1 00:00:09,270 --> 00:00:11,850 Good afternoon, appreciate everybody showing up. 2 00:00:12,190 --> 00:00:16,710 I remember the last time we were in a tent, it was about 114 degrees, but it was on the roof. 3 00:00:17,030 --> 00:00:19,790 And the air condition didn't work so well, so this is pretty good. 4 00:00:21,310 --> 00:00:24,870 This is, I guess, the sixth Meet the Fed panel. 5 00:00:24,870 --> 00:00:27,390 We actually were fed pretty well anyway. 6 00:00:27,450 --> 00:00:30,570 Meet the Fed panel that I participated in. 7 00:00:30,670 --> 00:00:35,410 And this year we went international, so we have a representative from the Royal Canadian Mounted Police with us. 8 00:00:35,410 --> 00:00:38,230 So, appreciate it. 9 00:00:38,230 --> 00:00:39,410 I'm Jim Christie. 10 00:00:39,490 --> 00:00:43,610 I'm a criminal investigator with the Air Force Office of Special Investigations. 11 00:00:43,610 --> 00:00:46,990 And I'm the director of the Defense Cybercrime Institute. 12 00:00:47,190 --> 00:00:53,970 What we're going to do this morning, this afternoon, is I'm going to do a quick bio on each of our members of the panel. 13 00:00:53,970 --> 00:00:57,390 Then I'm going to let them have a one to two minute opening statement. 14 00:00:57,450 --> 00:01:02,710 And I know Keith Rhodes will have to cut him off because he can't say anything in one to two minutes. 15 00:01:02,710 --> 00:01:07,530 And then at that point, we're just going to open it up to questions from the floor. 16 00:01:08,550 --> 00:01:14,810 So, let me start out with, they're not in any particular order, it might be an alphabetic order. 17 00:01:14,810 --> 00:01:17,410 Don Blumenthal, if you'd raise your hand, Don. 18 00:01:17,810 --> 00:01:23,990 Don is the Internet Lab Coordinator for the Federal Trade Commission, Bureau of Consumer Protection. 19 00:01:24,290 --> 00:01:24,610 Mr. 20 00:01:24,610 --> 00:01:35,550 Blumenthal established the Overseas Labs Managing Consumer Protection Technical Support Group and provides technical expertise to investigations that involve system issues. 21 00:01:35,850 --> 00:01:38,990 His career also includes time with another federal agency. 22 00:01:38,990 --> 00:01:40,270 And I don't know what that means, Don. 23 00:01:40,270 --> 00:01:41,210 What does that mean? 24 00:01:43,290 --> 00:01:44,450 No comment. 25 00:01:44,450 --> 00:01:44,810 Okay. 26 00:01:44,810 --> 00:01:46,270 It's one that nobody's heard of. 27 00:01:46,270 --> 00:01:47,590 It's not that it's sacred. 28 00:01:50,630 --> 00:01:56,910 He's also had time in the private sector and as a legislative director for a member of the House of Representatives. 29 00:01:56,910 --> 00:01:58,290 Who? 30 00:01:59,410 --> 00:02:01,770 Louis Stokes, Northeast Ohio. 31 00:02:03,870 --> 00:02:05,730 In his alternate universe, Mr. 32 00:02:05,730 --> 00:02:12,050 Blumenthal is about to start his 23rd year as a part-time scout for the Oakland Raiders. 33 00:02:12,450 --> 00:02:13,990 So that's an interesting background. 34 00:02:17,790 --> 00:02:18,990 Ovi Carroll. 35 00:02:18,990 --> 00:02:20,390 Raise your hand, Ovi. 36 00:02:20,390 --> 00:02:21,510 Okay. 37 00:02:21,870 --> 00:02:27,050 Ovi Carroll is a special agent in charge of the Computer Crime Unit for the United States Postal Service. 38 00:02:27,110 --> 00:02:29,250 Office of Inspector General. 39 00:02:29,250 --> 00:02:35,690 The Computer Crime Unit is responsible for all computer intrusions, investigations, analysis and support. 40 00:02:36,930 --> 00:02:43,030 Technical computer surveillance equipment and support to other criminal investigative organizations. 41 00:02:44,590 --> 00:02:57,530 Ovi was also, he's a retired Air Force Office of Special Investigations agent, where he had 20 years of law enforcement experience with the Air Force before going into retirement with the Postal Service. 42 00:03:00,450 --> 00:03:01,230 Okay. 43 00:03:01,330 --> 00:03:04,430 Gauri, you're going to have to pronounce your name for us. 44 00:03:05,850 --> 00:03:08,990 Hi, I'm Gauri Dhanuam with the RCMP. 45 00:03:10,110 --> 00:03:14,570 My name is Gauri Dhanuam with the Royal Canadian Mounted Police in Ottawa, Canada. 46 00:03:14,570 --> 00:03:18,430 And I guess I'll let Jim do the rest of the talking on my bio. 47 00:03:18,910 --> 00:03:21,670 He was scared that he was going to bastardize my name. 48 00:03:21,750 --> 00:03:23,770 You glad to be here, eh? 49 00:03:28,990 --> 00:03:29,670 Okay. 50 00:03:29,670 --> 00:03:33,830 Andy Freed, I don't have a bio on because he doesn't answer emails. 51 00:03:34,250 --> 00:03:36,690 He doesn't know how to do internet stuff. 52 00:03:36,970 --> 00:03:40,210 But I've known Andy for, he's with the IRS. 53 00:03:40,570 --> 00:03:43,770 I've known Andy since about 1986. 54 00:03:43,770 --> 00:03:55,070 And I've got to tell you, in 1986 through probably 1992, all the investigative software used by any computer crime investigator worldwide was written by Andy Freed. 55 00:03:55,150 --> 00:03:57,790 In 1992 we found out it didn't work. 56 00:04:04,650 --> 00:04:06,410 Mike Jacobs. 57 00:04:11,630 --> 00:04:14,310 Wow, we've got a lot of NSA-ers here. 58 00:04:14,570 --> 00:04:17,070 Okay, if you're NSA, raise your hand. 59 00:04:17,950 --> 00:04:19,170 You're not. 60 00:04:19,170 --> 00:04:20,690 Yeah, why? 61 00:04:21,430 --> 00:04:27,810 Mike is the Vice President of SRA International, Director of the Cyber and National Security Program. 62 00:04:27,810 --> 00:04:29,590 Prior to SRA, Mr. 63 00:04:29,590 --> 00:04:42,790 Jacobs was the Information Assurance Director at the National Security Agency, responsible for development and provisioning of information security products, services, operations for the federal government. 64 00:04:43,190 --> 00:04:46,430 Also, Mike was the Mayor of College Park, Maryland. 65 00:04:46,430 --> 00:04:54,830 So whenever the University of Maryland won a basketball game or lost a basketball game and they burned down the city, Mike would be on the news. 66 00:04:54,830 --> 00:04:56,650 I'm sure that made NSA happy. 67 00:04:59,650 --> 00:05:01,590 Rich Marshall, Esquire. 68 00:05:01,590 --> 00:05:04,150 Also known Rich for a long time. 69 00:05:04,350 --> 00:05:12,090 Senior Information Assurance Representative, Office of Legislative Affairs, National Security Agency. 70 00:05:12,090 --> 00:05:25,030 NSA's Legislative Affairs Office, the agency point of contact for all NSA matters concerning Congress, is committing to maintaining a relationship with Congress built on trust. 71 00:05:31,010 --> 00:05:34,490 Their operating principles are the five C's. 72 00:05:34,490 --> 00:05:36,950 Oh my God, I can't believe you put this in there. 73 00:05:38,250 --> 00:05:44,130 CANDOR, COMPLETENESS, CORRECTNESS, CONSISTENCY, and CORPORATENESS. 74 00:05:48,550 --> 00:05:51,690 You've got more shit with you than a Christmas turkey. 75 00:05:53,250 --> 00:06:03,170 He was the former Principal Deputy Director of the Critical Infrastructure Assurance Office, the CHAO, Bureau of Industry and Security, Department of Commerce. 