start	end	text
0	5700	Thank you so much. And hi everyone, good morning, good afternoon, good evening, wherever you are. I
5700	10480	hope I got one of them right. So we're going to talk about how to get rights for hackers.
11060	17340	And let's dive into it, shall we? First things first. I want to just let you guys know that
17340	21620	this talk is completely dedicated to all the hackers who've been scared to disclose,
22240	26780	to all the hackers who've been prosecuted for trying to do something good, and to all the
26780	33460	people who are in the fight to bring rights for hackers. For those that don't know who I am,
33460	38140	my name is Chloe Mazzotti. I am the VP of Strategy over at Point3 Security, and when I'm not there,
38140	44080	I'm an ethical hacker advocate. I'm basically fighting for your rights, and then also trying
44080	49240	to do whatever I can to improve our hacker community. I'm the president and co-founder
49240	54040	of Wozzeck, which is Women of Security, and the founder WeAreHackers, formerly known as Women
54040	60680	Hackers. I'm also the podcaster for ITSP Magazine, The Uncommon Journey, and when I'm not doing that,
60680	66420	I'm also a Hacker Book Club organizer. Basically, we read a book about the hacker community or
66420	72000	written by someone in the hacker community. And basically, we read a new book every month,
72000	77560	and it's every Tuesday at 5 p.m. Pacific time when we meet. And yes, the author and people
77560	82000	mentioned in the books do attend. Our upcoming one is going to be Tribe of Hackers and
82000	87400	Red Team Edition, so you should come and join. That is my website, so feel free, if you want to
87400	93180	know anything about me, it's most likely on there. And yes, my Twitter and Instagram, the DMs are
93180	100120	always open, so if you do have other questions or anything like that, feel free to DM me at any time.
102560	106960	So we're first going to dive into the current landscape. I know this is scary,
106960	114260	but let's dive in it together. So first things first, Equifax. I would say usually raise your
114260	120300	hand if the Equifax breach impacted you, but let's be real, let's just pretend, okay?
120580	124960	But did you know a secure researcher warned Equifax that it was vulnerable to the kind of
124960	129940	attack that later compromised the personal data of more than 147 billion Americans?
129960	134780	And this was reported by Motherboard. Six months after the researcher first notified the company
134780	139440	about the vulnerability, Equifax patched it, but only after the massive breach that made headlines
139440	146440	had already taken place, according to Equifax on the timeline. But the real question is,
146440	153520	but what if no one reported the breach? And it happens often because hackers don't report a
153520	158120	breach due to the fear of prosecution. This statistic was discovered by the hard worker
158120	163540	Amit Elzari, who knows our laws prevent good hackers from doing what they do best, protecting
163540	169000	you and me and everyone we love. She has been spearheading this movement towards safe harbor,
169000	177100	and that is her at the corner. So why are hackers scared? Well, besides prosecution, looking for
177100	182440	contact information and reading the policies have been a burden to reporting vulnerabilities.
182460	188660	Think about it. Sometimes when we find something we want to report, it can take hours, days,
188660	193160	weeks, and then we get to a point like, what is, should I even keep trying at this point?
193360	199920	To try to find the right contact information to disclose is a burden on you. This is why it's
199920	203880	important to have like these vulnerability disclosure programs or bug bounty programs,
203880	208680	because at least you feel like you have some sort of protection, and you know who to contact,
208680	213900	you know the policies, you know what's in scope, what's out of scope, way ahead of the time.
