So this is the talk about the public policy department.
By show of hands, how many of you have heard of the policy department before?
Oh, man, that's a lot more than I expected it to be.
That's good.
How many of you have been to policy talks at DEF CON in years past?
Fewer people.
Good.
Room to grow this year.
So we are one of the newest departments at DEF CON.
We are kind of focused on the idea that you can bring public policymakers and hackers together in the same space and have them collaborate, cooperate, build trust, and start to cause things to happen in a better way than they would have otherwise.
We're going to have the Dark Tangent come on in a couple of minutes and elaborate more on his vision for what the policy department should look like.
And some of the history of the policy department and policy itself at DEF CON.
We've got an interesting program.
We've got three very distinguished folks up here, over here on my right, your left, that have spent the last 30 years in some way, shape, or form as hackers transforming public policy.
Engaged in conversation with members of Congress.
With the executive branch.
Globally as well.
To try and bridge the gap to close the expanse between public policy and the hacking community.
For those of you who aren't aware, DEF CON has had a little bit of a tenuous relationship with government in the past.
Requisite.
Requisite.
Pause for laughter.
But I think we're closing those gaps.
We're changing the way that things get done in D.C. and around the world in public policy centers and centers of power.
And I think that we've got a huge opportunity to expand on that.
I myself live in downtown D.C.
By the way, I'm Beau Woods.
I run the policy department this year.
And I'm excited to have you all here.
I live in D.C.
And I've seen the change in just the last five or six years in public policy and the way that they look at hackers.
You know, a decade ago, public policy folks thought we were all criminals.
And now they have a much more in-depth and nuanced understanding.
And the reason is partly because of some of the folks over here to my right and your left.
And so I want to start off.
And give them an opportunity to give a little perspective and context and history.
In the past 30 years, what's happened in the hacking community in public policy?
And how have they seen that change?
So just immediately to my right, we have Jay Healy and then Jack Cable and Space Road.
So, Jay, do you want to kick us off?
Yeah, sure thing.
So, hi, everyone.
Jay Healy.
And one of the reasons that I've gotten involved and to really start thinking about policy was I came across a great quote that said,
few if any contemporary security controls can stop a dedicated red team from easily accessing any information.
So, like, we know that.
That the red team is going to get through.
The hacker is going to get through.
The offense has the advantage over defense.
Right?
That quote was from 1979.
Right?
Since before DEFCON, the attackers had the advantage.
And so hackers do what we do for a lot of reasons.
Right?
We do a lot of it for curiosity.
A lot of it because, you know, we hack because it's there.
But a lot do it because we think we're making the world better.
Right?
That we're going to, doing this is going to lead to more security, to more privacy that our kids and our grandkids aren't going to have to deal with the shit that we've been dealing about with for 30 DEFCONs.
But it's not working.
Right?
That quote from 1979 is still relevant.
So that's one of the things that we try and do on policy is saying, all right, people are working super hard to find vulnerabilities and fix them.
And we're not making any progress.
So what else can we do differently?
What else can we try to do out of D.C., out of other governments, out of things like I'm the cavalry so that the work the hacker is doing is having more impact and that we can find more security?
We can find other ways to have impact.
And that's what's really driving me in the way I think of the problems.
Yeah.
Jack?
Hi, everyone.
I'm Jack Cable.
I'm a hacker.
I'm also a security researcher, which is what I call myself in front of policy people to make myself appear more professional.
Good tip out there.
So I got into the world of policy.
Kind of my foray into that.
I think that started when I was in high school.
I got an e-mail titled, what if I told you the Pentagon wanted you to hack it?
This was the first U.S. government, I believe the first government bug bounty program where they were inviting hackers to find vulnerabilities in the Pentagon systems, something that even a few years before you could only go to jail for.
So now there was a legal pathway for doing this.
Government was recognizing the value of people like us.
In helping secure their systems.
Helping secure our country.
So I participated in that.
Got involved a couple more.
Went to work for the defense digital service, which is an agency that put this on.
And before that, I had never really considered working in government or doing anything policy related.
I had been kind of immersed in this community and really enjoyed what I did.
But that never really crossed my mind.
Until I went and saw the potential for change.
The idea that there are places in government you can do where you can actually make change, where you can get around the bureaucracy.
There's, I won't say that's everywhere in government, but there are certainly places where that can be done.
