0
00:00:10,000 --> 00:00:11,000
Speaker 1:

1
00:00:10,000 --> 00:00:11,000
Awesome. So a couple things right before we jump into it. One, please keep your cell phones on silent just as a courtesy for the speakers. There are mics throughout the room, so hopefully they should be able to pick up everything you said. If there isn't, we'll repeat the questions. Please keep your masks on at all times. With that, I'll kick it off to Jan who can introduce the panel. I'm looking forward to this discussion.

2
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

3
00:00:10,000 --> 00:00:11,000
All right. Welcome, everybody. Oh good. I'm sorry?

4
00:00:10,000 --> 00:00:11,000
Speaker 3:

5
00:00:10,000 --> 00:00:11,000
House rules.

6
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

7
00:00:10,000 --> 00:00:11,000
What?

8
00:00:10,000 --> 00:00:11,000
Speaker 3:

9
00:00:10,000 --> 00:00:11,000
We don't have the rules, the Chatham House rules.

10
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

11
00:00:10,000 --> 00:00:11,000
Oh, the Chatham House rules. What are the Chatham House rules?

12
00:00:10,000 --> 00:00:11,000
Speaker 3:

13
00:00:10,000 --> 00:00:11,000
[inaudible 00:00:44]. Oh no. These are the Chatham House rules.

14
00:00:10,000 --> 00:00:11,000
Speaker 4:

15
00:00:10,000 --> 00:00:11,000
I'll open them together when they're the Chatham House rules.

16
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

17
00:00:10,000 --> 00:00:11,000
Okay, okay. Well, no rules here. No, maybe that's not ... All right. So we are here to talk about emerging topics in cyber policy. Now, I'm Yan, Yan Shoshitaishvili, some might know me as Artist. We'll go and introduce ourselves.

18
00:00:10,000 --> 00:00:11,000
The general idea, I'm a professor at Arizona State University. When we say emerging topics blah, in a class, it means we are just going to teach anything. Right? It's just a catch all for whatever. So hopefully that won't be this. We'll be a little more structured about actual security policy topics. But why don't we start with introductions by my co-panelists? We'll go from there.

19
00:00:10,000 --> 00:00:11,000
Jan:

20
00:00:10,000 --> 00:00:11,000
All right. Confusingly, I'm also Jan, so you only have to remember one last name here. I am ... So I used to work at the EFF with Kurt over there doing all the technology side of policy. So we made things like Let's Encrypt. We helped out with the Tour Project, et. Now I run security at Brave Software, which is a browser company.

21
00:00:10,000 --> 00:00:11,000
Louis Eduardo:

22
00:00:10,000 --> 00:00:11,000
Good afternoon. My name is Louis Eduardo. My day trade is I run the product security for a large networking company. My other job here is to run the network team. So that's what I do.

23
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

24
00:00:10,000 --> 00:00:11,000
I'm Bill Woodcock, I'm the Executive Director at Packet Clearinghouse. We do sort of internet critical infrastructure and the policy around that.

25
00:00:10,000 --> 00:00:11,000
Speaker 8:

26
00:00:10,000 --> 00:00:11,000
Quad Nine in the house.

27
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

28
00:00:10,000 --> 00:00:11,000
Yeah, Quad Nine also. That's like our consumer facing thing.

29
00:00:10,000 --> 00:00:11,000
Speaker 8:

30
00:00:10,000 --> 00:00:11,000
Not what? 130 CCTLDs.

31
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

32
00:00:10,000 --> 00:00:11,000
Yeah. Yep, 150. It's over 150 now.

33
00:00:10,000 --> 00:00:11,000
Speaker 3:

34
00:00:10,000 --> 00:00:11,000
Yeah. So basically half the world's CCTLDs.

35
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

36
00:00:10,000 --> 00:00:11,000
Hey everybody, my name is Kurt Opsel. I am the Deputy Executive Director and General Council at the Electronic Frontier Foundation. EFF has been working on tech policy issues for ... Founded in 1990.

37
00:00:10,000 --> 00:00:11,000
I work a lot with this community through Our Coder's Rights project, trying to provide counsel on legal issues to security researchers about doing their research and about the issues surrounding disclosing, and especially if the vendor is upset or there are people who want that information not disclosed. So we try and fight for things like free speech and privacy and innovation policy, and trying making the world a better place through good law and policy, and technology too. John will help us.

38
00:00:10,000 --> 00:00:11,000
Jeff Moss:

39
00:00:10,000 --> 00:00:11,000
I'm Jeff Moss, founder of DEF Con. Really happy to see people here. This is our attempt to really try to increase the engagement between the technical community and policy minded individuals. I hope it moves us past the first phase of us cursorily looking at each other, moving into a more substantial way in which we can interact and help each other. What really galvanized my thoughts around this area was the success our vote hacking machine village had in influencing not just policy in the United States around voting machines but globally. It turned out that our simple little report impacted that space in one weekend more than a decade of a lot of activist groups trying to raise awareness.

40
00:00:10,000 --> 00:00:11,000
It turns out that you can tell people that plate is hot, but until they touch it and burn their finger, it doesn't count. So by us in one weekend hacking and successfully compromising these voting machines, what's more important than a decade of people saying out loud that these machines are vulnerable.

41
00:00:10,000 --> 00:00:11,000
So I think there's a lot of what we're trying to do is speak truth to power and provide a third party kind of more neutral perspective because I don't think policy gets that. I think policy gets a lot of trade associations and self-interest. Civil society doesn't have a big voice and that's what we're trying to do.

42
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

43
00:00:10,000 --> 00:00:11,000
Cool. So from that perspective, I'm going to do my best moderating. My moderation experience, I was in a couple rooms over. I ran CTF for four years and that mostly involves screaming at teams that are misbehaving. So I'll try to do that as little as possible. I'm a very loud person by nature. But lets kind of start things off.

44
00:00:10,000 --> 00:00:11,000
Jeff, you said the voting machine village and that was a great example of something very practical that informed policy down the line once it came out, right. So in some sense it would be great if one of the outcomes of this round table discussion were ideas of potentially future villages that we can do to then inform people down the line. So I'll start with one thing that actually I got administrative pressure for the other day, unless you have an idea on direction to go initially.

45
00:00:10,000 --> 00:00:11,000
Jeff Moss:

46
00:00:10,000 --> 00:00:11,000
No, no, I was just going to say, and the reason of the success of the voting village was completely random. I mean, I would like to take credit for it being such a success. But until the year before 2015, there was no exception in the DMCA for good faith researcher, security research and critical infrastructure and voting infrastructure.

47
00:00:10,000 --> 00:00:11,000
That's why people weren't hacking this stuff. It was against the law. So the Library of Congress put in this exemption for the DMCA. So now it's legally possible, but you can't get the machines. There's not enough machines, they're not available. They're only sold under contract. The whole system is designed to make sure nobody ever figures out how these ancient machines work.

48
00:00:10,000 --> 00:00:11,000
But there was a storm, much like in Las Vegas. The storm collapsed the roof of a warehouse where a county was storing their voting equipment. The insurance company totaled the equipment and because they were a green insurance company, they sent out the zero value items to get recycled at a re-PC company. That electronic recyclers like, well they still work, I'll sell them for 200 bucks. Just start selling them on eBay.

49
00:00:10,000 --> 00:00:11,000
So now the law has changed, and they're available. The manufacturer catches on that this is happening and goes them and says, "You have to return them all to us." He says, "Great, okay, 200 bucks how many do you want?" They're like, "No, no, they're our machines. You have to return them to us." He's like, "Well, I never signed those agreements. I got them legally from the insurance company, no." He's like, "Well, then you have to destroy them because they have proprietary parts." He's like, "Okay. 200 bucks an hour. How many do you want me to destroy?" He's like, "No, we don't want to pay for it." He says, "Well, then we're selling it."

50
00:00:10,000 --> 00:00:11,000
So because the insurance voting companies didn't want to pay for the machines, they got out, and we had our success. So I think since then they've recognized the importance of that exception under the DMCA, and they want to expand that. Right? So that was a very tangible law changes, machines available, look at this outcome. I'd like to see those kind of exceptions expanded if possible because in other countries, you can't do this. Right?

51
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

52
00:00:10,000 --> 00:00:11,000
Well, I think an interesting event that I very nearly witnessed in my first DEF Con, When I stepped out of the room and my brother witnessed it instead, was Dmitri Skinarov being arrested basically on stage after disclosing something Adobe didn't want disclosed. Right? This doesn't happen anymore because as a society, we've kind of grown up and accepted vulnerability research and proper disclosure channels, and when you went to pull the parachute and tweet the bug.

