start	end	text
9270	16710	Good afternoon, appreciate everybody showing up. I remember the last time we were in a tent, it was about 114 degrees, but it was on the roof.
17030	19790	And the air condition didn't work so well, so this is pretty good.
21310	27390	This is, I guess, the sixth Meet the Fed panel. We actually were fed pretty well anyway.
27450	30570	Meet the Fed panel that I participated in.
30670	35410	And this year we went international, so we have a representative from the Royal Canadian Mounted Police with us.
35410	43610	So, appreciate it. I'm Jim Christie. I'm a criminal investigator with the Air Force Office of Special Investigations.
43610	46990	And I'm the director of the Defense Cybercrime Institute.
47190	53970	What we're going to do this morning, this afternoon, is I'm going to do a quick bio on each of our members of the panel.
53970	57390	Then I'm going to let them have a one to two minute opening statement.
57450	62710	And I know Keith Rhodes will have to cut him off because he can't say anything in one to two minutes.
62710	67530	And then at that point, we're just going to open it up to questions from the floor.
68550	74810	So, let me start out with, they're not in any particular order, it might be an alphabetic order.
74810	77410	Don Blumenthal, if you'd raise your hand, Don.
77810	83990	Don is the Internet Lab Coordinator for the Federal Trade Commission, Bureau of Consumer Protection.
84290	89690	Mr. Blumenthal established the Overseas Labs Managing Consumer Protection Technical Support Group
89690	95550	and provides technical expertise to investigations that involve system issues.
95850	98990	His career also includes time with another federal agency.
98990	101210	And I don't know what that means, Don. What does that mean?
103290	104810	No comment. Okay.
104810	107590	It's one that nobody's heard of. It's not that it's sacred.
110630	116910	He's also had time in the private sector and as a legislative director for a member of the House of Representatives.
116910	118290	Who?
119410	121770	Louis Stokes, Northeast Ohio.
123870	132050	In his alternate universe, Mr. Blumenthal is about to start his 23rd year as a part-time scout for the Oakland Raiders.
132450	133990	So that's an interesting background.
137790	140390	Ovi Carroll. Raise your hand, Ovi.
140390	147050	Okay. Ovi Carroll is a special agent in charge of the Computer Crime Unit for the United States Postal Service.
147110	149250	Office of Inspector General.
149250	155690	The Computer Crime Unit is responsible for all computer intrusions, investigations, analysis and support.
156930	163030	Technical computer surveillance equipment and support to other criminal investigative organizations.
164590	169310	Ovi was also, he's a retired Air Force Office of Special Investigations agent,
169310	177530	where he had 20 years of law enforcement experience with the Air Force before going into retirement with the Postal Service.
180450	184430	Okay. Gauri, you're going to have to pronounce your name for us.
185850	188990	Hi, I'm Gauri Dhanuam with the RCMP.
190110	194570	My name is Gauri Dhanuam with the Royal Canadian Mounted Police in Ottawa, Canada.
194570	198430	And I guess I'll let Jim do the rest of the talking on my bio.
198910	201670	He was scared that he was going to bastardize my name.
201750	203770	You glad to be here, eh?
208990	213830	Okay. Andy Freed, I don't have a bio on because he doesn't answer emails.
214250	216690	He doesn't know how to do internet stuff.
216970	220210	But I've known Andy for, he's with the IRS.
220570	223770	I've known Andy since about 1986.
223770	228050	And I've got to tell you, in 1986 through probably 1992,
228370	235070	all the investigative software used by any computer crime investigator worldwide was written by Andy Freed.
235150	237790	In 1992 we found out it didn't work.
244650	246410	Mike Jacobs.
251630	254310	Wow, we've got a lot of NSA-ers here.
254570	257070	Okay, if you're NSA, raise your hand.
257950	259170	You're not.
259170	260690	Yeah, why?
261430	267810	Mike is the Vice President of SRA International, Director of the Cyber and National Security Program.
267810	274210	Prior to SRA, Mr. Jacobs was the Information Assurance Director at the National Security Agency,
274210	282790	responsible for development and provisioning of information security products, services, operations for the federal government.
283190	286430	Also, Mike was the Mayor of College Park, Maryland.
286430	293050	So whenever the University of Maryland won a basketball game or lost a basketball game and they burned down the city,
293050	294830	Mike would be on the news.
294830	296650	I'm sure that made NSA happy.
299650	301590	Rich Marshall, Esquire.
301590	304150	Also known Rich for a long time.
304350	312090	Senior Information Assurance Representative, Office of Legislative Affairs, National Security Agency.
312090	319810	NSA's Legislative Affairs Office, the agency point of contact for all NSA matters concerning Congress,
319810	325030	is committing to maintaining a relationship with Congress built on trust.
331010	334490	Their operating principles are the five C's.
334490	336950	Oh my God, I can't believe you put this in there.
338250	344130	CANDOR, COMPLETENESS, CORRECTNESS, CONSISTENCY, and CORPORATENESS.
