Drones, AI, and Autonomous Failure | Full Interview with Chad Butler

Welcome to the Security Cocktail Hour. I'm Joe Patti

I'm Adam Roth.

Adam, we've got something really exciting today because we've been talking about drones on a lot of episodes and we have a guest on who knows how to break them seriously and he's going to tell us a little bit about what we should really be worrying about. We've got Chad Butler. Chad, welcome.

you

Thanks guys, thanks for having me on. Appreciate it.

just want to add, Joe pointed out you know how to break drones? Joe just broke his own drone, but that's another story.

Yes, once again, I've had to admit that this was my third flight, is what it resulted in. I'm pretty good at security, but piloting is not one of my skills. So, what can you do?

Yeah, I've broken a few joints.

no.

You know, it's funny, I had a brother-in-law that ⁓ I watched his drone fly off in the distance. I thought he kind of had control of it. Turns out he didn't. And we watched it fly off into the sunset, maiden flight, never saw it again. it just kept going really fast. It wasn't super expensive. It was probably a couple hundred dollars. wasn't too bad, but still.

But Chadi been

Yeah

It just kept going?

How expensive?

You know the funny thing is is that people like I'm gonna get a cheap drone because I want to get a cheap drone to experiment if I break it's not to be that bad the truth of the matter is and watch I'm gonna get so much hate mail I wish I would get some mail but um the more expensive drones I'm not saying like you want a $25,000 drone but like maybe $600, $700 and up those drones have collision avoidance really good return to home

You know, like really good stability. You know, the chances of ruining that drone, I mean, you kind of have to crash it to crash it. You know, the less expensive drones, well, they don't have collision avoidance. They don't know where to go. They like boom, goes into a tree, hits the ground.

Yeah.

Well, Chad, you've been in the drone, you've been associated with them, working with them for quite a while. And I don't know, do you actually fly them too?

you

⁓ not as much as I used to. I've got a drone. I don't have as much time as I used to have. So it sits, ⁓ it sits here most of most of the time, unfortunately. ⁓ I would like to fly more.

you have been sounding the alarm about some things that can go wrong with drones and things that we should be worried about that, you know, we've been getting into it and I haven't heard that your take on it before. ⁓ So, you know, tell us

what should we be worried about besides terrible pilots like me crashing into stuff.

my involvement with drones was back in, about 2018. So I was working at Amazon. It was at AWS doing product security and, an opening came up to lead security for Primair, the drone delivery program. And, you know, I'd heard about Zipline and some of the things that they were doing to deliver, you know, blood for transfusions to remote clinics in Africa.

⁓ you know, where they could, it might take two or three hours to get there by car, but they could get it there within 30 minutes. And I was like, this sounds awesome. I want to be involved with this. ⁓ So I was more involved on the, you know, the commercial package delivery or, you know, drone, delivery by drone aspect. ⁓ And so I went into that situation knowing that, well, at the time, what we thought was that we were going to launch imminently.

and that I was going to build a program to make sure that everything was going to be secure. And that included everything from the traditional kind of cloud security aspect of, you know, how do you run all of the routing and the delivery stuff that has to happen in the cloud to what's actually running on the drone itself, the hardware, as well as the software, and then the compliance aspect of, you know, how do we do

How do we comply with an FAA rule which has not been made yet? How do we look around the corner and try to figure out what they're gonna expect? ⁓ And so that was kind of my involvement. That was years ago. I've kind of kept in touch with it a little bit. And of course it all kind of merges together. There was autonomous drones, but then self-driving vehicles, autonomous vehicles, that's very similar. And now with AI we see

a lot of the same things, right, with agents doing things that humans used to do. And so that was kind of the landscape of where this sort of resurfaced for me. And I saw, I think it was a Reuters article that said Amazon had pulled out of the Commercial Drone Alliance ⁓ organization, which is kind of like a conglomeration of a bunch of different drone delivery companies.

who were trying to lobby the FAA to get rules that will work for their organization. And Amazon pulled out of it. And as I looked into that, ⁓ I could kind of read between the lines a little bit. I saw a little bit more, ⁓ I guess you could say I saw the story behind the story, which was the Commercial Drone Alliance was arguing that the rules or the proposals that the FAA put out were too stringent and too strict.

you

And they were lobbying for something that was a lower requirement. And the problem is what they're arguing for kind of removed a key control that made GPS spoofing and drone capture and takeover easier to pull off. And so that's when I kind of raised my hand and said, you know, we shouldn't be lowering the bar just because it's

maybe harder and more expensive because these are, you know, flying objects that are kinetic objects that when they fall on people or things, they cause damage or injury. So that's kind of how I came into it.

