Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Craig Newmark on cyber philanthropy, internet pioneers and a “cyber civil defense”
Guest:
Craig Newmark
Published:
Updated:
Duration:
34 min
Episode summary
Philanthropist Craig Newmark is most famous for founding the classifieds site Craigslist nearly 30 years ago. But he’s recently earned praise in the cybersecurity community for pledging $50 million in early 2022 to support a cyber civil defense initiative through his namesake philanthropy.
On the latest episode of WE’RE IN!, hear Craig describe what he means by cyber civil defense and listen to his candid thoughts on everything from quantum computing to the dangers of state-sponsored disinformation campaigns. He also shares insights into the philanthropic strategy driving many of his contributions to the field of cybersecurity and continuing education.
Tune in to hear more about:
Challenges in fostering collaboration across the cybersecurity community, from the White House to organizations like the Aspen Institute’s Cybersecurity Group
How a “cybersecurity nutrition label” could empower consumers
Craig’s participation in the Whole Earth ‘Lectronic Link, one of the oldest virtual communities
Cyber civil defense starts at home Newmark wants everyone who is good with computers to protect their own Wi-Fi, phones and laptops, know what is happening on their home network, and run software that flags anything suspicious.
Fund doers and push collaboration Rather than run programs himself, he funds groups like Consumer Reports and the Global Cyber Alliance and keeps reminding them to work with each other, which he says is harder than it sounds.
Education should lead from basics to careers He favors self-instructional material that teaches civilians the basics and leads people who enjoy it toward professional training, including team exercises to defend and attack networks.
Labels for connected devices A cybersecurity nutrition label would show a product, from a car to a coffee maker, has been tested in good faith to be reasonably secure against malicious hacking.
Threat models are personal Newmark says everyone's threat matrix is different, the hard part is getting started, and constant worry is itself a loss.
Notable quotes
Our country is under increasing attack by people who wish us harm. I figure I can help, so I should.
…a product with a cybersecurity nutrition label is basically a product which has been tested in good faith to be reasonably secure against malicious hacking.
There are real problems. But if you're worried about it all the time, then you've already lost.
Broadly speaking, knowing when to get out of the way is a really big deal and a highly desirable skill.
Questions this episode answers
What is cyber civil defense?
Newmark describes it as everyone pitching in, much like civilians did in World War II, by learning to protect their own systems at home and on the road. It requires more education and better software to detect when something fishy has happened. Read this section
Why did Craig Newmark pledge $50 million to cybersecurity?
He said the country is under increasing attack by people who wish it harm and he figured he could help, so he should. The realization was gradual and accelerated by conversations about a foundation's cybersecurity project. Read this section
What is a cybersecurity nutrition label?
It marks a product that has been tested in good faith to be reasonably secure against malicious hacking, an idea the White House was discussing. Consumer Reports, which Newmark funds, was working on it with NIST and others. Read this section
How can the industry close the cybersecurity workforce gap?
Newmark favors cybersecurity education at civilian and professional levels that is largely self-instructional, since he believes many people suited to cyber learn by teaching themselves. Read this section
Will quantum computers break encryption?
In theory a quantum computer with enough qubits could break current encryption, which is why CISA and others are discussing quantum-resistant algorithms. Newmark is not convinced quantum computing will get that far because of decoherence. Read this section
About the guest
Craig Newmark is a philanthropist best known for founding Craigslist. At the time of recording, he had pledged $50 million in early 2022 through Craig Newmark Philanthropies to support what he calls a cyber civil defense initiative, funding groups such as Consumer Reports, the Global Cyber Alliance, Girls Who Code, the Girl Scouts and Vets in Tech. He was an early member of The Well, helped build home banking for Bank of America, and spent about fifteen years doing customer service at Craigslist after stepping back from the CEO role.
And I'm Bella DeShantz-Cook. We have a very special guest for today's show, renowned philanthropist Craig Newmark, perhaps best known for founding, well, Craigslist.
