start	end	text
0	8160	Our next speaker here, Trey Fogetti, is here to talk about the challenges of user privacy in a location-sensitive system like 911.
8640	17840	He's part of the 911 Association. This talk is being recorded to show it online later on, so if anyone has any questions,
17840	23320	please walk down to the microphone at the center aisle and we can record the questions too.
23320	25260	So without further ado, Trey.
25940	29500	Thank you so much, and thank all of you for being here this afternoon.
29500	32360	I know your time at DEF CON is precious.
32740	40400	And I will say for my part, I very much want to make this talk a lot less formal and a lot more interactive
40400	43260	than some of the talks that you'll see in the other tracks.
43260	48540	So if you have at some point a question about anything that I'm saying, please don't wait until the end.
48540	54180	Come up to the microphone, and as soon as I get to a convenient pausing point, I will take your question.
54180	59060	Because this is a really interesting area that I'm very passionate about.
59140	63660	I'm being told I can't be heard, so let me... I'm just going to hold this. How about that?
63660	65360	Everybody hear me now? Good.
65760	73040	So where we start is... I get a question all the time.
73080	77020	So you guys at 911, you're just tracking everybody all the time, right?
77020	78760	That's how you know where I am.
78900	81300	And the answer couldn't be further from the truth.
81300	84760	We are not tracking you at any time.
84760	90580	In fact, you would almost be appalled at how little location data we do get when we want to find you,
90580	92240	which is when you call 911.
92320	97040	So my talk is going to go over a little bit about what we do get, when we get it,
97040	105940	how we are actually part of the privacy solution by virtue of keeping people who want access to location data
105940	108200	away from it when they shouldn't have it,
108200	116940	and how we acquire and store and use location data when you make it available by calling 911.
117120	123580	So at the outset, I think I want to start with just a quick thing about how location works.
123660	128100	Are folks here familiar with how GPS works, like generally?
128900	132100	Okay, I'm going to go into it just kind of at a very high level.
132100	139060	So basically, a few thousand miles up, we have a constellation of 30-odd satellites orbiting the Earth,
139060	140980	roughly every 90 minutes.
140980	147060	And each one of them is singing a unique song, but they're singing it on the same frequency.
147280	152080	And by singing the same song inside a receiver, essentially,
152080	158860	you can find out how far off in time your song is from the one being sung by the satellite.
158860	161080	And that tells you a time offset.
161080	168900	So we multiply that by the speed of light, correct for things like the diffraction of the ionosphere
168900	174540	that delays these signals, and then once we have ranging from multiple satellites,
174540	179120	then your device can calculate its location in 3D space.
179120	181440	Now, it's pretty good horizontally.
181440	188160	GPS, in the best of cases, can give us 5 to 10 meter fixes most of the time.
188160	192940	If you have a really good device with a great antenna and, you know, a multi-band receiver,
192940	195220	and you leave it stationary for a very long time,
195220	199980	you can get that down to like a tenth of a meter reliably, or better.
200020	204560	But for this typical case of something that's cheap enough to put in a smartphone,
204560	206940	and for us to carry around with us every day,
206940	210780	and, you know, doesn't have a gigantic antenna sticking out the end of it,
210780	214660	that's not really the reality. You're not going to get anything nearly that close.
215220	220780	So, historically, we've had this problem of we need to find people when they call 911,
220780	221760	so how are we going to do that?
221760	223600	Well, in the wireline world, it was easy.
223600	227040	We knew where the telephone company's wires went.
227040	230900	They kept a billing database that said, you know, here's where our wires go.
230900	234020	And when you established phone service, we could go to them and say,
234020	239240	look, for every address that you put in your database, you have to validate that with somebody.
239240	242800	It's something called the Master Street Address Guide for your locality,
242800	246480	which is a table that contains all of the valid street names
246940	251200	and all of the valid number ranges within those street names.
251540	254120	And so they could submit that address, make sure that it was valid.
254120	258460	If it wasn't, they had to go back to you and say, hey, it looks like your street doesn't exist,
258460	261160	or potentially your number's out of the range.
261160	262960	Like, what happened? Did somebody build something new?
262960	265240	And if that's the case, okay, we've got to go fix the database.
265300	267500	But there was a process. We knew where everything was.
267620	269720	Smartphones aren't like that. They move around.
269720	271780	Cell phones generally move around.
271780	277600	And so we had to come up with ways to figure out where mobile devices were.
277600	281920	In the early days, there were two very general ways of doing this.
281920	285620	There was called the network-based model and the handset-based model.
285620	292280	In the network-based model, devices in the network either transmitted or received signals
292780	299600	to or from a device and used information like angle of arrival, time difference of arrival,
299600	306760	or absolute timing offsets to calculate ranging and bearing data and figure out where the device was.
306760	308620	And that worked. It's actually very fast.
308620	311180	It's one of the fastest ways to find someone generally.
311180	313460	The problem is it's not terribly precise.
313460	318380	With those sorts of methods, you can get within 200 to 300 meters very quickly,
318380	322100	but you'll never get down to some tens of meters.
322100	323920	It just doesn't work that way.
323920	331300	So that was the typical technology in CDMA, or excuse me, in GSM networks,
331300	334500	because in GSM networks, that was what was convenient.
334500	337900	They had the right sort of signal structure to do that kind of ranging.
338080	340900	CDMA had, at the time, a really cool advantage,
340900	344820	which is when I talked about the way GPS satellites sing little songs,
344820	348180	they're actually doing that in kind of a version of CDMA.
348200	351220	All the satellites transmit on the same frequency,
351220	356200	but they do it with different pseudo-random number sequences imposed over that,
356200	360260	and you can pick individual satellites out by knowing which one of those are,
360260	364200	looking up in an almanac, okay, what satellites should I be able to see,
364200	366480	getting that from the constellation itself even,
366480	369760	and using that data to figure out, okay, what should I listen for?
369760	372980	Since CDMA handsets already had correlators inside
372980	375800	that could do that for the networks they were attached to,
375800	379460	someone had the bright idea, well, let's just reuse that as a GPS receiver.
379460	380760	And it worked. It worked brilliantly.
