A (4:59)

Yes, it is. I mean, and of course all of us Tick Tock users in the us what does that actually mean in practice? I mean, I'm not going to lie. Back in January, when it was off for like 24 hours, I. It took me a moment to kind of reset. Like how I'm going to spend my time, you know, at night and on the weekends when I lose three hours looking at all these, you know, piglet, cute piglet videos, you know, but what. I guess coming back, I have a.

B (5:30)

Panic stack of books by my bed, by the way. It's like, oh my God, the Internet's down. I'm like meaning to read that book.

A (5:37)

But, you know, and again, it gets me back to this walled garden thing. Like, are we only going to be able to see U.S. content? Because that takes the fun out of as well, right? I loved seeing content from China, I'm not going to lie. But also other countries and perspectives and it's a nice cross section of information that of course you have to validate and don't take at face value. But I know there's a lot of questions. What does that mean when we bring it to the U.S. to your point, and the implications of that and, you know, what we get to see and what we don't get to see and who decides that?

B (6:11)

So I spend a lot of time on the. It's now it's like beyond anybody calling it section230 now. But I've spent a lot of time in, you know, around section 230 and what do we do about content and who gets to decide what it is. And ultimately, at the end of the day, I always remind myself that I am a free marketer capitalist. And you do not have to have Instagram or any of these devices on your phone. First of all, let's take that back to the child online protection. Don't give your kid a phone. Don't put Instagram on it. If you're worried about it, it's a really easy fix, faster than anything. But when it comes to what do you do about content in general, you have to remember it is a terms of service, it's a terms of use. And we've seen there was hearings, I believe in the last. Senate's still having hearings. It was in the Senate last week about just content. And Google can decide at every one of their product lines. At Chrome, there's certain things that they do or don't want to link to that are outside of their terms of use that they think fall into the harm category. YouTube, same situation. Apple has a different version of that that really runs more towards their app store where they're like, we just don't think this is outside the scope of what we want to be in the business of doing. And that's legally their right to do that we run afoul of. And we've seen both sides of this on free expression. So when I want to have an opinion on something that can be all fine and good, but it's a matter of which platform, I get on that they may be like, I'm cool with that. And I say that in my terms of use and I'm taking you down. Right. So there's, there's probably been a lot more refinement on that in the last, you know, couple years. But I think that we've now seen with. I've learned a lot about job owning because I have one of my colleagues, Clay Calvert, writes on it, actually wrote on it this week about the importance of, you know, understanding it and when you can and cannot do that. Part of this was the, the ice blocker that the federal government asked Apple to take down. And there was apparently a discussion and they landed on, you know, deciding was not in their best interest to have it on their app store. But that was a decision by a company about what they thought was good or not good for their consumer base. But the idea of being able to share certain things, it gets very interesting. The easy corner case is pornography because you're like, there's just certain age generations we just don't think is appropriate for their psyche. We probably should broaden that scope, but we don't. But when you come to actual harm of people or when is this a problem, and hopefully with artificial intelligence, the platforms will catch that faster. Because there's a lot of things that we've seen recently that are just bodily harm. Things like those that, again, go to what I talked about earlier. It's more of a mirror on society than it is. It's not the app. It's that you are getting a reflection of something that you're garnering from society. But we need to be able to pick up on those signals. And artificial intelligence will bring us to a point of resolution of go, no go, take down, this is harmful, or I need to, you know, I need to put some guide rails up. Or the other thing is just sort of these, like, take a beat thing that they're doing. A lot are directed towards kids, but sometimes I'm like, I. I have a thing. I'm not allowed to buy anything on Instagram between. I. I broaden the hours. It used to be 11pm to like 4am and I thought, well, that's ridiculous. Let's just. Let's just say that that needs to not happen. You know, not daylight. Let's just go with daylight.

C (9:32)

That's a good plan.

B (9:33)

Yeah. So there's a lot going on in there, and sometimes it just gets oversimplified. But it's also just a core fundamental of who we are as a country. We believe in freedom of expression, and so we have to make sure that we protect that, but we also are not allowing harm to happen by wanting to protect that freedom of expression capability.