Fun fact, I once made ends meet working at a paint shop while singing furniture on Craigslist. That was back in the early twenty tens, and it could be surprisingly lucrative.
not too late, and we will hear a little bit more about Craigslist today. But the main reason we invited Craig to be on the show was his whopping $50,000,000 pledge in early twenty twenty two in support of what he calls a cyber civil defense initiative through his namesake Philanthropy.
Craig will explain exactly what he means by cyber civil defense, and we'll talk more about the impact that some of that money is already having. But first, let's hear a quick word from our sponsor.
We're in is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven pentesting, intelligence, and vulnerability management from a global network of vetted and trusted researchers. Their work is enhanced by smart technologies to accelerate your critical cybersecurity missions. Synack gives businesses the best chance of finding every vulnerability that matters. Find out more at synack.com. That's synack.com.
So, Craig, thank you so much for joining us on the podcast. I wanna jump right into it. In April, you committed through Craig Newmark Philanthropies to donating $50,000,000 to an array of organizations that help Americans face escalating cybersecurity threats. That is a big chunk of change. Can you share your reasons for doing that and the rationale behind that?
Our country is under increasing attack by people who wish us harm. I figure I can help, so I should. Like I tell people, a nerd's gotta do what a nerd's gotta do.
there a specific moment in time, maybe an event or a particular hack that made you think, oh, I should really care and start doing something about the cybersecurity threat? It was just a gradual realization accelerated a bit by conversations with Kelly Born from Hewlett Foundation and their cybersecurity project. Somebody needed to stand up. And frankly, cybersecurity is something that I know something about, so I figured I was the guy.
Frankly, my thesis work had a bit to do with security way back in 1976. And so over the decades, I've been, paying intermittent attention to cybersecurity issues, sometimes more than other times. For example, when I helped build home banking for Bank of America, I was one of a couple of people who kept saying, we need to think about this. My contributions to that project were minor, but I was persistent.
Well, since you're... We're going back in time here a little bit to your thesis work, and I did wanna, you know, get a chance. It's not often that I get to talk with an Internet Pioneer here, and so I really wanted to go back and ask about The Well, the Whole Earth 'Lectronic Link. Guess that gained notoriety in the '80s and '90s. Many of our listeners, I'm sure, are familiar with that. How did your participation in that Internet salon kind of shape your views on these subjects?
Yeah. I joined The Well right around thirty years ago, and the community spirit was a big deal. The idea that people should help each other out, should give each other a break now and then should even be, one's brother's keeper. That spirit was very much part of the well. When I moved to, San Francisco about a year after, I found that spirit alive and well, not only at the well, and I went to a few of the, parties, but I saw it there. I saw it at the, meetings of the virtual reality special interest group. People could help each other, and everyone got ahead.
Going back to your commitment through your philanthropic organization to helping protect against cyber attacks, what areas are most interesting or maybe most frightening to you?
Of greatest interest is just the need for everyone to pitch in and play a role much like people did during World War two. The idea is that we all, if we're any good with computers, should learn how to protect our stuff, whether it's Wi Fi and our systems at home or our phones or notebooks when we're on the road. Everyone should be able to do that, but it does require additional education for what I'm calling Cyber Civil Defense. The idea is that at home, you should have some idea of what's going on on your network. And overall, you should have software running in your systems to tell you if something fishy has happened. Some of that software exists, some doesn't.
But in terms of the people I've helped fund, I've helped build a network, a team of people, focusing on that kind of stuff. For example, Consumer Reports, they're doing a lot of curation work. That shouldn't be surprising since they've been doing that for eighty five years. Back then, the washing machine was high-tech. Now we have to be concerned with our Internet connected devices like our cars and coffee makers and refrigerators.
Consumer Reports is such a trusted authority in so many realms of product reviews. I remember even, I believe it was virtual private networks that they did a deep dive into the value proposition, and maybe oftentimes some of these cyber tools are misunderstood. I was hoping you could speak a bit to the challenges of building this cyber civil defense. You have so many people who might not be as technically astute or know what to do with enabling multi factor authentication or setting up password managers or taking some other steps. How do you get through to those people, and are the organizations you're supporting working on that dilemma?
