We'd like to welcome Jay Healy from the CFP team, and then Flamita.
Welcome to DEF CON.
They'll be giving a fireside talk.
Please watch your schedules, and you'll see the latest information on the Hacker Tracker app.
So if you're following which times and rooms you'd like to see, that's the best place to find your updated information.
So please give a warm welcome to our panelists.
Thank you for the reminder.
Hi, I'm Nandini, and I'm so excited to get a chance.
Yeah, I don't think we have audio for Flamita.
Should I just?
Yeah.
Okay.
Hi, there we go.
I hear myself now.
Hacking.
So I'm Flamita Rashid.
I'm the managing editor at Dark Reading, and it is my pleasure to be here at DEF CON to speak with Jay Healy.
We're going to be talking a little bit about the past, present, and the future.
InfoSec, hacking, policy, we're going to be touching on a lot of different topics.
So, Jay, thank you so much for joining me today.
Thanks, Miss.
Thanks for being excited.
Yeah.
So I think one of the things that I was hearing is this is DEF CON 30.
And I think you mentioned to me, it's also the 50th anniversary of the realization that hackers will almost always succeed.
Yeah.
So what does that tell you?
How does that make you feel?
Yeah, let me push that back on what led to that question.
Are we, thank you for those that are giving me the universal sign of, are we doing any better on this one?
Okay.
Check one, check two.
And I was just on this, check one.
Check two, test.
I'm wearing pants and a shirt.
Check one, check two.
Yes, thank you.
We have connected.
Great to hear you.
Or great that you can hear me.
So, Femida's intro, she was talking about how we haven't done as much as we want to as a community.
You know, this is DEF CON 30, right?
If we look at why a lot of hackers do what we do.
A lot of it is for curiosity.
A lot of it is because they're driven to do so.
But a lot of it is to make things better.
Right?
We're doing this for a purpose, many of us.
And I came across this quote that said, few, if any, contemporary computer security controls can stop a dedicated red team from easily accessing any information sought.
Right?
So, it's saying that.
the red team is going to get through, the hacker is going to get through, the attacker
has the advantage.
That quote was from 1979, and I found actual quotes that go back to 1972 that say the red
team is going to get through.
So if we're doing this to try and make things better, it's failing.
Using the normal way we go about things.
That's why I'm glad to see everyone here in policy.
That's a lot of what we're trying to get done with policy, is to say, all right, the normal
things, like hacking things and telling people about it, isn't leading to the success at
scale that we wanted.
Because the attackers, if anything, are just getting better and better.
Have you heard Chris Inglis and others talk about this in this room?
And so just think of that since 1972.
Think about.
All of the patents, all of the hundreds of billions of dollars, all the worked weekends,
all the missed kids' birthdays that we, a community, have done in 50 years, and we haven't
changed the most fundamental dynamic because things aren't better now.
I mean, I'm thinking back and like you said, it's like all those work weekends, we're thinking,
hey, what is the purpose of all of this?
Right.
So it does get a little bit disheartening.
Yeah.
And a lot of the mindset from this community over the last 30 years, I've been coming
since DEFCON 9, I've been on the CFP review board for the last six or seven years, is
that if we fuck things up, right, if we hack the planet, it's going to be better.
And it's not working that way.
Right.
We're hacking stuff and it's not getting better, at least at the speed and scale that
we want.
If anyone heard Dark Tangent in here this morning, he was talking about how it worked
for the election village.
So we can do better.
Right.
We can make it so that when we break things, it really is going to lead to better outcomes
on the other side.
So, I mean, before we even start figuring out, okay, what are we going to do differently?
Why don't we just kind of go back a little bit?
What was the early days of hacking like?
What was...
I know.
I mean, I know some of us have been around, but I know not all of us have been around
for that.
So what was that like?
Yeah.
It's...
So I don't have the hacking chops of a lot of the others on the CFP board, right?
I'm there to help out on the policy talks.
But it's really interesting to see how DEFCON has been changing as part of that.
Right?
When we started off, you know, the early years at Alexis Park, right, it was about shenanigans.
You know, there was cool hacks.
There was fucking stuff up, you know, and doing cool hacks, right?
If you ever...
One of my buddies, he said to me one morning, oh, God, how drunk was I last night?
Oh, man, I don't know.
