1 00:00:00,000 --> 00:00:05,520 Our next speaker is a Supervisory Special Agent with the Federal Bureau of 2 00:00:05,520 --> 00:00:12,140 Investigations, Weapons of Mass Destruction, Directorate Biological Countermeasures Unit. I 3 00:00:12,140 --> 00:00:20,560 found the Fed, I get a shirt. A little fun fact, he is also a big Star Trek fan and is a 4 00:00:20,560 --> 00:00:27,480 molecular biologist and biochemist originally. So here to present on his talk, Biotechnology 5 00:00:27,480 --> 00:00:31,460 Needs a Security Patch. Ladies and gentlemen, please welcome Ed Yu. 6 00:00:36,960 --> 00:00:42,120 So good afternoon. Let me start off by saying I consider it a real privilege and an 7 00:00:42,120 --> 00:00:47,200 honor to be able to speak at DEF CON and at the Biohacking Village in particular. And in the 8 00:00:47,200 --> 00:00:50,320 interest of time I'll just go ahead and launch right into it in order to save some time for 9 00:00:50,320 --> 00:00:55,300 questions and answers at the end. But very quickly, and this is very appropriate because a 10 00:00:55,300 --> 00:00:57,420 couple of hours ago there was a talk. 11 00:00:57,480 --> 00:01:01,840 There was a talk on DIY bioweapons and if there's anybody out there who's supposed to be 12 00:01:01,840 --> 00:01:07,000 protecting you all against biological weapons, it's us. We're one of the bigger players. I'm 13 00:01:07,000 --> 00:01:11,240 part of the WMD Directorate, the Weapons of Mass Destruction Directorate. It is one of the 14 00:01:11,240 --> 00:01:16,220 newest divisions within the FBI and it was born unfortunately out of the events of the 9-11 15 00:01:16,220 --> 00:01:21,980 attacks. And if you all recall, we, you know, the U.S. has a dubious honor of being the one 16 00:01:21,980 --> 00:01:27,460 country that actually had a bioterrorism event. Literally one month after 9-11 we had the 17 00:01:27,480 --> 00:01:34,700 anthrax mailings that not only rocked the U.S. but it rocked the FBI in particular. And it 18 00:01:34,700 --> 00:01:39,820 shifted us from being not only a law enforcement investigative agency where we go in after the 19 00:01:39,820 --> 00:01:45,080 fact, where a crime has been committed, we go in, collect the evidence, find the perpetrator. 20 00:01:45,300 --> 00:01:50,620 That's all inherently reactive. Our priority, our number one priority now is one of prevention 21 00:01:50,620 --> 00:01:56,620 and how do we stop another 9-11 from happening again. And in particular for my program is how do 22 00:01:56,620 --> 00:01:57,460 you prevent that? 23 00:01:57,480 --> 00:02:03,600 The life sciences from being exploited and abused for offensive criminal purposes. Key point, 24 00:02:03,900 --> 00:02:08,660 there actually is a position within the FBI called WMD Coordinators. It's kind of a kick-ass 25 00:02:08,660 --> 00:02:14,160 title. But these are really the cornerstone of our programs. These are special agents, men and 26 00:02:14,160 --> 00:02:18,940 women that are trained in chemical, biological, radiological and nuclear matters. And the 27 00:02:18,940 --> 00:02:22,520 reason why they're the strength of the program, there's at least one of these agents stationed in 28 00:02:22,520 --> 00:02:27,460 each of our 56 field offices across the U.S. So their job is to set up, you know, the 29 00:02:27,460 --> 00:02:31,900 linkages and partnerships with state and local law enforcement, with public health. And 30 00:02:31,900 --> 00:02:37,160 ultimately their number one priority is to go out and develop partnerships with universities, with 31 00:02:37,160 --> 00:02:42,200 companies in their jurisdiction, including the biohacker community. So there are a lot of 32 00:02:42,200 --> 00:02:46,920 community labs across the U.S. who have heard of our message and has met. And one of the 33 00:02:47,520 --> 00:02:51,740 recommendations is, hey, find out who your friendly local neighborhood WMD coordinator is and 34 00:02:51,740 --> 00:02:57,360 invite them out for a beer. But that's how we've been effectively trying to make sure that we protect 35 00:02:57,460 --> 00:03:04,820 the life sciences. And don't worry, I'm not going to bore you to death on this one slide, but this is 36 00:03:04,820 --> 00:03:11,080 just, there actually are federal criminal statutes dealing with biology specifically. And if you 37 00:03:11,080 --> 00:03:14,780 just look at the first one, it's a crime to possess a biological agent, toxin or delivery system 38 00:03:14,780 --> 00:03:19,980 for use as a weapon. So if you have possession of a particularly dangerous biological agent, a 39 00:03:19,980 --> 00:03:26,800 virus, a bacteria, a toxin, and you perpetrate an attack, that's the focus of the whole statute. It's 40 00:03:26,800 --> 00:03:27,140 the intent. 