Securing Our Future: The Cyber Challenge in Aging Infrastructure

Chip Harris (NaN:00NaN) Well, my name is Luther Chip Harris. I am a cyber criminal investigator. Um, and I'm a certified ethical hacker, pen tester, forensic investigator, and auditor. So I deal with, um, not the nicest people on the planet that, you know, are here to do you and the general public harm. Um, you know, and, uh, I've been a, uh, the reason why I wear a mask and I get a lot of questions around that is, is to protect my identity.

Chip Harris (NaN:00NaN) I've been doxed, you know, twice. And I've had to been moved, you know, the federal government had to move me once to an undisclosed location, you know, and it was very impactful to me, you know, and I go very hard on protecting my identity against these threat actors from Russia and China, you know, that have come after me and my family. And, you know, I take my security and my, you know, security very, very

Chip Harris (NaN:00NaN) as I say, to a whole nother level of paranoia to protect my family, you know, as well as myself, you know, and I have worked with military and special forces for the better part, you know, of a long time. And there are people that wish me dead, you know, so there you go. That is the reason why when I do a lot of these podcasts, you know, I take it to the nth level and I wear a mask to protect my identity from, you know, for example, the people that wanted to be have deported, which was China, which they have some great facial recognition software.

Chip Harris (NaN:00NaN) They're really good at tracking down where you're at in your location to send a death squad to come and eliminate you. So therefore I go to very great lengths to protect my online identity, you know, behind, let's say, you know, my four firewalls that I have here in my six proxies that, you know, that protect me in my IP that rolls every 30 minutes to make sure that you do not know where it is and who it is that I am. So I'm kind of the Banksy of the internet, you know? So I go very hard on, you know,

Chip Harris (NaN:00NaN) to the paint to protect myself.

Chip Harris (NaN:00NaN) Well, I'm a state and federal pain in the ass. Um, because normally when they call me, it's pretty damn bad. I mean, it's like, you know, um, it's never like a warm reception, like, Ooh, look, he's here to help solve the problem. No, my job is to tell you what the problem is and how to go fix it. Now you can take all that information for all you want. Hey, and it is left up to you. So I just tell people to do as they will. So, you know, that's one thing.

Chip Harris (NaN:00NaN) that I tell people, especially when it comes down to critical infrastructure that I have to deal with is that, you know, um, there is a totalitarian, you know, uh, fallout of when these things go bad that affect human people that affect human beings. So it's not just like, you know, it where it's, you know, you're dealing with data and servers and, you know, stuff like this, I mean, you're dealing with physical infrastructure. You're dealing with.

Chip Harris (NaN:00NaN) power generation, you're dealing with water, you know, so forth. And right now it's pretty bad. I mean, most of this stuff. And I know this is not a political show and I don't deal with politics. I cut through a boulder of red tape daily just to get stuff done, you know? So I have enough of that, that I have to deal with on the state and the federal side. But you know, as I tell people, our infrastructure is aging out and getting really old, like 30 years old and you know, people are like, well, which administration do we blame?

Chip Harris (NaN:00NaN) Well, I'm part of the blame a party. I blame both of them. It's like you've had 30 years under multiple, you know, administrations to get the stuff fixed. And it's not what I call sexy news. Like, Ooh, we're going to work on the water treatment facility today and, you know, get better pipelines put in the ground and, you know, and we're going to start repaving roads, you know, and stuff like that, um, you know, these are things that have are steadily. It's what I call the death of a thousand cuts, you know,

Chip Harris (NaN:00NaN) It's, you know, you're slowly getting cut and you're slowly bleeding. You're slowly bleak. But then I, you know, after you get about a thousand cuts, I drop you into a huge, gigantic ocean full of sharks and piranhas that are there to basically eat and destroy you because that's what these people do. And it's not that we don't know that threat actors like, you know, Russia, China, you know, um, Iran have not hit our nuclear power grids, you know, or our, uh, power systems at all, or, you know, our water treatment.

Chip Harris (NaN:00NaN) We know that these countries that are, you know, what I call the dirty 30 countries, because there's about 30 of them out there that want us, you know, dead, you know, as the infidels and they want to do us harm that they hit constantly, you know, from low kinetic attacks to high level, you know, cyber attacks. Um, and it is, um, it's just a matter of time before they get it. It's not a matter of time of when they're going to do something. It's when they want to do something on based on their time clock.

Chip Harris (NaN:00NaN) And my job is to help roll that time clock back the best I possibly can. Um, especially in the power industry, especially in nuclear, you know, that's very, that's a very big thing. Uh, people in the United States don't realize that, Hey, there's 53 nuclear reactors throughout the continental United States. Well, if one of those goes up, you know, and blows up, that's a very bad situation for about a hundred thousand years. So, you know,

Chip Harris (NaN:00NaN) And when I explained that to the general public and the populace, that kind of gets them scared and gets politicians scared and it gets a lot of people scared. Well, they should be scared because guess what? You know, would you, you know, do you still own a 30 year old, a 30 year old car? No. Do you still, you know, uh, drive on 30 year old, you know, trains and railroad tracks? Yeah. Do you drive on 30 year old planes? No.

Chip Harris (NaN:00NaN) But do you drive on 30 year old subways? Yes. So, you know, it, and the poison that I try to, in the bitter pill that I try to get people to swallow that deal with on a daily basis is, is that this is completely fixable. It can be done. Yeah. It's, it's expensive. You know, it's a, I call it green paper problem. There's a lot of money that's got to be invested into doing this. And this current administration.

Chip Harris (NaN:00NaN) um, actually has passed an infrastructure build where we're starting to see improvement on roads, improvement on streets, improvement on bridges, lighting for streets, you know, and so, and it's going to be a gradual rollout. But, you know, as I tell people, you should be spending about 20% of your state's GP, GPD, you know, and, uh, the federal GPD should be at least 25 to 30% just on infrastructure projects, uh, throughout the common United States.

Chip Harris (NaN:00NaN) Will that ever happen? Well, until it starts breaking and failing. Yeah. Then they'll start doing it. When, and when the body start piling up and people die, you know, and you know, it hits the news and then everybody goes, Oh my God, I can't believe it. And I'm like, no, I can believe it.

Chip Harris (NaN:00NaN) Mm-hmm.

Chip Harris (NaN:00NaN) Mm-hmm.

Chip Harris (NaN:00NaN) Yeah. And there's a three more that are, yeah, there's three more that are scheduled and they're being built by Microsoft. They're being built by Bill Gates. So the guy that created windows, which is not the greatest operating system on the planet is going to be in charge and own nuclear power facilities. Now I'm not saying that that's set up for failure, but I'm just setting it up for a lot of questions and answers.

Chip Harris (NaN:00NaN) is like, wow, you people can't even make an operating system that can't be hacked. So you're going to make a goddamn nuclear power plant. I mean, so anyway, you know, it's just, you know, and when you're dealing with FERP and NERP and all those guys, you know, and all the regulations and stuff that go with it, you know, I mean, you, you mean, and we've learned from three mile Island, you know, when that happened, you know, the safety and the security that deals with this stuff, you know, and.

Chip Harris (NaN:00NaN) It is issues and stuff that we have to be able to address first off from a, you know, a human standpoint and then an environmental standpoint. Now I'm not a tree hugging hippie by any means whatsoever, but I am a conservationist, but you know, and I tell people that, you know, you have to respect the land that's given to us. You have to respect the environment and stuff that's there, you know, and can we go a little bit greener? Yeah, we can go hard to the paint. You know, if we wanted to put up more, you know, solar, we could do that. I mean that, you know,

Chip Harris (NaN:00NaN) the free energy, you know, now it's going to have to be in certain locations and it's only going to hurt, you know, help certain power grids, you know, but, you know, it's a, it's a really cool thing to see some of the new technologies that's coming out there, but then I say, okay, that's just really cool and all just because it's really cool and neat and can do these great things is it, you know, and it gives you more and we are addicted in this country to convenience. We, we really have become addicted to convenience.

