The Cyberattack We’re Not Ready For

Summary

Podcast Summary: On with Kara Swisher — "The Cyberattack We’re Not Ready For"

Date: July 16, 2026
Host: Kara Swisher (Vox Media)
Guest: Nicole Perlroth (cybersecurity expert, author, and podcast host)

---

Overview — Main Theme

This episode explores the escalating risks in global cybersecurity, focusing on the collision of nation-state cyber capabilities and the rapid evolution of artificial intelligence, and examining the role of countries like China and North Korea in advancing cyber threats that the US and other democracies aren’t prepared for. Nicole Perlroth shares firsthand investigative insights into North Korean IT infiltrations, the AI-driven cyber arms race, and why the “everything, everywhere, all at once” cyberattack scenario is no longer science fiction. The conversation also unpacks current political dysfunction’s impact on US cyber defenses in the lead-up to the midterms.

---

Key Topics & Insights

1. The “Everything, Everywhere, All at Once” Cyber Scenario

• Kara asks if Perlroth is still most concerned about simultaneous infrastructure cyberattacks.
• Nicole Perlroth (03:48):

  “Everything's changed...we had to contemplate this nightmare scenario of what would happen if all of these hackers sort of detonated on the access they have all at once...It wouldn't just be one Colonial Pipeline, but hacks on critical infrastructure across the country.”

2. Entering the "Mythos Era": AI Cyber Risk

• Perlroth explains how Anthropic’s Mythos model, designed to write code, unexpectedly learned to exploit code—posing novel security threats.
• Nicole Perlroth (04:59):

  “It can find vulnerabilities in every major operating system, every browser, and chain them together into an exploit...These are capabilities that I, the expert as a human, would never have found otherwise.”

• Tier-2 states like North Korea and Iran—previously lacking top-tier cyber skills—can now be supercharged by AI.

3. North Korea’s Evolved Cyber Operations

• The podcast "To Catch a Thief" investigates North Korean IT worker schemes.
• After their infamous 2014 Sony hack, North Korea pivoted to bank, crypto, and IT labor scams to evade sanctions and fund nuclear programs.
• Nicole Perlroth (10:35):

  “They found their way into these [crypto] bridges...able to funnel more than $600 million back to their wallets...This is now funding about half of North Korea's regime.”

4. The North Korean IT Worker Scheme Unveiled

• North Koreans use stolen or “rented” American identities to land remote IT jobs and operate through “laptop farms.”
• Nicole Perlroth (13:09):

  “They are paying Americans to loan out their identities...finding Americans to host their corporate laptop. So the employer will ship a laptop to this American...and then that American will download some remote app that lets the North Korean remote in.”

• Large-scale: One cell of 22 DPRK IT workers made 160,000 job applications in three months. (16:53)

Memorable Moment (15:01):

• Kara: “Yeah, that's it. That's how you catch a thief.”
• Nicole: “That's how you catch a thief.”

5. Implications for HR, Remote Work, and Security

• Companies are now tightening in-person requirements, ending remote work flexibility due to North Korean infiltration.
• The scheme is spreading to Iran—potentially more destructive actors.
• Nicole Perlroth (22:00):

  “It really isn't a cybersecurity problem. In many ways, it's becoming one now... It's really an HR problem...It tells you how little we're actually screening some of these remote workers.”

6. China’s Cyber Dominance and AI Arms Race ([23:54])

• China’s sophistication has increased. Perlroth outlines how state laws channeled vulnerabilities found by Chinese coders directly to the government, resulting in undetected zero-day exploits in core infrastructure.
• “Mutually assured digital destruction” is now reality, with China potentially holding the upper hand, especially if US regulations stall innovation.
• China manipulates American public opinion around data centers as part of an influence campaign.

7. Can the US and China Cooperate on AI? ([26:49])

• Perlroth is pessimistic about meaningful technology treaties, citing repeated failures in setting even basic “cyber red lines.”
• She highlights China’s intent to control the backbone of AI infrastructure and data centers, leveraging disinformation for strategic advantage.

8. Public Attribution and Deterrence of Hackers ([29:19])

• Guest question from Dmitri Alperovich (CrowdStrike co-founder; 29:19): Has “naming and shaming” hackers lost its deterrence value?
• Nicole Perlroth (29:52):

  “...When it resumed, it resumed in a much more sophisticated, well organized, stealthy way. So... in retrospect, all of that naming and shaming... sent them further underground.”

9. AI’s Double-Edged Sword in Security ([31:38])

• AI allows hackers to conduct social engineering, phishing, and exploitation at scale—the advantage previously held only by “tier-1” nation states.
• Defensive hope: Use AI models like Mythos to identify vulnerabilities and strengthen defenses, but bureaucracy, politics, and industry rivalry slow this progress.

10. Silicon Valley Intrigue and the Pentagon ([34:19])

• The Trump administration temporarily bans foreign use of Anthropic’s AI models; Silicon Valley “beefing” drives regulatory mess, not actual national security considerations.
• Nicole Perlroth (35:24):

  “Well, I think it's fair to call this a giant shit show. I don't dispute anything you just said that. I think it comes down to beefing and who's kissed the ring and who hasn't adequately kissed the ring.”

11. Defensive A.I.: Pen-Testing Ourselves ([38:07], [38:10])

• The best use of models like Mythos is to stress-test US infrastructure before adversaries can use similar tools offensively.
• Nicole Perlroth (38:11):

  “...Our best defense is to take them, aim them at ourselves, and see where we are vulnerable and move very quickly to eliminate those inroads and kill paths.”

12. Election Security in the Age of Disinformation ([45:24])

• Trump administration dismantles CISA, FBI, and State Department units meant to protect elections, making the US “in no way prepared” for coordinated foreign influence or potential cyberattacks on midterms.
• Nicole Perlroth (50:42):

  “We are in no way prepared, is my understanding, for some of the coordinated misinformation campaigns that will come at us full throttle in this election.”

13. Nightmare Election Scenarios and AI

• Python-precision hacks could flip small but consequential numbers of voter rolls in “purple” US counties.
• AI can supercharge not just hacking, but deeply targeted misinformation.

14. (Lost) Bipartisanship Around Cybersecurity ([54:08])

• Cyber remained bipartisan “until now”; currently, White House-level politicization and targeted attacks on disinformation units have chilled collaboration and made cybersecurity jobs dangerous.
• Nicole Perlroth (54:08):

  “Clearly at the White House, it's been politicized. It's no longer a bipartisan issue. Every level below that, though... there's a lot of collaboration...among political parties, but among competitive companies.”

