1 00:00:05,150 --> 00:00:10,090 Sorry, I had to have some theme music for folks while we waited for our next talk. 2 00:00:16,340 --> 00:00:20,740 Chloe, could you broadcast your slides really quick? 3 00:00:20,740 --> 00:00:35,080 What I'll do is I will introduce you as you put them up there, and then we will have our staff kind of give you the go-ahead, and as soon as they do, I'll introduce you so they can make sure they have the stream lined up with things as they go. 4 00:00:37,860 --> 00:00:39,160 Can you hear me okay? 5 00:00:40,220 --> 00:00:40,900 Definitely. 6 00:00:40,900 --> 00:00:42,020 We can hear you pretty well. 7 00:00:42,020 --> 00:00:42,400 Okay. 8 00:00:42,400 --> 00:00:45,800 I was like, we had the push-to-talk feature for some of the talks. 9 00:00:45,800 --> 00:00:47,360 I was like, okay, I need to turn it off. 10 00:00:47,360 --> 00:00:49,020 I'm assuming at this point. 11 00:00:49,880 --> 00:00:50,320 Oh, yeah. 12 00:00:50,320 --> 00:00:53,480 This is going to be mostly you, so yeah. 13 00:00:54,760 --> 00:00:55,400 All right. 14 00:00:55,400 --> 00:00:59,040 And then let me put – you guys can see my screen already. 15 00:00:59,040 --> 00:01:03,040 Let me just put my video on for the very beginning here. 16 00:01:04,280 --> 00:01:05,160 Perfect. 17 00:01:05,220 --> 00:01:06,040 Hi. 18 00:01:06,260 --> 00:01:07,020 Hey. 19 00:01:07,960 --> 00:01:08,700 All right. 20 00:01:08,700 --> 00:01:09,000 There we go. 21 00:01:09,000 --> 00:01:09,500 Good to see you. 22 00:01:09,500 --> 00:01:10,220 Good to see you. 23 00:01:10,220 --> 00:01:11,100 Good to see you, too. 24 00:01:11,100 --> 00:01:11,860 All right. 25 00:01:12,240 --> 00:01:13,480 Let's see. 26 00:01:14,140 --> 00:01:22,520 Let me know, staff, when I can start – when we start, once you get the stream all going, and we will start as soon as that starts. 27 00:01:22,660 --> 00:01:23,240 Cool. 28 00:01:23,240 --> 00:01:24,500 Quick question. 29 00:01:24,960 --> 00:01:27,820 I want my video to be off. 30 00:01:27,960 --> 00:01:36,560 After I do – when I move from this slide to the next, could you guys control that, or do you want me to quickly go back into Discord and do that myself? 31 00:01:36,840 --> 00:01:43,100 I'd probably say if you can shut off the video on your end, so that way we can just ensure that things are being recorded. 32 00:01:43,100 --> 00:01:43,660 Sure. 33 00:01:44,080 --> 00:01:52,440 Yeah, and I'll just – so I'll just make sure that my camera is off now, and then I'll just turn it back on for Q&A so I can get out of the slides. 34 00:01:52,440 --> 00:01:53,220 Sound good? 35 00:01:53,320 --> 00:01:53,900 Yep. 36 00:01:53,900 --> 00:01:57,160 Can you put your slides on full screen really quick? 37 00:01:57,520 --> 00:01:59,140 Can you see it full screen? 38 00:01:59,140 --> 00:02:02,860 No, right now we see just the default PowerPoint. 39 00:02:03,720 --> 00:02:04,520 Huh. 40 00:02:05,280 --> 00:02:08,500 If you hit F5 – No, that's not it. 41 00:02:10,060 --> 00:02:11,220 That's weird. 42 00:02:12,080 --> 00:02:14,600 Can you see it now, the full screen? 43 00:02:14,920 --> 00:02:18,960 Right now, all we see are like the slide deck when you first go into – Yeah. 44 00:02:19,160 --> 00:02:20,040 Yeah. 45 00:02:20,740 --> 00:02:21,240 Huh. 46 00:02:21,240 --> 00:02:22,360 How about now? 47 00:02:22,360 --> 00:02:23,480 What do you see? 48 00:02:24,040 --> 00:02:28,540 Right now, we are seeing just the general slide deck. 49 00:02:28,540 --> 00:02:29,980 It's the presenter view. 50 00:02:30,180 --> 00:02:35,360 I wonder – it was doing that before. 51 00:02:36,300 --> 00:02:37,380 No worries. 52 00:02:37,880 --> 00:02:38,960 Huh. 53 00:02:39,280 --> 00:02:49,560 And for those folks that are currently on Twitch and are tuning in on Discord, give us a few seconds as we set up our stream, and we set up our slides really quick. 54 00:02:49,560 --> 00:02:54,200 So just sit tight, and we will start our presentation by Chloe in just a few. 55 00:02:54,200 --> 00:02:55,640 So hang in there. 56 00:02:57,540 --> 00:03:00,460 Looks like we've got a decent amount of Twitch folks on there. 57 00:03:01,440 --> 00:03:02,240 Okay. 58 00:03:02,240 --> 00:03:03,420 Let me try again. 59 00:03:03,420 --> 00:03:05,380 Maybe I just need to restart it. 60 00:03:05,420 --> 00:03:06,720 Sounds good. 61 00:03:07,880 --> 00:03:09,320 All right. 62 00:03:11,540 --> 00:03:12,260 All right. 63 00:03:12,260 --> 00:03:13,980 Can you see it full screen now? 64 00:03:13,980 --> 00:03:14,700 No. 65 00:03:14,700 --> 00:03:17,780 Right now, it shows play from start. 66 00:03:17,780 --> 00:03:19,680 We still see the presenter view. 67 00:03:20,500 --> 00:03:21,800 Oh, okay. 68 00:03:27,630 --> 00:03:28,630 That's so weird. 69 00:03:28,630 --> 00:03:29,890 I'm sorry, guys. 70 00:03:29,890 --> 00:03:30,830 No worries. 71 00:03:30,830 --> 00:03:31,690 No worries. 72 00:03:32,430 --> 00:03:39,950 What I would probably say is, if anything – do you have two monitors at the moment? 73 00:03:40,110 --> 00:03:41,250 I do. 74 00:03:41,250 --> 00:03:44,330 What I would do is share the – don't share the application. 75 00:03:44,330 --> 00:03:47,690 Share the monitor where the slide is going full view. 76 00:03:48,710 --> 00:03:49,230 Oh, okay. 77 00:03:49,230 --> 00:03:50,930 So this is on my laptop right now. 78 00:03:50,930 --> 00:03:51,230 Sorry. 79 00:03:51,230 --> 00:03:53,290 I have two computers next to me, though. 80 00:03:53,730 --> 00:03:54,310 I got you. 81 00:03:54,310 --> 00:03:55,070 I got you. 82 00:03:56,470 --> 00:03:57,270 Huh. 83 00:03:58,290 --> 00:03:59,450 That's weird. 84 00:04:01,210 --> 00:04:02,010 Crap. 85 00:04:03,790 --> 00:04:07,590 If you'd like, you can send me the slides and I can drive them. 86 00:04:07,590 --> 00:04:08,030 Okay. 87 00:04:08,030 --> 00:04:08,430 Yeah. 88 00:04:08,430 --> 00:04:11,350 And I'll just say next slide or whatnot. 89 00:04:11,350 --> 00:04:12,410 Sounds good. 90 00:04:12,690 --> 00:04:13,690 Okay. 91 00:04:13,690 --> 00:04:15,270 Where should I send it to? 92 00:04:15,370 --> 00:04:15,810 Here. 93 00:04:15,810 --> 00:04:19,250 I will direct message you my email really quick. 94 00:04:22,840 --> 00:04:23,720 Cool. 95 00:04:23,720 --> 00:04:28,620 So for folks that are tuning in on the Twitch stream, give us one quick second while we get Chloe's slides. 96 00:04:28,620 --> 00:04:31,400 I will drive them and we will go from there. 97 00:04:31,400 --> 00:04:33,060 So sorry, folks. 98 00:04:33,060 --> 00:04:34,560 Give us one second. 99 00:04:34,560 --> 00:04:38,780 Let me pop the – back in there. 100 00:04:38,780 --> 00:04:40,420 Let me turn that off. 101 00:04:40,520 --> 00:04:47,260 I hope everybody is doing pretty well today in the spirit of DEF CON. 102 00:04:47,260 --> 00:04:48,940 Welcome to the final day. 103 00:04:48,940 --> 00:04:55,180 Let me go to Gmail. 104 00:05:06,800 --> 00:05:12,560 So for those of you that just joined, give us one quick second as we set up our slides. 105 00:05:12,860 --> 00:05:16,160 We are starting the stream just shortly. 106 00:05:16,160 --> 00:05:19,180 Give us one quick second while we go and do that. 107 00:05:45,860 --> 00:05:46,940 That is correct. 108 00:05:46,940 --> 00:05:49,240 I think we should get that beach ball. 109 00:06:19,930 --> 00:06:34,030 So while the slides are being sent, for those of you that were on the call at the last presentation, we had Michael Antonino that was kind of talking a little bit about blackmail and disclosure and a few other things. 110 00:06:34,030 --> 00:06:39,590 So it's pretty nice because Chloe's talk will kind of talk a little bit about that, about the hacker's rights. 111 00:06:39,590 --> 00:06:43,790 It's a nice segue kind of moving into her talk. 112 00:06:43,790 --> 00:06:56,750 For those of you that have just tuned in or have just joined us at DEF CON 28, Ethics Village 2020, what I'd probably say is if you have any questions during the talk, please queue them up. 113 00:06:56,810 --> 00:07:04,050 We are watching the Twitch chat room and we are also watching Discord as well. 114 00:07:04,170 --> 00:07:06,830 So any questions you all have, please queue them up. 115 00:07:06,830 --> 00:07:10,610 I will either relay them to Chloe or Chloe will see them in the chat. 116 00:07:10,610 --> 00:07:14,530 So yeah, just hang in there and we will get started just shortly. 117 00:07:14,530 --> 00:07:18,950 So thank you all for coming for this final talk. 118 00:07:18,950 --> 00:07:20,590 All right, let me see if I can open them now. 119 00:07:20,590 --> 00:07:22,030 I'll be right back, folks. 120 00:08:32,390 --> 00:08:34,270 Okay, and we are back. 121 00:08:34,390 --> 00:08:42,110 For those of you, so I would say, staff, can you please switch the screen really quick to mine? 122 00:08:42,110 --> 00:08:50,550 And I would say, Chloe, you might want to stop presenting the live or stop sharing your screen. 123 00:08:50,550 --> 00:08:52,190 So that way, just in case. 124 00:08:59,160 --> 00:09:00,600 Perfect, perfect. 125 00:09:00,840 --> 00:09:06,540 And I will ask, let me move back to the chat really fast. 126 00:09:06,540 --> 00:09:08,080 One quick second. 127 00:09:08,820 --> 00:09:12,360 So our staff, Ethics Village staff, are we ready to start the stream? 