Second instance was when I was registering to vote.
I came across a pretty serious vulnerability.
I did not know much about election systems or who administered elections.
But I knew this was pretty serious.
I went about trying to figure out who to disclose this to.
It was a long and confusing path.
Eventually after around six or so months, found the right people, was able to get to them so they could fix it.
That was not at all transparent.
I got connected with the folks at CISA, the US Cyber Security Infrastructure Security Agency, along the way.
Who were able to help make those connections in order to be able to effectively disclose the vulnerability.
I then went to work for CISA.
Working on election security.
Helping secure both state and local election systems, as well as some of their disinformation work.
So through this work, I've been able to engage with election officials, election manufacturers, policy makers across the country.
And I can say that the conversation is changing.
If you want to engage with this conversation, which I think is critically important.
Because us here in Vegas, wherever we usually are, do not typically intersect with the folks in DC.
There's a disconnect there.
I think of policy and the technical side as really two sides of the same coin.
Almost all policy problems have underlying technical truths that we all know.
That unless we're there in the room helping them get it right, aren't going to get right.
So a couple of takeaways.
Policy is really about creating change at scale.
That's part of why I got into this is because I saw the ability to kind of take the technical work I had done.
And raise that to a level where I could apply that not just for, say, one company or one organization.
But at a more national scale.
A second thing is being able to speak the language of policy makers.
We have very different lingo.
And what we all do is great.
And what they all do is great.
But unless we're able to effectively communicate, we're not going to be able to effectively make change.
So it goes both ways, of course.
We must speak their language.
They must speak ours.
But making an effort to kind of meet them in the middle will go a long way in order to make progress here.
And third is just to get involved.
And fortunately, it's easier than ever to do so.
You could walk over down back there to the policy village where Bo's done a great job of putting this together.
Conversation efforts.
After conversation on really important policy topics with top policy makers across the country.
So I encourage everyone here to take a moment, step in there, participate in some of those discussions.
And see how you can apply your expertise to help advance policy in our country.
All right.
And before we go to the last, I want to bring up a dark tangent to give us some perspective.
What his vision is for the policy department.
And some of the policy interactions at DEF CON over the past 30 years.
So, Jeff.
I didn't expect this many people to be interested in policy.
Thanks for coming early on a chaotic day after a flood.
So we want to just give you a little bit of an idea.
I'm sure Bo's been orienting you.
The big sort of picture is that DEF CON was doing policy without realizing we were doing policy.
And we thought we should probably be a little more intentional about that.
So it's sort of like that old saying that if you're not doing policy, it's being done to you.
And we think it's important that we have a seat at the table.
And if we're not at the table, we're going to be skeptical of the outcomes of the policy.
And over the years, a lot of informal interactions would happen between different policy makers, different governments.
And them trying to get an idea of what is going on.
And it turns out that our community's super power is basically speaking truth to power.
But also giving a more unbiased sort of third party perspective.
When you're here, you're not really working for your vendor.
You don't have to have your day job vendor perspective.
You can be a little bit more open.
And that turns out to be in short supply for people in policy.
Who generally get pitched information from trade shows, I mean trade groups and vendors and other private interests.
And they need information to balance it out.
They need another voice, civil society's voice, maybe not commercial America's voice, to give them another perspective.
And so that's one of the things we're trying to do, right?
Is build a countervailing force.
To be considered.
Over the years, when we would interact with law enforcement and say, no, no, they're misrepresenting.
This lock is very insecure.
Or don't worry about this safe cracking thing.
It's not feasible.
You can see the relief.
Oh my gosh, somebody told me what's really happening.
You know, the vendor would never tell me that.
Okay, great.
That's what I needed to know.
And building those bridges builds trust between our candidates.
And it's gotten to the point over the last five years, since we started doing policy more intentionally, that it's time to upscale it into these maiden stage talks that we've scheduled this year.
It's time to have a real department that Beau took the lead of this year.
Built an incredible team of goons.
And we're trying out a lot of new things this year.
And so your feedback is going to be very important for helping us correct and decide what we do next.
And did you talk about like the three tiers of kind of what we're doing?
No, not yet.
So we're trying three different tiers.
Why try one thing when we can try three things?
We're trying the main stage talks.
We're trying the policy village, where we dive in deeper on specific topics.
