00:00:00.125-->00:00:05.458 >>Welcome to Def Con, thank you all for being here with us. I am Andrea Matwyshyn, I am a law 00:00:05.458-->00:00:11.500 professor and I served for a year as the Federal Trade Commission’s Senior Policy 00:00:11.500-->00:00:18.500 Advisor and Academic in Residence. I am an ex-fed um and also I’ve been coming to Vegas 00:00:18.500-->00:00:24.583 for the hacker circus since 2003. So this is uh always a welcome treat to be with all of 00:00:24.583-->00:00:30.667 you in Vegas this time of year. And without further ado let me introduce our spectacular 00:00:30.667-->00:00:37.583 panelists to you um and uh they look forward to your questions and uh also just as uh on a 00:00:37.583-->00:00:43.042 personal note, I wanna give props to each of the panelists here because these are security 00:00:43.042-->00:00:49.958 friends. These are the people who are helping to advance the conversation in a meaningful 00:00:49.958-->00:00:54.958 way. Um and we are grateful uh as citizens for their work in this direction. So furthest to 00:00:58.250-->00:01:03.250 closest we have Suzanne Schwartz from the FDA, Dr. Suzanne Schwartz we have [applause] FTC 00:01:06.958-->00:01:11.958 Commissioner Terrell McSweeny, [applause] we have Leonard Bailey from DOJ [applause] and 00:01:15.708-->00:01:20.708 we have Lisa Wiswell, formally DOD currently Grimm [applause]. So I will ask each of the 00:01:25.542-->00:01:30.125 panelists to tell you a little bit about their respective agencies and their agency 00:01:30.125-->00:01:35.583 submissions and the evolution of security within their respective organizations and also tell them 00:01:35.583-->00:01:40.583 a little- tell you a little bit about themselves. So not much talking from me, more from them. 00:01:40.583-->00:01:45.000 I have a few starter questions then we’re gonna turn it all over to y’all out there. So 00:01:45.000-->00:01:50.792 we’ll start with Suzanne please. >>Hi good morning everybody. It’s really a uh a privilege to 00:01:50.792-->00:01:57.250 be here talking to with all of you today. So I’m at the Food and Drug Administration and um I 00:01:57.250-->00:02:03.958 hope you know what the Food and Drug Administration does. Our mission is to protect and 00:02:03.958-->00:02:10.708 promote the public health and to advance the public health and specifically I’m at the Center 00:02:10.708-->00:02:16.375 for Devices and Radiological Health. FDA is organized into multiple centers, including 00:02:16.375-->00:02:21.375 several medical product centers and Center for Devices and Radiological Health or CDRH is 00:02:23.458-->00:02:30.167 responsible for having oversight and authority on medical devices throughout the entire lifetime 00:02:30.167-->00:02:35.583 of that device. So devices for them to come onto the market, to give approval or clearance for 00:02:35.583-->00:02:40.583 that to happen as well as that continued oversight as that device stays in it’s 00:02:42.667-->00:02:47.667 distribution. So um uh having that responsibility, one of the areas that has been emerging of 00:02:53.208-->00:02:58.208 great challenge for us at CDRH at FDA has been the area that’s gotten a lot of attention in 00:03:01.167-->00:03:06.167 the, in the press uh and in the public of late, and that is medical device cyber security. 00:03:08.208-->00:03:15.042 And as we have been challenged in this particular area I’ll just touch on right now what has 00:03:15.042-->00:03:20.042 been really of extraordinary value for us as an agency and that is to embrace the concept 00:03:23.083-->00:03:28.083 of collaboration. And that it is absolutely necessary for us to be able to create that community 00:03:31.958-->00:03:36.958 if you will in drawing upon the great expertize the value, the skills, the knowledge, the tools 00:03:40.667-->00:03:47.333 that so many different stakeholders bring to this significant problem set. And so 00:03:47.333-->00:03:52.333 we at FDA, and specifically at CDRH value and look to the security researcher community to 00:03:55.542-->00:04:00.542 help us in this area. We know that as a r- government agency there’s no way that we can be 00:04:04.500-->00:04:11.000 able to deal with this very important and critical area on our own, but that it really does 00:04:11.000-->00:04:16.417 require everyone partnering and working together. And that’s something that we have focused 00:04:16.417-->00:04:21.417 on leveraging over the past several years in creating uh, bridges, building bridges 00:04:23.542-->00:04:29.042 between stakeholders, whether it’s the medical device manufacturers, the hospitals and 00:04:29.042-->00:04:34.458 health care delivery organizations, the government, security researchers and others 00:04:34.458-->00:04:41.208 so that we are able to really leverage and pull our strengths together. I’m gonna leave it at 00:04:41.208-->00:04:46.208 that for now as an introduction. We can talk more as we go forward. >>Commissioner 00:04:46.417-->00:04:50.375 McSweeny. >>Ok, I’m next? >>You next! >>Alright, Um hi! I’m Terrell McSweeny, 00:04:50.375-->00:04:57.167 Commissioner at the Federal Trade Commission. Um I have to start by giving a disclaimer 00:04:57.167-->00:05:06.542 that uh >>Move it a bit back. Like that. >>Oh ok we’re cool. We’re not cool. Um that uh I’m 00:05:06.542-->00:05:11.125 gonna give you uh my own personal views today, not the official views of the Federal 00:05:11.125-->00:05:15.250 Trade Commision, uh or necessarily the views shared by my colleague acting Chairman 00:05:15.250-->00:05:22.292 Ohlhausen. Um that’s so I can be completely candid. Uh this is my fourth Def Con, I think Andrea 00:05:22.292-->00:05:26.917 actually brought me to my first one when she was at the FTC so thank you for that. Uh the 00:05:26.917-->00:05:33.792 Federal Trade Commission is a government agency that has nothing to do with trade, in 00:05:33.792-->00:05:39.667 spite of our name, so it’s a little confusing. We’re actually a consumer protection agency and 00:05:39.667-->00:05:46.167 an antitrust agency. We’ve been around for about 103 years and we have a very broad authority 00:05:46.167-->00:05:52.708 to protect consumers from unfair deceptive acts and practices in the marketplace, and unfair 00:05:52.708-->00:05:57.500 competition. And what’s happened is as consumers have moved from a brick and morr- brick and 00:05:57.500-->00:06:04.167 mortar world of consuming to an online and digital one, we’ve sort of followed them along. Uh 00:06:04.167-->00:06:13.750 bringing more than um 500 privacy uh related cases in the last 25 years um and uh also 00:06:13.750-->00:06:20.958 more recently bringing about 60 plus data security cases including this year uh some IOT 00:06:20.958-->00:06:26.917 cases as well. We work very closely with the research community. We’ve uh been here at 00:06:26.917-->00:06:32.708 Def Con running contests in past years. Uh Zapping Rachel to go after robocalls, Humanity 00:06:32.708-->00:06:38.333 Strikes Back, again to go after robocalls. This year we’re going to be, uh talking a little bit 00:06:38.333-->00:06:42.958 about a challenge that we just completed which is our IOT home inspector challenge where we 00:06:42.958-->00:06:49.208 created a 25 thousand dollar award for a new, uh app that’s gonna help consumers hopefully 00:06:49.208-->00:06:53.125 be able to monitor what devices they even have in their homes and whether they need to be 00:06:53.125-->00:06:58.000 updated. And you can check out more about that at the IOT village um we have a talk um 00:06:58.000-->00:07:02.208 it’s going to be presented tomorrow on how that worked and what it is. And if you wanna 00:07:02.208-->00:07:07.333 learn more about the history of the FTC and it’s privacy and data security enforcement, uh I 00:07:07.333-->00:07:11.333 invite you to a talk that I’m giving later on this afternoon at 4oclock where we’ll be going 00:07:11.333-->00:07:15.875 into a lot of our cases in depth and kind of how those work, so. We are, we are a small agency we 00:07:15.875-->00:07:22.333 are a civil agency um but we view ourselves as an agency that really is trying to partner with 00:07:22.333-->00:07:26.583 the research community in order to provide consumers with better information, more secure 00:07:26.583-->00:07:36.000 products, and um visibility into what’s happening in the connected world. >>Leonard 00:07:36.000-->00:07:44.958 Bailey. >>Thank you very much, goodmorning. Um one thank you Andrea for inviting me to 00:07:44.958-->00:07:48.292 participate in this panel. And thank you to the uh Def Con community for what has been so 00:07:48.292-->00:07:51.417 far a warm welcome. Uh I am Leonard Bailey from the Department of Justice I am a 00:07:51.417-->00:07:57.042 special counsel for National Security in the computer crime and intellectual property 00:07:57.042-->00:08:00.042 section. And essentially what that section does is we are the department’s experts on the 00:08:00.042-->00:08:04.458 Computer the Computer Fraud and Abuse Act, the federal hacking statute. Uh also on all issues 00:08:04.458-->00:08:09.000 related to electronic surveillance of computers. And on electronic uh evidence 00:08:09.000-->00:08:20.583 gathering. Um so about 3 years now ago uh a company wandered into our offices, uh a brave 00:08:20.583-->00:08:25.125 company and said essentially “Your your ways are strange to us. And you scare us, and we 00:08:25.125-->00:08:30.000 think that you are chilling legitimate research.” And our reaction was “that’s a problem.” 00:08:30.000-->00:08:34.583 Um cyber security is uh is complex enough that we don’t wanna sideline anyone. And so we 00:08:34.583-->00:08:38.500 started a string of engagements with the computer security research community. That started 00:08:38.500-->00:08:43.708 with me coming out to uh BlackHat, I can say that right? BlackHat. Um and having a 00:08:43.708-->00:08:48.375 meeting with about 25 uh researchers, about 2 hour meeting, the first hour was them 00:08:48.375-->00:08:53.875 yelling at me, the second hour uh was a discussion about what it was that was sort of the 00:08:53.875-->00:08:58.500 source of, of the problem. This was 2015 and there were still some very very raw feeling about 00:08:58.500-->00:09:04.208 some things that had happened involving the Department of Justice. Um from there we 00:09:04.208-->00:09:09.208 started to build. So we had about 2 months of weekly phone calls where we were trying to 00:09:09.208-->00:09:13.292 figure out whether there was any kind of guidance that could be put out by the department or 00:09:13.292-->00:09:17.292 more likely the computer security research community that would help guide research so 00:09:17.292-->00:09:22.417 that people would not be so afraid of the CFAA and would be willing to, to move forward. Um 00:09:22.417-->00:09:28.667 that was kind of interrupted in January 2015 when a a proposal for CFAA amendments dropped and 00:09:28.667-->00:09:33.708 we all started working on that instead. Uh in the meantime though we decided to figure out 00:09:33.708-->00:09:37.500 if there were certain what I’m going to call confidence building measures that we could 00:09:37.500-->00:09:42.292 take that would help the communities understand each other a bit better. So uh I was 00:09:42.292-->00:09:48.125 formally invited by people to present that year at at BlackHat to explain what the history of 00:09:48.125-->00:09:52.625 the CFAA um and our prosecutions have been, uh particularly in the area of computer security 00:09:52.625-->00:09:58.167 research and then I did that in uh 2015. Uh the next year we invited a panel of hackers to 00:09:58.167-->00:10:02.625 come out and speak at what is our CHIPP conference, computer hacking and intellectual 00:10:02.625-->00:10:08.125 property prosecutors. These are the um 300 or so prosecutors