The Internet Has No Off Switch: AI’s Security Debt, ICANN Lessons & the Scam Tsunami

Justin Beals: Hello and welcome to Secure Talk. That was Brian Cute, our guest today, and the wave he's describing is already building. Tests of AI generated phishing results in a click 54% of the time. The old average was 12%. Threat actors are scaling their enterprises at AI speed. Brian has seen this pattern before. He helped engineer the early internet, including the seminal work of standing up the domain registry system.

We all rely on to find anything online. He watched security get left out where it seemed unnecessary, then watched criminals find every gap once the network went global. He says the race into AI is the same play, only faster and cheaper. Today he is CEO of the Global Cyber Alliance. We get into why 400 million small businesses with no IT team are standing right in front of this wave. And what works.

Once awareness on its own stops being enough. Join me in welcoming Brian Cute.

—

Justin Beals: Brian, thanks so much for joining us on Secure Talk today.

Brian Cute:  Thanks for having me. Appreciate it.

Justin Beals: Wonderful. You started out as a telecom lawyer, advising on submarine cables, and you ended up running one of the internet's largest domain registries. I'm curious about what that taught you about the internet and control points. It's a very ground-level place to begin with the internet, Brian.

Brian Cute:  Thanks for the question. And that's going back to really the beginning of my career. Working for Teleglobe, which was a Canadian international telecom carrier. We had submarine cable systems; we had satellites as well, and we delivered international traffic. And I was there actually during the great dot-com bubble burst in 2000. So that also was part of my internet history; that, you know, the dot-com bubble was created, and a lot of inaccurate valuations of companies ended up bringing down the telecom market almost entirely, which was a shock to us all. And it was because of that Teleglobe actually went bankrupt as a result, as many companies did, telecom companies. And I did some bankruptcy work while I was there, some cleanup, and then I had an opportunity to just take the next job, which turned out to be
Network Solutions as director of policy. And Network Solutions, for those of you who don't know, back in the beginning of internet time, way back when there was only one company that sold domain names. It was name was Network Solutions. It was the single organization on the planet when the internet started, they started selling domain names in 1995 for a fee. And so I ended up in Network Solutions, and I knew nothing about domain names, but from that point on I went on the most incredible journey professionally and around the globe, being part of a community that literally helped grow the internet globally and helped bring people online through domain names and websites. So it was really kind of fortuitous. And what it taught me about the internet, I think, first of all, the experience with Teleglobe, people have described the internet as simply a network of networks.

And the most simple basis, that is what it is. It's thousands of network operators around the world who agree to interconnect openly, use the same internet standards, and share traffic. And at its very base, the internet is a network of networks. So, you know, my time at Teleglobe understanding how telephone, telecom networks actually work, the physical networks, was a great place to start. from there.


And you you mentioned control points. The hard truth about the internet is there are no control points. There's none, there's not a one, there's not a single organization, there's not a single government that's got a switch that can turn this thing on or off. And it's part of the beauty of the design, right? And it's also something that's caused governments a lot of frustration over the years in terms of jurisdiction, the internet as a thing kind of challenges our concepts of, you know, boundaries and, you know, geography because anyone from any place can connect with another person. So understanding the physical network part of it was really helpful. The really interesting part of the journey has been to see the internet without a single control point, yet expanding to serve virtually everybody in the world. By the way, there's still about two billion people who aren't connected. We need to get them connected. But it's a remarkable piece of technology and transformative all around.

Justin Beals: When I worked at British Telecom and the Network Operations Center, we were rolling out their global data network, the frame relay network. And it was a really fun time. I don't I think I loved working in it at the time. The tech was really interesting. I was a little unaware of the impact it would be, but it does feel like when you mention a bubble, I just had to say it feels a little like we are repeating cycles again and again and again in this tech space. We are once again at a crazy valuation time. You brought it up. Don't know that that valuation is true. I don't with a lot of these companies, organizations, especially some of the foundational model companies. And I think we're all kind of waiting for the other shoe to drop. Do you feel similarly as you look across the market?

