1 00:00:00,360 --> 00:00:04,083 - We'd like to welcome Jay Healey from the CFP team, 2 00:00:05,580 --> 00:00:06,933 and then Fahmida. 3 00:00:07,770 --> 00:00:09,840 Welcome to DEF CON. 4 00:00:09,840 --> 00:00:11,850 They'll be giving a fireside talk. 5 00:00:11,850 --> 00:00:13,740 Please watch your schedules 6 00:00:13,740 --> 00:00:16,680 and you'll see the latest information 7 00:00:16,680 --> 00:00:18,570 on the Hacker Tracker app. 8 00:00:18,570 --> 00:00:21,630 So if you're following which times and rooms 9 00:00:21,630 --> 00:00:22,620 you'd like to see, 10 00:00:22,620 --> 00:00:24,780 that's the best place to find your updated information. 11 00:00:24,780 --> 00:00:29,154 So please give a warm welcome to our panelists. 12 00:00:29,154 --> 00:00:30,810 (audience applauding) 13 00:00:30,810 --> 00:00:31,643 - [Jay] Fahmida. 14 00:00:33,202 --> 00:00:34,035 Yeah. 15 00:00:35,856 --> 00:00:37,131 - Thank you for the reminder, Jay. 16 00:00:37,131 --> 00:00:39,147 (Jay and Fahmida laugh) 17 00:00:39,147 --> 00:00:41,429 Hi, I'm Fahmida Rashid, 18 00:00:41,429 --> 00:00:43,156 I'm managing editor of features at Dark Reading, 19 00:00:43,156 --> 00:00:45,390 and I am so excited to get a chance to... 20 00:00:45,390 --> 00:00:48,090 - [Jay] Yeah, I don't think we have audio for Fahmida? 21 00:00:49,212 --> 00:00:52,253 - Or should I just use? 22 00:00:52,253 --> 00:00:53,086 Okay. 23 00:00:54,840 --> 00:00:55,673 Hi, is this better? 24 00:00:55,673 --> 00:00:56,506 There we go. - Yay! 25 00:00:56,506 --> 00:00:57,690 - I hear myself now. 26 00:00:57,690 --> 00:01:00,061 - Hacking! (Fahmida laughs) 27 00:01:00,061 --> 00:01:01,560 - So I'm Fahmida Rashid, 28 00:01:01,560 --> 00:01:03,960 I'm the managing editor at Dark Reading, 29 00:01:03,960 --> 00:01:07,440 and it is my pleasure to be here at DEF CON 30 00:01:07,440 --> 00:01:09,390 to speak with Jay Healey. 31 00:01:09,390 --> 00:01:11,490 We're gonna be talking a little bit about the past, 32 00:01:11,490 --> 00:01:16,490 present, and the future of info sec, hacking, policy, 33 00:01:17,190 --> 00:01:19,050 we're gonna be touching on a lot of different topics. 34 00:01:19,050 --> 00:01:21,599 So Jay, thank you so much for joining me today. 35 00:01:21,599 --> 00:01:23,310 - Thanks, thanks Fahmida, excited. 36 00:01:23,310 --> 00:01:24,143 - Yeah. 37 00:01:24,143 --> 00:01:27,533 So I think one of the things that I was hearing is, 38 00:01:27,533 --> 00:01:30,333 this is DEF CON 30, but I think you mentioned to me 39 00:01:30,333 --> 00:01:34,093 it's also the 50th anniversary of the realization 40 00:01:34,093 --> 00:01:35,460 - Yeah. - that hackers 41 00:01:35,460 --> 00:01:37,560 will almost always succeed. 42 00:01:37,560 --> 00:01:39,150 - Yeah. - So what did that tell you? 43 00:01:39,150 --> 00:01:40,720 How did that make you feel? 44 00:01:40,720 --> 00:01:45,720 - Yeah, let me push that back on what led to that question. 45 00:01:46,814 --> 00:01:48,780 Are we, thank you for those that are giving me 46 00:01:48,780 --> 00:01:50,157 the universal sign of, 47 00:01:50,157 --> 00:01:51,957 are we doing any better on this one? 48 00:01:53,280 --> 00:01:54,639 Okay. 49 00:01:54,639 --> 00:01:56,010 - [Staff] Get the mic up to your mouth. 50 00:01:56,010 --> 00:01:58,020 - Check one, check two. 51 00:01:58,020 --> 00:01:59,460 I was just on this. 52 00:01:59,460 --> 00:02:02,403 Check one, check two, test, I'm wearing pants and a shirt. 53 00:02:06,780 --> 00:02:07,870 - No, it's not. 54 00:02:07,870 --> 00:02:09,390 - Check one, check two. 55 00:02:09,390 --> 00:02:10,380 Yes, thank you. 56 00:02:10,380 --> 00:02:11,553 We have connected. 57 00:02:12,810 --> 00:02:15,630 Great to hear you, or great that you can hear me. 58 00:02:15,630 --> 00:02:19,470 So Fahmida's intro, she was talking about 59 00:02:19,470 --> 00:02:23,673 how we haven't done as much as we want to as a community. 60 00:02:24,626 --> 00:02:26,460 This is DEF CON 30, right? 61 00:02:26,460 --> 00:02:31,140 If we look at why a lot of hackers do what we do, right, 62 00:02:31,140 --> 00:02:32,820 a lot of it is for curiosity, 63 00:02:32,820 --> 00:02:35,040 a lot of it is because we're driven to do so, 64 00:02:35,040 --> 00:02:38,643 but a lot of it is to make things better. 65 00:02:39,635 --> 00:02:42,363 We're doing this for a purpose, many of us. 66 00:02:44,250 --> 00:02:48,967 And I came across this quote that said, 67 00:02:48,967 --> 00:02:52,860 "Few, if any, contemporary computer security controls 68 00:02:52,860 --> 00:02:55,140 can stop a dedicated red team 69 00:02:55,140 --> 00:02:58,227 from easily accessing any information sought." 70 00:02:59,070 --> 00:03:02,370 So it's saying the red team is going to get through, right? 71 00:03:02,370 --> 00:03:03,600 The hacker is going to get through, 72 00:03:03,600 --> 00:03:06,120 the attacker has the advantage. 73 00:03:06,120 --> 00:03:08,553 That quote was from 1979. 74 00:03:09,630 --> 00:03:13,290 And I found actual quotes that go back to 1972 75 00:03:13,290 --> 00:03:15,390 that say the red team's gonna get through. 76 00:03:16,560 --> 00:03:17,430 So, all right. 77 00:03:17,430 --> 00:03:20,850 So if we're doing this to try and make things better, 78 00:03:20,850 --> 00:03:21,993 it's failing. 79 00:03:23,610 --> 00:03:26,730 Using the normal way we go about things. 80 00:03:26,730 --> 00:03:30,210 And that's why I'm glad to see everyone here in policy. 81 00:03:30,210 --> 00:03:33,090 That's a lot of what we're trying to get done with policy, 82 00:03:33,090 --> 00:03:35,160 is to say, all right, the normal things, 83 00:03:35,160 --> 00:03:40,160 like hacking things and telling people about it, 84 00:03:40,170 --> 00:03:43,800 isn't leading to the success at scale that we wanted, 85 00:03:43,800 --> 00:03:45,120 'cause the attackers, if anything, 86 00:03:45,120 --> 00:03:48,060 are just getting better and better. 87 00:03:48,060 --> 00:03:49,800 And if you heard, Chris Inglis and others 88 00:03:49,800 --> 00:03:51,690 talked about this in this room. 89 00:03:51,690 --> 00:03:55,020 And so just think of that, since 1972, right, 90 00:03:55,020 --> 00:03:59,100 think about all of the patents, 91 00:03:59,100 --> 00:04:00,990 all of the hundreds of billions of dollars, 92 00:04:00,990 --> 00:04:05,220 all the worked weekends, all the missed kids' birthdays 93 00:04:05,220 --> 00:04:08,850 that we, a community, have done in 50 years. 94 00:04:08,850 --> 00:04:12,033 And we haven't changed the most fundamental dynamic, 95 00:04:13,020 --> 00:04:14,620 'cause things aren't better now. 96 00:04:15,930 --> 00:04:19,350 - I mean, I'm thinking back, and like you said, 97 00:04:19,350 --> 00:04:21,150 it's like all those work weekends, 98 00:04:21,150 --> 00:04:24,270 we're thinking, "Hey, what is the purpose of all of this?" 99 00:04:24,270 --> 00:04:28,020 So it does get a little bit disheartening. 100 00:04:28,020 --> 00:04:31,500 - Yeah, and a lot of the mindset from this community 101 00:04:31,500 --> 00:04:32,550 over the last 30 years, 102 00:04:32,550 --> 00:04:35,190 I've started, I've been coming since DEF CON 9, 103 00:04:35,190 --> 00:04:36,870 I've been on the CFP review board 104 00:04:36,870 --> 00:04:39,213 for the last six or seven years, 105 00:04:40,740 --> 00:04:44,070 is that if we fuck things up, right? 106 00:04:44,070 --> 00:04:48,303 If we hack the planet, it's gonna be better, 107 00:04:49,180 --> 00:04:51,813 and it's not working that way. 108 00:04:53,220 --> 00:04:56,760 We're hacking stuff and it's not getting better, 109 00:04:56,760 --> 00:04:59,220 at least at the speed and scale that we want. 110 00:04:59,220 --> 00:05:01,500 If anyone heard Dark Tangent in here this morning, 111 00:05:01,500 --> 00:05:03,690 he was talking about how it worked for the Election Village. 112 00:05:03,690 --> 00:05:05,010 So we can do better, right? 113 00:05:05,010 --> 00:05:06,990 We can make it so that when we break things, 114 00:05:06,990 --> 00:05:08,880 it really is gonna lead to better outcomes 115 00:05:08,880 --> 00:05:10,320 on the other side. 116 00:05:10,320 --> 00:05:12,810 - So, I mean, before we even start figuring out, 117 00:05:12,810 --> 00:05:14,700 okay, what are we gonna do differently? 118 00:05:14,700 --> 00:05:16,860 Why don't we just kind of go back a little bit. 119 00:05:16,860 --> 00:05:20,673 What was the early days of hacking like? 120 00:05:23,250 --> 00:05:25,020 I mean, I know some of us have been around, 121 00:05:25,020 --> 00:05:27,360 but I know not all of us have been around for that, 122 00:05:27,360 --> 00:05:28,625 so what was that like? 123 00:05:28,625 --> 00:05:30,510 - Yeah, it's. 124 00:05:30,510 --> 00:05:33,810 So I don't have the hacking chops of a lot of the others 125 00:05:33,810 --> 00:05:35,520 on the CFP board. 126 00:05:35,520 --> 00:05:39,960 I'm there to help out on the policy talks. 127 00:05:39,960 --> 00:05:41,580 But it's really interesting to see 128 00:05:41,580 --> 00:05:46,230 how DEF CON has been changing as part of that, right? 129 00:05:46,230 --> 00:05:47,730 When we started off, 130 00:05:47,730 --> 00:05:50,730 you know, the early years at Alexis Park, right? 131 00:05:50,730 --> 00:05:52,503 It was about shenanigans. 132 00:05:53,970 --> 00:05:55,680 There was cool hacks. 133 00:05:55,680 --> 00:06:00,680 There was fucking stuff up and doing cool hacks. 134 00:06:00,810 --> 00:06:03,697 One of my buddies, he said to me one morning, 135 00:06:03,697 --> 00:06:05,797 "Oh God, how drunk was I last night?" 