Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Kim Zetter on election security, Stuxnet and Substack
Guest:
Kim Zetter
Published:
Updated:
Duration:
35 min
Episode summary
Kim Zetter is a former staff writer at WIRED and author of the seminal cybersecurity book “Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon.” Her work has appeared in The New York Times, POLITICO, The Washington Post and regularly in her Substack newsletter, “Zero Day.” In this episode, Kim talks about her approach to reporting, what sparked her Stuxnet investigation and how the discovery of that malware fundamentally altered our global cybersecurity conversation. Why you should listen:
Hear from one of the most influential and knowledgeable journalists writing about cybersecurity today.
Get her take on some of the biggest security stories of 2021 such as Colonial Pipeline and the Pegasus Project.
Learn more about the key policy debates around election security and critical infrastructure protections.
Stuxnet normalized digital attacks Kim argues Stuxnet taught other countries that cyberattacks were acceptable and effective for resolving political disputes, especially since the US faced no repercussions.
The US reacts rather than prepares Ransomware had hit US institutions aggressively since about 2012, but it took the Colonial Pipeline shutdown and panic buying of gasoline to drive mandates for critical infrastructure.
A bank attack is a trust attack The biggest risk of a systemic attack on the financial sector is a run on banks and a loss of trust in the system the whole sector depends on.
Everyday spyware is the broader risk Most people will never be targeted with Pegasus, but stalkerware, hacked baby monitors, home cameras, and careless app installs pose real risks to ordinary users.
Offline voting machines can still be hacked Kim reported proof that voting machines had been connected to the internet, and notes that rogue insiders or connections to other systems put even offline systems at risk.
Topics covered
Thought Leadership
U.S. Public Sector
Notable quotes
I can't keep up. There's no secret. It's really overwhelming.
We tend to react to things. Right? We don't prepare for things.
The budget comes when you make it a priority.
All of the technologies that you bring into your home that you love because of what they can do for you have a double edge to them.
Questions this episode answers
Why did Stuxnet not lead the US to secure critical infrastructure sooner?
Kim says Stuxnet happened overseas and did not target the US, and the US tends to react rather than prepare. It took Colonial Pipeline, with its economic and national security consequences, to get lawmakers to act. Read this section
What would happen in a systemic cyberattack on the financial sector?
The main fear is a run on banks by individuals and large businesses, and more broadly a loss of trust in a financial system that runs on trust, which could cause the banking system to collapse. Read this section
Should ordinary people worry about Pegasus spyware?
Kim says most people will never be targeted by Pegasus, which is sold mainly to governments, but criminals and corporate espionage actors have had similar capabilities, such as turning on a phone's microphone, for nearly twenty years. Read this section
Can online voting be made secure?
No. Kim says the Department of Defense, NIST, and other agencies concluded that, given ballot anonymity requirements and unsecurable home devices, there is no way for online voting to be secure. Read this section
About the guest
Kim Zetter is a cybersecurity journalist and former staff writer at WIRED whose work has appeared in The New York Times, POLITICO, The Washington Post, and Vice. She is the author of Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital Weapon. At the time of recording, she had been freelancing since 2016 and publishing her Substack newsletter, Zero Day, focused on nation-state attacks, cyber warfare, election security, and critical infrastructure.
And I'm Bella DeShantz Cook. Today, we're talking with Kim Zetter, one of the most knowledgeable journalists covering cybersecurity today and author of one of the best books about hacking, Countdown to Zero Day.
We'll talk about that book, which chronicled the Stuxnet attack over a decade ago, but also some of today's most pressing cybersecurity issues like ransomware, threats to the financial sector, and her reporting on some of the really problematic security issues with elections too. But first, a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers twenty four seven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
Awesome. So we're gonna jump right in. You've been writing about cybersecurity for a while. You've reported for Wired, Politico, Vice, The New York Times, and you've also written a book about Stuxnet called Countdown to Zero Day. How can you possibly keep up with everything that's going on in cyber today? And how do you choose what subjects and stories you wanna cover?
I can't keep up. There's no secret. It's really overwhelming. It didn't used to be. I remember that there used to be days where you were fishing around trying to find something to write about. And that's just not the case ever anymore. So, yeah, it's overwhelming for everyone. I mean, only thing that I can do to handle that is really to pick some specific areas that I wanna focus on and then kind of ignore everything else. And so the things that I focus on are nation state attacks, cyber warfare, the exports of digital tools, election security, things like that. So I really had... And critical infrastructure. So I really had to narrow the focus just in order to manage what I'm taking in.