214900	223220	But I want to first dive into this case. So after DJI, the drone manufacturer recently launched a bug
223220	231640	bounty program. Two researchers, Sean and Kevin, basically were looking at their scope. For the
231640	235860	scope, the bug bounty program covers all the security issues in firmware, application, and
235860	242120	servers, including source code leak, security workaround, privacy issues. Now, Kevin, he emailed
242120	248620	them to confirm the scope to be safe. It took them two weeks to finally confirm the scope. He then
248620	255160	reported the vulnerability, and he was provided with $30,000 for the finding. However, the agreement
255160	261960	of receiving it offered no legal protection for him. So he did what most people should be doing,
261960	267520	which is, he walked away. The revelations resulted in the company challenging the researcher's
267520	272600	findings and seemingly threatening one with a lawsuit tied to the Computer Fraud Abuse Act, also
272600	278600	known as CFA. They claimed that basically he went out of scope, regardless of the fact that he made
278600	284400	sure to confirm the scope. In return, he posted the entire situation with all conversations with
284400	291120	the DJI publicly. And if you see that link, you'll be able to see his blog to see what happened. I
291120	296320	think one of the things, the best part that I read on there was there was this moment when DJI didn't
296320	302900	know that when they respond to his email, there was an internal chain going on, basically saying
302900	308380	he's putting them at risk, and they should do everything possible to prevent the risk,
308380	316740	including lawsuits and bad PR for them. But this case, it did get dropped, and they did get bad PR for this.
319220	324300	But language and what is in scope and or out of scope when disclosing or how to disclose
324300	330500	can be so scary, and potential indictments, especially. It could keep all parties awake at
330500	336920	night. And I know it has done for me, and I know that you probably too. But program managers,
336920	342200	overall, they're always asking to be hacked, but not hacked badly. And how to conduct, handle
342200	347620	situations when researchers report something is something that they need to work on too as well.
347660	353920	But overall, organizations and governments all know it's probably needed at this time, as you
353920	360860	can see on this slide. And I know, once again, this is a scary subject, and we're going to keep getting
360860	366960	into the more scary, scary parts of the subject. But here are some puppies to lift your spirits.
367000	374160	And yes, there is a picture for the cat lovers as well. So if you see the cat, bravo. And no,
374160	381160	Sherlock and Luna is not on here. All right, so why are they scared? Let's dive into this a little
381160	386140	bit more. Even though ethical hackers are not malicious actors, they're still being seen and
386140	389960	treated as such by the public. And because of this, it reduces the chance of reporting
389960	394680	vulnerability and can cause hackers to go to the dark side because they're seen as the same by the
394680	399740	public. To the left is what you see when typing in criminal hackers, and to the right is ethical
399740	407480	hackers. Once again, there's this dark hoodie darkness, sometimes with a ski mask. But I want
407480	412920	to also point out that it's not just the imagery, it's also the language used in the media,
412920	418720	seen as in marketing and press. So anytime I say media, it's marketing and press. And marketing
418720	425620	could be even for infosec companies. You find this often. Using the term hacker as someone who
425620	431400	is seen as a criminal is incorrect. They should be using the term attacker, cyber criminal,
431400	436700	malicious actor, and so on. Unless they're reporting something good about us, then they can definitely
436700	444200	do a hacker thing. So you're probably wondering, how does this imagery and language impact us?
444200	449780	It continues to feed the fear and stereotypes, the biases that exist through social construction.
450600	456080	And of course, if you have attended any of my talks before, I am obsessed with the brain, so
456080	462340	we're going to talk about the brain today. So what is really important is to understand how fear works
462340	469580	in your brain. So first of all, I want you to take a look at this. So fear is usually based around your
469580	475800	amygdala, which is like this almond shaped, and it's the size of an almond, believe it or not,
475800	481620	inside your brain within the temporal lobe. It is the part where your emotions are attached to
481620	487200	memories. So for example, if you have a nightmare, you're going to recall it a little bit more because
487660	492700	a strong emotion was attached to it. Versus if it's just a regular dream, you might not remember
492700	500160	it, but you will always remember a dream where it is extremely happy or extremely scary.
500520	505120	So think of that. Anyway, the thing that you might know about the amygdala is usually the fight
505120	511480	versus flight mechanism. And what I really want to explain is fight versus flight mechanism is a
511480	518980	great way to showcase what the amygdala is, but it also is this part of you that's subconscious,
518980	525360	and it decides what's like you, who's not like you. And based on that belief itself,
525360	531600	you put people into categories of people to trust, people not to trust. And so for example,
531600	538420	the amygdala, because it's stored in your memory section of your brain, it's also dictating
538420	544060	subconsciously whatever socially constructive beliefs that you've had. And if you're wondering,
544060	550380	what is a socially constructive belief? It's just any time when you were growing up or, you know,
550380	556160	you had a teacher tell you that this is unsafe, your parents tell you that's not safe, or like
556820	564000	anything that you've seen in movies, TV, indirectly, it's letting you know some memory for you to hold
564000	571420	on to. Now, I want to give you kind of a better example here. So I always tell people, think about
571420	577420	this way. You were growing up and you watched a bunch of movies as a kid. And every time someone
577420	583280	had pink hair, they were the criminal, the villain in it. And not just that, but also you see on the
583280	588240	news, people with pink hair are dangerous individuals, they're committing all the crimes.