136 00:06:05,797 --> 00:06:06,663 "Oh man, I don't know, 137 00:06:06,663 --> 00:06:07,920 like I didn't think you were that drunk. 138 00:06:07,920 --> 00:06:08,753 What happened?" 139 00:06:08,753 --> 00:06:11,160 "Oh, I found an ATM receipt in my pocket 140 00:06:11,160 --> 00:06:12,930 from the Alexis Park." 141 00:06:12,930 --> 00:06:14,280 That was considered the height 142 00:06:14,280 --> 00:06:15,510 of the stupid thing you could do, 143 00:06:15,510 --> 00:06:17,910 is actually using the ATM at the Alexis Park, 144 00:06:17,910 --> 00:06:21,720 'cause it was the most hacked ATM in Las Vegas, 145 00:06:21,720 --> 00:06:22,983 and probably the world, 146 00:06:24,930 --> 00:06:28,903 and DEF CON was absolutely 100% 147 00:06:28,903 --> 00:06:32,880 a hacking conference for hackers. 148 00:06:32,880 --> 00:06:35,730 And it still substantially is now, 149 00:06:35,730 --> 00:06:39,393 but if anyone heard Jeff here today, 150 00:06:40,943 --> 00:06:42,510 I'm sorry, Dark Tangent, 151 00:06:42,510 --> 00:06:47,013 especially after Snowden and after Stuxnet, 152 00:06:48,480 --> 00:06:52,440 DT disinvited feds coming to the conference. 153 00:06:52,440 --> 00:06:55,470 He said, "You are no longer welcome in our conference. 154 00:06:55,470 --> 00:06:57,237 We need some time away." 155 00:06:58,110 --> 00:07:00,508 And that was around DEF CON, anyone remember that? 156 00:07:00,508 --> 00:07:01,920 That was around DEF CON 22? 157 00:07:01,920 --> 00:07:02,790 - 22. 158 00:07:02,790 --> 00:07:03,890 - Something like that? 159 00:07:05,640 --> 00:07:07,980 And just look at how different it is today, right? 160 00:07:07,980 --> 00:07:11,943 Not only have we repaired that rift for now, 161 00:07:13,710 --> 00:07:18,090 but Jeff has said, DT has said, we need to do better. 162 00:07:18,090 --> 00:07:20,700 We're not making a difference as a community of hackers 163 00:07:20,700 --> 00:07:21,780 just on our own, 164 00:07:21,780 --> 00:07:26,550 but we need to better integrate with the policy makers, 165 00:07:26,550 --> 00:07:28,500 not just in the United States, but across the world, 166 00:07:28,500 --> 00:07:30,660 so we have an actual policy track 167 00:07:30,660 --> 00:07:31,890 to try and make more difference. 168 00:07:31,890 --> 00:07:33,930 This is still a hacker conference, 169 00:07:33,930 --> 00:07:35,730 but I think you're seeing that commitment at DT 170 00:07:35,730 --> 00:07:37,110 that we need to start doing better. 171 00:07:37,110 --> 00:07:39,660 We need to start getting defense better than offense. 172 00:07:39,660 --> 00:07:43,320 - I think that's actually the more positive aspect 173 00:07:43,320 --> 00:07:44,250 that we've seen. 174 00:07:44,250 --> 00:07:47,760 Like hackers have always been a little bit on the outskirts, 175 00:07:47,760 --> 00:07:51,210 a little bit doing their own thing. 176 00:07:51,210 --> 00:07:53,160 But now with policy involvement, 177 00:07:53,160 --> 00:07:57,390 we're seeing a little bit more, not necessarily mainstream, 178 00:07:57,390 --> 00:08:00,660 but the idea that our ideas matter. 179 00:08:00,660 --> 00:08:03,300 So what have you seen in the past few years 180 00:08:03,300 --> 00:08:07,500 where you were seeing these kind of solicitation of ideas 181 00:08:07,500 --> 00:08:09,210 from the hacker community? 182 00:08:09,210 --> 00:08:10,590 - Yeah, and first I have to say, 183 00:08:10,590 --> 00:08:13,560 I'm speaking in my personal capacity right now, 184 00:08:13,560 --> 00:08:16,413 not with any of my affiliations. 185 00:08:17,610 --> 00:08:19,740 And we're starting to see a lot more ways 186 00:08:19,740 --> 00:08:21,240 that hackers can get involved. 187 00:08:21,240 --> 00:08:22,073 Just that you're here, 188 00:08:22,073 --> 00:08:24,540 that we have a policy track here. 189 00:08:24,540 --> 00:08:26,460 We heard some great ideas this morning. 190 00:08:26,460 --> 00:08:30,270 We had a panel and a lot of folks 191 00:08:30,270 --> 00:08:32,520 that are involved in the Policy Village, 192 00:08:32,520 --> 00:08:34,920 and some really great ideas came outta that. 193 00:08:34,920 --> 00:08:38,610 We heard from Mosfet, who's a fabulous hacker, 194 00:08:38,610 --> 00:08:40,470 and she went to Congress. 195 00:08:40,470 --> 00:08:43,380 She was part of TechCongress fellow 196 00:08:43,380 --> 00:08:48,000 that went to help members of Congress and their staff 197 00:08:48,000 --> 00:08:51,543 learn to do better, to have better laws. 198 00:08:52,770 --> 00:08:55,260 We had Monica Ruiz here, 199 00:08:55,260 --> 00:08:56,580 who was helping out, I think, 200 00:08:56,580 --> 00:08:59,100 something called Digital Peace Now, 201 00:08:59,100 --> 00:09:01,140 which is a global youth movement 202 00:09:01,140 --> 00:09:05,190 to say we're tired of nation states hacking, 203 00:09:05,190 --> 00:09:08,010 and everybody else having to pay the penalty, 204 00:09:08,010 --> 00:09:10,950 and so what can we do to try and to help 205 00:09:10,950 --> 00:09:12,783 make governments more responsible? 206 00:09:14,370 --> 00:09:15,600 And they're really well meaning. 207 00:09:15,600 --> 00:09:16,950 Is anyone with Digital Peace Now? 208 00:09:16,950 --> 00:09:19,380 Anyone signed up to Digital Peace Now? 209 00:09:19,380 --> 00:09:20,490 Super well meaning, 210 00:09:20,490 --> 00:09:23,970 but they don't understand the tech as well as they might. 211 00:09:23,970 --> 00:09:26,460 And so if that sounds like it's something 212 00:09:26,460 --> 00:09:27,420 that's of interest to you, 213 00:09:27,420 --> 00:09:30,930 they can really use your help in whatever country you're in. 214 00:09:30,930 --> 00:09:34,830 Like checking with your city council. 215 00:09:34,830 --> 00:09:37,590 There are people there that need your help as a hacker 216 00:09:37,590 --> 00:09:40,530 to say, "Good, yes, I need help. 217 00:09:40,530 --> 00:09:43,020 I need some advice on how we can do better." 218 00:09:43,020 --> 00:09:46,470 Whether that's at your village, your city, your state, 219 00:09:46,470 --> 00:09:49,920 your region, whatever those are. 220 00:09:49,920 --> 00:09:52,410 We had Jack Cable here this morning 221 00:09:52,410 --> 00:09:55,920 who was around, he got involved in Hack the Pentagon, 222 00:09:55,920 --> 00:09:57,330 the first bug bounty program 223 00:09:57,330 --> 00:09:59,250 against the Department of Defense. 224 00:09:59,250 --> 00:10:00,750 That's how he got his start, 225 00:10:00,750 --> 00:10:03,600 was finding these bugs in the Pentagon, 226 00:10:03,600 --> 00:10:04,620 and then moving on, 227 00:10:04,620 --> 00:10:06,330 and then he switched to a job in government 228 00:10:06,330 --> 00:10:10,620 to help do things like improve election security 229 00:10:10,620 --> 00:10:12,150 in the United States. 230 00:10:12,150 --> 00:10:16,230 And he did that 'cause he got in through the front door, 231 00:10:16,230 --> 00:10:18,600 in just doing a bug bounty program. 232 00:10:18,600 --> 00:10:19,920 So that's a U.S. example, 233 00:10:19,920 --> 00:10:23,070 but we're starting to see these "hack the blank" 234 00:10:23,070 --> 00:10:27,090 come up in all sorts of country. 235 00:10:27,090 --> 00:10:29,250 And the last one I'll mention is 236 00:10:29,250 --> 00:10:31,350 the United States Government, as well as other governments, 237 00:10:31,350 --> 00:10:34,380 when they're coming out with a new rule, 238 00:10:34,380 --> 00:10:36,480 they'll ask for input. 239 00:10:36,480 --> 00:10:38,040 So we heard this morning, 240 00:10:38,040 --> 00:10:40,507 Harley, who's a former congressional staffer, said, 241 00:10:40,507 --> 00:10:44,430 "Look, the FTC is coming out with a new rulemaking 242 00:10:44,430 --> 00:10:48,657 on what cybersecurity should be to help protect consumers." 243 00:10:49,710 --> 00:10:52,460 That so fits into the kinds of things that we're doing. 244 00:10:53,460 --> 00:10:56,190 And rulemaking, it sounds boring, 245 00:10:56,190 --> 00:10:59,130 but it's how big things change over time. 246 00:10:59,130 --> 00:11:02,403 Not just in the United States, but in other places. 247 00:11:03,750 --> 00:11:05,190 So whatever your context is, 248 00:11:05,190 --> 00:11:07,080 however it is that's interesting to you, 249 00:11:07,080 --> 00:11:09,270 take a look at these things, right? 250 00:11:09,270 --> 00:11:12,070 Beau Woods runs I Am the Cavalry 251 00:11:12,930 --> 00:11:15,543 with Josh Corman and others. 252 00:11:16,410 --> 00:11:18,540 And so take a look at I Am the Calvary. 253 00:11:18,540 --> 00:11:21,150 They did this probably, what, how long is it? 254 00:11:21,150 --> 00:11:22,200 Six years, maybe? 255 00:11:22,200 --> 00:11:23,233 Seven years? - A little bit longer. 256 00:11:23,233 --> 00:11:24,066 I mean, - Yeah. 257 00:11:24,066 --> 00:11:25,950 - they were around for at least four or five years 258 00:11:25,950 --> 00:11:27,660 before all the stuff locked down. 259 00:11:27,660 --> 00:11:29,157 - Oh wow, okay. 260 00:11:29,157 --> 00:11:30,930 And the message from I Am the Calvary 261 00:11:30,930 --> 00:11:35,100 is we can't just hack stuff and wait for someone else 262 00:11:35,100 --> 00:11:36,873 to own the responsibility of it. 263 00:11:37,710 --> 00:11:39,750 That if you hack something, 264 00:11:39,750 --> 00:11:42,390 you're responsible for the result, 265 00:11:42,390 --> 00:11:44,310 whether it gets fixed or not. 266 00:11:44,310 --> 00:11:47,670 So the name came from the cavalry's not coming, right? 