00:00:00.000-->00:00:05.672 >>Welcome to Def Con! [clears throat] Alright, uh, do you guys believe thes-the hacker's been 00:00:05.672-->00:00:10.677 coming to the city- the desert for 25 times now? Give yourselves a round of applause 00:00:13.547-->00:00:20.120 for coming to the desert. 25 years. [Applause] So, uh, I believe we're making history 00:00:20.120-->00:00:24.925 here, this is the first time sitting congressmen have been to uh, officially, in official 00:00:24.925-->00:00:30.297 capacity speakers at, uh, the largest hacker conference in the world. So that to me, looks like 00:00:30.297-->00:00:36.036 some progress. Uhm, we're going to do some introductions in a minute, uh, first things first, 00:00:36.036-->00:00:42.342 we're going to do a little framing to explain why we were able to get, uh, these two 00:00:42.342-->00:00:47.114 distinguished, uh, public servants to our conference. So, we've been coming here 25 years 00:00:47.114-->00:00:51.351 and we are not necessarily a single tribe. And a lot of the outside world thinks a hacker 00:00:51.351-->00:00:56.623 equals a criminal, and I think over the last few years we've been turning that tide, and now 00:00:56.623-->00:01:01.628 they understand there's a- hacking is just a form of power, it's like magic and we can use 00:01:01.628-->00:01:06.233 it for good, for ill, for any number of purposes, and one of the ways we've been trying to 00:01:06.233-->00:01:12.139 turn that tide is explaining why we do what we do. And we all have different motives, not 00:01:12.139-->00:01:17.911 everyone in here is the same, but you know alliteration works, short lists work, so we have 00:01:17.911-->00:01:23.817 these five P's. We basically say some people are protectors. They want to get stuff fixed, they 00:01:23.817-->00:01:28.855 want to make the world a better place. Some people are puzzlers, that's why most of us got into 00:01:28.855-->00:01:31.825 this in the first place right, we want to tinker, we want to take it apart we want to put it 00:01:31.825-->00:01:38.432 back together. We're curious. Curiosity is our original motivation. Some of us do this 00:01:38.432-->00:01:42.336 cause we want to win the white jacket or we want to be famous. We do it for prestige or for 00:01:42.336-->00:01:48.475 pride. And there's nothing wrong with that. It's allowing us to achieve great things. Some of us 00:01:48.475-->00:01:54.214 do this for profit or personal/professional gain. And we make a career out of it. And 00:01:54.214-->00:01:59.186 Some of us do this for a protest for or against some ideological cause that we care deeply about. 00:01:59.186-->00:02:04.224 Ideally within the bounds of the laws. So whether you're motivated by being a protector, 00:02:04.224-->00:02:09.830 a puzzler, a prestige/profit, or protest. You know we're complicated individuals but 00:02:09.830-->00:02:15.402 there's a reason you got in thins in the first place and there's a reason you stay in it. 00:02:15.402-->00:02:19.740 So for my part, I wanna make the world a safer place. So I'm first and foremost a protector, 00:02:19.740-->00:02:24.711 and like luckily over the last several years we've met several of you that feel the same, but 00:02:24.711-->00:02:29.082 you know I also like hard problems, so I'm a bit of a puzzler as well. And uh, we're 00:02:29.082-->00:02:33.653 gonna ask these congressmen during their intros, why did you get into public service in the 00:02:33.653-->00:02:39.393 first place? What's your motivation? Now, in the spirit of that 4 years ago here at Def 00:02:39.393-->00:02:43.530 Con we launch I am the cavalry. this was this idea that could we be the voice of the reason, an 00:02:43.530-->00:02:49.636 ambassador, a translator, should we bring Def Con to DC? Should we try to be a voice of 00:02:49.636-->00:02:54.041 translating the things we care about, specifically were ever there is issues of public safety 00:02:54.041-->00:02:58.478 and human life. The idea is could we shift from being a pointing finger at pass failure 00:02:58.478-->00:03:04.384 to a helping hand towards future success. Can we stop celebrating failure and what wrong with 00:03:04.384-->00:03:09.423 something and look for what's right with something, uh, and-and through that we focus 00:03:09.423-->00:03:15.195 more on empathy and communication then we did on breaking things. And because of 00:03:15.195-->00:03:21.301 that we've slowly, slowly made ourselves accessible to public policy makers and whether you 00:03:21.301-->00:03:26.473 guys knew this or not over that last 2 years there are 18 parts of the US government who 00:03:26.473-->00:03:33.180 enthusiastically support and encourage the use of coordinated vulnerability disclosure so not 00:03:33.180-->00:03:37.851 only is what you're doing is not criminalized in all cases and were slowly turning the tide on 00:03:37.851-->00:03:42.889 that with things like the Digital Millennium Copyright Act exemptions, but they also see us 00:03:42.889-->00:03:49.129 as a vital resource and a teammate if done right. One of these two gentlemen on stage on 00:03:49.129-->00:03:55.735 the floor of congress said "Go hack the pentagon." So I think we're turning the tide and this 00:03:55.735-->00:03:59.306 is something I think is worth a little bit of cheers for yourselves and for others. 00:04:07.581-->00:04:12.719 [Applause] Now, there's a loong way to go. Uh, last year was pretty hot for first of a kind 00:04:12.719-->00:04:17.491 policy engagement on cyber security issues. Yes, I said cyber but A, I did my friggin 00:04:17.491-->00:04:22.496 shot and B, uh, this is the language they speak on the hill, and if we want to be effective 00:04:24.498-->00:04:28.869 you know, when you're in France you speak french, right so we have to harmonize the way we 00:04:28.869-->00:04:33.273 speak about things, but you know legislative and executive branch alone we saw the food and drug 00:04:33.273-->00:04:38.411 administration really tighten up things like medical advice cyber safety we saw the department of 00:04:38.411-->00:04:43.183 transportation do this, we saw commerce encourage disclosure and patching best practices. 00:04:43.183-->00:04:49.456 DHS, white house and congress themselves also asked, almost presciently, they said "we're 00:04:49.456-->00:04:53.260 concerned about over connectivity and security risks in our health care which is a 00:04:53.260-->00:04:57.464 sixth of our economy." So while we were all talking about information sharing in the CISA 00:04:57.464-->00:05:03.470 Act of 2015 they also asked for one year of congressional task force, and in that they wanted a 00:05:03.470-->00:05:10.377 diverse number of stakeholders to say "How risky is connective medicine?" and on June of this 00:05:10.377-->00:05:14.414 year we published this. They actually made sure they wanted a voice of hackers so I and the 00:05:14.414-->00:05:19.119 cavalry and a lot of the hacker community got to participate in this one year long task force. 