1
00:00:12,760 --> 00:00:14,520
Hello, Hapsek villagers.

2
00:00:15,160 --> 00:00:18,960
Welcome to the second year of Hapsek Village at DEF CON.

3
00:00:19,260 --> 00:00:25,720
Well, it says pause for cheering in my notes, but that's not going to work in safe mode, isn't it?

4
00:00:26,020 --> 00:00:31,060
So for those who do not know me, I'm Erez Yalon, the village mayor.

5
00:00:31,060 --> 00:00:33,160
I'm glad you could join us today.

6
00:00:33,200 --> 00:00:45,000
After years of participating in DEF CON and as an attendee, and then as part of some other villages, last year my dream of creating an Hapsek Village came true.

7
00:00:45,020 --> 00:00:49,160
Luckily, I had one person supporting my dream from the get-go.

8
00:00:49,160 --> 00:00:57,420
If you have not yet met my partner in crime, I encourage you to pop over to Discord and say hi to Leora, our Hapsek Village queen.

9
00:00:57,700 --> 00:01:02,600
She may not answer, as she is busy putting out fires, but it's worth a shot.

10
00:01:03,800 --> 00:01:08,900
Going virtual is full of challenges, but we did get a few things done right.

11
00:01:08,900 --> 00:01:14,100
One of those things was to bring Tiffany as our chief people herder.

12
00:01:14,560 --> 00:01:18,300
You will probably see the impact of her work throughout DEF CON.

13
00:01:18,660 --> 00:01:23,880
Interning to our leadership team in the role of Duke of Content is Joe Christian.

14
00:01:23,960 --> 00:01:30,620
Together with the CFP committee, he has put together a great lineup for you over the next three days.

15
00:01:30,800 --> 00:01:36,000
That lineup begins today with our keynote, Maddie Stone.

16
00:01:36,000 --> 00:01:39,220
Maddie is a security researcher at Google Project Zero.

17
00:01:39,540 --> 00:01:46,720
She likes to figure out how things work, from chips to software, and then break it.

18
00:01:46,780 --> 00:01:51,240
Her current focus is navigating the jungle of zero-day exploits.

19
00:01:51,560 --> 00:02:00,080
Please join me in welcoming Maddie Stone to the virtual stage with who's secure, who's not, and who makes that choice.

20
00:02:03,640 --> 00:02:12,180
Good morning, good afternoon, good day, since we're all in different time zones around the globe, I am so excited to be here.

21
00:02:12,180 --> 00:02:19,580
And I just want to say thank you to Ares and the whole APSEC village team for one, inviting me, and two, for putting on such a great event.

22
00:02:20,000 --> 00:02:31,520
And thank you for being here and joining me, as at least I hope some of you are here, since I am recording this all alone in my home, and I'm going to try to remember to look at the webcam.

23
00:02:31,680 --> 00:02:33,080
So let's get into it.

24
00:02:33,080 --> 00:02:44,180
My name is Maddie Stone, my pronouns are she and her, and I'm a security researcher on Google Project Zero, where I mainly focus on zero-day vulnerabilities that are exploited in the wild.

25
00:02:44,360 --> 00:02:58,400
But in other news, I also know every word to Hamilton, so I hope some of y'all picked up that the title of this talk is coming from the song, who lives, who dies, who tells their stories.

26
00:02:58,940 --> 00:03:05,140
So now this year, I've wrapped up Black Hat, sang here at APSEC village, and I think we're good to go.

27
00:03:06,040 --> 00:03:13,360
But getting back to the title of this talk, who's secure, who's not, and who makes that choice?

28
00:03:13,760 --> 00:03:16,080
Spoiler, who makes that choice?

29
00:03:16,080 --> 00:03:17,380
It's us.

30
00:03:17,600 --> 00:03:26,600
This talk has really been heavy on my heart a lot, and it really came from back at the end of May, here in the United States, George Floyd was murdered.

31
00:03:26,600 --> 00:03:31,800
And that came on the heel of Ahmaud Arbery and Breonna Taylor also being murdered.

32
00:03:31,800 --> 00:03:40,540
And it's been a real reckoning of the racism that prevails here in the United States, or at least I hope it's a reckoning.

33
00:03:40,540 --> 00:03:58,300
And for me, that's really prompted a lot of educating myself and figuring out what role have I played in racism, but how also, what role will I play in anti-racism and working to change this and address systemic racism across society.

34
00:03:58,300 --> 00:04:06,340
But it's also looking at and has brought attention to other marginalizations and inequities across populations across the globe.

35
00:04:06,680 --> 00:04:19,860
And so, when looking at this, I was reading books, listening to black voices and educators, donating money, going to protests, figuring out all these different ways to participate.

36
00:04:19,920 --> 00:04:28,140
But I think it was a really important one to also look inward of how might I contribute to either helping or harming through job 2.

37
00:04:28,140 --> 00:04:33,420
Especially with coronavirus, today everything is based on technology.

38
00:04:33,420 --> 00:04:38,840
To succeed, to participate in society, you have to be using technology.

39
00:04:38,980 --> 00:04:43,920
Schools are going online, work is going online, healthcare is going online.

40
00:04:43,920 --> 00:04:50,360
It's hard to buy devices nowadays that don't incorporate connections to the internet.

41
00:04:50,480 --> 00:05:00,680
So if that connection to the internet and using technology is not safe, secure, and private for all, then what type of effect does that have?

42
00:05:00,680 --> 00:05:08,260
How are we contributing if we are the ones who make all of those decisions about securing apps and devices?

43
00:05:08,940 --> 00:05:17,360
So I really started thinking about what is our role in the inequities in safe and secure access to technology?

44
00:05:17,620 --> 00:05:20,060
Because we are those decision makers.

45
00:05:20,180 --> 00:05:25,200
And as much as I would love there to be, I had to come to terms with the fact there is no neutral.

46
00:05:25,200 --> 00:05:27,440
There's only helping or harming.

47
00:05:27,440 --> 00:05:40,900
Because even if you're just helping one group of people and you try to believe there's no negative impacts to another, you're still broadening that gap if you're only helping one.

48
00:05:40,940 --> 00:05:44,520
And that contributes to more and more inequity.

49
00:05:44,700 --> 00:05:55,660
But the thing is, also, if we have the power to have caused and contributed to inequities, then that means we also have the power to address them.