267 00:11:47,670 --> 00:11:51,877 There are no adults that are going to come by and say, 268 00:11:51,877 --> 00:11:53,820 "Thank you for calling our attention to that. 269 00:11:53,820 --> 00:11:55,590 We got it from here." 270 00:11:55,590 --> 00:11:58,020 It is not gonna happen. 271 00:11:58,020 --> 00:12:00,090 Or at least it hasn't been happening. 272 00:12:00,090 --> 00:12:01,470 We're trying to do better. 273 00:12:01,470 --> 00:12:03,870 So this whole movement of I Am the Cavalry 274 00:12:03,870 --> 00:12:08,670 was to help hackers own up to that moment of good. 275 00:12:08,670 --> 00:12:09,630 How can we do better? 276 00:12:09,630 --> 00:12:12,420 How can we own the results? 277 00:12:12,420 --> 00:12:14,730 Not just for fucking things, 278 00:12:14,730 --> 00:12:16,320 but for unfucking them as well, 279 00:12:16,320 --> 00:12:18,840 and making sure that they stay unfucked. 280 00:12:18,840 --> 00:12:20,100 Technical term. 281 00:12:20,100 --> 00:12:21,600 - I think that's actually, 282 00:12:21,600 --> 00:12:23,310 when we were talking about all of this 283 00:12:23,310 --> 00:12:24,143 and as you were saying this, 284 00:12:24,143 --> 00:12:27,300 I'm thinking that is the biggest difference, I think, 285 00:12:27,300 --> 00:12:29,910 the early days of hacking and now, 286 00:12:29,910 --> 00:12:31,740 there's a little bit of accountability. 287 00:12:31,740 --> 00:12:34,710 The hackers are like, yeah, I'm doing all this cool stuff, 288 00:12:34,710 --> 00:12:36,270 but let me tell you how to fix it. 289 00:12:36,270 --> 00:12:38,370 Or even if I don't know how to fix it, 290 00:12:38,370 --> 00:12:42,150 give me someone who can sit down with me and fix it. 291 00:12:42,150 --> 00:12:44,207 And that level of accountability is, I think, 292 00:12:44,207 --> 00:12:47,670 one of the more positive aspects of what we've done. 293 00:12:47,670 --> 00:12:50,700 - I had a real tough moment after, 294 00:12:50,700 --> 00:12:52,620 it was probably around DEF CON 22, 295 00:12:52,620 --> 00:12:55,290 'cause anyone, anyone involved with NSA tool set 296 00:12:55,290 --> 00:12:56,370 and the folks that would come in 297 00:12:56,370 --> 00:12:58,320 doing the talks on NSA tool set? 298 00:12:58,320 --> 00:13:00,150 Not if you were actually doing NSA tool set, 299 00:13:00,150 --> 00:13:01,740 don't put up your hand. 300 00:13:01,740 --> 00:13:03,360 And it was after Snowden revelations, 301 00:13:03,360 --> 00:13:08,047 and it was a set of fabulous security researchers that said, 302 00:13:08,047 --> 00:13:09,540 "We wanna make... 303 00:13:09,540 --> 00:13:11,610 We wanna look at the stuff that Snowden revealed 304 00:13:11,610 --> 00:13:12,930 about what NSA was doing, 305 00:13:12,930 --> 00:13:15,930 and we wanna make it so easy," 306 00:13:15,930 --> 00:13:16,763 this was their words, 307 00:13:16,763 --> 00:13:18,300 "that a 10 year old girl could do it." 308 00:13:18,300 --> 00:13:21,030 Not sure why they had to gender that, but. 309 00:13:21,030 --> 00:13:23,370 And they were doing that for privacy. 310 00:13:23,370 --> 00:13:25,200 So their goal, I remember I was saying, 311 00:13:25,200 --> 00:13:26,670 they were hacking GSM encryption 312 00:13:26,670 --> 00:13:29,253 and they wanted to make hacking GSM so easy, 313 00:13:30,450 --> 00:13:32,580 and they were gonna do that for privacy. 314 00:13:32,580 --> 00:13:36,690 And I had real difficulty wrapping my head around that. 315 00:13:36,690 --> 00:13:37,770 It was a great talk. 316 00:13:37,770 --> 00:13:39,153 It was a great goal. 317 00:13:40,050 --> 00:13:43,110 But how long, especially back then, 318 00:13:43,110 --> 00:13:47,193 that process of we break things and then it will get fixed, 319 00:13:48,840 --> 00:13:50,850 it's not a direct causal relationship. 320 00:13:50,850 --> 00:13:51,840 Sorry, I'm an academic now. 321 00:13:51,840 --> 00:13:53,790 That's what we talk about, causal relationships. 322 00:13:53,790 --> 00:13:55,290 If you do something, 323 00:13:55,290 --> 00:13:57,390 are you expecting that it's actually gonna, 324 00:13:57,390 --> 00:14:00,120 what result does it actually get to? 325 00:14:00,120 --> 00:14:02,010 And so that's why I think we've done a lot better now 326 00:14:02,010 --> 00:14:02,910 in the community, 327 00:14:02,910 --> 00:14:05,227 of looking at that causal relationship. 328 00:14:05,227 --> 00:14:06,270 "Good, all right, if we break it, 329 00:14:06,270 --> 00:14:07,830 let's make sure it gets fixed." 330 00:14:07,830 --> 00:14:09,090 - And it's even just the fact 331 00:14:09,090 --> 00:14:11,280 that we have more of a structure, 332 00:14:11,280 --> 00:14:15,600 so that even if I can't make that, or I don't know who to, 333 00:14:15,600 --> 00:14:17,400 I now have sources to go to, 334 00:14:17,400 --> 00:14:19,627 we have bug bounty programs where they will say, 335 00:14:19,627 --> 00:14:21,930 "I'll help you make that connection." 336 00:14:21,930 --> 00:14:26,370 So I think we have more of an infrastructural support. 337 00:14:26,370 --> 00:14:27,360 - And I think the media, 338 00:14:27,360 --> 00:14:29,190 and I think the journalists are doing better too, 339 00:14:29,190 --> 00:14:30,023 right? - Thank you. 340 00:14:30,023 --> 00:14:30,897 - Yes. 341 00:14:30,897 --> 00:14:35,897 And if folks heard Jeff at DEF CON, I'm sorry, 342 00:14:36,480 --> 00:14:40,050 Black Hat, yesterday, introducing Kim Zetter, 343 00:14:40,050 --> 00:14:43,230 about how in the early days the journalists would just 344 00:14:43,230 --> 00:14:45,850 buzz in and buzz out and talk about the crazy hair 345 00:14:47,370 --> 00:14:50,880 and use the community for their purposes. 346 00:14:50,880 --> 00:14:53,610 Now you've got Dark Reading, you've got Kim Zetter, 347 00:14:53,610 --> 00:14:55,530 you've got so many other great journalists 348 00:14:55,530 --> 00:14:59,940 that are embedded in the community like yourself, 349 00:14:59,940 --> 00:15:02,733 deep tech chops in application security, 350 00:15:03,840 --> 00:15:07,050 and so help us to tell better stories, 351 00:15:07,050 --> 00:15:09,633 so that we get better change on the other side. 352 00:15:10,680 --> 00:15:13,170 - The one thing I wanted to actually touch upon, 353 00:15:13,170 --> 00:15:15,000 and you kind of hinted at it, 354 00:15:15,000 --> 00:15:17,430 I think a lot of the time when people hear, 355 00:15:17,430 --> 00:15:19,560 oh, hacking and policy, 356 00:15:19,560 --> 00:15:22,634 is, well, I'm not gonna run for office. 357 00:15:22,634 --> 00:15:25,980 I'm not a lawyer, so I don't know the laws. 358 00:15:25,980 --> 00:15:27,180 So you mentioned how 359 00:15:27,180 --> 00:15:29,670 working with the city council and stuff. 360 00:15:29,670 --> 00:15:31,770 How do you even start that language? 361 00:15:31,770 --> 00:15:34,710 How do you even get the folks in this room who are curious 362 00:15:34,710 --> 00:15:38,220 to understand that you don't need to be a legal expert 363 00:15:38,220 --> 00:15:39,630 to be involved in policies? 364 00:15:39,630 --> 00:15:40,980 - Right, they do that, right? 365 00:15:40,980 --> 00:15:42,723 They understand the legal side. 366 00:15:43,710 --> 00:15:46,680 They're curious about what you know, 367 00:15:46,680 --> 00:15:48,900 and so just have the conversation, right? 368 00:15:48,900 --> 00:15:51,810 I mean, for whatever level's comfortable for you, 369 00:15:51,810 --> 00:15:53,910 whatever path that you have is gonna be good. 370 00:15:53,910 --> 00:15:55,950 There's check out the stack for TechCongress 371 00:15:55,950 --> 00:15:56,850 and I Am the Cavalry. 372 00:15:56,850 --> 00:15:58,800 There's a lot of good material on this. 373 00:15:58,800 --> 00:16:00,330 If you've been out to BSides. 374 00:16:00,330 --> 00:16:02,760 BSides Las Vegas is usually a place 375 00:16:02,760 --> 00:16:04,260 where a lot of these folks are. 376 00:16:04,260 --> 00:16:06,870 If you go down to the policy track, look for Beau Woods, 377 00:16:06,870 --> 00:16:08,820 he's got the, he's got the, 378 00:16:08,820 --> 00:16:11,133 I think the hair's blue today? - I think so. 379 00:16:12,447 --> 00:16:13,890 - And just ask around there. 380 00:16:13,890 --> 00:16:17,223 There'll be a lot of folks that can help, 381 00:16:18,450 --> 00:16:20,430 not just have general ideas, 382 00:16:20,430 --> 00:16:22,380 but have been through it and helped others 383 00:16:22,380 --> 00:16:24,480 for whatever context you're bringing with. 384 00:16:25,350 --> 00:16:28,083 Just some other tips is one, trying at least, 385 00:16:29,580 --> 00:16:32,190 it's gonna take you a while to speak the language, 386 00:16:32,190 --> 00:16:34,650 but be forgiving of the language, right? 387 00:16:34,650 --> 00:16:37,710 Folks in policy, we say cyber a lot. 388 00:16:37,710 --> 00:16:40,380 If you can't forgive us that, (laughs) 389 00:16:40,380 --> 00:16:41,760 it's gonna have difficulty. 390 00:16:41,760 --> 00:16:43,050 If you wanna be understood, 391 00:16:43,050 --> 00:16:45,870 you have to help meet people halfway 392 00:16:45,870 --> 00:16:47,730 in how they talk about things. 393 00:16:47,730 --> 00:16:48,960 So on the policy side, 394 00:16:48,960 --> 00:16:51,690 attribution matters a lot to us, 395 00:16:51,690 --> 00:16:53,400 because at the end of the day, 396 00:16:53,400 --> 00:16:55,710 it's about what nation is responsible. 397 00:16:55,710 --> 00:16:58,320 I worked at the White House for a couple of years, right? 398 00:16:58,320 --> 00:17:00,090 I didn't care about attribution. 399 00:17:00,090 --> 00:17:02,880 I cared about national responsibility. 