380760	383440	Now, the trouble was, early on, there was only one,
383440	387920	because they only expected you to be carrying on one voice conversation at a time,
387920	392920	so when, in the early days, they wanted to figure out where you were for 911 purposes,
392920	397120	they actually had to say, hold on a second, you're going to hear silence
397600	400600	while I determine your location, and then they would trigger,
400600	404180	the 911 center would trigger something in the carrier network
404180	406540	to actually start that process with your device.
406540	410080	The device would listen for the satellites, collect the data, correlate it,
410080	412600	ship it off to the network, the network would calculate your position
412600	415960	and relay it via a database to the 911 center.
416000	419320	Really kludgy, and you don't want to tell somebody in the midst of an emergency,
419320	422220	please hold, right? That's not a great thing to tell someone
422220	424000	when they're, like, screaming to death.
425500	429360	So, over time, we got better, we got better chips with more correlators,
429360	432760	we got to the point that we could actually put GPS chips in almost every phone,
432760	434600	and these days, that's what everybody does.
434600	438580	We have GPS chips. Most of the network technologies have sort of gone away.
438580	442600	We still have two out there called Advanced Forward Link Trilateration,
442600	447100	which is a ranging technology used mostly in CDMA networks,
447100	452500	and then OTDOA, which stands for Observed Time Difference of Arrival.
452500	455860	How many navigation nerds are there in the room who have heard of LORAN?
457120	459140	Okay, we got a few people, good.
459140	460980	So, this is the really cool thing.
460980	465560	OTDOA is just LORAN with cell towers instead of LORAN chains.
465560	469980	You just listen for the time differences between transmissions of synchronized towers,
469980	473640	and then you can use that to do hyperbolic ranging, which is really fun.
473640	475060	It's kind of a cool sort of thing.
475060	480540	Again, it's one of these network technologies that are fast, but not necessarily super precise.
481960	486000	All well and good, okay, fine, you've got a measurement system.
486800	488340	What do we do with that now?
488340	491960	In the 911 case, and I said this before, we're not tracking you.
491960	494540	We don't want that stuff running all the time,
494540	496340	because frankly we don't have anything to do with the data,
496340	498460	and it's really not of any interest to us.
498460	501460	We need to know where you are when you have an emergency.
501840	504680	You don't want that going on, obviously for privacy reasons,
504680	507020	otherwise you wouldn't be in the crypto privacy village,
507020	510520	and you also don't want it going on because it's a very battery intensive activity
510880	513460	to keep track of yourself precisely all the time.
513460	517680	In fact, most of the things that you see, you know, this question,
517680	521480	why is it that Uber can find me, but 911 can't, that we hear so often,
521480	525860	I really hate this question, because like most of the time, Uber is not,
525860	529640	Uber doesn't, hasn't measured where you are to any degree of certainty.
529640	534760	They have software in your device platform and in their platform
534760	537300	that's making a very educated guess.
537320	541940	People tend to focus on the little blue dot that tells you where the thing thinks you are.
541940	545680	What they often don't realize is that there's also a blue circle around that.
545680	549860	There's some uncertainty associated with that location fix,
549860	553840	and often in the case of commercial apps on smartphones,
553840	556060	that uncertainty is actually relatively large.
556060	559980	It can be on the order of hundreds or even thousands of meters.
560760	565240	That's calculated at about a 90% confidence level most of the time,
565240	570160	which we want, we want only about a 10% margin that will find you outside the circle.
570160	573160	But if you think about a place like Caesar's Palace,
573760	579640	an uncertainty of 100 meters or 200 meters makes it really difficult to find someone.
579640	582020	It makes it really difficult to go search for them.
582020	586480	200 meters might put me in any one of three different hotel towers,
586480	589740	the casino, the conference center, and a bunch of restaurants.
589740	593540	So you really have to deal with constraining that uncertainty somehow
593540	596640	before you can use that for emergency response.
596640	600680	Uber can make those guesses because it has that ability to then ask you,
600680	603060	okay, where are you? In fact, does this match up?
603060	605260	And if not, drag the map and pick the little dot.
605260	607260	We don't have that luxury in 911.
607900	609780	So I've said that we're not tracking you.
609780	611200	Well, what are we doing?
611240	614020	When you call 911, a few things happen.
614020	616840	I've talked about some of the different methods that we've used.
617420	621000	We're starting to add things from the handset now.
621200	624920	Historically, only stuff that was baked into the baseband or the network
624920	626980	was really available for 911.
627220	629680	But these days, we're actually doing a lot more than that.
629680	633760	This is bleeding-edge stuff that's just starting to come into the devices.
633820	636600	But we're starting to be able to use Wi-Fi and Bluetooth
636600	640260	both to do sort of associative location to say,
640260	645620	look, we know that Trey's Wi-Fi access point is at this particular address in this town
645620	649580	because he's there all the time and he's associated with that and so on.
649580	653520	So if the phone can see Trey's Wi-Fi access point,
653520	660200	that's probably a location of association that we can use as a starting point for a search.
660200	662120	It's kind of a probabilistic sort of thing.
662120	664880	That's a very uncomfortable proposition for 911.
664880	666860	We want things to be deterministic.
666860	669020	We want to be able to say to the cops and firefighters in the field
669020	671520	who really couldn't find their way out of the building without our help
671520	676020	that this is exactly where to go.
676020	680500	But that's not realistic. That's just not the way the physics of measurement work.
680500	685460	And that's why the other thing that we're looking at, Bluetooth beacons,
685460	690760	you put Bluetooth low energy in a light bulb for lots of really great reasons.
690760	695740	One of the things you can do with that is associate that UUID,
695740	699800	that Bluetooth beacon ID, with that location in a database.
699800	703020	We're working on something called the National Emergency Address Database,
703020	709380	which will actually associate Wi-Fi max and Bluetooth UUIDs with physical locations in the world
709380	714780	so that if, for example, there's a beacon in this particular ballroom,
714780	718200	I can be localized, if I'm within 10 to 30 meters of that,
718200	721860	I can be localized very, very precisely with that.
721860	725180	But of course, that takes getting a lot of beacons out in the world.
725180	727340	Thank you, Internet of Things, that's going to be easy.