And we should kind of level set to say, we've talked about the different sizes of drones and things. When we're talking package delivery, it's got to carry a package. mean, not like a TV set, but these are sizable vehicles. If they crash into something, it's going to be trouble.

Well, let's talk about sizeable vehicles. We're talking about now. Last week, there was a test in ⁓ York City to carry a person in a drone. It's a drone taxi. Yeah. Yeah. So there's a drone taxi. Yeah. Yeah. Yeah. So the problem is, there's two types of classes, coach and then there's first class. Coach, you have to hold on to the drone. Yeah. Yeah.

Yeah.

There was? Oh, the taxi. Oh, okay. I thought you meant like someone hanging down from one of the things to see if they could lift him.

Yeah.

I you hanging outside.

You

First class

you it so you see inside the drone if you pay too little it's outside the joint to hold on via dear life But this but seriously the the dro the person's a package the drones like a quadcopter guess and it's carrying somebody from a helipad to to to I think I we would have got delivered to that's the size of a package. That's like at least well for me It's like at least 150 pounds

But for somebody else, it might be 250, you know? All right, I'm not 150 pounds, but you know what I mean.

Yeah.

Yeah, I mean, but even on the on the smaller drones, I mean, if you're carrying a five pound package, you know, and doing a 30 minute delivery, like, you've got to you've got to have a sizable drone to carry that. And then you talk about the batteries that are required. ⁓ That takes a lot of battery. And so you know, you've got the weight of it, but you've also got these

Yes.

out.

batteries that are flammable and somewhat explosive. like, so there's, there's a lot on these things and that, you know, big, big spinny blades that, when they come in contact with flesh ⁓ do damage, right? So like, and I'm not trying to be an alarmist, but I like, I've been up close to one of these things when it's operating and it's, it's kind of scary, you know? And so, ⁓ right.

They're not toys. you know, it's

still an object that's kind of heavy heading towards you. It's going to hurt.

So the good

news is for a lot of these law enforcement programs, the drones have had very little issues at all. But what we're talking now is we're talking about going away from municipal or law enforcement now to commercial, which opens up a whole new brand of stuff. Typically, in order to be compliant, you have to do visual line of sight. Now it's beyond visual line of sight if you're doing package delivery.

And where I live, you can't fly a drone at all. It's illegal to fly a drone, not because of the FAA, but because the local law enforcement agency controls that airspace. In order to take off or land, you require to get a landing and takeoff permit, unless you fly in a park in New York City. So if you don't fly in a park in New York City, you're not allowed to fly anywhere else without getting a permit to land and take off. That's just how it is. So it's going to be very interesting and very, very

Right.

dense populations. And then the issue is you have to contend with helicopters, airspace for airports. We have three major airports right here and some minor airports. That's a lot of airspace to be careful of.

Yeah, and if you look at, you know, regulation wise, up until, well, it's still the case that part 107 from the FAA is what's required to do commercial flights, right, to pilot a drone and do so for commercial reasons. Part 108, so part 107 allows you to do that, but you have to remain in visual line of sight at all times, ⁓ unless you have a waiver. So for the last... ⁓

what's it been since 2016 up until 2025 and still ongoing, you had to go through a waiver process, which was very involved, very expensive, which means the only organizations doing that today are the ones that can pay the big dollars to go through that process. The FAA wants to get through part 108, which allows beyond visual line of sight for everybody else, right? And so, we're kind of at this point where

when part 108 goes live, then presumably it'll be much easier for drone deliveries to happen or commercial drones to fly beyond visual line of sight, which you would assume would mean we would have more drones flying beyond visual line of sight in our shared airspace, right? So that's kind of the landscape of where we're at with this.

And then when you have dense populations and then now look at it this way, right? I know it's a one-off, but we have ⁓ FIFA coming to the Tri-State area in New York City, New Jersey. And it's very hard to distinguish between what is considered a safe drone or a non-lethal threatening drone versus out, you know, a commercial delivery drone. So if you started having commercial delivery pre-FIFA in New York City,

Mm-hmm.