Like, I didn't think you were that drunk.
What happened?
Oh, I found an ATM receipt in my pocket from the Alexis Park, right?
That was considered the height of the stupid thing you could do was actually using the
ATM at the Alexis Park because it was the most hacked ATM in Las Vegas.
Right?
It was probably the world.
And DEFCON was absolutely 100% a hacking conference for hackers, and it still substantially
is now.
But if anyone heard Jeff here today, I'm sorry, Dark Tangent, right, especially after
Snowden and after Stuxnet.
DT disinvited Feds coming to the conference.
He said, you are no longer welcome to our conference.
We need some time away.
And that was around DEFCON 22.
Something like that.
And just look at how different it is today, right?
Not only have we repaired that rift for now, but Jeff has said, DT has said, we need to
do better.
We're not making a difference as a community of hackers just on our own.
But we need to better integrate with the policy makers, not just in the United States
but across the world, so we have an actual policy track to try and make more difference.
This is still a hacker conference.
But I think you're seeing that commitment at DT that we need to start doing better.
We need to start getting defense better than offense.
I think that's actually the more positive aspect that we've seen.
Hackers have always been a little bit on the outskirts, a little bit doing their own thing.
But now with policy involvement, we're seeing a little bit more, not necessarily mainstream,
but the idea that our ideas matter.
So what have you seen in the past few years where you were seeing these kind of solicitation
of ideas from the hacker community?
Yeah.
And first, I have to say, I'm speaking in my personal capacity right now, not with
any of my affiliations.
And so we're starting to see a lot more ways that hackers can do better.
We're starting to see a lot more ways that hackers can get involved, right, just that
you're here, that we have a policy track here.
We had some great ideas this morning.
We had a panel and a lot of folks that are involved in the policy village, and some really
great ideas came out of that.
We heard from Mosfet, who is a fabulous hacker, and she went to Congress, right?
She was part of TechCongress, a fellow that went to help members of Congress and their
staff learn to do better, right?
To have a policy.
To have better laws.
We had Monica Ruiz here, who is helping out, I think, something called Digital Peace Now,
which is a global youth movement to say, we're tired of nation states hacking and everybody
else having to pay the penalty.
And so what can we do to try and get, to help make governments more responsible?
And they're really well-meaning.
Is anyone with Digital Peace Now, anyone signed up to Digital Peace Now?
Super well-meaning.
But they don't understand the tech as well as they might.
And so if that sounds like it's something that's of interest to you, they can really
use your help.
In whatever country you're in, like checking with your city council, like there are people
there that need your help as a hacker to say, good, yes, I need help.
I need some advice on how that we can do better, whether that's at your village, your city,
your state, your region, whatever those are.
We had Jack King.
He was on the cable here this morning, who's around.
He got involved in Hack the Pentagon, the first bug bounty program against the Department
of Defense.
That's how he got his start, was finding these bugs in the Pentagon and then moving
on.
And then he switched to a job in government to help do things like improve election security
in the United States.
And he did that because he got in through the front door and just doing a bug bounty
program.
So that's a U.S. example.
But we're starting to do that now.
We're starting to see these hack the blank come up in all sorts of countries.
And the last one I'll mention is the United States government, as well as other governments,
when they're coming out with a new rule, they'll ask for input.
So we heard this morning, Harley, who's a former congressional staffer, said, look,
the FTC is coming out with a new rulemaking on what cybersecurity should be to help protect
consumers.
That's so fascinating.
It fits into the kinds of things that we're doing.
And rulemaking, it sounds boring, but it's how big things change over time.
Not just in the United States, but in other places.
So whatever your context is, however it is that's interesting to you, take a look at
these things.
Bo Woods runs I Am the Cavalry with Josh Corman and others.
And so take a look at I Am the Cavalry.
They did this probably what?
How long is it?
Six years, maybe?
Seven years?
A little bit longer.
Yeah.
I mean, they were around for at least four or five years before all of the lockdown.
Oh, wow.
Okay.
And the message from I Am the Cavalry is we can't just hack stuff and wait for someone
else to own the responsibility of it.
That if you hack something, you're responsible for the result whether it gets fixed or not.
So the name came from the cavalry is not coming, right?
There are no adults that are going to come by.
And say, thank you for calling our attention to that.