727400	731800	But then it also means we've got to track those things and make sure that if they move,
731800	735480	we find out about it, that there's some aging in the database to make sure
735480	740140	as things get older, we trust them less to provide location and so on.
740580	745760	So at call time, when you make a 911 call, a couple of things happen.
745760	752060	First off, your platform, your phone platform, whether it's Android, iOS, Blackberry, whatever,
752060	754380	completely overrides your location privacy settings.
754380	760220	It says, look, you've made a 911 call, this is really important, turn everything on, we need to find you.
760220	765780	Historically, that's only meant like the GPS chip and not some of the other cool things
765780	769480	that you have in there like the accelerometers, gyroscopes, magnetometers, barometers,
769480	772280	Wi-Fi, Bluetooth, et cetera, but we're working to change that.
772280	775420	We're actually working to get to the point where we can ingest data
775420	781160	from all of those different things to create something called device-based hybrid.
781420	787800	And this is where we use things opportunistically where they make sense.
787800	795260	So GNSS, GPS, Galileo, Glonass, Compass, Baidu, all of those things work phenomenally well
795800	803040	outdoors in urban and suburban environments and even to some extent in sort of urban clusters,
803040	807820	not necessarily in Manhattan and San Francisco and downtown Atlanta and Chicago.
807820	810660	In those places, GPS is really, really awful.
810860	815480	But Wi-Fi and Bluetooth things have much higher densities in those environments
815480	817580	and consequently they are of more use.
817580	820320	And so this is the concept behind device-based hybrid is
820320	824860	we're going to opportunistically use what is best in the environment that it's in.
824860	828860	So if you're in Manhattan and the best thing we have to figure out where you are
828860	830680	is Wi-Fi and Bluetooth, we'll use that.
830840	835500	And if not, if you're out someplace where GPS is working great, we'll use that.
836460	840620	All of this is just, just sort of starting to happen.
841100	845840	We've had one company called Rapid SOS that built some really cool stuff
845840	852960	to kind of get location data around the database limitations of the legacy 911 network.
852960	858020	And in doing that, they've kind of proven out that you can, you can get a lot more calls
858020	864360	clustered down in that, you know, 0 to 20 meter range with device-based hybrid.
864360	867080	And, and I don't mean to like endorse Rapid or, or something like that.
867080	868900	There are tons of folks working on this.
868900	873260	Google just announced a few months back that they're going to be doing a lot more
873260	878340	in their fused location provider for emergency services purposes over the next 3 or 4 years.
878540	880520	Including, and this, I thought this was really cool.
880520	883860	They're putting dual frequency GPS receivers in their devices,
883860	888740	which allows you to directly measure and cancel the ionospheric diffraction delay.
888740	891720	And that is the primary source of error in a GPS fix.
891720	896700	So in 3 to 4 years, your handset GPS locations,
896700	899240	indoors and out, are going to be phenomenally better.
899240	902440	They, they really will just get meaningfully better.
903200	906960	We're also seeing barometers go into devices, which is really cool.
907320	913900	These allow us to implicitly pull out a vertical location.
913900	916580	If you have, oop, I've gone dead.
916580	923800	If you happen to have, I think so,
928040	930380	hmm, oh, there we go, we're back.
930380	933220	If you happen to have a barometer,
933220	937260	and you have a good external reference for what sea level pressure is,
937260	940120	you can use those measurements, you can compare them and say,
940120	943980	okay, I must be this much up or down from that reference datum.
943980	947580	Now, in order to do this, you've got to have measurements that are fairly localized.
947820	950880	And so, you know, another example, this company, NexNav,
950880	955240	their idea is to put sort of pseudolites or fake GPS satellites
955240	960300	on cell towers in buildings and broadcast basically their own GPS signal
960300	965360	down at 900 megahertz where it penetrates deep into buildings.
965360	968840	And to broadcast as part of that hyperlocal barometric pressure corrections
968840	974840	that let them pull up exactly the height that you are at
974840	977200	with a great deal of reliability.
977200	979900	Now, what do we know about 900? 900 is the junk band, right?
979900	982140	Everything awful is in there, it's completely useless
982140	985300	other than wireless meter readers who just sit on top of everything.
985420	990280	Except that the one thing that is actually privileged in 900 megahertz
990280	994240	is multilateration and location monitoring services.
994240	998220	And there are licenses and these guys happen to have a lot of them.
998240	1000560	There are other folks who have them for other markets,
1000560	1004120	but this is like a cool thing that you can do in the 900 megahertz band
1004120	1008760	and you actually get interference protection if you do this.
1008760	1013000	So, another cool thing. When you make that 911 call,
1013000	1015940	all of this stuff kicks on and starts saying,
1015940	1018240	okay, now where are you?
1018440	1022660	Initially, when your 911 call arrives at a 911 center,
1022660	1028140	most likely we will not have good location data at the start of the call.
1028140	1032380	What typically happens, and this is something called phase 1 and phase 2,
1032380	1036820	phase 1 location is what we get at the beginning of basically every wireless call
1036820	1043880	and it just tells us the street address of the cell tower that you're attached to
1044800	1047420	and the GPS coordinates of the tower.
1047420	1049440	Again, this is not you, this is the tower.
1050080	1055440	And it tells us the central bearing of the cell sector that's serving you.
1055440	1058280	So, if you look up at a cell tower, it's usually kind of triangular.
1058280	1060720	It's got antennas on the vertices of the triangle.
1060720	1063540	Each of those has a particular central bearing.
1063540	1066300	It's serving about 60 to 120 degrees.
1066300	1070980	And so by knowing that kind of general bearing and then asking you questions,
1070980	1074360	hopefully we can figure out, if you don't know, where you are.
1075740	1078440	The way all of that works is super kludgy.
1078440	1082600	It actually happens because of a database process that got started in the 1980s
1082600	1084920	built for the wireline world.
1084920	1089060	And that's why before we can get your more precise location,
1089060	1092080	we have to wait a period of time for a couple of processes to happen.
1092080	1096160	So, first of all, the device has to actually calculate a fix
1096160	1102300	that is better than whatever it had from the tower and so forth.