41 00:03:27,600 --> 00:03:33,080 If the intent is to perpetrate an attack, you're in violation of this crime. But the only reason why I 42 00:03:33,080 --> 00:03:38,680 show this is that this is only looking at historically, for the last several decades, when we talk 43 00:03:38,680 --> 00:03:43,580 about bio threats, it's always about the dangerous bugs or the toxins. And I want to spend this 44 00:03:43,580 --> 00:03:50,480 afternoon to talk to you about where biotech is taking us. This is no longer sufficient. So here's 45 00:03:50,480 --> 00:03:54,660 where things get a little bit interesting, where biotech is taking us. This paper came out almost 46 00:03:54,660 --> 00:03:57,440 two years ago now, where in China, they used biotech as a means of protecting the environment. And 47 00:03:57,440 --> 00:04:03,800 they used gene editing. It's a very powerful molecular biology tool now that is fueling synthetic 48 00:04:03,800 --> 00:04:10,260 biology. It's going to be utilized by the biohacking communities. It's a very powerful beneficial tool. 49 00:04:10,660 --> 00:04:18,440 And here, the Chinese actually announced that they modified human embryos. And that shocked 50 00:04:18,440 --> 00:04:24,140 everybody. I mean, this caused a flurry of policy discussions around the world. And then on top of 51 00:04:24,140 --> 00:04:27,420 that, just last year, you had the former director of the Institute of Biopharmaceutical and Biological 52 00:04:27,420 --> 00:04:32,840 Engineering of the U.S. National Intelligence Organization classifying gene editing the 53 00:04:32,840 --> 00:04:39,020 equivalent of a WMD. So here you have, he listed the top ten threats. Right there, up there, was 54 00:04:39,540 --> 00:04:44,840 North Korea and their nuclear program, Iran and their nuclear program, and gene editing. And to be 55 00:04:44,840 --> 00:04:52,340 honest with you, what? But that's the whole focus, is the whole focus on here, biotech is developing 56 00:04:52,340 --> 00:04:56,980 some really powerful tools. And, oh, God, someone out there is going to engineer the next zombie 57 00:04:57,420 --> 00:05:03,620 apocalypse-causing virus. Okay, that's a little bit of a concern. But because of those one or two 58 00:05:03,620 --> 00:05:12,140 specific trees, we're missing an entire forest. And, by the way, let me back up one real quick. If 59 00:05:12,140 --> 00:05:16,740 you look at that one paper, though, even the Chinese admitted that the work that they did on the 60 00:05:16,740 --> 00:05:22,760 human embryos, it was crappy. The efficiency was really bad. And one of the things they realized 61 00:05:22,760 --> 00:05:27,400 that to counter, to make things like gene editing work better in the future, they need to 62 00:05:27,420 --> 00:05:33,360 more data. They need more genetic information to make targeting more efficient. So the takeaway 63 00:05:33,360 --> 00:05:37,280 for me here is not the zombie apocalypse. The takeaway from here is, this is an indication that 64 00:05:37,280 --> 00:05:45,080 it incentivizes gathering more biological data to make tools like this more effective. So what 65 00:05:45,080 --> 00:05:50,300 do I mean by that? Well, this, this is you. And I don't mean this as a commentary on your 66 00:05:50,300 --> 00:05:57,340 personal hygiene. But if you think about it, this is us, because you leave DNA everywhere. 67 00:05:57,420 --> 00:06:04,060 Like, you throw away the plastic water bottle you just drank from. Spit out a piece of chewing gum. 68 00:06:04,200 --> 00:06:08,300 Throw away a cigarette butt. Use a plastic fork you toss away. Even the seats you're sitting in. 69 00:06:08,360 --> 00:06:14,780 You're leaving a bit of yourself. DNA is everywhere. And that is actually very specific biological 70 00:06:14,780 --> 00:06:20,020 data. And it's getting more and more accessible, not just in what you slough off. But the first 71 00:06:20,020 --> 00:06:25,300 time an entire human person, an individual's DNA was sequenced was in 2002, the Human Genome 72 00:06:25,300 --> 00:06:27,400 Project. That took over ten years. And that's a lot of data. And that's a lot of data. And that's 73 00:06:27,420 --> 00:06:33,860 3.5 billion dollars to sequence one person's DNA. The technology today, you can sequence 74 00:06:33,860 --> 00:06:39,140 all of your DNA in one day for about 600 bucks. And I think in about a year or two it's gonna 75 00:06:39,140 --> 00:06:44,520 be about $200 to sequence all of your DNA. And so right now we are generating massive 76 00:06:44,520 --> 00:06:50,400 amounts of DNA, uh, genetic information. It also comprises of the data footprint you leave 77 00:06:50,400 --> 00:06:53,900 when you go visit a doctor's office. It's your medical records. It's your family history. 