53
00:00:10,000 --> 00:00:11,000
Jeff Moss:

54
00:00:10,000 --> 00:00:11,000
Not to hijack every conversation, but that was interesting because Dmitri was an employee for a company, Elcom Soft in Russia. In Russia, there was a law that allowed you to make one, a personal backup of your software for your own safety. So they made tools to allow Russians to make that backup, right, to crack a lot of protections. PDF files I think were the thing that Adobe didn't like.

55
00:00:10,000 --> 00:00:11,000
So they were in some kind of argument. Adobe's like, "Well, we're in Russia, and it's legal here." Adobe didn't like that. So when their employee came into the States, they got the FBI to arrest an employee as a proxy for the company, and then all these protests started. Adobe went to the FBI and said, "Oh okay, we don't want to prosecute anymore." The federal government's like, "Well, that's not your choice. That's a state issue now, you started it but ..." So now, Adobe flips around it. Now they're on his side, and they're the ones that created the whole mess because the PR disaster was so great. I'm sure you have stories like that, but the policy outcomes can end up being very bizarre.

56
00:00:10,000 --> 00:00:11,000
Louis Eduardo:

57
00:00:10,000 --> 00:00:11,000
Yeah. Seems like what we're all honing in on here is the difference between public interest and private interest, and the government's role in which side of that fight the government comes down on. I think many of us would really like to see the government acting more in the public interest more of the time, and less in the pocket of some private interest like Adobe or whoever, John Deere.

58
00:00:10,000 --> 00:00:11,000
There are a lot of different kinds of areas in which this comes up. The rectory repair stuff is a lot of it. A lot of it is around misuse of intellectual property law to keep people from advancing the state of the art. Something Kurt and I worked on, what, three years ago now was there was a private equity firm that tried to do a hostile takeover of the entire dot org domain.

59
00:00:10,000 --> 00:00:11,000
So that they could charge every nonprofit in the world the maximum possible amount of money for their domain name, which the Red Cross was pretty scared by that given the size of their budget. Right? The government didn't really have anything to say about that and ... Public to make sure that people were paying attention to the public's interest.

60
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

61
00:00:10,000 --> 00:00:11,000
So I wanted to add into this thing. How could we go forward? So we've seen a couple of these barriers. So the DMCA has been a barrier. They have a rule-making process every three years where you can try and get some exemptions from the DMCA. That is a process which has made a number of good strides forward, but it still is a restrictive process. The DMCA impedes a number of possible research paths or we would like to see that expanded.

62
00:00:10,000 --> 00:00:11,000
But I think also one of the things coming out of the voting villages is that the public got interested, and then the government got interested in having it happen. I think this could be expanded to other areas. I see some of this, like the aerospace village here and the car hacking village bring some things in. We've had some trouble in the past with aerospace where they don't want people hacking on their planes, certainly not a live plane.

63
00:00:10,000 --> 00:00:11,000
But I think it would be great to get these industries involved, willing to open up their systems to have security research do it, do it so that there're some rules around it. So it's a plane, for example, that is not in flight but rather parked and safely done. Then that research would be published in a forum like this, give them a time to fix the flaws before they go out there.

64
00:00:10,000 --> 00:00:11,000
But have that kind of cooperation with people who are otherwise hesitant or the voting industry for a while, was basically threatening people if they went ahead and did this research. Flip that around, and I think that might be corporations need to change on this, but also I think it would be great to get policy support all around from government levels to see there's a good thing. We want to make the environment in which it can happen.

65
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

66
00:00:10,000 --> 00:00:11,000
So how do we make that flip happen? Right? I guess Adobe flipped due to public pressure. Do we have the bandwidth as a DEF Con community to public pressure?

67
00:00:10,000 --> 00:00:11,000
Jeff Moss:

68
00:00:10,000 --> 00:00:11,000
The normal trajectory has always been researcher finds flaw in X. Access control system, physical lock system. Right? What have we had? Implantable medical devices, whatever it is, manufacturing people freak out, threaten lawsuits, they're successful or not. They get the Boston students to withdraw their access control talk on the subway system or physical HID got some talks pulled on access control stuff, right?

69
00:00:10,000 --> 00:00:11,000
Then EFF gets involved, and the media starts reporting. Pretty soon the manufacturers realize they can't keep doing this. The cat's out of the bag, people know their stuff. It's like a forced maturation, and it's painful. They don't all grow up at once. It started with network and operating system companies, but I remember when it was access control. Then now it's been aviation and cars. It's so painful. But they all follow the same trajectory it seems. At some point, we're going to run out of industries, I hope and we'll all finally ...

70
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

71
00:00:10,000 --> 00:00:11,000
There's a first contact issue to solve. Like when an industry has not previously been in contact with the security world, they're always nervous at first contact. So maybe one way is to think about what are the first contacts and how to make that run smoothly because we've seen just so many injuries where it goes badly at first. This oftentimes comes in an industry that previously did not think about computer security.

72
00:00:10,000 --> 00:00:11,000
In fact, many of them didn't have something that had much computers in it like 20, 30 years ago, but now everything has a computer in it. So many of them are connected to devices. Then they're getting treated like a computer company as they should because that's where their security problems are. But their PR and their lawyers are not yet ready for it. So to try and smooth out those first contexts so it doesn't go into that bad threading lawsuit phase and gets into the good cooperative phase or at least minimize the time in the middle.

73
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

74
00:00:10,000 --> 00:00:11,000
In the US particularly, the liability insurers are a huge actor, and they're pretty unpredictable. Figuring out how to get liability insurers to take the approach you want is really powerful. I mean, one of the huge problems we have right now is ransomware. The reason we have the ransomware problem is because liability insurers are seeing fit to pay ransoms. Right? Every ransom that gets paid pays for a hundred more attacks.

75
00:00:10,000 --> 00:00:11,000
So spiraling out of control because the liability insurers went the wrong way on that. But with stuff like vulnerabilities, you could see that going the right way a lot more easily than an insurer having been informed of a liability in a product that they're insuring the manufacturer of against liability, you can imagine them saying, "Oh well, actually, you, the manufacturer or insured party needs to clean this up, right. Not just sweep it under the rug."

76
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

77
00:00:10,000 --> 00:00:11,000
Yeah, I would love to see it if there was an insurance program that would try to reduce the risk that they saw it in their interest. But we have a question down here. Yeah.

78
00:00:10,000 --> 00:00:11,000
Speaker 14 :

79
00:00:10,000 --> 00:00:11,000
Sorry. Due to the whole ask questions than later.

80
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

81
00:00:10,000 --> 00:00:11,000
General too.

82
00:00:10,000 --> 00:00:11,000
Speaker 14 :

83
00:00:10,000 --> 00:00:11,000
Great. Maybe I have the question related to the names and reliability.

84
00:00:10,000 --> 00:00:11,000
Jeff Moss:

85
00:00:10,000 --> 00:00:11,000
Oh, maybe just say hi and who you are.

86
00:00:10,000 --> 00:00:11,000
Speaker 14 :

87
00:00:10,000 --> 00:00:11,000
Sorry?

88
00:00:10,000 --> 00:00:11,000
Jeff Moss:

89
00:00:10,000 --> 00:00:11,000
Say hi and who you are.

90
00:00:10,000 --> 00:00:11,000
Speaker 14 :

91
00:00:10,000 --> 00:00:11,000
Sorry. Hi. My name is Hardy Gain for ... So we're producing certain coordinations and even only a few years, my coordination is verbal.

92
00:00:10,000 --> 00:00:11,000
Art:

93
00:00:10,000 --> 00:00:11,000
I have personally chased down industry sectors to try to socialize exactly the patterns you just described before it happened to them, so with impartial success. Just the immediate response, one idea could be, and I think this has maybe worked a little bit, at least in the industrial control systems, the OT space is a little bit of success here.

94
00:00:10,000 --> 00:00:11,000
I don't know who does this. Right? This community, again an actual, somewhat planned campaign, go to the medical device sector, go to auto, go to aviation, go to their conferences, don't expect them to come here, find their trade industries, any channel you have and multiyear concerted campaign has introduced these sorts of things.

