start	end	text
5150	10090	Sorry, I had to have some theme music for folks while we waited for our next talk.
16340	20740	Chloe, could you broadcast your slides really quick?
20740	24760	What I'll do is I will introduce you as you put them up there,
24760	29800	and then we will have our staff kind of give you the go-ahead,
29800	32580	and as soon as they do, I'll introduce you so they can make sure
32580	35080	they have the stream lined up with things as they go.
37860	39160	Can you hear me okay?
40220	42020	Definitely. We can hear you pretty well.
42020	45800	Okay. I was like, we had the push-to-talk feature for some of the talks.
45800	49020	I was like, okay, I need to turn it off. I'm assuming at this point.
49880	53480	Oh, yeah. This is going to be mostly you, so yeah.
54760	59040	All right. And then let me put – you guys can see my screen already.
59040	63040	Let me just put my video on for the very beginning here.
64280	66040	Perfect. Hi.
66260	67020	Hey.
67960	69000	All right. There we go.
69000	70220	Good to see you. Good to see you.
70220	71100	Good to see you, too.
71100	77500	All right. Let's see. Let me know, staff, when I can start – when we start,
78040	82520	once you get the stream all going, and we will start as soon as that starts.
82660	87820	Cool. Quick question. I want my video to be off.
87960	91120	After I do – when I move from this slide to the next,
91120	95180	could you guys control that, or do you want me to quickly go back into Discord
95180	96560	and do that myself?
96840	100060	I'd probably say if you can shut off the video on your end,
100060	103100	so that way we can just ensure that things are being recorded.
103100	108000	Sure. Yeah, and I'll just – so I'll just make sure that my camera is off now,
108000	112440	and then I'll just turn it back on for Q&A so I can get out of the slides.
112440	113220	Sound good?
113320	117160	Yep. Can you put your slides on full screen really quick?
117520	119140	Can you see it full screen?
119140	122860	No, right now we see just the default PowerPoint.
123720	124520	Huh.
125280	126720	If you hit F5 –
126720	134600	No, that's not it. That's weird. Can you see it now, the full screen?
134920	138400	Right now, all we see are like the slide deck when you first go into –
138400	138960	Yeah.
139160	140040	Yeah.
140740	143480	Huh. How about now? What do you see?
144040	148540	Right now, we are seeing just the general slide deck.
148540	149980	It's the presenter view.
150180	155360	I wonder – it was doing that before.
156300	157380	No worries.
157880	158960	Huh.
159280	163840	And for those folks that are currently on Twitch and are tuning in on Discord,
163840	169560	give us a few seconds as we set up our stream, and we set up our slides really quick.
169560	174200	So just sit tight, and we will start our presentation by Chloe in just a few.
174200	175640	So hang in there.
177540	180460	Looks like we've got a decent amount of Twitch folks on there.
181440	185380	Okay. Let me try again. Maybe I just need to restart it.
185420	186720	Sounds good.
187880	189320	All right.
191540	193980	All right. Can you see it full screen now?
193980	199680	No. Right now, it shows play from start. We still see the presenter view.
200500	201800	Oh, okay.
207630	209890	That's so weird. I'm sorry, guys.
209890	211690	No worries. No worries.
212430	219950	What I would probably say is, if anything – do you have two monitors at the moment?
220110	221250	I do.
221250	227690	What I would do is share the – don't share the application. Share the monitor where the slide is going full view.
228710	233290	Oh, okay. So this is on my laptop right now. Sorry. I have two computers next to me, though.
233730	235070	I got you. I got you.
236470	239450	Huh. That's weird.
241210	242010	Crap.
243790	247590	If you'd like, you can send me the slides and I can drive them.
247590	251350	Okay. Yeah. And I'll just say next slide or whatnot.
251350	252410	Sounds good.
252690	255270	Okay. Where should I send it to?
255370	259250	Here. I will direct message you my email really quick.
262840	268620	Cool. So for folks that are tuning in on the Twitch stream, give us one quick second while we get Chloe's slides.
268620	274560	I will drive them and we will go from there. So sorry, folks. Give us one second.
274560	280420	Let me pop the – back in there. Let me turn that off.
280520	287260	I hope everybody is doing pretty well today in the spirit of DEF CON.
287260	288940	Welcome to the final day.
288940	295180	Let me go to Gmail.
306800	312560	So for those of you that just joined, give us one quick second as we set up our slides.
312860	319180	We are starting the stream just shortly. Give us one quick second while we go and do that.
345860	349240	That is correct. I think we should get that beach ball.
379930	386070	So while the slides are being sent, for those of you that were on the call at the last presentation,
386070	394030	we had Michael Antonino that was kind of talking a little bit about blackmail and disclosure and a few other things.
394030	399590	So it's pretty nice because Chloe's talk will kind of talk a little bit about that, about the hacker's rights.
399590	403790	It's a nice segue kind of moving into her talk.
403790	412110	For those of you that have just tuned in or have just joined us at DEF CON 28, Ethics Village 2020,
412110	416750	what I'd probably say is if you have any questions during the talk, please queue them up.
416810	424050	We are watching the Twitch chat room and we are also watching Discord as well.
424170	426830	So any questions you all have, please queue them up.
426830	430610	I will either relay them to Chloe or Chloe will see them in the chat.
430610	434530	So yeah, just hang in there and we will get started just shortly.
434530	438950	So thank you all for coming for this final talk.
438950	442030	All right, let me see if I can open them now. I'll be right back, folks.
512390	514270	Okay, and we are back.
514390	522110	For those of you, so I would say, staff, can you please switch the screen really quick to mine?
522110	530550	And I would say, Chloe, you might want to stop presenting the live or stop sharing your screen.
530550	532190	So that way, just in case.
539160	540600	Perfect, perfect.
540840	546540	And I will ask, let me move back to the chat really fast.
546540	548080	One quick second.
548820	552360	So our staff, Ethics Village staff, are we ready to start the stream?
552960	555300	Give me a thumbs up if we are good.
559240	562700	Oh, one quick second, one quick second. Things are being queued up.
571810	575150	Chloe, I might be butchering your last name. How do you pronounce your last name?
575250	576550	Miss Doggy.
576750	578130	Miss Doggy, yeah, okay.
578130	579210	There we go.
580210	584290	I've been butchering people's names all day for the past two days, so yeah.