50
00:05:55,660 --> 00:05:59,220
To create a more safe and secure society for all.

51
00:05:59,260 --> 00:06:00,600
And that can be exciting.

52
00:06:00,960 --> 00:06:11,000
So through this talk, I'm going to show some examples of where I think we in the security community have not served everyone.

53
00:06:11,160 --> 00:06:16,340
But I'm not using those negative examples to shame us or be like, no, no, no.

54
00:06:16,400 --> 00:06:19,080
In this example, all these people are bad.

55
00:06:19,080 --> 00:06:27,380
No, it's that, you know, really come to terms taking ownership for the decisions we make as a community and an industry.

56
00:06:27,380 --> 00:06:32,040
Because then we can see and address them so we can do better in the future.

57
00:06:32,040 --> 00:06:33,560
And we can do it together.

58
00:06:34,380 --> 00:06:36,500
So here's our first example.

59
00:06:36,500 --> 00:06:37,800
And it's topical.

60
00:06:38,200 --> 00:06:47,400
You know, come March when lockdowns and shelter in place started in a lot of places around the world, a lot of everything we did shifted to Zoom.

61
00:06:47,500 --> 00:06:52,700
And Zoom was listening as everyone was crying for, we need end-to-end encryption.

62
00:06:53,180 --> 00:06:57,900
You shouldn't be able to, you at Zoom, see the contents of the calls.

63
00:06:57,900 --> 00:06:59,400
And so Zoom listened.

64
00:06:59,400 --> 00:07:05,720
They got all excited and issued, you know, to the press, we will begin providing end-to-end encryption.

65
00:07:05,820 --> 00:07:10,360
But it will only be for the paid tier, for the paying customers only.

66
00:07:10,820 --> 00:07:19,820
And so it's only those who can pay and will pay are deserving of that end-to-end encryption protection.

67
00:07:19,880 --> 00:07:28,900
But it even went so far as to say the reason why it's only for paying customers is that they want to be able to work with law enforcement to catch bad actors.

68
00:07:28,940 --> 00:07:30,540
So that makes it even worse.

69
00:07:30,540 --> 00:07:46,160
Because isn't the meaning then of that is, hey, we think that only those who can't afford and won't pay for the paid version of Zoom, they're the only ones who could be bad actors and thus should be reported to law enforcement.

70
00:07:46,640 --> 00:07:56,140
And thus, we're then saying you can be safe, don't deserve to go to jail, you know, on and on if you're going to pay us.

71
00:07:56,160 --> 00:07:59,320
But otherwise, you don't deserve that protection.

72
00:07:59,560 --> 00:08:06,520
Thankfully, this was reversed thanks to outcry from the community as well as ACLU.

73
00:08:06,680 --> 00:08:09,180
But the fact that we got to this point.

74
00:08:11,240 --> 00:08:14,840
Now let's go back in time a little further.

75
00:08:14,940 --> 00:08:22,140
In October 2018 and March 2019, two 737 MAX Boeing airplanes crashed.

76
00:08:22,140 --> 00:08:26,200
One was from Lion Air, a budget Indonesian airline company.

77
00:08:26,200 --> 00:08:30,100
And the other was Ethiopian Air based in Ethiopia.

78
00:08:30,600 --> 00:08:35,440
And so there was a lot of press about how the cause of this was the MCAS system.

79
00:08:35,440 --> 00:08:39,340
A system put into these new jets that pilots hadn't been trained on.

80
00:08:39,340 --> 00:08:47,500
And using technology made a lot of decisions for the pilots such as when the nose should go down or up and things like that.

81
00:08:47,980 --> 00:08:57,020
But then it came out in this New York Times article that there were two actual extras that airlines could buy for their airplanes.

82
00:08:57,020 --> 00:09:11,760
And these two extras could have helped prevent the crashes potentially because they would alert the pilots when that MCAS system was acting up and that the sensors maybe shouldn't be trusted.

83
00:09:11,760 --> 00:09:17,320
And so those two features were the angle of attack indication and the angle of attack discreet light.

84
00:09:17,880 --> 00:09:21,060
But Boeing charged extra for them.

85
00:09:24,230 --> 00:09:27,110
Another example is single sign-on.

86
00:09:27,110 --> 00:09:36,930
So across our community, best practices, I think we all generally say that SSO is a critical part of securing enterprises.

87
00:09:37,110 --> 00:09:44,970
Single sign-on or SSO allows users to sign into many different tools using that same account.

88
00:09:45,850 --> 00:10:04,430
And so the reason why this is considered a best practice is then like the company who's buying these different tools and needs their employees to log in only has to track privileges and accesses on one account system and it prevents different password roles,

89
00:10:04,430 --> 00:10:10,350
potential repetition if the employees have to come up with all these different accounts and passwords.

90
00:10:10,350 --> 00:10:13,930
And it also is much easier to handle when an employee leaves.

91
00:10:13,930 --> 00:10:17,350
You don't have to remember to remove all of these different accesses.

92
00:10:17,350 --> 00:10:19,350
You only have to delete it in one place.

93
00:10:19,670 --> 00:10:33,950
So this website, sso.tax, tracks the difference in costs that software-as-a-service companies charge if the company buying their software, their customer wants single sign-on as a part of this.

94
00:10:33,970 --> 00:10:48,570
And so it's often two to three times more if you want to use single sign-on but sometimes can be as much as 500% increase in price in the case of IrrTable and you can see the others here.

95
00:10:48,710 --> 00:10:51,490
And just think about that for a second.

96
00:10:51,490 --> 00:10:56,170
This is something we consider as the information security community.

97
00:10:56,170 --> 00:11:02,570
We consider it a core thing enterprises should be doing to protect themselves and thereby their users.

98
00:11:02,870 --> 00:11:08,670
And we as an industry also complain when companies don't follow our best practices.

99
00:11:08,730 --> 00:11:13,510
But we're now adding these hurdles for them to be able to follow our best practices.

100
00:11:13,510 --> 00:11:18,550
We're saying, actually you only should do it if you can pay this extra.

101
00:11:18,550 --> 00:11:22,930
Otherwise you don't need this core security feature.

102
00:11:26,260 --> 00:11:46,960
Another example where paying got you more privacy or safety or security is that from 2013 to 2016, AT&T which is an internet provider here in the United States, they would charge you 30 to 60 dollars more a month if you did not consent to their internet preferences program.

