start	end	text
12760	14520	Hello, Hapsek villagers.
15160	18960	Welcome to the second year of Hapsek Village at DEF CON.
19260	22420	Well, it says pause for cheering in my notes,
22420	25720	but that's not going to work in safe mode, isn't it?
26020	31060	So for those who do not know me, I'm Erez Yalon, the village mayor.
31060	33160	I'm glad you could join us today.
33200	37400	After years of participating in DEF CON and as an attendee,
37400	41080	and then as part of some other villages,
41080	45000	last year my dream of creating an Hapsek Village came true.
45020	49160	Luckily, I had one person supporting my dream from the get-go.
49160	51580	If you have not yet met my partner in crime,
51580	55080	I encourage you to pop over to Discord and say hi to Leora,
55680	57420	our Hapsek Village queen.
57700	61240	She may not answer, as she is busy putting out fires,
61240	62600	but it's worth a shot.
63800	66140	Going virtual is full of challenges,
66140	68900	but we did get a few things done right.
68900	74100	One of those things was to bring Tiffany as our chief people herder.
74560	78300	You will probably see the impact of her work throughout DEF CON.
78660	83880	Interning to our leadership team in the role of Duke of Content is Joe Christian.
83960	86080	Together with the CFP committee,
86080	90620	he has put together a great lineup for you over the next three days.
90800	96000	That lineup begins today with our keynote, Maddie Stone.
96000	99220	Maddie is a security researcher at Google Project Zero.
99540	101940	She likes to figure out how things work,
101940	106720	from chips to software, and then break it.
106780	111240	Her current focus is navigating the jungle of zero-day exploits.
111560	115040	Please join me in welcoming Maddie Stone to the virtual stage
115040	120080	with who's secure, who's not, and who makes that choice.
123640	126920	Good morning, good afternoon, good day,
126920	130180	since we're all in different time zones around the globe,
130180	132180	I am so excited to be here.
132180	135640	And I just want to say thank you to Ares and the whole APSEC village team
135640	139580	for one, inviting me, and two, for putting on such a great event.
140000	143180	And thank you for being here and joining me,
143180	145300	as at least I hope some of you are here,
145300	148100	since I am recording this all alone in my home,
148100	151520	and I'm going to try to remember to look at the webcam.
151680	153080	So let's get into it.
153080	156240	My name is Maddie Stone, my pronouns are she and her,
156240	159200	and I'm a security researcher on Google Project Zero,
159200	162040	where I mainly focus on zero-day vulnerabilities
162040	164180	that are exploited in the wild.
164360	168180	But in other news, I also know every word to Hamilton,
168180	172180	so I hope some of y'all picked up that the title of this talk
172180	173980	is coming from the song,
173980	178400	who lives, who dies, who tells their stories.
178940	181460	So now this year, I've wrapped up Black Hat,
181460	185140	sang here at APSEC village, and I think we're good to go.
186040	189320	But getting back to the title of this talk,
189320	193360	who's secure, who's not, and who makes that choice?
193760	197380	Spoiler, who makes that choice? It's us.
197600	201080	This talk has really been heavy on my heart a lot,
201080	204140	and it really came from back at the end of May,
204140	206600	here in the United States, George Floyd was murdered.
206600	209940	And that came on the heel of Ahmaud Arbery and Breonna Taylor
209940	211800	also being murdered.
211800	214920	And it's been a real reckoning of the racism
214920	217680	that prevails here in the United States,
217680	220540	or at least I hope it's a reckoning.
220540	223100	And for me, that's really prompted a lot of
223100	225520	educating myself and figuring out
225520	228220	what role have I played in racism,
228220	232780	but how also, what role will I play in anti-racism
232780	238300	and working to change this and address systemic racism across society.
238300	241000	But it's also looking at and has brought attention to
241000	243680	other marginalizations and inequities
243680	246340	across populations across the globe.
246680	248820	And so, when looking at this,
248820	251620	I was reading books, listening to
252520	254740	black voices and educators,
254740	257300	donating money, going to protests,
257300	259860	figuring out all these different ways to participate.
259920	263180	But I think it was a really important one to also look inward of
263180	266300	how might I contribute to either helping or harming
266300	268140	through job 2.
268140	271120	Especially with coronavirus, today everything
271120	273420	is based on technology.
273420	276120	To succeed, to participate in society,
276120	278840	you have to be using technology.
278980	282320	Schools are going online, work is going online,
282320	283920	healthcare is going online.
283920	286960	It's hard to buy devices nowadays that don't
286960	290360	incorporate connections to the internet.
290480	293480	So if that connection to the internet and using technology
293480	297260	is not safe, secure, and private for all,
297260	300680	then what type of effect does that have?
300680	303880	How are we contributing if we are the ones
303880	306600	who make all of those decisions about securing
306600	308260	apps and devices?
308940	311140	So I really started thinking about
311140	314040	what is our role in the inequities
314040	317360	in safe and secure access to technology?
317620	320060	Because we are those decision makers.
320180	322300	And as much as I would love there to be,
322300	325200	I had to come to terms with the fact there is no neutral.
325200	327440	There's only helping or harming.
327440	330160	Because even if you're just helping one
330900	334060	group of people and you try to believe there's
334060	336720	no negative impacts to another,
336720	340900	you're still broadening that gap if you're only helping one.
340940	343220	And that contributes to more and more
343220	346000	inequity. But the thing is,
346000	349080	also, if we have the power to
349080	352640	have caused and contributed to inequities,
352640	355660	then that means we also have the power to address them.
355660	359220	To create a more safe and secure society for all.
359260	360600	And that can be exciting.
360960	364240	So through this talk, I'm going to show some examples
364240	366940	of where I think we in the security community
368460	371000	have not served everyone.
371160	373860	But I'm not using those negative examples
373860	376340	to shame us or be like, no, no, no.
376400	379080	In this example, all these people are bad.
379080	382040	No, it's that, you know, really come to terms
382040	385060	taking ownership for the decisions we make as a community
385700	387380	and an industry.
387380	390920	Because then we can see and address them so we can do better
390920	393560	in the future. And we can do it together.