584310	589610	I do this trick where I just say their first name and then I'm like, okay, go ahead and introduce yourself.
589610	593430	No, no, I must go through the pain. I must learn everybody's name.
593430	596830	Because I'm just like, no, I have to say it.
596830	600630	Although, yeah, yesterday I butchered some poor speaker's name.
600630	601950	I'm like, I am so sorry.
602770	607630	I'm from the Midwest, and the Midwest is unfortunately very, very bland.
610730	611610	Right.
612870	615370	All right, Ethics Village staff, what do you all say?
615370	617190	We good to start?
618070	619830	Let me double check.
621830	625630	I'm just going to say next slide. What is next slide? Sound good?
625750	628690	Perfect for me. And we are good to go. Thank you all.
628690	633650	Oh, wow, we've got a lot of people on Twitch, and we have a lot of folks over on Discord.
633650	636530	So now I will introduce our speaker.
636950	643490	So hi, everybody. Welcome to the final live talk of DEF CON Ethics Village 2020.
643490	646690	So today with us we have Chloe, Miss Doggy.
646690	650670	Chloe is the VP of Strategy at Point3 Security.
650670	656730	She is a researcher advocate who strongly believes that information security is a humanitarian issue.
656730	662890	Besides her passion to keep people safe and empowered online and offline,
662890	665050	she's driven to fight for hackers' rights.
665050	670750	She is the founder of Women Hackers and the president and co-founder of Women of Security, or WOWSEC,
670750	676110	podcaster for ITSP magazines, The Uncommon Journey, and runs the Hacker Book Club.
676110	679350	So in all fairness, folks, check out the Hacker Book Club.
679350	681770	They've got some pretty cool suggestions in there.
681830	684550	You can tweet her at ChloeMissDoggy.
684550	686350	And yeah, we will go from there.
686350	689810	And without further interruptions, Chloe, all you.
690150	693730	Excellent. Thanks, everyone. I hope everyone is enjoying their Sunday.
693730	700990	And I guess good afternoon, good evening, or good early, early morning, depending on where you are.
701310	705090	Let's dive into this. So let's go to the next slide.
709490	716650	All right. So I just want to say that this talk is completely dedicated to all the hackers who've been scared to disclose,
716650	721890	to all the hackers who've been prosecuted for doing something good or doing their actual job, believe it or not,
721890	725650	and to all the people who are in the fight to bring rights for hackers.
725650	731530	And there's many of us basically behind scenes doing whatever we can to make changes.
731730	736390	But this talk is going to be good for you because you get to find out how you can also help.
736390	747300	Next slide. So once again, my name is Chloe Mostagi. I am the VP of Strategy over at Point3Security.
747300	752540	I'm an ethical hacker advocate. Basically, I'm fighting for hacker rights,
752540	755860	and especially trying to help out the community in any sort of way.
755860	762240	If that means trying to push out mental health issues, if that means bringing diversity and inclusion
762240	768320	and doing whatever I can to promote others in the field that are trying to do something good, I do so.
768320	771920	Also a person co-founder at Urbosec. We have hackers all over the world.
772180	775640	Founder of WeAreHackers, formerly known as WomenHackers.
775640	781000	We are a private group of hackers who hack at all different levels that are marginalized genders.
781420	786220	Also a podcaster for ITSP Magazine, The Uncommon Dream with Phil Wiley and Alyson Miller.
786220	789040	And when I'm not doing that, I run the Hacker Book Club.
789840	795080	And so one thing you should know about it, we meet every week virtually at 5 p.m. Pacific Time.
795080	803120	We do read one book every month, and usually the books are written by hackers in the community or about the hacker community.
803280	808420	And the authors do attend our sessions, and also people that are mentioned in the book do attend our sessions.
808420	815600	We will be doing Trevor Packer's Red Team Edition. That's going to be coming up next, so I highly recommend it.
815600	819920	That is my URL. If you want to know anything about me, it's probably on there.
820020	822800	And I do have a Twitter and Instagram. My DMs are always open.
822800	824280	All right, next slide.
827650	832090	So I know this is going to be scary, but we're going to dive in it together.
832410	833410	Next slide.
838860	845160	So usually at this point, I say, like, oh, raise your hand if the Equifax breach impacted you.
845160	849400	But the thing is, you're behind your screen, so I'm just going to pretend you raised your hand.
849560	858440	But did you know a security researcher warned Equifax that it was vulnerable to a kind of attack that later compromised the personal data of more than 147 million Americans?
859320	865060	Six months after the researcher first notified the company about the vulnerability, Equifax patched it,
865060	871840	but only after the massive breach that made headlines had already taken place, according to Equifax's timeline.
872780	874300	Next slide.
877900	880160	And then we have the case of Capital One.
880160	885220	According to the federal complaint, the breach took place in stages across March and April 2019.
885220	897920	But Capital One only became aware of the problem on July 17, when a security researcher tipped the company to a public GitHub page that was displaying something that looked an awful lot like private Capital One data.
898200	899500	Next slide.
903590	908090	But the real question is, well, what if no one reported the breach?
908250	909670	Next slide.
913640	919100	It happens often because hackers don't report a breach due to the fear of prosecution.
919100	928020	This statistic was discovered by the hard work of Amit Elazari, who knows her laws prevent good hackers from doing what they do best, protecting you and me and everyone we love.
928080	931100	She's been spearheading this movement towards safe harbor.
931100	949760	And according to HackerOne's 2018 hacker report, which surveyed over seven, I think, 60 members or something like that of the hacking community, they found that almost one in four ethical hackers have not reported vulnerability because the company in question didn't have a VDP, a vulnerability disclosure program.
950060	957740	Those who tried to notify the company through other channels, such as email or social media, also claimed they were frequently ignored or misunderstood.
958500	960020	Next slide, please.
963320	971000	So besides prosecution, looking for contact information and reading the policies have been a burden to report vulnerabilities. Think about it.
971000	975840	Sometimes it takes hours, days, and weeks to find the right contact information to disclose.
976160	985620	And I have to admit, it's really difficult because at that point, you're like, should I even disclose anything if I can't locate the right person?
985620	995500	And that's a very frustrating thing because you're trying to protect their customers' data, usually, and letting them know ahead of time that there is this vulnerability.
995500	998700	But reporting it can be so hard.