95
00:00:10,000 --> 00:00:11,000
So maybe the first time through, they're not completely surprised by it. But I've many times seen what you both described as the reaction. I didn't know we used computers in our things and that response. There's a paper I've partially read. I think it's called Blessed are the Lawyers Where They Shall Inherit Cybersecurity. It's a great title. Well, here's the point, right? It gets to the liability and I've seen a little bit of this as well.

96
00:00:10,000 --> 00:00:11,000
Right? Vendor has a vulnerability where they get compromised. Right? There's an in-house people who's there. The IR law firm's legal is there. The insurance company is interested. If no one else sorts this out, maybe eventually, right, civil courts might end up defining maybe slowly over time, "Hey, Company X. You made an honest mistake. The best nation state model on the planet got you. You were doing all the good things. That was an accident, you're off the hook."

97
00:00:10,000 --> 00:00:11,000
Or I knew about a public vulnerability that was patched two months ago. I didn't get to it. There was a high threat for it, and I didn't patch my stuff and I got caught. You lose. Honestly, my opinion after 20 years is if it costs enough to lose out, that'll make a change. Lots of techniques we could do today, we don't because the motivation and the price model is not that you get punished enough for screwing up cybersecurity really badly. If there's a way to help define that minimum liability line, I'd love to work on that in here, expect it too.

98
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

99
00:00:10,000 --> 00:00:11,000
So one thing you said that was really interesting is this, increasing the cost of the failure. It makes a lot of sense. I think you can fail cybersecurity from what ... I mean in many, many ways, right? One of the ways you can fail is just not patching. But another way you can fail is never ... I mean, it's related but never looking at your systems from an adversarial context.

100
00:00:10,000 --> 00:00:11,000
So if you're talking about insurances, something popped into my head. People always tell me when you replace your roof, you tell your insurance agent, and your insurance will go down. I've never experienced this. I've told my insurance agent, like, "Great to hear." But maybe it's something like that. When you do a pen test, and I guess now that I say it, it sounds this already does happen, right, with insurances.

101
00:00:10,000 --> 00:00:11,000
But maybe what we can actually do is when you receive a disclosed vulnerability in your products from the community to encourage this sort of community involvement, to bring it back to how do we close that shock of first contact, the liability insurer actually says, "Hey actually, if you receive a properly disclosed vulnerability, that's a good thing for you. Maybe that can reduce your risk and lower costs."

102
00:00:10,000 --> 00:00:11,000
Speaker 15:

103
00:00:10,000 --> 00:00:11,000
Many insurance companies and actually fintech value company has, built around that whole thing, the liability world. This place on this company practice and value for improvement of it.

104
00:00:10,000 --> 00:00:11,000
Speaker 16:

105
00:00:10,000 --> 00:00:11,000
Insurance and cyber liability insurance that we're seeing. Sorry, Cecil. From a legal perspective, we're ending up with a lot of the privacy controls are starting to drive the liability insurance down. So GDPR is a prime example of that because it carries both the physical liability and the corporate liability with it. That's where we see a lot of the changes starting to take place with regards to policies around privacy.

106
00:00:10,000 --> 00:00:11,000
Not necessarily the legal side because they don't understand it. But they do understand privacy. So a lot of drive and a lot of focus in that area because of these large data breaches like Adobe and LinkedIn and others, is where we're seeing that traction take place. But with that in mind, I mean it all starts with how do you close the door?

107
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

108
00:00:10,000 --> 00:00:11,000
Yeah.

109
00:00:10,000 --> 00:00:11,000
Speaker 16:

110
00:00:10,000 --> 00:00:11,000
Where do you start?

111
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

112
00:00:10,000 --> 00:00:11,000
Highlight one thing. I appreciate what Art was saying, about the difference between you getting popped by a nation state. Basically there's nothing you can do about it and not patching someone for months and also putting in places things like bug bodies, as Amit was saying. What we want to actually incentivize is having good practices, having the most well defended system.

113
00:00:10,000 --> 00:00:11,000
One of the things about where problems occur is it's not distributed necessarily according to how your practices are. Sometimes you have the best practices, but you also have high value target. You get popped by something that's very difficult to defend against. Sometimes you have the worst practices and just you happen to get popped. So how do you tie it? So you're incentivizing people to take the practices, do you think patch comes out, you take care of immediately you, open yourself to finding out that information, act on it. But focus it on incentivizing, doing the things that you would defend with less. Whether you actually got popped is an interesting aspect of it, but it's not necessarily meaning you have bad practices or you have good practices.

114
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

115
00:00:10,000 --> 00:00:11,000
Well, that sort of ratio of risk and cost is exactly what insurance companies, in theory, are good at dealing with. I mean, I've got a manufacturing facility and the liability insurer for that does an annual audit. They send an expert who comes around and says ... I mean, the last one said that we had a broken window that was a window pane and that was adjacent to a window then, right? Yeah, okay. I guess none of our guys had noticed that. Right? But that was on a long laundry list of little things that ought to be fixed up. That was someone the insurance company employed. The insurance company sent them. It was just part of the insurance company's business.

116
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

117
00:00:10,000 --> 00:00:11,000
To reduce the risk.

118
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

119
00:00:10,000 --> 00:00:11,000
Right. But they're not thinking that way in cyber yet. They're thinking that way still in physical realm but not in cyber risk.

120
00:00:10,000 --> 00:00:11,000
Jeff Moss:

121
00:00:10,000 --> 00:00:11,000
To bring it back a little bit, one of the things that we've seen that's been successful at Black Hat and DEF Con was in the early days, US Cert when they were still around in their old form, we would get ... A researcher would say, "I've disclosed to the medical manufacturer. They don't believe that this is a problem. It's really a problem. I don't want to dump it publicly. Can you talk to the manufacturer US Cert? Study my results, go and talk to manufacturers. They might believe the message if it comes from the government."

122
00:00:10,000 --> 00:00:11,000
So there is this partnership role in which maybe the government can validate the finding of the crazy researcher and then deliver that message too. It's different when US Cert's calling the CFO than Rando. So I think there are some tangible outreach style programs that would increase the credibility of the government, increase the accessibility by the private sector.

123
00:00:10,000 --> 00:00:11,000
Speaker 19:

124
00:00:10,000 --> 00:00:11,000
It's still a costly thing to day. It's just that you provide that, each of the services.

125
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

126
00:00:10,000 --> 00:00:11,000
Right. So it might be then to bring it back to that first contact scenario. It might be worth preemptively identifying sectors that haven't had their kind of-

127
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

128
00:00:10,000 --> 00:00:11,000
Oh yeah, yeah.

129
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

130
00:00:10,000 --> 00:00:11,000
Moment in cybersecurity and preemptively reaching out to the big actors and saying, "Hey let's build a channel." So that when this inevitably happens, and it'll happen to you eventually, there'll be a less shock response. We will be ready to go.

131
00:00:10,000 --> 00:00:11,000
Jeff Moss:

132
00:00:10,000 --> 00:00:11,000
Awesome. Hey look, you're already solved.

133
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

134
00:00:10,000 --> 00:00:11,000
Boom

135
00:00:10,000 --> 00:00:11,000
Jeff Moss:

136
00:00:10,000 --> 00:00:11,000
Drinks on me. There's this story about the Voting Village, I'll go back to that because it seems relevant. When we wanted to try to grow the Voting Village Community, we figured we had to reach out to the municipalities that actually are running all the election officials. There is no list of election officials. There is no list of what all the counties were and who to contact to.

137
00:00:10,000 --> 00:00:11,000
So one of the people, Jake, who helped form the voting village, with his own money from his company and five employees, they tracked down the 8000. Or no, I think it was 6000 or so. But we made 8000 contacts, phone calls. We physically mailed every single one of them in the country, a piece of mail explaining what's going on at the voting village. You are invited. You can come. Everything. That wasn't being done by the government. It wasn't being done by anybody.

138
00:00:10,000 --> 00:00:11,000
None of these groups that had been around for 15 years that were champion voter transparency had done that either. It's like Jake with his budget, right? That brought about two dozen officials. That was sort of the beginning. Well, now there's different ... Everybody's jumped in on it. But I mean it was like a storm that got us voting machines and Jake with some budget started the whole community off. Now, it probably would've gotten there a couple years later maybe. But I think there's a lot of ripe opportunities like that where it's just somebody with some initiative and 10 grand and some phone bankers.

139
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

140
00:00:10,000 --> 00:00:11,000
Yeah. I wonder, I think we might have some feedback if we are too loud. I wonder if there's something there, going back to how ... Well, what's crazy to me is the whole voting village was a convergence of two random events that enabled it.

