WEBVTT 00:12.760 --> 00:14.520 Hello, Hapsek villagers. 00:15.160 --> 00:18.960 Welcome to the second year of Hapsek Village at DEF CON. 00:19.260 --> 00:25.720 Well, it says pause for cheering in my notes, but that's not going to work in safe mode, isn't it? 00:26.020 --> 00:31.060 So for those who do not know me, I'm Erez Yalon, the village mayor. 00:31.060 --> 00:33.160 I'm glad you could join us today. 00:33.200 --> 00:45.000 After years of participating in DEF CON and as an attendee, and then as part of some other villages, last year my dream of creating an Hapsek Village came true. 00:45.020 --> 00:49.160 Luckily, I had one person supporting my dream from the get-go. 00:49.160 --> 00:57.420 If you have not yet met my partner in crime, I encourage you to pop over to Discord and say hi to Leora, our Hapsek Village queen. 00:57.700 --> 01:02.600 She may not answer, as she is busy putting out fires, but it's worth a shot. 01:03.800 --> 01:08.900 Going virtual is full of challenges, but we did get a few things done right. 01:08.900 --> 01:14.100 One of those things was to bring Tiffany as our chief people herder. 01:14.560 --> 01:18.300 You will probably see the impact of her work throughout DEF CON. 01:18.660 --> 01:23.880 Interning to our leadership team in the role of Duke of Content is Joe Christian. 01:23.960 --> 01:30.620 Together with the CFP committee, he has put together a great lineup for you over the next three days. 01:30.800 --> 01:36.000 That lineup begins today with our keynote, Maddie Stone. 01:36.000 --> 01:39.220 Maddie is a security researcher at Google Project Zero. 01:39.540 --> 01:46.720 She likes to figure out how things work, from chips to software, and then break it. 01:46.780 --> 01:51.240 Her current focus is navigating the jungle of zero-day exploits. 01:51.560 --> 02:00.080 Please join me in welcoming Maddie Stone to the virtual stage with who's secure, who's not, and who makes that choice. 02:03.640 --> 02:12.180 Good morning, good afternoon, good day, since we're all in different time zones around the globe, I am so excited to be here. 02:12.180 --> 02:19.580 And I just want to say thank you to Ares and the whole APSEC village team for one, inviting me, and two, for putting on such a great event. 02:20.000 --> 02:31.520 And thank you for being here and joining me, as at least I hope some of you are here, since I am recording this all alone in my home, and I'm going to try to remember to look at the webcam. 02:31.680 --> 02:33.080 So let's get into it. 02:33.080 --> 02:44.180 My name is Maddie Stone, my pronouns are she and her, and I'm a security researcher on Google Project Zero, where I mainly focus on zero-day vulnerabilities that are exploited in the wild. 02:44.360 --> 02:58.400 But in other news, I also know every word to Hamilton, so I hope some of y'all picked up that the title of this talk is coming from the song, who lives, who dies, who tells their stories. 02:58.940 --> 03:05.140 So now this year, I've wrapped up Black Hat, sang here at APSEC village, and I think we're good to go. 03:06.040 --> 03:13.360 But getting back to the title of this talk, who's secure, who's not, and who makes that choice? 03:13.760 --> 03:16.080 Spoiler, who makes that choice? 03:16.080 --> 03:17.380 It's us. 03:17.600 --> 03:26.600 This talk has really been heavy on my heart a lot, and it really came from back at the end of May, here in the United States, George Floyd was murdered. 03:26.600 --> 03:31.800 And that came on the heel of Ahmaud Arbery and Breonna Taylor also being murdered. 03:31.800 --> 03:40.540 And it's been a real reckoning of the racism that prevails here in the United States, or at least I hope it's a reckoning. 03:40.540 --> 03:58.300 And for me, that's really prompted a lot of educating myself and figuring out what role have I played in racism, but how also, what role will I play in anti-racism and working to change this and address systemic racism across society. 03:58.300 --> 04:06.340 But it's also looking at and has brought attention to other marginalizations and inequities across populations across the globe. 04:06.680 --> 04:19.860 And so, when looking at this, I was reading books, listening to black voices and educators, donating money, going to protests, figuring out all these different ways to participate. 04:19.920 --> 04:28.140 But I think it was a really important one to also look inward of how might I contribute to either helping or harming through job 2. 04:28.140 --> 04:33.420 Especially with coronavirus, today everything is based on technology. 04:33.420 --> 04:38.840 To succeed, to participate in society, you have to be using technology. 04:38.980 --> 04:43.920 Schools are going online, work is going online, healthcare is going online. 04:43.920 --> 04:50.360 It's hard to buy devices nowadays that don't incorporate connections to the internet. 04:50.480 --> 05:00.680 So if that connection to the internet and using technology is not safe, secure, and private for all, then what type of effect does that have? 05:00.680 --> 05:08.260 How are we contributing if we are the ones who make all of those decisions about securing apps and devices? 05:08.940 --> 05:17.360 So I really started thinking about what is our role in the inequities in safe and secure access to technology? 05:17.620 --> 05:20.060 Because we are those decision makers. 05:20.180 --> 05:25.200 And as much as I would love there to be, I had to come to terms with the fact there is no neutral. 05:25.200 --> 05:27.440 There's only helping or harming. 05:27.440 --> 05:40.900 Because even if you're just helping one group of people and you try to believe there's no negative impacts to another, you're still broadening that gap if you're only helping one. 05:40.940 --> 05:44.520 And that contributes to more and more inequity. 05:44.700 --> 05:55.660 But the thing is, also, if we have the power to have caused and contributed to inequities, then that means we also have the power to address them. 05:55.660 --> 05:59.220 To create a more safe and secure society for all. 05:59.260 --> 06:00.600 And that can be exciting. 06:00.960 --> 06:11.000 So through this talk, I'm going to show some examples of where I think we in the security community have not served everyone. 