C (9:52)

So have we kind of gone too centralized, though, with. With all these platforms? Like, you know, you talked about, you know, our experience back when the Internet was first being found and everything was very decentralized, like, anybody could bring up a website and post whatever they want. There was so much freedom. Right. Like, should. What can we do to kind of get back to not having other people's terms of service preventing our expression or so on, or is that even the right thing to do?

B (10:22)

Yeah, no, I mean, you bring up something. So I just. Actually, my podcast that just dropped yesterday, I interviewed the general counsel from Blue sky. Actually, he's the head of Legal. I asked him why they didn't give him an adult title, but he's head of legal. He said they just stopped at that point. So Matt's lovely, and they came to see me at aei and I was like, I don't have a Blue sky account. I don't really have anything to talk to you about. And he said, no, no, I think you'll find what we have to say interesting. And he said, we weren't designed because what has happened. I love Twitter. I'm still going to call it Twitter. I know it's X, but I know how to filter things. But I'm such a long term user, I get a lot of interesting hits of media really quick there. I like that. And so I thought, okay, well what is it then? What happened is people were mad about Trump. So they, a bunch of people just upped and left at the same time and went over to Blue sky and they just found themselves barraged with a particular liberal values process. And what they were trying to say to me is that what they were trying to build was basically a portal. I think of it in my head as like a Lego, like a Lego. I can take the people I like to see. I follow my followers and my information and I should in theory be able to port this, you know, and export it to another thing. So if I get bored and I think that this platform is no longer serving my interest, I can up with my in theory, you know, and my followers and all this stuff and move it. I admit I just opened my Blue sky account because we were doing this and I have not played with it yet. Well, that's not true. The first thing I did, I opened it. And the only person that, because the way I did it really narrow because I was just like, I need to start small and grab is I get Robert Reich and everything. And I have zero interest in what Robert Reich has to say. So I have to figure out how to like get this going. But I like the theory of where they're heading on that. I don't know, you know, how far they're gonna go. Or maybe they're just like the first. I was trying to look for the word that he kept saying in this. Cause I had him talk to our other scholars yesterday. Let me see if I can find it. Because it was just, it's an interesting way of saying, you know, there's other ways to do this. Oh, here it is. It's authenticated transfer. It's a way of doing interoperability. And you know, they may be ahead of themselves on that. We need to find a way to do that. And maybe we do want to be in a more disaggregated way. But I feel like the counterfactual on that is the bubbles, you know, that we do find people are just really into these Titan bubbles. And you all probably see this too. Like I just hear it like people start to talk about something and I'm like, I know where that's coming from. And I just, I'M like, I don't think I can pierce that. And I'm just, I do a five minute check on myself. I'm like, is this conversation going to last longer than five minutes? If not, I'm going to let them have their opinion and I'm going to say thank you and walk away because I don't have time to unbraid things that probably take a little longer to have that discussion. So I love the idea of the portability, but I hope that that doesn't mean that we just harden the bubbles and people really just don't look at both sides of an issue. But anybody can get a website just to say that's still old school.

C (13:13)

But you can, you still can. But yeah, your friends aren't going to look at it is kind of the problem. You know, it's still out there.

B (13:21)

My old school. Yeah.

A (13:22)

It's funny, I have a website. Yeah, I bought my name. I bought my domain name like, you know, 20 years ago or something like that.

B (13:29)

I did too. I don't use it, but I have it.

A (13:34)

Yeah, I haven't used it in years. I used it when I went back to graduate school, but Just to publish blogs. But yeah, it's. I feel cool. Sorry, John, you were gonna.

C (13:44)

No, go ahead, Rachel.

B (13:46)

John, do you have yours? Should we go look you up right now?

C (13:49)

I don't think it's been updated since the 90s, but you're gonna hit an error.

B (13:53)

404, like, nope.

A (13:56)

Fantastic.

C (13:56)

It's gonna be all text.

A (13:59)

That's awesome.

B (13:59)

Yeah, like reading an IETF document. I did that this week. That was hard.

A (14:05)

Speaking of blue sky, I gotta tell you, every time I see my mom, she gives me an update on number of followers she has. So now she's up to 1100. She's thrilled.