103
00:11:46,960 --> 00:11:54,460
So the internet preferences program tracked all of the web browsing you did, how long you spent on the website and things like that.

104
00:11:54,460 --> 00:12:01,220
And since it was at the IPSP level, it ignored cookie preferences, ignored do not track private browsing, etc.

105
00:12:01,300 --> 00:12:10,560
So if you consented to AT&T being able to gather all this data from you, you got to pay 30 to 60 dollars less.

106
00:12:10,800 --> 00:12:21,200
So at the point of a year, that's 720 dollars or this article says 744 extra per year.

107
00:12:21,560 --> 00:12:36,580
I don't know a lot of people who would say, sure, I can pay 744 dollars a year for so-and-so privacy, but the ones who can and will and understand that, they get to be safe and secure and private.

108
00:12:36,600 --> 00:12:42,640
Everyone else deserves to have their data read and tracked.

109
00:12:42,860 --> 00:12:51,880
And so finally after, you know, multiple years of this program ongoing, AT&T was getting more bad press and they decided to cancel the program.

110
00:12:52,080 --> 00:12:56,520
But it still went on for a while, you know, from 2013 to 2016.

111
00:12:57,640 --> 00:13:07,640
And so this is where I think we all really need to think both individually and as an industry, what do our actions say?

112
00:13:08,160 --> 00:13:13,640
And do those, they match our beliefs around InfoSec and security and privacy.

113
00:13:14,300 --> 00:13:23,200
Because I know what I hear from others and what I believe is not that, oh, security is only for some.

114
00:13:23,200 --> 00:13:30,300
I continue to hear that security and privacy is a requirement and that shouldn't be a commoditized feature.

115
00:13:30,300 --> 00:13:34,600
Because while we all value it, it's the baseline.

116
00:13:34,600 --> 00:13:35,940
It's the foundation.

117
00:13:35,940 --> 00:13:41,180
You shouldn't have a minimal viable product that doesn't have security and privacy built in.

118
00:13:41,180 --> 00:13:47,980
It's not that extra that you can add in in version 2 or it's only for premium users.

119
00:13:48,180 --> 00:13:55,240
So if we know there is a type of way to keep users safe, then they deserve that.

120
00:13:55,680 --> 00:14:02,740
If that's our mission and our beliefs and our values though, do our actions line up with that?

121
00:14:02,740 --> 00:14:11,080
Because it looks like based on these many anecdotes that we're actually saying only the rich deserve to be secure.

122
00:14:11,600 --> 00:14:19,860
And I don't think, honestly, that's what any of us in the community believe what we would go around telling.

123
00:14:19,860 --> 00:14:24,660
People get up on the stage during conference talks saying only the rich deserve privacy.

124
00:14:24,660 --> 00:14:28,140
Everyone else should have all of their internet behaviors tracked.

125
00:14:28,200 --> 00:14:29,740
But is that...

126
00:14:29,740 --> 00:14:37,780
do our actions and how we secure products and the products we release and the apps we release, do they show that?

127
00:14:38,740 --> 00:14:43,820
So security, privacy, and safety are our minimal viable product.

128
00:14:43,920 --> 00:14:49,220
Everything has to have them built in to be a product, to be an app that launched.

129
00:14:49,220 --> 00:14:55,680
Otherwise, we don't have anything that is fit to be released to prod, basically.

130
00:14:55,860 --> 00:15:00,580
And I know this analogy has been beaten over and over and over again.

131
00:15:00,620 --> 00:15:09,180
But what we need to do is treat the security, privacy, and safety in the same way that cars treat seatbelts.

132
00:15:09,220 --> 00:15:12,380
Yes, it costs more to add a seatbelt to a car.

133
00:15:12,380 --> 00:15:14,840
But that is the minimal accepted level.

134
00:15:14,840 --> 00:15:18,580
You can't buy a car right now that does not have seatbelts in.

135
00:15:18,580 --> 00:15:21,820
And so that's how we should treat security, too.

136
00:15:24,200 --> 00:15:31,880
And so, at this point, sometimes people say, oh, we should just all be apolitical.

137
00:15:31,960 --> 00:15:47,040
If that straw man argument is coming up, then I would just like you to think about the fact that all we're talking about is addressing the inequities that can occur for different groups of people when we're trying to secure products.

138
00:15:47,040 --> 00:15:52,920
Our job is to be security engineers or other types of professionals in the information security community.

139
00:15:52,920 --> 00:15:57,300
So talking about those impacts, I don't think that's political.

140
00:15:57,660 --> 00:16:02,820
If you do, then sure, InfoSec is inherently political.

141
00:16:02,900 --> 00:16:20,140
But these conversations about having a specific group we're trying to protect have been around since the beginning of the industry and the community because we've always had set users that we're hoping to secure further or provide more privacy for.

142
00:16:20,140 --> 00:16:26,260
And so let's look at some of that and how that's framed that we've always had a user in mind.

143
00:16:26,520 --> 00:16:35,260
So first, we can go back to 2002 when Hato Bismo, a branch off from the cult of the dead cow, launched the 6-4 system.

144
00:16:35,260 --> 00:16:49,520
So the 6-4 system is a network proxy built to evade censorship and the protocol was named 6-4 to remember the massacre at Tiananmen Square, which occurred on June 4th, therefore 6-4.

145
00:16:50,900 --> 00:17:05,420
And one of the main reasons at least that I've read that this was created was to specifically help users who are living in countries that have heavy censorship of the internet, like China and Iran.

146
00:17:07,180 --> 00:17:14,940
And fast forward to today, here's another example of having a very clear user base of who you're trying to protect in mind.

147
00:17:14,940 --> 00:17:18,940
It's even in the advertisement top of the page.

148
00:17:18,940 --> 00:17:29,120
A few years ago, Google launched the Advanced Protection Program and it's specifically to protect and secure those at risk of targeted attacks.

149
00:17:29,120 --> 00:17:33,940
So journalists, political campaign leaders, activists, etc.

150
00:17:36,440 --> 00:17:51,780
And again, here's another example from the early days of our industry until now, that generally as a community we have come together to fight against DRM and fight for consumers.

151
00:17:51,780 --> 00:18:05,720
So we're not going through and trying to protect the companies that are building DRM into their devices like a refrigerator, Windows 95, video games, John Deere tractors.