Well, in terms of getting the people to do the job, I'm working with people who I can see already know how to do it. Consumer Reports in particular, but there's also the Global Cyber Alliance. And then there's a bunch of people... Bunch of groups who are doing good work, educating people. That includes Girls Who Code, the Girl Scouts, Vets in Tech, which trains, vet centers and military spouses for careers in technology. The idea is that a lot of people are doing a lot of good work already. I guess my job is to help them do that and maybe to get them to work with each other. Sometimes that's the hard part. You have to remind people that we succeed when we work together, And that's showing a lot of promise and I think is beginning to work.
And on that, with this idea of organizations that are specifically for getting more folks into cybersecurity. What do you think is holding people back? Like, what's holding us back from getting more people into this field?
A lot of it is getting people the education in basics so at least they could protect themselves. And then the education which can take them from the basics seamlessly into professional level education. So the theme of the teams that I work with are let's get some education out there and necessary tools for civilians, including myself. And that education should lead someone to reflect that, hey. If they're good at cyber on that level and if they find it an interesting challenge, then they can consider a career in that. So basics. And then for people who are good at it and who are looking forward to that as a career, then they can proceed there.
I was really amazed to read in a recent ISC2 report that in 2022, I guess we hit a record number of cybersecurity professionals in the industry worldwide of 4,700,000. That number really struck me. Was really impressed by it. But then the report goes on to say that there's still this shortage of millions of individuals. I think the number floated with something in the 3,400,000 range. How do you scale up addressing this challenge?
The way the people I work with and myself are doing it is by trying to figure out how to provide cybersecurity education, again, on civilian and professional levels, and to try to make it, self instructional so that people can teach themselves basics. And a lot of people can do that. That's how I relearned software engineering and new languages over the last thirty years, even though I haven't coded anything in the last twenty. But the idea is that the kind of people who I think might be good at cyber, a lot of that has to be self education. I don't know if that's true. That's just what my gut tells me.
I think a lot of the information that I got when I was first getting into the field was self taught. And so I'm kind of inclined to agree with you that having this information available for folks that are interested in self teaching is really important. But I also struggle to understand why that's the route. But I wonder if maybe it's partly because of how quickly this industry changes. I know when I first started getting into cybersecurity, a lot of the information that I needed to learn was in almost forums. There wasn't always a lot of published information about it. It was just sort of having to do research to see who's posting things right now. But as folks that are already in the industry, how do we help create resources and learning opportunities for folks trying to get into the industry?
My guess is help the people who are building the material. Again, like the Girl Scouts, the idea is they have a cybersecurity merit badges already, but more work needs to be done. And then we need to take that education and education from, other places and make it available to everyone. That has to be accompanied by, the software people need, and some of it may not exist. And finally, there may be be a big need to create, teaching environments. For example, in the transition from civilian to possibly professional level education, we need to, make it easy for people to work with others to build a network and defend it, and then, conversely to work with a team to, attack networks.
So those two together would be graduation exercises maybe at civilian and professional levels. The deal is we all need our home systems to be periodically pentested because that's a big deal for everyone to some extent. It's a much bigger deal, of course, for people who may wind up being targeted one way or the other.
Pen testing is music to our ears here at Synack. We do know a thing or two about that, I will say, and it is important ultimately. But both postures are. Right? Even this notion of defense and getting the word out to as many people as possible, I love this idea of a cybersecurity nutrition label. What do you mean by that?
Well, what I mean is what the White House is talking about in that a product with a cybersecurity nutrition label is basically a product which has been tested in good faith to be reasonably secure against malicious hacking. For example, you want your car to be tested so that you have confidence that a hacker wants to steer it in the wrong place when you're on the freeway or maybe driving along a cliffside road. You want some confidence that your coffee maker won't engage in a distributed denial of service attack. You want some confidence too that the... That your coffee maker won't try to poison you. And since, people like me have, unintentional bioweapons development going on in the back of our refrigerators, we, want our refrigerators to be relatively safe from happening.
