Full transcript
0:00All righty. Well, hey there Ally. Goodness gracious, it is super good to get together and chat, but I think you've got some incredible news lately, right? You're releasing, you're launching, you're publishing a whole new book, Code War: How Nations Hack, Spy, and Shape the Digital Battlefield. Is that right? >> Yes, that is right. Thanks so much for
0:19having me. I'm really, really thrilled. You know, this is my first book. Uh it's been crazy. So much work. But it's really been so fun. I've wanted to do this for years, but I didn't realize that it would be a book or I didn't really think about it in that way. And seeing it now finally in print has been so powerful. It is all
0:40about the intersection of cybersecurity and geopolitics. I specifically look at the histories of Russia, China, and the United States and take a look at how the cyberattacks that they use today and the defenses have been shaped by their histories. And it's been so neat because I go back to like Tsarist Russia, Imperial China, and I pull themes out
1:02that put context into exactly why they use the cyberattacks the way that they do and why they built the defenses the way that they do. It's uh it's something that's like been a bit of a passion project for me, but now that I'm into cuz I'm a big history of war buff, it's been so fun. >> Goodness gracious, there is certainly so
1:20much to dig into. But would you be willing, I don't know, just giving a quick crash course of who you are and what you've been up to in your own world? Like how did you get to this book? Where how did you lead to this? Um I know you mentioned, "Look, this has been a passion project." But how did you
1:34find yourself in your life and everything that you've been up to now, "All right, yeah, we'll take on a book, a mountain of work." >> Yeah, it's funny. Um I've been very lucky. So I got started in cybersecurity back in college. I was getting a degree in computer engineering and at the time there was one cybersecurity class in the
1:52entirety of Boston University, which is now very different. Different world now, but at the time it was one and I was very lucky we even had one. And it was actually such a cool class. Looking back especially, like I didn't realize how good I had it because our professor would set up labs so that we could actually like hack a server for
2:11our midterm, hack a server for our final, have to defend a server. Um and so it was super interesting, super hands-on, and I felt really lucky just thinking about like how much time it probably took him as a professor just doing it himself to set up these labs and make sure we had access to all of that and then of course like teaching us
2:28all this stuff too. Uh and so for our like mid-year project, we had to either do some research of our own or copy someone else's research and kind of come back with this research project and present it to the class. And so me and a few friends decided to do our own research. We ended up hacking the Square
2:48reader. We turned it into a credit card skimmer with a hardware encryption bypass, which was very cool cuz I was getting my degree in computer engineering, so I was very interested in like that intersection of computer science and the hardware piece of it. And it so it was a perfect representation of that and we went to present it to the professor and he was
3:06like, "This is really cool. You guys should submit this to Black Hat." And I was like, "What's Black Hat? That sounds interesting." And so we wrote a paper on it, we submitted it, it got accepted. And so my first real experience with the cybersecurity industry was flying out to Vegas and presenting on it, getting to meet the community, going on CNN and
3:25CNBC and I was like, "This is awesome. I love this. If this is every day, this is a great day." >> lion's den. Yeah. >> So um I pretty much fell in love with the industry after that and I was a hacker for a few years before becoming a security practitioner and then becoming an industry analyst and I've been an
3:43industry analyst for 5 years now focused on detection response. So my passion has always been very detection and response oriented. Um but yeah, kind of a a wild journey, but it's shown me a lot of different sides of the industry in a really unique way and I I'm very grateful for that. >> Well, I'll admit I have seen you across
4:02the internet airwaves, right? All online, whatever it's Twitter, LinkedIn, social media and all, but you've always been doing such like super cool stuff. And then hey, sometimes you got to reach out to Huntress and see what we're up to and that's just been sweet. Hey, cool. I'm I'm so happy to hang out with Ali. >> Thank you. That means the world to me.
4:21>> So, could you tell me more about the book? I feel like I I don't want to ask for a whole crash course, but where's it at? How are you doing? The whole process of making it? What are the some of the sweet highlights? Please just tell me everything you can. >> Yeah, like how am I doing emotionally?