We got it from here.
It is not going to happen.
Or at least it hasn't been happening.
We're trying to do better.
So this whole movement of I Am the Cavalry was to help hackers own up to that moment
of good.
How can we do better?
How can we own the results?
Not just for fucking things, but for un-fucking them as well and making sure that they stay
un-fucked.
Technical term.
I think that's actually, when we were talking about all of this, as you were saying this,
I'm thinking that is the biggest difference, I think, the early days of hacking and now.
There's a little bit of accountability.
The hackers are like, yeah, I'm doing all this cool stuff, but let me tell you how to
fix it.
Or even if I don't know how to fix it, give me someone who can sit down with me and fix
it.
And that level of accountability is, I think, one of the more positive aspects of what we've
done.
Yeah.
I had a real tough moment after, it was probably around DEF CON 22, because anyone involved
in NSA tool set, the folks that would come in and do the talks on NSA tool set, not if
you were actually doing NSA tool set, don't put up your hand, and it was after Snowden
revelations, and it was a set of fabulous security researchers that said, we want to
make, we want to look at the stuff that Snowden revealed about what NSA was doing, and we
want to make it so easy.
This was their words.
This was their words that a 10-year-old girl could do it.
Not sure why they had to gender that, but.
And they were doing that for privacy.
Right?
So their goal, I remember I was saying, they were hacking GSM encryption.
They wanted to make hacking GSM so easy, and they were going to do that for privacy.
And I had real difficulty getting my, wrapping my head around that.
It was a great talk.
It was a great goal.
But how long, especially back then, right, that process of we break things and then it
will get fixed, it's not a direct causal relationship.
Sorry, I'm an academic now.
That's what we talk about, causal relationship.
If you do something, are you expecting that it's actually going to lead you?
What result does it actually get to?
And so that's why I think we've done a lot better now in the community of looking at
that causal relationship, and a good, all right, if we break it, let's make sure it
gets fixed.
And it's even the fact that we have more of a structure so that even if I can't make
that or I don't know who to.
I now have sources to go to.
We have bug bounty programs where they'll say, I'll help you make that connection.
So I think we have more of an infrastructural support.
And I think the media, I think the journalists are doing better too, right?
Thank you.
Yes.
And if folks heard Jeff at DeathCon, I'm sorry, Black Hat yesterday introducing Kim
Zetter, right, about how in the early days the journalists would just buzz in and buzz
out.
And talk about the crazy hair and use the community for their purposes.
Now you've got Dark Reading, you've got Kim Zetter, you've got so many other great
journalists that are embedded in the community, like yourself, like deep tech shops, right,
in application security.
And so help us to tell better stories so that we get better change on the other side.
Yeah.
So one thing I wanted to actually touch upon.
Yeah.
I think a lot of the times when people hear, oh, hacking and policy is, well, I'm not going
to run for office.
I'm not a lawyer, so I don't know the laws.
So you mentioned how working with like the city council and stuff, how do you even start
that language?
How do you even get the folks in this room who are curious to understand that you don't
need to be a legal expert to be involved in policy?
Right.
They do that.
Right.
They understand the legal side.
They're curious about what you know.
And so just have the conversation, right?
I mean, for whatever levels comfortable for you, whatever path that you have is going
to be good.
Check out this tech for tech congress and I am the cavalry.
There's a lot of good material on this.
If you've been out to B-Sides, B-Sides Las Vegas is usually a place where a lot of these
folks are.
If you go down to the policy track, look for Bo Woods.
He's got the, I think the hair is blue today.
Yeah.
I think so.
And just ask around there.
There'll be a lot of folks that can help not just have general ideas but have been through
it and helped others for whatever context you're bringing with.
Just some other tips.
Is one trying at least, it's going to take you a while to speak the language but be forgiving
of the language, right?
Folks in policy, we say cyber a lot.
If you can't forgive us that, right?
It's going to have difficulty, right?
If you want to be understood, you have to help meet people halfway in how they talk
about things, right?
So on the policy side, attribution matters a lot to us because at the end of the day,
it's about what nation is responsible, right?
I worked at the White House for a couple of years, right?
I didn't care about attribution.
I cared about national responsibility.
At the end of the day, the president is going to have to pick up the phone and he's going
to have to call some prime minister or some president and say, knock it off.
