Inside Cyber Warfare: Mapping the Cyber Underworld

Welcome to the deep dive. Today, we're plunging into a world where, honestly, cyber warfare has kind of shattered the digital barrier. It's not really just about stealing data anymore or causing digital disruption. It's evolving into something much more physical, something that's really deeply intertwined with almost every aspect of our lives, you know, from the power grid to the

Yeah, and our insights for this they're drawn primarily from Jeffrey Caruso's Inside cyber Warfare, third edition. It's really indispensable guide. I think it helps navigate this wilderness of evolving threats, and it reveals some truths often kind of hidden beneath the surface of the daily headlines. Right.

And our mission for you listening is to unpack how software is fundamental insecurity. This core problem, along with the cybersecurity industry, is let's say, unique incentives and the blurring lines of modern conflict. How all that is shaping our digital and increasingly our physical world. We promise some genuinely surprising insights and maybe some practical considerations you can actually apply. Okay, so let's unpack this first big piece. We really have

Ever. It's kind of mind blowing when you think about it.

It goes all the way back to the first high stea computer maniac, back in the nineteen fifties. So, I mean think about that for a second. Insecurity was basically baked in from day one, and it sort of came to a head with what was famously called the software crisis in nineteen sixty eight. Douglas Ross, who is a pioneer in computer aided design, he us this really vivid analogy. He compared systems supposedly in good working order to a person having a heart attack.

Wow, a heart attack.

Yeah, So the underlying fragility, as you can see, it's been there right from the very beginning.

It's truly eye opening, and that inherent insecurity it isn't just a buz, right, the author argues, it's actually become a core feature, something that's actively exploited by the well multi billion dollar cybersecurity industry.

Exploited how well?

He puts it very provocatively. He says, it pays much better to play offense than defense. Then he introduces this really striking analogy. He compares the cybersecurity industry's model, you know, discovering vulnerabilities then selling the protection rack. He compares it to an organized crime protection racket.

Okay, that's strong language, a protection racket.

From your perspective reading this, how much truth is there to that analogy? What does it really imply about the industry's incentives.

Well, it definitely forces us to ask some tough questions, doesn't it. I mean, if you look at the Global Prohibition on biological warfare, for instance, finding a vulnerability in the human body and then trying to sell the cure after announcing you've maybe created a disease that can be considered a crime against humanity, unthinkable exactly. Yet in the digital realm, discovering of vulnerability and then monetizing the fix, well,

That's yeah, that's a truly unsettling thought. And the real world impacts of these software flaws, I mean, while they're often hidden, they can be genuinely tragic. There's this research from Donald McKenzie back in nineteen ninety four. He found that by nineteen ninety two, only about three percent of computer related deaths, so like thirty out of eleven hundred, were actually due to software bugs. Most were caused by faulty human computer interaction like user error, basically preface issues.

But fast forward and the examples get much more alarming. In two thousand and one, five patients died from radiation over exposure at Panama's National Oncological Institute directly due to software flaws.

Oh wow.

And then there's what the source calls the shocking number of injuries and deaths linked to the accelerated adoption of electronic health. Both records EHRs since about twenty eleven.

The EHR problem.

Yeah, and the FDA's m UE database even revealed one hundred and forty four deaths and almost fourteen hundred patient injuries just from robotic surgeries between twenty and twenty thirteen, and the source stresses those numbers are likely seriously underreported. So what then explains this underreporting, especially with the EHR issues. It sounds like a huge problem that's just being swept under the rug.

You're right, it seems to be a massive issue, and it's largely down to a lack of legal requirements to report these incidents. There's this chilling quote from a hospital administrator in the book, quote, we don't want to know the safety performance of our system because what would that mean?

Wow, just don't look.

Exactly this reluctance, this sort of active avoidance of transparency. It's also very common, the author knowes, with companies underplaying how serious cybersecurity incidents are. It really feels like accountability often becomes an afrothought because there's no real penalty usually for not being transparent.