78 00:06:55,620 --> 00:06:57,220 The private sector's developing 79 00:06:57,220 --> 00:07:02,720 an interesting data profile on who you are. When you download an app, this DEF CON among 80 00:07:02,720 --> 00:07:08,960 any other place is painfully recognizing that, you know, what rights are you allowing these 81 00:07:08,960 --> 00:07:12,460 different companies when you download an app to have access to your contact list, your 82 00:07:12,460 --> 00:07:19,160 caller activity? They're using that information for some, yes, some beneficial and some profitable 83 00:07:19,160 --> 00:07:24,960 ways, but do you realize what you're agreeing to when you sign on to that? Wearable tech. 84 00:07:24,960 --> 00:07:30,740 You know, you have your Fitbit or your Jawbone and you upload your daily activity into their 85 00:07:30,740 --> 00:07:35,180 corporate clouds. There's a reason why that's going to be intriguing, not just only for 86 00:07:35,180 --> 00:07:41,180 your individual health, but I'll talk a little bit more about that later. And even social 87 00:07:41,180 --> 00:07:45,080 media is looking at the potential health, the biological applications of the data, because 88 00:07:45,080 --> 00:07:49,940 when you put in an entry, that's timed, date stamped, and geotagged. So that's actually 89 00:07:49,940 --> 00:07:54,820 going to be kind of interesting. And a good shining example of that is the near and 90 00:07:54,820 --> 00:07:54,940 present. 91 00:07:54,940 --> 00:08:00,680 Precision and personalized medicine. So this is happening as we speak, that when you go 92 00:08:00,680 --> 00:08:04,140 into a doctor's office pretty soon, when you need, require medical treatment, the first 93 00:08:04,140 --> 00:08:07,620 thing they're probably going to do is do a data dump. They're going to look at your 94 00:08:07,620 --> 00:08:10,480 genetic information. They're going to look at your family records, your medical history. 95 00:08:11,080 --> 00:08:15,620 And this is happening in order to treat existing disease states. So if you go in as a cancer 96 00:08:15,620 --> 00:08:20,660 patient, they'll do a DNA sequence and based on your genetic profile, that'll determine 97 00:08:20,660 --> 00:08:24,400 what your chemotherapy cocktail will look like. So we're starting to see that already. 98 00:08:24,400 --> 00:08:28,760 But the real brass ring, the goal is how do you stop disease from happening in the 99 00:08:28,760 --> 00:08:33,500 first place? And that's where all the other data comes in. That if you identify the risk 100 00:08:33,500 --> 00:08:38,960 factors, maybe you can counter it and stop it now in its tracks before the disease, before 101 00:08:38,960 --> 00:08:44,200 the medical condition manifests itself. That's the whole goal of how do we get customized 102 00:08:44,200 --> 00:08:48,000 specific treatment for your condition, but even better, how do we stop it from happening 103 00:08:48,000 --> 00:08:54,000 in the first place? And here's a good example of data in action. This is a U.S.-based company. 104 00:08:54,000 --> 00:08:58,440 It's one of those DNA diagnostic services. You pay a monthly service, subscription fee. 105 00:08:58,820 --> 00:09:05,140 You submit a DNA sample. They'll sequence it. And they provide you some regular information. 106 00:09:05,300 --> 00:09:09,180 So for like the women in the room, they'll identify for you what BRCA, the BRCA gene 107 00:09:09,180 --> 00:09:13,460 variant you have. And that'll determine your risk of developing potentially breast cancer 108 00:09:13,820 --> 00:09:17,440 or obesity or Alzheimer's disease. This is a new thing. 109 00:09:17,680 --> 00:09:23,260 But here this company, they've published this paper that was really significant in two ways. 110 00:09:23,260 --> 00:09:28,800 That one, they identified 15 specific regions in your DNA that are highly correlated to 111 00:09:29,360 --> 00:09:34,540 severe clinical depression. And what I mean that's interesting is that it's one of the 112 00:09:34,540 --> 00:09:40,560 few times where you see such a high correlation between genetic and to a clinical state. But 113 00:09:40,560 --> 00:09:45,340 the other part that really makes this so powerful is how they got there. They had a cohort of 114 00:09:45,340 --> 00:09:52,880 450,000 individuals. So 450,000 of these subscribers provided their genetic information and volunteered 115 00:09:53,260 --> 00:09:58,960 their medical history, their family history, and using all that data is how they were able to find this correlation. 116 00:09:59,380 --> 00:10:04,580 This is how precision medicine works. It's finding all the data, looking at it in the massive scale. 