Knock it off or there's going to be consequences.
That's not attribution, right?
So that stuff matters at places like the White House and Congress or in your national equivalents.
So again, if you can't get past the fact that attribution is stupid and you're in your
full threat butt and attribution dice, like that stuff is funny and it might not matter
much in your context but it definitely matters when you're thinking about first some aspects
of this national security policy.
But definitely be yourself, right?
If you're angry and you're pissed off, don't lose that, right?
Stay angry and stay pissed off.
Just let's keep it channeled and stay energized.
Yeah, I think we have a big problem sometimes when you get angry, when you're just annoyed,
you're frustrated, you think, hey, nothing's ever going to change, but we tend to get a
little insular.
Yeah.
So I think this track is like the perfect way of explaining don't become insular.
Yeah.
I think we have one year.
This was right around 2011, 2012.
I had Jeff Moss, Dimitri Alperovitch, Richard Baitlick and others say we're frustrated because
we're not making the difference that we wanted to have through technology, but we don't know
how to make this happen on policy.
I was working for a think tank at the time, the Atlanta Council.
So a lot of folks have been down this road of saying I need to do differently, I need
to figure out other ways to get my voice heard.
Yeah.
And to bring my knowledge and skills to bear.
So this is a well-trod path.
Yeah.
So we're talking a lot about how we're doing things differently now, but what is the ‑‑ if
you can even give me one example of something that we are doing better.
Yeah.
I don't want to be just all doom and gloom saying we haven't done anything better.
So I consider myself a strategy person.
Right?
It's been a long time since my fingers were on a keyboard.
I don't know if I ever got a keyboard in any meaningful way or that would be meaningful
to y'all.
Remember what I said, right?
It went back to 1972.
We're 50 years in where we haven't been having the effect that we want.
And I was reading a news article maybe five years ago in The Economist and they looked
at climate change.
And they said what have been the interventions that we have done as a species that's taken
the most carbon dioxide equivalent out of the atmosphere?
And they rated them like one through 30.
And they said as far as we can tell, no chuckleheads have ever asked the question in that way before.
Here it is, one of the most compelling issues faced by humanity and no one had ever said
what have we done that's made the biggest difference at the largest scale and the least
cost?
And so I had an epiphany.
So what is it that we as a community have done?
That's given the defender.
That's given the defender the greatest advantage over attackers at the largest scale and the
least cost.
And let's do more of that.
Any guesses?
Just shout out.
Like the number one thing that we think we've done at scale and cost as a community?
Windows update.
Yeah.
Who said Windows update?
Absolutely.
Because instead of doing something that only affects a single enterprise, right, we could
come up with the most perfect widget.
Right?
And it gets all the VC money because it is the most brilliant thing.
We still have to buy a billion of them.
We've got to integrate it into the enterprise or our home networks.
We have to monitor it.
We have to keep it up to date.
We have to train people to use the widget.
We have to get it to integrate with all the goddamn other tools that we have.
And do that a billion times.
Things like Windows update, cloud, end-to-end encryption.
You do it once.
And a billion devices or people can take advantage of it.
This is why especially a lot of us on policy are so upset over government folks looking
to break end-to-end encryption.
It's one of the few things that aids the defenders at scale easily if it's implemented right.
It's really one of the few things that you can get it and it really makes it hard for
adversaries.
And it's actually one of those things that we're seeing really become mainstream.
Because it's become easier to use.
Like the number of people I know who say, oh, I know nothing about security.
And they use Signal.
And I'm saying, there you go.
Like that right there is an important thing you're doing.
And if I could push on one area.
So for me, it's something like strategy.
We've never had a real strategy.
What was the U.S. strategy for the Cold War?
It's a single word, containment.
Yeah.
Yeah.
So I'm a veteran.
For folks that were in the military, everybody knew what General Petraeus' strategy was for
winning.
It was win hearts and minds.
A different general would have a different strategy like getting fire fights and killing
people.
Petraeus was very simple.
No, we want to win hearts and minds more or less.
It's a strategy you can fit on a single, small sheet of paper in this phrase.
So mine, since I read that quote from 1972 and 1979.
in 1979 was defensible. We've got to get the defender most advantage over the attacker
at the largest scale and the least cost. Sometimes I like to flip it around and talk about a
sustainable Internet. Just like we want our grandkids to have clean air and clean water.