400 00:17:02,880 --> 00:17:04,320 At the end of the day, 401 00:17:04,320 --> 00:17:06,090 the president is gonna have to pick up the phone 402 00:17:06,090 --> 00:17:08,490 and he's gonna have to call some prime minister, 403 00:17:08,490 --> 00:17:09,607 some president and say, 404 00:17:09,607 --> 00:17:12,330 "Knock it off or there's gonna be consequences." 405 00:17:12,330 --> 00:17:13,533 That's not attribution. 406 00:17:14,430 --> 00:17:18,150 So that stuff matters at places like the White House 407 00:17:18,150 --> 00:17:22,320 and Congress or in your national equivalence. 408 00:17:22,320 --> 00:17:24,120 So again, if you can't get past the fact that, 409 00:17:24,120 --> 00:17:26,100 no, attribution's stupid, 410 00:17:26,100 --> 00:17:28,620 in your full Threatbutt and Attribution Dice, 411 00:17:28,620 --> 00:17:29,610 like that stuff's funny, 412 00:17:29,610 --> 00:17:33,690 and it might not matter much in your context, 413 00:17:33,690 --> 00:17:36,870 but it definitely matters when you're thinking about 414 00:17:36,870 --> 00:17:40,200 for some aspects of this national security policy. 415 00:17:40,200 --> 00:17:41,550 But definitely be yourself, right? 416 00:17:41,550 --> 00:17:43,620 If you're angry and you're pissed off, 417 00:17:43,620 --> 00:17:45,630 don't lose that. (laughs) 418 00:17:45,630 --> 00:17:48,240 Stay angry and stay pissed off. 419 00:17:48,240 --> 00:17:51,333 Just, let's keep it channeled and stay energized. 420 00:17:52,410 --> 00:17:55,560 - Yeah, I think we have a big problem sometimes 421 00:17:55,560 --> 00:17:58,020 when you get angry, when you are just annoyed, 422 00:17:58,020 --> 00:17:59,347 you're frustrated, you think, 423 00:17:59,347 --> 00:18:01,950 "Hey, nothing's ever gonna change," 424 00:18:01,950 --> 00:18:04,290 that we tend to get a little insular. 425 00:18:04,290 --> 00:18:07,440 So I think this track is the perfect way of explaining, 426 00:18:07,440 --> 00:18:08,850 don't become insular. 427 00:18:08,850 --> 00:18:10,710 - And within the course of one year, 428 00:18:10,710 --> 00:18:13,260 this was right around 2011, 2012, 429 00:18:13,260 --> 00:18:17,430 I had Jeff Moss, Dmitri Alperovitch, Richard Bejtlich, 430 00:18:17,430 --> 00:18:19,260 and others say we can't, 431 00:18:19,260 --> 00:18:21,300 we're frustrated 'cause we're not making the difference 432 00:18:21,300 --> 00:18:25,143 that we wanted to have through technology, 433 00:18:27,000 --> 00:18:29,580 but we don't know how to make this happen on policy. 434 00:18:29,580 --> 00:18:31,140 I was working for a think tank at the time, 435 00:18:31,140 --> 00:18:31,973 the Atlantic Council, sorry. 436 00:18:31,973 --> 00:18:34,606 So a lot of folks have been down this road of saying, 437 00:18:34,606 --> 00:18:36,300 I need to do differently, 438 00:18:36,300 --> 00:18:37,680 I need to figure out other ways 439 00:18:37,680 --> 00:18:41,040 to get my voice heard and to bring my knowledge 440 00:18:41,040 --> 00:18:42,360 and skills to bear. 441 00:18:42,360 --> 00:18:44,553 So this is well trod path. 442 00:18:49,710 --> 00:18:50,730 - We're talking a lot about 443 00:18:50,730 --> 00:18:52,770 how we are doing things differently now, 444 00:18:52,770 --> 00:18:57,030 but if you can even give me one example of something 445 00:18:57,030 --> 00:19:00,030 that we are doing better. 446 00:19:00,030 --> 00:19:01,680 I don't wanna be just doom and gloom 447 00:19:01,680 --> 00:19:03,690 saying we haven't done anything better. 448 00:19:03,690 --> 00:19:06,990 - So I consider myself a strategy person, right? 449 00:19:06,990 --> 00:19:10,050 It's been a long time since my fingers were on a keyboard 450 00:19:10,050 --> 00:19:12,903 in any meaningful way, or that'd be meaningful to y'all, 451 00:19:14,040 --> 00:19:16,590 remember the way I said it was went back to 1972, 452 00:19:16,590 --> 00:19:18,420 we're 50 years in 453 00:19:18,420 --> 00:19:21,903 where we haven't been having the effect that we want. 454 00:19:22,740 --> 00:19:25,920 And I was reading a news article 455 00:19:25,920 --> 00:19:28,200 maybe five years ago in "The Economist." 456 00:19:28,200 --> 00:19:31,957 And they looked at climate change and they said, 457 00:19:31,957 --> 00:19:35,100 "What have been the interventions 458 00:19:35,100 --> 00:19:36,990 that we have done as a species 459 00:19:36,990 --> 00:19:39,210 that's taken the most carbon dioxide equivalent 460 00:19:39,210 --> 00:19:40,800 outta the atmosphere?" 461 00:19:40,800 --> 00:19:43,260 And they rated them like 1 through 30. 462 00:19:43,260 --> 00:19:46,290 And they said, "As far as we can tell, 463 00:19:46,290 --> 00:19:48,990 no chuckleheads have ever asked the question 464 00:19:48,990 --> 00:19:50,370 in that way before." 465 00:19:50,370 --> 00:19:53,340 Here it is, one of the most compelling issues 466 00:19:53,340 --> 00:19:54,810 faced by humanity, 467 00:19:54,810 --> 00:19:56,227 and no one had ever said, 468 00:19:56,227 --> 00:19:59,370 "What have we done that's made the biggest difference 469 00:19:59,370 --> 00:20:02,340 at the largest scale and the least cost?" 470 00:20:02,340 --> 00:20:04,500 And so I had an epiphany of, (mimics explosion) 471 00:20:04,500 --> 00:20:08,490 so what is it that we as a community have done, 472 00:20:08,490 --> 00:20:09,810 that's given the defender 473 00:20:09,810 --> 00:20:12,540 the greatest advantage over attackers 474 00:20:12,540 --> 00:20:15,420 at the larger scale and the least cost? 475 00:20:15,420 --> 00:20:17,010 And let's do more of that. 476 00:20:17,010 --> 00:20:18,870 The number, any guesses, just shout out, 477 00:20:18,870 --> 00:20:20,490 the number one thing that we think we've done 478 00:20:20,490 --> 00:20:24,423 at scale and cost as a community? 479 00:20:26,970 --> 00:20:29,730 Windows Update, yeah, who said Windows Update? 480 00:20:29,730 --> 00:20:31,530 Absolutely. 481 00:20:31,530 --> 00:20:33,090 Because instead of doing something 482 00:20:33,090 --> 00:20:36,390 that only affects a single enterprise, 483 00:20:36,390 --> 00:20:38,830 we could come up with the most perfect widget 484 00:20:40,290 --> 00:20:41,910 and it gets all the VC money 485 00:20:41,910 --> 00:20:44,130 'cause it is the most brilliant thing. 486 00:20:44,130 --> 00:20:46,830 We still have to buy a billion of them. 487 00:20:46,830 --> 00:20:49,170 We've gotta integrate it into the enterprise 488 00:20:49,170 --> 00:20:50,520 or our home networks. 489 00:20:50,520 --> 00:20:51,690 We have to monitor it. 490 00:20:51,690 --> 00:20:53,010 We have to keep it up to date. 491 00:20:53,010 --> 00:20:55,410 We have to train people to use the widget. 492 00:20:55,410 --> 00:20:56,760 We have to get it to integrate 493 00:20:56,760 --> 00:20:59,010 with all the goddamn other tools that we have 494 00:21:00,210 --> 00:21:02,070 and do that a billion times. 495 00:21:02,070 --> 00:21:07,070 Things like Windows Update, cloud, end-to-end encryption, 496 00:21:07,740 --> 00:21:11,280 you do it once and a billion devices or people 497 00:21:11,280 --> 00:21:13,140 can take advantage of it. 498 00:21:13,140 --> 00:21:15,210 This is why, especially a lot of us on policy 499 00:21:15,210 --> 00:21:20,210 are so upset over government folks looking to break 500 00:21:21,510 --> 00:21:22,770 end-to-end encryption. 501 00:21:22,770 --> 00:21:25,650 It's one of the few things that aids the defenders 502 00:21:25,650 --> 00:21:27,630 at scale, easily, 503 00:21:27,630 --> 00:21:28,620 if it's implemented right. 504 00:21:28,620 --> 00:21:31,890 It's really one of the few things that you can get it 505 00:21:31,890 --> 00:21:34,680 and it really makes it hard for adversaries. 506 00:21:34,680 --> 00:21:36,063 - And it's actually one of those things 507 00:21:36,063 --> 00:21:39,390 that we've seen really become mainstream, 508 00:21:39,390 --> 00:21:41,550 because it's become easier to use. 509 00:21:41,550 --> 00:21:43,417 Like the number of people I know who say, 510 00:21:43,417 --> 00:21:45,300 "Oh, I know nothing about security," 511 00:21:45,300 --> 00:21:46,680 and they use Signal, 512 00:21:46,680 --> 00:21:48,120 and I'm saying, "There you go! (Jay laughs) 513 00:21:48,120 --> 00:21:51,750 Like that right there is an important thing you're doing." 514 00:21:51,750 --> 00:21:53,580 - And if I could push on one area. 515 00:21:53,580 --> 00:21:55,020 So for me as some of that strategy, 516 00:21:55,020 --> 00:21:57,453 we've never had a real strategy. 517 00:21:59,790 --> 00:22:03,180 What was the U.S. strategy for the Cold War? 518 00:22:03,180 --> 00:22:04,780 It's a single word, containment. 519 00:22:08,970 --> 00:22:10,470 Sorry, I'm a veteran, you know, 520 00:22:10,470 --> 00:22:12,030 for folks that were in the military, 521 00:22:12,030 --> 00:22:14,190 everybody knew what General Petraeus's strategy 522 00:22:14,190 --> 00:22:15,180 was for winning. 523 00:22:15,180 --> 00:22:17,100 It was win hearts and minds. 524 00:22:17,100 --> 00:22:19,410 A different general would have a different strategy, 525 00:22:19,410 --> 00:22:21,750 like get in firefights and kill people. 526 00:22:21,750 --> 00:22:23,520 Petraeus was very simple. 527 00:22:23,520 --> 00:22:26,430 No, we wanna win hearts and minds, more or less. 528 00:22:26,430 --> 00:22:28,020 It's a strategy that you can fit 529 00:22:28,020 --> 00:22:31,860 on a single small sheet of paper, in this phrase. 530 00:22:31,860 --> 00:22:36,540 So mine, since I read that quote from 1972 and 1979, 531 00:22:36,540 --> 00:22:38,130 was defensible. 