1
00:00:00,000 --> 00:00:08,160
Our next speaker here, Trey Fogetti, is here to talk about the challenges of user privacy in a location-sensitive system like 911.

2
00:00:08,640 --> 00:00:11,300
He's part of the 911 Association.

3
00:00:11,800 --> 00:00:23,320
This talk is being recorded to show it online later on, so if anyone has any questions, please walk down to the microphone at the center aisle and we can record the questions too.

4
00:00:23,320 --> 00:00:25,260
So without further ado, Trey.

5
00:00:25,940 --> 00:00:29,500
Thank you so much, and thank all of you for being here this afternoon.

6
00:00:29,500 --> 00:00:32,360
I know your time at DEF CON is precious.

7
00:00:32,740 --> 00:00:43,260
And I will say for my part, I very much want to make this talk a lot less formal and a lot more interactive than some of the talks that you'll see in the other tracks.

8
00:00:43,260 --> 00:00:48,540
So if you have at some point a question about anything that I'm saying, please don't wait until the end.

9
00:00:48,540 --> 00:00:54,180
Come up to the microphone, and as soon as I get to a convenient pausing point, I will take your question.

10
00:00:54,180 --> 00:00:59,060
Because this is a really interesting area that I'm very passionate about.

11
00:00:59,140 --> 00:01:03,080
I'm being told I can't be heard, so let me... I'm just going to hold this.

12
00:01:03,080 --> 00:01:03,660
How about that?

13
00:01:03,660 --> 00:01:04,660
Everybody hear me now?

14
00:01:04,660 --> 00:01:05,360
Good.

15
00:01:05,760 --> 00:01:13,040
So where we start is... I get a question all the time.

16
00:01:13,080 --> 00:01:17,020
So you guys at 911, you're just tracking everybody all the time, right?

17
00:01:17,020 --> 00:01:18,760
That's how you know where I am.

18
00:01:18,900 --> 00:01:21,300
And the answer couldn't be further from the truth.

19
00:01:21,300 --> 00:01:24,760
We are not tracking you at any time.

20
00:01:24,760 --> 00:01:32,240
In fact, you would almost be appalled at how little location data we do get when we want to find you, which is when you call 911.

21
00:01:32,320 --> 00:01:56,940
So my talk is going to go over a little bit about what we do get, when we get it, how we are actually part of the privacy solution by virtue of keeping people who want access to location data away from it when they shouldn't have it, and how we acquire and store and use location data when you make it available by calling 911.

22
00:01:57,120 --> 00:02:03,580
So at the outset, I think I want to start with just a quick thing about how location works.

23
00:02:03,660 --> 00:02:08,100
Are folks here familiar with how GPS works, like generally?

24
00:02:08,900 --> 00:02:12,100
Okay, I'm going to go into it just kind of at a very high level.

25
00:02:12,100 --> 00:02:20,980
So basically, a few thousand miles up, we have a constellation of 30-odd satellites orbiting the Earth, roughly every 90 minutes.

26
00:02:20,980 --> 00:02:27,060
And each one of them is singing a unique song, but they're singing it on the same frequency.

27
00:02:27,280 --> 00:02:38,860
And by singing the same song inside a receiver, essentially, you can find out how far off in time your song is from the one being sung by the satellite.

28
00:02:38,860 --> 00:02:41,080
And that tells you a time offset.

29
00:02:41,080 --> 00:02:59,120
So we multiply that by the speed of light, correct for things like the diffraction of the ionosphere that delays these signals, and then once we have ranging from multiple satellites, then your device can calculate its location in 3D space.

30
00:02:59,120 --> 00:03:01,440
Now, it's pretty good horizontally.

31
00:03:01,440 --> 00:03:08,160
GPS, in the best of cases, can give us 5 to 10 meter fixes most of the time.

32
00:03:08,160 --> 00:03:19,980
If you have a really good device with a great antenna and, you know, a multi-band receiver, and you leave it stationary for a very long time, you can get that down to like a tenth of a meter reliably, or better.

33
00:03:20,020 --> 00:03:32,340
But for this typical case of something that's cheap enough to put in a smartphone, and for us to carry around with us every day, and, you know, doesn't have a gigantic antenna sticking out the end of it, that's not really the reality.

34
00:03:32,340 --> 00:03:34,660
You're not going to get anything nearly that close.

35
00:03:35,220 --> 00:03:41,760
So, historically, we've had this problem of we need to find people when they call 911, so how are we going to do that?

36
00:03:41,760 --> 00:03:43,600
Well, in the wireline world, it was easy.

37
00:03:43,600 --> 00:03:47,040
We knew where the telephone company's wires went.

38
00:03:47,040 --> 00:03:50,900
They kept a billing database that said, you know, here's where our wires go.

39
00:03:50,900 --> 00:03:59,240
And when you established phone service, we could go to them and say, look, for every address that you put in your database, you have to validate that with somebody.

40
00:03:59,240 --> 00:04:11,200
It's something called the Master Street Address Guide for your locality, which is a table that contains all of the valid street names and all of the valid number ranges within those street names.

41
00:04:11,540 --> 00:04:14,120
And so they could submit that address, make sure that it was valid.

42
00:04:14,120 --> 00:04:21,160
If it wasn't, they had to go back to you and say, hey, it looks like your street doesn't exist, or potentially your number's out of the range.

43
00:04:21,160 --> 00:04:21,900
Like, what happened?

44
00:04:21,900 --> 00:04:22,960
Did somebody build something new?

45
00:04:22,960 --> 00:04:25,240
And if that's the case, okay, we've got to go fix the database.

46
00:04:25,300 --> 00:04:26,300
But there was a process.

47
00:04:26,300 --> 00:04:27,500
We knew where everything was.

48
00:04:27,620 --> 00:04:28,800
Smartphones aren't like that.

49
00:04:28,800 --> 00:04:29,720
They move around.

50
00:04:29,720 --> 00:04:31,780
Cell phones generally move around.

51
00:04:31,780 --> 00:04:37,600
And so we had to come up with ways to figure out where mobile devices were.

52
00:04:37,600 --> 00:04:41,920
In the early days, there were two very general ways of doing this.

53
00:04:41,920 --> 00:04:45,620
There was called the network-based model and the handset-based model.

54
00:04:45,620 --> 00:05:06,760
In the network-based model, devices in the network either transmitted or received signals to or from a device and used information like angle of arrival, time difference of arrival, or absolute timing offsets to calculate ranging and bearing data and figure out where the device was.

55
00:05:06,760 --> 00:05:07,380
And that worked.

56
00:05:07,380 --> 00:05:08,620
It's actually very fast.

57
00:05:08,620 --> 00:05:11,180
It's one of the fastest ways to find someone generally.

58
00:05:11,180 --> 00:05:13,460
The problem is it's not terribly precise.

59
00:05:13,460 --> 00:05:22,100
With those sorts of methods, you can get within 200 to 300 meters very quickly, but you'll never get down to some tens of meters.

60
00:05:22,100 --> 00:05:23,920
It just doesn't work that way.

61
00:05:23,920 --> 00:05:34,500
So that was the typical technology in CDMA, or excuse me, in GSM networks, because in GSM networks, that was what was convenient.

62
00:05:34,500 --> 00:05:37,900
They had the right sort of signal structure to do that kind of ranging.

63
00:05:38,080 --> 00:05:48,180
CDMA had, at the time, a really cool advantage, which is when I talked about the way GPS satellites sing little songs, they're actually doing that in kind of a version of CDMA.

64
00:05:48,200 --> 00:06:04,200
All the satellites transmit on the same frequency, but they do it with different pseudo-random number sequences imposed over that, and you can pick individual satellites out by knowing which one of those are, looking up in an almanac, okay, what satellites should I be able to see,

65
00:06:04,200 --> 00:06:09,760
getting that from the constellation itself even, and using that data to figure out, okay, what should I listen for?