06:11.160 --> 06:16.340 But I'm not using those negative examples to shame us or be like, no, no, no. 06:16.400 --> 06:19.080 In this example, all these people are bad. 06:19.080 --> 06:27.380 No, it's that, you know, really come to terms taking ownership for the decisions we make as a community and an industry. 06:27.380 --> 06:32.040 Because then we can see and address them so we can do better in the future. 06:32.040 --> 06:33.560 And we can do it together. 06:34.380 --> 06:36.500 So here's our first example. 06:36.500 --> 06:37.800 And it's topical. 06:38.200 --> 06:47.400 You know, come March when lockdowns and shelter in place started in a lot of places around the world, a lot of everything we did shifted to Zoom. 06:47.500 --> 06:52.700 And Zoom was listening as everyone was crying for, we need end-to-end encryption. 06:53.180 --> 06:57.900 You shouldn't be able to, you at Zoom, see the contents of the calls. 06:57.900 --> 06:59.400 And so Zoom listened. 06:59.400 --> 07:05.720 They got all excited and issued, you know, to the press, we will begin providing end-to-end encryption. 07:05.820 --> 07:10.360 But it will only be for the paid tier, for the paying customers only. 07:10.820 --> 07:19.820 And so it's only those who can pay and will pay are deserving of that end-to-end encryption protection. 07:19.880 --> 07:28.900 But it even went so far as to say the reason why it's only for paying customers is that they want to be able to work with law enforcement to catch bad actors. 07:28.940 --> 07:30.540 So that makes it even worse. 07:30.540 --> 07:46.160 Because isn't the meaning then of that is, hey, we think that only those who can't afford and won't pay for the paid version of Zoom, they're the only ones who could be bad actors and thus should be reported to law enforcement. 07:46.640 --> 07:56.140 And thus, we're then saying you can be safe, don't deserve to go to jail, you know, on and on if you're going to pay us. 07:56.160 --> 07:59.320 But otherwise, you don't deserve that protection. 07:59.560 --> 08:06.520 Thankfully, this was reversed thanks to outcry from the community as well as ACLU. 08:06.680 --> 08:09.180 But the fact that we got to this point. 08:11.240 --> 08:14.840 Now let's go back in time a little further. 08:14.940 --> 08:22.140 In October 2018 and March 2019, two 737 MAX Boeing airplanes crashed. 08:22.140 --> 08:26.200 One was from Lion Air, a budget Indonesian airline company. 08:26.200 --> 08:30.100 And the other was Ethiopian Air based in Ethiopia. 08:30.600 --> 08:35.440 And so there was a lot of press about how the cause of this was the MCAS system. 08:35.440 --> 08:39.340 A system put into these new jets that pilots hadn't been trained on. 08:39.340 --> 08:47.500 And using technology made a lot of decisions for the pilots such as when the nose should go down or up and things like that. 08:47.980 --> 08:57.020 But then it came out in this New York Times article that there were two actual extras that airlines could buy for their airplanes. 08:57.020 --> 09:11.760 And these two extras could have helped prevent the crashes potentially because they would alert the pilots when that MCAS system was acting up and that the sensors maybe shouldn't be trusted. 09:11.760 --> 09:17.320 And so those two features were the angle of attack indication and the angle of attack discreet light. 09:17.880 --> 09:21.060 But Boeing charged extra for them. 09:24.230 --> 09:27.110 Another example is single sign-on. 09:27.110 --> 09:36.930 So across our community, best practices, I think we all generally say that SSO is a critical part of securing enterprises. 09:37.110 --> 09:44.970 Single sign-on or SSO allows users to sign into many different tools using that same account. 09:45.850 --> 10:04.430 And so the reason why this is considered a best practice is then like the company who's buying these different tools and needs their employees to log in only has to track privileges and accesses on one account system and it prevents different password roles, 10:04.430 --> 10:10.350 potential repetition if the employees have to come up with all these different accounts and passwords. 10:10.350 --> 10:13.930 And it also is much easier to handle when an employee leaves. 10:13.930 --> 10:17.350 You don't have to remember to remove all of these different accesses. 10:17.350 --> 10:19.350 You only have to delete it in one place. 10:19.670 --> 10:33.950 So this website, sso.tax, tracks the difference in costs that software-as-a-service companies charge if the company buying their software, their customer wants single sign-on as a part of this. 10:33.970 --> 10:48.570 And so it's often two to three times more if you want to use single sign-on but sometimes can be as much as 500% increase in price in the case of IrrTable and you can see the others here. 10:48.710 --> 10:51.490 And just think about that for a second. 10:51.490 --> 10:56.170 This is something we consider as the information security community. 10:56.170 --> 11:02.570 We consider it a core thing enterprises should be doing to protect themselves and thereby their users. 11:02.870 --> 11:08.670 And we as an industry also complain when companies don't follow our best practices. 11:08.730 --> 11:13.510 But we're now adding these hurdles for them to be able to follow our best practices. 11:13.510 --> 11:18.550 We're saying, actually you only should do it if you can pay this extra. 11:18.550 --> 11:22.930 Otherwise you don't need this core security feature. 11:26.260 --> 11:46.960 Another example where paying got you more privacy or safety or security is that from 2013 to 2016, AT&T which is an internet provider here in the United States, they would charge you 30 to 60 dollars more a month if you did not consent to their internet preferences program. 