76 00:06:03,170 --> 00:06:04,870 Before joining the CHAO, Mr. 77 00:06:04,870 --> 00:06:07,050 Marshall served with distinction. 78 00:06:07,050 --> 00:06:08,450 You wrote this, didn't you? 79 00:06:09,750 --> 00:06:21,190 Served with distinction as the Associate General Counsel for Information Systems Security for the Information Assurance Office of the General Counsel's National Security Agency for over eight years. 80 00:06:21,510 --> 00:06:21,810 Mr. 81 00:06:21,810 --> 00:06:33,310 Marshall also represented the United States before the High Court of Justice in London and has addressed various international, Department of Defense, Army, Navy, and Air Force legal conferences. 82 00:06:33,310 --> 00:06:36,370 And now he has DEFCON on his resume. 83 00:06:40,300 --> 00:06:40,900 Mr. 84 00:06:40,900 --> 00:06:42,060 Keith Rhodes. 85 00:06:43,880 --> 00:06:45,540 No clapping, you notice. 86 00:06:47,320 --> 00:06:55,840 Keith Rhodes is the Chief Technologist and Director of the Center for Technology and Engineering for the USGAO. 87 00:06:55,840 --> 00:06:57,440 Anybody know what GAO stands for? 88 00:06:58,840 --> 00:06:59,700 Wrong. 89 00:06:59,700 --> 00:07:00,320 Wrong. 90 00:07:00,320 --> 00:07:01,660 They changed their name. 91 00:07:01,660 --> 00:07:04,540 It's the Government Accountability Office. 92 00:07:04,540 --> 00:07:05,840 Y'all failed. 93 00:07:06,120 --> 00:07:14,120 For the past ten years, he's led that team and has tested the information security of US government. 94 00:07:14,120 --> 00:07:20,560 As the investigative arm of Congress, everybody else up here on the panel just loves Keith and his folks. 95 00:07:21,460 --> 00:07:31,760 He regularly testifies before the US Congress and has addressed foreign governments, speaks publicly about the results of the tests and on the off chance that something might improve. 96 00:07:35,100 --> 00:07:36,900 David Thomas. 97 00:07:37,900 --> 00:07:40,040 No clapping for you either. 98 00:07:40,940 --> 00:07:44,980 David Thomas was designated Special Agent of the FBI in 1989. 99 00:07:44,980 --> 00:07:50,340 After completing training, he was assigned to the Tampa Division where he worked violent crime matters. 100 00:07:50,340 --> 00:07:52,180 So that's why he's here. 101 00:07:52,930 --> 00:08:01,000 In October 1996, Special Agent Thomas was promoted to the position of Supervisory Special Agent in charge of violent crimes and domestic terrorism. 102 00:08:01,120 --> 00:08:07,500 Upon completing that assignment with the Tampa Division, he was transferred to the FBI headquarters. 103 00:08:07,500 --> 00:08:08,880 Who'd you piss off? 104 00:08:11,360 --> 00:08:13,680 I did two years down there. 105 00:08:13,680 --> 00:08:15,700 In July of 2004, Mr. 106 00:08:15,700 --> 00:08:25,200 Thomas was promoted to the position of Section Chief of the Cyber Counterterrorism, Counterintelligence and Criminal Computer Intrusion Investigations. 107 00:08:25,200 --> 00:08:35,760 Additionally, he's responsible for the development of the FBI's Cyber Intelligence Unit and Cyber Action Teams, which deploy domestically and internationally in response to major cyber events. 108 00:08:37,700 --> 00:08:38,420 Dr. 109 00:08:38,420 --> 00:08:39,400 Linton Wells. 110 00:08:39,400 --> 00:08:41,680 A lot of you heard him speak. 111 00:08:42,780 --> 00:08:45,080 Who's sucking up over there? 112 00:08:47,080 --> 00:08:48,120 Actually, Dr. 113 00:08:48,120 --> 00:08:53,260 Wells was my boss when I was down at the FBI, so I'm a little pissed at you, sir. 114 00:08:54,720 --> 00:08:55,840 Dr. 115 00:08:57,000 --> 00:09:10,760 Wells assumed duties as the Acting Assistant Secretary on 8 March 2004 and became the Principal Deputy Assistant Secretary of Defense for Network and Information Integration on August 20, 1998. 116 00:09:10,760 --> 00:09:18,560 Prior to assignment, he was served in the Office of the Undersecretary of Defense for Policy since July of 1991. 117 00:09:18,680 --> 00:09:25,580 Most recently as the Deputy Undersecretary of Defense Policy Support since 1998. 118 00:09:26,000 --> 00:09:28,100 In 26 years of naval service, Dr. 119 00:09:28,100 --> 00:09:34,340 Wells served in a variety of surface ships, including command of a destroyer squadron and a guided missile destroyer. 120 00:09:34,340 --> 00:09:48,800 In addition, he acquired a wide range of experience in operations analysis, Pacific Indian Ocean, Middle East Affairs Network and Information Integration and Special Access Program Oversight. 121 00:09:51,240 --> 00:09:52,180 Wow, Dr. 122 00:09:52,180 --> 00:09:54,560 Wells was born in Angola. 123 00:09:54,760 --> 00:09:56,260 We won't tell him the year. 124 00:09:56,260 --> 00:09:59,320 He was graduated from the U.S. 125 00:09:59,320 --> 00:10:04,900 Naval Academy in 1967 and holds a Bachelor of Science degree in Physics and Oceanography. 126 00:10:04,900 --> 00:10:13,220 He attended graduate school at Johns Hopkins University and received a Master of Science of Engineering degree in Mathematical Sciences and a Ph.D. 127 00:10:13,220 --> 00:10:14,880 in International Relations. 128 00:10:14,880 --> 00:10:23,320 He is also a 1983 graduate of the Japanese National Institute for Defense Studies in Tokyo, the first naval officer to attend there. 129 00:10:23,320 --> 00:10:23,740 Dr. 130 00:10:23,740 --> 00:10:32,460 Wells has written widely on security studies in English and Japanese journals. 131 00:10:32,460 --> 00:10:37,580 He has co-authored Japanese Cruisers of the Pacific War, which was published in 1997. 132 00:10:37,800 --> 00:10:44,260 His hobbies include history, the relationship between policy, technology, scuba diving and flying. 133 00:10:44,340 --> 00:10:46,560 So I read his whole bio because he is my boss. 134 00:10:48,240 --> 00:10:51,620 We have one other person on the far end. 135 00:10:52,060 --> 00:10:53,620 You can't see him. 136 00:10:53,620 --> 00:10:54,960 Raise your hand, Andy. 137 00:10:54,960 --> 00:10:59,540 The seat on your left, on your right, that's the CIA. 138 00:11:05,440 --> 00:11:08,760 The individual is actually sitting among you. 139 00:11:09,520 --> 00:11:15,140 Oh, I forgot Robert. 140 00:11:15,140 --> 00:11:18,060 We just added Robert Mars, Sr. 141 00:11:19,820 --> 00:11:23,680 I met Robert last year officially. 142 00:11:32,460 --> 00:11:38,700 Chief Scientist for NSA and the way I met him was through his son. 143 00:11:43,480 --> 00:11:47,020 So, pretty good panel. 144 00:11:47,020 --> 00:11:49,520 I'm hoping the questions are going to be pretty good. 145 00:11:49,520 --> 00:11:54,280 Before we start the questions, the panel asked me for a favor. 146 00:11:54,300 --> 00:11:56,400 They wanted to do a survey. 147 00:11:58,860 --> 00:12:01,600 Could everybody please stand up for a second? 148 00:12:06,230 --> 00:12:09,790 Okay, if you are with NSA, please sit down. 149 00:12:11,770 --> 00:12:14,370 A couple of wobbles there. 150 00:12:14,370 --> 00:12:19,830 Okay, if you've never broken the law by breaking into somebody else's system, please sit down. 151 00:12:36,500 --> 00:12:38,500 A couple of the cameras weren't working. 152 00:12:38,500 --> 00:12:40,020 Could you guys please stand up again? 