348550	351690	You've got more shit with you than a Christmas turkey.
353250	360070	He was the former Principal Deputy Director of the Critical Infrastructure Assurance Office, the CHAO,
360070	363170	Bureau of Industry and Security, Department of Commerce.
363170	367050	Before joining the CHAO, Mr. Marshall served with distinction.
367050	368450	You wrote this, didn't you?
369750	375330	Served with distinction as the Associate General Counsel for Information Systems Security
375330	381190	for the Information Assurance Office of the General Counsel's National Security Agency for over eight years.
381510	385670	Mr. Marshall also represented the United States before the High Court of Justice in London
385670	393310	and has addressed various international, Department of Defense, Army, Navy, and Air Force legal conferences.
393310	396370	And now he has DEFCON on his resume.
400300	402060	Mr. Keith Rhodes.
403880	405540	No clapping, you notice.
407320	415840	Keith Rhodes is the Chief Technologist and Director of the Center for Technology and Engineering for the USGAO.
415840	417440	Anybody know what GAO stands for?
418840	421660	Wrong. Wrong. They changed their name.
421660	424540	It's the Government Accountability Office.
424540	425840	Y'all failed.
426120	434120	For the past ten years, he's led that team and has tested the information security of US government.
434120	440560	As the investigative arm of Congress, everybody else up here on the panel just loves Keith and his folks.
441460	445960	He regularly testifies before the US Congress and has addressed foreign governments,
445960	451760	speaks publicly about the results of the tests and on the off chance that something might improve.
455100	456900	David Thomas.
457900	460040	No clapping for you either.
460940	464980	David Thomas was designated Special Agent of the FBI in 1989.
464980	470340	After completing training, he was assigned to the Tampa Division where he worked violent crime matters.
470340	472180	So that's why he's here.
472930	481000	In October 1996, Special Agent Thomas was promoted to the position of Supervisory Special Agent in charge of violent crimes and domestic terrorism.
481120	487500	Upon completing that assignment with the Tampa Division, he was transferred to the FBI headquarters.
487500	488880	Who'd you piss off?
491360	493680	I did two years down there.
493680	505200	In July of 2004, Mr. Thomas was promoted to the position of Section Chief of the Cyber Counterterrorism, Counterintelligence and Criminal Computer Intrusion Investigations.
505200	510560	Additionally, he's responsible for the development of the FBI's Cyber Intelligence Unit and Cyber Action Teams,
510560	515760	which deploy domestically and internationally in response to major cyber events.
517700	521680	Dr. Linton Wells. A lot of you heard him speak.
522780	525080	Who's sucking up over there?
527080	533260	Actually, Dr. Wells was my boss when I was down at the FBI, so I'm a little pissed at you, sir.
534720	550760	Dr. Wells assumed duties as the Acting Assistant Secretary on 8 March 2004 and became the Principal Deputy Assistant Secretary of Defense for Network and Information Integration on August 20, 1998.
550760	558560	Prior to assignment, he was served in the Office of the Undersecretary of Defense for Policy since July of 1991.
558680	565580	Most recently as the Deputy Undersecretary of Defense Policy Support since 1998.
566000	574340	In 26 years of naval service, Dr. Wells served in a variety of surface ships, including command of a destroyer squadron and a guided missile destroyer.
574340	588800	In addition, he acquired a wide range of experience in operations analysis, Pacific Indian Ocean, Middle East Affairs Network and Information Integration and Special Access Program Oversight.
591240	596260	Wow, Dr. Wells was born in Angola. We won't tell him the year.
596260	604900	He was graduated from the U.S. Naval Academy in 1967 and holds a Bachelor of Science degree in Physics and Oceanography.
604900	614880	He attended graduate school at Johns Hopkins University and received a Master of Science of Engineering degree in Mathematical Sciences and a Ph.D. in International Relations.
614880	623320	He is also a 1983 graduate of the Japanese National Institute for Defense Studies in Tokyo, the first naval officer to attend there.
623320	632460	Dr. Wells has written widely on security studies in English and Japanese journals.
632460	637580	He has co-authored Japanese Cruisers of the Pacific War, which was published in 1997.
637800	644260	His hobbies include history, the relationship between policy, technology, scuba diving and flying.
644340	646560	So I read his whole bio because he is my boss.
648240	654960	We have one other person on the far end. You can't see him. Raise your hand, Andy.
654960	659540	The seat on your left, on your right, that's the CIA.
665440	668760	The individual is actually sitting among you.
669520	678060	Oh, I forgot Robert. We just added Robert Mars, Sr.
679820	683680	I met Robert last year officially.
692460	698700	Chief Scientist for NSA and the way I met him was through his son.
703480	709520	So, pretty good panel. I'm hoping the questions are going to be pretty good.
709520	714280	Before we start the questions, the panel asked me for a favor.
714300	716400	They wanted to do a survey.
718860	721600	Could everybody please stand up for a second?
726230	729790	Okay, if you are with NSA, please sit down.
731770	734370	A couple of wobbles there.