B (14:12)

What is mom doing?

A (14:13)

That was my question because she's not a social media person. And so I've got a lot of questions. She'll be here in a few weeks.

B (14:22)

She's like blueberry pie recipe that she's given out to everybody that's just gone gangbusters.

A (14:26)

Or I think she's commenting on a lot of posts and I don't know what she's commenting and, you know, but I think it's a lot of like. Right on. Yeah, brother.

B (14:34)

You know, actually there was an article in the Economist this past week about how what's interesting is, you know, the economy of time and the people that really have a lot of time now to be messing around on these social media apps are the older generation she's retired.

A (14:52)

That's a really good point. Yes.

B (14:54)

They're big consumers, more than you would expect.

A (14:59)

Can we shift gears a little bit? I would be really interested in your perspective. So you've seen a lot in the news this last week or so about the UN Cyber treaty signing, right. In, in Vietnam. And there's, there's a couple different perspectives depending on how you want to look at it. But I'd be interested in your take on, you know, kind of what is like 65 nations signed it, I think, or up to 70, something like that.

B (15:23)

I actually have to say I have, it's been a busy week and I haven't seen that. So the first thing I will do when I go to look at it is sees if China and Russia signed it, then I'll say no.

A (15:30)

Right.

B (15:32)

They. Anything that Russia and China signs together, it means that we did not get, we didn't probably win. This has been a tough one for a really long time because it's a lot of wordsmithing and the Russians were very good early on when it came to cyber to make it sound like we're just defending our nation, we're just defending our homeland, to not let people come in. And I need the UN to be my guardian to help me do this. But when you really look at that, what they were doing was they were, to use the phrase used earlier, they're walled gardening their own citizens away from the traditional global Internet. And that has been the core problem with their cybersecurity initiatives with that, that working group in the UN for a long time. So I haven't seen what they did this week, but I'm sure I'm not going to like it.

A (16:20)

The US did not sign.

B (16:22)

Yeah, it sounds about right.

A (16:24)

There was that aspect as well. But yeah, the coverage was really interesting to follow depending on how you, how you were looking at it, for sure.

B (16:31)

Well, and it's one of those things where if you look at the high level intent, you could probably be like, yeah, if you didn't tell me anything else about that, you're saying that I need the help to defend my citizens from cyber criminals and scams and you're like, great. But then, then I want to go see like, did Thailand signed it? Because they're the worst. Like, I love the country, it's so beautiful. And there's four criminals in Thailand that we have not one, but two FBI operations that are permanent in Thailand.

A (16:58)

Oh, that's funny. We had. It was, was it. The inspector general came on a couple years ago and he was, you know, investigation wise and we, we named the podcast episode One Night in Bangkok. Yeah, we talked where he's like literally running after criminals. Yes, it was kind of fascinating that you. Funny that you say that. Sorry, John, I will turn it over to you.

C (17:23)

I was going to change gears again. And let's talk a little bit about AI. What are you seeing on the policy side for all of the different AI companies and their different strategies and how do we get some transparency around what they're doing and security for their platforms?

B (17:45)