152
00:18:06,120 --> 00:18:15,840
Hackers are generally trying to find bypasses for these to protect and fight for those consumers and the customers who have bought or used these products.

153
00:18:17,660 --> 00:18:26,780
And all of those examples of having a clear user base in mind of who we're trying to protect comes to finally threat modeling.

154
00:18:26,860 --> 00:18:41,660
Threat modeling is a very basic but integral and probably required part of our jobs when we're looking to give advice, suggestions, or build new security things into what we're deploying.

155
00:18:42,120 --> 00:18:49,240
And in the threat model, you're trying to decide what are all these threats to the thing I'm trying to protect?

156
00:18:49,340 --> 00:18:56,100
So to be able to create that threat model, you have to know really well the exact group you're trying to protect.

157
00:18:56,340 --> 00:19:00,960
Threat models shouldn't be, I'm trying to protect everyone that exists on this globe.

158
00:19:00,960 --> 00:19:09,600
That would be a terrible threat model because we all are different human beings with different concerns, different threats, and that's just the way it is.

159
00:19:09,600 --> 00:19:16,300
So I hope through this talk you're not taking that Maddy is saying our threat models have to be every single human.

160
00:19:16,300 --> 00:19:29,820
The point is that first identifying, like we do, exactly who is the person we have in mind that we're creating these security features for and are thus trying to protect.

161
00:19:30,940 --> 00:19:43,420
And the key of that is that though, once we make that choice of who is protected, we also need to acknowledge and take ownership that that is also making a choice of who is not protected.

162
00:19:43,540 --> 00:19:52,100
Because when we're building security and new products and features for a certain group of people, inherently another is excluded.

163
00:19:52,860 --> 00:20:04,640
So for example, Google Advanced Protection, that's not bad because not everyone needs all of that protection and some would actually find it very frustrating to use.

164
00:20:04,820 --> 00:20:19,600
But that is a decision and an ownership of okay, it's the people who choose to opt in who view themselves as at risk of targeted attacks or fall into one of these certain categories like working on a political campaign.

165
00:20:20,600 --> 00:20:38,670
But we do need to address this because the ability for us to make those choices is inherently a power and a privilege because others don't get to make that choice necessarily whether or not they're included in these groups that we're trying to protect.

166
00:20:39,060 --> 00:20:49,600
And when some people are protected and secure and others aren't, that's going to continue to grow the systemic inequality that we see around the world.

167
00:20:49,600 --> 00:20:59,840
So let's look at some side effects of security decisions when you have in mind a clear group you're trying to protect but maybe don't think about all the implications for others.

168
00:21:00,860 --> 00:21:08,280
So first, Rite Aid uses facial recognition in secret across hundreds of its stores.

169
00:21:08,580 --> 00:21:12,480
So Rite Aid deployed this, you know, to protect themselves.

170
00:21:12,540 --> 00:21:24,540
They said in this article that their concern and their reasoning was we need to protect ourselves from theft and we also need to protect our staff and our customers from violence.

171
00:21:24,540 --> 00:21:27,480
So that's their security concerns.

172
00:21:28,380 --> 00:21:40,560
But if that's who is quote-unquote being protected, it's Rite Aid, they're actually sacrificing all of the privacy of their customers in order to have that security for themselves.

173
00:21:41,220 --> 00:21:49,360
And if you read this article and it even says in this headline, this wasn't deployed equally.

174
00:21:49,360 --> 00:21:54,100
It was predominantly used in low-income and non-white neighborhoods.

175
00:21:54,140 --> 00:22:10,060
And so it's furthering a gap that, oh, we're just worried about theft and violence in non-white, low-income neighborhoods and so we don't need to worry about it there and thus we're sacrificing these people's privacy.

176
00:22:10,060 --> 00:22:17,460
But I think if you took a step back and let's say we're security engineers tasked with this problem.

177
00:22:17,460 --> 00:22:20,760
How do we help protect Rite Aid from theft?

178
00:22:20,760 --> 00:22:24,840
How do we help protect them from violence occurring in the stores?

179
00:22:25,240 --> 00:22:38,000
I think we could come up with a lot of different other solutions that could help protect themselves without sacrificing the customers' privacy in the process.

180
00:22:39,380 --> 00:22:43,680
Another example is parent or child protection apps.

181
00:22:43,820 --> 00:22:48,980
I have a lot of feelings about these apps but I'm not going to get into that now because I'm not a parent.

182
00:22:48,980 --> 00:23:04,180
But the whole premise is these are built for the customer which is the parent or the adult guardian to install on their child's mobile devices in order to try and keep the child safe.

183
00:23:04,240 --> 00:23:17,080
But if the parent is the one responsible and the customer, it's actually built to address what the parent thinks the kid's threat model is not actually who the user of the device's threat model.

184
00:23:17,080 --> 00:23:30,220
And so that can have unintended consequences or maybe intended but we'll go with unintended consequences on whoever is using the device and has this application installed on their own device.

185
00:23:31,180 --> 00:23:44,060
So for example in here it's saying this app gives you the ability to listen to the surroundings of whoever is using this app.

186
00:23:44,140 --> 00:23:45,300
What?

187
00:23:45,320 --> 00:23:48,060
That's turning on the microphone and listening?

188
00:23:48,520 --> 00:23:56,600
While the folks securing and building this app may be intending that this app is only used in consensual relationships.

189
00:23:56,640 --> 00:24:07,220
The kid gets the phone, the parent talks to the kid of you can have this phone but I'm going to be monitoring these different behaviors for you to be able to use this phone.

190
00:24:07,420 --> 00:24:09,480
Hopefully that's what they're building for.

191
00:24:09,600 --> 00:24:13,420
That doesn't mean that's the only way this technology will be used.

192
00:24:13,680 --> 00:24:19,900
What's the difference in the technology at the base level between spyware and stalkerware?

193
00:24:19,900 --> 00:24:29,280
Instead you're depending on the users to only use it in a way in which you're building it.

194
00:24:29,280 --> 00:24:39,360
As a woman in my 20s, I have had friends who have stalkerware installed on their phones but it looks and it brands itself as a child protection app.

195
00:24:40,040 --> 00:24:54,620
And also do the people building this and the security and the threat model of their users also consider the reality that sometimes the adult parent and guardian doesn't have the child's best interests at heart.

