WEBVTT 00:00.000 --> 00:01.340 Thank you so much. 00:01.340 --> 00:05.600 And hi everyone, good morning, good afternoon, good evening, wherever you are. 00:05.600 --> 00:07.260 I hope I got one of them right. 00:07.260 --> 00:10.480 So we're going to talk about how to get rights for hackers. 00:11.060 --> 00:13.360 And let's dive into it, shall we? 00:13.520 --> 00:15.000 First things first. 00:15.840 --> 00:29.660 I want to just let you guys know that this talk is completely dedicated to all the hackers who've been scared to disclose, to all the hackers who've been prosecuted for trying to do something good, and to all the people who are in the fight to bring rights for hackers. 00:31.900 --> 00:34.840 For those that don't know who I am, my name is Chloe Mazzotti. 00:34.840 --> 00:39.920 I am the VP of Strategy over at Point3 Security, and when I'm not there, I'm an ethical hacker advocate. 00:39.920 --> 00:47.540 I'm basically fighting for your rights, and then also trying to do whatever I can to improve our hacker community. 00:47.900 --> 00:54.940 I'm the president and co-founder of Wozzeck, which is Women of Security, and the founder WeAreHackers, formerly known as Women Hackers. 00:54.940 --> 01:02.820 I'm also the podcaster for ITSP Magazine, The Uncommon Journey, and when I'm not doing that, I'm also a Hacker Book Club organizer. 01:02.820 --> 01:09.240 Basically, we read a book about the hacker community or written by someone in the hacker community. 01:09.780 --> 01:14.540 And basically, we read a new book every month, and it's every Tuesday at 5 p.m. 01:14.540 --> 01:16.060 Pacific time when we meet. 01:16.060 --> 01:19.560 And yes, the author and people mentioned in the books do attend. 01:19.560 --> 01:24.620 Our upcoming one is going to be Tribe of Hackers and Red Team Edition, so you should come and join. 01:25.100 --> 01:30.620 That is my website, so feel free, if you want to know anything about me, it's most likely on there. 01:31.000 --> 01:40.120 And yes, my Twitter and Instagram, the DMs are always open, so if you do have other questions or anything like that, feel free to DM me at any time. 01:42.560 --> 01:45.860 So we're first going to dive into the current landscape. 01:45.860 --> 01:48.840 I know this is scary, but let's dive in it together. 01:49.560 --> 01:52.240 So first things first, Equifax. 01:52.380 --> 02:00.300 I would say usually raise your hand if the Equifax breach impacted you, but let's be real, let's just pretend, okay? 02:00.580 --> 02:09.940 But did you know a secure researcher warned Equifax that it was vulnerable to the kind of attack that later compromised the personal data of more than 147 billion Americans? 02:09.960 --> 02:12.100 And this was reported by Motherboard. 02:12.100 --> 02:23.680 Six months after the researcher first notified the company about the vulnerability, Equifax patched it, but only after the massive breach that made headlines had already taken place, according to Equifax on the timeline. 02:24.500 --> 02:29.120 But the real question is, but what if no one reported the breach? 02:29.820 --> 02:35.540 And it happens often because hackers don't report a breach due to the fear of prosecution. 02:35.680 --> 02:45.680 This statistic was discovered by the hard worker Amit Elzari, who knows our laws prevent good hackers from doing what they do best, protecting you and me and everyone we love. 02:45.680 --> 02:50.960 She has been spearheading this movement towards safe harbor, and that is her at the corner. 02:52.120 --> 02:54.720 So why are hackers scared? 02:54.880 --> 03:02.440 Well, besides prosecution, looking for contact information and reading the policies have been a burden to reporting vulnerabilities. 03:02.460 --> 03:03.400 Think about it. 03:03.400 --> 03:13.160 Sometimes when we find something we want to report, it can take hours, days, weeks, and then we get to a point like, what is, should I even keep trying at this point? 03:13.360 --> 03:18.740 To try to find the right contact information to disclose is a burden on you. 03:19.220 --> 03:31.920 This is why it's important to have like these vulnerability disclosure programs or bug bounty programs, because at least you feel like you have some sort of protection, and you know who to contact, you know the policies, you know what's in scope, what's out of scope, 03:31.920 --> 03:33.900 way ahead of the time. 03:34.900 --> 03:38.760 But I want to first dive into this case. 03:38.760 --> 03:44.840 So after DJI, the drone manufacturer recently launched a bug bounty program. 