00:05:19.119-->00:05:23.056 Now, I'm going to saw some stuff that's a little scary so we can ground this group in why we're 00:05:23.056-->00:05:28.862 having them here today. So, of the many thing we found, the punchline was that healthcare is 00:05:28.862-->00:05:34.100 in critical condition and whether you can read this graphic or not the 5 things on 00:05:34.100-->00:05:39.606 the front page of this report are essentially, about 85% of our US health delivery 00:05:39.606-->00:05:45.912 organization lack a single qualified security person on staff. That should scare 00:05:45.912-->00:05:50.717 everybody. And this is not a US only problem we talked with our international partners. Number 00:05:50.717-->00:05:57.057 2, we tend to be defending legacy XP or older in the leg- in the-in the clinical 00:05:57.057-->00:05:59.960 environment so these things a well past their end of life where they're no longer 00:05:59.960-->00:06:04.364 supported. Number 3, they tend to be over connected to each other and reachable by the 00:06:04.364-->00:06:09.069 outside world..which means that a single flaw in a single device could take out and entire 00:06:09.069-->00:06:13.874 hospital as you saw with Hollywood Presbyterian last February. And more over the 00:06:13.874-->00:06:18.378 average device in a clinical environment has over 1-->000 known vulnerabilities. So put those 00:06:18.378-->00:06:22.949 together, most of our hospitals lack a single one of you, you're defending harder to defend 00:06:22.949-->00:06:27.587 things, they're over connected to each other and reachable by the outside world, a single flaw 00:06:27.587-->00:06:31.625 in a single device took out patient care at Hollywood Presbyterian Hospital, and the 00:06:31.625-->00:06:37.497 average device may give us 1-->000 chances to do it. We've done amazing things over the last 25 00:06:37.497-->00:06:43.503 years but we need more of you. To help us solve these wicked problems and if there wasn't a 00:06:43.503-->00:06:48.742 sense of urgency as we were publishing this report back to congress, WannaCry took out 65 00:06:48.742-->00:06:53.747 hospitals in a single day. That was 20% of their national capacity. You now people died 00:06:56.449-->00:07:02.455 from degraded and delayed patient care. So, I wanna call out to the best of you, as we 00:07:02.455-->00:07:07.994 reach out to the best of them, and in the spirit of that I think we've proven the model to 00:07:07.994-->00:07:13.500 work over the last 4 years, bringing Def Con to D.C. In fact some of us have actually quit 00:07:13.500-->00:07:17.937 our day jobs and moved into think tanks like the Atlantic Counsel and what not. And now 00:07:17.937-->00:07:22.742 we've brought part of D.C here to Def Con in a way that hasn't been done before and I am 00:07:22.742-->00:07:29.616 honored and humbled that we have two sitting members of our democratic process here. So 00:07:29.616-->00:07:34.621 please, I'll introduce them in a moment, but let's give it a huge round of applause for these two 00:07:44.831-->00:07:49.936 pioneers. [Applause] All right, we're going to try and keep an eye on the hashtag if you wanna 00:07:49.936-->00:07:55.008 send me your poll answers and what not, uh, Def Con- uh DC2 Def Con, uh, first 00:07:55.008-->00:08:01.614 representative James Langevin, he will give his own intro, but I was uh, really excited to work 00:08:01.614-->00:08:07.220 with him as the chair and founder- co-chair of the cyber caucus in the house of 00:08:07.220-->00:08:12.225 representatives. And also representative Hurd of Texas who uh, also a very strong and 00:08:14.728-->00:08:19.599 leading and informed voice on cyber security issues and Ill you them tell you their origin 00:08:19.599-->00:08:24.404 stories but please gentlemen weave in which of the motivations do you carry to 00:08:24.404-->00:08:30.744 public service? So, you first representative Langevin. >>Alright, well thank you very 00:08:30.744-->00:08:35.749 much Josh, for the introduction, for the invitation to join you today and uh, and uh, I wanna 00:08:38.084-->00:08:44.090 thank both you and Def Con and let me also recognise BOW and uh, the Atlantic Counsel for 00:08:44.090-->00:08:49.095 everything you did to make our visit here possible and uh, let me just say to the security 00:08:51.297-->00:08:57.137 researchers community, thank you all for what you do and uh, I know that collaboratively 00:08:57.137-->00:09:02.008 together we're going to make a difference in this field and we're going to make the uh, the 00:09:02.008-->00:09:08.448 internet much more secure than it is today and we're gonna do it together. So I thank you for 00:09:08.448-->00:09:15.288 that I know it's a challenging, uh, environment, for sure, dynamic one but I find it an 00:09:15.288-->00:09:20.293 amazing topic to work on. I am thrilled to be here with my colleague, Will Hurd, uh, Will 00:09:22.328-->00:09:27.333 and served on the Homeland Security committee together, and uh, let it be recognized here 00:09:29.702-->00:09:34.707 that I can tell you my partisanship is not dead on the hill there are pockets that 00:09:34.707-->00:09:41.281 still exist and guys like will and I hopefully are helping set an example and helping to raise 00:09:41.281-->00:09:47.387 the bar to show that by working together that's how we truly get things done. So, great to be 00:09:47.387-->00:09:52.392 here with my colleague..So [Light Applause] >>Clap, You can clap for that [Applause] >>So, 00:09:56.129-->00:10:01.634 just to brief you a little about myself, uhm, So I am a congressman from the 2nd 00:10:01.634-->00:10:08.074 district of Rhode Island. I'm in my 9th term in congress and I sit on both the uh the senior 00:10:08.074-->00:10:12.112 memb- the House Armed Services Committee and a founding member and senior member of the 00:10:12.112-->00:10:17.584 Homeland Security Committee. Uh, in all of that work, I specialize in-in cyber security 00:10:17.584-->00:10:22.555 and uh, the ranking member on the emerging threats and capabilities subcommittee on 00:10:22.555-->00:10:28.194 armed services. We have primary jurisdiction over NSA and US cyber command and uh, the 00:10:28.194-->00:10:33.299 Homeland Security Committee, I sit on the subcommand in cyber security and infrastructure 00:10:33.299-->00:10:37.871 protection. But I have to tell you, I