00:00:00.000-->00:00:05.439 >>Uh, so thank you all very much, its a pleasure to see you all, uh in addition to being uh 00:00:05.439-->00:00:09.743 a normal Def Con talk, this is actually also the last stop in a book tour that I've been on 00:00:09.743-->00:00:14.748 since April, 35 cities, 3 countries, uh I this is my final resting place on this tour, I am 00:00:17.551-->00:00:22.556 uh I've been waiting since April the 4th to tell this joke, I am now touring complete [laughter] 00:00:25.292-->00:00:30.297 [applause]. And you are the only audience that I could tell that joke too [laughter]. So, it's 00:00:34.401-->00:00:39.306 uniquely appropriate that I finish here. So, uh uh uh as a little bit of housekeeping when 00:00:39.306-->00:00:44.111 this is done adpro pro the tour I'll be signing copies of my book Walk Away uh in the 00:00:44.111-->00:00:48.148 retailer's room at the no starch booth, they very kindly brought in a few hundred copies of Walk 00:00:48.148-->00:00:53.820 Away and I -I hope to see you there. But lets screw the bougie commerce and lets get down to 00:00:53.820-->00:00:59.626 brass tacks here, uh in November 2013, a guy named Tom Wheeler was appointed to run the federal 00:00:59.626-->00:01:04.932 communications commission uh he was a former former cable lobbyist who is now going to be 00:01:04.932-->00:01:10.604 in charge of regulating the cable industry. Uh memorably John Oliver went on TV to 00:01:10.604-->00:01:15.609 explain why this might not be a bad idea, called Tom Wheeler a dingo babysitter. Um, and then, 00:01:18.312-->00:01:24.685 a funny thing happened on the way to regulation which is that millions and millions of people 00:01:24.685-->00:01:28.822 called the FCC, and wrote to the FCC, and called their congressmen, and showed up in 00:01:28.822-->00:01:35.128 person and showed up outside Tom Wheeler's house everyday at the end of his driveway with signs. 00:01:35.128-->00:01:40.133 And then, on February 26, 2015 uh Tom Wheeler created a title 2 role for a network neutrality 00:01:43.570-->00:01:49.276 that said that ISPs couldn't give preference to uh different packets based on who had bribed 00:01:49.276-->00:01:55.182 them the most to carry them to you. He also said, that states that had passed laws that said 00:01:55.182-->00:01:59.319 that cities couldn't provide their own networks to compete with the crummy overpriced 00:01:59.319-->00:02:04.624 networks that the monopolies were provided that um those states were violating the FCC's 00:02:04.624-->00:02:09.963 rules, and that cities if they wanted to could create networks for the people who lived in 00:02:09.963-->00:02:14.968 them. And then, yeah that was good news, the story gets dark though cause on January the 00:02:17.170-->00:02:22.175 20th, Donald Trump was sworn in I know, and he appointed a new dingo babysitter. Uh a guy named 00:02:27.180-->00:02:32.185 Ajit Pai, also a former cable lobbyist. Uh and he hated network neutrality and announced 00:02:35.889-->00:02:42.696 that his first order of business would be dismantling it. And on July 12th, 8 million people sent 00:02:42.696-->00:02:47.701 comments to the FCC about this, significantly more than had ever lobbied the FCC on it a year 00:02:51.004-->00:02:55.075 before. Now, we don't know what Pai is going to do at this point, we don't know if we're 00:02:55.075-->00:03:00.814 winning or losing the fight for network neutrality. But, winning or losing is the wrong way to 00:03:00.814-->00:03:05.819 understand this kind of problem. Because political process, like security is a process and not a 00:03:08.121-->00:03:14.694 product, and it's a process governed by 4 forces. Lawrence Lessig wrote this book Code and 00:03:14.694-->00:03:21.435 the other laws of cyberspace in 1999 in which he said that our world is regulated by code, it's 00:03:21.435-->00:03:27.407 what's technologically possible, markets that's what's profitable, law, what's legal, 00:03:27.407-->00:03:32.412 and norms, what's socially acceptable. And what happens in our world is the result of those 00:03:35.715-->00:03:42.422 4 factors coming together; law, code, norms and markets. So, let's look at where net 00:03:42.422-->00:03:47.427 neutrality stands according to Lessig's analysis. Well, code, uh Tim Woo coined the term 00:03:49.496-->00:03:54.401 network neutrality uh old school chum of mine, I lost touch with him for 20 years, he sent me an 00:03:54.401-->00:03:58.572 email saying uh I just found you on the internet and by the way I'm really sorry for shooting 00:03:58.572-->00:04:03.510 your dwarf in the back with a crossbow in 1980 [laughter]. Um, Tim Woo, uh went to work for the 00:04:05.612-->00:04:09.282 Federal trade commission in or the uh sorry not the federal trade commission, the New York 00:04:09.282-->00:04:15.589 Attorney General's office and uh distributed open sourced tools to New Yorkers to measure 00:04:15.589-->00:04:22.496 network performance across uh the internet uh service being offered by the duopoly in New 00:04:22.496-->00:04:29.136 York state, and he sent an open letter to Time Warner cable saying in advertisement after 00:04:29.136-->00:04:34.107 advertisement Time warner promised a quote blaton fast, super reliable internet 00:04:34.107-->00:04:39.112 connection, yet it appears the company has been failing to take adequate or necessary steps to 00:04:39.112-->00:04:44.151 keep pace with the demand of the Time Warner cable customers at times letting communi- 00:04:44.151-->00:04:49.089 connections with key internet content providers become so congested that large volumes of 00:04:49.089-->00:04:55.028 internet data were regularly lost or discarded. So, code is on our side right? Now we know 00:04:55.028-->00:05:01.234 the full extent of cable company F***ery. We can measure it and report on it to the byte level 00:05:01.234-->00:05:06.239 in real time. So code is looking good. How about law? Law is looking dubious. So we have this 00:05:08.975-->00:05:14.681 title 2 rule, it's a year old, uh what the FCC can and can't do is set bylaw, congress would 00:05:14.681-->00:05:20.554 need to pass a new law to change how the FCC works, congress is not going to pass any laws 00:05:20.554-->00:05:25.125 anytime soon, I don't know if you've noticed, but they're not making laws these days 00:05:25.125-->00:05:30.297 [laughter] and so the laws kind of ambivalent because maybe Ajit Pai can get the commissioners to 00:05:30.297-->00:05:36.403 vote down title 2, maybe not, we'll see, certainly there's a lot of people who have put him 00:05:36.403-->00:05:41.942 on notice that this would be terrible idea and while we were away while the network 00:05:41.942-->00:05:47.180 neutrality uh rule was in place what happened was the cable operators started to get on 00:05:47.180-->00:05:52.352 investor phone calls where they had to make full disclosures or face personal criminal liability 00:05:52.352-->00:05:58.058 under Dodd Frank, so lying on those phone calls can send you to jail, and they