66
00:06:09,760 --> 00:06:19,460
Since CDMA handsets already had correlators inside that could do that for the networks they were attached to, someone had the bright idea, well, let's just reuse that as a GPS receiver.

67
00:06:19,460 --> 00:06:19,980
And it worked.

68
00:06:19,980 --> 00:06:20,760
It worked brilliantly.

69
00:06:20,760 --> 00:06:35,920
Now, the trouble was, early on, there was only one, because they only expected you to be carrying on one voice conversation at a time, so when, in the early days, they wanted to figure out where you were for 911 purposes, they actually had to say, hold on a second,

70
00:06:35,920 --> 00:06:46,540
you're going to hear silence while I determine your location, and then they would trigger, the 911 center would trigger something in the carrier network to actually start that process with your device.

71
00:06:46,540 --> 00:06:55,960
The device would listen for the satellites, collect the data, correlate it, ship it off to the network, the network would calculate your position and relay it via a database to the 911 center.

72
00:06:56,000 --> 00:07:00,240
Really kludgy, and you don't want to tell somebody in the midst of an emergency, please hold, right?

73
00:07:00,240 --> 00:07:04,000
That's not a great thing to tell someone when they're, like, screaming to death.

74
00:07:05,500 --> 00:07:14,600
So, over time, we got better, we got better chips with more correlators, we got to the point that we could actually put GPS chips in almost every phone, and these days, that's what everybody does.

75
00:07:14,600 --> 00:07:15,680
We have GPS chips.

76
00:07:15,680 --> 00:07:18,580
Most of the network technologies have sort of gone away.

77
00:07:18,580 --> 00:07:32,500
We still have two out there called Advanced Forward Link Trilateration, which is a ranging technology used mostly in CDMA networks, and then OTDOA, which stands for Observed Time Difference of Arrival.

78
00:07:32,500 --> 00:07:35,860
How many navigation nerds are there in the room who have heard of LORAN?

79
00:07:37,120 --> 00:07:39,140
Okay, we got a few people, good.

80
00:07:39,140 --> 00:07:40,980
So, this is the really cool thing.

81
00:07:40,980 --> 00:07:45,560
OTDOA is just LORAN with cell towers instead of LORAN chains.

82
00:07:45,560 --> 00:07:53,640
You just listen for the time differences between transmissions of synchronized towers, and then you can use that to do hyperbolic ranging, which is really fun.

83
00:07:53,640 --> 00:07:55,060
It's kind of a cool sort of thing.

84
00:07:55,060 --> 00:08:00,540
Again, it's one of these network technologies that are fast, but not necessarily super precise.

85
00:08:01,960 --> 00:08:06,000
All well and good, okay, fine, you've got a measurement system.

86
00:08:06,800 --> 00:08:08,340
What do we do with that now?

87
00:08:08,340 --> 00:08:11,960
In the 911 case, and I said this before, we're not tracking you.

88
00:08:11,960 --> 00:08:18,460
We don't want that stuff running all the time, because frankly we don't have anything to do with the data, and it's really not of any interest to us.

89
00:08:18,460 --> 00:08:21,460
We need to know where you are when you have an emergency.

90
00:08:21,840 --> 00:08:33,460
You don't want that going on, obviously for privacy reasons, otherwise you wouldn't be in the crypto privacy village, and you also don't want it going on because it's a very battery intensive activity to keep track of yourself precisely all the time.

91
00:08:33,460 --> 00:08:49,640
In fact, most of the things that you see, you know, this question, why is it that Uber can find me, but 911 can't, that we hear so often, I really hate this question, because like most of the time, Uber is not, Uber doesn't, hasn't measured where you are to any degree of certainty.

92
00:08:49,640 --> 00:08:57,300
They have software in your device platform and in their platform that's making a very educated guess.

93
00:08:57,320 --> 00:09:01,940
People tend to focus on the little blue dot that tells you where the thing thinks you are.

94
00:09:01,940 --> 00:09:05,680
What they often don't realize is that there's also a blue circle around that.

95
00:09:05,680 --> 00:09:16,060
There's some uncertainty associated with that location fix, and often in the case of commercial apps on smartphones, that uncertainty is actually relatively large.

96
00:09:16,060 --> 00:09:19,980
It can be on the order of hundreds or even thousands of meters.

97
00:09:20,760 --> 00:09:30,160
That's calculated at about a 90% confidence level most of the time, which we want, we want only about a 10% margin that will find you outside the circle.

98
00:09:30,160 --> 00:09:39,640
But if you think about a place like Caesar's Palace, an uncertainty of 100 meters or 200 meters makes it really difficult to find someone.

99
00:09:39,640 --> 00:09:42,020
It makes it really difficult to go search for them.

100
00:09:42,020 --> 00:09:49,740
200 meters might put me in any one of three different hotel towers, the casino, the conference center, and a bunch of restaurants.

101
00:09:49,740 --> 00:09:56,640
So you really have to deal with constraining that uncertainty somehow before you can use that for emergency response.

102
00:09:56,640 --> 00:10:01,880
Uber can make those guesses because it has that ability to then ask you, okay, where are you?

103
00:10:01,880 --> 00:10:03,060
In fact, does this match up?

104
00:10:03,060 --> 00:10:05,260
And if not, drag the map and pick the little dot.

105
00:10:05,260 --> 00:10:07,260
We don't have that luxury in 911.

106
00:10:07,900 --> 00:10:09,780
So I've said that we're not tracking you.

107
00:10:09,780 --> 00:10:11,200
Well, what are we doing?

108
00:10:11,240 --> 00:10:14,020
When you call 911, a few things happen.

109
00:10:14,020 --> 00:10:16,840
I've talked about some of the different methods that we've used.

110
00:10:17,420 --> 00:10:21,000
We're starting to add things from the handset now.

111
00:10:21,200 --> 00:10:26,980
Historically, only stuff that was baked into the baseband or the network was really available for 911.

112
00:10:27,220 --> 00:10:29,680
But these days, we're actually doing a lot more than that.

113
00:10:29,680 --> 00:10:33,760
This is bleeding-edge stuff that's just starting to come into the devices.

114
00:10:33,820 --> 00:10:49,580
But we're starting to be able to use Wi-Fi and Bluetooth both to do sort of associative location to say, look, we know that Trey's Wi-Fi access point is at this particular address in this town because he's there all the time and he's associated with that and so on.

115
00:10:49,580 --> 00:11:00,200
So if the phone can see Trey's Wi-Fi access point, that's probably a location of association that we can use as a starting point for a search.

116
00:11:00,200 --> 00:11:02,120
It's kind of a probabilistic sort of thing.

117
00:11:02,120 --> 00:11:04,880
That's a very uncomfortable proposition for 911.

118
00:11:04,880 --> 00:11:06,860
We want things to be deterministic.

119
00:11:06,860 --> 00:11:16,020
We want to be able to say to the cops and firefighters in the field who really couldn't find their way out of the building without our help that this is exactly where to go.

120
00:11:16,020 --> 00:11:17,160
But that's not realistic.

121
00:11:17,160 --> 00:11:20,500
That's just not the way the physics of measurement work.

122
00:11:20,500 --> 00:11:30,760
And that's why the other thing that we're looking at, Bluetooth beacons, you put Bluetooth low energy in a light bulb for lots of really great reasons.

123
00:11:30,760 --> 00:11:39,800
One of the things you can do with that is associate that UUID, that Bluetooth beacon ID, with that location in a database.

