We Know You Can Pay a Million: Anja Shortland Illuminates the Dark Screen of Ransomware
“It’s like wrecking a car to steal a pair of sunglasses. The sunglasses are the ransom. The damage to the car is fifty to seventy-five billion dollars a year.” — Anja Shortland
Cybercrime is booming. Ransomware attacks — where criminal gangs encrypt your servers and hold your data hostage until you pay — cost victims somewhere between fifty and seventy-five billion dollars a year in damage. The hackers themselves pocket around a billion. As Anja Shortland, professor of political economy at King’s College London and author of Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware, puts it: “it’s like wrecking a car to steal a pair of sunglasses.” The sunglasses are the ransom. The wrecked car is the damage to the rest of us.
Shortland is an expert in extortive crime — transactions where a legal entity has to make a deal with a criminal group under conditions of zero trust. She has studied kidnap for ransom, Somali piracy, art theft, and now the booming business of ransomware. What fascinates her is not the crime itself but the institutions that emerge in the space between the legal world and the criminal underworld: the insurance companies that price the risk, the negotiators who manage the transaction, the norms that make it possible for a corporation to pay a criminal gang and actually get its data back. In Russia, hacking Westerners isn’t even a crime. In North Korea, it’s an actual department with a small army of government employees. In Iran, it’s a foreign policy. Criminality, Shortland thus argues, is defined by whoever holds power.
The game-changer, she argues, is cryptocurrency. Without it, ransomware doesn’t work — you can’t move money anonymously at scale without it. Regulate cryptocurrency, and you take the profit motive out of most of what she studies. The irony is that the current American administration is amongst the most crypto-friendly in history. Meanwhile, AI — specifically Anthropic’s Claude Mythos, the hacking model that was leaked rather than released — is about to give criminals tools that only well-resourced banks and corporations can currently deploy defensively. So cybercrime will continue to boom. Expect a pile-up of wrecked cars on our information highway.
Five Takeaways
• We Know You Can Pay a Million: The title of the UK edition of Shortland’s book is the most revealing line in ransomware. Criminal gangs don’t pick ransom figures arbitrarily. They spend weeks inside the victim’s systems, studying cash flow, cash reserves, and insurance coverage, before setting a demand on the painful side of affordable. The victim usually pays — because the alternative is losing access to patient records, customer data, or patents permanently. The hackers know this. The negotiation that follows is, in Shortland’s framing, a transaction between parties with zero trust and one thing in common: both want a deal.
• In Russia, It’s Not a Crime: Ransomware is not a uniform global crime. In Russia, theft and extortion directed at Westerners is not considered a criminal act. In North Korea, hacking is organised as a government department — a state revenue stream, not a criminal enterprise. The line between crime and legitimacy is drawn by whoever holds power. This complicates any enforcement response: you cannot extradite a North Korean government employee. You cannot prosecute a Russian hacker in a Russian court. The only effective levers are diplomatic, financial, and technical — and all three are currently being weakened.
• Insurance Orders Criminality: Shortland’s most counterintuitive argument: insurance companies are not passive bystanders in ransomware. They are active market-makers. By pricing the risk, they create the conditions under which a corporation can make a rational decision to pay. By negotiating on behalf of victims, they create norms — what a fair ransom looks like, what proof of decryption looks like, what happens if the hackers don’t deliver. Insurance, in Shortland’s telling, is what makes the criminal market function. Most people think insurance is boring. They are not thinking about this.
• Cryptocurrency Is the Real Game-Changer: Ransomware as a profitable business model did not exist before cryptocurrency. Without the ability to move money anonymously at scale, without blockchain verification that payment has been received, the transaction between criminal and victim cannot be completed. Regulate cryptocurrency — apply the anti-money-laundering frameworks that govern wire transfers and bank accounts — and you take the profit motive out of most of what Shortland studies. The irony: the current American administration is among the most crypto-friendly in history, and the president’s own family has direct financial interests in the sector.
