1
00:00:00,000 --> 00:00:01,340
Thank you so much.

2
00:00:01,340 --> 00:00:05,600
And hi everyone, good morning, good afternoon, good evening, wherever you are.

3
00:00:05,600 --> 00:00:07,260
I hope I got one of them right.

4
00:00:07,260 --> 00:00:10,480
So we're going to talk about how to get rights for hackers.

5
00:00:11,060 --> 00:00:13,360
And let's dive into it, shall we?

6
00:00:13,520 --> 00:00:15,000
First things first.

7
00:00:15,840 --> 00:00:29,660
I want to just let you guys know that this talk is completely dedicated to all the hackers who've been scared to disclose, to all the hackers who've been prosecuted for trying to do something good, and to all the people who are in the fight to bring rights for hackers.

8
00:00:31,900 --> 00:00:34,840
For those that don't know who I am, my name is Chloe Mazzotti.

9
00:00:34,840 --> 00:00:39,920
I am the VP of Strategy over at Point3 Security, and when I'm not there, I'm an ethical hacker advocate.

10
00:00:39,920 --> 00:00:47,540
I'm basically fighting for your rights, and then also trying to do whatever I can to improve our hacker community.

11
00:00:47,900 --> 00:00:54,940
I'm the president and co-founder of Wozzeck, which is Women of Security, and the founder WeAreHackers, formerly known as Women Hackers.

12
00:00:54,940 --> 00:01:02,820
I'm also the podcaster for ITSP Magazine, The Uncommon Journey, and when I'm not doing that, I'm also a Hacker Book Club organizer.

13
00:01:02,820 --> 00:01:09,240
Basically, we read a book about the hacker community or written by someone in the hacker community.

14
00:01:09,780 --> 00:01:14,540
And basically, we read a new book every month, and it's every Tuesday at 5 p.m.

15
00:01:14,540 --> 00:01:16,060
Pacific time when we meet.

16
00:01:16,060 --> 00:01:19,560
And yes, the author and people mentioned in the books do attend.

17
00:01:19,560 --> 00:01:24,620
Our upcoming one is going to be Tribe of Hackers and Red Team Edition, so you should come and join.

18
00:01:25,100 --> 00:01:30,620
That is my website, so feel free, if you want to know anything about me, it's most likely on there.

19
00:01:31,000 --> 00:01:40,120
And yes, my Twitter and Instagram, the DMs are always open, so if you do have other questions or anything like that, feel free to DM me at any time.

20
00:01:42,560 --> 00:01:45,860
So we're first going to dive into the current landscape.

21
00:01:45,860 --> 00:01:48,840
I know this is scary, but let's dive in it together.

22
00:01:49,560 --> 00:01:52,240
So first things first, Equifax.

23
00:01:52,380 --> 00:02:00,300
I would say usually raise your hand if the Equifax breach impacted you, but let's be real, let's just pretend, okay?

24
00:02:00,580 --> 00:02:09,940
But did you know a secure researcher warned Equifax that it was vulnerable to the kind of attack that later compromised the personal data of more than 147 billion Americans?

25
00:02:09,960 --> 00:02:12,100
And this was reported by Motherboard.

26
00:02:12,100 --> 00:02:23,680
Six months after the researcher first notified the company about the vulnerability, Equifax patched it, but only after the massive breach that made headlines had already taken place, according to Equifax on the timeline.

27
00:02:24,500 --> 00:02:29,120
But the real question is, but what if no one reported the breach?

28
00:02:29,820 --> 00:02:35,540
And it happens often because hackers don't report a breach due to the fear of prosecution.

29
00:02:35,680 --> 00:02:45,680
This statistic was discovered by the hard worker Amit Elzari, who knows our laws prevent good hackers from doing what they do best, protecting you and me and everyone we love.

30
00:02:45,680 --> 00:02:50,960
She has been spearheading this movement towards safe harbor, and that is her at the corner.

31
00:02:52,120 --> 00:02:54,720
So why are hackers scared?

32
00:02:54,880 --> 00:03:02,440
Well, besides prosecution, looking for contact information and reading the policies have been a burden to reporting vulnerabilities.

33
00:03:02,460 --> 00:03:03,400
Think about it.

34
00:03:03,400 --> 00:03:13,160
Sometimes when we find something we want to report, it can take hours, days, weeks, and then we get to a point like, what is, should I even keep trying at this point?

