Topics:
Jake Braun, cofounder of DEF CON Franklin and former White House acting Principal Deputy National Cyber Director, joins the Nexus Podcast to discuss cybersecurity for water and wastewater utilities.
DEF CON Franklin is a volunteer-driven program that connects security researchers and hackers associated with the DEF CON conference with U.S.-based water wastewater utilities and K-12 schools. This summer at DEF CON, DEF CON Franklin and the National Rural Water Association announced the Water Watch Center, which provides support to water utilities in the event of a breach.
Jake explains how both initiatives are progressing, the cybersecurity challenges smaller water utilities face, and what the government can do to help from a policy and regulatory standpoint.
MIMOSO 0:15
All right, welcome back to the Nexus podcast. Jake Braun is my guest. Jake is uh a co-founder of DEF CON Franklin and former White House acting principal, deputy national cyber director. If you are unfamiliar, DEF CON Franklin is a volunteer-driven security program. It connects security researchers and hackers associated with DEF CON with uh US-based water and wastewater utilities, as well as K-12 schools. Very interesting. So this summer at DEF CON, uh, DEF CON Franklin and the National Rural Water Association announced the Water Watch Center, which provides uh support to utilities in the event of a breach. So Jake is going to take us through both programs, and uh obviously this is a very timely conversation. I've been looking forward to this, so I really appreciate Jake coming on. Uh, before we start, just my usual reminder to subscribe to the podcast. It's really the best way to keep up with new episodes and check out uh all 141 that uh maybe you've missed so far. So if you're new to the show. So thanks for listening. And uh, we are on all the platforms and easy to find, so please subscribe to us. So let's get started with today's episode. Hi, Jake. How are you?
BRAUN 1:27
Good, how are you? Thanks for having me.
MIMOSO 1:29
Thank you. Yeah, you're welcome. I appreciate you giving me the time. Um, tell everybody a little bit about yourself and of course DEF CON Franklin. How'd you get involved there?
BRAUN 1:38
Sure. Uh so I'm Jake Braun. As you suggested, uh right now I um the executive director of the Cyber Policy Initiative at the University of Chicago and uh also CEO of a small uh consulting firm in Washington called Cambridge Global Advisors. Uh previous to that, I was the um acting principal deputy national cyber director in the White House, which is a very long way of saying that I was the essentially the COO of uh the new cyber office they set up uh in the White House back in in uh 2019. Um and uh in that capacity, uh, you know, we did a lot of work on uh water security, um uh issues with cyber workforce and and so on and so forth. And so when I left, uh was talking to my good friend Jeff Moss about uh some work we had done years ago uh when he and I and a couple friends of ours, Matt Blaze and Hari Hirsty and Maggie McAlpine, uh started the the voting machine hacking village or the voting village as we call it, uh DEF CON. And uh when we when we started that, uh, you know, we there was a lot of great things that came out of it. Um, but two of them were we started doing uh reports annually uh from the voting village on kind of what uh hacks we found and and and how they were relevant from a policy perspective. And uh and we started putting that in an annual report. And we also uh encouraged folks from the DEF CON community to volunteer to support local election offices and stuff. And so as Jeff and I were talking when I was leaving the White House, we were like, gee, why don't we extend that to all of DEF CON? And so now we do an annual report for DEF CON uh via this project you mentioned called Franklin, um which Jeff and I co-uh co-run that identifies the best and brightest uh um discoveries or announcements or uh innovations at DEF CON. And then we do some policy analysis on why that matters um from a policy perspective. And so we put that out in our Hackers Almanac that we put out two of now. Uh and uh um we'll we'll have another one we're working on right now for Blast DEF CON. And then also we've asked uh uh the DEF CON community to s to step up and help these really under-resourced water uh utilities um to uh um you know help up their game in cyber because right now they they're uh kind of uh at the top of every bad guy's target list, yeah, particularly the ones that support military assets, data centers, or hospitals. Um so it's a little bit about my background and a little bit of a kind of an overview of what Franklin is uh is all about.