• Claude Mythos and the Asymmetric AI Problem: Anthropic’s Claude Mythos — the AI model built to find software vulnerabilities, which was leaked rather than formally released — is the next phase of this war. The defensive use case is real: a well-resourced bank can use it to find and fix its vulnerabilities before attackers do. The problem is asymmetry. A large financial institution can deploy Claude Mythos defensively. Wiltshire County Council, a local hospital, a dental practice, a legal firm — the soft targets that ransomware gangs prefer — cannot. The hackers will eventually get it. The debate about who should be allowed to use it, and under what conditions, has not happened. That is what worries Shortland most.
About the Guest
Anja Shortland is a Professor of Political Economy at King’s College London and the author of Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware (Princeton University Press, 2025; US edition April 2026) and Kidnap: Inside the Ransom Business. She was a member of the Ransomware Task Force.
References:
• Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware by Anja Shortland (Princeton University Press, US edition April 2026).
• Steven Levy, Hackers: Heroes of the Computer Revolution (1984) — referenced in the interview as the origin story of hacking culture.
• Episode 2885: Keith Teare on Adulting — the week Anthropic’s Claude Mythos was discussed; the Shortland interview is the companion piece on what it means in practice.
About Keen On America
Nobody asks more awkward questions than the Anglo-American writer and filmmaker Andrew Keen. In Keen On America, Andrew brings his pointed Transatlantic wit to making sense of the United States — hosting daily interviews about the history and future of this now venerable Republic. With nearly 2,900 episodes since the show launched on TechCrunch in 2010, Keen On America is the most prolific intellectual interview show in the histo...
00:31 - Introduction: cybercrime is on the rise
01:48 - What is extortive crime? Zero trust, criminal markets
03:20 - The world between legal and criminal: institutions and norms
04:22 - Insurance as market-maker: why it’s not boring
05:18 - From hero hackers to villain hackers: Steven Levy’s arc
06:48 - The size of the industry: $1B to hackers, $75B in damage
07:53 - We Know You Can Pay a Million: how ransoms are set
09:26 - Corporate ransomware vs. fraud targeting vulnerable people
10:54 - Inside the dark world: Shortland’s research methods
12:36 - Did she take risks? Talking to hackers
15:00 - In Russia, hacking Westerners is not a crime
18:00 - North Korea: hacking as a government department
22:00 - The victim’s dilemma: pay or lose everything
26:00 - Insurance, negotiators, and the norms of ransomware
30:00 - What individuals can do: passwords, phishing, hygiene
34:26 - Claude Mythos: Anthropic’s leaked hacking AI
36:48 - Should Anthropic have released it?
38:23 - AI and war: switching off the lights
39:33 - Regulation: is the state the problem or the answer?
41:05 - Cryptocurrency: the real game-changer
41:43 - Trump, crypto, and the church-state distinction
00:00:31 Andrew Keen: Hello, everybody. It hardly goes without saying these days that cybercrime is on the rise. Cyberattacks — everything from Somali pirates to ransomware — are increasingly making us fearful of going online. My guest today is an expert on cybercrime. She's the author of a book that came out last year in the United Kingdom with the title We Know You Can Pay a Million, and it's out this week in the United States — the same book with a different title: Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware. Anja Shortland teaches cybercrime and criminality at King's College in London. She's talking to us from Wiltshire. Anja, I don't suppose there's much cybercrime in rural Wiltshire, is there?
00:01:27 Anja Shortland: Well, wherever people are online, there is a possibility of it happening, and that's the scary thing about it.
00:01:35 Andrew Keen: Anja, I haven't known you very long. We just chatted for a couple of minutes before we went live. You seem an extremely nice person. Why would you get into cybercrime? What was so interesting for you? You're one of the world's leading experts on it.
00:01:48 Anja Shortland: So I'm interested in criminal markets. I'm specifically interested in extortive crime — transactions where you have a legal entity that has to make a deal with a criminal group. You can imagine that this is a really tricky transaction: there is zero trust, there is often not the expectation of a repeated interaction, it might be difficult for you to find out whether the people you're dealing with have a good reputation for delivering what they have promised. They've just victimized you, and you now have to engage in a negotiation over a ransom — whether that's over a hijacked ship, or a hostage, or a piece of art, or, in the case of ransomware, which is my latest project, stolen data.