Okay, So, given this fundamental fragility of software we've just discussed, it raises an even bigger question, doesn't it. When an attack does happen, how can we possibly know who's really behind it? This is where things get really complex and pretty surprising.

Yeah, the bit really drills down on this core concept of attribution. Yeah, And the key takeaway is it's not deduced like a mathematical proof. It's inferred.

Inferred meaning like an educated guess sort of.

It means it relies on a whole series of assumptions, not necessarily proven facts. Think about it simply. You see wet crass, you infer it rained, right, but maybe a sprinkler was just malfunctioning. Or you see a police car at a closed bank, you infer a break in, but.

The officer might just be using the ATM god exactly.

And historically assumptions like you know, all financial cybercrime must be Russian or all ip theft must be Chinese these often led to wildly increate blame.

So if attribution really is just inference not deduction, that must lead to some pretty significant missteps in the real world. Have we seen compelling historical examples of how wrong this inference can go?

Oh, absolutely plenty. Take Moonlight Mays back in nineteen ninety six massive theft of classified data Pentagon.

NASA, Right, I remember hearing about that.

He was initial attributed to Russia based on things like working hours and holidays observed in the logs. But even then, the specific military or intelligence unit remained fuzzy. There was some early caution. Okay, then you have Solar Sunrise in nineteen ninety eight attacks on unclassified Defense Department computers. This was during military preparations against a rock, so the immediate assumption was Bagdad.

Makes sense politically right.

But it turned out to be a group of teenagers from California and Israel teenagers.

Wow.

Yeah. And then came Titan Rain, also known as Byzantine Hades, starting around two thousand and three. This one was directly attributed to China's PLA Unit sixty one three ninety eight, and significantly, this attribution, published by the security company Mandian, led directly to their one billion dollar acquisition by FireEye.

A billion dollars.

Yeah. The lesson for the cybersecurity industry became pretty clear. Attributing a major attack to China meant headlines, new business, and potentially massive valuations.

That example alone just makes you wonder how many other attributions might have been driven by similar incentives, consciously or not. You mentioned that many commonly accepted assumptions in these investigations have actually been proven invalid. Which of these, looking through the source, do you think has led to the most significant misjudgments or maybe even policy errors.

That's a really good question. I think I'd have to point to what the author calls the exclusive use assumption.

Okay, what's that.

It's the belief that malware source code is proprietary, like a secret recipe, and is not shared or stolen.

But that's not true.

Definitely not always true. We've seen malware like ex agent famously used by the Russian group Fancy Bear or APT twenty eight. It's been in the while circulating since twenty twelve. Its source code is obtainable. And get this, Ukraine's g URE military intelligence actually maintains a repository of seized Russian and Iranian malware that they repurpose for their own operations.

Wow, so they're using the enemy's tools.

Against them precisely. And remember the wikileague CIA files. They revealed the Umbradge subgroup whose job was specifically to catalog exploits from other groups to use for false flag operations.

False flags, so making it look like someone else did it exactly.

So, if you assume a piece of malware is unique to one group and it's actually floating around or being deliberately misused, Yeah, you're almost certainly blaming the wrong party.

And that flawed assumption feeds into others.

Right, It feeds into things like the working hours assumption, the idea that state sponsored hackers keep regular nine to five office hours in their home country.

It sounds ridiculous.

It's ludicrous on its face, as the author says, I mean Russia alone spans eleven time zones, and you have other major offensive cyber players like you're on Israel, Ukraine, the UAE many in similar or adjacent time zones. It tells you almost nothing. And finally, there's the criminals versus spy's assumption, the belief that criminal hackers don't engage in espionage unless a government pays them to. But we know hackers for hire and espionage as a service are thriving

So this interconnected web of faulty assumptions, it sounds like it could lead to major geopolitical miscalculations.

Absolutely, it really.

Sounds like, as the author suggests, no one, not even the NSA, can definitively tell you who is actually operating the keyboard. They can trace traffic maybe back to a certain point, but the person behind the screen they are may elusive. So if this is all just inference and based on such shaky assumptions, what are the repercussions for poor analysis? It seems like maybe there aren't any.