Brian Cute: I do. First of all, first of all, I am old enough to remember frame relay. So thank you for reminding me.

Justin Beals: You're welcome. Yeah. Try not to bring too much nostalgia to secure talk, but it happens, yeah. Good

Brian Cute:  Put a smile on my face. But yeah, I do feel like in some ways we're watching a similar movie again with this AI, the rise of AI and the valuation of these companies. And
I think there's a couple of lessons that a couple things I'm keeping my eye on. And with respect to security and cybersecurity, which you know, I want to share some thoughts there. A lesson we learned in the domain name system, you know, the DNS, which and TCP/IP were the standards and domain name system, domain names, IP addresses, etcetera, those are the piece parts that make the internet work. we learned some important lessons when the internet was designed: Vint Cerf and Bob, and the good folks at USC. They were designing this for a network of universities only. And Vint Cerf has said this many times: that they were designing for scale within those universities. They wanted everybody to connect and be able to communicate and find a different way to do it than the old telecom system. And they made some choices in the design, right?

In some places where you might have been tempted to put a security feature, they didn't, right? Because their assumption was this is a closed user group, it's just a certain number of universities. We want this to scale across them. And that feature may not have been needed. What happened was when the internet then went global and that technology began being used across countries and by millions of users, the cyber criminals figure out how to exploit the weaknesses and where there should be security and there isn't, they know how to leverage it. So what we learned in that case is that the importance of addressing security on the front end, if a technology is going to prolifer proliferate, because once it proliferates, it's humpty dumpty. It's virtually impossible to shoehorn security back in because this is a network of networks of thousands, and getting everybody to adopt a security fix is really, really hard, next to impossible. So watching this movie again, and everybody's rushing to use AI, using it in their businesses, using tools off the shelf. There are real security risks with AI agents and Gen AI technology. We all know it hallucinates. We all know it can exfiltrate data and share it with the bad guys, right?

There's a lot of security risks here. And yet everybody is rushing in. And everybody is using the technology. And most people are using it not knowing what those risks are or how to manage them. So I do feel, as you alluded to, we're kind of watching a similar movie, yet again.

Justin Beals: Yeah. And actually to the AI side, I think in New Delhi this February, you said that generative AI has made cybercrime cheaper and more effective. Those were the two lanes that it was really adjusting in the crime space. Are you seeing that in GCA's own data? And is there any insights you can give us in where it's making cybercrime the less expensive or operate at a greater scale?

Brian Cute: Sure. So yeah, the data that we look at- third-party data on the volume of phishing attacks, for example, email phishing attacks or scam attacks- the increase in volume in the last two years would blow your hair back. Just the overall volume. And that is because the cyber criminals are leveraging Gen AI and deepfake technology.

I'm sure you've heard of the scam centers in Southeast Asia. These are places that are the size, literally the size of small cities, sprawling campuses that have been used by what is now transnational crime, criminal organizations. This is this is industrialized crime, make no mistakes. And they have the capabilities now to deliver volumes of phishing attacks, of scam attacks that dwarf the volume from five years ago. And that's because of automation. So to answer your question, the lowering of cost for the cybercriminal is Gen AI allows them to automate the creation of and delivery of a phishing email, a scam exploit. And you know, some of those in the past, when they were using humans in those small cities.

You know, they had to go get data if they wanted to put together a personalized phishing attack, if they wanted to put together a spear phishing attack where they're going after a really, you know, big fish, if you will. They had to go research that target. They had to pull data; they had to put together a profile and craft the content. All of that's automated now. All of it. And so AI has significantly brought down the cost of doing this, and we've seen the corresponding spikes- I mean, really scary spikes in volume. And, more concerning, the effectiveness is going up. 

There was one Microsoft study that they ran where they found that Gen AI- and deepfake-enabled phishing emails achieved a 54% click rate, whereas the average had been 12%.

Now think about that. Click-through is the business engine for phishing, right? And scams. That's a business engine right there. If you're moving that needle from 12% click-through into the 50s, you understand why this is becoming a huge business globally. So yeah, it's automation, it's lowered costs, and it's the effectiveness as well that's truly, truly scary.