across the country who are 00:10:08.125-->00:10:14.208 responsible for prosecuting computer crime cases.And the thinking was by having hackers 00:10:14.208-->00:10:20.708 explain first person what it is that they did and why they did it, um there’d be at least a 00:10:20.708-->00:10:28.625 better understanding of those cases that were in and outside of bounds. Uh after that, uh we 00:10:28.625-->00:10:32.667 have continued to move on to various other projects. Most recently just on Wednesday of 00:10:32.667-->00:10:37.792 this week, we released a uh document on it’s on our our webpage if you did a websearch 00:10:37.792-->00:10:42.625 for DOJ Cyber Security Unit, um you would find a page that has something called the 00:10:42.625-->00:10:48.000 Vulnerability Disclosure Framework uh it is a sort of set of guidelines or some guidance 00:10:48.000-->00:10:52.167 to companies that may be thinking about creating a Vulnerability Disclosure 00:10:52.167-->00:10:56.667 program, a formal program. Uh the the idea of the framework is to walk through various 00:10:56.667-->00:11:01.458 considerations, it doesn’t dictate whether a company should choose X or Y, but it suggests 00:11:01.458-->00:11:05.583 “these are the things you may wanna think about and clarify in your policies so that you don’t 00:11:05.583-->00:11:09.958 have a misunderstanding with someone who is, you know, probing your system that is 00:11:09.958-->00:11:16.083 going to sort of grow into a dispute that is gonna be brought into court.” Um so at the high 00:11:16.083-->00:11:22.417 level that’s what we’re doing, we are working now, ideally, on both the you know prosecutorial 00:11:22.417-->00:11:27.792 side, where we are enforcement and we are attempting to make sure that bad guys who break 00:11:27.792-->00:11:32.333 into networks and steal information um actually are punished in the way that they 00:11:32.333-->00:11:36.208 should be under the law. Also they’re working to make sure that people who are trying to 00:11:36.208-->00:11:43.667 help out and shore up networks, reveal vulnerabilities, um are not put into the crosshairs. So 00:11:43.667-->00:11:48.833 uh I’ll leave it there. >>Lisa Wiswell >>Morning everyone, thanks for having me Andrea. Um 00:11:48.833-->00:11:57.917 well this is my 8th Def Con, uh and the first one as a non-fed um as it turns out I very very 00:11:57.917-->00:12:02.708 recently left federal service at the Department of Defense so it’s probably even more 00:12:02.708-->00:12:08.250 important for me to explain. I am not a fed, I do not represent a US government position right 00:12:08.250-->00:12:14.875 now, these words are my own. Um with that said, I uh, I hail from the Department of Defense 00:12:14.875-->00:12:19.958 where um most recently I was responsible for standing up the Hack the Pentagon Bug Bounty 00:12:19.958-->00:12:25.792 programs, the first bug bounties in the US government. Uh and then subsequently, the 00:12:25.792-->00:12:32.708 vulnerability disclosure policy in the Department of Defense. Um you could say these aren’t 00:12:32.708-->00:12:37.042 particularly innovative concepts, you can’t even sneeze without somebody talking about 00:12:37.042-->00:12:42.583 how bug bounty is gonna fix their networks whatever else. Um that was not the the reason 00:12:42.583-->00:12:49.542 necessarily, the sole reason why we did it. Umm but we are it in the government we were in a 00:12:49.542-->00:12:54.500 position especially in DoD to be able to sort of hack our own internal bureaucracy to be able 00:12:54.500-->00:13:01.333 to achieve these things. Uh so DoD um it’s the largest bureaucracy in the government. 00:13:01.333-->00:13:10.208 Uh 3.2 million personnel. Lot of generals, lot of senior people. Uh dispersed across the globe. 00:13:10.208-->00:13:16.333 So not just the Pentagon, eh practically everywhere across the globe. We have 3 missions in 00:13:16.333-->00:13:23.083 cyberspace. The first is to uh protect our networks, DoD networks, the networks that we 00:13:23.083-->00:13:30.542 rely on to do our jobs um both in the US and elsewhere. Um to defend against nation and state 00:13:30.542-->00:13:37.250 uh attacks and then thirdly to provide um options using the cyberspace domain uh to 00:13:37.250-->00:13:46.292 integrate them into our war fighting um work. So along those lines um we use security 00:13:46.292-->00:13:51.667 researchers for all of those things and the thing that we hadn’t really explored yet was 00:13:51.667-->00:13:58.500 using folks like yourselves to help for defensive reasons in a in a crowdsource way. W- uh- 00:13:58.500-->00:14:03.375 allowing for a certain amount of anonymity still um and then actually opening our our 00:14:03.375-->00:14:10.500 networks up um both the public facing stuff and then uh internal stuff to you all to 00:14:10.500-->00:14:17.167 hack against. So I come from an organization most recently called the Defense Digital 00:14:17.167-->00:14:22.083 Service which is- which is really responsible for doing this kind of thing for involving 00:14:22.083-->00:14:26.125 folks that have absolutely nothing to do with the government, pairing them with 00:14:26.125-->00:14:31.708 folks like myself, my title was Bureaucracy Hacker, no s**t that was actually on a business card. 00:14:31.708-->00:14:35.917 It also my business card also said “Get S** Done” on it so eh this is a a little bit of a 00:14:35.917-->00:14:42.625 different kind of organization. Umm but leveraging uh folks that had absolutely nothing to do 00:14:42.625-->00:14:46.583 with the government, didn’t know how it worked, didn’t didn’t particularly care to know how it 00:14:46.583-->00:14:51.292 worked, just wanted to continue to do umm what they do. And culturally this was really 00:14:51.292-->00:14:56.000 tricky, as you can imagine. So in an organization that cares a lot about control because 00:14:56.000-->00:15:02.708 control is important as it relates to people's’ safety and national security, you uh 00:15:02.708-->00:15:08.500 allowing for absolutely almost no control here was pretty significant. Um and we also 00:15:08.500-->00:15:14.625 suffered from this culture for 35 plus years of security through obscurity. So you you 00:15:14.625-->00:15:20.083 say you’re secure and so it shall be. Which obviously, after lots and lots of attacks against 00:15:20.083-->00:15:26.958 the government, uh and DoD in particular, that is a ridiculous thing to say. So we pushed past 00:15:26.958-->00:15:32.333 that, hacked the pentagon, you’ve probably heard a lot about um since Def Con last year 00:15:32.333-->00:15:38.917 we’ve had 3 additional very successful bug bounty programs there's about 6 um in planning 00:15:38.917-->00:15:44.750 phases right now. Uh one just launched just started recently. Um and the vulnerability 00:15:44.750-->00:15:50.208 disclosure policy itself has been wildly successful. Um one of the things that we really did 00:15:50.208-->00:15:54.667 right I think compared to some of the other organizations that host these coordinated 00:15:54.667-->00:16:00.000 disclosure programs is we aire on the side of disclosure. After we’ve worked with a security 00:16:00.000-->00:16:04.333 researcher and fixed something if you wanna give a talk at Def Con about it, you’re welcome to. 00:16:04.333-->00:16:08.792 Uh we work with you to make sure that you know that you’re able to do that because we think that 00:16:08.792-->00:16:14.458 sharing that information is useful to the community at large. Um so why did we do this? 00:16:14.458-->00:16:20.875 Uh at DoD particularly to start? Um 3 things that are culturally um important that I just wanted 00:16:20.875-->00:16:25.667 to touch upon. The first is because we felt very strongly that if DoD did this, if the 00:16:25.667-->00:16:31.875 Department of Defense the largest organization was able to do this um everyone else could. 00:16:31.875-->00:16:36.833 Whether that was in the government or elsewhere. If we could figure out legally how to 00:16:36.833-->00:16:43.000 let people hack on our mission critical systems it was going to be something that other federal 00:16:43.000-->00:16:47.917 agencies could work on. Um and as you can imagine we spent a fair amount of time talking to 00:16:47.917-->00:16:51.875 Leonard to make sure we were doing this in a in the right way. So lot of government 00:16:51.875-->00:16:57.208 agencies have started to do this. Lot of state governments have started to do this. So that 00:16:57.208-->00:17:03.542 that part worked. The second is we have got to get away from compliance and focus on 00:17:03.542-->00:17:10.333 security. So checking a box is not actually security. Um forcing that cultural shift 00:17:10.333-->00:17:15.750 inside the Department of Defense for me was really critical. And I I you’ll probably I’ll 00:17:15.750-->00:17:20.458 probably say this another few times, I’m sorry if I do, but it’s eh you know if I can’t help 00:17:20.458-->00:17:27.083 people understand why an an open port, because it’s not on their checklist, is actually important 00:17:27.083-->00:17:32.583 because it dic- takes you from a public facing website into a mission critical internal 00:17:32.583-->00:17:38.583 system, that’s a problem, that’s a security problem. Um so thankfully that’s shifted. And 00:17:38.583-->00:17:46.125 then thirdly um we we care a lot about making sure that we are fixing s**t as fast as we can so 00:17:46.125-->00:17:53.458 um I mentioned security through obscurity before, you know if if we don’t know if somebody knows 00:17:53.458-->00:17:59.292 about something it might sit in our priorities list and be the very bottom and take 12, 18 00:17:59.292-->00:18:06.500 months to fix. In the Hack the Pentagon pilot just about half of the 138 um uh unique 00:18:06.500-->00:18:12.000 vulnerabilities that were submitted were fixed within 1 week. So truncating the life 00:18:12.000-->00:18:18.125 cycle of a vulnerability. From found disclosed remediated, if we can get that to be closer to 00:18:18.125-->00:18:25.875 a week, that’s a h**l of an impact. So those were uh, the 3 real things that um we really we 00:18:25.875-->00:18:31.250 cared a lot about. The the DoD assures me they still care a lot about this. The rest of the 00:18:31.250-->00:18:36.417 government as you can see also does um and so enabling finding all of the legal avenues for 00:18:36.417-->00:18:43.083 y’all to do what you do umm and and and help out. Um in DoD and other government agencies and 00:18:43.083-->00:18:49.208 other non government agencies all together is a good effective thing that we’re, we’re really 00:18:49.208-->00:18:54.000 trying to find all of the ways to be able to do. >>Thank you. So I have 3 starter questions 00:18:54.000-->00:18:57.583 and then we are throwing it out to the audience for as many questions as time will allow. 00:18:57.583-->00:19:06.292 And uh I think the goons will be kind enough to direct you to the place to line up for questions. 