153 00:12:43,080 --> 00:12:48,760 Okay, those of you, we did this five years ago and I can't believe you guys fell for it again. 154 00:12:48,760 --> 00:12:55,100 I hope you have clean underwear and a toothbrush because we've got the paddy wagons lined up out back. 155 00:12:55,580 --> 00:13:04,140 So, with that, what we're going to do is we're going to start with Rich and go right down the line and let everybody make a one to two minute opening statement and then we'll just open it up to you guys. 156 00:13:04,140 --> 00:13:04,900 So, Rich. 157 00:13:05,060 --> 00:13:06,560 Okay, I'm going to be real quick. 158 00:13:06,560 --> 00:13:07,300 A couple of things. 159 00:13:07,300 --> 00:13:09,260 This is a legitimate deadhead shirt. 160 00:13:09,260 --> 00:13:11,060 I am first generation dead. 161 00:13:11,140 --> 00:13:12,700 Spent a lot of time partying. 162 00:13:16,350 --> 00:13:20,070 Spent a lot of time partying with Jerry when he was alive and loved it. 163 00:13:20,070 --> 00:13:23,990 Never did or never have been caught doing the drugs. 164 00:13:27,290 --> 00:13:30,470 Tested 17 times at NSA. 165 00:13:31,050 --> 00:13:33,950 They recognized me when I walked in. 166 00:13:35,150 --> 00:13:37,430 I can't remember what year. 167 00:13:39,010 --> 00:13:42,130 A couple of other things you should know about. 168 00:13:42,450 --> 00:13:44,110 Jim mentioned that I'm a lawyer. 169 00:13:44,110 --> 00:13:47,570 I was the legal architect for Eligible Receiver 97. 170 00:13:47,570 --> 00:13:49,630 That was an important event. 171 00:13:49,630 --> 00:13:56,370 In the United States history because that demonstrated to senior leadership that information warfare was not a theory. 172 00:13:56,370 --> 00:13:57,930 It was a reality. 173 00:13:58,210 --> 00:14:02,210 And that was the time that Dick Clark decided he wanted to be a cyber security expert. 174 00:14:02,390 --> 00:14:07,850 And the two of the people that really were instrumental in helping make that program work are on the panel with us today. 175 00:14:07,850 --> 00:14:08,230 Dr. 176 00:14:08,230 --> 00:14:10,810 Lynn Wells, we worked very closely putting that together. 177 00:14:10,810 --> 00:14:13,770 And my former boss and great friend, Mike Jacobs. 178 00:14:13,770 --> 00:14:15,670 Just absolutely awesome guys. 179 00:14:19,990 --> 00:14:23,210 And my association with Bob Morris we can't talk about. 180 00:14:23,210 --> 00:14:25,470 But it was through him, not his son. 181 00:14:25,470 --> 00:14:27,450 He's an absolutely awesome guy. 182 00:14:27,810 --> 00:14:29,650 Tremendous respect for him. 183 00:14:29,790 --> 00:14:35,410 Last thing I want to talk about is we would love to have your resumes if you're clean. 184 00:14:35,630 --> 00:14:36,690 I'm not talking drug. 185 00:14:36,690 --> 00:14:37,810 Well, yeah, we are. 186 00:14:39,310 --> 00:14:40,650 40th slip. 187 00:14:41,670 --> 00:14:48,390 But particularly in today's environment, it's very critical that we have the best and brightest working on solutions. 188 00:14:48,630 --> 00:14:51,390 And work with us on those solutions. 189 00:14:51,450 --> 00:14:52,550 Come and join the team. 190 00:14:52,550 --> 00:14:53,690 Send me your resume. 191 00:14:53,690 --> 00:14:55,910 We'll make sure it gets the appropriate consideration. 192 00:14:55,910 --> 00:14:56,830 Fair enough? 193 00:14:57,010 --> 00:14:57,830 Thanks. 194 00:15:02,480 --> 00:15:03,040 Dr. 195 00:15:03,040 --> 00:15:03,840 Wells. 196 00:15:05,620 --> 00:15:07,000 You want to hear me in the back? 197 00:15:08,440 --> 00:15:21,620 As I mentioned earlier, for those of you who had a chance to hear it, DOD is moving toward this concept of network-centric operations which really puts a greatly increased premium on the importance of the network and thus protecting the network. 198 00:15:21,620 --> 00:15:32,860 We've got a very sort of worldwide heterogeneous complex set of missions which don't necessarily map to the private sector security concerns. 199 00:15:32,860 --> 00:15:35,500 And so we certainly don't have all the answers. 200 00:15:35,500 --> 00:15:37,660 And I second the point here. 201 00:15:37,660 --> 00:15:39,800 We need to work with you. 202 00:15:39,800 --> 00:15:42,620 We need to address your resumes. 203 00:15:42,620 --> 00:15:51,600 The point I would ask, though, specifically is what concerns me is not the kind of casual hacker for recreation or thrills. 204 00:15:51,600 --> 00:16:00,000 I'm really concerned about people who are trying to get into DOD's networks to steal the information or conduct attacks that disrupt what we're doing. 205 00:16:00,000 --> 00:16:07,400 We have people out there today from Afghanistan to Iraq to Darfur to whatever whose people's lives are on the line. 206 00:16:07,400 --> 00:16:09,020 They depend on these networks. 207 00:16:09,020 --> 00:16:11,880 And it's not just a casual thing for them. 208 00:16:11,880 --> 00:16:16,540 So what I'd ask is a little less noise in the system. 209 00:16:16,600 --> 00:16:26,820 The intrusions, the probing, the whatever, basically moves our resources away from things that really need to be addressed. 210 00:16:26,820 --> 00:16:35,200 And there clearly are people out there who are trying to do us harm and harm to the kind of values I think that most of us share about the value of information being shared. 211 00:16:35,200 --> 00:16:41,220 So I'd ask for your cooperation and I look forward very much to working with you and getting your ideas. 212 00:16:41,220 --> 00:16:42,080 Thank you very much. 213 00:16:42,360 --> 00:16:43,340 Thanks. 214 00:16:47,650 --> 00:16:49,010 Bob? 215 00:16:50,890 --> 00:16:53,790 I promise not to give a speech. 216 00:16:56,170 --> 00:16:57,510 I'm sorry. 217 00:16:57,510 --> 00:16:59,970 My whole speech is no comment. 218 00:17:01,870 --> 00:17:06,890 I will very likely, before the end of this, break that promise. 219 00:17:06,990 --> 00:17:10,210 But there's something substantive I want to say. 220 00:17:10,210 --> 00:17:14,850 The smartest and brightest of you, we need you guys. 221 00:17:15,650 --> 00:17:16,710 Two things. 222 00:17:16,710 --> 00:17:27,890 One is, if you're reasonably good, do consider seriously coming to the government, including my organization that also badly needs the brightest and best. 223 00:17:28,090 --> 00:17:33,970 There is one side issue, though, that you need to take care of. 224 00:17:33,970 --> 00:17:41,990 We would like to hire the best of you, and we will if you can apply and do apply. 225 00:17:42,110 --> 00:17:44,390 But there's a line. 226 00:17:44,510 --> 00:17:46,510 Don't cross the line. 227 00:17:46,790 --> 00:17:48,910 Others will say that to you also. 228 00:17:48,930 --> 00:17:50,890 Hey, it's okay to smoke pot. 229 00:17:50,890 --> 00:17:51,510 Oh, I'm sorry. 230 00:17:51,510 --> 00:17:52,770 I shouldn't have said that. 231 00:17:59,260 --> 00:18:00,920 Okay, thank you, Bob. 232 00:18:03,800 --> 00:18:05,680 But don't get caught. 233 00:18:07,340 --> 00:18:09,580 Otherwise, no comment. 234 00:18:10,500 --> 00:18:12,300 And don't inhale. 