00:02:45 Andrew Keen: For people just listening, Anja, I can't resist observing that you're half smiling when you're talking about this. I sense a frisson of maybe excitement or intrigue. As I said to you, what is it about all this? I mean, you have this new book out, Dark Screens, you teach at King's College — do you get excited by all this? Did you ever fantasize about being a hacking criminal yourself?
00:03:20 Anja Shortland: No. It's the world in between that I find fascinating — the norms, processes, institutions that fill the gap between the legal world and the criminal underworld. And yes, I really like the people. I like the inventiveness of the people who structure and order these really tricky trades. So that's what I find exciting. I'm amused by the idea that people find insurance boring, given that insurance comes into these markets to order criminality, to create structures for resolving kidnaps and hijacks and art recovery and ransomware resolution — they price this. So that's where my amusement lies, because normally people think insurance is boring. They're not thinking, well, actually, this is fascinating.
00:04:22 Andrew Keen: Maybe we can talk about insurance a bit later, because it seems to me, just as a general consumer, that insurance, at least in the United States when it comes to domestic issues, is breaking down. Steven Levy, one of Silicon Valley's most respected technology historians, has been on the show many times — an old friend of mine — wrote a book; it's perhaps his best-known book, Hackers: Heroes of the Computer Revolution, came out many years ago, published in 1984. And in this book, the hackers were the Steve Jobses and the Steve Wozniaks of the world, who were the heroes of the computer revolution. I know you kind of acknowledge that in Dark Screens, but you suggest that, of course, they're no longer the heroes — they're the villains. Is that a fair narrative of the history of hacking?
00:05:18 Anja Shortland: Yeah. I do start with these early hackers, and as Steven Levy says, with their ethic, with their excitement about this anarchic space that they are co-creating. And over time, yes, there is a real shift from explorative and co-creative hacking towards profit-motivated hacking. And then there is an even darker turn to destructive hacking, malware, wiping, and ransomware as well. So yes, there is a shift. But on the other hand, I don't really see the hackers necessarily as villains. I see them as people who are trapped in circumstances and games that are bigger than themselves, who often don't really get much of a choice about which side they're on. Sometimes it's not even considered a crime by the country in which they're placed. So for example, in Russia, theft and extortion is not a crime as long as it's directed at Westerners. And in North Korea, it's organized as a government department. So I think the crime and criminality side of it is really subtle here. We think it's a crime; they don't necessarily think it is.
00:06:48 Andrew Keen: Give us some numbers, Anja, about the size of this, quote unquote, industry. We're talking, I'm assuming, about many billions of dollars a year that are being extorted and exploited on dark screens. Is that fair?
00:07:09 Anja Shortland: That is fair. There are two sides to this. There is the profitability of it as far as the hackers are concerned — every year we're talking about a billion dollars that get transferred to the hackers' pockets. There aren't that many of them, so it's a lot of money for each of them. But on the other hand, the damage that's being done is a multiple of that. So it's like wrecking a car to steal a pair of sunglasses. It's more in the region of fifty to seventy-five billion dollars a year.
00:07:53 Andrew Keen: Where does it most break down, though? You mentioned insurance, extortion. As I said, when the book came out in the UK, it was titled We Know You Can Pay a Million. Is extortion and ransomware now the key element of our dark-screen economy?
00:08:17 Anja Shortland: That's the one where I'm an expert, so that's the one I focus on. And yeah, that is the really profitable business model. The reason we called it We Know You Can Pay a Million is because the hackers often spend a serious amount of time investigating the victim systems. They find out what their cash flow is, what their cash reserves are, how much they are insured for. And then they set the ransom demand at a place that's on the painful side of affordable. So it's an interesting one, because they know so much about their —
00:08:58 Andrew Keen: — business, usually. Anja, we often hear stories of old people in particular being extorted or ripped off by online crime. Is your Dark Screens mostly focusing on corporate extortion when you say "we know you can pay a million"? This is a message to corporations, as opposed to individuals who are often incredibly vulnerable, especially old people.
