A no-click iPhone exploit sold for $2.5 million. Silence was the only condition.

Nicole Perlroth is a cybersecurity journalist who spent nearly a decade at the *New York Times* and later wrote *This Is How They Tell Me the World Ends*, her account of the cyber-weapons arms race. Lex Fridman asks her to start with the basics. A zero-day, she says, is a bug in software — say, iPhone iOS — that nobody else knows about, especially not the vendor. The name is literal: the minute it is discovered, engineers have had zero days to fix it.

Finding the hole is only the first step. Study it long enough and you can write a program that uses it. That program is a zero-day exploit. On iOS, the dream is a remote, no-click implant: you never touch the phone, you never trick the owner into tapping a link, and you still capture location, contacts, calls, and the camera. "Basically, you can put an invisible ankle bracelet on someone without them knowing," she says. Spy agencies and governments that want to watch critics will pay for that.

For a long stretch, a remote zero-click iOS exploit was the crown of the underground market. Perlroth says you could sell one to a broker for about two million dollars; she also describes a $2.5 million investment that vanishes the moment Apple hears and ships a patch, which is why the buyer’s condition is that you never tell anyone. About two years before this recording, an Android remote zero-click topped iOS for the first time. Some people read that as Apple’s security slipping. She offers another explanation: market share. There are simply more Android phones in the world, and the governments paying top dollar now are deep-pocketed Gulf states that want to watch their own citizens, not dinner-party elites.

The targeting, in her reporting, runs both ways. Some of the highest prices she has heard in the United States were for a single phone, on a 24-hour clock, because a terrorist attack looked imminent. Then there are watering-hole attacks. A few years earlier, a site with information aimed at Uyghurs dropped an iOS zero-day on anyone who visited — the diaspora abroad, and anyone else interested in that population, including, in principle, an American high-school student writing a paper. Huge swaths of one community, in real time, with no click required.

The question Perlroth set out to answer in the book is not only technical. Who would sell a bug that could ruin a dissident’s life, or neutralize a Schneider Electric safety lock at a petrochemical plant? In the 1980s and 1990s, she found, many hackers were tinkerers — the kid down the block who could not leave the hood of his father’s car alone. They took holes in Microsoft, Sun Microsystems, or Oracle software to the companies and said, in effect, I can use this to break into NASA. The usual reply was not thank you. It was stay out of our software, or we will send the general counsel.

People who had tried to do the right thing were told to shut up. They started trading the information quietly among themselves. That is the soil of the 1990s disclosure wars: dump the bug online, and any script kiddie can cause mischief; keep it quiet, and you are flipping off the companies that keep threatening you. Government agencies and their contractors tapped the resentment. They reached out on forums and offered six figures for a custom version of the bug you had just tried to get Microsoft to fix for free — so long as you never said who paid. Boutique contractors did this through the 1990s. Early on, much of it was quiet counterintelligence. Once Windows and industrial software from Schneider Electric and Siemens were baked into nuclear plants, factories, the grid, petrochemical sites, and pipelines, the same bugs became useful for sabotage and war planning.

Today some researchers still refuse to sell to a broker or a government, because they will not know which classified program, or which criminal group, inherits the exploit. Others say the sleeplessness is the vendor’s problem: if companies would stop shipping new bugs, there would be no market. A constructive shift of the last decade, she says, is bug bounty programs. Google, Facebook, Microsoft, and eventually Apple, which resisted for a long time, began paying for what is essentially free quality assurance — sometimes six figures. They will never outbid a broker who sells to governments, but they can get the bug early enough to neutralize it before a year of exploit development. Intermediaries rose to translate between the two cultures: HackerOne, Bugcrowd, and Synack, which runs paid private bounties. The Department of Defense hired all three. Perlroth still hears, every week, from someone who tried to tell Microsoft about a bug two years before a nation-state used it in the wild, and was offered peanuts.

Should vendors simply match the $2.5 million? She thinks they should not. If Apple posted that number, its own engineers would ask why they were working a nine-to-five for less. You would advertise offense and create a perverse incentive inside the company. What firms have, and agencies do not, is the ability to let you talk. Street cred, a conference talk, a line on a résumé: you found the iOS zero-day nobody else found. Sell it to a broker and you never mention it. That silence, she says, really does eat at people.

