all that cooperating.

I don’t see French delegates at cybersecurity conferences in Sofia, Bulgaria, or in Bucharest.

I’ve yet to see one.

Where are they?

But yet Bucharest right now is the center of cybersecurity in all of Europe.

I can understand.

I just would really like to have that more.

Yeah, absolutely.

We do mean they are from a history perspective.

I think that’s one of the things, is that they, they were, you know, through the Soviet times and they’ve got that really kind of not too far distant memory of the situation.

And that’s, that’s why the cooperation and visibility and working together through the Baltics as well.

Yeah.

I mean, they had even a spin on the Soviet times because Ceausescu, the leader, wasn’t quite all Soviet.

I mean, he was very angry that the Soviets invaded Czechoslovakia.

Right.

But he leaned towards North Korea, so him and the Kim family were friends.

So imagine it was even worse, right?

I was like.

And no food.

Not joking.

The guy exported all the good food.

So, you know, it was even worse.

So they know last November, I should.

One second, I’ll get the book.

Okay.

I should market myself more.

I forget this.

Oh, I wrote this little book, Fuel Tested how to Hack a Modern Dictatorship with AI, the digital CIA OSS sabotage manual.

And I was giving a talk about it at the Romanian Parliament last November, just after Johnny Christmas, because he had the keynote.

And I was discussing, you know, authoritarian regimes and dictatorships.

The Romanian parliament that was built by the.

The Romanian authoritarian and dictator.

Right.

And looking at the digital tools that, that they’re using more and more against us.

So we’ve already discussed some of those tools, like smear campaigns, Right.

They’ll do these types of things really, really nasty against groups of people or refugees.

Like, for example, there’s been very unfortunate ones, not really in the News where the Bulgarians highly suspect and attribute a variety of different cyber attacks against refugee centers, specifically to get information, private information about Ukrainian refugees, because there’s quite a few that are in Bulgaria.

There, again, privacy and cybersecurity kind of sync up.

Right, sorry.

Denmark, we have to look at these tactics, what used to be considered no go lines.

Yes, you might bomb a hospital, but you’re really not supposed to.

Right.

But you can cyber attack a hospital.

So the year before last, majority of Romania’s big hospital networks were under attack and were basically shut down.

But they’re not at physical war with Russia.

So we’re seeing this more and more in the Baltics, in Estonia.

Lovely.

Estonia.

A week as I’m on the bus.

So for everybody listening, Estonia is a bit unique.

They’ve got one of the last remaining land borders with Russia in the Baltics.

And that particular land border has actually been broken by the Estonians, so that you cannot drive over it.

It’s got dragon teeth to keep the tanks out and you can only walk over.

It’s very, very strict.

Now, in order to get to that border and the border town is called Narva, you have to take a bus on Lux bus.

The St. Petersburg, Russia bus driver does not speak English, does not speak Estonian, does not speak Ukrainian, but he only speaks Russian.

And that sets the stage for getting to Narva.

Now I’m on my way to Narva and I’m chatting with my friend who’s in Estonia who couldn’t join me.

And I’m getting the news.

And we’re passing by a.

A port city begins with an S. It was the closest port city to Narva.

Right.

And as we’re passing, a ship is leaving the port, still in Estonian waters.

And the Russian government seizes the ship as we’re going past, because the week before the.

The Estonians had boarded a Russian ship that had come into Estonian waters.

Awesome.

So then I get to Narva and boy, oh, boy, it was so much fun.

On the way, I found out that you can.

So the buses, this is the part they’ll never let me back on the bus.

So everybody’s like plugging in to charge their phones and they might play some games and share their contact info, whatever,.

Inadvertently, with the infotainment system in the bus.

Right.

So as I’m on the bus, I find a blog of a guy, an Estonian I translated, where he had hacked them.

So I’m like, oh, let me see.

And of course, I’m getting all the contact information from everybody that is plugged in use a USB data blocker sometimes.

And it was so much fun getting all this stuff.

One lady did get yelled at on the bus for trying to play really loud, annoying, patriotic Russian music because we all wanted to sleep.

But it was a very interesting crowd.

And so you get off the bus and there’s a really long line.

And because you can only walk over now, I’m not going to Russia because, you know, bad things would happen to me.

But I’m like walking around, I’m like, wow, there’s more Russian spoken here in Narva, Estonia, than there was when I was in Transnistria around Russian peacekeeping troops.

And there was all this other stuff going on.

Like the GPS didn’t work, of course.