Chip Harris (NaN:00NaN) Um, just because it's convenient necessarily doesn't mean it's secure, you know, and I say that a lot, you know, the, the audits and the investigations and stuff that I do, when I really start taking a look at this stuff and going, you know, wow, you know, and I'm going to give you an example, you know, they called me in on a colonial pipeline, just to look at the evidence, just to look at the stuff that was there. And those skater based systems are running on Windows XP service pack one. And I was like going, wow.

Chip Harris (NaN:00NaN) This company makes over a billion dollars, you know, a billion dollars, and they couldn't even upgrade this. Right. I mean, they couldn't even, I mean, and people would just got, you know, and the problem was the reason why they turned all that off was the gas and the oil is still going to flow, you know, at a, at a whopping seven, you know, seven to 15 miles an hour, depending on how far they're pushing through the pipe.

Chip Harris (NaN:00NaN) But the problem is it pushes it through all these different states. And when it fails, that gave the state attorney generals the ability to look into how much they're getting charged. So it's like, why is Mississippi getting charged more than Alabama is for the same amount of fuel going through. And that's what they said. Okay. Turn it all off, turn it all off until we get it all fixed because they didn't want to be audited by all the states that they have to get the oil to go through. You know, so it was a money decision. It wasn't like.

Chip Harris (NaN:00NaN) The gas is going to run out. It's not going to run out people. I mean, you know, we, we have a plethora of oil in this country if we need to get it, you know, from the national stockpile all the way down to fracking, if we have to, you know, we're not going to run out of natural gas, we're not going to run out. I mean, we have a lot more resources than the, you know, people think that we don't have that we actually do have, you know, and, uh,

Chip Harris (NaN:00NaN) But the problem is those telephone poles have been there a lot longer than that pipeline has, you know, and some of the, you know, um, uh, and when I finished up that, you know, looking at the stuff that, you know, that was presented by my state to me to look at that I didn't even charge them for, I did totally pro bono. I was like going, you're getting screwed by this pipeline because, you know, you have the right to audit them for, you know, the, you know, the taxes that they're charging for you for these certain things, and they actually took it to, you know, the state's Supreme court.

Chip Harris (NaN:00NaN) They lost and they said, Oh, we're going to take it to the Supreme Court. And they said, bring it because you know, you, you say this, you're supposed to be charging us this rate, but you're actually charging us this rate. And that's like three times the normal than the other states that you were charging. So, you know, it was very interesting to say the least to see the, you know, the politics that actually ran out of that. And they, then they finally said, okay, we'll just cut you a check. You know, we'll just cut your check and we'll make it all go away. The lawyers will be happy and whatnot. But.

Chip Harris (NaN:00NaN) Did it really fix anything? No. It is like, you know, did you go out there and replace that older system that was out there that was causing these issues? No, all it is turn right back on. It's doing the exact same thing, you know, and they followed back up with another, uh, you know, uh, audit and the DOE said, yeah, guess what? They're using the exact same systems. They're going to keep paying the fine. Then it would be the fix. And I'm like, that just makes no sense to me whatsoever. But then the, the crashing reality said.

Chip Harris (NaN:00NaN) It's just easier for them to pay the parking ticket than it is in the fine. Then it is for them to do the fix. And that's, that's where we're missing the point. That is where, you know, uh, NERP and, you know, um, CESA and all these regulatory bodies that we have in Washington should come down on them, like the wrath of frigging God, you know, because they're the, instead of just paying for the, you know, the fine, which is a bump in the road for them, basically.

Chip Harris (NaN:00NaN) You know, they should be fixing that system so that we don't have the loss of fuel, you know, and whatnot. Same thing with PG&E. PG&E had over, you know, uh, 30 something, 40 something years, the ability of placing J hooks that hold their lines up, you know, on their phone poles and, you know, you literally had a phone pole drop a line, you know, during fire season, you know, during their summer, they caused the, you know, um,

Chip Harris (NaN:00NaN) the paradise fire that, you know, burned hundreds. I mean, it's the third biggest fire ever in California history where it burned hundreds of thousands of acres of land and burned cities down to the ground, you know, and there was no alerting or warning system, you know, that these, and it caused a paradise fire that literally, you know, you had people burning alive and that's, that's the human loss. And will we ever see.

Chip Harris (NaN:00NaN) you know, PG&E going out there and start replacing these things. Well, guess what? This year they've started doing that because people have started filing multi-million dollar lawsuits for losing their loved ones, which they should, you know, and you have a city in California that's suing their own power company within their own state because they had the opportunity to fix these things and they never really did. So, you know, and in a way, you know, what I deal with.

Chip Harris (NaN:00NaN) All at that level is a blame game. You know, this, this hand's pointing at this thing. Well, you're all responsible. You know, they're all trying to blame each other, but it's like, congratulations. That blame is actually put onto you as a whole, as a blanketed, carpeted thing, not just, you know, one person for one decision that they did or did not make. You know? Um, and it's, you know, what we're dealing with now. And I tell people, this is like all of these old systems, let's put it on the internet, which is.

Chip Harris (NaN:00NaN) a really bad idea, you know, and it's like, Oh, but yeah, I will. I was at a conference, uh, last year where the director of cyber security had on his iPad, on the plane, he was showing me like, Hey, I can take a look at, you know, all this kind of cool stuff, you know, um, of my entire, you know, power plant and my coal fire plant and my water treatment facility and all this stuff.

Chip Harris (NaN:00NaN) right here on my iPad. And I was like going, okay, what the heck your iPad? And he's like, well, what do you mean? I was like, if I get into your user account and I own your account, I now own those systems. And he's like, that's not totally possible. This is a, you know, blah, blah. And I'm like, okay. So I turned on Kali Linux and he was sitting right next to me in the convention. And I said, you know, I literally, you know, made a pop-up that popped up on his screens like

Chip Harris (NaN:00NaN) Hi there. I'm the guy sitting next to you that now owns your iPad that now owns your account and, you know, and dude, he flipped out. He was like, you know, I'm going to sue you. And I'm like, you can't do shit, dude. I'm seriously. I mean, you said it couldn't be done. I did it within about 15 minutes and congratulations. Now you've got to go change all your user accounts and everything for all your stuff and better yet, you should not be doing your monitoring, you know, from a surface or an iPad for your, you know, systems.

Chip Harris (NaN:00NaN) And, you know, do I blame the manufacturer for that? No. Do I blame, uh, the administration for that? Yes. You should not, you know, there's a certain level of security in, well, did you not think this through for 30 seconds conversation did, you know, uh, that should be happening when you're dealing with some of these systems?

Chip Harris (NaN:00NaN) You know, it's like, you know, do we need to put that on the internet? Do we still need to be able to have the ability of hand cranking it? You know, if something goes wrong, you know, um, and there's lots of examples out there, you know, that I tell the general public, like, you know, uh, black energy, sandworm, you know, there, there's some really good books and some white papers that are floating out there if you really want to learn about what it is a nation state, you know, can do, you know, and we've all heard of Stuxnet and all the kind of stuff that can go with that.

Chip Harris (NaN:00NaN) Yeah. And there's a little spy and intrigue and stuff that kind of goes into that, but there's some other operations that they've written books about that are way more, you know, devastating, you know, that I've seen out there. And I participated in some of those, you know, attacks as a nation attacking another nation on their infrastructure. So it can be, um, very delicate.

Chip Harris (NaN:00NaN) but you know, there is a human toll and factor that goes with that. And people don't want to acknowledge that yet. They just think it's a bunch of make believe and Oh, the power just cut off. But I'm going to give you a very real world example. And I've explained this one before. Um, I was hired by a, um, medical company, you know, in a hospital to come in and test, test with my red team. Um,

Chip Harris (NaN:00NaN) you know, and my little happy band of hackers that I work with, uh, to come in and do a red teaming event on a hospital to see how secure they were because they had just spent a ton of money with general electric and Siemens and name a vendor and throw it on a wall. And they stuck there, right? You know, how their IOT systems were and how their tracing trackability are. And you know, how their firewalls are all been done, but guess what? I found out very quickly that their IT and their OT merged together.

