CyberWire Daily at 10: A decade of leaks, espionage, and influence operations. [Special Edition]

Summary

CyberWire Daily at 10: A Decade of Leaks, Espionage, and Influence Operations

Podcast: CyberWire Daily
Host: Maria Varmazis (A), Guest: Dave Bittner (B)
Release Date: June 19, 2026

---

Episode Overview

In this special 10th-anniversary episode of the CyberWire Daily, host Maria Varmazis and long-time presenter Dave Bittner reflect on a decade of covering cyberattacks, leaks, espionage, and the evolving arena of influence operations. Through a candid and often wry conversation, they examine pivotal events since 2016, the shifting threat landscape, and the changing perceptions and societal impacts surrounding high-profile hacks, disclosures, and the increasing weaponization of digital information.

---

Key Discussion Points & Insights

---

1. The Turning Point: 2016 and the Rise of Influence Operations

• 2016 as an Inflection Point:

  • The year is highlighted as a watershed moment for the weaponization of leaks. Espionage shifts from simply intelligence-gathering to influencing public narrative by leaking sensitive information.
  • Dave Bittner: “What was different is that nation states had been doing espionage forever ... But doing this sort of thing of not just stealing the information so that you know what's going on ... This was when we started ... weaponizing this information, in this case, a political weapon.” [03:07]

• DNC Email Leaks:

  • Russian intelligence operators infiltrated the DNC, with emails leaked during the U.S. presidential campaign.
  • Set precedent for leaks as tools for mass influence.

• Changing Journalistic Norms:

  • In 2016, debate arose around whether media should publish hacked/leaked info, whereas by 2026, publishing such materials has become routine.
  • Maria Varmazis: “There was a lot of fallout from that one where the stories were sort of getting percolated through the news. But also I think it was opening of a door of going, hey, they can do that, so one can do this.” [05:47]

---

2. The Fallout and Escalation: Large-scale Leaks and Their Impact

• The Panama Papers ([06:19]–[07:50]):

  • Massive leak exposes offshore financial arrangements, rocks global politics and economies.
  • Highlights shift from manual investigation to present-day AI-driven analysis.

• Corporate and Social Impact:

  • Companies and boards become increasingly aware and terrified of reputational harm from leaked internal communications.
  • Bittner: “So now companies are thinking about the reputational damage of a potential leak ... they're saying ... could all of our information ... could they be accessed and leaked? ... if it can happen to the DNC, it could happen to anybody.” [08:32]

---

3. Weaponization and Commercialization of Cyber Tools

• Shadow Brokers & Leaked Offensive Tools ([09:48]–[11:02]):

  • Release of NSA’s hacking tools (e.g., EternalBlue), later used in WannaCry ransomware.
  • 2017: WikiLeaks publishes CIA cyber techniques.

• Pegasus and the Market for Spyware ([11:02]–[12:28]):

  • NSO Group’s Pegasus exemplifies the movement of advanced cyber capabilities into commercial markets.
  • Bittner: “That was new as well, that now there's commercialization, there's a market for these tools ... from industrial espionage to ... regular spyware became a thing.” [11:41]

• Trickle-down Effects:

  • Advanced tools eventually reach consumers; spyware becomes accessible to the public.

---

4. Norms, Cynicism, and the Evolution of Trust

• Erosion of Old Norms:

  • Social and political mores regarding privacy, leaks, and acceptable targets have steadily declined (“gentlemen don't read each other's mail” is now seen as quaint).
  • Bittner: “There was a norm that is no longer there ... it's the reputational damage that's huge. A lot of these actors ... just want to do a smash and grab and threaten to leak it. And that's enough.” [13:34]

• Rise of Public Cynicism:

  • Early leaks sometimes viewed as acts for the public good; by 2026, leaks provoke skepticism regarding actors and motives.
  • Varmazis: “I think everyone's like, yeah, yeah, yeah. What's the here? In 10 years, that’s been how. I guess everyone has sort of wised up to this a little bit.” [15:16]

---

5. The Age of Fabrication: Deepfakes and AI

• AI as the Ultimate Force Multiplier ([15:16]–[16:46]):