734370	739830	Okay, if you've never broken the law by breaking into somebody else's system, please sit down.
756500	760020	A couple of the cameras weren't working. Could you guys please stand up again?
763080	768760	Okay, those of you, we did this five years ago and I can't believe you guys fell for it again.
768760	775100	I hope you have clean underwear and a toothbrush because we've got the paddy wagons lined up out back.
775580	779300	So, with that, what we're going to do is we're going to start with Rich and go right down the line
779300	784140	and let everybody make a one to two minute opening statement and then we'll just open it up to you guys.
784140	784900	So, Rich.
785060	787300	Okay, I'm going to be real quick. A couple of things.
787300	789260	This is a legitimate deadhead shirt.
789260	791060	I am first generation dead.
791140	792700	Spent a lot of time partying.
796350	800070	Spent a lot of time partying with Jerry when he was alive and loved it.
800070	803990	Never did or never have been caught doing the drugs.
807290	810470	Tested 17 times at NSA.
811050	813950	They recognized me when I walked in.
815150	817430	I can't remember what year.
819010	822130	A couple of other things you should know about.
822450	824110	Jim mentioned that I'm a lawyer.
824110	827570	I was the legal architect for Eligible Receiver 97.
827570	829630	That was an important event.
829630	833930	In the United States history because that demonstrated to senior leadership
833930	836370	that information warfare was not a theory.
836370	837930	It was a reality.
838210	842210	And that was the time that Dick Clark decided he wanted to be a cyber security expert.
842390	846170	And the two of the people that really were instrumental in helping make that program work
846170	847850	are on the panel with us today.
847850	850810	Dr. Lynn Wells, we worked very closely putting that together.
850810	853770	And my former boss and great friend, Mike Jacobs.
853770	855670	Just absolutely awesome guys.
859990	863210	And my association with Bob Morris we can't talk about.
863210	865470	But it was through him, not his son.
865470	867450	He's an absolutely awesome guy.
867810	869650	Tremendous respect for him.
869790	875410	Last thing I want to talk about is we would love to have your resumes if you're clean.
875630	877810	I'm not talking drug. Well, yeah, we are.
879310	880650	40th slip.
881670	884150	But particularly in today's environment,
884150	888390	it's very critical that we have the best and brightest working on solutions.
888630	891390	And work with us on those solutions.
891450	893690	Come and join the team. Send me your resume.
893690	895910	We'll make sure it gets the appropriate consideration.
895910	897830	Fair enough? Thanks.
902480	903840	Dr. Wells.
905620	907000	You want to hear me in the back?
908440	911280	As I mentioned earlier, for those of you who had a chance to hear it,
911280	915340	DOD is moving toward this concept of network-centric operations
915340	919560	which really puts a greatly increased premium on the importance of the network
919560	921620	and thus protecting the network.
921620	927560	We've got a very sort of worldwide heterogeneous complex set of missions
927560	932860	which don't necessarily map to the private sector security concerns.
932860	935500	And so we certainly don't have all the answers.
935500	937660	And I second the point here.
937660	939800	We need to work with you.
939800	942620	We need to address your resumes.
942620	945500	The point I would ask, though, specifically is
946320	951600	what concerns me is not the kind of casual hacker for recreation or thrills.
951600	955420	I'm really concerned about people who are trying to get into DOD's networks
955420	960000	to steal the information or conduct attacks that disrupt what we're doing.
960000	964900	We have people out there today from Afghanistan to Iraq to Darfur to whatever
964900	967400	whose people's lives are on the line.
967400	969020	They depend on these networks.
969020	971880	And it's not just a casual thing for them.
971880	976540	So what I'd ask is a little less noise in the system.
976600	981600	The intrusions, the probing, the whatever,
981600	986820	basically moves our resources away from things that really need to be addressed.
986820	989760	And there clearly are people out there who are trying to do us harm
989760	993080	and harm to the kind of values I think that most of us share
993080	995200	about the value of information being shared.
995200	996640	So I'd ask for your cooperation
997240	1001220	and I look forward very much to working with you and getting your ideas.
1001220	1002080	Thank you very much.
1002360	1003340	Thanks.
1007650	1009010	Bob?
1010890	1013790	I promise not to give a speech.
1016170	1019970	I'm sorry. My whole speech is no comment.
1021870	1026890	I will very likely, before the end of this, break that promise.
1026990	1030210	But there's something substantive I want to say.
1030210	1034850	The smartest and brightest of you, we need you guys.
1035650	1039610	Two things. One is, if you're reasonably good,
1039610	1042590	do consider seriously coming to the government,
1042590	1047890	including my organization that also badly needs the brightest and best.
1048090	1053970	There is one side issue, though, that you need to take care of.
1053970	1057490	We would like to hire the best of you,
1057490	1061990	and we will if you can apply and do apply.
1062110	1066510	But there's a line. Don't cross the line.
1066790	1068910	Others will say that to you also.
1068930	1070890	Hey, it's okay to smoke pot.
1070890	1072770	Oh, I'm sorry. I shouldn't have said that.
