Loading summary
Transcript105 lines
- [00:00]
A
Foreign.
- [00:04]
B
This is Tom Buren, I'm here with the GRUK for another between two nerds. G', day Grok, how are you?
- [00:09]
A
G', day, Tom. I'm fine. And yourself?
- [00:12]
B
I'm well. This week's edition is brought to you by Push Security who tie together a browser extension to protect identity across corporate networks. Find them@PushSecurity.com this week they're was an article, or maybe last week, came out in a number of European publications. The one I looked at was the Insider, which is a Russia focused online magazine that we've, we've spoken about their material before. So a while ago they, they wrote about unit 29155 and how it got into cyber. Well, cyber operations now going to talk about, I guess, different training paths in different intelligence cultures. And so the article is, it's titled the GRU's Hogwarts. So GRU, Russian Military Intelligence. Hogwarts is obviously the school inside Bauman University's Department 4, an elite spy school for Russian military intelligence. I looked at this article and I did not write about it in the newsletter.
- [01:22]
A
Oh, you fool. How could you not write about it?
- [01:26]
B
Well, I'll tell you. And the reason was it felt to me that, yes, the Russians and the Chinese are far more explicit about what they want you to do. So there's talk in here about how the GRU trains students in hacking attacks. During the courses, students are taught to create viruses. And that felt like the ctf,
- [01:53]
A
which is dominated by university teams, I would point out, does not do that at all. Right. They absolutely deplore the idea of teaching offensive cyber skills to people.
- [02:11]
B
But it just felt to me that
- [02:12]
A
it's the sort of thing that a nefarious place that does war crimes would do is what I'm thinking.
- [02:18]
B
Right. Yeah. So it just felt to me that like this is more explicit about the purposes that we want to use it for. Like it's for Russian state intelligence and hacking and destructive operations. But that exactly the same thing goes on in Western universities. It's just maybe not quite so explicit but, but you know, NSA has relationships with a number of US universities. Like they've got good ones with Maryland I think, like just because geographically they're close. And ASD has a center at the Australian National University here in Canberra. And ASD people work there and they're not out there saying, yeah, we're going to help hack the planet.
- [03:02]
A
They don't have a, they don't have a booth that you go up to and say, you know, sign up to be A spy here, necessarily.
- [03:09]
B
Well, they have a booth, though. Like, there's a public face in the sense. And I think they go to careers fairs and say that.
- [03:19]
A
Right.
- [03:20]
B
They're pretty.
- [03:21]
A
I can't tell you what you would do, but you could sign up here.
- [03:23]
B
Well, I think that that has changed. So when I first joined, it was DSD back then.
- [03:29]
A
The fact that they didn't have computers back then, the Telegraph, was really exciting.
- [03:36]
B
We had Solaris boxes. I think I was on a Solaris machine back then. And the fact of hacking for intelligence was it was kept in a compartment, so it wasn't general knowledge, even within the classified space. So that was what, 25 years ago?
- [04:03]
A
But the recent. Then, if you're.
- [04:05]
B
It feels very recent. And so I think nowadays, getting back to Anu, it would be, yes, we've got a publicly acknowledged function to do this. It wouldn't be, oh, yeah, we're hacking the Russian President's office or whatever that's would be.
- [04:20]
A
It's a little bit more nudge, nudge, wink, wink. Thank you.
- [04:25]
B
Yeah. So I felt that this article was a difference of degree rather than of kind. Like, we do a very similar things. We've got links with universities, we try and get a pathway to find. And is it nurture and train good potential students and at least give them the opportunities to come into those communities, those jobs, if they've got, you know, whatever talents we happen to need. But. And this is. I think it's partly the reporting and partly the culture. Like, I think the culture is much more explicit and I think the reporting. You're probably going to pull out the really more sensational elements.
- [05:09]
A
Right?
- [05:09]
B
Yeah, yeah.
- [05:10]
A
You want to be. You're not going to be. News flash. People get advanced degrees and then go on to work for intelligence agencies.
- [05:18]
B
Exactly. Like, that's advanced degrees in computing and. Whoa, whoa, whoa, whoa. Exactly.
- [05:26]
A
That sounds like the Department of War Crimes, now that you put it that way.
- [05:32]
B
So that, in fact was one of the headlines from. I think it was Despiegel. Right.