00:19:06.292-->00:19:15.792 Which will be here. Ok so, uh dear panelists: you’ve described some important success stories 00:19:15.792-->00:19:21.167 inside your respective organizations. What did each of you find to be the biggest 00:19:21.167-->00:19:25.375 cultural or int- or institutional challenge to triggering the kinds of 00:19:25.375-->00:19:29.667 meaningful security improvements that you’ve described? Either internally or externally. And 00:19:29.667-->00:19:35.833 how did you overcome that challenge. Suzanne. >>Great, great, and actually, what I’ll 00:19:35.833-->00:19:41.667 do is also fill in a little bit from the initial introductory remarks that I didn’t get a 00:19:41.667-->00:19:46.583 chance to elaborate on as a pivot point to talk about um some of the challenges. So my 00:19:46.583-->00:19:51.958 colleagues here talked a lot about um the importance of coordinating disclosure policy 00:19:51.958-->00:20:01.167 and having that in place. That’s an area that we at FDA have underscored uh uh a lot and 00:20:01.167-->00:20:11.042 included within our policy and our guidance that our expectation is for manufacturers 00:20:11.042-->00:20:18.458 to work together with those who are identifying vulnerabilities, security researchers as well as 00:20:18.458-->00:20:24.375 others within the community and to utilize to have those kinds of processes in place and have a 00:20:24.375-->00:20:31.708 policy and a mechanism by which coordinated disclosure can be undertaken. We also because 00:20:31.708-->00:20:37.917 we’re dealing in a critical public health safety area, in an area that crosses over into 00:20:37.917-->00:20:43.750 national security from a standpoint of health care and public health being a critical 00:20:43.750-->00:20:52.250 infrastructure sector, want to make sure that these areas that these issues can be addressed in 00:20:52.250-->00:21:00.292 also as an expedited manner as possible. And that manufacturers have that latitude have that 00:21:00.292-->00:21:06.500 flexibility in terms of being able to be proactive. And when vulnerabilities are brought to 00:21:06.500-->00:21:12.500 manufacturer’s attention that they’re able to address those without impediments or barriers 00:21:12.500-->00:21:20.375 that would be uh theoretically imposed by a regulator. And so and m- we really had to shift 00:21:20.375-->00:21:26.292 the way we were thinking about cyber security in the medical device space to enable a lot 00:21:26.292-->00:21:34.750 more agility and to remove those kinds of regulatory barriers or challenges that would therefore 00:21:34.750-->00:21:42.958 incentivise or allow for vendors to be able to address what could become a concern for a 00:21:42.958-->00:21:48.875 patient’s, for public safety and for public health by being able to go out and do it proactively 00:21:48.875-->00:21:54.333 and that has been I think you know a key cornerstone of the work that we've been doing 00:21:54.333-->00:22:01.583 together with groups like I Am the Cavalry and uh uh I think that it’s that kind of a 00:22:01.583-->00:22:08.958 partnership that has been so extraordinary in terms of being able to create the that that 00:22:08.958-->00:22:13.917 mode of collaboration. But it didn’t start out that way. So that really brings us to the 00:22:13.917-->00:22:20.542 challenge uh challenges that we've seen and it comes back down to culture. It really does 00:22:20.542-->00:22:29.292 because culture if we were to reflect back several years ago, 2013 and prior to that, at best 00:22:29.292-->00:22:34.208 at best one could say that there was a lot of scepticism or certainly confusion lack of 00:22:34.208-->00:22:45.833 clarity as to what the role is of security researchers as they entered within the medical 00:22:45.833-->00:22:52.333 device area in the work that you've been doing in identifying particular challenges, 00:22:52.333-->00:23:00.417 vulnerabilities with medical devices. And I say that because we were seeing we were observing 00:23:00.417-->00:23:08.000 a lot of that kind of tension that existed between medical device manufacturers and health 00:23:08.000-->00:23:13.750 care delivery organizations and the researcher community which again at best could be called 00:23:13.750-->00:23:20.125 skepticism at worst really frank distrust. And so when you’re starting from there if that’s 00:23:20.125-->00:23:25.750 the current state, but recognizing that we have to be collaborative, how is it that 00:23:25.750-->00:23:34.000 we’re gonna move from that place of distrust or skepticism to one where actually no we have to be 00:23:34.000-->00:23:41.125 able to work together. And it’s through a lot of the vehicles that we used were public 00:23:41.125-->00:23:46.958 meetings and workshops some it’s working together with security research that had come forward 00:23:46.958-->00:23:54.750 that have acted really as great ambassadors for us within the the Food and Drug Administration 00:23:54.750-->00:24:01.000 and the medical device ecosystem as a whole. And helped us first of all in understanding 00:24:01.000-->00:24:07.208 different perspectives, different motivations, recognizing universally that 00:24:07.208-->00:24:12.125 there's a common purpose and that common purpose is to be able to address what the 00:24:12.125-->00:24:20.125 vulnerabilities are and to make devices safer and more secure and we all want that. Th- 00:24:20.125-->00:24:24.292 there’s no one in this room I’m sure that doesn’t want for that to be the case so identifying 00:24:24.292-->00:24:31.625 that common ground and that common purpose and working from there so that everyone really 00:24:31.625-->00:24:37.000 understands the unique constraints or the particular challenges that different groups 00:24:37.000-->00:24:43.500 are kind of bound by. So that’s you know that’s really like one critical piece that I think you 00:24:43.500-->00:24:52.000 know moving from that culture of um eh you this is the adversary versus actually no, these are 00:24:52.000-->00:24:58.958 our partners to where we are right now really brings us to today and I I’m I just want to 00:24:58.958-->00:25:04.167 put in this plug I’m really proud to see what’s happening in the IOT village at this year’s 00:25:04.167-->00:25:09.750 meeting with regard to the very first medical device hack a thon that’s actually occurring. And 00:25:09.750-->00:25:16.042 th- bringing together that collaborative space of manufacturers with researchers 00:25:16.042-->00:25:23.333 and uh the government being present as well. We think that that is a microcosm that’s 00:25:23.333-->00:25:31.042 emblematic of where we need to be as we go forward. >>Well, so from the FTC perspective, I’ll 00:25:31.042-->00:25:36.583 just say that there weren’t really any hurdles for me to overcome um when I joined the 00:25:36.583-->00:25:41.625 FTC in terms of trying to think about how to work constructively with the research community. 00:25:41.625-->00:25:47.667 Because our mission is so closely aligned to um a lot of WhiteHat hacking we want to know 00:25:47.667-->00:25:52.375 how technology is working we want to make sure that we’re getting, uh clear 00:25:52.375-->00:25:58.292 representations about it to consumers we want to make sure that products are secure. So um 00:25:58.292-->00:26:04.958 our partnership with the research community um which has been a long one uh really felt 00:26:04.958-->00:26:10.333 quite natural from from the beginning to me. Um and I think that’s partly also because we 00:26:10.333-->00:26:16.167 recognized at the Federal Trade Commission how important it is for us to bring researchers into 00:26:16.167-->00:26:22.500 our organization um. Andrea being one of the visiting technologists that we’ve had but 00:26:22.500-->00:26:28.417 we've also had academic researchers like Lori Kraner, Ed Felten, Latanya Sweeney, and 00:26:28.417-->00:26:33.083 others come in and be our our chief technology officers. Which sub which also subsequently gave 00:26:33.083-->00:26:37.583 birth to our office of technology. So we have an office called OTech which is also 00:26:37.583-->00:26:42.708 really helpful in both creating our own research um but helping us really understand technology 00:26:42.708-->00:26:48.958 and how it’s working and serving as a liaison to the research community. And we’ll be covering 00:26:48.958-->00:26:54.542 a little bit more this afternoon in in a talk I’m giving how our investigations come together and 00:26:54.542-->00:27:00.667 how to submit a complaint and what happens at that point. But I can say candidly that uh we 00:27:00.667-->00:27:05.500 haven’t just worked with researchers to expose how things are working or not working. 00:27:05.500-->00:27:10.542 We’ve actually uh taken complaints taken information, used that to bring uh law 00:27:10.542-->00:27:17.458 enforcement actions and to go after bad data security practices in the marketplace. So 00:27:17.458-->00:27:23.500 um for us it’s been closer, ok. For us it’s been a really important and very natural 00:27:23.500-->00:27:29.792 partnership. >>So, I I think that’s really a fascinating question and I’m gonna go with 00:27:29.792-->00:27:32.917 culture as all. Um and I’m now gonna speak in very broad generalizations that at least 00:27:32.917-->00:27:39.167 have a kernel of truth in them. Um let’s start off with on I’ll I’ll start off with with rules. 00:27:39.167-->00:27:46.000 So prosecutors by and large for example as a community, we follow rules. We we apply rules. 00:27:46.000-->00:27:53.917 Uh my my engagement with folks in this community has revealed that that may not exactly be the 00:27:53.917-->00:28:00.375 same cultural mindset that is uh the the kind of credo of a hacker may be, oh sorry, also, 00:28:00.375-->00:28:06.792 eat the microphone I am eating the microphone. Um maybe uh more so of taking something that 00:28:06.792-->00:28:12.167 wasn’t designed to do s- X and repurposing it to do something that the designer did not 00:28:12.167-->00:28:17.292 intend. Uh that no- maybe it’s better than what was intended. But it it is breaking a rule of 00:28:17.292-->00:28:25.417 some sort, uh and so there’s a there’s an interesting cultural divide in that. In addition I 00:28:25.417-->00:28:28.792 think there’s a cultural divide between the world of lawyers and the world of of people who do 00:28:28.792-->00:28:35.542 code. Uh and uh this has come up more than once where explaining to someone that the Computer 00:28:35.542-->00:28:41.667 Fraud and Abuse Act for example may not have a a yes or no binary to it. And so is is is 00:28:41.667-->00:28:46.583 this legal? Well there are a variety of factors that have to go into that. So there is is 00:28:46.583-->00:28:51.542 this zone of grey that exists with some of it until you get very pinned down facts. And 00:28:51.542-->00:28:57.917 speaking to you know, like people who are friends now who are coders, th- th- there’s a 00:28:57.917-->00:29:04.250 great deal of discomfort with with applying laws in that way. Oddly enough I think in many 00:29:04.250-->00:29:08.583 ways that’s the way laws are somewhat written. That is uh traditionally even criminal laws 00:29:08.583-->00:29:14.625 have a certain amount of leeway and give, and traditionally the way of of making sure that those 00:29:14.625-->00:29:19.333 laws uh are applied appropriately is to do something called prosecutorial discretion. 