128 00:09:12,960 --> 00:09:15,300 Give me a thumbs up if we are good. 129 00:09:19,240 --> 00:09:21,360 Oh, one quick second, one quick second. 130 00:09:21,360 --> 00:09:22,700 Things are being queued up. 131 00:09:31,810 --> 00:09:33,490 Chloe, I might be butchering your last name. 132 00:09:33,490 --> 00:09:35,150 How do you pronounce your last name? 133 00:09:35,250 --> 00:09:36,550 Miss Doggy. 134 00:09:36,750 --> 00:09:38,130 Miss Doggy, yeah, okay. 135 00:09:38,130 --> 00:09:39,210 There we go. 136 00:09:40,210 --> 00:09:44,290 I've been butchering people's names all day for the past two days, so yeah. 137 00:09:44,310 --> 00:09:49,610 I do this trick where I just say their first name and then I'm like, okay, go ahead and introduce yourself. 138 00:09:49,610 --> 00:09:51,830 No, no, I must go through the pain. 139 00:09:51,830 --> 00:09:53,430 I must learn everybody's name. 140 00:09:53,430 --> 00:09:56,830 Because I'm just like, no, I have to say it. 141 00:09:56,830 --> 00:10:00,630 Although , yeah, yesterday I butchered some poor speaker's name. 142 00:10:00,630 --> 00:10:01,950 I'm like, I am so sorry. 143 00:10:02,770 --> 00:10:07,630 I'm from the Midwest, and the Midwest is unfortunately very, very bland. 144 00:10:10,730 --> 00:10:11,610 Right. 145 00:10:12,870 --> 00:10:15,370 All right, Ethics Village staff, what do you all say? 146 00:10:15,370 --> 00:10:17,190 We good to start? 147 00:10:18,070 --> 00:10:19,830 Let me double check. 148 00:10:21,830 --> 00:10:23,650 I'm just going to say next slide. 149 00:10:23,650 --> 00:10:24,690 What is next slide? 150 00:10:24,690 --> 00:10:25,630 Sound good? 151 00:10:25,750 --> 00:10:26,650 Perfect for me. 152 00:10:26,650 --> 00:10:28,090 And we are good to go. 153 00:10:28,090 --> 00:10:28,690 Thank you all. 154 00:10:28,690 --> 00:10:33,650 Oh, wow, we've got a lot of people on Twitch, and we have a lot of folks over on Discord. 155 00:10:33,650 --> 00:10:36,530 So now I will introduce our speaker. 156 00:10:36,950 --> 00:10:38,350 So hi, everybody. 157 00:10:38,350 --> 00:10:43,490 Welcome to the final live talk of DEF CON Ethics Village 2020. 158 00:10:43,490 --> 00:10:46,690 So today with us we have Chloe, Miss Doggy. 159 00:10:46,690 --> 00:10:50,670 Chloe is the VP of Strategy at Point3 Security. 160 00:10:50,670 --> 00:10:56,730 She is a researcher advocate who strongly believes that information security is a humanitarian issue. 161 00:10:56,730 --> 00:11:05,050 Besides her passion to keep people safe and empowered online and offline, she's driven to fight for hackers' rights. 162 00:11:05,050 --> 00:11:16,110 She is the founder of Women Hackers and the president and co-founder of Women of Security, or WOWSEC, podcaster for ITSP magazines, The Uncommon Journey, and runs the Hacker Book Club. 163 00:11:16,110 --> 00:11:19,350 So in all fairness, folks, check out the Hacker Book Club. 164 00:11:19,350 --> 00:11:21,770 They've got some pretty cool suggestions in there. 165 00:11:21,830 --> 00:11:24,550 You can tweet her at ChloeMissDoggy. 166 00:11:24,550 --> 00:11:26,350 And yeah, we will go from there. 167 00:11:26,350 --> 00:11:29,810 And without further interruptions, Chloe, all you. 168 00:11:30,150 --> 00:11:30,730 Excellent. 169 00:11:30,730 --> 00:11:31,630 Thanks, everyone. 170 00:11:31,630 --> 00:11:33,730 I hope everyone is enjoying their Sunday. 171 00:11:33,730 --> 00:11:40,990 And I guess good afternoon, good evening, or good early, early morning, depending on where you are. 172 00:11:41,310 --> 00:11:43,210 Let's dive into this. 173 00:11:43,210 --> 00:11:45,090 So let's go to the next slide. 174 00:11:49,490 --> 00:11:50,210 All right. 175 00:11:50,210 --> 00:12:05,650 So I just want to say that this talk is completely dedicated to all the hackers who've been scared to disclose, to all the hackers who've been prosecuted for doing something good or doing their actual job, believe it or not, and to all the people who are in the fight to bring rights for hackers. 176 00:12:05,650 --> 00:12:11,530 And there's many of us basically behind scenes doing whatever we can to make changes. 177 00:12:11,730 --> 00:12:16,390 But this talk is going to be good for you because you get to find out how you can also help. 178 00:12:16,390 --> 00:12:17,810 Next slide. 179 00:12:22,840 --> 00:12:24,980 So once again, my name is Chloe Mostagi. 180 00:12:24,980 --> 00:12:27,300 I am the VP of Strategy over at Point3Security. 181 00:12:27,300 --> 00:12:28,920 I'm an ethical hacker advocate. 182 00:12:28,920 --> 00:12:35,860 Basically, I'm fighting for hacker rights, and especially trying to help out the community in any sort of way. 183 00:12:35,860 --> 00:12:48,320 If that means trying to push out mental health issues, if that means bringing diversity and inclusion and doing whatever I can to promote others in the field that are trying to do something good, I do so. 184 00:12:48,320 --> 00:12:49,880 Also a person co-founder at Urbosec. 185 00:12:49,880 --> 00:12:51,920 We have hackers all over the world. 186 00:12:52,180 --> 00:12:55,640 Founder of WeAreHackers, formerly known as WomenHackers. 187 00:12:55,640 --> 00:13:01,000 We are a private group of hackers who hack at all different levels that are marginalized genders. 188 00:13:01,420 --> 00:13:06,220 Also a podcaster for ITSP Magazine, The Uncommon Dream with Phil Wiley and Alyson Miller. 189 00:13:06,220 --> 00:13:09,040 And when I'm not doing that, I run the Hacker Book Club. 190 00:13:09,840 --> 00:13:13,820 And so one thing you should know about it, we meet every week virtually at 5 p.m. 191 00:13:13,820 --> 00:13:15,080 Pacific Time. 192 00:13:15,080 --> 00:13:23,120 We do read one book every month, and usually the books are written by hackers in the community or about the hacker community. 193 00:13:23,280 --> 00:13:28,420 And the authors do attend our sessions, and also people that are mentioned in the book do attend our sessions. 194 00:13:28,420 --> 00:13:32,320 We will be doing Trevor Packer's Red Team Edition. 195 00:13:32,740 --> 00:13:35,600 That's going to be coming up next, so I highly recommend it. 196 00:13:35,600 --> 00:13:36,800 That is my URL. 197 00:13:36,800 --> 00:13:39,920 If you want to know anything about me, it's probably on there. 198 00:13:40,020 --> 00:13:41,640 And I do have a Twitter and Instagram. 199 00:13:41,640 --> 00:13:42,800 My DMs are always open. 200 00:13:42,800 --> 00:13:44,280 All right, next slide. 201 00:13:47,650 --> 00:13:52,090 So I know this is going to be scary, but we're going to dive in it together. 202 00:13:52,410 --> 00:13:53,410 Next slide. 203 00:13:58,860 --> 00:14:05,160 So usually at this point, I say, like, oh, raise your hand if the Equifax breach impacted you. 204 00:14:05,160 --> 00:14:09,400 But the thing is, you're behind your screen, so I'm just going to pretend you raised your hand. 205 00:14:09,560 --> 00:14:18,440 But did you know a security researcher warned Equifax that it was vulnerable to a kind of attack that later compromised the personal data of more than 147 million Americans? 206 00:14:19,320 --> 00:14:31,840 Six months after the researcher first notified the company about the vulnerability, Equifax patched it, but only after the massive breach that made headlines had already taken place, according to Equifax's timeline. 207 00:14:32,780 --> 00:14:34,300 Next slide. 208 00:14:37,900 --> 00:14:40,160 And then we have the case of Capital One. 209 00:14:40,160 --> 00:14:45,220 According to the federal complaint, the breach took place in stages across March and April 2019. 210 00:14:45,220 --> 00:14:57,920 But Capital One only became aware of the problem on July 17, when a security researcher tipped the company to a public GitHub page that was displaying something that looked an awful lot like private Capital One data. 211 00:14:58,200 --> 00:14:59,500 Next slide. 212 00:15:03,590 --> 00:15:08,090 But the real question is, well, what if no one reported the breach? 213 00:15:08,250 --> 00:15:09,670 Next slide. 214 00:15:13,640 --> 00:15:19,100 It happens often because hackers don't report a breach due to the fear of prosecution. 215 00:15:19,100 --> 00:15:28,020 This statistic was discovered by the hard work of Amit Elazari, who knows her laws prevent good hackers from doing what they do best, protecting you and me and everyone we love. 216 00:15:28,080 --> 00:15:31,100 She's been spearheading this movement towards safe harbor. 217 00:15:31,100 --> 00:15:48,000 And according to HackerOne's 2018 hacker report, which surveyed over seven, I think, 60 members or something like that of the hacking community, they found that almost one in four ethical hackers have not reported vulnerability because the company in question didn't have a VDP, 218 00:15:48,020 --> 00:15:49,760 a vulnerability disclosure program. 219 00:15:50,060 --> 00:15:57,740 Those who tried to notify the company through other channels, such as email or social media, also claimed they were frequently ignored or misunderstood. 220 00:15:58,500 --> 00:16:00,020 Next slide, please. 221 00:16:03,320 --> 00:16:09,920 So besides prosecution, looking for contact information and reading the policies have been a burden to report vulnerabilities. 222 00:16:09,920 --> 00:16:11,000 Think about it. 223 00:16:11,000 --> 00:16:15,840 Sometimes it takes hours, days, and weeks to find the right contact information to disclose. 