Justin Beals: It's in parallel with what I see happening intriguingly in a lot of go-to-market teams, right? It's like Gen AI systems are automating much what is what was human capital in an outbound activity, trying to find new customers, trying to get them into a sales funnel. And if you're institutionalized crime and you're thinking about the addressable market, you want to go after the lever point, your funnel points like conversion on a click on an email, you're right. You change one part of that structure by a four X type of outcome and it can have a massive downstream effect on on the amount of crime they can successfully execute. Yeah.

Brian Cute: That's right. Yep. I was at a MasterCard security center meeting in Singapore last fall. And it was a two-day meeting with mostly Interpol and law enforcement agencies from across the ASEAN region. And there was a lot of, you know, useful data shared. And of course, law enforcement is working together, you know, much more closely together to try to apprehend and catch these people and put them where they belong, in prison. 
But it during one of those two days, this last October, somebody said, We anticipate that these scam centers will be running fully agentic systems within a year or less. And that's what really got my attention because what if you're just looking at the data that we've seen in the last couple of years, right, you make this if you make this a system, a family of AI agents that's working twenty-four seven, seven days,  365. 

What that really translates to in my mind is a tsunami of more increasingly effective phishing and scam attacks that are coming at all of us. Because with the volume they can generate and the automation they can use in identifying targets, that's what's coming at us. And so, you know, at Global Cyber Alliance, one of the things we focus on is getting basic cyber protection and tools into the hands of small businesses, NGOs, under-resourced organizations who don't have an IT department, who don't have the budget to go get, you know, great tools to protect themselves. Those organizations, and for example, there's 400 million or so micro and small businesses on the planet. There's about 10 million NGOs. They are largely unprotected. They don't have the resources. They haven't had the training, despite all the good efforts many of us have done. And they're sitting ducks for what's coming. So that's a real concern for all of us. That can impact the economy, right? That can make people lose jobs. Small businesses go down because of automated attacks that they fall victim to. It's a real threat globally. And that's something that we're trying to help address with many others.

Justin Beals: Brian, we're in the 23rd Cyber Security Awareness Month, I think. So 23 years of that program. I'm curious as we enter into this month, what's new, what's old that we shouldn't forget about? Like, hey, we never really finished last year this good security practice. Don't forget about it. And also this year, this is a new thing that you would recommend to organisations be very aware of and putting security controls around.

Brian Cute: Yeah, absolutely. so a theme in the cybersecurity community right now is that awareness raising is not enough. And it's true, I agree with that. There have been a lot of organizations, not just GCA, there's a lot of not-for-profits and other organizations that spend money to get these tools in the hands of end users, spend money on training, you know, capacity building, digital skills building around the world. And it's all very good work. And I think we've all come to learn that awareness, raising the awareness is not enough for a couple of reasons. One, as a community, it's been hard for us to measure behavior change of the end user. You know, small business person comes to training for a day or two, gets all the information they need to know about cyber attacks and what they are and how to avoid them and what tools to use. But it's hard to measure their behavior change after the fact when they go back to the office. So yes, it's Cybersecurity Awareness Month. And that is still important because so many people and so many organizations really aren't aware of their risks. And you've got to be aware of your risks if you're going have a chance at managing them, right? But what we're also focused on is how do we get awareness plus taking action. And where can we measure that? Right. 
We need to know that small businesses, NGOs, even individuals that we're providing training tools, that we're providing content to, that we're providing tools to, not only just get it, but they're actually implementing it. They're downloading some of the free tools that can provide operational protection. They're not creating simple passwords; they're creating complex, strong passwords and MFA.

That's where the cybersecurity community is focused right now. So Cybersecurity Awareness Month is a great thing. It's going to continue, I hope for many, many years. And there's a shift in the community saying, you know, we got to see behavior change, the use of tools that provide protection and be able to measure that to know that we're we're making a dent.