00:29:19.333-->00:29:24.750 I think we have over the last 10 years certainly become less comfortable with the notion of 00:29:24.750-->00:29:28.458 prosecutors having discretion in figuring out how to appropriately provide, you know, 00:29:28.458-->00:29:34.458 guidance on laws and as a result it actually has made the application of laws somewhat 00:29:34.458-->00:29:40.083 more difficult. Um just that that lack of trust and the ability perhaps to amend those 00:29:40.083-->00:29:44.833 laws in ways that that may suit us better. Um so I’m gonna go with culture and I think on a 00:29:44.833-->00:29:50.500 couple of different axis. >>Culture is going to be a word that we hear a lot today I’m 00:29:50.500-->00:29:57.167 afraid. Um so particularly for the Department of Defense for this uh these engagements that 00:29:57.167-->00:30:02.542 we did last year that they continue to do now, um I think one of the biggest things that 00:30:02.542-->00:30:09.083 we had to get comfortable with, and it’s why it took as long as it did frankly, is allowing uh a 00:30:09.083-->00:30:16.708 certain amount of trust. So we had to extend an olive branch and really put our money where 00:30:16.708-->00:30:22.000 our mouth was that we were not going to have a list of hackers’ names, which was one of the 00:30:22.000-->00:30:27.792 things that folks talked about a fair amount. Um so that we we built in a number of controls 00:30:27.792-->00:30:34.708 for purposes of the Hack the Pentagon bug bounty programs, which included outsourcing 00:30:34.708-->00:30:40.167 almost everything to contractors to handle for us. So HackerOne and Synack were both awarded 00:30:40.167-->00:30:46.625 contracts to to host these things for us. In addition to a lot of other things that they 00:30:46.625-->00:30:52.292 provide, they’re our level of trust that the security researchers, hackers, were going 00:30:52.292-->00:30:58.750 to do as they were supposed to do and that we pushed all of that responsibility on to the 00:30:58.750-->00:31:07.583 contractors. This meant outside of being able to see me logging in to my own personal HackerOne 00:31:07.583-->00:31:14.125 account to see which usernames were on the leaderboard, I knew nothing more about anyone’s 00:31:14.125-->00:31:19.292 identity, nothing. HackerOne knew for example for Hack The Pentagon. So if something were 00:31:19.292-->00:31:24.292 to happen, something drastic were to happen, we could work with that company to be able to 00:31:24.292-->00:31:28.917 get the information that was needed to be able to pass it to Leonard, to help take action, 00:31:28.917-->00:31:35.458 but none of that happened. And the great part is, everybody did what they were supposed to do. 00:31:35.458-->00:31:40.958 We didn’t have any kind of incidents umm at all. We haven’t in any of the challenges since 00:31:40.958-->00:31:47.000 then and it allowed folks to finally feel really comfortable that you know we weren’t gonna 00:31:47.000-->00:31:52.375 break the internet we weren’t gonna do anything um you know that that tripped any kind of 00:31:52.375-->00:31:57.625 line that needed to be taken care of legally. But this is a really uncomfortable thing, for 00:31:57.625-->00:32:02.458 again it gets back to that one word: control. Um not controlling something when 00:32:02.458-->00:32:08.042 you’re dealing with um, warfighters lives, or national security in general is an 00:32:08.042-->00:32:14.708 uncomfortable thing. And so um I I gave a talk uh last year in Vegas and and said “Please, 00:32:14.708-->00:32:19.500 thank you for having the grace dealing with us as we go through this.” And I think that’s what 00:32:19.500-->00:32:25.042 it is. I think we’ve started over the past year to you know wh- some of us on the government 00:32:25.042-->00:32:29.333 side have been skeptical- skeptical of our engagements with you. Some of you have been 00:32:29.333-->00:32:34.417 skeptical of your engagements with us and we keep kind of pushing the envelope a little 00:32:34.417-->00:32:39.833 bit and it’s been getting better every single engagement that’s exist. But it was a it's a it’s 00:32:39.833-->00:32:45.375 a trust factor and that all goes back to culture. And it’s a unfortunately um you know a bad 00:32:45.375-->00:32:50.708 cultural thing that’s been been prevalent for the past 35 years that we’re all actively trying 00:32:50.708-->00:32:56.542 to to unscrew. >>Ok so I’m gonna skip my second question ‘cause I think you’ve all addressed it 00:32:56.542-->00:33:03.833 and go to my third. Uh which is uh curiosity on my part more than anything else. So 00:33:03.833-->00:33:09.042 panelists, if budgetary constraints and political goodwill were no obstacles, what 00:33:09.042-->00:33:14.375 one aspect of your organization security initiatives would you personally like to see 00:33:14.375-->00:33:24.542 meaningfully expanded in the next five years? Let’s start with Lisa. >>So this one is very 00:33:24.542-->00:33:30.792 much Lisa Wiswell and not DoD necessarily. Um there's a last year the White House put out an 00:33:30.792-->00:33:39.875 open source policy. And it was indicative of this idea that it’s irresponsible frankly for 00:33:39.875-->00:33:44.875 us to continue to develop code by a bunch of folks that don’t develop code. Um that’s not 00:33:44.875-->00:33:51.500 their day job let’s actually use folks who are software developers to develop the code. 00:33:51.500-->00:33:57.583 Let’s stop also reinventing the wheel, stop using taxpayer dollars to develop the same darn 00:33:57.583-->00:34:04.792 thing that exists elsewhere. Um I would really like to see that continue and and that movement 00:34:04.792-->00:34:09.958 um you know be pushed out further culturally within the government not only to use 00:34:09.958-->00:34:15.625 things that are available in the open source community but to start contributing to it in a 00:34:15.625-->00:34:20.417 more meaningful way too so that folks that are not in the government can start using this. 00:34:20.417-->00:34:26.667 Um y- y- the White House policy was indicative of of this starting to evolve some. Uh it’s 00:34:26.667-->00:34:32.625 gonna take a lot of work though. I think this is a multi- year kind of um forcing a cultural 00:34:32.625-->00:34:42.958 change but the good part is you know it’s change is on the way. >>And so resources is always an 00:34:42.958-->00:34:47.208 issue are always an issue, but I I’m gonna go more on the political goodwill side. I think 00:34:47.208-->00:34:55.167 there’s a lot uh to be done uh in the next 5 years and you know in the next year uh to better 00:34:55.167-->00:35:01.875 understand exactly how legal constraints are impacting you know this community, and on the 00:35:01.875-->00:35:07.750 other side having this community understand how we apply the law. Uh so one of the things that was 00:35:07.750-->00:35:14.333 our message and this was kind of echoed just a few months ago by the Center of De- uh Center for 00:35:14.333-->00:35:19.167 Democracy in Technology. Um they did a report on computer security researchers and the 00:35:19.167-->00:35:23.083 CFAA and other legal constraints and what they found was what we found which is that the 00:35:23.083-->00:35:29.667 instances of us prosecuting researchers for doing researcher research is in their words 00:35:29.667-->00:35:37.292 “extremely rare” and to quantify that, there has been to our knowledge one instance that 00:35:37.292-->00:35:42.292 arguably was a researcher in the last 7 years who was uh prosecuted for for such conduct 00:35:42.292-->00:35:47.375 and that was what is now a very storied case, the um the Auernheimer case the Weev case. 00:35:47.375-->00:35:52.500 Uh that is the only instance that we’ve been able to identify or anyone else has been able to 00:35:52.500-->00:35:57.000 identify for us of a prosecution of an individual for doing computer security research. Or 00:35:57.000-->00:36:03.083 kind of it was believed to be computer security research. Um I think that the reason why it's 00:36:03.083-->00:36:09.875 important to to build this out is because one we would like to work on maybe establishing some 00:36:09.875-->00:36:15.542 understanding of what are our basically our our third rails. So what are the things that 00:36:15.542-->00:36:22.625 happen that are more likely to make it likely that we are going to view what you are doing as 00:36:22.625-->00:36:29.750 criminal conduct. On the flip side having you understand how we wield our authority and you 00:36:29.750-->00:36:36.875 know, we would tentatively, not over broadly but um how we do that so that you have a level of 00:36:36.875-->00:36:42.458 comfort that we will act responsibly with the authority that we have been given. Uh and 00:36:42.458-->00:36:49.083 that is a push a pull that is gonna be a dialogue, um it will have bumps, uh it’s a it’s a 00:36:49.083-->00:36:54.333 very large country, and there are a lot of cases that are circulating out there and as we 00:36:54.333-->00:37:01.250 have found uh even if we are on good behavior the problem is if we do have one case that goes 00:37:01.250-->00:37:08.833 poorly um the messaging and the results of that could be somewhat disastrous uh for this 00:37:08.833-->00:37:19.500 trust building effort. So uh the the the along the same lines, it’s a long term project. >>I’ll 00:37:19.500-->00:37:24.958 use this one, thanks. Umm ok so a lot of what I would put on my wishlist actually requires new 00:37:24.958-->00:37:30.417 laws to be passed, so I’ll put those over here. And if we’re dealing with like the current 00:37:30.417-->00:37:35.625 laws and the current authorities but I have unlimited resources which is I think what you’re 00:37:35.625-->00:37:42.167 question is um what I would do is really dramatically expand the role of researchers and 00:37:42.167-->00:37:47.333 technologists in our um operations and in our work. So we have a really good start at 00:37:47.333-->00:37:54.167 it in the Federal Trade Commission but I think we could definitely enhance our office of 00:37:54.167-->00:37:59.500 technology policy research in investigation, OTech. Um the way the FTC is struggle- is 00:37:59.500-->00:38:03.708 structured is actually at in bureaus. So we have a competition bureau a consumer 00:38:03.708-->00:38:08.833 protection bureau an economics bureau and I would love to have an actual bureau of 00:38:08.833-->00:38:14.625 technologists helping us across the board and also being available as a resource to other 00:38:14.625-->00:38:21.792 agencies like the FDA or like NHTSA that are thinking about how to use their expertise in 00:38:21.792-->00:38:26.375 the sector that they regulate and needing to take some of the learning that the FTC has on 00:38:26.375-->00:38:32.625 privacy and data security policy and apply that into what they do. So um if I could wave my 00:38:32.625-->00:38:36.708 wand and have unlimited resources I would bring in more technologists to help inform our 00:38:36.708-->00:38:43.042 our mission I would also have um a lot more people working on a lot more cases because um not a 00:38:43.042-->00:38:47.958 day goes by where I don’t look out and see something and think “Shoot I wish we could wish we 00:38:47.958-->00:38:53.583 had the resources to bring that case because that that definitely looks like a 00:38:53.583-->00:38:59.292 problem.” Um so uh you know we can’t we we get a lot more um complaints than we can act on 00:38:59.292-->00:39:04.250 and and so we do have to prioritize our enforcement mission and and sometimes I wish 00:39:04.250-->00:39:10.833 we we could bring more of those cases. >>So in June of this year a couple of months couple of 00:39:10.833-->00:39:19.042 months ago um there was a report that was issued publicly it was a report back to congress called 00:39:19.042-->00:39:24.250 the Healthcare Industry Cyber Security task force report and this report was a required 00:39:24.250-->00:39:33.333 deliverable or work product that came out of uh something called CISA which was uh uh 00:39:33.333-->00:39:42.250 Cybersecurity Information Sharing Act of 2015 and it was a mandate to the Department of 00:39:42.250-->00:39:50.042 Healthcare and Human Services HHS of which FDA is part to establish a task force of 00:39:50.042-->00:39:58.625 subject matter experts outside of government across the healthcare industry to do kind 00:39:58.625-->00:40:05.417 of a deep dive analysis of the landscape and to determine where the gaps and challenges are and 00:40:05.417-->00:40:12.833 what therefore would be the imperatives in order to improve and advance the state of 00:40:12.833-->00:40:18.917 cybersecurity in healthcare. Healthcare being a very very immature sector with respect to 00:40:18.917-->00:40:24.708 its security posture and then to also propose various recommendations. And included 00:40:24.708-->00:40:32.500 within this analysis I want to draw upon one particular area that um universally we recognise 00:40:32.500-->00:40:41.042 as rather critical and that being the work force and the workforce of individuals who 00:40:41.042-->00:40:48.875 bring a not only a specific interest in security and in security research but also that 00:40:48.875-->00:40:56.542 cross over into a desire to be within the public health and healthcare space. And we see 00:40:56.542-->00:41:03.417 that as an area that uh we want to really be able to encourage and to recruit um uh whether 00:41:03.417-->00:41:08.375 it’s you know younger professionals or people undergoing a career transition, 00:41:08.375-->00:41:19.417 this is an exciting and evolving and emerging area. And there’s a great need for individuals like 00:41:19.417-->00:41:25.625 yourselves who are very passionate about changing the state of affairs in terms of 00:41:25.625-->00:41:33.958 where we are right now in health care into making it more robust. And so filling in that 00:41:33.958-->00:41:42.417 particular gap area amongst other things is certainly high on my wish list and we at FDA uh 00:41:42.417-->00:41:48.875 you know would certainly want to grow our workforce as well in terms of having individuals who 00:41:48.875-->00:41:54.792 have greater security expertise and an interest in medical technology. We have a new 00:41:54.792-->00:42:00.625 digital health action plan that was actually just formally publically announced yesterday. 