4:37Not well. No, it I'm actually in such a good spot now because it's finally off to the printers, which has been great. So, I did not realize the extensive process that this is. It is writing it and you are not done when you turn it in. There's also all of the copy editing stage. There was actually when I
4:57submitted it to the publisher, I had 136,000 words. Turns out you at least for for the book style that I'm doing can only have 96,000. And so we had to cut out all of those words to get it down to the count. So, there was the cutting out period and then the copy editing period and then the proofing period to make sure
5:18everything was perfect and then off to the printers. So, it's been a long journey, but it's good to know that there's so much rigor that goes into publishing books. >> Totally. Yeah, yeah. >> Yeah, so now it is being printed as we speak and I'm really excited that I'm going to be releasing it at the RSA conference, which I think is
5:39really good timing. Yeah, and I'm going to be doing book signings there, too. So, it should be a ton of fun. What I really enjoy about the book, like I just recently did a little like um sneak peek reading from one of the chapters. And what I really enjoyed about the book is that I tried to make this approachable
5:57for anyone. I didn't want this to be like a oh here, we're going to get down low level into the weeds like technical. I wanted this to be something where you could come in with an interest in geopolitics or an interest in technology and start reading this and get value out of it because I think we have a lot of
6:14texts that are highly technical. We're getting more that are more focused around the business side. But when it comes to getting people to understand why cybersecurity is important, why privacy is important, why data is important, why this all fits so perfectly into the world of geopolitics, we can we have a bit of a gap there. And so this book is meant to to fill that
6:34gap and to show especially for China, Russia, and the US like what exactly they're doing and why it matters. And it it's so interesting how many different areas cybersecurity both defenses and offensive attacks touch. Like it it's not just oh these are the attacks that they're perpetrating against other nations. It's also like here's the
6:54vehicle that these nations have put in place to perpetrate repression and to make sure that they're that dissidents can't speak out or that they're able to capture dissidents more effectively like the whole surveillance state. And so it's been really cool because in each section of the book I go through here's all of the like the policy that has been put in place to set
7:15up the cyber defenses or that hasn't been put in place and here's the reason they set that up the way that they did because that is actually so different from China to Russia to certainly the United States. Um so I really loved it from that standpoint and I've tried like this is my my kind of thing is as I was
7:34writing it I was like oh my god this is so dry like I'm just writing about all of these laws and regulations. Nobody's going to want to read this. So, throughout it I added like I don't I don't want to call it gossip because it's it's true. Like it's all true. But these little like this little bit of
7:51tea, this little salacious bits that are just interesting and funny and human. And that was really important to me throughout to make it a little bit more interesting. >> No, I think you do still get to some gritty stuff though, too, right? I see I'm looking through the website, forgive me, but like NotPetya, you mentioned Sandworm. There's some some cool stuff
8:11to dig into. >> Yeah, there's some awesome stuff. I what I really liked was I know that like there's been so much ground that has been tread here for specific attacks where like amazing journalists have gone so deep into many of these attacks and like looked at every single facet. And so what I wanted to do and what I ended
8:28up doing is is putting in a bunch of chapters that go into specific attacks but in the context of the geopolitical goals of that country. So like for example, in the China and Russia sections, there were entire sections that are just dedicated to the countries that they are trying to either take over or influence. Of course like there's a
8:49whole long sec- section on Ukraine. There's also like a shorter one on Estonia and what Russia has done there. There's a whole very long one on Taiwan and what's happening there, Tibet. And so it's been cool because to your point like I go very in-depth on things like Stuxnet or NotPetya, but um
9:10and kind of talk about the human elements there, too. But I also take these like lesser-known stories and try to put them into that context of like this is another angle on what's happening and why it's happening that way to give that context. It's It's really fascinating and I think it gives a good perspective to the future, too,
9:29because I'm starting to to see as I like just experience the world in our new wild day-to-day, just how much all of this is applicable and understanding it in that historical and modern context is so critical. >> And thank you, really, like especially for shining the spotlight on it, because I know, even just my perspective, right?