---

Notable Quotes & Memorable Moments (with Timestamps)

• Nicole Perlroth on AI’s threat:
  “If you had asked me...make it science fiction. What is the nightmare next chapter of this thing? I would have written a book that didn't look that different from the era we are entering right now where AI can essentially find these vulnerabilities and turn them on anyone they choose.” (00:00)

• On North Korea’s blockchain mastery:
  “They have essentially become the masters of the blockchain. We just don’t know it yet.” (10:34)

• On scale of North Korean IT infiltration:
  “...this one cell of 22 North Korean fake IT workers applied to 160,000 jobs just in the United States.” (16:53)

• On US readiness for election cyberattacks:
  “We are in no way prepared...for some of the coordinated misinformation campaigns that will come at us full throttle in this election.” (50:42)

• On the political reality of US cybersecurity:
  “It was incredible...I walked into that advisory role with basically zero faith in the federal government doing anything on cybersecurity. And I left truly impressed at what they were able to build in such a short time. So imagine my dismay when...they started hollowing out the actual agency...” (46:08)

---

Important Segments & Timestamps

• AI and the Mythos Era – Explanation of Mythos and its threat: [03:48]–[06:25]
• North Korean IT Worker Fraud – Deep-dive & investigative anecdotes: [12:26]–[20:20]
• China’s Cyber Strategy & Influence – Cooperation feasibility and manipulation campaigns: [23:54]–[28:59]
• Expert Q&A: Attribution and Deterrence (Dmitri Alperovich): [29:15]–[31:38]
• AI Models for Offense and Defense – The promise and peril of automated cyber tools: [31:38]–[42:26]
• Election Security Backlash – US agencies gutted, threat landscape ahead of midterms: [45:24]–[56:17]
• Closing reflections on bipartisanship – Is there hope for collaboration?: [54:08]–[56:28]

---

Tone & Style

The episode combines urgent, expert explanation with practical, sometimes wry or darkly humorous observations (e.g., Swisher’s “Ray of cyber sunshine” comment). Swisher probes with pointed, direct questions, while Perlroth’s answers are rich in real-world anecdotes and grounded warnings.

---

Summary Takeaways

• AI is transforming cyber offense—putting powerful tools into more actors’ hands and dissolving the skill gap that once protected critical systems.
• North Korea’s cyber operations are extraordinarily innovative, leveraging crypto theft and US labor infiltration at massive scale.
• China’s cyber capability is entering a new phase, focused on stealth, plausible deniability, and influencing public opinion in the US.
• The US is politically distracted and organizationally weakened, especially ahead of consequential elections, raising the stakes for both cyber and information attacks.
• Silicon Valley rivalries and regulatory confusion are slowing down the development of necessary defenses.
• True “everything, everywhere, all at once” attacks may now be possible—or imminent—driven by AI.
• There’s a dangerous, growing gap between offensive and defensive cyber capabilities and readiness, exacerbated by political polarization and administrative chaos.

---

For listeners seeking a gripping, realistic, and unvarnished look at the frontlines of cyber conflict—and the urgent vulnerabilities the US faces—this episode is essential.

Transcript

[Nicole Perlroth]

I wrote a book about the humans and what it takes to find these zero day exploit capabilities. If you had asked me, hey, write a sequel and you can make it fiction, make it science fiction. What is the nightmare next chapter of this thing? I would have written a book that didn't look that different from the era we are entering right now where AI can essentially find these vulnerabilities and turn them on anyone they choose.

[Podcast Host Assistant/Announcer]

Hi everyone from New York Magazine and the Vox Media Podcast network.

[Kara Swisher]

This is on with Kara Swisher and I'm Kara Swisher. My guest today is Nicole Perlroth, a

[Podcast Host Assistant/Announcer]

leading expert on cybersecurity and cyber conflict.

[Kara Swisher]

Nicole spent a decade covering cybersecurity, digital espionage and sabotage as a reporter at

[Podcast Host Assistant/Announcer]

the New York Times before stepping out to become a founder and managing partner

[Kara Swisher]

at Silver Buckshot Ventures, a cyber moonshot fund investing in cybersecurity companies. She's also the author of one of my favorite books, this Is How They

[Podcast Host Assistant/Announcer]

Tell Me the World Ends, about the

[Kara Swisher]

global cyber arms race. It's a must read. The latest season of her award winning investigative podcast To Catch a Thief exposes North Korea's infiltration of American companies via a pipeline of remote IT labor that's sending hundreds of millions of dollars back to the regime and its nuclear weapons program. The season finale is out this week. I just love Nicole. I think she talks in plain English about some very serious and complicated threats to the United States and most democracies, around misinformation, around cybersecurity, around the efforts of this administration to undercut our cybersecurity and more. And she's just always a straight shooter and I really appreciate it.

[Podcast Host Assistant/Announcer]

Our expert question today comes from Dmitri Alperovich, co founder of CrowdStrike and the

[Kara Swisher]

chairman of the Silverado Policy Accelerator, Washington, D.C. based Geopolitical Think tank. So stick around.

[Podcast Host Assistant/Announcer]

And one more thing before we get started. If you're going to be in Washington,

[Kara Swisher]

D.C. today, July 16, please join us live at the Johns Hopkins University Bloomberg

[Podcast Host Assistant/Announcer]

center for a taping of On.

[Kara Swisher]

I'll be talking to Gina Raimondo, Commerce Secretary under President Biden and former Rhode

[Podcast Host Assistant/Announcer]

Island Governor, about what AI means for the workforce. And as a special bonus before that conversation, I'll be speaking with Johns Hopkins

[Kara Swisher]

University President Ron Daniels and the University of Notre Dame President, Father Robert Dowd, to talk about how universities are approaching AI and workforce issues. You can get tickets and Learn more at Voxmedia.com Karaswisherlive.

[Podcast Host Assistant/Announcer]

Support for this show comes from Odoo. Running a business takes Everything you've got

[Kara Swisher]

and a lot of the tools out

[Podcast Host Assistant/Announcer]

there that are supposed to make your life easier just aren't great at talking to each other. And that means you end up having to toggle between a dozen different apps and services just to keep the lights on. Enough of that. Now there's Odoo, the all in one fully integrated platform that actually might help you get it all done. Thousands of businesses have made the switch, so why not you try Odoo for [e-mail] that's o d o o.com.

[Nicole Perlroth]

It is od.

[Kara Swisher]

Nicole, thanks for coming on on.

[Nicole Perlroth]

Thanks so much for having me. It's so good to be back.

[Kara Swisher]

When you were on the show just over a year ago, you said you were most concerned about, quote, everything everywhere, all at once cyber scenario, or multiple simultaneous cyber attacks on infrastructure. In a short period of time, we've experienced more geopolitical instability and rapid advances in AI, but so far we've avoided this worst case scenario. Is that still your number one worry? Talk a little bit about what's changed in a year.

[Nicole Perlroth]

Everything's changed. You know, last year I was saying we were worried about this quote, you know, everything everywhere, all at once cyber scenario based on what we were actually seeing Chinese hackers pre position in which to jog everyone's memory and it's still happening, is water, power, pipeline, infrastructure, high speed rail, aviation, ports, logistics. That's all still happening. So we had to contemplate this nightmare scenario of what would happen if all of these hackers sort of detonated on the access they have all at once. So it wouldn't just be one colonial pipeline, but hacks on critical infrastructure across the country. I always thought that it was unlikely that they would detonate on all these things at once, unless they were making a move on Taiwan and they wanted us to think twice about whether we wanted to support this island 7,000 miles away. And that even in that case, they would maybe go for one water treatment facility and a power grid hack here or there. Just flicker the lights on and off. Okay. The problem is now we're in the Mythos era.