03:44.840 --> 03:50.840 Two researchers, Sean and Kevin, basically were looking at their scope. 03:51.200 --> 04:00.520 For the scope, the bug bounty program covers all the security issues in firmware, application, and servers, including source code leak, security workaround, privacy issues. 04:00.520 --> 04:04.920 Now, Kevin, he emailed them to confirm the scope to be safe. 04:04.920 --> 04:08.240 It took them two weeks to finally confirm the scope. 04:08.300 --> 04:13.360 He then reported the vulnerability, and he was provided with $30,000 for the finding. 04:13.360 --> 04:19.000 However, the agreement of receiving it offered no legal protection for him. 04:19.060 --> 04:23.980 So he did what most people should be doing, which is, he walked away. 04:24.260 --> 04:33.860 The revelations resulted in the company challenging the researcher's findings and seemingly threatening one with a lawsuit tied to the Computer Fraud Abuse Act, also known as CFA. 04:34.480 --> 04:40.300 They claimed that basically he went out of scope, regardless of the fact that he made sure to confirm the scope. 04:40.300 --> 04:46.180 In return, he posted the entire situation with all conversations with the DJI publicly. 04:46.400 --> 04:50.980 And if you see that link, you'll be able to see his blog to see what happened. 04:50.980 --> 05:08.380 I think one of the things, the best part that I read on there was there was this moment when DJI didn't know that when they respond to his email, there was an internal chain going on, basically saying he's putting them at risk, and they should do everything possible to prevent the risk, 05:08.380 --> 05:11.620 including lawsuits and bad PR for them. 05:12.260 --> 05:16.740 But this case, it did get dropped, and they did get bad PR for this. 05:19.220 --> 05:28.640 But language and what is in scope and or out of scope when disclosing or how to disclose can be so scary, and potential indictments, especially. 05:28.640 --> 05:30.920 It could keep all parties awake at night. 05:30.920 --> 05:35.160 And I know it has done for me, and I know that you probably too. 05:35.380 --> 05:41.020 But program managers, overall, they're always asking to be hacked, but not hacked badly. 05:41.020 --> 05:47.620 And how to conduct, handle situations when researchers report something is something that they need to work on too as well. 05:47.660 --> 05:55.780 But overall, organizations and governments all know it's probably needed at this time, as you can see on this slide. 05:57.020 --> 06:04.260 And I know, once again, this is a scary subject, and we're going to keep getting into the more scary, scary parts of the subject. 06:04.400 --> 06:06.960 But here are some puppies to lift your spirits. 06:07.000 --> 06:10.300 And yes, there is a picture for the cat lovers as well. 06:10.300 --> 06:13.260 So if you see the cat, bravo. 06:13.700 --> 06:16.000 And no, Sherlock and Luna is not on here. 06:16.720 --> 06:19.840 All right, so why are they scared? 06:19.840 --> 06:22.040 Let's dive into this a little bit more. 06:22.440 --> 06:27.840 Even though ethical hackers are not malicious actors, they're still being seen and treated as such by the public. 06:27.840 --> 06:35.560 And because of this, it reduces the chance of reporting vulnerability and can cause hackers to go to the dark side because they're seen as the same by the public. 06:35.820 --> 06:40.620 To the left is what you see when typing in criminal hackers, and to the right is ethical hackers. 06:40.800 --> 06:46.200 Once again, there's this dark hoodie darkness, sometimes with a ski mask. 06:46.800 --> 06:55.220 But I want to also point out that it's not just the imagery, it's also the language used in the media, seen as in marketing and press. 06:55.220 --> 06:58.340 So anytime I say media, it's marketing and press. 06:58.340 --> 07:01.060 And marketing could be even for infosec companies. 07:01.060 --> 07:02.640 You find this often. 07:03.040 --> 07:08.180 Using the term hacker as someone who is seen as a criminal is incorrect. 07:08.300 --> 07:13.460 They should be using the term attacker, cyber criminal, malicious actor, and so on. 07:13.900 --> 07:18.180 Unless they're reporting something good about us, then they can definitely do a hacker thing. 07:19.100 --> 07:24.200 So you're probably wondering, how does this imagery and language impact us? 07:24.200 --> 07:29.780 It continues to feed the fear and stereotypes, the biases that exist through social construction. 07:30.600 --> 07:38.220 And of course, if you have attended any of my talks before, I am obsessed with the brain, so we're going to talk about the brain today. 