Risky Bulletin Podcast Summary

Episode Title: Srsly Risky Biz: US Cyber Command to be unleashed
Host: Patrick Gray
Guest: Tom Uren, Policy and Intelligence Editor at Risky Business
Release Date: May 8, 2025

Overview

In this episode of Seriously Risky Business, host Patrick Gray engages in a deep-dive conversation with Tom Uren, the Policy and Intelligence Editor at Risky Business, to explore two critical topics impacting national cybersecurity. The discussion centers around the evolving role of the US Cyber Command towards more aggressive offensive cyber operations and the troubling use of the Telemessage Signal app by senior White House officials.

US Cyber Command's Aggressive Offensive Strategy

Patrick Gray initiates the conversation by referencing Tom's recent analysis of statements made by Alexei Burasal, the Senior Director for Cyber and Special Assistant to the President. Burasal has hinted at an impending increase in the aggressiveness of the Trump administration's offensive cyber operations.

Tom Uren reflects on the historical context, noting, “pretty consistently successive administrations have gotten more aggressive in using offensive cyber operations” (02:15). He elaborates that these operations aim to disrupt, degrade, and deny adversaries, effectively changing the cyber battlefield's dynamics.

Key Points Discussed:

• Effectiveness of Offensive Cyber Operations:
  Uren expresses skepticism about the US's ability to significantly deter cyber actors through offensive means alone. “The US has never really hit back hard against cyber actors... It's like trying to deter an army by shooting a few foot soldiers. It just doesn't work” (03:51).

• Political Challenges:
  Gray highlights the political rhetoric surrounding cyber retaliation, referencing Senator Mark Warner's assertion that America needs to "strike back" against threats like Volt Typhoon. However, he points out the lack of concrete strategies, stating, “politicians speak, politician answers, nothing about, like, what you would actually do” (04:53).

• Potential Retaliatory Measures:
  The discussion moves to possible cyber retaliation methods, such as ransomware attacks or the use of destructive commands (e.g., rm -rf). Uren suggests that while these actions could be tactically effective, they may only alter the cyber conflict's equilibrium rather than ending it: “It just changes the equilibrium. Now, I guess from a US point of view, you would say changing the equilibrium would be good...” (07:37).

• Asymmetry in Cyber Defense:
  Gray and Uren delve into the asymmetrical nature of cyber defense, noting that while the US might successfully deter low-level actors like Isoon through cyber attacks, targeting more secure and critical infrastructure remains a formidable challenge.

Notable Quote:

• Tom Uren:
  “They might respond by gaining access to their networks and actually do something like a ransomware attack or rmrf... that would act... that would slow them down and it would make them pay a lot more attention to opsec.” (06:38)

Use of Telemessage Signal App by White House Officials

The conversation shifts focus to the alarming revelation that senior White House officials are utilizing a forked version of Signal, known as Telemessage Signal, for their communications. This app, developed by Telemessage based in Israel, incorporates message archiving features but suffers from significant security flaws.

Patrick Gray criticizes the app's security vulnerabilities, mentioning, “the way that it's been architected is very insecure. There's source code repos out there with hard-coded creds that have allowed people to just... intercept messages and a whole bunch of customer data.” (13:17). He questions the procurement processes that allowed such an insecure app to be adopted over more secure alternatives like Wickr, an Amazon-owned product approved by the Department of Defense for non-mission-critical communications.

Key Points Discussed:

• Inadequate Security Measures:
  The Telemessage Signal app's poor security architecture raises concerns about potential foreign adversaries intercepting sensitive communications. “If you're using this, it makes our call at the time, which is that these messages were almost certainly being observed by foreign adversaries.” (16:35).

• Procurement Anomalies:
  Gray and Uren examine the puzzling decision to adopt Telemessage over Wickr, despite the latter's better security credentials and endorsements from authoritative bodies like FedRAMP. “Somehow they've sidestepped Wickr and gone to telemessage. Totally baffling.” (15:21).

• Policy and Governance Gaps:
  The episode underscores a broader issue: the lack of comprehensive policy guidelines governing secure communications for policymakers and government officials. “This is an area where I think there needs to be some serious policy work.” (19:46).

• Trust Issues with Intelligence Agencies:
  The discussion touches upon the distrust some politicians have towards intelligence agencies, complicating efforts to secure communications. “Do you really want to be just communicating on devices that are provisioned by essentially a spy agency?” (17:40).

Notable Quote:

• Patrick Gray:
  “When you're in government, do you really want to be just communicating on devices that are provisioned by essentially a spy agency?... I've known enough politicians where they wouldn't feel comfortable with that.” (17:40)

Insights and Conclusions

The episode highlights the complexities and challenges inherent in modern cybersecurity policy and operations. On one hand, there is a push for more aggressive offensive cyber strategies, yet the effectiveness and potential repercussions of such actions remain uncertain. On the other hand, lapses in secure communication practices among high-ranking officials expose vulnerabilities that could be exploited by adversaries.

Tom Uren emphasizes the need for a balanced approach: “If I was in charge, I wouldn't say, go and hack Chinese critical infrastructure. I would say, go and hack the people who are hacking our infrastructure.” (19:26).

Patrick Gray concurs, advocating for robust policy frameworks to guide secure communications and effective cyber retaliation strategies. Both speakers underscore the urgency of addressing these issues to safeguard national security interests.

Key Takeaways

• Offensive Cyber Operations:
  While increasing aggressiveness in cyber operations is a trend across administrations, its actual impact on deterring cyber threats is debatable. Effective strategies require more than just punitive measures against low-level actors.

• Secure Communications:
  The adoption of insecure communication tools by government officials poses significant security risks. There is a pressing need for stringent procurement processes and comprehensive policy guidelines to ensure the protection of sensitive information.

• Policy Development:
  Addressing cybersecurity challenges necessitates collaborative efforts to develop robust policies that balance offensive capabilities with secure communication practices, fostering a resilient national cybersecurity posture.

Timestamp Guide:

• 02:15 – Successive administrations’ approach to offensive cyber operations
• 03:51 – Skepticism about effectiveness of US cyber retaliation
• 04:53 – Political rhetoric vs. concrete cyber strategies
• 06:38 – Potential retaliatory cyber measures
• 07:37 – Impact of changing the cyber equilibrium
• 13:17 – Security flaws in Telemessage Signal app
• 15:21 – Procurement issues favoring Telemessage over Wickr
• 16:35 – Risks of foreign adversaries intercepting communications
• 17:40 – Trust issues with intelligence agencies and secure communications
• 19:26 – Recommended focus for offensive cyber actions
• 19:46 – Need for policy work in secure communications

This summary captures the essential discussions, insights, and conclusions from the Risky Bulletin podcast episode, providing a comprehensive overview for those who haven't listened to the full episode.