Who's you have to really monitor that airspace? I guess they would have Lisa put in and they will put in the put in no flight areas ⁓ And then Joe knows I got it I started getting into SDR so for to find radio to detect drones But detecting drones on a commercial enterprise level you got to spend a lot of money to get the right products So I'm not going to mention products. I don't want to but you know it's really important to have really good control of the airspace especially

you

and areas where the UN is and other major ⁓ VIP locations.

Mm-hmm.

Right. And where it comes down to, mean, so not to do like a history lesson here, but basically the FAA has been promising part 108 for years. I think they were supposed to release it in 2022 and then in 2024. And then there was an executive order that said, OK, you got 240 days to get this done.

⁓ And then of course there was the government shut down. So it pushed it out longer. And so they they released it and released it for public comment. And I think there was something like 900 and 900,000 total comments ⁓ between several comment periods of people who were concerned with, you know, what was going on. So ⁓ March 16th was the deadline. Obviously that's come and gone. So so it's late. But I think the

One of the major points of contest is, ⁓ okay, you're flying beyond visual line of sight. there's still an operator back there somewhere, but they can't physically see the drone. So ⁓ how do you account for the fact that you don't have a pilot with physical eyes able to see what's happening where the drone is flying? What do you need to put?

in that drone to make sure it's safe enough to account for the loss of a pilot or the lack of a pilot. And the contested point here is some folks are saying, well, ⁓ these drones should just have right of way and all of the other aircraft should have to detect them and route around them, right? And the reason Amazon pulled out is they said, no, ⁓ drones should detect and avoid other aircraft or objects, right?

And so their point was they had data that showed that there were two mid-air collisions that were avoided because of detect and avoid that would not have been avoided had they not had that. So, Adam, you mentioned SDR. ⁓ They're saying, let's just have drones emit ADS-B, ADS-B out, and then all of the other aircraft can see them and route around them, right?

you're-

Yeah, yeah.

Give the drones the right away basically. mean, I'm simplifying and I'll probably get some hate mail from this as well because I'm sure there's some nuance that I'm glossing over there. But that's kind of the issue. And the problem is, ADS-B out, like anybody with an SDR can capture that and it gives you location, it gives you heading and speed and all of that stuff, which is what you need if you're trying to spoof a drone's GPS and take control of it.

Correct, absolutely.

So you're

⁓ yeah, wow.

giving data to people who could spoof, but then you're also saying, ⁓ maybe let's not have the control that would see an object and route around and avoid it if it was going off course.

Yeah,

to me, I mean when you think of right of way, just like, know what, from being in a car, just think about how many times you avoided an accident because the person who had the right of way did something stupid. Or you had the right of way and you backed off and said, you know what, it's whatever, I'll let him go.

I mean, it would be disastrous without people exercising that kind of judgment.

I one better.

I'm a threat actor. I get some small drones. I get about 10 of them. I turn around, I launch them. Maybe I rob a bank. I shouldn't be saying this, but then all of a I have right away. And then law enforcement or wherever else is coming and they have to avoid me because I have right away. So now I've technically were able to create a gate that

you

law enforcement through a helicopter can't come. But I mean, there's so many different risks, my thing is life safety is always important over a package. If there's a soul on the plane, there's a soul on the helicopter, that gets right away over everything else in my opinion, but that's just my opinion.

Okay.

Yeah.

1%. And the other thing is, mean, like there's this assumption that human pilots could see the drones, right? And I think the people that are arguing for it are saying, well, yeah, they'll see it. It's a human, they're pilots, they're trained, they'll route around it. But, Henry Riddle did a study where they looked at the detection rate and like the overall detection rate was 30%. Moving drones, they saw it 50 % of the time stationary.

was like 13 % of the time. So there are already studies that show that pilots just can't see them. They can't see them with enough accuracy or consistency for us to say that like, this is good enough, right? And I get it. So I released a YouTube video a few weeks ago where I talked about this. And ⁓ I got a lot of pushback and quote unquote hate mail. ⁓

Yeah.

And I get it. I think it legitimately makes it more difficult for ⁓ commercial operators who want to do this because the technology to detect the void is expensive. It adds more weight. It's harder. All of those things. I get it. It's inconvenient. But if you're talking about a drone colliding with an aircraft that

where there's a human being on board. Sorry, I don't know. I'm not really sympathetic to it costs more, it's really hard, it's expensive. Like, sorry, you should just do that.