Chip Harris (NaN:00NaN) which are two things. If anybody hears this podcast, anybody out there in the world hears me. You do not merge your information technology systems and your OT systems together. You do. They don't. This one should be way over here on this side of the university. The other one should be way over there. They should not even be in the same conversation, but I found out very quickly that they had commingled both of those systems, but they had thought they had been separated. So, you know, um,

Chip Harris (NaN:00NaN) And this was just a, you know, a simple explanation. And then once, after about, you know, two weeks, they gave us 14 days to really kind of get in there and we were within their system within four hours. And then, you know, we had physically tested, um, you know, from low kinetic attacks to high level attacks, everything that we could, you know, on their systems. And then, you know, here I am, you know, suit and tie, not my normal jeans and t-shirt like I am, you know, no mask and everything, you know, and I.

Chip Harris (NaN:00NaN) in a very closed room with what I call decision-making people, you know, the decision-making cats, the people that have the checkbook, you know, they've paid all this money and everything. And I had, you know, uh, you know, uh, 300 page report, but of course, you know, they only want the, what I call the, the two pager report, you know, they just want the, the 10 minutes bad and the 30 minutes of good. Well, guess what? It's all bad. You know, it was like, yeah, yeah. You know, the.

Chip Harris (NaN:00NaN) Very simple terms to people that are not IT technologists. That's, I mean, they're doctors, you know, I mean, these people are, they are not an IT staff kind of people. I mean, these are people that, you know, their job is to go out there and save people's lives. Mine is to kill people's lives. My job is to end it. Theirs is to save it. So

Chip Harris (NaN:00NaN) And, you know, after I had done this explanation of like, hi there within, you know, 20 minutes, I would be able to get into your systems and delete all of your EMR, your patient record systems. Okay. Then I would, you know, be able to turn on your HBA system and turn it on to the coldest settings that's possibly out there on your, you know, chillers and everything that's on, you know, the building itself. Uh, I would turn on the sprinkler system and then, you know, turn the lights off and then cut the power to your life giving care systems, which is

Chip Harris (NaN:00NaN) If anybody's been in a hospital, you see those colored plugs that are on the wall there, that's a completely different electrical system than it would be for your lights and so forth. So not only would I turn off your lights, I would turn off that stuff. So that means that people that are in the ER, the emergency room, are basically at a loss. And people that are in critical care, as well as the NICU units, basically you've got people that are going to start dying and babies that are going to start dying very quickly.

Chip Harris (NaN:00NaN) And you've got, you know, water, you know, and toilets overflowing. You've got no power. You've got no way of tracking and tracing the stuff. And then I, you know, turn on all of the doors to where everything is locked, you know, cause you've got an automated locking system for all your doors. So I've locked all your systems, you know, and then, uh, I'm going to do this during like a very inclement weather, you know, time, you know, so for example, I'm going to do it like if it's up North, like a really bad snowstorm. This is when I'm going to do this.

Chip Harris (NaN:00NaN) So things are freezing people and patients are going to have to go start going from, you know, beds, you know, can't use the elevators because I've already cut all those off down the stairs, you know, or being evacuated by helicopter or ambulance to another facility. Okay. And, you know, after I went to this horrific conversation for about, you know, uh, 20 minutes, one of the doctors said, you know, well, this would never happen. I said, well, yeah, actually it has.

Chip Harris (NaN:00NaN) And he's like, no, it has. And I was like, well, yeah, it has. I mean, I was down there when it happened and he was like, what are you talking about? I said, hurricane Katrina. You know, this nobody's learned from that. I mean, this is the scenario that happened at hurricane Katrina. Well, what happened to the backup power supply? Well, you know, or the backup generator? Well, it was flooded with seawater. You know, you can't, it was dead. DOA. I mean, all your fail safes failed, you know, and you know, can this be done?

Chip Harris (NaN:00NaN) now in a digital kinetic attack versus a physical environmental attack. Well, yeah, because I mean, I did it within, you know, you know, a couple, a couple of days. Um, and I could build that into an attack package, you know, to where now, you know, I can execute that very quickly and quietly, you know, over the wire. And you would never even know about it. So, yeah. Yeah. And I mean,

Chip Harris (NaN:00NaN) You know, my five guys, I mean, we're, we're very separated by different states, but I mean, it's like, you know, I'm sitting here at home doing this on a, you know, work computer. I mean, not an HPC, not a high performance computer, not on a quantum bullshit, whatever the hell they pull out of their butt. Now, you know, computer, I mean, you know, I'm doing this from a home computer, you know, that is not as super duper powerful as you would think it is. Okay. And you know,

Chip Harris (NaN:00NaN) This scared the living bejesus out of these people. And I said, this is the reason why you have vendor management and control, you know, that you're constantly working with a patch management cycle, you know, and then you've got all of these departments all together, you know, and cybersecurity people and your IT people and your network people all together, all at once to sit down and then nobody leaves the room until we make a very good plan and decision and execute that. Right.

Chip Harris (NaN:00NaN) And then you think about the evils that can happen, you know, of what can be done to stop these things. Now the number one sweet, you know, attack, as I tell people right now that we have really got to prepare ourselves for is water treatment facilities right now. You know, people talk about power, people talk about electricity. This year I'm talking about dams.

Chip Harris (NaN:00NaN) This year I'm talking a lot about, you know, the high level risk and the IOT attack factors that we're dealing with water treatment facilities, because out of all the infrastructure that's out there in the United States, water is the oldest and what's the first thing that they want to do? They want to put that on the internet. And I'm like, that's a bad idea. You know, you know, because if you get somebody that gets in there and starts hacking away and is able to cause pneumatic pressure on 30 year old pipes.

Chip Harris (NaN:00NaN) That's bad. I mean, they're going to explode out of the road.

Chip Harris (NaN:00NaN) Oh, we've seen it in missus. Yeah. We've seen it in Mississippi. We've seen it in Flint, Michigan. I mean, if you've seen some of the pipes that these guys have cut out of the ground that I've looked at, I mean, I'm like going, Oh my God, people drink out of that. I mean, it's like, that is the, that is the, I don't know, that's the nastiest looking shit I have ever seen in my life. I'm like going, that is like rustic. There's not enough rust-oleum on the planet that could get that rust out of those pipes, you know, there's not, I mean, there's not enough stuff, you know, I mean, it was horrible.

Chip Harris (NaN:00NaN) And I was like going, so this is in just, I mean, and this isn't like a posh neighborhood, I mean, this is not like some, you know, this is not some rundown old, you know, 19, you know, but rundown neighborhood. I was like, well, this isn't just a posh neighborhood where they're digging up some of these pipes because you know, the pipes that they, that they're tapping off of have been there since the 1930s, the 1940s. So, you know, um, and

Chip Harris (NaN:00NaN) Digging that kind of infrastructure up and replacing that is really expensive and it's really hard. But as I tell people, it also generates a lot of jobs, okay. Because in the United States, we are not stressing enough a lot about people. I mean, and I'm all for engineering, trust me, I am so for it, but I'm also for vocational education and how we can fix all of this.

Chip Harris (NaN:00NaN) in our industry right now is that we need to be start bringing back, you know, vocational education in the school systems. Because not everybody's going to be a doctor. Not everybody's going to be an IT security guy, but you will eventually need a plumber and a carpenter and a welder. And, you know, and those guys, I mean, I've got a friend of mine that is a professional welder and he makes way much more money than I do an hour. I mean, it is ridiculous.

Chip Harris (NaN:00NaN) But, you know, and he loves what he does, you know, and I mean, and I'm, I am for that because, you know, not only am I for manufacturing, but I'm also for industrial manufacturing, you know, the jobs that are created out of infrastructure projects are epic. And I mean, epically good. And that's good for the States. That's good for the economy. That's, you know, good for everybody to be able to do that. And it's not like this stuff is not going away. I mean, it is there to stay.