394380	397800	So here's our first example. And it's topical.
398200	400100	You know, come March when
400100	403020	lockdowns and shelter in place started in a lot of places
403020	406300	around the world, a lot of everything we did shifted
406300	409620	to Zoom. And Zoom was listening as everyone was
409620	412700	crying for, we need end-to-end encryption.
413180	416120	You shouldn't be able to, you at Zoom,
416120	418140	see the contents of the calls. And so
418140	421540	Zoom listened. They got all excited and issued, you know,
421540	424140	to the press, we will begin providing
424140	427400	end-to-end encryption. But it will only be for the
427400	430360	paid tier, for the paying customers only.
430820	433400	And so it's only those
433400	436620	who can pay and will pay are deserving
436620	439820	of that end-to-end encryption protection.
439880	442320	But it even went so far as to say
442320	445540	the reason why it's only for paying customers is that they want to be
445540	448900	able to work with law enforcement to catch bad actors.
448940	451520	So that makes it even worse. Because isn't the
451520	454300	meaning then of that is, hey, we think that
454300	457380	only those who can't afford and won't
457380	460720	pay for the paid version of Zoom,
460720	463500	they're the only ones who could be bad actors and thus
463500	466160	should be reported to law enforcement.
466640	469440	And thus, we're then saying
469440	472800	you can be safe, don't deserve to go to jail,
472800	476140	you know, on and on if you're going to pay us.
476160	479320	But otherwise, you don't deserve that protection.
479560	481920	Thankfully, this was reversed thanks to
481920	484480	outcry from the community as well as
485680	487920	ACLU. But the fact that we got
487920	489180	to this point.
491240	494840	Now let's go back in time a little further.
494940	498560	In October 2018 and March 2019,
498560	500260	two 737 MAX
500260	503040	Boeing airplanes crashed. One was from
503040	506200	Lion Air, a budget Indonesian airline company.
506200	509120	And the other was Ethiopian Air based in
509120	511880	Ethiopia. And so there was a lot
511880	515440	of press about how the cause of this was the MCAS system.
515440	518060	A system put into these new jets that pilots
518060	521200	hadn't been trained on. And using technology
521200	524000	made a lot of decisions for the pilots such as when
524000	527500	the nose should go down or up and things like that.
527980	530400	But then it came out in this New York Times article
530400	532840	that there were two actual
533380	535800	extras that airlines could buy for their
536280	539360	airplanes. And these two extras could have
539360	542020	helped prevent the crashes
542020	545780	potentially because they would alert the pilots
545780	548580	when that MCAS system was acting up
548580	551760	and that the sensors maybe shouldn't be trusted.
551760	554400	And so those two features were the angle of attack
554400	557320	indication and the angle of attack discreet light.
557880	561060	But Boeing charged extra for them.
564230	567110	Another example is single sign-on.
567110	570310	So across our community, best practices,
570310	572750	I think we all generally say that SSO
572750	576930	is a critical part of securing enterprises.
577110	578930	Single sign-on or SSO allows
578930	582250	users to sign into many different tools
582250	584970	using that same account.
585850	587990	And so the reason why this is considered a best
587990	590970	practice is then like the company who's buying
590970	594110	these different tools and needs their employees to log in
594110	596950	only has to track privileges and
596950	599810	accesses on one account system
599810	601830	and it prevents
602990	605930	different password roles, potential repetition
605930	608710	if the employees have to come up with all these different
608710	611930	accounts and passwords. And it also is much easier
611930	614750	to handle when an employee leaves. You don't have to remember
614750	617850	to remove all of these different accesses. You only have to
617850	621250	delete it in one place. So this website,
621250	623870	sso.tax, tracks the difference
623870	627210	in costs that software-as-a-service companies charge
627210	630530	if the company buying their software, their customer
630530	633950	wants single sign-on as a part of this.
633970	636590	And so it's often two to three times more
636590	639190	if you want to use single sign-on
639190	642670	but sometimes can be as much as 500%
642670	645310	increase in price in the case of IrrTable
646030	648570	and you can see the others here.
648710	651490	And just think about that for a second.
651490	654390	This is something we consider as the information
654390	657690	security community. We consider it a core thing
657690	660290	enterprises should be doing to protect themselves
660290	663670	and thereby their users. And we as an
663670	666590	industry also complain when companies
666590	669730	don't follow our best practices. But we're now
669730	672750	adding these hurdles for them to be able to follow our best
672750	675690	practices. We're saying, actually you only
675690	678550	should do it if you can pay this extra.
678550	681730	Otherwise you don't need this core security
681730	682930	feature.
686260	689120	Another example where paying
689120	691900	got you more privacy or safety or security
691900	695740	is that from 2013 to 2016, AT&T
695740	698540	which is an internet provider here in the
698540	701660	United States, they would charge you 30 to 60
701660	704320	dollars more a month if you did not consent
704320	707400	to their internet preferences program. So the
707400	710520	internet preferences program tracked all of the web browsing
710520	713440	you did, how long you spent on the website and things
713440	716540	like that. And since it was at the IPSP level,
716540	719340	it ignored cookie preferences, ignored do not track
719340	722820	private browsing, etc. So if you consented
722820	725680	to AT&T being able to gather all
725680	728200	this data from you, you got to pay
728200	730560	30 to 60 dollars less.
730800	732900	So at the point of
735100	737560	a year, that's 720 dollars
737560	741200	or this article says 744 extra per year.
741560	743600	I don't know a lot of people who would say,
743600	746620	sure, I can pay 744 dollars a year
746620	749640	for so-and-so privacy, but the ones
749640	752500	who can and will and
752500	755640	understand that, they get to be safe and secure
755640	758220	and private. Everyone else deserves to
758220	761520	have their data read
761520	764480	and tracked. And so finally after, you know, multiple
764480	767760	years of this program ongoing,
767760	770560	AT&T was getting more bad press and they decided to
770560	774060	cancel the program. But it still went on for a while,
774060	776520	you know, from 2013 to 2016.