1079260	1080920	Okay, thank you, Bob.
1083800	1085680	But don't get caught.
1087340	1089580	Otherwise, no comment.
1090500	1092300	And don't inhale.
1093600	1100880	Just a little bit of a bio on myself here.
1100880	1106000	I'm in charge of the network and information operations team in Ottawa.
1106000	1110600	And basically, our team is composed of civilian members and regular members.
1110600	1115040	And we are also looking for some talent to come to the RCMP.
1115100	1118660	And it's an honor being in front of some of the brightest guys and people,
1118660	1122100	young ladies and men in the tent here today.
1122240	1124100	We investigate...
1124100	1126180	He's talking about the panel.
1128410	1129640	You too, Jim.
1132820	1137420	We investigate unauthorized use of computers, mishifted data,
1137420	1141500	anything related to computer crime incidents.
1141500	1147680	And also, the tech crime branch is the contact for any international agency.
1147680	1154540	We're 24-7, and so if anybody has any incident regarding computer-related incidents,
1154540	1159460	they call us and we'll disseminate to the right agency within Canada.
1160600	1162100	Thanks, Greg. Mike?
1168710	1171630	I've got to bring my fan club all the time.
1173050	1177110	After three years in the private sector, a couple of observations.
1178030	1182350	My career at NSA, I worked predominantly with the Department of Defense.
1183250	1189190	And now in the private sector, most of my clients are in the civil governmental side of the government.
1189910	1197450	The conditions there are perhaps what the Department of Defense experienced 25 years ago.
1197590	1199510	But they are improving.
1199870	1202110	So too is the product space.
1202110	1207530	Most of the failures that we're seeing today is in the human domain.
1208550	1210370	Stupidity in many cases.
1211330	1216550	Your skills and the activity that you're engaged in help us learn every day.
1217190	1220850	But as Bob said, don't cross the line. We do need you.
1220910	1224630	Both in the government, and we need you in the private sector.
1224970	1226670	There's an awful lot to be done.
1226670	1233270	Our near total dependency on the network today as a nation requires us to do the very best that we can
1233270	1238070	in terms of improving the security and the integrity of those networks.
1238570	1246350	Now last year when I was here, I had the opportunity to auction off to a single purchaser an NSA t-shirt.
1246930	1253590	And that purchaser, BIT, gave me $60 for an NSA t-shirt that I didn't pay anything for.
1254170	1255950	That all went to charity, of course.
1255950	1259730	Now this year I have two NSA t-shirts.
1260310	1264190	Is the guy here who bought it for $60 last year? Because these are different.
1268530	1277270	Now on the other hand, I'm willing to trade both of these t-shirts, one each, for a legitimate resume of someone I can hire.
1278350	1279410	Thank you.
1285930	1286970	David.
1287210	1289930	Thank you. Dave Thomas with the FBI.
1290210	1292810	On behalf of the FBI, I appreciate you coming.
1293050	1298270	Being from the great state of Tennessee, this somewhat reminds me of an old-time tent revival.
1299710	1308990	If any of you feel the power coming over you, I just want you to know that we're authorized to take confession 24 hours a day.
1310210	1311650	Please see me.
1315130	1319710	I'm living proof that the FBI doesn't always hire the best and the brightest.
1320570	1324630	For all of you, the rest of you out there, there is a chance. Stay with it.
1328790	1329670	Keith.
1330370	1333670	Hello, my name is Keith Rhodes. I'm with the GAO.
1333670	1335110	Speak up, we can't hear you.
1335110	1336070	Okay.
1337790	1345870	What I would like to say is that five years ago, when I sat on this panel, I said the following statement.
1345870	1350550	We always get in. Five years hence, we always get in.
1350810	1352510	Is that short enough for you, Jim?
1353050	1363110	If you would like to come to the legislative branch and test the security in the executive branch, give me a resume.
1366810	1367690	O.V.
1368930	1371950	I'm O.V. Carroll with the Postal Inspector General's Office.
1371950	1383210	We respond to the incidents involving the 35,000 postal networks, as well as all the computer crime, computer forensics for criminal investigations,
1383210	1386330	investigated by the Postal Inspector General's Office.
1386330	1394170	We have an announcement out on usajobs.opm.gov for Dallas, Denver, L.A., and Washington, D.C. right now.
1394170	1395190	Don.
1401380	1403500	A little too quick, I wasn't quite ready there.
1405060	1412560	I know a lot of people here have been at a number of these sessions before, but the FTC is new to meet the feds.
1412840	1416960	So I wanted to talk a little bit about what we do and what our involvement is.
1416960	1418240	Closer? Okay.
1420420	1429620	I've known about DEF CON for years, really appreciate the opportunity to come because I've wanted to and now since I'm on the panel I can get the agency to pay for it.
1430980	1436440	We're an independent agency and we're a civil law enforcement agency only.
1437640	1443500	We've been in internet and online activity law enforcement for, I think our first case was 1994.