Yeah, I don't blame you. mean, you know, we've been talking about soon there's gonna be a lot more drones in the sky, you know, especially if that part 108 comes along and just the idea of all these multiple things out there going and you know, three dimensions, all of them, assuming they have the right of way and just going without any intelligence or sensors. think it's insanity. I can't believe anyone would promote that. That to me is just totally nutty.

Look at Miracle in the Hudson, right? The plane was taken down by a bird strike. If a drone shouldn't be at a higher, I mean obviously we're talking about FAA 107, I'm sure there's other drones that fly higher, but at 400 feet to max, and that's depending on where you are in the airspace. If you're near an airport, it might be 200, it might be zero, it might be something. People who are not licensed typically, they don't go online and say, hey,

I'm only supposed to be at 300 feet max, you know, they don't do that. But so you take your drone up, plane comes along, gets sucked into the engine. What happens? It's like a bird strike, right? So people, it's very different these days. You go into one of those websites, you buy a $300 drone, $400 drone, you're already flying. If it's under a certain amount of grams, you don't need a license, especially if you're not using it for commercial. And then people are flying it not realizing

Mm-hmm.

how dangerous it could be is if people take it seriously, I'm sure we'll be okay. But there's some hobbyists that are just doing crazy things.

Yeah. Yeah. And I mean, you could even go back to what was it January 2025 when that ⁓ commercial jet collided with the military, the Black Hawk helicopter in DCA that wasn't emitting ADS-B. So I mean, there are

yeah, yeah, yeah.

Even today, to make the assumption that everything is going to have ADS-B is like you can't rely on that. There are military aircraft and that was in a very busy airspace. That should have been very well controlled and tightly coordinated, but it still happened. And what about hang gliders and all of these other things? ⁓ And frankly, even if you do have detectin' void, you're still gonna have issues.

So I live in Arizona and there's drone deliveries going on out here. one of Amazon's drones hit a tower crane boom, right? Just ran into it. And then a few minutes later, a second drone hit it as well. you know, like these are drones that are equipped with all of that technology that's supposed to help avoid those types of things. And it still breaks down. So it...

We should be doing everything we can, not trying to certify to the minimum bar. Like this is a human safety issue, we should be raising the bar consistently to avoid those types of issues to the extent possible.

I agree. we make risk decisions in cybersecurity and all, but the risk calculation changes a lot when you talk about lives and safety and that sort of thing.

But Chad, now, if I understand a lot of your work, we've been talking about drones so we can get the drone hashtag and all, our listeners like it. But also,

Mm-hmm.

If I'm not mistaken, you actually talk about a lot of these issues with autonomous systems in general, not just drones and not even necessarily kinetic systems.

Yeah, I've spent the majority of my career in product security, and it's mainly been on software side, building secure software applications, all of those things. ⁓ More recently doing that with AI, figuring out how do you build secure software with AI coding agents? ⁓ You don't have to look very far to see issues that come from that.

But a lot of the concepts are the same. And I found the same thing going over to Primair. I'd spent a lot of time doing software, very little time doing hardware. I did a few projects at AWS that were hardware related. But what I found is that the principles are very similar. You have data coming from trusted or untrusted sources, you're doing something with it, and you're taking actions as a result of those things.

Hardware is very similar, whether it's you're data or sensor data from GPS or LIDAR or radar or magnetometer or whatever, and then determining ⁓ is this data source trustworthy? And is it trustworthy enough that I can make routing decisions with confidence that I believe will get me where I need to go without causing any issues in the process?

It's a lot of similarities there.

It's ironic because today on LinkedIn, ⁓ one of my colleagues from my university, he was talking about, can't wait to know, how hard is it to start hacking AI robots? like, ⁓ I can't wait to do it. I'm like, it's being done now. And what we talk about is untrusted sources, because not everything is locked down. It's very similar to a computer, right? You might have a USB port open. You might have a keyboard.

You might have Bluetooth, you might have Wi-Fi, and these autonomous vehicles are pretty similar, right? If they get an untrusted source, if you're connecting, I mean, even an embedded AED, a defibrillator, in somebody's body, you can control that with ⁓ near-frequency communications that supposedly are supposed to be vetted. ⁓

Mm-hmm.

you you

So what I'm getting at, yeah, and it's happened, right? That's why we talk about like, you know, if somebody has

That's scary.

an AED, and in my case, I had a family member that has an embedded AED and they were overclocked. And what I mean by that is, instead of maybe being 60 beats per minute, was 70. And then when we went back to that hospital, like who did it? They said, we don't know. And this really happened. They ended up being hospitalized because the

Wow. ⁓

the defibrillator, the, its rate was, ⁓ was higher than it should have been. So that's one case of,

of an IOT embedded device that did that. Now, if you have a drone and you're a threat actor and you're able to get into that, however it is, whether it's alternating the GPS to make it believe it's somewhere else. And then when you alternate it, says, I'm gonna take the fastest route.