777640	779700	And so this is
779700	782680	where I think we all really need
782680	785480	to think both individually and as an
785480	788500	industry, what do our actions say? And do
788500	791560	those, they match our beliefs around InfoSec
791560	793640	and security and privacy.
794300	797620	Because I know what I hear from others and what
797620	800600	I believe is not that, oh, security
801480	803900	is only for some. I continue
803900	806520	to hear that security and privacy is a requirement
806520	810300	and that shouldn't be a commoditized feature.
810300	812750	Because while we all value it,
813120	815940	it's the baseline. It's the foundation.
815940	818740	You shouldn't have a minimal viable product that doesn't
818740	821760	have security and privacy built in. It's not
821760	824760	that extra that you can add in in version 2
824760	827980	or it's only for premium users.
828180	830580	So if we know there is
831200	833860	a type of way to keep users safe, then they
833860	836720	deserve that. If that's
836720	840040	our mission and our beliefs and our values though,
840380	842740	do our actions line up with that?
842740	845840	Because it looks like based on these many anecdotes
845840	848060	that we're actually saying
848640	851080	only the rich deserve to be secure.
851600	854520	And I don't think, honestly, that's what
854520	858080	any of us in the community believe
858080	860920	what we would go around telling. People get up on
860920	863840	the stage during conference talks saying only the rich deserve
863840	866400	privacy. Everyone else should have all of their internet
866400	869740	behaviors tracked. But is that...
869740	872760	do our actions and how we secure
872760	875640	products and the products we release and the apps we
875640	877780	release, do they show that?
878740	881720	So security, privacy, and safety are
881720	884440	our minimal viable product. Everything
884440	887520	has to have them built in to be a product,
887520	890560	to be an app that launched. Otherwise, we don't
890560	892840	have anything that is fit to be released
893580	896620	to prod, basically. And I know this
896620	899740	analogy has been beaten over and over and over
899740	902680	again. But what we need to do is
902680	905340	treat the security, privacy, and safety
905340	909180	in the same way that cars treat seatbelts.
909220	912380	Yes, it costs more to add a seatbelt to a car.
912380	914840	But that is the minimal accepted level.
914840	918000	You can't buy a car right now that does not have seatbelts
918000	920240	in. And so that's how we should treat
920240	921820	security, too.
924200	926940	And so, at this point, sometimes
926940	930380	people say, oh, we should just all be
930380	933360	apolitical. If that straw man argument
933360	936220	is coming up, then I would just like you
936220	939240	to think about the fact that all we're talking
939240	942040	about is addressing the inequities that
942040	945220	can occur for different groups of people when
945220	948060	we're trying to secure products. Our job is to be
948060	951080	security engineers or other types of professionals in
951080	954000	the information security community. So talking about
954000	957300	those impacts, I don't think that's political.
957660	960180	If you do, then sure, InfoSec
960180	962820	is inherently political.
962900	966400	But these conversations about having a
966400	969200	specific group we're trying to protect have been around
969200	972280	since the beginning of the industry and the community
972280	975380	because we've always had set users that
975380	978620	we're hoping to secure further or
978620	980140	provide more privacy for.
980140	983220	And so let's look at some of that and how that's
983220	986260	framed that we've always had a user in mind.
986520	989420	So first, we can go back to 2002
989420	992340	when Hato Bismo, a branch off from the
992340	995260	cult of the dead cow, launched the 6-4 system.
995260	997320	So the 6-4 system is a network
998320	1000780	proxy built to evade censorship
1000780	1004260	and the protocol was named 6-4 to remember
1004260	1006980	the massacre at Tiananmen Square, which occurred on
1006980	1009520	June 4th, therefore 6-4.
1010900	1013360	And one of the main reasons
1013360	1015940	at least that I've read that this was created
1015940	1018800	was to specifically help users
1018800	1021960	who are living in countries that have heavy censorship
1021960	1025420	of the internet, like China and Iran.
1027180	1028240	And fast forward
1028240	1031240	to today, here's another example of having a very
1031240	1034040	clear user base of who you're trying to protect
1034040	1037000	in mind. It's even in the advertisement
1037000	1040080	top of the page. A few years ago, Google
1040080	1043080	launched the Advanced Protection Program and it's
1043080	1045980	specifically to protect and secure
1045980	1049120	those at risk of targeted attacks.
1049120	1052000	So journalists, political campaign leaders,
1052000	1053940	activists, etc.
1056440	1057900	And again,
1057900	1060820	here's another example from the early days of our industry
1060820	1063640	until now, that generally as a community
1063640	1066740	we have come together to fight against
1066740	1069300	DRM and fight for
1070220	1072640	consumers. So we're not
1072640	1075660	going through and trying to protect the companies that
1075660	1078700	are building DRM into their devices
1078700	1082040	like a refrigerator, Windows 95,
1082040	1085720	video games, John Deere tractors.
1086120	1087840	Hackers are generally trying to
1087840	1090220	find bypasses for these to protect
1090220	1093320	and fight for those consumers and the customers who have
1093640	1095840	bought or used these products.
1097660	1099360	And all of those examples
1099360	1102640	of having a clear user base in mind of who we're
1102640	1105500	trying to protect comes to finally
1105500	1108340	threat modeling. Threat modeling is a very
1108340	1111900	basic but integral and probably required
1111900	1114160	part of our jobs when we're looking to give
1114160	1117440	advice, suggestions, or build new security
1118940	1120640	things into what we're
1120640	1123620	deploying. And in the threat
1123620	1126460	model, you're trying to decide what
1126460	1129240	are all these threats to the thing I'm trying to protect?
1129340	1132340	So to be able to create that threat model, you have to know
1132340	1136100	really well the exact group you're trying to protect.
1136340	1138000	Threat models shouldn't be,
1138000	1140960	I'm trying to protect everyone that exists on this globe.
1140960	1143460	That would be a terrible threat model because we all are
1143460	1147240	different human beings with different concerns, different threats,
1147240	1149600	and that's just the way it is.
1149600	1152980	So I hope through this talk you're not taking that Maddy is saying
1152980	1156300	our threat models have to be every single human.