117 00:10:04,720 --> 00:10:09,920 It's straight-up statistics, right? The bigger the data set you have, the more reliability 118 00:10:10,320 --> 00:10:15,360 or fidelity you're going to have in your results. So bottom line if I go in as a patient, you can have 119 00:10:15,360 --> 00:10:20,760 every single piece of data about who I am. It means nothing in isolation. How this works is now you 120 00:10:20,760 --> 00:10:23,240 compare me to a population data set. And now I can look at these data sets and measure in what the 121 00:10:23,740 --> 00:10:28,640 So look at how many other people are like Asian, male, my age range, my lifestyle. 122 00:10:29,040 --> 00:10:30,020 Look at the similarities. 123 00:10:30,020 --> 00:10:30,900 Look at the differences. 124 00:10:31,000 --> 00:10:33,680 And that will dictate what the treatment is going to be. 125 00:10:34,060 --> 00:10:37,480 And by the way, all those companies out there that you are now seeing advertising a lot, 126 00:10:37,540 --> 00:10:39,060 saying, hey, look at your genealogy. 127 00:10:39,160 --> 00:10:40,100 What ethnicity are you? 128 00:10:40,140 --> 00:10:41,540 And all these type of diagnostic services. 129 00:10:42,380 --> 00:10:45,340 When you subscribe, they don't make money off of that. 130 00:10:45,380 --> 00:10:46,400 In fact, they lose money. 131 00:10:46,560 --> 00:10:47,760 It's not profitable for them. 132 00:10:47,820 --> 00:10:50,520 How they're going to make their return on investment is just this. 133 00:10:50,520 --> 00:10:54,440 Pharmaceutics, that when they find those correlations, they can sell this information 134 00:10:54,440 --> 00:10:59,340 to pharmaceutical, to biotech companies, and come up with the specific treatments and the drugs. 135 00:10:59,540 --> 00:11:02,660 And by the way, if you're a subscriber, you sign on. 136 00:11:02,700 --> 00:11:07,140 You sign on any rights, any claim to any products that come out of this. 137 00:11:07,300 --> 00:11:08,460 So bear that in mind. 138 00:11:08,800 --> 00:11:12,980 But the important aspect of this is that the name of the game as we speak today is 139 00:11:12,980 --> 00:11:17,660 whoever has the largest, most diverse data sets wins the day. 140 00:11:19,140 --> 00:11:20,340 Unfortunately, that means that. 141 00:11:20,520 --> 00:11:22,080 The bad guys know that, too. 142 00:11:23,120 --> 00:11:26,560 And what I'm proposing here, and this is somewhat theoretical, 143 00:11:26,720 --> 00:11:29,980 is that this is one of the reasons why you're seeing a targeting of the health care sector. 144 00:11:30,640 --> 00:11:33,120 That this is not ransomware. 145 00:11:33,160 --> 00:11:34,300 This is not want to cry. 146 00:11:34,500 --> 00:11:37,320 This is looking at getting access to biological data. 147 00:11:37,640 --> 00:11:42,980 So if you look at historically, the very, very large and significant health insurance company hacks. 148 00:11:44,000 --> 00:11:47,000 I don't care about the PII, the private information. 149 00:11:47,180 --> 00:11:48,180 I don't care about the insurance. 150 00:11:48,320 --> 00:11:49,520 I don't care about the credit card information. 151 00:11:50,520 --> 00:11:52,420 It's the biological data that's really important. 152 00:11:53,220 --> 00:11:59,600 Because here you have a senior level person at a university who suffered from a breach of 4.5 million patients. 153 00:11:59,900 --> 00:12:01,140 And this is a direct quote. 154 00:12:01,220 --> 00:12:02,320 Say, hey, don't worry, folks. 155 00:12:02,580 --> 00:12:05,320 It doesn't look like your credit card or financial information was impacted. 156 00:12:05,480 --> 00:12:06,580 So don't sweat it. 157 00:12:06,740 --> 00:12:10,620 But in the same breath said, but those parts of the network that contains names of birth, 158 00:12:11,040 --> 00:12:13,920 names, dates of birth, social security numbers, Medicare health identification, 159 00:12:14,280 --> 00:12:16,360 and patient diagnoses and procedures. 160 00:12:16,660 --> 00:12:17,780 Well, yeah, that was hacked. 161 00:12:17,980 --> 00:12:18,840 That was accessed. 162 00:12:20,520 --> 00:12:21,580 Forget about credit card information. 163 00:12:21,720 --> 00:12:26,240 If you get the patient diagnoses and procedures, that's to the tune of millions of people, 164 00:12:26,340 --> 00:12:30,960 their medical condition, what drugs are being provided, what treatments are being provided, 165 00:12:31,140 --> 00:12:32,240 what the schedule is. 166 00:12:32,600 --> 00:12:39,020 And oh, by the way, all these significant hacks, these companies hired their own private cybersecurity firms. 167 00:12:39,140 --> 00:12:41,800 They were Mandiant, CrowdStrike, FireEye. 168 00:12:41,940 --> 00:12:47,240 And those companies attributed all these health insurance hacks to a hacker group based in China. 169 00:12:47,460 --> 00:12:50,420 So somewhere sitting in China is all this. 170 00:12:50,520 --> 00:12:56,080 This biologically relevant data to the tune of millions of patients out there. 