  • Concern shifts from real leaks to convincing fabrications.
  • Bittner: “Do I even need to steal the stuff anymore to upset your reputation? ... To me, that's another shift. ... How do you establish a chain of custody of information or video or photos or audio?” [16:08]
  • Varmazis: Quoting Orwell: “The party told you to reject the evidence of your eyes and ears ... That’s where we’re at right now.” [16:34]

• “Fake News” as a Defense:

  • Bittner: “When anything can be dismissed as fake news... they can just respond and say, fake news, we’re done here. Right.” [16:46]

---

6. Red Lines, State Behavior, and Ransomware’s Rise

• Reluctance to Set Boundaries:

  • Nation states avoid establishing “red lines” in cyberspace to preserve their own offensive capabilities.
  • Bittner: “They don't want to take away their own offensive capabilities by drawing bright red lines.” [18:11]

• Hospitals and Critical Infrastructure:

  • Even most sacred targets (like hospitals) are not off limits, showing collapse of norms.

---

7. Cyber Conflict: From the Technical to the Societal

• Wars of Software, Not Steel:

  • Modern cyber conflict impacts entire societies, transcending military or technical boundaries.
  • Bittner: “Much more societal. I think it's much more political. … You don’t need aircraft carriers to do cyber. … The Gulf is not as wide as it used to be.” [19:20–20:06]

• Cybersecurity is Everyone’s Problem:

  • Organizations increasingly recognize that cyber isn't just an IT issue—it's a company-wide risk.
  • Varmazis: “Let’s get real. Any place that’s really worth their salt is not thinking [cybersecurity is just IT] anymore.” [20:34]

• Ubiquity of Cybercrime:

  • Growth of scams and consumer-targeted attacks highlights the spread of risk and need for awareness among the general public.

---

Notable Quotes & Memorable Moments

• On 2016 as a turning point:
  • “Nation states had been doing espionage forever ... but this was when ... information was being leaked as a weapon.” (Bittner, [03:07])
• On change in norms:
  • “The comparative innocence [of 2016] seems kind of quaint by today’s standards.” (Bittner, [05:08])
• On the commercialization of cyber tools:
  • “Just that it trickled down to just being something in the public awareness that you could just buy.” (Bittner, [12:28])
• On AI and deepfakes:
  • “Isn't that wild when people can no longer trust their eyes or their ears ... because it all can be fabricated convincingly?” (Bittner, [16:08])
• On the exhaustion of perpetual skepticism:
  • “It's just a really challenging time. I don't know about you, but I find it to be quite often exhausting to try to wade through all of this stuff.” (Bittner, [17:04])
• On how far we've come:
  • “There's a little ... boil the frog going on where you don't notice it in small increments, but when you really look back ... you can see how much things have changed.” (Bittner, [22:23])

---

Timestamps for Key Segments

• 2016 & Influence Operations: [02:23]–[04:33]
• Media Use of Leaked Info: [04:33]–[05:15]
• DNC and Panama Papers Discussion: [06:19]–[07:50]
• Corporate Fears & Ransomware: [07:50]–[09:48]
• Shadow Brokers & Offensive Tools: [09:48]–[11:02]
• Pegasus & Commercial Spyware: [11:02]–[12:28]
• Erosion of Norms and Trust: [12:28]–[16:46]
• Red Lines & State Behavior: [18:11]–[19:06]
• Cyber Conflict Becomes Societal: [19:20]–[21:44]
• Conclusion & Reflections: [22:23]–[23:34]

---

Final Thoughts

Reflecting on a decade in cybersecurity, Maria and Dave highlight how cyber threats have dramatically shifted in scope, impact, and public perception. Leaks have evolved from rare events to common tools in influence campaigns. The development and commercialization of sophisticated cyber tools have lowered the barrier for all sorts of actors—from nation states to individuals. Perhaps most striking is the corresponding shift in cultural and political norms: what was once unthinkable or “quaint” is now standard practice, fostering cynicism and skepticism about information. As AI-driven misinformation grows, the challenge of establishing trust and “red lines” in cyberspace only intensifies.

Dave Bittner’s closing remark:

“To err is human, but to really screw up requires the use of a computer. Well, be careful what you ask for. Here we are.” [23:23]

---

For listeners, this episode offers a thought-provoking look back, highlighting how dramatically cyber threats—and our understanding of them—have changed in just ten years, and raises critical questions for the decade ahead.