Around 2015 or 2016, Perlroth went to Argentina looking for the person who would sell a plant-killing bug. What she found was a hacker paradise. You still could not get an iPhone. There was no Amazon Prime. The apps everyone else took for granted had to be cracked. Locals described a MacGyver culture: wire and tape, figure it out. That produced a lot of people who specialize in zero-day exploits. At Ekoparty in Buenos Aires she asked an organizer to introduce her to someone selling to governments. Throw a stone, he said, you will hit one. The room was full of men who spoke only Arabic, clearly from Gulf states, at a young hacking conference in Argentina.

She took the godfather of that scene to lunch and asked a question she is still embarrassed by: will these people sell only to good Western governments? He told her that last time he checked, the United States was not a good Western government. The last country that bombed another into oblivion was not China or Iran. It was the United States. Down here, he said, we have a different calculus; we might rather sell to Iran, Russia, or China — or to whoever brings the biggest bag of cash, given the inflation. The underground market’s first rule, she realized, is Fight Club: nobody talks about Fight Club. Hackers stay quiet so they do not lose a $2.5 million bounty. Governments roll the bugs into classified programs. Operate in the dark long enough, and morals get easier to set aside.

That is also why almost nobody in this world will sit for a camera. Fridman asks how you interview current operators on microphone and video. She is a print journalist for a reason. When people do appear on camera, they are usually a silhouette with a distorted voice. The cautionary tale is the Grugq, a South African zero-day broker living in Thailand. As she was starting on the subject at the *Times*, he talked to *Forbes* about the business and posed with a giant duffel of cash. He later said he had been speaking off the record and had not understood the rules. People who did business with him told her he was PNG’d — persona non grata — the minute the story landed. Volume dropped by at least half. Nobody wants to deal with someone who will get on camera and discuss selling zero-days to governments. She also heard that some security people paid him a visit. If the world knows you hold those exploits, you become a target for nation-states. Your operational security had better be perfect.

The silence is a trap. Transparency would educate the public and might pull more engineers toward defense, but the incentives block that path. What she can do is report, write, and hide her sources. HackerOne’s pitch, which she likes, is to leave aside the full-time exploit developers and tap the millions of programmers who have never heard of a zero-day. Pay them to find bugs in United Airlines software, Schneider Electric gear, Ford, or Tesla, and neutralize the holes before the people who will sell them to governments get there first. An untapped army, in other words, on the defensive side of the ledger.

After they booked the interview, Fridman was hit for the first time. He kept a QNAP NAS — about 60 terabytes, 50 terabytes of data, RAID 5 — as cold-ish storage. A ransomware strain called Deadbolt hit roughly four to five thousand of those devices, encrypting file by file. The ransom page was oddly polite. This is not a personal attack, it said; you were targeted because of inadequate security from your vendor. Pay 0.03 bitcoin, then about a thousand dollars, for a decryption key. A second note to QNAP offered two prices: five bitcoin to be told the vulnerability, or 50 bitcoin — about $1.8 million — for a master key for every customer. He had not backed up most of it. He thought RAID 5 was protection. He lost personal 4K video and raw interview footage. QNAP told customers not to pay.

What is new, Perlroth says, is ransomware that exploits a zero-day. In her telling that had only become real in the previous 18 months. Before that, the data said about 80 percent of these intrusions came down to missing two-factor authentication and weak employee passwords — things you can actually fix next time. This time QNAP may not even know where the hole is. Pay, and if the bug is still secret, what stops them from hitting you again? It is also a supply-chain hit: you are being punished for your vendor. A related turn is going after individuals to apply pressure. She describes a mental-health clinic in Norway where criminals went to the patients and said pay, or we release your psychiatric records.

Whether to pay is not a slogan. An Apple supplier in Taiwan was hit with a $50 million demand. When the city of Baltimore was attacked, she recalls an initial ransom around $76,000. The city stood its ground. Rebuilding from scratch cost $18 million — money that could have gone to schools, roads, and public health — and residents asked why they had not just paid the $76,000. Colonial Pipeline is the under-reported case. After the company shut the line because billing was frozen, she and colleague David Sanger obtained a classified assessment: the country could have afforded only two or three more days. The surprise was not gasoline or jet fuel. It was diesel. Without diesel, refineries stop, and the economy goes with them. There was almost a national-security case for paying.

