Hello, Roots. Our next speaker is Alex Stamos, the chief security officer at Facebook.
Hey, everybody. I'm Alex. I work at Facebook. And I get to work with a bunch of people whose
job it is to think about the safety and security issues. No, it's okay. I'll just leave it here.
It's fine, John. Safety and security issues for over 2 billion people. How many people
do you guys think in the world have Internet access? Who thinks? How many people are there
in the world? We'll do a little. Should I do Socratic method? Yeah. 7.6 billion? I think
that's about right. That's more significant digits than I feel comfortable saying. So
about a little less than 4 billion of those people have some amount of Internet access.
Right? Have...
So we define that as have regular access to 2G internet, which is slower internet than any kid in here has ever used in their life.
But that's actually really significant.
And so about 2 billion of those people use one of our products.
So we have Facebook, which none of you kids have heard of.
You've heard of Instagram, which is us as well.
And WhatsApp, which has about 1.3 billion people.
WhatsApp actually has more messages on WhatsApp than all the text messages in the world put together.
Which makes it pretty amazing.
And it's also pretty amazing in that it's end-to-end encrypted, which means that all of the things that you send on WhatsApp are secret except for the two people or the multiple people part of the conversation.
And that was a really tough thing.
And it's also a really interesting ethical issue, as you'll hear later probably from Leonard.
So what I just wanted to do is talk a little bit about what we do in security and safety and why it's really important.
And then I'm going to have plenty of time for questions.
And we've got prizes for questions because I want to encourage candidates.
So I'm going to start off with a little bit of curiosity and questioning of authority figures, which is something I've done.
So this is my 20th year at DEF CON.
I came when I was 18 years old.
So you can do the math on that.
I did not have a beard when I was 18.
But what I did, just like you, I was really excited to come to DEF CON and to meet a lot of people who were, just like me, really curious in how the world worked.
And at the time, we didn't do stuff like this where there's all the awesome opportunity to hack stuff.
To go do competitive hacking.
To go disassemble things.
For us, we kind of had to find a lot of that.
And a lot of my friends of that era did those things in a way that wasn't completely legal.
And DEF CON has really changed a lot and given us all these opportunities to explore and use our creative skills in a way that is not just legal and ethical, but you're making the world a little bit of a better place.
And so the things we do at our security team.
So the first is we work to protect our company.
So people want to break into us all the time.
Why do you think they want to break into us?
Why would you want to break into a company that has 2 billion people communicating with each other?
Yeah.
That's fantastic.
What's your name?
Maggie Young.
Thank you very much, Maggie Young.
That's a totally correct answer.
You can break into the company and get information about people.
Their private information.
Which can be super valuable to lots of bad people.
Right?
To criminals who want to steal money from people.
From governments that don't like the fact that people that live in their country are able to communicate freely.
And lots of people who want to cause individual harm.
And so we have to protect the company.
And that's a big challenge because we deal with some of the best hackers in the world who want to break in.
We have another challenge which is we have to build really secure products.
Right?
So like I said, we have 2 billion people on Facebook.
700 million on Instagram.
1.3 billion on WhatsApp.
We also make the Oculus headsets.
Has anybody here played with an Oculus before?
That's a lot of fun.
Right?
Technically you're not supposed to do it until you're 13.
There's this interesting safety legal issue.
So I'm going to ignore those hands.
But yes.
It's a lot of fun.
And we build those.
We don't actually build them ourselves.
We have a contract manufacturer.
We make our products secure.
And we do that both by having people on the inside who work to think about how can this thing break.
But we also ask people on the outside to break things for us.
Anybody know what that's called when we pay people to find bugs?
Yeah.
White hat program or a bug bounty program.
That's right.
And so we've given out about $5 million over the last 4 years to people who have found bugs.
And for some of these people it's like a fun thing to do.
It's like a side project.
For some of the people that do this, this is a full-time job.
And they support their entire family doing this.
We have a young man from India from a small village who's made over $100,000 just from us finding bugs.
And that's allowed him to support his entire family.
And so you meet all these really interesting people.
And then the third thing we do is we focus on the safety of our community.
Which when you have 2 billion people, 99.9% of people are good.
But the 0.1% of people who aren't good can do a lot of good things.
A lot of bad things online.
And so in that area we try to make sure that people are being nice to each other.
That they're behaving per our rules.
That they're not abusing each other.
And then we also, one of the things we particularly focus on is the interaction between adults and younger people.
Because that can be a really dangerous thing sometimes.
And so we do a lot of works in the safety issue as well.
And it's a lot of fun.
And one of the things we've been working on recently is around protecting elections.
Anybody know what happened last November?
No.
Oh, where are you from?
Canada.
Canada?
Yes.
Where you have a functioning democracy.
Congratulations on that.
I've got to meet your prime minister.
He's a very nice guy.
You have to not look him straight in the eyes because you'll fall into them.
Into those deep blue pools.
But, yeah.
Yeah, but you're right.
So there was alleged hacking of the U.S. election.
You said the name of the country.
Which is the United States.
Which I'm not allowed to do.
According to our lawyers.
But there was a lot of things going on to try to influence our election in the United States.
And that's actually happened in other places, too.
We've seen that in France.
There's activity in Germany.
And there's actually activity all around the world trying to mess with people's elections.
So that's the kind of thing that is a new problem for us.
And one of the great parts about our job and my job is I get to deal, that's a great look.
Yeah.
One of the great parts about my job is I get to work on these security problems that nobody's ever seen before.
Countries trying to manipulate millions or hundreds of millions of people to change elections is the kind of security problem that nobody's had to deal with before.
And so there's no book you can read.
And there's no class you can go to.
We just have to kind of figure it out as we go along.
And that's what we're doing.
We had to spin up an entire team whose job it is to study that.