35
00:03:13,360 --> 00:03:18,740
To try to find the right contact information to disclose is a burden on you.

36
00:03:19,220 --> 00:03:31,920
This is why it's important to have like these vulnerability disclosure programs or bug bounty programs, because at least you feel like you have some sort of protection, and you know who to contact, you know the policies, you know what's in scope, what's out of scope,

37
00:03:31,920 --> 00:03:33,900
way ahead of the time.

38
00:03:34,900 --> 00:03:38,760
But I want to first dive into this case.

39
00:03:38,760 --> 00:03:44,840
So after DJI, the drone manufacturer recently launched a bug bounty program.

40
00:03:44,840 --> 00:03:50,840
Two researchers, Sean and Kevin, basically were looking at their scope.

41
00:03:51,200 --> 00:04:00,520
For the scope, the bug bounty program covers all the security issues in firmware, application, and servers, including source code leak, security workaround, privacy issues.

42
00:04:00,520 --> 00:04:04,920
Now, Kevin, he emailed them to confirm the scope to be safe.

43
00:04:04,920 --> 00:04:08,240
It took them two weeks to finally confirm the scope.

44
00:04:08,300 --> 00:04:13,360
He then reported the vulnerability, and he was provided with $30,000 for the finding.

45
00:04:13,360 --> 00:04:19,000
However, the agreement of receiving it offered no legal protection for him.

46
00:04:19,060 --> 00:04:23,980
So he did what most people should be doing, which is, he walked away.

47
00:04:24,260 --> 00:04:33,860
The revelations resulted in the company challenging the researcher's findings and seemingly threatening one with a lawsuit tied to the Computer Fraud Abuse Act, also known as CFA.

48
00:04:34,480 --> 00:04:40,300
They claimed that basically he went out of scope, regardless of the fact that he made sure to confirm the scope.

49
00:04:40,300 --> 00:04:46,180
In return, he posted the entire situation with all conversations with the DJI publicly.

50
00:04:46,400 --> 00:04:50,980
And if you see that link, you'll be able to see his blog to see what happened.

51
00:04:50,980 --> 00:05:08,380
I think one of the things, the best part that I read on there was there was this moment when DJI didn't know that when they respond to his email, there was an internal chain going on, basically saying he's putting them at risk, and they should do everything possible to prevent the risk,

52
00:05:08,380 --> 00:05:11,620
including lawsuits and bad PR for them.

53
00:05:12,260 --> 00:05:16,740
But this case, it did get dropped, and they did get bad PR for this.

54
00:05:19,220 --> 00:05:28,640
But language and what is in scope and or out of scope when disclosing or how to disclose can be so scary, and potential indictments, especially.

55
00:05:28,640 --> 00:05:30,920
It could keep all parties awake at night.

56
00:05:30,920 --> 00:05:35,160
And I know it has done for me, and I know that you probably too.

57
00:05:35,380 --> 00:05:41,020
But program managers, overall, they're always asking to be hacked, but not hacked badly.

58
00:05:41,020 --> 00:05:47,620
And how to conduct, handle situations when researchers report something is something that they need to work on too as well.

59
00:05:47,660 --> 00:05:55,780
But overall, organizations and governments all know it's probably needed at this time, as you can see on this slide.

60
00:05:57,020 --> 00:06:04,260
And I know, once again, this is a scary subject, and we're going to keep getting into the more scary, scary parts of the subject.

61
00:06:04,400 --> 00:06:06,960
But here are some puppies to lift your spirits.

62
00:06:07,000 --> 00:06:10,300
And yes, there is a picture for the cat lovers as well.

63
00:06:10,300 --> 00:06:13,260
So if you see the cat, bravo.

64
00:06:13,700 --> 00:06:16,000
And no, Sherlock and Luna is not on here.

65
00:06:16,720 --> 00:06:19,840
All right, so why are they scared?

66
00:06:19,840 --> 00:06:22,040
Let's dive into this a little bit more.

67
00:06:22,440 --> 00:06:27,840
Even though ethical hackers are not malicious actors, they're still being seen and treated as such by the public.

68
00:06:27,840 --> 00:06:35,560
And because of this, it reduces the chance of reporting vulnerability and can cause hackers to go to the dark side because they're seen as the same by the public.