224 00:16:16,160 --> 00:16:25,620 And I have to admit, it's really difficult because at that point, you're like, should I even disclose anything if I can't locate the right person? 225 00:16:25,620 --> 00:16:35,500 And that's a very frustrating thing because you're trying to protect their customers' data, usually, and letting them know ahead of time that there is this vulnerability. 226 00:16:35,500 --> 00:16:38,700 But reporting it can be so hard. 227 00:16:38,700 --> 00:16:59,300 So it's really good and important for companies to state having some sort of in-scope, out-scope policies, and then also contact information, what to expect when reporting, if there are any rewards at all, to mention what kind of rewards could be given. 228 00:16:59,300 --> 00:17:05,960 But having some sort of policies in place that protects the hacker by notifying them about the situation. 229 00:17:05,960 --> 00:17:12,520 But it's not just, you know, hackers online that are having to worry about being prosecuted. 230 00:17:12,520 --> 00:17:16,000 Also, those that are doing physical security as well. 231 00:17:16,000 --> 00:17:20,740 Even if they're hired to do that job, they can still get prosecuted. 232 00:17:20,900 --> 00:17:22,640 Next slide, please. 233 00:17:25,840 --> 00:17:30,980 So after DJI, the drone manufacturer recently launched a bug-bunny program. 234 00:17:30,980 --> 00:17:33,200 Two researchers named Sean and Kevin. 235 00:17:33,280 --> 00:17:42,920 For the scope, the bug-bunny program covers all the security issues confirmed by our application servers, including source code leak, security workaround, privacy issue. 236 00:17:42,920 --> 00:17:46,040 And Kevin emailed them to confirm the scope to be safe. 237 00:17:46,040 --> 00:17:49,280 It took them two weeks to finally confirm the scope. 238 00:17:49,280 --> 00:17:51,160 He then reported the vulnerability. 239 00:17:51,160 --> 00:18:00,080 However, when he reported, he was provided with $30,000 for the finding, but the agreement in receiving it offered no legal protection for him. 240 00:18:00,080 --> 00:18:02,020 So he decided to walk away. 241 00:18:02,080 --> 00:18:10,740 The revelations resulted in the company challenging his findings and seemingly threatening one with a lawsuit tied to the Computer Fraud Abuse Act, CFA. 242 00:18:10,740 --> 00:18:16,760 Claiming he went out of scope, regardless to the fact that he made sure to confirm that he was within scope. 243 00:18:16,760 --> 00:18:27,280 And in return, because it was getting so bad with basically giving him a lawsuit, he decided to post the entire situation with all the conversations with DJI publicly. 244 00:18:27,400 --> 00:18:40,880 I think one of my favorite things, if you look at the blog post, is that in the chain you'll see that there was a moment where the people at DJI didn't know he was cc'd on... 245 00:18:40,880 --> 00:18:47,900 Well, not cc'd, but there was a chain in the email, and in it, it said, like, this guy is going to cause us a problem. 246 00:18:47,960 --> 00:18:51,840 We need to take initiatives, legal initiatives on it. 247 00:18:51,840 --> 00:19:00,200 And when he got the email from them about something else, he scrolled down and he saw, like, the internal conversations happening around him. 248 00:19:00,200 --> 00:19:10,040 So it's really good to read, and it gives you, once again, one of those moments where you realize, even when you're in the good, you have these situations that occur. 249 00:19:10,580 --> 00:19:12,240 Next slide, please. 250 00:19:16,200 --> 00:19:18,040 This is another case. 251 00:19:18,040 --> 00:19:21,960 So this is a case in September of last year. 252 00:19:22,000 --> 00:19:31,240 Basically, Iowa State asked the cybersecurity firm CoalFire to conduct a penetration test to see if its staff could gain access to sensitive data or equipment. 253 00:19:31,320 --> 00:19:41,220 So two CoalFire employees found a door to the Dallas courthouse open, and when they closed the door to see if it would lock and then attempted to open it, an alarm was set off. 254 00:19:41,220 --> 00:19:47,760 Following the protocol, the employees waited for the police to arrive and show them their paperwork that they were legally hired. 255 00:19:48,400 --> 00:19:51,880 Initially, they were told they were good to go by the police. 256 00:19:51,880 --> 00:19:58,320 However, the sheriff showed up and arrested them, and they ended up having to spend a night in jail. 257 00:19:58,460 --> 00:20:09,300 There were charges for burglary, which is just so upsetting in so many ways, but they were later dropped in the late January 2020. 258 00:20:09,300 --> 00:20:16,760 This is one of those examples of why a good, you know, a good cemetery in law that would protect their industry. 259 00:20:17,660 --> 00:20:27,120 Basically, if their industry appears from any kind of prosecution and that people are still not, you know, reading up on the differences between ethical hacker and attackers. 260 00:20:27,180 --> 00:20:37,380 So it's important to notice is that even, you know, even physical security still has issues too, as well in this situation. 261 00:20:37,380 --> 00:20:39,300 Next slide, please. 262 00:20:43,240 --> 00:20:52,840 Overall community consensus here is that language of what is in scope, out of scope, when disclosing, or how do I disclose can be so scary, and potential indictments especially. 263 00:20:52,840 --> 00:20:55,000 It can keep both parties awake at night. 264 00:20:55,200 --> 00:20:58,340 And I'll tell you it does for me, of course. 265 00:20:58,500 --> 00:21:02,180 I mean, there are program managers asking to be hacked, but not to get hacked badly. 266 00:21:02,320 --> 00:21:07,460 And how to conduct and handle situations where researchers report something is another fear of theirs. 267 00:21:07,460 --> 00:21:12,980 But overall, organizations and government all know that it's probably needed at this time. 268 00:21:13,060 --> 00:21:16,120 And that's why they do work with the hacker community, right? 269 00:21:16,120 --> 00:21:19,280 You have like Hack the Pentagon, Hack the Army. 270 00:21:19,280 --> 00:21:26,720 You even have them hiring like coal fire employees to go and test their sites to see if they're safe. 271 00:21:26,720 --> 00:21:29,820 So overall, people are aware that they need to work with us. 272 00:21:29,820 --> 00:21:41,920 It's just that there's this thing going on behind, which is like these really unchecked beliefs about the hacker community and that hackers are criminals. 273 00:21:41,920 --> 00:21:45,780 And it's very sad because it keeps us from moving forward every day. 274 00:21:46,160 --> 00:21:47,620 Next slide, please. 275 00:21:51,360 --> 00:21:54,080 And I know this is a very scary subject. 276 00:21:54,900 --> 00:21:57,500 But here are some puppies to lift your spirits. 277 00:21:57,500 --> 00:21:59,960 And of course, I place a cat for cat lovers as well. 278 00:21:59,960 --> 00:22:02,080 So take a moment to enjoy it. 279 00:22:02,820 --> 00:22:04,540 Next slide, please. 280 00:22:08,600 --> 00:22:12,580 So the real question is, why do they continue to be scared of us? 281 00:22:12,580 --> 00:22:18,200 Well, even though ethical hackers are not malicious actors, they're still being seen and treated as such. 282 00:22:18,200 --> 00:22:26,480 And because of this, it reduces the chances of reporting a vulnerability and can cause hackers to go more towards the dark side because they're seen as the same. 283 00:22:26,480 --> 00:22:31,820 So if you can see in the imagery to the left is what you see when you type in criminal hackers. 284 00:22:31,940 --> 00:22:35,340 And on the right is what you get when you type in ethical hackers. 285 00:22:35,340 --> 00:22:46,820 Once again, there's like this hoodie, this darkness, sometimes with a ski mask, basically still portraying us as these dark, devious people that are doing malicious things. 286 00:22:47,320 --> 00:22:48,540 Next slide, please. 287 00:22:52,090 --> 00:22:54,810 But I want to let you guys know it's not just the imagery. 288 00:22:54,810 --> 00:22:56,590 It's also language used in the media. 289 00:22:56,590 --> 00:22:59,590 And when I say media, I mean marketing in the press. 290 00:22:59,590 --> 00:23:08,090 Using the term hacker as someone as a criminal when they should be using the term attacker or cyber criminal, malicious actor, and so on. 291 00:23:08,350 --> 00:23:09,750 Next slide, please. 292 00:23:13,610 --> 00:23:17,170 So how does this imagery and language impact us? 293 00:23:17,270 --> 00:23:22,590 It continues to feed the fear and stereotypes and biases that exist through social construction. 294 00:23:22,590 --> 00:23:31,450 And we're going to have to dive into the brain to understand how does social construction believes us and how it works exactly. 295 00:23:31,450 --> 00:23:32,370 Next slide. 296 00:23:35,720 --> 00:23:43,120 So if any of you guys have ever attended any of my previous talks, I usually always bring up the brain because I have an obsession with the brain. 297 00:23:43,220 --> 00:23:45,780 Because that's how we understand the human element. 298 00:23:45,780 --> 00:23:51,580 And the human element plays a huge role when it comes to getting rights, but also within InfoSec itself. 