Justin Beals: I love this word measure. I mean, it it's it's cropped up a ton for me in my career and my practice in computer science, and especially in security, I think it's an emerging kind of area of learning and knowledge and of course pain and suffering. And because the current measurement tools, when I think what people go and grasp onto are things like I got a SOC2 assessment, I got ISO 27001. These are and but they're nascent. You know, when I look at measurement tools that I might have built in standardized testing or other, you know, human capital measurement and productivity, we're just starting to do the baseline things of measuring security activity and its effectiveness, I feel like. Do you agree?

Brian Cute: Absolutely. I do. I can tell you in our specific domain. So what we do in the context I just described is we will, since we're a cybersecurity expert organization, there are training companies that train small businesses and NGOs around the world on basic digital skills. And we will bring the risks of cybersecurity that need to be known, we will develop content and curriculum around that. We will put it in local language. We will train the trainers so that they can deliver the content. So you make the end user aware of their risks, you bring them through some content that helps them understand what it is, how to spot it, how to avoid it. And then what we offer, almost uniquely, is we offer actual free tools that provide operational protection.

Right?. So like a protective DNS service like Quad9, right? A service that you anybody's so simple. You can download in your machine and your network. It will prevent you from connecting with a website that has a known malicious domain name. So it will literally reduce the aperture of what's coming at you from phishing. So we always say to end users.

“Hey, there are a number of really good free tools out there. We've tested them; they're good. And if you download them on your machine, they're gonna operationally protect you” . In the background, you've got, like a backup. Why is that important? Because even the best-trained person is gonna click on a link at the link at some point. I'm gonna click on a link some point. I'm gonna call you, you know the number I shouldn't. It's just human nature. 

So, that's what we try to deliver. Now, how do we measure that? Right. So the training's been done. How do we measure that? The small business goes back to their office. The one way we've been able to measure something is by seeing visits to the small business toolkit. You know, we see it we can measure the volume, we can see where it's coming from geographically. We do a training; we can kind of correlate, okay, this cohort of trainees have been accessing the toolkit. And that's good.

But it's not enough to really measure impact. Where we are encouraged is that we've just developed an AI agent to automate most of this training and the delivery of those tools and resources. And once you start working with an agent, while we never collect PII- that's just a principle for us- and that also minimizes visibility today. But with an AI agent, where a user can come into training with the agent. They can learn what they need to learn, get pointed to tools, they can actually create an ongoing learning process because the agent remains at their disposal. They go back to the office, they have an event, there's a ransomware attack. They can come back to the agent and get guidance on what to do. We're also setting it up so they can create their own kind of learning process, right?

Cybersecurity can be intimidating. It's complex. It can feel like a lot. You know, we would love it if a small business said, you know what? Thanks for this training. The only thing I'm going to focus on is strong passwords and MFA and how to implement it across our small business. That's a win. And if they create their own learning module, right? So they go back, and they do the steps, they're working with this agent, that is more visibility for us into what steps are they taking to protect themselves. So there's real possibility here using AI for good, right? For protection that can help us understand and measure better the impact that it's having. And that's exciting.

Justin Beals: I find this a fascinating new tool, Brian. and it I can't I think it kind of highlights a tale of two cities for me in this marketplace right now. Here's an exceptional use of AI. I have often wondered what would happen as we turn these large language models into learning tools and people trying to learn with them at the same time. We are inundated with fears around how AI is going to take over the world or destroy humanity.



I'm curious on this deployment. It seems to me like what you've been developing is more along the small language model where it's really designed around a specific person's purpose. It can provide a lot of value. It's always on. It seems like a true solution to a market need here.

Brian Cute: We think it is. It's deterministic. It doesn't go out on the open web. It's trained only on our data. And that's intentional. The need that it addresses is I'll give you an example. We are in the third year out of a three-year project with the Asia Foundation, where we are working with them to train 300,000 micro and small businesses across 11 countries in Asia. And it's just as I described, they have the reach into those communities. We've created the content, the curriculum, we've localized it, contextualized it; we've got the tools; we've trained their trainers; they're delivering it. And in that one project, it's going to take 15 organizations all told, three and a half years, countless process steps to equip 300,000 micro and small businesses with the resources they need to protect themselves. 