1156300	1159700	The point is that first identifying,
1159700	1161780	like we do, exactly who
1161780	1164600	is the person we have in mind
1164600	1167840	that we're creating these security features for and are thus
1167840	1169820	trying to protect.
1170940	1173920	And the key of that is that though,
1173920	1177400	once we make that choice of who is protected,
1177400	1180040	we also need to acknowledge and take ownership
1180040	1183420	that that is also making a choice of who is not protected.
1183540	1185860	Because when we're building security
1185860	1189080	and new products and features for a certain
1189080	1192100	group of people, inherently another is excluded.
1192860	1195320	So for example, Google Advanced Protection,
1195320	1198220	that's not bad because not everyone needs
1198220	1201180	all of that protection and some would actually find it
1201180	1204640	very frustrating to use.
1204820	1207360	But that is a decision and an ownership of
1207360	1210240	okay, it's the people who choose to opt in
1210240	1213320	who view themselves as at risk of targeted
1213320	1215560	attacks or fall into one of these
1216320	1219600	certain categories like working on a political campaign.
1220600	1222420	But we do need to address this
1224900	1226680	because the ability for
1226680	1229260	us to make those choices is
1229260	1232420	inherently a power and a privilege because others
1232420	1235640	don't get to make that choice necessarily whether or not they're
1235640	1238670	included in these groups that we're trying to protect.
1239060	1241480	And when some people are protected and secure and
1241480	1244620	others aren't, that's going to continue
1244620	1247200	to grow the systemic inequality
1247200	1250520	that we see around the world. So let's look at some
1250520	1253540	side effects of security decisions when
1253540	1256280	you have in mind a clear group you're trying to protect
1256280	1259840	but maybe don't think about all the implications for others.
1260860	1262860	So first,
1262860	1265860	Rite Aid uses facial recognition in secret
1265860	1268280	across hundreds of its stores.
1268580	1272480	So Rite Aid deployed this, you know, to protect themselves.
1272540	1274340	They said in this article
1274340	1277180	that their concern and their reasoning was
1277180	1279940	we need to protect ourselves from theft
1279940	1283260	and we also need to protect our staff and our customers
1283260	1286160	from violence. So that's their security
1286160	1288680	concerns. But
1288680	1292260	if that's who is quote-unquote being protected,
1292260	1295080	it's Rite Aid, they're actually sacrificing
1295080	1298220	all of the privacy of their customers in order to have
1298220	1300560	that security for themselves.
1301220	1301380	And
1304000	1305820	if you read this article
1305820	1308340	and it even says in this headline, this wasn't deployed
1308340	1311340	equally. It was predominantly used in
1311340	1314480	low-income and non-white neighborhoods. And so
1314480	1317520	it's furthering a gap that, oh, we're just worried about
1317520	1319140	theft and
1321040	1323840	violence in non-white, low-income
1323840	1326740	neighborhoods and so we don't need to worry about it there
1326740	1330060	and thus we're sacrificing these people's privacy.
1330060	1332800	But I think if you took a step back
1332800	1336060	and let's say we're security engineers
1336060	1339320	tasked with this problem. How do we help protect Rite Aid
1339320	1342120	from theft? How do we help protect
1342120	1344840	them from violence occurring in the stores?
1345240	1348100	I think we could come up with a lot of different
1348100	1350260	other solutions that could help
1351000	1354120	protect themselves without sacrificing
1354120	1358000	the customers' privacy in the process.
1359380	1362120	Another example is parent or child
1362120	1365100	protection apps. I have a lot of feelings about
1365100	1368060	these apps but I'm not going to get into that now because I'm
1368060	1371120	not a parent. But the
1371120	1374120	whole premise is these are built for the customer
1374120	1376700	which is the parent or the adult guardian
1376700	1379760	to install on their child's mobile devices
1379760	1383200	in order to try and keep the child
1383200	1386200	safe. But if the parent is the one responsible
1386200	1389260	and the customer, it's actually built to address
1389260	1391860	what the parent thinks the kid's threat model is
1391860	1394800	not actually who the user
1394800	1397900	of the device's threat model. And so that can have
1397900	1401020	unintended consequences or maybe intended but
1401020	1404280	we'll go with unintended consequences on whoever
1404280	1407140	is using the device and has this application
1407140	1410220	installed on their own device.
1411180	1414240	So for example
1414820	1417980	in here it's saying this app gives you
1417980	1421500	the ability to listen to the surroundings
1421500	1424060	of whoever is using this app.
1424140	1428060	What? That's turning on the microphone and listening?
1428520	1430440	While the folks securing and building
1430440	1433480	this app may be intending that this
1433480	1436600	app is only used in consensual relationships.
1436640	1439460	The kid gets the phone, the parent talks to the
1439460	1442460	kid of you can have this phone but I'm going to be
1442460	1445300	monitoring these different behaviors for you
1445300	1448280	to be able to use this phone. Hopefully that's what they're
1448280	1451260	building for. That doesn't mean that's the only way
1451260	1454460	this technology will be used. What's the
1454460	1457420	difference in the technology at the base level
1457420	1460400	between spyware and stalkerware? Instead
1460400	1462500	you're depending on
1463800	1467320	the users to only use it in a way
1467320	1469280	in which you're building it.
1469280	1472380	As a woman in my 20s, I have had friends
1472380	1475180	who have stalkerware installed on their phones
1475180	1478380	but it looks and it brands itself as a child protection
1478380	1481000	app. And also do the people
1481000	1484060	building this and the security and the threat model of
1484060	1487200	their users also consider the
1488080	1490540	reality that sometimes the adult
1490540	1493520	parent and guardian doesn't have the child's best interests
1493520	1496280	at heart. These also have been
1496280	1498700	said to be used in child traffic
1499160	1502360	wings. And so when we make compromises
1502360	1505180	and sacrifices for a single
1505180	1508040	use case such as, oh
1508040	1511280	I don't love this idea but it's only going to be used by
1511280	1514360	parents who have a kid who consents to have it on their
1514360	1517240	phone because otherwise they wouldn't have the phone. If
1517240	1520080	we're building only for that use case but there's
1520080	1523240	nothing making that app only be used in that
1523240	1526700	use case, then we're still causing harm.