00:09:26 Anja Shortland: Yeah, so they're different things. There's the fraud that mostly targets vulnerable people — people who are looking for love or companionship on the internet. That's not what this is about. This is about criminal gangs taking servers hostage, encrypting them, and then offering to decrypt them for a ransom. And they may also have taken away some data that you might really want to keep private — exfiltrated, storing it on their own server — and say, you might not need a decryption key from us because you've got good backups, but on the other hand, you wouldn't want your patient data or your customer data or your patents to go missing or be sold on the dark net, so you must engage with us on that one. So it's a different business model. You say it's a corporate problem. Yes, you could say so. But the reason I've written the book is that the way into corporations is often the employees who divulge a password, who let somebody in, who have a guessable password, who click on a link, who fall prey to a phishing email. So it is something where, as individuals, we can really do a lot to improve our collective cybersecurity.
00:10:54 Andrew Keen: You stepped into the dark screen, so to speak, Anja. This is not just the work of an academic, an expert on criminality, who sat in your chair in King's College in London and wrote this book. You actually talked to many of these, quote unquote, heroes and hackers, and you got into the shadowy world. Tell me what you did to write this book. What were your experiences?
00:11:27 Anja Shortland: So as I said, I've been in this world of extortion and extortive crime and crisis response and crisis resolution for a while. I was part of the ransomware task force, as an observer, so I've been part of the conversation of how to increase cybersecurity for a while. I've been mostly working on the side of cybersecurity, cyber insurance. I am obviously interested in the way that criminal organizations work. I think it's a fascinating problem. How do you run a criminal organization where you only know the nicknames of your employees and associates, who can just ditch that nickname? What creates the trust in that space? But I'm there drawing on the research of my colleagues. So I've not gone into the dark world. I've stayed within my shady comfort zone.
00:12:36 Andrew Keen: But did you take risks for this book? Did you talk to some of these hackers?
00:12:43 Anja Shortland: No, I didn't. But that doesn't mean I haven't taken risks. This is inherently risky.
00:12:49 Andrew Keen: So what then is the book focused on? It's a general-reader book. It's not an academic book. What do you focus on in Dark Screens?
00:13:02 Anja Shortland: So it's a history of ransomware, told through the stories of some of these [unclear] — design flaws were built into the internet? What is the role of cryptocurrency in this economy? I start in 1989 with the first piece of ransomware, but it takes until 2013 for all these problems of how to encrypt, how to encrypt each system separately, how to take payment, etc., to really be resolved. And then from 2013 onwards, I talk about the several generations of ransomware and that cat-and-mouse game, the arms race between cybersecurity and the hackers.
00:14:07 Andrew Keen: And how many of the vulnerabilities you're writing about — they were built into the architecture of the original network of the internet and of the web. Is that fair?
00:14:21 Anja Shortland: That's right. I talked to some of the first-generation designers of the internet, and they're just really wonderful people, mostly academics, who —
00:14:32 Andrew Keen: Did you get to talk to Berners-Lee?
00:14:35 Anja Shortland: No, I stayed in the UK. The systems that got abandoned in that drive for the most frictionless communication — for a sharing type of place where good people were sharing important and fun information — they're absolutely dismayed when they realize that their wonderful invention could be used for mischief, primarily by students initially, but it just never occurred to them. So since then, security has always been a bolt-on solution, and it's quite clunky, because everything has been created around the most frictionless communication protocol that we could come up with.
00:15:24 Andrew Keen: Anja, how could these people, these pioneers — they were clearly highly sophisticated technologists — how could they have been so naive?
00:15:35 Anja Shortland: They just were. They just were. But it's also that that was the goal that was being set to them; that's what they were chasing. And they didn't stop to reflect on whether that was a great idea. And students just voted with their feet — everyone wanted to be on the internet. For a long time, the National Health Service in the UK, for example, had its own service. And it was the professors at the university hospitals who said, this is really clunky. We don't want to have to swap computers between our teaching work and our research work. So they gave up the security that a separate system would have afforded them, for the convenience. And that's an important trade-off.