11:46.960 --> 11:54.460 So the internet preferences program tracked all of the web browsing you did, how long you spent on the website and things like that. 11:54.460 --> 12:01.220 And since it was at the IPSP level, it ignored cookie preferences, ignored do not track private browsing, etc. 12:01.300 --> 12:10.560 So if you consented to AT&T being able to gather all this data from you, you got to pay 30 to 60 dollars less. 12:10.800 --> 12:21.200 So at the point of a year, that's 720 dollars or this article says 744 extra per year. 12:21.560 --> 12:36.580 I don't know a lot of people who would say, sure, I can pay 744 dollars a year for so-and-so privacy, but the ones who can and will and understand that, they get to be safe and secure and private. 12:36.600 --> 12:42.640 Everyone else deserves to have their data read and tracked. 12:42.860 --> 12:51.880 And so finally after, you know, multiple years of this program ongoing, AT&T was getting more bad press and they decided to cancel the program. 12:52.080 --> 12:56.520 But it still went on for a while, you know, from 2013 to 2016. 12:57.640 --> 13:07.640 And so this is where I think we all really need to think both individually and as an industry, what do our actions say? 13:08.160 --> 13:13.640 And do those, they match our beliefs around InfoSec and security and privacy. 13:14.300 --> 13:23.200 Because I know what I hear from others and what I believe is not that, oh, security is only for some. 13:23.200 --> 13:30.300 I continue to hear that security and privacy is a requirement and that shouldn't be a commoditized feature. 13:30.300 --> 13:34.600 Because while we all value it, it's the baseline. 13:34.600 --> 13:35.940 It's the foundation. 13:35.940 --> 13:41.180 You shouldn't have a minimal viable product that doesn't have security and privacy built in. 13:41.180 --> 13:47.980 It's not that extra that you can add in in version 2 or it's only for premium users. 13:48.180 --> 13:55.240 So if we know there is a type of way to keep users safe, then they deserve that. 13:55.680 --> 14:02.740 If that's our mission and our beliefs and our values though, do our actions line up with that? 14:02.740 --> 14:11.080 Because it looks like based on these many anecdotes that we're actually saying only the rich deserve to be secure. 14:11.600 --> 14:19.860 And I don't think, honestly, that's what any of us in the community believe what we would go around telling. 14:19.860 --> 14:24.660 People get up on the stage during conference talks saying only the rich deserve privacy. 14:24.660 --> 14:28.140 Everyone else should have all of their internet behaviors tracked. 14:28.200 --> 14:29.740 But is that... 14:29.740 --> 14:37.780 do our actions and how we secure products and the products we release and the apps we release, do they show that? 14:38.740 --> 14:43.820 So security, privacy, and safety are our minimal viable product. 14:43.920 --> 14:49.220 Everything has to have them built in to be a product, to be an app that launched. 14:49.220 --> 14:55.680 Otherwise, we don't have anything that is fit to be released to prod, basically. 14:55.860 --> 15:00.580 And I know this analogy has been beaten over and over and over again. 15:00.620 --> 15:09.180 But what we need to do is treat the security, privacy, and safety in the same way that cars treat seatbelts. 15:09.220 --> 15:12.380 Yes, it costs more to add a seatbelt to a car. 15:12.380 --> 15:14.840 But that is the minimal accepted level. 15:14.840 --> 15:18.580 You can't buy a car right now that does not have seatbelts in. 15:18.580 --> 15:21.820 And so that's how we should treat security, too. 15:24.200 --> 15:31.880 And so, at this point, sometimes people say, oh, we should just all be apolitical. 15:31.960 --> 15:47.040 If that straw man argument is coming up, then I would just like you to think about the fact that all we're talking about is addressing the inequities that can occur for different groups of people when we're trying to secure products. 15:47.040 --> 15:52.920 Our job is to be security engineers or other types of professionals in the information security community. 15:52.920 --> 15:57.300 So talking about those impacts, I don't think that's political. 15:57.660 --> 16:02.820 If you do, then sure, InfoSec is inherently political. 16:02.900 --> 16:20.140 But these conversations about having a specific group we're trying to protect have been around since the beginning of the industry and the community because we've always had set users that we're hoping to secure further or provide more privacy for. 16:20.140 --> 16:26.260 And so let's look at some of that and how that's framed that we've always had a user in mind. 16:26.520 --> 16:35.260 So first, we can go back to 2002 when Hato Bismo, a branch off from the cult of the dead cow, launched the 6-4 system. 16:35.260 --> 16:49.520 So the 6-4 system is a network proxy built to evade censorship and the protocol was named 6-4 to remember the massacre at Tiananmen Square, which occurred on June 4th, therefore 6-4. 16:50.900 --> 17:05.420 And one of the main reasons at least that I've read that this was created was to specifically help users who are living in countries that have heavy censorship of the internet, like China and Iran. 17:07.180 --> 17:14.940 And fast forward to today, here's another example of having a very clear user base of who you're trying to protect in mind. 17:14.940 --> 17:18.940 It's even in the advertisement top of the page. 17:18.940 --> 17:29.120 A few years ago, Google launched the Advanced Protection Program and it's specifically to protect and secure those at risk of targeted attacks. 17:29.120 --> 17:33.940 So journalists, political campaign leaders, activists, etc. 17:36.440 --> 17:51.780 And again, here's another example from the early days of our industry until now, that generally as a community we have come together to fight against DRM and fight for consumers. 17:51.780 --> 18:05.720 So we're not going through and trying to protect the companies that are building DRM into their devices like a refrigerator, Windows 95, video games, John Deere tractors. 18:06.120 --> 18:15.840 Hackers are generally trying to find bypasses for these to protect and fight for those consumers and the customers who have bought or used these products. 18:17.660 --> 18:26.780 And all of those examples of having a clear user base in mind of who we're trying to protect comes to finally threat modeling. 18:26.860 --> 18:41.660 Threat modeling is a very basic but integral and probably required part of our jobs when we're looking to give advice, suggestions, or build new security things into what we're deploying. 