- [05:36]
A
Much like you, I saw this article and I was a little bit like, yeah, no, so what they tell people that if you take advanced degrees in cryptography and hacking, you can work for state intelligence services that do cryptography and hacking. Like, it just. It's. It's not a very interesting story to me. Right. Then Vladimir Stirin, a Ukrainian hacker, wrote a substack post about this where he. He basically positioned it as, these are great articles, well written, well researched, etc. Etc. But the framing is counterproductive. Look at this evil thing that the heinous enemy is doing is a bad position to take because everyone should be doing that. This is not an optional thing that only the bad guys do. These are table stakes for a nation these days. You have to be developing a pipeline of people who are very capable in this domain, which I completely agree with. It is probably the most important thing that you could be doing as a state is making sure you've got good hackers. And there's probably other things that a state does, but I'm not really aware of them.
- [06:53]
B
Part of the problem I have with that framing is that, like I said, one of the magazines who wrote about it called it the Department of War Crimes. And it feels like to me, of all the bad things that Russia is doing in Ukraine, the cyber elements are actually the least concern.
- [07:10]
A
Right.
- [07:10]
B
Like, yes, they're doing really terrible things, but what they're doing in the real world vastly overshadows what they're carrying out in the cyber realm. And so, yeah, I'm not endorsing what they're doing, but the. That's not the main problem. Like, the main problem is that they're
- [07:27]
A
willing to do more things I'm concerned about. That's not one of them. Yeah, well, like, out of. Out of all of the things they're doing, that's bad, that's pretty. Like, in order to see it, I'd need to use the UNIX command tail, because it'll be at the bottom of the list, I guess.
- [07:43]
B
And I think the main problem is that they're willing to cross those boundaries, and then cyber is one of the tools that you're using as well.
- [07:49]
A
Right.
- [07:49]
B
And so it's not the cyber that is the problem, it's the willing to cross the boundaries. And cyber operations are generally less effective at causing physical damage and killing people. Right. If you're willing to kill people, that's the real problem, not the cyber operations.
- [08:08]
A
If you're willing to kill people and you use cyber, you're probably not going to be very good at it. So, yeah, like, I wouldn't consider it as much of a problem as if you're willing to kill people and you have planes with bombs. Like, that strikes me as a more dangerous proposition.
- [08:24]
B
Yeah. So Vladimir did make me think about what is a. That Russia. And I think I would put China in this category as well.
- [08:31]
A
Right. Yeah.
- [08:31]
B
What do they gain by being so overt and explicit about. The point is. So I remember when we spoke to Alex Joski, he said that, yes, they've Got ex or even current, I think mss, Ministry of State Security, people teaching at universities and they've developed a pipeline of universities to hacking. And so it feels like they're in the same camp of we'll be pretty explicit about what the purpose, why we want you to do it. Right. It's for state power and there's a pipeline to help the country.
- [09:07]
A
So as, as I recall, actually the MSS university is called the University of Contemporary International Relations. Right.
- [09:18]
B
That's. That's the MSS think tank is Kicker.
- [09:21]
A
Right.
- [09:24]
B
I think that's the, I think that's the same thing you're talking about. Yeah.
- [09:28]
A
Which I always thought was very funny because for China, international relations is a 5000 year history and then spying is like the last little bit of that.
- [09:38]
B
Yeah. So the think tank I worked at, we had a reciprocal thing with Kicker where we.
- [09:45]
A
You put people with them and they put people with you and there's a sort of cultural exchange.
- [09:50]
B
It was. What is it called, one and a half tracks or second track dialogue where you'd occasionally meet up and discuss issues. And those could be quite illuminating at times. Unfortunately, I never met up with the Kicker people. It just never happened. I think Covid got in the way or. And plus the fact that China and Australia had a really rocky relationship and we didn't want to go to China and get arrested there.
- [10:13]
A
Yeah. I'll admit that when I read Vladimir's post, I agreed with him that I think that the framing is not good. But in talking, I sort of, having not gone through any career path stuff, the fact that it's implicit meant that I wasn't really thinking about it.
- [10:36]
B
Right.
- [10:36]
A
Having, having not lived that experience, I could go, oh no, that doesn't make sense. It's, it's different. It was just like, it's a thing I know about intellectually, but it's not a, like, it's not something I would actively be like, wait a minute, I have a counterfactual to bring up. It's just. Yeah, you're absolutely right. It, the, the US should be doing this and the UK and Australia, they should be on top of this and then talking to you for two seconds like, oh yeah, they are. They just. Well, I mean, like, look, here's the thing, right. At this university, they, on their website they have this thing that goes like Department one, Department two, Department three, Department Five.