196
00:24:54,640 --> 00:24:59,940
These also have been said to be used in child traffic wings.

197
00:25:00,280 --> 00:25:16,520
And so when we make compromises and sacrifices for a single use case such as, oh I don't love this idea but it's only going to be used by parents who have a kid who consents to have it on their phone because otherwise they wouldn't have the phone.

198
00:25:17,060 --> 00:25:26,700
If we're building only for that use case but there's nothing making that app only be used in that use case, then we're still causing harm.

199
00:25:26,700 --> 00:25:31,820
And so there's no guarantees that code will be built the way we intend it to be built.

200
00:25:33,440 --> 00:25:36,840
So, headline kind of says it all.

201
00:25:36,840 --> 00:25:41,400
United States government funded phones come pre-installed with unremovable malware.

202
00:25:41,580 --> 00:25:55,220
So there is a program or there was in the United States that if you were low income if you didn't have the means to get yourself a phone the US government would provide you with a smartphone based on Android.

203
00:25:55,660 --> 00:26:02,260
You know, cheaper phones, not the flagships and lo and behold they come pre-installed with unremovable malware.

204
00:26:02,680 --> 00:26:14,300
So this is one of those things where I hope that the government wasn't intending to install malware on each of these devices.

205
00:26:14,300 --> 00:26:21,680
I hope that they were trying to give phone and technology access.

206
00:26:21,860 --> 00:26:43,380
But because of how cheaper devices have begun to subsidize themselves by installing whatever people will pay them to install we have now harmed the privacy and security of these users who really were already in a tough spot in society and trying to live their lives.

207
00:26:43,380 --> 00:26:45,420
So Strava.

208
00:26:45,440 --> 00:26:51,100
Even on their website the Strava app says they build for athletes.

209
00:26:51,100 --> 00:26:53,020
So that's their user base in mind.

210
00:26:53,020 --> 00:27:01,460
That's who they're trying to protect when they're securing this application and the data that is stored that comes from it.

211
00:27:02,000 --> 00:27:09,600
But when you just think about securing for athletes, that's only one part of who someone is.

212
00:27:09,600 --> 00:27:15,160
So we really need to take into account the intersectionality of all of us as humans.

213
00:27:15,260 --> 00:27:24,720
Because as a female athlete, I get very concerned about my location data being able to be tracked by anyone else.

214
00:27:24,880 --> 00:27:50,180
Military personnel want to be athletes, want to have the features of the Strava application but I bet it wasn't considered that although the data on the heat maps that are open to the public and on the internet that are seen is aggregated that aggregation meant that you could end up seeing where military bases were abroad when all these different military personnel,

215
00:27:50,180 --> 00:27:55,340
who are also athletes were going for their jogs at the end of the day.

216
00:27:58,040 --> 00:28:07,520
And here's another example of just how far our specific choices in security can go.

217
00:28:07,920 --> 00:28:16,300
So Pixel phones as well as many other devices have a support period where they guarantee you will have security updates for this amount of time.

218
00:28:16,300 --> 00:28:25,560
In this case, the Pixel phones have three years from the release date or at least 18 months from the time it's last sold on the Google store.

219
00:28:26,560 --> 00:28:38,620
So you know, as a community, I think one of the most basic things we say to users is you should only be using devices that get security updates or else you're kind of asking for trouble.

220
00:28:38,720 --> 00:28:48,320
But we also are shortening sometimes these periods that the updates are available for things like phones and computers and devices.

221
00:28:48,320 --> 00:29:16,500
And so the first obvious impact that this choice of doing three years of security updates may have is on those again, lower income or don't have access to buying phones quickly and regularly or even just communities which sometimes can be elder adults who are not used to and don't realize they need to be updating a phone every three years.

222
00:29:16,500 --> 00:29:22,260
And they actually prefer the older ones because they know how to use them and it's more intuitive to them.

223
00:29:22,440 --> 00:29:29,060
So those are some of the obvious impacts to users that we might not be building for or choosing security for.

224
00:29:29,060 --> 00:29:32,120
But these decisions go that much further.

225
00:29:32,300 --> 00:29:39,460
If we're getting new phones every three years or faster that generates a lot of e-waste.

226
00:29:39,600 --> 00:29:49,720
And so while climate change is such a big thing, the more e-waste we generate the more negative impacts that has on our environment.

227
00:29:50,000 --> 00:29:55,060
And the environment and climate change doesn't impact all of us equally.

228
00:29:55,060 --> 00:30:12,720
There's already been a lot of research out that generally communities already in tougher positions, lower socioeconomic status, generally communities of color are the ones that are hit the hardest by the environment and climate change.

229
00:30:12,980 --> 00:30:22,880
And yet it's those of us predominantly in US and Western Europe who are buying and disposing of these phones.

230
00:30:22,880 --> 00:30:35,760
And so our security decisions end up impacting these people, you know, on other places who might have nothing to do and have never interacted with these phones or devices in the first place.

231
00:30:37,100 --> 00:30:40,400
So those were a lot of examples.

232
00:30:40,660 --> 00:30:42,820
Not so happy, not so negative.

233
00:30:42,820 --> 00:30:48,500
But you might be saying to me because, you know, I've said it to myself as I try to work through these things myself.

234
00:30:48,900 --> 00:30:50,500
I'm just one person.

235
00:30:50,500 --> 00:30:54,660
I just work on securing a single app with only a thousand users.

236
00:30:54,880 --> 00:30:57,300
I'm just a manager of a little team.

237
00:30:57,300 --> 00:30:58,380
I'm not an exec.

238
00:30:58,380 --> 00:31:00,440
I'm not the director of security.

239
00:31:00,560 --> 00:31:02,500
I'm just a document writer.

240
00:31:02,500 --> 00:31:04,280
All those different things.

241
00:31:04,280 --> 00:31:07,260
And you might say I'm just making little choices.

242
00:31:07,320 --> 00:31:08,960
They don't have that big of an impact.

243
00:31:08,960 --> 00:31:11,240
It's none of the examples you have listed here.

244
00:31:12,160 --> 00:31:24,060
But the issue becomes that each of our choices become patterns and the norm and the status quo for how we expect products to be developed and released.

245
00:31:24,300 --> 00:31:30,900
So you might think, oh, I'm just making this little sacrifice, a compromise to get this product out the door for me.