299 00:23:51,580 --> 00:23:57,760 So what I want you guys to understand is there is three parts. 300 00:23:57,760 --> 00:24:02,280 So the first part is around how do we collect fear? 301 00:24:02,700 --> 00:24:19,360 So socially constructed beliefs are beliefs that you were told as a child or as an adult from someone that you look up to or someone with knowledge or on the news or in images or in movies or TV shows. 302 00:24:19,360 --> 00:24:24,060 These things feed into basically creating beliefs. 303 00:24:24,060 --> 00:24:29,560 Now, the thing is that a lot of people know of the amygdala as this fight versus flight mechanism. 304 00:24:29,560 --> 00:24:36,280 But what they don't really understand is that it's more like sorting who is like me and who is not like me. 305 00:24:36,480 --> 00:24:44,980 So when they see something or they're told something that, say, for example, someone with pink hair are dangerous individuals. 306 00:24:45,520 --> 00:24:48,760 They might not say that directly, but indirectly. 307 00:24:48,760 --> 00:24:59,640 So by watching movies, every time you see someone with pink hair, they're seen as the villain, the criminal, or they might use the term, you know, when they see someone with pink hair. 308 00:24:59,940 --> 00:25:02,620 And this is also in the news. 309 00:25:02,620 --> 00:25:05,100 Maybe you had a teacher, a parent or friends. 310 00:25:05,100 --> 00:25:10,340 They like people with pink hair are dangerous and it's best for you to cross the street or whatnot. 311 00:25:10,400 --> 00:25:18,120 So every time you see someone with pink hair, you might clutch your purse a little bit tighter or you might cross the street to avoid the person with pink hair. 312 00:25:18,120 --> 00:25:22,120 Or you might get out of an elevator when you see someone with pink hair get on. 313 00:25:23,780 --> 00:25:25,320 And that's the one thing. 314 00:25:25,320 --> 00:25:31,400 The one thing you should take away from that example right now is that the person literally just only has pink hair. 315 00:25:31,400 --> 00:25:32,440 There's really no difference. 316 00:25:32,440 --> 00:25:39,880 But the thing is, is that you've been indirectly told to believe that people with pink hair are dangerous. 317 00:25:41,500 --> 00:25:48,260 So the thing to know about the amygdala is that it works with the memories within your temporal lobe. 318 00:25:48,260 --> 00:25:53,460 And because your temporal lobe is there, also emotions are connected to your memories. 319 00:25:53,460 --> 00:26:06,280 So whenever there's a fear moment, your amygdala will be lit up and the amygdala will basically be like, OK, we are under a threat right now and we need to do something about this. 320 00:26:06,280 --> 00:26:12,660 And so what happens is the amygdala subconsciously sends next a message to the prefrontal cortex. 321 00:26:12,700 --> 00:26:14,560 Next slide, please. 322 00:26:19,240 --> 00:26:27,260 So once it gets to the prefrontal cortex, it's checking in to see whether or not this thing is actually a threat. 323 00:26:27,260 --> 00:26:34,040 This is the only time that you can actually consciously question any action before taking action. 324 00:26:34,040 --> 00:26:41,820 So, for example, you see someone with pink hair and your amygdala is like, warning, warning, pink hair person behind you. 325 00:26:41,980 --> 00:26:43,100 What should we do? 326 00:26:43,100 --> 00:26:45,120 And sends it to the prefrontal cortex. 327 00:26:45,120 --> 00:26:47,860 The prefrontal cortex is thinking, OK, I can do this action. 328 00:26:47,860 --> 00:26:49,100 I can do that action. 329 00:26:49,100 --> 00:26:50,640 I could go inside the store. 330 00:26:50,640 --> 00:26:52,300 I can cross the street. 331 00:26:52,300 --> 00:26:53,860 I can walk a little bit fast. 332 00:26:53,940 --> 00:27:00,480 I can make sure that I have my phone dialed 911 in case of emergency because this person has pink hair. 333 00:27:00,480 --> 00:27:03,320 I just want to remind you just because this person has pink hair. 334 00:27:03,320 --> 00:27:09,500 This socially constructed beliefs are, you know, are stored in your memory and whatnot. 335 00:27:09,500 --> 00:27:12,240 But the prefrontal cortex acts like the CEO of your brain. 336 00:27:12,240 --> 00:27:15,700 It's basically saying whether or not it is an actual fear. 337 00:27:16,160 --> 00:27:22,300 Now, the thing is, is that, say, for example, you've been told all these things about people with pink hair are dangerous. 338 00:27:22,680 --> 00:27:27,280 And what you do is that you're on YouTube and you come across a video. 339 00:27:27,280 --> 00:27:38,420 And there's in this video, it's someone with pink hair talking about basically how everyone always sees them as a criminal and how they can't get a job because people treat them differently. 340 00:27:38,860 --> 00:27:49,480 And that they don't understand because why are they always picked on as the criminal in movies or in the news when in reality, it's just having pink hair. 341 00:27:49,480 --> 00:27:58,440 And how it's caused them to have a very, very negative impact in their life because of people's perceptions of them. 342 00:27:58,940 --> 00:28:10,120 So when you saw that video on YouTube of the person with pink hair explaining these things, next thing you know is that there's a part of you that's like, huh, I wonder if I've ever done that. 343 00:28:10,120 --> 00:28:12,500 I think I may have done that before. 344 00:28:13,460 --> 00:28:27,140 So the thing to note about is that from hearing people's personal stories and hearing other sides and different perspectives, what you're supposed to be doing is challenging your belief system. 345 00:28:27,140 --> 00:28:32,740 But you have to be okay with being uncomfortable because we don't like to be wrong most of the time as humans. 346 00:28:32,740 --> 00:28:34,960 We see it as a weakness of ourselves. 347 00:28:34,960 --> 00:28:38,560 And we want to constantly come off as being the strong person. 348 00:28:38,560 --> 00:28:50,060 And so the thing is, is that because you saw the video with pink hair, and you're walking down the street, and you see that there's someone with pink hair like crosses the street and now is walking next to you. 349 00:28:50,080 --> 00:28:55,260 A part of you is like, your amygdala is going off, like, warning, warning, pink hair person's right next to you. 350 00:28:55,260 --> 00:28:56,220 You should be freaking out. 351 00:28:56,220 --> 00:28:56,880 What should you do? 352 00:28:56,880 --> 00:28:58,220 You need to take an action. 353 00:28:58,280 --> 00:29:02,920 And your prefrontal cortex is like, okay, I'll just tie my purse a little bit closer. 354 00:29:02,920 --> 00:29:06,300 But in reality, that video pops up in your head. 355 00:29:06,300 --> 00:29:10,080 And you're reminded of this personal story, the person with pink hair. 356 00:29:10,320 --> 00:29:16,100 And you realize at that very moment, you're about to practice some sort of discrimination. 357 00:29:16,700 --> 00:29:23,400 And you freeze in that moment, recognizing that, and decide, I'm not going to clutch my back. 358 00:29:23,400 --> 00:29:25,000 I'm not going to be that person. 359 00:29:25,960 --> 00:29:27,480 Next slide, please. 360 00:29:32,630 --> 00:29:38,530 And that's the thing I want to take away from this, is that personal stories are really important. 361 00:29:38,530 --> 00:29:45,530 Sharing the truth and fact-checking is so critical, more than ever before. 362 00:29:45,530 --> 00:29:55,630 And just note that people can be totally challenged on socially constructed beliefs, because we have to retrain ourselves to be okay with the person with the pink hair. 363 00:29:55,890 --> 00:30:02,550 Now, I want you all to think of, this is how basically our society also sees, you know, hackers in some ways, right? 364 00:30:02,550 --> 00:30:07,650 In movies, they show hackers as the bad people, the evil people. 365 00:30:07,650 --> 00:30:08,650 They're doing malicious things. 366 00:30:08,650 --> 00:30:16,090 The news, they report the term hackers, and they use it, once again, to showcase that the hacker community are bad people. 367 00:30:16,090 --> 00:30:25,330 The thing is, they're not differentiating between a criminal and someone who's ethically doing something to protect people. 368 00:30:25,330 --> 00:30:36,890 And because that they keep showing this imagery of a devious person with a hoodie or with a ski mask, we're still getting set up for our community to be looked at in a bad way. 369 00:30:36,890 --> 00:30:41,590 And that is how it's preventing so many good things from happening for us. 370 00:30:41,970 --> 00:30:46,490 And so it's so important for us to understand how our brain works. 371 00:30:46,490 --> 00:30:53,330 And note that you can always, always question beliefs, and you can always get people to question their beliefs of you. 372 00:30:53,330 --> 00:30:59,850 It's just fact-checking them, sharing personal stories that change people's mindset. 373 00:30:59,850 --> 00:31:02,670 And we need that more than ever before. 374 00:31:03,130 --> 00:31:04,790 Next slide, please. 375 00:31:07,790 --> 00:31:21,530 Because what's happened is, due to this situation, the mindset set by society, by people in the media, it's keeping us unsafe and preventing us from doing what we do well and trying to protect people. 