69
00:06:35,820 --> 00:06:40,620
To the left is what you see when typing in criminal hackers, and to the right is ethical hackers.

70
00:06:40,800 --> 00:06:46,200
Once again, there's this dark hoodie darkness, sometimes with a ski mask.

71
00:06:46,800 --> 00:06:55,220
But I want to also point out that it's not just the imagery, it's also the language used in the media, seen as in marketing and press.

72
00:06:55,220 --> 00:06:58,340
So anytime I say media, it's marketing and press.

73
00:06:58,340 --> 00:07:01,060
And marketing could be even for infosec companies.

74
00:07:01,060 --> 00:07:02,640
You find this often.

75
00:07:03,040 --> 00:07:08,180
Using the term hacker as someone who is seen as a criminal is incorrect.

76
00:07:08,300 --> 00:07:13,460
They should be using the term attacker, cyber criminal, malicious actor, and so on.

77
00:07:13,900 --> 00:07:18,180
Unless they're reporting something good about us, then they can definitely do a hacker thing.

78
00:07:19,100 --> 00:07:24,200
So you're probably wondering, how does this imagery and language impact us?

79
00:07:24,200 --> 00:07:29,780
It continues to feed the fear and stereotypes, the biases that exist through social construction.

80
00:07:30,600 --> 00:07:38,220
And of course, if you have attended any of my talks before, I am obsessed with the brain, so we're going to talk about the brain today.

81
00:07:38,460 --> 00:07:43,620
So what is really important is to understand how fear works in your brain.

82
00:07:43,820 --> 00:07:46,820
So first of all, I want you to take a look at this.

83
00:07:46,900 --> 00:07:58,700
So fear is usually based around your amygdala, which is like this almond shaped, and it's the size of an almond, believe it or not, inside your brain within the temporal lobe.

84
00:07:58,760 --> 00:08:02,580
It is the part where your emotions are attached to memories.

85
00:08:02,800 --> 00:08:10,160
So for example, if you have a nightmare, you're going to recall it a little bit more because a strong emotion was attached to it.

86
00:08:10,300 --> 00:08:20,160
Versus if it's just a regular dream, you might not remember it, but you will always remember a dream where it is extremely happy or extremely scary.

87
00:08:20,520 --> 00:08:22,040
So think of that.

88
00:08:22,040 --> 00:08:26,940
Anyway, the thing that you might know about the amygdala is usually the fight versus flight mechanism.

89
00:08:27,140 --> 00:08:43,040
And what I really want to explain is fight versus flight mechanism is a great way to showcase what the amygdala is, but it also is this part of you that's subconscious, and it decides what's like you, who's not like you.

90
00:08:43,040 --> 00:08:50,160
And based on that belief itself, you put people into categories of people to trust, people not to trust.

91
00:08:50,260 --> 00:09:03,360
And so for example, the amygdala, because it's stored in your memory section of your brain, it's also dictating subconsciously whatever socially constructive beliefs that you've had.

92
00:09:03,360 --> 00:09:06,140
And if you're wondering, what is a socially constructive belief?

93
00:09:06,500 --> 00:09:24,780
It's just any time when you were growing up or, you know, you had a teacher tell you that this is unsafe, your parents tell you that's not safe, or like anything that you've seen in movies, TV, indirectly, it's letting you know some memory for you to hold on to.

94
00:09:25,140 --> 00:09:28,420
Now, I want to give you kind of a better example here.

95
00:09:28,420 --> 00:09:32,280
So I always tell people, think about this way.

96
00:09:32,280 --> 00:09:35,460
You were growing up and you watched a bunch of movies as a kid.

97
00:09:35,460 --> 00:09:41,380
And every time someone had pink hair, they were the criminal, the villain in it.

98
00:09:41,620 --> 00:09:48,240
And not just that, but also you see on the news, people with pink hair are dangerous individuals, they're committing all the crimes.

99
00:09:48,240 --> 00:09:56,500
You read in textbooks, you read from teachers' letters, you read everything just showcasing that people with pink hair are dangerous.

100
00:09:56,740 --> 00:10:10,020
So when you see someone with pink hair at this point, you will probably clutch your bag a little bit closer, or you might cross the street, or you might actually lock your car doors when you see someone with pink hair.