started to say 00:05:58.058-->00:06:02.062 something really different when they could go to jail for lying than they did when they were 00:06:02.062-->00:06:08.368 just talking to the press. And what they started to say was actually network neutrality not 00:06:08.368-->00:06:11.771 network neutrality doesn't matter we're gonna build out our networks no matter what, our 00:06:11.771-->00:06:17.577 investment is strong, it doesn't matter if this rule is in place or not. So um, we do have some 00:06:17.577-->00:06:21.715 good facts and evidence that we can bring to the likes of Ajit Pai who says that network 00:06:21.715-->00:06:25.886 neutrality causes under investment in American broadband. Now how about 00:06:25.886-->00:06:30.891 markets, markets are really serious trouble here, right the most concentrated industry, the 00:06:33.693-->00:06:38.698 first really concentrated modern industry is telcoms and their buying online companies now so 00:06:41.534-->00:06:46.806 the companies used to fight them to say don't uh congest your pipes on purpose to stop our 00:06:46.806-->00:06:53.313 customers from seeing uh our pages, those companies are now part of the um the phone 00:06:53.313-->00:06:59.085 company, like verizon owns tumblr now. Tumblr was one of the great proponents of net 00:06:59.085-->00:07:04.024 neutrality a year ago, this year they were a little weak kneed. Or Netflix right? Netflix a year 00:07:06.693-->00:07:12.232 ago Netflix lead the charge on network neutrality this year on one of those phone calls where 00:07:12.232-->00:07:17.871 you have to tell the truth or you go to jail, CEO said very frankly eh network neutrality's 00:07:17.871-->00:07:23.310 not as important to the survival of our business as it was a year ago cause everyone loves Netflix 00:07:23.310-->00:07:27.814 now and if a cable operator started to screw with Netflix they would face so much backlash 00:07:27.814-->00:07:32.419 from our customers who are there customers that we could probably win that fight. Now we'll still 00:07:32.419-->00:07:36.990 fight for network neutrality but it's not an existential threat for us and even taking Madas 00:07:36.990-->00:07:40.894 word and I don't know why you wouldn't take Madas word, I think he's telling the truth, I 00:07:40.894-->00:07:45.298 think it's facially obvious that netflix will fight harder for something that is an existential 00:07:45.298-->00:07:51.004 threat to the business than they will for something that they view is a good idea, so that's 00:07:51.004-->00:07:57.243 bad news. But how about norms? Norms are where the good news starts. People care about 00:07:57.243-->00:08:02.882 network neutrality. Saying that network neutrality is not a good idea, makes you sound like a 00:08:02.882-->00:08:07.887 colossal a**hole [laughter]. Network neutrality is counted as a victory one that people have a 00:08:10.957-->00:08:17.263 stake in defending as opposed to some weird idea which it was a year ago that most people 00:08:17.263-->00:08:22.869 weren't even sure what it was. 8 million people sent comments to the FCC about network 00:08:22.869-->00:08:28.141 neutrality. There's evidence in hand that network neutrality does not impact telecoms 00:08:28.141-->00:08:33.146 infrastructure investment. Norms are huge we have millions of Americans who in the last year 00:08:37.150-->00:08:42.155 have formed strong opinions about telecoms policy. I mean even I find it difficult to 00:08:45.325-->00:08:49.662 remain engaged when people are talking about telecoms [snoring], so are we winning or 00:08:49.662-->00:08:54.667 losing on telecoms policy? Well both. Last year we leveraged norms to win a legal battle, 00:08:58.004-->00:09:03.977 this year the legal side pushed back helped by the market and government got bought out by big 00:09:03.977-->00:09:09.349 Telco, but this year we got bigger norms to push back with because the politicians who got 00:09:09.349-->00:09:14.821 bought out by big Telco, they also got elected by online ground swells net roots groups 00:09:14.821-->00:09:21.594 that really care about network neutrality and the politicians may also realize that incumbency 00:09:21.594-->00:09:27.333 is better served by controllable internet than by a wild one right? Having achieved uh 00:09:27.333-->00:09:32.238 victory and gotten elected by insurgent grassroots movements, they would like those insurgent 00:09:32.238-->00:09:35.942 grassroots movements to go away so that they don't throw them out and put someone new in there 00:09:35.942-->00:09:41.781 see, so it's hard to know but we don't need to know, we don't need to pay attention because 00:09:41.781-->00:09:47.887 winning or losing is the wrong sort of question. The right question is how do we win more 00:09:47.887-->00:09:52.826 than we are right now and how do we make our adversaries lose more than they are right now. 00:09:52.826-->00:09:58.098 This is a security problem, it is a process and not a product. When you're red teaming your 00:09:58.098-->00:10:03.103 adversaries you look for weak points and you attack them with your strengths and our strength 00:10:03.103-->00:10:10.109 on network neutrality is norms. Network neutrality is not about regulating the internet telecoms 00:10:10.109-->00:10:16.816 is regulation uh if you think about what a telecom is it's a bunch of rules saying you're 00:10:16.816-->00:10:21.120 allowed to go and stick poles on every corner and dig up every sidewalk of every city in 00:10:21.120-->00:10:26.359 America along with all of the rights of way along all the railroad tracks in America at 00:10:26.359-->00:10:31.498 knock down prices without having to negotiate with every retailer, every individual, 00:10:31.498-->00:10:36.469 every government for the right to dig up that sidewalk and in exchange you get to be our phone 00:10:36.469-->00:10:41.841 company. Without a regulation there is no phone company right? You can't go golf with your 00:10:41.841-->00:10:45.411 phone company and pay market rates for your sidewalk clearance. I mean maybe you 00:10:45.411-->00:10:50.850 could but a trillion dollars later you'd still be arguing with that one person in Brooklyn 00:10:50.850-->00:10:55.622 who wants artisanal sidewalk digging and refuses to let your guys in [laughter] to dig it up 00:10:55.622-->00:11:01.327 and complete your last mile. So we're not arguing about whether there should be regulation, 00:11:01.327-->00:11:06.299 we're just arguing about whether the regulation should serve the public or the telecoms giants 00:11:06.299-->00:11:10.703 who've been profiting at the expense of the public. Who will win this time is the wrong 00:11:10.703-->00:11:15.708 question, I mean it would rock to get Ajit Pai to do a total climb down on his hard core 00:11:17.877-->00:11:22.382 commitment to destroy net neutrality but it would also work for him to screw over 00:11:22.382-->00:11:28.388 network neutrality and then take his a** to court and hand him his a** in the courtroom, either 00:11:28.388-->00:11:33.927 