235 00:18:13,600 --> 00:18:14,160 Just 236 00:18:18,740 --> 00:18:20,880 a little bit of a bio on myself here. 237 00:18:20,880 --> 00:18:26,000 I'm in charge of the network and information operations team in Ottawa. 238 00:18:26,000 --> 00:18:30,600 And basically, our team is composed of civilian members and regular members. 239 00:18:30,600 --> 00:18:35,040 And we are also looking for some talent to come to the RCMP. 240 00:18:35,100 --> 00:18:42,100 And it's an honor being in front of some of the brightest guys and people, young ladies and men in the tent here today. 241 00:18:42,240 --> 00:18:44,100 We investigate... 242 00:18:44,100 --> 00:18:46,180 He's talking about the panel. 243 00:18:48,410 --> 00:18:49,640 You too, Jim. 244 00:18:52,820 --> 00:19:01,500 We investigate unauthorized use of computers, mishifted data, anything related to computer crime incidents. 245 00:19:01,500 --> 00:19:07,680 And also, the tech crime branch is the contact for any international agency. 246 00:19:07,680 --> 00:19:19,460 We're 24-7, and so if anybody has any incident regarding computer-related incidents, they call us and we'll disseminate to the right agency within Canada. 247 00:19:20,600 --> 00:19:21,280 Thanks, Greg. 248 00:19:21,280 --> 00:19:22,100 Mike? 249 00:19:28,710 --> 00:19:31,630 I've got to bring my fan club all the time. 250 00:19:33,050 --> 00:19:37,110 After three years in the private sector, a couple of observations. 251 00:19:38,030 --> 00:19:42,350 My career at NSA, I worked predominantly with the Department of Defense. 252 00:19:43,250 --> 00:19:49,190 And now in the private sector, most of my clients are in the civil governmental side of the government. 253 00:19:49,910 --> 00:19:57,450 The conditions there are perhaps what the Department of Defense experienced 25 years ago. 254 00:19:57,590 --> 00:19:59,510 But they are improving. 255 00:19:59,870 --> 00:20:02,110 So too is the product space. 256 00:20:02,110 --> 00:20:07,530 Most of the failures that we're seeing today is in the human domain. 257 00:20:08,550 --> 00:20:10,370 Stupidity in many cases. 258 00:20:11,330 --> 00:20:16,550 Your skills and the activity that you're engaged in help us learn every day. 259 00:20:17,190 --> 00:20:19,670 But as Bob said, don't cross the line. 260 00:20:19,670 --> 00:20:20,850 We do need you. 261 00:20:20,910 --> 00:20:24,630 Both in the government, and we need you in the private sector. 262 00:20:24,970 --> 00:20:26,670 There's an awful lot to be done. 263 00:20:26,670 --> 00:20:38,070 Our near total dependency on the network today as a nation requires us to do the very best that we can in terms of improving the security and the integrity of those networks. 264 00:20:38,570 --> 00:20:46,350 Now last year when I was here, I had the opportunity to auction off to a single purchaser an NSA t-shirt. 265 00:20:46,930 --> 00:20:53,590 And that purchaser, BIT, gave me $60 for an NSA t-shirt that I didn't pay anything for. 266 00:20:54,170 --> 00:20:55,950 That all went to charity, of course. 267 00:20:55,950 --> 00:20:59,730 Now this year I have two NSA t-shirts. 268 00:21:00,310 --> 00:21:02,930 Is the guy here who bought it for $60 last year? 269 00:21:02,930 --> 00:21:04,190 Because these are different. 270 00:21:08,530 --> 00:21:17,270 Now on the other hand, I'm willing to trade both of these t-shirts, one each, for a legitimate resume of someone I can hire. 271 00:21:18,350 --> 00:21:19,410 Thank you. 272 00:21:25,930 --> 00:21:26,970 David. 273 00:21:27,210 --> 00:21:28,090 Thank you. 274 00:21:28,090 --> 00:21:29,930 Dave Thomas with the FBI. 275 00:21:30,210 --> 00:21:32,810 On behalf of the FBI, I appreciate you coming. 276 00:21:33,050 --> 00:21:38,270 Being from the great state of Tennessee, this somewhat reminds me of an old-time tent revival. 277 00:21:39,710 --> 00:21:48,990 If any of you feel the power coming over you, I just want you to know that we're authorized to take confession 24 hours a day. 278 00:21:50,210 --> 00:21:51,650 Please see me. 279 00:21:55,130 --> 00:21:59,710 I'm living proof that the FBI doesn't always hire the best and the brightest. 280 00:22:00,570 --> 00:22:03,850 For all of you, the rest of you out there, there is a chance. 281 00:22:03,850 --> 00:22:04,630 Stay with it. 282 00:22:08,790 --> 00:22:09,670 Keith. 283 00:22:10,370 --> 00:22:12,270 Hello, my name is Keith Rhodes. 284 00:22:12,270 --> 00:22:13,670 I'm with the GAO. 285 00:22:13,670 --> 00:22:15,110 Speak up, we can't hear you. 286 00:22:15,110 --> 00:22:16,070 Okay. 287 00:22:17,790 --> 00:22:25,870 What I would like to say is that five years ago, when I sat on this panel, I said the following statement. 288 00:22:25,870 --> 00:22:27,410 We always get in. 289 00:22:27,610 --> 00:22:30,550 Five years hence, we always get in. 290 00:22:30,810 --> 00:22:32,510 Is that short enough for you, Jim? 291 00:22:33,050 --> 00:22:43,110 If you would like to come to the legislative branch and test the security in the executive branch, give me a resume. 292 00:22:46,810 --> 00:22:47,690 O.V. 293 00:22:48,930 --> 00:22:49,830 I'm O.V. 294 00:22:49,830 --> 00:22:51,950 Carroll with the Postal Inspector General's Office. 295 00:22:51,950 --> 00:23:06,330 We respond to the incidents involving the 35,000 postal networks, as well as all the computer crime, computer forensics for criminal investigations, investigated by the Postal Inspector General's Office. 296 00:23:06,330 --> 00:23:13,170 We have an announcement out on usajobs.opm.gov for Dallas, Denver, L.A., and Washington, D.C. 297 00:23:13,170 --> 00:23:14,170 right now. 298 00:23:14,170 --> 00:23:15,190 Don. 299 00:23:21,380 --> 00:23:23,500 A little too quick, I wasn't quite ready there. 300 00:23:25,060 --> 00:23:32,560 I know a lot of people here have been at a number of these sessions before, but the FTC is new to meet the feds. 301 00:23:32,840 --> 00:23:36,960 So I wanted to talk a little bit about what we do and what our involvement is. 302 00:23:36,960 --> 00:23:37,600 Closer? 303 00:23:37,620 --> 00:23:38,240 Okay. 304 00:23:40,420 --> 00:23:49,620 I've known about DEF CON for years, really appreciate the opportunity to come because I've wanted to and now since I'm on the panel I can get the agency to pay for it. 305 00:23:50,980 --> 00:23:56,440 We're an independent agency and we're a civil law enforcement agency only. 306 00:23:57,640 --> 00:24:03,500 We've been in internet and online activity law enforcement for, I think our first case was 1994. 307 00:24:04,220 --> 00:24:15,700 And because of the wording of our mandate, which is one of the broadest in the federal sector, we can dabble in just about anything we think might affect consumers. 308 00:24:16,140 --> 00:24:23,680 So in the internet world we have dealt with good old scams, you know, the things that used to be in the back of the magazines but are now on websites. 309 00:24:25,300 --> 00:24:36,260 We have dealt with mouse trapping, page jacking, a lot of technical things that really, or techniques new to the internet, couldn't have been done before. 