101
00:10:10,440 --> 00:10:14,560
And I know that sounds like, but the person just has pink hair could.

102
00:10:14,980 --> 00:10:21,620
The thing is that you have been led to believe that someone with pink hair is someone dangerous.

103
00:10:22,080 --> 00:10:24,740
And that's a socially constructive belief.

104
00:10:24,880 --> 00:10:30,340
And the amygdala will always act on socially constructive beliefs when it comes to survival.

105
00:10:30,340 --> 00:10:36,680
So if it's known that someone with pink hair is dangerous, thus you will react in the same way.

106
00:10:37,980 --> 00:10:42,160
So the good news though is that it has to verify.

107
00:10:42,160 --> 00:10:45,200
So the prefrontal cortex acts kind of like the CEO in the brain.

108
00:10:45,380 --> 00:10:47,900
So this is completely conscious now.

109
00:10:47,900 --> 00:10:54,240
So what happens is the amygdala sends a message saying, warning, someone with pink hair is right behind you.

110
00:10:54,320 --> 00:11:11,620
And then your prefrontal cortex thinks, okay, I can either cross the street, or I can go into a building, or I can clutch my bag a little bit closer, or I can look behind me to be on top of everything, or I just ignore the threat.

111
00:11:11,960 --> 00:11:21,200
So the prefrontal cortex then, you decide which action to take, and it sends the message back to the amygdala to act on that action.

112
00:11:21,320 --> 00:11:28,660
But the one thing to note about is that you are completely conscious about it, and you're making that decision.

113
00:11:28,720 --> 00:11:33,360
But the good news is that there's still this validation.

114
00:11:33,360 --> 00:11:39,500
So people's biases, socially constructed beliefs, or whatnot, can always be challenged.

115
00:11:39,720 --> 00:11:43,720
And the best way how to do with that is through stories, hearing people's personal stories.

116
00:11:43,720 --> 00:12:01,860
So for example, in the same pink hair situation, if the person with pink hair made a YouTube video talking about how it's so terrible for them, because every time someone sees them, they see them as a criminal, and how that prevents them getting a job,

117
00:12:01,860 --> 00:12:18,240
how that prevents them getting where they need to go, how, for example, cops are called on them just for being outside, and how society as a whole isn't doing enough to understand that it's just because the person has pink hair.

118
00:12:18,240 --> 00:12:20,900
There's nothing else than that.

119
00:12:21,360 --> 00:12:36,220
So now if you put in a lens of a hacker, you probably have experienced once or twice, where when you tell someone you're a hacker, or you work in the hacker community, the next thing you know is that they take a step back, or the mouth kind of drops, or their eyes get bigger.

120
00:12:36,220 --> 00:12:37,780
They just get afraid.

121
00:12:37,780 --> 00:12:47,400
Because the thing is, is that our world has been socially constructed to see hackers as criminals, as a blanket for all hackers.

122
00:12:47,400 --> 00:12:55,900
And instead of thinking them as not just hackers, there's a difference between a hacker and an attacker, because they haven't learned that yet.

123
00:12:55,900 --> 00:12:59,520
And because our personal stories are not really out there yet either.

124
00:12:59,520 --> 00:13:01,500
And that's the problem.

125
00:13:04,220 --> 00:13:17,240
So what happens is, for the hacker situation, is that because of the mindset set by society, by people in the media, that's keeping us unsafe and preventing hackers what they do well in.

126
00:13:17,280 --> 00:13:26,060
Companies are afraid of hackers and don't want to create vulnerability disclosure policies because of the lack of a bilateral trust amongst hackers and organizations and government.

127
00:13:26,060 --> 00:13:29,340
It's one of the reasons why 60% do not report vulnerabilities.

128
00:13:29,340 --> 00:13:33,760
Hackers are scared of outdated laws such as CFA and DMCA.

129
00:13:33,800 --> 00:13:44,060
Also from interviewing attackers, one of the reasons they decide to move away from ethical hacking is the pay and the constant worrying of being prosecuted regardless if they did something legal.

130
00:13:44,060 --> 00:13:49,220
This is stated also similarly by those who switch from being an attacker to a hacker.

131
00:13:49,220 --> 00:13:52,340
The reason they switched was the insomnia of being arrested.