1444220	1455700	And because of the wording of our mandate, which is one of the broadest in the federal sector, we can dabble in just about anything we think might affect consumers.
1456140	1463680	So in the internet world we have dealt with good old scams, you know, the things that used to be in the back of the magazines but are now on websites.
1465300	1476260	We have dealt with mouse trapping, page jacking, a lot of technical things that really, or techniques new to the internet, couldn't have been done before.
1478860	1487900	One of our biggest areas right now, best known program I think of my division, I'm not mad, the division that my group's in is the Do Not Call List,
1487900	1497440	which is probably, I think it's the thing we're best known for these days, but the other thing that we have going is our spam law enforcement.
1497440	1503060	We were one of the earliest, we have the spam database, spam at uce.gov.
1506660	1512320	Forward your messages to that address, they're indexed within an hour and there for us.
1512320	1517360	And now other law enforcement agencies to use to find raw evidence in spam investigations.
1519320	1523480	We, on the law enforcement side, we come at this from a little bit different angle.
1523480	1526980	We are civil. I can't threaten anybody with jail.
1527460	1534640	But on the other hand, my burden of proof is a lot lower than in the criminal side, and I don't have to prove intent.
1535080	1539740	So very often we can make the cases that the crims can't, and frequently we work with them.
1541300	1546060	If we decide it's crossed the line, we'll hand it over, that's happened in some phishing matters.
1546060	1549440	We brought phishing, but some of them are beyond what we should be doing.
1551240	1553940	The other thing is we do security cases.
1554220	1560800	We have kind of marked ourselves out as big in the whole area of consumer privacy, consumer security.
1560860	1568360	But the difference with us is, when we brought a security case, we have not gone against the people doing the breaches.
1568880	1572920	Our defendants have been the companies who have allowed themselves to be breached.
1572920	1579540	With idiotically, maybe that's a bad word, with weak security systems.
1579540	1588380	On, for example, online ordering systems, or a wireless point of sale system.
1588380	1590740	That case just hit about six weeks ago.
1590940	1598520	So our view is more toward the consumer, and as a result, what the consumer has heard is more by the companies that are breached,
1598520	1601040	rather than the folks who do that work.
1603240	1607800	We've got some ideas for some other things, but at least that's the types of cases we've brought so far.
1607880	1609640	Thanks, Don.
1612420	1613300	Andy.
1614540	1618960	Hi, my name is Andrew Freed. I'm with the Treasury Department. I've been there 17 years.
1619100	1623820	For those of you who were not caught because my software didn't work, you can thank me later.
1624860	1630920	When Jim Christie and I first got involved in computer security, there was no internet publicly available.
1630920	1638360	It's been very interesting seeing how a lot of people have come up through the ranks and put together programs that were just amazing.
1638360	1639460	Can't hear you.
1641940	1644120	I like to mess with the sound guys.
1645060	1650080	Basically, we want to say to all of you that if you're interested in law enforcement and you have a computer background,
1650460	1653200	it's a really good lifestyle. It's a lot of fun.
1653360	1659120	Sometimes people don't like you showing up at their doorstep, but for the most part, it's very challenging and rewarding.
1659120	1665900	I would once again invite all of you that are interested in law enforcement to pursue it, try to stay as clean as you can,
1665900	1667760	and see us after the show.
1669100	1670160	Thanks, guys.
1675600	1678920	What I wanted to say before we just... we're going to open it up to questions in a second.
1678920	1683480	I need you to speak up because I've got the fans going. It's hard to hear up here.
1684340	1686140	This is mainly for the media.
1686140	1693160	After every DEF CON Meet the Fed panel, there are headlines that we all have to go back and answer for that says,
1693160	1697120	we're here recruiting hackers, which means to our bosses, criminals.
1697120	1698800	That's not why we're here.
1698820	1704300	Like everybody here on the panel said, we're looking for the folks who haven't crossed that line yet.
1704460	1709160	If you cross the line, we want you to stop because you're adding that noise to our networks
1709160	1715340	where we're trying to prevent and catch the real bad guys, the nation states, etc.
1715340	1720060	But if you've crossed over that line, we're not hiring hackers.
1720060	1723420	This is just for the media because you guys don't get it right very often.
1725660	1727700	That was the press booing.
1728300	1734420	At that point, I also have t-shirts that are for trade.
1734420	1735200	Ready?
1742640	1747240	At the Defense Cyber Crime Center, we do have jobs available.
1747240	1749600	You don't have to be a law enforcement agent.
1749600	1756860	We have forensic examiner positions and programmers and engineers to do development,
1756860	1760400	research and development of digital forensic and investigative tools.
1760400	1763520	So lots of opportunities for those who are interested.
1763520	1767000	Okay, let's open this up to questions and be loud.
1767900	1778220	How many of these agencies here are hung up on the applicant requires to have a bachelor's degree
1778220	1782520	as opposed to just experience, certifications, etc.?
1785260	1791460	I'll start that. At the Defense Cyber Crime Center, you have to compete.