310 00:24:38,860 --> 00:24:57,440 One of our biggest areas right now, best known program I think of my division, I'm not mad, the division that my group's in is the Do Not Call List, which is probably, I think it's the thing we're best known for these days, but the other thing that we have going is our spam law enforcement. 311 00:24:57,440 --> 00:25:03,060 We were one of the earliest, we have the spam database, spam at uce.gov. 312 00:25:06,660 --> 00:25:12,320 Forward your messages to that address, they're indexed within an hour and there for us. 313 00:25:12,320 --> 00:25:17,360 And now other law enforcement agencies to use to find raw evidence in spam investigations. 314 00:25:19,320 --> 00:25:23,480 We, on the law enforcement side, we come at this from a little bit different angle. 315 00:25:23,480 --> 00:25:24,360 We are civil. 316 00:25:24,500 --> 00:25:26,980 I can't threaten anybody with jail. 317 00:25:27,460 --> 00:25:34,640 But on the other hand, my burden of proof is a lot lower than in the criminal side, and I don't have to prove intent. 318 00:25:35,080 --> 00:25:39,740 So very often we can make the cases that the crims can't, and frequently we work with them. 319 00:25:41,300 --> 00:25:46,060 If we decide it's crossed the line, we'll hand it over, that's happened in some phishing matters. 320 00:25:46,060 --> 00:25:49,440 We brought phishing, but some of them are beyond what we should be doing. 321 00:25:51,240 --> 00:25:53,940 The other thing is we do security cases. 322 00:25:54,220 --> 00:26:00,800 We have kind of marked ourselves out as big in the whole area of consumer privacy, consumer security. 323 00:26:00,860 --> 00:26:08,360 But the difference with us is, when we brought a security case, we have not gone against the people doing the breaches. 324 00:26:08,880 --> 00:26:12,920 Our defendants have been the companies who have allowed themselves to be breached. 325 00:26:12,920 --> 00:26:19,540 With idiotically, maybe that's a bad word, with weak security systems. 326 00:26:19,540 --> 00:26:28,380 On, for example, online ordering systems, or a wireless point of sale system. 327 00:26:28,380 --> 00:26:30,740 That case just hit about six weeks ago. 328 00:26:30,940 --> 00:26:41,040 So our view is more toward the consumer, and as a result, what the consumer has heard is more by the companies that are breached, rather than the folks who do that work. 329 00:26:43,240 --> 00:26:47,800 We've got some ideas for some other things, but at least that's the types of cases we've brought so far. 330 00:26:47,880 --> 00:26:49,640 Thanks, Don. 331 00:26:52,420 --> 00:26:53,300 Andy. 332 00:26:54,540 --> 00:26:56,240 Hi, my name is Andrew Freed. 333 00:26:56,240 --> 00:26:57,520 I'm with the Treasury Department. 334 00:26:57,520 --> 00:26:58,960 I've been there 17 years. 335 00:26:59,100 --> 00:27:03,820 For those of you who were not caught because my software didn't work, you can thank me later. 336 00:27:04,860 --> 00:27:10,920 When Jim Christie and I first got involved in computer security, there was no internet publicly available. 337 00:27:10,920 --> 00:27:18,360 It's been very interesting seeing how a lot of people have come up through the ranks and put together programs that were just amazing. 338 00:27:18,360 --> 00:27:19,460 Can't hear you. 339 00:27:21,940 --> 00:27:24,120 I like to mess with the sound guys. 340 00:27:25,060 --> 00:27:32,060 Basically, we want to say to all of you that if you're interested in law enforcement and you have a computer background, it's a really good lifestyle. 341 00:27:32,060 --> 00:27:33,200 It's a lot of fun. 342 00:27:33,360 --> 00:27:39,120 Sometimes people don't like you showing up at their doorstep, but for the most part, it's very challenging and rewarding. 343 00:27:39,120 --> 00:27:47,760 I would once again invite all of you that are interested in law enforcement to pursue it, try to stay as clean as you can, and see us after the show. 344 00:27:49,100 --> 00:27:50,160 Thanks, guys. 345 00:27:55,600 --> 00:27:58,920 What I wanted to say before we just... we're going to open it up to questions in a second. 346 00:27:58,920 --> 00:28:01,620 I need you to speak up because I've got the fans going. 347 00:28:01,980 --> 00:28:03,480 It's hard to hear up here. 348 00:28:04,340 --> 00:28:06,140 This is mainly for the media. 349 00:28:06,140 --> 00:28:17,120 After every DEF CON Meet the Fed panel, there are headlines that we all have to go back and answer for that says, we're here recruiting hackers, which means to our bosses, criminals. 350 00:28:17,120 --> 00:28:18,800 That's not why we're here. 351 00:28:18,820 --> 00:28:24,300 Like everybody here on the panel said, we're looking for the folks who haven't crossed that line yet. 352 00:28:24,460 --> 00:28:35,340 If you cross the line, we want you to stop because you're adding that noise to our networks where we're trying to prevent and catch the real bad guys, the nation states, etc. 353 00:28:35,340 --> 00:28:40,060 But if you've crossed over that line, we're not hiring hackers. 354 00:28:40,060 --> 00:28:43,420 This is just for the media because you guys don't get it right very often. 355 00:28:45,660 --> 00:28:47,700 That was the press booing. 356 00:28:48,300 --> 00:28:54,420 At that point, I also have t-shirts that are for trade. 357 00:28:54,420 --> 00:28:55,200 Ready? 358 00:29:02,640 --> 00:29:07,240 At the Defense Cyber Crime Center, we do have jobs available. 359 00:29:07,240 --> 00:29:09,600 You don't have to be a law enforcement agent. 360 00:29:09,600 --> 00:29:20,400 We have forensic examiner positions and programmers and engineers to do development, research and development of digital forensic and investigative tools. 361 00:29:20,400 --> 00:29:23,520 So lots of opportunities for those who are interested. 362 00:29:23,520 --> 00:29:27,000 Okay, let's open this up to questions and be loud. 363 00:29:27,900 --> 00:29:42,520 How many of these agencies here are hung up on the applicant requires to have a bachelor's degree as opposed to just experience, certifications, etc.? 364 00:29:45,260 --> 00:29:46,380 I'll start that. 365 00:29:46,380 --> 00:29:51,460 At the Defense Cyber Crime Center, you have to compete. 366 00:29:51,460 --> 00:30:01,980 But if you have experience, you don't have to have a degree to be a forensic examiner nor an engineer to develop tools. 367 00:30:05,140 --> 00:30:07,460 Anybody else on the panel want to take that? 368 00:30:08,600 --> 00:30:11,620 I have no hang-ups, nor does the organization. 369 00:30:11,620 --> 00:30:12,400 Louder. 370 00:30:12,400 --> 00:30:15,320 I have no hang-ups as to whether or not you have a degree. 371 00:30:15,320 --> 00:30:26,720 As Jim said, though, within any service, whether it's the government service or a large contractor, your competitive position relative to promotion and other things does depend upon the degree sometimes. 372 00:30:27,020 --> 00:30:31,840 But in terms of your ability to perform the work, whether or not you have a degree, that's what I'm looking for. 373 00:30:32,160 --> 00:30:37,390 Any reason why you don't have women on your panel? 374 00:30:41,950 --> 00:30:45,670 Is there any reason why you don't have women on your panel? 