Chip Harris (NaN:00NaN) And, you know, we really need to be stressing, you know, and, you know, highly, I know you're an electrical engineer and everything, but would you think about, you know, cybersecurity for electrical engineering? I mean, you know, because you can only trust the vendors so much, you know, they are there, they're infant, you know, their interest is a profit margin, not necessarily the safety and security of what you do with their, you know, you know, hardware and software. So.

Chip Harris (NaN:00NaN) Yeah, that's the whole point is there's no inter cooperatively and we're going to have to set a standard for that eventually to where it's like, okay, you guys have got to pick TC IP, TC, you know, how are we all going to interconnect with each other? You know, Mod buses out on his way out SMB one, two and three on its way out. You know, everybody wants to be TC IP, you know, TMP and UDP. So I know the networking people right now are just screaming their heads off, you know, into the mic, you know, going, Oh my God, I can't believe you saying this, but it's true.

Chip Harris (NaN:00NaN) You know, because, you know, in one, one facility that I have, you got 22 different vendors, okay. And all the systems are different. You know, the only reason that we control and contain those is that we have a software management system that is, you know, that's built for monitoring just OT systems, not IT, just OT. And out of that, we have got basically a four year plan that we're having to put together to fix all of that stuff.

Chip Harris (NaN:00NaN) And it's going to take multiple years because we're dealing with multiple vendors. Snyder electrical is only going to do so much after that. It's on you, you know, GE same thing. And it don't even get me started on Siemens. God bless America. I hate those Germans. I mean, they drive me up the wall, but you know, they've got good stuff. Don't get me wrong. I'm not, you know, you know, saying they don't. It's just that this system is meant as a standalone system. It only does one certain thing.

Chip Harris (NaN:00NaN) It doesn't work with these other systems. Now you've got some other, you know, you've got some hardware and some software solutions that are out there. Like, you know, you've got waterfall, you've gotten the nozomies, you've got the clarity that are out there, but you know, they're not meant for patch management systems, you know, that goes back to your window side and your SSC EMS and you know, what you're doing for patch management, you know.

Chip Harris (NaN:00NaN) Same thing with op, you know, are all the operating systems at the desired level. So for example, some of these systems only run on XP, you know, some of these systems will not work on windows 11. You know, some of the vendors even tell you do not put our stuff on windows 11. Period. Like we go to windows seven and that's about it, you know? So there's, you know, risk and vulnerability that it's actually put in there because based on the operating system and the stuff that you're using.

Chip Harris (NaN:00NaN) is how's it going to inter cooperate with some of the systems that are controlled and main, you know, maintaining monitoring. Do we do one way diodes? Do we do, you know, firewalls and, you know, in front of these things, you know, do we virtualize them? That's the big thing too is, you know, do we throw everything in VMware or, you know, whatever, and, you know, run it that way? Well, you know, in it, you know, how good your network because latency matters in a lot of this stuff, you know, um, especially in fuel generation and gasoline.

Chip Harris (NaN:00NaN) you know, and petrol based products, oil based products. Um, you know, those pressures, you know, uh, have to be very controlled and maintained in real time and heartbeat matters for some of this stuff. And when it turns off, you know, for you people that don't know, it either goes into a safe mode, which means it just stops, you know? So if you're monitoring on the systems, like I do, you see those red lines and those yellow lines and those green lines.

Chip Harris (NaN:00NaN) You know, when those things start lighting up, it's like, hmm, something is a miss here, you know, and what could that be? And was, well, you know, because there's something that's wrong with that sensor. You know, now in a lot of these things, we can still hand crank them. We can still go out there and, you know, turn the knobs and get it where it needs to be, but if some of these people had it their way, you wouldn't do any of that. You know, they want, they want it all to be digitized. You know, they want it. Well, that's not a good thing because sometimes if, you know,

Chip Harris (NaN:00NaN) What's the fail over for that? You know, what if there is a Stuxnet, Stuxnet attack, you know, on that system and causes that client to, you know, either shut off completely or blow something up. You know, you're back now where we originally were in the first part of this conversation, the loss of human life again, you know, and the impact, you know, on what it's going to do. So this is a very circular conversation, you know, and there's no.

Chip Harris (NaN:00NaN) definitive one answer. It's completely different to based on what industry that you're looking at and that you're, you're looking at doing. And, uh, it's a very, as I tell people, exciting time, because we have gotten to the point to where it is so bad. And when we have kicked that can so far down the line, you know, we have no other choice, but to fix it, you know, and, uh, I don't want it to get to the point to where we have a loss of life. You know,

Chip Harris (NaN:00NaN) Uh, or something like that to where we have to really start paying kind of attention on, you know, fixing our infrastructure projects and fixing our infrastructure.

Chip Harris (NaN:00NaN) Woo!

Chip Harris (NaN:00NaN) Well, the one, yeah, as I tell people, the one I proposed is like, you know, you make it a law that is passed to where a certain amount of the federal budget and state budgets are written to where you cannot touch it. Okay. You're, you know, and that's based on your, our tax dollars. Okay. That is based on money that we pay back in taxes, you know, and corporations supposedly pay back in taxes.

Chip Harris (NaN:00NaN) to help, you know, the better good, you know, as I tell the help the common folk. Right. So, you know, um, and there's nothing political about it. As I tell people, there's no politics when it comes into paving a street. Okay. If you want to get political about it, there's a right side and the left side. Ooh. Okay. You know, there you go. That's about as political it's going to get. Fix the damn pothole. Right. You know, so this goes back to what you're going to see at a township level, you know,

Chip Harris (NaN:00NaN) which you're going to see at a state level and then what you're going to see in a federal level. Okay. But what it is that you have a certain amount of dollars that go into that pot like insurance that you can't touch until something happens. Okay. So it starts at a, as I tell people, a local level, like how much money am I spending or paying back in city, county taxes and property taxes, whatever it may be to get stuff fixed. Right. And is that being delegated correctly the way that needs to be done? Okay.

Chip Harris (NaN:00NaN) Next on top of that is the state. How much is the state bringing in, you know, to where we are delegating that down to the township, right? You know, so it's just a trickle down effect that they can't touch. So it's like, okay, 20% of our state, you know, annual budget goes into infrastructure projects. No matter what they are, we can't touch that money, okay? Colorado did this, you know, and is a very good example of doing this. You know, when they made, you know, cannabis, you know, or marijuana legal.

Chip Harris (NaN:00NaN) All that money went into infrastructure. They can't touch that money. The state legislature can't touch that money. The feds can't touch that money. Anything that they get from taxes from the sale of weed, you know, goes into paving roads, goes into building bridges, goes into, you know, improving the electrical system and the water, you know, congratulations, you know, the, the cities can't touch it and the feds can't touch it, you know.

Chip Harris (NaN:00NaN) So next thing we go to a federal level, right? And this is going to be, ladies and gentlemen, a five, seven, 10 year agenda. This is not something like you just said, snap your fingers and it magically happens. It doesn't work that way. The federal government moves incredibly slow, you know, and especially when you're doling out money, they work even slower. And sometimes they use the lowest in bidder. So let me give you an example of that. NASA, when they were building this,

Chip Harris (NaN:00NaN) wonderful rocket that was going to the moon, you know, Buzz Aldrich looked over to Neil Armstrong and said, Neil, how does it feel to be sitting on the world's biggest bomb made by the lowest in bitter? You know, so, and Neil Armstrong literally says in the right stuff in the book, he almost threw up in his helmet because he thought about it for about, you know, he's like, Oh my God, I'm sitting on the world's biggest bomb, you know, made by the lowest in bitter. And he was right.

Chip Harris (NaN:00NaN) So, you know, there is a state process and a, you know, a federal process of going through bids, which I'm not going to talk about because it just causes me more headache, you know, than it wants me to pull out my eyeballs in some points because this, you know, that process is very slow, you know, to make sure that you get the proper bidding, you know, that's done for these things.