Yeah, first of all, I'd say I feel very lucky because of where I sit and the interests of having my think tank at many levels involved. We have lots of the. We get to see a lot of things and one of them I love, Anthropic has been early on asking us to look at their data when it comes to workforce. And that then reflects into what we should be doing around education. I think about it as an infinity loop in my head. My colleague Brent Orrell does work in this area and it really is an area I've never done education because I can't understand how we spend this much money and kids aren't smarter. So you need to understand where the workforce is going to make sure that we have the academic environment looking at changing the landscape to make sure that we're giving kids the education they need to go forward. We did a meeting actually in January and we had all the major AI companies were there and then people from a bunch of administrative people, but also universities and actually we had people from the city of New York and the city of Oklahoma just talking about data. I just asked, well, what do you guys right now? What are you using as your major thing that you look at? And this is before they disabled the Bureau of Labor Statistics a couple weeks ago. They said we're still looking at kind of a version of BLS and oh, I know it was unemployment records. And I was like, that is behind the power curve. What are you going to do? These people don't have jobs. And so that whole mindset, change is so important on how we look at this. And I was just talking to another colleague who's an economist about this too, because the challenge with economics is always you're looking in the rearview mirror. So how do you possibly enable AI to be, you know, give you a refractory look into the future and say, what is it? And how are people using this? Anthropic does a lovely job, I'm pretty sure. ChatGPT OpenAI just haven't seen Their data, but I imagine it's available, are giving an eye. And it is. It's other people that currently fear that AI is going to take their jobs are actually the heaviest users from the most recent data I've seen. So it is creatives, it's marketing operations, it's people who are writing scripts. It's, you know, just writers. I mean, I know I very. I'm like, I'm very transparent. I use AI all the time. A lot of times I use it now as a first draft. I became much more trustful of it when they started to source. So, you know, I'd go to Perplexity. And I love the fact that, like, Gemini will source things. So it'll just give me an idea, and then I can go back and read the article and make sure that, you know, we're in sync on what's going on there. So that's been really helpful. The trust vector, the opaqueness that you mentioned is a lot of that is. I mean, it's a combination of the algorithm. It's a black box. There was an article in the Information this week that was saying that one of the things, if they finally get around this is OpenAI, a nonprofit or whatever it is, if it is eventually able to want to go into the public market, they will have to then be transparent about a lot of things that they currently are not. And I don't really care about the finances of it, even though the finances are the most fascinating thing. What's going on with OpenAI right now, it's the idea of giving people that validation. And as somebody who actually does look at a lot of terms of service, in terms of use and system cards and things that make all this stuff work, I usually say, just tell people what you're doing. Like, just be really brutally honest and simplify it. And if they don't like that, they can walk away. But if they don't, if you don't, tell them that you're gathering all this information. And the example I always use, because this isn't interesting, it's not really. It's tech. It's tech being used by the finance industry. You know, I lucky girl. I refinanced a while ago and got a really great mortgage. You know, refinanced before everything blew up. But so then one company bought my information, and at some point in that, you know, refinancing, I guess I said yes to, you know, you can market to me now somebody else owns it, and they call me all the time and want to be my Local bank. And I'm like, there's nothing I want about a local bank right now. Like, you know, and I can't make them stop because somewhere along the time I gave them permission. And this is my challenge with the third party aggregators. And I haven't seen it, but I guess there's legislation that addressed this in California this week that I need to get caught up on. And that's where I get. I kind of fear it's not the one company that I bought my mattress from. Let's say it's the, you know, that I agreed as I was pending a bunch of stuff, not thinking about it. Yes. And now all of a sudden every partnership they have has my information and is banging on me and then they're selling it. And I don't know where to make that stop. And I think that's a really important for the trust that people are going to need. And I realize I'm talking about something that's actually been going on forever and is old school, but we need to course correct on that to allow people to feel like they can trust these. When we get to real agentic AI and not just past the learning language models I'm concerned about. I love ChatGPT. I use it, but I have it set because I pay the $20amount not to collect my data. People that are doing that at zero don't have that opportunity. But then there's others, like Meta just said, we're going to start if you use our model. We love Kamana and we've got this great thing. We're going to sell that to advertisers. And I'm like, I don't know, that's a great idea. But they're being very open about it. They're being very honest and I will give them credit for that.

C (22:52)

Yeah, I have. I have the same problem with getting those constant marketing things. And I agree with you. I don't want my data being used to train while using these tools either, so. But what Toggle, John?

B (23:08)

There's a toggle in there. There's a toggle. Just toggle. Well, I pay him.

C (23:11)

I like you. I pay him the 20 bucks too.

B (23:13)

Right. So you can just go say no. You can do that. As soon as we get off this podcast, you can go say no.

C (23:17)

Go say no.

B (23:18)

Yeah, yeah.

A (23:21)

Sorry. My dogs are barking, so I hope.

B (23:25)

They'Re getting the squirrel they're going after or something.

A (23:27)

So much fun. I have an Australian shepherd that just never stops, stops.

B (23:31)

You're asking for somebody to.