998700	1019300	So it's really good and important for companies to state having some sort of in-scope, out-scope policies, and then also contact information, what to expect when reporting, if there are any rewards at all, to mention what kind of rewards could be given.
1019300	1025960	But having some sort of policies in place that protects the hacker by notifying them about the situation.
1025960	1036000	But it's not just, you know, hackers online that are having to worry about being prosecuted. Also, those that are doing physical security as well.
1036000	1040740	Even if they're hired to do that job, they can still get prosecuted.
1040900	1042640	Next slide, please.
1045840	1050980	So after DJI, the drone manufacturer recently launched a bug-bunny program.
1050980	1053200	Two researchers named Sean and Kevin.
1053280	1062920	For the scope, the bug-bunny program covers all the security issues confirmed by our application servers, including source code leak, security workaround, privacy issue.
1062920	1066040	And Kevin emailed them to confirm the scope to be safe.
1066040	1069280	It took them two weeks to finally confirm the scope.
1069280	1071160	He then reported the vulnerability.
1071160	1080080	However, when he reported, he was provided with $30,000 for the finding, but the agreement in receiving it offered no legal protection for him.
1080080	1082020	So he decided to walk away.
1082080	1090740	The revelations resulted in the company challenging his findings and seemingly threatening one with a lawsuit tied to the Computer Fraud Abuse Act, CFA.
1090740	1096760	Claiming he went out of scope, regardless to the fact that he made sure to confirm that he was within scope.
1096760	1107280	And in return, because it was getting so bad with basically giving him a lawsuit, he decided to post the entire situation with all the conversations with DJI publicly.
1107400	1120880	I think one of my favorite things, if you look at the blog post, is that in the chain you'll see that there was a moment where the people at DJI didn't know he was cc'd on...
1120880	1127900	Well, not cc'd, but there was a chain in the email, and in it, it said, like, this guy is going to cause us a problem.
1127960	1131840	We need to take initiatives, legal initiatives on it.
1131840	1140200	And when he got the email from them about something else, he scrolled down and he saw, like, the internal conversations happening around him.
1140200	1150040	So it's really good to read, and it gives you, once again, one of those moments where you realize, even when you're in the good, you have these situations that occur.
1150580	1152240	Next slide, please.
1156200	1161960	This is another case. So this is a case in September of last year.
1162000	1171240	Basically, Iowa State asked the cybersecurity firm CoalFire to conduct a penetration test to see if its staff could gain access to sensitive data or equipment.
1171320	1181220	So two CoalFire employees found a door to the Dallas courthouse open, and when they closed the door to see if it would lock and then attempted to open it, an alarm was set off.
1181220	1187760	Following the protocol, the employees waited for the police to arrive and show them their paperwork that they were legally hired.
1188400	1198320	Initially, they were told they were good to go by the police. However, the sheriff showed up and arrested them, and they ended up having to spend a night in jail.
1198460	1209300	There were charges for burglary, which is just so upsetting in so many ways, but they were later dropped in the late January 2020.
1209300	1216760	This is one of those examples of why a good, you know, a good cemetery in law that would protect their industry.
1217660	1227120	Basically, if their industry appears from any kind of prosecution and that people are still not, you know, reading up on the differences between ethical hacker and attackers.
1227180	1237380	So it's important to notice is that even, you know, even physical security still has issues too, as well in this situation.
1237380	1239300	Next slide, please.
1243240	1255000	Overall community consensus here is that language of what is in scope, out of scope, when disclosing, or how do I disclose can be so scary, and potential indictments especially. It can keep both parties awake at night.
1255200	1262180	And I'll tell you it does for me, of course. I mean, there are program managers asking to be hacked, but not to get hacked badly.
1262320	1267460	And how to conduct and handle situations where researchers report something is another fear of theirs.
1267460	1272980	But overall, organizations and government all know that it's probably needed at this time.
1273060	1279280	And that's why they do work with the hacker community, right? You have like Hack the Pentagon, Hack the Army.
1279280	1286720	You even have them hiring like coal fire employees to go and test their sites to see if they're safe.
1286720	1289820	So overall, people are aware that they need to work with us.
1289820	1301920	It's just that there's this thing going on behind, which is like these really unchecked beliefs about the hacker community and that hackers are criminals.
1301920	1305780	And it's very sad because it keeps us from moving forward every day.
1306160	1307620	Next slide, please.
1311360	1314080	And I know this is a very scary subject.
1314900	1319960	But here are some puppies to lift your spirits. And of course, I place a cat for cat lovers as well.
1319960	1322080	So take a moment to enjoy it.
1322820	1324540	Next slide, please.
1328600	1332580	So the real question is, why do they continue to be scared of us?
1332580	1338200	Well, even though ethical hackers are not malicious actors, they're still being seen and treated as such.
1338200	1346480	And because of this, it reduces the chances of reporting a vulnerability and can cause hackers to go more towards the dark side because they're seen as the same.
1346480	1351820	So if you can see in the imagery to the left is what you see when you type in criminal hackers.
1351940	1355340	And on the right is what you get when you type in ethical hackers.
1355340	1366820	Once again, there's like this hoodie, this darkness, sometimes with a ski mask, basically still portraying us as these dark, devious people that are doing malicious things.
1367320	1368540	Next slide, please.
1372090	1374810	But I want to let you guys know it's not just the imagery.
1374810	1376590	It's also language used in the media.
1376590	1379590	And when I say media, I mean marketing in the press.
1379590	1388090	Using the term hacker as someone as a criminal when they should be using the term attacker or cyber criminal, malicious actor, and so on.
1388350	1389750	Next slide, please.
1393610	1397170	So how does this imagery and language impact us?
1397270	1402590	It continues to feed the fear and stereotypes and biases that exist through social construction.
1402590	1411450	And we're going to have to dive into the brain to understand how does social construction believes us and how it works exactly.
1411450	1412370	Next slide.
1415720	1423120	So if any of you guys have ever attended any of my previous talks, I usually always bring up the brain because I have an obsession with the brain.
1423220	1425780	Because that's how we understand the human element.
1425780	1431580	And the human element plays a huge role when it comes to getting rights, but also within InfoSec itself.
1431580	1437760	So what I want you guys to understand is there is three parts.
1437760	1442280	So the first part is around how do we collect fear?
1442700	1459360	So socially constructed beliefs are beliefs that you were told as a child or as an adult from someone that you look up to or someone with knowledge or on the news or in images or in movies or TV shows.