1791460	1797100	But if you have experience, you don't have to have a degree to be a forensic examiner
1797600	1801980	nor an engineer to develop tools.
1805140	1807460	Anybody else on the panel want to take that?
1808600	1811620	I have no hang-ups, nor does the organization.
1811620	1812400	Louder.
1812400	1815320	I have no hang-ups as to whether or not you have a degree.
1815320	1821720	As Jim said, though, within any service, whether it's the government service or a large contractor,
1821720	1826720	your competitive position relative to promotion and other things does depend upon the degree sometimes.
1827020	1831840	But in terms of your ability to perform the work, whether or not you have a degree, that's what I'm looking for.
1832160	1837390	Any reason why you don't have women on your panel?
1841950	1845670	Is there any reason why you don't have women on your panel?
1845670	1849770	No. No. Next question.
1855840	1859760	I'd just like to say that three of my Deputy Assistant Secretaries are women.
1862080	1867600	My boss is a woman, as well as we have one of our females out in the audience right now.
1867600	1869780	She just doesn't want to come up. She's very shy.
1874300	1882540	Gentlemen, this is not an attack against any one of you or your individual departments.
1882540	1891940	However, I would like to know why the federal government, especially some of the law enforcement agencies, are destroying this country.
1891940	1899860	And to clarify this position, I would like to read two paragraphs from the July 23rd edition...
1899860	1902480	Can I see your badge? Can I see your badge?
1902480	1904940	Why is it in your pocket? You hiding?
1904940	1905440	No, sir.
1905440	1908360	Oh. Okay. Is that a press pass?
1908360	1908900	No, sir.
1908900	1918920	Okay. The FBI is now under the full control of the Executive Office so that our President now has his own Gestapo.
1918920	1921000	Then we have the National Security Service...
1921000	1923080	They forgot to tell me that. I'm sorry.
1923540	1929660	...formed without congressional approval as part of the new anti-terrorism legislation.
1929660	1934480	This new group has already been dubbed the SS. It operates under the...
1934480	1936480	Okay. Can we cut him off?
1940600	1941720	Okay.
1951790	1953510	Anybody want to take that?
1953510	1956030	Let's go back to that best and brightest scenario.
1957170	1965330	I think if we had those capabilities, we'd brag about it. But we don't. We don't use microwaves. We're pretty on the up and up.
1967250	1970200	I'd just like to know briefly from each of the members of the panel...
1970690	1977390	I'm sure you're aware of the big Cisco thing that happened this week. I'd like to hear what the various agencies have to think about that.
1983570	1984410	Keith.
1989170	2004130	I think that if you have a fundamental flaw starting in the operating system, that's what we are fighting against.
2004130	2007410	I mean, that's why I can get in. That's why you can get in.
2007410	2019890	There's a trade being made all the time. And that trade is between operational whatever and security.
2019950	2030910	And I don't know anyone. And part of me revels in this idea because that means I'm going to be employed forever.
2031510	2041350	But I don't know anyone who's getting any corporate organization that's building software right now to do it right.
2042790	2049370	Richard Powers in the audience, and he and I spoke at a software development conference, I guess it was in 2000.
2049810	2057110	And I talked about how it was the fault of the people in that room that I could do what I can do.
2057110	2068290	Because if I can utilize a buffer overflow because everybody's writing to the same address space in memory, then that software is crap.
2068910	2080850	And it should be fixed. But I don't know that anything has happened enough to get anybody's attention except a bunch of people sitting in a tent in Las Vegas.
2080850	2088310	I mean, you know, how many years ago did you lose 80,000 credit cards? Now you got 42 million.
2089010	2097050	Anybody go to jail? Anybody get shot dead in the street over that? Anybody get hung from a tree? No.
2097790	2106310	So I guess I have to turn it back to you. If you're expecting, you know, I'm not a law enforcement person.
2106310	2112290	I'm just a tester like you all, except the ones who are working for the folks up here on the panel.
2112370	2119670	But I mean, the other folks on this panel have credentials, right? But they can't execute laws that don't exist.
2119670	2131430	They can't enforce something that's not there. So if the infrastructure is broken, or as Peter Neumann says so clearly, the infrastructure stinks.
2131430	2136110	And it just stinks more and more and more and more because it becomes more complicated.
2136230	2143950	Then, yeah, you can say, okay, Cisco this and Microsoft that and blah, blah, blah. And you can say, well, it's fine. I run WAPEX, you know.
2143950	2153990	Well, great. It's got problems too. Everything has problems. So where's the result that's coming from you folks?
2153990	2164150	I mean, yeah, you're out doing your thing and, you know, you're breaking in, which is kind of trivial because if you can't break a Wi-Fi connection with two tin cans and a string, you better go home.
2164530	2172630	But the point is that you're doing what you're doing, but where's the result? When does it get to the boardroom?
2173050	2178670	That's my question to you and to all of you. Because we can only do what we can do.
2180330	2181310	That's it.
2185490	2187710	Dr. Wells, did you want to respond on that?
