On an unseasonably warm day in October of 2018,
Turkish police got a call from a distraught woman,
Hatice Cengiz,
saying that her fiancé was missing.
The missing man was renowned journalist Jamal Khashoggi.
He stepped into a Saudi Arabian embassy in Istanbul, Turkey 10 hours earlier
and never came out.
A manhunt ensued, and months later,
accusations are made by the Turkish authorities that Khashoggi was dead.
But Jamal wasn't just any journalist.
He was a former confidant of the Saudi royal family
and even met with Osama bin Laden to convince him to turn himself in.
But Khashoggi turned his back on the Royal House of Saud
when he uncovered their connections to Al Qaeda.
There are Saudi intellectuals and journalists jailed.
Now, nobody will dare to speak and criticize the reform they like.
This drew the fury of the new prince of Saudi Arabia Mohammed bin Salman Al Saud,
otherwise known as MBS.
Khashoggi's connections and information was such a great threat to MBS
that he called up his personal group of assassins the Tiger Squad
to eliminate Jamal.
An ornate trap was devised,
and under the pretext of having some legal documentation notarized,
Jamal was led into a second floor office,
was jumped by five men,
suffocated to death,
and then dismembered by a Saudi coroner who remarked,
"I've never worked on a warm body."
This was a heinous crime.
But I take full responsibility as a leader in Saudi Arabia,
especially since it was committed by individuals working for the Saudi government.
But how did a seasoned journalist,
who was friends with the royal family up until 2016,
fall into such a trap?
He knew how the Saudis worked,
how they had people killed,
and who would carry out such an operation.
It wasn't easy.
Jamal had been living in the US and in Turkey on a self-imposed exile,
fearing imprisonment or, worse, if he ever came back to the Kingdom.
In fact, Jamal Khashoggi was so well versed on Saudi tactics
that it took the Tiger Squad 10 other people to carry out the hit.
Tiger Squad knew they needed an advantage to get ahead of Khashoggi
and get him comfortable enough to slip up.
In fact, MBS hated Khashoggi so much,
he approved contact with Saudi Arabia's mortal enemy Israel
to make a purchase from the Israeli cybersecurity firm the NSO Group
for their anti-terrorism program called Pegasus.
After all, Khashoggi was considered a terrorist to MBS.
That's all the NSO Group needed to know.
The Crown Prince was hunting down some terrorists.
Payment accepted.
The Pegasus program,
a cyber weapon so powerful,
no one thought it could exist.
It's a malware unlike anything anyone has ever seen.
Pegasus is able to be loaded onto any smartphone
without the need for a link to be clicked or an email attachment to be opened.
That's called zero-click capability.
Once it's at the target's device,
Pegasus would erase its traces
and then make the target phone fully open to any sort of manipulation.
It can turn on the camera, microphone.
It can record your screen,
log all inputs from biometrics or touch inputs,
gain access to notifications and location data,
and even access your device's contacts and their location data based on call records.
Tiger Squad loaded Pegasus onto two devices close to Khashoggi,
one belonging to his closest friend Omar Abdulaziz
and his second wife in the United States Hanan Elatr.
From there, they were able to track Khashoggi's movements and plans to divorce his first wife
who still lived in Saudi Arabia.
But the story that shook world governments wasn't necessarily the brazen murder.
Just how powerful Pegasus was.
This new weapon and its unprecedented zero-click capability was a game changer.
While the NSO Group said they only sold it to governments under specific anti-terrorism cases,
it was obvious that the dam was open
and the world had entered a new phase of cyber warfare,
one that wasn't just targeting government mainframes,
but was powerful, personal and almost mythical in its capabilities.
A powerful thing about technology is that it's deflationary by nature.
Just think.
Making a website used to be a massive undertaking,
requiring lots of capital and a group of dedicated engineers.
But today, it's easier than ever.
You don't need to know how to code or anything special to get up and running.
Your purchasing power for website creation has increased exponentially
while the quality has also increased.
But this cuts both ways.
Cyber warfare used to be the playground of governments and mega corporations,
but as time goes on, it's becoming cheaper and more effective.
So what cost the Saudis a few million dollars in 2017
can be bought for only a few hundred thousand now.
In 10 years, it'll be cheaper than a car payment.
This is a slippery slope,
not just for someone holding a grudge or a political party looking to remove an opponent.
It means that everything connected to the Internet of Things can be weaponized.
But hacking isn't magic.
It's data.
The easier it is to get data, the easier it is for the hacker to find a password,
find a bug in some software,
track movements,
create disinformation or even manipulate an election.
Lucky for them, we live in an age of cheap data and big data.
Everything you do online creates data.
IDs, passwords, social security numbers,
addresses, medical information, contacts, text messages, cookies and metadata.
It's all a commodity,
and consumers have been conditioned to give up their data in exchange for free services
like photo storage, streaming music, social media and search engines.
But your data being a commodity means it is owned by a dozen or so companies and agencies,
all of which are just as vulnerable as you are to cyber attacks.
The Colonial Pipeline supplies fuel to gas stations, airports, military bases,
and runs over 5000 miles along the east coast of the United States.
It's a vital part of infrastructure that tens of millions of people rely on.
But the backbone of US infrastructure, like the Colonial Pipeline,
runs on a patchwork of different software,
some of which haven't been updated since the 80s.
A ransomware attack in 2021 shut down the pipeline for over a week.
The attack wasn't particularly complicated.