[Kara Swisher]

And explain what that is for people who don't know.

[Nicole Perlroth]

So Mythos is this new anthropic model, newish at this point. Anthropic model that wasn't designed to exploit code. It was actually designed to write code. But as a byproduct, it can exploit code, which means it can find vulnerabilities in every major operating system, every browser, and chain them together into an exploit. So it can do things like. And by the way, I interviewed the head red teamer at Anthropic, so I'm a little bit close to the capability. And I said, describe the capabilities that this model has in plain English. He said, it's the type of thing where I can direct you to a website and gather all your banking activity. I can pull the photos off your phone without you unlocking it. We have found exploits using this model in most major operating systems, most browsers, et cetera, et cetera, et cetera. And these are capabilities that I, the expert as a human, would never have found otherwise. The model is finding these. And so the problem is now these models can do what only previously the tier one elite nation state intelligence or their contractors could do, therefore and may not have done.

[Kara Swisher]

They're just using it as a strategic advantage versus they would do it. And the people that could now do it are kind of crazy people, possibly, or just chaos monkeys or whatever.

[Nicole Perlroth]

Exactly. And when I asked this red teamer at Anthropic, Nicholas Carlini, who do you worry about the most? He said, well, on some level, the tier 1s already have had this capability. You know, obviously the models will increase their productivity, but you have to worry about these sort of tier 2, tier 3 nation states like Iran, like North Korea, that have never had this capability before, but have done pretty well with just social engineering, are now going to have the ability to break in essentially anywhere they want.

[Kara Swisher]

So let's talk about your new season of your investigative podcast, To Catch a Thief, which focuses, speaking of chaos monkeys, on how North Korean IT workers have successfully infiltrated major US Companies. We're going to talk about Mythos more later. But cybercrime is now a key part of the North Korean economy. People may remember the 2014 cyber attack on Sony Pictures carried out by a North Korean government backed group. Talk about the advancements in North Korea's cyber criminal operations in those years. And in what way does the DPRK influence other adversaries? Because they're sort of the out front group here.

[Nicole Perlroth]

Yeah. So, you know, they came on the scene with Sony and I think if I remember, I think it was all things D that broke that it was a North Korean cyber attack.

[Kara Swisher]

Yeah, that was me. That was me. Yeah, that was Kara Swisher.

[Nicole Perlroth]

Yeah, Kara Swisher broke that one when

[Kara Swisher]

I was a reporter back in the day. When I was a reporter. Yeah.

[Nicole Perlroth]

You know, most people remember that attack, but as I kind of say in the podcast, few people remember it for what it actually was because most People remember the leaks and sort of the

[Kara Swisher]

absurdity of all arguments between the studio heads over stupid things. Yes, right, exactly.

[Nicole Perlroth]

Yeah. But what they don't really remember is that these North Korean hackers decimated 70% of Sony's server capacity. You know, no one could get on email. No one could get on their devices. People were using fax machines, pen and paper. It was hugely destructive. And what the North Koreans learned from that attack is, okay, we can do this. You know, we can get into an organization with social engineering. We can basically map their network, find the crown jewels, and then we can decide what to do with those crown jewels for maximum impact. In this case, it was to embarrass Sony and keep them from releasing this ridiculous movie. Yeah, yes, the interview with Seth Rogen, which depicted the assassination of Kim Jong Un. So right after Sony, we saw them basically take those same capabilities and deploy them against banks. And we saw them go after one bank in particular, the bank of Bangladesh, and they were able to, using social engineering, for the most part, get into the bank's connection to something called swift, which is essentially like a messaging protocol. So if you, Kara, want to send me $10,000, you know, the bank says, okay, send $10,000 from Kara's account here over to Nicole's account here. They were able to manipulate it to essentially get $81 million out of the New York Fed. They were looking for a billion, but they had a few typos, and basically through good luck, they were only able to get 81 million out of the billion. So they learned a lot from that attack. They learned that they could basically use hacking to evade sanctions to generate the cash that they needed for their nukes program. And they also learned that there were a lot of choke points in the system. You know, one typo can basically throw off the whole operation. Then, almost like a gift from above, the world handed them crypto. And we have really not paid close attention. I think I. Even someone who studies cyber for a living had not paid very close attention to what North Koreans were doing with crypto, but they have essentially become the masters of the blockchain. We just don't know it yet.

[Kara Swisher]

What do you mean by that?

[Nicole Perlroth]

They started off basically hacking people's private wallets just by social engineering and fishing, but then they really started to study the infrastructure of the blockchain, and they started pulling off some heists that, to quote Rob Joyce, who used to run the NSA's hacking divisions, are some of the most sophisticated he's seen in his career. They found their way into these bridges that convert Ethereum into some other kind of cryptocurrency. And they were able to funnel more than $600 million back to their wallets. In one case, in the case of Bybit, the second biggest cryptocurrency exchange, they pulled off a heist that was like David Copperfield esque. They got the CEO of Bybit to approve what looked like a routine transfer, when underneath the user interface, he was actually approving more than a billion dollars in transfers to North Korean wallets. So this is now funding about half of North Korea's regime. It's responsible for about half of their total funding. They need the money. And if you read the coverage around Xi Jinping's visit to North Korea this year, the Wall Street Journal, the New York Times, they all wrote about, hey, like, we don't know why, but North Korea seems to be doing just fine, despite being the most sanctioned nation on earth.

[Kara Swisher]

So they're getting better, and they're using crypto to do so. They had their usual schemes, the phishing, the hacking. But this is a quantum level up. So talk about how did the investigation to the North Korean remote IT worker fraud begin? And just for people who know, last year, Amazon said one of its contractors hired a North Korean as its IT systems administrator. Talk about that.

[Nicole Perlroth]

Yeah. So this is super weird. And I started hearing about this about two years ago. You know, some CISOs, some chief information security officers started telling me, you won't believe what happened. We actually accidentally hired a North Korean who had applied as a full Stack developer under someone else's identity. I was like, that's kind of weird. You know, what did they do? The weird thing was, Nicole, they didn't do anything. They were actually just there for the paycheck. So it kind of was just kind of this bizarre, absurd thing. And then I started hearing about major defense contractors having this issue, major ag companies.

[Kara Swisher]

So it was North Koreans pretending to be someone else in order to get a job?

[Nicole Perlroth]

Yes. And in some cases, they are stealing identities to get these jobs. In other cases, they are paying Americans to loan out their identities.

[Kara Swisher]

Their identity?

[Nicole Perlroth]

Yeah. And pass background checks. And they are finding Americans to host their corporate laptop. So the employer will ship a laptop to this American who gets, you know, $100 a month per laptop. You. And then that American will download some remote app that lets the North Korean remote in, and the North Korea pays them, you know, some nominal fee, and then is basically able to do what they need to do to do their job.