The attacks that stay with her are personal. A hospital in Vermont could not give cancer patients chemo because the protocol of who gets what lived in systems the nurses could not reach. One nurse said the only thing that compared was working a burn unit after the Boston Marathon bombing. The *Wall Street Journal* later attributed an infant death to a ransomware attack after fetal-monitoring gear failed. On a larger, less intimate scale, NotPetya — Russia’s attack on Ukraine through a tax-software supplier — hit any company worldwide with even one employee working remotely in Ukraine: Maersk, Pfizer, FedEx, and, unforgettably, Merck. Merck’s factories froze. The firm had to tap the CDC’s emergency Gardasil stock because vaccine production had stopped. Imagine that, she says, at Pfizer, Moderna, or Johnson & Johnson during a pandemic: a global cyber-terror event. She had long called the extra victims collateral damage. The day of the taping, a researcher at Cisco’s Talos team said to stop. They could see who would be hit before they deployed the malware. It was a message to anyone doing business with Ukraine.

Fridman asks whether China and the United States will fight a war that lives only in cyberspace. Perlroth’s answer is broader: any geopolitical conflict from now on is guaranteed to have a cyber element. The Justice Department had recently declassified a report that China had been hacking U.S. pipelines not for intellectual property but for a foothold — so that if things escalate over Taiwan, they are already where they need to be to shut the lines down. Colonial Pipeline was a glimpse: panic buying, jet-fuel shortages, and that diesel assessment. Whenever she reads about Chinese fighter jets near Taiwan, Russia’s buildup on Ukraine’s border, or India and Pakistan, she looks through a cyber lens, and it bothers her that others do not.

She is an advisor to the Cybersecurity and Infrastructure Security Agency at DHS, and she is not sharing classified material. What the public needs to understand, she says, is the collateral damage to American businesses and critical infrastructure when those conflicts escalate. Adversaries have learned they may never match U.S. spending on traditional weapons and fighter jets. They have also learned that the United States has a very soft underbelly. Eighty percent or more of American critical infrastructure — pipelines, the power grid, nuclear plants, water systems — is owned and operated by the private sector. For the most part, nothing requires those companies to report that they have been breached. They do not even have to tell the government. Nothing mandates a bare-minimum standard of cybersecurity. If you were going to design a system to be as blind and as vulnerable as possible, she says, that is pretty much what you would build.

The cultural slogan she blames is "software eats the world." Hook everything up, for convenience and for cost, because we can. Nobody pauses to ask whether these systems should be on the internet. In the year before the interview, she says, there was a record number of zero-day attacks — about 80, probably more than double 2019 — many of them from nation-states. The geopolitical hot spots are the same places that have been investing heavily in offensive tools. A zero-day nobody else knows about is a card you can play when a war starts. Zero-days are the sexy layer. The boring layer is that defenders still skip two-factor authentication and leave Shellshock unpatched years later. And because everyone is running the same Windows and the same industrial software, a bug you keep in order to spy on Russia is a bug you are also leaving in American plants.

Every country except Antarctica — someone added the Vatican to her list — is looking for offensive hacking tools and zero-days. States that lack the skill can buy them. Two and a half million dollars is chump change next to a fighter jet. Russia turned the lights off twice in Ukraine in part, she thinks, to sow doubt: your government cannot even keep the power on. Fridman wonders whether the pile of mutual vulnerabilities might freeze conflict the way nuclear arsenals did. Perlroth is not counting on it. Nuclear analogies fall apart here. You do not need fissile material. You need a laptop and the skills, and you are in the game. The barrier to entry is that low.

Attribution is harder, and states work to keep it that way. They piggyback on other countries’ spy operations. Russia hacked into Iran’s command-and-control servers. It hit a Saudi petrochemical plant and neutralized the safety locks; everyone assumed Iran, which had been targeting Saudi oil companies for years. It was a graduate research institute outside Moscow. The motive for muddying the trail is simple: I cannot afford the response if this is obviously mine. At the *Times* she had covered Chinese hacks of pipeline companies, Russian probes of nuclear plants, and the Ukraine grid attacks. In 2018 she and Sanger reported that U.S. Cyber Command had been hacking the Russian grid and making a loud show of it. When they went to the National Security Council for comment, she expected the "blood on your hands" speech. They had no problem with publication. The point, unspoken, was that Moscow should know the United States was in its grid too.