And most of all, of course, we don't want all the refrigerators, coffee makers, and other appliances. We don't want them networking networking together, achieving sentience, and then harboring ill will towards us. It would call itself Skynet, and the next thing you know, it's gonna send Arnold Schwarzenegger back in time to, kill someone who would otherwise prevent the rise of the machines.
See, as alarmed as I should be about that last statement, it's really the shrimp that I just remembered in the back of the refrigerator that has me more worried at the moment from your earlier comments about needing to stay on top of these things. Actually, you talk about all these devices and connected technologies. I remember one of the most striking examples, actually, Andy Greenberg over at Wired demonstrated that live hack of, I believe it was a Jeep Cherokee, I'm not mistaken, not to pick on particular brand, where as he's driving, these elite hackers were able to break into the car and grind it to a halt on the freeway and kill the engine. It blew my mind to witness that and see where we're headed as a society. Yeah. And now these conversations are happening, as you mentioned, at the highest levels in the White House. Really, are you part of those conversations, or have you been monitoring with interest?
What I'm doing is funding the people who are doing the actual work who are going to the White House. For example, the people at Consumer Reports. We are, talking about it pretty actively. The deal is it's for real. The Consumer Reports people are really good at this kind of stuff. They'll be working with NIST and other people who are really good at this stuff. And I'm working with the Aspen Cyber Security Group to make it happen. The idea is that I can provide the resources needed for people who do good work to do more good work and to do it collaborating in partnership with other groups to do the work. My job is to provide those resources to bug people into working together and then to remind them over and over to be working with each other.
Yeah. I was gonna ask, are you... Are we any closer to the... This notion of a of a cyber civil defense since you made the announcement of this $50,000,000 pledge?
I wanna think so. I see people working together that normally might not because collaboration is much harder than it sounds. So people are working together. We'll be working with a lot of different groups, even CISA and the part of the White House National Security Council that does cyber. The deal is that people wanna work with each other, and maybe they just need someone bugging them to do it. As I also... I like to refer to the way that... Well, what Batman would say, maybe I'm not the nerd you want, but I'm the nerd you got.
I did want to flip back to Craigslist for a second and just, as you were spinning that up and as Craigslist was starting up, I understand this is with the caveat to listeners that I understand you haven't had an active role there in many years, but I'm curious, were you faced with any big cybersecurity challenges getting such a huge network built?
Well, when it was just me or maybe in our first year when I was still foolishly acting as CEO, I would tell people, hey. Think about cybersecurity. I would ask specific questions, for example, regarding firewalling and subjects which I barely understood, like SQL injection. I would, from the beginning, I would talk to the system administrators about making sure things were patched properly because that was true, for example, when Craigslist ran as a guest on someone's servers. It was true when we were running on a machine which was administered, you know, as... For people who were doing, us a favor and then into the actual real days of Craigslist.
I did turn down the CEO role after probably, less than a year of doing so. People helped me understand how much as a manager I suck and how much there was a real need to get someone else in that role. I did then go into full time and pretty intense customer service, did that for about fifteen years, which can take a lot out of you.
I can imagine. Stepping back for a second and thinking about the scope of the work of your philanthropy and the donations that you've committed to making, it's hard not to think of this word legacy, looking at it from the outside. What would you want that to be, either from Craigslist or a combination of your giving? How are you thinking about your legacy in in in cybersecurity? I guess we'll we'll we'll start there.
I'm, not really thinking about my legacy, not in those terms. I do think ahead. My planning horizon is a couple hundred years, although that really illustrates that I read too much science fiction. But I figure I need to set in motion a number of good activities which will perpetuate themselves. I do like to tell people that, I'm committed to customer service in one form or another, and, you know, I will continue to do so, but only as long as I live. After that, well, I'd like to say it's over, except I'm now working on things including Hologram Craig, but that's for another day.