9:51I I like to think, "Oh, kind of nerdy geek. I like to be on the keyboard and technical. Look at malware, see what hackers are up to." But, I'll be the first to admit, I've always just tend to shrug off kind of who who did it, right? What nation? What bad actor? What APT? XYZ, etc. But, getting to Okay, look at
10:10the geopolitical aspect of this, uh, is still super important, because even that's just the understanding of the world we all live in. I'm always thinking, "Okay, it's malware. It's a hacker. It's bad. Let's just get it out the door." But, you do kind of need to know who's who on the playground here, right? >> Yes, and it's such a good point, because
10:31that is so important thinking about this more strategically. There's so much that you can learn about and to help you predict exactly why a nation is going to target a particular target or react a particular way. And like, that's the fundamental thing about this book that was so important to me is I kind of I started off with being like,
10:51"Cyber war is not happening. That's not going to happen. That's not a reality that we're going to live through, because we don't exist in a vacuum." Like, there's a broader ecosystem that we interact with. I used this quote in the very beginning of the book from Richard Feynman and the 1986 Rogers Commission report on the Challenger shuttle disaster, which I just
11:09absolutely love, which is, "For a successful technology, reality must take precedence over public relations, for nature cannot be fooled." And this whole idea of like, "Nature cannot be fooled" was a core theme in the book for me, because of course, at the time he was talking about the failures, um, with the with Challenger. But, for me, it's very much so a if there's not a
11:29real-world reason, a real-world motivation for the cyber attack, they're just not going to do it. There's no point in doing it. And so once we recognize that, we can more closely predict and identify what they're most likely to attack and when, which I think is going to become very important over the next decade. It also is heavily related to and like one of
11:50the things that I did in the book is I is I actually bookended the book with two different wars. So I start with Yeah, this was I loved this. So the I started with Sorry, I'm totally going to start geeking out here. >> No, that's that's the whole point. That's what we're here for. >> I started with
12:08actually the Gulf War. And it's so interesting because like obviously cyber attacks not a big part of the Gulf War was 1990, right? Very different time comparatively to what we're seeing and like where I end the book, which is at Russia's war in Ukraine. But what the Gulf War really was was it was an inflection point for the US, Russia, and
12:30China where they all solidified around the realization that like joint military operations, joint warfare is the only way forward. That's the way that you win. Like it showed that for the United States because of the decisive victory that they had. Russia had been doing it for years with radio electronic combat, but what was really
12:50cool about it is it was a moment for them where they were like, yep, this is continued validation that what we're doing is the right path, that this is the way that we need to go. And for China, it was a wake-up call of we really need to start taking joint warfare more seriously, multi-domain operations more seriously. And so to me
13:07that kicked off this race and this change to integrating multiple different types of warfare together, which of course became cybersecurity as a core part of that, too. And we now see that actually happening in Ukraine, which is so fascinating. >> Yeah. That is wild. >> Yeah. It's not that long. It's not that much time. You know, 30 years, but like
13:30it's a lot of change. >> Can you tell me, if I may, even just like your own personal lifestyle in writing the book and putting it all together? Like I know, I think both of us are like something I've got this idea. I'm a little obsessed with it. I'm going to keep working on it as much as I can. I want
13:47to pour myself into this. Is that like still balancing it with your day-to-day? Is that something that you were, I don't know, burning the midnight oil for to make this thing come together? How much time are you pouring into pages? Can I ask? >> Yeah, it's a great question because as an industry analyst, I actually write a lot. So, it was
14:06not ideal to also be writing a lot for a book because it was completely separate from my work. So, it was 5:00 p.m. on, you're writing, and 7:00 a.m. to 9:00 a.m., you're writing, and Ally's not doing anything fun on the weekends. Ally's not going out with the friends for a while. Just to get it get it done. I did have a few like kind of
14:27romantic moments of writing. One time I stopped over, I was headed back from a business trip, and I was like, "I'm just going to stop over in Paris, and I'm going to work at a cafe for a few days and just write." And that was a treat. So, I did try to make it a little bit more pleasant that way. It's funny, I
14:43actually got advice from someone almost 2 years ago now who said, "You need to just disappear to a cabin for a month and do it. Like that's the only way." And I was like, "No, it'll be fine." Oh god, I wish I'd done that. I wish. >> That is good advice. >> So, it is definitely like I think it's
15:03tough, too, because these are not simple stories. Like even though I tried to kind of pull it up out of the technical, you at least from my perspective, when I write about stuff like this, I want to understand it completely. I don't want to just like look at surface level cuz I think you get into much more nuanced
