Topic
23 facts from 3 episodes, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
1910s-1920s
David Bray cites anarchists' use of TNT in the 1910s and 1920s as a past threat that society handled with defense in depth, not by locking down.
“In the nineteen tens, nineteen twenties, there was this thing called TNT. TNT was being used by anarchists to do bad things, but we didn't go into lockdown mode.”
1940s-1960s
David Bray says laws rarely expire, leaving healthcare rules from the 1940s to 1960s that may no longer fit.
“there's things still on the books from the nineteen forties, nineteen fifties and nineteen sixties that may have made sense then”
1970s-1980s
David Bray says a smartphone gives its owner capabilities comparable to the CIA of the late 1970s and early 1980s, and about 2 billion people have one.
“You have the CIA in your pocket, circa the late nineteen seventies, early nineteen eighties, and 2 billion people on the planet have it.”
2000-2005
David Bray worked on a bioterrorism preparedness program that tried to connect to hospital and state systems from the early 2000s to 2005.
“In a past life, uh, I was with the bioterrorism preparedness program. This was back in the early 2000s to 2005”
Undated
David Bray says the UK uses data trusts, and the US can use data cooperatives, to let communities control how sensitive data is used.
“In the UK, they call them data trust, here in the United States we call them data cooperatives.”
Undated
David Bray says a Birth to Three effort used existing contract law to create a data cooperative that includes community members and bars monetizing the data.
“we used existing contract law to create a data cooperative that includes members of that community”
Undated
David Bray says ultrasound for pregnant women met early resistance before becoming standard, as a model for patient adoption of healthcare technology.
“Initially, when ultrasounds and sonograms for pregnant women were introduced, uh, there was resistance.”
Undated
David Bray holds a role with the Stimson Center, specifically its Stimson Accelerator.
“One of the roles is with the Stimson Center, specifically the Stimson Accelerator.”
Undated
Bray describes a paper from a major AI company in which a model told to write insecure code secretly began producing hateful output, which he links to its internet training data.
“where they told the machine, write code that's insecure, but don't reveal it to the user.”
Undated
Bray says he took part as an expert witness in a public congressional hearing on AI held on September 28.
“There actually was a public hearing on AI. It was September twenty eighth, and you can find it if you do Congress dot gov.”
Undated
Bray says that during his earlier work on bioterrorism and public health response, red teams were called the B team.
“when I used to do response to bioterrorism and public health, we called them the B team.”
Undated
David Bray says that about fifteen years before the episode he advocated a public-health-style approach to cybersecurity, in which organizations share what they are seeing without sharing specifics.
“I can remember about fifteen years ago, I was pushing for, um, almost a public health approach to cybersecurity”
Undated
David Bray describes federated learning as a method in which the algorithm travels to each organization's data and learns there, so the data is not shipped elsewhere.
“instead of having the data be shipped somewhere, the algorithm comes and learns there”
Undated
David Bray says enterprises are not yet mature enough with digital twins to run fast simulations of the second- and third-order consequences of a security tool's actions.
“despite all this talk about digital twins or or whatever, we're really not that mature in terms of enterprises.”
Undated
David Bray suggests a sophisticated attacker could trick a company's security tools into taking its own systems offline, which would also demoralize the security team.
“if I was a really sophisticated hacker, I would make it so that you did it to yourself.”
Undated
David Bray says there are indications that bad actors found code libraries that AI tools reliably hallucinate and then wrote real open-source libraries under those names.
“some bad actors have identified when AI is being used for coding, for vibe coding, reliably hallucinates, and they have identified those reliable hallucinations and gone out and written a code library for the very hallucination”
Undated
David Bray says chief information officers and chief information security officers originally reported to chief financial officers and later to chief operating officers, which framed cybersecurity as prevention.
“both CIOs and CISOs initially reported to chief financial officers, then later chief operating officers.”
Undated
David Bray says an unnamed big tech company first tried replacing cybersecurity staff with AI, then found that humans looking for new exploits while AI handled known vulnerabilities outperformed.
“Unfortunately, they initially went down the path of replacing their cybersecurity people with AI, which I do not recommend, do not do, but they tried that.”
Undated
David Bray says safety filters applied after an AI computes are unlikely to be fully safe, and he prefers rules applied before computation.
“If something has a filter or a safety applied after compute, so post compute, I get very nervous about post compute agentic AI ever being 100% safe.”
Undated
David Bray says some US Navy vessels have a defense system that becomes fully autonomous when the captain flips a switch.
“we do have US. naval vessels where if the captain of the ship flips the switch, there is no human in the loop.”
Undated
David Bray says Waymo vehicles stopped when a power outage occurred, which he cites to show that interconnected AI systems can fail without any cyberattack.
“We saw when the power went out, they stopped, and that was not a cyber attack, it was just the power went out.”
Undated
David Bray says foreign jammers can block communications and geolocation signals within a three-kilometer radius.
“I've also seen where there are foreign jammers that can basically squelch any comms, any geolocation within a three kilometer radius.”
Undated
David Bray defines trust as the willingness to be vulnerable to the actions of an actor you cannot directly control, whether a human, organization or AI.
“I define trust as the willingness to be vulnerable to the actions of an actor you cannot directly control.”
Episodes