Thank you so much. And hi everyone, good morning, good afternoon, good evening, wherever you are. I
hope I got one of them right. So we're going to talk about how to get rights for hackers.
And let's dive into it, shall we? First things first. I want to just let you guys know that
this talk is completely dedicated to all the hackers who've been scared to disclose,
to all the hackers who've been prosecuted for trying to do something good, and to all the
people who are in the fight to bring rights for hackers. For those that don't know who I am,
my name is Chloe Mazzotti. I am the VP of Strategy over at Point3 Security, and when I'm not there,
I'm an ethical hacker advocate. I'm basically fighting for your rights, and then also trying
to do whatever I can to improve our hacker community. I'm the president and co-founder
of Wozzeck, which is Women of Security, and the founder WeAreHackers, formerly known as Women
Hackers. I'm also the podcaster for ITSP Magazine, The Uncommon Journey, and when I'm not doing that,
I'm also a Hacker Book Club organizer. Basically, we read a book about the hacker community or
written by someone in the hacker community. And basically, we read a new book every month,
and it's every Tuesday at 5 p.m. Pacific time when we meet. And yes, the author and people
mentioned in the books do attend. Our upcoming one is going to be Tribe of Hackers and
Red Team Edition, so you should come and join. That is my website, so feel free, if you want to
know anything about me, it's most likely on there. And yes, my Twitter and Instagram, the DMs are
always open, so if you do have other questions or anything like that, feel free to DM me at any time.
So we're first going to dive into the current landscape. I know this is scary,
but let's dive in it together. So first things first, Equifax. I would say usually raise your
hand if the Equifax breach impacted you, but let's be real, let's just pretend, okay?
But did you know a secure researcher warned Equifax that it was vulnerable to the kind of
attack that later compromised the personal data of more than 147 billion Americans?
And this was reported by Motherboard. Six months after the researcher first notified the company
about the vulnerability, Equifax patched it, but only after the massive breach that made headlines
had already taken place, according to Equifax on the timeline. But the real question is,
but what if no one reported the breach? And it happens often because hackers don't report a
breach due to the fear of prosecution. This statistic was discovered by the hard worker
Amit Elzari, who knows our laws prevent good hackers from doing what they do best, protecting
you and me and everyone we love. She has been spearheading this movement towards safe harbor,
and that is her at the corner. So why are hackers scared? Well, besides prosecution, looking for
contact information and reading the policies have been a burden to reporting vulnerabilities.
Think about it. Sometimes when we find something we want to report, it can take hours, days,
weeks, and then we get to a point like, what is, should I even keep trying at this point?
To try to find the right contact information to disclose is a burden on you. This is why it's
important to have like these vulnerability disclosure programs or bug bounty programs,
because at least you feel like you have some sort of protection, and you know who to contact,
you know the policies, you know what's in scope, what's out of scope, way ahead of the time.
But I want to first dive into this case. So after DJI, the drone manufacturer recently launched a bug
bounty program. Two researchers, Sean and Kevin, basically were looking at their scope. For the
scope, the bug bounty program covers all the security issues in firmware, application, and
servers, including source code leak, security workaround, privacy issues. Now, Kevin, he emailed
them to confirm the scope to be safe. It took them two weeks to finally confirm the scope. He then
reported the vulnerability, and he was provided with $30,000 for the finding. However, the agreement
of receiving it offered no legal protection for him. So he did what most people should be doing,
which is, he walked away. The revelations resulted in the company challenging the researcher's
findings and seemingly threatening one with a lawsuit tied to the Computer Fraud Abuse Act, also
known as CFA. They claimed that basically he went out of scope, regardless of the fact that he made
sure to confirm the scope. In return, he posted the entire situation with all conversations with
the DJI publicly. And if you see that link, you'll be able to see his blog to see what happened. I
think one of the things, the best part that I read on there was there was this moment when DJI didn't
know that when they respond to his email, there was an internal chain going on, basically saying
he's putting them at risk, and they should do everything possible to prevent the risk,
including lawsuits and bad PR for them. But this case, it did get dropped, and they did get bad PR for this.
