00:00:00.333-->00:00:06.875 >> Hi, everyone, um, thank you so much, er, for having us. [laughter], er, we're here to 00:00:06.875-->00:00:11.875 present Tick, tick, boom you're dead. Um, a brief history of tech and the FTC, though if you 00:00:16.000-->00:00:20.667 do not know me, I am Whitney Merrill, I am the, er, founder of the crypto and privacy 00:00:20.667-->00:00:25.917 village here at Defcon , and this is my first time speaking on a main tack. Um, I'm an 00:00:25.917-->00:00:30.917 attorney as well as a hacker, um and I -I'm pleased to be joined by, er, my former bosses bosses 00:00:33.375-->00:00:37.833 boss. [laughs]. >>Well, thanks for that introduction...it's working yes, hello. Um, I'm 00:00:37.833-->00:00:43.500 Terrell McSweeny,i'm a federal trade commissioner at the Federal Trade Commission. Um, 00:00:43.500-->00:00:49.750 which is, uh an agency that has a lot to do with consumer protection. We also are a data 00:00:49.750-->00:00:53.917 protection, information security consumer protection agency as well, and we're going to be 00:00:53.917-->00:00:59.375 talking a little bit about today in our talk. I'm super thrilled,er, that Whitney is 00:00:59.375-->00:01:03.292 joining me for this, i am actually super sad that she has moved on from the FTC, so she 00:01:03.292-->00:01:08.000 doesn't actually have to give the disclaimer that I'm about to give. Which is that these are 00:01:08.000-->00:01:12.458 not, er, the official views of the FTC, um I'm going to give you my individual views, not 00:01:12.458-->00:01:16.750 necessarily the views shared by anybody else at the FTC. So, that take that with a grain of 00:01:16.750-->00:01:21.750 salt. So, what is the FTC? Why are we are we here, why are we talking about this at Defcon, 00:01:25.667-->00:01:30.625 um, actually - again, the FTC has been at Defcon for a number of years now and, we're really 00:01:30.625-->00:01:35.500 thrilled to continue are partnership with the security researcher community because, 00:01:35.500-->00:01:41.500 er, your research helps inform our cases. What do I mean by that? Well, um, the FTC is a 100 00:01:41.500-->00:01:46.792 year old consumer protection agency, it's actually about 103 years old, so it's older than 00:01:46.792-->00:01:51.792 Defcon - at 25 years. Um, and it's older than the internet, even the world wide web. But 00:01:54.750-->00:01:59.917 we've had this authority, basically, to protect consumers from unfair deceptive acts and 00:01:59.917-->00:02:05.208 practices, and we've taken it from the brick and mortar world and brought it into the online 00:02:05.208-->00:02:07.208 one. So we - I'm thrilled about this talk today because we're actually going to spend a minute 00:02:07.208-->00:02:09.208 just going back in time, um and looking at some of the first cases FTC brought. And then 00:02:09.208-->00:02:11.208 comparing them to some of the cases we're bringing today. And we're going to end by talking to 00:02:11.208-->00:02:13.208 you a little bit about how we do investigations, how your work can help us and what we're 00:02:13.208-->00:02:15.208 looking for from the research community as well. It's great to have a retrospective in the 25th 00:02:15.208-->00:02:17.208 year of Defcon and so we're, we're going to take some time to do that now. We'll be looking at 00:02:17.208-->00:02:19.208 cases that we brought, um and we're also going to be talking about other tools the FTC uses 00:02:19.208-->00:02:24.208 to shape policy in the US government. We hold workshops, we write reports, increasingly, 00:02:43.958-->00:02:49.583 we do our own research and present that, um and we also do consumer and business education. 00:02:49.583-->00:02:54.750 So, we'll be covering all of those topics today. >>So, we're going to take you back as 00:02:54.750-->00:02:59.917 Terrell was saying. Um, you know, when we were discussing what kind of talk we wanted to 00:02:59.917-->00:03:04.292 submit to Defcon, I said we should do something that honors the 25 years of the hacker 00:03:04.292-->00:03:06.875 community. And how can we...basically, look and show how the FTC has been working 00:03:06.875-->00:03:12.208 hand in hand, basically, with that community over the past 25 years. Um, what have we done and 00:03:12.208-->00:03:17.208 how has it, um, been applied. So this is a quote from an attorney - probably 25 years ago at this 00:03:24.875-->00:03:31.667 point, um and says, "This is standard stuff, it's just in a new medium." And that's exactly 00:03:31.667-->00:03:36.583 what we will show. >> Yeah, so one the first things that's incredibly standard in human 00:03:36.583-->00:03:41.875 behaviour from the dawn of time is fraud. It is a thing we spend a lot of time and resources 00:03:41.875-->00:03:47.083 going after at the FTC, both in the brick and mortar world but also in the online world. The 00:03:47.083-->00:03:52.000 case i'm about to talk about, um actually we can queue that up - wa sone of our first cases 00:03:52.000-->00:03:58.292 involving fraud on the internet. Um, this was a case in which, um the company was running ads on 00:03:58.292-->00:04:05.167 AOL offering 99 credit repair kit that was basically worthless. For those of you free 00:04:05.167-->00:04:11.250 consumer types, credit repair is basically always worthless. Don't sign up for that stuff, it 00:04:11.250-->00:04:16.250 is a scam. Um, so this was, this was that kind of opportunity. Um also just a history lesson, for 00:04:19.250-->00:04:25.000 the young people in the room, um in 1994, which was which was about - Defcon was about 2 years 00:04:25.000-->00:04:31.000 old at that point, um America Online was the way in which most Americans connected to the thing 00:04:31.000-->00:04:37.375 called the Word Wide Web. they did that via the dial up service, you know, on a modem. 00:04:37.375-->00:04:41.500 They used the AOL email, I still love it when people have AOL emails, it's like 00:04:41.500-->00:04:46.500 retro...fabulous [laughing]um, and AOL was a primary web portal for a lot of users so, it was a 00:04:49.583-->00:04:56.000 really important part of protecting consumers - American consumers - on the internet. So 00:04:56.000-->00:05:00.458 the next case I'll bring up is, involves something called the mail order rule - and I bet 00:05:00.458-->00:05:05.583 you're all sitting there going, that sounds like the driest most boring rule in the entire world. 