- [11:18]
B
So I think.
- [11:19]
A
And that doesn't exist in the West, I think.
- [11:21]
B
Yeah, it may be larger, more explicit and more direct. Just like, yeah, here's A pathway from high school through to intelligence or organization.
- [11:35]
A
Right. Like you know what you're getting in for at the beginning because you basically explicitly signing up for that. Whereas in the west, my understanding is it's more of this. Like that's not just wink, wink. It's very, I think it's more explicit. You could do it if you wanted to, but it, yeah, it doesn't feel
- [11:52]
B
like a pathway so much as an opportunity. Like, so if you're interested in this, here's this area where you can study in related fields and if you think it's a good fit at the end you, you'll have skills that are relevant and you'll have spoken to people. And so it feels like here's a door that's opening rather than a pipeline or a pathway. And so, I mean, it made me think about what are we missing out on? Does anyone have it? Air quotes. Right.
- [12:25]
A
So I think that one of the things we need to consider is that is it fit for purpose? Right. It's slightly different from who is doing the correct education pipeline to sort of who is doing the right education pipeline for the strategy that they're pursuing, assuming that strategy is correct. Right, right and right. And I think China's pipeline, where they've got like, whatever it is, 9 or 16ft of universities, like just this huge number of universities that have explicit sort of intelligence school track, makes a lot of sense. If you're China and your idea of the correct strategy is just to have this overwhelming volume of skilled people in the private sector, in the public sector, contracting, starting companies. If you just want a lot of people doing this, then you want to have a lot of feeder universities producing people that can do this. I think it also makes sense.
- [13:25]
B
Yeah, I think it also makes sense in the term of if you want them to go out and steal intellectual property, it's probably good to be explicit at university, is that this is an okay thing to do. Probably doesn't make sense for the US or Australia to do that.
- [13:39]
A
You don't want them to go through an ethical, an ethical course and then come out the other end with crazy ideas about intellectual property and copyright. If, for example, Australia had 16 feeder universities, I don't know if you've got that many universities overall. I don't know if you've got that many people, to be honest. But okay, so if you had this huge number of universities with explicit career tracks of like you sign up on year one and at year four or eight or whatever, when you're done with your degree you have this entire career laid out for you that you could just get into. If the volume of people you would get from that would help in any way, like would it?
- [14:23]
B
Right.
- [14:23]
A
Would it just mean that you are suppressing the price of like, would you just be suppressing wages for cyber people in the private sector? Because it'd be flooded with all these people who just like you don't have that many roles like you, you can't, you know, staff 10,000 people every year into cyber or.
- [14:43]
B
Right.
- [14:43]
A
Yeah, whatever it is, you know.
- [14:44]
B
Yeah. I mean what occurred to me is that going back to when I started at Defense, it seems like these are both kind of symptoms of a sort of culture of being very, very careful about information.
- [14:57]
A
Right.
- [14:58]
B
And I can't say offhand that it's wrong because it seems that like, you know, you look at China, it seems that open, very forthright strategy suits what they're doing. But at the same time, I don't know. Well, actually like ASD as it's now known has like undergone tremendous growth over the last 10 years.
- [15:20]
A
So it's really developed and self actualized just in terms.
- [15:27]
B
You don't actually hear a whole lot more about it. But I know that the number of people there is two or three times when I was so like 10, 20 people now. And so they're, I guess hiring people has always been a difficulty, but not necessarily because they weren't there, but because there was a lot of competition from the private sector. And so you know, maybe suppressing wages by having more people.
- [15:55]
A
There is actually a very good reason. Yeah. So like my understanding is that people who do the public sector thing, I'm not going to say it's a cult but, but it does, it does have the sort of like you need to buy into the idea that mission and
- [16:10]
B
that is more important. That was the word I was going to use, mission.
- [16:14]
A
But yeah, like I, I know people who have left and for them it has been this thing of their. Like as soon as they started doing money instead of mission, they were like whoa, like there's a different way of looking at the world and it's different
- [16:33]
B
good or different bad.
- [16:35]
A
Yeah, it's. They just, they sort of lost the mission mindset I guess is how you would put it to be nice. It's like for them suddenly.
- [16:43]
B
And how would you put it if you weren't being nice?