Those are the areas that really interest me. There's just so much going on and it's the way that I've always actually handled my beat is really follow what interests me. And that's worked to a certain extent. I love intelligence, I love secrets, digging into things, investigative stuff. So that's where my interests lie And that's really sort of the yardstick that I use when I'm when I'm looking at something, things that are happening. Does it fall into the categories that I really care about and that I wanna know more about? So I'm really following my own curiosity.
I personally like secrets too. So you're right in my wheelhouse. I like to I like to find people's secrets, learn about people's secrets. And when I say people, I mean, like, you know, intelligence stuff.
I finished reading Countdown to Zero Day, not too long ago actually, and I really loved it. I thought that not only it it does such a good job of kind of discussing the technical nature of Stuxnet, of the the malware, how it worked, what it did to Iran's nuclear program. But beyond that, it really sort of feels like a spy thriller. I found myself reading and getting so caught up in the story, like, what's going to happen next? Like, how how can this all be true? What inspired you to write about that? And then also, not only to write about it but to write the book in the way that you did?
Well, I'm really happy to hear that it felt like a spy thriller to you. When I was approaching the book, I knew that I didn't want to write. I've been approached in the past about writing books and I really didn't want to write the books that I was asked to write. I don't like reading books. I mean there are a lot of really great books that I read for my work and they're really informative. But I didn't want to write a book that was just straight forward. Okay, here's a chapter on one thing and then here's a separate chapter on another thing and then another chapter on another thing. I didn't want to write a book like that. I wanted it to have some kind of narrative flow. I wanted to be a story teller and this is one of the first stories that I felt like was it merited book length treatment and also had that ability to be told in sort of a narrative line.
And so that was why I approached it the way I did. I wanted to write a story that I would want to read and that included in you know adding all of those footnotes in. I don't like when I read a book and the footnote is just a citation, title of a book or the title of an article. I want footnotes that are going to expand on the things that are in the body of the work and so you find more nuggets in the footnotes. I really love that. And why I decided to tell the story at all was it was just so meaty. There wasn't that much written about cyber warfare at the time. The government wasn't, admitting that it was engaging in any of this. And I really felt like there needed to be some public dialogue on the topic. And it was just also so meaty in the sense that it wasn't just about the technical issues, it was the geopolitical context around it.
So I wanted to tell that whole story of not just here's an attack and how it worked and how it was captured, but really why why it was done and why this appeared to be the first one done by The US. Like when I when I entered the story or when I before I started, the research, my assumption was this was not the first attack like this from The US. I was convinced they've been doing this probably for a decade and we just didn't know about it.
Yeah. So Stuxnet was Stuxnet was discovered in 2010 and I thought there was no way that something this sophisticated was the first. I felt like there must have been operations leading up to this that led to the development of something of this scope. And also just, you know, it was just so brilliantly done that I felt like there had to have been other sort of practices at the very least. And then I was surprised to find that there actually probably weren't. You know, what General Mike Hayden told me was that there were so many legal restrictions around engaging in these kind of operations that it was just an utter headache for anyone to even propose doing something like this for the longest time. And so I suppose that it really took the danger that was imminent from Iran having potential nuclear weapons and also the urgency of Israel pounding on The US doors saying something has to be done that really sort of put this one over the edge and convinced whoever was making these decisions that this was doable in a way that wouldn't cause collateral damage, also wouldn't trigger war.
When Stuxnet came out and then it was identified and people started really investigating it and looking into it, that's a game changing piece of malware. You know, nobody else had seen anything else like that anywhere. And so that's one of the most interesting things for me. It's sort of the beginning of... So everything coming forward from that point has been based off of, can I make something as good and sort of world shattering as Stuxnet? Can I build the next whatever that was? And so it's... It seems really interesting to me that we hadn't been doing those things prior to as a buildup. Like, I feel like we almost had to have been.
Well, there was electronic warfare. So you... The US has a long history of engaging in electronic warfare, taking out communication systems digitally. We have that going all the way back to the nineties, you know, Bosnia and things like that, where the government was engaging in this kind of activity but for really strategic military purposes. And so this was the first kind of example of this. And there had actually been proposals in the past of doing maybe something similar to this. During the Iraq war, there had been a proposal to go into the banking systems and eliminate money or transfer money or something belonging to Iraqi leaders, and that was nixed because they didn't want to have some kind of collateral implications of this.