one would be a huge moral boost, either one would do great on the normative side, either one would 00:11:33.927-->00:11:39.933 create a lot more net neutrality stakeholders who thought of themselves as pirates not as 00:11:39.933-->00:11:45.371 admirals because remember every pirate wants to be an admiral, and yesterday's pirates always 00:11:45.371-->00:11:49.943 turn into admirals who say when I did it that was totally legit, when you do it that's totally 00:11:49.943-->00:11:56.549 wrong. So, telecoms at competition advocates, we thought we won in 1982 when we 00:11:56.549-->00:12:01.487 got AT &T broken up, we thought we won when the net heads beat the bell heads at AT&T and 00:12:03.856-->00:12:09.662 circuit switching declined and packet switching grew but then the carriers came back because 00:12:09.662-->00:12:14.667 of course they did our victory uh over uh AT&T our victory over packet switching, neither one of 00:12:18.204-->00:12:23.176 those things turned all those greedy anti-competitive super villains to become like 00:12:23.176-->00:12:29.616 buddhists right? They didn't lose, they just had a technical, legal business and normative set 00:12:29.616-->00:12:34.754 back and so they worked at the margins like lord voldemort lurking on the back of someone's 00:12:34.754-->00:12:41.427 head waiting to find a new body [laughter] bringing their powers back to bare and it helped of 00:12:41.427-->00:12:45.798 course the finance capital devoured the world around the same time, meaning they had 00:12:45.798-->00:12:51.638 fewer and fewer limits on the ways they could use raw cash to buy political outcomes. Maybe 00:12:51.638-->00:12:55.241 we'll be able to spend them, maybe we'll be able to buy more politicians than them because 00:12:55.241-->00:13:01.214 the total value of the ecosystem that they want to strangle with their neutracidal ways uh 00:13:01.214-->00:13:06.586 exceeds the market cap of all the telecoms companies by orders of magnitudes, they just own the 00:13:06.586-->00:13:11.291 pipes, the stuff that's in the pipes is what matters but every pirate wants to be an admiral, 00:13:11.291-->00:13:15.762 and so the insurgents who are bank rolling net neutrality fights today will become 00:13:15.762-->00:13:20.933 tomorrow's telecom chums uh happy to slip big ISP a few bucks for premium carriage if it 00:13:20.933-->00:13:26.172 means the upstart competitors that friend due to them what they did to last years pirates 00:13:26.172-->00:13:32.512 uh uh could be walled off from their customers, it's like that last line in Animal Farm, the 00:13:32.512-->00:13:37.150 creatures look from the pig to the man and from the man to the pig and from the pig to the man 00:13:37.150-->00:13:43.956 again and already it was impossible to say which was which. So it's useless to ask 00:13:43.956-->00:13:48.961 whether the companies are on our side or not, coke does not want to buy the world a coke, 00:13:53.266-->00:13:59.439 companies are not on our side the right question is how do we get companies to see that our 00:13:59.439-->00:14:05.278 side is in their temporary advantage and when can we rely on companies to help us out. So 00:14:05.278-->00:14:10.817 let's apply that to some other issues like back doors, so EFF we made our bones fighting back 00:14:10.817-->00:14:16.422 doors 1992 we won this Bernstein law suit where Daniel J Bernstein DJB had published 00:14:16.422-->00:14:20.927 source code that allowed him to implement cypher stronger than the one that the NSA thought 00:14:20.927-->00:14:27.867 civilians should have access too and at the time uh everybody thought that it was a hopeless 00:14:27.867-->00:14:33.606 fight EFF brought a legal challenge we said that DJB had the first amendment right to 00:14:33.606-->00:14:37.710 publish source code, that source code was a form of expressive speech that programmers use to 00:14:37.710-->00:14:42.215 express their ideas and the ninth circuit at the lower division and the apal division 00:14:42.215-->00:14:47.220 both upheld us and cryptos been legal to use since then that's why this con exists thats why 00:14:47.220-->00:14:52.225 your jobs exist. You know, the odds were stacked against us in market and norms and in code um 00:14:57.263-->00:15:02.368 you know there was uh this this idea that DES 50 this this very weak cypher would be enough to 00:15:02.368-->00:15:08.407 defend all of uh all of American business, all of American enterprise, all of American 00:15:08.407-->00:15:14.847 activity and um we would say well that cyphers super weak and it doesn't work and the 00:15:14.847-->00:15:18.851 congressional oversight for the NSA would say well the NSA has hired all the best 00:15:18.851-->00:15:22.955 mathematicians that graduated form all the best universities for 30 years and they say it's 00:15:22.955-->00:15:28.094 fine who the h**l are you? So you know we set out to prove it, John Gilmore helped find, found 00:15:28.094-->00:15:33.266 EFF early in play in some microsystems, he built a computer called a DES cracker he 00:15:33.266-->00:15:37.770 built a computer that for a quarter million dollars could brute force the whole key space 00:15:37.770-->00:15:42.775 of DES 50 in two hours and he said this is the cost of honing the entire American finance 00:15:44.811-->00:15:49.282 system as well as all of our political communications, global or personal communications, 00:15:49.282-->00:15:54.453 quarter million bucks, 2 hours right? That is a good return on your investment, everybody 00:15:54.453-->00:15:59.458 should build a DES cracker [laughter] but it didn't help. Now, what did help was arguing 00:16:02.261-->00:16:07.099 that the first amendment protected programmers and the first amendment obviously only 00:16:07.099-->00:16:11.637 applies in America, I'm not an American, I'm Canadian, we're like serial killers, we look 00:16:11.637-->00:16:18.411 like everybody else and we're everywhere um [laughter] but the first amendment turned out to 00:16:18.411-->00:16:23.783 have a way that it could apply to everyone in the world which is that once the US made it 00:16:23.783-->00:16:30.389 legal to make strong crypto, it became the guardian of the world's working cryptography any 00:16:30.389-->00:16:34.560 other country that proposed to ban working cryptography would have people show up and say it 00:16:34.560-->00:16:38.865 doesn't matter if you ban working cryptography because the US will just keep exporting 00:16:38.865-->00:16:44.403 strong crypto to our constituencies and all that you'll get is that our industry 00:16:44.403-->00:16:48.674 won't be able to participate in the crypto market place. So these US fights, they're really 00:16:48.674-->00:16:55.081 important, that's why people all over the world watch so closely when the FBI tried to get um 00:16:55.081-->00:16:59.785 apple to backdoor its phones to read what the San Bernardino killers had been talking about 00:16:59.785-->00:17:04.223 before they went on their shooting spree. So, what is Lessig's four factors have to 00:17:04.223-->00:17:08.561 say about backdoors? How about norms, well we've had these super high powered breeches 00:17:08.561-->00:17:13.766 lately there was vault 7, there was shadow brokers and those gave rise to things like 00:17:13.766-->00:17:18.571 wannacry right where you have this ransomware worm that's shutting down key systems all 00:17:18.571-->00:17:23.476 over the world and one of the things that rarely got discussed in the world of wannacry is what 00:17:23.476-->00:17:27.446 the ransom was, does anyone know how much the ransom was in dollars [inaudible] $300 right? 