Oh my goodness. So I know you once told Insider that if you could have any job in the world, not your own, that you might've wanted to be a journalist at the top of their profession. What would you say if you were answering that question right now?
I think I would change my mind since journalists get a lot of abuse. And I've learned since then how hard the job is. So if I had a choice, I might wanna be a quantum physicist at the top of their profession. That's something if I had another century of life, might wanna be able to do except that, oh, physics and the needed math are really hard. At the end of my freshman year in college, I realized that and decided to, not go into those areas. That's when I decided I would go into computer sciences. Of course, for maybe as long as a year, I thought I would be able to go into artificial intelligence.
That's being a little bit ahead of your time perhaps. It's funny you talk about your career trajectory. I come from a journalism background. Before joining Synack, I worked at Politico and a publication called E&E News. I now run our cybersecurity publication called README, which covers a lot of the issues shaping the conversation around cyber today. But I think there's a reputation among journalists that, Okay, maybe we couldn't do the math or couldn't speak the language of physics to go down that path. I do still find it so fascinating. I'm a big sci fi fan myself, honestly, as well. I'm curious, with quantum stuff, that does have direct relevance to the cybersecurity world. Have you followed these threats proliferating about quantum computing? I guess, I don't fully claim to understand it, but just making it way easier, I guess, to break encryption protocols.
Well, it's something that I am I am paying attention to. In theory, a quantum computer with sufficient, qubits could break existing means of encryption, which is why, CISA and others are talking about encryption algorithms that aren't susceptible to quantum decryption. That's a big deal right there. I'm not convinced that quantum computing will ever be quite that developed because of the problems of, I guess, its decoherence. But I do pay attention to it if for no other reason that to understand a lot of contemporary hard science fiction, you have to know a fair amount about quantum physics, how networks work, how viruses and evolution works aside from the more traditional stuff like orbital mechanics.
I think so. One thing... I think it's interesting hearing you say that because, I don't know, I'm always fascinated by what cybersecurity things people find like genuinely worrisome versus what you know, might not really being impactful, at least not impactful for us in our lifetimes, for instance. As someone who has kind of a lot of experience seeing different cybersecurity threats and thinking about these things, do you have any tips, I guess, for making that distinction? What is a threat that we should actively be worrying about right now today versus, you know, science fiction?
That's highly individual. Everyone's, threat matrix is different. The hard part and the part which people find it hard to start is evaluating the threats, to oneself, to one's family, business, and so on. The idea is that, the hard part is to get started, and then you start to think about details like, well, how many doors and windows does your home have? Is anyone actually gonna try to get in there? Are you worried about ninjas rappelling down from adjacent buildings? Repelling ninjas is not part of my threat matrix. And I'm working carefully that that should never be a part of that.
Do you think that that is like that exercise of understanding your own threat matrix, do you think that that is something that is or is not well understood kind of by the general public?
I don't think the need to think about it is generally understood. And the problem is that a lot of people overreact to to possible threats. That's particularly true regarding, street crime these days because there are, corrupt people in politics and media who find it profitable to wildly exaggerate crime in the, in The US right now. These are real problems, but you don't have to live a life of fear. Some people like to live, fearfully as a kind of hobby, And we need to encourage people who might indulge in that to avoid panicking. There are real problems. But if you're worried about it all the time, then you've already lost.
Well, speaking of real problems and fears, based here in Washington, DC and with my background in journalism, it was with some degree of alarm that I witnessed some of my fellow countrymen marching for reasons that I thought were not founded in the reality that I experienced. That was certainly around the election issue, around the validity of certain results. It's been very eye opening to me to see that play out and to see how deep rooted some disinformation can really be in our society. I know that's been an area of interest for you as well. Can you speak a little bit to that piece?