171 00:12:57,860 --> 00:13:04,700 But it doesn't mean that, you know, I classify that as criminal or covert acquisition of data. 172 00:13:04,860 --> 00:13:06,460 It doesn't help that we're giving it away, too. 173 00:13:06,620 --> 00:13:10,960 That as of today, we are also in the midst of an information space race, whether you knew it or not. 174 00:13:11,640 --> 00:13:14,560 And we don't, and for the most part, we don't recognize that. 175 00:13:14,780 --> 00:13:19,060 And so what I mean by giving it away, this is a snapshot of a company called BGI. 176 00:13:20,100 --> 00:13:20,500 BGI. 177 00:13:20,520 --> 00:13:22,580 BGI was formerly known as the Beijing Genomics Institute. 178 00:13:23,280 --> 00:13:24,920 They are now based in Shenzhen. 179 00:13:25,060 --> 00:13:30,580 And through the government and private support over the years, they are one of the world's largest DNA sequencing companies out there. 180 00:13:30,680 --> 00:13:32,020 So they sequence DNA fast. 181 00:13:32,220 --> 00:13:32,760 They do it scale. 182 00:13:33,020 --> 00:13:34,840 And most importantly, they do it cheap. 183 00:13:35,320 --> 00:13:40,920 And so a lot of our universities and companies have partnered or contracted BGI to do DNA sequencing. 184 00:13:41,260 --> 00:13:47,760 So for cancer research, for diabetes research, for autism research, we're sending over blood samples, tissue samples. 185 00:13:47,860 --> 00:13:49,500 And, yes, the DNA gets sequenced. 186 00:13:49,580 --> 00:13:50,160 And our scientists. 187 00:13:50,160 --> 00:13:51,660 And our doctors are getting that information. 188 00:13:52,240 --> 00:13:54,900 But at the end of the day, they have it, too. 189 00:13:55,620 --> 00:14:00,320 And I don't care, really, whatever privacy, you know, contracts or statements they have signed. 190 00:14:01,400 --> 00:14:01,980 I don't know. 191 00:14:02,100 --> 00:14:04,900 But the point being is that the data is being made. 192 00:14:05,620 --> 00:14:08,220 And the key question is who actually has access to that? 193 00:14:09,500 --> 00:14:10,800 And it's not just the U.S. 194 00:14:11,340 --> 00:14:15,420 BGI rolled out a prenatal test kit in the European Union into 16 member countries. 195 00:14:15,500 --> 00:14:18,660 So if you're an expectant mother and you're worried about the health of your child, 196 00:14:19,120 --> 00:14:20,040 currently you go through. 197 00:14:20,160 --> 00:14:26,380 And a very invasive, somewhat risky amnio where they jam a large-bore needle into your abdomen and pull out some amnio fluid. 198 00:14:26,900 --> 00:14:30,600 Well, this test kit is you just do a blood draw from the mother. 199 00:14:30,680 --> 00:14:34,580 And they'll isolate the circulating maternal and fetal DNA and sequence the DNA. 200 00:14:34,940 --> 00:14:37,760 And you get just as good a result as you would get from an amnio. 201 00:14:37,960 --> 00:14:39,680 So very cheap, very easy to do. 202 00:14:39,960 --> 00:14:45,020 And BGI, when they rolled this out in 2014, they wanted to get 400,000 pregnant women into the program. 203 00:14:45,100 --> 00:14:46,760 As of last year, they had more than 1 million. 204 00:14:47,280 --> 00:14:49,800 So all across Europe, there are more than a million mothers. 205 00:14:50,160 --> 00:14:52,280 And their children and their genetic information. 206 00:14:52,300 --> 00:14:55,320 So, yes, they find out about the health of their future child. 207 00:14:55,680 --> 00:14:59,000 But, again, somewhere sitting in China is probably that genetic information. 208 00:15:01,300 --> 00:15:02,780 And it's not just BGI. 209 00:15:02,920 --> 00:15:04,360 This is another company called Wuxi. 210 00:15:05,180 --> 00:15:15,620 Well, that fantastic story I showed you of a U.S. company utilizing that information to find a correlation between data and depression. 211 00:15:16,220 --> 00:15:19,520 Well, less than a year before they rolled out that finding, 212 00:15:20,160 --> 00:15:26,120 Wuxi, this big, giant pharma company in China, became an investor, was an investor in that company. 213 00:15:26,980 --> 00:15:28,700 So why steal it? 214 00:15:28,760 --> 00:15:33,500 Just outright invest or merge with these companies and potentially have access to that data? 215 00:15:33,740 --> 00:15:35,680 The bottom part really bothers me a lot. 216 00:15:36,140 --> 00:15:39,360 That Wuxi got their own DNA sequencing company called Nextcode. 217 00:15:39,540 --> 00:15:40,440 They were based in Shanghai. 218 00:15:40,820 --> 00:15:44,440 And this company got CLIA-CAP accredited. 219 00:15:44,500 --> 00:15:45,060 What does that mean? 220 00:15:45,160 --> 00:15:49,600 They got accredited by the College of American Pathologists and got CLIA certification, 221 00:15:50,160 --> 00:15:52,880 which means that they are HIPAA or privacy-compliant. 