1 00:00:03,494 --> 00:00:06,180 - So this is the talk about the public policy department. 2 00:00:06,180 --> 00:00:07,500 By show of hands, 3 00:00:07,500 --> 00:00:10,920 how many of you have heard of the policy department before? 4 00:00:10,920 --> 00:00:14,340 Oh man, that's a lot more than I expected it to be. 5 00:00:14,340 --> 00:00:15,173 That's good. 6 00:00:15,173 --> 00:00:17,040 How many of you have been to policy talks 7 00:00:17,040 --> 00:00:19,053 at DEFCON in years past? 8 00:00:20,760 --> 00:00:23,880 Fewer people, good. Room to grow this year. 9 00:00:23,880 --> 00:00:26,883 So we are one of the newest departments at DEFCON. 10 00:00:27,900 --> 00:00:30,870 We are kind of focused on the idea 11 00:00:30,870 --> 00:00:35,010 that you can bring public policy makers and hackers together 12 00:00:35,010 --> 00:00:38,070 in the same space and have them collaborate, 13 00:00:38,070 --> 00:00:43,050 cooperate, build trust, and start to cause things 14 00:00:43,050 --> 00:00:46,530 to happen in a better way than they would have otherwise. 15 00:00:46,530 --> 00:00:48,680 And we're gonna have the Dark Tangent come on 16 00:00:48,680 --> 00:00:51,330 in a couple of minutes and elaborate more 17 00:00:51,330 --> 00:00:55,650 on his vision for what the policy department 18 00:00:55,650 --> 00:00:56,880 should look like. 19 00:00:56,880 --> 00:00:59,580 And some of the history of the policy department 20 00:00:59,580 --> 00:01:02,043 and policy itself at DEFCON. 21 00:01:04,260 --> 00:01:07,230 We've got an interesting program. 22 00:01:07,230 --> 00:01:09,720 We've got three very distinguished folks 23 00:01:09,720 --> 00:01:12,573 over here on my right, your left, 24 00:01:13,560 --> 00:01:17,160 that have spent the last 30 years, 25 00:01:17,160 --> 00:01:19,470 in some way, shape, or form, 26 00:01:19,470 --> 00:01:22,380 as hackers transforming public policy, 27 00:01:22,380 --> 00:01:27,030 engaged in conversation with members of Congress, 28 00:01:27,030 --> 00:01:30,843 with the executive branch, globally as well, 29 00:01:31,860 --> 00:01:34,500 to try and bridge the gap, 30 00:01:34,500 --> 00:01:37,290 to close the expanse between public policy 31 00:01:37,290 --> 00:01:39,063 and the hacking community. 32 00:01:42,900 --> 00:01:46,413 For those of you who aren't aware, 33 00:01:48,600 --> 00:01:51,750 DEFCON has had a little bit of a tenuous relationship 34 00:01:51,750 --> 00:01:53,306 with government in the past. 35 00:01:53,306 --> 00:01:55,470 (crowd laughing) 36 00:01:55,470 --> 00:01:57,633 Requisite pause for laughter. 37 00:01:59,370 --> 00:02:01,110 But I think we're closing those gaps. 38 00:02:01,110 --> 00:02:04,170 We're changing the way that things get done in DC 39 00:02:04,170 --> 00:02:06,930 and around the world in public policy centers 40 00:02:06,930 --> 00:02:08,610 and centers of power. 41 00:02:08,610 --> 00:02:10,890 And I think that we've got a huge opportunity 42 00:02:10,890 --> 00:02:12,003 to expand on that. 43 00:02:13,020 --> 00:02:15,480 I myself live in downtown DC. 44 00:02:15,480 --> 00:02:16,710 By the way, I'm Beau Woods. 45 00:02:16,710 --> 00:02:18,560 I run the policy department this year 46 00:02:19,740 --> 00:02:21,590 and I'm excited to have you all here. 47 00:02:22,440 --> 00:02:26,750 I live in DC and I've seen the change 48 00:02:26,750 --> 00:02:29,160 in just the last five or six years 49 00:02:29,160 --> 00:02:30,630 in public policy and the way 50 00:02:30,630 --> 00:02:32,490 that they look at hackers. 51 00:02:32,490 --> 00:02:34,290 You know, a decade ago, 52 00:02:34,290 --> 00:02:37,140 public policy folks thought we were all criminals. 53 00:02:37,140 --> 00:02:40,050 And now they have a much more 54 00:02:40,050 --> 00:02:41,973 in-depth and nuanced understanding. 55 00:02:44,070 --> 00:02:47,040 And the reason is partly because of some of the folks 56 00:02:47,040 --> 00:02:50,520 over here to my right, your left. 57 00:02:50,520 --> 00:02:54,330 And so I wanna start off and give them an opportunity 58 00:02:54,330 --> 00:02:59,330 to give a little perspective and context and history 59 00:02:59,370 --> 00:03:01,200 in the past 30 years, 60 00:03:01,200 --> 00:03:03,450 what's happened in the hacking community 61 00:03:03,450 --> 00:03:07,080 and public policy and how have they seen that change. 62 00:03:07,080 --> 00:03:10,050 So just immediately to my right, 63 00:03:10,050 --> 00:03:14,610 we have Jay Healey and then Jack Cable and Space Rogue. 64 00:03:14,610 --> 00:03:16,383 So Jay, do you wanna kick us off? 65 00:03:17,220 --> 00:03:19,110 - [Jay] Yeah, sure thing. 66 00:03:19,110 --> 00:03:21,090 So, hi everyone, Jay Healey. 67 00:03:21,090 --> 00:03:25,260 And one of the reasons that I've gotten involved 68 00:03:25,260 --> 00:03:28,260 and to really start thinking about policy 69 00:03:28,260 --> 00:03:33,187 was I came across a great quote that said, 70 00:03:33,187 --> 00:03:35,520 "Few, if any contemporary security controls 71 00:03:35,520 --> 00:03:37,350 can stop a dedicated red team 72 00:03:37,350 --> 00:03:39,210 from easily accessing any information." 73 00:03:39,210 --> 00:03:40,203 So we know that. 74 00:03:41,400 --> 00:03:42,600 The red team's gonna get through, 75 00:03:42,600 --> 00:03:43,620 the hacker is gonna get through, 76 00:03:43,620 --> 00:03:46,710 the offense has the advantage over defense. 77 00:03:46,710 --> 00:03:49,263 That quote was from 1979. 78 00:03:50,820 --> 00:03:52,533 Since before DEFCON, 79 00:03:53,670 --> 00:03:55,680 the attackers had the advantage. 80 00:03:55,680 --> 00:03:58,140 And so hackers do what we do for a lot of reasons. 81 00:03:58,140 --> 00:04:00,000 We know a lot do it for curiosity, 82 00:04:00,000 --> 00:04:03,213 a lot of it because we hack 'cause it's there, 83 00:04:04,260 --> 00:04:06,300 but a lot do it because we think 84 00:04:06,300 --> 00:04:08,400 we're making the world better. 85 00:04:08,400 --> 00:04:10,980 That doing this is gonna lead to more security, 86 00:04:10,980 --> 00:04:13,890 to more privacy that our kids and our grandkids 87 00:04:13,890 --> 00:04:15,240 aren't gonna have to deal with the shit 88 00:04:15,240 --> 00:04:17,913 that we've been dealing with for 30 DEFCONs. 89 00:04:18,810 --> 00:04:20,190 But it's not working, right? 90 00:04:20,190 --> 00:04:23,913 That quote from 1979 is still relevant. 91 00:04:24,960 --> 00:04:28,050 So that's one of the things that we try and do on policy. 92 00:04:28,050 --> 00:04:29,790 Is saying, all right, 93 00:04:29,790 --> 00:04:32,550 people are working super hard 94 00:04:32,550 --> 00:04:34,830 to find vulnerabilities and fix them. 95 00:04:34,830 --> 00:04:37,230 And we're not making any progress. 96 00:04:37,230 --> 00:04:39,243 So what else can we do differently? 97 00:04:40,440 --> 00:04:42,240 What else can we try to do out of DC, 98 00:04:42,240 --> 00:04:43,140 out of other governments, 99 00:04:43,140 --> 00:04:46,080 out of things like "I am the Cavalry," 100 00:04:46,080 --> 00:04:48,720 so that the work the hacker's doing is having more impact 101 00:04:48,720 --> 00:04:51,060 and that we can find other ways to have impact. 102 00:04:51,060 --> 00:04:52,383 And that that's really driving me 103 00:04:52,383 --> 00:04:54,133 in the way I think of the problems. 104 00:04:56,319 --> 00:04:57,152 - Yeah, Jack. 105 00:05:01,740 --> 00:05:03,600 - Hi everyone. I'm Jack Cable. 106 00:05:03,600 --> 00:05:07,050 I'm a hacker. I'm also a security researcher, 107 00:05:07,050 --> 00:05:09,570 which is what I call myself in front of policy people 108 00:05:09,570 --> 00:05:12,930 to make myself appear more professional. 109 00:05:12,930 --> 00:05:14,640 Good tip out there. 110 00:05:14,640 --> 00:05:18,570 So I got into the world of policy, 111 00:05:18,570 --> 00:05:19,590 kind of my foray into that, 112 00:05:19,590 --> 00:05:21,180 started when I was in high school. 113 00:05:21,180 --> 00:05:22,627 I got an email titled, 114 00:05:22,627 --> 00:05:26,190 "What if I had told you the Pentagon wanted you to hack it?" 115 00:05:26,190 --> 00:05:29,040 This was the first US government, 116 00:05:29,040 --> 00:05:31,680 I believe the first government bug bounty program, 117 00:05:31,680 --> 00:05:34,080 where they were inviting hackers 118 00:05:34,080 --> 00:05:37,320 to find vulnerabilities in Pentagon systems. 119 00:05:37,320 --> 00:05:40,020 Something that even a few years before 120 00:05:40,020 --> 00:05:41,880 you could only go to jail for. 121 00:05:41,880 --> 00:05:45,030 So now there was a legal pathway for doing this. 122 00:05:45,030 --> 00:05:48,360 Government was recognizing the value of people like us 123 00:05:48,360 --> 00:05:52,020 in helping secure their systems, helping secure our country. 124 00:05:52,020 --> 00:05:55,890 So I participated in that, got involved in a couple more, 125 00:05:55,890 --> 00:05:58,680 went to work for the Defense Digital Service, 126 00:05:58,680 --> 00:06:01,440 which is an agency that put this on. 127 00:06:01,440 --> 00:06:03,510 And before that I'd never really considered 128 00:06:03,510 --> 00:06:06,570 working in government or doing anything policy related. 129 00:06:06,570 --> 00:06:09,570 I had been kind of immersed in this community 130 00:06:09,570 --> 00:06:11,400 and really enjoyed what I did, 131 00:06:11,400 --> 00:06:14,400 but that never really crossed my mind. 132 00:06:14,400 --> 00:06:18,090 Until I went and saw the potential for change. 133 00:06:18,090 --> 00:06:23,040 The idea that there are places in government you can do, 134 00:06:23,040 --> 00:06:24,990 where you can actually make change, 135 00:06:24,990 --> 00:06:27,093 where you can get around the bureaucracy. 136 00:06:29,070 --> 00:06:30,870 I won't say that's everywhere in government, 137 00:06:30,870 --> 00:06:33,570 but there are certainly places where that can be done. 138 00:06:35,340 --> 00:06:39,270 Second instance was when I was registering to vote, 139 00:06:39,270 --> 00:06:42,420 I came across a pretty serious vulnerability. 140 00:06:42,420 --> 00:06:45,150 I did not know much about election systems 141 00:06:45,150 --> 00:06:46,680 or who administered elections, 142 00:06:46,680 --> 00:06:48,510 but I knew this was pretty serious. 143 00:06:48,510 --> 00:06:52,830 I went about trying to figure out who to disclose this to. 144 00:06:52,830 --> 00:06:56,130 Was a long and confusing path. 145 00:06:56,130 --> 00:06:59,340 Eventually after around six or so months, 146 00:06:59,340 --> 00:07:01,080 found the right people, was able to get to them 147 00:07:01,080 --> 00:07:02,310 so they could fix it. 148 00:07:02,310 --> 00:07:04,260 That was not at all transparent. 149 00:07:04,260 --> 00:07:06,480 I got connected with the folks at CISA, 150 00:07:06,480 --> 00:07:09,600 the US Cybersecurity Infrastructure Security Agency, 151 00:07:09,600 --> 00:07:13,320 along the way, who were able to help make those connections 152 00:07:13,320 --> 00:07:14,400 in order to be able to 153 00:07:14,400 --> 00:07:16,200 effectively disclose the vulnerability. 154 00:07:16,200 --> 00:07:19,140 I then went to work for CISA working on election security, 155 00:07:19,140 --> 00:07:22,710 helping secure both state and local election systems, 156 00:07:22,710 --> 00:07:26,043 as well as some of their disinformation work. 157 00:07:27,090 --> 00:07:28,680 So through this work, 158 00:07:28,680 --> 00:07:31,770 I've been able to engage with election officials, 159 00:07:31,770 --> 00:07:36,030 election manufacturers, policy makers across the country. 160 00:07:36,030 --> 00:07:41,030 And I can say that the conversation is changing. 161 00:07:43,440 --> 00:07:46,140 If you want to engage with this conversation, 162 00:07:46,140 --> 00:07:47,670 which I think is critically important, 163 00:07:47,670 --> 00:07:52,530 because us here in Vegas, wherever we usually are, 164 00:07:52,530 --> 00:07:55,740 do not typically intersect with the folks in DC. 165 00:07:55,740 --> 00:07:57,420 There's a disconnect there. 