Okay.

and they end up flying into something because they think that's the fastest route and they don't see that object,

you

well things can be done like that so we have to be very careful.

And one of the things that I keep seeing, unfortunately, both in autonomous vehicles and drones, as well as AI, is we're trying to make these systems safe and behave safely in kind of optimal environments. And we're still having trouble, you know, the...

proverbial ball goes out in the road, the kid chases it, you know, do we detect it? Do we do the right thing? ⁓ you know, there, there's still things in the natural environment that we, I think the autonomous systems aren't handling well all the time, right? And that's, that's understandably, there's a lot of, ⁓ it's very understandable. There's a lot of variables out there, but my thing is we, we haven't even really gotten to the point where we're saying, okay,

Well, now let's deal with the threats of somebody who maliciously wants to take control of this or do something bad, right? There was a research paper a few years back, I believe, I think it was a research team out of China who showed, you know, very simple, paint over a white line and paint a new white line driving the car off of the road.

And will the car follow that? And I think they were using like a ⁓ special type of paint that was kind of like photo luminescence or whatever so that it didn't really look out of sorts until the lights were off. But the response from the autonomous vehicle industry was, yeah, but nobody's going to do that. That's not a realistic environment, which is what we hear in security all the time. Hey, you've got a vulnerability.

wow.

Yeah, but that's really hard to exploit. Nobody's going to do that. and of course the three of us know, and probably all the people watching this podcast know that the moment you say that it's, you know, that's really hard. Nobody can do that or nobody will do that. It incentivizes everybody to go and do it. Right. So they're going to do it.

Yeah, that's a challenge for them. Yeah.

It's

Yeah,

I think something was said where this site couldn't be really easily compromised. Kid did it from his Roku in a hotel room and compromised the site.

Chad, you're right, because even besides the malicious part, I think the thing with painting a line is really funny. Because, think about that. Think about maybe though something not necessarily malicious, where the line gets painted and, you know, things like that need to be done very precisely. And maybe it's not quite done.

the way it's supposed to be, that they made a mistake or something. And it doesn't show up right away. Like a lot of cars or lot of devices can deal with it. And that's fine. Until the one comes along that can't. And all of a sudden you have a big problem. ⁓ Even detecting that there's a problem with them can be very difficult.

Right.

It's like the Waymos right? They came to an intersection, there's a video about it. It's like three or four Waymos They came to an intersection and they all had problems with contention, because none of them had priority, so none of them moved. And the one person that was in a regular vehicle, I might be really paraphrasing this, but the guy got frustrated. These Waymos like, ⁓ no, no, I'm not going anywhere. They're all sitting there. They just happened to not be able to navigate their own algorithm. Did you see that, Brad?

Okay.

Yeah.

They're all like, after you, no, after you,

⁓ Chad? Yeah.

after you, no, after you. I didn't see that specific one, but I've heard other situations where they get in a place where there's just no good way to go forward and they just stall and they can't move. Yeah.

Yeah.

And I'm not saying it's their fault per se, but you know, I'm saying when I say I don't want to blame Waymo, it's just that sometimes algorithms, you can't, you know, the known unknowns, you just don't know the unknown unknowns, right? And sometimes you just can't literally program for every single thing. It's kind of like, you know, you know, a lot of military, right? They plan for the most, the most known scenarios.

Right.

They can't plan for scenarios they never came across so they have to be active thinkers. They have to overcome that, which is why they're so great, these special forces guys, because they know how to navigate at that level.

Yeah.

Yeah. And I mean, I think the other thing that's interesting here is like, don't get me wrong. I legitimately feel that autonomous vehicles will get there and it will probably, you know, save more accidents and deaths than it causes. But it's, the whole, you know, personal risk calculation, you know, the same reason why, you know, somebody is much more likely to get killed in a car accident, you know, five miles from their house than they are to be killed.

in a commercial jet crash, but everybody freaks out when the airliner goes down because ⁓ that feels so much worse, right? You're not in control. Whereas if you're in the car, you got the steering wheel and somebody falls asleep and drives off the road, you're like, well, was an accident. That sucks. Accidents happen. But when it's somebody else is behind the controls or an autonomous system behind the controls and there's a crash.

somehow that feels worse, it feels ⁓ more concerning and risky. we tend to more, what do you call it, more aggressively, if you will, or risk averse to things where we're not in control,

Yeah.