222 00:15:53,320 --> 00:15:56,100 So on paper, they are good to go. 223 00:15:56,880 --> 00:16:01,460 So the entire state of California is looking at outsourcing genetic testing to China. 224 00:16:02,120 --> 00:16:03,520 So think about that for a second. 225 00:16:03,620 --> 00:16:08,160 You might be a patient in California, you walk into a health clinic or a hospital seeking medical care, 226 00:16:08,260 --> 00:16:15,940 and unbeknownst to you, your samples might be being tested in either a Chinese or a Chinese-affiliated firm. 227 00:16:16,120 --> 00:16:17,160 And you don't know that. 228 00:16:17,400 --> 00:16:18,800 But, at least on paper, 229 00:16:18,800 --> 00:16:22,400 they are privacy-compliant, according to our existing policies. 230 00:16:24,780 --> 00:16:31,320 This is another company that acquired, I guess you would say, older generation DNA sequencing. 231 00:16:32,040 --> 00:16:36,620 They acquired a company in the U.S. that had next-generation sequencing capabilities. 232 00:16:36,940 --> 00:16:42,240 And the only reason why I highlight this is that if a foreign company comes in and, say, 233 00:16:42,320 --> 00:16:47,060 wants to buy an arm of Raytheon, Northrop Grumman, or Boeing, 234 00:16:47,300 --> 00:16:48,780 that immediately raises the question, why is that? 235 00:16:48,780 --> 00:16:50,020 Well, the reason it raises is a lot of red flags, right? 236 00:16:50,100 --> 00:16:55,540 Because that's sensitive aerospace technology, and there's a lot of oversight and review that happens. 237 00:16:55,820 --> 00:17:01,280 But if a foreign company like this company in China comes in and takes over a biological company, 238 00:17:01,420 --> 00:17:09,260 or somebody has access to DNA sequencing data, it doesn't get flagged for the same kind of oversight and review. 239 00:17:09,360 --> 00:17:12,180 It's just bio, it's just medical data. What's the big deal? 240 00:17:14,980 --> 00:17:17,540 And here's yet another company called Novigene. 241 00:17:17,660 --> 00:17:18,760 They literally only have 20 years. 242 00:17:18,780 --> 00:17:23,120 couple of years old, they bought some of the latest generation DNA sequencers and now they 243 00:17:23,120 --> 00:17:27,860 are actually one of the largest DNA sequencing companies in the world. So, and the thing 244 00:17:27,860 --> 00:17:32,860 is, those three companies I just mentioned, Novagene, WooC, and BGI, as of two months 245 00:17:32,860 --> 00:17:38,860 ago, all three are CLIA CAP accredited. All three are HIPAA compliant. And so they can 246 00:17:38,860 --> 00:17:44,120 outbid everybody out there. So my guess is that if we're not careful, the entire U.S. 247 00:17:44,120 --> 00:17:47,480 and the rest of the world might outsource genetic testing to one of these three companies. 248 00:17:49,920 --> 00:17:54,000 So it doesn't matter that if you're familiar with data sciences, you can sit on all the 249 00:17:54,000 --> 00:17:59,380 data in the world. It doesn't matter. You have to get the tools to make that data useful. 250 00:17:59,720 --> 00:18:04,520 And China shows some tells here, too, that the head of BGI suddenly announced that he 251 00:18:04,520 --> 00:18:08,820 was quitting, which shocked the entire world, because he was sitting on top of everything. 252 00:18:09,060 --> 00:18:13,260 But why? He's starting a whole new artificial intelligence and machine learning company 253 00:18:13,260 --> 00:18:16,880 to make the data useful. And here's yet another interesting tell. 254 00:18:16,880 --> 00:18:22,740 That BGI partnered with Huawei. And if you're not familiar, Huawei is the world's largest 255 00:18:22,740 --> 00:18:27,800 telecom out there. Think of Amazon Web Services and AT&T and Verizon combined, and that's 256 00:18:27,800 --> 00:18:32,580 Huawei. And yet you have a DNA sequencing company partnering with them. And it's not 257 00:18:32,580 --> 00:18:40,880 just BGI. WooC also partnered with Huawei just last year. So pretty soon, a company that's 258 00:18:40,880 --> 00:18:45,400 trying to dominate the networks and put smartphones out there that you may download, you may install 259 00:18:46,880 --> 00:18:51,000 a health kit or Fitbit app onto, they're going to be tapping into those networks, and they're 260 00:18:51,560 --> 00:18:54,920 having access to those very large genetic data streams, as well. 261 00:18:56,620 --> 00:19:02,620 So bottom line. Do we really recognize what the security implications are? And nowhere 262 00:19:02,620 --> 00:19:07,460 do I want to say that we need to come full stop on this. There's just too much progress. 