532 00:22:38,130 --> 00:22:42,200 We've gotta get defender most advantage over the attack 533 00:22:42,200 --> 00:22:44,610 at the largest scale and least cost. 534 00:22:44,610 --> 00:22:45,870 Sometimes I like to flip it around 535 00:22:45,870 --> 00:22:47,760 and talk about a sustainable internet. 536 00:22:47,760 --> 00:22:51,960 Just like we want our grandkids to have an internet, 537 00:22:51,960 --> 00:22:54,213 to have clean air and clean water, 538 00:22:55,230 --> 00:22:56,673 better than we have today, 539 00:22:58,050 --> 00:23:00,030 we can think about the same, right? 540 00:23:00,030 --> 00:23:02,700 Let's have our grandkids where they have an internet 541 00:23:02,700 --> 00:23:06,360 that's at least as awesome as the one that we have today. 542 00:23:06,360 --> 00:23:08,880 'cause we can get so caught up in adversaries and the rest 543 00:23:08,880 --> 00:23:10,800 that we're not thinking about all the amazing things 544 00:23:10,800 --> 00:23:11,880 that we wanna do, 545 00:23:11,880 --> 00:23:13,803 and we want future generations to do. 546 00:23:15,930 --> 00:23:17,670 - Since we are talking about the future, 547 00:23:17,670 --> 00:23:21,300 and how we want the internet to be at least available 548 00:23:21,300 --> 00:23:23,760 for our grandkids, my children, 549 00:23:23,760 --> 00:23:27,900 but there's so many new types of technologies 550 00:23:27,900 --> 00:23:29,280 that's coming on. 551 00:23:29,280 --> 00:23:31,470 We are barely scratching the surface 552 00:23:31,470 --> 00:23:33,660 on understanding how we're gonna use it, 553 00:23:33,660 --> 00:23:35,370 how we're gonna regulate it. 554 00:23:35,370 --> 00:23:37,410 What are the policy implications 555 00:23:37,410 --> 00:23:39,870 that we should be thinking about with emerging tech? 556 00:23:39,870 --> 00:23:42,363 - Yeah, just think about, on emerging, 557 00:23:43,980 --> 00:23:45,900 because I know what I care about, 558 00:23:45,900 --> 00:23:49,800 a defensible internet that has defense better than offense, 559 00:23:49,800 --> 00:23:53,820 anytime I get asked about a new X, Y or Z, 560 00:23:53,820 --> 00:23:54,653 I always think about, 561 00:23:54,653 --> 00:23:56,610 all right, is this gonna preferentially aid 562 00:23:56,610 --> 00:23:58,710 the defender or the attacker? 563 00:23:58,710 --> 00:24:01,053 It, almost every time we've done anything, 564 00:24:01,890 --> 00:24:05,040 it's preferentially aided the attacker. 565 00:24:05,040 --> 00:24:06,930 That the attackers have been able to use 566 00:24:06,930 --> 00:24:10,030 the scale of the internet more effectively 567 00:24:10,920 --> 00:24:12,870 than the defenders have, 568 00:24:12,870 --> 00:24:15,810 to add scale to our operations and what we want to do. 569 00:24:15,810 --> 00:24:18,450 So anytime I get asked like quantum X, Y, or Z, or the rest, 570 00:24:18,450 --> 00:24:21,660 it's almost always, no, that's gonna help attackers more. 571 00:24:21,660 --> 00:24:24,300 Cloud, one of those that can definitely help, 572 00:24:24,300 --> 00:24:28,440 Beau Woods, Josh Corman, helped talk about it really well, 573 00:24:28,440 --> 00:24:31,500 that the original internet was never designed to be secure. 574 00:24:31,500 --> 00:24:32,550 We added things to it, 575 00:24:32,550 --> 00:24:35,160 and we just slapped Band-Aids on those. 576 00:24:35,160 --> 00:24:37,950 And now we've got five decades of Band-Aids all the way down 577 00:24:37,950 --> 00:24:41,460 when it comes to the security for the internet. 578 00:24:41,460 --> 00:24:43,560 Cloud is one of those opportunities 579 00:24:43,560 --> 00:24:46,260 that we can get it right from the start, 580 00:24:46,260 --> 00:24:47,880 once we get people trained for it. 581 00:24:47,880 --> 00:24:50,070 We really do have to have people more trained 582 00:24:50,070 --> 00:24:50,903 so that we're able to... 583 00:24:50,903 --> 00:24:52,590 - There's a definite mindset change 584 00:24:52,590 --> 00:24:54,143 that we need to make sure that people 585 00:24:54,143 --> 00:24:56,520 are not just bringing the same mistake, 586 00:24:56,520 --> 00:24:58,173 same ideas forward. 587 00:24:59,310 --> 00:25:00,330 - And before we switch, 588 00:25:00,330 --> 00:25:03,213 I know we're gonna probably switch to Q&A soon, 589 00:25:05,190 --> 00:25:06,937 we had a panel this morning and someone asked, 590 00:25:06,937 --> 00:25:11,937 "Who is your favorite trans or female hacker?" 591 00:25:12,900 --> 00:25:14,220 And we had a lot of great answers, 592 00:25:14,220 --> 00:25:17,280 a lot you'd expect from Grace Hopper to Katie Mou, 593 00:25:17,280 --> 00:25:19,680 to Amelia Koran and others. 594 00:25:19,680 --> 00:25:21,243 I wanna raise a woman named, 595 00:25:22,380 --> 00:25:24,270 her married name was Hilda Mathieu. 596 00:25:24,270 --> 00:25:25,770 Anyone heard of Hilda Mathieu? 597 00:25:26,790 --> 00:25:28,470 She's on the NSA Hall of Fame, 598 00:25:28,470 --> 00:25:31,470 because Hilda came up with the idea, 599 00:25:31,470 --> 00:25:32,613 back in the 80s, 600 00:25:33,810 --> 00:25:38,810 that NSA, that these new computer networks 601 00:25:39,450 --> 00:25:42,780 gave NSA this incredible ability 602 00:25:42,780 --> 00:25:46,413 to do amazing digital espionage. 603 00:25:47,280 --> 00:25:49,890 And she was doing this as a female technical engineer 604 00:25:49,890 --> 00:25:50,723 in the 80s. 605 00:25:50,723 --> 00:25:52,803 Just think of how rare that is. 606 00:25:53,970 --> 00:25:56,430 And she was the one that figured out, yep, we can, 607 00:25:56,430 --> 00:25:57,840 this is gonna be amazing, 608 00:25:57,840 --> 00:25:59,620 but she also realized 609 00:26:00,510 --> 00:26:03,483 this is gonna be a real problem for the United States, 610 00:26:04,470 --> 00:26:06,510 because we're incredibly vulnerable. 611 00:26:06,510 --> 00:26:08,880 So they were already understanding that at Fort Meade, 612 00:26:08,880 --> 00:26:10,620 in the 1980s. 613 00:26:10,620 --> 00:26:11,970 And what I really like about Hilda 614 00:26:11,970 --> 00:26:13,470 isn't just that she realized this 615 00:26:13,470 --> 00:26:17,460 and she was this real pioneering female engineer 616 00:26:17,460 --> 00:26:19,620 whom we've never heard about, 617 00:26:19,620 --> 00:26:24,510 but also her name before she got married was Faust. 618 00:26:24,510 --> 00:26:28,180 So here we've got this actual real Faustian bargain 619 00:26:29,670 --> 00:26:32,730 of wanting to both, 620 00:26:32,730 --> 00:26:35,400 NSA to have it both ways, 621 00:26:35,400 --> 00:26:37,710 and the U.S. Government to have it both ways, 622 00:26:37,710 --> 00:26:38,950 that we can hack shit 623 00:26:40,290 --> 00:26:44,490 and we can still secure things well enough. 624 00:26:44,490 --> 00:26:45,480 That we can hack it 625 00:26:45,480 --> 00:26:47,520 and the adversaries aren't gonna see what we're doing 626 00:26:47,520 --> 00:26:49,230 and decide they need to copy us. 627 00:26:49,230 --> 00:26:52,050 But also for us here in this room, 628 00:26:52,050 --> 00:26:54,180 and the people that have been coming to Vegas 629 00:26:54,180 --> 00:26:56,370 every August for 30 years, 630 00:26:56,370 --> 00:26:57,700 that we can hack shit 631 00:26:58,890 --> 00:27:03,060 and we don't have to worry about how it's going to turn out. 632 00:27:03,060 --> 00:27:06,060 It's the original Faustian bargain, (laughs) 633 00:27:06,060 --> 00:27:10,410 in part thanks to great engineers like Hilda Faust-Mathieu. 634 00:27:10,410 --> 00:27:11,940 - Exactly. 635 00:27:11,940 --> 00:27:14,910 So, I mean, we started off all of this conversation 636 00:27:14,910 --> 00:27:18,810 with you saying that we've been doing this 637 00:27:18,810 --> 00:27:21,963 over and over again, and nothing has changed. 638 00:27:24,120 --> 00:27:27,840 We are now talking about a strategy of defensibility. 639 00:27:27,840 --> 00:27:29,670 How are we going to change? 640 00:27:29,670 --> 00:27:31,710 What are the things that we can start saying, okay, 641 00:27:31,710 --> 00:27:33,150 these are the things we're gonna do 642 00:27:33,150 --> 00:27:36,933 so that we can get blue team better than the red? 643 00:27:39,900 --> 00:27:43,620 - I think you heard a lot of it here from Chris Inglis 644 00:27:43,620 --> 00:27:44,733 this morning, right? 645 00:27:46,500 --> 00:27:48,000 When I look at that question, 646 00:27:48,000 --> 00:27:49,500 so we've looked at, 647 00:27:49,500 --> 00:27:52,440 we did this report through the New York Cyber Task Force 648 00:27:52,440 --> 00:27:53,790 out of Columbia University, 649 00:27:53,790 --> 00:27:55,590 and we went back and we said, okay, 650 00:27:55,590 --> 00:27:57,420 what have been the actual innovations 651 00:27:57,420 --> 00:27:58,650 that have made the biggest difference 652 00:27:58,650 --> 00:28:01,920 at the largest scale and least cost 653 00:28:01,920 --> 00:28:04,050 over the last five decades, 654 00:28:04,050 --> 00:28:05,900 going back to the original passwords? 655 00:28:06,870 --> 00:28:08,100 And we looked at those 656 00:28:08,100 --> 00:28:10,830 that tend to operate inside the enterprise 657 00:28:10,830 --> 00:28:14,280 and those that operate across cyberspace as a whole. 658 00:28:14,280 --> 00:28:15,660 And the vast bulk of things I mentioned 659 00:28:15,660 --> 00:28:18,390 were up here in the technical things in the enterprise. 660 00:28:18,390 --> 00:28:20,670 So one, we really wanted to emphasize those things 661 00:28:20,670 --> 00:28:22,740 that we can get with the larger scale and the least cost. 662 00:28:22,740 --> 00:28:25,320 End-to-end encryption, cloud, we've already talked about. 663 00:28:25,320 --> 00:28:29,913 I also really want to emphasize the operational innovations. 