07:38.460 --> 07:43.620 So what is really important is to understand how fear works in your brain. 07:43.820 --> 07:46.820 So first of all, I want you to take a look at this. 07:46.900 --> 07:58.700 So fear is usually based around your amygdala, which is like this almond shaped, and it's the size of an almond, believe it or not, inside your brain within the temporal lobe. 07:58.760 --> 08:02.580 It is the part where your emotions are attached to memories. 08:02.800 --> 08:10.160 So for example, if you have a nightmare, you're going to recall it a little bit more because a strong emotion was attached to it. 08:10.300 --> 08:20.160 Versus if it's just a regular dream, you might not remember it, but you will always remember a dream where it is extremely happy or extremely scary. 08:20.520 --> 08:22.040 So think of that. 08:22.040 --> 08:26.940 Anyway, the thing that you might know about the amygdala is usually the fight versus flight mechanism. 08:27.140 --> 08:43.040 And what I really want to explain is fight versus flight mechanism is a great way to showcase what the amygdala is, but it also is this part of you that's subconscious, and it decides what's like you, who's not like you. 08:43.040 --> 08:50.160 And based on that belief itself, you put people into categories of people to trust, people not to trust. 08:50.260 --> 09:03.360 And so for example, the amygdala, because it's stored in your memory section of your brain, it's also dictating subconsciously whatever socially constructive beliefs that you've had. 09:03.360 --> 09:06.140 And if you're wondering, what is a socially constructive belief? 09:06.500 --> 09:24.780 It's just any time when you were growing up or, you know, you had a teacher tell you that this is unsafe, your parents tell you that's not safe, or like anything that you've seen in movies, TV, indirectly, it's letting you know some memory for you to hold on to. 09:25.140 --> 09:28.420 Now, I want to give you kind of a better example here. 09:28.420 --> 09:32.280 So I always tell people, think about this way. 09:32.280 --> 09:35.460 You were growing up and you watched a bunch of movies as a kid. 09:35.460 --> 09:41.380 And every time someone had pink hair, they were the criminal, the villain in it. 09:41.620 --> 09:48.240 And not just that, but also you see on the news, people with pink hair are dangerous individuals, they're committing all the crimes. 09:48.240 --> 09:56.500 You read in textbooks, you read from teachers' letters, you read everything just showcasing that people with pink hair are dangerous. 09:56.740 --> 10:10.020 So when you see someone with pink hair at this point, you will probably clutch your bag a little bit closer, or you might cross the street, or you might actually lock your car doors when you see someone with pink hair. 10:10.440 --> 10:14.560 And I know that sounds like, but the person just has pink hair could. 10:14.980 --> 10:21.620 The thing is that you have been led to believe that someone with pink hair is someone dangerous. 10:22.080 --> 10:24.740 And that's a socially constructive belief. 10:24.880 --> 10:30.340 And the amygdala will always act on socially constructive beliefs when it comes to survival. 10:30.340 --> 10:36.680 So if it's known that someone with pink hair is dangerous, thus you will react in the same way. 10:37.980 --> 10:42.160 So the good news though is that it has to verify. 10:42.160 --> 10:45.200 So the prefrontal cortex acts kind of like the CEO in the brain. 10:45.380 --> 10:47.900 So this is completely conscious now. 10:47.900 --> 10:54.240 So what happens is the amygdala sends a message saying, warning, someone with pink hair is right behind you. 10:54.320 --> 11:11.620 And then your prefrontal cortex thinks, okay, I can either cross the street, or I can go into a building, or I can clutch my bag a little bit closer, or I can look behind me to be on top of everything, or I just ignore the threat. 11:11.960 --> 11:21.200 So the prefrontal cortex then, you decide which action to take, and it sends the message back to the amygdala to act on that action. 11:21.320 --> 11:28.660 But the one thing to note about is that you are completely conscious about it, and you're making that decision. 11:28.720 --> 11:33.360 But the good news is that there's still this validation. 11:33.360 --> 11:39.500 So people's biases, socially constructed beliefs, or whatnot, can always be challenged. 11:39.720 --> 11:43.720 And the best way how to do with that is through stories, hearing people's personal stories. 