246
00:31:30,900 --> 00:31:33,220
Our app doesn't impact all that many people.

247
00:31:33,220 --> 00:31:34,680
So it's good.

248
00:31:35,100 --> 00:31:47,100
But that choice then gives a precedent or a permission for others to make the same one and make those same compromises or those same sacrifices for a different group of people.

249
00:31:47,460 --> 00:32:00,340
And unfortunately, because this technology is so built into our ability to thrive, each of those little choices become systemic inequities.

250
00:32:00,340 --> 00:32:04,860
And they end up having huge society ramifications.

251
00:32:05,200 --> 00:32:19,940
So for example, in general, I've been guilty of it myself and I'm working on it too, but I have to acknowledge I've said, yeah, we accept that lower priced devices are less secure and that's because of the business model.

252
00:32:19,960 --> 00:32:22,340
They can't do everything.

253
00:32:22,560 --> 00:32:29,480
We accept that there is more risk to women for any apps that choose to track location.

254
00:32:29,840 --> 00:32:36,980
We accept that biometric security technologies aren't as effective on non-white faces.

255
00:32:36,980 --> 00:32:51,940
But each of these acceptances means that we are creating a system that accepts that not everyone deserves the same level of safety, security, and privacy.

256
00:32:51,940 --> 00:33:01,440
And we are compounding the previously and already existing systemic injustices and inequality through this technology.

257
00:33:01,440 --> 00:33:07,420
So instead of shrinking that gap as technology can, we continue to widen it.

258
00:33:08,320 --> 00:33:18,080
And it's easier and it's easier a lot of the time to believe, you know, I'm just making this decision or one little sacrifice for one product.

259
00:33:18,080 --> 00:33:21,720
And there are so many other products and other people working in this space.

260
00:33:22,260 --> 00:33:29,980
But we lean on each other and it ends up growing and growing and showing others what's cool, what's okay.

261
00:33:30,040 --> 00:33:41,780
And that's how we end up with having these extreme gaps in how people are able to access technology privately and securely.

262
00:33:43,160 --> 00:34:01,400
So an example of how our choices for security and technology end up having huge ramifications is that in both the United States and Europe, many are now using artificial intelligence algorithms to decide on what punishments a person should receive after breaking the law.

263
00:34:01,400 --> 00:34:10,840
So these are things like how much or if they should have bail, what is their sentencing, are they eligible for parole?

264
00:34:10,840 --> 00:34:13,880
This has now been pushed off to algorithms.

265
00:34:13,900 --> 00:34:16,540
But we as humans write these algorithms.

266
00:34:16,540 --> 00:34:27,920
And so these algorithms are saying, that have been written by humans, are deciding whether or not we believe this person can be rehabilitated to become a contributing member of society.

267
00:34:27,980 --> 00:34:31,660
And this algorithm is saying whether or not this person will commit a crime.

268
00:34:32,320 --> 00:34:41,620
But since we're coding all of these algorithms, they're going to bring the reflections of the team that's writing them.

269
00:34:41,620 --> 00:34:46,240
And the reflections of that security team who's looking at it and assessing it.

270
00:34:46,600 --> 00:34:52,220
Because, for example, I'm a white woman from the US for Canada Tech Company.

271
00:34:52,260 --> 00:34:55,560
If I'm writing the algorithm, I know I'm innocent.

272
00:34:55,560 --> 00:35:01,500
So I'm probably going to assume that people like me are innocent too and deserve shorter sentences.

273
00:35:01,620 --> 00:35:18,160
And so if our team all looks like me or only a few groups of people, then we're probably going to write our algorithm to contribute to just those... to give shorter sentences for the people who are like us and it's the others who are harmed.

274
00:35:18,640 --> 00:35:25,680
And I use another slide of emphasizing the same thing because this impact is just so huge.

275
00:35:25,760 --> 00:35:27,320
This is life or death.

276
00:35:27,320 --> 00:35:30,060
Having to go to prison or not.

277
00:35:30,160 --> 00:35:36,060
And it also causes generational trauma that goes across families for years and years and years.

278
00:35:36,060 --> 00:35:43,260
And so we really make sure that we are looking at our choices and understanding each of the consequences.

279
00:35:43,260 --> 00:35:47,240
Those consequences can be good or those consequences can be bad.

280
00:35:47,240 --> 00:35:51,580
But our choices create systemic problems.

281
00:35:53,020 --> 00:36:01,880
Another example of a systemic issue is, you know, in general, sex workers are discriminated against.

282
00:36:01,880 --> 00:36:05,380
And this article from Airbnb is just another example of that.

283
00:36:05,380 --> 00:36:07,600
So Airbnb developed an algorithm.

284
00:36:07,600 --> 00:36:08,580
They actually bought it.

285
00:36:08,580 --> 00:36:15,600
They used it and then bought it to try and determine how trustworthy a potential guest might be.

286
00:36:15,600 --> 00:36:21,880
Okay, let's put our Airbnb security engineer hat on as we've done for some of the other companies.

287
00:36:22,320 --> 00:36:26,880
Our goal is to make sure a host's home and property is safe.

288
00:36:26,900 --> 00:36:27,880
That's the goal.

289
00:36:27,880 --> 00:36:36,420
We probably won't keep hosts coming back if there's a high likelihood that they'll be stolen from, their house destroyed, things like that.

290
00:36:36,420 --> 00:36:43,220
So we're going to use an algorithm to decide whether or not the guests are trustworthy and thus should be allowed to rent.

291
00:36:43,920 --> 00:36:51,860
But along the way, while building this algorithm, we decide that sex workers mean they are untrustworthy.

292
00:36:52,040 --> 00:36:57,380
It doesn't matter if the sex worker is not using this for sex work.

293
00:36:57,380 --> 00:36:59,160
They just want to go along with their life.

294
00:36:59,160 --> 00:37:05,160
It does not matter if we are in a country where sex work is legal.

295
00:37:05,160 --> 00:37:10,720
We have decided through this algorithm that sex work equals untrustworthy.

296
00:37:10,720 --> 00:37:13,340
And thus, they don't have access to units.

297
00:37:13,340 --> 00:37:21,000
There can be random cancellations that put them at further harm if they've already arrived in the city or location and thus no longer have lodging.

298
00:37:21,060 --> 00:37:24,060
But that's the decision we've made in our algorithm.