588240	594940	You read in textbooks, you read from teachers' letters, you read everything just showcasing that
594940	600240	people with pink hair are dangerous. So when you see someone with pink hair at this point,
600240	605300	you will probably clutch your bag a little bit closer, or you might cross the street,
605300	610020	or you might actually lock your car doors when you see someone with pink hair.
610440	616660	And I know that sounds like, but the person just has pink hair could. The thing is that you have
616660	622900	been led to believe that someone with pink hair is someone dangerous. And that's a socially
622900	629400	constructive belief. And the amygdala will always act on socially constructive beliefs when it comes
629400	635580	to survival. So if it's known that someone with pink hair is dangerous, thus you will react in the same
635580	644040	way. So the good news though is that it has to verify. So the prefrontal cortex acts kind of
644040	648940	like the CEO in the brain. So this is completely conscious now. So what happens is the amygdala
648940	655000	sends a message saying, warning, someone with pink hair is right behind you. And then your
655000	661800	prefrontal cortex thinks, okay, I can either cross the street, or I can go into a building,
661800	668700	or I can clutch my bag a little bit closer, or I can look behind me to be on top of everything,
669240	676620	or I just ignore the threat. So the prefrontal cortex then, you decide which action to take,
676620	682960	and it sends the message back to the amygdala to act on that action. But the one thing to note
682960	688660	about is that you are completely conscious about it, and you're making that decision.
688720	695900	But the good news is that there's still this validation. So people's biases, socially
695900	701000	constructed beliefs, or whatnot, can always be challenged. And the best way how to do with that
701000	706140	is through stories, hearing people's personal stories. So for example, in the same pink hair
706140	714240	situation, if the person with pink hair made a YouTube video talking about how it's so terrible
714240	720360	for them, because every time someone sees them, they see them as a criminal, and how that prevents
720360	726060	them getting a job, how that prevents them getting where they need to go, how, for example,
726060	733480	cops are called on them just for being outside, and how society as a whole isn't doing enough
733480	740900	to understand that it's just because the person has pink hair. There's nothing else than that.
741360	747040	So now if you put in a lens of a hacker, you probably have experienced once or twice,
747040	750960	where when you tell someone you're a hacker, or you work in the hacker community,
750960	755380	the next thing you know is that they take a step back, or the mouth kind of drops, or their eyes
755380	761620	get bigger. They just get afraid. Because the thing is, is that our world has been socially constructed
761620	769900	to see hackers as criminals, as a blanket for all hackers. And instead of thinking them as not just
769900	775900	hackers, there's a difference between a hacker and an attacker, because they haven't learned that yet.
775900	781500	And because our personal stories are not really out there yet either. And that's the problem.
784220	791840	So what happens is, for the hacker situation, is that because of the mindset set by society,
791840	797240	by people in the media, that's keeping us unsafe and preventing hackers what they do well in.
797280	801520	Companies are afraid of hackers and don't want to create vulnerability disclosure policies because
801520	806440	of the lack of a bilateral trust amongst hackers and organizations and government. It's one of the
806440	812200	reasons why 60% do not report vulnerabilities. Hackers are scared of outdated laws such as CFA
812200	818260	and DMCA. Also from interviewing attackers, one of the reasons they decide to move away from ethical
818260	823160	hacking is the pay and the constant worrying of being prosecuted regardless if they did something
823160	829220	legal. This is stated also similarly by those who switch from being an attacker to a hacker.
829220	833340	The reason they switched was the insomnia of being arrested. Because there are cases
833340	838500	when organizations prosecute ethical hackers regardless if they were in scope.