Well, I think we see some of these things like an autonomous vehicle and there's an expectation that it's going to work and that it's not going to make spectacular failures.

In a sense, they are kind of held to a higher standard than people. I I think you're absolutely right. People are terrible drivers. mean, I'm here in New Jersey. The place is a nightmare. You know, I can't imagine an autonomous system that could be worse. it's like, you know, when we see someone do something stupid on the road, like, well, we can't fix stupid. But we can make better autonomous systems. have an expectation that they'll be better.

was just gonna say that.

Yeah.

And that goes back to saying the whole thing like there are people out there that really shouldn't drive they get into accidents all the time Wouldn't it be better to put them in an autonomous vehicle? That would probably make better decisions in them. Let's be honest AI is not going anywhere Autonomy is not going anywhere and it's similar to what I'm doing. I'm working on a paper on cyber warfare The main thing here the real takeaway in my opinion

Yeah.

is there's nothing wrong with all this technology as long as you create the right framework, the right policies, the right procedures. If you put those in place, then you have the 80-20 kind of rule, right? And I hope it's better than 80%, but the 80-20 rule is like 80 % of the time you're gonna have really good experience, 20 you might have failure. Well, we need more like 98, 99, and then one, right? But if you put the right policies, the right frameworks, the right legal stuff,

Mm-hmm.

you

you will get to a point because people, the main thing is people don't always care about loss of life, they should. People care about litigation. And if you can put things in place where people want to avoid litigation, I'm not saying people don't care about people, they do. But let's be honest, if somebody knows that there's a possibility of being sued, they're probably gonna step it up just a little bit more.

I think what you're touching on it, like there's a huge public perception issue, right? It's whether it's safer or not is almost meaningless because it's what the public perceives. And if there is a catastrophic failure of an autonomous system that causes loss of life, that's going to get news, right? It's going to be the top of the newsfeed because it's extraordinary. It's a big deal.

and in a lot of ways, I think it's, very similar to where cloud was, you know, what, like 10 years ago, ⁓ where people weren't willing to go to the cloud because of cybersecurity, you know, I can control the cybersecurity in my data center better than I can in the cloud. And so I can't do that. And when I was at AWS, we used to have a saying that we repeated a lot, which was.

bad day in the cloud for one of us is a bad day in the cloud for all of us. So if AWS or Google or Microsoft had a security breach, you know, all of the other cloud providers were going to be under increased scrutiny because that's where the attention was. you know, so regardless of whether it was related to your cloud provider or not, you're going to be asking your cloud provider, are you vulnerable to this? What are you doing? You know, how are you protecting me? So, you know,

I would argue that these commercial drone, these commercial drone delivery providers, they shouldn't be trying to get the lowest bar necessary. Like they should be trying to get the, you know, whatever is necessary to make safe operations possible. Because as soon as one of these drone delivery drones ⁓ injures or kills somebody, like it's going to be a bad day for all of them.

I guarantee you, people are going to revolt and cause all sorts of backlash because of that. So you can deal with it now or later, but I think it's better now, right?

Yeah. You know what that makes me?

You know what that makes me think of that just popped into my head? ⁓ Something like, it's like you say, it's a bad day for everyone. If you have a mistake, like what happened with CrowdStrike, know, that bricks huge amounts of machines. God, what could a bad software update or a bad AI update do to thousands of autonomous systems running on it? My God, wow.

So

everything is risk versus reward, right? So for CrowdStrike, you know, and I really don't like to call out companies, but yeah, I know they had an issue, but how many machines did they save from being compromised? How many machines did they save from a threat actor? How many, so we never talk about how much good somebody does. We always talk about they can do a hundred great things and that one bad thing.

Yeah.

How many drones are saving people's lives by delivering defibrillators? How many drones are delivering possibly a blood supply that nobody else, like a rare blood, that to a hospital from another hospital? How many ones are delivering organs that normally couldn't get there? As an EMT, when I had to go lights and sirens to bring somebody to a hospital, I mean, I know we're not gonna bring somebody by, well, not today, we're not bringing somebody by drone.

Okay.