299
00:37:24,420 --> 00:37:32,220
And the thing is, is that that continues to allow permission for then other companies to say, oh yeah, they did it so we can do it too.

300
00:37:32,220 --> 00:37:33,240
They're sex work.

301
00:37:33,240 --> 00:37:34,180
It's a category.

302
00:37:34,180 --> 00:37:34,860
We don't trust them.

303
00:37:34,860 --> 00:37:35,980
We don't allow them.

304
00:37:35,980 --> 00:37:37,600
And I think we see this.

305
00:37:37,600 --> 00:37:43,900
We see it over and over again, how sex workers are discriminated against.

306
00:37:45,960 --> 00:37:55,840
And so in this case, we're coming back to the e-waste anecdote we discussed earlier regarding security updates and their support periods.

307
00:37:56,300 --> 00:38:07,460
And so based on this graph, we can see that North America, Western Europe, Australia and Japan and South Korea are generally the biggest producers of e-waste.

308
00:38:07,460 --> 00:38:11,660
But they don't keep the e-waste to themselves or ourselves.

309
00:38:11,880 --> 00:38:17,120
We send it off to other countries and we pay them to accept it.

310
00:38:17,300 --> 00:38:34,720
And so then those other countries, which you know, Eastern Africa, I mean Western Africa, I always forget my East and West and Southeast Asia are two of the places that predominantly receives this and they're also at huge risk from climate change.

311
00:38:34,720 --> 00:38:48,620
But we're saying, hey, now y'all have to figure out how to deal with all of these toxic metals and parts that are within all of these devices and you're also going to be the ones hurt by climate change.

312
00:38:50,480 --> 00:39:05,740
But lastly, to hopefully get you on board and one more way of... we're at this precipice and we might be a few years past it where everything is becoming reliant on technology.

313
00:39:05,740 --> 00:39:11,640
We can't say, oh people are generally going to be safe and secure because they can choose not to use it.

314
00:39:11,640 --> 00:39:17,840
They can choose to only buy the expensive ones or else they're fine without any device.

315
00:39:18,220 --> 00:39:21,680
That's not where we are or where we're going.

316
00:39:21,780 --> 00:39:26,700
You know, in the United States, there's a lot of talk about moving to mobile drivers license.

317
00:39:26,700 --> 00:39:30,840
There's been different efforts to move to mobile passports.

318
00:39:30,840 --> 00:39:39,580
And so it will take extra effort and cause extra money to have to go and get a physical card if that's even allowed in the future.

319
00:39:39,780 --> 00:39:51,420
Even with coronavirus, just in the last couple of months, a lot of restaurants and retailers have decided to stop accepting cash just because of perceived virus transmission.

320
00:39:51,740 --> 00:40:03,540
And this hurts communities that either don't have access to banks or have a lot of reason not to trust that banks are safe for them and who have been wholly reliant on cash.

321
00:40:03,540 --> 00:40:11,780
We're again leaving them behind and saying, oh yeah, you don't need to participate in the economy because we've decided to go cashless.

322
00:40:12,300 --> 00:40:16,440
And another example is airlines.

323
00:40:16,520 --> 00:40:18,960
So in this case, this is Ryanair.

324
00:40:18,960 --> 00:40:34,840
And if you don't have an online boarding pass and you need the airline to print it for you at the airport, you know, how things were done six, seven years ago and was the norm, it will now cost you an additional 20 pounds.

325
00:40:34,920 --> 00:40:40,220
So if you don't have technology, you are further penalized and charged for that.

326
00:40:42,160 --> 00:40:43,560
So what do we do?

327
00:40:43,560 --> 00:40:49,640
I told you I didn't want to just present problems with no solutions.

328
00:40:50,340 --> 00:40:58,380
And I'm guessing you, like me, are probably in the spot of, Maddie, this problem area is so huge.

329
00:40:58,380 --> 00:41:02,080
How do we even begin to confront it?

330
00:41:02,080 --> 00:41:12,020
And the first thing I want to do is remind us that we are in this powerful place of privilege and that the choice is up to us to address it.

331
00:41:12,020 --> 00:41:13,600
If we don't, no one else is.

332
00:41:13,600 --> 00:41:20,060
No one else can fix this because we are the ones who are in charge of information security.

333
00:41:20,380 --> 00:41:28,280
But this is also an exciting gift even if it might feel like a lot of responsibility because that means we don't have to sit here hopeless.

334
00:41:28,580 --> 00:41:47,880
We actually have the control personally to be able to start fighting for this new future where we believe that regardless of geolocation, race, gender, sexual orientation, ability, religion, and all the other different aspects that make us beautiful, diverse humans,

335
00:41:47,880 --> 00:41:54,160
if you have safe and secure access to the Internet, oh, what a beautiful world that would be.

336
00:41:54,560 --> 00:41:56,360
And so let's build it.

337
00:41:56,840 --> 00:42:04,040
We set the standards that security and privacy is a fundamental right, a fundamental foundation requirement.

338
00:42:04,080 --> 00:42:07,980
Nothing goes out that doesn't have security and privacy built in for it all.

339
00:42:07,980 --> 00:42:12,320
And this ultimately helps us, too, if you need the selfish argument.

340
00:42:12,320 --> 00:42:24,220
Because if we ensure that security and privacy is set in a fundamental right for everyone, if we're ever on the hook and on that precipice, we know it's guaranteed for us, too.

341
00:42:24,580 --> 00:42:37,820
So I hope 5, 10, 15, 50, 20, however many years from now, we're going to have that option hopefully to look back and say, huh, I really helped there.

342
00:42:37,820 --> 00:42:44,200
I pushed for it and now we're living in this world where everyone has security and privacy.

343
00:42:44,480 --> 00:42:49,700
Or we can look back and say, I had a chance to help change it and I didn't.

344
00:42:50,900 --> 00:42:52,980
So how do we do this?

345
00:42:52,980 --> 00:42:57,220
One, as I've said before, security is a requirement, not a feature.

346
00:42:57,220 --> 00:43:01,100
It's the baseline for even having a minimal viable product.

347
00:43:01,960 --> 00:43:08,860
This is for startups who, you know, a lot of them currently say, we get something out the door and then security is added in v2.

348
00:43:08,860 --> 00:43:10,760
Nope, we don't allow that anymore.

349
00:43:10,760 --> 00:43:14,160
It's not just for those who pay or can wait, it's for everyone.

