WEBVTT 00:13.140 --> 00:15.660 Welcome to Between Two Nerds. 00:15.700 --> 00:17.500 My name is Brett Goldstein. 00:17.500 --> 00:20.160 I'm the Director of the Defense Digital Service. 00:20.500 --> 00:21.680 And I'm Will Roper. 00:21.680 --> 00:25.260 I run all of the Air Force and Space Force programs. 00:25.260 --> 00:29.020 And we would like to introduce Roro, our moderator today. 00:29.360 --> 00:34.340 Roro is a member of the Defense Digital Service and has mad security skills. 00:34.340 --> 00:39.180 First things first, I wanted to ask you all the question that I've reached out to a bunch of hackers in the community about. 00:39.200 --> 00:44.160 And the most important thing that's on their minds right now is how do you attach the lanyard to the cassette tape? 00:44.160 --> 00:45.580 Well, that's a question for Dr. 00:45.580 --> 00:46.400 Roper, I think. 00:46.880 --> 00:47.660 Dr. 00:47.660 --> 00:50.200 Roper, considering your advanced work in this space... 00:51.960 --> 00:55.120 Well, I mean, first of all, there's a design issue here. 00:55.120 --> 00:59.480 So, whoever did this, you're fired if you're on the Air Force. 00:59.880 --> 01:06.060 Thing two, there's no place to immediately hook it, so I'd say we just tie it. 01:06.060 --> 01:12.580 We just tie it here, and then we hang it around her neck and get a better cassette next year, whoever did this. 01:12.580 --> 01:14.560 Do you have the duct tape? 01:14.560 --> 01:17.900 I mean, basically, if you have a small neck, you're okay. 01:18.580 --> 01:20.380 Like an actual duck. 01:20.380 --> 01:22.740 I could wear this if you don't have duct tape. 01:23.140 --> 01:29.480 So the other question that has also been on their minds is why are you all here at DEFCON Safe Mode? 01:29.680 --> 01:33.940 Sure, well, I mean, you had incriminating evidence on me, so I'm here. 01:34.580 --> 01:37.500 We're going to try to go flat the whole time, Roro. 01:37.500 --> 01:43.480 This is Between Two Nerds, after all, the inaugural shooting, so no laughter, no fun. 01:43.480 --> 01:44.740 This is serious business. 01:44.740 --> 01:47.080 We're hoping to be syndicated. 01:47.480 --> 01:48.440 Eventually. 01:49.360 --> 01:53.440 We can't afford firms yet, but we're headed towards that next step. 01:53.440 --> 01:56.900 Roro, we need a bit more of a positive attitude on this. 01:56.900 --> 02:01.840 Like, as we think about sort of our future careers, there seems to be a lot of potential. 02:01.840 --> 02:04.080 Row cubed today, Roro. 02:04.080 --> 02:12.980 So, Roro, in all seriousness, because we're being serious here on Between Two Nerds, satellite security is a big deal. 02:13.260 --> 02:15.320 All joking aside, it's a big deal. 02:15.320 --> 02:22.780 Our lives depend on space working in a benign, peaceful way that makes life better for everyone. 02:22.780 --> 02:26.120 You need it for the data that's coming to your phone right now. 02:26.120 --> 02:27.760 You need it for navigation. 02:27.760 --> 02:30.720 You even need it to get cash out of an ATM. 02:30.720 --> 02:35.420 Everyone's lives as we sit here today is connected to space. 02:35.520 --> 02:38.540 Well, you can imagine the military is no exception. 02:38.580 --> 02:40.300 We're connected to space. 02:40.300 --> 02:46.740 We use it to move planes from point A to point B, to guide weapons, to plan disaster relief missions. 02:46.740 --> 02:48.520 Everything we do. 02:48.720 --> 03:00.700 So, if you're thinking about a way to beat our military, holding space assets at risk is a pretty easy way to take a big leap forward in terms of your capabilities. 03:00.720 --> 03:05.560 And so, we want to know if cyber is something we need to put more worry into. 03:05.560 --> 03:10.220 So, we're here to see if people can hack a satellite, which we think they'll be able to. 03:10.220 --> 03:16.440 And we hope to learn from the community how to be better and more cyber resilient in systems we build in the future. 