124
00:11:39,800 --> 00:11:55,960
We're working on something called the National Emergency Address Database, which will actually associate Wi-Fi max and Bluetooth UUIDs with physical locations in the world so that if, for example, there's a beacon in this particular ballroom, I can be localized,

125
00:11:55,960 --> 00:12:01,860
if I'm within 10 to 30 meters of that, I can be localized very, very precisely with that.

126
00:12:01,860 --> 00:12:05,180
But of course, that takes getting a lot of beacons out in the world.

127
00:12:05,180 --> 00:12:07,340
Thank you, Internet of Things, that's going to be easy.

128
00:12:07,400 --> 00:12:20,140
But then it also means we've got to track those things and make sure that if they move, we find out about it, that there's some aging in the database to make sure as things get older, we trust them less to provide location and so on.

129
00:12:20,580 --> 00:12:25,760
So at call time, when you make a 911 call, a couple of things happen.

130
00:12:25,760 --> 00:12:34,380
First off, your platform, your phone platform, whether it's Android, iOS, Blackberry, whatever, completely overrides your location privacy settings.

131
00:12:34,380 --> 00:12:40,220
It says, look, you've made a 911 call, this is really important, turn everything on, we need to find you.

132
00:12:40,220 --> 00:12:52,280
Historically, that's only meant like the GPS chip and not some of the other cool things that you have in there like the accelerometers, gyroscopes, magnetometers, barometers, Wi-Fi, Bluetooth, et cetera, but we're working to change that.

133
00:12:52,280 --> 00:13:01,160
We're actually working to get to the point where we can ingest data from all of those different things to create something called device-based hybrid.

134
00:13:01,420 --> 00:13:07,800
And this is where we use things opportunistically where they make sense.

135
00:13:07,800 --> 00:13:27,820
So GNSS, GPS, Galileo, Glonass, Compass, Baidu, all of those things work phenomenally well outdoors in urban and suburban environments and even to some extent in sort of urban clusters, not necessarily in Manhattan and San Francisco and downtown Atlanta and Chicago.

136
00:13:27,820 --> 00:13:30,660
In those places, GPS is really, really awful.

137
00:13:30,860 --> 00:13:37,580
But Wi-Fi and Bluetooth things have much higher densities in those environments and consequently they are of more use.

138
00:13:37,580 --> 00:13:44,860
And so this is the concept behind device-based hybrid is we're going to opportunistically use what is best in the environment that it's in.

139
00:13:44,860 --> 00:13:50,680
So if you're in Manhattan and the best thing we have to figure out where you are is Wi-Fi and Bluetooth, we'll use that.

140
00:13:50,840 --> 00:13:55,500
And if not, if you're out someplace where GPS is working great, we'll use that.

141
00:13:56,460 --> 00:14:00,620
All of this is just, just sort of starting to happen.

142
00:14:01,100 --> 00:14:12,960
We've had one company called Rapid SOS that built some really cool stuff to kind of get location data around the database limitations of the legacy 911 network.

143
00:14:12,960 --> 00:14:24,360
And in doing that, they've kind of proven out that you can, you can get a lot more calls clustered down in that, you know, 0 to 20 meter range with device-based hybrid.

144
00:14:24,360 --> 00:14:27,080
And, and I don't mean to like endorse Rapid or, or something like that.

145
00:14:27,080 --> 00:14:28,900
There are tons of folks working on this.

146
00:14:28,900 --> 00:14:38,340
Google just announced a few months back that they're going to be doing a lot more in their fused location provider for emergency services purposes over the next 3 or 4 years.

147
00:14:38,540 --> 00:14:40,520
Including, and this, I thought this was really cool.

148
00:14:40,520 --> 00:14:48,740
They're putting dual frequency GPS receivers in their devices, which allows you to directly measure and cancel the ionospheric diffraction delay.

149
00:14:48,740 --> 00:14:51,720
And that is the primary source of error in a GPS fix.

150
00:14:51,720 --> 00:14:59,240
So in 3 to 4 years, your handset GPS locations, indoors and out, are going to be phenomenally better.

151
00:14:59,240 --> 00:15:02,440
They, they really will just get meaningfully better.

152
00:15:03,200 --> 00:15:06,960
We're also seeing barometers go into devices, which is really cool.

153
00:15:07,320 --> 00:15:13,900
These allow us to implicitly pull out a vertical location.

154
00:15:13,900 --> 00:15:16,580
If you have, oop, I've gone dead.

155
00:15:16,580 --> 00:15:18,220
If you happen to have,

156
00:15:21,320 --> 00:15:23,800
I think so,

157
00:15:28,040 --> 00:15:30,380
hmm, oh, there we go, we're back.

158
00:15:30,380 --> 00:15:43,980
If you happen to have a barometer, and you have a good external reference for what sea level pressure is, you can use those measurements, you can compare them and say, okay, I must be this much up or down from that reference datum.

159
00:15:43,980 --> 00:15:47,580
Now, in order to do this, you've got to have measurements that are fairly localized.

160
00:15:47,820 --> 00:16:05,360
And so, you know, another example, this company, NexNav, their idea is to put sort of pseudolites or fake GPS satellites on cell towers in buildings and broadcast basically their own GPS signal down at 900 megahertz where it penetrates deep into buildings.

161
00:16:05,360 --> 00:16:17,200
And to broadcast as part of that hyperlocal barometric pressure corrections that let them pull up exactly the height that you are at with a great deal of reliability.

162
00:16:17,200 --> 00:16:18,680
Now, what do we know about 900?

163
00:16:18,680 --> 00:16:19,900
900 is the junk band, right?

164
00:16:19,900 --> 00:16:25,300
Everything awful is in there, it's completely useless other than wireless meter readers who just sit on top of everything.

165
00:16:25,420 --> 00:16:34,240
Except that the one thing that is actually privileged in 900 megahertz is multilateration and location monitoring services.

166
00:16:34,240 --> 00:16:38,220
And there are licenses and these guys happen to have a lot of them.

167
00:16:38,240 --> 00:16:48,760
There are other folks who have them for other markets, but this is like a cool thing that you can do in the 900 megahertz band and you actually get interference protection if you do this.

168
00:16:48,760 --> 00:16:51,500
So, another cool thing.

169
00:16:51,500 --> 00:16:58,240
When you make that 911 call, all of this stuff kicks on and starts saying, okay, now where are you?

170
00:16:58,440 --> 00:17:08,140
Initially, when your 911 call arrives at a 911 center, most likely we will not have good location data at the start of the call.

171
00:17:08,140 --> 00:17:27,420
What typically happens, and this is something called phase 1 and phase 2, phase 1 location is what we get at the beginning of basically every wireless call and it just tells us the street address of the cell tower that you're attached to and the GPS coordinates of the tower.

172
00:17:27,420 --> 00:17:29,440
Again, this is not you, this is the tower.

173
00:17:30,080 --> 00:17:35,440
And it tells us the central bearing of the cell sector that's serving you.

174
00:17:35,440 --> 00:17:38,280
So, if you look up at a cell tower, it's usually kind of triangular.

175
00:17:38,280 --> 00:17:40,720
It's got antennas on the vertices of the triangle.

176
00:17:40,720 --> 00:17:43,540
Each of those has a particular central bearing.

177
00:17:43,540 --> 00:17:46,300
It's serving about 60 to 120 degrees.

178
00:17:46,300 --> 00:17:54,360
And so by knowing that kind of general bearing and then asking you questions, hopefully we can figure out, if you don't know, where you are.

179
00:17:55,740 --> 00:17:58,440
The way all of that works is super kludgy.

180
00:17:58,440 --> 00:18:04,920
It actually happens because of a database process that got started in the 1980s built for the wireline world.

181
00:18:04,920 --> 00:18:12,080
And that's why before we can get your more precise location, we have to wait a period of time for a couple of processes to happen.