2187710	2194790	I'd just say from defense's perspective, the U.S. Surge has issued a vulnerability alert and we're taking action in response to the vulnerability alert.
2196190	2198050	Next question. Yes, sir.
2198050	2202850	This is a question repeated from five years ago, I think, just following up.
2204270	2218930	Hey, to each of the agencies, as a parent and a teacher, what do your agencies now offer as far as internships, scholarships, and things like that to bring people to the good side, to have them work in your professions, to train them to be in your fields?
2219030	2225370	I'll take first shot at that. We have four interns at the Defense Cybercrime Institute today.
2225370	2241530	I was at Black Cat talking to several institutions, working with Jack Holleran. Jack Holleran hooked us up with a local university in Baltimore where we're going to kind of mentor the students that are doing digital forensics and offer internships.
2241530	2253890	And absolutely, but the problem is we had a series of their Cyber Corps, which is a scholarship for service call.
2254250	2256310	Hey, how you doing? How you doing?
2256310	2265770	And what we were doing is all these institutions came to meet with us and they wanted to know what they should be teaching students so we would hire them.
2265770	2278450	And mine was real simple. You've got to teach them not to do drugs and break into other people's systems. If you teach that, you know, the technology, there's plenty of technologists out there.
2278450	2285810	So you've got to give us folks with the right morals and the right value set. Absolutely. Anybody else?
2286490	2293470	Let's follow up a bit on the Cyber Corps. The Cyber Corps... okay, now?
2293470	2306050	Alright, following up a bit on the Cyber Corps, there are 52 universities in the United States today that are capable of distributing scholarships and fellowships through the Cyber Corps program.
2306050	2314810	Now those 52 universities are universities that have been designated as NSA Centers of Excellence in Information Security Education.
2314810	2323570	What comes with a Cyber Corps scholarship or fellowship is essentially an internship and a job within a federal agency.
2323570	2334610	It's an obligation of the student when they take the Cyber Corps scholarship or fellowship. It's essentially a service-for-fee situation.
2334610	2344330	There are some 450 Cyber Corps students in the system today. And there are several hundred that have already joined federal agencies.
2344510	2347410	Now that program has been quite a success.
2349470	2358550	On the Canadian side of it, we also have co-op students who come within the agency and we see how they perform.
2358550	2362490	They're there for either up to four months or eight months or it could be a year.
2362570	2373930	And we monitor their progress and eventually, later on, if they do want to come back to the government agency and if their positions are available, they may get hired.
2374190	2378870	So we do have a co-op program in place within the RCMP.
2379650	2380470	Dave?
2380470	2388130	Yes, the FBI has an extensive program of scholarships, tuition reimbursements. Detailed information is available on the FBI website.
2389010	2395910	We have tuition reimbursement and we've also brought in Cyber Corps students and we have summer intern programs.
2397370	2400030	We also have summer intern programs.
2400570	2411970	We've got summer intern programs, tuition reimbursement, and I appreciate the question because it reminded me to ask some folks around here about us taking advantage of the Cyber Corps program.
2412190	2415590	I'm not sure I would remember to do that without it.
2417130	2420430	The IRS does have summer intern programs as well.
2421210	2423110	So we've come some way in five years, huh?
2427870	2433090	Line up over here.
2433090	2446970	Actually, this is addressing the gentleman from the GAO, about your response to the question earlier.
2448790	2461570	With what Michael did and Cisco and his own company trying to sue him for what he was doing to be a responsible action, trying to let the community know that this problem was there.
2461570	2465390	Even though Cisco didn't want the information released.
2467350	2489690	I'd like to know what the organizations that you all represent are doing to change the laws in this country to quit holding accountable the individuals that are releasing this information trying to improve things rather than make the vendors responsible for taking appropriate actions and releasing the information.
2495380	2497360	One real quick thing, ladies and gentlemen.
2498460	2500140	You can't spot these guys.
2502200	2508940	Sorry. Please do not approach me after the panel and go, I spotted a Fed, and then drag one of these poor gentlemen up. That's just not fair.
2509800	2511660	It's kind of like sleeping with your sister, you know?
2513040	2514560	You slept with his sister?
2515120	2516120	Your sister?
2518440	2520280	Actually, yeah, your sister was pretty good.
2521720	2523100	Better that than my mother, though.
2524600	2526720	And by the way, Roy, would you stand up?
2527580	2531060	Contrary to popular belief to remember, this man is not a Fed.
2533040	2535520	Mystery solved. Thanks, guys.
2549940	2552060	I forgot I stepped on you. Thank you.
2552740	2554900	Yes, I'm with the mic now, sir.
2556400	2563840	We are doing the Men of DEF CON calendar. We ask the women, and the women only, please, if there is a man you would like to see on the website in terms of the Men of DEF CON.
2563840	2569380	Since we've exploited you guys, women, that is, for the last, God, how many years now?
2569660	2574760	A lot of the women from the Women in Hacking talk have asked if they could exploit you guys.
2575200	2578620	So the answer is yes, women. You are now able to objectify the men.