1102300	1106060	And then it has to communicate that back to the carrier network.
1106060	1111500	The carrier network has to pass that to a database management system provider.
1111500	1115720	They have to further process it and implant it into the database
1115720	1120560	that ultimately your local telephone company typically maintains
1120560	1126340	because it was the one that they maintained for that wireline process oh so long ago.
1127200	1131720	Then, at that point, the 911 center system either automatically or manually
1131720	1136640	can re-query the database and say, okay, is there anything better?
1136660	1142760	And typically by the 15 to 25 second mark is when we'll start to see an improvement.
1142760	1148000	Something like a GPS fix that's within the allowable error range.
1148000	1151320	The carriers have location targets that they have to hit.
1151320	1154760	Ultimately, those are going to get down to 50 meters horizontally
1154760	1158260	and some number vertically that we don't know exactly what it will be yet,
1158260	1161540	but we're working on that. Or a dispatchable address.
1161540	1166000	And dispatchable address is the process I talked about before with the database piece of it.
1166640	1173900	Now, the one sort of worrisome part about this is those values, those location values,
1173900	1177340	we know they're very sensitive. Those are actually transmitted in the clear.
1177340	1182640	But they're transmitted in the clear only within trusted carrier networks
1182640	1185240	and then only on the network's control plane.
1185240	1188440	So the location information never touches the user data plane
1188440	1194400	until it actually gets down to the 911 center and it is received at the start
1194400	1197560	or some number of seconds into your call.
1198140	1202900	And then at that point, we look at this as like a hot potato.
1202900	1208060	We'll keep that, store it, as long as we have to, to provide you with service
1208660	1214080	and to keep the sort of records that 911 centers are legally obliged to keep,
1214080	1217900	whether it's for investigatory purposes or just because the legislature said
1217900	1221300	we want everything to be kept for 90 days or 120 days.
1221300	1226180	Some things may get archived if they look like they're going to be important down the line,
1226180	1228120	but not necessarily everything.
1228120	1234100	We typically want to get rid of non-critical 911 data that's not subject to a litigation hold
1234100	1238120	as quickly as possible. We really just want to get that out of the system.
1239440	1244860	This is where it gets a little interesting because obviously being in public safety,
1244860	1249820	911 is part of a lot of law enforcement responses.
1249820	1253500	A lot of law enforcement responses start as a result of a 911 call.
1253500	1255060	In fact, almost all of them do.
1257300	1260600	And 911 is known for having location data.
1260600	1264980	People in the law enforcement and fire and EMS communities know that when you call 911,
1264980	1267060	we get your location data.
1267300	1271320	And so people not unreasonably often make the assumption that,
1271320	1274960	well, if I need that for some other purpose, the way I should be able to get that
1274960	1279060	is by just going to my friendly neighborhood 911 outfit and saying,
1279060	1282980	hey, help me out with some of that good, good location data, right?
1282980	1284820	And we get those requests all the time.
1284820	1289780	Our members actually get location data requests from law enforcement and fire and EMS
1289780	1292900	often when there's no actual 911 call going.
1292900	1297320	So I said earlier, 911 really is on the front line of protecting user privacy
1297320	1301920	because often the thing we have to do is tell sometimes even the boss no.
1301920	1306060	Because we get 911 data for a purpose. We use it for a purpose.
1306060	1310500	And that's part of user trust in the 911 system is that we're not going to misuse
1310500	1312660	that 911 location data.
1313100	1316220	The other reason that these things happen from time to time
1317440	1321540	is we also have access to a process for exigent circumstances.
1321820	1325360	So if you've ever seen the movie The Call with Halle Berry,
1325360	1327880	so small aside, I got to meet Halle Berry.
1327880	1329380	She is amazing in person.
1329380	1332880	She is even more beautiful and even more friendly and awesome and wonderful.
1332980	1336640	And she really took a lot of time and effort to get in the trenches
1336640	1340080	with real 911 call takers and learn how they do what they do,
1340080	1341760	which was really awesome and cool.
1342160	1343600	Hopefully there will be a sequel.
1343900	1348860	But in that movie, there was this occasion where a young woman was kidnapped
1348860	1350680	and thrown in a trunk.
1351120	1355380	And she made a very, she was only able to make a quick, discreet 911 call
1355380	1357900	to say, you know, help, I'm in the trunk, right?
1358700	1363860	When that happens, we've got to have some process to get some location data
1363860	1366200	when you're not on a 911 call.
1366200	1368740	Now the challenge for us is, as I talked about before,
1368740	1371980	all of the location privacy settings and all of those sensors
1371980	1377520	and measurement systems are not on unless you're in a 911 call.
1377520	1384600	So the moment you hang up, we lose the ability to query for updated location information.
1384660	1389540	And at that point, the best we can do, and I realize this sounds insane in 2017,
1389540	1396700	is fax, yes, fax, a form to the carrier that was serving that 911 call
1396700	1403340	to say, we need the best location data you've got for this particular phone number.
1403680	1408120	The turnaround time for that can be 15 to 45 minutes.
1408120	1409960	They generally, they do take it very seriously.
1409960	1414340	They try to get the accident circumstances request processed as quickly as possible.
1414340	1418280	But it is still a process. It's not an automated kind of thing.
1418280	1420620	It is a very manual process.
1420800	1423940	And then what happens once the carriers, lawyers, and engineers
1423940	1429120	have looked at the form and said, okay, yes, this is a valid accident circumstances request,
1429120	1433220	there really is an ongoing emergency with a threat to life or property,
1433220	1439520	then and only then can they start to do a little bit to help us.
1439520	1443360	But again, you're not in a 911 call. They can't turn on all the sensors.
1443460	1448840	Typically the best we can do is we fall back to that sort of phase one information.
1448840	1454140	We can typically get, okay, what tower and sector is serving the device.
1454420	1456640	So we get, you know, kind of a point and a bearing.
1457200	1464420	And if we're really, really lucky, in some cases, they will also be able to give us a range estimate.
1464500	1468500	So I talked before about, you know, GPS and the way the ranges kind of cross over
1468500	1470280	and you can get a location out of that.