And this is where you can debate Section 320 or DMCA or whatever it is with experts.
And this is essentially a new track at DEF CON.
It's like a policy track.
And then in the evening, we want to facilitate off the record chat amongst you.
So you can have some house rules conversations.
So you can get a more honest assessment and not have to maybe do it so publicly.
And that's our evening program.
And we have some evening lounges, much smaller.
And last night we had our first, it was an invite, but we had our first policy dinner.
And so we hope to grow all of these in an environment where we can interact honestly.
And if you think it's for you, we want you involved.
And if it's for somebody else, please point them our direction.
We're going to be learning a lot.
And our goal is to grow the policy just like the rest of the CON has grown.
If there were villages, the original villages, hardware hacking village and Wi-Fi village,
the original villages have grown into over 30 something villages.
We're hoping to take the policy department and turn it into, there's a section over here talking about aviation security.
There's a think tank Atlantic Council doing a Cyber 912.
There's EFF talking about online privacy.
We want to create that kind of environment.
So it's not just our perspectives.
We're bringing other groups in.
And you can participate.
And so I think in the early days it was policy tourists coming in from D.C. wanting to see the crazy hackers
and kind of get a flavor of it.
But there was no real chance to have a substantial interaction.
And the hackers were like, oh, look, a policy maker.
Great.
But there was no real way for them to interact either.
But we survived those initial contacts without killing each other.
And so it's time to go a little deeper.
And that's what we're signifying by kicking this off.
So with that said, I'm going to pass it back over to Beau.
And we'll end up taking some of your questions.
And we really hope that you check out some of the policy.
And if you have ideas for workshops, hands-on, white papers, anything, where we can show what our community can do.
I guess let me leave one thought with you.
The voting village, when I said we accidentally ended up doing policy, the voting village was really the best shining example of this.
Again, no master strategy.
But what happened was after 2015.
And 2016, we decided to hack voting machines.
And they had never been available.
And nobody had hacked on them.
And there had been a storm, much like last night, that caved in the roof of a warehouse that was holding voting equipment for a county.
And it destroyed the voting equipment.
It got wet.
The insurance company wrote off the voting equipment.
And the insurance company, being green, shipped all the voting equipment.
Because they owned it now.
Shipped it to a re-PC recycler.
Recycler got all these pallets of voting machines.
And started trying to sell them.
And we found them on eBay.
And we're like, oh, my God.
And we started buying them.
The manufacturer caught on and contacted them and said, great, we want our voting machines back.
And the re-PC place was like, great, they're $200 each.
No, no, we want them for free.
You shouldn't have them.
You didn't sign the contract.
And he's like, whatever, they're $200.
They said, okay, well, you have to destroy them.
He's like, okay, well, it's $200 an hour to destroy them.
He's like, well, we don't want to pay.
And he's like, okay, well, they're for sale, $200.
Like, you know, how many pallets do you want?
And so we bought them, as many as we could.
And we got our hands on these machines.
And it just so happened the year before, the DMCA has an exemption that was added, had never been added before, for good faith security research.
So had that storm not happened, had the Library of Congress not put in a research exemption for critical infrastructure and specifically called out voting infrastructure, we would have not been able to hack those voting machines.
Just crazy coincidence.
We hacked the voting machines.
And in policy land, this was very controversial.
There were some interest groups that were pro-voting machine reform, pro-transparency.
They did not want us to vote.
They wanted us to hack the voting machines.
And they were trying to talk us out of it.
Because their concern was if we could not hack the voting machine, they could not argue that voting machines were unsafe.
So it was for them this litmus test, this existential threat.
If the hackers did not succeed, their whole lobbying effort would go away.
And they're like, whatever, we're hacking the machines.
The first machine fell in like three minutes.
And then 90 minutes.
And everything got taken over.
And I'm telling you, that group within minutes went from hiding in the back of the room to jumping in front of the TV cameras.
Now their whole point of existence was validated.
We got more done in the hacking village to advance awareness in that one weekend than their organization had in 15 years.
Once people see it and can touch it, it's like touching a hot plate.
You know it's hot.
Your mom told you it's hot.
But until you touch it and burn your finger, it doesn't count.
And what we're trying to figure out is how many other hot plates can we set up for people to touch so they can learn things very quickly.
We don't have to wait 15 years for people to believe them that maybe a voting machine is not safe.