03:17.400 --> 03:24.120 As an international community of hackers and nerds, how can they help out? 03:24.120 --> 03:26.160 What is the call to action here if there is one? 03:26.160 --> 03:26.920 Sure, Rowan. 03:26.920 --> 03:28.100 I'm going to try to stay flat. 03:28.100 --> 03:30.500 But boy, it's really hard because I'm excited about this. 03:30.660 --> 03:32.560 Anyway, back to Between Two Nerds. 03:32.800 --> 03:35.640 Just being here and being interested is a huge deal. 03:35.640 --> 03:37.120 We want to learn from you. 03:37.120 --> 03:39.060 The military is here to learn. 03:39.980 --> 03:47.920 Historically, we have been secure by hiding behind our fence lines and keeping systems secret until they're used on the battlefield. 03:47.920 --> 03:49.620 Well, that doesn't work anymore. 03:49.680 --> 03:55.820 Software is increasingly the delineator in whether systems are dominant or out of the fight. 03:56.160 --> 04:05.880 So we're getting outside of our fence lines and involving communities that can help us, like DEFCON, to see if we need to up our game in cyber. 04:05.980 --> 04:17.340 And so if our satellites have to operate to make the military work the way it's supposed to, we want to expose opportunities to hack them ahead of us taking them into conflict. 04:17.340 --> 04:26.980 So what I hope to learn from DEFCON, from all the amazing community members here, is how good we are today and what we need to do to be better in the future. 04:27.020 --> 04:34.080 So the Department of Defense historically has operated cybersecurity through obscurity. 04:34.080 --> 04:38.100 And that is a culture that we're trying to change. 04:38.100 --> 04:44.940 So I'm fortunate I run the Defense Digital Service, which is affectionately known as a SWAT team of nerds. 04:44.940 --> 04:53.180 And we are out there and we are trying to bring the very best in technical talent to the DoD. 04:53.180 --> 04:58.120 And part of that is about technology, but part of it is about culture. 04:58.120 --> 05:09.900 So when Will and I went to DEFCON last year, I'd been attending DEFCON for many years, but I brought Will and I said to him, this is a community we need to embrace. 05:09.900 --> 05:15.180 And one, DoD does not need to be afraid of this community. 05:15.180 --> 05:17.580 These are folks who we should be friends with. 05:17.580 --> 05:20.660 But two, we need to raise our bar. 05:20.660 --> 05:22.800 We need to challenge our software. 05:22.800 --> 05:25.460 We need to try and test our systems. 05:25.460 --> 05:28.880 And by doing that, we bring the very best in cybersecurity. 05:29.040 --> 05:31.760 So I love this partnership. 05:31.940 --> 05:33.260 We learn a lot. 05:33.260 --> 05:34.660 We challenge ourselves. 05:34.660 --> 05:39.600 Sometimes we learn things that are hard, but this is a community we really want to embrace. 05:39.900 --> 05:45.700 Can you tell me a little bit more about how you got involved with the space or what was the initial ask? 05:45.700 --> 05:50.460 So the first time I went to DEFCON, I was by myself. 05:50.580 --> 05:57.900 And I had recently left my first stint in government and people were like, you have to go to DEFCON. 05:57.900 --> 06:00.300 And I went there and I'm like, holy shit. 06:00.300 --> 06:02.480 I'm like, there's a gazillion people here. 06:02.480 --> 06:03.980 There are crazy things going on. 06:03.980 --> 06:06.000 And people said, don't bring a phone in. 06:06.000 --> 06:10.260 And I was completely enamored with this community. 06:10.260 --> 06:12.080 And then I came to DoD. 06:12.080 --> 06:29.600 And as we're trying to change this culture, which is a obscurity culture, a security by checklist, I'm like, this is a community that can help make us smarter and help us again, raise the bar even against ourselves. 