1459360	1464060	These things feed into basically creating beliefs.
1464060	1469560	Now, the thing is that a lot of people know of the amygdala as this fight versus flight mechanism.
1469560	1476280	But what they don't really understand is that it's more like sorting who is like me and who is not like me.
1476480	1484980	So when they see something or they're told something that, say, for example, someone with pink hair are dangerous individuals.
1485520	1488760	They might not say that directly, but indirectly.
1488760	1499640	So by watching movies, every time you see someone with pink hair, they're seen as the villain, the criminal, or they might use the term, you know, when they see someone with pink hair.
1499940	1505100	And this is also in the news. Maybe you had a teacher, a parent or friends.
1505100	1510340	They like people with pink hair are dangerous and it's best for you to cross the street or whatnot.
1510400	1518120	So every time you see someone with pink hair, you might clutch your purse a little bit tighter or you might cross the street to avoid the person with pink hair.
1518120	1522120	Or you might get out of an elevator when you see someone with pink hair get on.
1523780	1531400	And that's the one thing. The one thing you should take away from that example right now is that the person literally just only has pink hair.
1531400	1539880	There's really no difference. But the thing is, is that you've been indirectly told to believe that people with pink hair are dangerous.
1541500	1548260	So the thing to know about the amygdala is that it works with the memories within your temporal lobe.
1548260	1553460	And because your temporal lobe is there, also emotions are connected to your memories.
1553460	1566280	So whenever there's a fear moment, your amygdala will be lit up and the amygdala will basically be like, OK, we are under a threat right now and we need to do something about this.
1566280	1572660	And so what happens is the amygdala subconsciously sends next a message to the prefrontal cortex.
1572700	1574560	Next slide, please.
1579240	1587260	So once it gets to the prefrontal cortex, it's checking in to see whether or not this thing is actually a threat.
1587260	1594040	This is the only time that you can actually consciously question any action before taking action.
1594040	1601820	So, for example, you see someone with pink hair and your amygdala is like, warning, warning, pink hair person behind you.
1601980	1605120	What should we do? And sends it to the prefrontal cortex.
1605120	1609100	The prefrontal cortex is thinking, OK, I can do this action. I can do that action.
1609100	1613860	I could go inside the store. I can cross the street. I can walk a little bit fast.
1613940	1620480	I can make sure that I have my phone dialed 911 in case of emergency because this person has pink hair.
1620480	1623320	I just want to remind you just because this person has pink hair.
1623320	1629500	This socially constructed beliefs are, you know, are stored in your memory and whatnot.
1629500	1632240	But the prefrontal cortex acts like the CEO of your brain.
1632240	1635700	It's basically saying whether or not it is an actual fear.
1636160	1642300	Now, the thing is, is that, say, for example, you've been told all these things about people with pink hair are dangerous.
1642680	1647280	And what you do is that you're on YouTube and you come across a video.
1647280	1658420	And there's in this video, it's someone with pink hair talking about basically how everyone always sees them as a criminal and how they can't get a job because people treat them differently.
1658860	1669480	And that they don't understand because why are they always picked on as the criminal in movies or in the news when in reality, it's just having pink hair.
1669480	1678440	And how it's caused them to have a very, very negative impact in their life because of people's perceptions of them.
1678940	1690120	So when you saw that video on YouTube of the person with pink hair explaining these things, next thing you know is that there's a part of you that's like, huh, I wonder if I've ever done that.
1690120	1692500	I think I may have done that before.
1693460	1707140	So the thing to note about is that from hearing people's personal stories and hearing other sides and different perspectives, what you're supposed to be doing is challenging your belief system.
1707140	1714960	But you have to be okay with being uncomfortable because we don't like to be wrong most of the time as humans. We see it as a weakness of ourselves.
1714960	1718560	And we want to constantly come off as being the strong person.
1718560	1730060	And so the thing is, is that because you saw the video with pink hair, and you're walking down the street, and you see that there's someone with pink hair like crosses the street and now is walking next to you.
1730080	1738220	A part of you is like, your amygdala is going off, like, warning, warning, pink hair person's right next to you. You should be freaking out. What should you do? You need to take an action.
1738280	1742920	And your prefrontal cortex is like, okay, I'll just tie my purse a little bit closer.
1742920	1746300	But in reality, that video pops up in your head.
1746300	1750080	And you're reminded of this personal story, the person with pink hair.
1750320	1756100	And you realize at that very moment, you're about to practice some sort of discrimination.
1756700	1765000	And you freeze in that moment, recognizing that, and decide, I'm not going to clutch my back. I'm not going to be that person.
1765960	1767480	Next slide, please.
1772630	1778530	And that's the thing I want to take away from this, is that personal stories are really important.
1778530	1785530	Sharing the truth and fact-checking is so critical, more than ever before.
1785530	1795630	And just note that people can be totally challenged on socially constructed beliefs, because we have to retrain ourselves to be okay with the person with the pink hair.
1795890	1802550	Now, I want you all to think of, this is how basically our society also sees, you know, hackers in some ways, right?
1802550	1808650	In movies, they show hackers as the bad people, the evil people. They're doing malicious things.
1808650	1816090	The news, they report the term hackers, and they use it, once again, to showcase that the hacker community are bad people.
1816090	1825330	The thing is, they're not differentiating between a criminal and someone who's ethically doing something to protect people.
1825330	1836890	And because that they keep showing this imagery of a devious person with a hoodie or with a ski mask, we're still getting set up for our community to be looked at in a bad way.
1836890	1841590	And that is how it's preventing so many good things from happening for us.
1841970	1846490	And so it's so important for us to understand how our brain works.
1846490	1853330	And note that you can always, always question beliefs, and you can always get people to question their beliefs of you.
1853330	1859850	It's just fact-checking them, sharing personal stories that change people's mindset.
1859850	1862670	And we need that more than ever before.
1863130	1864790	Next slide, please.
1867790	1881530	Because what's happened is, due to this situation, the mindset set by society, by people in the media, it's keeping us unsafe and preventing us from doing what we do well and trying to protect people.
1881530	1894730	Making sure that the customers are protected, the personal identifiable information is somewhere that's stored in a safe, secure place where it doesn't come out, especially hospital records.