So I had mapped out my stuff of where I wanted to go anyway.

It’s not like it’s a big city.

When I tried to connect to my phone, I noticed a few things.

The estonians only offered 2G, which you can easily surveil the Russians on the other side.

And the border’s only 350 meters.

Yep.

Small waterway.

Small waterway.

The river that goes into Lake Baby.

Yeah.

So the Russians, their cell phone signal was stronger than the estonians offering, and 4G to try to get you to connect to their network.

And of course, if you have auto connecting, which most phones do, then you will automatically connect to the Russian side.

Isn’t that cool?

Right.

So there’s even a fight, even with what’s in your pocket.

It’s amazing.

And then you have to be very careful what language you speak or where you stay, because there’s only a few places that will proudly put out that they’re Ukrainian.

The rest are pro Russia.

Then a week after I left, oh, and by the way, I started training the crows with fish in case the Russians sent drones over.

I figure they could protect me.

And they started following me around, you know, it’s just in case.

Right.

So then I leave Narva, I get back to Estonia, got an interview with a great firm.

Try Estonian Mexican food.

I do not recommend Estonian Mexican food.

It’s not good.

But I did it.

I did it, I did it.

And then city council members from Narva are arrested because they were running an intelligence op trying to restore some of the roads around to allow bypassing of the Dragon’s death teeth.

Because there’s a section that goes like this in and out of Russia.

You’re not allowed to stop your car.

Not allowed to.

That’s now been shut down.

Yeah, there’s a road, this one.

So in the southern Part of near Setima, there’s a road that, in order to get some of the villages and towns, there’s a section of the road that actually goes through Rochelle land.

And the.

The idea is that it’s.

It’s only about 1km plus it’s not.

Not very, very long.

But the idea is that when you’re driving on that road, you’re not allowed to stop.

You must continue moving because if you stop, then you’re considered trespassing on Russian land.

It’s always.

It’s always a challenge doing that last.

The drive there.

You just like.

You drive and you’re just like, okay.

But it’s also been controversy as well.

There’s been border guards who’s been captured and taken into Russia, and then there’s been exchange and commonplace in order to do prisoner exchanges as well.

But it is.

It is an area that you have to always be kind of very cautious about, especially about, you know, connectivity and what you’re listening, you know, the information that’s there.

And also.

So it’s something they’ll always be very aware of in.

Very cautious.

Yes, very much so.

There was also recently an incursion by some Russian troops near Narva as well.

So it’s getting very interesting in that area of town in Europe.

Well, I’ve been.

Most of what I’ve been monitoring mostly is around the ships, the ghost ships and the anchors and stuff, because that’s.

That’s a real.

That’s one of the biggest challenges is that one, they sever the cables.

In the last couple of years, we focused on resiliency in the energy cables.

So we have enough.

Because when Estonia cut themselves off from Russia last year, basically from the frequency.

So that was a massive change.

It was.

You’re talking about cutting yourself off and not just the frequency, but also the revenue that you get from the energy that you’re transferring into Russia as well.

But that’s been cut off.

And it means that the frequency between Estonia and Finland and Sweden and Baltics and stuff has to be at the right frequency.

So you have to.

At the right level.

And the moment, you know, those cables are severed, that causes a lot of disruption, a lot of challenges.

So deharmonization.

Yeah.

And we saw that in Spain happening not too long ago where they didn’t have the ability to switch the frequency or shut off the switches quick enough in order to stop the cascading effect.

But now that’s been kind of.

The resiliency has been put in place.

So there’s no capacity to deal with those situations.

But most recently it was the data cable.

We don’t have, you know, that too many resiliency in the data cables.

So what that causes then is either a switch to satellite communications, which of course then you have to deal with latency.

So there’s a massive challenge there, I think, for me, is that, you know, that’s the area that, you know, from a perspective that we need to have more protection over.

Oh, yeah.

Oh, definitely.

I mean, one thing I learned a couple of years ago was at the imo, International Maritime Organization, I went to their very first cybersecurity summit in London.

And funny enough, we had a storm and we lost power, second day.

But the things that I learned there were quite shocking.

I remember one speaker, he gets up and he goes, firstly he mentions that all hackers wear hoodies.

And I was there with a hoodie, and I had a hacker friend there with a hoodie.

We were the only two people with hoodies.

And then he goes, we need to change this idea.

But then he went on to describe.

And so did the lady speaker.

Gosh, I forget her name, but you should definitely have her on.

I’ll, I’ll get her name for you.

She’s an expert in it.