18:42.120 --> 18:49.240 And in the threat model, you're trying to decide what are all these threats to the thing I'm trying to protect? 18:49.340 --> 18:56.100 So to be able to create that threat model, you have to know really well the exact group you're trying to protect. 18:56.340 --> 19:00.960 Threat models shouldn't be, I'm trying to protect everyone that exists on this globe. 19:00.960 --> 19:09.600 That would be a terrible threat model because we all are different human beings with different concerns, different threats, and that's just the way it is. 19:09.600 --> 19:16.300 So I hope through this talk you're not taking that Maddy is saying our threat models have to be every single human. 19:16.300 --> 19:29.820 The point is that first identifying, like we do, exactly who is the person we have in mind that we're creating these security features for and are thus trying to protect. 19:30.940 --> 19:43.420 And the key of that is that though, once we make that choice of who is protected, we also need to acknowledge and take ownership that that is also making a choice of who is not protected. 19:43.540 --> 19:52.100 Because when we're building security and new products and features for a certain group of people, inherently another is excluded. 19:52.860 --> 20:04.640 So for example, Google Advanced Protection, that's not bad because not everyone needs all of that protection and some would actually find it very frustrating to use. 20:04.820 --> 20:19.600 But that is a decision and an ownership of okay, it's the people who choose to opt in who view themselves as at risk of targeted attacks or fall into one of these certain categories like working on a political campaign. 20:20.600 --> 20:38.670 But we do need to address this because the ability for us to make those choices is inherently a power and a privilege because others don't get to make that choice necessarily whether or not they're included in these groups that we're trying to protect. 20:39.060 --> 20:49.600 And when some people are protected and secure and others aren't, that's going to continue to grow the systemic inequality that we see around the world. 20:49.600 --> 20:59.840 So let's look at some side effects of security decisions when you have in mind a clear group you're trying to protect but maybe don't think about all the implications for others. 21:00.860 --> 21:08.280 So first, Rite Aid uses facial recognition in secret across hundreds of its stores. 21:08.580 --> 21:12.480 So Rite Aid deployed this, you know, to protect themselves. 21:12.540 --> 21:24.540 They said in this article that their concern and their reasoning was we need to protect ourselves from theft and we also need to protect our staff and our customers from violence. 21:24.540 --> 21:27.480 So that's their security concerns. 21:28.380 --> 21:40.560 But if that's who is quote-unquote being protected, it's Rite Aid, they're actually sacrificing all of the privacy of their customers in order to have that security for themselves. 21:41.220 --> 21:49.360 And if you read this article and it even says in this headline, this wasn't deployed equally. 21:49.360 --> 21:54.100 It was predominantly used in low-income and non-white neighborhoods. 21:54.140 --> 22:10.060 And so it's furthering a gap that, oh, we're just worried about theft and violence in non-white, low-income neighborhoods and so we don't need to worry about it there and thus we're sacrificing these people's privacy. 22:10.060 --> 22:17.460 But I think if you took a step back and let's say we're security engineers tasked with this problem. 22:17.460 --> 22:20.760 How do we help protect Rite Aid from theft? 22:20.760 --> 22:24.840 How do we help protect them from violence occurring in the stores? 22:25.240 --> 22:38.000 I think we could come up with a lot of different other solutions that could help protect themselves without sacrificing the customers' privacy in the process. 22:39.380 --> 22:43.680 Another example is parent or child protection apps. 22:43.820 --> 22:48.980 I have a lot of feelings about these apps but I'm not going to get into that now because I'm not a parent. 22:48.980 --> 23:04.180 But the whole premise is these are built for the customer which is the parent or the adult guardian to install on their child's mobile devices in order to try and keep the child safe. 23:04.240 --> 23:17.080 But if the parent is the one responsible and the customer, it's actually built to address what the parent thinks the kid's threat model is not actually who the user of the device's threat model. 23:17.080 --> 23:30.220 And so that can have unintended consequences or maybe intended but we'll go with unintended consequences on whoever is using the device and has this application installed on their own device. 23:31.180 --> 23:44.060 So for example in here it's saying this app gives you the ability to listen to the surroundings of whoever is using this app. 23:44.140 --> 23:45.300 What? 23:45.320 --> 23:48.060 That's turning on the microphone and listening? 23:48.520 --> 23:56.600 While the folks securing and building this app may be intending that this app is only used in consensual relationships. 23:56.640 --> 24:07.220 The kid gets the phone, the parent talks to the kid of you can have this phone but I'm going to be monitoring these different behaviors for you to be able to use this phone. 24:07.420 --> 24:09.480 Hopefully that's what they're building for. 24:09.600 --> 24:13.420 That doesn't mean that's the only way this technology will be used. 24:13.680 --> 24:19.900 What's the difference in the technology at the base level between spyware and stalkerware? 24:19.900 --> 24:29.280 Instead you're depending on the users to only use it in a way in which you're building it. 24:29.280 --> 24:39.360 As a woman in my 20s, I have had friends who have stalkerware installed on their phones but it looks and it brands itself as a child protection app. 24:40.040 --> 24:54.620 And also do the people building this and the security and the threat model of their users also consider the reality that sometimes the adult parent and guardian doesn't have the child's best interests at heart. 