We will eventually, we use helicopters now, right, for

high risk people. you know, like, you gotta think about how many people have enablement with drones? Like even with drones, how many businesses are gonna be able to thrive off of having drone deliveries? So again, we don't wanna talk about not doing something. We wanna talk about putting the right procedures, policies.

framework in place to minimize any loss of life and any other issues. That's what we want to talk about

I can't remember if was the I heard this from the FAA or the NTSB, but you know, basically the gist of it is every one of those FAA rules was written in blood. You know, it's there because some accident happened, somebody died, or maybe there was a near miss or something like that. There was there's some some wisdom behind these rules that that

you know, it's there to prevent these types of things from happening. so I think the FAA is probably going to come down. I mean, I hope that they come down on the side of safety, even if it's more expensive and inconvenient to certify. That's my hope. you know, obviously, I don't have I don't necessarily have a pony in this race other than, you know,

drones flying overhead and I don't want them to fall on top of me.

Yeah, think everyone does exactly. As much as I need my fidget spinner delivered before midnight, mean, we've got to walk down the street too.

you

Okay, and in the day I keep on repeating this not not every place is gonna have the ability to have drone deliveries if you're if you're living at if you're living in a nice little condo condominium outside in Washington DC and Two blocks away is the White House. I can rest assured that you're not gonna probably be getting drone deliveries However, if you live in some urban area

and maybe there's some building that's close by, keep in mind, at the end of the day, at least with batteries, most commercial drones don't even come close to, unless they're really big. The regular drones that you see doing stuff is about maybe an hour, if you're lucky. If a drone is doing two hours or three hours, wow, that's some size drone and some size battery. you also still have to have, even if it's two hours, it might be an hour.

Mm-hmm.

one way and now another way now it's really 45 minutes because you have to have reserve power but you're still delivering from a main hub that's still getting regular deliveries by truck to deliver it by drone so it's going to be in areas that are probably higher density it's not like you're living in the middle of the of a farm and you're getting a drone from a major city and it's flying two hours each way that doesn't work you know so he's still going to get truck deliveries

Mm-hmm.

Yeah.

Look, maybe in my lifetime, I probably won't see it. Maybe my grandkids, grandkids will see those type of drone deliveries when battery power is enhanced, but you know, we'll

well hopefully by then we'll know how to make it safe. So Chad, some parting thoughts. mean what should we have our eye on in this space? What worries you about it that might happen soon that we don't have a solution for yet?

the thing that comes to mind for me is it's it's the same problem we've seen for a long time. And in fact,

if you go back, ⁓ I think the, the Challenger shuttle disaster happened 40 years ago. In fact, I think it was 40 years ago this year. ⁓ if I'm not mistaken, when, when that shuttle disaster happened, ⁓ there was a presidential commission, ⁓

put out there to investigate the cause of the accident and they issued a report called the Rogers Commission Report. ⁓

There's one appendix to that. And I think it's like appendix F or something like that. It was written by Richard Feynman, the famed ⁓ physicist and scientist. Very brilliant, but he goes through and approaches this very systematically and scientifically and...

And what he found is that there was this fundamental breakdown in communication. And I'm probably gonna misquote the numbers here, but basically they said, if you talk to NASA management, they felt that the risk of a shuttle disaster was something like, know, one in a thousand or one in 10,000 or something like that, right? What it basically boiled down to was you could run a shuttle mission a day for years and never have an accident.

If you talk to the NASA engineers or the space engineers, ⁓ they felt like the risk of shuttle disaster was about one in a hundred, which, you know, basically you're rolling a die every time you launch the shuttle. so, so the, understanding was wildly off. There was this mismatch in understanding communication between the engineers and the managers. And they made a launch decision based off of

an assumption that it was safer than it actually was, right? And I feel like I'm seeing that happen ⁓ in autonomous vehicles and agentic designs and all of those things where sometimes security people are raising their hand and like, hey, like this isn't good enough. We're gonna have issues. And the other side of the table saying, yeah, yeah, yeah, but we gotta launch this. We gotta get this out, we're under pressure.

it's going to cost too much to do what you're talking about, et cetera. ⁓ It's the same story that we hear over and over again in security where the needs of the business, the concerns of security kind of come to a head and security is oftentimes getting swept under the rug. So that's what I've been thinking about lately is that appendix that Richard Feynman wrote 40 years ago, it's like he's still right. those...

communication gaps are still there, unfortunately. And we see issues from it.