350
00:43:16,100 --> 00:43:30,240
Next, we are already explicit a lot of the time, or if we're not, we should be, about the threat models of who we're trying to protect and why we're suggesting the security features we are, the privacy constraints we are.

351
00:43:30,280 --> 00:43:41,600
So let's not only be explicit about who is helped, but let's be explicit about who is harmed, who could be adversely impacted by the threat model we've created.

352
00:43:41,780 --> 00:43:47,880
And the reasoning is, is not that everyone should be protected and helped in the same way for every product.

353
00:43:47,880 --> 00:44:00,840
It's that by naming problems, by saying, oh, this group of people would be harmed by this choice, we can at least start to brainstorm and come up with solutions and bring our creativity.

354
00:44:01,200 --> 00:44:07,720
But it's definitely impossible to try and come up with solutions if you've never even named it to be a problem.

355
00:44:11,000 --> 00:44:18,660
Three, you might be saying to me, Maddie, there's so many different groups and identities and things that are different.

356
00:44:18,660 --> 00:44:23,100
How am I supposed to keep all of them in my head and understand all of the impacts to everyone?

357
00:44:23,100 --> 00:44:32,040
And the cool thing is, is you don't have to, I don't have to, as long as we create teams that represent all of these different views and identities.

358
00:44:32,040 --> 00:44:39,840
And that team is inclusive, such that everyone can speak up and represent those experiences that they're bringing to the table.

359
00:44:39,840 --> 00:44:49,700
So, you don't have to ensure that you know how this is going to affect someone who's LGBT in Vietnam.

360
00:44:49,700 --> 00:44:55,520
If you have someone who's LGBT and someone from Vietnam, then they can also help represent.

361
00:44:55,680 --> 00:45:00,620
But it's even better if you hire for intersectionality.

362
00:45:00,620 --> 00:45:07,240
So if you hire that LGBT person from Vietnam, then you've definitely gotten their viewpoint across.

363
00:45:07,360 --> 00:45:14,980
And so, for a lot of people in our industry, when they say, hire for diversity, it's people who look like me.

364
00:45:15,280 --> 00:45:25,320
But the only thing I bring to the table that's different is generally those views about gender that aren't always represented here.

365
00:45:25,320 --> 00:45:37,260
But if you hire a black woman or an indigenous woman, then she will bring to the table both the effects on race as well as the effects of being a woman.

366
00:45:37,260 --> 00:45:42,100
So, it's just a great investment for you to hire for intersectionality.

367
00:45:43,240 --> 00:45:49,980
Four, write code and build products for the worst possible case that it could be used for.

368
00:45:49,980 --> 00:45:56,100
And I totally spelled right wrong here, but we're this far in it, so it's going to continue.

369
00:45:56,900 --> 00:46:08,220
So, we may build technologies and secure things for a specific cause that we believe is ethically good and okay and all these things.

370
00:46:08,360 --> 00:46:13,060
But we don't always know how things are going to be used in the future.

371
00:46:13,180 --> 00:46:20,340
So, from the get-go, we need to build our products and frame our security requirements for the worst case imaginable.

372
00:46:20,360 --> 00:46:24,440
Because again, the technology can be used to help or hurt.

373
00:46:24,440 --> 00:46:27,060
So, let's build in our values and ethics from the beginning.

374
00:46:29,100 --> 00:46:33,060
Lastly, if you're a little overwhelmed, welcome to the club.

375
00:46:33,420 --> 00:46:35,040
Yes, this is hard.

376
00:46:35,040 --> 00:46:38,360
But as Glennon Doyle says, we can do hard things.

377
00:46:38,720 --> 00:46:40,140
We won't be perfect.

378
00:46:40,140 --> 00:46:41,880
I'm far from perfect.

379
00:46:41,880 --> 00:46:45,040
But we have to keep learning and trying.

380
00:46:45,220 --> 00:46:51,040
You know, an example of this is that this talk has been very US-centric because that's where my background.

381
00:46:51,040 --> 00:47:03,140
And so, it would be really valuable to Khans and the community as a whole to also have similar talks that are coming from different perspectives that I can't and don't know how to accurately represent.

382
00:47:03,440 --> 00:47:07,540
And so, the key thing is that we don't need to reinvent the wheel.

383
00:47:07,820 --> 00:47:17,020
We just need to hire and pay the people that are already doing this work and asking us to listen to the effects that this technology can have on their communities.

384
00:47:18,640 --> 00:47:24,520
And so, if we do those things together, that can make it a lot less hard.

385
00:47:24,700 --> 00:47:32,620
Because I don't know how many people are watching this talk, but I know that there are probably thousands and thousands attending DEF CON as a whole.

386
00:47:32,760 --> 00:47:46,960
So, if every single one of us decided, okay, from here on out, I'm going to start speaking up and taking actions to question, can we do better in helping more people and not allowing others to be harmed?

387
00:47:47,040 --> 00:47:48,420
And that becomes the norm.

388
00:47:48,460 --> 00:47:57,860
Because one of the things that makes this hard is being alone and feeling like you're the only one who's worried about this and challenging the status quo.

389
00:47:57,860 --> 00:48:02,300
So, if we all do this together, then the norm is to speak up.

390
00:48:02,300 --> 00:48:06,680
The norm is to demand the fundamental right to security and privacy.

391
00:48:06,920 --> 00:48:13,700
We're all in this together, and that's how we can hopefully do it and make it less scary and less hard.

392
00:48:14,080 --> 00:48:20,540
And so, finally, to close this all up, as I've said before, there's no neutral.

393
00:48:20,540 --> 00:48:26,900
I really wish there was, because sometimes we're all just tired and exhausted, but there's not.

394
00:48:26,900 --> 00:48:34,060
And so, we need to own that, and we need to own that we have the power and privilege, and all of these users are relying on us.

395
00:48:34,060 --> 00:48:42,480
So, let's use these beautiful positions and fun work we get to do to fight that security, privacy, and safety is a right for all.

396
00:48:42,940 --> 00:48:45,660
And, you know, that's the world I want to live in.

397
00:48:46,300 --> 00:48:48,380
So, with that, thank you.

398
00:48:48,960 --> 00:48:51,080
And yeah, I'm staring at my webcam now.

399
00:48:51,080 --> 00:48:52,100
Okay, bye!