141
00:00:10,000 --> 00:00:11,000
Jeff Moss:

142
00:00:10,000 --> 00:00:11,000
But remember ATM hacking?

143
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

144
00:00:10,000 --> 00:00:11,000
Yeah.

145
00:00:10,000 --> 00:00:11,000
Jeff Moss:

146
00:00:10,000 --> 00:00:11,000
Was a thing for a while because none of the ATM manufacturers had thought about security. Well, we don't see ATM hacking talks much anymore. It's kind of been ...

147
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

148
00:00:10,000 --> 00:00:11,000
Success.

149
00:00:10,000 --> 00:00:11,000
Jeff Moss:

150
00:00:10,000 --> 00:00:11,000
Yeah. Mostly figured out or people have moved on to something else. So yeah, I would be interested in the first contact principles. But I mean as a policy connection between the two, I think it's more about building trust ... Remember when eons ago, there was a cyber storm exercise between the civil society and the people who run the internet and government? The most important thing is building relationships and building trust. Because if there's a big problem, you want to pick up the phone and know you're talking to someone. People generally, at least in our communities, don't trust organizations. We trust individuals. So I'm not calling the FBI. I'm calling somebody I know specifically in the FBI that I trust to not get me sideways. So half of this is, I bet building relationships when something goes wrong, right?

151
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

152
00:00:10,000 --> 00:00:11,000
Yeah.

153
00:00:10,000 --> 00:00:11,000
Jeff Moss:

154
00:00:10,000 --> 00:00:11,000
So part of the conversation would be how do you build relationships? How do you get the government to recognize some consistency in relationships that are important? When I lived in DC, I spent three years trying to build relationships at all these different agencies, mostly on internet governance related topics. I swear every six months the person I just spent 5.9 months getting up to speed moved on to another, got rotated. I'd spend all my time just trying to figure out, "Well, who's in charge now?" Then get on their calendar and then get up on speed on the issues. Then just do that for a couple of years, and you're burned out. Where Woody, there's always been Woody, he's been doing that forever. There's a consistency on one side. But the other side, it just seems like there's a forever turn, and that makes it hard.

155
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

156
00:00:10,000 --> 00:00:11,000
Everyone in Washington DC is perpetually 23 years old. It's always September on the internet. One of the things Jeff just said, I mean the original topic of this round table was going to be how to give advice to government. Governments periodically ask for advice because they're all 23 years old, and they're just out of school and they want to know what their job should be.

157
00:00:10,000 --> 00:00:11,000
They ask industry, "Hey, what should we be doing?" Industry always says, "You know, there was this thing, it was called Cyber Storm. It was great. You should do it again." They're always like, "La, la, la, la, we can't hear you. That was when we were in kindergarten." For some reason, this just goes around and around and around. Every time government asks for advice in the US, the private sector says, "Cyber Storm, that was great. We should do it again." Government says, "We'd really like to have some advice from you."

158
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

159
00:00:10,000 --> 00:00:11,000
Well, I run into this as well. There's this feeling that hey, we already did that and we stopped doing it. So why would we start doing it again, right? That feeling, that there're examples like this all over the place. In the research field, there used to be this awesome program called Cyber Fast Track where DARPA would give small awards very quickly to small teams to do cool stuff. Then it stopped, and that was awesome. Everyone wants it back. It's like, "But why would they do it again?" They already did it. They stopped.

160
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

161
00:00:10,000 --> 00:00:11,000
Yeah.

162
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

163
00:00:10,000 --> 00:00:11,000
I wonder how we would. I mean that could be like a government agency standing up and say, "Hey, we should look back at things that worked and for whatever reason stopped being done."

164
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

165
00:00:10,000 --> 00:00:11,000
Part of it is that government tends to reward novelty. Right? If you're a politician, you got to propose something new and get support for something new and get momentum for that. Then you're onto the next thing. Whereas if you're in operations, you need continuity, right? You want to know that if we got something going, that we don't have to constantly tend it. That it will have some momentum. It's not just going to fall apart the moment you look away from it. So I mean that's a fundamental difference between the private sector and government in that government doesn't really reward spending that money again next year. Because if you spend that money again next year, then that money is not available next year for something flashy and new that you can get elected on. But I think people like continuity.

166
00:00:10,000 --> 00:00:11,000
Jeff Moss:

167
00:00:10,000 --> 00:00:11,000
I think citizens like continuity.

168
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

169
00:00:10,000 --> 00:00:11,000
I mean this here-

170
00:00:10,000 --> 00:00:11,000
Jeff Moss:

171
00:00:10,000 --> 00:00:11,000
I wanted to bring up one other thing. When we talk about government, we're not just talking US government. There's a tendency to think myopically, but these policy issues are global in nature. The problems that we face, pretty much every government faces. I like to say that even the internet problems are global problems.

172
00:00:10,000 --> 00:00:11,000
So we're going to have to talk to the other governments of the world if we want to solve some of them. That means talking to China in Russia, whether we like it or not. So you probably need to have mechanisms and ways of communicating to other, but more so with China because they're a major manufacturer of the technology. So if you're going to try to fix a problem, it's probably going to be potentially the manufacturer that's probably going to be a Chinese company.

173
00:00:10,000 --> 00:00:11,000
So we should keep that in mind that a lot of times, I've seen it where there're ideas in the states that don't work very well or don't get much traction. Then Singapore does it like a labeling requirement for software. Then it's like, "Oh good. Somebody else did it, first mover." Now we can talk about it, now we can do it.

174
00:00:10,000 --> 00:00:11,000
So it's almost like venue shopping as hackers, fine. We'll talk to people in European parliament. We'll talk to people. Wherever it takes, right, to move the ball forward. I remember talking to a member of European Parliament, and I explained what we did this Voting Village. It had just happened. We had the report and he said, "Oh my god, I would love to have that in Europe because what I get is a report from a trade group. I got a report from a special interest, and there is no civil society counterbalancing report." Now I want to not do what's in these two, I want to do this third thing with a little bit, but I can't point to a third thing. I can only point to these two things. If you could give me a scrap of paper with a scroll on it, anything I could point to, that would make my job much easier."

175
00:00:10,000 --> 00:00:11,000
So I'm thinking that just sometimes trying to get a five-page report out that says experts in the room think X, we think that's trivial and not in depth, that might be hugely valuable to other governments or other legislators.

176
00:00:10,000 --> 00:00:11,000
Speaker 1:

177
00:00:10,000 --> 00:00:11,000
It's interesting. Even if we produce it here. So I think one, two and then you over there.

178
00:00:10,000 --> 00:00:11,000
Speaker 19:

179
00:00:10,000 --> 00:00:11,000
Yes, please complete your thought.

180
00:00:10,000 --> 00:00:11,000
Jeff Moss:

181
00:00:10,000 --> 00:00:11,000
Huh?

182
00:00:10,000 --> 00:00:11,000
Speaker 19:

183
00:00:10,000 --> 00:00:11,000
Complete your thought.

184
00:00:10,000 --> 00:00:11,000
Jeff Moss:

185
00:00:10,000 --> 00:00:11,000
Oh yes. I was going to say it's interesting the outcomes that we produce here in the context of this community or the US government etc., etc. can kind of spread and have impact beyond and maybe bootstrap those conversations because what you could have probably do is then leverage that connection and that interest of that PM in Europe to start up some sort of a long term communication with them.

186
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

187
00:00:10,000 --> 00:00:11,000
Super interesting.

188
00:00:10,000 --> 00:00:11,000
Speaker 19:

189
00:00:10,000 --> 00:00:11,000
So we are involved in the following this around across. The priority here is to finish this, passport enablement to the examiners right here. One of the other interesting examples of how they're managing the difference was that the report was also referenced in the proceeding on the VMCA, to consider the next intermission of the good faith research. Not only is the engagement high within the security assembly space, but the report was mentioned in the proceedings, which makes the idea of exactly to your point, how do we work with the community to engage in consultation? So part of my day job is exactly that, working with associations and provide a commentary.

190
00:00:10,000 --> 00:00:11,000
But often these consultations, even if you look right now, these are what the proceedings are, which is a very important piece of legislation that is likely to have what we call the security requirement. How can we make that accessible to the community and maybe create a workshop that really talks about how you read that, provide the topic points, how do you engage, so the voice of the community is also running these consultations especially because to the point made, you might have a precedent in one jurisdiction that will then serve as the benchmark for other regulations in that space.