So the world has stumbled into mutually assured digital destruction, plus a quasi-norm of proportional response: if you are hit, you may answer at a time and place of your choosing. That was Obama’s language after North Korea hit Sony. Nobody quite knows what the answer looks like, so many operations stay just short of war. Russia turned the power off in Ukraine for hours, not a week. NotPetya wrecked companies; nobody died. The question she asks is what happens when someone does die, and whether a nation-state can masquerade as a ransomware crew. That possibility, more than anything, complicates a digital Geneva Convention — the idea Brad Smith at Microsoft has pushed, which sounds like a no-brainer: leave civilian hospitals, elections, grids, and pipelines alone.

Western officials, she says, would love to sign it with one another. They will not sign it with Xi, Putin, or Kim Jong-un, because those governments often outsource the work. In China, many attacks come from a loose network of private citizens operating at the behest of the Ministry of State Security. How do you write a state-to-state deal when you cannot tell whether a person acted alone or for the MSS or the FSB? She remembers Putin saying hackers are like artists who wake up in a good mood and start painting — in other words, I have no say. He had just, in her framing, wrecked Merck, Pfizer, and thousands of other companies. That gap between nuclear weapons and cyber attacks is fundamental, and attribution is a large part of it.

Fridman offers a constraint: she cannot fix authoritarian regimes or human nature, only something on the security side. Her answer is two-factor, multi-factor authentication. Colonial Pipeline took down the biggest conduit for gas, jet fuel, and diesel to the U.S. East Coast because an old employee account was still live, its password had been traded on the dark web, and nobody had turned on a second factor. A Florida water-treatment plant was hit while still running unpatchable Windows XP, also without two-factor. Time and again, she says, switching it on would have blocked the intrusion. If she gets only one snap of the fingers, that is it — knowing the attackers will then move to the next thing.

Perfect security does not exist. The name of the game is to make yourself a little harder than your competitor, so the crew gives up and moves along. If you are a target of an advanced nation-state or Russia’s SVR, you will get hacked anyway. You can still make life miserable for a group like Deadbolt by doing the basics. Factor one is the password. Factor two is another device or channel that says yes, it is me — usually a text, better a $20 FIDO hardware key from Amazon, without which you do not get in. Her first years at the *Times* were the cop beat of breaches: Home Depot, Target, Neiman Marcus. What the thieves took were credentials. People reuse passwords, so one dump becomes a test against email, a brokerage account, cold storage. Multi-factor breaks that chain. She gets alerts that someone is trying her Instagram, Twitter, or email and does not panic. They can try all day.

The catch is that security’s biggest problem is that it is annoying. It adds friction to a frictionless society. Fridman remembers MIT’s two-factor pinging him across subdomains until he wanted it gone; a bad interface is itself a vulnerability, because people turn the protection off. She wants the Steve Jobs of security. Apple, she argues, has already done more than anyone by shipping fingerprint then Face ID. Eight years earlier, phones had no passcode, an optional one, or four digits — and a stolen iPhone is a life. The next leap, in her view, is that the password should die. Fridman, from his Google years, describes active or passive authentication: gait, the way you draw a phone from a pocket, voice, liveness-checked video. Beating a good password on raw security is still hard.

She flags Abnormal Security, founded by people who had done ad tech at Twitter. The joke about ad tech is that it knows too much — glance at a pair of shoes and they follow you. Those founders applied the same pattern-recognition to email: most people’s mail is predictable, and a stray from the pattern gets blocked and investigated. Targeted-ad machinery, pointed at defense. The deeper point is design. Early in her *Times* years she tried PGP to protect sources and made so many mistakes it was not worth it. Then Signal made encrypted messaging wickeder, easier. The hack that gets us out of the current mess, she thinks, is creative minds in security design, because a perfect control that nobody will use is not a control.

Social engineering, she says, is every chief information security officer’s worst nightmare, and remote work has made it worse. A post going around that day described a company that hired a man named John; the person who then showed up every day did not act like the John from the interviews. Put on a pretty face, hire an actor, get inside, and you have the data. A few years earlier, Saudi Arabia planted spies inside Twitter, likely to learn who was criticizing the regime — a problem they could not solve with an outside hack. The side effect is xenophobia. Organizations start looking hard at applicants from China. The Commerce Department, she notes, has accused people of being spies who were not. A friend who had been a top NSA hacker told her that every time he went to Russia he got hit on by tens; his friends’ reply was, sorry, you are not a ten.