375 00:30:45,670 --> 00:30:46,390 No. 376 00:30:46,890 --> 00:30:47,770 No. 377 00:30:48,490 --> 00:30:49,770 Next question. 378 00:30:55,840 --> 00:30:59,760 I'd just like to say that three of my Deputy Assistant Secretaries are women. 379 00:31:02,080 --> 00:31:07,600 My boss is a woman, as well as we have one of our females out in the audience right now. 380 00:31:07,600 --> 00:31:08,620 She just doesn't want to come up. 381 00:31:08,620 --> 00:31:09,780 She's very shy. 382 00:31:14,300 --> 00:31:22,540 Gentlemen, this is not an attack against any one of you or your individual departments. 383 00:31:22,540 --> 00:31:31,940 However, I would like to know why the federal government, especially some of the law enforcement agencies, are destroying this country. 384 00:31:31,940 --> 00:31:39,860 And to clarify this position, I would like to read two paragraphs from the July 23rd edition... 385 00:31:39,860 --> 00:31:41,220 Can I see your badge? 386 00:31:41,220 --> 00:31:42,480 Can I see your badge? 387 00:31:42,480 --> 00:31:44,080 Why is it in your pocket? 388 00:31:44,100 --> 00:31:44,940 You hiding? 389 00:31:44,940 --> 00:31:45,440 No, sir. 390 00:31:45,440 --> 00:31:45,920 Oh. 391 00:31:45,980 --> 00:31:46,780 Okay. 392 00:31:46,780 --> 00:31:48,360 Is that a press pass? 393 00:31:48,360 --> 00:31:48,900 No, sir. 394 00:31:48,900 --> 00:31:49,680 Okay. 395 00:31:51,100 --> 00:31:58,920 The FBI is now under the full control of the Executive Office so that our President now has his own Gestapo. 396 00:31:58,920 --> 00:32:01,000 Then we have the National Security Service... 397 00:32:01,000 --> 00:32:02,120 They forgot to tell me that. 398 00:32:02,120 --> 00:32:03,080 I'm sorry. 399 00:32:03,540 --> 00:32:09,660 ...formed without congressional approval as part of the new anti-terrorism legislation. 400 00:32:09,660 --> 00:32:13,240 This new group has already been dubbed the SS. 401 00:32:13,240 --> 00:32:14,480 It operates under the... 402 00:32:14,480 --> 00:32:15,080 Okay. 403 00:32:15,080 --> 00:32:16,480 Can we cut him off? 404 00:32:20,600 --> 00:32:21,720 Okay. 405 00:32:31,790 --> 00:32:33,510 Anybody want to take that? 406 00:32:33,510 --> 00:32:36,030 Let's go back to that best and brightest scenario. 407 00:32:37,170 --> 00:32:40,490 I think if we had those capabilities, we'd brag about it. 408 00:32:40,590 --> 00:32:41,730 But we don't. 409 00:32:41,730 --> 00:32:43,270 We don't use microwaves. 410 00:32:43,270 --> 00:32:45,330 We're pretty on the up and up. 411 00:32:47,250 --> 00:32:50,200 I'd just like to know briefly from each of the members of the panel... 412 00:32:50,690 --> 00:32:53,890 I'm sure you're aware of the big Cisco thing that happened this week. 413 00:32:53,890 --> 00:32:57,390 I'd like to hear what the various agencies have to think about that. 414 00:33:03,570 --> 00:33:04,410 Keith. 415 00:33:09,170 --> 00:33:24,130 I think that if you have a fundamental flaw starting in the operating system, that's what we are fighting against. 416 00:33:24,130 --> 00:33:25,770 I mean, that's why I can get in. 417 00:33:25,770 --> 00:33:27,410 That's why you can get in. 418 00:33:27,410 --> 00:33:32,870 There's a trade being made all the time. 419 00:33:32,890 --> 00:33:39,890 And that trade is between operational whatever and security. 420 00:33:39,950 --> 00:33:44,730 And I don't know anyone. 421 00:33:44,730 --> 00:33:50,910 And part of me revels in this idea because that means I'm going to be employed forever. 422 00:33:51,510 --> 00:34:01,350 But I don't know anyone who's getting any corporate organization that's building software right now to do it right. 423 00:34:02,790 --> 00:34:09,370 Richard Powers in the audience, and he and I spoke at a software development conference, I guess it was in 2000. 424 00:34:09,810 --> 00:34:17,110 And I talked about how it was the fault of the people in that room that I could do what I can do. 425 00:34:17,110 --> 00:34:28,290 Because if I can utilize a buffer overflow because everybody's writing to the same address space in memory, then that software is crap. 426 00:34:28,910 --> 00:34:30,650 And it should be fixed. 427 00:34:30,650 --> 00:34:40,850 But I don't know that anything has happened enough to get anybody's attention except a bunch of people sitting in a tent in Las Vegas. 428 00:34:40,850 --> 00:34:46,490 I mean, you know, how many years ago did you lose 80,000 credit cards? 429 00:34:46,490 --> 00:34:48,310 Now you got 42 million. 430 00:34:49,010 --> 00:34:50,470 Anybody go to jail? 431 00:34:51,130 --> 00:34:53,670 Anybody get shot dead in the street over that? 432 00:34:53,710 --> 00:34:56,110 Anybody get hung from a tree? 433 00:34:56,350 --> 00:34:57,050 No. 434 00:34:57,790 --> 00:35:01,550 So I guess I have to turn it back to you. 435 00:35:01,550 --> 00:35:06,310 If you're expecting, you know, I'm not a law enforcement person. 436 00:35:06,310 --> 00:35:12,290 I'm just a tester like you all, except the ones who are working for the folks up here on the panel. 437 00:35:12,370 --> 00:35:16,030 But I mean, the other folks on this panel have credentials, right? 438 00:35:16,570 --> 00:35:19,670 But they can't execute laws that don't exist. 439 00:35:19,670 --> 00:35:24,010 They can't enforce something that's not there. 440 00:35:24,170 --> 00:35:31,430 So if the infrastructure is broken, or as Peter Neumann says so clearly, the infrastructure stinks. 441 00:35:31,430 --> 00:35:36,110 And it just stinks more and more and more and more because it becomes more complicated. 442 00:35:36,230 --> 00:35:41,130 Then, yeah, you can say, okay, Cisco this and Microsoft that and blah, blah, blah. 443 00:35:41,130 --> 00:35:42,270 And you can say, well, it's fine. 444 00:35:42,270 --> 00:35:43,950 I run WAPEX, you know. 445 00:35:43,950 --> 00:35:44,490 Well, great. 446 00:35:44,490 --> 00:35:45,770 It's got problems too. 447 00:35:45,930 --> 00:35:47,530 Everything has problems. 448 00:35:47,530 --> 00:35:53,990 So where's the result that's coming from you folks? 449 00:35:53,990 --> 00:36:04,150 I mean, yeah, you're out doing your thing and, you know, you're breaking in, which is kind of trivial because if you can't break a Wi-Fi connection with two tin cans and a string, you better go home. 450 00:36:04,530 --> 00:36:10,190 But the point is that you're doing what you're doing, but where's the result? 451 00:36:10,790 --> 00:36:12,630 When does it get to the boardroom? 452 00:36:13,050 --> 00:36:16,250 That's my question to you and to all of you. 453 00:36:16,310 --> 00:36:18,670 Because we can only do what we can do. 454 00:36:20,330 --> 00:36:21,310 That's it. 455 00:36:25,490 --> 00:36:25,990 Dr. 456 00:36:25,990 --> 00:36:27,710 Wells, did you want to respond on that? 457 00:36:27,710 --> 00:36:30,170 I'd just say from defense's perspective, the U.S. 458 00:36:30,170 --> 00:36:34,790 Surge has issued a vulnerability alert and we're taking action in response to the vulnerability alert. 459 00:36:36,190 --> 00:36:37,390 Next question. 