11:43.720 --> 12:01.860 So for example, in the same pink hair situation, if the person with pink hair made a YouTube video talking about how it's so terrible for them, because every time someone sees them, they see them as a criminal, and how that prevents them getting a job, 12:01.860 --> 12:18.240 how that prevents them getting where they need to go, how, for example, cops are called on them just for being outside, and how society as a whole isn't doing enough to understand that it's just because the person has pink hair. 12:18.240 --> 12:20.900 There's nothing else than that. 12:21.360 --> 12:36.220 So now if you put in a lens of a hacker, you probably have experienced once or twice, where when you tell someone you're a hacker, or you work in the hacker community, the next thing you know is that they take a step back, or the mouth kind of drops, or their eyes get bigger. 12:36.220 --> 12:37.780 They just get afraid. 12:37.780 --> 12:47.400 Because the thing is, is that our world has been socially constructed to see hackers as criminals, as a blanket for all hackers. 12:47.400 --> 12:55.900 And instead of thinking them as not just hackers, there's a difference between a hacker and an attacker, because they haven't learned that yet. 12:55.900 --> 12:59.520 And because our personal stories are not really out there yet either. 12:59.520 --> 13:01.500 And that's the problem. 13:04.220 --> 13:17.240 So what happens is, for the hacker situation, is that because of the mindset set by society, by people in the media, that's keeping us unsafe and preventing hackers what they do well in. 13:17.280 --> 13:26.060 Companies are afraid of hackers and don't want to create vulnerability disclosure policies because of the lack of a bilateral trust amongst hackers and organizations and government. 13:26.060 --> 13:29.340 It's one of the reasons why 60% do not report vulnerabilities. 13:29.340 --> 13:33.760 Hackers are scared of outdated laws such as CFA and DMCA. 13:33.800 --> 13:44.060 Also from interviewing attackers, one of the reasons they decide to move away from ethical hacking is the pay and the constant worrying of being prosecuted regardless if they did something legal. 13:44.060 --> 13:49.220 This is stated also similarly by those who switch from being an attacker to a hacker. 13:49.220 --> 13:52.340 The reason they switched was the insomnia of being arrested. 13:52.340 --> 13:58.500 Because there are cases when organizations prosecute ethical hackers regardless if they were in scope. 14:00.900 --> 14:07.260 So which leads us to needing to dive into the current legislation that can be found in most countries towards hackers. 14:07.260 --> 14:09.520 And this is worldwide legislation. 14:09.800 --> 14:19.460 So every country around the world has anti-hacking laws, anti-circumvention laws, also known as copyright type of laws, acceptable use policy. 14:19.720 --> 14:23.000 So let's first dive into the Computer Fraud Abuse Act. 14:23.220 --> 14:26.260 And every country has their own, but the U.S. 14:26.260 --> 14:28.820 is the first one I think who put it first. 14:28.820 --> 14:30.520 So let's dive into that one. 14:30.520 --> 14:32.680 The Computer Fraud Abuse Act in the U.S. 14:32.680 --> 14:42.740 cybersecurity bill that was enacted in 1984 as an amendment to existing computer fraud law, which has been included in the Comprehensive Crime Control Act of 1984. 14:43.040 --> 14:48.760 The law prohibits accessing a computer without authorization or in excess of authorization. 14:48.760 --> 14:54.160 Also to be used when a researcher tends to go out of scope, this act is used to prosecute hacking. 14:54.820 --> 14:58.880 Random fact, who here has heard of war games? 14:59.020 --> 15:05.140 Okay, did you know that Ronald Reagan, he watched it and freaked out about hackers and he's like, we gotta do something! 15:05.140 --> 15:07.360 So he pushed for CFA to happen. 15:07.900 --> 15:11.520 Now let's dive into anti-circumvention laws, so the copyright laws. 15:11.520 --> 15:15.500 So in Canada you have the copyright law, believe it or not, super easy. 15:15.500 --> 15:16.340 In the U.S. 15:16.340 --> 15:21.740 we have the DMCA, the Digital Millennium Copyright Act, and it was enacted in 1998. 15:21.780 --> 15:22.180 The U.S. 15:22.180 --> 15:28.780 copyright law that implements two 1996 treaties of World Intellectual Property Organization, WIPO. 15:28.900 --> 15:30.340 Basically it's the right to repair. 15:30.340 --> 15:33.760 Reverse engineering is seen as a breach of property. 