00:17:27.446-->00:17:30.883 These guys were seizing whole hospitals and asking for $300, this was not Lex Luthor, these 00:17:30.883-->00:17:35.888 guys [laughter] were dumb dumbs, they were dumb dumbs that got there hands on superweapons 00:17:44.797-->00:17:49.802 developed at taxpayer expense right all of a sudden people woke up and said maybe the idea 00:17:52.338-->00:17:56.909 that vulnerabilities that governments discover in commonly used systems that they don't 00:17:56.909-->00:18:02.214 patch maybe those will get independently discovered or leaked and used by dumb dumbs 00:18:02.214-->00:18:07.687 not just like North Korea but like that crackhead who broke your car window for the quarter 00:18:07.687-->00:18:12.692 you left on your dashboard [laughter] is gonna get there hands on these crazy cyber 00:18:12.692-->00:18:18.698 weapons. There in the normative sphere, there's no evidence of anyone going dark right? Every 00:18:18.698-->00:18:24.036 Time law enforcement is made to show its work when it says you know we can't police anyone 00:18:24.036-->00:18:27.907 anymore because the terrorists are going dark you ask them like have the terrorists gone dark 00:18:27.907-->00:18:32.278 like where's your evidence of it there like wellll they haven't gone dark yet I mean technically 00:18:32.278-->00:18:37.783 we just keep being able to spy on everyone all the time and like you know the the paris uh 00:18:37.783-->00:18:42.455 attackers they ditched a laptop uh in a garbage can with an unencrypted hard drive and a 00:18:42.455-->00:18:47.460 folder on the desktop labeled secret terror plans [laughter] but someday they're gonna go 00:18:50.096-->00:18:54.367 dark I mean we know it right like someday this plane might crash and that's why I'm gonna 00:18:54.367-->00:18:59.372 eat my seat mate now [laughter]. So, the normative side is looking pretty good, but it's 00:19:03.843-->00:19:08.114 not perfect uh there's lots of hysteria about the dark net, if any of you saw Roger Dingledine 00:19:08.114-->00:19:13.319 talk yesterday about about dark net hysteria um it's totally true that crypto uh that 00:19:13.319-->00:19:17.857 ransomware and crypto currencies have become the inseparable peanut butter and chocolate of 00:19:17.857-->00:19:23.095 s***y crime in the 21st century and not only that but like it's also become the thing that real 00:19:23.095-->00:19:27.099 world kidnappers are now using to cash out on their kidnappings, bitcoins and other 00:19:27.099-->00:19:32.304 coins, so it's a mixed bag on norms. How about markets? Well the market news is pretty good, 00:19:32.304-->00:19:36.842 it turns out that people want products that protect their privacy. Uh full disc encryption 00:19:36.842-->00:19:41.847 is now standard uh whats app is is uh implementing end to end encryption for uh billions of 00:19:44.483-->00:19:49.288 messaging users all around the world and putting competitive pressure on everyone else to 00:19:49.288-->00:19:54.493 match them and exceed them, but the bad news is that there's still a lot of money to be made 00:19:54.493-->00:20:00.633 from spying on your customers. Uh last year Henrich Mulka and others reported that AT&T were 00:20:00.633-->00:20:05.104 making tens of millions of dollars a year selling their customers data secretly and 00:20:05.104-->00:20:11.677 illegally to the NSA and the zero day trade is alive and well and countries around the world 00:20:11.677-->00:20:17.249 that are not well technologically developed and have no IT capacity to speak of 00:20:17.249-->00:20:21.253 are never the less able to enact super ambitious mass surveillance programs like in 00:20:21.253-->00:20:26.225 Ethiopia where they buy in tools from companies like hacking team to spy on everyone in the 00:20:26.225-->00:20:32.731 country even though no uh uh indigenous I uh well developed IT industry exists they can 00:20:32.731-->00:20:38.804 still spy like Americans um so the market side is a bit of a mixed bag. How about the Law? 00:20:38.804-->00:20:45.044 Well Bernstein is still the law of the land it was uh challenged a bit in 2000 over the 2600 case 00:20:45.044-->00:20:51.050 but it's still there um we have some hard cases that have come up uh on crypto, none have gone 00:20:51.050-->00:20:55.788 all the way through the courts, which is good because hard cases make bad law, uh judges are 00:20:55.788-->00:21:01.794 often willing to say um people who commit acts of terror don't aren't entitled to privacy uh 00:21:01.794-->00:21:06.565 and are indifferent to all the people who didn't commit an act of terror who will be implicated 00:21:06.565-->00:21:11.570 by that privacy decision uh we have uh a burgeoning idea around the world that the law should 00:21:13.706-->00:21:17.543 not protect cryptography and in fact should mandate that no one should have access to working 00:21:17.543-->00:21:22.414 cryptography. You may have seen that Australia has planned in an upcoming meeting of the five 00:21:22.414-->00:21:27.353 eyes countries, Australia, Canada, New Zealand the US and the UK to propose that all five 00:21:27.353-->00:21:32.658 of those countries ban working crypto and mandate backdoors in all of their uh products uh the 00:21:32.658-->00:21:38.130 uh that wasn't enough the prime minister of Australia recently said in public with a straight 00:21:38.130-->00:21:43.402 face that the laws of mathematics are all well and good but the law in Australia is 00:21:43.402-->00:21:48.407 the law of Australia [laughter]. You know nerds nerd harder [laughter]. Uh in the UK they 00:21:54.380-->00:22:00.085 passed a surveillance bill that uh makes 1984 look like a manual for state craft, China has 00:22:00.085-->00:22:04.690 banned VPNs and the major app stores including Googles and Apple are collaborating to 00:22:04.690-->00:22:09.795 remove VPNs that aren't man in the middle from mobile app stores, so the law side, not 00:22:09.795-->00:22:15.501 looking so good. The code side, well the code side obviously looks great cause crypto works 00:22:15.501-->00:22:20.506 right? Crypto works and the bad news is that increasingly um we are using devices that don't see 00:22:23.409-->00:22:28.180 themselves as your servants but as your adversaries right? Devices that are designed to 00:22:28.180-->00:22:33.452 make sure that you only use one kind of printer cartridge or that you only tie into one app 