1526700	1529260	And so there's no guarantees that code will be
1529260	1531820	built the way we intend it to be built.
1533440	1535260	So, headline
1535260	1538360	kind of says it all. United States government funded
1538360	1541400	phones come pre-installed with unremovable malware.
1541580	1544280	So there is a program or there was
1544280	1547160	in the United States that if you were low income
1547160	1549980	if you didn't have the means to get yourself a phone
1549980	1553180	the US government would provide you with a smartphone
1553180	1556160	based on Android. You know, cheaper
1556160	1558620	phones, not the flagships and
1558620	1562260	lo and behold they come pre-installed with unremovable malware.
1562680	1565260	So this is one of those things
1565260	1568000	where I hope that
1568000	1570860	the government wasn't intending to
1570860	1574300	install malware on each of these devices.
1574300	1577300	I hope that
1577300	1580180	they were trying to give phone and technology
1580180	1583500	access. But because of
1583500	1586360	how cheaper devices
1586360	1589120	have begun to subsidize themselves by installing
1589120	1591640	whatever people will pay them to install
1591640	1594660	we have now harmed the privacy and security
1595170	1597680	of these users who really
1597680	1601080	were already in a tough spot in society
1601080	1603380	and trying to live their lives.
1603380	1606700	So Strava. Even on their website
1606700	1609620	the Strava app says they build
1609620	1612560	for athletes. So that's their user base
1612560	1615080	in mind. That's who they're trying to protect
1615080	1618200	when they're securing this application and the data
1618200	1621460	that is stored that comes from it.
1622000	1624000	But when you just think about
1624000	1627540	securing for athletes, that's only one
1627540	1630520	part of who someone is. So we really need
1630520	1632780	to take into account the intersectionality
1632780	1635640	of all of us as humans. Because
1636400	1639540	as a female athlete, I get very
1639540	1642580	concerned about my location data being able
1642580	1645240	to be tracked by anyone else. Military
1645240	1648260	personnel want to be athletes, want to have
1648260	1651020	the features of the Strava application
1651320	1654000	but I bet it wasn't considered that
1654300	1657120	although the data on the heat maps that are open to the public
1657120	1660260	and on the internet that are seen is aggregated
1660260	1663220	that aggregation meant that you could
1663220	1666360	end up seeing where military bases
1666360	1669300	were abroad when all these different
1669300	1671540	military personnel, who are also athletes
1671940	1675340	were going for their jogs at the end of the day.
1678040	1680020	And here's another example
1680020	1683180	of just how far
1683180	1686200	our specific choices in security
1686200	1689600	can go. So Pixel phones as well as many
1689600	1692400	other devices have a support period where they
1692400	1695660	guarantee you will have security updates for this amount
1695660	1698500	of time. In this case, the Pixel phones
1698500	1701120	have three years from the release date
1701120	1704440	or at least 18 months from the time it's last sold on
1704440	1706980	the Google store. So
1706980	1710640	you know, as a community, I think one of the most basic things
1710640	1713340	we say to users is you should only be
1713340	1716240	using devices that get security updates or else
1716240	1719460	you're kind of asking for trouble. But we also
1719460	1722400	are shortening sometimes these periods that the
1722400	1725200	updates are available for things like phones
1725200	1728520	and computers and devices. And so
1728520	1730860	the first obvious impact that
1730860	1734620	this choice of doing three years of security
1734620	1737800	updates may have is on those
1737800	1740540	again, lower income or don't
1740540	1743320	have access to buying phones quickly
1743320	1746100	and regularly or even just communities
1746100	1749560	which sometimes can be elder
1749560	1752460	adults who are not used to and don't
1752460	1755260	realize they need to be updating a phone
1755260	1758500	every three years. And they actually prefer the older ones because they
1758500	1762260	know how to use them and it's more intuitive to them.
1762440	1764720	So those are some of the obvious impacts
1764720	1767800	to users that we might not be building for or choosing
1767800	1771080	security for. But these decisions go that much
1771080	1773940	further. If we're getting new
1773940	1776620	phones every three years or faster
1776620	1780000	that generates a lot of e-waste. And so
1780000	1782860	while climate change is such a big
1782860	1785480	thing, the more e-waste we generate
1785480	1789720	the more negative impacts that has on our environment.
1790000	1791840	And the environment
1791840	1795060	and climate change doesn't impact all of us equally.
1795060	1798160	There's already been a lot of research out that generally
1800280	1801400	communities already
1801400	1804300	in tougher positions, lower socioeconomic
1804300	1807100	status, generally communities of color
1807100	1810180	are the ones that are hit the hardest by the
1810180	1813440	environment and climate change. And yet
1813440	1815700	it's those of us predominantly
1817940	1819400	in US and
1819400	1822880	Western Europe who are buying and disposing of these phones.
1822880	1826000	And so our security decisions end up impacting
1826000	1829180	these people, you know, on other places
1829180	1832020	who might have nothing to do and have never
1832020	1835760	interacted with these phones or devices in the first place.
1837100	1837580	So
1838520	1841100	those were a lot of examples. Not so
1841100	1844260	happy, not so negative. But you might be saying to me
1844260	1847060	because, you know, I've said it to myself as I try to work
1847060	1850500	through these things myself. I'm just one person.
1850500	1853200	I just work on securing a single app with only
1853420	1856360	a thousand users. I'm just a manager of a little
1856360	1859320	team. I'm not an exec. I'm not the director
1859320	1862500	of security. I'm just a document writer.
1862500	1865000	All those different things. And you might say
1865320	1868100	I'm just making little choices. They don't have that big
1868100	1871240	of an impact. It's none of the examples you have listed here.
1872160	1874560	But the issue becomes
1874560	1877220	that each of our choices become
1877220	1879940	patterns and the norm and the status quo
1879940	1884060	for how we expect products to be developed and released.