00:05:05.583-->00:05:11.125 Um, actually had a fortunate opportunity to work on the mail order rule type cases, and it's 00:05:11.125-->00:05:16.625 more fascinating than you'd expect. But basically the rule says, if somebody says they are 00:05:16.625-->00:05:22.083 going to ship something to you by a particular date, they must do that, and if they don't do 00:05:22.083-->00:05:27.458 that, it's a unilateral modification of contract and you are a harmed consumer. So in 00:05:27.458-->00:05:33.208 this particular case, this was from 1996, and this was the first time this older rule was 00:05:33.208-->00:05:38.208 applied to business done over the internet. In this particular instance, Brensell was supplying 00:05:40.417-->00:05:45.417 the world with computer parts, um he was offering memory chips over user net and ultimately 00:05:47.458-->00:05:52.458 never shipped those chips. And so, the FTC, um...brought a case against Brensell, um and and got 00:05:56.625-->00:06:01.625 restitution for the consumers harmed. >>OK, next: deceptive advertising. This is also an 00:06:12.667-->00:06:17.875 area the FTC takes up a lot of time and energy and uses a lot of resources on. Essentially, 00:06:17.875-->00:06:20.375 um, what deceptive advertising is all about, is looking at claims that are being made, 00:06:20.375-->00:06:22.375 claims that are relevant to whether a reasonable person would decide whether or not to 00:06:22.375-->00:06:24.417 use a product and assessing whether they are true or not. And the assessment of truth is 00:06:24.417-->00:06:30.875 called substantiation. So, er, one of our first internet related, er, deceptive 00:06:30.875-->00:06:37.000 advertising cases was a case involving in a product, er, a coating to put on your glasses 00:06:37.000-->00:06:42.417 to protect you from the harmful rays coming out of your computer. Um, turns out, tha- 00:06:42.417-->00:06:47.333 >>You'd all be blind if this was true... >>[laughs]There wasn't a lot of science behind the 00:06:47.333-->00:06:51.958 harmful rays coming out of your computer claim or even the product, um and so this was, er, 00:06:51.958-->00:06:56.667 er, a sight for sore eyes case that, um, the FTC brought saying, look, that's a deceptive 00:06:56.667-->00:07:01.667 advertising claim being made. >>So many of you may be in the room and you were enticed by the 00:07:03.958-->00:07:09.250 title and you didn't read the abstract and you were like "Oh, this looks really crazy, I'm 00:07:09.250-->00:07:14.667 going to go to this talk...and you're like this is about law and policy. Well, you can leave 00:07:14.667-->00:07:20.917 now - [laughs] - no judgement. Other consumers may have had similar fears, for there was an 00:07:20.917-->00:07:25.917 advertisement run from 1992-93 by Hayes Mica Computer and it, it looked exactly like that one. 00:07:29.042-->00:07:34.292 It ap-appeared in computer magazines, um and networking magazines and it basically said: 00:07:34.292-->00:07:39.625 "Tick, tick boom - you're dead." And here they said that they were telling consumers that the 00:07:39.625-->00:07:45.458 time bomb might be lurking in their computer. Specifically, they said, well, like, you're 00:07:45.458-->00:07:50.458 thinking, "what's the time bomb?" and it was an accidental escape sequence. And, the modem 00:07:52.792-->00:07:58.833 company said that if you didn't use their improved escape sequence with guard time, that 00:07:58.833-->00:08:03.875 your data would be destroyed. Simply this was not true. There's was no better than the 00:08:03.875-->00:08:08.875 competitors, but even worse, they said, "hey, give us your information and send you a free 00:08:11.083-->00:08:17.375 kit to test your computer to see if it's dangerous." and it was basically malware installed on a 00:08:17.375-->00:08:22.375 user's computer that would force the competitor's modem to hang up. [audience laughter]. Oh 00:08:24.625-->00:08:30.458 yeah...the FTC specifically, my mentor when I was in the San Francisco office of the Federal 00:08:30.458-->00:08:34.583 Trade Commission, Linda Badger, who will hate that i'm giving her a shout-out right now, but 00:08:34.583-->00:08:41.500 she deserves it, um brought this, saw this ad and said this is baloney - brought the case. 00:08:41.500-->00:08:48.375 Um, and so the FTC here, basically, said, "No, this is not true. A modem's failure to 00:08:48.375-->00:08:54.917 incorporate this improved sequence with 'guard time," so fancy, "um, doesn't create any 00:08:54.917-->00:08:59.750 substantial risk of data destruction. >>I just, i think what's really interesting about 00:08:59.750-->00:09:05.625 this is this is an early case, but we still see this kind of fraudulent practice all over the 00:09:05.625-->00:09:12.000 place - all the time, um now it takes more the form of a tech support scam, we still have tons 00:09:12.000-->00:09:17.250 of cases involving, um scaring consumers about security vulnerabilities in their product 00:09:17.250-->00:09:23.458 and causing them to download malware or buy services that are useless. >>It's also something 00:09:23.458-->00:09:29.250 that companies do to you to entice you to buy their product. And so, FUD - Fear, Uncertainty 00:09:29.250-->00:09:35.500 and Doubt is not a new thing that we see in security or privacy. Here's a case from 2004 00:09:35.500-->00:09:40.958 that was also using FUD to entice people to purchase a security product. How many 00:09:40.958-->00:09:46.792 people have seen that before? In maybe your recent time? Um, this year was the internet alert. 00:09:46.792-->00:09:51.792 They would pop up throughout your browsing, um, enjoyment, um and basically claim that your 00:09:55.792-->00:10:01.750 computer might be insecure through banner and pop-ups online, um when they appear to 00:10:01.750-->00:10:07.667 consumers they, they like look like alert boxes. So a consumer would be enticed to click. Um, 00:10:07.667-->00:10:11.875 it would then take the user to the internet alert's software website where they could 00:10:11.875-->00:10:16.875 purchase, um, this software that really, um had no proof that the u- individual user's computer 00:10:20.167-->00:10:26.667 was insecure. Um, so the FTC brought this case and basically prevent, said to Bonzaai 00:10:26.667-->00:10:31.583 software that you cannot advertise in this particular way because it is deceptive to 00:10:31.583-->00:10:37.417 consumers. >>This, this is a little bit different. Also an advertisement. Um, this product 00:10:37.417-->00:10:42.125 actually works, I think as it was reported to work, but, um it's the it's really the problem 00:10:42.125-->00:10:48.917 with the thing in itself. This was CyberSpy selling spyware and showing people how to remotely 00:10:48.917-->00:10:53.125 install it without other people's knowledge or consent, and i think the tagline in the 00:10:53.125-->00:10:58.875 ad says it all: "Spy on anyone, anywhere." Like exciting and interesting. Um, we said look, 00:10:58.875-->00:11:04.458 you can't be enticing people to install keyloggers software on other people's computers without 