A group of hackers called DarkSide were monitoring several energy companies
waiting for an opening.
As soon as they found one, it was off to the races.
They locked up over 100 gigabytes of files
and threatened to delete them or publicly release the files unless they got paid in 24 hours.
Colonial initiated a standard response to a cyber attack,
a lockdown,
shut down operations,
find the leak,
assess the situation and mitigate.
Colonial ended up paying DarkSide over $5 million
but not before the entire East Coast was turned into chaos
with gas shortages lasting for weeks,
thousands of flights delayed or canceled,
and shipments of vital medical supplies were disrupted.
But this is just one of many cyber attacks that have happened over the past few years.
January of 2021,
an unknown hacker got into the water treatment plant for San Francisco,
turned off the water purification programs,
effectively poisoning the water supply for millions of people.
As of this recording,
no one knows how the hacker got in or who they are.
After that, Twitch was hacked,
and millions of user accounts were compromised.
Around the same time in 2021,
a cloud-based video security service was breached,
and over 150,000 cameras were accessed by an unknown hacker.
The cameras were everywhere,
from hospitals, classrooms, jails and other sensitive government locations.
How long were the hackers using the cameras and for what purpose?
Nobody knows.
The rate of cyber attacks are increasing exponentially every year.
At the same time,
it's an open secret among IT professionals
that there's a critical lack of cybersecurity assets available to get ahead of this.
Before we move on, it's a good time to mention there's a simple way to impede this threat.
It puts hackers at a disadvantage.
It's called an air gap.
Let me show you how it works.
How's it going?
I will show?
Can you show them how the air gap works?
Can you break into anything now?
Tch!
Disconnecting a computer from the internet for the sake of security is called an air gap.
It means that in order to interact with a device,
you must physically interact with it.
There is no wired or wireless connection at all.
That slows down the progress of a hacker and keep systems in their own bubbles.
If you need to move files between one set of servers to another,
you'd have to move them via a USB drive.
It's not flawless.
Viruses like Stuxnet can hide on USB drives.
But by and large, most cyber attacks happen to internet-connected devices.
The move away from air gap has been brought on by the relentless pursuit of efficiency,
both for profits and for green initiatives.
Air gapping slows things down and creates redundancies.
That's more secure but less efficient.
CEOs and politicians decided in the early days of Web2
that efficiency is more important than security.
And this went hand in hand with the centralization of the internet.
So what we have now is a hyper-connected world
with most of the data being centralized by a few dozen companies
that are vulnerable to cyber attack from thousands of adversaries across the world
with a critical lack of cybersecurity infrastructure to defend themselves.
Sounds like a disaster.
Well, it is.
And no one knows how to fix it.
In 2019, a group of banks, cybersecurity experts and defense contractors
ran the first large scale simulation of a global cyber attack.
It was called Cyber Polygon
and coincidentally was funded by the World Economic Forum.
You've got to hand it to Klaus.
He sees a threat to his narrative from a mile away.
Cyber Polygon recreated cyber attacks on banking and healthcare systems in two scenarios,
attack and response.
Teams would score points based on how well they stopped an attack or headed one off.
The results were not great.
In the attack phase, 27% of teams struggled to score points.
And in the second scenario, 21% failed to score any points at all.
None of the attacks were repelled.
The abysmal results show global leaders what they fear the most.
That they are sitting ducks.
But they can't go back.
They're addicted to centralization,
to the Internet of Everything,
to selling off the data of their citizens to the highest bidder
and to making everything more green
even if that means a disaster could spin out of control.
The groundwork for a cyber pandemic has already been laid.
And it's going to affect everyone.
December 8, 2020,
it was a normal day at FireEye Cybersecurity
until one of their mid-level technicians got a notification on her phone
asking for a two-factor authentication code.
But she didn't request a code and she got suspicious.
She brought the phone to her boss.
The management on duty that day checked the logs for the account tied to that phone
and discovered that their entire suite of Red Team programs have been stolen.
Red Team programs are tools used by companies to hack their own systems to test their capabilities.
FireEye traced the intrusion to a backdoor and a system monitoring program
from a company called SolarWinds.
But the attack wasn't carried out by a group of hackers looking for money.
It was a nation state that had been inside the SolarWinds servers for months!
Soon, everyone who was using SolarWinds was reporting breaches on their systems,
open doors that let anyone from a still unknown nation state
be able to snoop and spy on their files and data.
Every day, someone new reported a breach.
Intel,
Microsoft,
Department of Energy,
Department of Homeland Security,
the National Nuclear Administration and over 100 other major companies,
US government agencies were breached.
The back door had been open for weeks.
Sometimes months at a time.
The FBI and NSA traced the breach as best they could
but could only offer up one possible suspect---
Russia.
We don't know what the effects of the SolarWinds attack is going to be.
But if the attacks on our infrastructure are any indication,
it seems that an enemy is probing for weakness.
The machines of war are in place.
A digital siege is looming.
One that won't just lock us down
but has the potential to roll back half a century technological progress.
Everything that needs the internet to function could cease to work for weeks,
months or even years.
Cell phones, GPS, security systems, modern cars, trains and aircraft,
of course, don't forget, your money.
It's all hinging on the internet to work.
And once the supply lines are cut, they won't get reconnected quickly.
Data centralization is going to make it happen at the stroke of a keyboard
or click of a mouse.
And there's little we can do to stop it.
The only question is if we'll learn from it and be more responsible with our data afterwards.