You're hitting the nail on the head. The book argues there are essentially no repercussions for poor analysis. CrowdStrike is as an example achieving huge commercial success despite some heavily criticized reports on attribution. As Dimitri al Parevitch, Crowdstrikes co founder apparently put it quite bluntly, the required level of certainty for attribution is often just good enough for CNN.

Good enough for CNN.

Wow. That says a lot it does. Political expediency or commercial gain often seems to trump rigorous scientific certainty in this field.

This inherent ambiguity. It really highlights the immense difficulty in truly knowing who's behind these cyber attacks. So, given that huge uncertainty, why is there so much resistance to independent fact finding mechanisms? Why not create something like the OPCW. You know, the Organization for the Prohibition of Chemical weapons. But for cyber.

Attacks, that's a critical point, and it's discussed in the book. There's a proposal for just at and international attribution mechanism modeled after the OPCW to objectively investigate major cyber attacks. But the major cyberpowers, think the US, UK, Israel, they tend to resist this idea.

Why what's the fear?

They seem to fear a loss of autonomy and frankly, political options. Imagine, hypothetically, if German hackers used Russian infrastructure for a major attack on the US, Washington might prefer to blame Russia directly in opposed sanctions. That's a political choice, rather than go through a transparent, independent process that might point the finger elsewhere, complicating their response.

So keeping the ambiguity allows for more political maneuvering.

It seems that way. The author shares this anecdote. The FBI issued a warning about election tampering linked to a specific Russian web hosting company, but the owner of that company apparently told investigators his customers help tickets for those servers were in English coming from German and New Jersey email providers.

Not quite the smoking gun.

Exactly. Simple assumptions can be very misleading, and powerful nations often prefer to keep their attribution options open.

You could say, okay, so what stands out to you listening this about this immense difficulty and truly knowing who is behind these attacks?

It really changes how you read the headlines, doesn't it? Now, Given everything we've just uncovered about softwares and inherent flaws and these huge challenges and attribution, it really forces us to think about how these digital conflicts actually play out in the real world. How are traditional battlefields changing because of this.

Well, we're definitely moving way beyond distinct traditional military domains. Warfare now is deeply enmeshed.

That's the term used in mesh like tangled.

Together exactly, cyber electronic warfare, cognitive warfare, which is basically information in psychological operations, and traditional kinetic warfare. You know, bombs and bullets. They're no longer separate things. They're combined, often simultaneously, for a greater and more devastating effect.

And is there a key figure associated with this shift? The book points centrally to Yevgeny Pregosion, often called pootin the Chef. He was a fascinating and frankly terrifying figure. In this he led both the paramilitary Wagner Group ercenaries and the infamous disinformation engine the Internet Research Agency or IRA,

And we've seen some pretty compelling case studies that demonstrate this enmeshed strategy, haven't we were Propaganda and physical violence work hand in hand, Like the Mozart group in Ukraine. This was led by Andy Milburn, a retired US Marine Corps colonel. It was a volunteer organization providing really crucial training and humanitarian aid. I remember reading about them well Progosians IRA launched just a devastating information warfare campaign against them.

Wow, threats against hotels, Yes.

And this wasn't just digital noise. Three separate hotels where Mozart personnel were confirmed to have stayed were subsequently hit by Russian missiles.

That's terrifying, a direct.

Link absolutely, And add to that, a heavily manipulated video from the team House podcast pushing false narratives about Mozart garnered like three point five million views. All of this ultimately contributed to the Mozart group having to shut down after just nine months of doing really critical work.

That's a powerful example of information warfare having real, tangible negative consequences.

We also saw elements of this in Syria, didn't we Back in twenty fifteen, Wagner mercenaries were supporting Bashar al Asad's regime. There was that significant confrontation with US forces at a Konoco gas plant in twenty eighteen, and afterwards Russia publicly denied any Russian military personnel were present. Classic plausible deniability enabled by using mercenaries. Right.

It wasn't Russia, it was Wagner exactly.