We released a report for the voting village.
That ended up influencing a lot of different election counties.
I think Virginia was probably the most famous for us because they referenced our report when they changed back to paper marking devices, paper ballot marking devices.
And that's our shining example of what we want to try to accomplish.
It's not always going to happen, but I think that's the power of combining the two communities is that kind of change.
And then being a positive example for other conferences to copy what we're doing and really foster this relationship around the world.
So, okay, sorry I got sidetracked.
Take it away, Beau.
All right.
Thank you.
Thank you, Jeff.
All right.
So we'll go to our third and last person over there on the right to give their historical perspective.
I'll try to be quick because Jeff took up a lot of time.
I'm space rogue and some of you know me.
Like 25 years ago, I guess, in 1998, I was with a group called Loft Heavy Industries, a group of hackers out of Boston.
And we somehow ended up in front of what is now the Homeland Security Committee in Washington, D.C., testifying on weak computer security in government.
Space rogue.
There he is.
And so that was, I mean, up until that point, really the only policy that had happened was like CFAA and some other laws that had been passed.
And if you go back and you read the original CFAA, you can tell the people who wrote it did it so in basically a vacuum.
They had no control.
They had no concept of what was real and what was really going to make any difference.
That law has been amended several times since then, thank goodness.
It still needs work.
But anyway, so we went to Congress and we testified and we basically told them their pants were down around their ankles and the Internet was weak and everything was open and people just eyes opened up really wide and like, oh, my goodness.
But not a lot changed after that.
That was really my first foray into policy.
Yeah.
You know, over the years since then, I've been involved in various companies where we would do briefings on the Hill and talk to lawmakers in D.C.
And Beau was very instrumental in doing his hackers on the Hill where we would get a bunch of hackers together and go visit representatives and their staff and senators and their staff and try to discuss issues of the day and try to bring their knowledge level up.
Not so much for me.
Not so much as to actually write policy.
But so that when they do go to write their policies and pass their laws, that they do so with a little bit more knowledge.
I want to paraphrase something that D.T. said actually over at Black Hat.
That we have struggled for a long time as a community, as a group, as people who are trying to make the world safer and make the world a better place and trying to do that.
And we've started to do that.
We've started out trying to educate the user and say, hey, don't click stuff.
Right?
Or, you know, be wary of this e-mail.
And that has had limited success.
Right?
It really hasn't gone very far.
It's made some progress.
And so we sort of changed our focus and we went over to companies and we said, hey, you need to secure your stuff.
You need to work on this or that.
And by proxy with companies, we also relied on insurance companies.
Like, oh, insurance companies are going to have to pay out when there's a breach.
So they're going to force companies to be secure.
It hasn't really worked out the way we'd hoped either.
It's made some progress, again, like educating the user.
And then the third thing we've been relying on is legislation or regulation.
Not necessarily laws, but self-regulation, industry groups coming together.
And we've met with limited success with that.
So we sort of have a three-pronged area that we need to focus on to sort of get security to a point where the user is safe.
Educate the user.
Push companies and insurance companies.
And the policy.
Right?
Which is why we're here now.
Is to try to focus on policy, advance the narrative, educate the people who are writing the policies, and get to a point where things are safe.
Cool.
Thank you.
So obviously Jeff talked about his vision for the policy department and a little bit of the nuance that went into forming it.
But, you know, DEFCON has a long history of doing public policy, even before the voting system.
And that was a really good story that he told about how you accidentally change things in Washington.
But even at DEFCON 1, there were policy conversations that were going on.
There were legal conversations that were going on.
There were a lot of these same conversations.
And I think we kind of tend to forget that public policy is just a way to change the world.
And a lot of hackers really want to change the world.
I won't say hack the planet just for Space Rogue.
But hack the planet.
I really hate that.
And there's been a lot of other things.
How many people remember when they were members of Congress who came out to DEFCON?
Yeah.
So we've had many, many members of Congress come out to DEFCON and give talks, give sessions over in the crypto and privacy village or here on the main stage.
We had, I think, there have been five members of Congress now who have done that.
It's kind of epic.
We've also had high-ranking members of the government, the executive branch, come in.
And today on the same stage, the national cyber director, Chris Inglis, is going to be here.
And in case you don't know, the national cyber director's office was set up through a congressional act fueled by a report that a lot of hackers contributed to.