06:29.600 --> 06:44.440 So by bringing Will and then showing all of the crazy cool things that we're doing, it allowed for that DDS Air Force relationship, which we could then come back and try and do some really cool things. 06:44.620 --> 06:53.480 And the funny part was last year, when DEFCON was winding up, I go to Will, I'm like, we should go back. 06:53.480 --> 06:55.280 And Will's like, yeah, we should go back. 06:55.280 --> 06:57.160 And I'm like, what do you think we should do? 06:57.160 --> 07:00.840 And dude's like, we should bring a satellite. 07:00.900 --> 07:02.340 And that was crazy. 07:02.340 --> 07:03.820 But now it's real. 07:03.920 --> 07:09.520 Yeah, it's great when crazy and real can be the same inside the Pentagon. 07:09.600 --> 07:17.880 And Brett's exactly right, that this is a community that the department and the Pentagon have been afraid of embracing. 07:17.880 --> 07:22.600 Partly because it's an old Cold War culture that's just behind the times. 07:22.600 --> 07:28.900 And another is simply because it doesn't get outside of its five sided walls very often. 07:28.900 --> 07:31.900 And my first trip to DEFCON was amazing. 07:31.900 --> 07:34.160 I'm a string theorist by background. 07:34.160 --> 07:35.360 I work in physics. 07:35.360 --> 07:38.660 I crossed over into defense for really weird reasons. 07:38.660 --> 07:47.680 But it's been an awesome job of getting to run $60 billion of satellites and airplane and cyber capabilities every year. 07:47.680 --> 07:54.200 As I look at this amazing portfolio of programs, everything is driven by software. 07:54.360 --> 08:08.180 And the United States government and our amazing men and women in uniform have put so much time and treasure into these amazing military systems that increasingly operate based on their software. 08:08.180 --> 08:17.080 So if you're looking to defeat us, you don't have to recreate the same systems, build a fighter to match ours, build a satellite to match ours. 08:17.080 --> 08:19.140 You just need to be able to hack us. 08:19.200 --> 08:35.140 And so I came last year wanting to see could people who have a great amount of expertise but not a lot of hands-on capability inside the military get inside a system like an F-15 fighter or the systems that enable it. 08:35.140 --> 08:39.640 And so we brought some of those enabling systems and the hacker community got in. 08:39.640 --> 08:42.300 But getting in was not the point of being here. 08:42.300 --> 08:45.340 It was the learning that happened afterwards. 08:45.340 --> 08:52.780 The hacker community got to learn something about our military systems and we left knowing how to make them more secure. 08:52.860 --> 08:55.360 And so we want to do the same thing for satellites. 08:55.360 --> 09:01.360 It's a very different problem than handing you a piece of hardware and saying, can you get in? 09:01.360 --> 09:06.480 The satellite isn't here, it's overhead, moving at 7 kilometers a second. 09:06.480 --> 09:14.000 And it only talks to the ground at certain places where we have a ground station that uplinks and downlinks different commands. 09:14.000 --> 09:17.640 This is a wicked hard problem. 09:17.800 --> 09:21.180 But I expect the DEFCON community is going to get in again. 09:21.180 --> 09:24.640 And the question we're going to ask is what should we learn? 09:24.640 --> 09:26.160 What should we do better? 09:26.160 --> 09:32.160 Because cyber is something any country, any terrorist group can try to do against our military. 09:32.160 --> 09:37.380 It's quicker, easier, and more seductive than trying to take us head on. 09:37.380 --> 09:42.360 So this dark side of the force is something we're going to have to be able to defeat. 09:42.460 --> 09:45.300 And we're here to learn from people who know a lot more than we do.