So there have been discussions about this and there have been... There's always been this desire to engage in this, but again the legal limits I suppose prevented it. And I think that post Stuxnet, I think what Stuxnet really did was it taught a lot of countries that this is... It's possible to do this, this is obviously acceptable if The US and Israel were engaging it and really why haven't we been doing this as well? And so that's been the problem post Stuxnet is that everyone now has sort of picked on this as viable and legitimate way to resolve disputes, political disputes, diplomatic disputes and not have repercussions for it because certainly The US suffered no repercussions.
Oh, yeah. I mean, it's funny though because, when Stuxnet was, when it was discovered that Stuxnet was targeting critical infrastructure and targeting industrial control systems, there was an expectation that we would probably get some blowback attacks against the same kind of systems here in The US. And we didn't for a long time, but I think that you know it was a matter of first of all even recognizing this as a target. The InfoSec community didn't have an understanding and really didn't have anything to do with industrial control systems. All the focus was on IT systems, the business network, the corporate network. And they had been blind to that. There were people that were in the industry who specialized in this area but they were so limited in number. And they certainly didn't have kind of the attention of the public. And so Stuxnet really helped shine a light on industrial control systems as a target at all.
And the InfoSec community realized that they needed to school themselves on what these systems were, how they were used, what their vulnerabilities were, and then of course what the potential risks were. So I think that it took a lot of time to get up to speed. And then even then the government, the US government wasn't paying attention. And the Obama administration was the first administration to really sort of put cybersecurity as a priority, but they didn't really put critical infrastructure as a as a priority in the sense of using the government's weight to force security on critical infrastructure. And we're actually only seeing that, you know, in this last year really, where the mandates in the wake of ransomware, in the wake of the colonial pipeline attack.
But why do you think it took like, you know, Stuxnet like we've talked about? It didn't happen yesterday. It happened a little while ago. You know, why did it take that? That story is so scary. Right? Like, there's... That's such a serious example of targeting critical infrastructure. Why did it take ransomware attacks, which to me at least... I mean, also scary, but at a different level.
Why is it taking these ransomware attacks for people to start listening about, you know, securing critical infrastructure and industrial control systems and not things like Stuxnet?
Well, Stuxnet happened overseas. It wasn't conducted by an enemy of The US. It wasn't targeting The US. We tend to react to things. Right? We don't prepare for things. We react to things. And it's not that we reacted to ransomware because we... Ransomware has been going on for, I mean, you know, very aggressively against The US, against US institutions has been going on since twenty twelve, twenty thirteen. It's only because it targeted something that was recognized as a national security risk and also an economic risk. It's really coming down to the economic issues around Colonial Pipeline shutting down that pipeline. If Colonial Pipeline had not shut down that pipeline, I'm not even sure the attack on Colonial Pipeline would have had the consequences that did have. It was really, you know, lawmakers on Capitol Hill seeing people standing in line under what was really a fake manufactured shortage because there wasn't a gasoline shortage.
There was simply people panicking who created a shortage. And so I think that, you know, it was really the economic factor here and the national scale of the potential consequences of gasoline shortage, of a fuel shortage that really sparked this. And as far as, you know, not addressing this stuff for a decade, certainly with the election stuff when we saw Russia trying to interfere in 2016, that woke up DHS. That someone, somewhere needed to have some kind of authority or influence over election officials. And then I think from there, it sort of naturally rolled out. And that really depended on who was in DHS at the time. You know, Chris Krebs took a big role in that and deciding, okay, we are going to see some authority here and start taking some steps.
How do you think we can get consumers to care about that more? So we talked earlier about the type of stories that you cover and how they have to reach sort of a certain level of, I don't know, what you said earlier, but, you know, like covering broader than just like personal security. And I think that there is to me, and I think to a lot of folks that I know, when we hear these stories online about big, you know, industrial control system attacks and ransomware, that seems so far away from, like, personal security online. But ultimately, like, it's it's, you know, part of the same issue. How do we get consumers to care, you know, both about the big scary attacks, but also about their own personal security online?
Well, mean, you know, the Colonial Pipeline, you know, it's it was industrial control system. It feels removed from people, but really brought that home of course was the gasoline of the pump. And that's what got people caring about it and that's what got the headlines. So I think that, you know, until it actually does hit home, people seeing these stories about another breach of T Mobile customers. I mean, how many how many times does T Mobile customer information get breached? You know, once a year probably. So I think that, you know, getting customers to care about it, it really unfortunately comes down to the the same thing that gets lawmakers to care about it. Until it hits you personally, they don't. I mean, lawmakers, you know, they passed... This is always sort of my standard. For years, you could get information from Department of Motor Vehicles about anyone, from their driver's license information.