00:11:04.458-->00:11:10.250 their consent. That's a huge problem, um, so it's not really that the product is illegal it's 00:11:10.250-->00:11:15.250 just that you can't be using it on people in a deceptive way. >>So, we've discussed a lot 00:11:18.083-->00:11:24.500 about deceptive practices and the traditional type of consumer protection cases that they - an 00:11:24.500-->00:11:28.542 agency like the FTC would bring. We are going to talk specifically now about ones that 00:11:28.542-->00:11:31.500 involve security. You're probably thinking I bet some of those FUD cases look like 00:11:31.500-->00:11:37.083 security cases too. And the reality is that security falls into really two different like 00:11:37.083-->00:11:42.625 branches. There's deceptive practices and then unfair security practices, and so we'll 00:11:42.625-->00:11:47.667 kinda highlight some of those for you though. But most importantly. I'm here to 00:11:47.667-->00:11:52.667 emphasize, the FTC's, um, involvement in reg- you know [pause] advocating for security 00:11:58.167-->00:12:04.250 practices over the past 25 years. So in this particular case, um, at the time it was 00:12:04.250-->00:12:09.625 called modem hijacking. Um, it might now be considered more like ransomware? But in this 00:12:09.625-->00:12:14.625 particular case, defendants, um maintained adult entertainment websites: Beavis and Butthead 00:12:17.083-->00:12:23.958 dot com, sexy girls dot com, and one adult dot com. And when a user would visit that website, 00:12:23.958-->00:12:29.083 they would dow- they would be told you should download this program to view more free and 00:12:29.083-->00:12:34.083 images, with an exe called David dot exe. And when it was downloaded and executed, the 00:12:36.958-->00:12:42.375 program disconnected the computer from the consumer's own access provider, turned off the 00:12:42.375-->00:12:47.333 consumer's modem speakers, dialled an international telephone number and then 00:12:47.333-->00:12:52.292 reconnected the computer to a remote foreign site. Um, in this particular case the 00:12:52.292-->00:12:58.000 international call would be charged to consumers for more than 2 dollars a minute. Um, I 00:12:58.000-->00:13:03.958 don't know if anyone remembers how expensive telephone calls were? Way back when? And how 00:13:03.958-->00:13:07.750 ...telephones >> Telephones for those folk in the room who are younger - phones where things we 00:13:07.750-->00:13:12.750 had in our houses connected to wires [laughing] that's how people got America Online, um, 00:13:19.250-->00:13:23.167 [laughs] [audience laughs and applause] >>So these charges would continue to accrue for the 00:13:23.167-->00:13:27.125 poor user, until the computer was shut off. And how many people actually shut off their 00:13:27.125-->00:13:32.125 computers? Um, so consumers received telephone bi=bills, um purported to be made to Moldova, 00:13:34.500-->00:13:39.500 when in fact they were going so far as Canada. So the the FTC brought a series of cases 00:13:41.750-->00:13:48.000 against the, er, companies that were engaging in this, um practice to protect consumers. 00:13:48.000-->00:13:52.958 >>Now one of the things, and I'm trying to highlight, we're both trying to highlight here is 00:13:52.958-->00:13:57.958 that: the FTC knew the value of the internet and the value of protecting consumers on the 00:14:01.000-->00:14:07.583 internet and in the a way that, um, really ensured that they could engage with it, because if 00:14:07.583-->00:14:13.833 it became this unruly, um, you know, you'd order your microchips and then never 00:14:13.833-->00:14:20.750 receive them, no-one would want to engage or use the internet. >>So fastforward to last year, 00:14:20.750-->00:14:26.917 where [laughs] um, you know, I think, no-one is going to say we don't have plenty of work to do 00:14:26.917-->00:14:31.750 as a consumer protection agency every day all the time, which is part of why we've being trying 00:14:31.750-->00:14:36.333 to forge close relationships with the security research community as well, because we 00:14:36.333-->00:14:42.333 view you all as valuable partners in, er, in our work. Um, the Ashley Madison case is I 00:14:42.333-->00:14:47.417 think an interesting one. We brought actually about 60 cases involving data security, either 00:14:47.417-->00:14:52.792 in unfairness or deceptive practices, using either one of those authorities. Um, we wanted 00:14:52.792-->00:14:56.542 to highlight a couple of them that are more current. This one, I think, is particularly 00:14:56.542-->00:15:03.333 interesting because it gets to this trust point. Here we had a huge breach, you can think, um, 00:15:03.333-->00:15:08.000 I- I think it's pretty safe to say that, when, er, in many situations, if you read about a 00:15:08.000-->00:15:13.208 huge a breach of sensitive information, chances are the FTC probably are going to take a 00:15:13.208-->00:15:16.833 look at what happened there and whether the security practices were reasonable in the 00:15:16.833-->00:15:22.792 organization. Si unfortunately we had 36 million users whose identities were exposed on a 00:15:22.792-->00:15:28.917 social networking site that was being used by people to have extramarital affairs. Um, right 00:15:28.917-->00:15:33.083 there, I don't think I even need to unpack why this was sensitive information, unfortunately it 00:15:33.083-->00:15:39.417 had huge consequences for many of the people whose information was exposed. Marriages were 00:15:39.417-->00:15:44.458 ruined, people committed suicide, I mean this was not just economic identity theft, it 00:15:44.458-->00:15:50.500 was personal and emotional harm and it was pretty tragic. Um, so we took a look along with our, 00:15:50.500-->00:15:55.833 um, Canadian authorities, Australian authorities, it was actually kind a global 00:15:55.833-->00:16:00.375 investigation, thirteen other states at what was going on and not surprisingly we found some 00:16:00.375-->00:16:05.667 pretty serious security flaws in in the company. So that was part of the case. But there were some 00:16:05.667-->00:16:11.917 o - other practices we also took a look at that were deceptive. So for example, there was a full 00:16:11.917-->00:16:16.458 delete option available on this website, and if you paid ney for full delete, then they were 00:16:16.458-->00:16:21.208 going to delete all of your information - and this was explicitly said. Well, um, turns 00:16:21.208-->00:16:26.167 out that didn't happen, so a lot of people paid for full deleting of information that was not 00:16:26.167-->00:16:32.042 deleted, and then it was exposed as well. And then there was a thing I find particularly 00:16:32.042-->00:16:36.250 interesting, and