And in Mali, the book describes a similar pattern. Wagner Group operates militarily suppressing jihattists supposedly, while the IRA runs coordinated disinformation campaigns in parallel promoting Russia, pushing narratives to delay elections, fueling anti Western sentiment. It's a truly integrated playbook.

It's really striking too how social media platforms specifically X, TikTok, Facebook I mentioned, have become the sort of preferred platforms for delivering this disinformation and misinformation. Why them specifically, Well, they're easy to use, its incredibly low costs compared to traditional espionage or propaganda, and they're largely unregulated, especially across borders.

And kiktok that gets mentioned a lot in terms of security concerns.

Yeah, TikTok presents a particularly thorny national security threat, according to the source, because of his parent company Bike Dance's deep ties to the Chinese government in Beijing. The author cites examples of prominent Chinese citizens Jack Maw, the tennis player Peng Shui, the actress Zoe Way, who essentially disappeared for periods after crossing Beijing in some way, right.

The implication being the government has immense control.

Exactly, And the concern is that TikTok on your phone could effectively be turned into a two hundred and forty seven surveillance device feeding data back.

And this surveillance capability isn't just theoretical, is it. It's being used for direct targeting and conft zones.

Right now.

There's this incredible, chilling example from March twenty twenty two in Kiev, a Russian sympathizer apparently posted a TikTok video showing Ukrainian armored vehicles park near a shopping center. Oh no, shortly after that video went up, the shopping center was

Wow using ad tech for counter espionage.

Yeah, and Ukrainian special forces apparently used this methodology called F three EAD, find, fix, finish, exploit, analyze, disseminate. They actively leverage Russian social media like Telegram and VK, alongside commercial data brokers, facial recognition tech, even smartphone location services, all to track and target Russian military personnel. The book mentions them capturing an FSB officer's laptop. This way, it's

It's a really critical connection to make, and the book lays it out well. Imagine every click you make, every search, every app you open, each creates a tiny data point about you. Real Time Bidding r TB is the automated process where at exchanges scoop up literally billions of these tiny points every second, and they stitch them together into an incredibly detailed digital portrait of view. How detail, they use a standardized taxonomy apparently of one thousand, six hundred

So the capability is there, and it's been misused exactly, and.

This micro targeting capability built for commerce is precisely what intelligence agencies around the world find immensely valuable. They leverage this same data ecosystem for their own surveillance and targeting purposes, turning our everyday digital footprint into a powerful and potentially dangerous tool.

So far, we've talked a lot about data information propaganda, but the most alarming evolution of cyber warfare maybe isn't just about stealing secrets anymore. It's about causing real physical destruction. That feels like a profound shift.

It absolutely is, And to really understand this, we need to quickly define operational technology or.

Ot okay o T what is that.

These are basically the industrial control systems, the computers and networks that run critical infrastructure think power plants, water treatment facilities, subways, factories, pipelines, the physical backbone of our modern world.

And these systems they weren't built with security.

In mind for the most part. No, Many were designed decades ago before the Internet as we know it existed, focus purely on operational reliability, not on fending off nation state hackers. They're often incredibly vulnerable.

And the examples of cyber attacks actually causing physical kinetic effects they're chilling. The book details the Aurora generator test from two thousand and seven. This was done at Idaho National Laboratory, kind of a proof of concept experiment kept secret for a while. Or they do a cyber attack deliberately manipulated a protective relay on a huge twenty seven

Wow, so proof positive. Yeah, code can break heavy machinery unequivocally.

Then, more famously, there was stucksnet around twenty ten twenty eleven. This targeted Iran's nitens uranium enrichment facility and is widely believed to have destroyed between one thousand and two thousand centrifuges by manipulating their speeds.

Right, stucks net is the classic example, But here's.

A surprising detail from the book. Despite Stucksnet's success in destroying centrifuges, Iran's overall stockpile of enriched uranium actually increased tenfold between twenty eight and twenty thirteen.

So the sabotage didn't really stop the program long term.