263 00:19:07,580 --> 00:19:12,320 If you can cure cancer, if you can treat disease, absolutely we need that to happen. But we 264 00:19:12,320 --> 00:19:15,580 do need to see that we need to go into this with our eyes wide open, that there are some 265 00:19:15,580 --> 00:19:16,860 consequences that we need to deal with. 266 00:19:16,880 --> 00:19:21,120 We need to be taking into consideration. My program, we partner with the National Academies 267 00:19:21,120 --> 00:19:24,520 of Sciences, and we hosted a series of workshops over the last couple of years looking at this 268 00:19:24,520 --> 00:19:30,500 future bio-based economy and recognize that we're doing a lot on data security when it 269 00:19:30,500 --> 00:19:35,840 comes to privacy, not a whole heck of a lot when it comes to security. And that becomes a 270 00:19:35,840 --> 00:19:40,080 little bit of a problem. But because of this, though, it's a challenge. We have a window of 271 00:19:40,080 --> 00:19:46,180 opportunity to understand, hey, one, this is an issue. This is not, like I said, viruses, 272 00:19:46,880 --> 00:19:52,020 bacteria, or toxins. But sort of the meme that I'm trying to get started is, for our lack of 273 00:19:52,020 --> 00:19:57,280 foresight, if we're not careful, they corner the global pharmaceutical market based on our data 274 00:19:57,280 --> 00:20:02,300 and everybody else's, then the U.S. might become health care crack addicts and China might 275 00:20:02,300 --> 00:20:07,600 become our pusher. And if that happens, is that okay from a security standpoint? And I don't 276 00:20:07,600 --> 00:20:12,380 mean to be completely China-bashing all the time. It's just that they are the most blatant 277 00:20:12,380 --> 00:20:16,860 players. But I guarantee you that as data becomes more and more important, we're going to have to 278 00:20:16,880 --> 00:20:20,840 make sure that it becomes more a commodity that everybody's going to go out and try to grab as 279 00:20:20,840 --> 00:20:26,420 much data as they can to see how they can monetize it. And once it becomes a commodity, you're 280 00:20:26,420 --> 00:20:31,680 going to have all kinds of security considerations to think about. So with that, you know, I'm 281 00:20:31,680 --> 00:20:37,140 an FBI agent. I deal with biological WMDs. And yet here I am speaking at DEF CON, which, 282 00:20:37,200 --> 00:20:42,600 again, hats off to Nina and the invitation. This is really, truly a privilege. And even a few 283 00:20:42,600 --> 00:20:46,860 months back to South by Southwest where you're seeing the cutting edge of innovation and the 284 00:20:46,880 --> 00:20:52,620 investment. This is where the economy, not only in the U.S., but globally is going. And do we 285 00:20:52,620 --> 00:20:58,120 really, really understand what the security implications are? So with that, I just wanted to 286 00:20:58,120 --> 00:21:04,060 tell you that there's so much promise in this field in biotech that all of you are going to be a 287 00:21:04,060 --> 00:21:09,660 part of this, either willingly or not. But at the same time, how can we potentially recognize this 288 00:21:09,660 --> 00:21:14,360 as an issue and then how can we be part of the solution to address these new challenges? So with 289 00:21:14,360 --> 00:21:16,860 that, thank you. And I think I have a little bit of time for questions. 290 00:21:16,880 --> 00:21:18,160 Right? All right. Thank you very much. 291 00:21:27,200 --> 00:21:46,860 Hello? Is this work? Shout? Oh. Hello? Oh, okay. To sort of combine the whole WMD 292 00:21:46,880 --> 00:21:56,680 with the data is a commodity and hacking, do you guys look at, what if say, some foreign entity 293 00:21:56,680 --> 00:22:06,540 hacks this vast store of data, gets access to this data and then uses it to either one, target a 294 00:22:06,540 --> 00:22:14,580 specific population based on their genetic data? Or conversely, target a vast area of the 295 00:22:14,580 --> 00:22:16,980 the population based on the genetic data. 296 00:22:17,220 --> 00:22:18,460 Yes, thank you, I appreciate that. 297 00:22:18,540 --> 00:22:21,200 That always comes up, and that actually was brought up 298 00:22:21,200 --> 00:22:24,520 two talks ago about the DIY biological weapons. 299 00:22:24,740 --> 00:22:27,060 And again, it goes back to somebody making the engineering 300 00:22:27,060 --> 00:22:29,740 the zombie apocalypse of virus 301 00:22:29,740 --> 00:22:31,400 and targeting a specific ethnic group. 302 00:22:33,060 --> 00:22:35,080 Yeah, you're always gonna have a discussion that includes 303 00:22:35,080 --> 00:22:37,160 that, but I'm gonna turn that around a little bit. 304 00:22:37,580 --> 00:22:41,440 So, look at where the incentives are going to be, 305 00:22:41,500 --> 00:22:42,440 like I mentioned before. 306 00:22:42,640 --> 00:22:43,940 So, it's in their best interest. 