Transcript

[A]

You're listening to the Cyberwire Network, powered by N2K. Hello, Maria Varmaz is here. Thank you for joining me today. 2026 is a big year for us here at N2K Networks. We are celebrating the 10 year anniversary of the Cyberwire Daily. Yeah, time flies when you're having fun. In today's N2K CyberWire Special Edition, we're reflecting on a decade covering leaks, espionage and influence operations. So much intrigue. And for this retrospective, I'm chatting with none other than Dave Pittner, host of of the Cyberwire Daily. We are jumping back into our discussions about 10 years of the Cyberwire Daily. So who better to walk me through it than the host of the Cyberwire Daily, the one and only Dave Bittner. Hi, Dave.

[B]

Hello. I've been here the whole time.

[A]

You haven't left. We're doing this again. You've been sitting there in that chair for 10 years?

[B]

Pretty much, yeah.

[A]

Literally.

[B]

No, sometimes they let me out on good behavior, but rarely. Rarely.

[A]

Well, thank you for shambling over to the microphone.

[B]

Yeah, that's right. Hopefully you don't hear the chains clinking too loudly like an attic ghost.

[A]

Was that what that was?

[B]

Okay, well, the editors edit most of it out, but every now and then some sneaks through.

[A]

Well, for someone who's been trapped in a tiny room for 10 years, you sound very chipper. So appreciate that, Dave. Appreciate you talking to me today about yet another panorama of what you've noticed over the last 10 years in the stories that have been covered in the Cyber Wire Daily. And our focus for today is something that, honestly, I hadn't really put two and two together until I started doing some prep for this. I don't know what happened 10 years ago, but around 2016, some stuff started to happen in the cyber security world that I don't know what 2016 would have to do with it. It's a mystery. But there seems.

[B]

What was going on in that year? What was going on in that year in 2016?

[A]

Yeah, it's weird, right? Right. After years of people in infosec kind of chuckling about the threat of hacktivists being an overblown sort of 90s era threats, suddenly sometime in 2016, we started seeing nation states and other large organizations, shall we say, using cybersecurity, cyber attacks for influence operations and not just hacking stuff, but then hacking with the point of leaking that information to influence someone or something. And I'll. But again, I don't know what that year could have had to do with anything, but 2016. We started seeing a whole bunch of it. That's true, yeah. What do you remember from all that, Dave?

[B]

Well, I mean, obviously 2016 was a big election year and a contentious election year.

[A]

What?

[B]

I guess after 2016 there's been no other kind. But I think it's fair to say that objectively that it was a contentious election year. But what we're getting to here is that we had the DNC email leaks. The Democratic National Committee pretty much accepted these days that Russian intelligence operators got into the Democratic Party's networks and they stole a bunch of emails and then released them during the presidential campaign. And I guess to say what was the point of departure here? What was different is that nation states had been doing espionage forever, as long as there have been nation states, truly. But doing this sort of thing of not just stealing the information so that you know what's going on so that you know what the other side is up to. This was when we started, or they started, it was started that the information was being leaked as a weapon. They were weaponizing this information, in this case, a political weapon. So going from just simple intelligence collection and now, as you mentioned, using it for influence or influence operations.

[A]

Yeah, I remember some dialogue in 2016 about how ethical it would be for news organizations to report on the information that was leaked. And there was a lot of ringing of hands about, do we use this information that, you know, these. What do we want to call them? Hacktivists? That's not correct. But this, that's being leaked. And then it became a bit of a feeding frenzy of, well, if we don't use it, someone else will use it. And now it just seems a little bit de rigueur that, you know, major news outlets are gonna, of course they're gonna talk about it. If it gets leaked, it's gonna get used. But that wasn't always the way it was. Am I imagining this or is that.

[B]

No, no. I mean, the comparative innocence seems kind of quaint by today's standards. You're right.

[A]

Only 10 years ago.

[B]

Only 10 years ago. Oh, how time fly. And of course, you know, we have to realize we had Covid in the middle of all this in the middle of the last decade, which to me really made my relationship with time itself a lot looser. And I hear lots of people say that time doesn't really have the same meaning that it did before COVID I'm not sure what that means, but it seems to be commonly experienced enough that there's a lot of general agreement that that's A thing.