i suspect we are going to see more of this, um, just given all the 00:16:36.250-->00:16:41.958 technology that's out there. There was use of fake profiles, and, um, the reason I just want 00:16:41.958-->00:16:47.958 to call this out is, er, there was a lot of marketing to attract people to the platform 00:16:47.958-->00:16:53.750 to thicken it that promised, in some cases, 'thousands of women in your city', now it turned 00:16:53.750-->00:16:58.750 out, of the 19 million American users 16 million were men, um and [laughter] thing is no-one 00:17:02.000-->00:17:05.333 in the room is surprised [laughter] they're all like 'yeah', totally [laughter]. So, 00:17:05.333-->00:17:11.125 um, so mostly it was men on the platform and the fake engager profiles were being created by 00:17:11.125-->00:17:15.917 the company in order to create the impression that there thousands of women in cities, 00:17:15.917-->00:17:20.417 when in fact there really weren't. And, and so we said like that is also deceptive 00:17:20.417-->00:17:24.833 practices as well and one that clearly people were relying on because part of the promise of 00:17:24.833-->00:17:29.125 the entire thing was was being able to connect with people who were interested in having 00:17:29.125-->00:17:34.125 affairs. Do ya, do you want to hit IOT? >>Yes, Um, Aces. how many people here think Internet 00:17:39.250-->00:17:44.250 of Things is a problem? I think that's a lot. Um, so basically the FTC has had several 00:17:47.792-->00:17:54.125 initiatives in trying to regulate this unwieldy insecure place that is the Internet of 00:17:54.125-->00:17:59.125 Things and in 2016 the FTc brought a case against Aces for being insecure, Um, I wanna call 00:18:02.083-->00:18:08.417 out before I discuss this case really in depth is the failure to mitigate disclosed 00:18:08.417-->00:18:15.417 vulnerabilities in particularly the vulnerability allowed an attacker to bypass a login 00:18:15.417-->00:18:21.417 screen and gain complete access to a computer's connected storage device. Aces failed to 00:18:21.417-->00:18:26.833 encrypt consumer's files in transit and personal files were public by default. So that's 00:18:26.833-->00:18:32.958 pretty serious vulnerabilities to disclose to a company. In part- in this particular case in 00:18:32.958-->00:18:39.875 2013, a security researcher publicly disclosed, um based on his research that over 15 000 00:18:39.875-->00:18:44.875 Aces routers allowed for unauthorized access to um, disk, basically a storage disk that 00:18:47.000-->00:18:52.708 you could spin up in connection with Aces. Um, in his public disclosure, he claimed that he 00:18:52.708-->00:18:57.708 had previously reached, reached out to Aces several times and was ignored. And so here the FTC 00:18:59.833-->00:19:05.042 really called that out as a bad security practice - respond to vulnerabilities, patch 00:19:05.042-->00:19:10.042 vulnerabilities disclosed to you, um and ultimately, um, um yeah, the FTC...they had to deal 00:19:12.208-->00:19:18.250 with the FTC. >>And importantly, that's not our only IOT related data security or privacy case. 00:19:18.250-->00:19:23.083 We have others that are, um, pretty public, safe to say there are others in our pipeline and I 00:19:23.083-->00:19:26.750 think what's important about what Whitney just said is the presence of the security 00:19:26.750-->00:19:31.208 researcher here, helping to disclose the problems in the first place - again, incredibly 00:19:31.208-->00:19:37.000 valuable. And it's important to remember in the absence of any kind of er, established security 00:19:37.000-->00:19:42.375 standards for the Internet of Things, um the FTC is essentially using its authority 00:19:42.375-->00:19:47.000 again to protect consumers from unreasonable security practices, which we have decided are 00:19:47.000-->00:19:52.625 unfair, under our authority, um and providing education about what we think the best practices 00:19:52.625-->00:19:59.625 are for reasonable standards. So this is essentially, the the way in which we are trying to create 00:19:59.625-->00:20:05.625 incentives in the marketplace to improve IOT security. I don't think Whitney and I are standing 00:20:05.625-->00:20:11.083 up here saying we think it's sufficient, but it's the FTC doing what it can with the 00:20:11.083-->00:20:16.083 authority that it has, to try to improve the situation in...in IOT particularly. [pause] 00:20:18.625-->00:20:25.083 Privacy. >>Yes, so we'll kinda switch over, um to talk about, a little bit about privacy. Um, we 00:20:25.083-->00:20:31.250 start with a case from 1993 Defcon 1 and this is not your traditional privacy case, in the 00:20:31.250-->00:20:36.042 sense that it happened online. But, but I want to flag in it because of, it is one of the 00:20:36.042-->00:20:41.042 earliest cases where the FTC, um, sued transunion corporation from taking all the consumer 00:20:44.708-->00:20:51.042 credit data it had and selling those lists to marketers. And the FTC said, "you cannot take 00:20:51.042-->00:20:56.375 this type of data and not disclose to consumers that you are doing this, um it is, you 00:20:56.375-->00:21:01.375 know, unfair and deceptive to that consumer, um to be marketed in that particular way. 00:21:03.750-->00:21:09.375 >>Alright, so. GO cities, this is actually our first, um yeah well, GO cities, who knows GO 00:21:09.375-->00:21:14.667 cities? Anybody? Rain forests? >>Yeah. >>[laughs] OK, good. Um, so this was our, er, our, uh 00:21:14.667-->00:21:19.292 first official privacy case online and a really important one and it's important to 00:21:19.292-->00:21:25.292 remember that at the time we brought this case, it one of the most popular websites on the 00:21:25.292-->00:21:31.375 world wide web. With about 2 million users, which at that time, it seems tiny today, was a 00:21:31.375-->00:21:37.208 huge amount of people. It was a site that, um, was allowing people to create their own 00:21:37.208-->00:21:42.667 homepages and grouping them into communities. And, um this won't surprise anybody, given the way 00:21:42.667-->00:21:48.958 business models are today, it was asking for incredibly amount of detail, personal information 00:21:48.958-->00:21:54.250 about people, adults and children, about not just their location and their addresses but 00:21:54.250-->00:22:00.000 also their preferences and all kinds of things and then it was selling that to advertisers. So, 00:22:00.000-->00:22:05.000 um, what we said, was okay, you have to have notice and you have to get consent, u if you're 00:22:08.250-->00:22:14.208 going to be monetizing people's sensitive information in that way. And specifically when it 00:22:14.208-->00:22:19.208 comes to children, and at the time