1470280	1474700	Another way you can develop a location fix is with a bearing and a range.
1474700	1477400	So that's a line and an arc and wherever they cross,
1477400	1482080	that's sort of generally where you are because, again, our measurements are kind of fuzzy.
1482180	1485640	That arc can be really wide. That line can be really thick.
1485640	1487500	You get kind of an annular sector.
1488360	1490600	But, hey, that's still useful data.
1490600	1494340	But again, it's not data that we're getting easily.
1494340	1496700	It's something that's very, very protected.
1497120	1500880	And in the 911 case, when we do get that, again, that's a manual process.
1500880	1502320	So there's no database to put that in.
1502320	1509740	That's actually something that's done on a, you know, we're on the phone with AT&T, Verizon, Sprint, T-Mobile, somebody,
1509740	1511480	saying, okay, where are they now?
1511760	1514000	Okay, has the location changed? Where are they now?
1514280	1516740	And it's this very sort of iterative manual thing.
1516740	1523000	And eventually, hopefully, you can work out, okay, it's a car that's going down, you know, I-40 or something like that,
1523000	1527780	and say, let's go try to intercept whatever that is and find somebody.
1527780	1533060	And then, of course, immediately after that exigent circumstance passes,
1533060	1536760	that location data that was used for that purpose basically has to go away.
1536980	1543820	Because it wasn't necessarily obtained with an investigative purpose for law enforcement purposes.
1543820	1548320	So then you've got to start thinking about, okay, do we get a subpoena? Do we get a warrant?
1548320	1556980	How do we actually acquire that location data in a way that can be used for some criminal prosecutorial purpose
1556980	1561660	that's not related to an immediate emergency response?
1561900	1566960	So that's kind of the multiple phasic approach that you have within the 911 center.
1566960	1569460	We have the sort of baseline case.
1570440	1575120	Weirdly, I often hear people say, 112, which is the European emergency number,
1575120	1580180	is really part of the global emergency calling standard, and you should use that.
1580580	1585120	And in a lot of places, using 112 might actually get you to a 911 center.
1585120	1588440	It might. It won't always, but it might.
1588440	1593560	And if it does, the challenge, though, is it won't turn on, usually, any of that cool location stuff.
1593560	1595560	So don't dial 112 unless you're in Europe.
1597460	1605420	Once that location process is over with, there is sort of a residual question of, what do we do with the data?
1605420	1609460	And I don't think we have a good answer right now,
1609460	1616280	because your average 911 center is not technically sophisticated enough to be encrypting or hashing
1616280	1619260	or doing things like that with those sorts of data.
1619260	1623500	They kind of have to rely on whatever their system vendor makes available.
1624140	1629400	And oftentimes, that doesn't include robust confidentiality and integrity mechanisms.
1629400	1630840	But that is something we're working on.
1630840	1637180	So the next piece of this that I want to talk about is how we will acquire and use location information
1637180	1641080	in a next-generation 911 environment.
1641340	1647260	And basically, the process still stays heavily dependent on what the device and the network knows.
1647260	1652520	But now, instead of dealing with legacy wireline databases from the late 70s, early 80s,
1652520	1656300	we're going to take this into a more IP-based realm.
1656300	1663380	So in next-generation 911, when you dial 911 from a phone, whether that's a voice call to 911
1663380	1667400	or a video call or even a text session, we're going to have real-time text very soon.
1667400	1671680	Or total conversation. If you have different accessibility needs,
1671680	1674960	you'll have the ability to communicate in all of those different ways simultaneously,
1674960	1677480	which is really awesome if you have a hearing or speech disability.
1678820	1681840	At that point, you've got a couple of things that have to happen.
1681840	1688280	First, the device needs to figure out what 911 system its call should go to.
1688300	1692700	So it's going to query something in the access network provider's network.
1692700	1694920	And here I want to stop and define a couple of terms.
1696400	1699560	Historically, when you bought phone service from the phone company,
1699560	1702280	you were really buying two very different things.
1702280	1705280	But it looked like the same thing because it was all you knew.
1705380	1707680	When you bought voice service from the phone company,
1707680	1711420	you were buying, first off, a transport network.
1711520	1715960	So that's an access network that is capable of moving things around.
1715960	1718000	But you were also buying an originating service.
1718000	1724500	The ability to connect from one endpoint to another endpoint using some particular address.
1725000	1729120	Today, networks don't have to do all of those things in an integrated way.
1729120	1733700	I can buy my access network service from, for example, AT&T,
1733700	1738240	and I can buy my voice originating service from Vonage, for example.
1739220	1742180	We have to accommodate that in the 911 system.
1742180	1747960	We have to be able to deal with the fact that your carrier is no longer just the phone company.
1747960	1749500	It may be somebody else.
1749540	1751380	Historically, we have not done a good job of that
1751380	1755220	because we've just bolted stuff on to the 911 systems over the years
1755220	1761160	and we haven't really integrated a lot of these new technologies into the way the system works.
1761820	1764680	So your device goes to the access network provider.
1764680	1766140	Well, okay, why?
1766200	1769800	Well, the infrastructure provider, they know where their wires go.
1769800	1772440	They know where their cell towers are.
1772440	1776900	They're the ones who have the sort of intimate, real-world, physical connection with you
1776900	1781620	that can be used to start that process of localizing the call.
1781620	1785960	So your device goes and queries their location information server.
1786480	1790680	It gets back, currently, actually location by value.
1790680	1793240	It gets sort of your here, generally,
1793240	1796000	although we're trying to be very careful about giving that to devices
1796000	1800440	because we can see a state where you might have malware on the device
1800440	1802920	and you don't necessarily want to disclose location to that.
1802920	1806180	So we're working on some cryptographic stuff to try and keep that private as well,
1806180	1807440	to basically tokenize it,
1807440	1811580	so that then the device can pass either that location value or that token
1811580	1814840	to something called an emergency services routing proxy.
1815040	1820680	And the purpose there is for the proxy to say to a big thing called a forest guide,
1820680	1823440	which is basically a hierarchical database structure
1823440	1827400	that tells you here are where all the countries in the world,
1827400	1830500	what are their boundaries within those, what are the states within those,
1830500	1834760	what are the counties within those, what are the 911 center service areas,
1834760	1839040	and oh, by the way, you're there, great, you go to this 911 center.