MIMOSO 4:24
So from your experience, how would you characterize kind of the current state of affairs in terms of cybersecurity at water utilities? Like you mentioned, there's so many small community systems, and you probably got you know very strapped IT people trying to not only keep the water clean but try to do some security or they outsource it. Um, you know, what's the current state of affairs from your perspective?
BRAUN 4:50
Sure. So I I really think that water right now is where energy was about 10, 15 years ago. So I remember uh when I was in the Obama administration, I was White House liaison to Homeland Security, and I was talking to a friend of mine who was in the White House at uh the Council on Environmental Quality. And they were at the time really thinking through how they were gonna put together the smart grid. And as we remember, you know, the smart grid was okay, now we're gonna be able to, you know, um understand how and where to send power so we're not wasting all this power and and so on, is gonna be this great thing for the environment and for rate payers and everybody else. Um and so I remember uh saying to him, this is probably in 2009, I was like, hey, has cyber ever come up? Cybersecurity ever come up in these conversations? Uh and he was like, not once. No one has ever mentioned cybersecurity once. And that was 2009 in the energy space. Now, of course, energy is probably the furthest along next to maybe the financial industry or the defense industrial base, um, folks like that, in terms of uh the security of the industry. They've really upped their game tremendously since then. Um water uh is is kind of in the same place they were. You know, nobody's really talking about cybersecurity and water, um, even you know, four or five years ago. It's it's only really, you know, Vol Typhoon and and a few other things that have gotten uh broad swaths of policymakers and others to really even talking about what cybersecurity and water means. Um and so folks are really now um starting to pay attention and and starting to realize that they can't really rely on the herd theory anymore. You know, it can't just be I have to be uh a little bit faster or frankly luckier than than the other guy. Um the bad guys, the bad guys are after me. Uh and I think you know, Iran to your uh what you were alluding to earlier is has played a big role in that. Um, but really we're we're kind of starting at zero. Um and it's not because folks are dumb that work in this space, this just wasn't in their job jar until very recently.
MIMOSO 6:55
Sure.
BRAUN 6:56
And so, you know, we're we're still at a point where we're you know having talking to folks about changing default passwords and and uh you know turning on multi-factor authentication and so on. Um, but but I think the biggest need in the industry right now, by far and away, now that we've had um DEF CON researchers in these utilities for you know over two years now, is asset inventory. Um the you know, this is you know, control number one. If if we had the folks at the Center for N Security on the call right now that maintain the 20 critical cybersecurity controls, they'd tell you asset inventory is the most important thing. Well, turns out in the water space, that is absolutely true. Um, and I think maybe even more so uh for folks in the water space, uh just getting a sense of of what in their environment is connected to the is connected to their network uh is is really a non-trivial task and and and and kind of the basis for them understanding how they can secure their their utility and not just secure it by the way, but also in the event of a catastrophic effect um attack, understanding how to take it offline and run it manually, which in theory everybody knows how to do. Um, but what we've realized after uh you know the uh alleged Iranian attacks, um it in practice it's unclear if folks know exactly how they would go about running these plants.
MIMOSO 8:26
As you suggested, that's not necessarily uh uh from uh a negligence point of view or not wanting to do something about it. It's resources, it's maybe even experience with cybersecurity, right? There's just oh god.
BRAUN 8:40
Oh absolutely. I mean, I remember talking to somebody the other day uh at one of the water conferences, which we now go to all the time, where a bunch of you know hackers and cyber people walking around these water conferences, which is kind of funny, by the way. Um, as a side note, if you're uh if you're on a Zoom call with them or whatever, and uh you have a hacker on one screen and a water guy on the other screen, I swear to God, it's like they're cousins. Like they're they're you know, they'll usually have the like the long beard, um, you know, and kind of the frumpy clothes, uh, and uh and whatever. It's just like the water guys, a little bit more of like a Duck Dynasty flavor, and the hacker guys usually got some maybe piercings and like other maybe color going on uh you know with the hair. But it's like the same dude with a slightly different, you know, uh um uh take on take on that look.