[Kara Swisher]

So this is Americans who operate what are known as laptop farms and working for the dprk. But it's the DPRK that's working their laptops that they set up.

[Nicole Perlroth]

Exactly. And so I started digging into this, and at one point, I partnered with a security firm called Nisos, and that had been triaging some of these cases for Fortune 100 companies, and then posted a job for an AI developer and ended up getting a response from what they believed was a North Korean. So they confirmed it was a North Korean.

[Kara Swisher]

Why did they believe that?

[Nicole Perlroth]

Oh, it was, you know, all the red flags. It was someone who comes on, and there's a slight delay in their answer, and there's clearly a language barrier, but then their answer is spoken in perfect English, and it's clear they're using some kind of AI chatbot to answer these questions. And in this case, they actually, because they sort of suspected as much, they brought him back for a second interview, and they asked him questions like, oh, I see you're in Florida. You know, how'd you weather Hurricane George? And there's this kind of delay. And then they say, oh, you know, we did fine. A few branches came down here and there, but we were just fine. And there was no Hurricane George. That kind of thing.

[Kara Swisher]

Yeah, that's it. That's how you catch a thief.

[Nicole Perlroth]

That's how you catch a thief. So they ended up sending him along

[Kara Swisher]

the Manhattan Dodgers, but go ahead.

[Nicholas Carlini]

Sorry.

[Nicole Perlroth]

No, it's a lot of that. It's like, that's how you catch these guys. It's like, what was your university mascot? Was one that was tripping him up. My favorite was say something bad about Kim Jong Un. And that usually weeds him out quite quickly. But, you know, in this case, they hired him deliberately, and they sent him a laptop that had spyware on it. And this guy that they hired basically logged into his Discord account. And so they were able to get into his Discord account, and it turns out that's where they were managing their whole backend operation. And it was this entire cell.

[Kara Swisher]

So the guy was a North Korean. This American laptop farm that did it, or this was a corporation that they were trying to get into.

[Nicole Perlroth]

So the security farm hired a North Korean that was using an American to host his laptop in Florida. So could see through the camera that they were sitting in a basically, like container store type closet somewhere in Florida. And then they could. They sent him something that could cut through his VPN and show that actually he was logging in from China, which is where a lot of these North Korean IT workers are based. And then through this guy's own credentials that he stored in his Gmail account, they were able to get into this discord channel where they organized their whole cell operations. And it was one cell of 22 people. But the pertinent thing is they were only able to keep this guy for three months because they couldn't actually pay him because that would be against sanctions. And just in those three months that they had access to this discord channel, this one cell of 22 North Korean fake IT workers applied to 160,000 jobs just in the United States.

[Kara Swisher]

So they're trying to.

[Nicole Perlroth]

And that's when I realized the scale of this. Yeah, yeah.

[Kara Swisher]

And the goal is to steal, fuck up or steal.

[Nicole Perlroth]

The goal is to make a paycheck. So the goal is initially, when the mandiants of the world would come in and triage these cases, they would look, you know, did they plant malware, did they steal ip, did they steal data? And for the most part, and it was really weird, they're just there for the paycheck. And my understanding was this is basically a way to get a steady form of funding, like, almost like their ARR to fund sort of these larger hacking crypto heists. That can take a year in some cases of careful planning.

[Kara Swisher]

Right. So they may not be stealing. They want jobs and they want to hide their assets.

[Nicole Perlroth]

They want jobs, and they're taking like 12 jobs they could. And that's the thing is now that companies like Amazon is talking about this, Palo Alto Networks is Talking about this, CISOs are talking to each other about this, because it's really gotten to the point where, as one person at Mandiant told me, I have yet to find a company in the Fortune 500 that hasn't hired a North Korean IT worker. As they're talking to each other, they're looking for these red flags, and as they find them, they're firing these people. And so these people still have to monetize their access. And we're starting to see some more extortion cases and data theft and that kind of thing.

[Kara Swisher]

Right. And because eventually that's where it goes. So who are the Americans hosting the laptop farms?

[Nicole Perlroth]

Okay, so this was fascinating. I was like, who are these people that are just taking corporate laptops, hosting them in their house? So I wanted to go meet with one of these people. And the only case that we've really heard about publicly is a woman in Arizona named Christina Chapman who is hosting something like 60 laptops for the North Koreans. And so I was trying to find others. And it turns out a lot of these people have serious criminal records. They're Americans who, for whatever reason, can't get work. They're posting on a Reddit channel, hey, I'm looking for quick cash. And that's where the North Koreans are finding them. Sometimes they post that they're looking for work on LinkedIn, and that's how the North Koreans find them. But a lot of them have criminal backgrounds, which is why they can't get work and maybe why they're willing to accept laptops from a total stranger.

[Kara Swisher]

Yeah, please look this up and pretend it's, you know.

[Nicole Perlroth]

Yeah. And so for the podcast investigation, I wanted to go meet with one of these people, but their background checks were a little terrifying. But we found one woman in Cincinnati, and I did fly out to Cincinnati and knock on her door, and they let me in. And, you know, it's not like they ever tell these people, hey, we're North Koreans. You know, they make up an identity. In some ways, these people are being scammed themselves, but they come up with some reason why they can't be in the US and they need this person to host their laptop. And some of these Americans that are hosting laptops are vets. Like, some of them are just people who think they're running a legitimate business. One of them had essentially the words laptop farm on their resumes, but they're just not asking questions about these people who are willing to send them, you know, quick cash, quick crypto to host these laptops. Yeah. And what I think is really hard to think about is, like, the pool of those willing Americans is only going to get bigger and bigger as we start seeing more job losses from AI.

[Kara Swisher]

Job losses. Yeah, because it's easy money. It's easy money. So just be us. Just let's buy your identity, essentially. We're going to talk a little bit about China and the AI rise and cyber threats in a second. But what was your conclusion from catching these essentially thieves, but really catching these employees? Right, because they're not thieves yet. They're employees.

[Nicole Perlroth]

I think it was a few things. I think one of them is we just take our eye off of North Korea, we caricature them, but we should use them as a case study right now, because this is the actor that is an early adopter, as they were with crypto and the blockchain that is quite persistent, really good at social engineering. And I have no doubt they're going to be one of the first nation states that pop up in an AI powered Attack. And we can't take our eye off the ball. This is actually the kind of adversary that we should be paying very close attention to. The other thing is this really isn't a cybersecurity problem. In many ways, it's becoming one now that they're kind of moving towards extortion, et cetera. It's really an HR problem. And it tells you how little we're actually screening some of these remote workers. I want remote work to stay. I love remote work. I think it's wonderful. I love the flexibility it brings. It's probably going to be one of the costs of this North Korean operation. I'm already hearing about companies saying you have to come in. You know, at Amazon, they're like basically ending remote work. There's a lot of companies that said we have to see you and we have to see you for a prolonged amount of time. We have to make sure you're the person we interviewed, that you have the skills that you said you had. And we need to see that in person. Because, by the way, this playbook was North Korea's, but it's spreading. And this week we released the episode where we disclosed that we're starting to find Iranians are now using this playbook and getting jobs. And they have very different motivations in some cases than the North Koreans. They're more destructive, they're more retaliatory. So this playbook's spreading and we kind of just. We have to talk about this because we have to talk about how to filter for it.