That is a great outcome. I am not minimizing that outcome as an outcome. It's terrific. However, 400 million micro and small businesses on the planet largely unprotected, the wave of Gen AI and deepfake phishing and scam attacks that are coming at everybody on a daily basis, we need to close the gap.

We need to achieve scale with these resources. We need to be equipping tens of millions as quickly as we can, not 300,000. So when we looked at the way those resources are getting in the hands of end users today, it's far too slow. It's effective, but far too slow, and it doesn't scale. So this was a first step of what could we contribute? It's just one piece that could begin to scale the delivery of these resources into the millions, to the tens of millions. That's going to take collaboration. That's going to take working with ISPs and domain name registrars and others who are already selling services online to these companies who are willing to put the tool in their hands. It's going to take collaboration to get to full scale, but that's really the problem we were trying to address when we thought, you know what, we need to use an agent to deliver what we've been delivering the way we've been delivering it.

Justin Beals: Yeah. I mean, there's a ton of human capital data as well around like just in time information is, you know, more easily synthesized as something someone knows later. Whereas when I walk out of a training session, if I don't use that data within two weeks, I've lost it again, you know. So just our brains cannot hold the amount of data that's stored on the internet and all that we need to know. Yeah. And so we really do need a toolset to learn in the moment what a particular activity could be. Now you've been working in the Global South or Asia outs outside of Western communities for a little bit now. Was there any learnings, you know, between those communities that were surprises? I can think of my own work in Latin America, certainly had my eyes opened once or twice to running a business in a different country. Yeah.

Brian Cute: Yeah, I so the the work that I've done at Global Cyber Alliance is one piece of the work prior to that at Public Interest Registry. I spent a lot of time in the Global South. We were launching a couple of new top-level domains,.ngo and. g, specifically for nonprofit organizations. And I think the one thing that I learned that was most meaningful is the thing that kind of
I think when we come from the North, and we come from the West, we can be unaware that we have a little bit of a paternalistic mindset. all of the knowledge that is required to address these problems and others in rural villages already exists in rural vill villages. I bring nothing new in terms of knowledge, really. What I need to bring that I learned is: if I'm going to have a positive impact, I just need to bring a tool. Just a tool. The tool has to be fit for purpose. The tool has to address the problem. And by the way, when I introduce this tool, it's going to be modified. It's going to be adapted to the local circumstances. And all of the knowledge and skill that's needed to do that already exists. That the best I can do is just bring a tool that's fit for purpose that can solve a problem, and literally say here. And the village and the community will take it from there and take care of it. That's really what kind of blew my mind more than once: the innovation is incredible at those levels. And it's really about not coming in with your own mindset about how things should be, just how can I make a contribution that's gonna address this problem and then kind of get out of the way?

Justin Beals: Yeah. We at one point in time, we were doing a little research on- I think the political winds were different- but the putting some staff in Cuba for some computer science work that we were doing. And we went and did a visit, and we're shocked to learn that they had, you know, largely no access to the internet with the same level of bandwidth that we do, but they had downloaded /dot and a bunch of different bulletin boards with instructions on how to solve for particular bugs. And then we're passing them around on hard drives. And but really operating, you know, with a similar level of rigor and acuity around software engineering and what they were building. It was we learned more than I think we we learned than we taught when we went and visited. I find the tool thing quite interesting because I think as you know, as your organization is going for impact, this is unique. I've worked with lot of nonprofits or public interest groups over the years, especially in education, and they give a lot of advice, but you guys are trying to bring product to market in a way. Yeah.

Brian Cute: Yes. Absolutely. We are. The tools, the tools that I referenced before were free tools. And there's a lot of great free tools out there. But the types of organizations that we're serving, honestly, they don't know what their risks are. They don't know what questions to ask. They wouldn't know where to go to get tools that could make them more secure. So in recognizing that, we basically went out and curated.