- [16:46]
A
They've left the cult and they've reactualized, they've re acclimated to society. I mean it's the same thing with the Military, Right. Like the military has an indoctrination phase where you join the cult of the military, where you have to. Culture's got the wrong negative connotation here.
- [17:08]
B
I mean, it's a common system of belief.
- [17:11]
A
Right. And it would be the same things. Like, look, people who join the IRA to become terrorists, they join a cult in the same way it's that they have what J.B. bell called the Dragon World, which is a terrible name, that basically it's where this belief system that you have becomes the lens through which you interpret everything in the world. And so because as a, like a terrorist, your belief system is we will have a united Ireland or we will have a Basque homeland or whatever. Everything that happens has to be filtered through that lens. And I've seen. I've seen an interview with that guy who had left and now sort of tries to get people out. And he was saying that for him, like, there's sort of like these little things that like built up and built up and built up. And then suddenly one day there's literally like a pop and it fell away. Like there's a before and an after, and it was a physical sensation when he was like, this is different. Like, what was. I was. Like I was crazy. What was I thinking back then? That makes no sense. And there was this distinct before and after where his just worldview had changed.
- [18:14]
B
So this was someone who was in a terrorist organization. Yeah, like they were not working for the government. So I think this is very interesting in that up until the point where you said that someone could renege, renounce, understand that they were in a cult, I would have said that what you were saying applies to any organization which has a mission driven value set.
- [18:38]
A
Yes.
- [18:39]
B
And so I think that.
- [18:40]
A
I think it applies to a huge number of things. And cult is an unfortunate term in having all these negative connotations, but it does capture the sense of like, once you buy into something that becomes the way that you view all interactions. It's the lens through which you interpret.
- [18:56]
B
Yeah, yeah. So I would agree. I wouldn't have used the word cult. But like, you know, in that framing, I think that's true that many of the people in intelligence organizations are driven by the sort of values that they think that they're representing. And so, you know, if you're in asd, it's because you think you're doing a good thing for the country and the country is worth maybe not fighting for, but working for. And I think the value in being more explicit is that you can attract people by being much more direct about what you're actually achieving. And so they try and do that by couching things in hypotheticals or theoreticals like, you know, you'll contribute to the country somehow in this vaguely fuzzy, not particularly explicit way. I guess in Department four they can say you'll contribute to the country by hacking Ukrainians or whatever, by leaving mean
- [19:52]
A
comments underneath people's Instagram posts as part of an influence operation.
- [19:58]
B
Well, so that was the other interesting thing about Department four is that they've actually got explicit propaganda. Department four seminar over New overview for advanced students. The seminar, the group seminar. Developing a propaganda campaign is mandatory. The task description for the practical exercise Create a social video for any topic using manipulation, pressure and hidden propaganda to promote or refute Hot topic. The title of another lecture is Propaganda Agitation, Manipulation and Persuasion. So I thought that was like a pretty significant difference between what you would get at a Western university in these kinds of fields.
- [20:41]
A
Right, yeah. So I think it's because it reflects the Russian doctrine of information confrontation. Right. So they don't view like cyber as a separate category of things. They view it as a part of sort of information operations overall. So they have the idea of the information sphere and that you do things within the information sphere. Maybe it's, you know, put up posters or pay influencers or run ads or hack into things and compromise them. Like it's just all the same thing in general. And so when they're doing operations in theory, should sort of be thinking about the psychological angle as well.
- [21:29]
B
So that seemed like the description in the Insider. It seemed different from psychological. So I don't know if that's the translation. Now what it made me think about,
- [21:42]
A
conceptually they don't make that distinction. Right. Like they don't think that propaganda and influence or information, like they, they don't see these as like separate disciplines. It's just here is how you change people. Like here's how you impact like social cohesion or here's how you change minds and here's how disrupt groups of people. Like it's, it's a thing that you do to people's minds.
- [22:09]
B
Yeah. Now this part made me think about the uk, the National Cyber Force, their offensive cyber peoples. They came out with this document where they talked about the doctrine of cognitive effects. And they said the idea of offensive or of some of our operations is to influence the thinking of, of a relatively small number of people. And it seemed like maybe western courses are missing a trick because I've never seen a kind of psychology based manipulation course Just chucked in with all the cybersecurity stuff, right?