376 00:31:21,530 --> 00:31:34,730 Making sure that the customers are protected, the personal identifiable information is somewhere that's stored in a safe, secure place where it doesn't come out, especially hospital records. 377 00:31:34,790 --> 00:31:42,690 These are all scary things to ever come out in public, and that's what we're trying to do our best in, is to show that there are criminals. 378 00:31:42,750 --> 00:31:43,990 But we're not criminals. 379 00:31:43,990 --> 00:31:48,370 We're there to save and help and prevent situations from occurring. 380 00:31:49,030 --> 00:31:57,610 But the issue is, is because of the mindset, the public perception of who we really are, and if you're like, wait, Chloe, how do I know if that's the case? 381 00:31:57,610 --> 00:31:59,890 I mean, okay, you guys, let's be real. 382 00:32:00,030 --> 00:32:02,830 When you tell someone you're a hacker, what do they do? 383 00:32:02,950 --> 00:32:04,370 They usually take a step back, right? 384 00:32:04,370 --> 00:32:06,990 Their mouth drops, their eyes get a little bit bigger. 385 00:32:07,230 --> 00:32:08,450 Yeah, exactly. 386 00:32:08,570 --> 00:32:12,650 Because it still is there, this belief of us. 387 00:32:12,650 --> 00:32:19,330 But the thing is, is that this is one of the reasons why a lot of companies don't have vulnerability disclosure programs. 388 00:32:20,050 --> 00:32:25,770 We still have 94% of Forms Global 2000 still don't have a VDP. 389 00:32:26,250 --> 00:32:37,230 And that's really scary, because companies are still afraid of hackers, and they don't want to create vulnerability disclosure policies because of the lack of bilateral trust amongst hackers and organizations and government. 390 00:32:37,230 --> 00:32:40,910 It's one of the reasons why 60% do not report vulnerability. 391 00:32:41,550 --> 00:32:46,310 And hackers are scared of outdated laws such as CFA and DMCA. 392 00:32:46,430 --> 00:32:57,830 Also, from interviewing attackers, one of the reasons they decide to move away from hacking ethically is the pay and the constant word of being prosecuted, regardless if they did something legal. 393 00:32:57,830 --> 00:33:02,410 And this is also said similarly by those who switch from being an attacker to a hacker. 394 00:33:02,410 --> 00:33:13,130 The reason they switched was the insomnia of being arrested, because there are so many cases when an organization prosecutes an ethical hacker, regardless if they were in scope that we saw earlier today. 395 00:33:13,870 --> 00:33:15,130 Next slide, please. 396 00:33:19,310 --> 00:33:25,110 Which leads us to needing to dive into the current legislation that can be found in most countries towards hackers. 397 00:33:25,310 --> 00:33:31,910 We have anti-hacking laws, anti-circumvention laws, these are known as the copyright type of laws, and acceptable use policy. 398 00:33:33,050 --> 00:33:35,310 Let's first dive into anti-hacking laws. 399 00:33:35,310 --> 00:33:39,470 Overall, they're usually used when a researcher goes out of scope. 400 00:33:39,470 --> 00:33:41,910 It's usually the act used to prosecute hacking. 401 00:33:42,110 --> 00:33:46,330 But to give you a little bit of background on CFA, the Computer Fraud Abuse Act is a U.S. 402 00:33:46,330 --> 00:33:55,070 cybersecurity bill that was enacted in 1984 as an amendment to existing computer fraud law, which has been included in the Comprehensive Crime Control Act of 1984. 403 00:33:55,290 --> 00:34:00,610 The law prohibits accessing a computer without authorization or in excess of authorization. 404 00:34:01,490 --> 00:34:06,010 Random fact here is, who has heard the movie War Games? 405 00:34:06,910 --> 00:34:13,730 Now, did you know that Ronald Reagan, he watched the movie, and he freaked out completely about hackers. 406 00:34:13,730 --> 00:34:16,010 He was like, oh my god, we have to do something. 407 00:34:16,010 --> 00:34:19,670 And that's how CFA happened, was because he watched War Games. 408 00:34:19,670 --> 00:34:21,910 Which is sad, because I love that movie, you guys. 409 00:34:21,910 --> 00:34:24,030 It was an awesome movie, but still. 410 00:34:25,350 --> 00:34:28,670 Let's dive into anti-circumvention laws, the copyright type of laws. 411 00:34:28,670 --> 00:34:32,370 If you're in Canada, it's actually called just the Copyright Act. 412 00:34:32,790 --> 00:34:36,370 But in the U.S., we call it the Digital Millennium Copyright Act, DMCA. 413 00:34:36,910 --> 00:34:39,830 It was formed in 1998, the U.S. 414 00:34:39,830 --> 00:34:51,130 copyright law that implements two 1996 treaties, the World Intellectual Property Organization, WIPO, basically seen as the right to repair, reverse engineering as a breach of property to companies. 415 00:34:52,210 --> 00:34:54,610 Now, let's go into acceptable use policy. 416 00:34:54,610 --> 00:35:02,670 Quick question, who here in the room has ever read their terms and conditions for, say, for example, an Apple product? 417 00:35:03,170 --> 00:35:04,370 Yeah, okay, so I tried. 418 00:35:04,370 --> 00:35:09,310 I got really bored, and I decided to watch a movie instead. 419 00:35:09,310 --> 00:35:11,670 But in general, they can be long and too much verbiage. 420 00:35:11,670 --> 00:35:15,190 It can confuse anyone, especially if English is not their first language. 421 00:35:15,190 --> 00:35:21,050 This can lead to some serious miscommunication issues for ethical hackers that don't really speak English as their first language. 422 00:35:22,110 --> 00:35:25,670 Clearly, these laws are out of date. 423 00:35:25,670 --> 00:35:27,730 And honestly, they were created out of fear. 424 00:35:27,730 --> 00:35:31,630 And remember, we learned everything about fear and how it works in the brain, right? 425 00:35:31,930 --> 00:35:35,770 There was no empathy by taking the time to understand what is truly needed. 426 00:35:35,770 --> 00:35:37,050 It was rushed. 427 00:35:37,130 --> 00:35:43,190 It wasn't... not all the people that that would affect were represented in that room. 428 00:35:43,190 --> 00:35:54,810 And that's the issue we have today in so many things, is that without decent representation, having an equal voice, how are any laws supposed to help people? 429 00:35:54,810 --> 00:35:57,530 You have to have all the players in the room. 430 00:35:57,770 --> 00:36:06,430 And this is why these laws are prosecuting not just malicious actors, but also the really good people out there, the ethical hackers. 431 00:36:07,390 --> 00:36:09,130 Next slide, please. 432 00:36:12,790 --> 00:36:18,730 Overall takeaway is that laws prevent good hacking in the same way they prevent attackers. 433 00:36:18,730 --> 00:36:20,850 And we need good hacking. 434 00:36:21,090 --> 00:36:21,890 Next slide. 435 00:36:27,650 --> 00:36:30,710 So, I really do hate the CFA. 436 00:36:30,710 --> 00:36:34,170 And I'm going to tell you the reasons why you should too. 437 00:36:34,790 --> 00:36:44,630 So, the Computer Fraud Abuse Act, once again, which was passed in 1984, and I keep reinstating this year for you to remember and recognize that this is so out of date. 438 00:36:44,630 --> 00:36:45,990 We're in 2020. 439 00:36:45,990 --> 00:36:48,410 But just remember that. 440 00:36:48,550 --> 00:37:01,310 Has grown wildly outdated in that it offers prosecutors discretion to throw in huge potential fines and jail sentences for relatively undeserving violations of computer policy. 441 00:37:01,310 --> 00:37:07,370 First, the CFA, as written, punishes exceeding authorized access to a protected computer. 442 00:37:07,370 --> 00:37:13,240 It's a phrase that's so vague to inspire any type of some broad interpretations. 443 00:37:13,240 --> 00:37:19,440 Another flaw in the CFA is the redundant provisions that enable a person to be punished multiple times for the same crime. 444 00:37:19,480 --> 00:37:28,020 These charges can be stacked on one on top of another, resulting in a threat of a higher cumulative fines and jail time for the exact same violation. 445 00:37:28,380 --> 00:37:37,120 This allows prosecutors to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a single solitary act. 446 00:37:37,120 --> 00:37:40,100 It also plays a significant role in sentencing. 447 00:37:40,140 --> 00:37:51,060 The ambiguity of a provision meant to toughen sentencing for repeat offenders of the CFA may, in fact, make it possible for defendants to be sentenced based on what should have been our prior convictions. 448 00:37:51,060 --> 00:37:56,320 But we're nothing more than multiple convictions for the same exact crime. 449 00:37:58,040 --> 00:38:05,320 This is one of those things that it's just so overwhelming how this still exists and it hasn't changed. 450 00:38:05,320 --> 00:38:15,700 But I want you guys to know we're going to dive into Aaron Swartz's case because we need to for this to understand how this could be used to hurt someone so much. 451 00:38:15,840 --> 00:38:22,040 But I want you guys to also note is that the CFA also gives companies the right to sue. 452 00:38:22,340 --> 00:38:31,120 And I want to let you guys know that I think hackers have more to fear from companies and states right now than the actual Justice Department at this time. 453 00:38:31,120 --> 00:38:34,080 Things have changed a lot since 2014. 