kind of fell into this-this world of being 00:10:37.871-->00:10:44.544 involved in cyber security uh, about of a decade ago, when I was the chairman of the 00:10:44.544-->00:10:50.350 subcommittee on emerging threats, cybersecurity and science and technology and 00:10:50.350-->00:10:55.955 originally I thought we were going to be focusing mainly on the emerging threats part of the 00:10:55.955-->00:11:01.394 responsibility which was to look at all the, uh, the most serious threats to the face of the 00:11:01.394-->00:11:05.765 country such as chemical, biological, radiological, and nuclear threats to a, to 00:11:05.765-->00:11:10.770 America, and our allies. And then uh, one day my staff director uh came into me on the 00:11:13.339-->00:11:19.646 sub committee and said uh boss you're gonna get a briefing on this thing called the Aurora 00:11:19.646-->00:11:24.617 threat, uh, by two, found, discovered by two uh, researchers at Idaho National 00:11:24.617-->00:11:30.156 Labs where they found a vulnerability into a-into a critical infrastructure through 00:11:30.156-->00:11:35.161 a a-a skater attack, and hence everyone knows that as the Aurora threat but uh, I was 00:11:38.097-->00:11:43.636 riveted by the video that showed how a generator operating normally all of a sudden because 00:11:43.636-->00:11:50.543 of a a-a malicious code that was remotely inserted caused this generator to spin up out of 00:11:50.543-->00:11:55.548 control and then basically shake itself apart and uh, and that was just a small example of what 00:11:58.084-->00:12:03.022 could happen to, uhm, to our electric grid if in potentially shutting down a whole portion of 00:12:05.458-->00:12:10.463 our country's electric grid if a successful widespread skater attack were to be carried out. 00:12:13.199-->00:12:18.204 So that is how my interest in cyber began. And just to close out, from there we were asked 00:12:22.475-->00:12:27.780 Mike McCaul and I, uh, my co founder and co chair of the cybersecurity caucus, Mike now 00:12:27.780-->00:12:31.784 chairs the full Homeland Security Committee, but he's been a great, again bipartisan 00:12:31.784-->00:12:36.489 partner in this-in this effort to enhance our nation's cybersecurity uh, he and I were 00:12:36.489-->00:12:42.195 asked to chair b-be co-chairs of a national commission the CSIS commission, on cybersecurity for 00:12:42.195-->00:12:47.500 the 44th presidency, which became the foundational document for president Obama as he 00:12:47.500-->00:12:53.539 charted the nation's cybersecurity uh, blueprint and plan going forward, and uhm, and 00:12:53.539-->00:12:59.846 then we also you know, founded the a- co-founded the cybersecurity caucus. And, when 00:12:59.846-->00:13:04.017 we originally started in this field i have to tell you we got a lot of funny looks Mike and I 00:13:04.017-->00:13:09.022 we felt like we had a lone voice in the wilderness and uh, people did not understand the-the what 00:13:11.457-->00:13:16.462 we were so worked up about. They get it now. Times have certainly changed uhm, but we still have a 00:13:19.966-->00:13:24.904 lot of work to do. Clearly the awareness has been raised but now we've got to continue to 00:13:24.904-->00:13:29.876 work together to close the vulnerabilities. So, that is a, just briefly, probably went on 00:13:29.876-->00:13:35.748 too long, sorry, but uhm, that's-that's my introduction to the cybersecurity challenges 00:13:35.748-->00:13:40.753 that the nation faces and uh, and uh, it's a continued work in progress but i have a, been 00:13:43.690-->00:13:48.695 really gratified to know there are people like you in the security research community who 00:13:51.230-->00:13:55.668 are doing important work discovering vulnerabilities and I'm hoping that we continue for 00:13:55.668-->00:14:00.873 stronger partnerships uh to help do something about it when we find those vulnerabilities and 00:14:00.873-->00:14:04.677 uh as I said I know that we're going to be able to do this together, Will's been a great 00:14:04.677-->00:14:08.848 partner, in this a- in this effort, and I'm pleased again to share the stage with him but I 00:14:08.848-->00:14:13.853 want to thank you for your invitation and it's an honor to be with you today. Thankyou. 00:14:21.060-->00:14:26.065 [Applause] >>Which P are you Jim? Put the list back up. >> Yeah I'm the one that fixes 00:14:31.637-->00:14:36.642 thing. >>It's definitely not prestige right [Laughter] Ah, yeah that's when you have a 9 00:14:39.579-->00:14:46.152 percent job approval rating, uhm, that's not prestige.[Crowd Laughing] uhm, anyways, not us 00:14:46.152-->00:14:52.925 individually back home obviously, right, but as a body, as a body. Am I too far away 00:14:52.925-->00:14:57.930 from this? How do we get that echo out? Anyone? >>[From crowd] Pull it back >>Pull it back? 00:15:00.399-->00:15:05.404 This way? Uhm, well, again, thanks for having us here, this is my second time to-to to Def 00:15:10.676-->00:15:15.681 Con and I always take a lot away from the interactions that we have especially on the sidelines 00:15:18.785-->00:15:25.091 of many of these events. And I appreciate the Atlantic Counsel for making this happen and 00:15:25.091-->00:15:32.064 getting us out here to Las Vegas. Uhm, let me see a show of hands, How many- if this is your 00:15:32.064-->00:15:37.069 first Def Con? Okay, wow, a lot of noobs a lot a [light claps] Yeah, give it up for the 00:15:41.974-->00:15:46.979 noobies! [Applause] How manys been here over 5 years? Okay, over 10? We got any of the 00:15:50.183-->00:15:55.188 originals? No, No originals? What, DT ain't here? DT didn't want to come uh, here or talk? 00:15:57.557-->00:16:02.161 >>They're all on duty [Laughter] >>Yeah, uh, you just came here cause you drank too much last 00:16:02.161-->00:16:07.400 night and need somewhere c-cold to hangout? Anyone? Okay, I appreciate that, I appreciate 00:16:07.400-->00:16:13.439 the honesty. Uhm, So, I'm from San Antonio born and raised and [light cheers from crowd] A lot 00:16:13.439-->00:16:19.679 of San Antonians there you go. Uhm, and my, when I was in highschool I had the opportunity 00:16:19.679-->00:16:25.084 to take a internship at the southwest research institute and I had a female engineer[cheer 00:16:25.084-->00:16:31.390 from crowd] that exposed me, yeah? Female engineers? Give it up. [Applause] Exposed me to 00:16:31.390-->00:16:37.697 robotics and is the reason that I first got interested in computer science and I studied 00:16:37.697-->00:16:43.135 it at Texas A&M and [cheers from crowd] Yeah whoop gigamaggies! It's our year, it's our year. 00:16:43.135-->00:16:48.140 Uh, watch out Alabama [Crowd Laughing] Uhm, and so also if you need a turbo pascal or 00:16:51.210-->00:16:56.215 fortran programmer let me know [Crowd Laughing] Uhm, I sorta know a few things. And I had the 00:16:58.584-->00:17:03.522 opportunity, when I graduated, I went into the C.I.A. Uhm, I was a case officer. I did 2 years in 00:17:06.325-->00:17:11.197 Washington D.C at what I used to call the super secret C.I.A training facility called "The 00:17:11.197-->00:17:17.069 Farm". Uh, now it's on google maps and, uh [Crowd laughter], uh, two years Indian, two years 00:17:17.069-->00:17:22.041 in Pakistan, two years in New York City, a year in a half in Afghanistan where I managed all 00:17:22.041-->00:17:25.978 of our undercover operations. So I was the dude in the back allies at 4 o'clock in the 00:17:25.978-->00:17:31.651 morning collecting, uhm, intelligence on threats to our home land and I also had a brief 00:17:31.651-->00:17:38.357 members of congress. Had I met a guy like Jim, I probably would have stayed in the C.I.A. Uhm, I 00:17:38.357-->00:17:43.362 unfortunately had not been exposed to Jim and Mike McCaul and Ted Lieu from California, 00:17:46.098-->00:17:52.571 uh, folks that really understand the issues that they're talking about and so I was frustrated 00:17:52.571-->00:17:58.744 with the caliber of our elected officials and so I ran for congress in 2010 and I lost. 00:17:58.744-->00:18:03.549 [cheers and laughter] uhm, why does that always get a jok- get a laugh? I-I-I still don't 00:18:03.549-->00:18:10.256 understand that. Uhm, and-and I lost a round off by 700 votes. And that's not a lot of votes 00:18:10.256-->00:18:14.060 and it's even worse after you've been to the grocery store for the 2 months afterwards and 00:18:14.060-->00:18:17.997 people came up to you and say "How's the campaign?" and [crowd laughter] uhm, like I lost and 00:18:17.997-->00:18:22.001 they're like oh, shucks we forgot to-to vote, yah know?[crowd laughter] I 00:18:22.001-->00:18:27.707 literally ran into 740 people uh, [Crowd laughter] like that. Uhm, but it gave me an 00:18:27.707-->00:18:33.713 opportunity to-to work for a company called Crumpton Group, uh, Boutique Consulting Firm, 00:18:33.713-->00:18:38.718 and I helped Matt Debow with and build Fusion X and so if you don't like anything that I do, 00:18:42.154-->00:18:47.059 see Matt Debow, uhm, he- everything I've learned in this-about this industry i've 00:18:47.059-->00:18:52.365 learned from-i've learned from Debow. And he's a he's-he's-he's been a good friend and so 00:18:52.365-->00:18:56.102 understanding penetration testing, technical vulnerability assessment, things like that, 00:18:56.102-->00:19:02.208 understanding the talent that's outside of the government, uhm, understanding the threat that 00:19:02.208-->00:19:08.481 individuals in companies are-are faced, it was a great experience and to be able to leverage that 00:19:08.481-->00:19:14.053 when I got in congress. And So, in 14' I ran again uh, no- everybody thought I was crazy, 00:19:14.053-->00:19:18.391 uh, nobody thought the black dude would win in a hispanic district alright, I represent a 00:19:18.391-->00:19:23.396 71 percent hispanic district and it's been an opportunity to work on issues like cybersecurity. 00:19:25.765-->00:19:30.569 And that means in Washington D.C that actually means information sharing, uhm, we should have 00:19:30.569-->00:19:36.342 passed a cybersecurity act of 2015, 10 years ago? But we finally-we finally got something 00:19:36.342-->00:19:41.347 done. Uh, we look-we focus on privacy and you I said yesterday i don't know which crypto war 00:19:43.816-->00:19:48.821 we're on right now uhm, but we should be strengthening encryption not weakening it. 00:19:52.091-->00:19:57.096 Uhm, [Crowd cheers and applause] Our civil liberties are not burdens, they are the things 00:20:01.067-->00:20:06.072 that make our country great. And we, [crowd applause] we-we can chase bad guys, we can defend 00:20:10.242-->00:20:13.913 our digital infrastructure, and we can protect our civil liberties all at the same time. 00:20:13.913-->00:20:19.085 It's hard. And one of the things that I have to- that Jim and I have to do when we educate our 00:20:19.085-->00:20:24.957 colleagues is to let them know that uhm, guess that there is really no such thing as an 00:20:24.957-->00:20:30.996 impenetrable device yah know? Come out to Def Con if you don't believe us [light laughter] 00:20:30.996-->00:20:37.937 and-and so we have to get to a point where we can do security and protect privacy at the same 00:20:37.937-->00:20:42.975 time. And this conversations will go back and forth right, this is-ther-this is always the 00:20:42.975-->00:20:47.613 topic of back doors and encryption is always going to be out there and you're going to 00:20:47.613-->00:20:53.586 have to continue to-to-to fight those-fight that back and having the support of folks like ya'll 00:20:53.586-->00:20:58.591 is-is really important to do that and I will say everybody knows now what OPM stands for. 00:21:00.559-->00:21:07.466 >>Oh, yeah [crowd laughter] >>right, uh, as-as Lindsay Graham says, mucho bad [light 00:21:07.466-->00:21:12.471 laughter] ya know, uhm, it's-it's, that brought a consciousness to this issue that 00:21:16.342-->00:21:21.280 everybody understands the importance of protecting our digital infrastructure and our 00:21:21.280-->00:21:27.820 colleagues understand that but they don't alway necessarily understand the nuance and that's 00:21:27.820-->00:21:33.559 why we try to educate, that's why having ya'll is important ya know, many of our colleagues 00:21:33.559-->00:21:40.099 uhm, think that direct messaging on twitter is the dark web, ya know, uhm, [crowd laughter] it's 00:21:40.099-->00:21:45.437 like well no, it's a little more complicated than that uhm, but there's-there is a-there's an 00:21:45.437-->00:21:50.442 interest in understanding that topic and so i always get nervous when someone says oh, 00:21:52.745-->00:21:58.150 I'm an expert on anything let alone cybersecurity especially being in a room with folks like 00:21:58.150-->00:22:03.088 ya'll but coming out here helps ya know, prevent our knowledge base from getting stale so I 00:22:05.691-->00:22:11.964 appreciate, yall have been, everybody has been super nice to both of us uh, I think everybody 00:22:11.964-->00:22:16.402 was a little worried that we might have gotten attacked or something when we got here, uhm, 00:22:16.402-->00:22:22.007 but it really is-it really- ya'll ya'l have opened- have welcomed us with open arms and 00:22:22.007-->00:22:27.846 your willingness to help us understand the big issues and the small issues