[Kara Swisher]

We'll be back in a minute.

[Podcast Host Assistant/Announcer]

Support for this show comes from Odoo. Running a business is hard enough, so why make it harder? With a dozen different apps that don't talk to each other. One for sales, another for inventory, a separate one for accounting. Before you know it, you're drowning in software instead of growing your business. This is where Odoo comes in. Odoo is the only business software you'll ever need. It's an all in one, fully integrated platform that handles everything. CRM, accounting, inventory, E commerce, HR and more. No more app overload, no more juggling logins. Just one seamless system that makes work easier. And the best part, Odoo replaces multiple expensive platforms for a fraction of the cost. It's built to grow with your business, whether you're just starting out or already scaling up. Plus, it's easy to use, customizable and designed to streamline every process so you can focus on what really matters running your business. Thousands of businesses have made the Switch. So why not you try Odoo for [e-mail] that's o d o o dot com.

[Kara Swisher]

Let's talk about China and its rise in cyber dominance. You mentioned them earlier. For at least the last decade, China has targeted US telecom companies, notably the expansive salt Typhoo attacks. China backed hackers have also infiltrated critical infrastructure including water, transport and grid networks. You've talked about this being the era of quote, mutually assured digital destruction, but it sounds like China's gaining advantage in cyber dominance. Talk a little bit about that because this is the argument of course, all of Silicon Valley is making and others say no, it's not as much. But give me your assessment of where we are and if they have the upper hand, and if so, what are the consequences?

[Nicole Perlroth]

When I first started covering Chinese cyber attacks against the New York Times, for instance, a decade ago, it was brazen, but it was phishing. You know, it was loud, but it was successful. You know, some people called them the most polite hackers in cyber because it almost announced their presence. As we started outing some of these campaigns, they really went underground. And I think really the up leveling moment was when they started using their authoritarianism to their advantage. They basically created a series of new laws that said, hey, if you find a vulnerability, you have to give the state right of first refusal. And all these Chinese hackers that I used to see at the big hacking competitions that would show how to hack into a Tesla or an iPhone or Android stopped showing up on state's orders. Pretty much all that knowledge, all that skill started funneling directly to the state. And we started seeing some really significant up leveling and sophistication in some of these Chinese operations, like Salt Typhoon, like Chinese state operations. Not exactly. And these are much harder to defend against. You know, we started seeing them come for security devices, we started seeing them find zero days, you know, vulnerabilities. No one knew about using those in the course of their operations. And we're catching them in not only our backend telecom infrastructure, but, but in these critical entities like water and power, but their capabilities.

[Kara Swisher]

You know, US and China are locked in this global AI arms race that has experts on both sides concerned if the two nations fail to cooperate. Right. Obviously Anthropic and OpenAI are accusing China of copying their AI systems through distillation. And the Trump Xi summit in May ended without any meaningful agreements on AI. I mean, the biggest argument from Silga Malley is we must do all these things without any regulations in order to fight the Chinese Most people that I think are intelligent say we've got to cooperate with them in some way. But is there a realistic chance of cooperation between the US and China on AI, should it happen? And what do you make of the arguments of people, you know, in Silicon Valley? Or like, it's, you know, it's the Xi or me argument kind of thing that they try to pull.

[Nicole Perlroth]

You know, we are locked in this very dangerous game of chicken, and I wish that we had an entirely new generation of technological diplomats that could sit down with Xi and say, hey, you know, none of us want the world that we're crashing towards. But I am close to people who've had similar conversations with China on hacking for years on fentanyl, more recently on Volt Typhoon, these hacks of our critical infrastructure. At one point, one of the people I interviewed last season when we were focused on China, said they were tasked by the Biden administration to go to China and propose that we set up red lines just around hacking water treatment facilities, water systems, civilian water systems, and their counterparts in China said no. So I don't know if it has changed now that we are slightly ahead on AI, but for how long are we ahead? I think that the decision to release Deepseek as an open weight model was intentional. They really want to be the backbone of AI and AI infrastructure. And there's a really interesting report that came out last week that the New York Times covered from a startup called Aletheia, where they looked at some of the disinformation campaigns coming out of Russia and China right now, and they are latching onto data centers as an American culture war. I think in part in China's case. China wants to basically play up some of the fights around NIMBYism and environmental concerns and all of the legitimate concerns we have around data centers in terms of water use, energy use, contamination. They want to use that as a wedge issue so that we don't have the data center infrastructure in the United States that they own.

[Kara Swisher]

That's going into space. Nicola.

[Nicole Perlroth]

That's right. That's right. Yeah, can't wait for that one.

[Kara Swisher]

I gotta say, I'm with Sam Altman on this one. But anyway, at this moment in time,

[Nicole Perlroth]

all I'm saying is I wish we were living in a different world where we could actually sit down with them and have these conversations. And I think hopefully we will once the attacks start coming. But right now I am sort of the, you know, ye of little faith on this issue.

[Kara Swisher]

Every episode we get a question from an outside expert. Here is Yours.

[Dmitri Alperovich]

Hi, Nicole. Your friend Dmitri Alperic here, co founder of CrowdStrike and now chairman of Silverado Policy Accelerator. As you know, I spent a good chunk of my career putting names and faces on the hackers behind cyberattacks because I believed that naming and shaming them would deter them and mobilize collective government actions against them. From where you sit, do you think that public attribution of cyber intrusions is still important? Or have we become so accustomed and numb to it that it no longer serves any purpose? Thank you.

[Nicole Perlroth]

Love, Demetri. You know, the naming and shaming I thought had a big effect, and in some ways it did. We actually saw China go quiet. The Obama administration reached an unprecedented deal with China for a while that we would cease, well, really they would cease hacking for intellectual property and trade secrets. And we saw those drop off for about a period of 18 months. But that was during the Obama administration. In came Trump kind of tossed the tables over and we saw that resume. And when it resumed, it resumed in a much more sophisticated, well organized, stealthy way. And so in retrospect, all of that naming and shaming that made them stop, actually I think just sent them further underground. So there is a legitimate question to say, what is the long term benefit really of calling out these operations? I think we have to. I think the fact that China is pre positioning itself in some of our most critical infrastructure is worthy of almost daily national press coverage. And it hasn't gotten that, which is why I'm doing this podcast in the first place. I've just decided, okay, I'm going to focus on these issues that I think are super important but are not getting that kind of mainstream coverage. China's hacking of critical infrastructure being one of them. I mean, I think it would be a bizarre world if we were catching these Chinese nation state hackers inside our civilian water systems and for whatever reason saying, oh, it's just not worth attributing it to China. But Demetri has a great point, which is we are sort of becoming numb to this and there's been so little action and there is really no deterrence.