191
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

192
00:00:10,000 --> 00:00:11,000
Interesting. Yeah, I think as hackers we're often not very good at organization. That's something that takes a lot of organization that I think ... But yeah, but it's a great idea. Yeah.

193
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

194
00:00:10,000 --> 00:00:11,000
We have a question down there real quick.

195
00:00:10,000 --> 00:00:11,000
Speaker 20:

196
00:00:10,000 --> 00:00:11,000
Sorry. Thank you. I actually love that point. I'm Nicolla Mais with B2C setting, it's exactly as well. I think to that point, while we're in session here is we have the built environment actually France's reputation. Now speaking of the European dollar and thinking about this rest stop that is being created, it takes time. It takes six months. Six months ago. Overall, when we receive months, it should be accidental. This should be a systematic code to stipulate. I think that is that. Basically I think for us, this society was like a reputation on other city society maybe that is developing right now. We are actually moving forward. There also other channels, whether the industry is not as present and therefore like for SCC, it's less common. There might be other access.

197
00:00:10,000 --> 00:00:11,000
Basically, I don't know if any sponsor there, they have aby strategy to think there in point at this contact of ground policy on place which is definitely taken to lower the file, digital taxation and to complete that. This level of familiarization is difficult but there not enough time for society. There is one thing particularly advantage is one disadvantage as well. It could be adjustment, adjusts, sorry. If we bring an arrow of that, making sure that there is coordination. As you said, the first time relationship with university, next relationship with organization. You have to facilitate and develop this role. So yeah. I don't know if the frontier organization has that strategy from the application management outside the US. Whether that, yeah, this opportunity is founded. But this organization is able to evaluate this, really working.

198
00:00:10,000 --> 00:00:11,000
But a program for the entity, like he did, a precedent. You mentioned the distributors as well. That generally distributors would not be under their premises for cybersecurity unfortunately. That's included in our checkpoint. I just want to at least most of the effort. So yeah. I think we can get together and get the last part, okay, on that term because it shouldn't be accidental and global, I think.

199
00:00:10,000 --> 00:00:11,000
Jeff Moss:

200
00:00:10,000 --> 00:00:11,000
One of the points Yan or Juan pointed out was identifying where we might do policy where it's more ripe with say villages or something. We've tried this in the past, we've talked to different government committees and said what would be useful for you. They'd say, "Okay, AI and automotive are really coming up in the next congress. Those areas would be great." So we go to the AI village and the auto village. We say, "Hey, let's try to write a report." You quickly realize they don't know how to write reports. Right?

201
00:00:10,000 --> 00:00:11,000
So then we're like, "Aha, here's an opportunity." So Def Con, we can go find people from the policy world to help work with them, to help write reports that then can get released. So the first time we tried with the AI villager report was a disaster. We never released it. But we're thinking maybe one of the things we can do is help. The community can still come up with these ideas. But if policy people say next week or next year in Europe, it's going to be all about cryptography. Oh great, okay, let's do a work consensus. What are the experts at Def Con think about this? We'll find thing tanks or we'll scare up somebody, we'll get some policy people. I think that's probably more realistic at these early stages than starting a new center of something. Yeah. Wait, wait. I think she's been waiting the longest.

202
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

203
00:00:10,000 --> 00:00:11,000
Yeah.

204
00:00:10,000 --> 00:00:11,000
Speaker 21:

205
00:00:10,000 --> 00:00:11,000
I think one of the reasons why the voting village report was so valuable was because one, it was timely. Two, it was just out of curiosity, hacker curiosity. I've only been coming to Def Con since 2016. But it seemed to me that in 2017, when that voting village started, the community changed a little bit. We got in people from the news, from politicians, more politicians who are interested in voting machines. You've built community through the back.

206
00:00:10,000 --> 00:00:11,000
There are a lot of people here I think who are suspicious of organizations, maybe deservedly so. But you've got community through the badge. You've got a world, a global, I don't know how many countries are represented here today. But I think Black Hat had 111. So there's already an international pool of intellectual capital, property, whatever, smart people who think outside the box, who like to bring things but also maybe have a heart for making the world better. I think that's a very valuable culture at Def Con. I think you've created it, and I think you'll keep it. But I think that could underlie maybe the way policy gets thought about.

207
00:00:10,000 --> 00:00:11,000
Speaker 1:

208
00:00:10,000 --> 00:00:11,000
It's really act the planet and then fix the planet.

209
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

210
00:00:10,000 --> 00:00:11,000
Yeah, yeah, yeah. Exactly. No I think the nice thing about doing it at Def Con is hacking kind of ... It's actually a weird thing to say now that we have the rise of nation states waging cyber war functionally against each other. But hacking is such a fundamentally international thing. I was once at a conference in Shanghai. I was giving the opening talk and I said, "Packets don't care about national boundaries." There are certain people at that conference that got very nervous and I said that. But it's kind of true, right, for the community at least.

211
00:00:10,000 --> 00:00:11,000
Speaker 22:

212
00:00:10,000 --> 00:00:11,000
Just to mix and bring these points together. So what is ... Because cyber security is a team sport. Right? There's no version of this, whether you work for a corporation, you work for yourself, or right, we're all here together as perpetuates. Since we have a little bit of that depends. We all have different opinion. I think while there are a lot of senior sufficiency groups and organizations. There is none of who us who has tolerance together. Right.

213
00:00:10,000 --> 00:00:11,000
In order to change the system, you must be participants in the system. Right? That's just the way that it is. The reality is that there's a lot of us that are working in the science community of the role and shape things which calls for methods of practice. The bottom line is you just got to have ways to build trust in relationships as Jeff point out, right?

214
00:00:10,000 --> 00:00:11,000
Big part of the game is if you don't have personal online relationships, it's hard for you to build on those things and reflect the message better. To me, when I think about areas where we can improve and authorize this is I think about Isa said about other large communities, the cybersecurity. They revise cybersecurity, right? Other be running around it, found an issue. It's our groups, we need to create something that allows for the message of these types of activities. To your point, I have all the interest for next year. They want us others, European, and other and all. There's the cybersecurities law. Okay. We know, we talk about it. Stand in line.

215
00:00:10,000 --> 00:00:11,000
That is next year's topic. Right? Let's evoke energy and trust the corporation of people, humans, others all along participating in that and help make that federal case. Nobody wants that answer. Right? I think if we get it onto the right people, and to your point, land ahead. Think about what we need to get, what's coming, legal, regulatory online. Then make sure there's actually communities to actually respond to in a way in could go all night. I would love to see these kinds of communities possibly where I can. So we're aware of it. Like I said, online. Right?

216
00:00:10,000 --> 00:00:11,000
Jeff Moss:

217
00:00:10,000 --> 00:00:11,000
This is the perfect time to say Track Two at 6:00, there's a policy reception with free beer, but don't tell anybody that, because it's supposed to be for people who are interested in policy, not the people who are not in this room kind of thing. But it's after the last talk, Track Two. The Secure Signal Messaging App are supporting it because they're getting more interested in this stuff. So tell your policy buddies, Track Two 6:00 and more community building with alcohol.

218
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

219
00:00:10,000 --> 00:00:11,000
I want to riff on something you were saying. Working within the system, you can make some effective change. I get that. But I think there's also a bunch of people who are mistrustful of organizations. They need some help interfacing with that. I think both of it is one of the things that is good for the community, and people have tried to do this in the policy track and doing some is get people engaged individually in the system. They can talk to their representative. They can get engaged directly. But I think also, riffing off on Yan saying about the AI report was not perfect the first time around, is that also helping people in the community who can do the research, who can find the stuff, who want to make the world, but they're not sure how to coalesce this and present that in a good forum, have that interface that we want the technologist to be able to give their opinions but make it effective.

220
00:00:10,000 --> 00:00:11,000
Sometimes there's a little bit of an art to that. So having some ways of either getting communication between these groups but investing a little bit. I think a lot of people here in the policy space can be part of that solution. Getting involved with the community groups and helping them get involved in making reports and making a difference in a system that they may not be familiar with and maybe even mistrustul of.

221
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

222
00:00:10,000 --> 00:00:11,000
So I think we have a lot of subject matter expertise in this spread out. I think DFF is the perfect example. We once did a research paper, we broke a bunch of digital rights management automatically. You might remember because we worked with you because when we tried to publish it, the conference refused to publish it until DFF kind of signed off that this is all good. Through you, we worked with all of the vendors of the DRM that we broke. Right? DFF is one body like this but the DFF has a more scoped mission and sounds to me increasingly more and more what we need is some sort of organization that makes connections, like a policy routing.

