Podcast Summary: Risky Bulletin – Srsly Risky Biz: America Wants to Hack the Planet
Air Date: August 28, 2025
Host: Amberly Jack
Guest: Tom Uran (Policy & Intelligence Editor)
Theme: Exploring new U.S. legislative approaches to hacking foreign cybercrime, Microsoft's evolving China security posture, and repercussions for policy and the private sector.
Main Episode Theme
This episode dives into two major cybersecurity topics:
- Proposed U.S. Legislation: The "Scam Farms and Mark and Reprisal Authorization Act," a controversial bill to empower private sector hacking against foreign cybercrime.
- Microsoft’s Security Reversal: New restrictions on information sharing with Chinese vendors and the ramifications of deep-rooted trust issues between U.S. tech and China.
Key Discussion Points and Insights
1. U.S. "Hack-Back" Bill: The Scam Farms and Mark and Reprisal Authorization Act
- Overview (00:45–03:02)
- The bill revives the concept of “letters of marque” – historically, government licenses for privateers to attack enemy ships, now applied in cyberspace.
- Ostensibly targets “scam farms” (large criminal operations scamming U.S. citizens), but is written far more broadly.
- Critical Analysis (03:02–07:44)
- The bill allows the President to authorize private sector groups to hack any foreign cybercriminal entities, not limited to scam farms.
- Tom Uran:
“It’s more like hack anything or anyone that the President wants…tremendously broad, not at all limited to scam farms.” (03:02) - Comparison with the prior ACDC (Active Cyber Defense Authorization or Certainty) Act, which faltered under technical and policy flaws.
- Main problems with hack-back legislation:
- Attribution: Risk of attacking wrong targets.
- Scope: Applies to almost every threat actor attacking the U.S.—a wide-open field.
- Collateral Damage: Potential to interfere with ongoing law enforcement and state operations.
- Tom Uran:
“…when you’ve got such a large, I guess, scope like that’s just impossible to deal with. So the ACDC went nowhere.” (06:06)
- When Hack-Back Could "Make Sense" (07:44–08:36)
- Scam farms might be uniquely suited for targeted private action, due to their decentralized structure that's hard for state agencies to disrupt decisively.
- But Uran remains skeptical about direct impact:
“…I’m not sure that state action, at least in the cyber realm, will make that much difference; but perhaps like broad based, private sector based action could, could make some sort of difference.” (06:52)
- Flaws & Political Realities (07:44–09:59)
- The bill is vague about financial incentives—what happens to money seized from criminals?
- Not a serious legislative effort:
- Lacks co-sponsors.
- Likely a “messaging bill” to generate debate, not become law.
- Tom Uran:
"It felt to me like there's this thing called a messaging bill...a think piece, something to provoke thought. And I think for that purpose it's actually quite good." (09:19)
2. Microsoft, China, and "Trust Debt"
- Microsoft's MAP Program Change (10:16–12:14)
- Microsoft’s MAP (Active Protection Program) gives trusted vendors advance access to vulnerability details and sometimes proof-of-concept (PoC) exploit code.
- Recent incidents suggest Chinese vendors may have leaked PoC code to Chinese intelligence agencies or cyber contractors—possibly leading to high-profile mass hacks.
- Microsoft has decisively scaled back what Chinese vendors receive (from PoC exploit code to only general vulnerability descriptions, and only at patch release).
- Where Did the Leaks Come From? (12:14–13:18)
- Possibility the information actually leaked from Microsoft’s own China-based engineering teams.
- Chinese law requires individuals and companies to assist with intelligence efforts.
- Raises doubts over whether Microsoft should have ever trusted China-based engineers with sensitive projects.
- Microsoft’s Slow Security Evolution (13:18–15:58)
- For years, Microsoft prioritized cost and speed over security, leading to questionable decisions (e.g., Chinese engineers working on U.S. DoD systems).
- Only after a damning Cyber Safety Review Board report did Microsoft begin to prioritize security at the executive level.
- Tom Uran:
"If you really care about security, both of those are non-starters...but no, now Microsoft has had in the past year...a revelation that, oh actually security is important..." (13:54) - “Nadella, in his memo…said, you know, security is a team sport and they're only just realizing that some of their players are actually potentially playing for a different team.” (15:50)
- Long Road Ahead (15:58–17:03)
- The Microsoft-DoD-China entanglement will be extremely painful to unwind due to a lack of available, affordable skilled engineers.
- AI may be part of the solution, but “it’ll take time.”
- Tom Uran:
"I think it's going to be extremely painful." (16:20)
Notable Quotes & Memorable Moments
-
On the Bill’s Scope:
“Anyone the President doesn’t like, as long as you can, I guess, plausibly say that they’re a criminal…[it’s] tremendously broad, not at all limited to scam farms.”
— Tom Uran, (02:41) -
On Old Hack-Back Proposals:
“…if you were attacked, the idea was you could, air quotes, hack back…to do a certain limited number of things like attribution, try and protect themselves, or do things like delete stolen data. Now none of this made sense to me...”
— Tom Uran, (04:12) -
On Policy Messaging:
"It felt to me like there's this thing called a messaging bill which is you don't expect it to pass, but you float it up as a think piece, something to provoke thought. And I think for that purpose it's actually quite good."
— Tom Uran, (09:19) -
On Microsoft’s Delayed Security Prioritization:
"Microsoft has gone through a long phase over the last couple of decades where it's basically not cared about security enough in my view...Now Microsoft has had in past year or so a revelation that, oh actually security is important."
— Tom Uran, (13:19) -
On Learning from Mistakes:
"They're only just realizing that some of their players are actually potentially playing for a different team."
— Tom Uran, (15:50)
Important Segment Timestamps
- Introduction to the episode and topics: 00:05–00:45
- Overview and deep analysis of the U.S. hack-back bill: 00:45–09:59
- Microsoft’s evolving approach to China and lessons learned: 10:16–17:03
Tone and Style
The conversation balances skeptical, dry humor with serious concern over the practical realities and risks of cybersecurity policy. Tom Uran provides candid, often sardonic insights, while Amberly Jack steers the discussion to clarify legislative intentions and high-level industry impacts.
Takeaway
The episode provides a nuanced exploration of U.S. cyber counterattack legislation—ultimately revealing its broad overreach and limited political viability—while exposing long-standing problems in Microsoft's trust and security culture as it recalibrates its approach to China in a geopolitically charged era.