840900	845640	So which leads us to needing to dive into the current legislation that can be found in most
845640	852280	countries towards hackers. And this is worldwide legislation. So every country around the world
852280	857540	has anti-hacking laws, anti-circumvention laws, also known as copyright type of laws,
857540	863920	acceptable use policy. So let's first dive into the Computer Fraud Abuse Act. And every country
863920	869940	has their own, but the U.S. is the first one I think who put it first. So let's dive into that
869940	875100	one. The Computer Fraud Abuse Act in the U.S. cybersecurity bill that was enacted in 1984
875100	880300	as an amendment to existing computer fraud law, which has been included in the Comprehensive
880300	886240	Crime Control Act of 1984. The law prohibits accessing a computer without authorization
886240	891640	or in excess of authorization. Also to be used when a researcher tends to go out of scope,
891640	899640	this act is used to prosecute hacking. Random fact, who here has heard of war games? Okay,
899640	904080	did you know that Ronald Reagan, he watched it and freaked out about hackers and he's like,
904080	909900	we gotta do something! So he pushed for CFA to happen. Now let's dive into anti-circumvention
909900	915500	laws, so the copyright laws. So in Canada you have the copyright law, believe it or not, super easy.
915500	920420	In the U.S. we have the DMCA, the Digital Millennium Copyright Act, and it was enacted in
920420	926300	1998. The U.S. copyright law that implements two 1996 treaties of World Intellectual Property
926300	932160	Organization, WIPO. Basically it's the right to repair. Reverse engineering is seen as a breach
932160	939160	of property. Let's dive into acceptable use policy. Now who here has ever read their terms
939160	943960	and conditions? Say, for example, an Apple product. So I got trapped, I tried it, I got
943960	948420	really bored, and I decided to watch a movie instead. But in general, they can be long and
948420	952700	too much verbiage. It can confuse anyone, especially if English is not their first language.
952700	958380	And you're not an attorney. I'm not an attorney, by the way. But the thing is, is that this can
958380	963340	lead to some serious miscommunication issues for ethical hackers that don't really speak English.
963900	969080	Clearly these laws' overall takeaway is they're old and out of date. And honestly,
969080	975960	they were created out of fear. And you know now about fear. By not having empathy or taking the
975960	981580	time to understand what is actually needed and why laws should only prosecute malicious actors,
981580	987440	aka criminals, and not good hackers. Because at that time, and still to this day, a lot of
987440	993140	legislators and politicians still don't know that hackers are good people. There's a difference
993140	1000900	between a malicious actor, an attacker, a cyber criminal, and a hacker. Overall takeaway from
1000900	1004660	here is that there are laws that prevent good hacking in the same way that they prevent
1004660	1010520	attackers. And we need good hacking, especially during COVID-19, you guys.
1011680	1018700	And I really hate the CFA, and I want to dive a little bit further into it, just for you to know,
1018700	1023560	in case you don't know. So the Computer Fraud Abuse Act, once again, was passed in 1984,
1024020	1029920	is grown wildly outdated in that it offers prosecutors discretion to threaten huge
1029920	1036120	potential fines and jail sentences for relatively undisturbing violations of computer policy.
1036960	1044200	First, the CFA was written, punishes exceeding authorized access to a protected computer,
1044340	1049360	a phrase vague enough to inspire some broad interpretations. Another flaw in the CFA is the
1049360	1054320	redundant provisions that enable a person to be punished multiple times for the same crime.