132
00:13:52,340 --> 00:13:58,500
Because there are cases when organizations prosecute ethical hackers regardless if they were in scope.

133
00:14:00,900 --> 00:14:07,260
So which leads us to needing to dive into the current legislation that can be found in most countries towards hackers.

134
00:14:07,260 --> 00:14:09,520
And this is worldwide legislation.

135
00:14:09,800 --> 00:14:19,460
So every country around the world has anti-hacking laws, anti-circumvention laws, also known as copyright type of laws, acceptable use policy.

136
00:14:19,720 --> 00:14:23,000
So let's first dive into the Computer Fraud Abuse Act.

137
00:14:23,220 --> 00:14:26,260
And every country has their own, but the U.S.

138
00:14:26,260 --> 00:14:28,820
is the first one I think who put it first.

139
00:14:28,820 --> 00:14:30,520
So let's dive into that one.

140
00:14:30,520 --> 00:14:32,680
The Computer Fraud Abuse Act in the U.S.

141
00:14:32,680 --> 00:14:42,740
cybersecurity bill that was enacted in 1984 as an amendment to existing computer fraud law, which has been included in the Comprehensive Crime Control Act of 1984.

142
00:14:43,040 --> 00:14:48,760
The law prohibits accessing a computer without authorization or in excess of authorization.

143
00:14:48,760 --> 00:14:54,160
Also to be used when a researcher tends to go out of scope, this act is used to prosecute hacking.

144
00:14:54,820 --> 00:14:58,880
Random fact, who here has heard of war games?

145
00:14:59,020 --> 00:15:05,140
Okay, did you know that Ronald Reagan, he watched it and freaked out about hackers and he's like, we gotta do something!

146
00:15:05,140 --> 00:15:07,360
So he pushed for CFA to happen.

147
00:15:07,900 --> 00:15:11,520
Now let's dive into anti-circumvention laws, so the copyright laws.

148
00:15:11,520 --> 00:15:15,500
So in Canada you have the copyright law, believe it or not, super easy.

149
00:15:15,500 --> 00:15:16,340
In the U.S.

150
00:15:16,340 --> 00:15:21,740
we have the DMCA, the Digital Millennium Copyright Act, and it was enacted in 1998.

151
00:15:21,780 --> 00:15:22,180
The U.S.

152
00:15:22,180 --> 00:15:28,780
copyright law that implements two 1996 treaties of World Intellectual Property Organization, WIPO.

153
00:15:28,900 --> 00:15:30,340
Basically it's the right to repair.

154
00:15:30,340 --> 00:15:33,760
Reverse engineering is seen as a breach of property.

155
00:15:34,320 --> 00:15:36,620
Let's dive into acceptable use policy.

156
00:15:37,040 --> 00:15:39,640
Now who here has ever read their terms and conditions?

157
00:15:39,640 --> 00:15:42,020
Say, for example, an Apple product.

158
00:15:42,020 --> 00:15:46,860
So I got trapped, I tried it, I got really bored, and I decided to watch a movie instead.

159
00:15:46,860 --> 00:15:49,380
But in general, they can be long and too much verbiage.

160
00:15:49,380 --> 00:15:52,700
It can confuse anyone, especially if English is not their first language.

161
00:15:52,700 --> 00:15:54,720
And you're not an attorney.

162
00:15:54,720 --> 00:15:56,540
I'm not an attorney, by the way.

163
00:15:56,660 --> 00:16:03,340
But the thing is, is that this can lead to some serious miscommunication issues for ethical hackers that don't really speak English.

164
00:16:03,900 --> 00:16:08,460
Clearly these laws' overall takeaway is they're old and out of date.

165
00:16:08,460 --> 00:16:10,560
And honestly, they were created out of fear.

166
00:16:10,560 --> 00:16:12,800
And you know now about fear.

167
00:16:13,020 --> 00:16:23,960
By not having empathy or taking the time to understand what is actually needed and why laws should only prosecute malicious actors, aka criminals, and not good hackers.

168
00:16:23,960 --> 00:16:32,400
Because at that time, and still to this day, a lot of legislators and politicians still don't know that hackers are good people.

169
00:16:32,400 --> 00:16:37,900
There's a difference between a malicious actor, an attacker, a cyber criminal, and a hacker.