460 00:36:37,410 --> 00:36:38,050 Yes, sir. 461 00:36:38,050 --> 00:36:42,850 This is a question repeated from five years ago, I think, just following up. 462 00:36:44,270 --> 00:36:58,930 Hey, to each of the agencies, as a parent and a teacher, what do your agencies now offer as far as internships, scholarships, and things like that to bring people to the good side, to have them work in your professions, to train them to be in your fields? 463 00:36:59,030 --> 00:37:00,990 I'll take first shot at that. 464 00:37:00,990 --> 00:37:05,370 We have four interns at the Defense Cybercrime Institute today. 465 00:37:05,370 --> 00:37:10,990 I was at Black Cat talking to several institutions, working with Jack Holleran. 466 00:37:10,990 --> 00:37:21,530 Jack Holleran hooked us up with a local university in Baltimore where we're going to kind of mentor the students that are doing digital forensics and offer internships. 467 00:37:21,530 --> 00:37:33,890 And absolutely, but the problem is we had a series of their Cyber Corps, which is a scholarship for service call. 468 00:37:34,250 --> 00:37:35,450 Hey, how you doing? 469 00:37:35,450 --> 00:37:36,310 How you doing? 470 00:37:36,310 --> 00:37:45,770 And what we were doing is all these institutions came to meet with us and they wanted to know what they should be teaching students so we would hire them. 471 00:37:45,770 --> 00:37:50,390 And mine was real simple. 472 00:37:50,390 --> 00:37:54,070 You've got to teach them not to do drugs and break into other people's systems. 473 00:37:54,070 --> 00:37:58,450 If you teach that, you know, the technology, there's plenty of technologists out there. 474 00:37:58,450 --> 00:38:02,890 So you've got to give us folks with the right morals and the right value set. 475 00:38:03,890 --> 00:38:04,770 Absolutely. 476 00:38:04,910 --> 00:38:05,810 Anybody else? 477 00:38:06,490 --> 00:38:09,750 Let's follow up a bit on the Cyber Corps. 478 00:38:10,170 --> 00:38:13,470 The Cyber Corps... okay, now? 479 00:38:13,470 --> 00:38:26,050 Alright, following up a bit on the Cyber Corps, there are 52 universities in the United States today that are capable of distributing scholarships and fellowships through the Cyber Corps program. 480 00:38:26,050 --> 00:38:34,810 Now those 52 universities are universities that have been designated as NSA Centers of Excellence in Information Security Education. 481 00:38:34,810 --> 00:38:43,570 What comes with a Cyber Corps scholarship or fellowship is essentially an internship and a job within a federal agency. 482 00:38:43,570 --> 00:38:49,670 It's an obligation of the student when they take the Cyber Corps scholarship or fellowship. 483 00:38:49,670 --> 00:38:54,610 It's essentially a service-for-fee situation. 484 00:38:54,610 --> 00:39:00,310 There are some 450 Cyber Corps students in the system today. 485 00:39:00,530 --> 00:39:04,330 And there are several hundred that have already joined federal agencies. 486 00:39:04,510 --> 00:39:07,410 Now that program has been quite a success. 487 00:39:09,470 --> 00:39:18,550 On the Canadian side of it, we also have co-op students who come within the agency and we see how they perform. 488 00:39:18,550 --> 00:39:22,490 They're there for either up to four months or eight months or it could be a year. 489 00:39:22,570 --> 00:39:33,930 And we monitor their progress and eventually, later on, if they do want to come back to the government agency and if their positions are available, they may get hired. 490 00:39:34,190 --> 00:39:38,870 So we do have a co-op program in place within the RCMP. 491 00:39:39,650 --> 00:39:40,470 Dave? 492 00:39:40,470 --> 00:39:44,570 Yes, the FBI has an extensive program of scholarships, tuition reimbursements. 493 00:39:45,210 --> 00:39:48,130 Detailed information is available on the FBI website. 494 00:39:49,010 --> 00:39:55,910 We have tuition reimbursement and we've also brought in Cyber Corps students and we have summer intern programs. 495 00:39:57,370 --> 00:40:00,030 We also have summer intern programs. 496 00:40:00,570 --> 00:40:11,970 We've got summer intern programs, tuition reimbursement, and I appreciate the question because it reminded me to ask some folks around here about us taking advantage of the Cyber Corps program. 497 00:40:12,190 --> 00:40:15,590 I'm not sure I would remember to do that without it. 498 00:40:17,130 --> 00:40:20,430 The IRS does have summer intern programs as well. 499 00:40:21,210 --> 00:40:23,110 So we've come some way in five years, huh? 500 00:40:27,870 --> 00:40:33,090 Line up over here. 501 00:40:33,090 --> 00:40:46,970 Actually, this is addressing the gentleman from the GAO, about your response to the question earlier. 502 00:40:48,790 --> 00:41:01,570 With what Michael did and Cisco and his own company trying to sue him for what he was doing to be a responsible action, trying to let the community know that this problem was there. 503 00:41:01,570 --> 00:41:05,390 Even though Cisco didn't want the information released. 504 00:41:07,350 --> 00:41:29,690 I'd like to know what the organizations that you all represent are doing to change the laws in this country to quit holding accountable the individuals that are releasing this information trying to improve things rather than make the vendors responsible for taking appropriate actions and releasing the information. 505 00:41:35,380 --> 00:41:37,360 One real quick thing, ladies and gentlemen. 506 00:41:38,460 --> 00:41:40,140 You can't spot these guys. 507 00:41:42,200 --> 00:41:42,920 Sorry. 508 00:41:43,200 --> 00:41:47,900 Please do not approach me after the panel and go, I spotted a Fed, and then drag one of these poor gentlemen up. 509 00:41:47,900 --> 00:41:48,940 That's just not fair. 510 00:41:49,800 --> 00:41:51,660 It's kind of like sleeping with your sister, you know? 511 00:41:53,040 --> 00:41:54,560 You slept with his sister? 512 00:41:55,120 --> 00:41:56,120 Your sister? 513 00:41:58,440 --> 00:42:00,280 Actually, yeah, your sister was pretty good. 514 00:42:01,720 --> 00:42:03,100 Better that than my mother, though. 515 00:42:04,600 --> 00:42:06,720 And by the way, Roy, would you stand up? 516 00:42:07,580 --> 00:42:11,060 Contrary to popular belief to remember, this man is not a Fed. 517 00:42:13,040 --> 00:42:14,120 Mystery solved. 518 00:42:14,680 --> 00:42:15,520 Thanks, guys. 519 00:42:29,940 --> 00:42:31,440 I forgot I stepped on you. 520 00:42:31,440 --> 00:42:32,060 Thank you. 521 00:42:32,740 --> 00:42:34,900 Yes, I'm with the mic now, sir. 522 00:42:36,400 --> 00:42:38,080 We are doing the Men of DEF CON calendar. 523 00:42:38,080 --> 00:42:43,840 We ask the women, and the women only, please, if there is a man you would like to see on the website in terms of the Men of DEF CON. 524 00:42:43,840 --> 00:42:49,380 Since we've exploited you guys, women, that is, for the last, God, how many years now? 525 00:42:49,660 --> 00:42:54,760 A lot of the women from the Women in Hacking talk have asked if they could exploit you guys. 526 00:42:55,200 --> 00:42:56,300 So the answer is yes, women. 527 00:42:56,300 --> 00:42:58,620 You are now able to objectify the men. 528 00:42:59,660 --> 00:43:10,120 If you find a man that you find would be a good addition, be he a geek and fatass like I am, or incredibly in shape like the gentleman behind me, that you would... 