1839040	1840580	That's where your call should go.
1841060	1845800	So this involves a lot of GIS processing.
1845920	1847640	That's geospatial information system.
1847640	1850840	I think I have a slide here that actually shows some of that.
1850840	1854360	So we actually have a standard for geospatial information systems.
1854940	1859100	Remember I talked about that old school way of doing the database of addresses
1859100	1862820	where you have a list of street names, a table of street names,
1862820	1864900	and a table of valid number ranges?
1865140	1869460	That's all well and good if you only need to locate people in like row houses,
1869460	1871660	but what if you have an apartment building?
1871660	1873840	How do we know that a floor number is valid?
1873840	1876180	How do we know that a room number is valid?
1876180	1882580	And moreover, how do we decide where do all of those 911 calls within that thing go?
1882580	1888520	For example, if I'm Caesars Palace, I might have my own, I might be a limited municipality,
1888520	1891740	I might have my own response center that can get you help faster.
1891740	1895900	We might want to route all of the calls within Caesars Palace to them instead.
1897240	1898680	Disney World is a great example of that.
1898680	1900860	They actually have the Reedy Creek Improvement District.
1900860	1904700	There are like six Disney executives that have houses like on the property.
1904700	1907980	They're the entire voting block for the whole city of Reedy Creek,
1907980	1909960	and they actually have their own 911 center.
1909960	1911520	It's like a best practice place.
1911520	1912500	Everybody loves to hold it up.
1912500	1914480	It's like shiny and new and a good place to go.
1914720	1920260	But you have to be able to track those things so that you can do change management,
1920260	1924820	so that you can know when somebody puts up a new building.
1924820	1927220	How do we add that to our addressing system?
1927840	1930100	And then once you've consulted the forest guide,
1930100	1936340	it'll give you an IP address for something called the border control function of the NG911 system,
1936340	1940940	next generation 911 system, that actually serves that particular location.
1940940	1946080	At that point, the routing proxy, whether it's in your access network provider's network
1946080	1949760	or if it's disaggregated in the originating service provider's network,
1949760	1954080	will actually send signaling and media to that border control function.
1954080	1961040	To me, the coolest part of all this is if at some point during the call things change
1961040	1965020	and there's some reason, your location changes or whatnot,
1965020	1971100	and there's some reason to redirect the call either before the setup is complete or during the call,
1971100	1973960	there's actually an intelligent mechanism to say,
1973960	1978340	hey, there's this other 911 center that might need to be involved in this response.
1978340	1981860	Do you telecommunicator handling the call want to loop them in?
1981860	1985920	Even if it's on a listen-only basis. And you can do that.
1986020	1992200	And you also get another kind of cool capability is you can have now specialized 911 centers
1992200	1997060	that deal just with particular populations that have very specific needs.
1997060	2004240	So, for example, in Washington, D.C., we have one of the largest universities for the deaf and hard of hearing, Gallaudet.
2004380	2008660	Great school. They actually do a lot of cool engineering work related to 911 stuff.
2008660	2013760	But if you have a 911 call that's coming from just the area of the Gallaudet campus,
2013760	2019540	you might want to put that into a different queue for someone who has a hot connection with an ASL interpreter
2019540	2023020	or knows ASL themselves and can handle that video call that way,
2023020	2027460	or who's trained specially to handle real-time text calls.
2027460	2031440	And that's something in today's environment we absolutely can't do because, remember back,
2031440	2035780	we're routing everything based on that cell tower and the sector.
2035780	2037900	At the beginning of the call, that's all we know.
2037900	2045000	In the future, the idea is we're going to route based on the actual X, Y, and hopefully Z someday from the device.
2045000	2049980	And that makes it a lot easier to do much more granular things like that that can really help.
2049980	2054460	It has a huge impact. If you're in a population that has a specific need like that,
2054460	2061280	it's a really big deal to be able to get to something like that on the first try.
2061280	2065780	Because today, one of the terrible things that happens is if you need to connect with somebody
2066340	2072660	like a video interpreter, that can delay your 911 call on the order of 15 to 30 minutes.
2072820	2076080	And that is not an amount of time you want to be waiting in an emergency.
2077360	2081760	I've used about 40 minutes here. I haven't had anybody volunteer questions, so I just want to level set.
2081760	2087980	Are there things that I've covered in insufficient depth or not covered or other things you want to hear about
2087980	2091640	so that I can kind of tune the rest of the talk? Yep.
2105910	2110270	Oh, it's funny. You think there's IP switching involved in this. That's very quaint.
2110270	2117370	So the question was, when I said that location data is transmitted in the clear,
2117370	2120850	what part of the sort of transactional structure was I talking about?
2120850	2127710	So from the device to the network, it is encrypted at the level of whatever the bearer established.
2127710	2132910	So in LTE, it would be encrypted. In GSM, it would be encrypted probably weekly.
2132910	2140910	Same thing in CDMA. Within the carrier network, it will be segregated but not necessarily encrypted.
2141150	2145670	And then the way it's... I know this is why I laughed about the whole IP switching thing.
2145670	2150730	The way it's actually transmitted within the telephone company networks
2150730	2158050	is as a series of either medium frequency tones or maybe DTMF in some cases.
2158050	2162970	It's really kind of hilarious how some of this stuff still actually works.
2163190	2168550	The data block we get with a 911 call, I think I said this in my talk the other day but it bears repeating,
2168550	2178850	is 512 maximum, 512 non-extended ASCII character set letters and digits. And that's all.
2178850	2185850	So when you want to represent something like a physical location, that's all you've got to work with.
2185850	2189110	And so we've really had to figure out, okay, how do we dumb this stuff down?
2189110	2192650	One of the big things that we're looking forward to is once we have these next-gen systems
2192650	2196870	where we can protect it properly, encrypt it, and it is an IP system,
2196870	2199710	is actually starting to be able to represent things graphically.
2199710	2206010	I think I showed... here's an example of an uncertainty around a floor, for example.