1884300	1886380	So you might think, oh, I'm
1886380	1889320	just making this little sacrifice, a compromise to get this
1889320	1892240	product out the door for me. Our app doesn't impact
1892240	1895260	all that many people. So it's good. But
1895260	1898680	that choice then gives a precedent or a
1898680	1901660	permission for others to make the same one and
1901660	1904340	make those same compromises or those same
1904340	1907100	sacrifices for a different group of people.
1907460	1910360	And unfortunately, because this
1910360	1913300	technology is so built into
1913300	1916400	our ability to thrive, each of those
1916400	1919140	little choices become systemic
1919140	1922140	inequities. And they end up having huge
1922140	1924860	society ramifications.
1925200	1928360	So for example, in general, I've been guilty of it
1928360	1931340	myself and I'm working on it too, but
1931340	1934020	I have to acknowledge I've said, yeah,
1934020	1937380	we accept that lower priced devices are less secure
1937380	1939940	and that's because of the business model.
1939960	1943260	They can't do everything. We accept
1943260	1946260	that there is more risk to women for any apps
1946260	1949480	that choose to track location.
1949840	1952680	We accept that biometric
1952680	1955300	security technologies aren't as effective
1955300	1956980	on non-white faces.
1956980	1959960	But each of these acceptances
1959960	1962980	means that we are creating a system
1962980	1965700	that accepts that
1965700	1969220	not everyone deserves the same level of
1969220	1971940	safety, security, and privacy.
1971940	1975120	And we are compounding the previously
1975120	1977980	and already existing systemic injustices
1978640	1981440	and inequality through this technology.
1981440	1984460	So instead of shrinking that gap as technology
1984460	1987420	can, we continue to widen it.
1988320	1989960	And it's easier
1989960	1993280	and it's easier a lot of the time to believe,
1993280	1996320	you know, I'm just making this decision or one little
1996320	1999180	sacrifice for one product. And there are so many other
1999180	2001720	products and other people working in this space.
2002260	2004440	But we lean on each other
2005220	2008460	and it ends up growing and growing and showing others
2008460	2011540	what's cool, what's okay. And that's how we end up
2011540	2014440	with having these extreme gaps
2014440	2017460	in how people are able to access
2019360	2021780	technology privately and securely.
2023160	2024240	So an example
2024240	2027940	of how our choices for security and technology
2027940	2030800	end up having huge ramifications
2030800	2033660	is that in both the United States and Europe,
2033660	2036700	many are now using artificial intelligence algorithms
2036700	2039600	to decide on what punishments a person should
2039600	2042340	receive after breaking the law. So these are things like
2042340	2046380	how much or if they should have bail,
2046380	2048720	what is their sentencing,
2048720	2051660	are they eligible for parole? This has now been
2051660	2054940	pushed off to algorithms. But we as humans
2054940	2057520	write these algorithms. And so these algorithms
2057520	2060760	are saying, that have been written by humans, are deciding
2060760	2063480	whether or not we believe this person
2063480	2066680	can be rehabilitated to become a contributing member
2066680	2069660	of society. And this algorithm is saying whether or not
2069660	2072920	this person will commit a crime. But since
2072920	2076360	we're coding all of these algorithms,
2076360	2078020	they're going to bring the
2079200	2081620	reflections of the team that's writing them.
2081620	2084820	And the reflections of that security team who's looking at it
2084820	2088620	and assessing it. Because, for example,
2088620	2090680	I'm a white woman from the US
2090680	2094160	for Canada Tech Company. If I'm writing the algorithm,
2094160	2097280	I know I'm innocent. So I'm probably going to assume that people like
2097280	2099640	me are innocent too and deserve
2100140	2103220	shorter sentences. And so if our team all looks like
2103220	2106020	me or only a few groups of people, then we're
2106020	2109100	probably going to write our algorithm to contribute to
2109100	2112620	just those... to give shorter sentences
2112620	2115200	for the people who are like us and it's
2115200	2118160	the others who are harmed.
2118640	2121360	And I use another slide of emphasizing the same
2121360	2124480	thing because this impact is just so
2124480	2127320	huge. This is life or death.
2127320	2130060	Having to go to prison or not.
2130160	2133300	And it also causes generational trauma that goes across
2133300	2136060	families for years and years and years.
2136060	2138820	And so we really make sure that we are
2139100	2142060	looking at our choices and understanding each of the
2142060	2144720	consequences. Those consequences can be good
2145160	2148320	or those consequences can be bad. But our choices
2148320	2151580	create systemic problems.
2153020	2155260	Another example of a systemic issue
2155260	2158260	is, you know, in general,
2158260	2161880	sex workers are discriminated against.
2161880	2164020	And this article from Airbnb is just another
2164020	2167080	example of that. So Airbnb developed an
2167080	2169480	algorithm. They actually bought it. They used it and then bought it
2169480	2172280	to try and determine how trustworthy
2173280	2175600	a potential guest might be.
2175600	2178640	Okay, let's put our Airbnb security
2178640	2181880	engineer hat on as we've done for some of the other companies.
2182320	2184620	Our goal is to make sure
2184760	2187880	a host's home and property is safe. That's the goal.
2187880	2190760	We probably won't keep hosts coming back if
2190760	2193600	there's a high likelihood that they'll be
2193600	2196420	stolen from, their house destroyed, things like that.
2196420	2199700	So we're going to use an algorithm to decide whether or not
2199700	2203220	the guests are trustworthy and thus should be allowed to rent.
2203920	2207660	But along the way, while building this algorithm,
2207660	2210140	we decide that sex workers mean
2210140	2213240	they are untrustworthy. It doesn't matter
2213240	2216400	if the sex worker is not using
2216400	2219160	this for sex work. They just want to go along with their life.
2219160	2221320	It does not matter if
2222120	2225160	we are in a country where sex work is legal.
2225160	2227640	We have decided through this algorithm that
2228140	2230720	sex work equals untrustworthy.
2230720	2233740	And thus, they don't have access to units. There can be
2233740	2236760	random cancellations that put them at further harm
2236760	2239960	if they've already arrived in the city or location and thus no longer
2239960	2242860	have lodging. But that's the decision we've made
2242860	2245780	in our algorithm. And the thing is, is that
2245780	2248600	that continues to allow permission for then
2248600	2252220	other companies to say, oh yeah, they did it so we can do it too.