24:54.640 --> 24:59.940 These also have been said to be used in child traffic wings. 25:00.280 --> 25:16.520 And so when we make compromises and sacrifices for a single use case such as, oh I don't love this idea but it's only going to be used by parents who have a kid who consents to have it on their phone because otherwise they wouldn't have the phone. 25:17.060 --> 25:26.700 If we're building only for that use case but there's nothing making that app only be used in that use case, then we're still causing harm. 25:26.700 --> 25:31.820 And so there's no guarantees that code will be built the way we intend it to be built. 25:33.440 --> 25:36.840 So, headline kind of says it all. 25:36.840 --> 25:41.400 United States government funded phones come pre-installed with unremovable malware. 25:41.580 --> 25:55.220 So there is a program or there was in the United States that if you were low income if you didn't have the means to get yourself a phone the US government would provide you with a smartphone based on Android. 25:55.660 --> 26:02.260 You know, cheaper phones, not the flagships and lo and behold they come pre-installed with unremovable malware. 26:02.680 --> 26:14.300 So this is one of those things where I hope that the government wasn't intending to install malware on each of these devices. 26:14.300 --> 26:21.680 I hope that they were trying to give phone and technology access. 26:21.860 --> 26:43.380 But because of how cheaper devices have begun to subsidize themselves by installing whatever people will pay them to install we have now harmed the privacy and security of these users who really were already in a tough spot in society and trying to live their lives. 26:43.380 --> 26:45.420 So Strava. 26:45.440 --> 26:51.100 Even on their website the Strava app says they build for athletes. 26:51.100 --> 26:53.020 So that's their user base in mind. 26:53.020 --> 27:01.460 That's who they're trying to protect when they're securing this application and the data that is stored that comes from it. 27:02.000 --> 27:09.600 But when you just think about securing for athletes, that's only one part of who someone is. 27:09.600 --> 27:15.160 So we really need to take into account the intersectionality of all of us as humans. 27:15.260 --> 27:24.720 Because as a female athlete, I get very concerned about my location data being able to be tracked by anyone else. 27:24.880 --> 27:50.180 Military personnel want to be athletes, want to have the features of the Strava application but I bet it wasn't considered that although the data on the heat maps that are open to the public and on the internet that are seen is aggregated that aggregation meant that you could end up seeing where military bases were abroad when all these different military personnel, 27:50.180 --> 27:55.340 who are also athletes were going for their jogs at the end of the day. 27:58.040 --> 28:07.520 And here's another example of just how far our specific choices in security can go. 28:07.920 --> 28:16.300 So Pixel phones as well as many other devices have a support period where they guarantee you will have security updates for this amount of time. 28:16.300 --> 28:25.560 In this case, the Pixel phones have three years from the release date or at least 18 months from the time it's last sold on the Google store. 28:26.560 --> 28:38.620 So you know, as a community, I think one of the most basic things we say to users is you should only be using devices that get security updates or else you're kind of asking for trouble. 28:38.720 --> 28:48.320 But we also are shortening sometimes these periods that the updates are available for things like phones and computers and devices. 28:48.320 --> 29:16.500 And so the first obvious impact that this choice of doing three years of security updates may have is on those again, lower income or don't have access to buying phones quickly and regularly or even just communities which sometimes can be elder adults who are not used to and don't realize they need to be updating a phone every three years. 29:16.500 --> 29:22.260 And they actually prefer the older ones because they know how to use them and it's more intuitive to them. 29:22.440 --> 29:29.060 So those are some of the obvious impacts to users that we might not be building for or choosing security for. 29:29.060 --> 29:32.120 But these decisions go that much further. 29:32.300 --> 29:39.460 If we're getting new phones every three years or faster that generates a lot of e-waste. 29:39.600 --> 29:49.720 And so while climate change is such a big thing, the more e-waste we generate the more negative impacts that has on our environment. 29:50.000 --> 29:55.060 And the environment and climate change doesn't impact all of us equally. 29:55.060 --> 30:12.720 There's already been a lot of research out that generally communities already in tougher positions, lower socioeconomic status, generally communities of color are the ones that are hit the hardest by the environment and climate change. 30:12.980 --> 30:22.880 And yet it's those of us predominantly in US and Western Europe who are buying and disposing of these phones. 30:22.880 --> 30:35.760 And so our security decisions end up impacting these people, you know, on other places who might have nothing to do and have never interacted with these phones or devices in the first place. 30:37.100 --> 30:40.400 So those were a lot of examples. 30:40.660 --> 30:42.820 Not so happy, not so negative. 30:42.820 --> 30:48.500 But you might be saying to me because, you know, I've said it to myself as I try to work through these things myself. 30:48.900 --> 30:50.500 I'm just one person. 30:50.500 --> 30:54.660 I just work on securing a single app with only a thousand users. 30:54.880 --> 30:57.300 I'm just a manager of a little team. 30:57.300 --> 30:58.380 I'm not an exec. 30:58.380 --> 31:00.440 I'm not the director of security. 31:00.560 --> 31:02.500 I'm just a document writer. 31:02.500 --> 31:04.280 All those different things. 31:04.280 --> 31:07.260 And you might say I'm just making little choices. 31:07.320 --> 31:08.960 They don't have that big of an impact. 