2206770	2210390	Today, we couldn't do that. We couldn't pull up a visualization of a building
2210390	2215610	and put circles or ellipsoids or spheres or other things in there and say,
2215610	2222130	look in this general area because we have no way of representing that in the 911 systems that we have.
2222130	2227770	Now, the cool thing is, the carrier standard that makes all of this work at kind of the numerical level
2227770	2232390	is something called J standard 036, I think it's an ATIS slash TIA standard.
2232410	2237750	It actually defines the ability to send different geometric shapes.
2237750	2244030	So I can send an ellipsoid point with uncertainty. I can send a point with spherical uncertainty.
2244030	2248430	I can start to do annular segment, things like that.
2248430	2251650	Nobody does that because, again, we don't have any way to represent it today.
2264080	2271000	So the question was, what percentage when it comes to dispatch is sent in the clear versus encrypted or perhaps digital?
2271000	2276660	I assume you mean... and I assume you mean the radio part.
2276660	2281800	Okay, so the radio part of dispatch, how much of it is encrypted, how much of it is in the clear?
2282600	2289200	Overwhelmingly, it's in the clear. There are places that are starting to do more encrypted communications.
2291320	2297420	Badly, in most cases. If you look, Matt Blaze, Travis Goodspeed and some folks did an analysis a few years back
2297420	2304500	of one, like, the dominant public safety radio standard in the U.S. and found that it was basically hopelessly insecure.
2304500	2315760	They used a really weak, kind of, even more broken version of RC4 as the stream cipher in some commercial implementations that were very cheap.
2315860	2320900	And so everybody used those, even though they weren't terribly interoperable and they're not at all secure.
2320900	2330120	So we're in the process of trying to fix that. Earlier this year, the Department of Homeland Security and NIST worked together to get a requirement into the standard
2330120	2341680	so that, I think, starting in 2018, going forward, all radios built to that standard will now have to have AES-256 as a mandatory part of their cipher suite.
2341680	2347120	They can still have broken versions of RC4, but AES-256 has to be in there as well.
2347120	2351820	And part of the reason for that is, in the public safety community, interoperability is a huge deal.
2351820	2355600	Disasters may start local, but they usually don't stay local.
2355900	2358540	And when they go beyond the, you know...
2358540	2363220	Disasters don't obey jurisdictional lines, no matter how much we admonish them.
2363220	2368380	And so eventually you've got to have help from your neighbor, and when that happens, being able to talk with them is a big deal.
2369120	2372380	The other thing... I appreciate that question about encryption.
2372620	2378900	The other thing that I want to raise a serious point about, though, is authentication and integrity checking.
2378900	2385300	Because even though we are fixing the encryption problem, sort of, we're getting to a standard,
2385300	2392840	we are still not doing anything about protecting radio networks from bad devices.
2392840	2395140	So devices that don't belong there.
2395140	2402420	So most of the radio networks today, if you know an 8-digit code that is really easy to pull off the air,
2402420	2406680	you can get a radio attached to that network and start receiving traffic from it.
2406680	2408640	It's not authenticated in any way.
2408640	2412160	And then there are also vulnerabilities to replay attacks in these networks.
2412160	2416280	So you don't have good integrity mechanisms either.
2416340	2419200	So we know that's a problem. It's something we're working on.
2419200	2427560	The trouble is, these are tens of million dollar networks that turn over once every 15 to 20 years.
2427680	2430420	And the next iteration may just not happen.
2430420	2435700	Because they're actually building an LTE network right now for first responders that's going to be nationwide.
2435700	2439920	So there's a big debate about, well, do we even keep working on these standards,
2439920	2443680	because at some point we're just going to use that, because it'll be better.
2444180	2446240	Not necessarily soon, but someday.
2448320	2449560	Other questions?
2469880	2474900	So the question was, when you make a 911 call, location stuff turns on.
2474940	2480600	Does the data that's developed as a result of that get stored on the phone in a way that it could be recovered by forensic analysis,
2480600	2482580	the cops down the line or something?
2482580	2486260	I don't know a really good answer to that question.
2486320	2491280	The challenge is, there are so many parties involved.
2491280	2495080	Because there are legal obligations and interests that the carriers have.
2495080	2501180	There are very different legal obligations and interests that the handset manufacturer has.
2501180	2506680	And even the chipset manufacturer, the folks who are putting those measurement devices,
2506680	2510820	how those interface with the 911 aspect of the device can vary.
2510820	2513000	So I don't know the answer to that, unfortunately.
2513080	2518020	My hope would be that once the 911 call goes away, that that location data goes away as well.
2518040	2522160	In part because in the 911 business, one of our big concerns is always,
2522160	2526360	well, can we adequately protect the safety of someone who calls 911,
2526360	2530160	but doesn't want a third party to know that they have.
2530180	2535100	One tactic that we see, particularly in an abused spouse situation all the time,
2535100	2539580	is somebody calling 911 and pretending to order pizza.
2540120	2545340	And when they do that, most clever telecommunicators and dispatchers will say,
2545900	2549340	you're telling me that you need to order a pizza because you wanted to call 911
2549340	2551740	and you don't want someone else to know, is that right?
2551740	2553620	Yes, pepperoni.
2554060	2558740	And that's the kind of thing where we don't want somebody to be able to look at the device and say,
2558740	2563180	oh, you called 911 from the house, where you know you're not supposed to call anybody.
2563180	2568780	That would be a potential information disclosure that would not be good.
2569200	2571120	There's a question right there.
2571380	2574840	Could you come up to the mic so that we can get this on the recording?
2578700	2596560	Okay, the question was, can the location information that is collected be used to prevent things like,
2596560	2598060	for example, swatting?
2598060	2601020	I promise I did not pay him to ask that question,
2601020	2603460	but that is like the best possible question you could ask.
2604400	2608860	It is something that we have been looking at for a very long time.
2608860	2610980	The answer is yes, absolutely.
2611040	2613700	It should be used that way every time.
2614320	2622720	I go through no end of amazement that people don't always check mismatches like that when there is a call.
2622740	2628000	I do think one of the benefits of, frankly, having humans in the loop for 911 calls,
2628000	2630520	is that rather cleverly a lot of the time they do say that.