MIMOSO 9:31
But anyway, they need some sunlight.
BRAUN 9:34
Yeah, right, right. Um so uh no, we were talking to somebody the other day, uh, one of these water conferences, and you know, he was asking us about whatever, and you know, it turns out he's down the road from some military asset. He doesn't know exactly what they do, but knows the military runs it. Um, because nearly all military assets are ran on civilian um water, by the way. Uh and he's like, Well, what should I do? Blah blah blah. And so we were talking to him about some of the basics like I was just describing. And he was like, Yeah, I mean, I just God, I just don't have a lot of time, you know, because I run the Fourth of July parade as well for the town and blah, blah, blah. Literally, this guy runs the Fourth of July Parade and runs the water utility. And and again, no one ever told him, you know, that cybersecurity was part of his job until, you know, that conference was, I think, the first time he heard it. Sure. So it's not like he's dumb. It's just, you know, he's got a lot going on, has no resources. Um, you know, if if if they want to raise rates in these towns, um, that'll be the last time any of those people hold office. Um, who vote for them to raise rates, so it's completely unpalatable to do it. Um, and uh uh, you know, we're that's you know, that that's that's the that's the situation in most of the country.
MIMOSO 10:50
So with Franklin, it's it's largely a volunteer effort. Um how's that initiative gone so far? Uh are you finding folks want to step up? And you know, what are what is some of the kind of the output that's coming out of those interactions?
BRAUN 11:07
Oh God, I uh yes, people want to step up. I mean, you know, after we announced it a couple years ago, uh, we had so many signups in the first 10 days, we had to shut down the intake form because I didn't have enough staff to process all the people signing up. Um, and truly it's it's been invaluable. I I think that uh if you if you um won't, you know, when we move on to talk about the Water Watch Center, which I think you mentioned uh you want to talk about at some point.
MIMOSO 11:34
Yes.
BRAUN 11:35
Um had we not um had Franklin in place and had all these uh um folks who've who've raised their hand to volunteer, I wouldn't have been able to put folks, uh put you know, some of these really amazing technologists um in a handful of utilities for uh about two years uh to really study what is going on in these utilities, what is you know the the um you know the kind of baseline um you know uh uh status of the security and networks and so on and so forth. You know, but for that, um we would have made all, you know, we we wouldn't have been able to come up with what we've done. And in fact, um it's not just the folks we were able to embed in in several utilities, but also we had folks who were doing research on you know different options and so on. So, for example, one of the options that uh was proposed early on was providing a bunch of free uh products and stuff from some of the huge cyber companies. And we found out early on that's probably not gonna work for most of these little guys. Um, because, and by the way, like 95% of the utilities are are these little guys. Right. Uh, because they, you know, a lot of that free stuff is kind of free like a puppy. You know, it's it's uh yeah, here buy my I'll I'll I'll give you 20 free licenses, but you gotta buy my $150,000 box. Or I'm gonna give this screen that's gonna blink when something bad happens, but you have to find some guy, you have to pay $200,000 a year uh to to watch the screen and know what to do when it blinks, you know. Sure. Um, you know, when by the way, the highest salary and the water utility is $50,000 a year, you know, um in many of these places. Makes sense. Uh yeah, exactly. So so we had a lot of folks doing research like that on kind of what solutions and stuff made sense. And so uh uh because of all the the research, the this you know, security in terms of up in the game of a lot of these utilities, um, et cetera, et cetera. Um, but for that, we wouldn't have been able to launch the watch center. And now um that DEF CON community and the Franklin volunteers are still critical to what we're doing uh with the So let's talk about the Watch Center.
MIMOSO 13:48
Just kind of how does it work? So this is basically an initiative to provide support in the event of an attack and if in the event of a compromise. Um take it from there. What what happens? How do people get involved?