You could get information about video rentals. And it wasn't until a lawmaker who was running for office had his video rental history publicly exposed that we got a law that said that you cannot, share video rental history information, which is, you know, it feels like the most the most inane information, right, that needs to be protected.
You recently wrote a piece, for the New York Times, DealBook sort of outlining the risk of the systemic cyber cyber attack against the financial sector. What would the consequences of of that kind of an attack be? Maybe not just the immediate consequences, but some of those consequences that people don't necessarily think about from a secondary perspective.
Well, we saw a a parallel with the colonial pipeline, the run on gasoline. You know, I think the worst, concern for financial institutions is the run on the banks and not just among individual account holders, but you know large businesses who have lots amount of money in those banks, money that they need at a moment's notice to cover payroll, to cover loans, that kind of thing. Know the fear is that there would be some kind of you know residual panics that would cause a run on banks. Now as I wrote in the story, the banks are supposed to have enough money on hand in cash liquidated that would cover all loans if any loans got called, holdings within a bank. So legally they are required to have enough money if they do have a run to cover all of that.
But it's also the lock... The loss of trust in the banking system. I mean, entire financial sector runs on trust. You trust that when you send a bank transfer over the wire that it is going to arrive and it's going to get approved and it's going to get deposited into your account and the accurate amount is going to get deposited. Now we have a certain amount of checks and balances over that to ensure that and we have also guarantees so that if it doesn't happen the way it's supposed to happen, the bank covers that and you don't cover it to a certain extent. There are limitations on that of course. But that's the way we operate. We operate on this trust system with financial sector. If you lose that, then you potentially have a situation where the, you know, the banking system could collapse. And I think that that's the biggest concern.
That actually reminds me of something that you recently also wrote about from a privacy perspective ultimately is about the, Pegasus spyware case. How there are multiple law enforcement agencies and intelligence agencies who were identified as as utilizing this particular software to conduct surveillance operations in a pretty... Or several unique instances. I was wondering if you could elaborate a bit more on that.
Yeah. I mean, so Pegasus has been around for a while, and we've seen, you know, stories trickling out about activists and journalists, who've been targeted with it and have suffered repercussions for it, some thrown in jail, some tortured. And also family members, I mean the journalists whose family members have been surveilled, not just the journalists. So we've seen these stories trickling out and then it really just sort of hit ahead when we got the recent sort of Pegasus project that was done by multi, more than a dozen I think media outlets who were privy to this list that we still don't know the nature of this list, but it was identified as being a list of potential targets or a wish list of people that Pegasus customers, NSO Group customers would like to be spying on. It was a list of 50,000 and it's unlikely that this was actually a list compiled by NSO or any single customer.
It's unclear what the nature of the list was, but it's... The bottom line is that there are a subset, a small subset of people who are on that list who actually were targeted with Pegasus software.
Just to give those listeners a bit more of an idea, there's there's a particular quote I'd like to read from your article that specifies the Pegasus tool gives NSO clients powerful abilities to remotely and surreptitiously extract stored and real time data from phones without tipping off the user that their device is spilling its secrets. Like, this is heavy information. Think about where you go, location tracking, text information that's stored on the phone, a full gamut of collecting of data, browser history, social networks, all that sort of stuff.
I wanna put that in context though, because the NSO Group software, Pegasus is made by an Israeli company called NSO Group. This software is sold primarily to governments, law enforcement, intelligence agencies. You're probably not going to be infected with this software unless you are of interest, if you're an activist, if you're a journalist, if you're some kind of political... Politically active in those kinds of countries that will go after you using this software. But that doesn't mean that you won't be targeted by other kinds of software that criminals and corporate espionage actors will infect your system with. I think the most powerful effect for anyone who's targeted with this is not what websites you're going to visit. It is your email exchanges, your text exchanges, and also the ability to turn on the camera and the microphone on the phone.
Now I wrote a story about... This is back in DEFCON, probably 2003 about a piece of malware that would surreptitiously turn on the phone, its microphone, and turn that phone into a listening device. So that's almost twenty years ago now. That capability already existed in the hands of cyber criminals or people who are doing corporate espionage. But I think it's only that, you know, the NSO group got a lot of attention or that the stories about it got a lot of attention. And people get very, you know, are sort of stunned by that. But the majority, the vast, vast, vast majority of people are never going to be targeted with Pegasus. But they may be if you're working for a corporation like Apple or Microsoft or anyone else that has intellectual property that China might want or that your adversaries in another country might want.