15:34.320 --> 15:36.620 Let's dive into acceptable use policy. 15:37.040 --> 15:39.640 Now who here has ever read their terms and conditions? 15:39.640 --> 15:42.020 Say, for example, an Apple product. 15:42.020 --> 15:46.860 So I got trapped, I tried it, I got really bored, and I decided to watch a movie instead. 15:46.860 --> 15:49.380 But in general, they can be long and too much verbiage. 15:49.380 --> 15:52.700 It can confuse anyone, especially if English is not their first language. 15:52.700 --> 15:54.720 And you're not an attorney. 15:54.720 --> 15:56.540 I'm not an attorney, by the way. 15:56.660 --> 16:03.340 But the thing is, is that this can lead to some serious miscommunication issues for ethical hackers that don't really speak English. 16:03.900 --> 16:08.460 Clearly these laws' overall takeaway is they're old and out of date. 16:08.460 --> 16:10.560 And honestly, they were created out of fear. 16:10.560 --> 16:12.800 And you know now about fear. 16:13.020 --> 16:23.960 By not having empathy or taking the time to understand what is actually needed and why laws should only prosecute malicious actors, aka criminals, and not good hackers. 16:23.960 --> 16:32.400 Because at that time, and still to this day, a lot of legislators and politicians still don't know that hackers are good people. 16:32.400 --> 16:37.900 There's a difference between a malicious actor, an attacker, a cyber criminal, and a hacker. 16:39.580 --> 16:45.880 Overall takeaway from here is that there are laws that prevent good hacking in the same way that they prevent attackers. 16:45.980 --> 16:50.520 And we need good hacking, especially during COVID-19, you guys. 16:51.680 --> 17:00.180 And I really hate the CFA, and I want to dive a little bit further into it, just for you to know, in case you don't know. 17:00.200 --> 17:16.120 So the Computer Fraud Abuse Act, once again, was passed in 1984, is grown wildly outdated in that it offers prosecutors discretion to threaten huge potential fines and jail sentences for relatively undisturbing violations of computer policy. 17:16.960 --> 17:27.720 First, the CFA was written, punishes exceeding authorized access to a protected computer, a phrase vague enough to inspire some broad interpretations. 17:27.860 --> 17:34.320 Another flaw in the CFA is the redundant provisions that enable a person to be punished multiple times for the same crime. 17:34.320 --> 17:42.040 These crimes can be stacked one on top of another, resulting in a threat of a higher cumulative fines and jail time for the exact same violation. 17:42.340 --> 17:51.540 This also allows prosecutors to bully defendants into accepting a deal in order to avoid facing a multitude of charges from a single, solitary act. 17:51.540 --> 17:54.360 It also plays a significant role in sentencing. 17:54.360 --> 18:10.700 This ambiguity of provision meant to toughen sentencing for repeat offenders in the CFA may, in fact, make it possible for defendants to be sentenced based on what should be prior convictions, but were nothing more than multiple convictions for the same crime. 18:10.780 --> 18:15.700 And this is why it's now important for us to talk about Aaron Swartz's case. 18:17.080 --> 18:23.220 For those that do not know Aaron Swartz's case, it basically started off in 2011. 18:23.220 --> 18:24.760 Carmen Ortiz, the U.S. 18:24.760 --> 18:32.140 Attorney Office, charged Swartz with hacking into the MIT computer network to download millions of scholarly articles from JSTOR. 18:32.200 --> 18:38.420 An act of civil disobedience meant to protest the restricted access to research funded by taxpayers. 18:38.560 --> 18:39.580 For this, the U.S. 18:39.580 --> 18:45.820 Attorney brought charges that carried a maximum penalty of 35 years in prison and $1 million in fine. 18:45.820 --> 18:48.320 I want to pause there, because think about that. 18:48.320 --> 18:53.160 35 years in prison for downloading articles? 18:53.520 --> 18:57.800 You know, first degree murder, life in prison? 18:57.800 --> 19:04.100 No, it's actually on 25 years, and yet he was facing 35. 19:05.620 --> 19:16.420 Going back to this, they were able to charge such years because of the way CFA is run and the issues that have yet to be sorted since it was made into a law. 19:16.780 --> 19:22.180 But overall, looking at Aaron's situation, you have to understand what he was going through. 19:22.380 --> 19:30.140 He was dealing with a 17-month legal battle, one that had no set trial date and wasn't ending anytime soon. 19:30.140 --> 19:34.040 And through Swartz's perspective, it must have been so overwhelming. 