1054320	1058580	These crimes can be stacked one on top of another, resulting in a threat of a higher
1058580	1064500	cumulative fines and jail time for the exact same violation. This also allows prosecutors
1064500	1069840	to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a
1069840	1076540	single, solitary act. It also plays a significant role in sentencing. This ambiguity of provision
1076540	1082640	meant to toughen sentencing for repeat offenders in the CFA may, in fact, make it possible for
1082640	1087900	defendants to be sentenced based on what should be prior convictions, but were nothing more than
1087900	1094040	multiple convictions for the same crime. And this is why it's now important for us to talk about
1094040	1102000	Aaron Swartz's case. For those that do not know Aaron Swartz's case, it basically started off in
1102000	1108000	2011. Carmen Ortiz, the U.S. Attorney Office, charged Swartz with hacking into the MIT computer
1108000	1114380	network to download millions of scholarly articles from JSTOR. An act of civil disobedience meant to
1114380	1120080	protest the restricted access to research funded by taxpayers. For this, the U.S. Attorney brought
1120080	1126180	charges that carried a maximum penalty of 35 years in prison and $1 million in fine. I want
1126180	1134380	to pause there, because think about that. 35 years in prison for downloading articles? You know, first
1134380	1144100	degree murder, life in prison? No, it's actually on 25 years, and yet he was facing 35.
1145620	1152320	Going back to this, they were able to charge such years because of the way CFA is run and the issues
1152320	1158890	that have yet to be sorted since it was made into a law. But overall, looking at Aaron's situation,
1159260	1164900	you have to understand what he was going through. He was dealing with a 17-month legal battle,
1164900	1171540	one that had no set trial date and wasn't ending anytime soon. And through Swartz's perspective,
1171540	1177880	it must have been so overwhelming. And it was the future of this legal battle that
1177880	1185380	cast into doubt that Swartz unfortunately hung himself in his apartment on January 11, 2013.
1185620	1189220	And following his death, the federal prosecutors went on to drop the charges.
1189540	1194980	His family said that the government's prosecution contributed to his decision to take his own life.
1196320	1204260	In memory, and for what he went through, unfortunately, there was Aaron's Law. It
1204260	1211580	didn't pass because a probably lobbyist, very heavy corporate lobbyist, didn't want it to pass.
1211580	1216980	But what Aaron Law removes, the phrase exceeds authorized access and replaces it with access
1217340	1222920	with authorization, which is defined as to obtain information on a computer that the accessor
1222920	1228160	lacks authorization to obtain by not only circumventing technological or fiscal measures
1228160	1233680	designed to prevent unauthorized individuals from obtaining that information. The other thing is that
1233680	1238860	it would ensure people won't face criminal liability for violating the terms of service
1238860	1243440	agreement and contracted agreements, but also limits penalties. In other words, there was no
1243440	1253440	more duplicated charges. So no more stack on stack what Aaron went through. And with improvements to
1253440	1265000	legislation, so to CFA, DMCA, with these changes, then we can have what we need today.
1265680	1272020	And that is, we need to also talk about the other parts. So not only legislation, so we cover
1272020	1277780	legislation, we talked about the media, the press, and whatnot. We also talked about organizations
1277780	1284320	named vulnerability disclosure programs. And I want to dive into those three categories a little
1284320	1290640	bit more because in order to have any rights or to get any public change, we have to work with
1290640	1296560	three categories. So in order to have rights for hackers, we need to get the public on board. And
1296560	1304620	in order to do so, we need to dive into organizations, legislation, and media. We need media to push for
1304620	1308940	public to become aware. In other words, we need to change the language and imagery of a hacker and
1308940	1314640	start using the term cybercriminals for those who commit unethical hacking over really separate the
1314640	1320560	two groups. In order to help the press, organizations need to be on board with bilateral trust, with
1320560	1325200	having vulnerability disclosure programs, by showing they support hackers, the public changes
1325200	1331180	their view in general. Lastly, to have organizations and public opinion to push and motivate Capitol
1331180	1336020	Hill to get on board and update the current legislation that will protect ethical hackers.
1336020	1341520	Overall, we need all three to be supporting hacker rights for it to become a reality.