Corporate espionage has been going on for decades and this enables that. Know, we take our phone everywhere and when you go to the restaurant, take that phone out and you put it on the tabletop with you. You put that phone, on the table in the conference room when you're having meetings with your colleagues. So that's the concern.
It's helpful and I think important to clarify that those of us that have kind of a regular role in society are probably not at risk of being targeted by this kind of software. But I think for me, like knowing that this type of software exists still makes me nervous. Like, just because I won't be targeted by some foreign government doesn't make me necessarily, you know, what about folks around me or other just general danger? I guess my my question to turn this into a question, is it still important for us who who know that we won't be targeted by this level of attack to to care about this and to make sure that we're protected against it just in case?
Absolutely. Yes. And and the thing is is that you or the people around you can very well be targeted by, for instance, stalkerware, by a spouse or an ex, know those kinds of things. You can very easily be infected by that stuff. Parents put tracking software on their children's mobile phones. Well you know that tracking software can be taken over by an adversary, not adversary, but by criminals whatever. You know we see this sort of thing like with baby monitors, it seems like the most innocuous thing you can put in your house. And then of course hackers are taking over the baby monitors. And those baby monitors are not just recording the sounds in your child's room, but they are recording videos in your house. Your home surveillance system can be hacked into and then someone can be watching you if you've got surveillance in the bedroom or if you've got surveillance anywhere else in the house and your family members are engaging in conversations, that can be picked up.
Alexa can be picking up conversations, we've seen that. So I think that you know, it's not just, I mean focusing on the phones is important, but I think that people need to have a broader awareness of all of these things that feel very convenient. All of the technologies that you bring into your home that you love because of what they can do for you have a double edge to them. And you have to understand the risks and potential consequences of bringing that stuff into your home, of using it, of installing apps on your phone. I mean, will install anything on their phone, if it's a game or it helps them shop or allows them to find restaurants. I mean, I guess I'm saying that we focus too much on the stuff that makes the headlines and completely ignore the innocuous things that are... That you're downloading onto your phone with no thought at all.
Yeah. This is... My my friends get so tired of me complaining about all of their smart home to buy... Smart home devices, but it's it's... There's a real reason to be concerned. So on a on a slightly different note, you've written a lot about election security. And I wanna know, were you surprised by how politicized election security became in the last election? And do you think that that will maybe hinder any progress that has been made for election security across this country?
I mean, I've been writing about election security for a long time, and I think the problems are not... There there are some concerns, obviously, that it's become so politicized since the last election that it's hard to discuss vulnerabilities in voting systems because there's a fear of someone using it to politicize and falsely talk about fraud in elections that didn't happen. So there is a concern of that, but I think it was more concerning to me that for twenty years no one was paying attention to all of the security experts talking about problems with election security and election officials really not paying any kind of mind to them simply because the voting machine vendors told them, don't pay any attention to these.
With the information that's been available from, say, Stuxnet for the last ten years, we should have had the ability to fix systems and prioritize systems to be focused on from a security perspective. With Election Security, we've had, you know, a number of years for Election Security to be focused on and developed and really secured and honed, and and and it seems like we haven't been able to do that. Do you think that there's a... Or there's a connection between either people's inability to drive success in the realm of security, or is it more of a of a budgetary funding perspective?
The budget comes when you make it a priority. I mean, when it's clear that this is something that you have to do, you're gonna find the budget for it. When regulation comes down, you have no choice but to find the budget for it. So it really is a is a top down issue here. In critical infrastructure, everyone thought, you know, why would anyone come after my manufacturing facility? Or why would anyone target this small little dam in Upper State New York or something? You know, in Florida where we had the water treatment plant, years, you know, years, a decade since Stuxnet, and this water treatment plant in Florida is not using two factor authentication. So it really is, you know, it's the responsibility of all of the people who are administering and controlling and owning these facilities to take it seriously. But also in the case of that Florida municipality, they didn't have the budget. And these are...
This is a government issue because those municipalities are, you know, the the critical infrastructure water treatment plants are controlled by the municipality.
So you see people's push nowadays. Right? Like, why can't the government just get up, you know, up to date with things that are currently going on? Why don't we just do with election, you know, election capacities? Why don't we just do things from a remote capacity? Let me elect from my computer. Let me elect from my mobile phone. Let me, you know, let me do whatever.