It raises questions about the long term strategic effectiveness of sabotage like that, doesn't it? Did it just delay or force them to build better and more resilient system Interesting point, and the attacks on Iran continued. Israel is widely attributed with attacks in twenty twenty and twenty twenty one. One caused a major fire and explosion at a new set

Destroyed the power system. That's a critical blow.

Yeah, apparently forcing Iran to start building a new facility even deeper in the mountains. So the cycle continues, and it's not just state on state. More recently, in twenty twenty two, the book details how Ukraine's g u are their military intelligence working with limited funds, reportedly engineered ruptures and explosions in Russian gas prom pipelines by remotely manipulating pressurization.

Controls, manipulating pipeline pressure that sounds incredibly dangerous.

Extremely specific examples cited include a gas leak and the sarchans Neft to Gez pipeline in April twenty two after a related helicopter attack, a large fire in the Urungoi Center two pipeline also in April twenty two, and then a major explosion at the Urungoi gas field itself in June twenty twenty two. And Urungoi is the second largest natural gas field in the world.

These sound like major industrial.

Accidents exactly, but allegedly triggered by cyber, and the source suggests that vendoring competence and corruption on the Russian side, like a supplier bankruptcy leaving systems unfinished or fire safety systems contracted in twenty eleven still not being completed, actually facilitated these attacks, made them.

Easier, so basic security failures opened the door, it seems so.

There's even evidence presented of combined cyber and special operations missions, like a fire and explosion at Russia's second Central Research Institute in Tever in April twenty twenty two. This is where Russia designs things like their Iskander and S four hundred missile system.

A high value target extremely.

And informed sources cited in the book suggest this wasn't just an accident. It was a combined attack, a cyber attack possibly caused an initial electrical fire, which then ignited explosives potentially placed beforehand by commandos.

Wow, a truly enmeshed operation.

And one more quick example, in June twenty twenty two, a group calling itself Predatory Sparrow claimed responsibility for causing a fire at Iran's cuses Stand Steel Company. They apparently did it by accessing the SCATA system, the industrial control system controlling the plant's furnaces. They even posted videos online.

As proof, posting videos brazen.

It's a terrifying convergence of the digital and the physical, breaking things in the real world using code. So, given the sheer scale and potential impact of these kinetic cyber attacks, why is the cybersecurity industry seemingly struggling to defend against them. Why aren't we seeing massive investments pouring into preventing these kinds of devastating OT breaches.

Well, the book offers a pretty stark explanation, and it comes down to economics. Really. As the author puts it, fundamentally, these attacks are uncommon and so they aren't profitable to defend against them.

Uncommon, but they sound devastating.

They're devastating when they happen, absolutely but compared to the sheer volume of ransomware attacks or data breaches affecting millions of consumers or businesses, these highly targeted bespoke attacks on industrial systems are statistically rare. They don't fit neatly into the traditional cybersecurity playbooks or crucially, the venture capital funding models that drive so much of the industry.

So vcs aren't interested.

Venture capital looks for scalable solutions, products you can sell to thousands or millions of customers. Defending a specific type of power plant control system in one country. It just doesn't offer the same potential return on investment as say, the next big anti malware suite. It's a niche market, relatively speaking, And this.

Kind of links back to that broader systemic issue we touched on earlier, doesn't it The idea that the software industry, especially the world's largest and most valuable tech companies, has largely made all this possible because it has operated essentially free from liability for defects or security flaws for something like forty years.

That's a huge point the author Hammer's home. It's presented as a classic market for Lemons situation.

The economics concept. We're sellers no more than buyers.

Exactly sellers in this case. Software companies know about potential defects or vulnerabilities in their products, but they often don't disclose them fully, or they disclaim responsibility. You see this everywhere and end user license agreements elas, those things nobody reads before clicking agree too, we all are. They're full of as is disclaimers, language like you bear the entire risk of using it, and the limitations of liability are

So even if the software crashes your whole business, tough luck.

Pretty much. These are essentially contracts of adhesion for almost all users. Individuals, small businesses, even large corporations often have little room to negotiate. The message is clear. If you don't like the terms, don't use the software, but often you don't have a realistic alternative.