- [22:44]
A
No, I completely agree, but I think that it's a reflection of the fact that our doctrinal understanding of cyber is wrong or incomplete, I think is a better way of putting it that we, we have for too long we have simply discarded the idea that like there's people at the other end of the computer and you can manipulate them and that's a useful thing to do. And we've just been focusing on the like, oh, how can we turn off the lights or can we impact like water desalination or whatever. And because, because that's been sort of left aside, my feeling about this is that we were missing a huge part of how you can actually use the domain to achieve your end goals. So this reemergent of cognitive effects is great. The idea that, oh yeah, we can influence how people think, it's not sort of too little too late, but it's sort of quite a little and it's quite late. And I think it should, I agree with you that it should be more integrated into the trading pipeline. And this is going to be very, very controversial. But in my opinion, if you are doing computer science courses, to be a good hacker, you should also have to do literature courses and humanities courses because you need to know about people, you need to have critical thinking skills. And I know that that gets dismissed very easily, but fundamentally, if you understand that people are people, that will be super helpful with the rest of your career
- [24:26]
B
101. There are other people in the world, they have their own thoughts and feelings and motivations. Say after me, we have a two
- [24:37]
A
day seminar on not using NPC to describe everyone you interact with.
- [24:42]
B
Well, so, I mean, that's what I was thinking is that there's the people who, you know, this is a bit of a stereotype, but the people who often are very good at cybersecurity tasks are not people people people. Right.
- [24:57]
A
Not necessarily the best at say reading social cues or.
- [25:02]
B
Yeah, so in a intelligence community environment where you were trying to do that, you'd have like multidisciplinary disciplinary teams. You'd have hachetypes who are good at that and I don't know, the touchy feeling people who can understand.
- [25:17]
A
It's the old joke of like, how do you tell an extrovert at the nsa he's the one who stares at your shoes. Yeah, right, That's. I mean you're not going to take that guy and be like, all right, sell me this pen. Right.
- [25:30]
B
So I was you know, at defense, I was the, you know, I was the extrovert there. And when I did psychological, like testing, it was like, yeah, you're more introverted than 75% of people. And the other people in my team were more introverted than 99.9% of people.
- [25:52]
A
See, so one of the things, just sort of riffing off that, one of the things I've noticed is that even though there is this doctrine, this Russian doctrine of like, information, technical information, psychological, this spectrum of this continuous domain of conflict and all that, they don't seem to be doing that in Ukraine. That doesn't seem to be a big part of their operations, if at all. And well, okay, look, they have influence operations, but they don't have this sort of like integrated multi spectrum cyber influence, all the stuff together. And I have a theory for this, right? If you were going to design an influence operation, would you go to your hacking team and say, all right, guys, how do we change how other people think? Well, almost all of the things I've
- [26:43]
B
read, it doesn't seem like they construct multidisciplinary teams. They take units and the units do things. Whereas it seems to me that the better way to do things is say we've got this purpose and we need these different skills and we're going to bring them together and you're going to go do that job. And that could involve like the psychology
- [27:05]
A
type people used car salesman from CIA or whomever.
- [27:08]
B
Yeah, exactly. And that's how I expect it would get done in the US Intelligence community.
- [27:14]
A
Right. That seems, that seems the Western approach to a degree.
- [27:18]
B
And like, we don't see those operations usually because they're so small and tailored at individual people and they don't end up in the newspaper.
- [27:28]
A
So this is, this is, this is strategic culture, I think, in that the, in Russia, so I don't know the Chinese approach at all, I have no idea. But in Russia there's very much this sort of feudal idea of how things work. Like you, as, as the head of a department, you're basically a lord and you have your vassals beneath you. And so the idea of like sharing your people with someone else's people to go and do some third person's job where they get all the credit is just alien in a way that like, it's, it's so foreign, it doesn't really make sense. Like, why don't you lend me your right hand for a while and I'll give it back to you when I'm done. Like, it's just like it. It doesn't compute. But yeah there is this sort of futile structure of like when you're in charge of things you want to like very much stay there and you have your like group of people that reports to you and you do your stuff like you come up with your missions and well probably not exactly like that but you know, you're very much autonomous within your unit like that and so having a system of like putting people together based on skills for particular missions and then disbanding goes against how it's actually structured. Right. This is this informal implicit structure of how it works and that system just it's so alien I don't think you could like you need to restructure too much right.
- [28:57]
B
So it seems like the Russians have the kind of overarching framework right but the execution wrong whereas Western agencies have the execution right but the overarching framework wrong when it comes to. So you win some, you lose some. Thanks a lot. Thanks guy.
- [29:17]
A
It.