BRAUN 14:01
Well, I I I would actually say that's a little bit more prophylactic than than than just uh IR type uh situation. So uh essentially, so think about it as if it's like the human nervous system, right? So um if you think about the the human nervous system, so you've got the brain, right? And the brain takes in all this data and and makes decisions. And so that would be like the National Rural Water Association, which is this uh trade association in the water industry. They support about 90% of the utilities in the country. They've been funded by the federal government since 1976 to provide technical assistance, albeit not cyber, but up until now, um, to water utilities. And so they're kind of like the hub, like the brain. So uh anonymized data from water utilities will go up to the National Rural Water Association. It'll be able to understand trends, problems, solutions that it can push down nationally, blah, blah. Okay, but as we all know, um you don't want your brain making some like really fast decisions. So if your hand touches a stove, your brain doesn't, you don't want your brain deciding to pull your hand away. You have nerve nerve clusters around your body that would pull your hand away, right? Um and uh that can operate in in in a millisecond. And so uh that um so separate or one layer down from the brain, we have uh MSSPs. So we have seven right now. We're gonna expand to ten, one for each region of of uh uh federal region of the country. The federal government split up into ten regions, so we'll have one MSSP per region. Um we're not exactly that rigid, but basically. So those MSSPs are connected directly to water utilities. Uh and those uh so they're they're now providing uh, and this is where the prophylactic side of this comes in. They're providing you know security uh um advice, resources, etc., helping folks with things like asset inventory, making sure they're turning on their multi-factor authentication, software analysis, all this type of stuff. Um they are uh the conduit from the utilities to report up this anonymized data to the brain, but they also can act independent of the brain. And crucially, we've made them can the utility or the MSSPs connected to each other so that they can also act in concert if need be without the brain, if there's a if there's a massive attack quickly or something like that. Um and then uh down your kind of nerve endings are back to our Franklin volunteers. So we still have volunteers who uh we deploy out to utilities when needed. They can help with IR, for example. They can also help because we have so many volunteers. If we've got a utility that's really far away from an MSSP, we can set up a volunteer to kind of drive out there and help get them hooked up or help walk through um somebody through kind of you know ins and outs of some of the basics and so on. And so they're kind of like the nerve endings that that go out and kind of do things. Um speaking of the nerve endings, we do still have um in our scenario here uh a uh a big kind of challenge that is yet to be addressed that we're working on with DARPA. And so that is uh a massive workforce challenge. And so, you know, our volunteers are awesome, they are salt of the earth, these are some of the most brilliant hackers you'd ever meet in your life, and they're you know great Americans and good citizens and and and want to help their country and and their community, however, uh there will never be enough of them to cover 150,000 water utilities in the country, right? Um and certain certainly not, you know, at the you know uh standard rates we would need we need that coverage to happen. Yeah. And so uh, but the thing is at the same time, at any given moment, we've got about a 500,000-person shortage in cyber professionals to open cyber jobs across the country. So the idea we're gonna magically come up with 150,000 new cyber people to work in all these utilities, which by the way, often have as their you know, upper band income or salary $50,000, $60,000 a year, which almost nobody in cyber uh would agree to work for. Right uh, we've got a big challenge. And so we're working with DARPA to do some research uh where they're putting together some uh uh working with some of our utilities to create a digital twin. So a uh a digital twin of the environment of the utility, and then they drop a red team agent, a blue team agent into the twin, so not in the real environment, but into a twin. They fight each other a gazillion times until we can figure out how we help the blue the blue team win. Uh this is to research and assess. Um we don't know if this is gonna be the right solution, we're testing it. Um but could it be the right solution to dump a bunch of these blue team agents in these water utilities down the road that we just know are just never gonna have the resources to hire a cyber professional? And uh so again, we're not sure that's the right answer. This is a test. It's it's it is research, and DARPA is doing fundamental research, which is which is kind of where we are at this point, but it is um another key component of what we're doing uh to kind of try and think a few steps down the road where it's like, okay, great, we've got our nervous system in place, we've got our NRWA being the brain, we've got our MSSPs as the nerve clusters, we're doing all this great stuff. But oh, gee, a year from now when we're trying to really scale, it's like there's no humans to do it. Well, yeah, hopefully this might be an option that that can enable us to really scale um as this as we prove out the model.