166 00:07:57,420 --> 00:08:00,420 And I think of policy on the technical side 167 00:08:00,420 --> 00:08:02,643 is really two sides of the same coin. 168 00:08:03,840 --> 00:08:07,410 Almost all policy problems have underlying technical truths 169 00:08:07,410 --> 00:08:11,010 that we all know, that unless we're there in the room 170 00:08:11,010 --> 00:08:15,240 helping them get it right, aren't gonna get right. 171 00:08:15,240 --> 00:08:17,700 So a couple takeaways. I think one, 172 00:08:17,700 --> 00:08:21,000 policy is really about creating change at scale. 173 00:08:21,000 --> 00:08:23,070 That's part of why I got into this, 174 00:08:23,070 --> 00:08:26,730 is because I saw the ability to take the technical work 175 00:08:26,730 --> 00:08:30,060 I'd done and raise that to a level where I could apply that, 176 00:08:30,060 --> 00:08:33,060 not just for say one company or one organization, 177 00:08:33,060 --> 00:08:34,893 but at a more national scale. 178 00:08:36,270 --> 00:08:37,800 A second thing is being able 179 00:08:37,800 --> 00:08:39,990 to speak the language of policy makers. 180 00:08:39,990 --> 00:08:44,820 We have very different lingo and what we all do is great 181 00:08:44,820 --> 00:08:46,080 and what they all do is great. 182 00:08:46,080 --> 00:08:48,630 But unless we're able to effectively communicate, 183 00:08:48,630 --> 00:08:51,630 we're not gonna be able to effectively make change. 184 00:08:51,630 --> 00:08:52,980 So it goes both ways, of course, 185 00:08:52,980 --> 00:08:55,761 we must speak their language, they must speak ours. 186 00:08:55,761 --> 00:08:59,370 But making an effort to meet them in the middle 187 00:08:59,370 --> 00:09:02,880 will go a long way in order to make progress here. 188 00:09:02,880 --> 00:09:05,010 And third is just to get involved, 189 00:09:05,010 --> 00:09:07,410 and fortunately it's easier than ever to do so. 190 00:09:07,410 --> 00:09:10,920 You could walk over back there to the policy village 191 00:09:10,920 --> 00:09:14,970 where Beau's done a great job of putting this together, 192 00:09:14,970 --> 00:09:16,947 conversation after conversation 193 00:09:16,947 --> 00:09:20,190 on really important policy topics 194 00:09:20,190 --> 00:09:22,680 with top policy makers across the country. 195 00:09:22,680 --> 00:09:25,590 So I encourage everyone here to take a moment step in there, 196 00:09:25,590 --> 00:09:27,420 participate in some of those discussions 197 00:09:27,420 --> 00:09:30,690 and see how you can apply your expertise 198 00:09:30,690 --> 00:09:32,823 to help advance policy in our country. 199 00:09:34,590 --> 00:09:37,427 - All right, and before we go to the last, 200 00:09:37,427 --> 00:09:42,427 wanted to bring up Dark Tangent to give us some perspective, 201 00:09:42,660 --> 00:09:44,850 what his vision is for the policy department 202 00:09:44,850 --> 00:09:47,430 and some of the policy interactions 203 00:09:47,430 --> 00:09:50,523 at DEFCON over the past 30 years. So, Jeff. 204 00:09:53,340 --> 00:09:55,650 - I didn't expect this many people (crowd applause) 205 00:09:55,650 --> 00:09:57,123 to be interested in policy. 206 00:09:58,860 --> 00:10:02,823 Thanks for coming early on a chaotic day after a flood. 207 00:10:05,610 --> 00:10:07,320 So we want to just give you a little bit of an idea, 208 00:10:07,320 --> 00:10:09,840 I'm sure Beau's been orienting you. 209 00:10:09,840 --> 00:10:13,020 The big sort of picture is that DEFCON was doing policy 210 00:10:13,020 --> 00:10:15,720 without realizing we were doing policy. 211 00:10:15,720 --> 00:10:17,760 And we thought we should probably 212 00:10:17,760 --> 00:10:19,860 be a little more intentional about that. 213 00:10:19,860 --> 00:10:22,653 So it's sort of like that old saying that, 214 00:10:23,677 --> 00:10:27,000 "if you're not doing policy, it's being done to you." 215 00:10:27,000 --> 00:10:28,170 And we think it's important 216 00:10:28,170 --> 00:10:29,970 that we have a seat at the table. 217 00:10:29,970 --> 00:10:31,140 And if we're not at the table, 218 00:10:31,140 --> 00:10:35,370 we're gonna be skeptical of the outcomes of the policy. 219 00:10:35,370 --> 00:10:36,900 And over the years, 220 00:10:36,900 --> 00:10:39,780 a lot of informal interactions would happen between 221 00:10:39,780 --> 00:10:42,150 different policy makers, different governments, 222 00:10:42,150 --> 00:10:46,260 and them trying to get an idea of what is going on. 223 00:10:46,260 --> 00:10:50,430 And it turns out that our community's superpower 224 00:10:50,430 --> 00:10:53,520 is basically speaking truth to power, 225 00:10:53,520 --> 00:10:56,100 but also giving a more unbiased, 226 00:10:56,100 --> 00:10:58,743 sort of third party perspective. 227 00:10:59,790 --> 00:11:02,010 When you're here, you're not really working for your vendor, 228 00:11:02,010 --> 00:11:07,010 you don't have to have your day job vendor perspective. 229 00:11:08,070 --> 00:11:10,020 You can be a little bit more open. 230 00:11:10,020 --> 00:11:12,240 And that turns out to be in short supply 231 00:11:12,240 --> 00:11:15,780 for people in policy who generally get pitched information 232 00:11:15,780 --> 00:11:20,780 from trade groups and vendors and other private interests. 233 00:11:23,580 --> 00:11:26,100 And they need information to balance it out. 234 00:11:26,100 --> 00:11:28,680 They need another voice, civil society's voice, 235 00:11:28,680 --> 00:11:31,440 maybe not commercial America's voice, 236 00:11:31,440 --> 00:11:33,660 to give them another perspective. 237 00:11:33,660 --> 00:11:36,120 And so that's one of the things we're trying to do, right, 238 00:11:36,120 --> 00:11:40,563 is build a countervailing force to be considered. 239 00:11:42,930 --> 00:11:45,910 Over the years when we would interact with law enforcement 240 00:11:47,310 --> 00:11:50,430 and say, "no, no, this lock is very insecure," 241 00:11:50,430 --> 00:11:53,310 or "don't worry about this safe cracking thing, 242 00:11:53,310 --> 00:11:55,767 it's not feasible." 243 00:11:56,910 --> 00:11:57,937 You can see the relief. 244 00:11:57,937 --> 00:11:58,770 "Oh my gosh. 245 00:11:58,770 --> 00:12:00,450 Somebody told me what's really happening." 246 00:12:00,450 --> 00:12:02,610 The vendor would never tell me that. Okay, great. 247 00:12:02,610 --> 00:12:04,410 That's what I needed to know." 248 00:12:04,410 --> 00:12:05,910 And building those bridges, 249 00:12:05,910 --> 00:12:08,610 builds trust between our communities. 250 00:12:08,610 --> 00:12:11,070 And it's gotten to the point over the last five years 251 00:12:11,070 --> 00:12:13,920 since we started doing policy more intentionally, 252 00:12:13,920 --> 00:12:17,040 that its time to upscale it into these maiden stage talks 253 00:12:17,040 --> 00:12:18,990 that we've scheduled this year. 254 00:12:18,990 --> 00:12:20,430 It's time to have a real department 255 00:12:20,430 --> 00:12:23,520 that Beau took the lead of this year, 256 00:12:23,520 --> 00:12:26,880 built an incredible team of goons. 257 00:12:26,880 --> 00:12:29,220 And we're trying out a lot of new things this year. 258 00:12:29,220 --> 00:12:31,410 And so your feedback is gonna be very important 259 00:12:31,410 --> 00:12:34,950 for helping us correct and decide what we do next. 260 00:12:34,950 --> 00:12:37,200 And did you talk about the three tiers 261 00:12:37,200 --> 00:12:38,033 of what we're doing? 262 00:12:38,033 --> 00:12:38,880 - [Beau] No, not yet. 263 00:12:38,880 --> 00:12:40,530 - So we're trying three different tiers. 264 00:12:40,530 --> 00:12:43,740 Why try one thing when we can try three things? 265 00:12:43,740 --> 00:12:45,750 We're trying the main stage talks. 266 00:12:45,750 --> 00:12:49,110 We're trying the policy village, 267 00:12:49,110 --> 00:12:53,070 where we dive in deeper on specific topics. 268 00:12:53,070 --> 00:12:56,490 And this is where you can debate section 320 or DMCA 269 00:12:56,490 --> 00:13:00,840 or whatever it is with experts. 270 00:13:00,840 --> 00:13:03,030 And this is essentially a new track at DEFCON, 271 00:13:03,030 --> 00:13:04,170 it's like a policy track. 272 00:13:04,170 --> 00:13:05,370 And then in the evening, 273 00:13:05,370 --> 00:13:07,140 we want to facilitate, off the record, 274 00:13:07,140 --> 00:13:09,270 Chatham house rules conversations. 275 00:13:09,270 --> 00:13:11,550 So you can get a more honest assessment 276 00:13:11,550 --> 00:13:14,070 and not have to maybe do it so publicly. 277 00:13:14,070 --> 00:13:15,510 And that's our evening program 278 00:13:15,510 --> 00:13:18,513 and we have some evening lounges, much smaller. 279 00:13:19,830 --> 00:13:22,200 And last night we had our first, it was an invite, 280 00:13:22,200 --> 00:13:24,063 but we had our first policy dinner. 281 00:13:25,080 --> 00:13:27,990 And so we hope to grow all of these 282 00:13:27,990 --> 00:13:32,880 in an environment where we can interact, honestly. 283 00:13:32,880 --> 00:13:36,540 And if you think it's for you, we want you involved. 284 00:13:36,540 --> 00:13:37,830 And if you'd for somebody else, 285 00:13:37,830 --> 00:13:39,843 please point them our direction. 286 00:13:40,950 --> 00:13:41,940 We're gonna be learning a lot. 287 00:13:41,940 --> 00:13:44,880 And our goal is to grow the policy, 288 00:13:44,880 --> 00:13:47,490 just like the rest of the CON has grown. 289 00:13:47,490 --> 00:13:49,290 There were villages, the original villages, 290 00:13:49,290 --> 00:13:52,830 hardware hacking village and wifi village. 291 00:13:52,830 --> 00:13:54,360 The original villages have grown 292 00:13:54,360 --> 00:13:57,450 into over 30 something villages. 293 00:13:57,450 --> 00:14:02,450 We're hoping to take the policy department and turn it into, 294 00:14:02,737 --> 00:14:04,710 "there's a section over here 295 00:14:04,710 --> 00:14:05,850 talking about aviation security, 296 00:14:05,850 --> 00:14:09,330 there's a think tank Atlantic Council doing a cyber 912, 297 00:14:09,330 --> 00:14:12,600 there's an EFF talking about online privacy." 298 00:14:12,600 --> 00:14:16,590 We want to create that kind of environment. 299 00:14:16,590 --> 00:14:19,290 So it's not just our perspectives. 300 00:14:19,290 --> 00:14:24,290 We're bringing other groups in and you can participate. 301 00:14:24,300 --> 00:14:27,510 And so I think in the early days 302 00:14:27,510 --> 00:14:32,100 it was policy tourists coming in from DC, 303 00:14:32,100 --> 00:14:34,650 wanting to see the crazy hackers 304 00:14:34,650 --> 00:14:36,210 and kind of get a flavor of it. 305 00:14:36,210 --> 00:14:37,440 But there was no real chance 306 00:14:37,440 --> 00:14:39,570 to have a substantial interaction. 307 00:14:39,570 --> 00:14:43,710 And the hackers are like, "oh, look a policymaker, great." 308 00:14:43,710 --> 00:14:46,440 But there was no real way for them to interact either, 309 00:14:46,440 --> 00:14:48,420 but we survived those initial contacts 310 00:14:48,420 --> 00:14:49,980 without killing each other. 311 00:14:49,980 --> 00:14:52,500 And so it's time to go a little deeper. 312 00:14:52,500 --> 00:14:55,623 And that's what we're signifying by kicking this off. 313 00:14:56,550 --> 00:14:58,020 So with that said, 314 00:14:58,020 --> 00:15:00,914 I wanna pass it back over to Beau 315 00:15:00,914 --> 00:15:03,390 and we'll end up taking some of your questions. 316 00:15:03,390 --> 00:15:06,750 And we really hope that you check out some of the policy. 317 00:15:06,750 --> 00:15:11,750 And if you have ideas for workshops, hands-on, white papers, 318 00:15:11,850 --> 00:15:15,090 anything where we can show what our community can do, 319 00:15:15,090 --> 00:15:18,690 I guess that, let me leave one thought with you. 320 00:15:18,690 --> 00:15:20,550 The voting village, 321 00:15:20,550 --> 00:15:23,280 when I said we accidentally ended up doing policy, 322 00:15:23,280 --> 00:15:24,990 the voting village was really 323 00:15:24,990 --> 00:15:27,540 the best shining example of this. 324 00:15:27,540 --> 00:15:30,120 Again, no master strategy, 325 00:15:30,120 --> 00:15:35,120 but what happened was after 2015 and 2016, 326 00:15:35,610 --> 00:15:38,940 we decided to hack voting machines 327 00:15:38,940 --> 00:15:40,950 and they'd never been available. 