But language and what is in scope and or out of scope when disclosing or how to disclose
can be so scary, and potential indictments, especially. It could keep all parties awake at
night. And I know it has done for me, and I know that you probably too. But program managers,
overall, they're always asking to be hacked, but not hacked badly. And how to conduct, handle
situations when researchers report something is something that they need to work on too as well.
But overall, organizations and governments all know it's probably needed at this time, as you
can see on this slide. And I know, once again, this is a scary subject, and we're going to keep getting
into the more scary, scary parts of the subject. But here are some puppies to lift your spirits.
And yes, there is a picture for the cat lovers as well. So if you see the cat, bravo. And no,
Sherlock and Luna is not on here. All right, so why are they scared? Let's dive into this a little
bit more. Even though ethical hackers are not malicious actors, they're still being seen and
treated as such by the public. And because of this, it reduces the chance of reporting
vulnerability and can cause hackers to go to the dark side because they're seen as the same by the
public. To the left is what you see when typing in criminal hackers, and to the right is ethical
hackers. Once again, there's this dark hoodie darkness, sometimes with a ski mask. But I want
to also point out that it's not just the imagery, it's also the language used in the media,
seen as in marketing and press. So anytime I say media, it's marketing and press. And marketing
could be even for infosec companies. You find this often. Using the term hacker as someone who
is seen as a criminal is incorrect. They should be using the term attacker, cyber criminal,
malicious actor, and so on. Unless they're reporting something good about us, then they can definitely
do a hacker thing. So you're probably wondering, how does this imagery and language impact us?
It continues to feed the fear and stereotypes, the biases that exist through social construction.
And of course, if you have attended any of my talks before, I am obsessed with the brain, so
we're going to talk about the brain today. So what is really important is to understand how fear works
in your brain. So first of all, I want you to take a look at this. So fear is usually based around your
amygdala, which is like this almond shaped, and it's the size of an almond, believe it or not,
inside your brain within the temporal lobe. It is the part where your emotions are attached to
memories. So for example, if you have a nightmare, you're going to recall it a little bit more because
a strong emotion was attached to it. Versus if it's just a regular dream, you might not remember
it, but you will always remember a dream where it is extremely happy or extremely scary.
So think of that. Anyway, the thing that you might know about the amygdala is usually the fight
versus flight mechanism. And what I really want to explain is fight versus flight mechanism is a
great way to showcase what the amygdala is, but it also is this part of you that's subconscious,
and it decides what's like you, who's not like you. And based on that belief itself,
you put people into categories of people to trust, people not to trust. And so for example,
the amygdala, because it's stored in your memory section of your brain, it's also dictating
subconsciously whatever socially constructive beliefs that you've had. And if you're wondering,
what is a socially constructive belief? It's just any time when you were growing up or, you know,
you had a teacher tell you that this is unsafe, your parents tell you that's not safe, or like
anything that you've seen in movies, TV, indirectly, it's letting you know some memory for you to hold
on to. Now, I want to give you kind of a better example here. So I always tell people, think about
this way. You were growing up and you watched a bunch of movies as a kid. And every time someone
had pink hair, they were the criminal, the villain in it. And not just that, but also you see on the
news, people with pink hair are dangerous individuals, they're committing all the crimes.
You read in textbooks, you read from teachers' letters, you read everything just showcasing that
people with pink hair are dangerous. So when you see someone with pink hair at this point,
you will probably clutch your bag a little bit closer, or you might cross the street,
or you might actually lock your car doors when you see someone with pink hair.