223
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

224
00:00:10,000 --> 00:00:11,000
Almost like a con.

225
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

226
00:00:10,000 --> 00:00:11,000
Hm?

227
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

228
00:00:10,000 --> 00:00:11,000
Like a con.

229
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

230
00:00:10,000 --> 00:00:11,000
Exactly. We get them all in a room with free beer maybe.

231
00:00:10,000 --> 00:00:11,000
Louis Eduardo:

232
00:00:10,000 --> 00:00:11,000
I mean this is kind of CPRs is.

233
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

234
00:00:10,000 --> 00:00:11,000
I think we have this part of the solution. We're making outside conversation, in community to talk with us, conversation.

235
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

236
00:00:10,000 --> 00:00:11,000
You were going to say something, Bill?

237
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

238
00:00:10,000 --> 00:00:11,000
I was just going to say that that's kind of what CPSR was. But what happened with CPSR, I don't really even know the story.

239
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

240
00:00:10,000 --> 00:00:11,000
Yeah. it used be a key conference that everyone went to and sort of faded away.

241
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

242
00:00:10,000 --> 00:00:11,000
Yeah. Computer Professionals for Social Responsibility

243
00:00:10,000 --> 00:00:11,000
Jeff Moss:

244
00:00:10,000 --> 00:00:11,000
In the early days, they would make sure that the ergonomic seats were made and employers had to provide monitors. They were worried about social responsibility. They kind of disappeared. There was another one too. EFF made three, with the third to arrive on the scene. I can't remember what the very first one, Epic.

245
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

246
00:00:10,000 --> 00:00:11,000
Hey, Epic is still around but they're very small. Yeah.

247
00:00:10,000 --> 00:00:11,000
Jeff Moss:

248
00:00:10,000 --> 00:00:11,000
Yeah. Epic. What did I ... Electronic Privacy.

249
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

250
00:00:10,000 --> 00:00:11,000
Information Center.

251
00:00:10,000 --> 00:00:11,000
Jeff Moss:

252
00:00:10,000 --> 00:00:11,000
Information Center.

253
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

254
00:00:10,000 --> 00:00:11,000
Yeah. How do we get more light to shine out to them? Do we say does a government agency made an official recommendation that people from around government and industry go to these places?

255
00:00:10,000 --> 00:00:11,000
Jeff Moss:

256
00:00:10,000 --> 00:00:11,000
I mean, well, I should ask the government people. How do you find your civil society counterparts? I mean I'm assuming industry is constantly bombarding you with freebies. We don't look and sound like what you normally see as industry. So how do you even find us here?

257
00:00:10,000 --> 00:00:11,000
Rob:

258
00:00:10,000 --> 00:00:11,000
This is Rob. So I'm not currently working for the government there but I have stayed. You're exactly right. We are constantly bombarded by somebody trying to sell you something. So as a consequence, they develop a shell around them which is inure to the effects of somebody actually trying to sell them. So you need to trust your third party in order for that to be ... That does not have another agenda.

259
00:00:10,000 --> 00:00:11,000
As an example, I've been coming to your con for 20 years because I thought it was important,. I did the right thing that I gave people that were trying to do the right thing and to figure out the best approach. So there needs to be a different level of outreach. I'm willing, in my new role, to help. So I'm a cyber practice for a contract over this year. So these things are interesting to me. Having been on the other side, now trying to do the right thing. But we need an independent entity that is able to host a con or even gathering birds with other sessions. Something as simple as that in major centers to bring together folks from the community, folks from industry and government, hosted by somebody like EFFK, not to put you on the spot.

260
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

261
00:00:10,000 --> 00:00:11,000
Right. No pressure.

262
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

263
00:00:10,000 --> 00:00:11,000
We're all part of it. But I think EFF alone is just part of a larger system that we need to help develop to get these things. We do some work, a lot of work in the US, more so overseas. But there's still a lot of interfacing that can be done. I think that's why I say this group that we're bringing together here is actually a really important part of this.

264
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

265
00:00:10,000 --> 00:00:11,000
It's really tricky when you're dealing with government to sort retain that neutral, trusted third party kind of role and still get work done on important issues, right, that there's a balance to be struck. The problem is that I mean for the EFF, I think the problem is that the EFF because of who its donors and members and so forth are, is called on to take a strong position on critical issues. Right? They're very active. So then in DC, that gets viewed as, "Oh, they're at one end of the spectrum. We need a balanced approach." So let's go and ask the Koch brothers what they think, right? Or whatever, right?

266
00:00:10,000 --> 00:00:11,000
Rob:

267
00:00:10,000 --> 00:00:11,000
I agree completely. The reason why I bring of EFF having a lot of support is because of my interaction with them and how they work. I understand there's an adversarial relationship with certain aspects of the government within EFF. But that's okay because that necessary declarity, we need that balance. So if not them, who? Because I used to work for the legislature of California. I cry regularly, "How can I get you to listen to what I'm trying to tell you?" My side, my interest is yours. You're not viewing me as a trusted third party. At the same time, who else you going to listen to?

268
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

269
00:00:10,000 --> 00:00:11,000
One of the most valuable things that here security people community is just factual things like technical analysis, like reviewing code, finding vulnerabilities in voting machines. A turn of phrase we use, sort of say, speak truth to power, speak tech to power. To be able to explain how the technology works. Now, absolutely EFF has policy positions. We try to promote them. In some cases, we're in opposition on government position. But the tech is still the truth of these. Just going back to the voting machine example, because I think it's a really good one.

270
00:00:10,000 --> 00:00:11,000
It's literally finding the vulnerabilities, proving up what had been said before but providing some evidence to it. A lot of people who were doing it came from the academic community. So I think they also knew how to write things up in a way that maybe not everybody in the community does. But getting that information, so even also if government receives factual information and buys into that, they make a policy. You might disagree on the policy choices, but at least it's being based on how the technology works. Some of the worst policies or troubled ones is policymakers are doing it based on a misunderstanding of how the technology works.

271
00:00:10,000 --> 00:00:11,000
Speaker 24:

272
00:00:10,000 --> 00:00:11,000
Hey. Thank you. I'm Gerard Fin. I'm wearing a shed, look how I'm feeling evident in that, but completely rule with Jeff going on. I'll lay out the next time. Okay? But I think this is an issue that I really struggle with, getting two communities to work together. So in the last year and a half, my department has put out three, four or five consultations on potentially new cybersecurity laws for the UK. Most of the responses we get, public consultation is our way of saying, "What we're doing, is this right? Is this wrong?" We haven't had a response, I think it says you're doing this wrong, which means the wrong people are talking to the right government.

273
00:00:10,000 --> 00:00:11,000
We get loads of industry saying, This is the best thing that you're doing. This is great." We get people saying, "You do should more, you should less." No one's ever complemented, in charge of our grade. I think part of that is because a lot of this stuff is new. I think in this space can sometimes be a good starting point. But we're definitely not getting into the right people. Definitely wrong. So my department's first foray. How are we reaching out to those groups that are not ... then we'll be connected. I think Black Hat Europe will be the one. It's really where the base of the relationship is.

274
00:00:10,000 --> 00:00:11,000
One of the gaps that we view as in the case is the hacking community which we get involved in, into relationships. We respond to stuff on Twitter or we read stuff on Twitter because that's the most adversive thing that we get. It's very difficult to follow up on. But there's also room for the gap. I think both in the US and the UK, particularly along the US side, a think tank person. I think that's all the stuff on national stuff and national security. This is a lot on the economic side. But I think so and also you can come across, I think. Cyber security necessarily too is a national security issue in many ways.

275
00:00:10,000 --> 00:00:11,000
It's a really big economic problem. It's an economic problem where you have to weigh the risks of the cyber risks that are inherent with using digital services, with more benefits that are largely. In the UK I think and probably Europe as well, how important is cybersecurity versus information. How is that going to affect communities? There's not been a space to how that ... I think I don't go to do this only to agree with everything here. I think if anyone can get ... I think we can be more this kind of thing where we bring things together, they think I'd love to be able to work with what we're doing. Is it what people doing? Not just what they want, but also the next set of security issues that are going to be hacked, that are going to be counter risked, malicious activity that we need to get into to accept the group.

276
00:00:10,000 --> 00:00:11,000
Speaker 25:

277
00:00:10,000 --> 00:00:11,000
You go first because we not are best friends. I would say that we are entering a world where we can all go on agricultural, commerce and stuff. We are maybe a little bit further for all the things. We are turning in cybersecurity.