[A]

So, yeah, yeah, the black hole time. Yeah, truly. Yeah, it was a quainter time back then. But yeah, the DNC email leak, there was a lot of fallout from that one where the stories were sort of getting percolated through the news. But also I think it was opening of a door of going, hey, they can do that, so one can do this. Okay. And then we just saw a bunch of other campaigns sort of doing something similarly. Do you remember anything that might have come after the DNC leak in subsequent years?

[B]

Well, we had the Panama Papers. That was also right around 2016, and that was. Journalists got millions of documents that were talking about offshore financial arrangements in the old days. Used to say Swiss bank accounts, they were in islands and nations that were sympathetic to helping folks hide wealth and escape taxation and all that sort of thing. And so the release of those papers had ripples throughout the global economy. People were investigated, some people had to resign their positions and there were all kinds of policy debates about that. And I think one of the things that set that apart or got it so much notice at the time was just the scale of it. It was huge, millions of documents. And so journalists had their work cut out for them.

[A]

Yeah, I think people are still pouring through them. Right.

[B]

The days before ChatGPT, right, where you could just say, analyze this, you know, it was much more of a manual process. So now we have journalists, but also activists, people who are pro transparency, looking at this big document dump and saying. Looking at it as an opportunity to advance their cause or shine a light on things that had previously been going on in the shadows.

[A]

Yeah. And I imagine flipping it around a little bit. Organizations that were looking at these massive leaks happening that were affecting, you know, like the DNC or whatnot. Maybe companies were thinking, I can't imagine how this would necessarily be relevant. Of course, I'm being very naive here, but you know, the idea of a business being hit with such an attack where their IP being leaked is obviously a business level disaster. But you know, internal emails or policy decisions being made that also could really affect how a company would work. I'm not sure if that was as heightened of fear pre2016 as it then became. After all this. I'm thinking of SolarWinds. That's the one.

[B]

Right. Well, but you know, it's a great point. I mean, so now companies are thinking about the reputational damage of a potential leak. They're looking at something like this and they're saying the board of directors are pulling their CISO into a meeting and Saying, could this happen to us? Right. Could all of our information, could the confidential conversations that we have among ourselves as a board of directors, could they be accessed and leaked? Because if it can happen in the Panama Papers, if it can happen to the dnc, it could happen to anybody. And in some ways I wonder if that kind of primed the pump for ransomware with the fear of reputational damage beyond just the actual theft of the information itself.

[A]

Yeah. Cause the fear used to be, you know, if our service goes down or our website gets defaced, then I'm going back a while, that's egg on our face. And then, you know, customers won't trust us, that we're good at our jobs. And now it's like again, that almost feels, actually, it does honestly feel kind of quaint. Like your service goes down. I mean, not great, but you know, how about, yeah, all those board chats get leaked and that's. Then you're in the news cycle for reasons you really don't. And that is really a mess, to put it politely.

[B]

Right, right. And then, you know, following that, we have the shadow brokers who were releasing these offensive cyber tools that had been linked to the nsa. You know, that was the scuttlebutt that these offensive tools originated within our own intelligence community. And one of them was Eternal Blue, which later came to be used in things like WannaCry. And then what, a year after that we had WikiLeaks publishing documents describing CIA cyber capabilities and operational techniques. So it's not just others, right? It's not just the rich and the powerful who are hiding their money. These are national security concerns. When our own tools are being exposed, our own tradecraft is being exposed, and by these hacktivists and other people who are interested in public disclosure. You know, that's a huge concern as well. And also new, I remember hearing about

[A]

the Pegasus project and that on its own was a commercialization of weaponization. Yeah, yeah, yeah.

[B]

I mean, so you had these capabilities which I think previously had been limited to in house intelligence agencies. And now with Pegasus you have these sort of surveillance tools available on the open market. And certainly, I mean, Pegasus claimed that they were being very selective with who they sold these things to, but there's evidence to the contrary.

[A]

Yeah, yeah, yeah.

[B]

It's been found being used by many folks that either Pegasus turned a blind eye to or did not know, or it got, who knows, it got passed around. Right, but that was new as well, that now there's commercialization, there's a market for these tools. Both for other intelligence organizations, but all the way from industrial espionage to, well, just commercial, regular spyware became a thing. Right. I want to know if my wife is running out on me or not. And so I'm going to put something on her phone or her on mine. Just that it trickled down to just being something in the public awareness that you could just buy.