2252220	2254860	They're sex work. It's a category. We don't trust them.
2254860	2257600	We don't allow them. And I think we see this.
2257600	2259880	We see it over and over again, how
2260720	2263900	sex workers are discriminated against.
2265960	2266400	And so
2266400	2269640	in this case, we're coming back to the
2269820	2272740	e-waste anecdote we discussed earlier regarding
2272740	2275840	security updates and their support periods.
2276300	2278840	And so based on this graph, we can see that
2278840	2281440	North America, Western Europe, Australia
2281440	2284480	and Japan and South Korea are generally the biggest
2284480	2287460	producers of e-waste.
2287460	2290400	But they don't keep the e-waste to themselves
2290400	2293240	or ourselves. We send it off
2293240	2297120	to other countries and we pay them to accept it.
2297300	2299440	And so then those other countries, which
2299440	2302360	you know, Eastern Africa, I mean
2302360	2304580	Western Africa, I always forget my East and West
2305560	2307120	and Southeast Asia
2308340	2311480	are two of the places that predominantly receives this
2311480	2314720	and they're also at huge risk from climate change.
2314720	2317480	But we're saying, hey, now y'all have to figure
2317480	2320400	out how to deal with all of these toxic metals
2320400	2322960	and parts that are within
2323300	2326340	all of these devices and you're also
2326340	2328620	going to be the ones hurt by climate change.
2330480	2332120	But lastly,
2332120	2335440	to hopefully get you on board and one more
2335440	2338580	way of... we're at this precipice
2338580	2341480	and we might be a few years past it where
2342420	2344720	everything is becoming reliant on
2344720	2347560	technology. We can't say, oh
2347560	2350700	people are generally going to be safe and secure because they can choose not to
2350700	2353680	use it. They can choose to only buy
2353680	2356440	the expensive ones or else they're fine without
2356440	2359680	any device. That's not where
2359680	2362660	we are or where we're going. You know, in the United
2362660	2365400	States, there's a lot of talk about moving to mobile
2365400	2367980	drivers license. There's been different
2367980	2371400	efforts to move to mobile passports. And so it will
2371400	2374420	take extra effort and cause extra money
2374420	2377440	to have to go and get a physical card if
2377440	2380420	that's even allowed in the future. Even
2380420	2383480	with coronavirus, just in the last couple of months, a lot of
2383480	2386300	restaurants and retailers have decided to
2386300	2388840	stop accepting cash just because of
2389400	2392480	perceived virus transmission. And this hurts
2392480	2395540	communities that either don't have access to banks
2395540	2398700	or have a lot of reason not to
2398700	2401600	trust that banks are safe for them and who have been
2401600	2404300	wholly reliant on cash. We're again
2404300	2407520	leaving them behind and saying, oh yeah, you
2407520	2410620	don't need to participate in the economy because we've decided to go
2410620	2413760	cashless. And another example
2413760	2416440	is airlines.
2416520	2418960	So in this case, this is Ryanair.
2418960	2421960	And if you don't have an online boarding
2421960	2425020	pass and you need the airline to print it
2425020	2428240	for you at the airport, you know, how things were done
2428860	2430880	six, seven years ago and was
2430880	2433940	the norm, it will now cost you an additional 20
2433940	2437060	pounds. So if you don't have technology, you
2437060	2440220	are further penalized and charged for that.
2442160	2443560	So what do we do?
2443560	2446260	I told you I didn't want to just present problems
2446260	2449640	with no solutions.
2450340	2452580	And I'm guessing you, like me,
2452580	2455460	are probably in the spot of, Maddie,
2455460	2458380	this problem area is so huge.
2458380	2461260	How do we even begin to confront
2461260	2464400	it? And the first thing I want to do is remind us that
2464400	2467260	we are in this powerful place
2467260	2470240	of privilege and that the choice is
2470240	2473600	up to us to address it. If we don't, no one else is.
2473600	2476600	No one else can fix this because we are the ones who
2476600	2480060	are in charge of information security.
2480380	2482440	But this is also an exciting gift
2482440	2485000	even if it might feel like a lot of responsibility
2485600	2488280	because that means we don't have to sit here hopeless.
2488580	2491660	We actually have the control personally to be
2491660	2494040	able to start fighting for this new future
2494600	2497920	where we believe that regardless of
2498700	2500560	geolocation, race, gender, sexual
2500560	2503660	orientation, ability, religion, and all
2503660	2506800	the other different aspects that make us beautiful, diverse
2506800	2509840	humans, if you have safe and secure access
2509840	2512820	to the Internet, oh, what a beautiful world
2512820	2516360	that would be. And so let's build it.
2516840	2518700	We set the standards that
2518700	2521720	security and privacy is a fundamental right,
2521760	2524720	a fundamental foundation requirement. Nothing goes out
2524720	2527980	that doesn't have security and privacy built in for it all.
2527980	2530980	And this ultimately helps us, too, if you need
2530980	2533840	the selfish argument. Because if we ensure that
2533840	2537040	security and privacy is set in a fundamental right
2537040	2540060	for everyone, if we're ever on
2540060	2542700	the hook and on that precipice, we know it's guaranteed
2542700	2545300	for us, too. So I hope
2546120	2549080	5, 10, 15, 50, 20,
2549080	2552040	however many years from now, we're going to have that option
2552040	2555060	hopefully to look back and say,
2555060	2557820	huh, I really helped there.
2557820	2560940	I pushed for it and now we're living in this world where
2560940	2564200	everyone has security and privacy.
2564480	2566420	Or we can look back and say,
2566860	2569700	I had a chance to help change it and I didn't.
2570900	2572980	So how do we do this?
2572980	2576040	One, as I've said before, security is a requirement,
2576040	2579020	not a feature. It's the baseline for even having
2579280	2581100	a minimal viable product.
2581960	2584060	This is for startups who, you know,
2584200	2587060	a lot of them currently say, we get something out the door and then
2587060	2590120	security is added in v2. Nope, we don't allow that
2590120	2593080	anymore. It's not just for those who pay or can wait,
2593080	2594160	it's for everyone.