And she was explaining how basically because there’s a general lack of regulation in maritime, anyone can lay any cable that they want.

And so there’s this mishmash of all of these cables around.

And one of the big things that I believe part of this, I don’t even call it a ghost fleet, but the surveillance network that Russia had going before was called the ghost fleet.

Up in your area, the Baltics and Nordics, they were trying to figure out where some of these, say, non public undocumented data cables and energy cables were, because it isn’t.

You can cut an energy cable.

Oh, man, that hurts.

But also, if you cut data cables, one thing you have to realize, and this might not be common knowledge, after the Heathrow issue, just after Heathrow Airport, there was a fire at a substation nearby.

I had the.

I’m gonna sound like a LinkedIn lunatic, humble bragger person.

I had the privilege.

I was so honored.

But I was.

Yeah, I was first time ever, I got to keynote at Cambridge University.

Right.

Like, right.

And so the person after me was the lady who was put in charge of leading the investigation for what happened with Heathrow.

And privately, one of the big things is when you’re dealing with critical infrastructure and electricity substations Water, you name it.

It’s about 20% of the cost is actually mobile phone cost because you have to connect the things to be able to pull and transmit data because they might not be physically connected.

And these devices only have half an hour to an hour battery power.

So if there’s a fire and it drains the batteries, all of that stuff has to be brought up.

Just like imagine a big old network in the sequence that you have to bring it up, but then you have to worry about the batteries being charged up enough.

Right.

So if you’re cutting off the electric or the mobile data, then suddenly the water company cannot connect remotely to the water pump because you don’t want a water pump sucking in water boom, boom, boom, boom next to where people live.

So of course these things are far out.

So that’s the other dangers because once you kill the Internet, you’re also killing connectivity between networked critical infrastructure.

Now, I’m still wondering, I have not done a naughty scan cause I’ve been sick, but Iran is now back online.

And I was wondering the entire time not only about my, my friends and their safety, but what was going on with the critical infrastructure.

Because in order to do maintenance and things of that nature, say Honeywell and those types of manufacturers will connect and will poll and look at the entire environment.

And that was all cut off and it starts to drift and drift in some cases.

So it’s very, very, it’s very interesting how things have been developing in maritime and I hope that there are increases and that say less maritime powers that are in our wonderful alliance, start seeing the risks with maritime and start ramping up things between ice cutters and ice vessels because we definitely are going to have an Arctic war very soon.

Yay.

My, my, I’ve been to Greenland, so I’m not joking.

So yeah, we need to take what’s occurring now and turn it into a plan in a way that we can hopefully dissuade our frenemies and our enemies.

Yeah, it’s interesting when you’re talking about, because I remember years ago when I was working on the EU GDPR and it was interesting because I was doing at the time it was a lot of advisory for the maritime industry, satellite companies, shipping manufacturers, logistics.

And I remember we were doing a project, it was just after you were talking about the PIR earlier, we had this project called Looking Glass, which is where ships could centrally communicate in when they saw, you know, potential dangers.

And then that would broadcast out the rest of the vessel.

So, you know, avoid this area or kind of move away.

So, and it was interesting because at the, at the time and I was, I went to, to Belgium again to, to we were doing, the Ministry of Transportation was talking about, you know, GDPR and maritime side.

And then just after we had this massive EU council meeting and I remember afterwards we’re talking about, it was like.

And somebody said, as we were having a discussion about gdpr, they said, oh my goodness, what about international waters?

And that just brought up a massive issue because the whole idea was like an international maritime law for data across the cyberspace, but in international waters, of course it doesn’t apply.

Um, your point is, and that’s where you ran into lots of issues.

Things like autonomous shipping can be done because it would be considered no person on the vessel, therefore it could be salvaged.

Oh, that’s true, that’s true.

Because if there’s no person, you can take that boat.

I, I did that once in Florida.

But that’s, that’s when you get into the law of law.

International water territory, international maritime law applies and therefore then it’s space considered like in space the same.

And so that’s where we, you have, you know, when cables are moving through or go across international waters, you have to have some way of protecting and monitoring them, making sure.

Because, because a lot of whatever flag is flying on the vessel is the law that applies.

Yeah.

And usually it’s in the countries where there is pretty much very.

No, no existing law that’s really kind of strength strong enough to protect.

Correct?

Yeah, yeah, yeah, yeah.

So it was interesting.

And in that case when we realized that it didn’t apply and it became the maritime best practice framework came out which was focused, mostly focused at nearshore agreement because.