A (23:33)

He's defending this area, you know, but it keeps things lively here. So I apologize for the background noise, but I love this conversation, by the way. I'm going to tell you, this is so fascinating and, you know, kind of coming back to education. You talk about Arizona, you know, giving testimony to the House, but I think more broadly, with everything that's happening so quickly and lawmakers are being asked to have a point of view on, okay, we gotta legislate these things, but how do you educate? Right. When we look at the federal and state and local level, I remember a long time ago when a voice to text was really nascent and we were educating lawmakers on the Hill about, hey, in car systems are actually safe speak the text, you don't have to be distracted. But it was quite an effort just for something seemingly right. And I can't even imagine when we talk about digital trust, AI, agentic AI, all these things that are happening, the amount of education required to really come together with something thoughtful without it being, I think, overly restrictive.

C (24:41)

Right.

A (24:41)

But also there's overly innovative using your data. Like, how. How do you navigate forward with that kind of task?

B (24:48)

So I've been in the app association, doesn't love what I say this. I feel the easiest one is you go, I want some version of, you know, like, here's the three things that are going to freak me out the most or here's the five things. Like, and I immediately, they can color code them, they can make them emojis, but I want to be able to when I look at an app and I want to know when it changes to be like, I sell your day. I'm going to sell your data to the devil. But you know what? Most of us say yes to that for a 10% discount or free shipping. You know, like, so we have to admit, like, but we just didn't. We're like, I mean, I don't know, maybe I'll go back and undo that. But yeah, I want that 10%. So. But, you know, be more overt about those things. And we're going to have to figure out how to kind of cabin them together or collect them so people understand them. Most people don't ever do the reading. And I understand that. And I was having this discussion this week and this woman got very angry with me when I said, look, I can't help that people decide to be uneducated about the things that they do. You hand them a device and you try to make it as simple as possible, and they have to make a couple decisions and they're mad about that. And I'm like, you could just not use it. There's other things, there's other ways to do these things. But they don't want to be educated consumers is our first challenge. So then you're like, the trick of how do I get to where I feel like I need to be. Let's go back to your idea of the congressman or the representative. How do I educate him on the most basic fundamentals? And the fact that we're still seeing ransomware and malware and things go through email is still at 80%. I mean, it's where they. It's a breeding ground. And you try to tell them just the Nigerian really is not going to give you that money. But it still works, right? So there's so many layers, unfortunately, to what you're trying to be a good person and a good representative and make sure that people understand the dangers and the risks as well as the benefits of this. You have to have an audience that's on receive, and that one's a little tough. I mean, I feel like we haven't. It took us a long time in cybersecurity to get to that point. And we're just at the beginning of people willing to really spend money to protect themselves and their environment as well as enterprise systems. Maybe we've learned some lessons from that that we can apply to AI.

A (26:57)

Let's hope so.

B (26:58)

Yeah, me too. Yeah.

C (27:00)

So, I mean, thinking about this, right, like, should there be more. More policy or not around this and how kind of tying it back to, like, the discussion before about all of different countries having more or less wanting to wall themselves off, like, how do we end up with the right type of policy globally and maintain interoperability?

B (27:23)