328 00:15:40,950 --> 00:15:42,600 And nobody had hacked on them. 329 00:15:42,600 --> 00:15:47,600 And there had been a storm, much like last night, 330 00:15:47,640 --> 00:15:50,070 that caved in the roof of a warehouse 331 00:15:50,070 --> 00:15:53,220 that was holding voting equipment for our county. 332 00:15:53,220 --> 00:15:55,560 And it destroyed the voting equipment. It got wet. 333 00:15:55,560 --> 00:15:59,220 The insurance company wrote off the voting equipment, 334 00:15:59,220 --> 00:16:01,830 and the insurance company being green, 335 00:16:01,830 --> 00:16:03,870 shipped all the voting equipment, 'cause they owned it now, 336 00:16:03,870 --> 00:16:07,200 shipped it to a RE-PC recycler. 337 00:16:07,200 --> 00:16:09,510 Recycler got all these pallets of voting machines 338 00:16:09,510 --> 00:16:11,110 and started trying to sell them. 339 00:16:12,240 --> 00:16:15,540 And we found them on eBay and we're like, "oh my god," 340 00:16:15,540 --> 00:16:16,860 and we started buying them. 341 00:16:16,860 --> 00:16:21,097 The manufacturer caught on and contacted them and said, 342 00:16:21,097 --> 00:16:23,820 "great, we want our voting machines back." 343 00:16:23,820 --> 00:16:27,667 And the RE-PC place was like, "great, they're $200 each." 344 00:16:27,667 --> 00:16:29,130 "No, no we want them for free." 345 00:16:29,130 --> 00:16:31,260 You shouldn't have them. You didn't sign the contract." 346 00:16:31,260 --> 00:16:33,900 And he was like, "whatever, they're $200." 347 00:16:33,900 --> 00:16:35,940 They said, "okay, well you have to destroy them." 348 00:16:35,940 --> 00:16:40,050 He's like, "okay, well it's $200 an hour to destroy them." 349 00:16:40,050 --> 00:16:40,890 He's like, "well we don't wanna pay." 350 00:16:40,890 --> 00:16:43,380 And he's like, "okay, well they're for sale 200 bucks. 351 00:16:43,380 --> 00:16:44,760 How many pallets do you want?" 352 00:16:44,760 --> 00:16:47,340 And so we bought them, as many as we could. 353 00:16:47,340 --> 00:16:49,980 And we got our hands on these machines. 354 00:16:49,980 --> 00:16:51,990 And it just so happened the year before, 355 00:16:51,990 --> 00:16:55,530 the DMCA has an exemption that was added, 356 00:16:55,530 --> 00:16:57,030 had never been added before, 357 00:16:57,030 --> 00:17:00,030 for good faith security research. 358 00:17:00,030 --> 00:17:02,040 So had that storm not happened, 359 00:17:02,040 --> 00:17:04,470 had the library of Congress not put in 360 00:17:04,470 --> 00:17:07,350 a research exemption for critical infrastructure 361 00:17:07,350 --> 00:17:10,530 and specifically called out voting infrastructure, 362 00:17:10,530 --> 00:17:14,130 we would've not been able to hack those voting machines. 363 00:17:14,130 --> 00:17:15,690 Just crazy coincidence. 364 00:17:15,690 --> 00:17:19,770 We hacked the voting machines and in policy land, 365 00:17:19,770 --> 00:17:21,120 this was very controversial. 366 00:17:21,120 --> 00:17:23,190 There were some interest groups 367 00:17:23,190 --> 00:17:25,440 that were pro-voting machine reform, 368 00:17:25,440 --> 00:17:28,650 pro-transparency that did not want us 369 00:17:28,650 --> 00:17:30,120 to hack the voting machines. 370 00:17:30,120 --> 00:17:31,440 And they were trying to talk us out of it 371 00:17:31,440 --> 00:17:32,640 because their concern was, 372 00:17:32,640 --> 00:17:34,983 if we could not hack the voting machine, 373 00:17:36,030 --> 00:17:39,633 they could not argue that voting machines were unsafe. 374 00:17:41,040 --> 00:17:42,540 So it was for them, 375 00:17:42,540 --> 00:17:44,460 this litmus test, this existential threat. 376 00:17:44,460 --> 00:17:45,810 If the hackers did not succeed, 377 00:17:45,810 --> 00:17:49,230 their whole lobbying effort would go away. 378 00:17:49,230 --> 00:17:52,230 And we're like, "whatever we're hacking the machines." 379 00:17:52,230 --> 00:17:53,340 The first machine fell 380 00:17:53,340 --> 00:17:56,850 in like three minutes, (Jack laughing) and then 90 minutes. 381 00:17:56,850 --> 00:17:58,890 And I mean everything got taken over 382 00:17:58,890 --> 00:18:01,290 and I'm telling you that group within minutes, 383 00:18:01,290 --> 00:18:02,940 went from hiding in the back of the room 384 00:18:02,940 --> 00:18:05,340 to jumping in front of the TV cameras. 385 00:18:05,340 --> 00:18:08,103 Right, now the whole point of existence was validated. 386 00:18:08,970 --> 00:18:13,110 We got more done in hacking village to advance awareness 387 00:18:13,110 --> 00:18:17,313 in that one weekend than their organization had in 15 years. 388 00:18:18,810 --> 00:18:21,240 Once people see it and can touch it, 389 00:18:21,240 --> 00:18:23,820 it's like touching a hot plate. 390 00:18:23,820 --> 00:18:25,560 You know it's hot, your mom told you it's hot, 391 00:18:25,560 --> 00:18:28,260 but until you touch it and burn your finger, doesn't count. 392 00:18:28,260 --> 00:18:29,820 And what we're trying to figure out is, 393 00:18:29,820 --> 00:18:32,100 how many other hot plates can we set up 394 00:18:32,100 --> 00:18:35,190 for people to touch so they can learn things very quickly, 395 00:18:35,190 --> 00:18:36,660 and we don't have to wait 15 years 396 00:18:36,660 --> 00:18:37,560 for people to believe them 397 00:18:37,560 --> 00:18:40,003 that maybe a voting machine's not safe. 398 00:18:40,003 --> 00:18:42,990 We released a report for the voting village. 399 00:18:42,990 --> 00:18:44,610 That ended up influencing a lot 400 00:18:44,610 --> 00:18:47,580 of different elections in counties. 401 00:18:47,580 --> 00:18:50,130 I think Virginia was probably the most famous for us 402 00:18:50,130 --> 00:18:51,480 because they referenced our report 403 00:18:51,480 --> 00:18:53,520 when they changed back to paper marking devices, 404 00:18:53,520 --> 00:18:55,590 paper ballot marking devices. 405 00:18:55,590 --> 00:18:57,120 And that's our shining example 406 00:18:57,120 --> 00:18:58,980 of what we want to try to accomplish. 407 00:18:58,980 --> 00:19:00,720 It's not always gonna happen, 408 00:19:00,720 --> 00:19:02,310 but I think that's the power 409 00:19:02,310 --> 00:19:05,910 of combining the two communities, is that kind of change. 410 00:19:05,910 --> 00:19:08,910 And then being a positive example for other conferences 411 00:19:08,910 --> 00:19:10,890 to copy what we're doing, 412 00:19:10,890 --> 00:19:14,310 and really foster this relationship around the world. 413 00:19:14,310 --> 00:19:16,923 So, okay sorry, I got sidetracked. 414 00:19:18,540 --> 00:19:20,580 Take it away, Beau. 415 00:19:20,580 --> 00:19:21,730 - All right, thank you. 416 00:19:22,712 --> 00:19:25,629 (crowd applauding) 417 00:19:28,740 --> 00:19:29,573 Thank you, Jeff. 418 00:19:32,430 --> 00:19:36,150 All right, so we'll go to our third and last person 419 00:19:36,150 --> 00:19:37,530 over there on the right 420 00:19:37,530 --> 00:19:39,960 to give their historical perspective. 421 00:19:39,960 --> 00:19:42,860 - I'll try to be quick 'cause Jeff took up a lot of time. 422 00:19:42,860 --> 00:19:43,693 (everyone laughing) 423 00:19:43,693 --> 00:19:46,577 I'm Space Rogue, and some of you know me. 424 00:19:46,577 --> 00:19:50,130 It was like 25 years ago, I guess in 1998, 425 00:19:50,130 --> 00:19:53,370 I was with a group called L0pht Heavy Industries, 426 00:19:53,370 --> 00:19:55,200 group of hackers outta Boston. 427 00:19:55,200 --> 00:19:59,700 And we somehow ended up in front of what is now 428 00:19:59,700 --> 00:20:02,970 the Homeland Security Committee in Washington, DC, 429 00:20:02,970 --> 00:20:05,220 testifying on weak computer security in government. 430 00:20:05,220 --> 00:20:06,470 - [Attendee] Space Rogue! 431 00:20:07,710 --> 00:20:08,543 - There he is. 432 00:20:09,990 --> 00:20:13,380 So that was, I mean, up until that point, 433 00:20:13,380 --> 00:20:17,130 really the only policy that had happened was like CFAA 434 00:20:17,130 --> 00:20:18,750 and some other laws that had been passed. 435 00:20:18,750 --> 00:20:21,120 And if you go back and you read the original CFAA, 436 00:20:21,120 --> 00:20:22,410 you can tell the people who wrote it, 437 00:20:22,410 --> 00:20:24,300 did it basically in a vacuum. 438 00:20:24,300 --> 00:20:26,880 They had no concept of what was real 439 00:20:26,880 --> 00:20:29,180 and what was really gonna make any difference. 440 00:20:30,014 --> 00:20:32,430 That law has been amended several times since then, 441 00:20:32,430 --> 00:20:33,780 thank goodness, it still needs work. 442 00:20:33,780 --> 00:20:37,170 But anyway, so we went to Congress and we testified 443 00:20:37,170 --> 00:20:38,370 and we basically told them their pants 444 00:20:38,370 --> 00:20:40,530 were down around on their ankles and the internet was weak 445 00:20:40,530 --> 00:20:42,610 and everything was open 446 00:20:43,813 --> 00:20:46,170 and peoples' eyes just opened up really wide, 447 00:20:46,170 --> 00:20:47,320 like, "oh my goodness." 448 00:20:48,300 --> 00:20:50,040 But not a lot changed after that. 449 00:20:50,040 --> 00:20:53,673 That was really my first foray into policy. 450 00:20:55,050 --> 00:20:56,670 Over the years, since then, 451 00:20:56,670 --> 00:20:59,070 I've been involved at various companies 452 00:20:59,070 --> 00:21:01,020 where we would do briefings on the Hill 453 00:21:02,521 --> 00:21:05,460 and talk to lawmakers in DC. 454 00:21:05,460 --> 00:21:06,570 And Beau was very instrumental 455 00:21:06,570 --> 00:21:08,430 in doing his "Hackers on the Hill," 456 00:21:08,430 --> 00:21:10,590 where we would get a bunch of hackers together 457 00:21:10,590 --> 00:21:14,220 and go visit representatives and their staff 458 00:21:14,220 --> 00:21:16,260 and senators and their staff, 459 00:21:16,260 --> 00:21:20,460 and try to discuss issues of the day 460 00:21:20,460 --> 00:21:23,670 and try to bring their knowledge level up. 461 00:21:23,670 --> 00:21:26,220 Not so much as to actually write policy, 462 00:21:26,220 --> 00:21:27,390 but so that when they do 463 00:21:27,390 --> 00:21:30,210 go to write their policies and pass their laws, 464 00:21:30,210 --> 00:21:33,150 that they do so with a little bit more knowledge. 465 00:21:33,150 --> 00:21:38,150 I wanna paraphrase something that DT said over at Black Hat, 466 00:21:39,480 --> 00:21:43,290 that we have struggled for a long time 467 00:21:43,290 --> 00:21:45,273 as a community, as a group, 468 00:21:48,001 --> 00:21:50,279 as people who are trying to make the world safer, 469 00:21:50,279 --> 00:21:52,857 and make the world a better place and trying to do that. 470 00:21:52,857 --> 00:21:55,893 And we've started out trying to educate the user. 471 00:21:56,880 --> 00:21:58,580 And say, "hey, don't click stuff," 472 00:22:00,829 --> 00:22:02,160 or "be wary of this email." 473 00:22:02,160 --> 00:22:04,740 And that has had limited success. 474 00:22:04,740 --> 00:22:07,890 It really hasn't gone very far. Its made some progress. 475 00:22:07,890 --> 00:22:09,630 And so we sort of changed our focus 476 00:22:09,630 --> 00:22:10,767 and we went over to companies. 477 00:22:10,767 --> 00:22:13,530 And we said, "hey, you need to secure your stuff. 478 00:22:13,530 --> 00:22:15,870 You need to work on this or that." 479 00:22:15,870 --> 00:22:17,580 And by proxy with companies, 480 00:22:17,580 --> 00:22:19,290 we also relied on insurance companies. 481 00:22:19,290 --> 00:22:21,090 We're like, "oh insurance companies gonna have to pay out 482 00:22:21,090 --> 00:22:21,923 when there's a breach, 483 00:22:21,923 --> 00:22:23,850 so they're gonna force companies to be secure." 484 00:22:23,850 --> 00:22:26,850 And it hasn't really worked out the way we'd hoped either. 485 00:22:26,850 --> 00:22:29,340 Its made some progress again, like educating the user. 486 00:22:29,340 --> 00:22:31,350 And then the third thing we've been relying on 487 00:22:31,350 --> 00:22:33,603 is legislation or regulation. 488 00:22:34,710 --> 00:22:36,450 Not necessarily laws, 489 00:22:36,450 --> 00:22:40,800 but self-regulation industry groups coming together, 490 00:22:40,800 --> 00:22:42,540 and we've met with limited success with that. 491 00:22:42,540 --> 00:22:45,090 So we sort of have a three-pronged area 492 00:22:45,090 --> 00:22:48,150 that we need to focus on to get security to a point 493 00:22:48,150 --> 00:22:51,630 where the user is safe, educate the user, 494 00:22:51,630 --> 00:22:54,720 push companies and insurance companies and the policy. 