[Kara Swisher]

You mentioned Mythos at the beginning. Let's talk about Anthropic and its ongoing tensions with the US Government. Talk about how AI has transformed cybersecurity. This is something you had written about for Stuxnet and everything else. So talk about how it's transformed for both offensive and defensive purposes.

[Nicole Perlroth]

AI in the beginning, it's a really useful social engineering tool. Find me a useful target craft, a message in perfect English, in some cases, create an audio deep fake of someone's voice that this person legitimately knows, like a CFO of a major enterprise, and ask them to basically ask someone in their accounting department to make a wire transfer. All of those things are things that we are seeing. And we are seeing video deepfakes too. We're seeing North Koreans use deepfakes in some of these interviews. Now we're entering a new phase, which is AI is giving hackers this tremendous advantage to pull off everything I just mentioned at scale. It's also giving them the skills that they previously didn't have that previously were just the purview of these tier one nation states, like nsa. You know, US is nsa, and gchq. Israel, China, perhaps Russia, perhaps. It's throwing those skills in the laps of cybercriminals of these tier three nation states, like North Korea, like Iran. And I think we are about to enter what is truly the everything everywhere, all at once cyber scenario, which is anyone who has any interest in hacking, you will now have the tools to do so. Whether that is me pissing off North Korea because of a podcast, or Sony putting out a movie, or anyone that just has some dark interest in watching the world burn will now have these capabilities and all of them will come at us at machine speed. So on offense, I think it's very clear that AI will give the bad guys the advantage, the offensive advantage. The hope is, though, that AI will also help us defensively to do the things that, that we, with our puny human minds were never able to do before, like write secure code, handle configuration, ensure that we have multi factor authentication turned on at scale. You know, make sure that our vendors at least interrogate our vendors to make sure that they're not our biggest weak points. These are things where AI could create tremendous upleveling on defense. I think it's just a question of what is the delta between where we

[Kara Swisher]

are now and of course, there's this infighting. To me, a lot of what's been happening with the Trump administration is an inside Silicon Valley beef. But Anthropic initially released its Mythos, modeled in April to a limited group of companies for cybersecurity testing. Last month, the Trump administration abruptly banned the foreign use of Anthropic's two most powerful models, Methos and Fable 5. Just over two weeks ago, the Trump administration and Anthropic reached agreements to restore access. Talk a little bit of what's happening here, what's happening internally, because a little bit it is again this beefing among Silicon Valley rivals, really. And an example of that is Anthropic suing the Trump administration after the Pentagon declared it a supply chain risk. I think that was Emil Michaels doing. He's the undersecretary for Research and engineering. Anthropic CEO Dario Emodi went back and forth for months with Emil over safety guardrails and the Pentagon's use of AI. Emil famously was fired from Uber for a bunch of nefarious actions that he has denied. Talk about what's happening here overall and how does it end with the Pentagon, with the White House and everybody else.

[Nicole Perlroth]

Well, I think it's fair to call this a giant shit show. I don't dispute anything you just said that. I think it comes down to beefing and who's kissed the ring and who hasn't adequately kissed the ring. But, man, we have real supply chain risks in the United States, many of which I've called out in my reporting. You know, TP link routers were one. Deepseek is one. These are the real supply chain risks. So I think it says a lot that this administration went for Anthropic, I think because of these conversations between Pete Hegseth, who I went to college with, and Dario. Oh, wow.

[Kara Swisher]

How was that?

[Nicole Perlroth]

Over. I think they both actually spent some time at my alma mater. Anyway, no, Pete Hegseth, he was famous when we were in college for being part of this right wing organization that put out this magazine with an owl on the COVID in crosshairs. And OWL stood for Organization of Women Leaders. So he's always sort of been like this.

[Kara Swisher]

He's been a charmer for a long time.

[Nicole Perlroth]

Yeah, yeah. Anywho, I think, you know, this is why. And you've covered this brilliantly. This is why we saw Tim Cook show up with the golden statue. We saw everyone and their wives and mothers show up to the White House for the inauguration. This is what they're hoping to avoid. And in this case, apparently Dario didn't play the game, and they are where they are now. You know, it's amazing to me to have watched Anthropic do what I think was the responsible action to withhold this model once it saw what its cyber exploitation capabilities were, and then to watch David Sacks sort of disparage it on Twitter. And I think either in an interview with Politico where he said, this is all marketing, essentially, he was our Aizar. He's no longer our Aizar. But I had the same questions. You know, how much of this is real? How much this is marketing, which is why I went and interviewed Nicholas Carlini, the red teamer at Anthropic. If you listen to that interview, it's clear this guy doesn't have a marketing bone in his body. He's truly just a hacker's hacker who was testing the models to see what they're capable of and came away wide eyed at what these models can do. And I think Anthropic did the right thing. Now, coming back to the previous question on offense and defense, the best thing we can do defensively in this moment is take Mythos, take Fable, take every model from every major frontier lab, test its exploitation capabilities.

[Kara Swisher]

Including the new ChatGPT. Correct. There's a new one.

[Nicole Perlroth]

Exactly. And Gemini, you know, all of these models now have these capabilities, and soon again the open weight models will too. And our best defense is to take them, aim them at ourselves, and see where we are vulnerable and move very quickly to eliminate those inroads and kill paths. And so when you pull Mythos, or when you prevent our closest allies from having access to those models, from being able to essentially pen test themselves with these models, you know, test where they're weakest, it's a big deal because this is our sort of our greatest hope right now in terms of cyber defense, that we can use these models to test ourselves. And my understanding is that, you know, Mythos may still have the best cyber exploitation capabilities, but these other models are not far behind. And I don't know what the long term play here is.

[Kara Swisher]

They're not far behind, they're not far behind. Now, just for people to know, David Sacks, when he was repeatedly warned that any sort of AI regulation could cost the US and its lead race against China, he's accused Anthropic of, quote, running a sophisticated regulatory capture strategy based on fear mongering. And this is what's being influenced, this is what's influencing the Trump administration. This frenzied approach to lack of AI regulation in any way or cooperation, which is. Is more what you're saying here.

[Nicole Perlroth]

Yeah, that's right. And I think Anthropic has sort of done a good job doing some quiet education around some of these issues with the administration. Maybe that's why they backed off. But I think the big issue here is that again, we're entering a new era. I wrote a book, it took me seven years about the humans and what it takes to find these zero day exploit capabilities, these vulnerabilities that only they could find and, and the market that existed from governments to buy these from these hackers and use them in their offensive operations. And these were the best of the best.

[Kara Swisher]

And it was basically, this is how they tell me the world ends, correct?

[Nicole Perlroth]

Yes, this is how they tell me the world ends. And in retrospect, what that book was about was about scarcity. It was about the few people who could find these vulnerabilities and then create the code to exploit them in Systems like our iOS iPhone operating system, so that they could, you know, basically turn these things into ankle bracelets. If you had asked me, hey, write a sequel, and you can make it fiction, make it science fiction. What is the nightmare next chapter of this thing? I would have written a book that didn't look that different from the era we are entering right now where AI can essentially find these vulnerabilities that, again, were just the purview of these advanced hackers and nation states and turn them on anyone they choose. And that's the era we're walking into. And we can't do this like, game.