Chip Harris (NaN:00NaN) And then you've got to energize that workforce. So, you know, um, the only time that I've seen the federal government literally just get off its ass and do something was during the COVID, you know, pandemic with the NIH and the CDC where they just started, you know, mobilizing everybody immediately to just like attack one certain problem, right? So if we did this same thing with infrastructure, you're still looking at a three, five, seven year, 10 year process to get all of those monies distributed to the States and then down to the local level.

Chip Harris (NaN:00NaN) to where those projects can be start rolling off, you know, and if they even announced it today, like, hi there, we're, you know, and the same thing we're seeing now, even with the infrastructure bill that was passed four years ago, we're just now seeing the benefits now, you know, um, you know, saying, oh, well, this highway got repaved because of, you know, this project that was passed in Congress, right? So it's a long arborist process, but once it starts rolling, it really starts rolling. So.

Chip Harris (NaN:00NaN) I'm not saying that there should be endless construction going on all the time. What I'm saying is, is there needs to be a checks and balances way and oversight to that wealth committees that we already have that already exist. And some of them prob probably need to be eliminated because they're just, you know, fat on the lamb and it will tell people, you know, um, but you need to consolidate all that and look at the streamlining of that, just like you would a business, you know,

Chip Harris (NaN:00NaN) businesses in the, you know, have the ability to turn and pivot very quickly. Government is not, it's like, you know, it's like having a bass boat with, you know, two Ranger motors that can turn very quickly, you know, and go from one zigzag all over the river versus an ocean liner, you know, you've got to slowly turn that, it doesn't turn on a dime, you know, there's a lot of moving parts that got to go with it. So the analogies that I use when I explain this, you know, to people in layman's terms, you know, in

Chip Harris (NaN:00NaN) And, you know, Ted talks or whatever it is I'm doing, even on podcasts, it's like, you know, the amount of work and effort it goes into writing some of those proposals, you know, and saying, you know, cause I mean, the federal government, as well as you, even a private citizen, you're going to be a hundred million dollars. Why the hell am I going to give me a hundred million dollars? Well, here's the reason why you're going to give me a hundred million dollars. Well, who's involved with that hundred million dollars? So there's a lot of.

Chip Harris (NaN:00NaN) pull back and forth, you know, and so forth. And especially when I do audits and, you know, vulnerability and risk management reports and stuff is like, I can tell you and give you that information. Now, what you do with that, like I said, it's, you know, up to you. You've got to figure out what you want to do with it, you know? Um, and I don't try to scare people, you know, into buying, you know, uh, goods and services. I am vendor agnostic.

Chip Harris (NaN:00NaN) You know, you need to pick what's going to be best for you. Now I can point you in the general direction, but you know, I'm not going to, you know, say, well, you need to use these people because they're the best. And, you know, normally.

Chip Harris (NaN:00NaN) Oh my God. I wish there was.

Chip Harris (NaN:00NaN) It's like Medicare, Medicaid, you know, it's like doing your taxes every year. It's something that you're, yeah, it's just one of those things you're going to have to do and deal with and, oh my God. Yeah. Well, you kind of go to federal pound you in the ass prison for that, you know? So, I mean, you know, it, and you get in deep trouble, right? So, you know, and I'm a firm believer if you don't start something, won't be nothing, you know, and if you can.

Chip Harris (NaN:00NaN) Cause we in the United States, unfortunately, are a knee-jerk reaction society until something bad happens. We don't fix it. You know, it's very much, you know, the blind eye, I see no evil, hear no evil, speaking of. Yeah. If it ain't broke, don't fix it kind of deal. But sometimes you've got to be proactive, you know, on fixing some of these issues, especially when it comes down to nuclear power, you know, water, you know, electrical, you know, and uh,

Chip Harris (NaN:00NaN) And I don't blame vendors. They're, they're, they're doing what they're supposed to do. You know, they're trying to make sales and put in the stuff and, and do their work and whatnot. But it's like, you know, I'm fighting with a vendor right now at a certain facility, they only patch one time a year. You know, that's it. Like that's our patch management cycle. Like you pay for one patch a year. I'm like, what? I mean, would you, you know, and our CIO and CTO, God bless him. I love him to death.

Chip Harris (NaN:00NaN) they have gotten into some very venomous conversations with this vendor of like, we will not, you know, work with you and we will rip your shit out, literally of our facilities and never use you again, only unless you start patching our stuff to, you know, patch these CVEs and vulnerabilities that are out there. So for the general public doesn't know this, there are certain patches that vendors put out that are supposed to fix their stuff. Now they don't necessarily do that.

Chip Harris (NaN:00NaN) That's left up to the facility and to the company or the department to do those kinds of things. Normally you know, you can do it, but sometimes the vendor, if you're depending on your SLA, your service level agreement and the contracts that you have with them will patch your stuff. Now this one was for a really old system, you know, and it was like, okay, do we keep paying these people X amount of dollars a year?

Chip Harris (NaN:00NaN) Or do we just replace it, you know, to where it's newer and it's nice and shiny and it looks like the new car. Well, we figured out very quickly, you know, we could have paid for that new, shiny new car five years ago versus what we're having to pay now. So it was just, you know, it was like, let's do the math. Everybody break out your abacus and your calculator, you know, and

Chip Harris (NaN:00NaN) let's figure this out. And it was like, geez, we could have like paid for a new system five years ago, if we would have known how bad was, you know? So this is where, you know, like I tell people, this is where I kind of come into play is that, you know, the company that I work for and the great team of people that I have on staff, we are really good at being professional bad guys. We're really good at being, you know, state actors were really good at, you know,

Chip Harris (NaN:00NaN) knowing, you know, how these systems work and how to get into these systems and turn them off, manipulate them, do whatever we need to be able to do. And, um, you know, and I, and I don't blame anybody because sometimes, you know, you've got to be asleep at the wheel until you have a car crash until to figure out how bad is, um, and I don't want to see that, you know, affect human life. And I don't want to see it to infect the environment. And I definitely don't want to see it affect national security.

Chip Harris (NaN:00NaN) Uh, because normally when these things happen, they are not pretty at all.

Chip Harris (NaN:00NaN) Oh yeah.

Chip Harris (NaN:00NaN) Better yet since, yeah, I'm going to tell you, since we live in the biggest glass house, what happens if I turn off the internet for a week? The, I mean, I'm not talking about power. I'm just talking to you about the internet. So let me give you a really great example. It's affecting everybody still today. AT&T. I mean, all last week I spent, Oh my God, one meeting. Oh my God. As much really you've been set me on fire outside in the middle of the street. Then.

Chip Harris (NaN:00NaN) having to deal with all the stuff that I deal with, with trains, planes, automobiles, transportation, and so forth that are dependent on one service carrier, you know, and we don't have analog lines anymore. They're all digital, you know, and we lost, you know, connection to a lot of our clients lost connection and we're down the entire day, which impacted one facility at the wonderful tune of, you know, a hundred million dollars.

Chip Harris (NaN:00NaN) And is AT&T going to pay for that? Are they going to cut them a little $5 a check, you know, for their services? No, we just, yeah. Yeah. They lost a hundred million dollars, you know, and how are they going to recoup that? They're not. I mean, they literally lost it. Like we were shut that, that facility was shut down for an entire day. And I mean, they, they are a almost, you know, I mean, literally, you know, they, they average money by the, you know, the minute.

Chip Harris (NaN:00NaN) You know, and, um, and this also affected, you know, security at airports. This affected, you know, a lot of things that are in our transportation, a lot of things that are in our shipping lanes because, you know, that carrier decided that, well, you know, to hell with it. We're not going to test things in our DevOps facility. We're just going to throw it in production and, you know, we're just going to test in production. That's, that's the answer right there. Kids.

Chip Harris (NaN:00NaN) So, you know, they didn't do their due diligence and guess what? AT&T calls out, you know, I mean, people literally could not call 911. It is written by the FCC that no matter what happens to your phone in SOS mode, you're still be able to call 911 no matter what. I mean, that when John McAfee was alive, he said that was the number one attack vector to the United States on the phone system was congratulations, all cellular phone carriers by law.