I The the the Department of Defense looked into this. NIST looked into this. Multiple government agencies looked into this, and they all concluded that given the current state of technology and given the way we do elections in The US and how there has to be anonymity in casting a ballot and the fact that the voting would be done on someone's at home device that cannot be secured, there is absolutely no way currently and there's no logical way going forward given what we have and the way we do elections for this to ever be secure.
Like one story that I wrote about election security that stands out for me because it was kind of a holy grail in covering election security for so long. And that was a story that I wrote in 2000... I think it was eighteen or '19 about we finally actually had proof that voting machines were connected to the Internet. Now, as long as I've been covering this, election officials and voting machine vendors had been telling me and telling everyone else that these voting machines are never connected to the Internet and therefore they can't be hacked. That latter part of course is not true regardless of whether they're they're connected to Internet or not. Anything can be hacked and if it's not... And anything that's not connected to the Internet can still be hacked if you've got a rogue insider or if you've got that system that's not connected to the Internet somehow communicating with another system that is connected to the Internet. Election workers will will often plug in their phone to be charged on an election management system.
Election officials were trying to assure everyone that there was no way that anyone could have hacked the two thousand sixteen election because the voting machines are never connected to the Internet. The intention there was to calm the public and and to not create the kind of panic that we saw, of course, in 2020. So I understand the reason and the impulse to calm everyone and say the voting machines are never connected to the Internet. They've been told they weren't connected to the Internet. So that was a story that really stood out. I contacted DHS before I published that story. DHS had been given this information, and other entities had been given this information about the voting machines connected to the internet months before, a year before. So, you know, it's a frustration when these things do kind of hit a tipping point that it took it took a long time for them to reach that point.
When I see those kinds of things, it really, I don't know, irks me inside a little bit. I do have a question about a substack that you recently created. Well, not recent, but a substack that you did create called Zero Day. And I'm kinda curious what recently led you in that direction.
I went in that direction. Really, it was a measure of where we were in the pandemic at that point. I've been doing freelance since 2016 and freelance budget started to freeze up in the pandemic. And so there wasn't a lot of and also a lot of the focus of journalism turned to the pandemic. So there was a move away from you know buying stories about security. So it was really a measure of sort of hearing from other journalists what they were doing and how successful it was working out for them and feeling like if freelance budgets are drying up, I needed to find some other income. I also earned half my income through speaking engagements. And so those started drying up because conferences got canceled. So it was really a measure of trying to find some alternative way, to bring in some income during the pandemic.
And so a lot of people were trying to convince me of going independent like this and I just decided to give it a try. I really didn't expect much from it. I didn't think anyone would notice. I thought that I would just sort of do it quietly and then see how it went and maybe drop it after a month or so because I really didn't expect it to take off. I don't think it's the future of journalism. I think that there is a desire among journalists to have more control over their work to get a better value for their work. So there's really this desire on the part of journalists to find some kind of independent way to control their time, to control their talent, and to control what they produce. But I don't think it's a replacement for regular media. I don't think it ever will be.
I'm always looking for what will be. Again, that criteria for me is that it has to be media enough and it has to be something that I can do in a way that can be done as, telling a story. I think that that book was two years... It took me two years to do that, nights and weekends and holidays. And so if I'm gonna take something like that on, it's really gotta be something that I'm feeling that I want to read the story as much as I hope everyone else would. So So that's kind of a high bar for me.
The book's available on Amazon. You can buy it there in either hardcover, paperback, or Kindle or audio. You can find my work. I mean, I'm I'm publishing on the Substack in Zero Day. I'm on Twitter, so people can always sort of follow me and see what my interests are and what I'm writing through Twitter as well.
And in closing, there's one last thing that we ask all of our guests on the show. What is one thing that we wouldn't know about you from looking at your LinkedIn profile?
I love the gossip rags. Or maybe you would. Maybe you would because I tweet a lot from People Magazine. But, yeah, I I tell people this. It's it's my palate cleanser. I do so much.
I do so much heavy reading for my work, so much technical stuff and government reports and it's all just so dry. And I mean, it's it's fascinating because I love the topic, but I also just need sometimes pretty pictures. And that's why and that's what I rely on, these little pictures.
Cloud cybersecurity is a large penetration point for malicious actors. See how your organization can be protected at synack.com. That's synack.com. Check out the show notes to learn more.