A group of free tools that map to basic cyber hygiene principles, right? And so our toolkit isn't just educational. Yes, we take them one step at a time. The first thing, the first risk you have, is not knowing what's on your network. So the first thing you need to do is a complete inventory of everything on your network, no matter how big or small. And here's a tool to help you do that, right? And then

Down through access controls and phishing and malware and backing up your data. And the so the structure of our toolkit is yes, the education about the risk one at a time, understand it, understand how to manage it. And here's a tool that you can use, right? That provides you either that tool for doing an inventory or some operational protection in your network and in your devices in the background. so we've always had a tool focus, In terms of delivering protection. Those were third-party tools, by the way. I meant to say that. Those were third-party tools that we had vetted with our technical team. This is a tool that we've developed. And again, it's trying to address that problem of achieving scale and driving efficiencies through the delivery of these resources. And I think one of the most important things, in addition to having visibility into change in behavior now, is changing the and this is for this is for funders, changing the ROI proposition on I'm gonna give these folks a bunch of money; I want them to train 100,000 small businesses; we're gonna all get them in the room at one time, we're gonna give them the stuff, and they're gonna go back to their office. 

That one-off investment where you can't see mostly if there's behavior change, if it's having impact, to now a continuous learning process because we can ping these trainees three months down the road and check in. How are you doing on the strong passwords and MFA? They can come back to the agent with questions as we're they're confronting either a threat or some issue inside. And now we have a continuous learning loop. And that's what we're trying to cultivate because cyber threats evolve. This isn't a static thing, really. Unfortunately for all of us, we have to continue to pay attention to these things 'cause they morph.

Justin Beals: Yeah, absolutely. Well, and for those that haven't, I spend a lot of time in the enterprise education space and I just this discussion reminds me so much of studies that we would read where, as students were out of school for the summer, their retention would drop by like 70% of the information that they learned before. And it's just very hard to teach people things. Yeah, we throw a lot of money at it.

But retaining and operating that way, and I and we, there's not the ability to afford to put a CISO in every one of these businesses. And so you need an advice tool that they can deal with. I think it's phenomenal.

 I did want to talk about one other segment. You have deep expertise in domain registry, the internet, and some of the technologies there. And maybe I can, with the time we have left, just open up. What's changing about the way we're going to govern the internet from a security perspective? What are you a fan of and what are you afraid of?

Brian Cute: Good questions. All right, I spent most of my career working in domain name registries. I spent a large part of my career as an active participant in ICANN, the Internet Corporation for Assigned Names and Numbers, which is the technical coordinating body for the domain name system. It's not a government; it's a non-profit that's a technical coordinating body. A lot of people miss that.

But in all seriousness, you know, internet governance, I guess, at first kind of took shape within ICANN, but took on a bigger shape, you know, as the internet proliferated around the world, and you have the Internet Governance Forum that's active within the UN. And I think from a governance perspective, let's start with ICANN. ICANN was a completely new, creative, innovative idea about instead of regulating a technology, let's try this new model of multi-stakeholder, bottom-up governance. So industry, government, and civil society all get to participate on even ground, no one's more powerful than the other, in developing the policies that are going to make the domain name system, the internet's identifier system work.

I think largely it's been a success. It had some horrible, horribly painful growing pains early on as an organization. But I think largely now that we're here, it's worked. And it has preserved and advanced the internet as an open, interconnected, interoperable technology that everyone can use. And so it's been a success. Could it improve for sure? Internet governance, when you get to other questions, for example, where I see people talking about AI governance, it makes me flinch a little bit because, well, for one, the domain name system, because of the architecture of the DNS, right? You can only have one operator of one namespace. It's a scarce resource, right? It had attributes and qualities that lent better to creating this kind of multi-stakeholder governance envelope around it. It just did. AI as a technology doesn't have any of those attributes. So when I hear people say AI governance, I don't know what they're talking about. I don't see this similar type of opportunity to create a multi-stakeholder governance mechanism around it.