00:42:00.625-->00:42:07.083 And uh with that there will be a number of rollouts of some interesting opportunities for 00:42:07.083-->00:42:12.750 entrepreneurs even to come on board. Entrepreneurs in residence. So I would put in a 00:42:12.750-->00:42:17.792 plug to look out for these kinds of announcements. But we really very much want to encourage 00:42:17.792-->00:42:26.333 individuals to think about going further into this particular area. It doesn't necessarily 00:42:26.333-->00:42:32.875 mean joining government it can be but also just really picking a a niche in this particular 00:42:32.875-->00:42:42.875 space where there is great need for advancement. >>OK and with that we are open for questions. 00:42:42.875-->00:42:47.625 >>Alright so we have a lot of people that are excited to do questions, so we’ll try to do 00:42:47.625-->00:42:54.500 these in somewhat of a rapid fire way. Yeah? Alright. So one at a time come on up, let’s see, 00:42:54.500-->00:42:59.500 what have you got? >>Ok so um mine’s a little bit longer and a thing, but uh culture and 00:42:59.500-->00:43:03.208 collaboration is a good thing but when it comes time to patching spe- specifically in 00:43:03.208-->00:43:08.542 medical devices, nobody's there. Everybody hides behind their FDA certification and say that they 00:43:08.542-->00:43:12.333 can’t be changed. Uh the post market management of cybersecurity of medical devices 00:43:12.333-->00:43:16.708 outlines this patching as a guideline but they add in there “if it does not break the 00:43:16.708-->00:43:21.333 system.” So every vendor sits there and says “no it’s FD- uh FDA guidelines I can’t change 00:43:21.333-->00:43:24.417 it” and then if we say hey, we press them on it, they turn around and say “oh no we’re 00:43:24.417-->00:43:27.500 collaborating but it’ll break the system and they don’t allocate resources to fix the 00:43:27.500-->00:43:31.250 problem.” So we’re kind of looking for something is there some sort of directive that you 00:43:31.250-->00:43:33.875 could you guys could give to kind of force these organizations even though they 00:43:33.875-->00:43:38.083 say that they’re collaborating to actually patch these systems we had you know Microsoft came 00:43:38.083-->00:43:41.917 out with their MSMD 10 patch, nobody patched, then we had Wanna Cry and nobody patched, we 00:43:41.917-->00:43:46.542 had NotPet yet nobody patched and I bet you today somebody gave the same vulnerability. Um 00:43:46.542-->00:43:51.958 so something for recommendations [applause builds] of contract language uh to put into our 00:43:51.958-->00:43:56.625 contracts to give to our vendors so we can potentially force it at our end, saying hey, in our 00:43:56.625-->00:44:01.417 contract for every medical device we’re gonna put this uh recommended verbiage that forces 00:44:01.417-->00:44:05.458 those people to patch their systems so we don’t have to get hit uh stuck holding the bag 00:44:05.458-->00:44:10.292 when uh come- people come to attack our networks. >>That’s a great great question I I didn’t 00:44:10.292-->00:44:16.083 hear all of it uh but uh but you know you raise an issue that has been one that we have struggled 00:44:16.083-->00:44:20.000 with in terms of first of all dispelling some myths around there you know with regard to uh 00:44:20.000-->00:44:25.250 uh hiding behind this idea that you have to come back to the FDA for recertification before 00:44:25.250-->00:44:31.625 updating uh a a device, and um we’ve been very clear about first of all stating that not 00:44:31.625-->00:44:38.333 only in our guidances stating it verbally, in meetings like this but also putting together a 00:44:38.333-->00:44:43.000 actual fact sheet that has been distributed and that’s sitting on our web page with you know 00:44:43.000-->00:44:48.458 mythbusters being that being one of them. You know we encountered that challenge very much during 00:44:48.458-->00:44:54.792 Wanna Cry with regard to patch-ability of devices and expediting getting that that- 00:44:54.792-->00:45:00.083 those devices to be patched more quickly recognizing that um because the function of the 00:45:00.083-->00:45:05.667 device the performance of the device certainly we don’t want that to be impacted as the 00:45:05.667-->00:45:11.083 result of a patch, there is a need. >>[unclear] they hide behind too much money to do 00:45:11.083-->00:45:17.292 anything about it that’s what we’re getting at. >>Right and I think that, so what I would say 00:45:17.292-->00:45:20.792 to you because this is you’re not the only one that we’ve heard this from and we what 00:45:20.792-->00:45:25.625 we’ve been trying to do um in being very open and transparent is that when um when you hear 00:45:25.625-->00:45:30.417 that to reach back right right to us and I’m happy to give you my contact information we’re 00:45:30.417-->00:45:37.750 engaging directly with that particular manufacturer. We’re bridging the uh you know the the 00:45:37.750-->00:45:42.708 person or the organization that’s coming with the issue to us so that we can work through 00:45:42.708-->00:45:50.417 whatever the particular barrier is that's being you know utilized to kind of eh uh put 00:45:50.417-->00:45:56.708 forward a reason for not patching or for patching not being done in as expedient a 00:45:56.708-->00:46:00.125 manner as what is needed. Um and in some cases it may take a little bit longer, in some cases 00:46:00.125-->00:46:06.833 it can be uh you know uh put forward a little bit more quickly I would say that we’ve 00:46:06.833-->00:46:12.375 come to also understand that sometimes when you hear that from an organization from a 00:46:12.375-->00:46:20.750 vendor the individuals that are talking to the hospital may not be sufficiently in the know in 00:46:20.750-->00:46:26.375 terms of what they can and cannot be doing or saying and we’ve been working within- with 00:46:26.375-->00:46:32.417 the manufacturers with the with their organizations to make certain that they are conveying 00:46:32.417-->00:46:37.792 within their own organisational structure to for example their field service people that 00:46:37.792-->00:46:43.625 they’re providing you know that those individuals need to be providing accurate information 00:46:43.625-->00:46:56.167 as to what can and cannot be done. >>Alright [unclear offmic] >>So uh another question about 00:46:56.167-->00:47:03.583 medical device uh uh work. And specifically coming to this not so much as a uh security 00:47:03.583-->00:47:08.750 researcher but from the consumer side. Uh I’m wondering you know we’ve been we’ve been looking at 00:47:08.750-->00:47:13.583 the at press about the lack of security in medical devices uh and one of the concerns that 00:47:13.583-->00:47:19.375 I’ve had about the response to that is what happens if we take a route where durable medical 00:47:19.375-->00:47:22.917 equipment uh that it that we have such an intimate relationship with becomes even 00:47:22.917-->00:47:28.500 more of a black box than it is right now. In the last 5 or 10 years we’ve seen a lot of 00:47:28.500-->00:47:34.125 consumer driven innovation uh in medical devices uh particularly in the type one diabetes 00:47:34.125-->00:47:38.875 community uh we’ve seen some from hearing aid and Cochlear implant users we’ve seen I 00:47:38.875-->00:47:43.792 believe last year at Def Con there was a presentation uh by a guy who had modified his chair, 00:47:43.792-->00:47:49.750 uh his wheel chair pretty significantly and I’m wondering you know how we can make sure 00:47:49.750-->00:47:55.042 that the increased need for security does not further reduce our our ability to access 00:47:55.042-->00:48:01.083 information about the devices that uh that are in our bodies and around our bodies. >>Ok I’m 00:48:01.083-->00:48:07.125 not sure that I heard the heard the entire question. Um can we can you repeat the question 00:48:07.125-->00:48:13.750 again? I’m really sorry, heh. >>Sure. It’s about a tension between so historically as a 00:48:13.750-->00:48:18.750 consumer there’s very much been a sense that you get what is being sold. Um and it’s very 00:48:18.750-->00:48:22.792 difficult to get documentation and specifications about the equipment that that you’re 00:48:22.792-->00:48:28.750 selecting. Um and I guess what I’m what I’m asking about is you know when you talk about making 00:48:28.750-->00:48:35.542 that shift culturally uh between adversarial to partnership if there’s discussion within the 00:48:35.542-->00:48:40.750 FDA of making that apply not just to security researchers but also to consumers and making 00:48:40.750-->00:48:45.625 sure that we have that same sort of uh access to information and control. >>Ok yeah umm uh 00:48:45.625-->00:48:51.042 another great question and I think that um you know every every culture shay culture 00:48:51.042-->00:48:56.750 change takes uh some time of course it’s not something that you flip a switch and people 00:48:56.750-->00:49:02.583 change overnight so um we do see that we’re making incremental improvements and the point that 00:49:02.583-->00:49:08.917 you make about it not merely being a shift in terms of having tran- greater transparency 00:49:08.917-->00:49:14.125 working together openness with security researchers but broadly speaking with patients, 00:49:14.125-->00:49:19.792 caregivers, consumers how important that is. S- and and there are efforts that are 00:49:19.792-->00:49:26.292 underway in terms of really taking the lessons learned from working with certain groups and 00:49:26.292-->00:49:31.375 expanding them beyond so that we do have that greater transparency. What’s what’s been 00:49:31.375-->00:49:36.917 great to see are some manufacturers already who without this being mandated 00:49:36.917-->00:49:44.250 without it being enforced recognise the benefit and the value of being at that cutting 00:49:44.250-->00:49:49.125 edge of transparency and a good example of that would be putting forward what their software bill 00:49:49.125-->00:49:55.958 of materials is so that uh customers consumers those who are going to be purchasing would 00:49:55.958-->00:50:01.542 have that information up front at the time that they’re making a purchasing decision. And that 00:50:01.542-->00:50:06.375 they would also have that information you know through the lifetime of that device so that 00:50:06.375-->00:50:13.333 in advance of a attack such as a Wanna Cry they would have awareness as to the potential 00:50:13.333-->00:50:21.083 vulnerabilities that might exist within their inventory of