And that team had some kind of traditional nerds.
People like me.
People who went to a computer science or electrical engineering degrees.
But we also have a lot of interesting people who do different things.
So the woman who runs that team, her name is Jen, she has an undergraduate degree in like foreign relations.
And she went a master's degree from a famous school that teaches about foreign relations and international service.
And then she learned the computer stuff later.
We have people who have language skills and all the different languages we have to deal with.
We have people with sociology degrees.
And so one of the neat things about security is that you have to figure out how to use that.
It's not just about hacking computers in a super technical way.
Security is becoming the study of all of the different things that you can do with technology that can cause harm.
And I think that's a super important thing.
And I think that's also really exciting for young people because there's all kinds of new things you're going to have to deal with.
And honestly, I can't predict in 15, 20 years when you guys are in the workforce what the kind of problems are going to be that you're going to deal with.
So anyway, anybody have any questions about what we do or what's going on?
Yes.
What's my favorite part of what I do?
What's my favorite part of what I do?
That's a great question.
So I like meeting new people.
I get to do that a lot.
I get to travel around the world.
There's some swag.
You hacked our swag formula.
Good work, buddy.
Social engineering for sunglasses.
I like traveling around the world and meeting new people and representing the company and talking about the things we do security.
So I got to, in the last couple of months, I've been in, I got to go to Korea and Japan and meet people there.
I got to talk to them about what they're doing in security and meet their heads of cybersecurity.
I got to go to Germany and France.
So I got to go to the LSA palace, which is their White House in France, and talk to them about that, about security.
And then go to the Bundestag, which is the place where the German parliament is, and talk to them about what we're doing to secure their election.
And that's really neat.
It's neat to be able to, you know, we're entering this weird world where companies are doing things that are traditionally the realm of countries.
Right?
And we're in this new world where keeping people safe technically is the responsibility of private companies and people who work at private companies much more so than the actual countries where they live.
And so that's, like, been a really interesting thing to be able to work with these people who are representing, you know, these people who are elected to represent millions or hundreds of millions of people.
And we have a responsibility to listen to them and to work with them.
To keep their people safe.
So I like doing that.
I like hiring people.
I like having a team and seeing young people come in.
Like, we just had a class of interns come through.
And I got to go get dinner with the interns.
And it's just really exciting to go work with people who are new to the field.
Any other questions?
Anybody want to ask anything?
Yeah?
How much data does Facebook store?
That's an excellent question.
So we don't release the exact number.
But what do you think the...
So what's a big number of data that you would think?
How's it measured?
In what bytes?
Petabytes?
That's great.
So what's a thousand petabytes?
Starts with an E.
How's your Greek?
What's six in Greek?
Exabytes.
So we measure our storage capacity in exabytes.
So for the security industry,
our storage capacity is in petabytes.
But for the overall
of holding everybody's vacation videos
for the last ten years,
turns out to be measured in exabytes of data.
In about eight data centers globally.
So think of
hundreds and hundreds of thousands of spinning disks.
Each one is holding
something between two to ten terabytes.
And that's what
our storage looks like.
We also have petabytes and petabytes of RAM.
So a lot of, like if you open up Facebook
and you just scroll through it, everything you're seeing
that is there is actually not on a hard drive,
it's in RAM.
Because there's no way we could pull it off of a hard drive
fast enough for people to have a good experience.
So basically everything everybody's done
for the last couple of days in Facebook,
all the photos, all that stuff,
is stored in hundreds of petabytes of RAM
around the world.
And then we have this big complicated system
that when you say, I want to look at a picture on Instagram,
I want to look at a picture on Facebook,
it figures out where's the closest machine,
goes, pulls it out of RAM and then gets it to you.
And so we have about eight data centers globally,
servers that are close that will route then
over a private fiber optic network
to get to where we're holding your data.
Yeah, it's pretty cool.
Data engineering is amazing.
Yeah, that's a fantastic question.
So the question was, what are the legal issues
with holding so much data?
And they are extremely complicated.
So what percentage of our users
do you think are outside the United States?
Yes, miss?
75?
That's a good guess, but it's higher than that.
The percentage is higher.
What's a number higher than 75
and lower than 100%?
87.5, that's extremely close.
It's 88%.
That guy gets two sunglasses.
That's really good.
Yeah, so we are a global company,
and so one of the challenges
all of tech companies are facing right now
is that the laws for how we operate
are very, very different everywhere.
And countries have still not figured out
how they want to regulate
what data we collect,
how we hold it, what we do with it,
what our responsibility is.
And so it's a really complicated time
to try to deal with that.
What we do is we try to follow the laws
and the places where we have
major operations.
And so for us, that's the United States,
and then Ireland is where we have
our biggest, is our headquarters
for outside the United States.
And do countries give us mean glances?
Yes. In Europe, they're giving us
a very mean glance called the
General Data Protection Regulation,
which is a whole new set of rules
about what we're supposed to do
with people's data in Europe
that nobody knows what they actually mean
because they're incredibly broad.
And so there's this constant kind of discussion
about who has the appropriate rules.
They pass these rules.
We ask them what they actually mean.
Sometimes these are friendly discussions.
Sometimes they're less friendly,
and they end up in court.
But this is kind of a constant thing
that we're trying to figure out
because there's not one set of rules
we can live by that will make everybody happy.
So we try to do the best we can
to live by the privacy rules
of the most restrictive countries,
and then hopefully that works everywhere.
Okay, I've got to get going.
Thank you so much for your time.
I'm going to be around if anybody
wants to chat about anything.
And we have our Capture the Flag competition
starting at 1 o'clock today.
We've got lots of great prizes,
drones, echoes, all kinds of stuff.
So please give it a shot
and compete in the Capture the Flag.
Thank you.