Fridman is talking with Mark Zuckerberg about a metaverse in which falling in love, getting a job, and sharing a happy moment with a new friend all happen online, through avatars that can be hijacked by AI or troll farms. Perlroth’s mind goes to her three-year-old son, who had just asked what the internet was. She almost cried. She does not want his most meaningful experiences to live on a screen, and she does not know how you tell that an avatar is human. She believes in free speech. She does not believe in free speech for robots. The previous six years had produced bots posing as Black Lives Matter activists, Texas secessionists, organizers of anti-Hillary protests — anything to sew division, tie a country up in its own politics, and leave it too paralyzed to handle adversaries who think in decades. Just because we can build the metaverse, she says, does not mean she wants her child’s significant moments there. She is tired of being the guinea-pig parent generation.

We have never stopped a new technology only because it introduced risk. We say the promise is worth it and then try to manage the harm. Cryptocurrency is the current case. Covering ransomware, she thought governments would finally put the hammer down: five years earlier a thief told you to buy a pharmacy gift card for $200; now they want five bitcoin. After the FBI clawed back part of the Colonial Pipeline ransom from DarkSide, she spoke with TRM Labs, a blockchain-intelligence firm staffed in part by people from Treasury. Crypto enabled the crime, they said, but fiat would have taken years to trace to a front company in the Seychelles. On a chain you can watch the money in real time. The payments are not as anonymous as people think. Old-school intelligence, and zero-days, still find out who owns a wallet. We have never shut a promising technology down for its risks. We have figured out how to manage them.

That, she argues, is where the metaverse conversation has to go: prove a person is a person without handing one company the whole file. She hopes a firm she calls PII Ono — the name sounds like Piano — succeeds in putting a vault for personal information inside every organization. Delta does not need her Social Security number or birth date to book a flight. It needs a one-time token from her phone or FIDO key that says yes, it is her. The airline talks to a random token, not to Nicole Perlroth, *Times* journalist. Fridman is tired of fake phone numbers and emails at every signup because one hacked retailer propagates. She calls it low-hanging fruit, and she thinks Congress has been negligent. Her father was in the hospital; the phone would not stop with fake car-warranty spam aimed at a Social Security number. She wants those callers in jail for life, and she wants an answer to why every retailer gets to demand a Social Security number, a home address, and a passport — data they are plainly not protecting.

Fridman asks, in the long arc of history, whether Edward Snowden is a hero or a villain. Perlroth says neither. She has complicated feelings. She is a journalist; more transparency is good. She is grateful for the post-Snowden arguments about the limits of surveillance and the value of privacy. When you cannot see what secret courts are doing, how can you believe the country takes civil liberties seriously? That is one hand.

The other hand is what she brought into the storage closet of classified NSA material. She had just spent two years covering Chinese cyber espionage almost daily, and watching Russian attacks get more destructive. China appeared to have no limit on spying on its own citizens. Russia appeared to have no limit on cyber attacks, and in some cases on assassinating journalists. Walking into that room, a part of her was relieved. The NSA was as good as she had hoped. As far as she knew, the United States was not using that access to kill journalists or take out pharmaceutical companies. Most of it looked like traditional espionage. The American public’s reaction, she thought, was a little misplaced: anger at phone-metadata collection, Merkel’s understandable fury about her cell phone. In a spy-eat-spy world, hacking a leader’s phone is what spy agencies do. If there were another 9/11 tomorrow, the question would be why the NSA had not been watching.

The damage to America’s reputation as a protector of civil liberties was real. Her biggest gripe was the reporting itself. Story after story said the NSA has this program, the NSA is in Merkel’s phone, the NSA can do this — and nobody added that China had been in U.S. pipelines and walking out with intellectual property, that Russia had been in energy infrastructure and had used the same methods to spy on, track, and in many cases kill its own journalists, that the Saudis had been doing it to critics. You cannot talk about these countries in isolation. She also wishes the thousands of documents, many of them worthless PowerPoints with people’s names on them, had been released in a more targeted, limited way. A lot of the impact was volume, and a lot of the files felt taken out of context.

Fridman asks what a better whistleblower looks like. He is torn about the Facebook/Instagram research leak: an open culture in which any employee can pull a study from context, the press eats it, and the story becomes "Facebook is evil." Companies then get more secretive. A race to the bottom. Perlroth does not pretend she has a clean answer. Her own book, she says, is a kind of whistle on the underground zero-day market, scraped from the surface, without classified access. The example she applauds is the person who reported Trump’s call with Zelensky — an ally being leaned on over an election. They went through proper channels. There was no book. They are not living in Moscow.