1342580	1350740	So how do we get there? You're probably wondering. So these are the five needs. And this is the way
1350740	1357200	how we can push for awareness of ethical hackers needing rights. Now, how we get there, I'm going
1357200	1363060	to need your help. Overall, we need to work with the media, we need society to notice that we're
1363060	1367920	everyday heroes, we need organizations to have a vulnerability disclosure program, and we need
1367920	1373540	representatives to update today's legislation. But how we do that, we have to change the imagery
1373540	1380340	that the press is doing too. So the first step is this petition is for anyone out there that
1380340	1385240	supports ethical hackers and want to bring about a change is the first step that I'm working on to
1385240	1392080	bring attention to this matter. And we have over 1000 signatures. And honestly, it's really it's
1392080	1397160	broken down by organizations, legislators, and the media and the hacker community. And anyone can sign
1397160	1403740	this who agrees with it. So you can also share it around and sign it yourself. And it could be
1403740	1407760	friends and family. It doesn't have to be everyone has to be a hacker who signs this. It could be
1407760	1416800	anyone who believes that we deserve rights. The second step, tell the press. So anytime you see
1416800	1424360	the press reporting hackers in a bad light, correct them, write a comment below in the story,
1424360	1431620	tag them in a tweet, letting them know the term is actually cyber criminal and attacker, not hacker.
1431620	1437400	Hacker are good people. So you need to do that. The other thing is calling them out when they
1437400	1444260	use the dark hoodie imagery, or the ski mask, which is still to my mind is the worst thing ever.
1445220	1450360	We need to do fact checks. And that's how you do it is unfortunately, you kind of have to publicly
1450360	1457760	shame them till they get it right. And also, if you're someone who is interviewed by any
1457760	1464040	journalist or anything like that, please make sure to keep enforcing them and let them know to use
1464040	1472620	the term attacker versus hacker when reporting a breach. I've been doing that since I can do it.
1472840	1477680	But it's going to take all of us and Chris Roberts has been great also doing that kind of stuff. So
1477680	1485360	push out there, let them know they got the wrong term and the wrong imagery. So basically, everyone
1485360	1492780	gets a fact check. The third step is the push for organizations to partner and campaign with us.
1492780	1500220	We need companies, we need orgs to come out, even government agencies can too, basically to come out
1500220	1506980	publicly saying like, we stand with the ethical hackers, and it's time to change things or to push
1506980	1514140	for vulnerability disclosure programs to other companies, organizations and so on. So they're
1514140	1520580	also aware of that this is a need now at this point. Also to push for organizations to have a
1520890	1527660	like I just said, it's really important that we do that because I am so tired of having to spend
1527660	1534100	hours, days and weeks to find some information of who to contact and what's in scope, what's not in
1534100	1540700	scope. This is so important. Every company should have that at this point, because they need us
1540700	1547740	more than ever before. The fourth step, contact your local representatives to update current
1547740	1554820	legislation. So let them know that they need to change something, set up 10 minute appointments
1554820	1561300	virtually, or try whatever you can to work with other groups of people that want to volunteer to
1561300	1566880	go and approach representatives. And especially the ones that you need to be focusing on is your
1566880	1572640	local and state because those are the ones that we're having some serious problems with.
1573160	1580420	And also last but not least, follow the Van Buren U.S. case. And there's a reason for that in the fall
1580420	1586120	the CFA is going to be revisited in Supreme Court. So please take a look at it, follow it, and also
1586120	1593560	contact your representatives around it. The fifth step, support wonderful groups like this. So I'm
1593560	1602020	the Calvary Disclosed.io, CERT Coordination Center, CERT CC, EFF and CTI League. It's really,
1602020	1607400	that we work together and support one another and contact them to find out how they can do better
1607400	1613600	or how you can help. So main takeaways overall, we need to push for awareness of ethical hackers
1613600	1620960	and to let people know how we really are and our stories matter and how we get there. These are the
1620960	1627620	main takeaways and I might need your advice and assistance if you want some. But most importantly,
1627620	1634100	I want to remind you that the change starts with you and me. It's never too late and we must not
1634100	1640640	give up because we must continue to fight for rights and this is a time that we do so.
1642020	1648480	I want to first say thank you guys, everyone at IoT Village for selecting my talk to be a keynote.
1648480	1653500	I want to also thank you guys for participating. So thank you all for existing. I also want to
1653500	1661780	give a big shout out to Bo Woods and Harley Geiger. They helped basically put more ideas
1661780	1667780	in my head for this conversation. Thank you guys so much and thank you IoT Village once again.
1667780	1672260	Thank you guys for assisting and please stay safe and enjoy the rest of your DEF CON weekend.