[A]

It strikes me when we're talking about all of these things from Pegasus to just the influence operations and all the different leaks, the huge, huge change in norms around all this. I don't think we can overstate that.

[B]

I don't want to hang too bright a lantern on it, but let's go back to 2016. Right. I think it's fair to say again, objectively, that with 2016 came a very different expectation politically when it comes to norms. Right. And as we're in that, we're still in that today. So people threw the gloves off. There's things that would not have been imaginable. You know, what's the old saying? Back from way back when the quaint thing. Was it Churchill who said, gentlemen, don't read each other's mail. Probably have that wrong. But there was, you know, someone of historical significance said that.

[A]

Yeah. Something misattributed to Churchill. You know, as often is the case, sure.

[B]

It's either Churchill or Mark Twain.

[A]

Right.

[B]

I don't know. But again, quaint. And certainly espionage organizations were reading each other's mail from the beginning of time. But the point is, there was a norm that is no longer there. And through these leaks, through these capabilities, and now, even with things like ransomware, which we talked about in a previous episode of our conversations here, it's the reputational damage that's huge. A lot of these actors, they're not even worried about locking the stuff up anymore. They just want to do a smash and grab and threaten to leak it. And that's enough.

[A]

Yeah. And even as you're describing it, and I'm thinking back to the public perception, or at least how I perceived the public perception of these kinds of things going back 10 years ago with the DNC leaks and even the Panama Papers, there was a lot less cynicism, not saying none. And certainly within the infosec community, there was a healthy amount of cynicism, I

[B]

would say, but in the public, it's an industry more cynical than most, I was gonna say.

[A]

I'd be disappointed if they weren't. Yeah. But I mean, in the general public, I would say 10 years ago, it was almost a. Oh, this has Been leaked. You know, this is for the public good. There's. There's a reason this is being sent out, so we all should know about it because something needs to change. And now when these smash and grab. Great way of putting it, Dave. Smash and grab leaks are happening. Oh, people are so much more cynical, broadly. And again, it's not just infosec people. I think everyone's like, yeah, yeah, yeah. What's the here? In 10 years, that's been how. I guess everyone has sort of wised up to this a little bit.

[B]

Yeah. I think we're also much more primed to be more cynical when it comes to the information that's coming at us, particularly online, that we're not as trusting as we used to be by necessity. And now we've got. Wait for it. AI.

[A]

I knew you were gonna say it. I knew you were gonna say it. Everybody drink, right?

[B]

Everybody drink, right? It's the free square on our bingo card.

[A]

Yeah. So pouring the lighter fluid on the. On the burning gas grill, bad idea. But here we are.

[B]

Yeah. I mean, do I even need to steal the stuff anymore to upset your reputation?

[A]

Now we can just make things up. Yeah, just make it up. No one's gonna care and just make it up. Yeah.

[B]

Isn't that wild when people can no longer trust their eyes or their ears or, you know, because it all can be fabricated convincingly. To me, that's another shift. And that's another thing we're gonna have to deal with. How do you establish a chain of custody of information or video or photos or audio file interviews, any of that stuff?

[A]

I was just thinking of George Orwell, as you said that you were probably referencing him as well. The party told you to reject the evidence of your eyes and ears. It was their final, most essential command. That's where we're at right now with. Yeah, right.

[B]

When anything can be dismissed as fake news. You know, senator, you know, who was that young lady we saw you with? And they can just respond and say, fake news, we're done here. Right.

[A]

Sticks and stones or something like that.

[B]

But again, it all swings back around to norms. What is expected? What do we expect from the people we elect or the people we do business with, or even the people we choose to have as our friends? There's so much more skepticism and cynicism. It's just a really challenging time. I don't know about you, but I find it to be quite often exhausting to try to wade through all of this stuff.

[A]

Right, yeah, absolutely. And in that way, many industries. But cybersecurity certainly is a mirror to what's going on more broadly. And as we're talking about norms, I think when I was a baby cybersecurity person back in the day, a lot of the things we just talked about over the last 10 years would have, I think would have been considered red lines of some kind. And we just kind of just kept stepping over them and looking back and going, did we just do that? I guess so. Okay. And then we're just doing it again. And that's wild. I thought that that was a super. No, no. And here we are and that's the world we're in now. And.