495 00:22:54,720 --> 00:22:55,920 Which is why we're here now. 496 00:22:55,920 --> 00:22:58,680 Its to try to focus on policy, advance the narrative, 497 00:22:58,680 --> 00:23:00,960 educate the people who are writing the policies 498 00:23:00,960 --> 00:23:03,183 and get to a point where things are safe. 499 00:23:04,830 --> 00:23:07,860 Beau? - Cool. Thank you. 500 00:23:07,860 --> 00:23:11,040 So obviously Jeff talked about 501 00:23:11,040 --> 00:23:13,650 his vision for the policy department 502 00:23:13,650 --> 00:23:16,980 and a little bit of the nuance that went into forming it, 503 00:23:16,980 --> 00:23:21,210 but DEFCON has a long history of doing public policy 504 00:23:21,210 --> 00:23:24,180 even before the voting village. 505 00:23:24,180 --> 00:23:25,950 And that was a really good story that you told 506 00:23:25,950 --> 00:23:29,613 about how you accidentally changed things in Washington. 507 00:23:30,780 --> 00:23:32,610 But even at DEFCON one, 508 00:23:32,610 --> 00:23:34,860 there were policy conversations that were going on. 509 00:23:34,860 --> 00:23:37,041 There were legal conversations that were going on. 510 00:23:37,041 --> 00:23:38,247 There were a lot of these same conversations 511 00:23:38,247 --> 00:23:41,130 and I think we kind of tend to forget 512 00:23:41,130 --> 00:23:45,510 that public policy is just a way to change the world. 513 00:23:45,510 --> 00:23:48,360 And a lot of hackers really want to change the world. 514 00:23:48,360 --> 00:23:51,120 I won't say "Hack the Planet" just for Space Rogue, 515 00:23:51,120 --> 00:23:52,349 but "Hack the Planet." 516 00:23:52,349 --> 00:23:55,951 - [Space Rogue] I really hate that. (chuckling) 517 00:23:55,951 --> 00:23:58,830 - And there's been a lot of other things. 518 00:23:58,830 --> 00:24:01,830 How many people remember when they were members of Congress 519 00:24:01,830 --> 00:24:03,123 who came out to DEFCON? 520 00:24:04,230 --> 00:24:07,200 Yeah, so we've had many, many members of Congress 521 00:24:07,200 --> 00:24:10,560 come out to DEFCON and give talks, 522 00:24:10,560 --> 00:24:13,680 give sessions over in the crypto and privacy village 523 00:24:13,680 --> 00:24:17,520 or here on the main stage. 524 00:24:17,520 --> 00:24:18,480 I think there have been 525 00:24:18,480 --> 00:24:21,600 five members of Congress now who have done that. 526 00:24:21,600 --> 00:24:22,713 It's kind of epic. 527 00:24:24,150 --> 00:24:29,150 We've also had high ranking members of the government, 528 00:24:29,190 --> 00:24:30,723 the executive branch come in. 529 00:24:31,860 --> 00:24:36,030 And today on this same stage, the National Cyber Director, 530 00:24:36,030 --> 00:24:38,220 Chris Inglis is gonna be here. 531 00:24:38,220 --> 00:24:40,320 And in case you don't know, 532 00:24:40,320 --> 00:24:43,420 the National Cyber Director's office was stood up 533 00:24:44,400 --> 00:24:47,280 through a congressional act, 534 00:24:47,280 --> 00:24:50,490 fueled by a report that a lot of hackers contributed to. 535 00:24:50,490 --> 00:24:52,490 And a lot of people who are in this room 536 00:24:53,490 --> 00:24:56,310 helped advise and build that up. 537 00:24:56,310 --> 00:24:58,860 We're also gonna have Director Jen Easterly from CISA 538 00:24:58,860 --> 00:25:00,870 here on the stage. 539 00:25:00,870 --> 00:25:03,930 She will also be talking about 540 00:25:03,930 --> 00:25:06,660 getting more hackers involved in public policy. 541 00:25:06,660 --> 00:25:09,630 So I think it's kind of in our DNA at this point at DEFCON. 542 00:25:09,630 --> 00:25:10,920 And so it only seems right 543 00:25:10,920 --> 00:25:15,920 that we should have an outward, more visible, 544 00:25:16,230 --> 00:25:19,263 more overt and planned response to it. 545 00:25:21,270 --> 00:25:23,700 But it's not just about me. 546 00:25:23,700 --> 00:25:26,400 It's not just about the folks on the stage now, 547 00:25:26,400 --> 00:25:28,050 but we've got a really, really, 548 00:25:28,050 --> 00:25:31,200 really talented policy department team. 549 00:25:31,200 --> 00:25:33,930 And I wanted to bring some of them up now 550 00:25:33,930 --> 00:25:36,720 to talk about some of their experiences, 551 00:25:36,720 --> 00:25:39,210 what got them into public policy, 552 00:25:39,210 --> 00:25:41,190 why they think you're gonna get something out 553 00:25:41,190 --> 00:25:45,570 of these sessions and hopefully inspire you to come out 554 00:25:45,570 --> 00:25:47,790 and participate in some of the public policy discussions 555 00:25:47,790 --> 00:25:52,790 that we're having, which is over in rooms 224 through 226, 556 00:25:54,630 --> 00:25:56,970 the policy department on your map. 557 00:25:56,970 --> 00:26:01,830 So I'd like to introduce some of the amazing policy team. 558 00:26:01,830 --> 00:26:03,930 There are many others in the policy team 559 00:26:03,930 --> 00:26:07,050 who are holding down the fort over at the policy department 560 00:26:07,050 --> 00:26:09,093 or waiting for their shifts to start. 561 00:26:10,080 --> 00:26:11,610 And so I want to give each of these folks 562 00:26:11,610 --> 00:26:14,010 a couple of minutes to introduce themselves 563 00:26:14,010 --> 00:26:16,050 and give you some perspective 564 00:26:16,050 --> 00:26:18,600 and then we'll have a few minutes to take questions. 565 00:26:18,600 --> 00:26:21,191 So Jenny, do you wanna come up? 566 00:26:21,191 --> 00:26:22,441 - [Jenny] Sure. 567 00:26:29,820 --> 00:26:31,803 - Hi y'all. I'm Mosfet. 568 00:26:32,878 --> 00:26:36,180 I've been coming to DEFCON for just over a decade, 569 00:26:36,180 --> 00:26:38,190 for as long as I've been a hacker. 570 00:26:38,190 --> 00:26:41,280 I was a hardware hacker, I was a packet hacker, 571 00:26:41,280 --> 00:26:42,933 and now I'm a policy hacker. 572 00:26:44,040 --> 00:26:46,410 A few years ago in pre-pandemic times, 573 00:26:46,410 --> 00:26:49,050 I had the opportunity to jump into the deep end 574 00:26:49,050 --> 00:26:54,050 of policy making not knowing anything about cyber policy. 575 00:26:54,150 --> 00:26:58,080 I earned a spot in a fellowship called TechCongress, 576 00:26:58,080 --> 00:27:02,760 uprooted my life, quit my day job, and moved to DC. 577 00:27:02,760 --> 00:27:07,760 After a two week crash course, I went to work for Congress. 578 00:27:08,700 --> 00:27:12,900 On day one, my hacker friends informed me, 579 00:27:12,900 --> 00:27:14,550 to my existential dread, 580 00:27:14,550 --> 00:27:15,843 that I was now a fed. 581 00:27:18,240 --> 00:27:21,000 But it didn't take long, I was hooked. 582 00:27:21,000 --> 00:27:24,150 Public policy, the laws, and the regulations 583 00:27:24,150 --> 00:27:26,730 that governments all over the world were making, 584 00:27:26,730 --> 00:27:31,020 played such a big role in my hacker job and in my life, 585 00:27:31,020 --> 00:27:33,180 and I had no idea. 586 00:27:33,180 --> 00:27:37,350 So DEFCON policy for me is here. So you don't have to be me. 587 00:27:37,350 --> 00:27:38,880 You don't have to jump in the deep end. 588 00:27:38,880 --> 00:27:40,770 You don't have to quit your day job. 589 00:27:40,770 --> 00:27:42,840 You can come to our talks and come to our village 590 00:27:42,840 --> 00:27:45,060 and interface with those policy makers 591 00:27:45,060 --> 00:27:47,970 and learn a little more about how public policy 592 00:27:47,970 --> 00:27:50,670 might be affecting your job and how you can change it 593 00:27:50,670 --> 00:27:52,980 and how you can influence it. 594 00:27:52,980 --> 00:27:54,900 We can help you make those discussions 595 00:27:54,900 --> 00:27:56,580 and get in the conversation. 596 00:27:56,580 --> 00:27:59,700 And if you wanna quit your day job and come to Congress, 597 00:27:59,700 --> 00:28:02,780 we can talk too. (chuckling) 598 00:28:02,780 --> 00:28:03,613 - Thank you. - Thanks. 599 00:28:04,641 --> 00:28:07,558 (crowd applauding) 600 00:28:08,820 --> 00:28:10,560 Hello everyone. 601 00:28:10,560 --> 00:28:13,563 My mask is stuck on my earring. My name is Sarah Powazek. 602 00:28:13,563 --> 00:28:17,040 It's really nice to meet you all and I wanna say 603 00:28:17,040 --> 00:28:21,450 that we absolutely cannot make good policy without you all. 604 00:28:21,450 --> 00:28:23,160 In fact, good, impactful, 605 00:28:23,160 --> 00:28:26,460 thoughtful policy about cybersecurity is only possible, 606 00:28:26,460 --> 00:28:28,200 if we have the folks who are actually doing 607 00:28:28,200 --> 00:28:31,800 the day-to-day work integrally involved in that process. 608 00:28:31,800 --> 00:28:34,230 And that is why it is so, so important 609 00:28:34,230 --> 00:28:36,570 that you all are here, interested in policy, 610 00:28:36,570 --> 00:28:38,610 coming to our talks. 611 00:28:38,610 --> 00:28:40,080 I got my start in policy 612 00:28:40,080 --> 00:28:42,930 helping a group of cyber practitioners put together 613 00:28:42,930 --> 00:28:46,530 recommendations on how to combat ransomware as a nation. 614 00:28:46,530 --> 00:28:50,610 And I think that having a group of practitioners there 615 00:28:50,610 --> 00:28:53,550 made an incredible difference in the sorts of proposals 616 00:28:53,550 --> 00:28:55,680 that we actually ended up putting out. 617 00:28:55,680 --> 00:28:58,320 We had a whole section of the report that we put out 618 00:28:58,320 --> 00:29:01,230 that was only focused on helping organizations 619 00:29:01,230 --> 00:29:04,950 improve their cybersecurity maturity, giving them funding, 620 00:29:04,950 --> 00:29:06,570 creating funds to help them 621 00:29:06,570 --> 00:29:08,880 with response if they're attacked. 622 00:29:08,880 --> 00:29:12,660 And I think that that victim centric viewpoint 623 00:29:12,660 --> 00:29:14,670 is something unique to the hacker community, 624 00:29:14,670 --> 00:29:17,970 that spends day in day out actually helping folks 625 00:29:17,970 --> 00:29:21,240 recover and defend themselves against these attackers. 626 00:29:21,240 --> 00:29:23,700 And that was having those folks in the room, 627 00:29:23,700 --> 00:29:26,280 absolutely change the course of the sorts of proposals 628 00:29:26,280 --> 00:29:27,360 that we put out. 629 00:29:27,360 --> 00:29:32,360 Folks also strayed away from recommending punitive measures. 630 00:29:32,550 --> 00:29:35,370 We were much more focused on attacking 631 00:29:35,370 --> 00:29:37,290 the threat actors through sanctions, 632 00:29:37,290 --> 00:29:39,690 attacking cryptocurrency launderers, 633 00:29:39,690 --> 00:29:42,240 and focusing on positive incentives 634 00:29:42,240 --> 00:29:44,790 for organizations and for individuals, 635 00:29:44,790 --> 00:29:47,880 tying funding to improving cybersecurity maturity. 636 00:29:47,880 --> 00:29:50,370 And absolutely all of that is due to the fact 637 00:29:50,370 --> 00:29:51,900 that we had folks who were on the ground 638 00:29:51,900 --> 00:29:53,347 coming into these discussions and saying, 639 00:29:53,347 --> 00:29:56,070 "no, we need to make sure that people have the resources, 640 00:29:56,070 --> 00:29:59,520 that they need, the education that they need." 641 00:29:59,520 --> 00:30:01,950 And that's the sort of voice that you folks 642 00:30:01,950 --> 00:30:03,060 bring to public policy. 643 00:30:03,060 --> 00:30:05,250 It is absolutely crucial. 644 00:30:05,250 --> 00:30:08,550 We have a bunch of big problems coming up. 645 00:30:08,550 --> 00:30:09,750 Ransomware is one of them, 646 00:30:09,750 --> 00:30:13,560 protecting critical infrastructure, securing our elections. 647 00:30:13,560 --> 00:30:14,393 And I would say that 648 00:30:14,393 --> 00:30:17,400 there isn't a right policy solution for those problems, 649 00:30:17,400 --> 00:30:19,500 but there's absolutely a right process 650 00:30:19,500 --> 00:30:21,090 to create that policy. 651 00:30:21,090 --> 00:30:23,940 And that process is one where you are all at the table. 