MIMOSO 19:42
That's the DARPA Castle program you're referring to, right?
BRAUN 19:45
Yes, that's the DARPA Castle program.
MIMOSO 19:47
That's a really fascinating initiative. Yeah.
BRAUN 19:49
It really it really is. Every time I talk to those guys, I'm it's one of those things, you know, where you do these different projects and you're like, oh man, I wish I could just spend all my time on this. That's one of those, like every conference call I get off, I'm like, I wish I could just do this, but you know, there's people with much more boring things that actually pay for this and they have to do.
MIMOSO 20:06
Um just to go back to the Water Watch uh center for a second, uh, what's the outreach like there? Are you working through the uh N N RWA exclusively or knocking on doors, so to speak, and uh if there's an incident or a need?
BRAUN 20:22
Yeah, it's really all of the above. I will say one of the one of the really, you know, having having been in the in the election security space when this first all kind of popped, you know, back in 2016 after the election and the Russian interference and everything, um, you know, one of the one of the big issues in the election industry was that everybody was like, oh, there's no real threat here, you know, the the voting machines aren't aren't connected to the internet, which is just like what they mean is they're not persistently connected to the internet. I mean, I don't even want to go down this rabbit hole, it's so frustrating, but like, you know, all this stuff's secure, you couldn't really hack it at scale, you can't do blah, blah, blah. You know. Um, and it was just this kind of denial of the problem and this kind of visceral reaction against anybody who wanted to criticize, you know, call their baby ugly, and so on. Um, when in fact it was really the cyber community coming in and saying, hey, guess what? You guys are next on the list of the bad guys you're going after. You know, here's how we can try and, you know, up your game in cyber. It's been really the polar opposite in water. Um, you know, we we certainly there's folks who are like, hey, I could run this thing manually if I had to, but none of them are saying, I would prefer to run it manually, so leave me alone and don't talk to me about cybersecurity, you know? And none of them are saying, like, oh, this thing is totally secure and you could never hack my water utility. They're like, please tell me the things to do, you know. Um, and so I I think that we have really seen a um uh a far different and frankly more mature and responsible reaction by the water industry um to this than we did by uh from the election industry. Uh when all the when when when they went through pretty much exactly the same thing 10 years ago.
MIMOSO 22:04
Right. So given your past government experience, I I have to ask, are there is are there policy things, are there regulatory um initiatives that the government could push forward that would help here? What's what's missing from the government? Or are they doing stuff behind the scenes that we're not necessarily aware of?
BRAUN 22:27
Sure. Well, I mean they're they're funding the Castle program, you know, obviously, because that's a DARPA program. So um, and and that's really good, and they should keep doing that. Um uh, you know, the other thing is the WWC is funded um exclusively from philanthropic dollars right now, and that's not sustainable for the future, you know. Uh we don't ask uh, you know, if the Iranians are uh uh invading the country, we don't ask, you know, the Ford Foundation to fund the Kalamazoo County Water Utility to come out and fight the Iranian Red Guard off. You know, uh that's the federal government's job. The federal government does national security and they should they need to fund the security of uh our water utilities. Uh so that's one key policy uh uh decision that needs to be made. Is the government, the federal government needs to stand up and say, you know, this this is our job because it because it's a national security threat. Um that's number one. Uh number two is uh I while I I don't think that uh more regulations are are necessary, uh I do think that there needs to be uh kind of more concerted effort to really by the federal government to really prioritize which utilities are the most critical. So, i.e. those that support military assets, because they're at the top of all the bad guys' targets list, those that support hospitals, um, because for obvious reasons, and also this may seem counterintuitive, but those that support data centers, not because we need to subsidize security for the big AI companies, but because those communities who's uh who have a water utility that now supports a data center, unbeknownst to them, are on the top of everybody bad, every bad guy's target list. And so um, you know, we should be uh we can't let those communities suffer just because somebody put a data center in their backyard. Yeah. And uh, you know, so I would recommend prioritizing those three categories first and then really going out and uh, you know, showing up with the local National Guard general, um, and the adjutant general, as they say, um, in a particular state, you know, somebody from CISA probably, um, somebody from the governor's office, maybe the mayor, uh showing up at the utility and saying, Hey, guess what? We're not kidding. Um, we'll and you know, you we really need to up your game in cyber. And oh, by the way, we're gonna pay for it. Um, they would have, you know, they would largely be welcomed with open arms by most of these utilities, and it would enable us to really get after the the um you know highest impact uh uh utilities uh quickly. And and that's it, it's a workable list. I mean, you're talking about a few thousand, not a hundred thousand. You know, that's that's a that's a a number that you could have a few hundred people, uh, or maybe even a few dozen people in the federal government um organize around, you know, knocking on all their doors over the course of six to twelve months and and getting those utilities up to speed. Um that you don't need a law for that, you don't need legislation, you don't need anything else. You just need the government to make a policy decision to intentionally do that targeting and do that outreach. Right. And then, you know, the and then implement the basics that the you know the federal government can do in its sleep.