[B]

But I think that's a really powerful point as well, because something that I've observed over the past 10 years is Nation states reticence to draw red lines when it comes to cyber. And I believe, and it's been supported by folks I've spoken to who know much more about this than I do, that they don't want to take away their own offensive capabilities by drawing bright red lines.

[A]

Yeah, nobody wants to be the first person to pull a punch. I mean. Right, right, yeah, yeah.

[B]

They don't want to say this is off the table if behind the scenes we're using those tools for our own purposes. But the sideline or the side effect of that is ransomware operators target hospitals. When I think who in the world would disagree that they should be off limits? Right.

[A]

Yep. Yeah.

[B]

So what a world.

[A]

I think all of our 10 year anniversary conversations have ended up with us going, man, are we in a better place now than we were 10 years ago?

[B]

Right, right. But you think about, I mean, how much of cyber conflict, what we put under the air quotes of cyber conflict, I'd say 10 years ago was much more technical in nature. And now I think it's much more societal. I think it's much more political. As nations around the world have seen how much cyber is a force multiplier. Because you don't need aircraft carriers to do cyber. Right?

[A]

Yeah.

[B]

You don't need to make that investment.

[A]

I mean, you can, but you don't have to.

[B]

There's no doubt. Do aircraft carriers give the United States of America an advantage?

[A]

Sure, of course.

[B]

But it's not the. But the Gulf is not as wide as it used to be. When a small nation state can threaten turning off our lights or fouling our water or. Right. Or backing up our sewers because they can get into our critical infrastructure, I think, I believe that changes the equation. And I think that's A lot of what we're seeing these days are the ramifications of those truths.

[A]

Yes. And honestly, I think with that evolution, it's also just kind of making this a little silly, I suppose. I don't think anyone thinks cybersecurity is an IT problem anymore. Whereas, I mean, surely there are organizations that may think that, and I understand, but let's get real. Any place that's really worth their salt is not thinking that anymore. It's just the risks are too great. And we've seen it play out, so nobody's going, oh, Rob the IT guy, that's his issue. No.

[B]

Right, right. And even. I mean, even on a personal level, 10 years ago, we. We weren't seeing gift card scams the way we are today. We weren't seeing grandparents losing their life savings the way we are these days. So again, I think that points to the general awareness of these things by necessity, because as cyber has become so much a part of our daily lives through things like social media, so too has cybercrime, cyber, espionage, cyber influence naturally become part of our lives as well. And that's the new world we live in. And that genie's not going back in the bottle.

[A]

Well, on that upbeat note, Dave, right,

[B]

let's go curl up in a little ball in an empty bathtub, right. And sort of sway back and forth.

[A]

I mean, we always live in interesting times.

[B]

Yes. Yes, indeed. Yes, indeed.

[A]

Oh, my God. All right, well, Dave on, as always, a really illuminating chat. I promise I won't be rocking in the corner hyperventilating into a paper bag for too long.

[B]

No promises from me.

[A]

Yeah, it might happen, but I'll do that off mic. I'll do you a favor.

[B]

Right, right.

[A]

Would love to know if you have any parting thoughts for the audience before we close out?

[B]

No, I mean, I'm really enjoying these looks back that you and I are doing here, and I hope the audience as well. I think it's what it's done is made me kind of take stock and really see how far we've come and how much things have changed. I think when you're in the middle of it every day, there's a little, I don't know, boil the frog going on where you don't notice it in small increments, but when you really look back over the course of a decade, you can see how much things have changed. It makes me wonder where we're headed. I try to stay optimistic amidst all of this. I think most people in the world are generally good and operate in good faith, but these things happen disproportionately, I think. And what was the old joke from decades ago? That to err is human, but to really screw up requires the use of a computer. Well, be careful what you ask for. Here we are.

[A]

Here we are. Well, Dave Buettner, host of the Cyberwire Daily. As always, thank you so much for joining me today.

[B]

My pleasure. I look forward to our next chat.

[A]

You got it. Thank you for joining me today. See you back here next time.