00:16:31 Andrew Keen: We are speaking with Anja Shortland, the author of Dark Screens. The book is just out in the United States — Hackers and Heroes in the Shadowy World of Ransomware. I'll take a short break, and then we'll come back and talk more with Anja. I want to ask her about the Russian economy — again, quote unquote, economy. It sounds increasingly like a ransomware economy. And I also want to talk about AI and the impact of AI. We'll talk about Mythos AI and ransomware and the future of hacking in an AI world. So don't go away, anyone. We'll be back in about two seconds. This is not a commercial break. That's because we don't have commercials on this show. I'm not gonna waste your time trying to sell you inane products. However, I do have a pretty good deal for you. I'm writing a book about the United States. It's due out in 2028. And if you become a paid subscriber on my Keen On America Substack, you'll not only get very cool notes and photographs and videos from this project, but I'll also send you a personalized signed copy of the book when it comes out in 2028. So go to keenon.substack.com and become a paid subscriber. That's keenon.substack.com.
And now back to our conversation. We're speaking with Anja Shortland, the author of Dark Screens, a fascinating new book. It's out this week — Hackers and Heroes in the Shadowy World of Ransomware. Anja, in the first part of the conversation, you suggested that hacking — or at least corporate hacking — has become normalized in the Russian economy, maybe the North Korean economy too, where it's not even considered a crime. Is that really true? Is that official policy, or is this just an unspoken truth?
00:18:47 Anja Shortland: It is more of an unspoken truth, but the fact is that there are firms in this space which you wouldn't necessarily expect. Crime is branded. These firms build reputations, so they say, we are Conti, we are LockBit, we are CryptoLocker. They exist very openly. The FBI keeps telling the Russian authorities who these people are, where they live, what their tax number is, and they simply don't get arrested. Some of these places even have a physical presence, with office space in Moscow or St. Petersburg. So it's just an unspoken policy that, as long as no Russian citizens are victimized and nobody who's using a Cyrillic keyboard is attacked, the Russian law enforcement will not usually take action against them.
00:19:52 Andrew Keen: Anja, the war in Ukraine, the Russian invasion of Ukraine, is often associated as the first drone war. But to what extent is it also the first hacking war? Of course, the Russians also had their so-called first hacking war against Estonia a few years ago. But to what extent are these — and I use this word carefully — tools of hacking of this unofficial Russian state being used in the war in Ukraine?
00:20:23 Anja Shortland: There are some ambiguous effects here. Before the war on Ukraine, these ransomware groups often had both Russian and Ukrainian members — Russian-speaking Ukrainian members. And the war really threw a spanner into the works of that, and a non— [unclear]
00:20:42 Andrew Keen: So to speak — the spanner. Right? A metaphorical spanner.
00:20:46 Anja Shortland: Indeed. But people fell out. One of the really most interesting leaks that came out of the ransomware world, where we really found out the inner workings of one of these ransomware groups, was when Ukrainian patriots started leaking the internal chat documents of a group called Conti. So we know a lot about how this group operated, who was in it, who they were targeting, how they were targeting them, what they were thinking as they were running this rather odd business. So for a while, the war in Ukraine actually reduced the amount of hacking activity that came out of broadly that space within Eastern Europe. But of course, yes, both the Russians and the Ukrainians have been hacking each other pretty mercilessly for many years now. And the first instance of something that some people term ransomware — the NotPetya virus — was deliberately released by Russia into Ukraine. It caused massive damage globally because it was a computer worm that crawled indiscriminately, from Ukrainian servers to companies that were active in Ukraine and then onto their servers in Europe and North America, and caused billions of dollars of damage.
00:22:21 Andrew Keen: I don't suppose Putin is a hacking expert. His background, of course, is more analog KGB. But I assume, Anja, that there are now some very senior people in the Putin regime who are highly literate in all this. This is not just a few kids in hoodies, is it?
00:22:45 Anja Shortland: It is not, but the kids in hoodies are very useful to the Russian intelligence and security effort. There are indications that, if they've reached an interesting target, they are cooperating with the Russian government and its security apparatus, for sure.