278
00:00:10,000 --> 00:00:11,000
The challenge that we have is similar with what you're saying, explaining to either state government or service officers or a point service officers why cybersecurity is a relevant component of the organization and all the programs that you're funding and all the work you're doing, all that we should be having. Unless that person has an existing background in this space, it's really hard to do. One group did mention, it's national security. It's economic growth. It's growth, it's also civil society, which we touched on. Right? It's journalism. It's the right organizations. Those are the kinds of things that at least from forward policy side, the US government is now catching up on cyber program and having these conversations, that they're going to be interested in.

279
00:00:10,000 --> 00:00:11,000
Finding ways both from the community but then also internally, right. They in this circle is trying to explain cyber. These people have attributes on their own technically, some matters in little health. That's something. It's really something important. The last part I would is so much of the advertisement on cyber DC is like insist those in a high self, which is it's a little unsettled, couple of those managing people. But in commuter, that's 10% of the organization. 90% is trying to do other work and figure out other option, making sure they don't multiply.

280
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

281
00:00:10,000 --> 00:00:11,000
You keep coming back ... yeah.

282
00:00:10,000 --> 00:00:11,000
Speaker 26:

283
00:00:10,000 --> 00:00:11,000
Can I just come off?

284
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

285
00:00:10,000 --> 00:00:11,000
Yeah.

286
00:00:10,000 --> 00:00:11,000
Speaker 26:

287
00:00:10,000 --> 00:00:11,000
I'm Gart. A former consultant, digital, now working with community. One of the problems we have too is that a lot of the technical expertise now is related to you guys is that work well. When you're in the DOD, working with health community, you're engaged with some of civil society. There are so many problems that they can have because of security reasons. When you're concerned about insider, some kind of choices, doing legal things et cetera. It makes really painful for someone who's trying to engage. On top of that, even budgets. Right? So I had to work very hard to get budget to come out for you this week to a conference in Vegas for five days, six days or whatever. That costs us what, 2, 3, $4,000. That's not going to happen very often for a low income country. So there's another barrier as to engaging, particularly out here. You could do more in DC, probably a couple more hundred attendants. Just some thoughts there.

288
00:00:10,000 --> 00:00:11,000
Speaker 27:

289
00:00:10,000 --> 00:00:11,000
I just wanted to get people off. It's interesting. One of the challenge today with consultations is very well in confidence. You can possibly agree with associates that have been within these communities. So definitely an EU government legislation, consultation, scope of areas too or the cybersecurity sec and you guys' jurisdictions. There's also all the information out there.

290
00:00:10,000 --> 00:00:11,000
One of things that we see useful sometimes as a big association is either a monthly or some kind of gains or the most significant consultations that out there, obviously this is based on prioritizations. So the community want to make specific deliverables and I think mostly powerful program too. Then by sharing this information, this addressable consultation and turning that, mostly through them, like exclusively, how we can adjust that, then there is enough community to engage in. There is information, probably participation that we favor in front of this job.

291
00:00:10,000 --> 00:00:11,000
This is just a great example of how they ... Leadership as well consistently evolve. Then how this could be a geo. This is a more creative way to get feedback. But creating the opportunities or ideas. You get kind of leveraging associations and other policy experts that maybe acknowledge it, news talking to create a multi digest for the community as long as everybody is out there and doing consultations as well as something that is more appropriate ages in local communities that there is policy expert in the community who actually would see this local response. So that's a little bit of the organization as well as with being the community to address that gap.

292
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

293
00:00:10,000 --> 00:00:11,000
What about if we start small and have a discord category, right? Because I think you mentioned budgets, right? Having in DC will fix one aspect of it, but maybe not others. Right? Someone over here mentioned that it's difficult to make these connections beyond these conferences. Maybe Jeff mentioned something along those lines. But maybe if we have a online community that's kind of let's say semi vetted but fairly open to have these sort talks much more frequently without the need to spend $6,000 to come to probably the worst city on the planet. I don't know. Do you think that would be useful or is there like a ... What's the downside there?

294
00:00:10,000 --> 00:00:11,000
Jeff Moss:

295
00:00:10,000 --> 00:00:11,000
I found it really hard to build community online on the Def Con forums, we've tried for years to build this community around aerospace and satellite hacking. The people are out there. The content is out there but nobody wants to curate it. Unless the space has some sort of curated content, people don't really come back. So it's like you need a budget. You need somebody, an intern, somebody whose job is to gather all the satellite hacking articles and papers and YouTube videos and you have to create a critical mass and then two years later enough people might understand.

296
00:00:10,000 --> 00:00:11,000
We tried this with farm hacking which turned into sort right to repair. You get a couple people who know what they're talking about, they post a couple of things. They get low engagement, and they never come back. So it's not just like you start an online community. I've tried that many times. You need to have a core group of people that are posting all the time to cross promote it. I mean it's a job.

297
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

298
00:00:10,000 --> 00:00:11,000
And who want to get together in person to argue about it alongside meetings that they're going to anyway periodically. I mean essentially, that's what Def Con kind of is, is a whole lot of side meetings happening at the same place at the same time. But building on that and providing continuity between meetings is I think the part that needs more work.

299
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

300
00:00:10,000 --> 00:00:11,000
Someone needs to power that or a group needs to power that. I nominate Louis. No. I'm just kidding.

301
00:00:10,000 --> 00:00:11,000
Louis Eduardo:

302
00:00:10,000 --> 00:00:11,000
Again?

303
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

304
00:00:10,000 --> 00:00:11,000
Yeah, it's ... Go ahead.

305
00:00:10,000 --> 00:00:11,000
Speaker 28:

306
00:00:10,000 --> 00:00:11,000
Just a thought, I mean you keep talking about earlier, a leader on these public-private partnerships. These programs worked very well, US not much. We're trying to vet here across. But that construct is really goes back to you can't just create groups and don't show up. So you have figure out to build that trust. So there is still one motivated to this stuff. People participate in all this stuff. But to be honest, if you want to participate in order to win, you got to play. So you create public-private trust kind of relationships becomes really important. Now whether that's you got to work or a community that does it or whether that's your government that does it, you got to view it because you got to have someone with the same amount of valuation. You can't just have some random group.

307
00:00:10,000 --> 00:00:11,000
Jeff Moss:

308
00:00:10,000 --> 00:00:11,000
Well, that's the online is great if you've already met the people in person. Right? I think Bill and I were joking that one of the best trust building relationship exercises out of Cyberstorm would probably just be the beer and pizza phase of Cyberstorm. All the computers, and pretending you're running the internet and whatever, that's fine too. But really the valuable part was actually the beer and pizza part.

309
00:00:10,000 --> 00:00:11,000
Speaker 28:

310
00:00:10,000 --> 00:00:11,000
I agree. It's especially one on because it's meeting people. Right? I think so that becomes part of the dialogue as we figure there's this, about all this stuff. So this is enough. That's the control system. You can build on for the community.

311
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

312
00:00:10,000 --> 00:00:11,000
Well, we're starting to run out of time. So let's try to figure out what's our sort of key takeaways.

313
00:00:10,000 --> 00:00:11,000
Jeff Moss:

314
00:00:10,000 --> 00:00:11,000
Yeah. So from ... Good ahead.

315
00:00:10,000 --> 00:00:11,000
Louis Eduardo:

316
00:00:10,000 --> 00:00:11,000
I just wanted to ask something. We're talking about possibly meeting or promoting meetings and stuff like that. Maybe there is no answer for this, but if there are other meetings that are not related to cybersecurity, is there a way to have a cybersecurity breakout for these different meetings that might or might not exist? Because people, that's a way to start getting into the conversation. Right? Maybe say what are the cybersecurity implications for certain thing, for a segment or for an industry or something like that. That's possibly one way to start. That.

317
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

318
00:00:10,000 --> 00:00:11,000
I wasn't trying to.

319
00:00:10,000 --> 00:00:11,000
Louis Eduardo:

320
00:00:10,000 --> 00:00:11,000
Yeah, I know.

321
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

322
00:00:10,000 --> 00:00:11,000
Intrude. So an interesting thing on that, and I think that goes back into a lot of what we talked about is in order to organize that, I guess the effective way to do it would be you identify the trade group meeting of X, Y and Z industries or whatever or groups. Then you go and reach out to them and say, "Hey can we do a breakout?" A collaboration with Def Con for example?