454 00:38:34,080 --> 00:38:41,760 Since 2014, the DOJ has been working to try to prevent these situations from occurring on the federal side. 455 00:38:41,760 --> 00:38:45,140 But just please note that companies and states can definitely do these kind of things. 456 00:38:45,140 --> 00:38:48,800 So you want to be a little bit more careful when it comes to companies and states. 457 00:38:48,800 --> 00:38:54,820 Those are kind of the ones that threaten you more than, you know, having to worry about federal. 458 00:38:55,080 --> 00:38:56,320 Next slide, please. 459 00:38:59,400 --> 00:39:09,640 If you guys are not familiar with Aaron Swartz's case, it's something that is definitely a case study to consider when revisiting the CFA. 460 00:39:09,740 --> 00:39:12,660 So in 2011, Carmen Ortez, the U.S. 461 00:39:12,760 --> 00:39:19,700 Attorney's Office, charged Swartz with hacking into MIT's computer network to download millions of scholarly articles from JSTOR. 462 00:39:20,000 --> 00:39:26,740 It was an act of civil disobedience meant to protest the restrictive access to research funded by taxpayers. 463 00:39:26,740 --> 00:39:27,680 For this, the U.S. 464 00:39:27,680 --> 00:39:33,960 Attorney brought charges that carried a maximum penalty of 35 years in prison and $1 million in fines. 465 00:39:34,300 --> 00:39:42,100 I want to pause right there because the thing to note about was that 35 years in prison was the maximum penalty that he can get. 466 00:39:42,180 --> 00:39:46,980 I want you to understand a first degree murder charge is 25 years. 467 00:39:47,880 --> 00:39:49,720 It just doesn't seem right. 468 00:39:49,720 --> 00:39:50,280 I don't know. 469 00:39:50,280 --> 00:39:53,500 Just logically in my mind, that just doesn't sound right. 470 00:39:53,500 --> 00:40:02,560 Anyway, going back to this, they were able to charge such years because of the way that CFA is written and the issues that have yet to be sorted since it was made into a law. 471 00:40:02,560 --> 00:40:04,660 Remember that stack on stack thing? 472 00:40:04,960 --> 00:40:05,820 Right. 473 00:40:06,160 --> 00:40:16,160 Overall, looking at Aaron's situation, the sad thing was that he was dealing with a 17 month legal battle, one that had no set trial date and wasn't ending anytime soon. 474 00:40:16,160 --> 00:40:19,520 And through Swartz's perspective, it must have been so overwhelming. 475 00:40:19,520 --> 00:40:26,780 With the future of the legal battle cast into doubt, Swartz hung himself in his apartment on January 11, 2013. 476 00:40:27,060 --> 00:40:30,580 And following his death, federal prosecutors went on to drop the charges. 477 00:40:30,960 --> 00:40:36,500 His family said it was the government's prosecution that contributed to his decision to take his own life. 478 00:40:37,660 --> 00:40:39,140 Next slide, please. 479 00:40:42,080 --> 00:40:51,860 It was because of the situation that happened to Aaron that legislators came together thinking we need to do something about this. 480 00:40:51,960 --> 00:40:56,660 Unfortunately, Aaron's law did not pass, but it was a good start. 481 00:40:56,660 --> 00:41:18,680 Aaron's law basically was trying to remove the phrase exceeds authorized access and replace it with access without authorization, which is defined as to obtain information on a computer that the accessor lacks authorization to obtain by knowingly circumventing technological or fiscal measures designed to prevent unauthorized individuals from obtaining that information. 482 00:41:18,680 --> 00:41:30,440 In other words, it basically would also ensure people won't face criminal liability for violating terms of service agreements and contracted agreements, but also it limits the penalties. 483 00:41:30,440 --> 00:41:34,320 In other words, there was no more duplicated charges that he was facing. 484 00:41:34,800 --> 00:41:36,620 Next slide, please. 485 00:41:41,490 --> 00:41:44,130 Let's dive a little bit into the DMCA. 486 00:41:44,130 --> 00:41:47,290 So the DMCA was passed in 1998. 487 00:41:47,290 --> 00:41:50,370 And remember, reminding you this year is 2020. 488 00:41:50,370 --> 00:41:52,270 That was in 1998. 489 00:41:52,290 --> 00:41:53,550 Hasn't been any changes. 490 00:41:53,550 --> 00:41:54,690 So let's keep going. 491 00:41:54,690 --> 00:42:07,030 As an anti-privacy statute, effectively making it illegal to circumvent copy protections designed to prevent pirates from duplicating digital copyrighted works and selling or freely distributing them. 492 00:42:07,030 --> 00:42:13,150 It also makes it illegal to manufacture or distribute tools or techniques for circumventing copy controls. 493 00:42:13,150 --> 00:42:24,630 But in reality, the controversial law and facts have been much broader by allowing game developers, music and film companies, and others to keep a tight control on how consumers use their copyrighted works. 494 00:42:24,630 --> 00:42:34,990 Preventing them, in some cases, from making copies of their purchased products for their own use or from jailbreaking smartphones and other devices to use them in ways the manufacturer disliked. 495 00:42:34,990 --> 00:42:45,150 The thing you should note about this is that it just, overall, it just seems like it's so out of date once again. 496 00:42:45,150 --> 00:42:51,950 And it's so frustrating to see that there hasn't really been anything else on this overall. 497 00:42:51,950 --> 00:43:06,250 But when it does, it also prevents finding any research on it or finding if there are issues already within the product because apparently you might be actually dealing with that type of case. 498 00:43:06,710 --> 00:43:15,390 It protects more of the big companies and reduces consumer protection, which is what ethical hackers are all about, is protecting the consumer. 499 00:43:15,710 --> 00:43:20,650 It also puts a hold on free expression and it does interfere with computer intrusion laws. 500 00:43:20,650 --> 00:43:25,830 I do recommend reading the public comments, especially groups one through three. 501 00:43:25,930 --> 00:43:28,110 There is a link right there. 502 00:43:29,150 --> 00:43:30,610 Next slide, please. 503 00:43:34,330 --> 00:43:39,470 In general, with the improvements to legislation, we can change where we stand today. 504 00:43:39,470 --> 00:43:48,110 But in order to do that, we have to dive into three categories in which we have touched on because they work together to bring about a public change. 505 00:43:48,170 --> 00:43:49,610 Next slide, please. 506 00:43:54,060 --> 00:43:58,240 Overall, in order to have rights for hackers, we need to get the public on board. 507 00:43:58,240 --> 00:44:01,380 In order to do so, we need to dive into these three categories. 508 00:44:01,700 --> 00:44:05,400 We need the media to push for the public to become more aware. 509 00:44:05,500 --> 00:44:13,420 In other words, we need to change the language and imagery of a hacker and start using the term cyber criminals for those who commit unethical hacking. 510 00:44:13,460 --> 00:44:19,320 Overall, really separate these two groups because they are definitely separated on this. 511 00:44:19,320 --> 00:44:26,560 In order to help the press, organizations need to be on board with a bilateral trust with having moderate disclosure programs. 512 00:44:26,860 --> 00:44:36,780 By initiating a VDP program or putting contact information and following up with the researchers that do report, it's showing that you support the hackers and the community. 513 00:44:36,880 --> 00:44:44,560 And this is what is needed also because when the public starts seeing that, then the public slowly changes their view in general. 514 00:44:44,560 --> 00:44:47,720 And then we can actually build trust now. 515 00:44:47,720 --> 00:44:57,560 And lastly, to have organizations and public opinion to push and motivate Capitol Hill to get on board and update the current legislation that will protect ethical hackers. 516 00:44:57,640 --> 00:45:01,540 Overall, we need all three to be supporting hacker rights for it to become a reality. 517 00:45:01,660 --> 00:45:02,960 Next slide, please. 518 00:45:05,890 --> 00:45:11,590 So now you're probably wondering, so how do we get there exactly? 519 00:45:12,170 --> 00:45:13,710 Next slide, please. 520 00:45:17,450 --> 00:45:22,830 Overall, we need these five needs to push for awareness of ethical hackers. 521 00:45:22,830 --> 00:45:24,410 These are the five needs to get there. 522 00:45:24,410 --> 00:45:27,970 Now, how we get there, I need you to be honest. 523 00:45:27,970 --> 00:45:30,010 I can't be doing this all by myself. 524 00:45:30,010 --> 00:45:31,990 We need to work together more than ever. 525 00:45:31,990 --> 00:45:34,330 And we actually have a shot at it now. 526 00:45:35,490 --> 00:45:38,650 And I'm going to dive into each one of these needs next. 527 00:45:38,770 --> 00:45:40,090 Next slide, please. 528 00:45:44,130 --> 00:45:45,870 So the first step. 529 00:45:45,870 --> 00:45:49,590 This is a petition that I wrote at the end of RSA. 530 00:45:49,590 --> 00:45:55,250 I gave a talk about basically how we need to get rights for hackers. 531 00:45:55,250 --> 00:46:05,390 And this petition was created in a way so then we can get the public to be aware and get the public to sign it and really help us try to bring about a change. 