182
00:18:12,080 --> 00:18:22,300
So, first of all, the device has to actually calculate a fix that is better than whatever it had from the tower and so forth.

183
00:18:22,300 --> 00:18:26,060
And then it has to communicate that back to the carrier network.

184
00:18:26,060 --> 00:18:31,500
The carrier network has to pass that to a database management system provider.

185
00:18:31,500 --> 00:18:46,340
They have to further process it and implant it into the database that ultimately your local telephone company typically maintains because it was the one that they maintained for that wireline process oh so long ago.

186
00:18:47,200 --> 00:18:56,640
Then, at that point, the 911 center system either automatically or manually can re-query the database and say, okay, is there anything better?

187
00:18:56,660 --> 00:19:02,760
And typically by the 15 to 25 second mark is when we'll start to see an improvement.

188
00:19:02,760 --> 00:19:08,000
Something like a GPS fix that's within the allowable error range.

189
00:19:08,000 --> 00:19:11,320
The carriers have location targets that they have to hit.

190
00:19:11,320 --> 00:19:19,460
Ultimately, those are going to get down to 50 meters horizontally and some number vertically that we don't know exactly what it will be yet, but we're working on that.

191
00:19:19,780 --> 00:19:21,540
Or a dispatchable address.

192
00:19:21,540 --> 00:19:26,000
And dispatchable address is the process I talked about before with the database piece of it.

193
00:19:26,640 --> 00:19:34,960
Now, the one sort of worrisome part about this is those values, those location values, we know they're very sensitive.

194
00:19:34,960 --> 00:19:37,340
Those are actually transmitted in the clear.

195
00:19:37,340 --> 00:19:45,240
But they're transmitted in the clear only within trusted carrier networks and then only on the network's control plane.

196
00:19:45,240 --> 00:19:57,560
So the location information never touches the user data plane until it actually gets down to the 911 center and it is received at the start or some number of seconds into your call.

197
00:19:58,140 --> 00:20:02,900
And then at that point, we look at this as like a hot potato.

198
00:20:02,900 --> 00:20:21,300
We'll keep that, store it, as long as we have to, to provide you with service and to keep the sort of records that 911 centers are legally obliged to keep, whether it's for investigatory purposes or just because the legislature said we want everything to be kept for 90 days or 120 days.

199
00:20:21,300 --> 00:20:28,120
Some things may get archived if they look like they're going to be important down the line, but not necessarily everything.

200
00:20:28,120 --> 00:20:35,840
We typically want to get rid of non-critical 911 data that's not subject to a litigation hold as quickly as possible.

201
00:20:35,840 --> 00:20:38,120
We really just want to get that out of the system.

202
00:20:39,440 --> 00:20:49,820
This is where it gets a little interesting because obviously being in public safety, 911 is part of a lot of law enforcement responses.

203
00:20:49,820 --> 00:20:53,500
A lot of law enforcement responses start as a result of a 911 call.

204
00:20:53,500 --> 00:20:55,060
In fact, almost all of them do.

205
00:20:57,300 --> 00:21:00,600
And 911 is known for having location data.

206
00:21:00,600 --> 00:21:07,060
People in the law enforcement and fire and EMS communities know that when you call 911, we get your location data.

207
00:21:07,300 --> 00:21:21,540
And so people not unreasonably often make the assumption that, well, if I need that for some other purpose, the way I should be able to get that is by just going to my friendly neighborhood 911 outfit and saying, hey, help me out with some of that good,

208
00:21:21,540 --> 00:21:22,980
good location data, right?

209
00:21:22,980 --> 00:21:24,820
And we get those requests all the time.

210
00:21:24,820 --> 00:21:32,900
Our members actually get location data requests from law enforcement and fire and EMS often when there's no actual 911 call going.

211
00:21:32,900 --> 00:21:41,920
So I said earlier, 911 really is on the front line of protecting user privacy because often the thing we have to do is tell sometimes even the boss no.

212
00:21:41,920 --> 00:21:44,960
Because we get 911 data for a purpose.

213
00:21:44,960 --> 00:21:46,060
We use it for a purpose.

214
00:21:46,060 --> 00:21:52,660
And that's part of user trust in the 911 system is that we're not going to misuse that 911 location data.

215
00:21:53,100 --> 00:22:01,540
The other reason that these things happen from time to time is we also have access to a process for exigent circumstances.

216
00:22:01,820 --> 00:22:07,880
So if you've ever seen the movie The Call with Halle Berry, so small aside, I got to meet Halle Berry.

217
00:22:07,880 --> 00:22:09,380
She is amazing in person.

218
00:22:09,380 --> 00:22:12,880
She is even more beautiful and even more friendly and awesome and wonderful.

219
00:22:12,980 --> 00:22:21,760
And she really took a lot of time and effort to get in the trenches with real 911 call takers and learn how they do what they do, which was really awesome and cool.

220
00:22:22,160 --> 00:22:23,600
Hopefully there will be a sequel.

221
00:22:23,900 --> 00:22:30,680
But in that movie, there was this occasion where a young woman was kidnapped and thrown in a trunk.

222
00:22:31,120 --> 00:22:37,900
And she made a very, she was only able to make a quick, discreet 911 call to say, you know, help, I'm in the trunk, right?

223
00:22:38,700 --> 00:22:46,200
When that happens, we've got to have some process to get some location data when you're not on a 911 call.

224
00:22:46,200 --> 00:22:57,520
Now the challenge for us is, as I talked about before, all of the location privacy settings and all of those sensors and measurement systems are not on unless you're in a 911 call.

225
00:22:57,520 --> 00:23:04,600
So the moment you hang up, we lose the ability to query for updated location information.

226
00:23:04,660 --> 00:23:23,340
And at that point, the best we can do, and I realize this sounds insane in 2017, is fax, yes, fax, a form to the carrier that was serving that 911 call to say, we need the best location data you've got for this particular phone number.

227
00:23:23,680 --> 00:23:28,120
The turnaround time for that can be 15 to 45 minutes.

228
00:23:28,120 --> 00:23:29,960
They generally, they do take it very seriously.

229
00:23:29,960 --> 00:23:34,340
They try to get the accident circumstances request processed as quickly as possible.

230
00:23:34,340 --> 00:23:36,400
But it is still a process.

231
00:23:36,400 --> 00:23:38,280
It's not an automated kind of thing.

232
00:23:38,280 --> 00:23:40,620
It is a very manual process.

233
00:23:40,800 --> 00:23:59,520
And then what happens once the carriers, lawyers, and engineers have looked at the form and said, okay, yes, this is a valid accident circumstances request, there really is an ongoing emergency with a threat to life or property, then and only then can they start to do a little bit to help us.

234
00:23:59,520 --> 00:24:01,420
But again, you're not in a 911 call.

235
00:24:01,420 --> 00:24:03,360
They can't turn on all the sensors.

236
00:24:03,460 --> 00:24:08,840
Typically the best we can do is we fall back to that sort of phase one information.

237
00:24:08,840 --> 00:24:14,140
We can typically get, okay, what tower and sector is serving the device.

238
00:24:14,420 --> 00:24:16,640
So we get, you know, kind of a point and a bearing.

239
00:24:17,200 --> 00:24:24,420
And if we're really, really lucky, in some cases, they will also be able to give us a range estimate.

240
00:24:24,500 --> 00:24:30,280
So I talked before about, you know, GPS and the way the ranges kind of cross over and you can get a location out of that.

241
00:24:30,280 --> 00:24:34,700
Another way you can develop a location fix is with a bearing and a range.

242
00:24:34,700 --> 00:24:42,080
So that's a line and an arc and wherever they cross, that's sort of generally where you are because, again, our measurements are kind of fuzzy.