devices. S- and that’s something 00:50:21.083-->00:50:27.167 that we um and you know we think is really important uh the software bill of materials is an 00:50:27.167-->00:50:31.833 area that we want to encourage and see greater adoption across manufacturers. There may be 00:50:31.833-->00:50:38.167 other efforts in terms of really making that more main stay and more uh uh not just simply best 00:50:38.167-->00:50:44.083 practice but have that become the norm. That would be one of the areas uh that you know we’re 00:50:44.083-->00:50:52.750 targeting as we go forward. >>You gotta get close, there you go. >>Alright. Morning. Uh my 00:50:52.750-->00:50:56.125 question is for Lisa. Uh Hack the Pentagon was a great model that has encouraged other 00:50:56.125-->00:51:00.750 agencies to look into bug bounty programs uh I’d like to hear your thoughts on whether an 00:51:00.750-->00:51:05.625 agency should be looking to stand up their own program or uh whether you would think it would 00:51:05.625-->00:51:10.500 be a good idea to have that type of a program uh be more of a managed service through GSA or 00:51:10.500-->00:51:15.542 even provided by DHS? >>I think I spotted a Fed. >>That’s an excellent question. Uh that was 00:51:15.542-->00:51:20.500 asked of us a lot in during the time frame in which we were trying to come up with uh a good 00:51:20.500-->00:51:28.333 model. Um what I will say uh I feel very strongly that a bug bounty is not a it’s not a end 00:51:28.333-->00:51:34.208 all be all and it’s not useful for a wide variety of assets and it’s not useful for all 00:51:34.208-->00:51:42.542 organizations. Um that said yes. If we were in a uh a position as a government to have an 00:51:42.542-->00:51:48.500 organization, one consolidated organization that could do such a thing, it would make great 00:51:48.500-->00:51:52.625 sense. I think that’s absolutely the world in which we’re moving so what we did with the 00:51:52.625-->00:51:57.542 Department of Defense um sorry to be too detailed here, is develop one contract the entire 00:51:57.542-->00:52:03.458 department could use. So Department of Navy, Department of Air Force, um the Office of 00:52:03.458-->00:52:08.375 the Secretary of Defense, the CIO shop doesn’t matter who you are if you’re in if you’re one 00:52:08.375-->00:52:13.375 of those 3.2 million personnel in the Department of Defense you should only use this one 00:52:13.375-->00:52:18.000 consolidated contract vehicle so that you’re not reinventing the wheel. Um I do think that that 00:52:18.000-->00:52:23.583 model can and should be pushed to a more federalized uh government place to to make sure 00:52:23.583-->00:52:30.417 that there’s a certain amount of consistency and so that nobody’s being you know a a chuckle head 00:52:30.417-->00:52:35.417 for work of- lack of any other nice way to say it. Um and that we’re consistent with how we 00:52:35.417-->00:52:41.125 deal with researchers so that you know we keep that trust element up. >>Before the next 00:52:41.125-->00:52:45.542 person asks a question I just want if the individual who is in the room who asked the question 00:52:45.542-->00:52:50.750 about the hiding behind some you know preconceived ideas on FDA is still here, I’d like to be 00:52:50.750-->00:52:57.042 able to make sure that that individual has my card and we have the ability to continue 00:52:57.042-->00:53:05.333 that conversation and get to some resolution afterwards. >>Eat the mic >>This question is 00:53:05.333-->00:53:10.667 also for Lisa. Uh you mentioned that you’re you guys are dealing at least you were dealing with 00:53:10.667-->00:53:16.542 the challenge of changing the mindset from more of a compliance based to a security 00:53:16.542-->00:53:22.167 or risk based. Is that something that you guys were able to successfully uh change and if so 00:53:22.167-->00:53:28.917 do you have any ideas that you can share? >>Yeah, I I would say that baby steps have absolutely 00:53:28.917-->00:53:36.667 been taken to starting to change that culturally. The issue is one of I think Suzanne you 00:53:36.667-->00:53:43.208 talked about workforce um training is a I hate to say it because everybody always talks 00:53:43.208-->00:53:48.333 about training but training is a certain element here in which if if folks don’t even know if if 00:53:48.333-->00:53:55.000 they’ve been trained to only focus on you know this this the singular things that are on a 00:53:55.000-->00:54:00.708 checklist, they’re not even intellectually um you know uh agile enough to consider other 00:54:00.708-->00:54:05.667 issues that actually are security issues. So what I would say is yes we’ve made um big 00:54:05.667-->00:54:11.250 impacts we’ve started to shift entire organizations that are responsible for the security uh 00:54:11.250-->00:54:19.917 of networks. Um but it is a it’s gonna be a persistent challenge and when you’re talking about 00:54:19.917-->00:54:23.750 that many people that are responsible and that disperse of uh you know uh a network of 00:54:23.750-->00:54:28.750 folks it’s a persistent challenge. Um I will say that a lot of the other federal 00:54:28.750-->00:54:33.917 agencies have a little bit of a easier path ahead on this because they have such a smaller 00:54:33.917-->00:54:40.042 uh workforce, and the generally all sitting in the same room, or at least in the same country. So 00:54:40.042-->00:54:47.750 um a lot of work ahead. I’d say we’re on the crawl phase and walk and run are ahead of us. 00:54:47.750-->00:54:57.500 >>You know I think this is a follow up question, more or less along those lines. Umm I talk a 00:54:57.500-->00:55:01.500 lot in my day job about collaborative security, and I think this is an example of how 00:55:01.500-->00:55:07.000 you eh collaborate with the with your environment. My f- my question is around scalability. 00:55:07.000-->00:55:15.500 It feels that it’s really you guys that have changed something inside of your agency. Um so my 00:55:15.500-->00:55:23.292 question is really how much is it dependent on your personal contacts with the environment 00:55:23.292-->00:55:30.042 and how do you make sure that culture remains when you step out? You just left the uh the 00:55:30.042-->00:55:36.083 organization. And and what would be your advice to other agencies? Not only in the in the 00:55:36.083-->00:55:44.708 US but globally? >>Yeah actually um that’s a great question too. I’ve I’ve uh let’s see, about 00:55:44.708-->00:55:48.000 the last year, after we were successful with the first challenge most of my fulltime 00:55:48.000-->00:55:54.250 job was just explaining what we did and why we did it to other federal agencies. It does take a 00:55:54.250-->00:56:01.208 while that aha moment comes but it does take a while for them to understand the the value. Bad 00:56:01.208-->00:56:05.500 guys are already in your network, let’s level the playing field a little bit to allow good 00:56:05.500-->00:56:09.708 guys also in your network. Bad guys will always be in your network. This is this is a it’s 00:56:09.708-->00:56:16.833 a risk conversation yes but it’s a you know eh let’s stop pretending like these guys 00:56:16.833-->00:56:22.083 aren’t here. Um as soon as that aha moment happens, it’s a little bit easier for folks to 00:56:22.083-->00:56:29.250 really understand the value. Um and then start to take steps. So one of the things that we cared 00:56:29.250-->00:56:32.792 a lot about when we worked with folks like Leonard on this was making sure that the language 00:56:32.792-->00:56:38.875 for contracts the language that were um that it what the security researchers themselves 00:56:38.875-->00:56:46.917 saw uh was so explicit. Here’s precisely what you’re allowed to do, here’s precisely what you’re 00:56:46.917-->00:56:52.000 absolutely not allowed to do. So that there are no grey areas. Let’s be honest that’s 00:56:52.000-->00:56:55.833 everybody’s beef with the Computer Fraud and Abuse Act. Who the h**l knows exactly, 00:56:55.833-->00:57:00.375 unless Leonard is telling you, what you’re allowed to do and what you’re not by reading the 00:57:00.375-->00:57:06.875 law. Um it was really critical for us to do that and in fact uh we’ve been told by a couple of 00:57:06.875-->00:57:13.375 folks that not only is the DoD model that we came up with initially the the model for the 00:57:13.375-->00:57:18.458 government trying to be a little bit cookie cutter it’s also the model for a lot of um 00:57:18.458-->00:57:26.000 corporation’s challenges and disclosure programs right now because it’s explicit. Because 00:57:26.000-->00:57:33.750 there’s a lot of um detail and a lot of actual it i-i doesn’t let people you know have to do any 00:57:33.750-->00:57:40.250 of the guessing work. Um there’s a lotta a long road ahead though to make it so that it’s uh 00:57:40.250-->00:57:45.667 easier for certain organizations, particularly those um that have more sort of 00:57:45.667-->00:57:54.875 uh public facing um citizen facing stuff that’s relied on. HIPAA data, PII, all those kinds 00:57:54.875-->00:58:00.375 of things s- obviously a lot trickier. >>I and I would add to that that I think um it’s a 00:58:00.375-->00:58:06.875 responsibility of those within any organization or agency to lead by example and to model 00:58:06.875-->00:58:17.542 behavior. And if I were to leave or go somewhere else and this this the kind of behavior that 00:58:17.542-->00:58:23.167 change change hearts and minds you know that kind of activity were to to completely 00:58:23.167-->00:58:31.375 disintegrate than I would consider my work a failure. OK so it is about while one is 00:58:31.375-->00:58:37.167 working and creating that kind of change culture and change environment within one’s own 00:58:37.167-->00:58:43.333 organization it’s as important if not more important that that be sustainable and not be 00:58:43.333-->00:58:49.042 specific to the individual but rather that it becomes part of the DNA and the culture of the 00:58:49.042-->00:58:54.917 team and the individuals who staff up that particular endeavor and that’s been very 00:58:54.917-->00:59:00.500 important to me and to the team that I work with. >>And just uh, to add on to that, I think it’s 00:59:00.500-->00:59:03.708 a great question also because yeah it’s true that it’s not good enough for one individual 00:59:03.708-->00:59:09.125 to be able to sing Kumbaya with with the community it has to be somehow institutionalized. And 00:59:09.125-->00:59:14.250 in part that’s why we are interested in making sure we have documents, so things like 00:59:14.250-->00:59:18.750 the framework document that we just put out, but we also last year released our intake policy 00:59:18.750-->00:59:25.042 for CFAA cases so that people could understand what are the elements and principles we use 00:59:25.042-->00:59:29.417 for charging a case. Um it was also important when when the vulnerability disclosure policy 00:59:29.417-->00:59:34.875 came out to the DOD uh we worked with them to have the head of the criminal division include a 00:59:34.875-->00:59:38.792 statement in the press release that was supportive of the program because it has to be the 00:59:38.792-->00:59:44.333 institution speaking, right? It it can’t just be that an attorney from the DOJ was sent 00:59:44.333-->00:59:48.792 to a panel to speak to you. >>Alright I think we’ve got about >>I just wanna jump in and 00:59:48.792-->00:59:53.625 say all of this stuff is really really fragile and it is a 2 way street so it really requires um 00:59:53.625-->00:59:59.917 people who wanna engage with policy makers in the policy conversation or in bug bounty 00:59:59.917-->01:00:06.875 programs or with the government institutions to step up and do that, right? So um it’s one 01:00:06.875-->01:00:12.250 thing to to sit at home and complain