Chip Harris (NaN:00NaN) have to have 911 services available no matter where the hell they are. Well, guess what? We couldn't even get to that. So now you got the FBI, the CIA, the NTSB, um, FCC for whatever they're good for, you know, investigating, you know, the cell phone carrier that literally, I mean, so I, you know, that is a real world current example, you know, now imagine if I shut down, you know, we saw this during, you know, September 11th, you know, the airlines industry shutting down.

Chip Harris (NaN:00NaN) That is, I mean, they did that for a day. Okay. And that cost us that hit our gross national product. I mean, you know, I mean, FedEx couldn't even fly. I mean, and that tells you something right there. So, you know, when you have a national wide groundstop, which we had never had in our history until then, you know, it really affected the bottom line. Same thing. You got a cell phone carrier. They guess what that affected people's lives in the bottom line. You know, now.

Chip Harris (NaN:00NaN) you know, turn off the entire internet for the West coast or the East coast. It would literally within 24 hours, formal recession. I mean, they literally would, you know, we couldn't, we didn't, because we live in the biggest glass house, you know, we've connected all this crap to the internet. And, you know, I talk about some of this wonderful stuff, you know, and if you want to read a book about it, which is even worse, and this is written, you know, in the past.

Chip Harris (NaN:00NaN) was, uh, there was a book called, uh, lights out by Ted Koppel and he interviewed like all these people from the power industry to TSA, I mean, you name it, he interviewed these folks. And that was a really eye opening book, like, you know, of the preparedness of the United States and the lack thereof, you know, um, if we had a cyber attack hit the United States on critical infrastructure, and I really

Chip Harris (NaN:00NaN) First off is Ted Koppel, you know, like Uncle Walter, most people don't even know who that is. You know, Tom Brokaw. You know, I mean, I give him thumbs up. First off, because he did a book, you know, what I call non-sexy news. I mean, critical infrastructure is not necessarily, you know, woohoo, you know, you know, news that people just, you know, totally go out for, but, you know, it is one of those things that until it impacts you, then it becomes news.

Chip Harris (NaN:00NaN) So, but it's a really good book. You know, it was written, you know, back in 2015, 2016, you know, and it really, you know, kind of gave, you know, and there's been 60 minutes, you know, stuff that you can see on YouTube about this, you know, that they've done. But, you know, it's, it's very interesting, you know, when you really pull back that curtain and really see how the sausage is made, you know, sometimes you don't want to eat the sausage or the hot dog, but you know.

Chip Harris (NaN:00NaN) In the wonderful world that I live in, you pay me now, you pay me later, still gotta pay me.

Chip Harris (NaN:00NaN) Mm-hmm.

Chip Harris (NaN:00NaN) And, and, you know, and there, there are tons, as I tell people of job opportunities, you know, that are, that are out there for this, you know, uh, from a vendor level, you know, like Siemens, you know, all these, these people will train you. I mean, they will, you know, that's how I got into it was that, you know, um, and on a personal level with me was, you know, that's what really kind of set me on this track was years and years and years ago was that, you know, I had

Chip Harris (NaN:00NaN) didn't have a lot of job opportunities, you know, in, in the, in my location and in the state that I live in. And, um, you know, and if I didn't have vocational education and, you know, my father, you know, pushing me into computer science, uh, because he knew as well as I knew in eighth grade, you know, that computer that's sitting behind you on your desk, I was like, that's the future. I mean, like, you know, most people don't remember the days of green screen and command line only, but.

Chip Harris (NaN:00NaN) I mean, that's, you know, and you're like, crap. I mean, I was trying to get this smiley face to wink at me, you know, and I went through all these lines of code and it didn't work, you know, and having to redo it and read it and, you know, but I mean, it's like, but I said in eighth grade to myself, it's like, this is the future. I mean, you know, I mean, I got two choices in my area and I grew up poor. I mean, I grew up, I did not come from privilege. You know, I didn't come from money, you know, I didn't.

Chip Harris (NaN:00NaN) I had two choices, the funeral business or farming, you know, my family was in the funeral business and I got sick of dealing with dead people and cutting grass at cemeteries, or I could go work on the family farm, you know, and I didn't want to do that. And I was like, I saw my parents struggle and my grandparents struggle. And I was going, you know, man, this little box, you know, man, it is the, this is going to change the whole thing. And then once I figured out this little box is, you know, integrated into infrastructure, you know,

Chip Harris (NaN:00NaN) And maybe in the, you know, going through college and going into, you know, uh, learning about cybersecurity. And then, you know, how I really got into all of this was in my twenties, you know, uh, September 11th happened and I was a federal, you know, uh, I got my federal contracting license and I had just gotten my security plus and like two other CompTIA certifications. And I was, you know, making, working at CompUSA. Most people don't even remember CompUSA.

Chip Harris (NaN:00NaN) But I was a bench. Yeah. I was working as a bench technician, fixing Apple computers and PCs. And I was making a whopping $12 an hour with taxes coming out of that. And I was making no money. It was, you know, eating top end ramen noodle, you know, and I had a blowup mattress and a television on the floor, you know, living in my, you know, one bedroom, you know, apartment in the hood, you know, and I was like going, I, you know, I

Chip Harris (NaN:00NaN) gotten my education, you know, I am, I'm ready to rock, you know, and find it, you know, a good, um, job. And I became a private military contractor, you know, and I spent 18 years, you know, working with special forces and working, you know, in seven different States, 22 different countries. I never thought that I would be able to see the pyramids of Giza in, you know, reality in my life. You know, I had, you know, it's like, wow. I mean, you know, like some of these places I've only read about in textbooks.

Chip Harris (NaN:00NaN) I got to go to, you know, and I got to travel around and, you know, really get my hands deep into this, you know, and, uh, you know, I contributed to the war effort, you know, uh, in Afghanistan and in Iraq, you know, and I went to all these different military bases doing really cool things, working in counters, you know, counterintelligence, counter surveillance, espionage, uh, you know, and learning about OT systems, you know, and helping them, you know, secure some of these facilities, you know.

Chip Harris (NaN:00NaN) uh, that are, that are state, federal, or, you know, nationally owned and whatnot. You know, like I got to go to the United Arab Emirates. I never thought I'd do that. Never thought I'd go to Egypt. Never thought I'd get to go to Israel, you know, or some of these places that, you know, that you, uh, here at Sea Reed about now, most of them are conflict zones, but you know, that's where the army kind of the military kind of go, but you know, they say you're going here. It's like, okay, I'm going that way.

Chip Harris (NaN:00NaN) You know, and then I came back and then, you know, worked a lot in the transportation and warehousing industry and learned even more, you know, about how these systems are more vulnerable and old and archaic and whatnot, like, wow, all this stuff plugs into an AS 400. It's like, wow, I haven't seen this in decades, you know, but it, hey, if it runs, it runs, you know, you know, and uh,

Chip Harris (NaN:00NaN) started interfacing a lot with, you know, uh, cybersecurity companies here in the private sector and, you know, and really enjoyed it. And I worked with some really great companies like, you know, uh, Veranos and Dell, you know, and ASA, you know, and worked with tons of different vendors throughout and Nvidia, you know, working on say, um, you know, private, you know, contracts and social security projects. And then, you know, the infrastructure companies started calling me like, oh, and hey, we really need an audit. We really need.

Chip Harris (NaN:00NaN) somebody to come in here and tell us these issues and problems that we've run into over the years and how we can fix them. You know, and, uh, I really enjoyed that. You know, and, uh, now, you know, I am working with a really great company that does, you know, exactly what I do in my wheelhouse. You know, uh, I'm helping with sock and knock services and, you know, doing investigations for a lot of the different stuff. Now, how did I get into that? It took, you know, education, it took time, effort and energy.