and I'm looking 00:22:27.846-->00:22:32.551 forward to talking about some of those big strategy things that we have to get right before 00:22:32.551-->00:22:37.556 we're able to do some of the-some of the small things, so, Thank you all. [Crowd 00:22:42.294-->00:22:48.000 applause] >>Alright, your friendly reminder. I put out a twitter poll it's got probably 00:22:48.000-->00:22:53.606 20 minutes left, maybe 10, uh, on which topics I should prioritize amongst Mirai 00:22:53.606-->00:22:59.912 botnets, WannaCry hitting hospitals, power impacts, or Wassenaar export controls that 00:22:59.912-->00:23:04.350 may affect our ability to do our jobs, uh, internationally. So please vote, I'm gonna keep an 00:23:04.350-->00:23:10.556 eye on it for one of our last questions. So, uh, yesterday we had a pretty full line up. These 00:23:10.556-->00:23:15.527 guys are-are-are a very robust in their ability to take in information we-we had a lot of 00:23:15.527-->00:23:21.800 briefings yesterday, we took them on a walking tour of many of the villages downstairs we 00:23:21.800-->00:23:28.340 saw what, hack- auto hacking village, lock pick village, IOT, Industrial Control, the voting 00:23:28.340-->00:23:34.079 machine hacking. >>Roots. >>The Kids Roots Hackers >>Yeah >> So, uhm, you know, I know you're 00:23:34.079-->00:23:38.050 both pretty savvy on cybersecurity but what was a, what really stood out, what was 00:23:38.050-->00:23:42.488 your biggest surprise, and what kinda things might you be able to act upon when you get back to 00:23:42.488-->00:23:47.493 D.C if you wanna continue this cooperation? >>Uhm, what was I- the things that I was surprised 00:23:50.396-->00:23:55.401 by is the voting machines and the fact that all 24 got dismantled in less than 6 hours. 00:24:00.572-->00:24:05.577 That is- That is a huge problem. We have to ensure that the American people can trust their 00:24:10.316-->00:24:16.322 vote tabulating process. And now, the machine is just one step in that process, but I 00:24:16.322-->00:24:21.527 think that the work that has been done out here is important in educating the secretaries of 00:24:21.527-->00:24:26.832 state, uhm, all across the country as well as the election administrators, the people who 00:24:26.832-->00:24:33.605 are tasked with doing this and a lot of times ya know, I have a county that's the second least 00:24:33.605-->00:24:40.012 populated county in the United States of America. 95 people in the entire county. I've met 72 00:24:40.012-->00:24:45.017 of them. Uhm, and-and they don't have a cybersecurity professional to help them, ya 00:24:49.221-->00:24:56.028 know, manage that process and so figuring out how, uhm, the states and these election 00:24:56.028-->00:24:59.932 commissioners-uh, election administrators are-are-understand the risk and 00:24:59.932-->00:25:04.603 vulnerabilities is important. So that was important. Uhm, things that we can take away, I'm 00:25:04.603-->00:25:11.377 interested in doing a hearing on uhm, the 5 points. Uhm, the 5 points when it comes to-when it 00:25:11.377-->00:25:16.382 comes to connected cars uhm, it is it is an area that I think we have to have a little more 00:25:21.053-->00:25:25.724 conversation around because I want to ensure that we don't create an overly burdensome 00:25:25.724-->00:25:32.531 regulatory environment around some of these issues and I think connected cars is the subsection 00:25:32.531-->00:25:37.536 of IOT that most members can get their heads around uh, but it's such a-a-a broader conversation 00:25:40.205-->00:25:44.810 and how do we prevent, I don't want the government to get in the way. I want the government 00:25:44.810-->00:25:50.949 to be able to facilitate and to allow entrepreneurship to grow but we all know we have to 00:25:50.949-->00:25:56.822 vancane security. Lets not make the same mistakes that we've made in the creation of the 00:25:56.822-->00:26:02.294 internet, let's not make those same mistakes when it comes to-when it comes to IOT. Uhm, 00:26:02.294-->00:26:07.299 and those are-and look-learning about TLS 1.3 and ya'lls opinion on that, and ya'lls opinion on 00:26:11.537-->00:26:17.276 what is the future of Quantum Computing and the ya know how quickly is that going to get 00:26:17.276-->00:26:24.283 here on some kind of commercial scale and how do you defend against quantum computing. 00:26:24.283-->00:26:29.288 These-these conversations are going to lead, uhm, me to hold hearings on many of these topics 00:26:31.857-->00:26:38.263 through the subcommittee that I chair. >>Excellent, Thankyou. >>So the thing that surprised me 00:26:38.263-->00:26:43.268 the most, uhm, so uhm, when I -well ya know many of you have seen me riding around, and I use 00:26:46.238-->00:26:51.577 an Ibot wheelchair to get around and I can pop it up on two wheels, same inventor as the 00:26:51.577-->00:26:56.448 segway scooter, Dean Cabin, brilliant uh, inventor, uh, The thing that surprised me the most 00:26:56.448-->00:27:00.118 is that when I went into the car hacking room, that someone didn't find a way to hack into 00:27:00.118-->00:27:05.824 my system and start driving me around [crowd laughter] I did wonder if it was going to happen 00:27:05.824-->00:27:11.363 and it actually it's a sophisticated piece of technology and I uh don't 00:27:11.363-->00:27:15.467 pretend to understand all the magic but I do know it has 6 gyroscopes that keep it balanced 00:27:15.467-->00:27:20.973 and uh, I did put it down on four wheels just in case [laughter] so but a- >> He's 00:27:20.973-->00:27:25.978 here for 4 more hours by the way. [crowd laughter] >>So, uhm, so that was the thing that 00:27:28.380-->00:27:33.719 surprised me the most that didn't happen but uh, thats a good thing. Uhm, but a, I have 00:27:33.719-->00:27:38.724 to say that, I too was a-a-a-a surprised, and though not shocked by the election voting 00:27:46.031-->00:27:51.036 systems and apparently how easily those systems could be compromised and hacked uh, I-I 00:27:53.138-->00:27:58.210 knew that they were- that the electronic voting systems are uh, potentially vulnerable and 00:27:58.210-->00:28:04.383 I've heard the reports, how easy it was though was-was an eye opener. So I was a former 00:28:04.383-->00:28:09.021 secretary of state as well and before that I served for 6 years in Rhode Island general assembly 00:28:09.021-->00:28:13.725 as well as a state rep and I actually chaired a special legislated commission on 00:28:13.725-->00:28:19.197 purchasing new voting equipment. And the one thing, all though I love technology, and I was 00:28:19.197-->00:28:26.171 impressed by the DRE equipment the touch screen back