Well, right now, our country's adversaries use disinformation as part of what they call a hybrid warfare to divide us and weaken us as a country. However, dealing with that kind of stuff requires the communication skills that you don't find with a nerd and, well, like, you met me? And so what I've done is I've helped people who are good at this stuff learn how to deal with the issue. People are only beginning to learn the techniques that need... That are needed to defeat our country's adversaries. The techniques include prebunking and maybe flooding the zone with facts. But the deal there is that I help the country by supporting the people who could do a good job, and then my role is to stay out of their way.
I should probably avail myself of that option a little more often sometimes, but it's very tempting to inject yourself in areas where maybe you shouldn't be. So I can certainly respect that decision making on your part to say, Hey, here's what I care about. Here's where I want to support. But I wanted to flip back to sci fi because it's such an interesting, both personal interest of mine, but also just in the history of cybersecurity. You had the first mention of the concept of cybernetics, of cyber technology emerging from a sci fi book. What's on your bookshelf these days? What sort of ideas are you encountering?
In my Kindle app on my phone, I have a collection of books, science fiction, some of which involve, oh, future politics and warfare, some which just involve what happens when you try to build an interstellar civilization, and there's a lot of leftover autonomous weapons from previous wars. That's what's on my virtual bookshelf these days. There's also the latest Ian Rankin, John Rebus novel, part of a series set in Edinburgh. So I'm reading a lot. I'm reading all the time. The only downside in a way is that I prefer reading ebooks on my phone, which means that I don't buy paper anymore, and I I don't have much to add to my bookshelves, which is sad because the place I live in here in Greenwich Village has a perfect library, and filling those shelves has been more of a challenge than it should be.
I hear you there. I've yet to fill up my shelves. I moved somewhat recently and it's been difficult. So, okay, quick fourth wall caveat here. It'll take us a couple of weeks to edit this and get this out. With that said, what's next for Craig Newmark Philanthropies? What's on the horizon for you?
More of the same in that I need to find better ways all the time to help people doing the heavy lifting for our country. An evolving focus area for me is journalist protection because it's something I've been working on without focusing that way. For example, I support a couple of pro bono legal efforts like at Yale Law. And partially announced, but not fully, is an effort called Reporters Mutual, which is affordable media insurance for journalists and small news organizations. That's a program growing out of the White House Summit for Democracy, which has turned it over to USAID.
I do. I have one last question. Guest. This should be an easy one or it'll be either the easiest or hardest question of our day. We ask all of our guests this question. What is something that we wouldn't know about you just by looking at your LinkedIn profile or your general online social media presence?
Most of what I'm about is part of my, online presence. I mean, if you looked at my LinkedIn stuff, which is fairly formal, you wouldn't see, for example, that I, support a pigeon rescue. And for that matter, you may see that in the past I participated in pigeon related photo ops. I don't make clear that in such situations, you want the pigeons to be wearing pigeon pants. That's a thing. And basically, they're diapers for indoor pigeons. And I speak from direct firsthand experience. You want the pigeons to be wearing pigeon pants before they fly on your shoulder.
You know, I thought... In in digging around your online presence a little bit, I saw a suspicious amount about squirrel proofing. So that actually tracks.
I love that. I love that. Well, thank you so much again for for joining us here. Really appreciate also just on a personal note your contributions to the cybersecurity community. I think it's certainly gone... Hasn't gone unrecognized, and it's it's very important. Yeah.
Does your penetration testing meet compliance requirements? Does it adhere to the most rigorous security standards on the market today? Now you can find Synack on the FedRAMP marketplace for all of your agency's security testing needs. Synack recently received moderate in process status from FedRAMP, meaning that even more US departments, agencies, and contractors can utilize Synack's global network of trusted embedded security researchers for on demand around the clock pentesting. Learn more at synack.com. That's synack.com.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, you can share this episode with your friends and make sure to check out all of the other fascinating people that we've already interviewed. We're also open to your suggestions. If you know someone that we should be talking to, drop us a line at we'reinpodcastsynack dot com. That's we'reinpodcastsynack .com.