532 00:46:05,470 --> 00:46:10,370 And the best thing that you can do at this very moment is to sign and share this petition. 533 00:46:10,370 --> 00:46:14,590 It is broken down by orgs, legislators, the media, the hacker community. 534 00:46:14,870 --> 00:46:21,210 And anyone who can sign it can basically... anyone who agrees with it can sign it, in other words. 535 00:46:21,210 --> 00:46:24,310 And it's really important that we do this because this is the first step. 536 00:46:24,310 --> 00:46:27,370 How you get attention from the public is a petition. 537 00:46:27,550 --> 00:46:34,290 These petitions can be used next to go to politicians and show them that this is what's needed. 538 00:46:34,290 --> 00:46:41,390 It can also be adopted by other companies saying that they support this type of work as well. 539 00:46:41,390 --> 00:46:49,290 And we get basically the press involved too by noticing that all these different players are wanting for something to change. 540 00:46:49,870 --> 00:46:51,290 Next step, please. 541 00:46:51,290 --> 00:46:53,690 And by next step, I mean next slide. 542 00:46:54,930 --> 00:47:01,510 So there is this collaboration that's happening right now with Brian and myself. 543 00:47:01,510 --> 00:47:06,910 I hope you guys probably saw this video trending on Twitter this week. 544 00:47:06,910 --> 00:47:15,010 Basically showcasing what people generally think what a hacker looks like and what they do versus what it looks like actually in real life. 545 00:47:15,010 --> 00:47:17,590 It's actually hilarious and I hope you guys catch it. 546 00:47:17,590 --> 00:47:21,450 If not, it is on my page and I recommend it. 547 00:47:21,450 --> 00:47:30,250 But also check out the Hacking is Not a Crime itself, the Twitter handle, because you will also find those things. 548 00:47:30,250 --> 00:47:42,870 But in general, what Hacking is Not a Crime, what it's about is to try to push out public awareness and for them to have a better understanding of what we mean by that. 549 00:47:42,870 --> 00:47:44,450 Hacking is not a crime, okay? 550 00:47:44,450 --> 00:47:46,690 Let's just remind ourselves this. 551 00:47:46,790 --> 00:47:52,830 One of the other things you could do is to share this with friends and family to share your personal stories. 552 00:47:52,830 --> 00:48:02,670 But overall, the general mission for Hacking is Not a Crime is to bring awareness for the community and for the community to feel like that they are being listened to as well. 553 00:48:02,670 --> 00:48:07,590 And we have to work together as a community whole to get the public to be involved. 554 00:48:08,770 --> 00:48:12,690 And yeah, there's so many more things I could talk to you about this thing. 555 00:48:13,170 --> 00:48:16,270 It's actually the handle is Hack Not Crime. 556 00:48:16,270 --> 00:48:19,450 Thank you, Brian, for reminding me of this. 557 00:48:19,450 --> 00:48:21,790 Next slide, please. 558 00:48:25,870 --> 00:48:32,810 All right, the next step is we need to remind people the difference between a hacker versus a criminal and attacker. 559 00:48:32,890 --> 00:48:36,810 I usually tend to use this phrase, which is a locksmith. 560 00:48:36,810 --> 00:48:38,730 Say a locksmith is a hacker. 561 00:48:38,730 --> 00:48:42,890 A burglar is the criminal attackers that are kind of a malicious actor. 562 00:48:43,130 --> 00:48:46,570 This is actually the easiest way for people to understand the differences. 563 00:48:46,570 --> 00:48:47,850 So I do recommend it. 564 00:48:47,850 --> 00:48:50,190 So remember, locksmith equals hacker. 565 00:48:50,190 --> 00:48:52,570 Burglar equals criminal attacker. 566 00:48:52,570 --> 00:48:53,950 So criminal malicious actor. 567 00:48:53,950 --> 00:48:56,430 Anyway, it's really good thing to take away from it. 568 00:48:56,470 --> 00:48:59,610 Now, the thing to note about what do you mean by tell the press? 569 00:48:59,790 --> 00:49:06,710 So whenever I'm talking to the press about a breach or anything like that, and when they're saying, so what did this hacker do exactly? 570 00:49:06,710 --> 00:49:08,150 I'm like, I correct them. 571 00:49:08,150 --> 00:49:10,590 I say, you mean attacker. 572 00:49:11,090 --> 00:49:12,850 And there's a reason for that. 573 00:49:12,850 --> 00:49:22,670 We have to start correcting the press when we talk to them on when it comes to how they're labeling the people that are in the store that are doing negative things. 574 00:49:22,670 --> 00:49:26,250 The other thing you can do is simply shame them online. 575 00:49:26,250 --> 00:49:37,010 I know that sounds really bad to do, but on LinkedIn, on Twitter, basically publicly shaming them, reminding them once again, this is not a hacker that caused a breach. 576 00:49:37,010 --> 00:49:42,090 It was an attacker, or you could use the term cyber criminal if you want, or malicious actor. 577 00:49:42,750 --> 00:49:44,630 You get to pick which one you want to use. 578 00:49:44,630 --> 00:49:47,210 But the thing is, we have to let them know they got it wrong. 579 00:49:47,490 --> 00:49:55,730 Also, when it comes to images, if they show us another image of someone wearing a hood underneath, I don't know, in the basement or something. 580 00:49:55,730 --> 00:50:00,670 I think we need to start telling them, no, that's not, no, no. 581 00:50:00,670 --> 00:50:04,270 Actually, we could be in a cafe scene right next to you doing what we do. 582 00:50:04,270 --> 00:50:10,550 Anyway, it's just the thing is we have to showcase that they are wrong here at this point in time. 583 00:50:10,750 --> 00:50:17,070 So those are going to be the best thing is to fact check them, basically, and remind them they have it wrong until they learn. 584 00:50:17,210 --> 00:50:21,410 So I do recommend that, and that needs all of us in the community to do that. 585 00:50:21,830 --> 00:50:25,350 I think the person who started really doing that was Chris Roberts. 586 00:50:25,350 --> 00:50:27,890 He started being like, you got it wrong. 587 00:50:27,890 --> 00:50:30,730 That's a cyber criminal, not a hacker. 588 00:50:30,730 --> 00:50:32,150 This is a hacker. 589 00:50:32,670 --> 00:50:35,830 Also, Casey Ellis does that, too, as well. 590 00:50:36,370 --> 00:50:38,030 I try my best to do it, as well. 591 00:50:38,030 --> 00:50:43,290 So if you do have any of those cases, please let them know, share them online if you need to. 592 00:50:43,850 --> 00:50:45,050 Next step. 593 00:50:46,290 --> 00:50:47,950 Next slide, that is. 594 00:50:48,750 --> 00:50:53,870 All right, so the third step, what we need to do is push for organizations to partner and campaign with us. 595 00:50:53,870 --> 00:50:55,410 So remember that petition? 596 00:50:55,490 --> 00:51:06,330 Basically, we need organizations to get involved more by pushing out, saying, like, this is the reason why they have a VDP program, or this is why we trust the hacker community. 597 00:51:06,370 --> 00:51:12,890 This is why we need to do these things, because they need the hacker community to stay safe. 598 00:51:13,230 --> 00:51:16,290 Also, to push for organizations to have a disclosure program. 599 00:51:16,290 --> 00:51:24,830 So if a company doesn't have one, and you're working out one that doesn't have one, it's time to basically let them know they need to change that. 600 00:51:24,830 --> 00:51:31,570 Because having voluntary disclosure programs actually forces those more companies to do it themselves. 601 00:51:31,570 --> 00:51:41,870 So we want that Forbes list of companies to all have a program, because that means that we are definitely moving forward a lot faster. 602 00:51:42,550 --> 00:51:44,510 Next slide, please. 603 00:51:46,930 --> 00:51:48,830 The fourth step. 604 00:51:48,830 --> 00:51:54,270 Now, you need to contact your local representatives to update current legislation. 605 00:51:54,270 --> 00:51:56,490 You need to talk to local ones. 606 00:51:56,490 --> 00:52:00,050 That means, you know, your city, your county, your state. 607 00:52:00,490 --> 00:52:09,150 And the reason for that, once again, the actors that you need to be more concerned about these days are states and companies themselves prosecuting hackers. 608 00:52:09,350 --> 00:52:14,790 So it's really important to let them know that things are out of date, and it's time for you to do something about it. 609 00:52:14,790 --> 00:52:16,170 And let me tell you why. 610 00:52:16,170 --> 00:52:23,530 But the point, how you learn how to tell them why they need to change it, is find out what are the things that they're passionate about. 611 00:52:23,530 --> 00:52:28,870 What are the basically the things that they want to fix in their own community? 612 00:52:28,950 --> 00:52:40,630 If they're passionate about, say, for example, social media, tell them why it's important to work with hacker community when it comes to social media. 613 00:52:40,630 --> 00:52:49,130 Tell them why it's important to do so, because with the CFA, you might face the following other situations. 614 00:52:49,130 --> 00:52:58,050 Basically, you want to find whatever they're interested in, get them connected, because you're doing a bilateral kind of conversation, right? 