664 00:28:31,470 --> 00:28:36,090 When the Morris Worm hit the early internet in 1988, 665 00:28:38,220 --> 00:28:40,470 it took down 10% of the early internet. 666 00:28:40,470 --> 00:28:42,960 Now, yeah, that was only like 6,000 computers 667 00:28:42,960 --> 00:28:43,943 or something like that, 668 00:28:43,943 --> 00:28:45,930 but it took down 10% of the internet, 669 00:28:45,930 --> 00:28:48,390 because they didn't have anybody 670 00:28:48,390 --> 00:28:51,300 that was there to look for vulnerabilities 671 00:28:51,300 --> 00:28:52,560 and patch them beforehand, 672 00:28:52,560 --> 00:28:54,750 and they didn't have any coordination mechanism 673 00:28:54,750 --> 00:28:56,460 once there was a disaster. 674 00:28:56,460 --> 00:28:58,770 The only coordination mechanism they had 675 00:28:58,770 --> 00:29:00,570 was the internet itself. 676 00:29:00,570 --> 00:29:03,870 So they invented a computer emergency response team. 677 00:29:03,870 --> 00:29:05,700 We had to invent a CERT. 678 00:29:05,700 --> 00:29:07,350 And now, of course, everybody has a CERT, 679 00:29:07,350 --> 00:29:09,960 they're considered part of the environment. 680 00:29:09,960 --> 00:29:14,310 We had to invent the role of a CISO, 681 00:29:14,310 --> 00:29:16,470 chief information security officer. 682 00:29:16,470 --> 00:29:18,300 Vladimir Levin, a Russian hacker, 683 00:29:18,300 --> 00:29:23,300 took Citibank for $15 million or so in 1995. 684 00:29:23,490 --> 00:29:25,500 And we had to invent a CISO. 685 00:29:25,500 --> 00:29:29,220 We had to invent a ISAC. 686 00:29:29,220 --> 00:29:31,350 I used to be the vice chairman of the FS-ISAC. 687 00:29:31,350 --> 00:29:36,240 We had to invent ISACs in 1999 by a presidential directive. 688 00:29:36,240 --> 00:29:40,020 The MITRE ATT&CK framework, Lockheed Martin Kill Chain. 689 00:29:40,020 --> 00:29:43,050 This stuff is, like the kill chain or the cyber framework, 690 00:29:43,050 --> 00:29:47,340 like, it's almost free, right? 691 00:29:47,340 --> 00:29:48,240 It's a doctrine. 692 00:29:48,240 --> 00:29:52,350 It's an idea about how you do things. 693 00:29:52,350 --> 00:29:55,410 And just think about all the defensive innovations 694 00:29:55,410 --> 00:29:58,440 that we've gotten from the MITRE ATT&CK framework, 695 00:29:58,440 --> 00:30:01,110 and how it's allowed us to talk about things at scale 696 00:30:01,110 --> 00:30:04,530 and implement things that sticks in taxi. 697 00:30:04,530 --> 00:30:07,800 So as you're thinking about how we can have 698 00:30:07,800 --> 00:30:11,340 the most impact at scale, it's not all about technology. 699 00:30:11,340 --> 00:30:13,770 It's a lot of these operational, these process, 700 00:30:13,770 --> 00:30:16,050 the organizational innovations. 701 00:30:16,050 --> 00:30:18,645 Actually, maybe like CISA, right, is now doing JCDC. 702 00:30:18,645 --> 00:30:19,478 - Yeah. 703 00:30:19,478 --> 00:30:21,870 - The Joint Cyber Defense Collaborative. 704 00:30:21,870 --> 00:30:23,970 - I mean, the thing that really strikes me about 705 00:30:23,970 --> 00:30:28,080 the CERT, ISAC, even the MITRE ATT&CK framework, 706 00:30:28,080 --> 00:30:31,140 it's actually fundamentally collaboration. 707 00:30:31,140 --> 00:30:33,480 It's like, okay, how do I work with you? 708 00:30:33,480 --> 00:30:35,250 I can't do this alone. 709 00:30:35,250 --> 00:30:37,410 I need to get other people with me. 710 00:30:37,410 --> 00:30:39,420 And what is the shared language? 711 00:30:39,420 --> 00:30:41,910 And I love the examples you gave, 712 00:30:41,910 --> 00:30:45,240 because it kind of goes back to what we were saying earlier, 713 00:30:45,240 --> 00:30:48,210 that we need to be working with the community. 714 00:30:48,210 --> 00:30:50,343 We need to be engaging with the community. 715 00:30:51,270 --> 00:30:52,980 - There there's a guy named Rob Knake 716 00:30:52,980 --> 00:30:54,720 who had been with the Council on Foreign Relations. 717 00:30:54,720 --> 00:30:56,520 Now he's the deputy for strategy 718 00:30:56,520 --> 00:30:58,860 at the Office of the National Cyber Director. 719 00:30:58,860 --> 00:31:01,140 And he had a great phrase to it. 720 00:31:01,140 --> 00:31:02,983 He called it the Home Depot model. 721 00:31:02,983 --> 00:31:03,840 (Fahmida laughs) 722 00:31:03,840 --> 00:31:05,720 You can do it, government can, - We all know the Home Depot, 723 00:31:05,720 --> 00:31:06,553 that's for sure. 724 00:31:06,553 --> 00:31:07,953 - You can do it, government can help. 725 00:31:09,780 --> 00:31:11,400 'Cause when I looked at, how do you get defensible? 726 00:31:11,400 --> 00:31:12,510 It's not through government. 727 00:31:12,510 --> 00:31:13,530 We're not gonna get there 728 00:31:13,530 --> 00:31:16,410 by creating some new government office 729 00:31:16,410 --> 00:31:19,050 and hiring more civil servants in any country 730 00:31:19,050 --> 00:31:20,250 or in every country. 731 00:31:20,250 --> 00:31:21,393 It can help. 732 00:31:22,260 --> 00:31:24,990 But it's, the only real change to get defensible 733 00:31:24,990 --> 00:31:27,153 is gonna happen through the private sector. 734 00:31:28,500 --> 00:31:30,060 And that for the government, for me, 735 00:31:30,060 --> 00:31:31,980 is you have to enable them, right? 736 00:31:31,980 --> 00:31:34,293 Imagine, sorry to use a sports analogy, 737 00:31:35,670 --> 00:31:37,170 say it's American baseball, right? 738 00:31:37,170 --> 00:31:39,180 You've got nine players on the field. 739 00:31:39,180 --> 00:31:41,550 What we had with General Alexander 740 00:31:41,550 --> 00:31:43,230 when he was at Fort Meade, 741 00:31:43,230 --> 00:31:44,460 and he tried this here, 742 00:31:44,460 --> 00:31:46,680 well he tried it at Black Hat, right? 743 00:31:46,680 --> 00:31:47,797 He would run around and say, 744 00:31:47,797 --> 00:31:49,920 "Wherever the ball was hit, we got it. 745 00:31:49,920 --> 00:31:52,380 We at Fort Meade, we can make the play. 746 00:31:52,380 --> 00:31:54,930 Let government do this. 747 00:31:54,930 --> 00:31:57,540 Finance sector, y'all are doing a good job, 748 00:31:57,540 --> 00:31:59,434 but let me put my sensors on your network 749 00:31:59,434 --> 00:32:01,527 so we can collect it for you." 750 00:32:04,410 --> 00:32:06,720 But most of the time, whenever the balls hit, 751 00:32:06,720 --> 00:32:07,950 it's someone in the private sector 752 00:32:07,950 --> 00:32:09,630 that's in the position to make the play. 753 00:32:09,630 --> 00:32:13,920 Now, they might not be able to see the ball. 754 00:32:13,920 --> 00:32:15,030 They might have an old, 755 00:32:15,030 --> 00:32:17,580 and the government has to help them to see the ball. 756 00:32:17,580 --> 00:32:19,980 They might have a bad glove, 757 00:32:19,980 --> 00:32:22,110 and we might need to help them with some capability. 758 00:32:22,110 --> 00:32:24,870 They might be like me when I was in Little League, 759 00:32:24,870 --> 00:32:26,280 and they might forget they're in the game 760 00:32:26,280 --> 00:32:30,030 until they hear the crack of the ball on the bat, 761 00:32:30,030 --> 00:32:32,520 and they need to be reminded. 762 00:32:32,520 --> 00:32:37,350 Others don't need the enablement, they need encouragement. 763 00:32:37,350 --> 00:32:38,520 They know it's a problem. 764 00:32:38,520 --> 00:32:41,700 They've got the capability, but they're not stepping up. 765 00:32:41,700 --> 00:32:43,620 And their government has ways that can help. 766 00:32:43,620 --> 00:32:45,510 Not just U.S. Government, but others. 767 00:32:45,510 --> 00:32:46,920 And last is, at the end of the day, 768 00:32:46,920 --> 00:32:50,070 it might come down to enforcing where it already happens, 769 00:32:50,070 --> 00:32:51,840 the finance sector, energy sector, 770 00:32:51,840 --> 00:32:53,070 publicly traded companies. 771 00:32:53,070 --> 00:32:54,810 The enforcing is already happening 772 00:32:54,810 --> 00:32:56,850 in lots of regulated industries. 773 00:32:56,850 --> 00:32:59,790 And we first said in 1998, 774 00:32:59,790 --> 00:33:01,720 presidential directives that said 775 00:33:02,700 --> 00:33:07,700 that if the market doesn't work, we might need to regulate. 776 00:33:07,770 --> 00:33:11,760 And so it's been 25 years, so maybe we're getting close. 777 00:33:11,760 --> 00:33:14,010 - So one thing I wanna touch upon 778 00:33:14,010 --> 00:33:16,620 before we go to the audience questions 779 00:33:16,620 --> 00:33:20,100 is that there are a lot of people 780 00:33:20,100 --> 00:33:23,040 who can't get involved with Congress. 781 00:33:23,040 --> 00:33:25,200 They can't get involved with FTC. 782 00:33:25,200 --> 00:33:27,570 And I've been hearing a lot of friends who are lawyers, 783 00:33:27,570 --> 00:33:30,870 they talk about how they're required by their law firm 784 00:33:30,870 --> 00:33:32,280 to do pro bono work, 785 00:33:32,280 --> 00:33:33,113 kind of give back - Interesting. 786 00:33:33,113 --> 00:33:34,170 - to the community. 787 00:33:34,170 --> 00:33:36,750 What would that look like from a hacker community? 788 00:33:36,750 --> 00:33:39,510 - It's a great, wow. 789 00:33:39,510 --> 00:33:40,740 I hadn't really thought about it. 790 00:33:40,740 --> 00:33:42,750 It's a lovely, I love that idea. 791 00:33:42,750 --> 00:33:46,710 So imagine, for what Fahmida's raising here, right? 792 00:33:46,710 --> 00:33:48,120 If you're working, 793 00:33:48,120 --> 00:33:50,580 if you're a CEO of a tech company, 794 00:33:50,580 --> 00:33:53,670 and you care about these issues, say election security, 795 00:33:53,670 --> 00:33:56,523 or you're worried about the water, 796 00:33:57,570 --> 00:34:02,570 you know that your local water utility is probably insecure. 