The episode opens with a sponsor message before Erika Beras sets the geopolitical scene: US and Iran representatives are heading to Geneva for ceasefire talks, but the core conflict over Iran's nuclear program remains unresolved. Nick Fountain layers in a second dimension — an almost entirely invisible cyberwar running alongside the physical one. He teases the discovery of a piece of malware so psychologically sophisticated it might have driven Iranian nuclear scientists insane, and possibly saved the world from nuclear destruction. The hook is irresistible: a cyberweapon that attacked not just machines, but human certainty itself.

The hosts explain they sought out Jags to get a window into the invisible cyberwar. Juan Andrés Guerrero Saade — everyone calls him Jags — has a fauxhawk, sleeves of tattoos, and was on track for a philosophy PhD before pivoting to cybersecurity. He describes his role as a 'cyber paleontologist': digging up old malware buried on servers, reverse engineering what top-secret missions they were designed to carry out, and using that knowledge to defend against future attacks. ^{[1] — Juan Andrés Guerrero Saade "Jags reverse-engineers old malware buried deep on servers to understand how hackers got in and what they did — so future attacks can be sto…" 01:59 Play} Jags works at SentinelOne, protecting clients as varied as Samsung, the Golden State Warriors, and the U.S. government. The team notes his work is so significant that pieces based on it sit in the International Spy Museum in Washington, D.C. He jokes that in Jurassic Park terms, he's more Jeff Goldblum than Alan Grant — which, for a chaos-theory aficionado digging up digital dinosaurs, seems about right.

The fragment that launched Jags's investigation wasn't even a piece of code — it was just six words from a leaked NSA malware identification list. The tool was designed to help NSA operators in the field determine whether other hackers were already present on a target system. Every other entry had a standard warning: 'known malware, pull back.' Every entry, that is, except one. FAST16's entry simply read, in all caps: 'FAST16, nothing to see here, carry on.' ^{[1] — Juan Andrés Guerrero Saade "Out of an entire leaked NSA malware list, one entry stood completely apart: 'FAST16, nothing to see here, carry on' — in all caps, with no …" 03:35 Play} No warning, no instruction — just a dismissal. For a budding cyber paleontologist, this was pure catnip. Jags rummaged through public malware archives until he located the actual FAST16 code, and began the slow, painstaking work of reconstructing its skeleton. But even after assembling the full structure, its secret mission eluded him — leading to months of what he calls 'cracked-out nights' and residence in 'the Valley of Despair.'

Unable to crack FAST16 and forced to move on to other projects, Jags took an unusual step to ensure he'd never forget the unsolved puzzle: he had 'FAST16, nothing to see here, carry on' tattooed on his arm — visible proof of his unfinished business. ^{[1] — Juan Andrés Guerrero Saade "After months of fruitless nights failing to decode FAST16, Jags made a decision most researchers wouldn't: he tattooed 'FAST16, nothing to …" 06:49 Play} He shows the hosts during the interview, pointing out the exact words on his tricep. It's both a researcher's memento and a kind of self-imposed pressure: the mystery was now literally written on his skin, waiting to be solved.

Jags explains that Stuxnet, discovered in the late 2000s, effectively created the cybersecurity research industry by proving that large-scale offensive cyberoperations had been happening for years — at a scale far beyond anything researchers had imagined. ^{[1] — Nick Fountain "Before Stuxnet, offensive cyberweapons were theoretical. Then Israel and the U.S. allegedly used malware to make Iran's uranium enrichment …" 09:16 Play} The weapon allegedly infiltrated Iran's centrifuge network via a thumb drive, mapped normal operations, then commanded the machines to spin wildly out of control while feeding false 'all normal' readings to operators. The result: operators heard disturbing noises from the machine room while their screens insisted nothing was wrong. Stuxnet reportedly destroyed about a fifth of Iran's centrifuges, got nuclear scientists fired, and is widely believed to have set back Iran's nuclear program — all without firing a single shot. For Jags, Stuxnet was just 'a tibia': proof that the full skeleton of invisible cyberoperations was far larger and stranger than anyone knew.

Fast forward to the present day: Jags runs a large research team and wonders whether new AI tools could solve what years of human effort couldn't. He assigns the FAST16 problem to Vitaly Kamluk, a Belarusian cybersecurity legend based in Singapore, known for his calm, Zen-like demeanor. ^{[1] — Juan Andrés Guerrero Saade "Jags's colleague Vitaly Kamluk disappeared for two weeks into the FAST16 problem, using AI to verify his reverse engineering. What emerged:…" 12:20 Play} Rather than jump straight to testing the AI, Vitaly first spends nearly two weeks doing the reverse engineering himself — going completely dark, not answering messages — so he'd know whether the AI was getting it right. Then, at around 1am Singapore time, Jags gets a message: 'We need to talk.' Vitaly tells him he's had the AI models double and triple-check his work, and they all agree. The verdict: FAST16 targeted floating-point, high-precision math calculations — a type of operation no malware had ever touched before, and one exclusively associated with complex scientific modeling. Hearing this from the usually unflappable Vitaly, Jags takes it very seriously.