And it was like, you know, when you can get so many countries to agree on GDPR, then you’re talking about was 196, 197 countries had to agree on international maritime and getting something passed then was.

Was impossible to change because it’s a law that hasn’t changed for hundreds of years.

No, no, no, no.

So.

So one thing I learned really quickly at the IMO is although the International Maritime Organization is officially part of the un, it’s only for show.

They’re their own international organization.

Very independent, very separate.

Very, very separate.

Yeah, no, no, it’s only in name only.

Oh yeah, yeah, yeah, that’s nice.

But we’re our own thing.

Yeah.

Maritime.

If I have the opportunity listeners and I had a cyber sugar daddy, I would do a barrister one year course in London and concentrate on cyber maritime and space because they’re all quite interconnected and look at that.

And wow, maritime law.

It’s just so fascinating.

I love it.

So yes, yes it is.

I mean that’s me.

It was really interesting because after that then I got heavily involved in.

To the satellite communications because in space side and satellites it is very interesting into looking at the L band and cave end and then the security elements that gets into those, which was very fascinating.

Oh, would you mind if I brought up an interesting topic sort of related to that?

Sure, absolutely.

Yeah.

Okay.

It’s not an interesting topic.

It’s a bit of a dark topic.

I’m not sure you are aware of a particular situation.

I was told about it by a few individuals.

Now in Belarus there used to be about 50 licensed ham radio amateur radio folks, right.

And unfortunately they have been deemed enemies of the state suddenly and they are now being hunted down.

Some have been executed and the Amateur Radio association internationally has been trying to spread the word of the plight of what’s going on.

And it’s, it’s quite dire and it is a very unfortunate thing that seems to be a pattern more and more authoritarian regimes.

For example, during and now even after the Internet has come back on.

In Iran there were at the time before the Internet shutdown, 10 licensed radio operators as of last year in Iran and none of them have been back online since the Internet has come back even though they were already highly restricted and what type of communications they could actually do.

So it’s very, very sad.

But also shows the importance of radio.

And being able to so critical I think, I mean that’s, that’s, you know, when everything else doesn’t work, that’s what you’re, that’s.

That’s your doomsday fallback scenario.

Exactly.

For myself I, I got fascinated.

It must have been a little bit over 12 years ago when it was.

I was working in a lot of.

It was actually back the maritime side that we did a lot of RFID testing and I end up doing a lot with a Proxmark and of course flip of zeros and stuff like that.

And I became a ham radio certified operator as well just from that fascination of radio.

Because that’s the fallback is that one thing that you know, you don’t have to require on connectivity from satellites or cables.

You can just basically binds the signal across.

And it’s actually one of the things when you mentioned earlier about the critical infrastructure, these edge devices, typically cell phone or data stops working.

They usually do have a fallback to radio.

But of course it does require power and it does require near communication.

So, so it’s usually that’s, that’s sometimes a fallback for critical infrastructure.

You’re absolutely right.

Is that, you know when, when, when places go dark radio is, is, you know what especially low powered, you know, large antennas do have the ability to get information across.

That’s what you even.

That’s why Finnish had their TV antennas.

Finland was near Helsinki, not in the middle of Finland but near Helsinki because then it was able to broadcast radio and western signals to the Baltics when it was Soviet times.

That’s why a lot of these certain places, locations of antennas and TV towers was so that you can actually broadcast and they could receive it.

So sometimes it’s very key locations.

But yeah, it’s very concerning.

You know, especially countries which are very dictatorship and very controlling from a state perspective is that if you have the communication, the ability to communicate data in and out beyond their control because radio, you know you become restricted to the ham radio license restrictions and of course that if you’re able to, to secretly communicate information then yeah, it can be very damaging and very concerning.

It’s a shame that some countries are very controlling over that.

Well, I think a good index of how authoritarian a country is is the ability to get an amateur radio license.

Yep.

Yeah, I think that really.

Yeah, because that for them is losing control unless you control the person somehow.

So what other things have you been working?

What’s the most recent thing you’ve been getting involved?

What’s the latest project you’re working on?

Well, so there’s been a few of them recently.

Intel came out with a press release first in German, gotta center around the English one.

The book that I had held up before really I need to market myself more one day.