31:08.960 --> 31:11.240 It's none of the examples you have listed here. 31:12.160 --> 31:24.060 But the issue becomes that each of our choices become patterns and the norm and the status quo for how we expect products to be developed and released. 31:24.300 --> 31:30.900 So you might think, oh, I'm just making this little sacrifice, a compromise to get this product out the door for me. 31:30.900 --> 31:33.220 Our app doesn't impact all that many people. 31:33.220 --> 31:34.680 So it's good. 31:35.100 --> 31:47.100 But that choice then gives a precedent or a permission for others to make the same one and make those same compromises or those same sacrifices for a different group of people. 31:47.460 --> 32:00.340 And unfortunately, because this technology is so built into our ability to thrive, each of those little choices become systemic inequities. 32:00.340 --> 32:04.860 And they end up having huge society ramifications. 32:05.200 --> 32:19.940 So for example, in general, I've been guilty of it myself and I'm working on it too, but I have to acknowledge I've said, yeah, we accept that lower priced devices are less secure and that's because of the business model. 32:19.960 --> 32:22.340 They can't do everything. 32:22.560 --> 32:29.480 We accept that there is more risk to women for any apps that choose to track location. 32:29.840 --> 32:36.980 We accept that biometric security technologies aren't as effective on non-white faces. 32:36.980 --> 32:51.940 But each of these acceptances means that we are creating a system that accepts that not everyone deserves the same level of safety, security, and privacy. 32:51.940 --> 33:01.440 And we are compounding the previously and already existing systemic injustices and inequality through this technology. 33:01.440 --> 33:07.420 So instead of shrinking that gap as technology can, we continue to widen it. 33:08.320 --> 33:18.080 And it's easier and it's easier a lot of the time to believe, you know, I'm just making this decision or one little sacrifice for one product. 33:18.080 --> 33:21.720 And there are so many other products and other people working in this space. 33:22.260 --> 33:29.980 But we lean on each other and it ends up growing and growing and showing others what's cool, what's okay. 33:30.040 --> 33:41.780 And that's how we end up with having these extreme gaps in how people are able to access technology privately and securely. 33:43.160 --> 34:01.400 So an example of how our choices for security and technology end up having huge ramifications is that in both the United States and Europe, many are now using artificial intelligence algorithms to decide on what punishments a person should receive after breaking the law. 34:01.400 --> 34:10.840 So these are things like how much or if they should have bail, what is their sentencing, are they eligible for parole? 34:10.840 --> 34:13.880 This has now been pushed off to algorithms. 34:13.900 --> 34:16.540 But we as humans write these algorithms. 34:16.540 --> 34:27.920 And so these algorithms are saying, that have been written by humans, are deciding whether or not we believe this person can be rehabilitated to become a contributing member of society. 34:27.980 --> 34:31.660 And this algorithm is saying whether or not this person will commit a crime. 34:32.320 --> 34:41.620 But since we're coding all of these algorithms, they're going to bring the reflections of the team that's writing them. 34:41.620 --> 34:46.240 And the reflections of that security team who's looking at it and assessing it. 34:46.600 --> 34:52.220 Because, for example, I'm a white woman from the US for Canada Tech Company. 34:52.260 --> 34:55.560 If I'm writing the algorithm, I know I'm innocent. 34:55.560 --> 35:01.500 So I'm probably going to assume that people like me are innocent too and deserve shorter sentences. 35:01.620 --> 35:18.160 And so if our team all looks like me or only a few groups of people, then we're probably going to write our algorithm to contribute to just those... to give shorter sentences for the people who are like us and it's the others who are harmed. 35:18.640 --> 35:25.680 And I use another slide of emphasizing the same thing because this impact is just so huge. 35:25.760 --> 35:27.320 This is life or death. 35:27.320 --> 35:30.060 Having to go to prison or not. 35:30.160 --> 35:36.060 And it also causes generational trauma that goes across families for years and years and years. 35:36.060 --> 35:43.260 And so we really make sure that we are looking at our choices and understanding each of the consequences. 35:43.260 --> 35:47.240 Those consequences can be good or those consequences can be bad. 35:47.240 --> 35:51.580 But our choices create systemic problems. 35:53.020 --> 36:01.880 Another example of a systemic issue is, you know, in general, sex workers are discriminated against. 36:01.880 --> 36:05.380 And this article from Airbnb is just another example of that. 36:05.380 --> 36:07.600 So Airbnb developed an algorithm. 36:07.600 --> 36:08.580 They actually bought it. 36:08.580 --> 36:15.600 They used it and then bought it to try and determine how trustworthy a potential guest might be. 36:15.600 --> 36:21.880 Okay, let's put our Airbnb security engineer hat on as we've done for some of the other companies. 36:22.320 --> 36:26.880 Our goal is to make sure a host's home and property is safe. 36:26.900 --> 36:27.880 That's the goal. 36:27.880 --> 36:36.420 We probably won't keep hosts coming back if there's a high likelihood that they'll be stolen from, their house destroyed, things like that. 36:36.420 --> 36:43.220 So we're going to use an algorithm to decide whether or not the guests are trustworthy and thus should be allowed to rent. 36:43.920 --> 36:51.860 But along the way, while building this algorithm, we decide that sex workers mean they are untrustworthy. 36:52.040 --> 36:57.380 It doesn't matter if the sex worker is not using this for sex work. 36:57.380 --> 36:59.160 They just want to go along with their life. 36:59.160 --> 37:05.160 It does not matter if we are in a country where sex work is legal. 37:05.160 --> 37:10.720 We have decided through this algorithm that sex work equals untrustworthy. 37:10.720 --> 37:13.340 And thus, they don't have access to units. 