it's a completely other thing to get engaged and we uh 01:00:12.250-->01:00:18.250 want to keep those doors open and those lines of communication open. But we we also need people 01:00:18.250-->01:00:24.250 to to come work with us and are really interested in continuing to form those partnerships. >>So 01:00:24.250-->01:00:28.833 if you meet a magic policy maker, ask how you can help. >>Alright we’ve got 5 questions 01:00:28.833-->01:00:39.417 and about 15 minutes, so, that’ll give you an idea. Come on up. >>Hello um first I wanna 01:00:39.417-->01:00:44.542 commend uh, first I wanna commend you in the in the medical device community for 01:00:44.542-->01:00:49.583 actually making incremental improvements. Having been part of the security operation center 01:00:49.583-->01:00:55.500 trying to protect an intensive secure unit from killing people. I thank you for the hope of the 01:00:55.500-->01:01:00.375 future that we won’t kill people because I can’t come up with a defense good enough to protect 01:01:00.375-->01:01:06.792 these vulnerable devices. So I I appreciate your your um movement in this area. I wish you much 01:01:06.792-->01:01:14.875 better success. Um since I occasionally touch the future state of information security, I 01:01:14.875-->01:01:21.792 wish I didn’t but I do, umm this question is probably more focused to the DOJ. The laws of 01:01:21.792-->01:01:30.083 self defense physically have been largely clarified. What is fair, fair use of force to 01:01:30.083-->01:01:40.875 defend yourself. But the laws of digital self defense don’t exist. The rules of engagement 01:01:40.875-->01:01:53.875 don’t exist. [applause] I wrote a national secure computer that won a competing warfare exercise 01:01:53.875-->01:02:02.542 in 1992 the exerc- the functions that it had in 1992 no one can legally own even to today, even 01:02:02.542-->01:02:09.000 though it could satisfy those requirements even then and the NSA has had a referenced copy 01:02:09.000-->01:02:17.417 since then. Uh so I guess I would like to open to a future state question for you to talk 01:02:17.417-->01:02:23.042 about the rights of digital self defense and its possible future. Does that make sense? >>Of 01:02:23.042-->01:02:28.042 course, yes. So this topic, obviously, it there’s not a conference in which this issue 01:02:28.042-->01:02:34.042 is not at least one panel um and there’s there are reasons for that it’s obviously an area in 01:02:34.042-->01:02:37.625 which there’s not a lot of guidance and a lot of confusion. Uh a variety of things 01:02:37.625-->01:02:42.083 contribute to that. Uh I think one thing that has matured a little bit over the last years 01:02:42.083-->01:02:48.875 is an understanding that when you’re talking about sort of defensive activities you're 01:02:48.875-->01:02:51.750 talking about a range of behaviors, right? So there’s something called active cyber 01:02:51.750-->01:02:55.375 defense, there’s countermeasures, there’s counter strike, there’s hack back, eh 01:02:55.375-->01:02:59.667 you we have some lexicon issues where we sometimes end up talking past each other 01:02:59.667-->01:03:05.917 depending on what we’re talking about. On this spectrum, um it uh we’ve found it very important 01:03:05.917-->01:03:09.458 to make sure we know what we’re talking about at a particular time. So for example on the 01:03:09.458-->01:03:14.417 lower end we’re dealing with perhaps more passive things that um you know certainly things 01:03:14.417-->01:03:18.958 within your network. I think the law around that is fairly well established in part because you 01:03:18.958-->01:03:24.000 can uh get things that right now under our legal framework will allow you to do that. You can 01:03:24.000-->01:03:28.125 get the authorization and consent of parties within your own network to do certain 01:03:28.125-->01:03:31.750 activities. It is once you get outside of your network that the challenges occur. And, and 01:03:31.750-->01:03:36.708 there, uh there are I mean you’re absolutely right, the the law around this is not 01:03:36.708-->01:03:42.583 absolutely clear although I would say that the the CFA for example does not have a self 01:03:42.583-->01:03:47.792 help element, alright? So there’s no element of our you know exception in the computer 01:03:47.792-->01:03:52.458 fraud and abuse act that allows you to hack back against someone who has harmed your network. The 01:03:52.458-->01:03:59.542 question that we have struggled with on a policy level is the benefit of activities, 01:03:59.542-->01:04:07.625 particularly at the far end of the range of offensive conduct. So if you are doing things that 01:04:07.625-->01:04:15.000 perhaps are, disruptive, ?um either to data or maybe in the hardware, it it is difficult for 01:04:15.000-->01:04:23.042 us to imagine a context in which authorizing that conduct is going to lead to a more safe 01:04:23.042-->01:04:30.750 secure reliable internet if everyone has the same comparable right. Frequently uh in the 01:04:30.750-->01:04:36.583 middle where there is this range of things that has to do with monitoring and tracing 01:04:36.583-->01:04:40.292 information I think is is probably the bigger challenge because you're dealing with 01:04:40.292-->01:04:42.833 activities that you know you could say “I want to know where my data is so I can for example 01:04:42.833-->01:04:46.458 call law enforcement and tell them that they should go after that information.” It is also 01:04:46.458-->01:04:50.667 true as you suggested that there is not a framework for that right now. There are laws that 01:04:50.667-->01:04:54.042 govern that and then one of the things that that we flag every time we talk about this is 01:04:54.042-->01:04:58.833 people focus singularly on the Computer Fraud and Abuse Act. Which actually largely isn't the 01:04:58.833-->01:05:04.000 problem in that space. The issue is actually the Electronic Surveillance Statutes which 01:05:04.000-->01:05:11.000 apply to capturing recording intercepting electronic communications and there’s not 01:05:11.000-->01:05:16.792 been a lot of talk around how those laws work. The difficulty there is people traditionally 01:05:16.792-->01:05:22.708 have not been very fond of allowing people to trace intercept communications that 01:05:22.708-->01:05:28.833 are theirs um and alt- altering those laws in the service of tracing information that may be 01:05:28.833-->01:05:33.750 yours or may not has not been an easle- easy political lift and I don’t think we’ve seen a 01:05:33.750-->01:05:40.125 proposal of that sort. So all of this to say you’re right um there’s not a a well defined 01:05:40.125-->01:05:44.833 legal framework. I think we are maturing somewhat but I think that what’s important is making 01:05:44.833-->01:05:50.125 sure that we are talking about the same thing because I think the argument on a policy level 01:05:50.125-->01:06:01.917 for different conduct along this spectrum just differs. >>Well my question is for the D uh DOJ. Uh 01:06:01.917-->01:06:06.458 you know you come here today with all of this Kumbaya and all these good words but you know 01:06:06.458-->01:06:13.417 one thing I was taught words is actions speak louder than words. And when you know over the past 01:06:13.417-->01:06:19.875 year or so you know I have seen and one thing I want you to know I’m certified by the DHS to 01:06:19.875-->01:06:29.083 collect handle and analyze forensic data. Now you know during the election, you know I 01:06:29.083-->01:06:36.125 would like to know why someone like the Secretary of State can commit over 3-->000 counts of 01:06:36.125-->01:06:43.708 mishandling classified material sending it through servers even in that and in that evidence was 01:06:43.708-->01:06:50.625 evidence that she was taking money for her office, but yet nothing happens to her. But then 01:06:50.625-->01:06:57.417 one women Miss Winners leaks one document and you all throw her under the bus. [scattered 01:06:57.417-->01:07:05.708 applause] I guess I’d like to know, uh how much does a get out jail free card cost? I’d like to 01:07:05.708-->01:07:15.792 have one. [laughter] >>Um well I I guess I’ll start off with I I I don’t know what a get out of 01:07:15.792-->01:07:22.167 jail free card costs. [laughter] Umm I I I um you know it comes in handy I guess but um so I I 01:07:22.167-->01:07:26.833 unfortunately this is not going to surprise you, I don’t have an answer to your question about uh 01:07:26.833-->01:07:32.875 what I believe is an illusion to the Clinton email um issue. Um and I imagine this will be one 01:07:32.875-->01:07:37.375 of those questions of a political nature that will divide us for a long time. Um I 01:07:37.375-->01:07:42.917 can tell you that I nor was my office involved in the decision. I can’t tell you the basis of it 01:07:42.917-->01:07:47.833 I’m not sure I could even if I knew, because we don’t comment on pending investigations, but 01:07:47.833-->01:07:53.542 eeh I I’m sorry but that’s. >>There’s no investigation any more, you closed the 01:07:53.542-->01:07:59.042 investigation so now yes you can legally talk about it. >>Uh well so this actually does go back to 01:07:59.042-->01:08:03.625 departmental rules in the sense that they’re actually there to protect even people who were the 01:08:03.625-->01:08:07.917 subject of investigations we’re not supposed to speak afterwards, release information 01:08:07.917-->01:08:13.042 that’s not public about people who were the subjects of or targets of investigations. So 01:08:13.042-->01:08:18.375 I’m sorry but I I wouldn’t be able to comment further on that. >>[unclear off mic] one case and 01:08:18.375-->01:08:25.333 3 thousand counts [unclear] and even I [unclear] And you can’t win. And there’s one case where 01:08:25.333-->01:08:33.500 one woman tried to do the right thing and she gets thrown under the bus. You’re asking me to do 01:08:33.500-->01:08:40.917 the right thing for you but it scares me to do anything out here to help the people not the 01:08:40.917-->01:08:46.083 government of the United States but the people of this country. >>Use the mic >>Use the mic! 01:08:46.083-->01:08:50.958 >>We gotta we gotta get to the rest of the questions. >>You understand? >>I do >>I serve the 01:08:50.958-->01:08:54.250 people, not the government of the United States. I took an oath in the military to protect 01:08:54.250-->01:09:07.750 constitution and the people in this country [inaudible off mic] [shouting from crowd] [applause] 01:09:07.750-->01:09:15.583 >>And my question uh is for people that were victims of the OMB uh data breach uh current or 01:09:15.583-->01:09:24.000 former DoD civilian contractors. What avenues preferably you know with a sidebar conversation do 01:09:24.000-->01:09:34.333 we have to determine and work with uh DoD and uh DOJ to make sure that we’re safe as we’ve 01:09:34.333-->01:09:42.792 departed and moved on to other uh industries, private sector. >>So I’m sorry to punt that. But 01:09:42.792-->01:09:48.417 so OMB if you weren’t, raise your hand if you were affected, right? Uh the OMB hack [laughs] 01:09:48.417-->01:09:55.250 everybody every it was not just a DoD issue so the question was what tools do they have to 01:09:55.250-->01:10:01.167 protect themselves post OMB? So I think I’m afraid I have to pass that to my good friend 01:10:01.167-->01:10:04.500 Leonard. >>Right I I and unfortunately I don’t have a great answer other than what I 01:10:04.500-->01:10:09.083 understand uh OMB did which was to make things like credit monitoring available. Uh the 01:10:09.083-->01:10:16.583 notice notice and I and I understand that I mean I >>It’s more about the personnel 01:10:16.583-->01:10:22.333 protection we have too.. >>Use the mic! >>It’s about personnel protection, especially for those 01:10:22.333-->01:10:30.000 that are going global. >>Right. >>You want we wanted to feel safe and not be found in a 01:10:30.000-->01:10:40.167 country where for instance FSB uh you know bugs us and takes us into custody. >>Again, uh fair 01:10:40.167-->01:10:45.750 question I can only tell you what I what OMB has done so far which is uh the notice and the 01:10:45.750-->01:10:50.750 credit monitoring. >>Don’t be crazy. >>Try not to be crazy? But that’s my 01:10:50.750-->01:10:55.750 nickname.