19:34.640 --> 19:45.380 And it was the future of this legal battle that cast into doubt that Swartz unfortunately hung himself in his apartment on January 11, 2013. 19:45.620 --> 19:49.220 And following his death, the federal prosecutors went on to drop the charges. 19:49.540 --> 19:54.980 His family said that the government's prosecution contributed to his decision to take his own life. 19:56.320 --> 20:04.000 In memory, and for what he went through, unfortunately, there was Aaron's Law. 20:04.000 --> 20:11.580 It didn't pass because a probably lobbyist, very heavy corporate lobbyist, didn't want it to pass. 20:11.580 --> 20:32.600 But what Aaron Law removes, the phrase exceeds authorized access and replaces it with access with authorization, which is defined as to obtain information on a computer that the accessor lacks authorization to obtain by not only circumventing technological or fiscal measures designed to prevent unauthorized individuals from obtaining that information. 20:32.600 --> 20:42.620 The other thing is that it would ensure people won't face criminal liability for violating the terms of service agreement and contracted agreements, but also limits penalties. 20:42.620 --> 20:45.000 In other words, there was no more duplicated charges. 20:45.000 --> 20:48.520 So no more stack on stack what Aaron went through. 20:50.740 --> 21:05.000 And with improvements to legislation, so to CFA, DMCA, with these changes, then we can have what we need today. 21:05.680 --> 21:09.940 And that is, we need to also talk about the other parts. 21:09.940 --> 21:15.860 So not only legislation, so we cover legislation, we talked about the media, the press, and whatnot. 21:15.860 --> 21:20.140 We also talked about organizations named vulnerability disclosure programs. 21:21.460 --> 21:32.000 And I want to dive into those three categories a little bit more because in order to have any rights or to get any public change, we have to work with three categories. 21:32.900 --> 21:36.420 So in order to have rights for hackers, we need to get the public on board. 21:36.420 --> 21:42.520 And in order to do so, we need to dive into organizations, legislation, and media. 21:42.820 --> 21:46.240 We need media to push for public to become aware. 21:46.240 --> 21:56.000 In other words, we need to change the language and imagery of a hacker and start using the term cybercriminals for those who commit unethical hacking over really separate the two groups. 21:56.160 --> 22:06.600 In order to help the press, organizations need to be on board with bilateral trust, with having vulnerability disclosure programs, by showing they support hackers, the public changes their view in general. 22:07.040 --> 22:16.020 Lastly, to have organizations and public opinion to push and motivate Capitol Hill to get on board and update the current legislation that will protect ethical hackers. 22:16.020 --> 22:21.520 Overall, we need all three to be supporting hacker rights for it to become a reality. 22:22.580 --> 22:24.280 So how do we get there? 22:24.280 --> 22:25.760 You're probably wondering. 22:26.200 --> 22:29.240 So these are the five needs. 22:29.240 --> 22:35.160 And this is the way how we can push for awareness of ethical hackers needing rights. 22:35.280 --> 22:39.220 Now, how we get there, I'm going to need your help. 22:39.380 --> 22:50.620 Overall, we need to work with the media, we need society to notice that we're everyday heroes, we need organizations to have a vulnerability disclosure program, and we need representatives to update today's legislation. 22:51.160 --> 22:55.420 But how we do that, we have to change the imagery that the press is doing too. 22:56.740 --> 23:07.080 So the first step is this petition is for anyone out there that supports ethical hackers and want to bring about a change is the first step that I'm working on to bring attention to this matter. 23:07.080 --> 23:09.360 And we have over 1000 signatures. 23:09.680 --> 23:16.340 And honestly, it's really it's broken down by organizations, legislators, and the media and the hacker community. 23:16.340 --> 23:18.900 And anyone can sign this who agrees with it. 23:18.900 --> 23:22.960 So you can also share it around and sign it yourself. 23:23.040 --> 23:24.720 And it could be friends and family. 23:24.720 --> 23:27.240 It doesn't have to be everyone has to be a hacker who signs this. 23:27.240 --> 23:30.840 It could be anyone who believes that we deserve rights. 23:31.680 --> 23:35.500 The second step, tell the press. 