00:23:10 Andrew Keen: You mentioned Cyrillic keyboards. Of course, the Russian-Ukrainian war is a war of Cyrillic keyboards. There are other Slavic states, Slavic countries where hacking seems to have become almost a national interest, a national industry. Montenegro comes to mind. Is there something — I don't mean to sound anti-Slav here — but is there something that comes naturally to countries like Ukraine, Russia, Montenegro about hacking? Or is it just a consequence of our global economy and the reality of where power lies?
00:23:51 Anja Shortland: I think it's a combination of excellent education in computer science and a lack of great job-market opportunities in the legal economy within Russia and that sort of Eastern European space, and a geopolitical climate in which, if you're applying with a Russian passport, the American dream remains unreachable. I have a really lovely chapter about two young men, teenagers, who wanted nothing but to come to the United States to live the American dream and work in computer security. And they just could not get a green card until the FBI ran a sting operation against them. They extradited themselves to the US. They were tried there, and one of them now lives a very happy life as an American IT specialist, which is exactly what he wanted all along. He just had to go that route by way of prison.
00:24:59 Andrew Keen: That's ironic. I want to talk a little bit in a second about hacking in the West. It's not just a Slavic phenomenon. But it doesn't have to turn out that way. You don't have to become Russia or Montenegro. There's the Estonian model too, isn't there? I'm not sure if you deal with Estonia in the book, but Estonia, of course, was, from a technological point of view, the most sophisticated part of the old Soviet Union. When it split off, it became a digital innovator, and their economy is not rooted in hacking — or at least illegal hacking. It's very much based on innovation. Some of the most innovative companies, some of the most profitable companies, certainly in Europe, on the digital front have come out of Estonia. So there is an alternative. What does the Estonian model, or the Estonian route, tell us about perhaps a happier ending to the hacking story?
00:25:58 Anja Shortland: Well, first of all, they didn't have to worry so much about where they're going to apply their skills, because within Europe they had a chance to immigrate to places where their skills were useful. And then they were able to create enough capital to take back to Estonia and start up their own companies. It's about the integration. It's not an adversarial system, where if you're Russian, you are excluded almost automatically from all opportunities in the West. Whereas as an Estonian, you're a welcome citizen anywhere across Europe and beyond. So there's a lot of geopolitics in where hacking turns nasty, and quite a lot of people don't get a choice on which side they're on.
00:27:03 Andrew Keen: And when it comes to that, not having a choice on what side they're on in geopolitical terms, I assume that many of the issues that you write about in Dark Screens are particularly relevant today — not in the context of the Ukrainian war, but in the context of the war in Iran, the American-Israeli war in Iran. Israel is also an important player in this shadowy world, aren't they?
00:27:29 Anja Shortland: Yes, mostly on the computer security side. They're really excellent. But again, they have the opportunity to be on that side. I am indeed rather worried about Iranian hacktivists. At the moment, we're not seeing much hacking out of Iran, because they've switched off the internet for political reasons. But once they're back, I think we might see quite a lot of hostile activity emanating from Iran. And in the UK last year, we had two major attacks — one on the supermarket Marks & Spencer, and one on a big industrial company, Jaguar Land Rover. They were both perpetrated by British and American teenagers and young men, but the malware they were using to encrypt the system, the ransomware system, came from a group called DragonForce, which is Iranian-sponsored. So yes, they do have that weapons-grade malware that can be used by anyone who's got an axe to grind against the West.
00:28:45 Andrew Keen: How much of the principles, the cheerful anarchy of Jobs or Wozniak, do you find now in some of the hackers in the West? You mentioned these kids using Iranian malware to hack into British or American companies. Is there still some of that original — and I use this word carefully — idealism, sense of fun of hacking, in the United States or Britain or Germany or France?