797 00:34:03,810 --> 00:34:05,580 Just like a law firm might do pro bono, 798 00:34:05,580 --> 00:34:07,387 you're saying that you might say, 799 00:34:07,387 --> 00:34:08,220 "Hey, you know what? 800 00:34:08,220 --> 00:34:10,380 We're gonna go and we're gonna help out the water utility. 801 00:34:10,380 --> 00:34:11,910 And we're gonna do that pro bono, 802 00:34:11,910 --> 00:34:13,350 'cause we're a tech company." 803 00:34:13,350 --> 00:34:14,460 And you can imagine that working 804 00:34:14,460 --> 00:34:16,200 even not just for the CEO of a tech company, 805 00:34:16,200 --> 00:34:17,917 but it's anybody just saying, 806 00:34:17,917 --> 00:34:20,160 "Hey, I'm here to help." 807 00:34:20,160 --> 00:34:21,210 That's a great idea. - I mean, if you're an 808 00:34:21,210 --> 00:34:24,120 incident responder going up to, you know, 809 00:34:24,120 --> 00:34:26,580 hey journalists, human rights activists, 810 00:34:26,580 --> 00:34:28,950 and being like, "Hey, do you want us to take a look?" 811 00:34:28,950 --> 00:34:32,280 I just feel like there's so many ways we can use our skills. 812 00:34:32,280 --> 00:34:34,170 - And, you know, and it ties into 813 00:34:34,170 --> 00:34:36,870 a lot of corporations are worried about their ESG, right? 814 00:34:36,870 --> 00:34:40,080 Their environmental, social, and governance. 815 00:34:40,080 --> 00:34:42,420 And they wanna do well doing that. 816 00:34:42,420 --> 00:34:45,120 And companies wanna help on their ESG, 817 00:34:45,120 --> 00:34:46,590 and people will volunteer. 818 00:34:46,590 --> 00:34:47,610 So I worked for a bank, 819 00:34:47,610 --> 00:34:50,940 and we would go out and we would do Habitat for Humanity, 820 00:34:50,940 --> 00:34:54,480 or we'd clean a park, or we would go on a 5k fund run. 821 00:34:54,480 --> 00:34:57,630 Why shouldn't there be a tech aspect of that? 822 00:34:57,630 --> 00:35:00,330 And saying, "No, we're gonna get our awesome 823 00:35:00,330 --> 00:35:01,410 set of nerds together, 824 00:35:01,410 --> 00:35:02,790 and we're gonna go help people." 825 00:35:02,790 --> 00:35:06,510 Like a at risk community, 826 00:35:06,510 --> 00:35:09,040 like journalists, or Rohingya, or Uighurs. 827 00:35:09,934 --> 00:35:12,091 - Go to your local school and help your teachers. 828 00:35:12,091 --> 00:35:13,680 - (laughs) Go to school and help teachers. 829 00:35:13,680 --> 00:35:14,970 Yeah, it's a great idea 830 00:35:14,970 --> 00:35:16,890 to think about that as ESG, 831 00:35:16,890 --> 00:35:20,370 to think about that as pro bono work 832 00:35:20,370 --> 00:35:23,940 that we should do through our companies and get paid for it 833 00:35:23,940 --> 00:35:26,070 as part of making the world a better place. 834 00:35:26,070 --> 00:35:27,750 I love it, it's a great idea. 835 00:35:27,750 --> 00:35:32,250 - So there's, you have the microphone for the Q&A? 836 00:35:32,250 --> 00:35:34,980 So if you have any questions for Jason, 837 00:35:34,980 --> 00:35:36,984 please raise your hand, - Or Fahmida. 838 00:35:36,984 --> 00:35:39,963 - (laughs) and we welcome any questions here. 839 00:35:42,720 --> 00:35:43,740 I can barely see. - Got one. 840 00:35:43,740 --> 00:35:44,573 We have one over here. 841 00:35:44,573 --> 00:35:46,440 That's why I wear a hat. 842 00:35:46,440 --> 00:35:47,273 Yeah. 843 00:35:49,350 --> 00:35:52,413 - There's someone over there, and then a gentleman in blue. 844 00:35:57,696 --> 00:36:02,370 - [Staff] There you go. 845 00:36:02,370 --> 00:36:03,750 - [Audience Member] I mean, this kind of goes way back 846 00:36:03,750 --> 00:36:07,050 to the beginning of hacking and computer security. 847 00:36:07,050 --> 00:36:09,030 How do we still address the idea 848 00:36:09,030 --> 00:36:12,123 of what right do you have to check my doors? 849 00:36:13,200 --> 00:36:14,580 You know, if you walk down the neighborhood 850 00:36:14,580 --> 00:36:15,420 trying everybody's door, 851 00:36:15,420 --> 00:36:17,040 you're gonna get arrested. 852 00:36:17,040 --> 00:36:19,890 And there's that analogy to some of what's happening 853 00:36:19,890 --> 00:36:21,330 in the hacker community. 854 00:36:21,330 --> 00:36:22,230 How do we... 855 00:36:22,230 --> 00:36:24,240 Are we still struggling to justify that 856 00:36:24,240 --> 00:36:28,110 from a legal perspective and from an acceptance perspective? 857 00:36:28,110 --> 00:36:30,060 You know, who are you to check my doors? 858 00:36:30,060 --> 00:36:30,893 - Yeah. 859 00:36:33,180 --> 00:36:34,740 It's a great, and for those that didn't hear, 860 00:36:34,740 --> 00:36:36,360 who are you to check my doors, right? 861 00:36:36,360 --> 00:36:37,193 I mean, a lot of, 862 00:36:37,193 --> 00:36:39,660 and I think our communities had this 863 00:36:39,660 --> 00:36:41,550 from the very beginning. 864 00:36:41,550 --> 00:36:44,310 Who are you to tell me not to check your door? 865 00:36:44,310 --> 00:36:46,050 It's publicly available, 866 00:36:46,050 --> 00:36:47,610 why shouldn't I be able to scan it? 867 00:36:47,610 --> 00:36:49,080 I shouldn't even be able to get into your computer 868 00:36:49,080 --> 00:36:51,720 because you didn't protect it well enough. 869 00:36:51,720 --> 00:36:54,090 That's part of our legacy of being hackers 870 00:36:54,090 --> 00:36:56,550 and being in Vegas in this time of year, right? 871 00:36:56,550 --> 00:36:58,800 But also saying we also care about privacy 872 00:36:58,800 --> 00:36:59,910 and we want to do that. 873 00:36:59,910 --> 00:37:04,560 I liked how Chris Inglis put it together up here in that, 874 00:37:04,560 --> 00:37:05,880 at least how the government was seeing it, 875 00:37:05,880 --> 00:37:08,970 and saying we're all in it together, 876 00:37:08,970 --> 00:37:12,540 and just because your side of the boat has a leak, 877 00:37:12,540 --> 00:37:14,460 that's affecting the rest of us. 878 00:37:14,460 --> 00:37:16,770 And I honestly approached this. 879 00:37:16,770 --> 00:37:19,380 I talked about sustainability of how 880 00:37:19,380 --> 00:37:21,810 we want our kids and grandkids to have at least as good 881 00:37:21,810 --> 00:37:23,490 as we have today. 882 00:37:23,490 --> 00:37:28,440 And that's led to all sorts of norms and mindsets 883 00:37:28,440 --> 00:37:30,750 to think globally, act locally. 884 00:37:30,750 --> 00:37:32,430 But also knowing that the things that we do 885 00:37:32,430 --> 00:37:37,020 have externalities and that I can say, good, 886 00:37:37,020 --> 00:37:38,970 I have a right to use as much water I want, 887 00:37:38,970 --> 00:37:43,970 or I can have as polluting a company or car as I want. 888 00:37:43,980 --> 00:37:47,700 But the way I, speaking personally, 889 00:37:47,700 --> 00:37:48,690 I say it's kind of a dick move. 890 00:37:48,690 --> 00:37:50,070 Like yeah, you've got the right to do it, 891 00:37:50,070 --> 00:37:52,050 but you are imposing that on others, 892 00:37:52,050 --> 00:37:55,050 and you're making the situation worse for others. 893 00:37:55,050 --> 00:37:58,980 And so we are gonna have to think more about 894 00:37:58,980 --> 00:38:02,880 how that affects us, that good, your unpatched system. 895 00:38:02,880 --> 00:38:04,800 It's not just you getting hacked, 896 00:38:04,800 --> 00:38:06,690 but you're imposing that on others 897 00:38:06,690 --> 00:38:08,970 because you're gonna be part of a DDoS. 898 00:38:08,970 --> 00:38:12,960 And Inglis talks about this new social contract 899 00:38:12,960 --> 00:38:15,330 and what it is that we owe each other, 900 00:38:15,330 --> 00:38:18,990 what rights and responsibilities we can demand. 901 00:38:18,990 --> 00:38:21,630 But what are the concomitant responsibilities 902 00:38:21,630 --> 00:38:23,067 that we owe others? 903 00:38:23,067 --> 00:38:25,500 And I think it's a great part of that conversation. 904 00:38:25,500 --> 00:38:28,713 And for us to really address that afresh, 905 00:38:29,940 --> 00:38:31,530 'cause that's what it's coming down to a lot. 906 00:38:31,530 --> 00:38:33,240 What are we owed? 907 00:38:33,240 --> 00:38:38,240 Even if we're having unpatched systems versus, you know, 908 00:38:39,210 --> 00:38:41,880 FBI going in and patching systems for them 909 00:38:41,880 --> 00:38:44,190 like they did for Cyclops Blink, right? 910 00:38:44,190 --> 00:38:45,023 Let's address it. 911 00:38:45,023 --> 00:38:45,900 I think it's a great question. 912 00:38:45,900 --> 00:38:47,857 - Or the, ISP basically saying, 913 00:38:47,857 --> 00:38:49,920 "I'm gonna scan and I'm gonna take your computer 914 00:38:49,920 --> 00:38:52,410 off the network because you have malware." 915 00:38:52,410 --> 00:38:54,420 - And it's a great, and I know they won't happen. 916 00:38:54,420 --> 00:38:56,013 I remember there's a great, it was a, 917 00:38:56,013 --> 00:38:57,900 or I think it was Arbor Networks did this. 918 00:38:57,900 --> 00:39:00,600 And they looked at ISPs of saying, 919 00:39:00,600 --> 00:39:02,970 which, and this maybe 10 years ago, ISPs 920 00:39:02,970 --> 00:39:06,360 do you monitor for inbound attacks? 921 00:39:06,360 --> 00:39:08,580 And like 90% looked for inbound attacks. 922 00:39:08,580 --> 00:39:12,030 And they said, "Do you monitor for outbound attacks?" 923 00:39:12,030 --> 00:39:14,250 And half of them didn't even bother 924 00:39:14,250 --> 00:39:15,660 to monitor for outbound attacks, 925 00:39:15,660 --> 00:39:17,010 and those that did, 926 00:39:17,010 --> 00:39:19,833 something like half of them did nothing about it. 927 00:39:21,300 --> 00:39:23,340 They would just see the attacks going outbound. 