652 00:30:23,940 --> 00:30:25,350 So I really hope you'll join us 653 00:30:25,350 --> 00:30:27,930 at the public policy talks in the policy village 654 00:30:27,930 --> 00:30:29,100 and in track two today. 655 00:30:29,100 --> 00:30:30,120 Again, Sarah Powazek, 656 00:30:30,120 --> 00:30:31,260 it's really nice to meet you all 657 00:30:31,260 --> 00:30:33,250 and I'll give it up for Harley. 658 00:30:33,250 --> 00:30:36,167 (crowd applauding) 659 00:30:39,900 --> 00:30:42,870 - Hi everybody. I hope that you're having a great time. 660 00:30:42,870 --> 00:30:44,670 Thanks very much for coming. 661 00:30:44,670 --> 00:30:49,440 So my name is Harley and I am a cybersecurity attorney. 662 00:30:49,440 --> 00:30:51,540 I've been working in cybersecurity law 663 00:30:51,540 --> 00:30:53,610 and technology policy for several years. 664 00:30:53,610 --> 00:30:55,110 I'm a former congressional staffer 665 00:30:55,110 --> 00:30:57,570 and now I'm the Senior Public Policy Director 666 00:30:57,570 --> 00:31:00,210 at a cybersecurity company called Rapid7. 667 00:31:00,210 --> 00:31:03,840 I wanted to get into policy because I wanted to help people. 668 00:31:03,840 --> 00:31:07,560 I wanted to protect consumers and advance human rights. 669 00:31:07,560 --> 00:31:10,770 And cybersecurity is consumer protection. 670 00:31:10,770 --> 00:31:13,500 Hacker rights are human rights. 671 00:31:13,500 --> 00:31:15,690 What the security community does 672 00:31:15,690 --> 00:31:19,080 in finding vulnerabilities that can then be fixed, 673 00:31:19,080 --> 00:31:20,820 protects everybody in society 674 00:31:20,820 --> 00:31:22,800 and especially the most vulnerable among us, right? 675 00:31:22,800 --> 00:31:26,730 To consumers, vulnerable populations, dissidents, users, 676 00:31:26,730 --> 00:31:29,790 including enterprises and everybody else, 677 00:31:29,790 --> 00:31:31,110 it's really important. 678 00:31:31,110 --> 00:31:34,350 And its never really been a better time 679 00:31:34,350 --> 00:31:37,950 to be a hacker interested in policy than right now. 680 00:31:37,950 --> 00:31:40,650 The barriers to getting your input to government 681 00:31:40,650 --> 00:31:42,750 have arguably never been lower. 682 00:31:42,750 --> 00:31:44,760 And I'll just give you an example. 683 00:31:44,760 --> 00:31:47,340 Just yesterday, the Federal Trade Commission put out 684 00:31:47,340 --> 00:31:50,280 a call for public comments on privacy, 685 00:31:50,280 --> 00:31:52,680 data security, and commercial surveillance. 686 00:31:52,680 --> 00:31:55,470 They would love to hear from a community like this 687 00:31:55,470 --> 00:31:57,990 that has an outside DC perspective, 688 00:31:57,990 --> 00:31:59,970 and a lot of technical savvy. 689 00:31:59,970 --> 00:32:02,400 Government really does want to hear what you are saying. 690 00:32:02,400 --> 00:32:05,010 And there's lots of activity like this 691 00:32:05,010 --> 00:32:07,110 on cybersecurity policy happening 692 00:32:07,110 --> 00:32:08,190 within government right now. 693 00:32:08,190 --> 00:32:09,690 They get that it's a problem 694 00:32:09,690 --> 00:32:11,280 and they're trying to figure out how to fix it 695 00:32:11,280 --> 00:32:13,320 and they need your input. 696 00:32:13,320 --> 00:32:17,190 And I know that this community has a lot of valuable input 697 00:32:17,190 --> 00:32:18,750 that they can provide to governments. 698 00:32:18,750 --> 00:32:23,190 I think though that often, what becomes a challenge is, 699 00:32:23,190 --> 00:32:25,500 understanding where to comment, 700 00:32:25,500 --> 00:32:27,060 to whom should the comments be sent, 701 00:32:27,060 --> 00:32:28,500 how it'd have the most impact, 702 00:32:28,500 --> 00:32:30,480 what sort of format and that kind of thing. 703 00:32:30,480 --> 00:32:33,150 And that is part of what DEFCON policy 704 00:32:33,150 --> 00:32:35,490 is here to help solve. 705 00:32:35,490 --> 00:32:37,207 So to help build that connective tissue 706 00:32:37,207 --> 00:32:40,530 by bringing in policy makers to the hacker community, 707 00:32:40,530 --> 00:32:42,480 bringing hackers to policy makers, 708 00:32:42,480 --> 00:32:45,240 and identifying those venues for collaboration. 709 00:32:45,240 --> 00:32:48,270 So that policy going forward has your input 710 00:32:48,270 --> 00:32:51,541 and it makes us all more secure. Thank you all very much. 711 00:32:51,541 --> 00:32:54,458 (crowd applauding) 712 00:32:57,300 --> 00:32:58,620 - Good morning, everybody. 713 00:32:58,620 --> 00:33:00,090 My name is Will Loomis, 714 00:33:00,090 --> 00:33:03,030 and I am the Associate Director of the Cyber Policy Program 715 00:33:03,030 --> 00:33:05,850 at a DC think tank called the Atlantic Council. 716 00:33:05,850 --> 00:33:07,590 I've been working on cyber policy issues 717 00:33:07,590 --> 00:33:09,117 for about five years now. 718 00:33:09,117 --> 00:33:10,380 And one thing that I've seen 719 00:33:10,380 --> 00:33:12,600 over the course of the last two or three years 720 00:33:12,600 --> 00:33:14,640 is a serious increase in momentum 721 00:33:14,640 --> 00:33:17,310 when it comes to policy making around InfoSec 722 00:33:17,310 --> 00:33:19,290 and cybersecurity issues. 723 00:33:19,290 --> 00:33:21,780 I think we've seen a couple of really high profile incidents 724 00:33:21,780 --> 00:33:22,920 in the last couple years. 725 00:33:22,920 --> 00:33:26,460 Stuff like Solar Winds, Colonial Pipeline and Log4J, 726 00:33:26,460 --> 00:33:27,330 that have really functioned 727 00:33:27,330 --> 00:33:30,030 as the proverbial kick in the ass needed 728 00:33:30,030 --> 00:33:33,900 to get kind of action going within government here. 729 00:33:33,900 --> 00:33:36,870 And right now these folks within government 730 00:33:36,870 --> 00:33:39,480 are writing the legislation and the policy 731 00:33:39,480 --> 00:33:41,970 around InfoSec and cybersecurity issues 732 00:33:41,970 --> 00:33:44,010 that will really kind of manage the way 733 00:33:44,010 --> 00:33:45,540 that we deal with these issues over the course 734 00:33:45,540 --> 00:33:46,770 of the next decade. 735 00:33:46,770 --> 00:33:48,450 And I really, really, really, 736 00:33:48,450 --> 00:33:50,520 really strongly believe that hackers need 737 00:33:50,520 --> 00:33:52,560 to be a part of that conversation. 738 00:33:52,560 --> 00:33:54,120 And that's really why I got involved 739 00:33:54,120 --> 00:33:56,880 with DEFCON policy this year. 740 00:33:56,880 --> 00:33:57,810 So just quickly, 741 00:33:57,810 --> 00:33:58,890 I think DEFCON policy 742 00:33:58,890 --> 00:34:02,130 is really trying to do three main things, at least to me. 743 00:34:02,130 --> 00:34:04,500 The first is lowering barriers to entry 744 00:34:04,500 --> 00:34:05,760 to these types of government folks 745 00:34:05,760 --> 00:34:08,970 and making it easier to have these conversations. 746 00:34:08,970 --> 00:34:12,027 The second is really working to translate both, 747 00:34:12,027 --> 00:34:15,630 to make sure that hackers can understand policy makers 748 00:34:15,630 --> 00:34:17,340 and vice versa. 749 00:34:17,340 --> 00:34:18,720 And the third is just making sure 750 00:34:18,720 --> 00:34:21,270 that we're establishing meaningful connections 751 00:34:21,270 --> 00:34:23,490 and building communities around these issues. 752 00:34:23,490 --> 00:34:25,470 These can't be one off conversations. 753 00:34:25,470 --> 00:34:27,780 They need to be sustained to make sure 754 00:34:27,780 --> 00:34:29,400 that we're making the right types of changes 755 00:34:29,400 --> 00:34:31,110 in conversations here. 756 00:34:31,110 --> 00:34:33,180 So we have a lot of really good content 757 00:34:33,180 --> 00:34:36,780 going over the next three days at the DEFCON policy village. 758 00:34:36,780 --> 00:34:38,580 Some talks that are focused more on 759 00:34:38,580 --> 00:34:40,440 specific substantive issues like 760 00:34:40,440 --> 00:34:42,630 open source software supply chain security 761 00:34:42,630 --> 00:34:45,000 and others that are kind of more focused on 762 00:34:45,000 --> 00:34:46,920 that building relationships bit. 763 00:34:46,920 --> 00:34:48,907 Like the "Meet ONCD" and 764 00:34:48,907 --> 00:34:52,110 "Meet Cybersecurity and Infrastructure Security Agency" 765 00:34:52,110 --> 00:34:54,900 sessions that Beau was talking a little bit about earlier. 766 00:34:54,900 --> 00:34:57,000 So I really encourage you all to stop by 767 00:34:57,000 --> 00:34:58,350 over the course of the next three days, 768 00:34:58,350 --> 00:34:59,640 we got a lot of really good programming 769 00:34:59,640 --> 00:35:00,690 that we're really excited about 770 00:35:00,690 --> 00:35:03,633 and hope you guys enjoy it too. Thanks y'all. 771 00:35:03,633 --> 00:35:07,380 (crowd applauding) 772 00:35:07,380 --> 00:35:10,860 - Thanks Will. Hi, I am Doug Duck. 773 00:35:10,860 --> 00:35:12,660 My voice hopefully will come back by the end of CON 774 00:35:12,660 --> 00:35:14,940 if I don't shout and make a whole too much. 775 00:35:14,940 --> 00:35:17,850 I have a bunch of stuff I wrote down here. 776 00:35:17,850 --> 00:35:19,830 I think a lot of it's been covered, 777 00:35:19,830 --> 00:35:21,060 but really what I'm here to do 778 00:35:21,060 --> 00:35:23,820 is to call out to the hacker family here. 779 00:35:23,820 --> 00:35:25,350 I know many of you, 780 00:35:25,350 --> 00:35:28,020 most of you perhaps want to make a difference, 781 00:35:28,020 --> 00:35:29,670 like we were saying. 782 00:35:29,670 --> 00:35:30,690 You wanna make the world better. 783 00:35:30,690 --> 00:35:33,360 You wanna make it safer, make it more secure. 784 00:35:33,360 --> 00:35:38,360 And if you don't engage with the right aspects of security, 785 00:35:38,520 --> 00:35:39,660 you're not gonna get security. 786 00:35:39,660 --> 00:35:41,160 If you're in a corporation, 787 00:35:41,160 --> 00:35:43,290 you talk about securing the systems. 788 00:35:43,290 --> 00:35:44,610 And I think we all know at this point 789 00:35:44,610 --> 00:35:45,810 that it's also the human factor, 790 00:35:45,810 --> 00:35:47,820 it's also security awareness. 791 00:35:47,820 --> 00:35:49,320 When it comes to policy, 792 00:35:49,320 --> 00:35:52,398 when it comes to the statutory restrictions, 793 00:35:52,398 --> 00:35:56,490 and the legislation, the regulatory environment, 794 00:35:56,490 --> 00:35:59,430 that has gotten more and more complex 795 00:35:59,430 --> 00:36:02,580 and more burdensome over the last three decades. 796 00:36:02,580 --> 00:36:05,970 And I've been involved in it longer than that. 797 00:36:05,970 --> 00:36:10,970 And I am concerned that if you don't engage 798 00:36:11,520 --> 00:36:13,080 and we don't engage, 799 00:36:13,080 --> 00:36:15,480 then you're not gonna get what you want out of it. 800 00:36:15,480 --> 00:36:17,907 Not because the folks involved in that 801 00:36:17,907 --> 00:36:19,473 are not well intentioned, 802 00:36:20,340 --> 00:36:24,630 but because they need to hear additional perspectives. 803 00:36:24,630 --> 00:36:27,990 And we have a lot of potential 804 00:36:27,990 --> 00:36:31,080 to make huge, huge, positive impact. 805 00:36:31,080 --> 00:36:35,760 We also have a lot of potential with some of those burdens 806 00:36:35,760 --> 00:36:40,680 that are imposed on companies, on people, on communities. 807 00:36:40,680 --> 00:36:43,110 We have a lot of potential to make things worse, 808 00:36:43,110 --> 00:36:47,070 and we wanna make sure that we are articulating 809 00:36:47,070 --> 00:36:49,140 the right approaches that are gonna allow 810 00:36:49,140 --> 00:36:51,120 for a risk based solution, 811 00:36:51,120 --> 00:36:53,250 that are gonna allow for nimble solutions. 812 00:36:53,250 --> 00:36:55,020 So I would encourage you, 813 00:36:55,020 --> 00:36:57,600 if you are sitting there and saying 814 00:36:57,600 --> 00:37:00,720 maybe in your hotel room listening on DCTV, 815 00:37:00,720 --> 00:37:02,677 because I know a lot of people are saying, 816 00:37:02,677 --> 00:37:04,980 "oh my goodness, there's flooding, 817 00:37:04,980 --> 00:37:07,440 there's hangovers, whatever you're not here right now," 818 00:37:07,440 --> 00:37:12,150 come over to the policy village, have a chat, listen in. 819 00:37:12,150 --> 00:37:14,100 I think you're gonna like what you see. 820 00:37:15,030 --> 00:37:16,850 Welcome to DEFCON. 