00:29:15 Anja Shortland: There are two steps here. The one is the hacking stuff — how do you get in? And yes, I think there is some sort of teenage exuberance, not really rationally thinking things through. And then there is what do you do with the access? Do you sell that access for profit to somebody who knows how to monetize that? And that's what this Iranian group was able to offer to these teenagers, at which point this turns completely dark, of course. Because it's extremely difficult to operate a supermarket where all your systems are encrypted, and you don't know what's been sold, what's been ordered, what's in the warehouses, and everything comes to a standstill, and then you sort of slowly start to create some workarounds. The thing with hacking in the West, of course, is that it's not impossible — it's not that difficult — to find out who is behind the screens, which is why my book really focuses on the people. The question is what happens when you tell the police who's hacked into a system: whether they're going to knock on the door and arrest that person. And they arrested those British and US teenagers. That's something that's not possible in Russia. So we can stop the cyber mischief in the West at its source, given the right amount of resources, which are usually available. But we can't stop it at the source behind what was, what's the Iron Curtain, and starts to look again like that.
00:31:04 Andrew Keen: There was that famous remark — I think it was by Jesse James, the American bank robber, when he was asked why he robbed banks. And he said, because that's where the money is. In the old analog days, of course, American and British thieves robbed banks. You think of the Kray twins in London. We grew up on that mythology. Presumably today — and there's much organized crime, domestic, in the UK where you are, and in the US where I am; the Mafia, of course, has a long, dark, complicated history — presumably more and more organized crime is focused on the digital sphere. Is that fair, Anja? Do you deal with Western organized criminality much in Dark Screens?
00:31:55 Anja Shortland: Not so much. Because while it was there, it's generally possible to find the people, apprehend them, and punish them. Yes, it does exist, but it's much more profitable and lower risk to run this kind of operation from places where the state either doesn't care or actively encourages or is unable to do anything about it. So you were talking about fraud-type operations, the scamming type of operation — a lot of them coming out of Nigeria or that Golden Triangle, Cambodia, Laos, Vietnam, where there just isn't that much enforcement. That's what makes that kind of crime really attractive.
00:32:54 Andrew Keen: But if you're a British criminal — and Britain has a long history of criminality, mythical and otherwise — and you want to commit crimes on the internet, you want to get into ransomware, do you go and live in Nigeria or Russia? Are you suggesting it's actually quite hard to do from the UK?
00:33:16 Anja Shortland: I think you can do it once or twice, and then they'll find you. That's the message from my book. Yes, you can do it, but law enforcement is good enough to stop you sooner or later.
00:33:33 Andrew Keen: So, are you saying — sometimes the British police don't have the best reputation for their intelligence — but are you suggesting that British and American law enforcement is actually relatively sophisticated when it comes to hunting down hackers?
00:33:50 Anja Shortland: Well, they don't have to do it on their own, which is another really nice thing that I observe in this space. You say I sound like a nice positive person. Yes — I see a public-private partnership developed where IT security says, well, we can help. We can track this down. We can tell you what's going on. But we don't have the resources or the powers to do bad things to the hackers. So there is that cooperation, which works really quite well.
00:34:26 Andrew Keen: How much will AI change everything? A couple of weeks ago, there were many stories about Anthropic's Claude Mythos. They wouldn't let anyone use it. A secretive AI, a hacking system, according to the Washington Post, that sparked a global scramble. What do you make of Mythos and what it tells us about the future of dark screens, of hacking? Is this an answer to all this criminality, or does this suggest that actually the future is going to be even more dangerous?
00:35:06 Anja Shortland: The history of ransomware is one of two sides in constant competition with each other. So Claude Mythos at the moment seems to be held relatively closely, in the hands of people who are interested in computer security. And it's very good at finding vulnerabilities. So if you know what your vulnerabilities are, you can fix them. And the idea has been that that's what Claude Mythos is going to be used for. Great if you're a bank and a really well-resourced financial enterprise, or a firm that really got their act together when it comes to IT security. The problem, of course, is that hackers are eventually going to get it. And it's unlikely that Wiltshire County Council or a local hospital or a dental practice or a legal practice is going to be able to do anything much with Claude Mythos, whereas the hackers will. So it's going to create a lot of — it's not just hackers but hacktivists as well who have a political message. So I am really worried about where this will go. And I'm worried that we haven't had the debate of how we're going to mitigate the problems when part of the critical national infrastructure goes down because effectively it's easy to attack.