170
00:16:39,580 --> 00:16:45,880
Overall takeaway from here is that there are laws that prevent good hacking in the same way that they prevent attackers.

171
00:16:45,980 --> 00:16:50,520
And we need good hacking, especially during COVID-19, you guys.

172
00:16:51,680 --> 00:17:00,180
And I really hate the CFA, and I want to dive a little bit further into it, just for you to know, in case you don't know.

173
00:17:00,200 --> 00:17:16,120
So the Computer Fraud Abuse Act, once again, was passed in 1984, is grown wildly outdated in that it offers prosecutors discretion to threaten huge potential fines and jail sentences for relatively undisturbing violations of computer policy.

174
00:17:16,960 --> 00:17:27,720
First, the CFA was written, punishes exceeding authorized access to a protected computer, a phrase vague enough to inspire some broad interpretations.

175
00:17:27,860 --> 00:17:34,320
Another flaw in the CFA is the redundant provisions that enable a person to be punished multiple times for the same crime.

176
00:17:34,320 --> 00:17:42,040
These crimes can be stacked one on top of another, resulting in a threat of a higher cumulative fines and jail time for the exact same violation.

177
00:17:42,340 --> 00:17:51,540
This also allows prosecutors to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a single, solitary act.

178
00:17:51,540 --> 00:17:54,360
It also plays a significant role in sentencing.

179
00:17:54,360 --> 00:18:10,700
This ambiguity of provision meant to toughen sentencing for repeat offenders in the CFA may, in fact, make it possible for defendants to be sentenced based on what should be prior convictions, but were nothing more than multiple convictions for the same crime.

180
00:18:10,780 --> 00:18:15,700
And this is why it's now important for us to talk about Aaron Swartz's case.

181
00:18:17,080 --> 00:18:23,220
For those that do not know Aaron Swartz's case, it basically started off in 2011.

182
00:18:23,220 --> 00:18:24,760
Carmen Ortiz, the U.S.

183
00:18:24,760 --> 00:18:32,140
Attorney Office, charged Swartz with hacking into the MIT computer network to download millions of scholarly articles from JSTOR.

184
00:18:32,200 --> 00:18:38,420
An act of civil disobedience meant to protest the restricted access to research funded by taxpayers.

185
00:18:38,560 --> 00:18:39,580
For this, the U.S.

186
00:18:39,580 --> 00:18:45,820
Attorney brought charges that carried a maximum penalty of 35 years in prison and $1 million in fine.

187
00:18:45,820 --> 00:18:48,320
I want to pause there, because think about that.

188
00:18:48,320 --> 00:18:53,160
35 years in prison for downloading articles?

189
00:18:53,520 --> 00:18:57,800
You know, first degree murder, life in prison?

190
00:18:57,800 --> 00:19:04,100
No, it's actually on 25 years, and yet he was facing 35.

191
00:19:05,620 --> 00:19:16,420
Going back to this, they were able to charge such years because of the way CFA is run and the issues that have yet to be sorted since it was made into a law.

192
00:19:16,780 --> 00:19:22,180
But overall, looking at Aaron's situation, you have to understand what he was going through.

193
00:19:22,380 --> 00:19:30,140
He was dealing with a 17-month legal battle, one that had no set trial date and wasn't ending anytime soon.

194
00:19:30,140 --> 00:19:34,040
And through Swartz's perspective, it must have been so overwhelming.

195
00:19:34,640 --> 00:19:45,380
And it was the future of this legal battle that cast into doubt that Swartz unfortunately hung himself in his apartment on January 11, 2013.

196
00:19:45,620 --> 00:19:49,220
And following his death, the federal prosecutors went on to drop the charges.

197
00:19:49,540 --> 00:19:54,980
His family said that the government's prosecution contributed to his decision to take his own life.

198
00:19:56,320 --> 00:20:04,000
In memory, and for what he went through, unfortunately, there was Aaron's Law.

199
00:20:04,000 --> 00:20:11,580
It didn't pass because a probably lobbyist, very heavy corporate lobbyist, didn't want it to pass.

200
00:20:11,580 --> 00:20:32,600
But what Aaron Law removes, the phrase exceeds authorized access and replaces it with access with authorization, which is defined as to obtain information on a computer that the accessor lacks authorization to obtain by not only circumventing technological or fiscal measures designed to prevent unauthorized individuals from obtaining that information.