928 00:39:23,340 --> 00:39:26,040 They said, "Not my problem." 929 00:39:26,040 --> 00:39:27,570 What do we think about that? 930 00:39:27,570 --> 00:39:31,110 Is that, I mean, that's classic tragedy of the commons, 931 00:39:31,110 --> 00:39:32,730 that they either don't, 932 00:39:32,730 --> 00:39:37,110 half of the respondents back then didn't know or didn't care 933 00:39:37,110 --> 00:39:39,330 that they were imposing problems on others. 934 00:39:39,330 --> 00:39:40,560 That's externalities. 935 00:39:40,560 --> 00:39:41,550 And at the end of the day, 936 00:39:41,550 --> 00:39:44,100 that's where, in the normal social contract, 937 00:39:44,100 --> 00:39:45,847 we expect the government to come in and say, 938 00:39:45,847 --> 00:39:48,810 "No, you can't impose these costs on others 939 00:39:48,810 --> 00:39:50,533 through your own inaction." 940 00:39:50,533 --> 00:39:52,444 - Yeah, can we get the next question? 941 00:39:52,444 --> 00:39:53,277 - Yeah. 942 00:39:53,277 --> 00:39:54,450 - [Audience Member] Hey, good afternoon. 943 00:39:54,450 --> 00:39:56,670 So I have kind of an unpopular opinion here, 944 00:39:56,670 --> 00:39:58,710 so this might be agitating to some people, 945 00:39:58,710 --> 00:40:00,630 but I think one of the reasons 946 00:40:00,630 --> 00:40:03,810 why we have issues with policy , 947 00:40:03,810 --> 00:40:07,080 and that's really what the gist of this conversation was, 948 00:40:07,080 --> 00:40:09,210 is that a lot of people focus on the hackers, 949 00:40:09,210 --> 00:40:10,380 so people that are here. 950 00:40:10,380 --> 00:40:11,370 But if you actually look at 951 00:40:11,370 --> 00:40:14,700 when we actually were good at things like strategy, 952 00:40:14,700 --> 00:40:16,980 it was from offset strategies. 953 00:40:16,980 --> 00:40:19,050 We had a first offset strategy, nuclear. 954 00:40:19,050 --> 00:40:21,780 We had a second offset strategy, ISR. 955 00:40:21,780 --> 00:40:24,600 We tried getting a third offset strategy of technology. 956 00:40:24,600 --> 00:40:28,920 Ash Carter, Bob Work, and a few other people, Jim Baker, 957 00:40:28,920 --> 00:40:30,960 and a few other people that worked at the building 958 00:40:30,960 --> 00:40:32,520 were champions of this. 959 00:40:32,520 --> 00:40:35,340 And then it fell on its feet for whatever reason, 960 00:40:35,340 --> 00:40:38,070 because of a session, we'll just call it. 961 00:40:38,070 --> 00:40:42,540 So to me, the biggest problem that we have as a nation, 962 00:40:42,540 --> 00:40:45,480 'cause I wanna take this beyond just the hacking, 963 00:40:45,480 --> 00:40:47,880 it's really about cybersecurity 964 00:40:47,880 --> 00:40:49,320 and how do you secure things. 965 00:40:49,320 --> 00:40:52,020 It's that we do not have a defined offset strategy. 966 00:40:52,020 --> 00:40:54,510 And from there that's where your operational tactic, 967 00:40:54,510 --> 00:40:56,970 your operations go and your tactics go. 968 00:40:56,970 --> 00:40:58,740 My question to you is 969 00:40:58,740 --> 00:41:01,027 will there ever be somebody that says 970 00:41:01,027 --> 00:41:04,170 "No shit, wake the fuck up and get an offset strategy." 971 00:41:04,170 --> 00:41:05,368 Over. 972 00:41:05,368 --> 00:41:06,420 - Yeah, cool. 973 00:41:06,420 --> 00:41:07,860 And this is probably gonna be the last question, 974 00:41:07,860 --> 00:41:10,560 unless you want to take one more and then I answer both? 975 00:41:10,560 --> 00:41:11,550 I don't know how we're doing on time 976 00:41:11,550 --> 00:41:12,480 - [Staff] Two minutes. 977 00:41:12,480 --> 00:41:13,800 - Yeah, you wanna take one more of the question 978 00:41:13,800 --> 00:41:14,850 and then we can, yeah. - So he had, 979 00:41:14,850 --> 00:41:16,110 the gentleman in the blue, - Awesome. 980 00:41:16,110 --> 00:41:18,270 do you still have a question? 981 00:41:18,270 --> 00:41:19,103 You're fine? 982 00:41:19,103 --> 00:41:21,120 Okay, and then I think the gentleman in the black 983 00:41:21,120 --> 00:41:22,680 with the orange lanyard, 984 00:41:22,680 --> 00:41:26,070 he was one of the first people to have his hands up. 985 00:41:26,070 --> 00:41:27,533 - Thanks, Mike, we'll catch up. 986 00:41:32,730 --> 00:41:34,317 - [Staff] We have two minutes left. 987 00:41:34,317 --> 00:41:35,206 Two minutes, no rush. 988 00:41:35,206 --> 00:41:36,510 - [Audience Member] (laughs) Thanks. 989 00:41:36,510 --> 00:41:38,643 Hey, Jason, very good talk as always. 990 00:41:39,630 --> 00:41:42,360 You referenced earlier about control effectiveness, 991 00:41:42,360 --> 00:41:43,530 that for nearly 50 years, 992 00:41:43,530 --> 00:41:45,900 we haven't really seen significant advancement 993 00:41:45,900 --> 00:41:47,070 in control effectiveness. 994 00:41:47,070 --> 00:41:50,580 I was curious if, especially from a policy standpoint, 995 00:41:50,580 --> 00:41:55,580 we can get firms to all agree to improve cyber hygiene, 996 00:41:56,010 --> 00:41:58,530 cyber control, capabilities, and effectiveness. 997 00:41:58,530 --> 00:42:03,530 How would you suggest measuring control effectiveness 998 00:42:03,570 --> 00:42:07,380 and thresholds for essentially defining good. 999 00:42:07,380 --> 00:42:08,280 - Perfect, thanks. 1000 00:42:09,480 --> 00:42:12,060 So first, the first one is a very 1001 00:42:12,060 --> 00:42:13,290 U.S. Department of Defense strategy. 1002 00:42:13,290 --> 00:42:15,300 This thing's called the third offsets. 1003 00:42:15,300 --> 00:42:18,150 And the offsets were a military strategy to say, 1004 00:42:18,150 --> 00:42:21,210 what are the things that the United States and allies, 1005 00:42:21,210 --> 00:42:24,270 that are super easy for the United States 1006 00:42:24,270 --> 00:42:25,350 and our allies to do, 1007 00:42:25,350 --> 00:42:27,930 but are really hard for our adversaries. 1008 00:42:27,930 --> 00:42:28,763 I actually thought of it 1009 00:42:28,763 --> 00:42:30,810 as an encryption problem, (laughs) right? 1010 00:42:30,810 --> 00:42:31,920 'Cause encryption is there. 1011 00:42:31,920 --> 00:42:33,510 It's meant to be really easy one way 1012 00:42:33,510 --> 00:42:35,190 and really difficult the other way. 1013 00:42:35,190 --> 00:42:37,340 And it just took that to military strategy. 1014 00:42:40,582 --> 00:42:43,870 And so we were trying this over the last couple years 1015 00:42:44,850 --> 00:42:46,567 and people in D.C. would say, 1016 00:42:46,567 --> 00:42:49,380 "Cyber is a way that we're gonna do this offset strategy." 1017 00:42:49,380 --> 00:42:52,290 And I had no idea what they were talking about, 1018 00:42:52,290 --> 00:42:54,780 'cause it is just as easy, if not easier, 1019 00:42:54,780 --> 00:42:57,330 for our adversaries to have offensive cyber capabilities 1020 00:42:57,330 --> 00:42:58,500 as it is for us. 1021 00:42:58,500 --> 00:43:00,150 What's really hard for them 1022 00:43:00,150 --> 00:43:01,953 is to work with the private sector. 1023 00:43:03,060 --> 00:43:06,330 When you look back at almost every major cyber incident 1024 00:43:06,330 --> 00:43:08,700 that we've ever had, anywhere in the world, 1025 00:43:08,700 --> 00:43:11,850 it's almost always the private sector that has the agility, 1026 00:43:11,850 --> 00:43:13,110 the subject matter expertise, 1027 00:43:13,110 --> 00:43:14,910 and they have their hands deep in cyberspace, 1028 00:43:14,910 --> 00:43:16,023 and they can fix it. 1029 00:43:17,070 --> 00:43:18,810 Governments lack that. 1030 00:43:18,810 --> 00:43:20,880 So we need to do those things that the Russians, 1031 00:43:20,880 --> 00:43:23,250 the Chinese, the Iranians can't do, 1032 00:43:23,250 --> 00:43:25,710 is work with the private sector in the rich way 1033 00:43:25,710 --> 00:43:26,820 that we do in the West. 1034 00:43:26,820 --> 00:43:28,410 And then to close out on the measurement, 1035 00:43:28,410 --> 00:43:30,270 it's a fabulous question. 1036 00:43:30,270 --> 00:43:31,590 I'm really interested, 1037 00:43:31,590 --> 00:43:35,220 not on a measuring control by control, 1038 00:43:35,220 --> 00:43:36,450 but how do we measure 1039 00:43:36,450 --> 00:43:39,360 if defense is getting better than offense 1040 00:43:39,360 --> 00:43:41,430 at the largest scale of the internet? 1041 00:43:41,430 --> 00:43:45,240 For example, if we're seeing shorter breakout times, 1042 00:43:45,240 --> 00:43:47,190 we're probably not doing our job. 1043 00:43:47,190 --> 00:43:49,260 If we see longer breakout times, 1044 00:43:49,260 --> 00:43:51,630 if we see them taking longer to get in, 1045 00:43:51,630 --> 00:43:53,880 those are all the sorts of things that we might imagine 1046 00:43:53,880 --> 00:43:55,290 if the internet's getting more defensible. 1047 00:43:55,290 --> 00:43:57,694 - That might have to be a conversation next year. 1048 00:43:57,694 --> 00:43:58,680 - Yeah, exactly. (laughs) 1049 00:43:58,680 --> 00:43:59,700 - Jay, thank you so much 1050 00:43:59,700 --> 00:44:01,017 for joining us today. - Thank you. 1051 00:44:01,017 --> 00:44:02,250 - And thank you everyone. 1052 00:44:02,250 --> 00:44:03,750 Thank you for your good questions. 1053 00:44:03,750 --> 00:44:04,583 - Yep. (audience applauds) 1054 00:44:04,583 --> 00:44:05,416 Thanks for the questions. 1055 00:44:05,416 --> 00:44:06,390 Thanks for caring about policy. 1056 00:44:06,390 --> 00:44:07,500 Stay angry. 1057 00:44:07,500 --> 00:44:08,823 Go unfuck things.