And a lot of people who are in this room helped advise and build that up.
We're also going to have director Jenny Stierle from CISA here on the stage.
She will also be talking about getting more hackers involved in public policy.
So I think it's kind of in our DNA at this point at DEFCON.
And so it only seems right that we should have an outward, more visible, more overt and planned response to it.
But it's not just about me.
It's not just about the folks on the stage now.
But we've got a really, really, really talented policy department team.
And I wanted to bring some of them up now to talk about some of their experiences, what got them into public policy, why they think you're going to get something out of these sessions.
And hopefully inspire you to come out and participate in some of the public policy discussions that we're having.
Which is over in rooms 224 through 226, the policy department on your map.
So I'd like to introduce some of the amazing policy team.
There are many others in the policy team who are holding down the fort over at the policy department or waiting for their shifts to start.
And so I want to give each of these folks a couple of minutes to introduce themselves and give you some perspective.
And then we'll have a few minutes to take questions.
So.
Jenny, do you want to come up?
Hi, y'all.
I'm Mosfet.
I've been coming to DEF CON for just over a decade.
For as long as I've been a hacker.
I was a hardware hacker.
I was a packet hacker.
And now I'm a policy hacker.
A few years ago in pre-pandemic times, I had the opportunity to jump into the deep end.
Of policy making.
Not knowing anything about cyber policy.
I earned a spot in a fellowship called Tech Congress.
Uprooted my life.
Quit my day job.
And moved to DC.
After a two-week crash course, I went to work for Congress.
On day one, my hacker friends informed me to my existential dread that I was now a Fed.
But.
It didn't take long.
I was hooked.
Public policy.
The laws and the regulations that governments all over the world were making.
Played such a big role in my hacker job.
And in my life.
And I had no idea.
So DEF CON policy, for me, is here so you don't have to be me.
You don't have to jump in the deep end.
You don't have to quit your day job.
You can come to our talks and come to our village and interface with those policy makers.
And, you know, learn a little more about how public policy might change your life.
And how it might be affecting your job.
And how you can change it.
And how you can influence it.
We can help you make those discussions.
And get in the conversation.
And if you want to quit your day job and come to Congress, we can talk, too.
Thanks.
Hello, everyone.
My mask is stuck on my earring.
My name is Sarah Pawczyk.
It's really nice to meet you all.
And I want to say that we absolutely cannot make good policy without you all.
In fact, good, impactful, thoughtful policy about cybersecurity is only possible if we have the folks who are actually doing the day-to-day work integrally involved in that process.
And that is why it is so, so important that you all are here interested in policy coming to our talks.
I got my start in policy helping a group of cyber practitioners put together recommendations on how to combat ransomware.
As a nation.
And I think that having a group of practitioners there made an incredible difference in the sorts of proposals that we actually ended up putting out.
We had a whole section of the report that we put out that was only focused on helping organizations improve their cybersecurity maturity.
Giving them funding.
Creating funds to help them with response if they're attacked.
And I think that that victim-centric viewpoint is something unique to the hacker community.
That spends, you know, day in, day out actually helping folks recover and defend themselves against these attackers.
And that was having those folks in the room absolutely changed the course of the sorts of proposals that we put out.
Folks also strayed away from recommending punitive measures.
We were much more focused on attacking the threat actors through sanctions.
Attacking cryptocurrency launderers.
And focusing on positive incentives for organizations and for individuals.
Tying funding to improving cybersecurity maturity.
And absolutely all of that is due to the fact that we had folks who were on the ground coming into these discussions and saying no.
We need to make sure that people have the resources that they need.
The education that they need.
And that's the sort of voice that you folks bring to public policy.
It is absolutely crucial.
We have a bunch of big problems coming up.
Ransomware is one of them.
Protecting critical infrastructure.
Securing our elections.
And I would say that there isn't a right policy solution for those problems.
But there's absolutely a right process to create that policy.
And that process is one where you are all at the table.
So I really hope you'll join us at the public policy talks in the policy village.
And in track two today.
Again, it's Sarah Powazik.
It's really nice to meet you all.
And I'll give it up for Harley.
Hi, everybody.
I hope that you're having a great time.
Thanks very much for coming.
So my name is Harley.
And I am a cybersecurity attorney.
I've been working in cybersecurity law and technology policy for several years.