00:22:33.452-->00:22:37.890 store ecosystem or in some other way that you conduct your affairs to the benefit of the 00:22:37.890-->00:22:42.394 shareholders of the company that made the product instead of your own and in those cases those 00:22:42.394-->00:22:47.099 devices are designed to run code that you're not supposed to even know is there and that if you 00:22:47.099-->00:22:51.570 know it's there you can't find and if you find it you can't disable it or change it because 00:22:51.570-->00:22:55.374 if you can go in and say like I'd like to buy my apps from a different store please, then 00:22:55.374-->00:23:01.280 that whole model breaks down. And then in the middle um we have uh we have uh some some 00:23:01.280-->00:23:06.285 reasonably ok news um for the code side where were getting really good examples of how bad 00:23:08.787-->00:23:15.294 code really puts people at risk um you know the there's itunes uh being use, the updater 00:23:15.294-->00:23:20.099 mechanism being used by FinFisher to push malware that is a product they sold to 00:23:20.099-->00:23:25.704 governments uh you could push malware into itunes instances by masquerading as a software 00:23:25.704-->00:23:29.308 update that immediately triggered better security practices on the part of apple 00:23:29.308-->00:23:33.779 and was a warning to everyone who has unauthenticated software updates that this is bad news 00:23:33.779-->00:23:39.918 and could uh make really hard problems for your customers and your business. So backdoors, 00:23:39.918-->00:23:44.423 kind of in the middle, we've got a little strength on the on the norm side, the law sides ok, the 00:23:44.423-->00:23:49.428 code side looks amazing uh let's use code to uh try and push the law. Now how about uh DRM? 00:23:54.333-->00:24:00.673 Section 1201 of the DMCA the war on general purpose computing right? The idea uh very dumb 00:24:00.673-->00:24:05.678 idea that um I can give you a device that has a key to decrypt messages from me uh but that 00:24:08.781-->00:24:14.586 that key is hidden in the device somehow so that only programs that I provide can access that 00:24:14.586-->00:24:16.588 key and those programs can access that key and those programs will do what I tell 00:24:16.588-->00:24:21.160 them to do, like throw away the cleartext when it's done, that ideas like completely bankrupt 00:24:21.160-->00:24:25.164 we don't hide keys in equipment that we give to our adversaries for the same reason that we 00:24:25.164-->00:24:29.802 don't keep bank safes in bank robbers living rooms right? [laughter] because this is not 00:24:29.802-->00:24:36.241 Alice, and Bob and Carol, or Alice and Bob and Eve, it's just Alice and Bob right? Alice is uh 00:24:36.241-->00:24:40.879 like anyone in the world who wants to get a netflix account and Bob is netflix and bob gives 00:24:40.879-->00:24:45.017 anyone who signs up for a netflix account a copy of the netflix client with the netflix 00:24:45.017-->00:24:49.488 keys hidden in it in hopes that none of those Alice's including like the bored grad students 00:24:49.488-->00:24:52.858 with electron tunneling microscopes nothing to do in a weekend and a bunch of grad uh 00:24:52.858-->00:24:57.062 undergrads hanging around like a bad smell, that none of them look to hard at that stuff that 00:24:57.062-->00:25:02.401 netflix just gave them and figure out where the keys are. So, DRM is dumb, but it's not 00:25:02.401-->00:25:09.108 harmless. Because of the very fragility of DRM, DRM advocates, the companies that like DRM, 00:25:09.108-->00:25:13.712 they're not interested in the technology of DRM, they're not interested in making proprietary 00:25:13.712-->00:25:18.550 software that hides decryption keys from the users and discards cleartext, what they really want 00:25:18.550-->00:25:24.289 is the law that comes with DRM. So, once you make DRM and put it in a product, once you have a- a 00:25:24.289-->00:25:29.928 means of access control for copyrighted work, you can invoke laws like uh section 1201 of the 00:25:29.928-->00:25:35.401 DMCA in the US, in Europe its implementations of article 6 of the UCV, I could go on, every 00:25:35.401-->00:25:40.506 country in the world except Israel has a law that bans breaking DRM. Uh US trade 00:25:40.506-->00:25:45.511 representative had other priorities in respect to Israel. Um, and these laws, they say 00:25:47.913-->00:25:54.153 that tampering with a copyright lock, disabling that copyright lock, weakening that copyright 00:25:54.153-->00:26:00.692 lock are both criminal and civil acts, in the US it's a $500-->000 fine and a 5 year prison 00:26:00.692-->00:26:05.697 sentence for a first offense for weakening a- a digital lock on a copyrighted work. So, what this 00:26:09.234-->00:26:14.139 law has come to mean is that a corporation can force you to use your property in the way that 00:26:14.139-->00:26:20.712 they want you to on pain of felonization of your activity. If a phone vendor can make more 00:26:20.712-->00:26:24.683 money by making sure you only buy apps from them and not from a third party store and not 00:26:24.683-->00:26:29.388 directly from a software vendor, all they need to do is design their phone so that using anyone 00:26:29.388-->00:26:34.827 else's app store requires bypassing DRM. and now, bypass-uh using another app 00:26:34.827-->00:26:39.832 store is a felony. So, conceptually, there's no principal here, that separates 00:26:42.201-->00:26:47.539 deciding whose apps you can use on a phone that you own from whose bread you can use in a 00:26:47.539-->00:26:53.378 toaster you own. We are one vision system away from toasters that reject unauthorized bread 00:26:53.378-->00:26:57.983 [laughter] right? We are one RFID system away from a dishwasher that rejects 00:26:57.983-->00:27:02.020 unauthorized dishes. You can make every argument that people make for app stores, for 00:27:02.020-->00:27:05.824 toasters, for dishwashers, right? Your toaster could burn your house down if you stuck a 00:27:05.824-->00:27:10.262 bagel in it, that's why we have to make sure that you're only putting in authorized bread. 