243
00:24:42,180 --> 00:24:43,980
That arc can be really wide.

244
00:24:43,980 --> 00:24:45,640
That line can be really thick.

245
00:24:45,640 --> 00:24:47,500
You get kind of an annular sector.

246
00:24:48,360 --> 00:24:50,600
But, hey, that's still useful data.

247
00:24:50,600 --> 00:24:54,340
But again, it's not data that we're getting easily.

248
00:24:54,340 --> 00:24:56,700
It's something that's very, very protected.

249
00:24:57,120 --> 00:25:00,880
And in the 911 case, when we do get that, again, that's a manual process.

250
00:25:00,880 --> 00:25:02,320
So there's no database to put that in.

251
00:25:02,320 --> 00:25:11,480
That's actually something that's done on a, you know, we're on the phone with AT&T, Verizon, Sprint, T-Mobile, somebody, saying, okay, where are they now?

252
00:25:11,760 --> 00:25:13,020
Okay, has the location changed?

253
00:25:13,020 --> 00:25:14,000
Where are they now?

254
00:25:14,280 --> 00:25:16,740
And it's this very sort of iterative manual thing.

255
00:25:16,740 --> 00:25:27,780
And eventually, hopefully, you can work out, okay, it's a car that's going down, you know, I-40 or something like that, and say, let's go try to intercept whatever that is and find somebody.

256
00:25:27,780 --> 00:25:36,760
And then, of course, immediately after that exigent circumstance passes, that location data that was used for that purpose basically has to go away.

257
00:25:36,980 --> 00:25:43,820
Because it wasn't necessarily obtained with an investigative purpose for law enforcement purposes.

258
00:25:43,820 --> 00:25:47,300
So then you've got to start thinking about, okay, do we get a subpoena?

259
00:25:47,300 --> 00:25:48,320
Do we get a warrant?

260
00:25:48,320 --> 00:26:01,660
How do we actually acquire that location data in a way that can be used for some criminal prosecutorial purpose that's not related to an immediate emergency response?

261
00:26:01,900 --> 00:26:06,960
So that's kind of the multiple phasic approach that you have within the 911 center.

262
00:26:06,960 --> 00:26:09,460
We have the sort of baseline case.

263
00:26:10,440 --> 00:26:20,180
Weirdly, I often hear people say, 112, which is the European emergency number, is really part of the global emergency calling standard, and you should use that.

264
00:26:20,580 --> 00:26:25,120
And in a lot of places, using 112 might actually get you to a 911 center.

265
00:26:25,120 --> 00:26:26,340
It might.

266
00:26:26,340 --> 00:26:28,440
It won't always, but it might.

267
00:26:28,440 --> 00:26:33,560
And if it does, the challenge, though, is it won't turn on, usually, any of that cool location stuff.

268
00:26:33,560 --> 00:26:35,560
So don't dial 112 unless you're in Europe.

269
00:26:37,460 --> 00:26:45,420
Once that location process is over with, there is sort of a residual question of, what do we do with the data?

270
00:26:45,420 --> 00:26:59,260
And I don't think we have a good answer right now, because your average 911 center is not technically sophisticated enough to be encrypting or hashing or doing things like that with those sorts of data.

271
00:26:59,260 --> 00:27:03,500
They kind of have to rely on whatever their system vendor makes available.

272
00:27:04,140 --> 00:27:09,400
And oftentimes, that doesn't include robust confidentiality and integrity mechanisms.

273
00:27:09,400 --> 00:27:10,840
But that is something we're working on.

274
00:27:10,840 --> 00:27:21,080
So the next piece of this that I want to talk about is how we will acquire and use location information in a next-generation 911 environment.

275
00:27:21,340 --> 00:27:27,260
And basically, the process still stays heavily dependent on what the device and the network knows.

276
00:27:27,260 --> 00:27:36,300
But now, instead of dealing with legacy wireline databases from the late 70s, early 80s, we're going to take this into a more IP-based realm.

277
00:27:36,300 --> 00:27:47,400
So in next-generation 911, when you dial 911 from a phone, whether that's a voice call to 911 or a video call or even a text session, we're going to have real-time text very soon.

278
00:27:47,400 --> 00:27:48,940
Or total conversation.

279
00:27:48,940 --> 00:27:57,480
If you have different accessibility needs, you'll have the ability to communicate in all of those different ways simultaneously, which is really awesome if you have a hearing or speech disability.

280
00:27:58,820 --> 00:28:01,840
At that point, you've got a couple of things that have to happen.

281
00:28:01,840 --> 00:28:08,280
First, the device needs to figure out what 911 system its call should go to.

282
00:28:08,300 --> 00:28:12,700
So it's going to query something in the access network provider's network.

283
00:28:12,700 --> 00:28:14,920
And here I want to stop and define a couple of terms.

284
00:28:16,400 --> 00:28:22,280
Historically, when you bought phone service from the phone company, you were really buying two very different things.

285
00:28:22,280 --> 00:28:25,280
But it looked like the same thing because it was all you knew.

286
00:28:25,380 --> 00:28:31,420
When you bought voice service from the phone company, you were buying, first off, a transport network.

287
00:28:31,520 --> 00:28:35,960
So that's an access network that is capable of moving things around.

288
00:28:35,960 --> 00:28:38,000
But you were also buying an originating service.

289
00:28:38,000 --> 00:28:44,500
The ability to connect from one endpoint to another endpoint using some particular address.

290
00:28:45,000 --> 00:28:49,120
Today, networks don't have to do all of those things in an integrated way.

291
00:28:49,120 --> 00:28:58,240
I can buy my access network service from, for example, AT&T, and I can buy my voice originating service from Vonage, for example.

292
00:28:59,220 --> 00:29:02,180
We have to accommodate that in the 911 system.

293
00:29:02,180 --> 00:29:07,960
We have to be able to deal with the fact that your carrier is no longer just the phone company.

294
00:29:07,960 --> 00:29:09,500
It may be somebody else.

295
00:29:09,540 --> 00:29:21,160
Historically, we have not done a good job of that because we've just bolted stuff on to the 911 systems over the years and we haven't really integrated a lot of these new technologies into the way the system works.

296
00:29:21,820 --> 00:29:24,680
So your device goes to the access network provider.

297
00:29:24,680 --> 00:29:26,140
Well, okay, why?

298
00:29:26,200 --> 00:29:29,800
Well, the infrastructure provider, they know where their wires go.

299
00:29:29,800 --> 00:29:32,440
They know where their cell towers are.

300
00:29:32,440 --> 00:29:41,620
They're the ones who have the sort of intimate, real-world, physical connection with you that can be used to start that process of localizing the call.

301
00:29:41,620 --> 00:29:45,960
So your device goes and queries their location information server.

302
00:29:46,480 --> 00:29:50,680
It gets back, currently, actually location by value.

303
00:29:50,680 --> 00:30:02,920
It gets sort of your here, generally, although we're trying to be very careful about giving that to devices because we can see a state where you might have malware on the device and you don't necessarily want to disclose location to that.

304
00:30:02,920 --> 00:30:14,840
So we're working on some cryptographic stuff to try and keep that private as well, to basically tokenize it, so that then the device can pass either that location value or that token to something called an emergency services routing proxy.

305
00:30:15,040 --> 00:30:30,500
And the purpose there is for the proxy to say to a big thing called a forest guide, which is basically a hierarchical database structure that tells you here are where all the countries in the world, what are their boundaries within those, what are the states within those,

306
00:30:30,500 --> 00:30:39,040
what are the counties within those, what are the 911 center service areas, and oh, by the way, you're there, great, you go to this 911 center.

307
00:30:39,040 --> 00:30:40,580
That's where your call should go.