then at the time. I could never get 00:28:26.171-->00:28:31.543 passed the fear or the concern that ya know, what happened if everything went south and the 00:28:31.543-->00:28:36.548 data was lost. How do you ever recreate that election? Or prove t-t-to verify how people voted 00:28:39.017-->00:28:44.022 is actually how th-th-the vote turned out. An duh, so we consequently wound up 00:28:47.192-->00:28:53.699 recommending to this- to the legislature to the governor at the time, that when we choose 00:28:53.699-->00:28:58.637 the voting equipment that it should be optical scan so you can have The best of the old in 00:28:58.637-->00:29:05.477 the new technology but you have to have the paper ballot as the ultimate audit trail. Uhm, so 00:29:05.477-->00:29:11.950 that's what we wound up doing and I was able to uhm, to get new optical scan voting 00:29:11.950-->00:29:16.355 equipment for the state when I became secretary of state. But to see- go in the room and talk 00:29:16.355-->00:29:22.527 to the professors and the-the researchers who set up the room and who set up the a the 00:29:22.527-->00:29:28.567 challenge and to hear how easily the systems were compromised was-was certainly disturbing and 00:29:28.567-->00:29:34.606 an eye opened and certainly gives me plause as we go back to D.C now and a- and and I'm part 00:29:34.606-->00:29:39.878 of a task force to look at a-at elections and this is certainly going to be a primary topic of 00:29:39.878-->00:29:46.118 conversation. The other thing I'll just say and finally . the one thing that really impressed 00:29:46.118-->00:29:51.123 me, is how the uh, the hacker community wants to be pro active yet both identify and closing 00:29:56.461-->00:30:01.466 vulnerabilities in our cyber ecosystem. So i look forward to those-growing those 00:30:03.935-->00:30:10.876 opportunities and-and making sure that we have a way to have a vulnerability disclosure 00:30:10.876-->00:30:16.014 process at each of the government agencies I think that's somet-it's long overdue 00:30:16.014-->00:30:21.019 and that's something that I hope to work with you all on. >>On the-[crowd applause] On that 00:30:26.091-->00:30:30.429 last point, Jim ,and I want to add I-I-I told this story yesterday, some reporter asked 00:30:30.429-->00:30:36.735 me "you know,are you out here to get these hacker civically engaged?" And I was like what 00:30:36.735-->00:30:41.940 are you talking about? They already are. Right and-and the feedback and what you all do for 00:30:41.940-->00:30:46.945 society is incredibly important and we gotta make sure we can continue to build upon-upo that 00:30:50.015-->00:30:55.020 relationship, so, and I think we want to try to come back as often as we can and we'd like to 00:31:00.192-->00:31:05.197 see ya'll up in D.C as well. [crowd applause] >>So I knew, yesterday, we had them, uhm, in 00:31:07.733-->00:31:13.071 a small room for 2 hours of completely unvetted questions and exchanges. It was amazing, 00:31:13.071-->00:31:18.076 it was magical, I wish we had 2 hours now uh, we're at about the T-minus 15 minutes mark. Uhm, 00:31:20.712-->00:31:26.118 really quickly, what's an example-we want examples of uh positive and negative or 00:31:26.118-->00:31:31.523 effective proactive or reactive forms of engagement for the hacker community. And uhm, I-I 00:31:31.523-->00:31:37.529 remember over lunch you were talking about a good example of the risk of wassenaar. Can you 00:31:37.529-->00:31:42.534 quickly explain an example how hackers helped you do your job and preserve US interest? 00:31:44.903-->00:31:50.542 >>Sure, So, this is something that I-I tackled pretty aggressively with my team once 00:31:50.542-->00:31:57.182 we became aware of the problem and again it was the a the research community the tech 00:31:57.182-->00:32:02.120 community that came to me and-and-and made us aware of what was ya know, I'm sure done 00:32:05.157-->00:32:10.162 with good intentions, missed the mark uh, Walsh and I are trying to use a cold war legacy 00:32:12.497-->00:32:17.502 agreement to prevent uh, dual use technologies from falling into the-into the wrong hands 00:32:20.305-->00:32:25.310 when you try to uhh, apply that to software and to uh- prevention of uh, transfer 00:32:30.015-->00:32:35.020 intrusion control software, but it missed the mark. It didn't work and here you had the a 00:32:37.589-->00:32:42.861 department of commerce that was charged with promulgating the rules and regulations on how 00:32:42.861-->00:32:47.766 this was going to work uh, during the common period, but the researched community really 00:32:47.766-->00:32:53.305 stepped up, the tech community really stepped up, and made robust comments and I can tell 00:32:53.305-->00:32:58.310 you I took those comments and these challenges and stuff that you brought to me and with 124 00:33:02.547-->00:33:07.552 of my colleagues was able to organize a letter again to the Obama administration to really 00:33:13.758-->00:33:18.763 ask them to change course on the addition of these controls that a- and now we're making sole 00:33:21.199-->00:33:26.338 progress on getting those controls clarified. But it wouldn't have happened without 00:33:26.338-->00:33:31.343 the engagement of the of the-a of the technology community and i just wanna underscore, uh, 00:33:34.346-->00:33:40.719 never underestimate the value that you bring to the table in advising policy makers about 00:33:40.719-->00:33:45.190 what's going to work and what's not going to work or what we need to do to change course 00:33:45.190-->00:33:51.930 to-to-to close vulnerabilities. There are 435 members of congress. The House. 100 members 00:33:51.930-->00:33:57.035 of the United States senate. We all have varied interests we all have things we per say 00:33:57.035-->00:34:01.973 specialize in. And you have a small group of us, uh, myself, and Will, Mike McCaul, uhm, 00:34:04.943-->00:34:09.948 Dutch Ruppersberger, uhm, you have Mac Thornberry, and uh, a couple others here that really 00:34:13.285-->00:34:19.391 get cyber and and we've made it primary focus of what we do. And then you've got the next level 00:34:19.391-->00:34:24.396 down of members who recognise it's important but it's not maybe persay their thing but 00:34:26.531-->00:34:30.702 they want to know more about it and they wanna be up to speed on it. And they got a few- they 00:34:30.702-->00:34:35.073 have a significant number that it's not their thing- maybe it's never going to be their thing, 00:34:35.073-->00:34:41.846 but they still need good advice and people coming forward to advise them and their staff. So 00:34:41.846-->00:34:48.286 I just wanted to close by