00:27:10.262-->00:27:14.299 Your dishwasher could kill you with a foodborne illness if we can't fully sterilize your 00:27:14.299-->00:27:19.638 dishes, that's why you can only used authorized dishes. But that's not the way it works in 00:27:19.638-->00:27:23.775 property regimes. In property, if it's your property, you're suppose to be able to decide 00:27:23.775-->00:27:29.214 what you do with it. If having software and DRM in a device means you don't get to decide 00:27:29.214-->00:27:33.352 how you use your property, it stops being your property. You know the definition that every 00:27:33.352-->00:27:38.924 law school teaches about what property is, Blackwell on property, property is that thing 00:27:38.924-->00:27:44.029 of the world in which man possesses sole and despotic dominion to the exclusion of all 00:27:44.029-->00:27:50.135 other men in the universe. Right? You do not have sole and despotic dominion over things uh 00:27:50.135-->00:27:55.340 that you aren't allowed to configure and use in the way that suits you best. Now, a 00:27:55.340-->00:27:59.778 bonus side effect of this from the perspective of the manufacturers, is they get to 00:27:59.778-->00:28:05.817 threaten security researchers just like you. Because if I know about a defect in a DRM system, 00:28:05.817-->00:28:10.923 I know how to start unraveling that DRM system, removing that DRM system and so these 00:28:10.923-->00:28:16.662 researchers have successfully argued that weakening DRM system by publishing security 00:28:16.662-->00:28:23.368 vulnerability reports is also a felony. And at this conference, a security researcher was 00:28:23.368-->00:28:29.775 dragged off stage by the FBI and put in jail for reporting on defects in a DRM system. The 00:28:29.775-->00:28:36.415 chilling effect of DRM is alive and well. Security researchers in 2015 went to US copyright 00:28:36.415-->00:28:41.620 office to report that they are sitting on vulnerabilities, not disclosing vulnerabilities in 00:28:41.620-->00:28:47.225 medical implants, in farming vehicles, in passenger vehicles, in voting machines, and more 00:28:47.225-->00:28:51.063 because they are worried about getting jailed or sued for disclosing defects in DRM and 00:28:51.063-->00:28:55.033 all of these things have DRM in them because it lets the manufacturers constrain how 00:28:55.033-->00:29:00.172 they're used. So, where do we stand on DRM, well code, it's not hard to break DRM, it's a 00:29:00.172-->00:29:05.944 fool's errand to make DRM, how about markets well there's more DRM than ever because it's an 00:29:05.944-->00:29:10.048 attractive nuisance, we've said to companies add DRM, tell your customers how to use your 00:29:10.048-->00:29:15.187 products it's making bank for those companies, GM uses DRM to lock up the telemetry on their 00:29:15.187-->00:29:20.192 cars and charges $75-->000 for a tool to read out the telemetry on your own car. Now this has 00:29:23.228-->00:29:28.767 huge costs for other sectors of the economy, um if you want to start a business to repair 00:29:28.767-->00:29:32.938 electronics or cars or whatever, you can't do that without the sufferance and say so of the 00:29:32.938-->00:29:38.176 original manufacturers, uh those businesses are local by definition, no one sends their 00:29:38.176-->00:29:42.614 car to India or China to get it fixed, they don't even send their phones to China or India 00:29:42.614-->00:29:48.420 to get it fixed and repair jobs are much better than uh breaking up this electronics and 00:29:48.420-->00:29:55.093 recycling it. A ton of e-waste produces 15 jobs if it's recycled, it produces 200 jobs 00:29:55.093-->00:30:00.932 if it's repaired. It's on share and it's local, but the markets are fighting back, uh, uh to 00:30:00.932-->00:30:06.438 make DRM the rule and to stop these local businesses and these local jobs from occurring. But 00:30:06.438-->00:30:12.944 it's markets could be a force for breaking DRM uh, uh a team of researchers at the University 00:30:12.944-->00:30:17.683 of Glasgow, uh published a paper that we um helped them get funding for by writing a letter 00:30:17.683-->00:30:23.555 in support of them uh economists and and other kinds of data scientists where they scraped 00:30:23.555-->00:30:29.327 a-a product category on Amazon, DVD players to look at how um the presence of an illegal 00:30:29.327-->00:30:35.100 circumvention feature affects the price of a DVD player, and what they found is that if you 00:30:35.100-->00:30:40.439 compare a set of DVD players on Amazon of similar vintage with similar numbers of reviews and 00:30:40.439-->00:30:46.011 similar overall ratings, that the ones that have a-a primitive DRM circumvention feature sell 00:30:46.011-->00:30:51.883 at a 50 percent premium, compared to the ones that follow the rules on DVD DRM. Now, the 00:30:51.883-->00:30:58.023 actual margin for a DVD player is in the realm of 2 percent, so you can increase your profits by 00:30:58.023-->00:31:02.961 25 fold just by adding minimal DRM breaking features. So, that's the market story, it 00:31:06.031-->00:31:09.835 could be could if we could convince companies local businesses that they should be 00:31:09.835-->00:31:14.339 bold and think about fighting to break DRM and standing up for the rights of their customers, 00:31:14.339-->00:31:17.976 the rights of their communities, but it's pretty terrible because big companies have figured out 00:31:17.976-->00:31:22.881 they can get a lot bigger if they could use DRM to force you to only conduct your affairs to 00:31:22.881-->00:31:28.353 their benefit. How about norms? Well we are definitely at the peak indifference to DRM. 00:31:28.353-->00:31:33.125 Everyday there's a new horrific DRM story. People wake up and they say, I had no idea that 00:31:33.125-->00:31:38.029 that's what that meant, whether it's HP pushing a fake security update to millions of inkjet 00:31:38.029-->00:31:42.534 owners that uh was posed as a thing to protect your network stack in your printer but was 00:31:42.534-->00:31:47.172 actually a thing that could detect and reject third party ink cartridges, or people 00:31:47.172-->00:31:52.711 finding out that they can't make closed loop insulin pumps because the DRM on one or both 00:31:52.711-->00:31:57.449 parts of it prevents them from bypassing it to link up a glucose monitor and an insulin 00:31:57.449-->00:32:03.155 pump. People are increasingly aware that this is a rip off. People are increasingly aware 00:32:03.155-->00:32:06.691 that telling security researchers that they're not allowed to disclose defects in 00:32:06.691-->00:32:11.830 products that are intimately woven in your life does not make you more secure. How about the 00:32:11.830-->00:32:18.503 law? Well the law is a mixed bag too, a year ago Electronic Frontier Foundation sued the US 00:32:18.503-->00:32:24.142 Government to invalidate section 1201 of the DMCA. We brought our lawsuit on behalf of two people 00:32:24.142-->00:32:28.513 you may have heard of, two of my favorite people in the world, one is Andrew Bunny Huang, you 00:32:28.513-->00:32:35.053 may know him as the Xbox hacker uh [applause] he's a dude, the other one is Matthew Green at 00:32:35.053-->00:32:41.726 Johns Hopkins and um together they represent a set of legal challenges to section 1201 of 00:32:41.726-->00:32:44.763 the DMCA that will comprehensively demolish it if we win our suit. Uh, the 00:32:44.763-->00:32:48.233 government filed a motion to dismiss, the courts have been sitting on the motion, we have 00:32:48.233-->00:32:51.736 reason to believe we will hear from them in the next month or so, there's a thing where judges 00:32:51.736-->00:32:56.675 have to reply within a certain number of months or they get censured by their peers uh and 00:32:56.675-->00:33:01.613 um the period in which that that censure is going to come up is uh ends at the end of August, so 00:33:03.849-->00:33:09.788 