529 00:43:10,120 --> 00:43:11,360 You like big butts, sir? 530 00:43:11,360 --> 00:43:12,140 Congratulations. 531 00:43:13,840 --> 00:43:15,740 I think there's a song about that for you, sir. 532 00:43:17,580 --> 00:43:19,420 Please have them see Q. 533 00:43:20,120 --> 00:43:22,540 You can find Q through the information booth. 534 00:43:22,600 --> 00:43:24,540 Please make sure your subject is willing. 535 00:43:24,860 --> 00:43:25,200 Okay? 536 00:43:25,200 --> 00:43:27,580 We don't want you kidding them over the head and raping them. 537 00:43:27,940 --> 00:43:28,400 Oh, I'm sorry. 538 00:43:28,400 --> 00:43:28,620 Wait a minute. 539 00:43:28,620 --> 00:43:29,060 I didn't see that one. 540 00:43:29,060 --> 00:43:29,480 Sorry. 541 00:43:32,120 --> 00:43:34,260 Yes, sir, just bear with me here, okay? 542 00:43:34,260 --> 00:43:36,720 I realize you're not getting any, but some guys are. 543 00:43:38,620 --> 00:43:40,040 And it's not naked. 544 00:43:40,040 --> 00:43:41,360 It's shirt optional. 545 00:43:41,360 --> 00:43:42,400 And it's nothing nasty. 546 00:43:42,400 --> 00:43:43,640 It's just a picture of you on the webpage. 547 00:43:43,640 --> 00:43:44,640 Nothing identifying. 548 00:43:44,960 --> 00:43:47,480 It's just for the girls to vote on who's the sexiest guy at Def Con. 549 00:43:47,480 --> 00:43:48,900 So, thank you. 550 00:43:55,240 --> 00:43:59,720 Well, since I think the question was directed to me, I'll respond to it. 551 00:44:01,480 --> 00:44:05,480 We report what we find to the Congress. 552 00:44:05,740 --> 00:44:12,520 And we report what we find to the Congress in a way of saying, this is open and this is closed. 553 00:44:13,260 --> 00:44:18,280 So, what's closed information, we're telling them that the general public doesn't have it. 554 00:44:18,280 --> 00:44:22,120 And what's open information, we're saying this is what the public does have. 555 00:44:22,120 --> 00:44:23,880 So we make the distinction. 556 00:44:24,000 --> 00:44:28,760 It's up to the lawmakers to make the law. 557 00:44:29,100 --> 00:44:31,240 All we can do is tell them. 558 00:44:31,700 --> 00:44:37,680 Just like all the law enforcement people up on this panel can do is enforce the laws that exist. 559 00:44:41,370 --> 00:44:42,850 Next question. 560 00:44:42,850 --> 00:44:47,710 I'm really glad that the HR department prepped everyone. 561 00:44:47,710 --> 00:44:49,310 Sorry, I did have a question. 562 00:44:49,490 --> 00:45:09,050 And that was that when the Department of Homeland Security talks about very big concepts that can be boiled down to three words like critical infrastructure protection, how do you conceptually protect the nation's critical infrastructure from a grassroots effort, 563 00:45:09,050 --> 00:45:09,510 i.e. 564 00:45:10,050 --> 00:45:11,170 InfraGard? 565 00:45:13,110 --> 00:45:15,310 By doing something like this, I mean, it's very difficult. 566 00:45:15,310 --> 00:45:25,490 You can protect the planes, you can make it look good on the news, but in terms of affecting terror and things like that, there are many, many easier ways to do this that we know that we just cannot protect against. 567 00:45:25,490 --> 00:45:33,430 But what kind of grassroots efforts are you cultivating to try to at least reduce the risk exposure? 568 00:45:40,160 --> 00:45:50,200 I'm not sure I understand exactly the question, but there are, and you did mention InfraGard, and I'll answer because it is an FBI program, but InfraGard is a cooperation between the FBI and industry. 569 00:45:50,200 --> 00:45:54,360 There's over 14,000 members, and we expect those members to come forward. 570 00:45:54,360 --> 00:46:01,000 We share information with them on vulnerabilities and assessments and things that you don't get in the public because they're a part of that. 571 00:46:01,000 --> 00:46:04,660 And I know the Secret Service, they're not here, but I'll speak for them. 572 00:46:04,660 --> 00:46:15,680 There are New York electronic crimes task forces, which are similar to InfraGard, so there are a lot of efforts out there between us and private industry to share information. 573 00:46:16,640 --> 00:46:19,760 Okay, do we have time for one last question? 574 00:46:19,940 --> 00:46:22,300 I'm part of the Maryland InfraGard. 575 00:46:22,300 --> 00:46:28,120 The big thing we've discussed is how to build better education awareness to everybody. 576 00:46:28,260 --> 00:46:32,380 First they have to understand the problem before we can give them solutions. 577 00:46:33,600 --> 00:46:36,040 I've got time for one more question here. 578 00:46:36,420 --> 00:46:40,960 By the way, I teach security awareness courses for dummies with Wynn Shortoff. 579 00:46:40,960 --> 00:46:46,760 My question is back to the Centers for Excellence that you were talking about, Mr. 580 00:46:46,760 --> 00:46:47,600 Jacobs. 581 00:46:47,700 --> 00:47:00,120 And three or four years ago I was at Syracuse University as a reporter for Computer World, and I was covering the master's program as they were undergoing the criteria exchange to become a Center for Excellence. 582 00:47:00,240 --> 00:47:05,300 In the master's program, and I wrote about this, there were 32 students. 583 00:47:05,300 --> 00:47:07,100 One of them was American. 584 00:47:07,380 --> 00:47:10,460 The rest of them were from the Pacific Rim and the Middle East. 585 00:47:10,960 --> 00:47:17,300 And I was wondering what we can do to protect our educational outreach so that it goes to the right people. 586 00:47:29,810 --> 00:47:40,750 To be a member of the Cyber Corps, you are looking for Americans that are clearable, for the most part, at the end of the day. 587 00:47:41,390 --> 00:47:48,890 To suggest that our educational system, however, should restrict its offerings only to Americans generally... 588 00:47:48,890 --> 00:47:52,290 Are there any academics in the room? 589 00:47:52,290 --> 00:47:54,990 I think you'd have a real serious problem with that. 590 00:47:57,390 --> 00:48:00,770 Your observation at Syracuse is no different than mine. 591 00:48:00,770 --> 00:48:12,490 When I used to visit NSA Centers of Excellence at some of the earlier schools, I was struck by the composition of the classes that I was addressing. 592 00:48:13,230 --> 00:48:17,120 Perhaps better than 60% of them were not Americans. 593 00:48:17,880 --> 00:48:23,440 That's just the price you pay for having a premier educational system. 594 00:48:24,060 --> 00:48:28,920 And the education we dispense is helping people globally. 595 00:48:33,990 --> 00:48:36,830 Anybody else want to take a shot at that? 596 00:48:37,730 --> 00:48:39,090 May I? 597 00:48:39,090 --> 00:48:40,650 Absolutely, Bob. 598 00:48:44,910 --> 00:48:47,270 Hey, too soon. 599 00:48:49,330 --> 00:48:51,690 We would like to hire you. 600 00:48:52,090 --> 00:48:54,630 Please don't cross the line. 601 00:48:59,740 --> 00:49:02,180 That concludes the Meet the Fed panel. 602 00:49:02,180 --> 00:49:03,000 Thank you, guys. 603 00:49:03,000 --> 00:49:03,800 Got t-shirts.