MIMOSO 25:49
And just to go back to the WWC for a second, in terms of like uh sharing information on threats as they're happening, is there kind of like a real-time mechanism? Um, is it going through the N RWA or something else? I mean, how how are how are you guys sharing threat telemetry, etc.?
BRAUN 26:11
Yeah, exactly. So um we've we've kind of built the back end uh for this and and actually have data um moving up to it now. Uh it is, yes, housed at the National Rural Water Association. Uh and and it's housed there for a for a pretty specific reason, kind of back to your point about policy um opportunities. Yeah. That since the National Rural Water Association is already funded by the federal government to provide technical assistance to water utilities, uh, we believe that by building this capability at NRWA, that will make uh create an easy button for the federal government to just say, okay, great, they already have this capability, fine, we'll just kind of increase the line item in the federal budget that already goes to them annually, and they can just do this uh moving forward. But um, yes, that is the the capability is built at NRWA. It is uh there is data flowing there now. Um, we're just hoping to really uh um be able to scale it dramatically in in the coming months and years and and hoping the federal government is gonna step in and do its part for that.
MIMOSO 27:19
Uh any early wins or success metrics you can tell me about the WWC so far since it was announced in August?
BRAUN 27:29
Sure. Uh couple things. Well, oh, by the way, first of all, I um um I I hope that you uh and your listeners um uh notice our play on acronyms here. Uh so the WWC, so it's like you know, water closet, so WC, but this is the WWC. So but then also it's a triple play on acronyms because it's like WWE, but this is WWC. So like we're we got a lot going on with this acronym, very intentionally. Um, thank you. So I had a feeling. Uh but anyway, we love our acronyms. Um uh yeah, so uh we've actually been uh contacted by some folks who were uh several entities that were affected by the recent attack uh that you referenced and have been supporting them. Um we're happy that you know the words getting out that that we're an entity that folks can trust to reach out to that you know we're not making any money off this. This is, like I said, philanthropically funded. Um, but at the same time, we're bringing in, you know, the best in the business, um, you know, from the water perspective, you know, the NRWA, and and also these MSSPs from the uh cyber perspective, and not to mention DARPA and so on. So um that's been a big success for us that we've that we've been uh asked to help with some of the remediation and so on, uh following that. And then separately, um, you know, because uh for the first two years it was so hard to gain adoption um uh that we really thought that our our big challenge after announcing the WWE C was gonna be uh you know just getting folks to take the free help because there's a lot of these utilities who just don't didn't know about the threat or or you know, again, you know, are thinking about viewing it in terms of herd theory instead of you know they're gonna find them eventually. Um but since we announced it, we've just got an overwhelming number of utilities that are raising their hand and and and asking to be a part of it. Uh and we're uh really excited about the fact that our our problem right now is processing um all the incoming utilities, um, not uh getting folks to pay attention and take the help. Um and so that's that's been a great um uh surprise to us, honestly. Um but it's also again, as I as I said, you know, compared to the election industry 10 years ago, it it really is just such a night and day scenario where folks understand the threat um and and realize that it can affect them and they want help. Um and they're raising their hand, which is great.