615 00:52:58,050 --> 00:53:04,870 Find out what their passions, their weaknesses are, and then utilize that to help your cause too. 616 00:53:04,870 --> 00:53:08,790 So you both are ending the conversation with both feeling like you're winning. 617 00:53:08,790 --> 00:53:11,530 And that's the way how you do things. 618 00:53:11,530 --> 00:53:15,770 If you want to practice diplomacy, that is the way you should do diplomacy. 619 00:53:15,770 --> 00:53:18,670 So that's the most important thing. 620 00:53:19,350 --> 00:53:22,450 And yes, you need to know who your local representatives are. 621 00:53:22,450 --> 00:53:25,850 If you don't know who they are, this is the time to do so. 622 00:53:26,710 --> 00:53:30,130 Also, follow the Van Buren and United States case. 623 00:53:30,130 --> 00:53:32,830 That is actually very important to do. 624 00:53:33,470 --> 00:53:34,430 Next slide. 625 00:53:34,430 --> 00:53:38,790 And I'll tell you, if you haven't heard about this case, why it's important. 626 00:53:38,790 --> 00:53:47,510 So basically, a former Georgia police officer was wrongly convicted under this notoriously vague, you know, CFA. 627 00:53:47,510 --> 00:53:49,750 So Computer Fraud Abuse Act is back, right? 628 00:53:49,770 --> 00:53:59,030 And basically what happened is, is that the person has gone to the Supreme Court to re-look over the CFA. 629 00:53:59,310 --> 00:54:07,750 Because what was happening was that Nathan Van Buren was accused of taking money in exchange for looking up a license plate in a law enforcement database. 630 00:54:07,750 --> 00:54:17,410 He was convicted of violating the CFA because he allegedly used that database for an improper purpose, even though it was a database that he was allowed to access for work purpose. 631 00:54:17,410 --> 00:54:27,450 Under this expansive interpretation of the CFA, it would be considered a federal crime any time a person violates a website's term of services. 632 00:54:27,450 --> 00:54:36,390 If violating terms of services is a crime, private companies get to decide who goes to prison and for what, and putting us all at risk for everyday online behavior. 633 00:54:36,390 --> 00:54:45,550 And so this case is actually going in the fall to the Supreme Court, and the CFA is going to be talking about this. 634 00:54:46,390 --> 00:54:47,330 All right. 635 00:54:47,570 --> 00:54:48,770 Next one. 636 00:54:49,250 --> 00:54:50,530 Next slide, that is. 637 00:54:52,330 --> 00:54:53,550 The fifth step. 638 00:54:53,550 --> 00:54:57,150 These are some great organizations that can use your support. 639 00:54:57,150 --> 00:55:03,670 If that means volunteering, if that means donating, if that means anything, just contact them and find out how you can help them out. 640 00:55:03,670 --> 00:55:06,090 It's super, super important. 641 00:55:06,470 --> 00:55:07,190 All right. 642 00:55:07,190 --> 00:55:09,370 So, I Am The Calvary is a great one. 643 00:55:09,370 --> 00:55:16,070 It has been having conversations with representatives since, I think, 2013, 2014. 644 00:55:16,570 --> 00:55:20,950 So, they've been pushing for things to change. 645 00:55:21,050 --> 00:55:33,070 Disclose.io, once again, is a great site to know what are the companies that are trying to practice some sort of bilateral trust agreement between the hacker community and the organization itself. 646 00:55:33,070 --> 00:55:39,370 Basically, if you're a part of Disclose.io, you have to state contact information. 647 00:55:39,370 --> 00:55:57,470 If you want to have a hacker basically disclose any information, their email addresses, what kind of rewards to expect, if there is any rewards, the policy link to their page that has to be following the Disclose.io RIN drafted policies to use. 648 00:55:59,270 --> 00:56:05,550 And then I think there's one more thing I'm forgetting about Disclose.io, but overall, do check it out. 649 00:56:05,550 --> 00:56:06,330 It is great. 650 00:56:06,330 --> 00:56:11,790 If your company is not listed on there, but they do practice these kind of things, I do recommend adding them to it. 651 00:56:11,790 --> 00:56:20,750 It is basically everyone in the community has participated by throwing it, whatever organization that they know is practicing these things and what to expect. 652 00:56:20,750 --> 00:56:23,870 And yes, it does talk about Safe Harbor. 653 00:56:24,730 --> 00:56:28,450 So just to let you know about that ahead of time. 654 00:56:29,270 --> 00:56:32,630 The other one to consider is CERT Coordination Center. 655 00:56:32,630 --> 00:56:34,670 So CERT CC is a great one. 656 00:56:34,670 --> 00:56:41,410 EFF, of course, and the CTI League, which is doing some phenomenal work right now during COVID-19. 657 00:56:41,410 --> 00:56:44,390 I highly recommend helping them out if you can. 658 00:56:44,390 --> 00:56:45,570 All right. 659 00:56:45,770 --> 00:56:47,370 Next slide, please. 660 00:56:52,250 --> 00:56:59,850 So overall, we need all these things to happen to have any type of awareness for ethical hackers. 661 00:57:00,410 --> 00:57:01,970 And how are we going to get there? 662 00:57:01,970 --> 00:57:05,450 It really is going to need your advice and your assistance, too. 663 00:57:06,010 --> 00:57:10,270 But what I have to tell you guys is, like, just don't give up yet. 664 00:57:10,450 --> 00:57:11,470 Just don't. 665 00:57:11,470 --> 00:57:12,550 It's going to get better. 666 00:57:12,550 --> 00:57:13,950 I promise you it will. 667 00:57:13,950 --> 00:57:16,730 This is the time where it's going to get better. 668 00:57:16,730 --> 00:57:22,750 Maybe not this year, but next year, I guarantee you it's going to be a lot of talk around it. 669 00:57:22,890 --> 00:57:24,210 Next slide, please. 670 00:57:27,470 --> 00:57:34,510 But most importantly, I just have one main takeaway from this entire conversation with you guys. 671 00:57:34,630 --> 00:57:36,430 Next slide, please. 672 00:57:39,930 --> 00:57:44,210 I want to remind you that the change starts with you and me. 673 00:57:44,210 --> 00:57:45,990 We must not give up. 674 00:57:45,990 --> 00:57:48,250 We must continue to fight for rights. 675 00:57:48,650 --> 00:57:54,050 And it's so important that we do that, because it's just not Aaron Swartz's life that we need to do this for. 676 00:57:54,050 --> 00:57:56,930 But there's so many other ones out there, too. 677 00:57:57,150 --> 00:58:05,910 It's about time that we do whatever we can as a community, as a whole, as a collective, to come together and to do these things. 678 00:58:05,910 --> 00:58:10,110 Because there are people working behind scenes, once again, for all these things. 679 00:58:10,110 --> 00:58:19,650 But when you have a crowd of hundreds and hundreds of people pushing for something to change, then things change. 680 00:58:19,670 --> 00:58:22,690 With numbers, things change. 681 00:58:22,690 --> 00:58:25,510 With pressure from numbers, things change. 682 00:58:25,510 --> 00:58:29,750 But we cannot get there unless we get all of us in this together. 683 00:58:29,750 --> 00:58:36,130 It doesn't mean the entire community, but we need at least a couple hundred of us to at least try to start changing things. 684 00:58:36,130 --> 00:58:44,730 And all those takeaways and things and steps to do that you can do at this moment, you have more of the ability of doing so. 685 00:58:44,730 --> 00:58:46,970 There should be nothing stopping you on this. 686 00:58:46,970 --> 00:59:03,270 So if you are bothered by these outdated laws, and you're tired of how the public has perceived you, and you feel like you are silenced at any sort of way because of the thing that you're passionate about, then you need to act, too. 687 00:59:03,410 --> 00:59:04,850 You need to take the actions. 688 00:59:04,850 --> 00:59:08,510 And if you feel uncomfortable or awkward about that, reach out to me. 689 00:59:08,510 --> 00:59:10,210 I am here for you. 690 00:59:11,210 --> 00:59:12,850 Next slide, please. 691 00:59:16,350 --> 00:59:17,510 All right, everyone. 692 00:59:17,510 --> 00:59:19,210 That is all my talk. 693 00:59:19,210 --> 00:59:23,350 So I'm looking forward to doing the Q&A, and I'll put my camera on for that. 694 00:59:23,350 --> 00:59:31,210 But I just want to say thank you guys so much for existing, for being who you are, and being part of this community. 695 00:59:31,250 --> 00:59:33,090 I really do appreciate it. 696 00:59:33,090 --> 00:59:36,610 Thank you to Ethics Village for having me do this talk. 697 00:59:36,610 --> 00:59:50,950 I want to give a special shout-out to Bo Woods and Harley Gager for providing further insight into the current situation so I was able to have a better understanding of what are things that I could be missing in the presentation. 698 00:59:52,130 --> 00:59:56,630 All right, I'll put my camera on, and I'm ready to take any questions that you guys may have. 699 00:59:58,350 --> 01:00:03,230 So everybody, thanks to Chloe, again, for that really amazing talk. 700 01:00:03,230 --> 01:00:06,330 That's something that I think is incredibly important. 701 01:00:06,330 --> 01:00:21,750 Moving forward, while back in the day, hacking and everything was very niche in the early days of computerism, I think more so nowadays, especially with all the breaches and things that are happening, it's something that we really need to take seriously.