And I know that sounds like, but the person just has pink hair could. The thing is that you have
been led to believe that someone with pink hair is someone dangerous. And that's a socially
constructive belief. And the amygdala will always act on socially constructive beliefs when it comes
to survival. So if it's known that someone with pink hair is dangerous, thus you will react in the same
way. So the good news though is that it has to verify. So the prefrontal cortex acts kind of
like the CEO in the brain. So this is completely conscious now. So what happens is the amygdala
sends a message saying, warning, someone with pink hair is right behind you. And then your
prefrontal cortex thinks, okay, I can either cross the street, or I can go into a building,
or I can clutch my bag a little bit closer, or I can look behind me to be on top of everything,
or I just ignore the threat. So the prefrontal cortex then, you decide which action to take,
and it sends the message back to the amygdala to act on that action. But the one thing to note
about is that you are completely conscious about it, and you're making that decision.
But the good news is that there's still this validation. So people's biases, socially
constructed beliefs, or whatnot, can always be challenged. And the best way how to do with that
is through stories, hearing people's personal stories. So for example, in the same pink hair
situation, if the person with pink hair made a YouTube video talking about how it's so terrible
for them, because every time someone sees them, they see them as a criminal, and how that prevents
them getting a job, how that prevents them getting where they need to go, how, for example,
cops are called on them just for being outside, and how society as a whole isn't doing enough
to understand that it's just because the person has pink hair. There's nothing else than that.
So now if you put in a lens of a hacker, you probably have experienced once or twice,
where when you tell someone you're a hacker, or you work in the hacker community,
the next thing you know is that they take a step back, or the mouth kind of drops, or their eyes
get bigger. They just get afraid. Because the thing is, is that our world has been socially constructed
to see hackers as criminals, as a blanket for all hackers. And instead of thinking them as not just
hackers, there's a difference between a hacker and an attacker, because they haven't learned that yet.
And because our personal stories are not really out there yet either. And that's the problem.
So what happens is, for the hacker situation, is that because of the mindset set by society,
by people in the media, that's keeping us unsafe and preventing hackers what they do well in.
Companies are afraid of hackers and don't want to create vulnerability disclosure policies because
of the lack of a bilateral trust amongst hackers and organizations and government. It's one of the
reasons why 60% do not report vulnerabilities. Hackers are scared of outdated laws such as CFA
and DMCA. Also from interviewing attackers, one of the reasons they decide to move away from ethical
hacking is the pay and the constant worrying of being prosecuted regardless if they did something
legal. This is stated also similarly by those who switch from being an attacker to a hacker.
The reason they switched was the insomnia of being arrested. Because there are cases
when organizations prosecute ethical hackers regardless if they were in scope.
So which leads us to needing to dive into the current legislation that can be found in most
countries towards hackers. And this is worldwide legislation. So every country around the world
has anti-hacking laws, anti-circumvention laws, also known as copyright type of laws,
acceptable use policy. So let's first dive into the Computer Fraud Abuse Act. And every country
has their own, but the U.S. is the first one I think who put it first. So let's dive into that
one. The Computer Fraud Abuse Act in the U.S. cybersecurity bill that was enacted in 1984
as an amendment to existing computer fraud law, which has been included in the Comprehensive
Crime Control Act of 1984. The law prohibits accessing a computer without authorization
or in excess of authorization. Also to be used when a researcher tends to go out of scope,
this act is used to prosecute hacking. Random fact, who here has heard of war games? Okay,
did you know that Ronald Reagan, he watched it and freaked out about hackers and he's like,
we gotta do something! So he pushed for CFA to happen. Now let's dive into anti-circumvention
laws, so the copyright laws. So in Canada you have the copyright law, believe it or not, super easy.
In the U.S. we have the DMCA, the Digital Millennium Copyright Act, and it was enacted in
1998. The U.S. copyright law that implements two 1996 treaties of World Intellectual Property
Organization, WIPO. Basically it's the right to repair. Reverse engineering is seen as a breach
of property. Let's dive into acceptable use policy. Now who here has ever read their terms
and conditions? Say, for example, an Apple product. So I got trapped, I tried it, I got
really bored, and I decided to watch a movie instead. But in general, they can be long and
too much verbiage. It can confuse anyone, especially if English is not their first language.
And you're not an attorney. I'm not an attorney, by the way. But the thing is, is that this can
lead to some serious miscommunication issues for ethical hackers that don't really speak English.