821 00:37:16,850 --> 00:37:19,767 (crowd applauding) 822 00:37:21,946 --> 00:37:22,779 - Thank you. 823 00:37:22,779 --> 00:37:25,863 And we've got a few minutes left for questions. 824 00:37:26,820 --> 00:37:27,750 I don't see any mics, 825 00:37:27,750 --> 00:37:29,580 but if we've got mics and mic runners, 826 00:37:29,580 --> 00:37:31,140 I'm sure they're coming around. 827 00:37:31,140 --> 00:37:32,700 But while we wait on people 828 00:37:32,700 --> 00:37:34,170 to generate them from the audience, 829 00:37:34,170 --> 00:37:35,910 maybe I'll just throw a couple of questions 830 00:37:35,910 --> 00:37:39,033 into the folks here on my right. 831 00:37:39,990 --> 00:37:44,990 So as folks who went into public policy, 832 00:37:45,330 --> 00:37:48,030 before that you were kind of in the hacking community, 833 00:37:48,990 --> 00:37:53,010 what was your kind of emotional journey 834 00:37:53,010 --> 00:37:54,930 the first time you talked to a policy person? 835 00:37:54,930 --> 00:37:57,570 Was like, "oh, they don't get it. I need to help." 836 00:37:57,570 --> 00:37:59,820 Or maybe the opposite. - [Space Rogue] Fear. 837 00:38:00,750 --> 00:38:01,950 - Fear? Yeah. 838 00:38:01,950 --> 00:38:03,273 - I mean the first time, 839 00:38:04,831 --> 00:38:06,210 that was probably one of the very first times 840 00:38:06,210 --> 00:38:07,440 I'd ever been publicly speaking. 841 00:38:07,440 --> 00:38:10,773 So in 1998, it was a long time ago. It was definitely fear. 842 00:38:12,480 --> 00:38:14,970 And if you ever watched the CSPAN video, 843 00:38:14,970 --> 00:38:17,373 you can see I'm hopelessly looking at the floor. 844 00:38:19,110 --> 00:38:24,110 More recently I think it's a feeling of education 845 00:38:25,260 --> 00:38:30,260 or trying to communicate what is real 846 00:38:30,420 --> 00:38:33,480 or that the truth on the ground, the facts of the case, 847 00:38:33,480 --> 00:38:37,770 and trying to make sure that they understand 848 00:38:37,770 --> 00:38:39,243 your point of view. 849 00:38:41,827 --> 00:38:44,580 And that's the hardest part for me. 850 00:38:44,580 --> 00:38:47,580 I'll get in a room with a staffer or a policy person, 851 00:38:47,580 --> 00:38:49,260 and we're having a discussion 852 00:38:49,260 --> 00:38:52,140 and I'm explaining whatever I think is going on. 853 00:38:52,140 --> 00:38:54,630 And I'm trying to gauge their reaction on their face 854 00:38:54,630 --> 00:38:57,360 as to whether or not they actually get it or not. 855 00:38:57,360 --> 00:38:59,527 And sometimes I get that glimmer in their eyes like, 856 00:38:59,527 --> 00:39:00,630 "oh, this guy understands." 857 00:39:00,630 --> 00:39:01,800 And sometimes I don't get that. 858 00:39:01,800 --> 00:39:03,037 And sometimes I get, 859 00:39:03,037 --> 00:39:04,082 "oh, this guy has no clue what's going on, 860 00:39:04,082 --> 00:39:05,793 or gal," excuse me. 861 00:39:11,697 --> 00:39:13,170 So that's the feeling that I get anyway. 862 00:39:13,170 --> 00:39:14,880 I dunno if anybody else wants to -- 863 00:39:14,880 --> 00:39:18,990 - Yeah. I'd say the first feeling I had was of frustration 864 00:39:18,990 --> 00:39:22,470 because I had seen these problems out there. 865 00:39:22,470 --> 00:39:25,080 There would be ways to fix them, 866 00:39:25,080 --> 00:39:27,750 but clearly something wasn't working. 867 00:39:27,750 --> 00:39:31,680 And so I wanted to know why this had happened 868 00:39:31,680 --> 00:39:33,600 and what we could do to make it better. 869 00:39:33,600 --> 00:39:36,810 I would echo a lot of Space Rogue's points 870 00:39:36,810 --> 00:39:41,810 that this really is you need to be persistent, 871 00:39:42,000 --> 00:39:44,700 because policy makers want to learn. 872 00:39:44,700 --> 00:39:46,830 They want to know how to do this right. 873 00:39:46,830 --> 00:39:49,650 And over time you can help them learn, 874 00:39:49,650 --> 00:39:52,200 but it's not gonna change overnight. 875 00:39:52,200 --> 00:39:56,130 It's a process that has taken years, decades, 876 00:39:56,130 --> 00:39:57,930 for us to even get to the point we are today. 877 00:39:57,930 --> 00:40:00,210 And there's still a lot of room to go. 878 00:40:00,210 --> 00:40:05,210 So have patience but know that policy makers and hackers 879 00:40:06,180 --> 00:40:08,700 share the same goal of wanting to make progress. 880 00:40:08,700 --> 00:40:10,923 And we will get there even if it is slow. 881 00:40:12,210 --> 00:40:15,120 - And two things to ask your patience for, 882 00:40:15,120 --> 00:40:16,380 people that are in policy, 883 00:40:16,380 --> 00:40:18,630 we tend to say two relatively douchey things, 884 00:40:18,630 --> 00:40:20,070 and thank you for putting up for it with them. 885 00:40:20,070 --> 00:40:21,900 One is we tend to say "cyber" a lot 886 00:40:21,900 --> 00:40:25,620 and thank you for your patience on that issue. 887 00:40:25,620 --> 00:40:27,150 It's a DC thing. 888 00:40:27,150 --> 00:40:28,590 We also tend to say, 889 00:40:28,590 --> 00:40:30,150 we're speaking on our own capacity 890 00:40:30,150 --> 00:40:34,170 and not any kind of official job and speaking as a person. 891 00:40:34,170 --> 00:40:36,390 So thanks for letting us get that out of the way. 892 00:40:36,390 --> 00:40:37,710 And one of the things that really struck me, 893 00:40:37,710 --> 00:40:38,543 I was a veteran, 894 00:40:38,543 --> 00:40:41,181 so I came up kind of dealing with policy 895 00:40:41,181 --> 00:40:43,920 as a little bit more of a natural thing. 896 00:40:43,920 --> 00:40:47,490 I got started in doing this work at the Pentagon, 897 00:40:47,490 --> 00:40:50,130 helping set up the very first joint cyber command 898 00:40:50,130 --> 00:40:51,540 back in the nineties, 899 00:40:51,540 --> 00:40:52,440 but what really struck me, 900 00:40:52,440 --> 00:40:53,670 'cause after not long after that, 901 00:40:53,670 --> 00:40:57,060 I was at the White House working these issues 902 00:40:57,060 --> 00:40:59,460 and it really struck me on how much the government folks 903 00:40:59,460 --> 00:41:03,030 thought what they did really mattered into this space. 904 00:41:03,030 --> 00:41:06,930 That we were gonna solve this by setting up some new office 905 00:41:06,930 --> 00:41:10,620 and hiring a couple of civil servants to do something 906 00:41:10,620 --> 00:41:13,440 that I knew the private sector and the hacker community 907 00:41:13,440 --> 00:41:18,210 were already doing and had been doing for years. 908 00:41:18,210 --> 00:41:20,650 And so that's a lot of where I'm in on 909 00:41:21,570 --> 00:41:23,670 and I'm going the policy makers now to say, 910 00:41:23,670 --> 00:41:25,477 I hate sports analogies, but I'm like, 911 00:41:25,477 --> 00:41:27,390 "look, there's a lot of players on the field. 912 00:41:27,390 --> 00:41:30,090 And generally it's gonna be a hacker. 913 00:41:30,090 --> 00:41:32,790 It's gonna be someone that at a tech company, 914 00:41:32,790 --> 00:41:35,460 at a information security company, 915 00:41:35,460 --> 00:41:37,860 that's in the position to most make the play." 916 00:41:37,860 --> 00:41:39,630 And so that's one of the things I really think 917 00:41:39,630 --> 00:41:41,160 that they need some help with too. 918 00:41:41,160 --> 00:41:43,560 There's a lot of other people that can help. 919 00:41:43,560 --> 00:41:46,350 - One other point, you mentioned frustration. 920 00:41:46,350 --> 00:41:49,263 This is a looooooong process. 921 00:41:50,190 --> 00:41:51,323 I mean, I've been doing this for 25 years 922 00:41:51,323 --> 00:41:53,400 and the needle has moved, 923 00:41:53,400 --> 00:41:56,100 but you can't jump into doing policy work 924 00:41:56,100 --> 00:41:57,840 and thinking you're gonna solve everything next week, 925 00:41:57,840 --> 00:41:59,590 'cause that is not going to happen. 926 00:42:00,660 --> 00:42:01,710 And everybody agrees. 927 00:42:03,390 --> 00:42:05,070 - Anybody on the policy department team 928 00:42:05,070 --> 00:42:06,720 want to answer the same question? 929 00:42:13,110 --> 00:42:14,520 - Like Space Rogue said, 930 00:42:14,520 --> 00:42:16,830 it was definitely a process 931 00:42:16,830 --> 00:42:19,200 because I was only there for a year and a half, 932 00:42:19,200 --> 00:42:23,220 but the first time I spoke to a policymaker 933 00:42:23,220 --> 00:42:25,770 about a cyber issue, 934 00:42:25,770 --> 00:42:29,160 why TikTok is a national security issue, 935 00:42:29,160 --> 00:42:33,780 I realized I needed to learn from them who CFIUS was, 936 00:42:33,780 --> 00:42:35,910 I had as much to learn from them 937 00:42:35,910 --> 00:42:38,280 as they had to learn from the community. 938 00:42:38,280 --> 00:42:43,280 And the optimism of all the policy makers 939 00:42:43,500 --> 00:42:45,360 to make a difference, to move that needle, 940 00:42:45,360 --> 00:42:47,730 even if it's a little bit at a time, 941 00:42:47,730 --> 00:42:51,030 was just off the charts, 942 00:42:51,030 --> 00:42:53,760 off the charts how much they wanted to help. 943 00:42:53,760 --> 00:42:56,220 And so this engagement is wanted and needed 944 00:42:56,220 --> 00:42:59,613 and we can learn as much from them as they can from us. 945 00:43:02,970 --> 00:43:05,970 - So I have maybe a little bit of a different perspective 946 00:43:05,970 --> 00:43:09,120 insofar as I'm not coming at policy as an outsider, 947 00:43:09,120 --> 00:43:11,370 I'm coming at it as an insider. 948 00:43:11,370 --> 00:43:13,500 This is my career is public policy 949 00:43:13,500 --> 00:43:16,200 and living in DC and talking to policy makers. 950 00:43:16,200 --> 00:43:18,900 And my experience has been largely positive. 951 00:43:18,900 --> 00:43:21,480 They've been actually very receptive 952 00:43:21,480 --> 00:43:22,770 and there are a lot of ways 953 00:43:22,770 --> 00:43:25,490 that you can communicate your input to government. 954 00:43:25,490 --> 00:43:29,340 It is not just that there is a lack 955 00:43:29,340 --> 00:43:30,780 of technical understanding. 956 00:43:30,780 --> 00:43:33,210 In some cases you'll be surprised by how well 957 00:43:33,210 --> 00:43:35,190 they actually understand technology 958 00:43:35,190 --> 00:43:37,050 and may be surprised that government 959 00:43:37,050 --> 00:43:39,480 is already trying to solve certain problems. 960 00:43:39,480 --> 00:43:42,000 If you do try to communicate your input to government, 961 00:43:42,000 --> 00:43:43,890 I do encourage you to try to look 962 00:43:43,890 --> 00:43:47,520 into what government may already be doing about that. 963 00:43:47,520 --> 00:43:51,030 It's important not to just appreciate a problem. 964 00:43:51,030 --> 00:43:53,970 We ask our government officials to solve problems 965 00:43:53,970 --> 00:43:55,560 and that is actually much higher, 966 00:43:55,560 --> 00:43:57,090 a much higher level of advocacy 967 00:43:57,090 --> 00:43:58,770 than just identifying a problem. 968 00:43:58,770 --> 00:44:01,560 So bringing to them your thoughts on a workable solution, 969 00:44:01,560 --> 00:44:03,300 it doesn't have to be very polished, 970 00:44:03,300 --> 00:44:06,300 but it actually really advances the ball quite a lot. 971 00:44:06,300 --> 00:44:08,910 And then there is one other uncomfortable truth 972 00:44:08,910 --> 00:44:10,620 in all of this, which is again, 973 00:44:10,620 --> 00:44:13,230 not just a lack of technical understanding, 974 00:44:13,230 --> 00:44:17,730 but there will be lobbying groups and parties 975 00:44:17,730 --> 00:44:22,380 from corporations or from interest groups, 976 00:44:22,380 --> 00:44:24,690 things like that that may disagree with your position 977 00:44:24,690 --> 00:44:26,130 and run interference. 978 00:44:26,130 --> 00:44:29,370 Don't underestimate the power of that to stall things out 979 00:44:29,370 --> 00:44:32,490 and drag things and problems and solutions out a lot longer 980 00:44:32,490 --> 00:44:35,373 than you may anticipate. It's a very profound influence. 