308
00:30:41,060 --> 00:30:45,800
So this involves a lot of GIS processing.

309
00:30:45,920 --> 00:30:47,640
That's geospatial information system.

310
00:30:47,640 --> 00:30:50,840
I think I have a slide here that actually shows some of that.

311
00:30:50,840 --> 00:30:54,360
So we actually have a standard for geospatial information systems.

312
00:30:54,940 --> 00:31:04,900
Remember I talked about that old school way of doing the database of addresses where you have a list of street names, a table of street names, and a table of valid number ranges?

313
00:31:05,140 --> 00:31:11,660
That's all well and good if you only need to locate people in like row houses, but what if you have an apartment building?

314
00:31:11,660 --> 00:31:13,840
How do we know that a floor number is valid?

315
00:31:13,840 --> 00:31:16,180
How do we know that a room number is valid?

316
00:31:16,180 --> 00:31:22,580
And moreover, how do we decide where do all of those 911 calls within that thing go?

317
00:31:22,580 --> 00:31:31,740
For example, if I'm Caesars Palace, I might have my own, I might be a limited municipality, I might have my own response center that can get you help faster.

318
00:31:31,740 --> 00:31:35,900
We might want to route all of the calls within Caesars Palace to them instead.

319
00:31:37,240 --> 00:31:38,680
Disney World is a great example of that.

320
00:31:38,680 --> 00:31:40,860
They actually have the Reedy Creek Improvement District.

321
00:31:40,860 --> 00:31:44,700
There are like six Disney executives that have houses like on the property.

322
00:31:44,700 --> 00:31:49,960
They're the entire voting block for the whole city of Reedy Creek, and they actually have their own 911 center.

323
00:31:49,960 --> 00:31:51,520
It's like a best practice place.

324
00:31:51,520 --> 00:31:52,500
Everybody loves to hold it up.

325
00:31:52,500 --> 00:31:54,480
It's like shiny and new and a good place to go.

326
00:31:54,720 --> 00:32:04,820
But you have to be able to track those things so that you can do change management, so that you can know when somebody puts up a new building.

327
00:32:04,820 --> 00:32:07,220
How do we add that to our addressing system?

328
00:32:07,840 --> 00:32:20,940
And then once you've consulted the forest guide, it'll give you an IP address for something called the border control function of the NG911 system, next generation 911 system, that actually serves that particular location.

329
00:32:20,940 --> 00:32:34,080
At that point, the routing proxy, whether it's in your access network provider's network or if it's disaggregated in the originating service provider's network, will actually send signaling and media to that border control function.

330
00:32:34,080 --> 00:32:53,960
To me, the coolest part of all this is if at some point during the call things change and there's some reason, your location changes or whatnot, and there's some reason to redirect the call either before the setup is complete or during the call, there's actually an intelligent mechanism to say,

331
00:32:53,960 --> 00:32:58,340
hey, there's this other 911 center that might need to be involved in this response.

332
00:32:58,340 --> 00:33:01,860
Do you telecommunicator handling the call want to loop them in?

333
00:33:01,860 --> 00:33:04,340
Even if it's on a listen-only basis.

334
00:33:04,580 --> 00:33:05,920
And you can do that.

335
00:33:06,020 --> 00:33:17,060
And you also get another kind of cool capability is you can have now specialized 911 centers that deal just with particular populations that have very specific needs.

336
00:33:17,060 --> 00:33:24,240
So, for example, in Washington, D.C., we have one of the largest universities for the deaf and hard of hearing, Gallaudet.

337
00:33:24,380 --> 00:33:25,260
Great school.

338
00:33:25,260 --> 00:33:28,660
They actually do a lot of cool engineering work related to 911 stuff.

339
00:33:28,660 --> 00:33:43,020
But if you have a 911 call that's coming from just the area of the Gallaudet campus, you might want to put that into a different queue for someone who has a hot connection with an ASL interpreter or knows ASL themselves and can handle that video call that way,

340
00:33:43,020 --> 00:33:47,460
or who's trained specially to handle real-time text calls.

341
00:33:47,460 --> 00:33:55,780
And that's something in today's environment we absolutely can't do because, remember back, we're routing everything based on that cell tower and the sector.

342
00:33:55,780 --> 00:33:57,900
At the beginning of the call, that's all we know.

343
00:33:57,900 --> 00:34:05,000
In the future, the idea is we're going to route based on the actual X, Y, and hopefully Z someday from the device.

344
00:34:05,000 --> 00:34:09,980
And that makes it a lot easier to do much more granular things like that that can really help.

345
00:34:09,980 --> 00:34:11,080
It has a huge impact.

346
00:34:11,080 --> 00:34:21,280
If you're in a population that has a specific need like that, it's a really big deal to be able to get to something like that on the first try.

347
00:34:21,280 --> 00:34:32,660
Because today, one of the terrible things that happens is if you need to connect with somebody like a video interpreter, that can delay your 911 call on the order of 15 to 30 minutes.

348
00:34:32,820 --> 00:34:36,080
And that is not an amount of time you want to be waiting in an emergency.

349
00:34:37,360 --> 00:34:38,860
I've used about 40 minutes here.

350
00:34:38,860 --> 00:34:41,760
I haven't had anybody volunteer questions, so I just want to level set.

351
00:34:41,760 --> 00:34:51,100
Are there things that I've covered in insufficient depth or not covered or other things you want to hear about so that I can kind of tune the rest of the talk?

352
00:34:51,100 --> 00:34:51,640
Yep.

353
00:35:05,910 --> 00:35:06,910
Oh, it's funny.

354
00:35:06,910 --> 00:35:08,750
You think there's IP switching involved in this.

355
00:35:08,750 --> 00:35:10,270
That's very quaint.

356
00:35:10,270 --> 00:35:20,850
So the question was, when I said that location data is transmitted in the clear, what part of the sort of transactional structure was I talking about?

357
00:35:20,850 --> 00:35:27,710
So from the device to the network, it is encrypted at the level of whatever the bearer established.

358
00:35:27,710 --> 00:35:30,430
So in LTE, it would be encrypted.

359
00:35:30,430 --> 00:35:32,910
In GSM, it would be encrypted probably weekly.

360
00:35:32,910 --> 00:35:34,930
Same thing in CDMA.

361
00:35:35,410 --> 00:35:40,910
Within the carrier network, it will be segregated but not necessarily encrypted.

362
00:35:41,150 --> 00:35:45,670
And then the way it's... I know this is why I laughed about the whole IP switching thing.

363
00:35:45,670 --> 00:35:58,050
The way it's actually transmitted within the telephone company networks is as a series of either medium frequency tones or maybe DTMF in some cases.

364
00:35:58,050 --> 00:36:02,970
It's really kind of hilarious how some of this stuff still actually works.

365
00:36:03,190 --> 00:36:17,390
The data block we get with a 911 call, I think I said this in my talk the other day but it bears repeating, is 512 maximum, 512 non-extended ASCII character set letters and digits.

366
00:36:17,850 --> 00:36:18,850
And that's all.

367
00:36:18,850 --> 00:36:25,850
So when you want to represent something like a physical location, that's all you've got to work with.

368
00:36:25,850 --> 00:36:29,110
And so we've really had to figure out, okay, how do we dumb this stuff down?

369
00:36:29,110 --> 00:36:39,710
One of the big things that we're looking forward to is once we have these next-gen systems where we can protect it properly, encrypt it, and it is an IP system, is actually starting to be able to represent things graphically.

370
00:36:39,710 --> 00:36:46,010
I think I showed... here's an example of an uncertainty around a floor, for example.

371
00:36:46,770 --> 00:36:48,170
Today, we couldn't do that.