it was under 12, um we are going to require, er, verified 00:22:21.250-->00:22:26.667 parental consent. Now, that's going to sound very familiar, er, to anybody that deals with 00:22:26.667-->00:22:31.625 children's data on a regular basis, because that actually became the law of the land in 00:22:31.625-->00:22:37.958 the Children's Online Privacy Protection Act, which again requires, parental consent for 00:22:37.958-->00:22:42.958 the collection and use of children's information. >>Er, so the next case also calls 00:22:45.917-->00:22:51.833 collecting information on children as well as adult users. Um, in this particular case, 00:22:51.833-->00:22:56.833 InMobi um, ad network, um actively undermined the privacy choices of consumers. How did 00:22:59.833-->00:23:06.583 they do this? Well, in an individual app you could choose to opt of out of location 00:23:06.583-->00:23:12.750 tracking and in mobi instead tracked consumers locations regardless of these permission 00:23:12.750-->00:23:19.458 settings.They used a database of wireless network location information to infer a 00:23:19.458-->00:23:24.458 consumer's physical location and then match up where you were. Um the FTC said, basically, no you 00:23:27.250-->00:23:33.792 can't do this, this is a misrepresentation, not only to consumers, but also to the 00:23:33.792-->00:23:39.417 developers of the apps, because they were not being told that this was being done by InMobi 00:23:39.417-->00:23:45.708 and the FTC issued a 4 million dollar civil penalty for violating the children's Online 00:23:45.708-->00:23:51.500 Privacy Protection Act, and said that InMobi for the next 20 years must institute a 00:23:51.500-->00:23:56.958 comprehensive privacy program and be independently audited eve- for every two years for the 00:23:56.958-->00:24:01.000 next twenty years. >>I think what's really important about this case that this is a 00:24:01.000-->00:24:06.125 situation where there was a clever tech worker around that was really working around an 00:24:06.125-->00:24:12.500 expressed privacy choice by consumers. And I think that's an area I think the FTC needs to 00:24:12.500-->00:24:19.167 continue to stay really focused on, um, these cases are hard to detect and we really can't do it 00:24:19.167-->00:24:25.250 without the work and help of people like yourselves, so, um that is, that is really 00:24:25.250-->00:24:31.292 important to us as well. >>Um, ye-yeah. And unlike the other cases we've discussed earlier in 00:24:31.292-->00:24:37.542 the presentation, you know, you see an ad and go "this is weird, er," you don't need to be 00:24:37.542-->00:24:42.458 technical to necessarily understand, you know, the technical problems or the 00:24:42.458-->00:24:47.958 privacy issues or the data security issues, um a lot of these newer privacy and data 00:24:47.958-->00:24:51.750 security issues, you don't see unless you're actively researching it. And so, really, 00:24:51.750-->00:24:57.875 it takes a community to find out, um and search these out, which us what, really, all of 00:24:57.875-->00:25:02.875 you are about. >>And the next case actually was also directly the result of research and um, 00:25:05.042-->00:25:10.042 information that we er, we gathered and read, um, from media reports about how a Smart 00:25:12.625-->00:25:17.625 television was working. So this is Visio, which is a case from this year, what's really 00:25:17.625-->00:25:23.792 important about it was, um, that for the first time we are, we have a case involving a smart 00:25:23.792-->00:25:28.333 television and we're also taking a careful look at the kind of disclosure that's being made 00:25:28.333-->00:25:32.208 because of the kind of information that's being collected. So what's happened in 00:25:32.208-->00:25:38.542 this case being used by Visio that allowed it to gather, er, second by second viewing 00:25:38.542-->00:25:41.542 information from the television for anything that was playing on the TV, so it wasn't just 00:25:41.542-->00:25:45.708 whatever's coming through the cable box or whatever -anything on that screen was collected and 00:25:45.708-->00:25:50.708 then it was sent back, uh for monitorization. Um, what people are watching when they are 00:25:53.958-->00:25:57.500 watching it, how long they are watching it is incredibly valuable advertising 00:25:57.500-->00:26:03.667 information. Now, er, we took a look at it, and it turned out there was a disclosure made to 00:26:03.667-->00:26:10.333 consumers about this practice. It was in the smart interactivity section, um and it 00:26:10.333-->00:26:15.167 essentially made it sound like this information was being gathered to optimize performance 00:26:15.167-->00:26:20.708 or provide recommendations for viewers or something like that, with not at all clear it was 00:26:20.708-->00:26:26.250 actually being collected and used for targeted advertising purposes and other profiling 00:26:26.250-->00:26:32.167 information. So, we brought, we brought a case and said, look, you have - if you're going to be 00:26:32.167-->00:26:36.500 collecting sensitive information, in this case, second by second television 00:26:36.500-->00:26:41.458 viewing information you have to provide a clear choice to consumers and that needs to be 00:26:41.458-->00:26:47.125 an opt -in choice that they can clearly understand if they're reasonable people, like my mom. 00:26:47.125-->00:26:53.583 Who is a very reasonable person. But not a very high tech person - she actually has an AOL 00:26:53.583-->00:26:58.583 account. [laughter] >>So, uh one of the things we're gonna point out looking at the past and the 00:27:03.833-->00:27:08.208 present is, you know, like the workshops and and the initiatives that the FTC has 00:27:08.208-->00:27:13.500 done to engage, not only with consumers but individual researchers and experts in the 00:27:13.500-->00:27:18.500 area, um looking back as far as 1995, 96, the FTC was asking questions about cookies. In 2007 00:27:22.250-->00:27:27.458 we started to really dee- take a deep dive into behavioural advertising - how are you being 00:27:27.458-->00:27:33.042 used, tracked and targeted by ad companies and they've continued to do privacy and security 00:27:33.042-->00:27:38.042 series. Most recently a fall technology series and, er, er, last year involving, er, drones, 00:27:40.375-->00:27:45.708 smart TVs and ransomware with ter - >>Yeah, and there were smart TVs, we had a workshop, we 00:27:45.708-->00:27:49.208 looking at a lot of the things that were going on on smart televisions and lo and behold, 00:27:49.208-->00:27:54.042 shortly thereafter we had a law enforcement action involving one, that was the Visio case, I 00:27:54.042-->00:27:59.208 was just talking about. But