1894790	1902690	These are all scary things to ever come out in public, and that's what we're trying to do our best in, is to show that there are criminals.
1902750	1908370	But we're not criminals. We're there to save and help and prevent situations from occurring.
1909030	1917610	But the issue is, is because of the mindset, the public perception of who we really are, and if you're like, wait, Chloe, how do I know if that's the case?
1917610	1922830	I mean, okay, you guys, let's be real. When you tell someone you're a hacker, what do they do?
1922950	1926990	They usually take a step back, right? Their mouth drops, their eyes get a little bit bigger.
1927230	1932650	Yeah, exactly. Because it still is there, this belief of us.
1932650	1939330	But the thing is, is that this is one of the reasons why a lot of companies don't have vulnerability disclosure programs.
1940050	1945770	We still have 94% of Forms Global 2000 still don't have a VDP.
1946250	1957230	And that's really scary, because companies are still afraid of hackers, and they don't want to create vulnerability disclosure policies because of the lack of bilateral trust amongst hackers and organizations and government.
1957230	1960910	It's one of the reasons why 60% do not report vulnerability.
1961550	1966310	And hackers are scared of outdated laws such as CFA and DMCA.
1966430	1977830	Also, from interviewing attackers, one of the reasons they decide to move away from hacking ethically is the pay and the constant word of being prosecuted, regardless if they did something legal.
1977830	1982410	And this is also said similarly by those who switch from being an attacker to a hacker.
1982410	1993130	The reason they switched was the insomnia of being arrested, because there are so many cases when an organization prosecutes an ethical hacker, regardless if they were in scope that we saw earlier today.
1993870	1995130	Next slide, please.
1999310	2005110	Which leads us to needing to dive into the current legislation that can be found in most countries towards hackers.
2005310	2011910	We have anti-hacking laws, anti-circumvention laws, these are known as the copyright type of laws, and acceptable use policy.
2013050	2015310	Let's first dive into anti-hacking laws.
2015310	2019470	Overall, they're usually used when a researcher goes out of scope.
2019470	2021910	It's usually the act used to prosecute hacking.
2022110	2035070	But to give you a little bit of background on CFA, the Computer Fraud Abuse Act is a U.S. cybersecurity bill that was enacted in 1984 as an amendment to existing computer fraud law, which has been included in the Comprehensive Crime Control Act of 1984.
2035290	2040610	The law prohibits accessing a computer without authorization or in excess of authorization.
2041490	2046010	Random fact here is, who has heard the movie War Games?
2046910	2053730	Now, did you know that Ronald Reagan, he watched the movie, and he freaked out completely about hackers.
2053730	2056010	He was like, oh my god, we have to do something.
2056010	2059670	And that's how CFA happened, was because he watched War Games.
2059670	2061910	Which is sad, because I love that movie, you guys.
2061910	2064030	It was an awesome movie, but still.
2065350	2068670	Let's dive into anti-circumvention laws, the copyright type of laws.
2068670	2072370	If you're in Canada, it's actually called just the Copyright Act.
2072790	2076370	But in the U.S., we call it the Digital Millennium Copyright Act, DMCA.
2076910	2091130	It was formed in 1998, the U.S. copyright law that implements two 1996 treaties, the World Intellectual Property Organization, WIPO, basically seen as the right to repair, reverse engineering as a breach of property to companies.
2092210	2094610	Now, let's go into acceptable use policy.
2094610	2102670	Quick question, who here in the room has ever read their terms and conditions for, say, for example, an Apple product?
2103170	2109310	Yeah, okay, so I tried. I got really bored, and I decided to watch a movie instead.
2109310	2111670	But in general, they can be long and too much verbiage.
2111670	2115190	It can confuse anyone, especially if English is not their first language.
2115190	2121050	This can lead to some serious miscommunication issues for ethical hackers that don't really speak English as their first language.
2122110	2125670	Clearly, these laws are out of date.
2125670	2127730	And honestly, they were created out of fear.
2127730	2131630	And remember, we learned everything about fear and how it works in the brain, right?
2131930	2135770	There was no empathy by taking the time to understand what is truly needed.
2135770	2137050	It was rushed.
2137130	2143190	It wasn't... not all the people that that would affect were represented in that room.
2143190	2154810	And that's the issue we have today in so many things, is that without decent representation, having an equal voice, how are any laws supposed to help people?
2154810	2157530	You have to have all the players in the room.
2157770	2166430	And this is why these laws are prosecuting not just malicious actors, but also the really good people out there, the ethical hackers.
2167390	2169130	Next slide, please.
2172790	2178730	Overall takeaway is that laws prevent good hacking in the same way they prevent attackers.
2178730	2180850	And we need good hacking.
2181090	2181890	Next slide.
2187650	2190710	So, I really do hate the CFA.
2190710	2194170	And I'm going to tell you the reasons why you should too.
2194790	2204630	So, the Computer Fraud Abuse Act, once again, which was passed in 1984, and I keep reinstating this year for you to remember and recognize that this is so out of date.
2204630	2205990	We're in 2020.
2205990	2208410	But just remember that.
2208550	2221310	Has grown wildly outdated in that it offers prosecutors discretion to throw in huge potential fines and jail sentences for relatively undeserving violations of computer policy.
2221310	2227370	First, the CFA, as written, punishes exceeding authorized access to a protected computer.
2227370	2233240	It's a phrase that's so vague to inspire any type of some broad interpretations.
2233240	2239440	Another flaw in the CFA is the redundant provisions that enable a person to be punished multiple times for the same crime.
2239480	2248020	These charges can be stacked on one on top of another, resulting in a threat of a higher cumulative fines and jail time for the exact same violation.
2248380	2257120	This allows prosecutors to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a single solitary act.
2257120	2260100	It also plays a significant role in sentencing.
2260140	2271060	The ambiguity of a provision meant to toughen sentencing for repeat offenders of the CFA may, in fact, make it possible for defendants to be sentenced based on what should have been our prior convictions.
2271060	2276320	But we're nothing more than multiple convictions for the same exact crime.
2278040	2285320	This is one of those things that it's just so overwhelming how this still exists and it hasn't changed.
2285320	2295700	But I want you guys to know we're going to dive into Aaron Swartz's case because we need to for this to understand how this could be used to hurt someone so much.
2295840	2302040	But I want you guys to also note is that the CFA also gives companies the right to sue.