201
00:20:32,600 --> 00:20:42,620
The other thing is that it would ensure people won't face criminal liability for violating the terms of service agreement and contracted agreements, but also limits penalties.

202
00:20:42,620 --> 00:20:45,000
In other words, there was no more duplicated charges.

203
00:20:45,000 --> 00:20:48,520
So no more stack on stack what Aaron went through.

204
00:20:50,740 --> 00:21:05,000
And with improvements to legislation, so to CFA, DMCA, with these changes, then we can have what we need today.

205
00:21:05,680 --> 00:21:09,940
And that is, we need to also talk about the other parts.

206
00:21:09,940 --> 00:21:15,860
So not only legislation, so we cover legislation, we talked about the media, the press, and whatnot.

207
00:21:15,860 --> 00:21:20,140
We also talked about organizations named vulnerability disclosure programs.

208
00:21:21,460 --> 00:21:32,000
And I want to dive into those three categories a little bit more because in order to have any rights or to get any public change, we have to work with three categories.

209
00:21:32,900 --> 00:21:36,420
So in order to have rights for hackers, we need to get the public on board.

210
00:21:36,420 --> 00:21:42,520
And in order to do so, we need to dive into organizations, legislation, and media.

211
00:21:42,820 --> 00:21:46,240
We need media to push for public to become aware.

212
00:21:46,240 --> 00:21:56,000
In other words, we need to change the language and imagery of a hacker and start using the term cybercriminals for those who commit unethical hacking over really separate the two groups.

213
00:21:56,160 --> 00:22:06,600
In order to help the press, organizations need to be on board with bilateral trust, with having vulnerability disclosure programs, by showing they support hackers, the public changes their view in general.

214
00:22:07,040 --> 00:22:16,020
Lastly, to have organizations and public opinion to push and motivate Capitol Hill to get on board and update the current legislation that will protect ethical hackers.

215
00:22:16,020 --> 00:22:21,520
Overall, we need all three to be supporting hacker rights for it to become a reality.

216
00:22:22,580 --> 00:22:24,280
So how do we get there?

217
00:22:24,280 --> 00:22:25,760
You're probably wondering.

218
00:22:26,200 --> 00:22:29,240
So these are the five needs.

219
00:22:29,240 --> 00:22:35,160
And this is the way how we can push for awareness of ethical hackers needing rights.

220
00:22:35,280 --> 00:22:39,220
Now, how we get there, I'm going to need your help.

221
00:22:39,380 --> 00:22:50,620
Overall, we need to work with the media, we need society to notice that we're everyday heroes, we need organizations to have a vulnerability disclosure program, and we need representatives to update today's legislation.

222
00:22:51,160 --> 00:22:55,420
But how we do that, we have to change the imagery that the press is doing too.

223
00:22:56,740 --> 00:23:07,080
So the first step is this petition is for anyone out there that supports ethical hackers and want to bring about a change is the first step that I'm working on to bring attention to this matter.

224
00:23:07,080 --> 00:23:09,360
And we have over 1000 signatures.

225
00:23:09,680 --> 00:23:16,340
And honestly, it's really it's broken down by organizations, legislators, and the media and the hacker community.

226
00:23:16,340 --> 00:23:18,900
And anyone can sign this who agrees with it.

227
00:23:18,900 --> 00:23:22,960
So you can also share it around and sign it yourself.

228
00:23:23,040 --> 00:23:24,720
And it could be friends and family.

229
00:23:24,720 --> 00:23:27,240
It doesn't have to be everyone has to be a hacker who signs this.

230
00:23:27,240 --> 00:23:30,840
It could be anyone who believes that we deserve rights.

231
00:23:31,680 --> 00:23:35,500
The second step, tell the press.

232
00:23:35,680 --> 00:23:51,620
So anytime you see the press reporting hackers in a bad light, correct them, write a comment below in the story, tag them in a tweet, letting them know the term is actually cyber criminal and attacker, not hacker.

233
00:23:51,620 --> 00:23:53,100
Hacker are good people.

234
00:23:53,100 --> 00:23:55,080
So you need to do that.

235
00:23:55,080 --> 00:24:04,260
The other thing is calling them out when they use the dark hoodie imagery, or the ski mask, which is still to my mind is the worst thing ever.