Better than we have today. We can think about the same, right? Let's have our grandkids
have an Internet that's at least as awesome as the one that we have today. Because we can get
so caught up in adversaries and the rest that we're not thinking about all the amazing things
that we want to do and we want future generations to do. Since we are talking about the
future and how we want the Internet to be at least available for our grandkids, my children,
but there's so many new types of technology that's coming on. We're barely scratching the surface
on understanding how we're going to use it, how we're going to regulate it. What are sort of like
the policy implications that we should be thinking about with emerging tech?
Just think about on emerging, because I know what I care about, a defensible Internet that has
defense better than offense. Any time I get asked about a new X, Y, or Z, I always think about,
all right, is this going to preferentially aid the defender or the attacker? Almost every time
we've done anything.
It's preferentially aided the attacker, right? That the attackers have been able to use the
scale of the Internet more effectively than the defenders have to add scale to our operations and
what we want to do. So any time I get asked, like, quantum X, Y, or Z or the rest, it's almost
always, no, that's going to help attackers more. Cloud, one of those that can definitely help,
Bo Woods, Josh Korman, helped talk about it really well, that the original Internet was never
designed to be secure. It was designed to be secure. It was designed to be safe. It was designed to
be secure. We added things to it and we just slapped Band-Aids on those. And now we've got five
decades of Band-Aids all the way down when it comes to the security for the Internet. Cloud is one of
those opportunities that we can get it right from the start once we get people trained for it,
right? We really do have to have people more trained so that we're able to
There's a definite mindset change that we need to make sure that people are not just bringing the
same mistakes, same ideas forward. Yeah. And before we switch, I know we're going to probably switch
to Q&A soon, we had a panel this morning and someone asked, who is your favorite trans or female
hacker? And we had a lot of great answers, a lot you'd expect from Grace Hopper to Katie Moe to
Emily Caron and others. I want to raise a woman name, her name was Hilda Matthew. Anyone heard of
Hilda Matthew? She's on the NSA Hall of Fame because Hilda came up with the idea. And she was like,
Back in the 80s, that NSA, that these new computer networks gave NSA this incredible ability to do amazing digital espionage.
And she was doing this as a female technical engineer in the 80s.
Just think how rare that is.
And she was the one that figured out, yep, this is going to be amazing.
But she also realized, this is going to be a real problem for the United States.
Because we're incredibly vulnerable.
So they were already understanding that at Fort Meade in the 1980s.
And what I really like about Hilda isn't just that she realized this and she was this real pioneering female engineer whom we've never heard about.
But also her name before she got married was Faust.
So here we've got this actual real Faust.
And she's a real Faustian bargain of wanting to both NSA to have it both ways and the U.S. government to have it both ways that we can hack shit and we can still secure things well enough that we can hack it and the adversaries aren't going to see what we're doing and decide they need to copy us.
But also for us here in this room and the people that have been coming to Vegas every August for 30 years.
That we can hack shit.
And we don't have to worry about how it's going to turn out.
It's the original Faustian bargain in part thanks to great engineers like Hilda, Faust, Matthew.
Exactly.
So, I mean, we started off all of this conversation with you saying that we've been doing this over and over again and nothing has changed.
We are now talking about a strategy of defensibility.
How are we going to change?
What are the things that we can start saying, okay, these are the things we're going to do so that we can get blue team better than the red?
I think you heard a lot of it here from Chris Inglis this morning.
When I look at that question, so we've looked at, we did this report to the New York Cyber Task Force out of Columbia University.
And we went back and we said, okay, what have been the actual innovations?
What are the things that have made the biggest difference at the largest scale in these costs?
Over the last five decades, right, going back to the original passwords, and we looked at those that tend to operate inside the enterprise and those that operate across cyberspace as a whole.
And the vast bulk of things, as I mentioned, were up here in the technical things in the enterprise.
So, one, we really wanted to emphasize those things that we can get the largest scale in the least cost, end-to-end encryption, cloud, we've already talked about.
Right?
But I also really want to emphasize the operational innovations.
Right?
When the Morris worm hit the early internet in 1988, it took down 10% of the early internet.
Now, yeah, that was only like 6,000 computers or something like that.