15:21cool stuff when you get into that deeper level and then can pull it back up. And so uh every story there were times I got into like these liminal spaces where hours would pass and I would have no idea. And I was just like in a flow state. So it was really cool but also like where did the time go and how did I
15:40spend like 6 hours just on this one story, you know? >> Well, super valuable cuz those are as you said not simple stories but not simple ideas. Like you're you're it's it's war. It's nations. It's the countries. It's the deception. It's the it's the cyber security warfare to the realest extent. So hey, kudos to you
16:00genuinely. I I I'm stoked to read it. >> Thank you. I hope you enjoy it. I can't wait to like I think the most exciting part for me is just hearing what everyone thinks and hearing their perspectives. One of the really cool things that I've done recently is like I was on a um I've been at a few events
16:17and talking to people about the book and they'll bring up some of their experience and I'll be like, "I wrote about that. I wrote about you doing that in the book." And that's the coolest part when that happens. I'm like, "Oh my god, that's amazing." I love to hear these stories. >> Well, I'm looking at it. Amazon,
16:33Blackwell's, Barnes & Noble's, just about everywhere, right? Available wherever books are sold, I think. >> Yep, wherever books are sold it is sold. So definitely get a copy. Bring it to RSA. I'll sign it. I'd love to. >> Heck yeah. Are you still going on the media tour? Are you doing any other oh talks or other presentations even more
16:52following this? I'm sure they're keeping you busy. So >> Yeah, you know, I think to me and I'm I'm kind of curious what you think of this too. Like to me this is a perfect time for this topic. Like a year ago when I was writing it, I was like, "Oh, I really wish I could have released it
17:07this year." And now I'm thinking I'm so glad that I couldn't have released it last year because now is the time. And so I'm going to be speaking on this and writing about it and talking about it for at least all year because I think we're going to need that conversation around multiple different elements of this. You know, the surveillance state
17:27is one big part of it. The cyber attacks that we're seeing used whether it's in Venezuela or whatever is going to come next are very important to talk about and to understand more completely and why they're happening. And so, I think that there is nothing but um nothing but opportunity to talk about and explain these and make sure that
17:46it's clear as to why they're happening and whether or not they're actually the right direction. One of the things that I think about a lot is like we've got of course like the surveillance state and how that is changing, but we've also got and one of the things I talk about a lot in the book is like the splintering of
18:00the internet along regional lines and what that means because it's ultimately a big negative for democracies. Like democracies thrive when communication can spread freely and it can spread across borders. And what we're seeing is that through because of many different competing priorities, that's changing completely and I have a lot of concerns
18:21for the direction it's going and for how we still enable different countries and the people within those countries to communicate freely. So, I think there's long story short a wealth of things to talk about here and at the very least intend to blog a lot on them. But I'm curious what what you think of this year and like everything
18:38that's coming up. >> No, I mean I agree completely and that okay, the state of cybersecurity, the state of misinformation, the state of privacy, surveillance, etc. is just something that continues to get more and more and more in the spotlight for a massive conversation in every direction, good, bad, and ugly. Uh So, without a doubt, I mean what I I am
19:00glad and I'm super happy and again, this is kind of why I wanted to reach out and for us to have a chance to chat cuz I know it's like such a personal milestone for you to get this out and create it and out the door across the finish line. So, like I would totally wanted to celebrate and like
19:16really help shine a spotlight on like, yeah, we got to have this conversation and I'm glad you're here with a voice to be able to do that. So, right now, 2026, sure, as opposed to 2025, making it happen and absolutely this year now more than ever. I I I got to keep saying kudos. >> Well, thank you so much and thank you
19:35for uh supporting the process. It's been amazing. Like I've had so many people um that I interviewed for the book and I'm really grateful for that because those ideas and those thoughts have like they transformed the way that I approached this. So, thank you for being interviewed and for your support of it. >> Excellent. Thank you so so much, Ali.
19:54Any more sweet call to action? Is it hey, just jump over to the website, go and pre-order? What else is there for folks to be able to tune in and get this thing in their hands? >> Yeah, I think definitely pre-order. Come to RSA if you're not and I'll sign a copy and uh >> I'll see you there. I want to come hang
20:09out for sure. >> Exactly. And then um also, I have a Substack, so you can follow me there cuz I'm going to be writing a lot more about this beyond the book, but looking at like what's actually happening now and kind of extending the the focus of the book into what's happening today and and trying to tie it to some of the more
20:26recent events that are happening. So, you can follow me over there, too. >> Always a lot to talk about, I'm sure. So. >> Yes. >> Thanks again and again, Ali. I'll leave all the sweet links in the description and all for hey, folks will have some easy access to it, but I just can't say thank you enough and congratulations.
20:42That's what I can't say enough. >> Thank you so much.