2596100	2598780	Next, we are already explicit
2599120	2601860	a lot of the time, or if we're not, we should be,
2601860	2604840	about the threat models of who we're trying to protect and
2604840	2608060	why we're suggesting the security features we are, the privacy
2608060	2611560	constraints we are. So let's not only
2611560	2614380	be explicit about who is helped,
2614380	2617340	but let's be explicit about who is harmed, who could be
2617340	2620300	adversely impacted by the threat model
2620300	2623280	we've created. And the reasoning is, is not
2623280	2626360	that everyone should be protected and helped in the same
2626360	2629080	way for every product. It's that by
2629080	2632580	naming problems, by saying, oh,
2632580	2636180	this group of people would be harmed by this choice,
2636180	2639100	we can at least start to brainstorm and come up with solutions
2639100	2642640	and bring our creativity. But it's definitely impossible
2642640	2645320	to try and come up with solutions if you've
2645320	2647720	never even named it to be a problem.
2651000	2651880	Three,
2651880	2654360	you might be saying to me, Maddie, there's
2654360	2657440	so many different groups and identities and things
2657440	2660460	that are different. How am I supposed to keep all of them in my
2660460	2663100	head and understand all of the impacts to everyone?
2663100	2666380	And the cool thing is, is you don't have to, I don't have to,
2666380	2668700	as long as we create teams
2668700	2672040	that represent all of these different views and identities.
2672040	2675040	And that team is inclusive, such that everyone
2675040	2678100	can speak up and represent those experiences
2678100	2680860	that they're bringing to the table. So,
2680860	2683980	you don't have to ensure that you know
2683980	2686960	how this is going to affect someone
2686960	2689700	who's LGBT in Vietnam.
2689700	2693140	If you have someone who's LGBT and someone from Vietnam,
2693140	2695520	then they can also help represent.
2695680	2698120	But it's even better if you hire for
2699840	2701940	intersectionality. So if you hire that LGBT
2701940	2704860	person from Vietnam, then you've definitely gotten their
2705680	2708280	viewpoint across. And so,
2708280	2711120	for a lot of people in our industry,
2711120	2713760	when they say, hire for diversity, it's people
2713760	2716760	who look like me. But the only thing I bring
2716760	2719720	to the table that's different
2719720	2722560	is generally those views about gender
2722560	2725800	that aren't always represented here. But if you
2725800	2728880	hire a black woman or an indigenous woman, then she
2728880	2731920	will bring to the table both the
2732960	2734760	effects on race
2734760	2737600	as well as the effects of being a woman. So,
2737600	2740360	it's just a great investment for you to hire for
2740980	2742100	intersectionality.
2743240	2744600	Four,
2745580	2748300	write code and build products for the worst possible
2748300	2751060	case that it could be used for. And I totally spelled
2751060	2753980	right wrong here, but we're this far in it, so it's
2753980	2756100	going to continue.
2756900	2759940	So, we may build technologies and
2759940	2762060	secure things for a specific
2762980	2766020	cause that we believe is ethically good
2766020	2769420	and okay and all these things. But we
2769420	2773060	don't always know how things are going to be used in the future.
2773180	2775980	So, from the get-go, we need to build our products
2775980	2778960	and frame our security requirements for the worst
2778960	2782400	case imaginable. Because again, the technology
2782400	2785300	can be used to help or hurt. So, let's build in our
2785300	2787060	values and ethics from the beginning.
2789100	2791780	Lastly, if you're a little overwhelmed,
2791780	2794240	welcome to the club. Yes, this is
2794240	2797400	hard. But as Glennon Doyle says, we can do hard
2797400	2800140	things. We won't be perfect.
2800140	2803620	I'm far from perfect. But we have to keep learning
2803620	2806440	and trying. You know, an example of this is
2806440	2809560	that this talk has been very US-centric because
2809560	2812420	that's where my background. And so, it would be really valuable
2812420	2815480	to Khans and the community as a whole to also
2815480	2818320	have similar talks that are coming from different
2818320	2821300	perspectives that I can't and don't know how to
2821300	2824480	accurately represent. And so, the key thing
2824480	2827540	is that we don't need to reinvent the wheel.
2827820	2830460	We just need to hire and pay the people that are
2830460	2833520	already doing this work and asking us to listen to
2833520	2837020	the effects that this technology can have on their communities.
2838640	2842060	And so, if we do those things together,
2842060	2844520	that can make it a lot less hard.
2844700	2847580	Because I don't know how many people are watching this talk,
2847580	2849860	but I know that there are probably thousands and thousands
2850760	2853300	attending DEF CON as a whole. So, if
2853300	2856600	every single one of us decided,
2856600	2859300	okay, from here on out, I'm going to start speaking
2859300	2861940	up and taking actions to question,
2861940	2865220	can we do better in helping more people and not
2865220	2868420	allowing others to be harmed? And that becomes the norm.
2868460	2870640	Because one of the things that makes this hard is
2871800	2874340	being alone and feeling like you're the only
2874340	2877380	one who's worried about this and challenging the status
2877380	2880180	quo. So, if we all do this together,
2880180	2883360	then the norm is to speak up. The norm is to demand
2883360	2886680	the fundamental right to security and privacy.
2886920	2889380	We're all in this together, and that's how
2889380	2892380	we can hopefully do it and make it less scary
2892380	2895420	and less hard. And so, finally,
2895420	2898340	to close this all up, as I've said
2898340	2901440	before, there's no neutral. I really wish
2901440	2904420	there was, because sometimes we're all just tired
2904420	2907540	and exhausted, but there's not. And so, we need
2907540	2910420	to own that, and we need to own that we have the power
2910420	2914060	and privilege, and all of these users are relying on us.
2914060	2916720	So, let's use these beautiful positions
2916720	2920020	and fun work we get to do to fight that security,
2920020	2922480	privacy, and safety is a right for all.
2922940	2925660	And, you know, that's the world I want to live in.
2926300	2928380	So, with that, thank you.
2928960	2932100	And yeah, I'm staring at my webcam now. Okay, bye!