00:36:48 Andrew Keen: So was Anthropic right not to allow anyone to use it? I don't quite know why they even announced it or released it. If they had something that was so dangerous, why not just keep it secret?
00:37:01 Anja Shortland: Indeed. I think part of it was leaked. So I think that hand was forced. But yeah, I mean, that is what AI is good at — scanning for vulnerabilities, capturing the flag. It's something that if Anthropic doesn't release it, then somebody else will find it. At least this one's given us a little bit of advance warning about what's around the corner. But what proportion of vulnerable enterprises and people are able to use it to fix all of these gaps? I don't know.
00:37:42 Andrew Keen: What's your feeling, Anja? There's a recent story — a number of people who work at Google don't want their AI, their Gemini AI, being used by the American military state for wars overseas. Anthropic — Dario Amodei got involved in a debate, a controversy, with the American state on the same subject. What's your fear about the way these hacking technologies will be used in AI terms, in terms of war? I mean, should we be existentially fearful?
00:38:23 Anja Shortland: In my opinion, you don't need B-52s and B-2s to bomb a civilization back to the Stone Age. And if anyone is threatening that to anyone else, they should be very careful that the lights don't just get switched off, by targeting power stations or something like the Colonial Pipeline incident in the US, where suddenly gasoline supplies on the East Coast of America were imperiled. So yes, this is powerful.
00:39:03 Andrew Keen: And finally, does that mean we should have more or less regulation? I know your new book, Dark Screens, doesn't really deal with the issue of regulation. But with AI and its potential power, its destructiveness — in terms of your research and your work on dark screens, on the criminality online, on ransomware — is the state the problem or the answer? More regulation?
00:39:33 Anja Shortland: I really want to start the debate. That's my wish for this book — that people will read it, they'll be interested in it because it's about people and about fascinating people, and they will get the language and the ideas of us not being helpless in these matters. There are trade-offs between how safe we are and how open our economy is and how resilient we are and how much that's going to cost. So I just hope that people will engage with their politicians and say, what is the plan? Where are we going with this? Have you really thought through this? Or are we just burying our head in the sand? That's not good enough. This is really dangerous. And we want to see some contingency planning. We want to see how resilient we can become, whether we've made the right trade-offs. And yes, to what extent AI is being put into the hands of hackers and hacktivists is very much part of that, if we can get that genie back in the bottle.
00:40:47 Andrew Keen: Well, you started the debate, Anja. I take your point on wanting to start the debate, but what would you tell your local politician or your local tech chieftain — or maybe Silicon Valley chieftains — about putting that genie back in the bottle? Is it possible?
00:41:05 Anja Shortland: I think the genie that needs putting back in the bottle will be cryptocurrencies, which have been such a wonderful —
00:41:12 Andrew Keen: Another subject, yeah.
00:41:14 Anja Shortland: — for criminals to take payments without pretty much any impediment. That was the technology that really changed the game in the world of computer crime. So we have more chances there, I think, of regulating that world. And it would take the profit motive out of a lot of the things that I'm studying.
00:41:43 Andrew Keen: And of course, in the United States, the current administration — certainly the president and his family — are very much involved in cryptocurrency. So perhaps this distinction between the state and ransomware and hacking in the West isn't quite as church-state clear as we'd like to think.
00:42:07 Anja Shortland: No. I'm sure that anyone with a criminal intention has been celebrated by US members of the government's stance towards cryptocurrency. But to me, in my book, that is really the turning point where cybercrime takes off.
00:42:34 Andrew Keen: Well, there you have it. Very worrying and intriguing at the same time. Anja Shortland's new book, Dark Screens: Hackers and Heroes in the Shadowy World of Ransomware, is out in the United States this week. Congratulations, Anja. Keep doing this incredibly important work. Someone's got to do it, and you drew the short straw — and you're doing a great job. Thank you so much.
00:43:00 Anja Shortland: Thank you. I'm actually enjoying it. And thanks for your questions.