The episode breaks for a series of sponsor advertisements: Whole Foods Market promotes its summer cookout products; Schwab introduces its new Teen Investor Account; Ethos promotes online life insurance with no medical exam and same-day coverage up to $3 million; and Odoo pitches its all-in-one business management software platform with a free trial. These commercial reads take up approximately two minutes before the investigation resumes.

With the knowledge that FAST16 targeted high-precision math, Jags and Vitaly search old systems for software containing the same strings of bytes embedded in FAST16's rules engine. The results point to complex physics modeling software — the kind used to simulate bridge stress tests or car crash dynamics. ^{[1] — Juan Andrés Guerrero Saade "The string of bytes in FAST16's code matched LSDyna, a physics modeling program. A think tank report revealed that Iranian nuclear scientis…" 18:50 Play} But one software package stands out: LSDyna, short for Livermore Software Dynamic Analysis. When Jags searches for LSDyna online, he stumbles upon a report from the Institute for Science and International Security — 'the good ISIS' — which documents that Iranian nuclear scientists were publicly using LSDyna for calculations involving explosive materials for nuclear payloads. This is the key link: FAST16 was designed to corrupt calculations in the exact software Iranian nuclear scientists were using to design nuclear bombs. Vitaly's initial horror makes sense: this malware could theoretically corrupt any safety-critical engineering calculation — bridges, cars, aircraft — raising profound ethical questions about the limits of cyber sabotage.

With LSDyna identified as the target, Jags and Vitaly finally obtain a copy of the old software and confirm FAST16's full mission. ^{[1] — Juan Andrés Guerrero Saade "FAST16 hid silently on computers until it detected the specific pressure calculations used to simulate a nuclear explosion. Then it corrupt…" 23:00 Play} The malware was designed to do nothing — absolutely nothing — until it detected the very specific pressure calculations used to simulate a nuclear explosion. At that critical threshold, and only then, it would alter the mathematics just enough to produce wrong answers. The true genius was in the propagation: FAST16 spread from machine to machine and produced the exact same wrong answer on every one. ^{[2] — Juan Andrés Guerrero Saade "FAST16 didn't just corrupt one machine — it spread computer to computer and gave the exact same wrong answer on every one. That coherence w…" 23:25 Play} If a scientist suspected one computer and switched to another, they'd get the same result — and conclude the problem was human error, not malware. Jags describes it as 'right math, wrong answer, right formula, wrong answer, over and over everywhere you go.' The psychological damage was the point: scientists and their supervisors would doubt human competence long before suspecting sabotage. Jags and Vitaly publicly announced their findings in April 2025.

Despite their breakthrough, Jags and the Planet Money team are left with three enduring mysteries. First: was Iran definitely the target? North Korea also had active nuclear ambitions in the mid-2000s, but Jags is confident the circumstantial evidence all points to Iran — no similar cyber sabotage has ever been documented against anyone else in that era. Second: who built it? It has Stuxnet-like fingerprints — widely attributed to the US and Israel — but no one has confirmed this. Planet Money reached out to the NSA, CIA, and Israeli Defense Forces; none confirmed, none denied, and the IDF never responded. Jags's own check-in with the intelligence community before publication met no resistance — which he reads as confirmation that 20-year-old secrets don't need protecting. Third: why did the NSA write 'nothing to see here, carry on' about FAST16 in their own detection tool? Was it a genuine misdirection to protect an allied operation? A wink from the agency? One day, declassification may answer all three.

Nick Fountain asks Jags whether 'epistemological warfare' is the right framing for what FAST16 did. Jags — who was once heading toward a philosophy PhD — takes the bait. ^{[1] — Juan Andrés Guerrero Saade "Certainty isn't coherent deduction — it's a background assumption that lets you function. FAST16 weaponized that assumption, forcing scient…" 28:15 Play} He explains that certainty isn't a product of careful deduction; it's a background assumption that lets us function at all. If you questioned every step — whether the floor will hold you, whether the train is safe — you'd be paralyzed. FAST16 weaponized that assumption, forcing scientists to question their results, their methods, and ultimately themselves. The episode closes with a vivid anecdote: Jags and Vitaly, riding a driverless train in Singapore on their way to present their FAST16 research at a hacker conference, when Vitaly notes that this is exactly the kind of system FAST16-style malware could degrade. There'd been a train collision recently. Officials said no cyberattack was involved. Jags and Vitaly glanced at each other and said, 'Well, as far as we know.' The people who understand cyber threats best are also the least able to trust anything.

Nick Fountain wraps up with a call-to-action: if any intelligence operatives want to share information about clandestine operations, 'you know how to find me.' Erika Beras adds a request for international listeners to submit surprising economic ideas for Planet Money Summer School. Credits roll: produced by Willa Rubin, edited by Marianne McCune and Jess Jiang, fact-checked by Charlotte Isidore, engineered by Kwesi Lee, executive producer Alex Goldmark. Special thanks go to the Symantec research team, Wired journalist Andy Greenberg who broke the FAST16 story, Kim Zetter who wrote the definitive Stuxnet book, and David Albright of the Institute for Science and International Security. Nick notes that Jags hosts a podcast of his own called The Three Buddy Problem. Closing sponsor spots from American Home Shield and Capella University end the episode.