981 00:44:37,470 --> 00:44:38,303 - [Beau] Cool. All right. 982 00:44:38,303 --> 00:44:41,253 I saw at least one hand over here. Yes, sir? 983 00:44:42,300 --> 00:44:44,250 - [Attendee] I love the idea. I think it's great. 984 00:44:44,250 --> 00:44:46,607 A lot of us have been doing policy work (indistinct). 985 00:44:51,210 --> 00:44:54,797 One of the things I think, I listened to this introduction, 986 00:44:54,797 --> 00:44:58,890 that's fantastic, and my question is really about, 987 00:44:58,890 --> 00:45:01,852 are you really global, right? So I hear a lot of US, 988 00:45:01,852 --> 00:45:05,730 I know from my friends traveling the world, 989 00:45:05,730 --> 00:45:09,671 there's Singapore, UK, what have you, 990 00:45:09,671 --> 00:45:12,018 and they're doing some incredible stuff as well. 991 00:45:12,018 --> 00:45:16,950 And I think your point about you all need to work together 992 00:45:16,950 --> 00:45:18,593 and look at other people's work. 993 00:45:18,593 --> 00:45:22,320 I mean, we're seeing some of this GDPR the last few years. 994 00:45:22,320 --> 00:45:25,380 Now in cybersecurity, you've got a number of facts 995 00:45:25,380 --> 00:45:27,154 that are happening in Europe. 996 00:45:27,154 --> 00:45:31,500 How are we at DEFCON on taking a more global perspective? 997 00:45:31,500 --> 00:45:34,653 Not just the US, but a global perspective. 998 00:45:34,653 --> 00:45:36,537 - Yeah. I'll repeat the question 999 00:45:36,537 --> 00:45:40,440 and then add a short thing and then throw it open. 1000 00:45:40,440 --> 00:45:43,350 So the question was, "a lot of people have been doing policy 1001 00:45:43,350 --> 00:45:46,230 for a long time, which I think is awesome. Thank you. 1002 00:45:46,230 --> 00:45:49,620 And a lot of the accents on stage here 1003 00:45:49,620 --> 00:45:51,660 are gringos, we're Americans. 1004 00:45:51,660 --> 00:45:55,830 So what are we doing at DEFCON, as well as beyond, 1005 00:45:55,830 --> 00:45:57,957 to make things more global?" 1006 00:45:58,920 --> 00:46:00,960 And I'll say this year has been very challenging 1007 00:46:00,960 --> 00:46:02,160 for DEFCON in particular 1008 00:46:02,160 --> 00:46:05,250 because we're still in the aftermath of COVID 1009 00:46:05,250 --> 00:46:08,580 and some of the travel restrictions 1010 00:46:08,580 --> 00:46:10,680 and costs and everything else. 1011 00:46:10,680 --> 00:46:13,020 But we actually do have quite a few folks. 1012 00:46:13,020 --> 00:46:15,180 We've got a panel coming up today later, 1013 00:46:15,180 --> 00:46:17,040 that is an international panel 1014 00:46:17,040 --> 00:46:20,520 that has Singapore and the UK represented. 1015 00:46:20,520 --> 00:46:21,750 And we've tried to weave in 1016 00:46:21,750 --> 00:46:23,700 international perspectives where we can. 1017 00:46:23,700 --> 00:46:27,660 Some of the conversations over in the policy department 1018 00:46:27,660 --> 00:46:30,630 are very internationally focused. 1019 00:46:30,630 --> 00:46:33,060 So we're trying, we would love to have more help 1020 00:46:33,060 --> 00:46:35,010 getting better at being more international 1021 00:46:35,010 --> 00:46:38,160 and maybe bringing the message of DEFCON more broadly 1022 00:46:38,160 --> 00:46:39,810 and bringing more international folks here. 1023 00:46:39,810 --> 00:46:42,083 So for the rest of the group? 1024 00:46:43,260 --> 00:46:44,430 - [Jay] Yeah, I would just add that, 1025 00:46:44,430 --> 00:46:47,160 so I'm on the CFP review board, 1026 00:46:47,160 --> 00:46:50,387 so in the people that submit talks 1027 00:46:50,387 --> 00:46:53,520 through the main process rather than through the DEFCON. 1028 00:46:53,520 --> 00:46:55,350 It comes up a lot also for Black Hat, 1029 00:46:55,350 --> 00:46:57,177 I'm on the Black Hat policy. 1030 00:46:57,177 --> 00:46:59,130 And it comes up a lot of just trying to make sure 1031 00:46:59,130 --> 00:47:02,670 that we're not just picking the US talks. 1032 00:47:02,670 --> 00:47:03,660 It's really difficult. 1033 00:47:03,660 --> 00:47:07,140 We're not always getting the talks submitted, 1034 00:47:07,140 --> 00:47:09,090 but thanks for helping keep our attention to it. 1035 00:47:09,090 --> 00:47:10,803 And so we appreciate it. 1036 00:47:13,440 --> 00:47:15,723 - [Beau] All right, I see one way over there. 1037 00:47:18,184 --> 00:47:19,360 - [Attendee] Good morning. Can you hear me? 1038 00:47:19,360 --> 00:47:20,193 - Yes. 1039 00:47:21,427 --> 00:47:23,658 - I'm curious about the panel's perspective 1040 00:47:23,658 --> 00:47:27,457 on the question of policy and also regulations. 1041 00:47:27,457 --> 00:47:28,587 Should we be restricted 1042 00:47:28,587 --> 00:47:31,545 on the types of controls that we use? 1043 00:47:31,545 --> 00:47:33,895 Or should we take a (indistinct) approach 1044 00:47:33,895 --> 00:47:35,028 in terms of just addressing risks. 1045 00:47:35,028 --> 00:47:37,689 So for example, should policy mandate 1046 00:47:37,689 --> 00:47:40,743 passwords or multifactor authentication? 1047 00:47:40,743 --> 00:47:42,870 - Okay. So I'll just repeat the question, 1048 00:47:42,870 --> 00:47:44,820 then throw it to the group. 1049 00:47:44,820 --> 00:47:48,780 How prescriptive versus descriptive should policies be? 1050 00:47:48,780 --> 00:47:52,113 For instance, mandating multifactor authentication? 1051 00:47:54,180 --> 00:47:56,280 - [Jack] So I can start with taking a crack at that. 1052 00:47:56,280 --> 00:47:58,800 I think that, and especially when we're thinking of, 1053 00:47:58,800 --> 00:48:00,330 for instance law, 1054 00:48:00,330 --> 00:48:02,940 we have to keep in mind that something we write today 1055 00:48:02,940 --> 00:48:05,220 is gonna apply 10 years from now. 1056 00:48:05,220 --> 00:48:07,980 And we have to make sure that what we do 1057 00:48:07,980 --> 00:48:10,440 doesn't lead to unintended consequences. 1058 00:48:10,440 --> 00:48:13,230 So multifactor authentication 1059 00:48:13,230 --> 00:48:14,820 might be a best practice today. 1060 00:48:14,820 --> 00:48:17,850 We don't know if it'll be a best practice 10 years from now. 1061 00:48:17,850 --> 00:48:20,070 So I think this is very similar in a lot of ways 1062 00:48:20,070 --> 00:48:23,460 to what we're seeing with security compliance, 1063 00:48:23,460 --> 00:48:25,800 where we don't want to just make something 1064 00:48:25,800 --> 00:48:28,860 where it's check off these boxes and then you're secure, 1065 00:48:28,860 --> 00:48:31,350 because as everyone in this room knows, 1066 00:48:31,350 --> 00:48:34,650 compliance doesn't actually equate to security. 1067 00:48:34,650 --> 00:48:37,620 So I think it's a very similar model with policy 1068 00:48:37,620 --> 00:48:40,140 where we want to think about what are the goals 1069 00:48:40,140 --> 00:48:42,930 we can set out that get us to where we want to be, 1070 00:48:42,930 --> 00:48:44,790 without having to be over prescriptive, 1071 00:48:44,790 --> 00:48:49,790 without having to, say codify, like these X controls, 1072 00:48:51,300 --> 00:48:53,790 but rather what is the end state and then 1073 00:48:53,790 --> 00:48:56,303 can there be a kind of flexible approach to get there. 1074 00:49:00,480 --> 00:49:01,560 - Oh please. 1075 00:49:01,560 --> 00:49:03,313 - [Jay] Oh no, please go ahead Harley. 1076 00:49:03,313 --> 00:49:05,940 - So the question of whether regulation 1077 00:49:05,940 --> 00:49:08,790 should be prescriptive or just very flexible 1078 00:49:08,790 --> 00:49:13,050 is actually a perennial problem in DC policy making. 1079 00:49:13,050 --> 00:49:16,470 And you see this endlessly battled on both sides 1080 00:49:16,470 --> 00:49:17,340 and it's one of those reasons 1081 00:49:17,340 --> 00:49:20,250 why the process gets drawn out, as we discussed. 1082 00:49:20,250 --> 00:49:21,750 I think that there is a move now 1083 00:49:21,750 --> 00:49:26,640 towards more risk based regulation, 1084 00:49:26,640 --> 00:49:29,400 recognizing that one enterprise's risks 1085 00:49:29,400 --> 00:49:31,860 or one community's risks are not the same as another. 1086 00:49:31,860 --> 00:49:35,280 The problem there though is that sometimes it is easier 1087 00:49:35,280 --> 00:49:39,300 to fudge enforcement on risk based security. 1088 00:49:39,300 --> 00:49:41,730 And so I think we're also seeing a bit of a movement 1089 00:49:41,730 --> 00:49:43,830 towards some minimum baselines. 1090 00:49:43,830 --> 00:49:47,040 So that, you know, you have to do this minimum baseline 1091 00:49:47,040 --> 00:49:48,690 if you want to address your risk. 1092 00:49:48,690 --> 00:49:51,000 But the rest of it is a process of identifying your risk 1093 00:49:51,000 --> 00:49:52,860 and having safeguards around it. 1094 00:49:52,860 --> 00:49:55,740 Most of the new regulations around safeguards 1095 00:49:55,740 --> 00:49:57,030 seem to be built that way, 1096 00:49:57,030 --> 00:49:59,040 but it also depends on what you're trying to address. 1097 00:49:59,040 --> 00:50:00,930 So things like incident reporting tend to be 1098 00:50:00,930 --> 00:50:03,270 a lot more prescriptive and less risk based. 1099 00:50:03,270 --> 00:50:05,470 So I think it's both, I think it's a hybrid. 1100 00:50:09,794 --> 00:50:11,610 - And I think to that last point, 1101 00:50:11,610 --> 00:50:14,010 it's precisely for that reason, 1102 00:50:14,010 --> 00:50:15,720 that we need you in the conversation 1103 00:50:15,720 --> 00:50:19,830 because just because there's a lot of folks 1104 00:50:19,830 --> 00:50:20,790 in the room that think they're very, 1105 00:50:20,790 --> 00:50:23,280 very smart hackers doesn't, mean you are always right. 1106 00:50:23,280 --> 00:50:25,230 But it does mean that if you listen 1107 00:50:25,230 --> 00:50:27,030 to the other side of the equation 1108 00:50:27,030 --> 00:50:29,070 and we think about the consequences, 1109 00:50:29,070 --> 00:50:30,870 both intended and unintended, 1110 00:50:30,870 --> 00:50:32,870 we're gonna likely get a better outcome. 1111 00:50:35,010 --> 00:50:38,010 - [Jay] And I'll just say, the very first, 1112 00:50:38,010 --> 00:50:39,560 as far as we know in the world, 1113 00:50:41,280 --> 00:50:44,020 national policy document that really tackled this, 1114 00:50:44,020 --> 00:50:46,440 especially for a critical infrastructure protection, 1115 00:50:46,440 --> 00:50:49,440 was 1998; it was from the Clinton administration. 1116 00:50:49,440 --> 00:50:52,770 And it said we don't wanna regulate, 1117 00:50:52,770 --> 00:50:55,140 but if market forces aren't obviously solving the problem, 1118 00:50:55,140 --> 00:50:56,100 we might need to. 1119 00:50:56,100 --> 00:51:00,377 So that was almost 25 years ago that we came up with that. 1120 00:51:00,377 --> 00:51:02,040 And so we're still here, right? 1121 00:51:02,040 --> 00:51:02,873 We're at DEFCON 30 1122 00:51:02,873 --> 00:51:05,280 and we know the problems haven't been solved. 1123 00:51:05,280 --> 00:51:06,330 And I think you'll see a difference 1124 00:51:06,330 --> 00:51:07,590 between existing regulation. 1125 00:51:07,590 --> 00:51:08,820 We've got a ton of regulation, 1126 00:51:08,820 --> 00:51:10,650 the finance sector, the energy sector, 1127 00:51:10,650 --> 00:51:12,510 a lot of 'em are already heavily regulated. 1128 00:51:12,510 --> 00:51:13,950 You've got things like the SCC 1129 00:51:13,950 --> 00:51:15,960 going to publicly traded companies. 1130 00:51:15,960 --> 00:51:18,180 So hope that after you do see regulation, 1131 00:51:18,180 --> 00:51:20,820 it's gonna be locking in and looking these different areas. 1132 00:51:20,820 --> 00:51:22,290 And especially it's great to see the frameworks 1133 00:51:22,290 --> 00:51:23,850 that are coming out. 1134 00:51:23,850 --> 00:51:25,770 The NIST Cybersecurity Framework is not a regulation, 1135 00:51:25,770 --> 00:51:30,303 but boy it's really helped drive a lot of positive change. 1136 00:51:31,860 --> 00:51:32,940 - [Beau] All right. 1137 00:51:32,940 --> 00:51:34,757 Yes. Over here. 1138 00:51:34,757 --> 00:51:39,757 - [Attendee] Oh hey (indistinct) crypto privacy village. 