So we saw a lot of that early on that was really interesting. Like, think about, I mean, when they were doing Bletchley park and we had the UK Cyber or the AI Safety Summit, and we just felt like that was going to, you know, they just felt like it was groundbreaking. And I thought that's kind of smart because the UK is trying to say, come to the UK first, use our guidance and rules. So if you're based here, you'll get UK rules, which will light touch, step you into the eu and hopefully we'll bring the US along. And then they went off to Singapore and had round two of that. And then it's just sort of like, then the Biden administration went away and the Trump administration showed up and said, nothing's gonna get done with all these damn rules. Screw them. And they like backed out of. And I was actually okay with that because a lot of them, I was like, these are really nanny state rules for this thing that has barely even been out of the box for like a year. You know, so it's. And then if you followed, then the UK had a change, a regime change themselves and the new prime minister immediately walked back most of what they were going to do. And I kind of though where we landed was, hey, let's start with us. How can we use artificial intelligence to just make our systems in the UK government better? And that's about what we can afford. This stuff that we were talking about at Bletchley was not obtainable. We could not afford to do that. And he's not wrong. Like, you know, like, that's actually really accurate. And when I think about what we could hopefully show consumers, you know, is an easy thing to do. And a lot, I mean it's so much in called AI but we've been trying to do this with like smart cities for so long is just do those, those pattern recognitions of like where, where can I just look at something and say, if I just stop doing this, like I would gain X amount. And it's, you know, I'm a big believer in the 80, 20 rule of life. A lot of times you'd go, if I stop doing this, 80% of my pain goes away. And I can focus on this 20% and I can adjust my financing around that. And that can be me as an individual, a corporation, as cities, D.C. we just recently. And I haven't seen the data on this. I'm sure it's probably worthwhile. We've just gone to a. You don't turn on red lights. Just don't. And I'm like, I know people are honking because I live right where they honk. But I'm sure that there's enough statistics to say if you're willing to wait 30 seconds, you're going to save enough car accidents, lives, you know, and then you go across a bridge to Virginia and there's no rule there. And it's very weird because your mind has to be like, oh, I can turn. People are honking at. You're like, oh, that's right, they can turn red here. And I feel there's a little bit of that, you know, analogy in artificial intelligence. We're going to hit these places where, you know, France is going to be like, do not turn on red lights. And then you go to Lichtenstein and they're like, I'm going to have your rules here. So we need to, we're getting to a point where we need to figure that out. I would prefer that we start with, as the Internet does, guidance through kind of rules of the road structure that is not necessarily standards are hardened. So I don't want them to necessarily be standards, but something that we do with guidance. The question is, who are we willing to follow? And the IETF is the Internet Education Technology, whatever IETF stands for. They are working on trying to work with the IP and copyright holders right now because the politeness of what is known as robot Txt or robot Txt is you used to go to, we were talking about old school, you know, websites. You'd go to the website and it was in, you know, white language that you really couldn't see. But you would hit this thing that would say very politely, please don't crawl me. I would prefer you don't do that. And then the polite people would say, okay. And they would walk away. Now the, you know, the agents are just brute forcing right through that. They're like, I don't see that I'm.

C (30:57)

Gonna scroll or don't use it as a hint. They'll be like, oh, this is really good stuff.

B (31:02)

Let's grab it. And then, so what do you do about the fact like while they've been trying to do the polite answer to this that, you know, they've ingested probably 99% of that stuff anyway. So, like, you know, why do you just abandon it? I was talking to a lawyer about this the other day and I was like, I don't know, I think I would start my plan with 2026 and whatever you're going to produce going forward and just forget about everything that's pre2025 because they've got it. So, you know, and there's, so there's a little bit of a, you know, reality check on where do you put your time, money and energy to solve what problem?

A (31:34)

I love it. I do want to be mindful of time. Shane, I know we're running long and you've been lovely to answer our barrage, particularly mine of questions because it's just an endless topic we could talk about, you know, all day. It's fascinating, exciting to see it as well, where things will be going. So, Shane, thank you, thank you for sharing all your great insights with our listeners.

B (31:54)

I really appreciate you having me. It's been fantastic. Keep going guys. I can't wait to find out what you're going to do in your next podcast.

A (32:02)

You never know. We like to surprise.

B (32:05)

Well, I really appreciate you having me as a guest.

A (32:07)

Wonderful. And John, what's our call to action to our listeners?

C (32:11)

As always, smash that subscribe button.

A (32:17)

And you get a fresh episode every single Tuesday. I don't know if Shane, that's your call to action with your podcast as well, but it's always fun to hear Jonathan say smash sometimes.

B (32:27)

I'm gonna let him have that. I'm not gonna address that.

A (32:32)

To all of our listeners out there. Thanks again for joining us for yet another insightful conversation. And until next time, everybody stay secure. Thanks for joining us on the to the Point Cybersecurity podcast brought to you by forcepoint. For more information and show notes from today's episode, please visit forcepoint.com podcast and don't forget to subscribe and leave a review on Apple Podcasts or your favorite listening platform.