Are intelligence agencies competent? Malevolent? Perlroth says it depends which one. Think about Mossad killing Iranian nuclear scientists over the years. Have they delayed the bomb? Yes. Have they probably staved off terror attacks on their own citizens? Also yes. Intelligence is intelligence; the labels hero and villain do not travel. The people she has met are not the chest-thumping patriots on a Fourth of July beach. Many have complicated feelings about former employers. At the NSA, doing what the public thought they were doing after Snowden — spying on Americans — would have taken a mountain of red tape. Then the same files produced LOVEINT: a few analysts using access to spy on ex-girlfriends. There is an exception to every rule.

She expects the charge of Western bias. She still thinks you can barely compare some Western services to what China is doing to the Uyghurs, at that scale, and to the way it is starting to export the same surveillance. The watering-hole attack did not only hit Uyghurs inside China. It hit anyone interested in their plight outside China, including that hypothetical American student. There are, in her view, no real rules in China limiting how far that goes. Pay attention, she says, because just as Ukraine has been Russia’s test kitchen for cyber attacks, the Uyghurs are China’s petri dish for surveillance. She has no doubt the methods will be exported.

In 2015 Obama and Xi Jinping agreed not to hack each other for commercial benefit. For about 18 months, Chinese cyber attacks on American companies dropped off. Some continued: aviation firms, hospitality groups like Marriott. In Beijing’s framing that was not IP theft. It was counterintelligence — who is staying in this city when Chinese citizens are there, so you can cross-match likely spies. She assumes the United States does some of that too. Counterintelligence is considered fair game. Where it gets evil, for her, is censorship and the suppression of dissent. She talked to Ahmed Mansoor, a UAE critic who had gone on Twitter to advocate for better voting rights. Passports confiscated. Beaten up. Labeled a terrorist though he did not know how to operate a gun. By the time they spoke, his phone was already hacked; they were listening. They had hacked his baby monitor and were watching his child. They stole his car. Then came a law against criticizing the ruling family on Twitter. He has been in solitary confinement, on hunger strike, ever since.

"That's evil," she says. "We don't do that here. We have rules here. We don't cross that line." She will not go to Dubai or Abu Dhabi. If she ever wants the Maldives, too bad: most flights go through Dubai. Fridman pushes into the conspiracy register — Epstein as an intelligence front, blackmail, manufactured scandal. She does not claim omniscience. Bureaucracy makes some of those plots hard. She hopes that in a free society intelligence services are mostly trying to do good, and she also knows that if they were not, the public might not know. That is one reason Snowden still sits in the "maybe necessary" column even for someone who will not call him a hero.

Has she been afraid? She has had moments. The *Times* security team called to say someone on the dark web was offering good money to anyone who could hack her phone or laptop. After Ekoparty she brought home a burner laptop, stored it in a safe with nothing on it, and found the safe opened and the machine moved. She has also gone too far into paranoia. While writing about the *Times* hack by China, and about Chinese operators who had gotten into a corporate thermostat, she was living alone in San Francisco. Her cable box made a noise in the night. She ripped it out of the wall and, she thinks, said something embarrassing like "fuck you, China." In the morning light the box was on the floor. She told herself she was not going down that road.

The fork was tinfoil hat or ordinary life: no car with navigation, no Google Maps, no iPhone, no Amazon diapers, an alias — or do the best you can in the digital world we actually have. Her method is crown jewels. You cannot protect everything. You can protect the few things that matter. For a long time hers were sources. Some she met at the same dim-sum place, or a different restaurant on the same date each quarter. No driving, no Uber, no devices, a pencil and a notepad. Sometimes the source did not come. They never communicated digitally. You cannot do that for everyone. For everyone else: Signal, two-factor, updated devices, no phishing clicks, a password manager — the things we already know. Do not go crazy, she tells people. That is the ultimate hack: they have hacked your mind.