saying never underestimate the value you can bring to the table, in 00:34:48.286-->00:34:52.724 helping to educate members and staff about what the best policies are and what's going to 00:34:52.724-->00:34:58.863 work and what's not going to work and again, never assume that we're-that we know all the 00:34:58.863-->00:35:03.868 thousands of bills that are introduced in congress each year it's not possible. So if you 00:35:03.868-->00:35:08.840 hear something or you become aware of a bill or idea that you think we need to know about, be 00:35:08.840-->00:35:13.845 proactive about it. And Engage. And I just- in closing I just ask you just rhetorically, you 00:35:17.215-->00:35:22.287 know, how many of you have ever made an appointment with your member of congress or their 00:35:22.287-->00:35:29.227 staff, or written an email, or made a phone call? Ya know, I would just ask you to be 00:35:29.227-->00:35:34.232 proactive because you can make an impact and we want you to be engaged. Thank you. [Crowd 00:35:41.306-->00:35:47.145 applause] >>An important point in that story as well is the process around this worked. The 00:35:47.145-->00:35:54.052 feedback that commerce was getting instigated some congressional hearings and one 00:35:54.052-->00:35:59.057 of your own, ended up going into the negotiating room in-in Europe to-to try to fix this 00:36:02.494-->00:36:09.100 multilateral agreement. And so I think this is a-a-a great example of how the right 00:36:09.100-->00:36:15.206 engagement of really smart people fix a problem. Now, we're not completely there yet, 00:36:15.206-->00:36:20.345 because we haven't signed the new agreement, but I think we're going to try and sort that out 00:36:20.345-->00:36:26.951 in-in December so it's an example of how the wheels of the process worked. >>Yeah, and 00:36:26.951-->00:36:31.056 Let's hear it for Katie Missouri because she was the one the really help- [applause and 00:36:31.056-->00:36:36.061 cheering from crowd] >>Thanks Katie, Yeah >>Thank you Katie. >>Katie Mo! >>So- So Katie, I 00:36:38.296-->00:36:43.668 want a picture when you walk in with all these stuffy diplomats and your pink hair. Yah know, 00:36:43.668-->00:36:48.673 and-and make sure you get that picture next time. [faint laughing] >>Alright, now that 00:36:51.009-->00:36:55.113 wasn't a- yah know Karen Ellis already says that hackers are the immune system of the 00:36:55.113-->00:37:00.885 internet right, we're the a- so we flock to the dangerous threat to the way we do our jobs and 00:37:00.885-->00:37:06.324 security in this particular case but in some of these we want to get in front of them uh, so our 00:37:06.324-->00:37:11.296 part we- it looks like the Twitter poll was a pretty tight race here, uhm, the winner was 00:37:11.296-->00:37:17.569 concerns of our a power utilities infrastructures so in the US and other countries these 00:37:17.569-->00:37:21.306 are designated critical infrastructure that are very, very important but are often 00:37:21.306-->00:37:27.545 privately owned and operated and often quite exposed. Uhm, it's a pretty close vote with also 00:37:27.545-->00:37:32.584 Marai's effect on taking out the internet for a day. These low cost, low hygiene devices, 00:37:32.584-->00:37:37.422 there's so many of them now with the internet of everything. Uhm, and then also the WannaCry type 00:37:37.422-->00:37:43.161 hospital outages where it's just too easy for these things. We tend to summarize these things 00:37:43.161-->00:37:48.566 at the Atlantic Counsel that our over dependence on undependable things is exposing us to 00:37:48.566-->00:37:53.238 accidents and adversaries. Uh, that could be a National security level event. Uh, 00:37:53.238-->00:37:58.610 instead of us flocking to maybe go, you know, stop bad wassenaar, what are the 00:37:58.610-->00:38:04.182 appropriate mechanisms or most effective mechanisms for us to proactively engage with members, 00:38:04.182-->00:38:08.520 with their staffs, with committees? It's a bit of a confusing and nebulous thing for 00:38:08.520-->00:38:13.291 us if you could give us some succinct advice of where to get started or whats worked to date 00:38:13.291-->00:38:19.097 for us bringing topics so we don't wait for hospital outages? >>Sure, I would go back to what 00:38:19.097-->00:38:24.102 I touched on just a few minutes ago. Don't wait til something comes to your attention to start 00:38:29.140-->00:38:33.378 engaging with your members of congress and staff. Introduce yourselves ahead of time, get to 00:38:33.378-->00:38:38.383 know them, let them get to know you . And develop a rapport. Develop a-open up a dialogue so 00:38:41.252-->00:38:47.625 that you know, you've already established that rapport, that trust if you will and so when 00:38:47.625-->00:38:54.365 something , you know, comes to your attention that is serious and needs to get their attention 00:38:54.365-->00:38:58.636 right away you already have a point of contact. You don't have to go searching for who that 00:38:58.636-->00:39:03.575 person is. >>On many of these issues that you just went through, there is a lack of a 00:39:07.045-->00:39:13.484 proper strategy on how to deal with it. And so, let's start with- let start with doing 00:39:13.484-->00:39:20.024 something to industrial controls within the utility routes. So what is it, 3 years ago, 2 years 00:39:20.024-->00:39:26.064 ago, this was no longer a philosophical exercise. The Russians did it in the Ukraine. 00:39:26.064-->00:39:31.069 If you look at the UN, the UN says there's certain things that are an act of war. It is foolin 00:39:34.005-->00:39:39.010 with somebody's grid. Is an Act of war according to the UN. What was the response to the Russians 00:39:43.548-->00:39:50.021 when they did that? Nothing. The sanctions that were put in and the sanctions that we just 00:39:50.021-->00:39:55.026 strengthened, uhm, in the House, this week, was not because of that. And So if you don't 00:39:59.564-->00:40:04.569 articulate what a response will be to a certain redline, uhm, that's a form of a deterrent. 