236
00:24:05,220 --> 00:24:07,060
We need to do fact checks.

237
00:24:07,060 --> 00:24:12,860
And that's how you do it is unfortunately, you kind of have to publicly shame them till they get it right.

238
00:24:13,660 --> 00:24:28,560
And also, if you're someone who is interviewed by any journalist or anything like that, please make sure to keep enforcing them and let them know to use the term attacker versus hacker when reporting a breach.

239
00:24:28,680 --> 00:24:32,620
I've been doing that since I can do it.

240
00:24:32,840 --> 00:24:37,520
But it's going to take all of us and Chris Roberts has been great also doing that kind of stuff.

241
00:24:37,520 --> 00:24:44,040
So push out there, let them know they got the wrong term and the wrong imagery.

242
00:24:44,280 --> 00:24:46,660
So basically, everyone gets a fact check.

243
00:24:48,340 --> 00:24:52,780
The third step is the push for organizations to partner and campaign with us.

244
00:24:52,780 --> 00:25:12,060
We need companies, we need orgs to come out, even government agencies can too, basically to come out publicly saying like, we stand with the ethical hackers, and it's time to change things or to push for vulnerability disclosure programs to other companies,

245
00:25:12,060 --> 00:25:13,800
organizations and so on.

246
00:25:13,800 --> 00:25:17,920
So they're also aware of that this is a need now at this point.

247
00:25:18,400 --> 00:25:34,380
Also to push for organizations to have a like I just said, it's really important that we do that because I am so tired of having to spend hours, days and weeks to find some information of who to contact and what's in scope, what's not in scope.

248
00:25:34,380 --> 00:25:35,520
This is so important.

249
00:25:35,520 --> 00:25:42,900
Every company should have that at this point, because they need us more than ever before.

250
00:25:43,980 --> 00:25:48,960
The fourth step, contact your local representatives to update current legislation.

251
00:25:48,960 --> 00:26:03,700
So let them know that they need to change something, set up 10 minute appointments virtually, or try whatever you can to work with other groups of people that want to volunteer to go and approach representatives.

252
00:26:03,700 --> 00:26:12,640
And especially the ones that you need to be focusing on is your local and state because those are the ones that we're having some serious problems with.

253
00:26:13,160 --> 00:26:17,080
And also last but not least, follow the Van Buren U.S.

254
00:26:17,080 --> 00:26:17,960
case.

255
00:26:18,240 --> 00:26:23,060
And there's a reason for that in the fall the CFA is going to be revisited in Supreme Court.

256
00:26:23,060 --> 00:26:28,420
So please take a look at it, follow it, and also contact your representatives around it.

257
00:26:29,320 --> 00:26:33,220
The fifth step, support wonderful groups like this.

258
00:26:33,220 --> 00:26:40,760
So I'm the Calvary Disclosed.io, CERT Coordination Center, CERT CC, EFF and CTI League.

259
00:26:40,760 --> 00:26:49,560
It's really, that we work together and support one another and contact them to find out how they can do better or how you can help.

260
00:26:50,120 --> 00:27:00,440
So main takeaways overall, we need to push for awareness of ethical hackers and to let people know how we really are and our stories matter and how we get there.

261
00:27:00,440 --> 00:27:05,880
These are the main takeaways and I might need your advice and assistance if you want some.

262
00:27:06,400 --> 00:27:11,520
But most importantly, I want to remind you that the change starts with you and me.

263
00:27:11,520 --> 00:27:20,640
It's never too late and we must not give up because we must continue to fight for rights and this is a time that we do so.

264
00:27:22,020 --> 00:27:28,480
I want to first say thank you guys, everyone at IoT Village for selecting my talk to be a keynote.

265
00:27:28,480 --> 00:27:31,200
I want to also thank you guys for participating.

266
00:27:31,200 --> 00:27:32,940
So thank you all for existing.

267
00:27:32,980 --> 00:27:38,000
I also want to give a big shout out to Bo Woods and Harley Geiger.

268
00:27:38,100 --> 00:27:43,980
They helped basically put more ideas in my head for this conversation.

269
00:27:44,180 --> 00:27:47,780
Thank you guys so much and thank you IoT Village once again.

270
00:27:47,780 --> 00:27:52,260
Thank you guys for assisting and please stay safe and enjoy the rest of your DEF CON weekend.