we think we'll probably hear pretty soon, we'll have more to say then. Um, there's uh a new 00:33:09.788-->00:33:15.060 uh 1201 study from the library of congress and the copyright office that suggests that the 00:33:15.060-->00:33:20.031 DMCA horrifically overreaches and they've made it really easy for people like you to ask for 00:33:20.031-->00:33:25.437 exceptions to the DMCA to let you do your work. Uh if you look at EFF's website, you can find 00:33:25.437-->00:33:29.774 more information on that. Now, this is the time in the talk where have given you the lay of 00:33:29.774-->00:33:33.511 the land I'm supposed to tell you something very anodyne and generic about what we should do 00:33:33.511-->00:33:38.049 next, like you should donate to EFF, which you should do, you should tell your friends, which 00:33:38.049-->00:33:42.654 you should do, you should write good code, which you should do, and that's all good advice but, 00:33:42.654-->00:33:48.026 this time I have a specific actionable thing that you can do when you get back to work on 00:33:48.026-->00:33:53.164 Monday, that will make a huge difference. So there's an organization that you've all 00:33:53.164-->00:33:57.369 heard of and that you probably feel good about like I do, I think they're an amazing 00:33:57.369-->00:34:02.073 organization called the world wide web consortium. The leading, uh proponent of open 00:34:02.073-->00:34:08.113 standards on the web, the W3C, they're where uh most of the code that we write for the web 00:34:08.113-->00:34:14.853 uh is standardized. And since 2013, the W3C has pursued a-a course that I think was really 00:34:14.853-->00:34:20.458 unwise and whose wiseness becomes more clear with everyday. They decided to allow 00:34:20.458-->00:34:25.864 themselves to be used to make a DRM standard for web video. That means that the entertainment 00:34:25.864-->00:34:30.769 companies and DRM vendors who joined the W3C could work with the browser vendors to form a 00:34:30.769-->00:34:37.275 patent pool that lets them make DRM for all browsers that works relatively seamlessly so that uh 00:34:37.275-->00:34:41.713 there isn't as much market pushback against it without facing any of the uh thorny 00:34:41.713-->00:34:45.417 antitrust scrutiny that they would get if they were just to go do that in a smoke filled 00:34:45.417-->00:34:51.957 room. Now EFF we joined and we tried and failed to convince them not to make DRM. So we 00:34:51.957-->00:34:57.462 offered a huge compromise, I think the biggest compromise in EFF's uh activist history. We 00:34:57.462-->00:35:03.268 said go ahead if you must and make DRM, but don't let your members use the W3C process to 00:35:03.268-->00:35:09.975 seize control over the future of the web, we said take your existing W3C IPR agreement 00:35:09.975-->00:35:14.346 that's the one that says that members can't use their patents to attack people who implement 00:35:14.346-->00:35:19.484 W3C standards and do legitimate things with them and expand it so that members also can't use 00:35:19.484-->00:35:24.489 the rights they get under DRM law to attack people doing legitimate things. Thank you 00:35:27.158-->00:35:32.163 [applause] So, this compromise, it doesn't stop W3C members from suing anyone who commits a 00:35:36.034-->00:35:40.538 copyright infringement, primary, secondary, it doesn't stop them from suing people who infringe 00:35:40.538-->00:35:44.442 their patents or their trademarks or people who steal their trade secrets or people 00:35:44.442-->00:35:50.849 who commit tortious interference with their agreements with their users. All it says is that W3C 00:35:50.849-->00:35:56.054 members can't use DRM as an excuse to threaten and silence security researchers. They can't 00:35:56.054-->00:35:59.991 use DRM to attack people who work to make video more accessible to people with 00:35:59.991-->00:36:04.496 disabilities. They can't use DRM to decide who can enter the market and with which products 00:36:04.496-->00:36:10.301 and services, they can't use DRM to stop legitimate activities like archiving videos. And 00:36:10.301-->00:36:15.373 dozens of members supported this compromise in a vote last March. The royal national institute for 00:36:15.373-->00:36:20.712 blind people, stone- us uh uh Stony Brook University, the German national library, 00:36:20.712-->00:36:25.884 cryptocurrency and blockchain companies, security research firms like Dan Kaminsky's uh 00:36:25.884-->00:36:30.321 white opps, outside organizations like Unesco, the internet archive and the 00:36:30.321-->00:36:34.692 international federation of library associations all came out to support this proposal. 00:36:34.692-->00:36:38.163 Hundreds of human rights groups from around the world, especially the global south 00:36:38.163-->00:36:43.168 supported it, and then this month, the W3C overruled every single one of those objections. 00:36:45.203-->00:36:51.609 So we filed the first ever appeal in W3C history, and we need your help with it. Your 00:36:51.609-->00:36:57.615 employer, they dropped a couple grand to send you here to nerd summer camp, and put you up in a 00:36:57.615-->00:37:03.321 hotel and it's not because they're big hearted slobs, it's because they need you! Security 00:37:03.321-->00:37:08.760 experts are a non fungible highly scarce resource that is essential to the successful 00:37:08.760-->00:37:14.132 operation of every enterprise. In a world with millions of people looking for jobs, you are 00:37:14.132-->00:37:19.571 the people who have jobs looking for you! That's why your email inbox and your Linkedin profile 00:37:19.571-->00:37:25.844 are filled with spammy requests from recruiters, and that gives you power that you can flex and 00:37:25.844-->00:37:30.215 you need to flex it because you are under attack, the digital millennium copyright act, the 00:37:30.215-->00:37:35.019 computer fraud and abuse act and other laws have become the rug that the inconvenient truths 00:37:35.019-->00:37:40.492 that the security research community are swept under. In a world in which security is an 00:37:40.492-->00:37:45.196 afterthought, and billions are at risk, your ability to speak the truth about the dumb 00:37:45.196-->00:37:51.903 mistakes that companies make is under sustained relentless assault. We can't afford a 00:37:51.903-->00:37:57.542 future in which billions of people use a browser with standardized DRM in it that no 00:37:57.542-->00:38:02.380 one is allowed to investigate and report on. So, if you work for google, remember that your 00:38:02.380-->00:38:07.886 company made its profits by integrating units like blogger and youtube and search whose 00:38:07.886-->00:38:14.125 only rule was only reference copyrighted uh only reference copyrighted works in accordance 00:38:14.125-->00:38:19.464 with the law and not only use copyrighted works in ways that no one objects to. You got to do 00:38:19.464-->00:38:24.936 what was legal, not what didn't rock the boat. Go and find your chrome security team and tell 00:38:24.936-->00:38:29.474 them the ability of independent researchers to report on mistakes that put the whole web 00:38:29.474-->00:38:35.079 at risk is under assault remind them that lifeline, your implementation of this DRM, it 00:38:35.079-->00:38:40.251 was broken for 6 years before anyone had the guts to point it out. That person worked at a 00:38:40.251-->00:38:46.024 university in Israel, the only country that doesn't have a law banning disclosures about DRM. 00:38:46.024-->00:38:50.495 If you work for Mozilla, remember that there would be no Mozilla if rights holders had be 00:38:50.495-->00:38:55.700 en successful in their bid to stop mods from shipping a pop up blocker that was on by default. 