37:13.340 --> 37:21.000 There can be random cancellations that put them at further harm if they've already arrived in the city or location and thus no longer have lodging. 37:21.060 --> 37:24.060 But that's the decision we've made in our algorithm. 37:24.420 --> 37:32.220 And the thing is, is that that continues to allow permission for then other companies to say, oh yeah, they did it so we can do it too. 37:32.220 --> 37:33.240 They're sex work. 37:33.240 --> 37:34.180 It's a category. 37:34.180 --> 37:34.860 We don't trust them. 37:34.860 --> 37:35.980 We don't allow them. 37:35.980 --> 37:37.600 And I think we see this. 37:37.600 --> 37:43.900 We see it over and over again, how sex workers are discriminated against. 37:45.960 --> 37:55.840 And so in this case, we're coming back to the e-waste anecdote we discussed earlier regarding security updates and their support periods. 37:56.300 --> 38:07.460 And so based on this graph, we can see that North America, Western Europe, Australia and Japan and South Korea are generally the biggest producers of e-waste. 38:07.460 --> 38:11.660 But they don't keep the e-waste to themselves or ourselves. 38:11.880 --> 38:17.120 We send it off to other countries and we pay them to accept it. 38:17.300 --> 38:34.720 And so then those other countries, which you know, Eastern Africa, I mean Western Africa, I always forget my East and West and Southeast Asia are two of the places that predominantly receives this and they're also at huge risk from climate change. 38:34.720 --> 38:48.620 But we're saying, hey, now y'all have to figure out how to deal with all of these toxic metals and parts that are within all of these devices and you're also going to be the ones hurt by climate change. 38:50.480 --> 39:05.740 But lastly, to hopefully get you on board and one more way of... we're at this precipice and we might be a few years past it where everything is becoming reliant on technology. 39:05.740 --> 39:11.640 We can't say, oh people are generally going to be safe and secure because they can choose not to use it. 39:11.640 --> 39:17.840 They can choose to only buy the expensive ones or else they're fine without any device. 39:18.220 --> 39:21.680 That's not where we are or where we're going. 39:21.780 --> 39:26.700 You know, in the United States, there's a lot of talk about moving to mobile drivers license. 39:26.700 --> 39:30.840 There's been different efforts to move to mobile passports. 39:30.840 --> 39:39.580 And so it will take extra effort and cause extra money to have to go and get a physical card if that's even allowed in the future. 39:39.780 --> 39:51.420 Even with coronavirus, just in the last couple of months, a lot of restaurants and retailers have decided to stop accepting cash just because of perceived virus transmission. 39:51.740 --> 40:03.540 And this hurts communities that either don't have access to banks or have a lot of reason not to trust that banks are safe for them and who have been wholly reliant on cash. 40:03.540 --> 40:11.780 We're again leaving them behind and saying, oh yeah, you don't need to participate in the economy because we've decided to go cashless. 40:12.300 --> 40:16.440 And another example is airlines. 40:16.520 --> 40:18.960 So in this case, this is Ryanair. 40:18.960 --> 40:34.840 And if you don't have an online boarding pass and you need the airline to print it for you at the airport, you know, how things were done six, seven years ago and was the norm, it will now cost you an additional 20 pounds. 40:34.920 --> 40:40.220 So if you don't have technology, you are further penalized and charged for that. 40:42.160 --> 40:43.560 So what do we do? 40:43.560 --> 40:49.640 I told you I didn't want to just present problems with no solutions. 40:50.340 --> 40:58.380 And I'm guessing you, like me, are probably in the spot of, Maddie, this problem area is so huge. 40:58.380 --> 41:02.080 How do we even begin to confront it? 41:02.080 --> 41:12.020 And the first thing I want to do is remind us that we are in this powerful place of privilege and that the choice is up to us to address it. 41:12.020 --> 41:13.600 If we don't, no one else is. 41:13.600 --> 41:20.060 No one else can fix this because we are the ones who are in charge of information security. 41:20.380 --> 41:28.280 But this is also an exciting gift even if it might feel like a lot of responsibility because that means we don't have to sit here hopeless. 41:28.580 --> 41:47.880 We actually have the control personally to be able to start fighting for this new future where we believe that regardless of geolocation, race, gender, sexual orientation, ability, religion, and all the other different aspects that make us beautiful, diverse humans, 41:47.880 --> 41:54.160 if you have safe and secure access to the Internet, oh, what a beautiful world that would be. 41:54.560 --> 41:56.360 And so let's build it. 41:56.840 --> 42:04.040 We set the standards that security and privacy is a fundamental right, a fundamental foundation requirement. 42:04.080 --> 42:07.980 Nothing goes out that doesn't have security and privacy built in for it all. 42:07.980 --> 42:12.320 And this ultimately helps us, too, if you need the selfish argument. 42:12.320 --> 42:24.220 Because if we ensure that security and privacy is set in a fundamental right for everyone, if we're ever on the hook and on that precipice, we know it's guaranteed for us, too. 42:24.580 --> 42:37.820 So I hope 5, 10, 15, 50, 20, however many years from now, we're going to have that option hopefully to look back and say, huh, I really helped there. 42:37.820 --> 42:44.200 I pushed for it and now we're living in this world where everyone has security and privacy. 42:44.480 --> 42:49.700 Or we can look back and say, I had a chance to help change it and I didn't. 42:50.900 --> 42:52.980 So how do we do this? 42:52.980 --> 42:57.220 One, as I've said before, security is a requirement, not a feature. 42:57.220 --> 43:01.100 It's the baseline for even having a minimal viable product. 43:01.960 --> 43:08.860 This is for startups who, you know, a lot of them currently say, we get something out the door and then security is added in v2. 