2579660	2590120	If you find a man that you find would be a good addition, be he a geek and fatass like I am, or incredibly in shape like the gentleman behind me, that you would...
2590120	2592140	You like big butts, sir? Congratulations.
2593840	2595740	I think there's a song about that for you, sir.
2597580	2602540	Please have them see Q. You can find Q through the information booth.
2602600	2607580	Please make sure your subject is willing. Okay? We don't want you kidding them over the head and raping them.
2607940	2609480	Oh, I'm sorry. Wait a minute. I didn't see that one. Sorry.
2612120	2614260	Yes, sir, just bear with me here, okay?
2614260	2616720	I realize you're not getting any, but some guys are.
2618620	2621360	And it's not naked. It's shirt optional.
2621360	2624640	And it's nothing nasty. It's just a picture of you on the webpage. Nothing identifying.
2624960	2628900	It's just for the girls to vote on who's the sexiest guy at Def Con. So, thank you.
2635240	2639720	Well, since I think the question was directed to me, I'll respond to it.
2641480	2645480	We report what we find to the Congress.
2645740	2652520	And we report what we find to the Congress in a way of saying, this is open and this is closed.
2653260	2658280	So, what's closed information, we're telling them that the general public doesn't have it.
2658280	2662120	And what's open information, we're saying this is what the public does have.
2662120	2668760	So we make the distinction. It's up to the lawmakers to make the law.
2669100	2671240	All we can do is tell them.
2671700	2677680	Just like all the law enforcement people up on this panel can do is enforce the laws that exist.
2681370	2682850	Next question.
2682850	2687710	I'm really glad that the HR department prepped everyone.
2687710	2689310	Sorry, I did have a question.
2689490	2696090	And that was that when the Department of Homeland Security talks about very big concepts
2696090	2700610	that can be boiled down to three words like critical infrastructure protection,
2700610	2711170	how do you conceptually protect the nation's critical infrastructure from a grassroots effort, i.e. InfraGard?
2713110	2715310	By doing something like this, I mean, it's very difficult.
2715310	2719190	You can protect the planes, you can make it look good on the news,
2719190	2721990	but in terms of affecting terror and things like that,
2721990	2725490	there are many, many easier ways to do this that we know that we just cannot protect against.
2725490	2733430	But what kind of grassroots efforts are you cultivating to try to at least reduce the risk exposure?
2740160	2744100	I'm not sure I understand exactly the question, but there are, and you did mention InfraGard,
2744100	2750200	and I'll answer because it is an FBI program, but InfraGard is a cooperation between the FBI and industry.
2750200	2754360	There's over 14,000 members, and we expect those members to come forward.
2754360	2758740	We share information with them on vulnerabilities and assessments and things that you don't get in the public
2758740	2764660	because they're a part of that. And I know the Secret Service, they're not here, but I'll speak for them.
2764660	2769960	There are New York electronic crimes task forces, which are similar to InfraGard,
2769960	2773840	so there are a lot of efforts out there between us and private industry
2774100	2775680	to share information.
2776640	2779760	Okay, do we have time for one last question?
2779940	2788120	I'm part of the Maryland InfraGard. The big thing we've discussed is how to build better education awareness to everybody.
2788260	2792380	First they have to understand the problem before we can give them solutions.
2793600	2796040	I've got time for one more question here.
2796420	2800960	By the way, I teach security awareness courses for dummies with Wynn Shortoff.
2800960	2807600	My question is back to the Centers for Excellence that you were talking about, Mr. Jacobs.
2807700	2812420	And three or four years ago I was at Syracuse University as a reporter for Computer World,
2812420	2820120	and I was covering the master's program as they were undergoing the criteria exchange to become a Center for Excellence.
2820240	2825300	In the master's program, and I wrote about this, there were 32 students.
2825300	2830460	One of them was American. The rest of them were from the Pacific Rim and the Middle East.
2830960	2837300	And I was wondering what we can do to protect our educational outreach so that it goes to the right people.
2849810	2860750	To be a member of the Cyber Corps, you are looking for Americans that are clearable, for the most part, at the end of the day.
2861390	2868890	To suggest that our educational system, however, should restrict its offerings only to Americans generally...
2868890	2874990	Are there any academics in the room? I think you'd have a real serious problem with that.
2877390	2880770	Your observation at Syracuse is no different than mine.
2880770	2892490	When I used to visit NSA Centers of Excellence at some of the earlier schools, I was struck by the composition of the classes that I was addressing.
2893230	2897120	Perhaps better than 60% of them were not Americans.
2897880	2903440	That's just the price you pay for having a premier educational system.
2904060	2908920	And the education we dispense is helping people globally.
2913990	2916830	Anybody else want to take a shot at that?
2917730	2919090	May I?
2919090	2920650	Absolutely, Bob.
2924910	2927270	Hey, too soon.
2929330	2934630	We would like to hire you. Please don't cross the line.
2939740	2943800	That concludes the Meet the Fed panel. Thank you, guys. Got t-shirts.