It’s actually field tested and it was based on some of the activities that myself and a group that I’m now a spokesperson for, White Lotus Security and what we had been doing was processing things like and receiving detainee lists, checking legitimate prisons versus torture sites, working on gathering information, helping to track and rescue political opponents whose children were politically kidnapped, help facilitate and a few other rather high profile things in Venezuela and trying to keep certain key individuals in Venezuela safe whilst also facilitating a variety of different types of evacuations as well as loads and loads of information about the ongoings of the then Maduro administration, the head of their intelligence and the cartel networks that they are connected with via the Minister of Transport which is the head of the intelligence brother.

It’s all very tightly controlled as, as.

They typically would have.

Yes, yes.

So after the interesting arrest of now former President Maduro, we decided to go public and we’re still operating in that area.

However, our big focus is to protect people and certain key individuals and to make sure that hopefully the government doesn’t turn its guns on peaceful protesters again that we know ahead of time.

Absolutely.

It’s important that people that are doing the right thing and the best thing stay safe and get the protection they need.

So how do you stay up to date yourself?

What’s the resources?

You mean how do you stay.

What, what, what do you, what books do you read or what podcasts do you listen to?

How do you stay up to date or what conferences do you go to?

What’s good?

Well, let’s see.

I go to a good deal of B sides conferences because I love the atmosphere and I’ll be doing the keynote out.

I, I seem to not be able to pronounce it correctly.

Galway.

Yeah, Galway.

Galway.

Galway, Ireland in a month.

But I also attend a lot of government sort of stuffy conferences.

Stuffy on the front where all the photographs are taken, but quite exciting in the back room.

For example, I got to witness a cyber defense agreement signed between Romania and Kenya late last year.

Right.

Capacity planning, I guess are supporting or sharing.

It now gives an opportunity for the EU to get intelligence directly from East Africa.

Now previous it was only the US it had two rather large listening stations, but the larger one at the time was in Dar es Salaam in Tanzania.

And now that the US is no longer a full on intelligence partner with the eu, that’s one of the resources.

And from Kenya and East Africa there are a good deal of very interesting a different type of terrorist activity flavor, a different type of cybercrime, just with a different view.

But now that information can be absorbed and processed and enriched and its relevance can be measured for the rest of Europe.

That’s where it goes back to the transparency, incorporation, that’s key.

It’s key that we have ways of working together and the information is flowing so we can all make critical decisions both directions for the audience.

What’s the best way if they do want to contact you or have questions or want to learn more, what’s the best way for them to reach out to you?

Ooh, golly g will occur.

Well, we’ll put up a link for my LinkedIn profile because that’s easy.

And also my website has email for journalists listed as well or my substack.

I keep forgetting all these Things.

Oh no, there’s so, so many resources today.

But yeah, I mean I like talking to people, I like meeting new people, I like to collaborate.

I know that we have to collaborate more and more and that’s one of the areas when you ask me, oh, what podcasts do you listen to?

Whatever, whatever.

My biggest source of information is directly from the people that I meet and their local news and I do a lot of that with where I will look at the right, left in between of local news, try to get the flavor, but also talk directly to people.

Like recently I’ve been running a series and I’ve gotta do some more from one of my sources from Iran of really what’s been for realsy going on and what some of the major issues are.

And in that way I meet a lot of people at conferences to be able to do this.

So I say network and go to conferences and talk to the people.

The talks are cool, but the people are even cooler.

Absolutely.

The networking and the.

And the connections it’s made is the most critical things and the ones that say as well.

So.

Well, many thanks for being on the podcast.

It’s always great talking with and we spent way too long.

I know it’s been way too long.

Next time I’m in Estonia I gotta visit you and I’m gonna do this in.

Perfect.

We’ll do it in person.

I’ve got a podcast studio over here, so.

Or we’ll go on on site to Narva and I’ll introduce you to the crows that I trained.

Actually there are some fascinating places in Nara.

Oh no.

Yes.

Yeah.

Oh, we can take our fishing poles.

Fishing poles, yeah.

So.

But absolutely we’ll find, find another follow up.

That’ll be fun.

Absolutely.

In person.

But many thanks for being on and you know, it’s always great chatting with all three insights and what you’re doing in the world and you know, the focus around keeping people safe and keeping information flowing and makes it makes the world a safer place and it also makes us more knowledgeable as well.

I think it’s really important is that information that gets shared that we can all consume it and make decisions in context out of it.

So it’s, it’s critical.

Thanks for being on and it’s always great chatting with you.

So for everyone, this is the security by default podcast.

Bringing awesome guests knowledge, insights, lessons and world experience in order for you to help incorporate that into your own daily life and work.

And hopefully we all have the same goal to make the world a safer place and a fun one at the same time.

So stay safe and thank you until the next time.