Chip Harris (NaN:00NaN) And it took, you know, a lot of networking and being at the right place and a lot of luck, you know, being in the right place at the right time, you know, for some of these things to kind of fall into place. And I've had my ups and downs in this industry, but, you know, I always encourage, you know, people that are in cybersecurity right now, anybody that can hear my voice, look into OT cybersecurity. It is a very growing field and it pays pretty well there kids, you know, I mean, you're going to have to hit the books, you know, and I can't do it for you.

Chip Harris (NaN:00NaN) You know, and, you know, there, and there are, you know, um, institutions now that are, you know, uh, even remote institutions that are teaching, you know, about OT cybersecurity, you know, and how it is that, you know, if you want to go work for the state, like I do, you know, they, they pay pretty well on an annual basis, you know, they don't, they're not going away anytime soon, you know, and there's also vendors that will train you in, you know, about their systems and whatnot, but you know,

Chip Harris (NaN:00NaN) A lot of this goes back into, you know, you got to get your hands in it. You know, it's, it's vocational based, you know, at one end of the spectrum and then the other end of the spectrum, it's very, you know, computer based. So, and it's a lot of fun. I mean, it's, and it's never, and I'm going to tell you that I will go on the record for this, it's never the same thing twice. It's always different.

Chip Harris (NaN:00NaN) Yeah, it's like tomato, still tomato, but it's just how you say tomato, you know? So, and people laugh about that, but it's true. I mean, it's so true, you know, but you know, um, and, uh, I, I tell people, you know, especially people that, that see these podcasts like yours, that's out there, you know, it's, you know, there is a lot of work to be done. And we need a lot of people to do it.

Chip Harris (NaN:00NaN) And if you look, if you look at the standard right now, considering how far behind we are, we need about 1.7, I think it was when I turned it into the department of energy and the department and actually the department of nuclear regulatory commission. We need about 1.7 million people in OT right now. You know, that's not just OT security. I mean, that's from line technicians down to, you know, people pounding the ground to

Chip Harris (NaN:00NaN) You know, working on oil rigs, you know, I mean, we need, I mean, that's a lot of folks, that's a lot of people. And, you know, you don't see a lot of people coming into this industry because one, they don't know about it too. They don't want to do the physical labor of the work to get into it. Three, they just think it's going to be handed to them and they take a certification exam and then boom, they automatically are going to get a six figure salary and it's like, no, it didn't work that way. I wish it did, but it doesn't.

Chip Harris (NaN:00NaN) Mm-hmm.

Chip Harris (NaN:00NaN) Yeah, I mean, I do that for students. Like, you know, uh, I don't charge speaking to students or universities or school systems. I don't, I mean, that's just me giving back to our industry because no one ever gave it back to me. So hell, I'm going to give it back to them. Um, but you know, like, uh, companies and corporations, I do have a, you know, I do have an agent and everything is booked through him, you know? Um, you know, most of my speaking engagements, if you don't, you know, uh, I mean, like you, I have, I have a family, I have limited amount of time, but.

Chip Harris (NaN:00NaN) I'm glad to talk to anybody about, you know, Hey, you know, if you want to have an assessment done and everybody, you go talk to these folks, you know, but if you just want to have, you know, podcasts with me and talk about some of the wonderful things that are actually are happening in our industry versus some of the bad things that have, we have seen in our industry that are, that are happening now, cause I am not all doom and gloom. Everybody goes, well, Jesus, you're a very scary person. No, I'm a very scared person. As I tell people, I'm very scared of some of the bad things that can happen that I know are presentable.

Chip Harris (NaN:00NaN) You know, and it's just, you know, if I can head it off at the past, that's what I try to do for people is to stop the hemorrhaging before, you know, you trying to put a bandaid on a bullet wound. That ain't going to work kids. You know, sorry. Uh, you know, I yell, scream, cuss, hoot, holler and throw things. And that's why I work remote because I am an HR nightmare. You know, you want to keep me at a distance, you know, as I tell people.

Chip Harris (NaN:00NaN) because you know, I'm very passionate about, you know, uh, this industry. I'm very passionate about some of the things that, you know, I engage in because I don't want to see the evil things that I can do happen to you. That's the reason. And I've always stuck with that is because, you know, knowledge is power, but you know, knowledge and sometimes power can be used and abused in very horrible ways, you know, and it's the, the mode and the instrument of how you want to be able to.

Chip Harris (NaN:00NaN) use that. So I tell people, you know, you want to contact me, that's perfectly fine. You know, I'm only on two social media platforms. You know, I'm not on ex Twitter, whatever the hell they're calling it now. I'm not on Instagram. I'm not on, you know, Pinterest or crap, you know, it's like I'm on Facebook and LinkedIn and that's about it because that's all the federal government will allow me to have, you know,

Chip Harris (NaN:00NaN) Everything in this room is monitored by big brother. As I tell people, you know, and I have multiple, you know, ways of not only protecting my digital profile, but I mean, I have, you know, I can't even go to a conference without my lawyer. I mean, I've had people, you know, serve subpoenas to me and I'm like, no, you talk to him, not me, you know, it's like, we want you to talk about and testify in this, you know, blah, blah case. And I'm like, no, I can't do that. You know,

Chip Harris (NaN:00NaN) If you want to book my time, you know, you talk to my lawyer over there who's at the, and he and I are very good friends and we've been, you know, been, you know, bosom buddies for, you know, for years now, but it's pretty sad that I go to a conference and I have to wear a mask or I go to a conference and I got people that are trying to sequester me for a jury. I laugh about it. My wife does not.

Chip Harris (NaN:00NaN) You're gonna get killed! I'm like, uh, not planning on it. Heheheheheheh.

Chip Harris (NaN:00NaN) Oh yeah.

Chip Harris (NaN:00NaN) Thank you all so very much. You all have a wonderful day today.

Aaron Crow (NaN:00NaN) Awesome. Hey man, thanks for joining me. Why don't you tell us who you are and why you're wearing a mask and all the things, man. Tell us who you are and in the audience, what, what you're doing here.

Aaron Crow (NaN:00NaN) Yeah, absolutely. Well, let's dive in, man. I appreciate you taking the time today and we don't know each other. We just started communicating through LinkedIn, but I've done a lot in critical infrastructure and my background is power generation and critical infrastructure as well and working in OT spaces and power plants and all that. So I know we talked off camera a little bit before this. So let's just dive in. Let's talk about the aging infrastructure. Let's talk about...

Aaron Crow (NaN:00NaN) you know, the power plants and the wastewater and the water treatment facilities and, and how, where we are with that and what you're seeing. And obviously the things that you can talk about publicly, um, uh, of the status and, and criticality of those, those environments.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm. Yeah.

Aaron Crow (NaN:00NaN) Yeah, I mean, I supported a nuclear power plant. You know, I worked, I was an asset owner and supported power generation here in Texas. And one of my plants was, was a nuclear facility. So I was badged there and you know, the whole background check and all that kind of stuff, you know, supporting that. And our, the architecture was different in a, in a nuclear power plant than it was my coal fire power plants and the others, but still that, that plant was built in the thing, it was designed in the fifties, built in the sixties, went online in the seventies and it's still the same technology.

Aaron Crow (NaN:00NaN) two units, you know, 1800 megawatts. And you know, it's still running, right? It's still the same thing. They actually had a license to build a third and fourth unit that they ended up getting rid of, or getting rid of the license. And you know, it's, yes, we've upgraded the controls somewhat. You know, the analog controls, they have tertiary systems and everything, safety systems and tertiary, everything. But you know, the analog controls that were put in the 70s are still there.

Aaron Crow (NaN:00NaN) Right? Yes, we have some digital stuff. Yes, we have some upgraded stuff, but still it's a plant that was built in the 70s. And to your point, it's not that it's bad. It's just it was never designed to run that long. They actually call it Comanche peak because it was going to be a peaker plant. It was supposed to be ramped up and down. That's how little they understood about nuclear generation at the time when it was designed. And of course, now it's a baseload. It just runs constantly all the time, unless it's an outage for refueling every 18 months. So, you know, talk a little bit about what

Aaron Crow (NaN:00NaN) You know, obviously that's and that's the norm. Like power, I think there's been what? Two nuclear power plants built in the United States in the last what? 15 years. And there's a couple that are currently being built. Yep.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) Oh yeah.