372
00:36:48,170 --> 00:37:02,130
We couldn't pull up a visualization of a building and put circles or ellipsoids or spheres or other things in there and say, look in this general area because we have no way of representing that in the 911 systems that we have.

373
00:37:02,130 --> 00:37:12,390
Now, the cool thing is, the carrier standard that makes all of this work at kind of the numerical level is something called J standard 036, I think it's an ATIS slash TIA standard.

374
00:37:12,410 --> 00:37:17,750
It actually defines the ability to send different geometric shapes.

375
00:37:17,750 --> 00:37:21,030
So I can send an ellipsoid point with uncertainty.

376
00:37:21,070 --> 00:37:24,030
I can send a point with spherical uncertainty.

377
00:37:24,030 --> 00:37:28,430
I can start to do annular segment, things like that.

378
00:37:28,430 --> 00:37:31,650
Nobody does that because, again, we don't have any way to represent it today.

379
00:37:44,080 --> 00:37:51,000
So the question was, what percentage when it comes to dispatch is sent in the clear versus encrypted or perhaps digital?

380
00:37:51,000 --> 00:37:56,660
I assume you mean... and I assume you mean the radio part.

381
00:37:56,660 --> 00:38:01,800
Okay, so the radio part of dispatch, how much of it is encrypted, how much of it is in the clear?

382
00:38:02,600 --> 00:38:04,140
Overwhelmingly, it's in the clear.

383
00:38:04,200 --> 00:38:09,200
There are places that are starting to do more encrypted communications.

384
00:38:11,320 --> 00:38:13,260
Badly, in most cases.

385
00:38:13,300 --> 00:38:21,460
If you look, Matt Blaze, Travis Goodspeed and some folks did an analysis a few years back of one, like, the dominant public safety radio standard in the U.S.

386
00:38:21,760 --> 00:38:24,500
and found that it was basically hopelessly insecure.

387
00:38:24,500 --> 00:38:35,760
They used a really weak, kind of, even more broken version of RC4 as the stream cipher in some commercial implementations that were very cheap.

388
00:38:35,860 --> 00:38:40,900
And so everybody used those, even though they weren't terribly interoperable and they're not at all secure.

389
00:38:40,900 --> 00:38:42,980
So we're in the process of trying to fix that.

390
00:38:42,980 --> 00:39:01,680
Earlier this year, the Department of Homeland Security and NIST worked together to get a requirement into the standard so that, I think, starting in 2018, going forward, all radios built to that standard will now have to have AES-256 as a mandatory part of their cipher suite.

391
00:39:01,680 --> 00:39:07,120
They can still have broken versions of RC4, but AES-256 has to be in there as well.

392
00:39:07,120 --> 00:39:11,820
And part of the reason for that is, in the public safety community, interoperability is a huge deal.

393
00:39:11,820 --> 00:39:15,600
Disasters may start local, but they usually don't stay local.

394
00:39:15,900 --> 00:39:18,540
And when they go beyond the, you know...

395
00:39:18,540 --> 00:39:23,220
Disasters don't obey jurisdictional lines, no matter how much we admonish them.

396
00:39:23,220 --> 00:39:28,380
And so eventually you've got to have help from your neighbor, and when that happens, being able to talk with them is a big deal.

397
00:39:29,120 --> 00:39:32,380
The other thing... I appreciate that question about encryption.

398
00:39:32,620 --> 00:39:38,900
The other thing that I want to raise a serious point about, though, is authentication and integrity checking.

399
00:39:38,900 --> 00:39:52,840
Because even though we are fixing the encryption problem, sort of, we're getting to a standard, we are still not doing anything about protecting radio networks from bad devices.

400
00:39:52,840 --> 00:39:55,140
So devices that don't belong there.

401
00:39:55,140 --> 00:40:06,680
So most of the radio networks today, if you know an 8-digit code that is really easy to pull off the air, you can get a radio attached to that network and start receiving traffic from it.

402
00:40:06,680 --> 00:40:08,640
It's not authenticated in any way.

403
00:40:08,640 --> 00:40:12,160
And then there are also vulnerabilities to replay attacks in these networks.

404
00:40:12,160 --> 00:40:16,280
So you don't have good integrity mechanisms either.

405
00:40:16,340 --> 00:40:17,880
So we know that's a problem.

406
00:40:17,880 --> 00:40:19,200
It's something we're working on.

407
00:40:19,200 --> 00:40:27,560
The trouble is, these are tens of million dollar networks that turn over once every 15 to 20 years.

408
00:40:27,680 --> 00:40:30,420
And the next iteration may just not happen.

409
00:40:30,420 --> 00:40:35,700
Because they're actually building an LTE network right now for first responders that's going to be nationwide.

410
00:40:35,700 --> 00:40:43,680
So there's a big debate about, well, do we even keep working on these standards, because at some point we're just going to use that, because it'll be better.

411
00:40:44,180 --> 00:40:46,240
Not necessarily soon, but someday.

412
00:40:48,320 --> 00:40:49,560
Other questions?

413
00:41:09,880 --> 00:41:14,900
So the question was, when you make a 911 call, location stuff turns on.

414
00:41:14,940 --> 00:41:22,580
Does the data that's developed as a result of that get stored on the phone in a way that it could be recovered by forensic analysis, the cops down the line or something?

415
00:41:22,580 --> 00:41:26,260
I don't know a really good answer to that question.

416
00:41:26,320 --> 00:41:31,280
The challenge is, there are so many parties involved.

417
00:41:31,280 --> 00:41:35,080
Because there are legal obligations and interests that the carriers have.

418
00:41:35,080 --> 00:41:41,180
There are very different legal obligations and interests that the handset manufacturer has.

419
00:41:41,180 --> 00:41:50,820
And even the chipset manufacturer, the folks who are putting those measurement devices, how those interface with the 911 aspect of the device can vary.

420
00:41:50,820 --> 00:41:53,000
So I don't know the answer to that, unfortunately.

421
00:41:53,080 --> 00:41:58,020
My hope would be that once the 911 call goes away, that that location data goes away as well.

422
00:41:58,040 --> 00:42:10,160
In part because in the 911 business, one of our big concerns is always, well, can we adequately protect the safety of someone who calls 911, but doesn't want a third party to know that they have.

423
00:42:10,180 --> 00:42:19,580
One tactic that we see, particularly in an abused spouse situation all the time, is somebody calling 911 and pretending to order pizza.

424
00:42:20,120 --> 00:42:31,740
And when they do that, most clever telecommunicators and dispatchers will say, you're telling me that you need to order a pizza because you wanted to call 911 and you don't want someone else to know, is that right?

425
00:42:31,740 --> 00:42:33,620
Yes, pepperoni.

426
00:42:34,060 --> 00:42:43,180
And that's the kind of thing where we don't want somebody to be able to look at the device and say, oh, you called 911 from the house, where you know you're not supposed to call anybody.

427
00:42:43,180 --> 00:42:48,780
That would be a potential information disclosure that would not be good.

428
00:42:49,200 --> 00:42:51,120
There's a question right there.

429
00:42:51,380 --> 00:42:54,840
Could you come up to the mic so that we can get this on the recording?

430
00:42:58,700 --> 00:42:59,660
Okay,

431
00:43:09,580 --> 00:43:18,060
the question was, can the location information that is collected be used to prevent things like, for example, swatting?

432
00:43:18,060 --> 00:43:23,460
I promise I did not pay him to ask that question, but that is like the best possible question you could ask.

433
00:43:24,400 --> 00:43:28,860
It is something that we have been looking at for a very long time.

434
00:43:28,860 --> 00:43:30,980
The answer is yes, absolutely.

435
00:43:31,040 --> 00:43:33,700
It should be used that way every time.