But it took down 10% of the internet.
Because they didn't have anybody that was there to look for vulnerabilities and patch them beforehand.
And they didn't have any coordination mechanism once there was an internet connection.
It was a disaster.
The only coordination mechanism they had was the internet itself.
So they invented a computer emergency response team.
Right?
We had to invent a cert.
And, of course, everybody has a cert.
They're considered part of the environment.
Right?
We had to invent the role of a CSO, chief information security officer.
Vladimir Levin, a Russian hacker, took Citibank for $15 million or so in 1995.
And we had to invent a CSO.
We had to invent an ISAC.
I used to be the vice chairman of the FS ISAC.
We had to invent ISACs in 1999 by a presidential directive.
The MITRE ATT&CK framework.
The Lockheed Martin kill chain.
This stuff is like the kill chain or the .
It's almost free.
Right?
It's a doctrine.
It's an idea about how you do things.
And just think about all the defensive innovations.
That we've gotten from the MITRE ATT&CK framework.
And how it's allowed us to talk about things at scale and implement things.
Stick syntaxy.
Right?
So as you're thinking about how we can have the most impact at scale.
Right?
It's not all about technology.
Right?
It's a lot of these operational, these process, these organizational innovations.
Actually, maybe like CESA, right, is now doing JCDC.
The joint cyber defense collaborative.
Yeah.
I mean, the thing that really strikes me.
Talking about the CERT, ISAC, even the MITRE ATT&CK framework.
It's actually fundamentally collaboration.
It's like, okay, how do I work with you?
I can't do this alone.
I need to get other people with me.
And what is the shared language?
And I love the examples you gave.
Because it kind of goes back to what we were saying earlier.
That we need to be working with the community.
We need to be engaging with the community.
Yeah.
There's a guy named Rob Kanaki.
Who had been with the Council on Foreign Relations.
Now he's the deputy for strategy at the Office of the National Cyber Director.
And he had a great phrase to it.
He called it the Home Depot model.
You can do it.
We all know the Home Depot.
That's for sure.
You can do it.
Government can help.
Right?
And because when I looked at how do you get defensible.
Right?
It's not through government.
Right?
We're not going to get there by creating some new government office.
And hiring more civil servants in any country or in every country.
Right?
It can help.
But the only real change to get to defensible is going to happen through the private sector.
You know.
And that for the government for me is you have to enable them.
Right?
Imagine.
Sorry to use a sports analogy.
Say it's American baseball.
Right?
You've got nine players on the field.
What we had with General Alexander when he was at Fort Meade.
And he tried this here.
Right?
Well, he tried it at Black Hat.
Right?
He would run around and say wherever the ball is hit, we got it.
We at Fort Meade, we can make the play.
Let government do this.
Finance sector, you all are doing a good job.
But let me put my sensors on your network so we can collect it for you.
So, but most of the time, whenever the ball is hit, it's someone in the private sector
that's in the position to make the play.
Now, they might not be able to see the ball.
They might have an old and the government has to help them to see the ball.
They might have a bad glove.
And we might need to help them with some capability.
They might be like me when I was in Little League.
And they might forget they're in the game until they hear the crack of the ball on the bat.
And they need to be reminded.
Others don't need the enablement.
They need encouragement.
Right?
They know it's a problem.
They've got the capability.
But they're not stepping up.
And their government has ways that can help.
Not just U.S. government, but others.
And last is, you know, at the end of the day, it might come down to this.
It might come down to enforcing.
It already happens in the finance sector, energy sector, publicly traded companies.
The enforcing is already happening in lots of regulated industries.
And, you know, we first said in 1998 presidential directives that said that if the market doesn't work,
we might need to regulate.
And so, you know, it's been 25 years, so maybe we're getting close.
So one thing I want to touch upon before we go to the audience questions
is there are a lot of people who can't get involved with Congress.
They can't get involved with FTC.
And I've been hearing a lot of friends who are lawyers.
They talk about how they're required by their law firm to do pro bono work, kind of give back to the community.
What would that look like from a hacker community?
It's a great ‑‑ wow.
I hadn't really thought about it.
It's a lovely ‑‑ I love that idea.
Right?
So imagine it.
For what Tamita is raising here, right?