What's truly shocking to me reading this section is the stark absence of independent testing for cybersecurity products. I mean, we have consumer reports for cars or appliances, right, why not for the software protect our most vital data and systems.

It's a glaring gap. The AUTHO points to the Anti Malware Testing Standards Organization or AMTSO.

Okay, sounds like it should be doing.

That testing, you'd think so. But AMTSO is composed almost entirely of the cybersecurity companies themselves.

Wait, the companies are testing their own products or each other's.

Effectively, yes, it creates a massive conflict of interest. It fails to meet the basic balance of interest requirements needed for a credible independent standards organization. It's essentially the industry grading its own homework, which, as you can imagine, doesn't inspire a whole lot of confidence in the results.

No kidding, So it sounds pretty bleak. Is anyone trying to fix this accountability gap?

Well, there is what the author calls a nascent effort, a beginning to try and bring some accountability to the software world. CIEs director Jen Easterly in the US has been vocal about principles for a new model, things like putting the burden of safety squarely on the manufacturers, demanding radical trans parency about flaws, enforcing real accountability, and pushing for products to be secure by design and secure by default from the outset.

Okay, those sound like good principles. Are they being implemented?

That's the challenge. We're also seeing legislative efforts. The European Union has its Cyber Resilience Act, which aims to tackle inadequate cybersecurity through regulation, and the US National Cybersecurity Strategy from March twenty twenty three explicitly calls for shifting liability for software products and services onto the vendors.

So we have these ideas, these proposed solutions from government, but what are the biggest hurdles to actually making them happen? Because, as the book notes, relying on voluntary compliance from the industry hasn't worked in twenty five years.

Right, Voluntary measures just haven't cut.

It, and market forces, like maybe some states trying to impose liability and contracts. New Jersey is mentioned trying to impose two hundred percent liability on vendors for breaches in state contracts. Those seem limited in scope.

They are they only affect specific contracts, not the whole market.

So it really seems like forced change through regulation is what's needed. But why aren't we seeing that happen faster? What's the hold up?

Well, it really comes down to political will versus the immense lobbying power of the tech industry. These are incredibly profitable companies that, understandably from their perspective, resist regulations that could increase their costs or expose them to significant liability.

So the usual DC gridlock and.

Influence pretty much and the author offers a rather sobering prediction here. He suggests that it might take a truly catastrophic failure, most likely involved in the use of AI, to actually galvanize Congress into taking decisive regulatory action.

A catastrophe involving AI. That's not exactly reassuring.

No, it reflects a pattern, sadly, where we often seem to wait for disaster before we implement meaningful preventative measures. We react rather than anticipate.

Which brings us inevitably to the cutting edge artificial intelligence AI. And this technology, even from its earliest conceptual days, carry it a stark warning. John von Neumann, one of the pioneers of computing, cautioned way back then that we were potentially creating a monster whose existence is going to change history. And then he added, provided there is any history left.

That's a pretty heavy thought to kick off our discussion on AI, wouldn't you say? It?

Absolutely is heavy and maybe prescient. And to navigate this incredibly complex topic, it's probably helpful to clarify some essential AI terminology. First, as laid out.

In the source good idea, let's get the basic straight.

Okay. First, generative AI. This is what most people think of now, things like chatch EPT or image generators like Bailey. The author describes it somewhat dismissively, perhaps as a stochastic parrot, meaning it generates new content based on patterns in its vast training data, but without any reference to meaning or real understanding.

Okay, stochastic parrot, got it. Second, the neural network. This is basically the brain of the AI, a complex structure of layers and nodes controlled by algorithms inspired by biological brains, but working very differently. Right. Third, narrow AI or NAI. This is AI designed for very specific functions, playing chess, brilliantly optimizing airline prices, detecting spam. Most AI we use today is narrow AI. Fourth, a foundation model. This is

Model big versatile ones exactly.

Fifth frontier AI. This is a somewhat fuzzy term often used by policymakers and the industry. It generally refers to highly capable foundation models that could possess dangerous capabilities, often hinting at abilities approaching or exceeding human levels in certain areas, and often linked to the idea of AGI AGI.