a word about workshops. Workshops are really valuable for us 00:27:59.208-->00:28:03.042 because the are a chance to both present our own in-house research which we're 00:28:03.042-->00:28:07.500 increasingly capable of doing, they're a chance to talk to people in industry and in the 00:28:07.500-->00:28:12.708 community about the trends out there and how technology is shaping our lives and they're a 00:28:12.708-->00:28:17.000 chance for us to inform ourselves, because as I, as we said at the outset, what the FTC 00:28:17.000-->00:28:21.625 is doing here is trying to figure out when is something deceptive to a consumer and when 00:28:21.625-->00:28:28.083 is it unfair...and and we need to make sure we're being very clear about what the 00:28:28.083-->00:28:33.583 requirements are if, uh if we're going to be investigating people for unfair practices. So we 00:28:33.583-->00:28:39.417 spend a lot of time and energy, both creating information for ourselves in the form of 00:28:39.417-->00:28:45.000 workshops and gathering it, but also in putting our guidance back out to businesses and 00:28:45.000-->00:28:49.875 consumers so that there's information available to people about what the standards are 00:28:49.875-->00:28:56.167 that we are hoping people will be following. So the smart TVs was one of our workshops, we've 00:28:56.167-->00:29:02.250 also been working on cross device tracking - an area that is, er, changing really rapidly 00:29:02.250-->00:29:08.167 and we've we've recommended clear choices for people across their device graphs and what's 00:29:08.167-->00:29:14.750 happening to them. Um , and er, we're studying ransomware, er, I don't have to tell anybody in 00:29:14.750-->00:29:20.000 the room that this a big challenge for consumers. Um, one of the things, frankly, that 00:29:20.000-->00:29:24.833 keeps me up at night is the prospect of a lot of insecure IOT, er, really harassing people 00:29:24.833-->00:29:30.792 with small ransomware attacks in their daily lives [laughs] i think it could be really 00:29:30.792-->00:29:36.208 problematic, and the more we're continuing to rely on end user consumers who are are not 00:29:36.208-->00:29:41.083 technically sophisticated to be the front line defence for their IOT, I think the bigger the 00:29:41.083-->00:29:45.625 challenge we're going to have there. That's a different talk. Um, but we've been looking at 00:29:45.625-->00:29:49.875 ransomware trying to provide consumers with information about how to protect themselves and 00:29:49.875-->00:29:55.125 frankly, it's pretty challenging - it's basically, keep your, keep your software and things up 00:29:55.125-->00:30:00.125 to date, right? And: backup your information, um and we're trying to work with businesses and 00:30:02.125-->00:30:07.083 industry to understand the kinds of attacks, um that are happening and where they're 00:30:07.083-->00:30:12.958 happening and and how they're happening. >>Important to mention here on all IOT and 00:30:12.958-->00:30:18.750 smart televisions is the change of interface, you know, from a traditional computer. Here, you 00:30:18.750-->00:30:23.667 know, it really matters: usability, security, notice and choice -all these buzz words,um 00:30:23.667-->00:30:28.667 really change when there's no way for you to interact with the device or you spend five hours 00:30:31.500-->00:30:36.500 trying to hang a camera in the corner. And so, if it's dealt, you know, part of a bot, right? 00:30:38.667-->00:30:43.667 Um, um, how do you patch that? And entice consumers to, to update. Um, one of the things, 00:30:45.708-->00:30:51.333 um you may have noticed or seen before if you've been to Defcon before, is the FTC has had a 00:30:51.333-->00:30:55.958 pretty regular presence. In particular we've held contests - ask anyone in the hacker 00:30:55.958-->00:31:02.667 community for help, um, how many people get, has gotten a robocall before? Oh yeah, that 00:31:02.667-->00:31:08.625 should be everyone, because if not, you don't own a phone um, [laughs], I get like three a day 00:31:08.625-->00:31:14.125 and i'm on every list, but you know this is a big problem that plagues consumers, in particular 00:31:14.125-->00:31:19.125 we named our contest after Rachel from cardholder services, um [audience laughs] and the FTc 00:31:21.333-->00:31:27.083 came to Defcon and said, you know, "come up with a solution, um, come up with a way to solve 00:31:27.083-->00:31:32.042 this problem that's techinical, because right now, you know, a do not call list is not 00:31:32.042-->00:31:37.042 sufficient." So we, er, the FTC had Zapping Rachel at Defcon 22 and then at Defcon 23, er, uh a 00:31:40.042-->00:31:44.750 follow up contest to that as well, er, um and one of the applications that came out of 00:31:44.750-->00:31:49.750 that was NomoRobo um for 22. >>And we're also just recently wrapped up a contest called the 00:31:52.500-->00:31:57.833 IOT home inspector challenge. Um, so there'll actually be a talk tomorrow in IOT village 00:31:57.833-->00:32:03.250 talking a little bit about that Erin - you can raise your hand wave Erin Elva and um really 00:32:03.250-->00:32:08.875 excited about that. That was a 25 thousand dollar prize that was given to a new app that will 00:32:08.875-->00:32:14.500 hopefully help consumers, um, understand even what IOT they have in their home networks and 00:32:14.500-->00:32:20.708 whether, um they're software on it is up to date or needs to be updated. >>Um, consumer, 00:32:20.708-->00:32:26.250 consumer education - >>This is my favourite part - >>Um, does anyone know who Dewy the 00:32:26.250-->00:32:31.250 E-Turtle is? Anyone? Anyone? OK, that's not surprising. He was the short lived mascot of the 00:32:33.625-->00:32:40.417 FTC who I actually have a little bit of love for despite his dorkiness appeal. Um her was 00:32:40.417-->00:32:45.417 introduced in - >>He was like best friends with Clippy... >>Yeah, Clippy [laughter] 00:32:45.417-->00:32:51.750 mascots we're really in. The national force service had, um, the bear whose name is Blinking 00:32:51.750-->00:32:56.750 - >>Smokey! >>Ah...