If you're working ‑‑ if you're a CEO of a tech company and you care about these issues, right, say election security,
or you're worried about the water, you know that your local water utility is probably insecure,
just like a law firm might do pro bono, you're saying, that you might say, hey, you know what,
we're going to go and we're going to help out the water utility.
And we're going to do that pro bono because we're a tech company.
And you can imagine that worry.
Right?
And it's working even not just for the CEO of a tech company, but just anybody.
Like, I'm just saying, hey, I'm here to help.
Right?
That's a great idea.
I mean, if you're an incident responder going up to, you know, hey, journalist, human rights activist, and being like, hey, do you want us to take a look?
I just feel like there's so many ways we can use our skills.
And, you know, and it ties into ‑‑ a lot of corporations are worried about their ESG.
Right?
Their environmental, social, and governance.
Yeah.
And they want to be do well doing that.
And, you know, companies want to help on their ESG.
And people will volunteer.
Right?
So I worked for a bank.
And we would go out and we would do Habitat for Humanity or we'd clean a park or we would go on a 5K fun run.
Like, why shouldn't there be a tech aspect of that?
Right?
And saying, no, we're going to get our awesome set of nerds together and we're going to go help people.
Like an at‑risk community.
Like journalists or Rohingya or Uyghurs.
Go to your local school and help your teachers.
Go to school and help teachers.
Yeah.
It's a great idea to think about that as ESG.
To think about that as pro‑bono work that we should do through our companies and get paid for it as part of making the world a better place.
I love it.
It's a great idea.
So there is ‑‑ do you have the microphone for the Q&A?
So if you have any questions for Jason, you know, please raise your hand.
Or Femida.
And we welcome any questions here.
I can barely see.
Got one.
Here.
That's why I wear a hat.
Yeah.
There is someone over there and then a gentleman in blue.
There we go.
I mean, this kind of goes way back to the beginning of, you know, hacking and computer security.
How do we still address the idea of what right do you have to check my doors?
You know, if you walk down the neighborhood trying everybody's door, you're going to get arrested.
And there's that analogy to some of what's happening in the hacker community.
How do we ‑‑ are we still struggling to justify that from a legal perspective and from an acceptance perspective?
You know, who are you to check my doors?
Yeah.
It's a great ‑‑ and for those that didn't hear, who are you to check my doors, right?
I mean, a lot of ‑‑ and I think our communities had this from the very beginning.
Right?
Who are you to tell me not to check your door?
Right?
It's publicly available.
Right?
Why shouldn't I be able to scan it?
Right?
I shouldn't be able to get into your computer because you didn't protect it well enough.
Right?
That's part of our legacy of being hackers and being in Vegas in this time of year.
Right?
But also saying we also care about privacy and we want to do that.
I liked how Chris Inglis put it together, you know, up here in that at least how the government was seeing it and saying we're all in it together.
And just because your side of the boat has a leak, right, that's affecting the rest of us.
And I honestly approached this ‑‑ I talked about sustainability of how, you know, we want our kids and grandkids to have at least as good as we have today.
And that's led to all sorts of norms and mindsets.
Right?
Think globally.
Act locally.
But also knowing that the things that we do have externalities.
And that I can say, good, I have a right to use as much water as I want.
Or I can have as polluting a company or car as I want.
But the way I'm speaking personally, right, I say it's kind of a dick move.
Like, yeah, you've got the right to do it, but you're imposing that on others.
And you're making the situation worse for others.
And so we are going to have to think about, you know, think more about how that affects us that, good, your unpatched system, it's not just you getting hacked, but you're imposing that on others because you're going to be part of a DDoS.
Right?
And English talks about this new social contract and what it is that we owe each other.
What rights and responsibilities we can demand, but what are the concomitant responsibilities that we owe others?
And I think it's a great part of that conversation.
And for us to really address that afresh, because that's what it's coming down to a lot.
Like, what are we owed?
Even if we're having unpatched systems versus, you know.
FBI going in and patching systems for them, like they did for SOC Ops Blink, right?
Let's address it.
I think it's a great question.
Or the ISP basically saying, I'm going to scan and I'm going to take your computer off the network because you have malware.
And it's a great, and I know they want to happen.
I remember there was a great, I think it was Arbor Networks did this, and they looked at ISPs of saying, and this was maybe ten years ago, ISPs, do you monitor for inbound attacks?