Aaron Crow (NaN:00NaN) Yep, I couldn't bill for it.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Ha ha ha.

Aaron Crow (NaN:00NaN) Ha ha

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Ha!

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Rich dummy version, right?

Aaron Crow (NaN:00NaN) Sure. Yeah.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) And if you can do it, then who else can do it, right?

Aaron Crow (NaN:00NaN) Sure. Yeah.

Aaron Crow (NaN:00NaN) Well, we saw that with Detroit and the water issues that we've seen there, right? It's it's antiquated systems. Yeah.

Aaron Crow (NaN:00NaN) And that's where your drinking water is coming from. It's why I drink from bottled water.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Oh yeah. Oh yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Well, and even on that too, right? Is, is maybe vendor is great. So GE and Siemens and, and Schneider Electric and Emerson, they're building their system, but at a power plant, there's multiple systems. Same thing in a water treatment site, right? I've got PLCs over here from vendor A, I've got vendor B. You used to have six different vendors and yes, they're good at their thing, but they don't know how to integrate with the other vendors. That's not their job.

Aaron Crow (NaN:00NaN) Yeah. Yep.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Well, I think you hit a really good point there, right? Is, is, if, as you know, uh, a lot of the layman's out there don't see, and they don't understand how bad it is. But if we really look at the 17 critical infrastructures and we're looking at power utility and wastewater and you know, TSA, all the trains and the rail and all the different things, if we just looked at how, I mean, I did a power plant assessment last week and XP was there. The newest operating system they had was windows seven.

Aaron Crow (NaN:00NaN) Right. And that wasn't even exactly. And that wasn't even patched to the same level. Now, granted, they have other mitigating controls and you know, they're not, they're supposed to be segmented. You, you know, as well as I do, that's not always the case. Um, but you know, if we just took a step back and we looked at the infrastructure in the United States, there's no way, even if we, even if we got an unlimited budget, if, if I was czar, they made me king for the day. And I, and I just gave a trisillion bazillion dollars to

Aaron Crow (NaN:00NaN) America to upgrade everything. There's no way we could do that in a timely manner, right? We're gonna have to find alternate ways. We can't rip out every xp box and every windows 7 box and replace everything in day one Like it's just a big it's a giant problem. We need to build this thing and start, you know Prioritizing the risk prioritizing the but having a strategy but right now we have no strategy We're just we're bailing wire and duct tape

Aaron Crow (NaN:00NaN) Exactly.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Sure. Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) That's right.

Aaron Crow (NaN:00NaN) Hehehe

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) That's right. No.

Aaron Crow (NaN:00NaN) That's right.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) Well, and I think, I think that's a problem anyways, right? Is I think you and I both know that there's no technology. There's no silver bullet that if you install this technology, you solve your problem. It's never, it's, and it's not a finish line that just like with the road, I pave a road today. I'm it's going to break. I'm going to have to fix it over time. I can't just play, pave it once and I'm done. Cyber security, all this infrastructure stuff we're talking about. It's the same thing. It should be a constant budget line item.

Aaron Crow (NaN:00NaN) that I'm doing maintenance, I'm replacing it. How, what is the lifespan of it? These control systems like absolutely. Yeah.

Aaron Crow (NaN:00NaN) unfortunately.

Aaron Crow (NaN:00NaN) or you're going to have a problem. If you don't do your taxes, you're going to have a problem.

Aaron Crow (NaN:00NaN) That's right.

Aaron Crow (NaN:00NaN) If it ain't broke, don't fix it.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yeah, yeah, yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Well, I mean, like you said, you know, you look at Katrina, those of us that were around for that, you know, you look at Katrina, we were a third world country in New Orleans when Katrina hit, right? It was martial law, people dying in the streets. Like it was insanity. That's what would happen if we lost power in this country and it would happen that quickly. And wastewater, all those things, right?

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Nope.

Aaron Crow (NaN:00NaN) I'll send you an Amazon gift card.

Aaron Crow (NaN:00NaN) Test and prod.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) Absolutely.

Aaron Crow (NaN:00NaN) Absolutely. Yeah. And you know, that that's the key here is we talked a lot today about all the different critical infrastructures, all the different places that we're at how we're behind, you know, but it's not going to get solved. We didn't get here in a day, we're not going to solve it in a day. But there's a lot of things that we need to do. And, and that's why I love having conversations like this. It's my intent and goal and hope that the audience takes away from this is reach out to your congressman or you know, reach out to your local authorities, your city, you know, ask your water environment what they're doing.

Aaron Crow (NaN:00NaN) this matters, right? And we need to start making changes in this now before, you know, left of bang instead of waiting until right of bang. You know, you hear that term in cyber and warfare and all that kind of stuff. Right now we're still left of bang in a lot of different spaces. There's been a lot of bangs that have happened and we just haven't necessarily spread that amongst down or it hasn't trickled down, trickled down economy, whatever the hell you wanna call it down to all the infrastructure. And we need to continue to push this battle, have these conversations.

Aaron Crow (NaN:00NaN) and make sure the right people hear this because we need to make changes or there can be some very big implications, uh, whether it be natural disaster, whether it be a state actor, um, or, you know, just a bored kid that, you know, the one in North Carolina, you know, idiots shooting out substations and transformers, any of these things, it doesn't matter what the attack vector is. The outcome is the same. We've got to start making changes.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) I do we sound to be similar age

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Yeah, sure.

Aaron Crow (NaN:00NaN) Absolutely.

Aaron Crow (NaN:00NaN) Yep.

Aaron Crow (NaN:00NaN) It never is. It is and it's not. I still, we, we have the same problems all the time, but it's always a different, a little bit different scenario. And it's always like, holy shit, I've seen this before, but man, that's a different twist.

Aaron Crow (NaN:00NaN) Exactly.

Aaron Crow (NaN:00NaN) Absolutely.

Aaron Crow (NaN:00NaN) Yeah, absolutely.

Aaron Crow (NaN:00NaN) No. Ha ha ha.

Aaron Crow (NaN:00NaN) So, so I'll share, um, in the show notes, you know, obviously anything to, for folks to get in touch with you and, and if they need to engage you, they knew they want to have an assessment done. Any of that kind of stuff will include all that, how to get a hold of you and all that kind of stuff, anything you want to, uh, make sure everybody's aware or, or kind of a call to action. Obviously we already have the get into this, dig in, you know, there's, there's organizations like ICS village. It's a nonprofit that I work with that does training. Um, they're all there at conferences, go to a conference, listen to a podcast.

Aaron Crow (NaN:00NaN) Reach out to people like me, like Chip, you know, we are here, I am 100% willing to have conversations with anybody that asks. I don't always have the unlimited time, but I'm 100% and most of the people that I've come across are more than willing to have conversations. Give you some guidance, give you some, hey, this is what I would do, this is what worked for me type of thing, so.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) Yep. Right. Yep.

Aaron Crow (NaN:00NaN) Right. Yeah.

Aaron Crow (NaN:00NaN) Hehehehehehe

Aaron Crow (NaN:00NaN) Absolutely.

Aaron Crow (NaN:00NaN) Ha ha.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) sure. Yep.

Aaron Crow (NaN:00NaN) Yeah.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) Take some of the fun out of it, doesn't it?

Aaron Crow (NaN:00NaN) Yeah, exactly.

Aaron Crow (NaN:00NaN) Yeah. Well, hey man, I appreciate your time today. It was an awesome conversation. Maybe we'll do it again and talk about the fun stuff or the happy things and what's the good side of it. Cause we, I know we focus a lot on the negative, but it's the truth. And I think it's a conversation that we need to have. So thank you for the time. I'm sure that we'll run cross paths again. It's soon. We seem to have a very similar background and a lot of the things.

Aaron Crow (NaN:00NaN) all the way back from, from the, the Mac over there in the quarter. So thanks for your time today, but I appreciate it.

Transcript lightly edited for readability.