[laughter] so in 2002 the FTC said, you know we need to make security, er, 00:33:01.292-->00:33:07.500 culture a thing for children and younger people. They need to be thinking about security a lot. 00:33:07.500-->00:33:13.500 And while Dewy may not have been the best answer for that 'cause [laughter] clearly none of you 00:33:13.500-->00:33:19.750 remember him, um that's, that really goes towards our consumer education intia-initiatives and 00:33:19.750-->00:33:25.292 communities that um need this type of information to tell them to think about the information 00:33:25.292-->00:33:30.292 they are giving to co-companies, um and how to secure themselves. Um, other than that we've had a 00:33:32.917-->00:33:37.833 lot of other, or the FTC, I keep saying we because I worked there until 6 weeks ago [laughs] um, 00:33:37.833-->00:33:42.833 the er, we've had a lot of other initiatives to teach consumers about security. >>I think it's 00:33:46.792-->00:33:52.875 important to note here that this a huge task and why we are going to be continuing to engage it, 00:33:52.875-->00:33:58.292 but it's really really hard to make sure people have enough information, um out there in the 00:33:58.292-->00:34:03.750 marketplace because it is so dynamic and changes all the time. We also run identity theft 00:34:03.750-->00:34:09.625 dot gov - which is a portal we've been continually updating to make sure that people who are 00:34:09.625-->00:34:16.500 experiencing a breach, or an identity theft situation have a streamlined remediation process 00:34:16.500-->00:34:21.125 that they can uh use online. And I'm pretty happy to say that in the last year we've been able to 00:34:21.125-->00:34:25.083 update that, so that now that you can almost automatically almost walk through all the 00:34:25.083-->00:34:31.792 steps, the filing reports and and helping secure your credit, whether that's putting a freeze 00:34:31.792-->00:34:37.208 on your credit report, to actually filing a claim, um we have it, we have it all there on 00:34:37.208-->00:34:43.000 one website on identity theft dot gov. So we're always spending time and energy trying 00:34:43.000-->00:34:47.875 to get consumers the best information possible because consumers are their first best 00:34:47.875-->00:34:53.708 line of defence in an insecure world, er, but we recognize that it's a huge ongoing challenge. 00:34:53.708-->00:34:59.750 We haven't found the right mascot for it yet. [laughs] >>So, we'll take a look at the 00:34:59.750-->00:35:05.833 present, not now, not that anything in the past isn't work the FTC still continuing to do 00:35:05.833-->00:35:10.833 today, uh these are some particular initiatives the FTC has been working on. >>Er, oh 00:35:13.250-->00:35:17.958 yeah [laughs] I'm supposed to do this. [laughter]. So, um, again we've talking of the role of 00:35:17.958-->00:35:22.750 workshopping, conferences. We've been particularly focused in the last few months on working with 00:35:22.750-->00:35:26.375 [inaudible 35:23] on connected cars, we're also working generally with other government 00:35:26.375-->00:35:31.208 agencies that are, that are sort of expert regulators in their industries thinking about how to 00:35:31.208-->00:35:37.250 incorporate some of the learning of the last 25 years on privacy and security that the FTC has 00:35:37.250-->00:35:41.875 and to what they're doing. Um we work closely with the NTIA and their multi stakeholder 00:35:41.875-->00:35:46.833 processes around these issues. We, er, have very helpful information that we harmonize 00:35:46.833-->00:35:51.917 with the NIS critical infrastructure framework so that we can say, look, we're all 00:35:51.917-->00:35:56.750 advocating a process based approach to security - we call ours: start with security, um we 00:35:56.750-->00:36:01.708 have guides available to businesses about learning from our cases and are putting out 00:36:01.708-->00:36:07.792 actually blogs every Friday now that are really helpful - tips based on hypotheticals we've 00:36:07.792-->00:36:12.792 seen in investigations of data security situations that are following on our start with 00:36:12.792-->00:36:17.667 security guide, I think we're call it: stick with security, I can't remember but, um basically 00:36:17.667-->00:36:21.708 trying to get as much information about the current best practices out into the 00:36:21.708-->00:36:26.875 marketplace as quickly as we can. Um, because we, we recognize that the situation is 00:36:26.875-->00:36:33.208 always evolving, so, um we're, we're putting that out and um, we're hoping to have another 00:36:33.208-->00:36:39.417 privacy con, um, in er, next year. This a thing we started a couple of years ago, we present 00:36:39.417-->00:36:45.417 research on privacy and data security at an annual con in DC called privacy con, and I think, 00:36:45.417-->00:36:51.375 er, our our call for papers is currently open for that. And that's on our website. >>So, 00:36:51.375-->00:36:57.542 really briefly, since we're running low on time. Um, we will talk about how and why the FTC 00:36:57.542-->00:37:02.542 brings cases...um, so one one way is you can file a report. You go to FTC dot gov, you click 00:37:07.292-->00:37:12.292 on: file a consumer report. I can tell you, um, people actually read these. I actually 00:37:14.458-->00:37:19.458 read consumer complaints. They do matter and it is how the FTC brings cases. Um, I say, 00:37:21.583-->00:37:27.000 viewers, like you, ah, the security researcher com- community. The case InMobi, 00:37:27.000-->00:37:33.792 mentioned previously, ah, was actually brought because of academic researcher, research 00:37:33.792-->00:37:38.792 done by a series of researchers in France, um, we are the, the FTC brings cases through tips, 00:37:41.125-->00:37:46.458 news reports, security and privacy blogs and vulnerability reports. But really, it's you 00:37:46.458-->00:37:52.875 folks that can shape the type of cases that the FTC brings. >>And I just note that in our 00:37:52.875-->00:37:58.417 complaints system, that we do ready by the way, anybody can complain. We are also working 00:37:58.417-->00:38:02.417 closely with other organizations: state attorney generals, the better business 00:38:02.417-->00:38:07.250 bureaus that are collecting complaints as well and feeding them into our system. So we are 00:38:07.250-->00:38:12.250 trying to form as many partnerships as possible on these issues. >>So, I bet you're 00:38:14.625-->00:38:20.583 wondering - oh I have this great idea, how do I share my research? Like what really 00:38:20.583-->00:38:25.583 matters? What may matter naturally to you, is uh great, but the FTC looks for particular 00:38:28.042-->00:38:34.250 things in bringing cases. In particular they're very in repres- representations made to 00:38:34.250-->00:38:39.250 consumers, you know, screenshots of where you bought the device, software and um evidence of what 00:38:41.792-->00:38:47.958 the consumer or the user might have seen, um, if it's a vulnerability - what is it? What 00:38:47.958-->00:38:53.875 does it impact? What kind of information is at risk? And when you discuss the impact, and I 00:38:53.875-->00:39:00.208 know these are cut off but, um I think they'll be out in the world, um be creative, um don't 00:39:00.208-->00:39:05.708 just provide reasonable doub-, um don't over sell it, but provider