[Kara Swisher]

Yeah, China just said that it's Z. AI Already matched Mythos and cybersecurity. And then, of course, all the others will match what Mythos can do relatively quickly.

[Nicole Perlroth]

Right. These are all sort of like momentary delays towards the inevitable. Correct.

[Kara Swisher]

They just were the first to get there to say, oh, dear, where you're all headed.

[Nicole Perlroth]

But to your earlier point, like, we don't have time for the beefing.

[Kara Swisher]

No, we don't have time. But guess who likes to beef people with self interest. I'm not saying David Sacks has self interest, but I think I just said that David Sacks has self interest. I think it's all a Silicon Valley beef, and I don't think they're interested in national security at all. At all.

[Nicholas Carlini]

At all.

[Kara Swisher]

Like, in so many ways, it's something else happening here. But speaking of which, with Carlini, this research scientist in anthropic, let's listen to what he has to say about whether we're in for stability or chaos. Let's listen to him talk about it.

[Nicholas Carlini]

I think the primary thing that determines how this plays out is how good the models get and whether or not they favor defenders or attackers more. And I feel like this is mostly a question of nature, and we can try and balance it one way or the other by making sure that when we put these models out for the first time, we bias them towards defensive capabilities. But I don't feel like there's any particular action that this week we can take that will determine what happens here.

[Kara Swisher]

Are we past the point of policy or an ability to handle these risks that AI poses to cybersecurity.

[Nicole Perlroth]

I think that actually what Anthropic did with Mythos, essentially withholding it, they announced this project, project glasswing, where they were going to give the model to a certain subset of companies, mostly cybersecurity companies and banks, so that they could test their own systems and basically get ahead of the threat that was going to come. It's not perfect. There will be jailbreaks, et cetera, but I think it's actually a taste of somewhat good policy that we essentially, before we kind of throw these capabilities into everyone's lap, we essentially test them against ourselves and that way at least have a chance of defending ourselves. You know, there are companies coming to market that deploy agents that mimic these adversaries that you can test against your systems and not just the usual ways, but with social engineering and that kind of a thing. So there are, I think, ways to essentially uplevel ourselves here. And I think the best way is probably something that looks a lot like glasswing. And I don't think that it's a bad idea to essentially force the Frontier labs to red team these systems and give companies, particularly in critical infrastructure, advance access to these models so that they can uplevel themselves as well. But I have now been in CyberSecurity for almost 20 years and the state of our cybersecurity, particularly at critical infrastructure entities, is terrible.

[Kara Swisher]

We'll be back in a minute.

[Podcast Host Assistant/Announcer]

Support for this show comes from Odoo. There's an endless supply of software out there that promises to streamline your workflow. That may be true for a specific aspect of your business, but if you need one app for accounting, one for inventory management, another for sale, how streamlined can your workflow actually be? If you have to be the middleman between them, Odoo says they're the answer you're looking for. The only business software you'll ever need, Odoo can be your one stop shop for CRM, accounting, inventory, E commerce, HR and more. Plus, it's super customizable and easy to use out of the box. And the best part, they say not only can they replace multiple applications, but they say they'll do it for a fraction of the cost cost. Whether you're just starting out or already well on your way to scaling, Odoo wants to help you put the clutter aside so you can do what you set out to do when you started your company. Thousands of businesses have made the switch, so why not you try Odoo for free? @odoo.com that's o d o o dot com.

[Kara Swisher]

Let's go into cyber threat to the US Ahead of the midterms. The Trump administration has weakened CISA Cybersecurity and infrastruct security agency, CISA, which Trump established actually in 2018 as responsible for election cybersecurity, among other things. He also shut down an FBI task force intended to fight foreign influence in elections. The New York Times has reported these changes are part of a larger effort to affect the outcome of midterm elections. Talk about diminished cybersecurity agencies will impact election officials, voters, and potentially their results. And that's. That's not with the other stuff that they're doing. They're also getting these bipartisan commissions that help elections and give them good information. They're trying to break them down. Talk a little bit about that state when you're saying it's a shitshow, essentially.

[Nicole Perlroth]

So I should disclose here that when I left the New York Times, I left in part because I joined the, essentially the advisory board at cisa, which is the Cybersecurity and Infrastructure Security agency under Biden. They wanted a journalist on that committee. They asked me, I said yes. But of course, that meant stepping out of journalism because you can't be sort of inside the tent and reporting outside the tent at the same time. And it was incredible because I joined just before Russia invaded Ukraine, and a lot of CISA's efforts during that timeframe went towards getting American companies to get their shields up and also working with Ukraine cyber defense entities and other allies to help Ukraine. And it was an incredible effort. And one day, that should be my next book, because it really was a model for how public private partnerships can come together in a meaningful way. And, you know, I walked into that advisory role with basically zero faith in the federal government doing anything on cybersecurity. And I left truly impressed at what they were able to build in such a short time. So imagine my dismay when, you know, by the way, I got a letter saying, due to the misuse of resources, you are no longer on this committee. Like, I don't think I ever got paid a single dollar. In fact, I think I, like, forgot to expense my economy back at the plane.

[Kara Swisher]

So Elon's always trying to save us money. Elon's always trying to save us money. Mostly so he can take it for himself, but go ahead.

[Nicole Perlroth]

So they eliminated that committee. Fine. But then they started hollowing out the actual agency, I think in large part because of Chris Krebs. Coming out in the 2020 election and calling it the most secure election in history. But yeah, they took out some of the best. Those were people who were recruited during that time that I served on that committee who were probationary, which is just like, that's what happens when you take these jobs. No matter who you are or how good you are, you're just probationary until one day.

[Kara Swisher]

As long as you're not North Korean, but go ahead.

[Nicole Perlroth]

Yes, exactly. Way to bring us full circle. So, so anyway, they basically fired all those people and now we have a hollowed out cyber defense agency and it's kind of free reign now. I should give credit to the FBI that I think has really stepped up and the FBI cyber division is incredible and they are still doing what needs to be done to sort of out some of these Chinese operations on our critical infrastructure. And they're getting on top of this North Korean issue as well. And those are really good people. I will say that the people I have met in the FBI cyber division are fantastic. They are shouldering a lot.

[Kara Swisher]

So Patel doesn't know about them yet.

[Nicole Perlroth]

Yeah. And hopefully he doesn't listen to this because I like to keep it that way. But yeah, it doesn't make any sense if you truly care about national security. Well, cybersecurity is national security. This is where our adversaries, especially adversaries that know they can never match us militarily, are investing. And you know, it might be the case that you don't care if Russia tries to interfere with our elections because maybe you think that they're on your side, but they're not the only game in town. You know, there is China, there is Iran, there are other adversaries. There are a lot of good reasons why we should all care about cybersecurity of our critical infrastructure. And it's getting to the point where we're just sort of waiting for that everything everywhere, all at once, attack era to start. But it's coming. I mean, it's coming without human fatigue from machines across all time zones. And it hasn't happened yet. But hopefully once it does, we'll see just how shortsighted these decisions were.