[laughter] Hi I’m going to try not to be crazy and not to tell you my nickname but, and 01:10:55.750-->01:11:00.542 I’ll also give you the question mainly for the DOJ but it’s applicable to everybody. Let me 01:11:00.542-->01:11:04.792 give you more background so most of the stuff that’s in BlackHat is frankly band aids, stuff 01:11:04.792-->01:11:12.083 that’s already happened. Um and it’s really good that security researches or security hackers 01:11:12.083-->01:11:19.042 who responsibly disclose should not be sent to jail. But more and more I’m thinking that uh we 01:11:19.042-->01:11:22.958 need to have an incentive for vendors, companies, not to ship c**p, not to ship bugs, 01:11:22.958-->01:11:30.417 [applause] I- that incentive is- might be in part litigation from the government and it might be 01:11:30.417-->01:11:35.333 part litigation from private lawyers because that seems to be the way the english common law 01:11:35.333-->01:11:39.792 system goes. Can I just go wh- a little bit background? I’m a computer architect a CPU 01:11:39.792-->01:11:44.708 architect I design hardware instructions and performance. You guys use my stuff, my 01:11:44.708-->01:11:51.958 patents. My stuff that makes your stuff run fast sells. I’ve also done security can’t sell 01:11:51.958-->01:11:57.958 it, because nobody’s interested in making things more secure, nobody’s interested in paying 10 01:11:57.958-->01:12:03.917 percent more in performance to make things more secure. We need to have incentives for people to 01:12:03.917-->01:12:11.125 do it where as right now adding a bandaid after the fact, covers your a**. >>So actually if I 01:12:11.125-->01:12:15.875 could jump in on this um when I said that I that most of the things that I wanna change 01:12:15.875-->01:12:19.792 required laws to pass, I this is precisely what I’m talking about. I don’t think we have 01:12:19.792-->01:12:25.708 sufficient incentives in the marketplace to get a market based correction to the 01:12:25.708-->01:12:31.708 insecurity of all of the stuff that we’re using in our daily lives. We need either a law that 01:12:31.708-->01:12:37.375 requires uh comprehensive security and some sort of uh rule making or regulation around 01:12:37.375-->01:12:44.167 this issue or other eh ways to uh create stronger incentives. There are efforts underway that 01:12:44.167-->01:12:50.375 I totally applaud that are that are about creating voluntary uh stakeholder led regulations for 01:12:50.375-->01:12:55.125 IOT and other things that's very useful. We have agencies that with expert authority that are 01:12:55.125-->01:12:59.875 deeply engaged in the sectors that they regulate but we really don’t have any kind of 01:12:59.875-->01:13:04.333 comprehensive approach. And there’s an incredible information asymmetry there’s no 01:13:04.333-->01:13:11.250 way for people who are buying the products to really be able to evaluate the security of them 01:13:11.250-->01:13:17.833 in the first place, so um there’s no way uh to really get um competition going where you 01:13:17.833-->01:13:22.708 would be competing based on the security of the device, yet although there are efforts 01:13:22.708-->01:13:26.083 underway again to create more of a labeling system and other ways that consumers can get this 01:13:26.083-->01:13:32.542 information. Which might be incredibly helpful in trying to um make it worthwhile to make 01:13:32.542-->01:13:37.458 that investment in security even if the end thing is going to be a little bit more expensive. 01:13:37.458-->01:13:42.125 >>Alright we have 3 minutes left. So let me try to get a least one more question here, 01:13:42.125-->01:13:47.875 ‘cause you’ve been standing so patiently. >>OK I’m gonna do it really fast. First of all thank 01:13:47.875-->01:13:53.083 you for this panel and sharing your insights. Um so there is another important regulator that 01:13:53.083-->01:13:58.417 facilitates security re- research or undermines it but is not here in the room and that’s 01:13:58.417-->01:14:05.000 private private uh industry through contracts and terms of use and I’ve read a lot of bug 01:14:05.000-->01:14:09.750 bounty terms of use and some of them are saying circling back to the ULaws thing no reverse 01:14:09.750-->01:14:14.208 engineering. And that’s a problem under the CFAA to my understanding that’s a problem 01:14:14.208-->01:14:20.208 under the DECA new exceptions. And I’m wondering how the DOJ or maybe uh Lisa or all the other 01:14:20.208-->01:14:26.958 um panelists can share some ideas on how we are making sure the private industry through 01:14:26.958-->01:14:32.625 contracts are not undermining your important efforts in bug bounty and just facilitating 01:14:32.625-->01:14:39.125 security research in general? >>Let’s grab the other two questions. >>Yeah we’re gonna 01:14:39.125-->01:14:43.292 ask the have the other two questions and then everybody can pick one and quickly answer one 01:14:43.292-->01:14:51.708 of your choosing. >>My question is very simple, um and it’s great that you guys are here and 01:14:51.708-->01:14:54.833 you’ve been working with individuals like Bo and Josh from the Cavalry and had 01:14:54.833-->01:14:58.792 representatives from our community like Mudge, and for Darpa, but I guess the problem 01:14:58.792-->01:15:03.042 is you keep saying the word “culture, culture, culture” and your culture is as different as 01:15:03.042-->01:15:09.167 you think our culture is. How do you change that in your culture to stop the demonization of the 01:15:09.167-->01:15:14.917 word “hacker” and researchers and the their independent nature. [applause] >>Excellent 01:15:14.917-->01:15:19.917 question we have one more. [applause dies down] This’ll be a yes/no, watch this! >>[laughs] 01:15:19.917-->01:15:25.792 Sure um the FCC the FDA and lots of other government agencies require and do a lot of testing 01:15:25.792-->01:15:30.792 of products and and documentation of things and they do a really horrible job of 01:15:30.792-->01:15:35.125 sharing that information with the consumers. And you have an entire community of people who 01:15:35.125-->01:15:40.583 if you made that information available to them could do a lot of this work. And they have a a 01:15:40.583-->01:15:45.333 vested interest in things like things the FDA are doing, why are we not making that 01:15:45.333-->01:15:52.792 information available? >>Good stuff. Thank you guys. >>So I’m not even sure where which one 01:15:52.792-->01:15:58.250 which question to start with umm. >>And we only have like, yeah, one minute. >>So with res- 01:15:58.250-->01:16:04.083 with respect to information sharing, and uh uh making that information available or 01:16:04.083-->01:16:07.875 transparent you’re talking about I assume from like the medical device manufacturers and uh uh 01:16:07.875-->01:16:23.625 we have several efforts underway to further kind of socialize and escalate that um. You know I I’m 01:16:23.625-->01:16:28.208 not without knowing specifically what it is that you’re talking about, and I’m happy to have a 01:16:28.208-->01:16:32.083 separate conversation with you, I think that um the whole concept of information sharing 01:16:32.083-->01:16:40.042 um for cybersecurity is one that we embedded and we consider to be a core concept um within our 01:16:40.042-->01:16:46.458 guidance at FDA and we've been working very hard with different other p- different parties with 01:16:46.458-->01:16:54.708 that are part of the entire ecosystem to adopt that and we know that that also takes some 01:16:54.708-->01:16:58.958 time to further embrace. So there’s some organizations that are a little bit ahead of that 01:16:58.958-->01:17:04.708 and there are others that are very slow towards adoption. But there are you know there are 01:17:04.708-->01:17:09.792 efforts underway with regard to that. Umm there was I don’t remember what the second 01:17:09.792-->01:17:14.667 question was at this point um. >>That’s ok. I I liked the stop demonizing hackers one so I’ll 01:17:14.667-->01:17:18.875 just uh follow up on that I think you’re absolutely right and that’s part of why um I try 01:17:18.875-->01:17:24.542 to encourage people to show up and be in part of this conversation and to reach out to 01:17:24.542-->01:17:30.625 to people who are thinking about these issues in the government so that they uh can get to know 01:17:30.625-->01:17:34.208 so so you can get to know each other. ‘Cause that’s the only way we can change it. It is a 01:17:34.208-->01:17:38.375 problem agencies like the Federal Trade Commision are working really hard to to 01:17:38.375-->01:17:44.542 appropriately value hacker and not make that a pejorative phrase. But you’re absolutely 01:17:44.542-->01:17:48.250 right like in the government this is a thing that we have to keep working on every single 01:17:48.250-->01:17:53.708 day. >>Uh 2 quick very quickly. Um one, uh we are trying to do this by things like as we did 01:17:53.708-->01:17:59.208 last year invite hackers in to speak to the prosecutors who would consider the cases that 01:17:59.208-->01:18:03.917 would fall, come come before them. Um that’s probably not enough but the good news is I 01:18:03.917-->01:18:08.542 think this is happening through the course of time. As our operations become more 01:18:08.542-->01:18:12.708 complicated we are understanding that we need help that we don't have internally. So in our 01:18:12.708-->01:18:17.958 botnet takedowns for example we work with computer security researchers on the front end and 01:18:17.958-->01:18:22.375 back end and on the malware analysis and on the the sort of maintenance of the the botnet 01:18:22.375-->01:18:25.833 afterwards. And so I think there is sort of a growing appreciation for what that 01:18:25.833-->01:18:30.792 knowledge does and how it helps. Um the only other thing was on the gentlemen that was talking 01:18:30.792-->01:18:34.250 about incentives in market I guess the only thing I’d flag is that part of the reason for 01:18:34.250-->01:18:37.208 something like CISA the Cy- Cybersecurity Information Sharing Act was to stimulate 01:18:37.208-->01:18:43.125 information sharing that would make vulnerabilities and problems more transparent. And 01:18:43.125-->01:18:49.917 make it more possible for people to make choices based on such information. >>[unclear off mic] 01:18:49.917-->01:19:07.125 >>I I ok yeah. >>Final thought from Lisa. >>You’re absolutely right I had the great privilege 01:19:07.125-->01:19:11.417 of working for Mudge once upon a time at DARPA um and there is a big initiative in the government 01:19:11.417-->01:19:15.000 to bring folks who have actual technical chops into the government uh the US digital 01:19:15.000-->01:19:20.208 service was started, 18F, other organizations. These are technologists firsts and let me 01:19:20.208-->01:19:26.333 tell you they are not government people. Um eh eh and the it requires folks again I have this 01:19:26.333-->01:19:31.125 title Bureaucracy Hacker, sort of middle ground people that understand both communities that 01:19:31.125-->01:19:35.458 can actually talk to one another too. And we really need a big push to make sure that there’s 01:19:35.458-->01:19:41.167 more folks like that. >>Career change for some of you perhaps. Let’s thank our panelists. 01:19:41.167-->00:00:00.000 [applause]