very, er, ...real 00:39:05.708-->00:39:10.708 impact that it has on consumers. Um and the vulnerability disclosure timeline, if any, is 00:39:14.000-->00:39:19.875 really important, um and and the contents, you know, did you send them emails? You can provide 00:39:19.875-->00:39:25.750 those as well. And where do you send this? >>Yeah.. But, so just a word on that. Um, one the more 00:39:25.750-->00:39:30.458 you send the easier it is for us to figure out or recreate what it is in the first place, which 00:39:30.458-->00:39:36.458 can be really important. But secondly, um, if we decide to open an investigation, and at 00:39:36.458-->00:39:40.958 that point, the presence of that investigation becomes non- public, which means we can't say 00:39:40.958-->00:39:46.042 anything about it back out into the world because we want to keep it confidential that we're 00:39:46.042-->00:39:51.083 investigating a company, um that's because not all of our investigations result in cases 00:39:51.083-->00:39:55.958 and we don't want, er, someone to have a bad reputation just because of us opening an 00:39:55.958-->00:39:57.958 investigation on them So, we um are are a bit of a black box if we decide to open an 00:39:57.958-->00:39:59.958 investigation. >>Um, this is the email address you can email, with research, or if you're 00:39:59.958-->00:40:01.958 interested in doing research or participating with the FTC, um this is a mailbox that's 00:40:01.958-->00:40:03.958 actively, um looked at by researchers within the FTC and they'd love to hear from you. 00:40:03.958-->00:40:05.958 >>Um, and I think that's pretty much it. >>Yeah, so we hope you've gotten an overview of our 00:40:05.958-->00:40:10.958 talk of the history of the FTC, what we're doing here in the first place and a bit of flavour 00:40:23.792-->00:40:28.792 for the kinds of cases that we bring. We're hoping you can use this information to help us with 00:40:36.083-->00:40:40.833 our consumer protection mission. Um, we're serious when we say please do stay in touch, um, 00:40:40.833-->00:40:47.625 participate in our workshops, in our cons, reach out to research at FTC dot gov. Um follow us on 00:40:47.625-->00:40:52.583 twitter, um we are we are really interested in continuing the important partnership that we 00:40:52.583-->00:40:57.792 have with the Defcon community. I think we have a couple minutes for questions? Um and then if we 00:40:57.792-->00:41:02.167 don't get to all of them, we're happy to hang out in the hallway, er, yeah. >>[question 00:41:02.167-->00:41:07.667 from the audience] So recently a Danish company, er, installed bluetooth trackers amongst a 00:41:07.667-->00:41:13.917 city to track vehicular data, they could optimize routes and light timings and such, um but 00:41:13.917-->00:41:17.833 they're doing that because [indiscernible] are always broadcasting their identity 00:41:17.833-->00:41:22.833 would that be something the FTC would be interested in? If a st- if the state in the US or a city 00:41:26.458-->00:41:31.333 were to employ something like that? [indiscernible] >>Right, so the question is, um Danish 00:41:31.333-->00:41:38.292 city using bluetooth trackers to track car location um for mapping and traffic flow, 00:41:38.292-->00:41:44.625 presumably, right? Er, so, the question is would the FTC be interested. Um, yes, but we 00:41:44.625-->00:41:49.250 don't have jurisdictions over what state and local governments do because we're the federal 00:41:49.250-->00:41:54.500 government so, um, so if a government decided to do something, we don't really have 00:41:54.500-->00:41:59.375 jurisdiction over them, Um, you know, we'd stay consistent with our guidance. Tracking people's 00:41:59.375-->00:42:04.625 precise GEO location in an identifiable way is probably a thing people need to gain 00:42:04.625-->00:42:09.792 consent on, um but I'm assuming, probably the technology here is,er, well, I'm not going to 00:42:09.792-->00:42:14.667 assume anything about what is is, but it's the facts that matter, um and think we're gonna 00:42:14.667-->00:42:18.625 continue to have this conversation in a lot of communities as we think about 00:42:18.625-->00:42:24.000 how we,um, increasingly autonomous vehicles on the road, which is not altogether a bad 00:42:24.000-->00:42:29.417 thing, right? We wanna figure out how to bring this technology which has some real value into 00:42:29.417-->00:42:35.333 the marketplace while making sure people continue to have some privacy. >>Yes. >>So, uh 00:42:35.333-->00:42:40.333 two parts to the question, so first is, what are your thoughts around uh consumer class actions 00:42:52.292-->00:42:57.292 [indiscernible] and the second thing is...what- what makes it different for us [indiscernible] 00:43:03.583-->00:43:08.583 class action lawsuit, should that mean [inaudible]. >>Yes. Okay, when they, the FTC, I'll 00:43:13.625-->00:43:17.750 answer questions where they're what are your thoughts on consumer class action lawsuits 00:43:17.750-->00:43:22.750 and why are we not going to private law firms to uh bring cases, on on behalf of simi - 00:43:25.292-->00:43:31.125 similarly situated class do ga - to get them money because you get money from private class 00:43:31.125-->00:43:36.125 actions. So, one, I will debunk that. The FTC when they receive money from er, individual cases, 00:43:39.708-->00:43:46.667 uh we actually don't keep that, it goes to consumers. Um one case in particular was butter, 00:43:46.667-->00:43:53.500 was against butterfly labs, um and the money they paid ended up being restitution for consumers 00:43:53.500-->00:43:58.500 that filed a claim. Um so one, so so that's positive. Er, two, uh class action attorneys are 00:44:01.083-->00:44:06.083 generally limited by arbitration clauses, um for particular types of violations, um the FTC, 00:44:10.583-->00:44:15.583 luckily can can bring cases, um on behalf of consumers, without having to kind of...deal with 00:44:17.833-->00:44:22.833 arbitration, it's also very expensive, um for A for some consumers, um and so you have to 00:44:25.583-->00:44:31.042 take on the depositions and everything that needs to be...part of that. [calling out 00:44:31.042-->00:44:34.792 in audience] >>I mean, I think we're here talking about the FTC because it's the agency we know 00:44:34.792-->00:44:39.292 well, but there's more than one solution out there for consumers and of course there's state 00:44:39.292-->00:44:43.208 attorney generals who are excellent and doing terrific work as well and we partner with 00:44:43.208-->00:44:47.208 them. Right, they're about to haul us off stage so congratulations Whitney on your 00:44:47.208-->00:44:51.875 first Defcon talk and I- >>Aw, thank you. Thank you everyone. [applause]