I see law and regulation; I see law enforcement. I see antitrust laws, you know, in terms of the large companies. I see tools that are out there that can regulate it, manage it, direct it to some degree, but governance, I don't know. I think we might spend a lot of resources and time and energy chasing something that's not a fit here. When I think what we should be talking about, I really do think we should be talking about this. Take the word " governance " away. We've got a lot of experience now with governments, industry, and civil society actors coming together around a technology and working together. What are the working constructs? What are the working mechanisms? What work needs to be produced? What does that working mechanism look like? How do the different stakeholders feed into that within their respective roles, so that we can achieve protection at scale or achieve X or Y. I think that's the conversation we need to be having.

But AI is such a powerful distraction in some ways that it's just going to subsume every conversation. So th that's what I'm concerned about: is that I think we have a track record of creating working collaborations that could address AI if we got all the right stakeholders together. But nobody's talking about that right now. Or they're just off working in their own silos.

Justin Beals  It isnot like the internet, right? Like if we were to build a network but not have an addressing system for where you want to wind up in that network, it's not a very useful system, right? Because you never know where you're gonna wind up. It's that a shared addressing system, when I look at ICANN, when I look at domain name registries, are critical. Otherwise we couldn't figure out which data we were looking for and who the owner was of it. AI is software that runs on a server. You can run it on any server you want. I run it on my local laptop; I run it in the cloud. And I think first adhering from a corporate perspective to the laws and requirements of restrictions, even like the intellectual property laws that seem to have been run roughshod over recently. It's like we don't need a lot of brand new things from a governance perspective around AI. You need the cybersecurity tools to manage what it's doing if you adopt it and you're using it in your product or things like that. But just following the existing legal requirements from a privacy perspective, from a, you know, a fraud perspective, it th those things seem to be, I think, a distraction in that way. Like the moniker is a distraction for people just going after good behavior that we should be living by. Yeah.

Brian Cute: Yep. That's that's what I see right now. And I'd like to see some conversations starting that focus on how can government, industry, and civil society work together. What what's the specific problem? What's the shared desired outcome? And how can we start collaboration mechanisms where we are together driving toward that outcome?

Justin Beals: Yeah. One aspect of that that I think has been successful in AI is like the MCP standard. Like we were desperate for a framework by which we could communicate, and they've been iterating the security in that. That feels like a working group where we're starting to learn how we can build a technology agreement around how AI works.

Brian Cute: And that's a good example. And I like, I mentioned a lot of people are working in silos. There's nothing wrong with working in silos per se. That's an example of a good piece of work, standards-based work, and that's important to know. And that was the other thing about the DNS and the building of ICANN that was kind of unique is I used to glibly refer to it as the technical priesthood, you know, because there was at the beginning, you know, the DNS, the TCP IP, was really put together by a bunch of engineers. And then this guy, John Postel, who was running all of the domains in the route at one time. There really was a and still is in the ICANN space, a group of engineers who built it, designed it,but also cared very deeply about how the technology was used. And you have standards bodies like the IETF out there that are still doing what's important in terms of creating the right standards. But that community played such an important role in how governance of the domain name system grew. And they were a presence in ICANN throughout those years and often consulted, you know. 

That's the the first thing I did when I got to Network Solutions I called actually, one of the engineers I work with today, Leslie Daigle, who's the CTO at Global Cyber Alliance. She was one of the first calls I made because I was supposed to be helping develop policy. And the first question was Look, this is my job. This is what I have to do. But I never want to put something forward that could break the technology or make it not work. So that's where stakeholders, right? Government, industry, civil society, the technical community. Everybody can play a really important role. We just need a working mechanism that can help us drive to the shared outcome.

Justin Beals: Well, Brian, I am deeply grateful for the internet you helped us create. I w wouldn't have had the career job opportunities. 

Brian Cute:  So many other people, not me.

Justin Beals: I know. But I did. I love that we've been a part of that community, and both of us have seen an opportunity to make our contributions. And I'm grateful for you sitting with us today and our listeners on Secure Talk. Thanks for sharing your expertise with us.

Brian Cute: Thank you. I really enjoyed it. Appreciate it.