2302340	2311120	And I want to let you guys know that I think hackers have more to fear from companies and states right now than the actual Justice Department at this time.
2311120	2314080	Things have changed a lot since 2014.
2314080	2321760	Since 2014, the DOJ has been working to try to prevent these situations from occurring on the federal side.
2321760	2325140	But just please note that companies and states can definitely do these kind of things.
2325140	2328800	So you want to be a little bit more careful when it comes to companies and states.
2328800	2334820	Those are kind of the ones that threaten you more than, you know, having to worry about federal.
2335080	2336320	Next slide, please.
2339400	2349640	If you guys are not familiar with Aaron Swartz's case, it's something that is definitely a case study to consider when revisiting the CFA.
2349740	2359700	So in 2011, Carmen Ortez, the U.S. Attorney's Office, charged Swartz with hacking into MIT's computer network to download millions of scholarly articles from JSTOR.
2360000	2366740	It was an act of civil disobedience meant to protest the restrictive access to research funded by taxpayers.
2366740	2373960	For this, the U.S. Attorney brought charges that carried a maximum penalty of 35 years in prison and $1 million in fines.
2374300	2382100	I want to pause right there because the thing to note about was that 35 years in prison was the maximum penalty that he can get.
2382180	2386980	I want you to understand a first degree murder charge is 25 years.
2387880	2393500	It just doesn't seem right. I don't know. Just logically in my mind, that just doesn't sound right.
2393500	2402560	Anyway, going back to this, they were able to charge such years because of the way that CFA is written and the issues that have yet to be sorted since it was made into a law.
2402560	2405820	Remember that stack on stack thing? Right.
2406160	2416160	Overall, looking at Aaron's situation, the sad thing was that he was dealing with a 17 month legal battle, one that had no set trial date and wasn't ending anytime soon.
2416160	2419520	And through Swartz's perspective, it must have been so overwhelming.
2419520	2426780	With the future of the legal battle cast into doubt, Swartz hung himself in his apartment on January 11, 2013.
2427060	2430580	And following his death, federal prosecutors went on to drop the charges.
2430960	2436500	His family said it was the government's prosecution that contributed to his decision to take his own life.
2437660	2439140	Next slide, please.
2442080	2451860	It was because of the situation that happened to Aaron that legislators came together thinking we need to do something about this.
2451960	2456660	Unfortunately, Aaron's law did not pass, but it was a good start.
2456660	2478680	Aaron's law basically was trying to remove the phrase exceeds authorized access and replace it with access without authorization, which is defined as to obtain information on a computer that the accessor lacks authorization to obtain by knowingly circumventing technological or fiscal measures designed to prevent unauthorized individuals from obtaining that information.
2478680	2490440	In other words, it basically would also ensure people won't face criminal liability for violating terms of service agreements and contracted agreements, but also it limits the penalties.
2490440	2494320	In other words, there was no more duplicated charges that he was facing.
2494800	2496620	Next slide, please.
2501490	2504130	Let's dive a little bit into the DMCA.
2504130	2507290	So the DMCA was passed in 1998.
2507290	2510370	And remember, reminding you this year is 2020.
2510370	2512270	That was in 1998.
2512290	2513550	Hasn't been any changes.
2513550	2514690	So let's keep going.
2514690	2527030	As an anti-privacy statute, effectively making it illegal to circumvent copy protections designed to prevent pirates from duplicating digital copyrighted works and selling or freely distributing them.
2527030	2533150	It also makes it illegal to manufacture or distribute tools or techniques for circumventing copy controls.
2533150	2544630	But in reality, the controversial law and facts have been much broader by allowing game developers, music and film companies, and others to keep a tight control on how consumers use their copyrighted works.
2544630	2554990	Preventing them, in some cases, from making copies of their purchased products for their own use or from jailbreaking smartphones and other devices to use them in ways the manufacturer disliked.
2554990	2565150	The thing you should note about this is that it just, overall, it just seems like it's so out of date once again.
2565150	2571950	And it's so frustrating to see that there hasn't really been anything else on this overall.
2571950	2586250	But when it does, it also prevents finding any research on it or finding if there are issues already within the product because apparently you might be actually dealing with that type of case.
2586710	2595390	It protects more of the big companies and reduces consumer protection, which is what ethical hackers are all about, is protecting the consumer.
2595710	2600650	It also puts a hold on free expression and it does interfere with computer intrusion laws.
2600650	2605830	I do recommend reading the public comments, especially groups one through three.
2605930	2608110	There is a link right there.
2609150	2610610	Next slide, please.
2614330	2619470	In general, with the improvements to legislation, we can change where we stand today.
2619470	2628110	But in order to do that, we have to dive into three categories in which we have touched on because they work together to bring about a public change.
2628170	2629610	Next slide, please.
2634060	2638240	Overall, in order to have rights for hackers, we need to get the public on board.
2638240	2641380	In order to do so, we need to dive into these three categories.
2641700	2645400	We need the media to push for the public to become more aware.
2645500	2653420	In other words, we need to change the language and imagery of a hacker and start using the term cyber criminals for those who commit unethical hacking.
2653460	2659320	Overall, really separate these two groups because they are definitely separated on this.
2659320	2666560	In order to help the press, organizations need to be on board with a bilateral trust with having moderate disclosure programs.
2666860	2676780	By initiating a VDP program or putting contact information and following up with the researchers that do report, it's showing that you support the hackers and the community.
2676880	2684560	And this is what is needed also because when the public starts seeing that, then the public slowly changes their view in general.
2684560	2687720	And then we can actually build trust now.
2687720	2697560	And lastly, to have organizations and public opinion to push and motivate Capitol Hill to get on board and update the current legislation that will protect ethical hackers.
2697640	2701540	Overall, we need all three to be supporting hacker rights for it to become a reality.
2701660	2702960	Next slide, please.
2705890	2711590	So now you're probably wondering, so how do we get there exactly?
2712170	2713710	Next slide, please.
2717450	2722830	Overall, we need these five needs to push for awareness of ethical hackers.
2722830	2724410	These are the five needs to get there.
2724410	2727970	Now, how we get there, I need you to be honest.
2727970	2730010	I can't be doing this all by myself.
2730010	2731990	We need to work together more than ever.
2731990	2734330	And we actually have a shot at it now.
2735490	2738650	And I'm going to dive into each one of these needs next.