323
00:00:10,000 --> 00:00:11,000
Jeff Moss:

324
00:00:10,000 --> 00:00:11,000
So Aviation Village now in its, I don't know, X year incarnation it. The first few years was nothing but trying to convince industry that we're safe and we're not going to burn you down. Now I think, Beau, you can maybe mention this. We're finally getting actual manufacturer representation, but that was because of years of prospecting to build those relationships. Right?

325
00:00:10,000 --> 00:00:11,000
Speaker 29:

326
00:00:10,000 --> 00:00:11,000
Some of us going to their events, the aviation aerospace events. Liz has also worked a lot on the Aviation Aerospace Village and other things. Part of that was bringing them in early to the conversation so it wasn't just a bunch of hackers that are around the room. It was a bunch of hackers and a bunch of the really bold, really brave people from industry, from government who were a lot of times doing it in their personal capacity because their professional capacity wouldn't let them do it. I think things are changing now in a lot of places for the better where companies are starting to say, "Oh yeah, you could go and have those conversations, you could do that. That's cool." But not all at the same time. So some industries are farther along than others.

327
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

328
00:00:10,000 --> 00:00:11,000
I think one way to, kind of what Louis said. If we identify much of outreach conferences that we can go to, and they're already there, they can't escape. Right? We just kind of set up in a room and say, "Hey, let's talk about security of X." I guess that could be a concrete next step from a Def Con perspective.

329
00:00:10,000 --> 00:00:11,000
Jeff Moss:

330
00:00:10,000 --> 00:00:11,000
Sort of do the Def Con track at Aviation World or whatever.

331
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

332
00:00:10,000 --> 00:00:11,000
Exactly. Yeah, yeah.

333
00:00:10,000 --> 00:00:11,000
Jeff Moss:

334
00:00:10,000 --> 00:00:11,000
We did that once for what? The Tribeca Film Festival around storytellers and directors and actors and everything. But yeah, there's precedent. You could travel, we could have a ...

335
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

336
00:00:10,000 --> 00:00:11,000
Yeah. Def Con on the road. So that's one common theme, to summarize, that kept coming up is engaging with these other areas. The other common theme is maintaining relationships between people at different organizations across government-industry, government-government, government and kind of citizen groups. That seems like a very hard problem. Maybe that's where maybe we use Def Con outreach, Def Con goes and breaks into other conferences or doing the industry to security connection. Then we use an online, I don't know, maybe just ... I see what you're saying about maintaining the online community, but there's got to be a solution to the person to person connections.

337
00:00:10,000 --> 00:00:11,000
Jeff Moss:

338
00:00:10,000 --> 00:00:11,000
I've got to go to the general story review.

339
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

340
00:00:10,000 --> 00:00:11,000
Yeah, cool. Thanks for joining us, DT.

341
00:00:10,000 --> 00:00:11,000
Jeff Moss:

342
00:00:10,000 --> 00:00:11,000
Thank you everyone. Don't forget, tell your policy friends tonight, 6:00 Track 2.

343
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

344
00:00:10,000 --> 00:00:11,000
See you there.

345
00:00:10,000 --> 00:00:11,000
Speaker 30:

346
00:00:10,000 --> 00:00:11,000
That's not far. That definitely is not beyond the schedule.

347
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

348
00:00:10,000 --> 00:00:11,000
It's secret.

349
00:00:10,000 --> 00:00:11,000
Speaker 30:

350
00:00:10,000 --> 00:00:11,000
It's secret.

351
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

352
00:00:10,000 --> 00:00:11,000
Yeah. Otherwise everyone will be there for beer.

353
00:00:10,000 --> 00:00:11,000
Speaker 30:

354
00:00:10,000 --> 00:00:11,000
All right.

355
00:00:10,000 --> 00:00:11,000
Speaker 31:

356
00:00:10,000 --> 00:00:11,000
I think one of the things that I'm also excited about with what's coming with Def Con is going to be continue the immersions and organizations of policy clogs and obviously the different practices. Certainly tutorial, each of S quads, probably do requirements in this community. Then to be able to talk, to be able to create awareness for regulatory requirements on this manufacture. Have those across the community is absolutely I think ... that needs attention.

357
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

358
00:00:10,000 --> 00:00:11,000
Yeah. I think, yeah, and that's very different than building out the ... So it's also security community to security community that we got to connect. Cool. Anything we're missing in terms of the outtakes other than interconnectivity?

359
00:00:10,000 --> 00:00:11,000
Speaker 32:

360
00:00:10,000 --> 00:00:11,000
Are we talking both government? There might be something very simple, probably incentivize people whose employers don't want them to go there.

361
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

362
00:00:10,000 --> 00:00:11,000
That's right.

363
00:00:10,000 --> 00:00:11,000
Speaker 32:

364
00:00:10,000 --> 00:00:11,000
Is to say what if we can't be there so we can control products and products have to do that as a standard, whatever to make policy and encompass. That would be one easy way.

365
00:00:10,000 --> 00:00:11,000
Speaker 31:

366
00:00:10,000 --> 00:00:11,000
One more I guess. I find that we're very proud of how you in 2017 talked about digital security for abundance. This is the security as well as I go, to empower the community to support. You just heard across the way, the village to have consultation, going through a study that's prized and very specifically have a community engagement. Something that will be changed, maybe aspiring for community participation, and who that dictates to. The endpoints in a certain point, going into the space.

367
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

368
00:00:10,000 --> 00:00:11,000
I guess That's part of the point of policy track in general that we can enable these sort of things at Def Con. Cool. We got the 10 minute marker. Why don't we go around and see if anyone has any closing remarks on the panel or in the audience? Let's do audience first so then we can get the real closing remarks.

369
00:00:10,000 --> 00:00:11,000
Speaker 32:

370
00:00:10,000 --> 00:00:11,000
Yeah. Just one point. If you identify several institutions, those opportunities that influence each of the. I'd say this reach out and there is a confidence that you might be able to talk to them or at least move the relationship forward. Because I think that is trying to get them to proceed is all we need actually.

371
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

372
00:00:10,000 --> 00:00:11,000
Hang on. I got to know, are you Peter Stevens or not? Sorry, I have to know. Are you Peter Stevens or not? You're not Peter Stevens?

373
00:00:10,000 --> 00:00:11,000
Speaker 32:

374
00:00:10,000 --> 00:00:11,000
No. I'm not Peter Stevens.

375
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

376
00:00:10,000 --> 00:00:11,000
Interesting.

377
00:00:10,000 --> 00:00:11,000
Speaker 32:

378
00:00:10,000 --> 00:00:11,000
I am the tall one.

379
00:00:10,000 --> 00:00:11,000
Bill Woodcock:

380
00:00:10,000 --> 00:00:11,000
Okay.

381
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

382
00:00:10,000 --> 00:00:11,000
Are you sure it's you, not him? I'm joking, I'm joking. Cool. No, that's a great idea. I think that's probably one of the more actionable routes forward. Other closing remarks? Audience?

383
00:00:10,000 --> 00:00:11,000
Speaker 33:

384
00:00:10,000 --> 00:00:11,000
All right. Just to say OECD was mentioned a few times and most of them are plausible. Usually we'll allow 20 minutes.

385
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

386
00:00:10,000 --> 00:00:11,000
Cool. All right. Well, panelists, do we have any closing remarks? All right. Kurt, that's perfect.

387
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

388
00:00:10,000 --> 00:00:11,000
Well, not really as much of a closing remarks kind of things, thank everybody for this, this conversation. I think brainstorming a number of ideas here, and I think we're trying to find a path forward to get better engagement, minimize the problems with first contact scenarios, get the hacking community more able to be engaged. I hope we can keep moving forward and make this happen.

389
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

390
00:00:10,000 --> 00:00:11,000
As everyone filters out, if you've got a business card and want to be notified when, if we create Def Con policy, Discord channel or whatever, drop it off. We'll do our best.

391
00:00:10,000 --> 00:00:11,000
Speaker 34:

392
00:00:10,000 --> 00:00:11,000
Post it to your Twitter.

393
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

394
00:00:10,000 --> 00:00:11,000
Or Yeah, respond to my Twitter. Awesome. Remember to like and subscribe too. All right. Thank you everybody.

395
00:00:10,000 --> 00:00:11,000
Kurt Opsel:

396
00:00:10,000 --> 00:00:11,000
Thank you, everybody.

397
00:00:10,000 --> 00:00:11,000
Yan Shoshitaishvili:

398
00:00:10,000 --> 00:05:00,000
Thank you.