23:35.680 --> 23:51.620 So anytime you see the press reporting hackers in a bad light, correct them, write a comment below in the story, tag them in a tweet, letting them know the term is actually cyber criminal and attacker, not hacker. 23:51.620 --> 23:53.100 Hacker are good people. 23:53.100 --> 23:55.080 So you need to do that. 23:55.080 --> 24:04.260 The other thing is calling them out when they use the dark hoodie imagery, or the ski mask, which is still to my mind is the worst thing ever. 24:05.220 --> 24:07.060 We need to do fact checks. 24:07.060 --> 24:12.860 And that's how you do it is unfortunately, you kind of have to publicly shame them till they get it right. 24:13.660 --> 24:28.560 And also, if you're someone who is interviewed by any journalist or anything like that, please make sure to keep enforcing them and let them know to use the term attacker versus hacker when reporting a breach. 24:28.680 --> 24:32.620 I've been doing that since I can do it. 24:32.840 --> 24:37.520 But it's going to take all of us and Chris Roberts has been great also doing that kind of stuff. 24:37.520 --> 24:44.040 So push out there, let them know they got the wrong term and the wrong imagery. 24:44.280 --> 24:46.660 So basically, everyone gets a fact check. 24:48.340 --> 24:52.780 The third step is the push for organizations to partner and campaign with us. 24:52.780 --> 25:12.060 We need companies, we need orgs to come out, even government agencies can too, basically to come out publicly saying like, we stand with the ethical hackers, and it's time to change things or to push for vulnerability disclosure programs to other companies, 25:12.060 --> 25:13.800 organizations and so on. 25:13.800 --> 25:17.920 So they're also aware of that this is a need now at this point. 25:18.400 --> 25:34.380 Also to push for organizations to have a like I just said, it's really important that we do that because I am so tired of having to spend hours, days and weeks to find some information of who to contact and what's in scope, what's not in scope. 25:34.380 --> 25:35.520 This is so important. 25:35.520 --> 25:42.900 Every company should have that at this point, because they need us more than ever before. 25:43.980 --> 25:48.960 The fourth step, contact your local representatives to update current legislation. 25:48.960 --> 26:03.700 So let them know that they need to change something, set up 10 minute appointments virtually, or try whatever you can to work with other groups of people that want to volunteer to go and approach representatives. 26:03.700 --> 26:12.640 And especially the ones that you need to be focusing on is your local and state because those are the ones that we're having some serious problems with. 26:13.160 --> 26:17.080 And also last but not least, follow the Van Buren U.S. 26:17.080 --> 26:17.960 case. 26:18.240 --> 26:23.060 And there's a reason for that in the fall the CFA is going to be revisited in Supreme Court. 26:23.060 --> 26:28.420 So please take a look at it, follow it, and also contact your representatives around it. 26:29.320 --> 26:33.220 The fifth step, support wonderful groups like this. 26:33.220 --> 26:40.760 So I'm the Calvary Disclosed.io, CERT Coordination Center, CERT CC, EFF and CTI League. 26:40.760 --> 26:49.560 It's really, that we work together and support one another and contact them to find out how they can do better or how you can help. 26:50.120 --> 27:00.440 So main takeaways overall, we need to push for awareness of ethical hackers and to let people know how we really are and our stories matter and how we get there. 27:00.440 --> 27:05.880 These are the main takeaways and I might need your advice and assistance if you want some. 27:06.400 --> 27:11.520 But most importantly, I want to remind you that the change starts with you and me. 27:11.520 --> 27:20.640 It's never too late and we must not give up because we must continue to fight for rights and this is a time that we do so. 27:22.020 --> 27:28.480 I want to first say thank you guys, everyone at IoT Village for selecting my talk to be a keynote. 27:28.480 --> 27:31.200 I want to also thank you guys for participating. 27:31.200 --> 27:32.940 So thank you all for existing. 27:32.980 --> 27:38.000 I also want to give a big shout out to Bo Woods and Harley Geiger. 27:38.100 --> 27:43.980 They helped basically put more ideas in my head for this conversation. 27:44.180 --> 27:47.780 Thank you guys so much and thank you IoT Village once again. 27:47.780 --> 27:52.260 Thank you guys for assisting and please stay safe and enjoy the rest of your DEF CON weekend.