And like 90% looked for inbound attacks.
And they said, do you monitor for outbound attacks?
And half of them didn't even bother to monitor for outbound attacks.
And those that did, something like half of them did nothing about it.
They would just see the attacks going outbound.
They said, not my problem.
What do we think about that, right?
Is that, I mean, that's classic tragedy of the commons.
That they know, they either don't, half of the respondents back then didn't know, didn't care.
That they were imposing problems.
They were imposing problems on others.
That's externalities.
And at the end of the day, that's where in the normal social contract, we expect the government to come in and say, no, you can impose these costs on others through your own inaction.
Can we get the next question?
Yeah.
Good afternoon.
So I have kind of an unpopular opinion here.
So this might be agitating to some people.
But I think one of the reasons why we have issues with policy, and that's really what the gist of this conversation was.
Is that a lot of people focus on the hackers, the people that are here.
But if you actually look at when we actually were good at things like strategy, it was from offset strategies.
You know, we had a first offset strategy, nuclear.
We had a second offset strategy, ISR.
We tried getting a third offset strategy of technology.
Ash Carter, Bob Work, and a few other people, Jim Baker, and a few other people that worked at the building were champions of this.
And then it fell on its feet for whatever reason.
Yeah.
Because of accession, we'll just call it.
So to me, the biggest problem that we have as a nation, because I want to take this beyond just the hacking.
You know, it's really about cybersecurity and how do you secure things.
Is that we do not have a defined offset strategy.
And from there, that's where your operations go and your tactics go.
My question to you is, will there ever be somebody that says, no shit, wake the fuck up, and get an offset strategy?
Over.
Yeah.
Cool.
And this is probably going to be the last question, unless you want to take one more, and then I can answer both.
I don't know how we're doing on time.
Two minutes?
Yeah.
You want to take one more of the question, and then we can, yeah.
So he had, the gentleman in the blue, do you still have a question?
You're fine?
Okay.
And then I think the gentleman in the black with the orange lanyard, he was one of the first people to have his hands up.
Thanks, Mike.
We'll catch up.
Yeah.
We have two minutes.
We have two minutes over.
Two minutes over.
Yeah.
Yeah.
Thanks.
Jason, very good talk, as always.
You referenced earlier about control effectiveness, that for nearly 50 years we haven't really seen significant advancement in control effectiveness.
I was curious if, especially from a policy standpoint, we can get firms to all agree to improve cyber hygiene, cyber control capabilities and effectiveness.
How would you suggest measuring control effectiveness and thresholds for?
Yeah.
For essentially defining good.
Perfect.
Thanks.
Yeah.
So first, the first one is a very US Department of Defense strategy.
This thing is called the third offsets.
And it was, and the offsets were a military strategy to say, what are the things that the United States and, that are super easy for what our, for the United States and our allies to do, but are really hard for our adversaries?
I actually thought of it as an encryption problem, right?
Because encryption is there.
It's meant to be really easy one way and really difficult the other way.
And it just took that to military strategy.
And so we were trying this over the last couple of years and we, and people in D.C. would say, cyber is the way that we're going to do this offset strategy.
And I had no idea what they were talking about.
Because it is just as easy, if not easier for our adversaries to have offensive cyber capabilities as it is for us.
What's really hard for them is to work with the private sector.
When you look back at almost everything.
Every major cyber incident that we've ever had anywhere in the world, it's almost always the private sector that has the agility, the subject matter expertise, and they have their hands deep in cyberspace and they can fix it.
Governments lack that.
So we need to do those things that the Russians, the Chinese, the Iranians can't do, is work with the private sector in the rich way that we do in the West.
And then to close out on the measurement, it's a fabulous question.
I'm really interested.
Not on a control, on a measuring control by control.
But how do we measure if defense is getting better than offense at the largest scale of the Internet?
For example, if we're seeing shorter breakout times, we're probably not doing our job.
If we see longer breakout times, if we see them taking longer to get in, those are all the sorts of things that we might imagine if the Internet is getting more defensible.
That might have to be our conversation next year.
Yeah, exactly.
Jay, thank you so much for joining us today.
And thank you, everyone.
Thank you for your good questions.
Thanks for the questions.
Thanks for coming at policy.
Stay angry.
Go unfuck things.