That's a big one, right right.

And finally, AGI, which stands for artificial general intelligence sometimes we use interchangeably with superintelligence. This refers to the hypothetical future AI with human level or vastly superior cognitive abilities across the board, self aware, self preserving, and potentially capable of recursively self improving at an exponential rate. Like seed AI that can build better versions of itself.

That sounds like sci fi. Is it even feasible?

Well, that's a key point. Scientists still disagree profoundly on its technical feasibility and there's currently no clear roadmap for actually achieving it. It remains largely speculative, though highly debated.

Okay, so thanks for that breakdown. Let's focus first on the present and tangible risks of AI. The stuff happening right here, right now or very near term. Not the potential robot uprising, but what's already causing problems or has the clear potential to very soon.

Good place to start. In cybersecurity itself, AI presents immediate threats. There's something called indirect prompt injection. This is a type of attack where attackers can sneak malicious instructions into data that an AI later process is manipulating it to produce harmful outputs or leak sensitive information. The source states there's no no mitigation for some forms of.

This yet no known fix.

That's concerning very Then there's automated vulnerability exploitation. Studies cited show that AI agents like ones based on CHATSHPT four can autonomously hack into real world computer systems. They can analyze vulnerability or reports cvees and automatically develop and execute the code needed to exploit them, apparently succeeding against a high percentage of known high or critical flaws.

So AI can find and exploit weaknesses on its own.

Now it appears so and beyond that, AI is already being used more broadly by attackers to right malware more efficiently, compose much more believable spear phishing emails, power sophisticated human like bots for scams or influence operations, and even run simulations to test network attack strategies before launching them.

Okay, those are direct cyber threats. What about other areas well?

There's automated decision making. The dangers of using AI in sensitive areas like the criminal justice system or healthcare are becoming increasingly apparent. The core issue is hidden biases beaked into the massive data sets used to train these AI models, and often this training data isn't public or open for scrutiny.

So the AI can perpetuate or even amplify existing societal biases exactly.

The author notes the nightmare scenario we already see with buggy ehr is causing patient harm, and suggests this could get much worse with biased AI in healthcare. He even speculates about a future need for the six of Amendment right, the right to confront your accuser to include the right to confront witnesses.

Or algorithm confront the algorithm wow. And in war fighting.

Big impacts there too. First, disinformation or cognitive warfare gets supercharged. AI generated dfakes using text, audio, and video are becoming so realistic that it's now virtually impossible for the average person to tell a fake from the real thing, and AI enabled to take accounts are starting to replace human runtrol farms for spreading propaganda, making it cheaper and more scalable, so.

More convincing fakes spread more easily.

Right, and then there are AI guided drone swarms. These are described as potentially game changing lethal weapons platforms. Imagine dozens or hundreds of small drones equipped with facial or even gait recognition, carrying explosives, coordinating autonomously defined and attack targets the sources they could be close to impossible to defend against using current methods.

Are these really it?

Systems like Elbit Systems, Legion x A Reportal being used by the Israeli defense forces, the US, China, and Russia, which is used non AI swarms, are all actively developing this kind of technology. It's not science fiction, It's on the immediate horizon or already here in early forms.

It's interesting, though, isn't it, How much of the public conversation and maybe even the funding seems focused on those more theoretical, existential even sci fi like AI risks, the AGI the superintelligence, when as the author points out, there are these tangible right now dangers like mass surveillance, bias decision making, or energy consumption that maybe aren't getting the

It's a really valid concern, and the book deals into this quite critically. Much of the high profile AI safety debate is driven by these speculative future risks. You have Nick Bostrom's famous paper clip maximizer thought experiment. An AI designed simply to maximize paper clip production might logically decide to eliminate humans to convert our atoms into more paper clips, fulfilling its goal in a perverse way, right.

The unintended consequences idea exactly.

Then there's Stuart russell self preservation scenario, sometimes called the fetch the coffee problem. An advanced AI, given the simple task like setching coffee might realize that being shut down would prevent it from completing the task, so it might take steps to prevent being shut off, even if those steps harm humans, its core goal conflicts with our safety.