00:38:55.700-->00:39:01.806 Mozilla only exists because the rule is don't break the law, not don't rock the boat. Go and find 00:39:01.806-->00:39:07.145 your security team on Monday and remind them that they're working at a substantial discount of the 00:39:07.145-->00:39:12.217 market rate of their wage bec- at a non profit because they believe in the open web, and 00:39:12.217-->00:39:17.722 Mozilla can save the open web by voting of the W3C for a rule that says that rights holders 00:39:17.722-->00:39:23.161 can't threaten security researchers. If you work for apple, remember that rip mix 00:39:23.161-->00:39:29.334 burn is the origin story of the iphone and that apple as we know it today depends on the ability 00:39:29.334-->00:39:35.873 to do what's legal and not what doesn't piss off rights holders. Go and find your safari security 00:39:35.873-->00:39:41.145 team, and remind them that spyware companies have used fake updates for apple products to 00:39:41.145-->00:39:46.184 target disadence on behalf of torturing regimes and that we need to be able to disclose 00:39:46.184-->00:39:50.555 security defects in our products so we can catch that kind of shenanigans. Remind them that 00:39:50.555-->00:39:54.692 apple, just like everybody else makes mistakes and that securities a process and not a 00:39:54.692-->00:39:59.764 product and the process requires that anyone be allowed to tell the truth about defects in 00:39:59.764-->00:40:04.702 apple's products. No matter which browser vendor you work for, Microsoft or by due, 00:40:04.702-->00:40:09.407 remember that you will probably work for someone else eventually, and your ability to 00:40:09.407-->00:40:14.045 come up with amazing products that build on the stuff you did in your last job requires that 00:40:14.045-->00:40:18.950 you be allowed to do what's legal, not what your old boss would approve of. You are 00:40:18.950-->00:40:23.221 security researchers, you are the elite and your employers need you. They sent you to 00:40:23.221-->00:40:27.926 DEFCON as a little bonus, like a parent sending a beloved child to summer camp, and I want you 00:40:27.926-->00:40:32.797 to go home from camp with a homemade ear piercing, a comprehensive vocabulary with 00:40:32.797-->00:40:37.335 shocking swear words and a word perfect knowledge of every song the Ramones ever wrote 00:40:41.005-->00:40:46.010 [laughter] [applause]. I don't care how badly entertainment companies want DRM to be a 00:40:48.112-->00:40:54.519 thing, it's still bullsh**t that doesn't make it harmless. DRM for web video will mean that for 00:40:54.519-->00:40:58.623 example, no one can write code to scan ahead looking for strobes that could trigger 00:40:58.623-->00:41:03.194 seizures from people with photosensitive epilepsy, and that is not a theoretical risk. 00:41:03.194-->00:41:06.631 I wish I did have my slides, because I have a picture of my friend Jennifer, she works at my 00:41:06.631-->00:41:10.802 local mailbox, its where I go and pick up my mail everyday and spontaneously she started 00:41:10.802-->00:41:15.073 telling me about how she has photosensitive epilepsy, how she has 3 kids, how she likes to 00:41:15.073-->00:41:20.745 unwind with Netflix and how 2 years ago the worst seizure of her life 5 gran mal consecutive 00:41:20.745-->00:41:25.116 seizures that landed her in hospital were triggered by watching a netflix video with a 00:41:25.116-->00:41:30.421 strobe effect in it. There are not enough human video watching hours remaining in our species 00:41:30.421-->00:41:35.126 to watch every video online and subtitle it add assisted tracks to it shift it's gamma for 00:41:35.126-->00:41:39.597 people with color blindness and find intact the strobe effects, but we can make those things for 00:41:39.597-->00:41:44.435 video with code if we can run the code. If it's not a felony punishable by 5 year prison 00:41:44.435-->00:41:49.207 sentence and a 500, 000 dollar fine, to break the code. If the W3 steps up and tells the 00:41:49.207-->00:41:53.845 entertainment companies that the quid pro quo for getting to use the W3C to make DRM's, they have 00:41:53.845-->00:41:58.850 to promise not to abuse the DMCA. So, your employers need you uh the reason you get to uh 00:42:01.753-->00:42:06.424 one minute, the reason you get to go to work with facial piercings and blue hair and 00:42:06.424-->00:42:10.027 black t-shirts with vaguely menacing slogans on them, and the janitors don't, is not that 00:42:10.027-->00:42:14.098 you're more important than the janitors, the janitors are doing important security work, the 00:42:14.098-->00:42:19.137 reason that you're not dead of listeria is that they do their job. The reason you get to do 00:42:19.137-->00:42:23.641 what you do and the janitors don't is that you have rare skills that your employer 00:42:23.641-->00:42:30.047 depends on. You have market power and with power comes responsibility. Your job is to 00:42:30.047-->00:42:34.886 keep people safe, you signed up to make computers safe for people, not to help the cause of 00:42:34.886-->00:42:39.657 making people subservient to computers. When your boss wants you to make DRM they are asking 00:42:39.657-->00:42:44.462 you to do something that is both delusional and dangerous. It is a catastrophically bad idea to 00:42:44.462-->00:42:48.800 design computers that treat their owners as their adversaries, and thankfully, 00:42:48.800-->00:42:53.137 it's also a catastrophically stupid idea, and that's why your boss is on the wrong side of 00:42:53.137-->00:42:57.341 history. The future won't be full of computers that are almost or incomplete that run 00:42:57.341-->00:43:01.979 all the programs except for the ones that your boss doesn't like even though some quack convinced 00:43:01.979-->00:43:07.385 your boss that DRM is a thing, it's not a thing. I didn't come here today to make you feel 00:43:07.385-->00:43:11.556 sh**y about your job, but if you feel s***y about your job right now, think about what you can do 00:43:11.556-->00:43:15.526 about it. We won't win this fight, cause it's not the kind of fight that you win, it's the 00:43:15.526-->00:43:20.264 kind of fight you fight forever and that's what EFF is going to do, with your help. Thank you 00:43:20.264-->00:43:25.269 [applause]