1139 00:51:45,657 --> 00:51:49,943 We put out some guidance yesterday that doesn't require MFA, 1140 00:51:49,943 --> 00:51:54,943 but (indistinct) to MFA, may be illegal? (indistinct) 1141 00:51:56,894 --> 00:51:58,908 I also have a question for the whole panel, 1142 00:51:58,908 --> 00:52:03,325 one by one your favorite female or non-binary hacker? 1143 00:52:05,227 --> 00:52:09,150 - Before we do that, for those who didn't hear, 1144 00:52:09,150 --> 00:52:10,893 you said tomorrow 4:00 PM? 1145 00:52:12,314 --> 00:52:15,150 Today 4:00 PM today, crypto privacy village 1146 00:52:15,150 --> 00:52:16,083 talking about MFA. 1147 00:52:18,450 --> 00:52:19,740 - [Beau] Okay. You wanna start. 1148 00:52:19,740 --> 00:52:23,490 - My favorite female or non-binary hacker? 1149 00:52:23,490 --> 00:52:28,490 Can I give you three? BIA, Katie Moe, and Window. 1150 00:52:32,400 --> 00:52:33,450 - [Jack] Stole one of mine there, 1151 00:52:33,450 --> 00:52:35,520 I'll go with Jen Easterly. 1152 00:52:35,520 --> 00:52:37,680 I think Director Easterly has done a great job 1153 00:52:37,680 --> 00:52:39,630 kind of taking the helms at CISA 1154 00:52:39,630 --> 00:52:42,483 and I'm looking forward to see where she continues it. 1155 00:52:44,030 --> 00:52:45,197 - [Attendee] I can't tell what you're saying. 1156 00:52:45,197 --> 00:52:46,863 - Sorry, Jen Easterly. 1157 00:52:48,000 --> 00:52:49,710 - [Jay] And I'll add Amélie Koran to that, 1158 00:52:49,710 --> 00:52:51,780 especially 'cause Beau and I have done a lot of work 1159 00:52:51,780 --> 00:52:54,087 on hacker film festival called "Defrag," 1160 00:52:54,087 --> 00:52:57,120 and the knowledge that Amélie brings of hacking 1161 00:52:57,120 --> 00:52:59,040 and of just so many other 1162 00:52:59,040 --> 00:53:02,913 awesome nerdy stuff like soundtracks, fabulous. 1163 00:53:03,750 --> 00:53:06,750 - [Beau] Yeah, couple of mine also got stolen, 1164 00:53:06,750 --> 00:53:07,980 but that's great. 1165 00:53:07,980 --> 00:53:11,733 I'd say Alyssa Knight is another one who's awesome. 1166 00:53:12,570 --> 00:53:15,600 And I'll go with maybe an unconventional one. 1167 00:53:15,600 --> 00:53:17,457 I really like Jen Ellis. 1168 00:53:22,650 --> 00:53:25,500 She's not a hacker herself, 1169 00:53:25,500 --> 00:53:27,267 but comes from the hacker community 1170 00:53:27,267 --> 00:53:29,790 and has done a lot to really advance public policy 1171 00:53:29,790 --> 00:53:31,440 and to bridge those gaps as well. 1172 00:53:33,510 --> 00:53:34,360 Anybody up there. 1173 00:53:36,690 --> 00:53:39,330 - [Doug] Hey, I'm gonna go for Grace Hopper. 1174 00:53:39,330 --> 00:53:42,663 I know that's an old one but she was freaking awesome. 1175 00:53:47,100 --> 00:53:48,270 - I'll give you three. 1176 00:53:48,270 --> 00:53:50,460 I think Grace Hopper is great, 1177 00:53:50,460 --> 00:53:52,623 Katie Moussouris and Emily Velasco. 1178 00:53:55,380 --> 00:53:57,390 - I'm also gonna cheat and do two, 1179 00:53:57,390 --> 00:54:00,153 I'll say Amélie Koran and Katie Hegemon. 1180 00:54:05,580 --> 00:54:07,179 - [Jenny] Me! 1181 00:54:07,179 --> 00:54:10,179 (crowd applauding) 1182 00:54:11,610 --> 00:54:14,370 But my hero is Dr. Lorrie Cranor, 1183 00:54:14,370 --> 00:54:18,069 password researcher at Carnegie Mellon. 1184 00:54:18,069 --> 00:54:19,830 (clapping) 1185 00:54:19,830 --> 00:54:22,773 - [Beau] All right, I saw another hand, here's one. 1186 00:54:25,350 --> 00:54:29,237 - [Attendee] So I work in policy, I used to work in Congress 1187 00:54:32,008 --> 00:54:35,380 and at some point I think we're frustrating, 1188 00:54:35,380 --> 00:54:40,380 and at times, did I stick with it? Yes, but (indistinct) 1189 00:54:56,344 --> 00:54:58,761 (indistinct) 1190 00:55:02,610 --> 00:55:03,840 - Great question. 1191 00:55:03,840 --> 00:55:06,153 So the question for the cameras is, 1192 00:55:07,380 --> 00:55:09,930 there's a lot of really good technical people in here. 1193 00:55:09,930 --> 00:55:12,720 How do you convince them to get started talking 1194 00:55:12,720 --> 00:55:14,670 with policy folks and stay with it, 1195 00:55:14,670 --> 00:55:17,463 since it can be a long drawn out process? 1196 00:55:25,920 --> 00:55:28,598 - [Jay] A lot of it is getting to know the staffers. 1197 00:55:28,598 --> 00:55:30,840 A lot of times you're working with a member of Congress 1198 00:55:30,840 --> 00:55:32,010 or your local equivalent. 1199 00:55:32,010 --> 00:55:34,260 Like do this thing at your city council. 1200 00:55:34,260 --> 00:55:36,270 Do this for your town, your village, 1201 00:55:36,270 --> 00:55:41,270 do this for your legislature, for your state or your region. 1202 00:55:44,310 --> 00:55:47,040 The attention of the policymaker is gonna drift, right? 1203 00:55:47,040 --> 00:55:49,950 If something happens that day, 1204 00:55:49,950 --> 00:55:51,000 they're not gonna have your attention. 1205 00:55:51,000 --> 00:55:54,330 It's really the staffers like Harley had mentioned, 1206 00:55:54,330 --> 00:55:57,900 like Mosfet had been helping that they're there. 1207 00:55:57,900 --> 00:56:00,480 They are there year in year out 1208 00:56:00,480 --> 00:56:03,990 and they need to know the ask the right questions, 1209 00:56:03,990 --> 00:56:06,420 and so I think staying in with them. 1210 00:56:06,420 --> 00:56:07,830 And I always try and tell myself, 1211 00:56:07,830 --> 00:56:10,443 like please, to help you on the patience, 1212 00:56:11,940 --> 00:56:13,590 I suck at billiards. 1213 00:56:13,590 --> 00:56:15,630 And so whenever I'm playing pool with a buddy, 1214 00:56:15,630 --> 00:56:17,010 my job is just to get the ball 1215 00:56:17,010 --> 00:56:19,770 a little bit closer to the hole. 1216 00:56:19,770 --> 00:56:21,510 'Cause if I actually try and hit it in the hole, 1217 00:56:21,510 --> 00:56:23,820 I'm never gonna get it. 1218 00:56:23,820 --> 00:56:25,950 And it's just gonna ricochet off. 1219 00:56:25,950 --> 00:56:28,410 So just trying those half measures 1220 00:56:28,410 --> 00:56:29,880 and being happy with a half measure 1221 00:56:29,880 --> 00:56:32,730 that the ball is a little bit closer to the pocket. 1222 00:56:32,730 --> 00:56:34,170 And then a little bit closer after that. 1223 00:56:34,170 --> 00:56:35,670 And then the third time I'm hopefully 1224 00:56:35,670 --> 00:56:37,140 gonna be able to sink it. 1225 00:56:37,140 --> 00:56:40,380 If you go in thinking I'm gonna just roll in 1226 00:56:40,380 --> 00:56:42,420 and we're just gonna get this done in one, 1227 00:56:42,420 --> 00:56:46,890 it's almost never gonna happen unless you get really lucky. 1228 00:56:46,890 --> 00:56:48,930 Sometimes with that political moment, 1229 00:56:48,930 --> 00:56:50,100 like we had this report called 1230 00:56:50,100 --> 00:56:51,810 the Cyberspace Solarium Commission, 1231 00:56:51,810 --> 00:56:53,430 the political moment was there 1232 00:56:53,430 --> 00:56:56,490 and shit just lined up and it happened. 1233 00:56:56,490 --> 00:57:00,990 So when you have those moments, be ready for them. 1234 00:57:00,990 --> 00:57:04,140 When we have the bad thing happen, as always does, 1235 00:57:04,140 --> 00:57:06,690 and you have the attention of these policy makers, 1236 00:57:06,690 --> 00:57:09,930 that's when you need to be ready with your ideas. 1237 00:57:09,930 --> 00:57:11,467 So that you can come in and say, 1238 00:57:11,467 --> 00:57:13,050 "here's what we need to do," 1239 00:57:13,050 --> 00:57:14,287 rather than beating them up with, 1240 00:57:14,287 --> 00:57:16,487 "we told you this is what was gonna happen." 1241 00:57:18,750 --> 00:57:19,850 - [Beau] And I'll say, 1242 00:57:22,530 --> 00:57:25,057 I help organize an initiative called, 1243 00:57:25,057 --> 00:57:27,090 "I am the Cavalry" as well. 1244 00:57:27,090 --> 00:57:28,470 And one of the things that we found, 1245 00:57:28,470 --> 00:57:32,400 was the most effective at bridging the gap, 1246 00:57:32,400 --> 00:57:34,230 and I think is actually really helpful, 1247 00:57:34,230 --> 00:57:36,450 for encouraging people to stick with it, 1248 00:57:36,450 --> 00:57:39,240 is starting with building empathy, right? 1249 00:57:39,240 --> 00:57:40,740 Get to understand the person, 1250 00:57:40,740 --> 00:57:42,273 why they're doing something. 1251 00:57:43,230 --> 00:57:45,660 For me anyways, it's a lot more interesting. 1252 00:57:45,660 --> 00:57:47,790 It keeps me a lot more encouraged to go back 1253 00:57:47,790 --> 00:57:49,590 if I understand their motivations, 1254 00:57:49,590 --> 00:57:52,770 if I understand them as a human being. 1255 00:57:52,770 --> 00:57:54,600 And it gives me a lot more patience 1256 00:57:54,600 --> 00:57:56,100 to be able to stick with them, 1257 00:57:56,100 --> 00:57:58,920 to work with them, to know what they're going through. 1258 00:57:58,920 --> 00:58:01,000 So maybe just start with 1259 00:58:01,000 --> 00:58:03,690 not just diving into the technical content 1260 00:58:03,690 --> 00:58:05,640 or the policy content, 1261 00:58:05,640 --> 00:58:07,740 but hear what's going on 1262 00:58:07,740 --> 00:58:09,810 and understand what they're trying to achieve 1263 00:58:09,810 --> 00:58:13,080 with either the particular thing they're working on 1264 00:58:13,080 --> 00:58:17,043 or overall is a longer term career goal or life goal. 1265 00:58:18,450 --> 00:58:20,040 - I would just add super quickly, 1266 00:58:20,040 --> 00:58:22,890 that I think where we see some of the most tangible effects, 1267 00:58:22,890 --> 00:58:26,220 is where we kind of create either programs or venues 1268 00:58:26,220 --> 00:58:28,410 to really foster these types of conversations 1269 00:58:28,410 --> 00:58:31,080 and bring both the policy and the tech folks together. 1270 00:58:31,080 --> 00:58:32,760 So whether it's "I am the Cavalry," 1271 00:58:32,760 --> 00:58:34,020 whether it's DEFCON policy, 1272 00:58:34,020 --> 00:58:36,330 whether it's programs like TechCongress, 1273 00:58:36,330 --> 00:58:38,310 or Hackers on the Hill, 1274 00:58:38,310 --> 00:58:40,800 these are the types of venues and opportunities 1275 00:58:40,800 --> 00:58:42,840 where we can really have these meaningful conversations 1276 00:58:42,840 --> 00:58:44,160 that can help drive impact. 1277 00:58:44,160 --> 00:58:46,050 So wherever we can create more of these types 1278 00:58:46,050 --> 00:58:48,131 of opportunities, programs, events, 1279 00:58:48,131 --> 00:58:50,970 that's really, really increasing the opportunities 1280 00:58:50,970 --> 00:58:53,100 for these types of things to happen and manifest. 1281 00:58:53,100 --> 00:58:54,210 - And just on the global side, 1282 00:58:54,210 --> 00:58:56,670 since a lot of this was just "Digital Peace Now." 1283 00:58:56,670 --> 00:58:57,697 So if you're interested in this, 1284 00:58:57,697 --> 00:59:00,637 "Digital Peace Now" is kind of a youth movement to say, 1285 00:59:00,637 --> 00:59:01,860 "we need to do better on these." 1286 00:59:01,860 --> 00:59:04,680 And they can use a lot of tech expert expertise 1287 00:59:04,680 --> 00:59:06,360 and it is a global movement. 1288 00:59:06,360 --> 00:59:09,986 - All right, so we got the five minute sign 1289 00:59:09,986 --> 00:59:11,610 a few minutes ago. 1290 00:59:11,610 --> 00:59:14,160 So unfortunately I think we're not gonna be able 1291 00:59:14,160 --> 00:59:18,270 to take any more questions, but I've got a question for you. 1292 00:59:18,270 --> 00:59:19,470 How many of you are gonna come 1293 00:59:19,470 --> 00:59:21,510 and see us at the policy department today, 1294 00:59:21,510 --> 00:59:23,130 tomorrow or Sunday? 1295 00:59:23,130 --> 00:59:23,979 All right. 1296 00:59:23,979 --> 00:59:26,250 (crowd applauding) 1297 00:59:26,250 --> 00:59:27,150 Thank you everybody. 1298 00:59:27,150 --> 00:59:31,530 Let's continue the conversation over there and -- 1299 00:59:31,530 --> 00:59:32,363 What's that? 1300 00:59:32,363 --> 00:59:33,210 - [Jenny] Follow @DEFCONPolicy. 1301 00:59:33,210 --> 00:59:36,090 - [Beau] Follow @DEFCONPolicy on Twitter. 1302 00:59:36,090 --> 00:59:38,430 We're trying to get to a thousand by the end of CON, 1303 00:59:38,430 --> 00:59:40,710 so you can help us make that happen. 1304 00:59:40,710 --> 00:59:42,315 Thank you very much. 1305 00:59:42,315 --> 00:59:43,148 - [Jay] Thanks everyone.