MIMOSO 30:12
All right, so uh a last question. I definitely wanted to bring up the summer's attacks on the the different water communities, and I think close to a dozen states, if I recall correctly. When you hear about incidents like this, what what do you make of them from it we didn't really see an uh a super negative impact, certainly on public safety. Do you see these kinds of attacks, these kinds of incidents, as more of a demonstration of capabilities or an attempt to sow some chaos rather than actual kind of sabotage of a water utility in in this case?
BRAUN 30:49
Yeah, I think there's a couple it it I think there's a couple different things. So in the case of Vol Typhoon, which I know isn't what you just referenced, but just to kind of go back to the example, and I'll come back to uh the other thing. Um in the case of Vol Typhoon, what seems to be, and this is all in the press, I'm obviously not saying anything that is classified, but um what seems to be the case is that the Chinese are very deliberately putting malware on water utilities that support military assets that that would have to work immediately if there was a crisis with China. So presumably in a you know, a Chinese invading Taiwan or something like that. Um in that case, the the malware seems to be there for the very specific purpose of being able to shut off the water. It's not really a threat or they want to show us that they can do it. Like we know they can do it. That's not, I mean, they're one of the best countries in the world at this stuff, and and it's not that hard to plant malware in a in a water utility. So um in that case, the the object seems to be actual destruction of the uh of the IT in the event they need it, you know, in the event there is a conflict. In the case of what presumably was Iran, I know it hasn't been confirmed, but you know, the media reports and so on seem to uh you know uh imply that it was Iran. Um what that seemed to be, based on the timing and so on, was uh exactly what you said a a demonstration of capability and willingness to use it. Um and that is likely because it was a it was happened right around a key time in negotiations between the administration, uh the American administration, the Trump administration, and uh the Iranians uh over the war. And it seemed to be a shot across the bow of the Iranians saying, you know, you guys might think you have all the cards, but you know, we have a few up our sleeves too. Uh, you know, I think a lot of people criticize Trump for denying that it ex it happened, but um, you know, look, I I don't agree with Trump on everything by any stretch of the imagination. But I think in in that particular situation, um, you know, again, the the president's in the middle of an information war himself, and he doesn't uh want to cede any ground to the Iranians, uh, particularly in the middle of a negotiation. So I I understand at least the thinking behind why they they wouldn't come from it, uh and and so on. But uh it's that seemed to be a demonstration of capability and again willingness to use that capability uh that that I don't think we've we've seen from that really that I don't think we've seen before. Um and by the way, there's some I think from the Iranian's perspective, uh I think there in their mind there's some real kind of poetic justice going on because of course what they attack is a PLC. And as we all know, uh what was attacked in the um Stuxnet uh or what's you know colloquially referred to as the Stuxnet attacks uh against their nuclear program was what? A PLC. And so you know these these uh these spooks, they they they love this type of stuff, and and I I I would be surprised if they picked that particular device just because it it uh you know functionally made sense. I I think they do they do do these things to you know send signals to each other and so forth.
MIMOSO 34:18
Yeah, definitely.
BRAUN 34:19
Which is kind of cool. It's like the stuff you see in spy movies, but actually real, you know.
MIMOSO 34:22
Yeah, it's definitely part of the playbook.
BRAUN 34:24
Yeah.
MIMOSO 34:25
All right, Jake. That's a good place to leave it. Um I want to thank you for coming on the show. I really appreciate it. I thought it was a great conversation. I think people are gonna get a lot out of it.
BRAUN 34:34
Yeah, absolutely. Thanks for having me.
MIMOSO 34:37
All right, have a good day. Thanks.
Michael Mimoso is Director of Influencer Marketing at Claroty and Editorial Director of Nexus.