43:08.860 --> 43:10.760 Nope, we don't allow that anymore. 43:10.760 --> 43:14.160 It's not just for those who pay or can wait, it's for everyone. 43:16.100 --> 43:30.240 Next, we are already explicit a lot of the time, or if we're not, we should be, about the threat models of who we're trying to protect and why we're suggesting the security features we are, the privacy constraints we are. 43:30.280 --> 43:41.600 So let's not only be explicit about who is helped, but let's be explicit about who is harmed, who could be adversely impacted by the threat model we've created. 43:41.780 --> 43:47.880 And the reasoning is, is not that everyone should be protected and helped in the same way for every product. 43:47.880 --> 44:00.840 It's that by naming problems, by saying, oh, this group of people would be harmed by this choice, we can at least start to brainstorm and come up with solutions and bring our creativity. 44:01.200 --> 44:07.720 But it's definitely impossible to try and come up with solutions if you've never even named it to be a problem. 44:11.000 --> 44:18.660 Three, you might be saying to me, Maddie, there's so many different groups and identities and things that are different. 44:18.660 --> 44:23.100 How am I supposed to keep all of them in my head and understand all of the impacts to everyone? 44:23.100 --> 44:32.040 And the cool thing is, is you don't have to, I don't have to, as long as we create teams that represent all of these different views and identities. 44:32.040 --> 44:39.840 And that team is inclusive, such that everyone can speak up and represent those experiences that they're bringing to the table. 44:39.840 --> 44:49.700 So, you don't have to ensure that you know how this is going to affect someone who's LGBT in Vietnam. 44:49.700 --> 44:55.520 If you have someone who's LGBT and someone from Vietnam, then they can also help represent. 44:55.680 --> 45:00.620 But it's even better if you hire for intersectionality. 45:00.620 --> 45:07.240 So if you hire that LGBT person from Vietnam, then you've definitely gotten their viewpoint across. 45:07.360 --> 45:14.980 And so, for a lot of people in our industry, when they say, hire for diversity, it's people who look like me. 45:15.280 --> 45:25.320 But the only thing I bring to the table that's different is generally those views about gender that aren't always represented here. 45:25.320 --> 45:37.260 But if you hire a black woman or an indigenous woman, then she will bring to the table both the effects on race as well as the effects of being a woman. 45:37.260 --> 45:42.100 So, it's just a great investment for you to hire for intersectionality. 45:43.240 --> 45:49.980 Four, write code and build products for the worst possible case that it could be used for. 45:49.980 --> 45:56.100 And I totally spelled right wrong here, but we're this far in it, so it's going to continue. 45:56.900 --> 46:08.220 So, we may build technologies and secure things for a specific cause that we believe is ethically good and okay and all these things. 46:08.360 --> 46:13.060 But we don't always know how things are going to be used in the future. 46:13.180 --> 46:20.340 So, from the get-go, we need to build our products and frame our security requirements for the worst case imaginable. 46:20.360 --> 46:24.440 Because again, the technology can be used to help or hurt. 46:24.440 --> 46:27.060 So, let's build in our values and ethics from the beginning. 46:29.100 --> 46:33.060 Lastly, if you're a little overwhelmed, welcome to the club. 46:33.420 --> 46:35.040 Yes, this is hard. 46:35.040 --> 46:38.360 But as Glennon Doyle says, we can do hard things. 46:38.720 --> 46:40.140 We won't be perfect. 46:40.140 --> 46:41.880 I'm far from perfect. 46:41.880 --> 46:45.040 But we have to keep learning and trying. 46:45.220 --> 46:51.040 You know, an example of this is that this talk has been very US-centric because that's where my background. 46:51.040 --> 47:03.140 And so, it would be really valuable to Khans and the community as a whole to also have similar talks that are coming from different perspectives that I can't and don't know how to accurately represent. 47:03.440 --> 47:07.540 And so, the key thing is that we don't need to reinvent the wheel. 47:07.820 --> 47:17.020 We just need to hire and pay the people that are already doing this work and asking us to listen to the effects that this technology can have on their communities. 47:18.640 --> 47:24.520 And so, if we do those things together, that can make it a lot less hard. 47:24.700 --> 47:32.620 Because I don't know how many people are watching this talk, but I know that there are probably thousands and thousands attending DEF CON as a whole. 47:32.760 --> 47:46.960 So, if every single one of us decided, okay, from here on out, I'm going to start speaking up and taking actions to question, can we do better in helping more people and not allowing others to be harmed? 47:47.040 --> 47:48.420 And that becomes the norm. 47:48.460 --> 47:57.860 Because one of the things that makes this hard is being alone and feeling like you're the only one who's worried about this and challenging the status quo. 47:57.860 --> 48:02.300 So, if we all do this together, then the norm is to speak up. 48:02.300 --> 48:06.680 The norm is to demand the fundamental right to security and privacy. 48:06.920 --> 48:13.700 We're all in this together, and that's how we can hopefully do it and make it less scary and less hard. 48:14.080 --> 48:20.540 And so, finally, to close this all up, as I've said before, there's no neutral. 48:20.540 --> 48:26.900 I really wish there was, because sometimes we're all just tired and exhausted, but there's not. 48:26.900 --> 48:34.060 And so, we need to own that, and we need to own that we have the power and privilege, and all of these users are relying on us. 48:34.060 --> 48:42.480 So, let's use these beautiful positions and fun work we get to do to fight that security, privacy, and safety is a right for all. 48:42.940 --> 48:45.660 And, you know, that's the world I want to live in. 48:46.300 --> 48:48.380 So, with that, thank you. 48:48.960 --> 48:51.080 And yeah, I'm staring at my webcam now. 48:51.080 --> 48:52.100 Okay, bye!