That worries me. Sorry, that worries me because as I start doing research, I'm subject to an IRB, believe it's an institutional review board. And in order to do research, obviously a lot of, there's nothing ever perfectly written or written about any research. But how would one group have 101 and one group have 1,001? That is nowhere near each other. And it's not based on...

quantitative data that was analyzed or is that emotional? More of emotional data, right? You know, like, oh, I see this issue. You have to quantify what it is in order to really understand. You have to do research. So was there two different groups doing research or was it more about some emotional aspect of it? And plus, if one has 100 and one has a thousand, they're definitely not working off the same data.

Yeah.

Because if they're working off the same day, they can't make different decisions. So that's a very, very interesting thing. I'm going look into that further because now my head is just spinning from that.

Right.

There, I mean, the two things that I remember he mentioned, one, you know, the space program has been political, right? And it certainly was 40 years ago. It was like the space race, right? And even after the first to put a person on the moon, satellites and, all of those things, it was a way to flex your, your, your national muscle, so to speak. So there were political aspects, I'm sure. But the other thing that, ⁓

that Feynman mentioned was there was very much this attitude of problem solving where engineers would say, hey, we've got this problem. And he said, in a healthy engineering culture, managers should say, OK, that's interesting. Tell me more about that. What can we learn from that? What can we do about that? But in NASA's case, it was like, you brought me a problem. Well, go fix it.

you know, don't bring me problems, bring me solutions, right? You've all heard that before. And so by NASA management taking that approach, they were basically punishing anybody who brought issues to them because now it's like, you brought me an issue, now you own solving it, it's on you to get it done. As opposed to the manager saying, all right, we've got an issue, let's figure this out and find a solution together. And so...

Yeah.

Like you set up that leadership

culture and now people aren't bringing issues to you, right? Because they're not getting the support they need to get it fixed.

Or don't raise an issue because then you own it and you have to do more work.

that's a cultural problem and a management problem too, totally. I mean, I can tell you one of my favorite tricks used to be or things is if someone brought me something, I used to do this to you Adam, remember? If you bring me something, there's a big problem, I have this huge thing, we got to fix this, whatever, I'd say good, you own it. But I would only do that when people were bringing trivial things and they hadn't thought through.

100%.

the risk and the prioritization and whether this was ⁓ worthy of expending resources on. For things that are real problems, that are really serious, especially when you're talking about life safety, you're absolutely right. You need to take that stuff seriously.

Yeah.

So Joe, I worked for you for about seven years. The last two years I didn't bring you any problems if you recall.

Yeah, you were job hunting,

right. I mean, there's a difference between hey, you know, bring me like don't just dump a problem on my lap, think through it and give me the options. You know, I like that's I think a healthy, healthy interaction. But when you're like, you know,

All right.

Don't tell me about that because we've got this presidential mandate, we got to launch on this date, and that messes up my plan. That's more of a problem.

Yeah, that's a problem.

For

the times I was a manager, I would tell people something similar to Joe, but if you're going to bring me a problem, also bring me solutions. What are your recommendations? Don't just tell me you have a problem, ask me to solve it for you. So, ⁓ Adam, we have a problem with this server, but the problem with the server, I think we can do either this or this. That is a good employee. That is a good engineer. They notice a problem, they have identified the problem, but they also identify possible solutions.

But if you're bringing me problems without a solution and asking me to solve it, then what good are you? I know that sounds horrible, you need to be able to, you don't always have to have the right solution, but you should think through it. What are the possibilities? Give me some ideas.

you

Hopefully, we don't have that kind of dysfunction in organizations putting together autonomous systems, especially in the kinetic world because, you know, we know NASA had some culture problems. We know the auto industry has had some problems with saying, you know what, we'll just let it go. We'll pay off the victims, families, whatever. It'll be cheaper.

I hope that we've collectively learned the lesson that we shouldn't let that happen, but we'll see.

Okay.

For sure.

so much for joining us. This has been very illuminating, a little bit scary but if we're going to move ahead with stuff we have some things we need to solve.

Well, thanks for having me on and I apologize. My intent is never to spread fear and certainty and doubt. ⁓ But sometimes I feel like my role is to just try to connect the dots and make sure people are aware of the risks. so sometimes that's scary.

It's all good for provocative thought.

That's right. And it's something we need to deal with regardless. So thanks again for joining Chad Adam, always good to see you. And thanks everyone for listening.