[Kara Swisher]

The other side of that, of course, is there are real threats from China and Russia. And you talked about the exploiting the public debate around data centers and so division through AI generated images on social media. I do think it's a real grassroots situation and it's not being organized by Russian China. People on the ground are really upset about these data centers, but there is an element of foreign influence campaigns everywhere in every aspect of America. Now, how prepared are U.S. cyber officials to combat this level of misinformation ahead of midterms, the stuff that's there already, although some of the misinformation is from the government itself, by the way. So it's kind of a weird situation we find ourselves in.

[Nicole Perlroth]

Yeah, I would say it's the weirdest situation that we've been in since I started studying this stuff. We are in no way prepared, is my understanding, for some of the coordinated misinformation campaigns that will come at us full throttle in this election. You know, it wasn't just cisa, it was the State Department. You know, their bureau that basically monitored these threats was completely dismantled, and we saw what happened. I think it was last week, where they essentially fired everyone on this election commission, that their whole job is ensuring free and fair elections at the state level or helping states offer free and fair elections. So I'm pretty concerned this is coming at us, though. It's not just Russia.

[Kara Swisher]

What could they do? Give me an example. What could any of these sort of nefarious entities do?

[Nicole Perlroth]

So my nightmare scenario has always been that we saw in 2016 that Russia got access to the voter rolls, and they didn't do anything right was our understanding. But they got access to them, and it was clear that they were sort of mapping our election infrastructure. And the sort of consolation that I would hear at the time was, well, thank God our elections are so decentralized. They could never hack this thing at scale. But I think what we have all learned over the last 12 years is our elections come down to a few purple states and a few counties in those purple states. And my nightmare scenario is you would pull off a hack where you'd essentially go to those voter rolls and mark the people that might vote for the candidate that you don't want to win as not registered. You would change their registration status. So they would show up to vote on election day, and they'd be told, oh, you're not registered. You could think of it like a denial of service attack against sort of key people in these key counties in a U.S. election. And when we're not paying attention to some of these operations, you know, that's really hacking. That's not disinformation. It's more that we've dismantled disinformation. I'm assuming, hoping.

[Kara Swisher]

But you could use AI to figure out what are the 300 key people here.

[Nicole Perlroth]

Well, it's, you know, what I just described as a hacking campaign. But you could also imagine a disinformation campaign aimed at those people where you wouldn't have to change their registration status or leave those fingerprints, but would just send them some kind of notice to say, hey, you're not registered, and maybe they wouldn't show up on their own volition. And then how do you go back and track that? And there are all sorts of tools that are being thrown in people and nation states lapse to do that. So when you don't have people whose specific job is to track these campaigns, at the State Department, at cisa, et cetera, et cetera, et cetera, that's very troubling.

[Kara Swisher]

Yeah. It's almost like they want to change elections. It's interesting. Anyway, last question. Last year on this podcast, you said that cybersecurity remains a bipartisan issue despite all this nonsense from Trump. Especially, you said it remains a. A bipartisan issue. Is that still true? Do you feel that or not at this point? Because the Trump administration is trying to put his finger on the scale. It's very obvious through these firings and demotions or just disintegration of these units that matter.

[Nicole Perlroth]

So clearly at the White House, it's been politicized. It's no longer a bipartisan issue. Every level below that, though, I've met with staffers for senators from both sides. Same with Congress. There's a lot of collaboration that happens in cybersecurity, thank God, not just among political parties, but among competitive companies. This is one space where the chief information security officers are constantly talking to each other about the threats that they're seeing, and they're even organized by industry, where they get together and talk about the threats that they're seeing. And that level of threat intelligence is only increasing now with AI and hopefully will continue to scale. Unfortunately, some of these things have become politicized, particularly around the misinformation, disinformation. Tracking and Elon made it a huge issue. The Twitter files were basically used to validate this conspiracy theory and validate what happened next, which was sort of the destruction of the teams that tracked these issues. And even worse, we saw the people who worked on these issues at Twitter, et cetera, become targets for death threats, et cetera. So it's like, who wants to raise their hand to take these jobs anymore? We saw what happened with Chris Krebs.

[Kara Swisher]

So who does?

[Nicole Perlroth]

Well, it's depressing. It's not just cybersecurity. I was calling my friend, who I think is infinitely qualified to run for Senate in Maine right now, and if he was to stand up and raise his hand and say, I'm running. I think he could win, but he won't because, you know, he's looking at past data that says there's a narrow path. But more than that, it's just like, if you have a nice life, why put yourself through that right now? And it is happening on both sides of the aisle. You know, I also went to college with Mike Gallagher, and when he retired from Congress, he said, I signed up for this, but my family didn't sign up for death threats and swatting. To me, that's almost the guy.

[Kara Swisher]

Very too bad he left. Right. Another person who was very sharp and bipartisan. But do you have any hopes for bipartisanship? I guess at this moment, I think

[Nicole Perlroth]

someone has to go. And I think until then, it's just gonna get worse and worse and worse.

[Kara Swisher]

Or we get an attack. Or we get an attack. That's devastating. Yeah.

[Nicole Perlroth]

Yeah.

[Kara Swisher]

Well, on that note, Nicole, I appreciate this is a great conversation. I really appreciate it. You bring all this sunshine to our world, right?

[Nicole Perlroth]

Just a ray of sunshine.

[Kara Swisher]

Ray of cyber sunshine. Thank you so much, Nicole.

[Nicole Perlroth]

Oh, my gosh. Thank you so much, Kara. Good to see you.

[Kara Swisher]

Today's show was produced by Michelle Aloy, Kathryn Millsop, Madeline LaPlante, Duby and Kalyn Lynch. Nishat Kurwa is Vox Media's executive producer of podcasts.

[Podcast Host Assistant/Announcer]

Special thanks to Julia Sharp Levine, Bradley Sylvester, and Dave Shaw.

[Kara Swisher]

Our engineers are Fernando Arruda and Rick Kwan, and our theme music is by Trackademics. If you're already following the show, you won't be recruited to join a global hacking crime syndicate.

[Podcast Host Assistant/Announcer]

If not, your linen closet would make a great laptop farm.

[Kara Swisher]

Go wherever you listen to podcasts, search for on with Kara Swisher and hit follow. Thanks for listening to on with Kara

[Podcast Host Assistant/Announcer]

Swisher from Podium Media, New York magazine,

[Kara Swisher]

the Vox Media podcast network, and us. We'll be back on Monday with more.

[Podcast Host Assistant/Announcer]

Thanks again to Odoo for supporting this show. Odoo wants to be your ultimate all in one, fully integrated platform to handle everything. Seriously, everything. Inventory, CRM, accounting, hr, and much more. No more shopping around or settling for expensive services that can only handle a fraction of your business. Thousands of businesses have made the switch, so why not you try Odoo for [e-mail] that's o d o o com.