Okay, those are some worrying scenarios.

They are, and this focus on what the author terms the zero probability high impact risk model. These potentially civilization ending but maybe incredibly unlikely events has driven huge funding over half a billion dollars cided into AI safety research, particularly from the effective altruism movement.

But the argument is this distracts from current problems.

Yes, the author argues strongly that this intense focus on theoretical and highly unlikely outcomes like rogue superintelligent machines taking over it diverts crucial resources, attention, and talent away from the dangerous problems that exist today, things like the very real thread of AI powered mass surveillance, the enormous energy drain of training and running these large models, the potential for widespread job displacement due to automation, and the amplification

And if AI is at its core fundamentally just very complex software, as we established earlier, what are the challenges of actually regulating it? Are we just doomed to repeat the mistakes of the past forty years, where the software industry largely operated without meaningful liability.

That's precisely the fear expressed in the book. Since AI is software, the prediction is that companies developing it will lobby intensely to regulate its use rather than its engineering.

What's the difference there?

Regulating use means putting rules on how people or companies deploy AI. Don't use it for discriminate to hiring, don't use it for autonomous weapons without human oversight, etc. Regulating engineering would mean putting rules on how the AI itself is built, requirements for transparency, security, safety testing, maybe mandating certain programming languages or architectures.

And companies prefer regulating use.

Generally yes, because it shifts the burden and liability away from them the developers, onto the users who deploy the AI. It echoes the whole history of software liability we discussed, and we're already seeing the failure of voluntary compliance efforts in AI safety. The Bletchley Park AI Safety Summit is cited where initially only one company agreed to share its

What would effective regular look like? According to the source, Ultimately.

The argument is that effective regulation must include specific security requirements for building AI, things like mandating the use of memory safe programming languages to reduce vulnerabilities, and critically, it must involve finally, shifting liability for damages caused by AI failures onto the developers of the foundational models themselves.

Making the creators responsible.

Exactly Without that fundamental shift in liability, we're likely just to see the same market for lemons dynamic play out all over again with AI, but this time with potentially far far greater consequences for society.

It really is a sobering reality for you listening. We are almost entirely dependent, increasingly so, upon devices and systems that fundamentally cannot be made perfectly safe. Our deep dive today has really spanned a complex, interconnected landscape, hasn't it.

It's a lot to take in. So what can you, as an individual actually do in the face of all this? If you overwhelming the AUTHO offers a pretty concrete three step plan focused on personal safety and resilience.

It's quite practical, okay, let's hear it. Step one.

Step one is reduce your attack surface, basically, make yourself a smaller, harder target. Suggestions include switching from Windows, which is the most targeted operating system, to Macorus or Linux if possible, as they tend to be less vulnerable. Overall, go through your phone into lead apps you don't actually use.

That's a big one for privacy, too huge.

Also, make sure your home Wi Fi router isn't using the default password and that it has a strong, unique password, use a reputable password manager for all your accounts. Don't reuse passwords.

Okay, reduce the surface area makes sense.

Step two, Step two create redundancies for your critical systems. This draws on the old military adage two is one and one is none, meaning don't rely on a single point of failure for things essential to your survival or well being. This applies to personal preparedness for basic needs power backup generator, solar, water storage, purification, food, emergency supplies, and communications radio satellite phone.

Thinking about resilience if the grid goes down basic exactly.

The author even suggests considering moving to more rural areas for greater self sufficiency potential, and points to resources on home setting skills. It's about building backup plans right.

And the final step, step three, diversify your risks. This is similar to financial advice right, don't put all your eggs in one basket. Practically, this means things like keeping some emergency cash on hand, maybe in multiple secure locations, not relying solely on digital banking or payment systems that

Reduce your surface, create redundancies, diversify risks, and build community that's actionable, you know. Reflecting on all this, the author notes, we are not good at getting ahead of disaster or moving left of boom, as they say in the military, acting before the crisis hits. It does seem we often wait for that catastrophic event to finally galvanize us into