Clearly these laws' overall takeaway is they're old and out of date. And honestly,
they were created out of fear. And you know now about fear. By not having empathy or taking the
time to understand what is actually needed and why laws should only prosecute malicious actors,
aka criminals, and not good hackers. Because at that time, and still to this day, a lot of
legislators and politicians still don't know that hackers are good people. There's a difference
between a malicious actor, an attacker, a cyber criminal, and a hacker. Overall takeaway from
here is that there are laws that prevent good hacking in the same way that they prevent
attackers. And we need good hacking, especially during COVID-19, you guys.
And I really hate the CFA, and I want to dive a little bit further into it, just for you to know,
in case you don't know. So the Computer Fraud Abuse Act, once again, was passed in 1984,
is grown wildly outdated in that it offers prosecutors discretion to threaten huge
potential fines and jail sentences for relatively undisturbing violations of computer policy.
First, the CFA was written, punishes exceeding authorized access to a protected computer,
a phrase vague enough to inspire some broad interpretations. Another flaw in the CFA is the
redundant provisions that enable a person to be punished multiple times for the same crime.
These crimes can be stacked one on top of another, resulting in a threat of a higher
cumulative fines and jail time for the exact same violation. This also allows prosecutors
to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a
single, solitary act. It also plays a significant role in sentencing. This ambiguity of provision
meant to toughen sentencing for repeat offenders in the CFA may, in fact, make it possible for
defendants to be sentenced based on what should be prior convictions, but were nothing more than
multiple convictions for the same crime. And this is why it's now important for us to talk about
Aaron Swartz's case. For those that do not know Aaron Swartz's case, it basically started off in
2011. Carmen Ortiz, the U.S. Attorney Office, charged Swartz with hacking into the MIT computer
network to download millions of scholarly articles from JSTOR. An act of civil disobedience meant to
protest the restricted access to research funded by taxpayers. For this, the U.S. Attorney brought
charges that carried a maximum penalty of 35 years in prison and $1 million in fine. I want
to pause there, because think about that. 35 years in prison for downloading articles? You know, first
degree murder, life in prison? No, it's actually on 25 years, and yet he was facing 35.
Going back to this, they were able to charge such years because of the way CFA is run and the issues
that have yet to be sorted since it was made into a law. But overall, looking at Aaron's situation,
you have to understand what he was going through. He was dealing with a 17-month legal battle,
one that had no set trial date and wasn't ending anytime soon. And through Swartz's perspective,
it must have been so overwhelming. And it was the future of this legal battle that
cast into doubt that Swartz unfortunately hung himself in his apartment on January 11, 2013.
And following his death, the federal prosecutors went on to drop the charges.
His family said that the government's prosecution contributed to his decision to take his own life.
In memory, and for what he went through, unfortunately, there was Aaron's Law. It
didn't pass because a probably lobbyist, very heavy corporate lobbyist, didn't want it to pass.
But what Aaron Law removes, the phrase exceeds authorized access and replaces it with access
with authorization, which is defined as to obtain information on a computer that the accessor
lacks authorization to obtain by not only circumventing technological or fiscal measures
designed to prevent unauthorized individuals from obtaining that information. The other thing is that
it would ensure people won't face criminal liability for violating the terms of service
agreement and contracted agreements, but also limits penalties. In other words, there was no
more duplicated charges. So no more stack on stack what Aaron went through. And with improvements to
legislation, so to CFA, DMCA, with these changes, then we can have what we need today.
And that is, we need to also talk about the other parts. So not only legislation, so we cover
legislation, we talked about the media, the press, and whatnot. We also talked about organizations
named vulnerability disclosure programs. And I want to dive into those three categories a little
bit more because in order to have any rights or to get any public change, we have to work with
three categories. So in order to have rights for hackers, we need to get the public on board. And
in order to do so, we need to dive into organizations, legislation, and media. We need media to push for
public to become aware. In other words, we need to change the language and imagery of a hacker and
start using the term cybercriminals for those who commit unethical hacking over really separate the
two groups. In order to help the press, organizations need to be on board with bilateral trust, with
having vulnerability disclosure programs, by showing they support hackers, the public changes
their view in general. Lastly, to have organizations and public opinion to push and motivate Capitol
Hill to get on board and update the current legislation that will protect ethical hackers.