2738770	2740090	Next slide, please.
2744130	2745870	So the first step.
2745870	2749590	This is a petition that I wrote at the end of RSA.
2749590	2755250	I gave a talk about basically how we need to get rights for hackers.
2755250	2765390	And this petition was created in a way so then we can get the public to be aware and get the public to sign it and really help us try to bring about a change.
2765470	2770370	And the best thing that you can do at this very moment is to sign and share this petition.
2770370	2774590	It is broken down by orgs, legislators, the media, the hacker community.
2774870	2781210	And anyone who can sign it can basically... anyone who agrees with it can sign it, in other words.
2781210	2784310	And it's really important that we do this because this is the first step.
2784310	2787370	How you get attention from the public is a petition.
2787550	2794290	These petitions can be used next to go to politicians and show them that this is what's needed.
2794290	2801390	It can also be adopted by other companies saying that they support this type of work as well.
2801390	2809290	And we get basically the press involved too by noticing that all these different players are wanting for something to change.
2809870	2813690	Next step, please. And by next step, I mean next slide.
2814930	2821510	So there is this collaboration that's happening right now with Brian and myself.
2821510	2826910	I hope you guys probably saw this video trending on Twitter this week.
2826910	2835010	Basically showcasing what people generally think what a hacker looks like and what they do versus what it looks like actually in real life.
2835010	2837590	It's actually hilarious and I hope you guys catch it.
2837590	2841450	If not, it is on my page and I recommend it.
2841450	2850250	But also check out the Hacking is Not a Crime itself, the Twitter handle, because you will also find those things.
2850250	2862870	But in general, what Hacking is Not a Crime, what it's about is to try to push out public awareness and for them to have a better understanding of what we mean by that.
2862870	2866690	Hacking is not a crime, okay? Let's just remind ourselves this.
2866790	2872830	One of the other things you could do is to share this with friends and family to share your personal stories.
2872830	2882670	But overall, the general mission for Hacking is Not a Crime is to bring awareness for the community and for the community to feel like that they are being listened to as well.
2882670	2887590	And we have to work together as a community whole to get the public to be involved.
2888770	2892690	And yeah, there's so many more things I could talk to you about this thing.
2893170	2896270	It's actually the handle is Hack Not Crime.
2896270	2899450	Thank you, Brian, for reminding me of this.
2899450	2901790	Next slide, please.
2905870	2912810	All right, the next step is we need to remind people the difference between a hacker versus a criminal and attacker.
2912890	2916810	I usually tend to use this phrase, which is a locksmith.
2916810	2922890	Say a locksmith is a hacker. A burglar is the criminal attackers that are kind of a malicious actor.
2923130	2926570	This is actually the easiest way for people to understand the differences.
2926570	2933950	So I do recommend it. So remember, locksmith equals hacker. Burglar equals criminal attacker. So criminal malicious actor.
2933950	2936430	Anyway, it's really good thing to take away from it.
2936470	2939610	Now, the thing to note about what do you mean by tell the press?
2939790	2946710	So whenever I'm talking to the press about a breach or anything like that, and when they're saying, so what did this hacker do exactly?
2946710	2950590	I'm like, I correct them. I say, you mean attacker.
2951090	2952850	And there's a reason for that.
2952850	2962670	We have to start correcting the press when we talk to them on when it comes to how they're labeling the people that are in the store that are doing negative things.
2962670	2966250	The other thing you can do is simply shame them online.
2966250	2977010	I know that sounds really bad to do, but on LinkedIn, on Twitter, basically publicly shaming them, reminding them once again, this is not a hacker that caused a breach.
2977010	2982090	It was an attacker, or you could use the term cyber criminal if you want, or malicious actor.
2982750	2984630	You get to pick which one you want to use.
2984630	2987210	But the thing is, we have to let them know they got it wrong.
2987490	2995730	Also, when it comes to images, if they show us another image of someone wearing a hood underneath, I don't know, in the basement or something.
2995730	3000670	I think we need to start telling them, no, that's not, no, no.
3000670	3004270	Actually, we could be in a cafe scene right next to you doing what we do.
3004270	3010550	Anyway, it's just the thing is we have to showcase that they are wrong here at this point in time.
3010750	3017070	So those are going to be the best thing is to fact check them, basically, and remind them they have it wrong until they learn.
3017210	3021410	So I do recommend that, and that needs all of us in the community to do that.
3021830	3025350	I think the person who started really doing that was Chris Roberts.
3025350	3032150	He started being like, you got it wrong. That's a cyber criminal, not a hacker. This is a hacker.
3032670	3038030	Also, Casey Ellis does that, too, as well. I try my best to do it, as well.
3038030	3043290	So if you do have any of those cases, please let them know, share them online if you need to.
3043850	3047950	Next step. Next slide, that is.
3048750	3053870	All right, so the third step, what we need to do is push for organizations to partner and campaign with us.
3053870	3060710	So remember that petition? Basically, we need organizations to get involved more by pushing out, saying, like,
3060710	3066330	this is the reason why they have a VDP program, or this is why we trust the hacker community.
3066370	3072890	This is why we need to do these things, because they need the hacker community to stay safe.
3073230	3076290	Also, to push for organizations to have a disclosure program.
3076290	3084830	So if a company doesn't have one, and you're working out one that doesn't have one, it's time to basically let them know they need to change that.
3084830	3091570	Because having voluntary disclosure programs actually forces those more companies to do it themselves.
3091570	3101870	So we want that Forbes list of companies to all have a program, because that means that we are definitely moving forward a lot faster.
3102550	3104510	Next slide, please.
3106930	3114270	The fourth step. Now, you need to contact your local representatives to update current legislation.
3114270	3120050	You need to talk to local ones. That means, you know, your city, your county, your state.
3120490	3129150	And the reason for that, once again, the actors that you need to be more concerned about these days are states and companies themselves prosecuting hackers.
3129350	3134790	So it's really important to let them know that things are out of date, and it's time for you to do something about it.
3134790	3143530	And let me tell you why. But the point, how you learn how to tell them why they need to change it, is find out what are the things that they're passionate about.
3143530	3148870	What are the basically the things that they want to fix in their own community?
3148950	3160630	If they're passionate about, say, for example, social media, tell them why it's important to work with hacker community when it comes to social media.