436
00:43:34,320 --> 00:43:42,720
I go through no end of amazement that people don't always check mismatches like that when there is a call.

437
00:43:42,740 --> 00:43:50,520
I do think one of the benefits of, frankly, having humans in the loop for 911 calls, is that rather cleverly a lot of the time they do say that.

438
00:43:50,520 --> 00:44:00,160
They'll say to somebody, look, before you go full swat on Brian Krebs again, maybe let's make sure that this call is actually coming from there.

439
00:44:00,160 --> 00:44:14,780
And the other thing that we've been able to train on is, when you get a call from a non-service initialized device, so a cell phone that doesn't have service, which is required to still be able to make a 911 call, treat that as suspect until you have really,

440
00:44:14,780 --> 00:44:19,340
really good information linking it to that person's thing.

441
00:44:19,340 --> 00:44:28,580
Now part of the challenge is, if you're too far away from the target of a swatting attack in the first place, your call's not going to go to the right 911 center anyway.

442
00:44:28,780 --> 00:44:31,620
And then you're going to raise a whole host of other questions.

443
00:44:31,620 --> 00:44:46,800
Like, well, if your call ended up in Boca Raton, but you're calling from Denver, then there's something, clearly something has happened that we don't expect and that we ought to be asking more questions about.

444
00:44:47,360 --> 00:44:49,440
So great, great question, really appreciate that.

445
00:44:49,440 --> 00:44:56,020
And in NG911, one of the things we're going to do is a lot more data analytics capabilities to make sure we're authenticating things like that.

446
00:44:56,020 --> 00:45:11,840
In fact, as I talked about, like the device-based hybrid and the National Emergency Address Database and all that, when we were negotiating those new rules with the wireless carriers and the FCC, that was one of our key concerns was if they get a Wi-Fi hotspot,

447
00:45:11,840 --> 00:45:29,260
for example, out of the database and it says this hotspot is here, let's say Caesars Palace in Las Vegas, but the call came in from a cell tower that was in Knoxville, Tennessee, okay, Houston, we have a problem, don't use that location data.

448
00:45:29,260 --> 00:45:32,640
Fall back, use the tower, use the GPS, whatever else you've got.

449
00:45:32,640 --> 00:45:38,560
So location data that comes from the database process has to be corroborated going forward.

450
00:45:38,560 --> 00:45:43,640
That was a big deal for us from an integrity standpoint to make sure that we had corroboration.

451
00:45:44,500 --> 00:45:45,520
Yep, in the back.

452
00:45:50,900 --> 00:45:53,500
The question was, is there a 911 app?

453
00:45:53,500 --> 00:45:54,580
Let me be really clear.

454
00:45:54,580 --> 00:45:57,960
No, there is not a 911 app.

455
00:45:59,000 --> 00:46:08,800
If I could get Apple and Google to do one thing, it would be to just grep the entire app store, the entire Play Store, and delete anything that involves the words 911.

456
00:46:08,800 --> 00:46:10,760
They don't work.

457
00:46:10,760 --> 00:46:12,280
They're totally bogus.

458
00:46:12,280 --> 00:46:22,680
There's all kinds of things, and I hate to be this passionate and upset about it, because I love that there are developers out there trying to do helpful things for people in an emergency.

459
00:46:23,280 --> 00:46:38,240
But the thing that none of the developers, with maybe one exception, who have ever attacked this problem have understood is just how much legacy cruft there is that stands between anything you can do with an app and the 911 system.

460
00:46:38,240 --> 00:46:40,740
It just doesn't work.

461
00:46:41,000 --> 00:46:51,060
The only, there's been one startup that sort of kind of halfway cracked the problem, and they literally had to go and build millions of dollars of infrastructure.

462
00:46:51,060 --> 00:46:59,900
They built their own NG911 system to just do an end run around the whole thing, and then ultimately find some carrier partner to trunk the calls out to PSAPs.

463
00:47:00,940 --> 00:47:05,720
No, there is no app that works with 911, and there won't be.

464
00:47:05,960 --> 00:47:09,360
There are very good reasons that you should not do that.

465
00:47:09,580 --> 00:47:13,420
Again, I appreciate people's passion, but it just doesn't work.

466
00:47:13,420 --> 00:47:14,240
Don't.

467
00:47:15,740 --> 00:47:26,060
Unfortunately, there are dozens of apps on both of the major platforms that purport to do something like connect you directly to the nearest police officer.

468
00:47:26,060 --> 00:47:38,800
Well, okay, A, the app provider doesn't know where the nearest police officer is, and B, the only way to connect to that nearest police officer is over a radio platform that I guarantee you that app developer knows nothing about.

469
00:47:39,000 --> 00:47:42,540
And moreover, that police officer does not want your 911 call.

470
00:47:42,540 --> 00:47:44,320
Like, that's not the process.

471
00:47:44,540 --> 00:47:46,760
You know, they've got other stuff going on.

472
00:47:46,760 --> 00:47:58,380
You know, for the third of 911 calls that are like, cat up a tree, or McDonald's got my order wrong, or whatever the thing was that went wrong, the nearest cop, the nearest firefighter doesn't want that.

473
00:47:58,380 --> 00:48:01,320
We have these things centralized for a very good reason.

474
00:48:01,320 --> 00:48:05,420
The people that take these calls are an important part of the process, and you can't circumvent that.

475
00:48:05,760 --> 00:48:09,200
So, sorry to be passionate about it, but yeah, no, no app, and won't be.

476
00:48:10,480 --> 00:48:11,500
Down front?

477
00:48:15,900 --> 00:48:17,480
Let's say someone released an Android

478
00:48:27,200 --> 00:48:27,620
9.

479
00:48:27,960 --> 00:48:29,960
Clearly you missed my talk yesterday.

480
00:48:31,400 --> 00:48:32,960
So that actually happened.

481
00:48:32,960 --> 00:48:45,060
So the question was, if we have all this legacy stuff that's very susceptible, and, you know, minimum traffic carrying capacity, what if somebody has some malware that gets on a major platform, and then starts calling 911 repeatedly?

482
00:48:45,400 --> 00:48:52,540
What I will do is point you to the DEF CON media server, because once that talk goes up, you can get 45 minutes of a great answer to that question.

483
00:48:52,640 --> 00:48:54,300
In the back.

484
00:49:02,210 --> 00:49:04,850
The question is, what about the integration with SS7?

485
00:49:05,590 --> 00:49:11,390
The regrettable reality is, SS7 is going to be with us for some period of time.

486
00:49:11,390 --> 00:49:15,610
For most 911 systems, SS7 would be an upgrade.

487
00:49:15,610 --> 00:49:17,830
Because they're still using MF and Cama.

488
00:49:18,690 --> 00:49:24,010
Yes, yes, that is exactly the look you should have when I say they're still using MF and Cama, but they are.

489
00:49:24,010 --> 00:49:25,450
That's how they're signaling things.

490
00:49:25,450 --> 00:49:27,090
They're not using SS7.

491
00:49:28,050 --> 00:49:31,410
The ultimate goal is to bypass that completely.

492
00:49:31,410 --> 00:49:40,610
We'll still have to have SS7 interfaces for carrier networks that hang around, because signaling system 7 is going to be with us for some period of time.

493
00:49:40,610 --> 00:49:45,230
But next generation 911 is designed to start getting rid of that, get it out of the system as quickly as we can.

494
00:49:46,090 --> 00:49:48,990
I think we've got time for maybe one or two more questions.

495
00:49:53,130 --> 00:49:55,590
Okay, I'll be hanging around in the hallway then.

496
00:49:55,590 --> 00:49:59,490
Thank you all very much for coming to the talk, and great getting to chat with you.

497
00:49:59,490 --> 00:49:59,930
Take care.