Overall, we need all three to be supporting hacker rights for it to become a reality.
So how do we get there? You're probably wondering. So these are the five needs. And this is the way
how we can push for awareness of ethical hackers needing rights. Now, how we get there, I'm going
to need your help. Overall, we need to work with the media, we need society to notice that we're
everyday heroes, we need organizations to have a vulnerability disclosure program, and we need
representatives to update today's legislation. But how we do that, we have to change the imagery
that the press is doing too. So the first step is this petition is for anyone out there that
supports ethical hackers and want to bring about a change is the first step that I'm working on to
bring attention to this matter. And we have over 1000 signatures. And honestly, it's really it's
broken down by organizations, legislators, and the media and the hacker community. And anyone can sign
this who agrees with it. So you can also share it around and sign it yourself. And it could be
friends and family. It doesn't have to be everyone has to be a hacker who signs this. It could be
anyone who believes that we deserve rights. The second step, tell the press. So anytime you see
the press reporting hackers in a bad light, correct them, write a comment below in the story,
tag them in a tweet, letting them know the term is actually cyber criminal and attacker, not hacker.
Hacker are good people. So you need to do that. The other thing is calling them out when they
use the dark hoodie imagery, or the ski mask, which is still to my mind is the worst thing ever.
We need to do fact checks. And that's how you do it is unfortunately, you kind of have to publicly
shame them till they get it right. And also, if you're someone who is interviewed by any
journalist or anything like that, please make sure to keep enforcing them and let them know to use
the term attacker versus hacker when reporting a breach. I've been doing that since I can do it.
But it's going to take all of us and Chris Roberts has been great also doing that kind of stuff. So
push out there, let them know they got the wrong term and the wrong imagery. So basically, everyone
gets a fact check. The third step is the push for organizations to partner and campaign with us.
We need companies, we need orgs to come out, even government agencies can too, basically to come out
publicly saying like, we stand with the ethical hackers, and it's time to change things or to push
for vulnerability disclosure programs to other companies, organizations and so on. So they're
also aware of that this is a need now at this point. Also to push for organizations to have a
like I just said, it's really important that we do that because I am so tired of having to spend
hours, days and weeks to find some information of who to contact and what's in scope, what's not in
scope. This is so important. Every company should have that at this point, because they need us
more than ever before. The fourth step, contact your local representatives to update current
legislation. So let them know that they need to change something, set up 10 minute appointments
virtually, or try whatever you can to work with other groups of people that want to volunteer to
go and approach representatives. And especially the ones that you need to be focusing on is your
local and state because those are the ones that we're having some serious problems with.
And also last but not least, follow the Van Buren U.S. case. And there's a reason for that in the fall
the CFA is going to be revisited in Supreme Court. So please take a look at it, follow it, and also
contact your representatives around it. The fifth step, support wonderful groups like this. So I'm
the Calvary Disclosed.io, CERT Coordination Center, CERT CC, EFF and CTI League. It's really,
that we work together and support one another and contact them to find out how they can do better
or how you can help. So main takeaways overall, we need to push for awareness of ethical hackers
and to let people know how we really are and our stories matter and how we get there. These are the
main takeaways and I might need your advice and assistance if you want some. But most importantly,
I want to remind you that the change starts with you and me. It's never too late and we must not
give up because we must continue to fight for rights and this is a time that we do so.
I want to first say thank you guys, everyone at IoT Village for selecting my talk to be a keynote.
I want to also thank you guys for participating. So thank you all for existing. I also want to
give a big shout out to Bo Woods and Harley Geiger. They helped basically put more ideas
in my head for this conversation. Thank you guys so much and thank you IoT Village once again.
Thank you guys for assisting and please stay safe and enjoy the rest of your DEF CON weekend.