307 00:22:43,940 --> 00:22:46,800 So, if you look at China or the Southeast Asian region 308 00:22:46,800 --> 00:22:50,300 just in general, they are faced with a clear 309 00:22:50,300 --> 00:22:51,340 and present danger of emerging 310 00:22:51,340 --> 00:22:52,840 and re-emerging infectious disease. 311 00:22:53,760 --> 00:22:55,780 Influenza, it's percolating in their background. 312 00:22:56,040 --> 00:22:58,720 It's not a matter of if, it's when. 313 00:22:58,900 --> 00:23:01,700 We had a 2009 H1N1 pandemic, right? 314 00:23:01,820 --> 00:23:03,880 It's gonna happen again, I guarantee you that. 315 00:23:04,880 --> 00:23:06,800 But theoretically speaking, though, 316 00:23:07,520 --> 00:23:09,540 theoretically speaking, you could potentially, 317 00:23:09,620 --> 00:23:12,140 if you have enough population data all around, 318 00:23:12,860 --> 00:23:13,920 next time you get hit by a virus, 319 00:23:13,920 --> 00:23:14,600 if you get hit with a pandemic, 320 00:23:14,820 --> 00:23:17,900 you can probably engineer, manufacture a vaccine 321 00:23:18,480 --> 00:23:20,940 that may be more specific for your own population 322 00:23:21,360 --> 00:23:23,800 and just sit back and let the rest of the world get sick. 323 00:23:24,320 --> 00:23:26,180 That's almost as good as an offensive capability, 324 00:23:26,400 --> 00:23:27,680 but it's far more an incentive 325 00:23:27,680 --> 00:23:29,020 to want to do that for yourself. 326 00:23:29,440 --> 00:23:32,240 Either, or sell it to the rest of the world 327 00:23:32,240 --> 00:23:33,640 at an incredible markup. 328 00:23:33,960 --> 00:23:36,060 Either way, they hold all the levers. 329 00:23:36,420 --> 00:23:39,380 And again, it comes back to this is not privacy, 330 00:23:39,580 --> 00:23:41,420 this is not germ warfare per se, 331 00:23:42,040 --> 00:23:43,600 although it has an aspect of it, 332 00:23:43,920 --> 00:23:45,620 it's a whole spectrum of risk that we're not thinking about. 333 00:23:45,720 --> 00:23:47,820 What does it mean that if some are out there, 334 00:23:48,460 --> 00:23:50,680 they can figure out what your future medical fate 335 00:23:50,680 --> 00:23:51,720 or those of your family members 336 00:23:51,720 --> 00:23:53,220 or those of your children, what it might be? 337 00:23:53,800 --> 00:23:55,440 Can you imagine right now that when you buy stuff 338 00:23:55,440 --> 00:23:59,660 from Google or Amazon, you get bombarded with emails saying, 339 00:23:59,740 --> 00:24:00,920 hey, based on your purchase history, 340 00:24:01,020 --> 00:24:02,020 you might be interested in this. 341 00:24:02,800 --> 00:24:05,900 That's all machine learning based on your pattern of activity. 342 00:24:06,140 --> 00:24:07,540 Well, what happens if someone out there 343 00:24:07,540 --> 00:24:09,980 has that type of information about you biologically? 344 00:24:10,940 --> 00:24:13,080 And say, hey, you might be vulnerable 345 00:24:13,080 --> 00:24:14,340 to this particular disease. 346 00:24:15,660 --> 00:24:17,860 We're the only ones that can provide this to you. 347 00:24:18,320 --> 00:24:20,480 That becomes an incredible hook. 348 00:24:20,720 --> 00:24:23,920 And again, this goes so much beyond the individual, 349 00:24:24,560 --> 00:24:28,280 looking at what's the impact on our economy or economies, 350 00:24:28,600 --> 00:24:31,420 and then looking at what does this do for our biodefense 351 00:24:31,420 --> 00:24:35,860 or also destabilization on our current foreign trade 352 00:24:35,860 --> 00:24:36,340 agreements. 353 00:24:36,980 --> 00:24:42,280 If you promise I won't target your finished IP, data today, 354 00:24:42,280 --> 00:24:45,100 it may not mean that much because you don't have the tools 355 00:24:45,100 --> 00:24:45,800 to make it useful. 356 00:24:46,120 --> 00:24:49,400 And if someone out there will take it, but two years, 357 00:24:49,500 --> 00:24:51,840 five years, 10 years from now, as soon as we develop this, 358 00:24:51,940 --> 00:24:54,140 all of a sudden, that data becomes incredibly valuable. 359 00:24:54,720 --> 00:24:56,540 But we're not thinking about it that way. 360 00:24:56,640 --> 00:24:57,960 We're looking at the finished product. 361 00:24:58,140 --> 00:25:00,260 And I think that's too short-sighted on our part. 362 00:25:00,400 --> 00:25:02,200 And because of that, we're leaving our size 363 00:25:02,200 --> 00:25:03,400 wide open to be blindsided. 364 00:25:03,780 --> 00:25:08,140 So sorry, long-winded answer to your question, but it is true. 365 00:25:08,240 --> 00:25:11,760 You bring up at one point, that's one aspect, but there's 366 00:25:11,760 --> 00:25:14,000 a whole other range of issues that we haven't taken 367 00:25:14,000 --> 00:25:15,000 into consideration yet. 368 00:25:16,700 --> 00:25:17,560 All right, thank you, everyone.