A mentor who had been the *Times* Moscow bureau chief during the Cold War took her to lunch after her China series. When he dropped his kids at preschool, the KGB followed and made a loud show of it — tails, horns, a ruckus. They never actually did anything. They wanted him to know they were there, and he operated accordingly. That, he said, is how to live in the digital world. Also: at the *New York Times* you have a little invisible shield. If something happened to you, it would be an international incident. She carried that shield for years. Then Jamal Khashoggi happened. He was a Saudi, and he was a *Washington Post* columnist, living mostly in the United States, a journalist. They did what they did almost in the open and got away with it, and the United States let them, she says, to preserve relations with the Saudis. That threw her worldview upside down. It sent a message that it was open season on journalists. She calls it one of the most destructive things of the previous administration. She no longer knows what to think of the shield.

Fridman offers his own security philosophy: have nothing to hide; be the same person in public and in private; if you are weird, be publicly weird, so there is nothing to blackmail. Perlroth knows the *Times* front-page rule — do not put in email anything you would not want on page one. It works, and it has a cost. Maybe you cannot be a secret asshole, which she will put in the good bucket. The other voice, the one that asks how a sentence could be read and used against you, stifles creativity, weirdness, and free thought. That small voice is, on a micro level, why Tim Cook goes so hard on privacy. Twitter, they agree, is engineered for cortisol: open the phone and the trending list is whatever will make people angriest today. Half a day on the site and she loses hope in humanity. A grocery store, a hike, a stranger’s smile, and she remembers that people are fundamentally good — we just do not hear from those people enough.

Advice for someone in high school or college: be a hacker, then apply yourself to defense. The United States has scholarship programs that find people early, pay for college, and ask for a stretch of federal cybersecurity work. Every year the graduates want NSA or Cyber Command. They want offense, the sexy work. Filling defense jobs is hard. "It's always been more fun to be a pirate than being the coast guard." There are, she says, 3.5 million unfilled cybersecurity positions around the world. That is job security. A free-market country is at a disadvantage because it cannot match Palantir, Facebook, Google, or Microsoft on salary. Other states have a workaround that looks like conscription. China, in her telling, lets you work at Alibaba, even do some ransomware, until someone taps you on the shoulder for a sensitive operation, at which point the answer is yes. When Yahoo was hacked, the indictment described two cyber criminals and two FSB officers: the criminals could have their fun, but a White House, State Department, or military Yahoo password had to be passed along. The United States does not run that model, and the defense gap is worse for it.

If you tinker, learn to hack. SANS runs competitions. Then use the skill to neuter the bugs autocratic regimes use to make a life into a prison, and to defend industrial systems and water plants against people who would poison the supply. The work is intellectually hard, you can tell yourself you are serving the country and saving lives, and you will always have a job. If you need the two-million-dollar salary, that exists too, with more of a public profile than a classified operator will ever have. In this field the more interesting threats often show up in the private sector, because that is where the attacks land. Criminals and nation-states coming for the United States do not walk into Cyber Command. They go to banks, Google, Microsoft, critical infrastructure. Those companies see the sophisticated stuff. Call out SolarWinds from FireEye and you have saved, she says, God knows how many systems from something closer to sabotage. Or go be a journalist.

What gives her hope that the world does not end? She has to have hope: she has a child and another on the way. It is a frightening time — pandemic, climate, disinformation, increasingly advanced and perhaps deadly cyber attacks. She shares Fridman’s view that people are fundamentally good, and she is almost never reminded of that online. Twitter for half the day and you lose faith. A grocery store, a hike, a smile, a kind sentence, and you get it back. She thinks the political climate has hit rock bottom and that the shift has to be generational. She calls herself a geriatric millennial or a young Gen X: old enough to have grown up without the internet and social media, native enough to know the good and the bad. The same is true of climate anxiety and disinformation. A lot of today’s crises, she says, have mostly exposed long inertia. The next generation will have to refuse to do business the old way — stripping the earth, turning people on each other, letting lobbyists dictate the country.

Fridman adds that when older leaders behave badly, they accidentally recruit their replacements. Talk of journalism being broken is an invitation to found better institutions. Perlroth lands on authenticity. Nobody plastic rises now; people are craving the real thing, and the internet makes it hard to hide who you are on every platform. She used to worry that a nephew born into Facebook could never be president, because there would always be a photograph of a mistake. She has taken that back. Everyone will have a photograph. The culture will have to grow up, become a little more forgiving, a little more humble, or it will cancel everyone and no one will be able to live there. Lex leaves her with a line from her own book: we have entrusted passwords, texts, love letters, bank records, health files, credit cards, sources, and deepest thoughts to a mystery box whose circuitry most of us will never vet, run by code in a language most of us will never fully understand.