00:40:07.839-->00:40:12.844 And so-so what should an actual response be in-in that-in that case and there's all kinds of 00:40:16.047-->00:40:22.854 conversations around it but there is not an accepted policy at the NSC that would ultimately 00:40:22.854-->00:40:29.127 drive this. Now, folks in congress, we could be shining light on this and talk through 00:40:29.127-->00:40:34.132 these issues. It's the Homeland Security committee, which we're on, it's the oversign government 00:40:36.935-->00:40:43.374 reform committee, where I chair a sub committee there. It's energy and commerce and it's 00:40:43.374-->00:40:50.181 also, uhm, science and technology. Right, but Homeland and OGR are 2 of the ones that 00:40:50.181-->00:40:56.654 do the bulk of some of this of some of this work and so it's important to educate us, the 00:40:56.654-->00:41:02.760 individual members of congress, but we also need yall sitting down with some of the staff that 00:41:02.760-->00:41:07.765 populate these committees. Sitting down with GAO. GAO is-is basically the inspector general 00:41:10.335-->00:41:15.606 of the entire government, and then every department has IGs as well, but these are the folks 00:41:15.606-->00:41:21.379 that are looking at kind of the holes in policy, the holes in-in taxes techniques and procedures 00:41:21.379-->00:41:27.852 when it come to defending a digital infrastructure uhm, so-so that we-we-we need to 00:41:27.852-->00:41:32.457 help-we need to be talking about what's the strategies so then we can start talking about the 00:41:32.457-->00:41:39.030 tactics and how we- how we should be- who should be responding to what. And this is 00:41:39.030-->00:41:44.702 another problem when it comes with-comes along with disinformation. The Russians are 00:41:44.702-->00:41:49.707 trying to erode trust in our institutions. Period. End of story. And how do we deal we do 00:41:54.379-->00:42:01.252 not have a counter covert influence strategy. And many of ya'll in this room can help and 00:42:01.252-->00:42:07.125 have delt and have operated in some of these communities that we could be leveraging 00:42:07.125-->00:42:12.330 intelligence from and talking about so we don't have a strategy there. So that's 00:42:12.330-->00:42:18.703 something that I'm concerned with. Cause guess what we're going to see this in 2018. And 00:42:18.703-->00:42:25.143 it's not just the Russians. We know other nation states have tried to do this and based on 00:42:25.143-->00:42:30.581 what was demonstrated in the last 48 hours, we have to tighten up some of these voting 00:42:30.581-->00:42:35.586 machines as well. So, all of this stuff is connected and-and nobody has the right answer but 00:42:38.189-->00:42:44.996 talking to folks that live and breath this is important. And so, committee staff's important, 00:42:44.996-->00:42:49.434 the legislative direc- wherever y'all live, your member of congress you should know the 00:42:49.434-->00:42:54.439 district director, uhm, you should know the legislative director for your member, those 00:42:54.439-->00:42:59.444 are 2 people that drive the policies of those offices. >>And who on their staff is the point 00:43:01.412-->00:43:06.417 person that deals with the research community issues in particularly. I just want to say 00:43:08.820-->00:43:14.125 something else if I could just to underscore what Will had said. What the Russians did was 00:43:14.125-->00:43:16.461 outrageous, it was wrong and they are going to keep doing it. Particularly if they're not hit 00:43:16.461-->00:43:21.466 hard enough, if they don't get strong enough sanctions or the message isn't sent clear enough 00:43:26.971-->00:43:31.008 that we're not going to tolerate that kind of interference or undermining our- our- of the 00:43:31.008-->00:43:36.614 pillars of our democracy. And we have to look at this holistically and say that as a 00:43:36.614-->00:43:43.488 nation state we have a whole sweep of options that we can draw from to-to retaliate to 00:43:43.488-->00:43:49.227 make the point that we're not going to uh accept that kind of interference with our elections 00:43:49.227-->00:43:56.200 and we need to make it very clear from here forward. >>Alright we're reaching the end 00:43:56.200-->00:44:03.074 here, um, boy I wish we had 3 hours for this. Um so, as we face these challenges they're 00:44:03.074-->00:44:08.546 not going to slow down. I think while we were here one of the victims from Petya was Merck in 00:44:08.546-->00:44:12.617 the pharmaceutical industry admitted that it had a material impact on the production of 00:44:12.617-->00:44:17.889 several of their drugs. This is designated critical infrastructure. Unrestrained 00:44:17.889-->00:44:22.994 cyber ammunitions got outside it's intended target and affected US critical 00:44:22.994-->00:44:29.000 infrastructure. These are the types of companies that make our pandemic vaccines and shots 00:44:29.000-->00:44:34.372 incase we have a national emergency. So, as I look across this room I see a lot of raw 00:44:34.372-->00:44:39.377 talent. And I know in general we loath to regulate, we loath to work with government, we uh, in 00:44:41.646-->00:44:46.484 general like the come as you are, do as you please type guys. I know a lot of the things we 00:44:46.484-->00:44:51.989 see come on the news or around the hill might have some rough edges. As things get very, very 00:44:51.989-->00:44:58.162 real, and as the consequences of failure get very, very high, I really encourage you to see that 00:44:58.162-->00:45:03.234 they're outreaching a hand and trying. And when they publish something or they ask a question 00:45:03.234-->00:45:08.472 look for what's right in it and cultivate that. We're really, really good at finding what's 00:45:08.472-->00:45:12.777 wrong with something but I think we're at that stage now where we have to make that outstretched 00:45:12.777-->00:45:17.548 hand and go that extra mile and meet in the middle if we're going to rise to meet these 00:45:17.548-->00:45:24.355 challenges together. So I see what we've done here maybe as a coal or a little ember a little 00:45:24.355-->00:45:30.761 bit of heat and light. We can either snuff it out or we can foster it and grow it, uh, into 00:45:30.761-->00:45:35.766 a real vibrant collaboration here. Uhm, we have now brought D.C. to Def Con, I'm trying to 00:45:37.768-->00:45:42.607 make it happen so we can bring more of Def Con to D.C. Perhaps we can turn this into a regular 00:45:42.607-->00:45:47.612 thing. Maybe a Cyber caucus in the Summer here? Maybe a cyber caucus in D.C. around ShmooCon? 00:45:53.684-->00:45:58.689 Just sayin'. [light laughter and applause] When we said 4 years ago the cavalry isn't coming, it 00:46:01.225-->00:46:06.230 meant it fell to you. It was to be depressed it falls to you. So, if we see something missing 00:46:06.230-->00:46:11.202 in the world, we gotta put it there. I hope this is the start. I respect and admire every 00:46:11.202-->00:46:16.874 single person in this room. I respect and admire our colleagues in D.C. This has got 00:46:16.874-->00:46:22.813 to be the beginning. We've been amazing for 25 years. Who are we going to be for the next 25? 00:46:22.813-->00:46:27.818 Thank you. [Crowd Applause and cheers]