3160630	3169130	Tell them why it's important to do so, because with the CFA, you might face the following other situations.
3169130	3178050	Basically, you want to find whatever they're interested in, get them connected, because you're doing a bilateral kind of conversation, right?
3178050	3184870	Find out what their passions, their weaknesses are, and then utilize that to help your cause too.
3184870	3188790	So you both are ending the conversation with both feeling like you're winning.
3188790	3195770	And that's the way how you do things. If you want to practice diplomacy, that is the way you should do diplomacy.
3195770	3198670	So that's the most important thing.
3199350	3205850	And yes, you need to know who your local representatives are. If you don't know who they are, this is the time to do so.
3206710	3212830	Also, follow the Van Buren and United States case. That is actually very important to do.
3213470	3218790	Next slide. And I'll tell you, if you haven't heard about this case, why it's important.
3218790	3227510	So basically, a former Georgia police officer was wrongly convicted under this notoriously vague, you know, CFA.
3227510	3239030	So Computer Fraud Abuse Act is back, right? And basically what happened is, is that the person has gone to the Supreme Court to re-look over the CFA.
3239310	3247750	Because what was happening was that Nathan Van Buren was accused of taking money in exchange for looking up a license plate in a law enforcement database.
3247750	3257410	He was convicted of violating the CFA because he allegedly used that database for an improper purpose, even though it was a database that he was allowed to access for work purpose.
3257410	3267450	Under this expansive interpretation of the CFA, it would be considered a federal crime any time a person violates a website's term of services.
3267450	3276390	If violating terms of services is a crime, private companies get to decide who goes to prison and for what, and putting us all at risk for everyday online behavior.
3276390	3285550	And so this case is actually going in the fall to the Supreme Court, and the CFA is going to be talking about this.
3286390	3290530	All right. Next one. Next slide, that is.
3292330	3297150	The fifth step. These are some great organizations that can use your support.
3297150	3303670	If that means volunteering, if that means donating, if that means anything, just contact them and find out how you can help them out.
3303670	3309370	It's super, super important. All right. So, I Am The Calvary is a great one.
3309370	3316070	It has been having conversations with representatives since, I think, 2013, 2014.
3316570	3320950	So, they've been pushing for things to change.
3321050	3333070	Disclose.io, once again, is a great site to know what are the companies that are trying to practice some sort of bilateral trust agreement between the hacker community and the organization itself.
3333070	3339370	Basically, if you're a part of Disclose.io, you have to state contact information.
3339370	3357470	If you want to have a hacker basically disclose any information, their email addresses, what kind of rewards to expect, if there is any rewards, the policy link to their page that has to be following the Disclose.io RIN drafted policies to use.
3359270	3366330	And then I think there's one more thing I'm forgetting about Disclose.io, but overall, do check it out. It is great.
3366330	3371790	If your company is not listed on there, but they do practice these kind of things, I do recommend adding them to it.
3371790	3380750	It is basically everyone in the community has participated by throwing it, whatever organization that they know is practicing these things and what to expect.
3380750	3388450	And yes, it does talk about Safe Harbor. So just to let you know about that ahead of time.
3389270	3401410	The other one to consider is CERT Coordination Center. So CERT CC is a great one. EFF, of course, and the CTI League, which is doing some phenomenal work right now during COVID-19.
3401410	3404390	I highly recommend helping them out if you can.
3404390	3407370	All right. Next slide, please.
3412250	3419850	So overall, we need all these things to happen to have any type of awareness for ethical hackers.
3420410	3425450	And how are we going to get there? It really is going to need your advice and your assistance, too.
3426010	3436730	But what I have to tell you guys is, like, just don't give up yet. Just don't. It's going to get better. I promise you it will. This is the time where it's going to get better.
3436730	3442750	Maybe not this year, but next year, I guarantee you it's going to be a lot of talk around it.
3442890	3444210	Next slide, please.
3447470	3454510	But most importantly, I just have one main takeaway from this entire conversation with you guys.
3454630	3456430	Next slide, please.
3459930	3464210	I want to remind you that the change starts with you and me.
3464210	3468250	We must not give up. We must continue to fight for rights.
3468650	3474050	And it's so important that we do that, because it's just not Aaron Swartz's life that we need to do this for.
3474050	3476930	But there's so many other ones out there, too.
3477150	3485910	It's about time that we do whatever we can as a community, as a whole, as a collective, to come together and to do these things.
3485910	3490110	Because there are people working behind scenes, once again, for all these things.
3490110	3499650	But when you have a crowd of hundreds and hundreds of people pushing for something to change, then things change.
3499670	3505510	With numbers, things change. With pressure from numbers, things change.
3505510	3509750	But we cannot get there unless we get all of us in this together.
3509750	3516130	It doesn't mean the entire community, but we need at least a couple hundred of us to at least try to start changing things.
3516130	3524730	And all those takeaways and things and steps to do that you can do at this moment, you have more of the ability of doing so.
3524730	3526970	There should be nothing stopping you on this.
3526970	3533470	So if you are bothered by these outdated laws, and you're tired of how the public has perceived you,
3533470	3540670	and you feel like you are silenced at any sort of way because of the thing that you're passionate about,
3540670	3544850	then you need to act, too. You need to take the actions.
3544850	3550210	And if you feel uncomfortable or awkward about that, reach out to me. I am here for you.
3551210	3552850	Next slide, please.
3556350	3559210	All right, everyone. That is all my talk.
3559210	3563350	So I'm looking forward to doing the Q&A, and I'll put my camera on for that.
3563350	3571210	But I just want to say thank you guys so much for existing, for being who you are, and being part of this community.
3571250	3576610	I really do appreciate it. Thank you to Ethics Village for having me do this talk.
3576610	3584610	I want to give a special shout-out to Bo Woods and Harley Gager for providing further insight into the current situation
3584610	3590950	so I was able to have a better understanding of what are things that I could be missing in the presentation.
3592130	3596630	All right, I'll put my camera on, and I'm ready to take any questions that you guys may have.
3598350	3603230	So everybody, thanks to Chloe, again, for that really amazing talk.
3603230	3606330	That's something that I think is incredibly important.
3606330	3613930	Moving forward, while back in the day, hacking and everything was very niche in the early days of computerism,
3613930	3618510	I think more so nowadays, especially with all the breaches and things that are happening,
3618510	3621750	it's something that we really need to take seriously.