2630520	2636180	They'll say to somebody, look, before you go full swat on Brian Krebs again,
2637080	2640160	maybe let's make sure that this call is actually coming from there.
2640160	2642300	And the other thing that we've been able to train on is,
2642300	2645340	when you get a call from a non-service initialized device,
2645340	2647560	so a cell phone that doesn't have service,
2647560	2651280	which is required to still be able to make a 911 call,
2651280	2655820	treat that as suspect until you have really, really good information
2656820	2659340	linking it to that person's thing.
2659340	2665540	Now part of the challenge is, if you're too far away from the target of a swatting attack in the first place,
2665540	2668580	your call's not going to go to the right 911 center anyway.
2668780	2671620	And then you're going to raise a whole host of other questions.
2671620	2677820	Like, well, if your call ended up in Boca Raton, but you're calling from Denver,
2679540	2684140	then there's something, clearly something has happened that we don't expect
2684140	2686800	and that we ought to be asking more questions about.
2687360	2689440	So great, great question, really appreciate that.
2689440	2693280	And in NG911, one of the things we're going to do is a lot more data analytics capabilities
2693280	2696020	to make sure we're authenticating things like that.
2696020	2698760	In fact, as I talked about, like the device-based hybrid
2698760	2701500	and the National Emergency Address Database and all that,
2701500	2706500	when we were negotiating those new rules with the wireless carriers and the FCC,
2706500	2712440	that was one of our key concerns was if they get a Wi-Fi hotspot, for example,
2712440	2719220	out of the database and it says this hotspot is here, let's say Caesars Palace in Las Vegas,
2719220	2724760	but the call came in from a cell tower that was in Knoxville, Tennessee,
2724760	2729260	okay, Houston, we have a problem, don't use that location data.
2729260	2732640	Fall back, use the tower, use the GPS, whatever else you've got.
2732640	2738560	So location data that comes from the database process has to be corroborated going forward.
2738560	2743640	That was a big deal for us from an integrity standpoint to make sure that we had corroboration.
2744500	2745520	Yep, in the back.
2750900	2754580	The question was, is there a 911 app? Let me be really clear.
2754580	2757960	No, there is not a 911 app.
2759000	2764460	If I could get Apple and Google to do one thing, it would be to just grep the entire app store,
2764460	2768800	the entire Play Store, and delete anything that involves the words 911.
2768800	2772280	They don't work. They're totally bogus.
2772280	2777100	There's all kinds of things, and I hate to be this passionate and upset about it,
2777100	2782680	because I love that there are developers out there trying to do helpful things for people in an emergency.
2783280	2787420	But the thing that none of the developers, with maybe one exception,
2787420	2794020	who have ever attacked this problem have understood is just how much legacy cruft there is
2794020	2798240	that stands between anything you can do with an app and the 911 system.
2798240	2800740	It just doesn't work.
2801000	2806660	The only, there's been one startup that sort of kind of halfway cracked the problem,
2806660	2811060	and they literally had to go and build millions of dollars of infrastructure.
2811060	2815680	They built their own NG911 system to just do an end run around the whole thing,
2815680	2819900	and then ultimately find some carrier partner to trunk the calls out to PSAPs.
2820940	2825720	No, there is no app that works with 911, and there won't be.
2825960	2829360	There are very good reasons that you should not do that.
2829580	2834240	Again, I appreciate people's passion, but it just doesn't work. Don't.
2835740	2840800	Unfortunately, there are dozens of apps on both of the major platforms
2840800	2846060	that purport to do something like connect you directly to the nearest police officer.
2846060	2851320	Well, okay, A, the app provider doesn't know where the nearest police officer is,
2851320	2855240	and B, the only way to connect to that nearest police officer is over a radio platform
2855240	2858800	that I guarantee you that app developer knows nothing about.
2859000	2862540	And moreover, that police officer does not want your 911 call.
2862540	2866760	Like, that's not the process. You know, they've got other stuff going on.
2866760	2870260	You know, for the third of 911 calls that are like, cat up a tree,
2870260	2875760	or McDonald's got my order wrong, or whatever the thing was that went wrong,
2875760	2878380	the nearest cop, the nearest firefighter doesn't want that.
2878380	2881320	We have these things centralized for a very good reason.
2881320	2883860	The people that take these calls are an important part of the process,
2883860	2885420	and you can't circumvent that.
2885760	2889200	So, sorry to be passionate about it, but yeah, no, no app, and won't be.
2890480	2891500	Down front?
2895900	2907620	Let's say someone released an Android 9.
2907960	2909960	Clearly you missed my talk yesterday.
2911400	2912960	So that actually happened.
2912960	2916940	So the question was, if we have all this legacy stuff that's very susceptible,
2916940	2919140	and, you know, minimum traffic carrying capacity,
2919140	2923000	what if somebody has some malware that gets on a major platform,
2923000	2925060	and then starts calling 911 repeatedly?
2925400	2927700	What I will do is point you to the DEF CON media server,
2927700	2932540	because once that talk goes up, you can get 45 minutes of a great answer to that question.
2932640	2934300	In the back.
2942210	2944850	The question is, what about the integration with SS7?
2945590	2951390	The regrettable reality is, SS7 is going to be with us for some period of time.
2951390	2955610	For most 911 systems, SS7 would be an upgrade.
2955610	2957830	Because they're still using MF and Cama.
2958690	2963450	Yes, yes, that is exactly the look you should have when I say they're still using MF and Cama,
2963450	2965450	but they are. That's how they're signaling things.
2965450	2967090	They're not using SS7.
2968050	2971410	The ultimate goal is to bypass that completely.
2971410	2976450	We'll still have to have SS7 interfaces for carrier networks that hang around,
2976450	2980610	because signaling system 7 is going to be with us for some period of time.
2980610	2983410	But next generation 911 is designed to start getting rid of that,
2983410	2985230	get it out of the system as quickly as we can.
2986090	2988990	I think we've got time for maybe one or two more questions.
2993130	2995590	Okay, I'll be hanging around in the hallway then.
2995590	2999490	Thank you all very much for coming to the talk, and great getting to chat with you.
2999490	2999930	Take care.