Perlroth, Nicole
▶ Watch on YouTubeCore ideas
Perlroth explains the zero-day exploit market — bugs in software (she highlights iOS and, increasingly, Android) that vendors don't know about and that can be weaponized for remote, undetectable surveillance — tracing its history from 1990s hacker culture (curious tinkerers rebuffed or threatened by companies like Microsoft after reporting bugs for free) to a lucrative underground market where government agencies and brokers began quietly paying six-to-seven-figure sums for exploits, initially for traditional espionage and increasingly for sabotage as vulnerable commercial software got embedded into critical infrastructure (power grids, pipelines, nuclear plants). She describes researching the psychology of sellers for her book, finding many who refuse to sell exploits with catastrophic potential out of conscience, but also encountering a starkly different moral framework among hackers she interviewed in Argentina, where a source told her he'd sooner sell to Russia, China, or Iran than the U.S., which he did not regard as a "good" government — an anecdote she cites as a check on assuming Western moral consensus applies globally in this market. She credits the rise of bug bounty programs (Google, Facebook, eventually Apple) and specialized intermediary firms (HackerOne, Bugcrowd, Synack) as a meaningful, if incomplete, shift toward rewarding hackers for defense rather than leaving offense as the only lucrative path, while noting governments deliberately avoid outbidding these programs to prevent perverse incentives among their own contractors.
She discusses the difficulty of studying this world as a journalist given its extreme secrecy (comparing its omertà to "Fight Club"), citing the case of a South African broker whose business collapsed after he was photographed and interviewed on the record, illustrating the danger sources face if identified as holders of valuable exploits. Drawing on her own recent experience as a ransomware victim (a QNAP device hit by "DeadBolt" ransomware), she discusses the ethics and practicalities of ransom payment — citing the Colonial Pipeline case (where a classified assessment reportedly found the U.S. could have withstood only two to three more days of shutdown before serious economic damage, driven by diesel shortages rather than gasoline) and Baltimore's decision not to pay an initial ~$76,000 demand, which ultimately cost the city roughly $18 million to remediate — alongside more severe cases she covered, including chemotherapy treatment disruptions at a Vermont hospital and a Wall Street Journal report attributing an infant death to a ransomware-disabled fetal monitor. She distinguishes the 2017 NotPetya attack (Russia targeting Ukraine through a tax software supply chain, which spread to Maersk, Merck, and other global companies, disrupting Merck's vaccine production) as arguably not "collateral damage" but a calculated act meant to send a broader message, per one threat researcher's assessment she cites.
On geopolitical cyber conflict, Perlroth argues any future great-power conflict is now guaranteed to include a cyber dimension, citing a declassified DOJ report on Chinese infiltration of U.S. pipelines allegedly aimed at establishing footholds for potential use in a Taiwan crisis, and stresses that roughly 80% of U.S. critical infrastructure is privately owned with no legal requirement to disclose breaches or meet baseline security standards. She notes rising nation-state attribution games (Russia disguising attacks, or piggybacking on others' operations) complicate emerging norms like "proportional response," discusses a semi-deterrent dynamic she calls "mutually assured digital destruction" (illustrated by the U.S. allowing reporting on its own penetration of the Russian power grid, apparently as a deterrence signal), and is skeptical that a "Digital Geneva Convention" (proposed by Microsoft's Brad Smith) is achievable given how states like Russia and China outsource operations to loosely affiliated criminal or contractor networks, complicating accountability — quoting Putin's comparison of hackers to independent-minded "artists." Asked what single fix would most improve global cybersecurity, she names widespread adoption of multi-factor authentication, citing Colonial Pipeline (compromised via an old account without MFA) and a Florida water treatment facility (running unpatched Windows XP without MFA) as cases where basic hygiene, not sophisticated defense, would have prevented the breach.
Perlroth discusses identity and trust online, including nation-state "insider threat" operations (citing an alleged Saudi infiltration of Twitter to identify anonymous critics) and the difficulty of building secure, low-friction authentication (citing Apple's biometric authentication as a meaningful, if imperfect, advance and voicing hope for passive/behavioral authentication methods to eventually replace passwords). Reflecting on Edward Snowden, she describes deeply mixed feelings: valuing the resulting public debate about surveillance limits, but also feeling — after gaining her own exposure to classified material during her reporting — that the NSA was largely operating within traditional espionage norms rather than the catastrophic abuses some assumed, and criticizing the volume and lack of curated context in the leaks compared to what she considers more clearly justified whistleblowing (citing the Trump-Zelensky call whistleblower as a contrasting, in her view, more responsible case). She extends a similarly non-absolute view to intelligence agencies generally, distinguishing Western agencies' conduct (citing internal abuses like the NSA's "LOVEINT" program as real but bounded exceptions) from what she describes as China's mass surveillance of Uyghurs (which she frames as a "test kitchen" likely to be exported globally) and alleged UAE targeting, blackmail, and imprisonment of dissidents like Ahmed Mansoor — while stating her view that the U.S. crossed a different kind of line in not holding Saudi Arabia accountable for the killing of Jamal Khashoggi, an event she says shattered her prior sense that journalists operated under some protective "invisible shield." She closes discussing her own security practices and risk model (protecting sources as her "crown jewels," a personal shift toward heightened caution after becoming a parent), advocates for more young technologists to pursue cybersecurity defense work (citing roughly 3.5 million unfilled global cybersecurity positions and the comparative allure of "offense" work), and expresses hope rooted in a belief that most people are fundamentally good and in generational change from a cohort, like herself, that grew up both before and fully immersed in the internet era.
Excerpts
On the moral assumptions she brought into reporting on the zero-day market, and how a hacker in Argentina upended them:
“I said, so you know, will these guys only sell these zero-day exploits to good Western governments? And he said, 'Nicole, last time I checked, the United States wasn't a good Western government... if we're going to go by your whole moral calculus, just know that we have a very different calculus down here.'”
On the single change she would make to improve cybersecurity, and why basic hygiene rather than advanced defense is the real bottleneck:
“Two-factor authentication, multi-factor authentication... Colonial Pipeline — they took down the biggest conduit for gas, jet fuel, and diesel to the East Coast — how? Because they forgot to deactivate an old employee account whose password had been traded on the dark web, and they'd never turned on two-factor authentication.”
On why the Khashoggi killing changed her sense of safety as a journalist covering this world:
“I kind of carried that invisible shield with me for years, and then Jamal Khashoggi happened, and that destroyed my vision of my invisible shield... for them to do what they did to him, pretty much in the open, and get away with it... that really threw my worldview upside down.”