I'm a former congressional staffer.
And now I'm the senior public policy director at a cybersecurity company called Rapid7.
I wanted to get into policy because I wanted to help people.
I wanted to protect consumers and advance human rights.
And cybersecurity is consumer protection.
Hacker rights are human rights.
What the security community does in finding vulnerabilities that can then be fixed protects everybody in society, especially the most vulnerable among us, right, to consumers, vulnerable populations, dissidents, users, including enterprises and everybody else.
It's really important.
And it's never really been a better time to be a hacker interested in policy than right now.
The barriers to getting your input to government have arguably never been lightened.
And I'll just give you an example.
Just yesterday the Federal Trade Commission put out a call for public comments on privacy, data security, and commercial surveillance.
They would love to hear from a community like this that has an outside D.C. perspective and a lot of technical savvy.
Government really does want to hear what you are saying.
And there's lots of activity like this on cybersecurity policy happening within government right now.
They get that it's a problem.
And they're trying to figure out how to fix it.
And they need your input.
And I know that this community has a lot of valuable input that they can provide to government.
I think, though, that often what becomes a challenge is understanding where to comment, to whom should the comments be sent, how to have the most impact, what sort of format and that kind of thing.
And that is part of what DEF CON policy is here to help solve, right?
So to help build that connective tissue by bringing in policymakers to the hacker community.
Bringing hackers to policymakers.
And identifying those venues for collaboration so that policy going forward has your input and it makes us all more secure.
Thank you all very much.
Good morning, everybody.
My name is Will Loomis.
And I am the associate director of the cyber policy program at a D.C. think tank called the Atlantic Council.
I've been working on cyber policy issues for about five years now.
And one thing that I've seen.
Over the course of the last two or three years is a serious increase in momentum when it comes to policy making around infosec and cyber security issues.
I think we've seen a couple of really high profile incidents in the last couple years.
Stuff like solar winds, colonial pipeline and log 4J that have really functioned as the proverbial kick in the ass needed to get kind of action going within government here.
And, you know, right now these folks within government are writing the legislation and the policy around infosec and cyber security.
Issues that will really kind of manage the way that we deal with these issues over the course of the next decade.
And I'm really, really, really, really strongly believe that hackers need to be a part of that conversation.
And that's really why I got involved with DEF CON policy this year.
So just quickly, I think DEF CON policy is really trying to do three main things at least to me.
The first is lowering barriers to entry to these types of government folks and making it easier to have these conversations.
The second is really working to.
To translate both to make sure that hackers can understand policy makers and vice versa.
And the third is just making sure that we're establishing meaningful connections and building communities around these issues.
These can't be one off conversations.
They need to be sustained to make sure that we're making the right types of changes and conversations here.
So we have a lot of really good content going over the next three days at the DEF CON policy village.
Some talks that are focused more on specific substantive issues.
Like open source software, supply chain security.
And others that are kind of more focused on that building relationships bit.
Like the meet ONCD and meet cyber security and infrastructure security agency sessions that Bo was talking a little bit about earlier.
So really encourage you all to stop by over the course of the next three days.
We've got a lot of really good programming that we're really excited about and hope you guys enjoy it too.
Thanks, y'all.
Thanks, Will.
Hi, I'm Doug Duck.
My voice hopefully will come back by the end of CON if I don't shout and make a hole too much.
I have a bunch of stuff I wrote down here.
I think a lot of it's been covered.
But really what I'm here to do is to call out to the hacker family here.
I know many of you, most of you perhaps, want to make a difference like we were saying.
You want to make the world better.
You want to make it safer.
Make it more secure.
And if you don't engage with the right aspects.
Of security, you're not going to get security.
If you're at a corporation, you talk about securing the systems.
And I think we all know at this point that it's also the human factor.
It's also security awareness.
When it comes to policy, when it comes to the statutory restrictions and the legislation,
the regulatory environment, that has gotten more and more complex and more burdensome over the last three decades.
And I've been involved in it longer than that.
And I am concerned that if you don't engage and we don't engage, then you're not going to get what you want out of it.
Not because the folks involved in that are not well intentioned, but because they need to hear additional perspectives.
And we have a lot of potential to make huge, huge positive impact.
We also have a lot of potential with some of those burdens.
That are imposed on companies, on people, on communities.
We have a lot of potential to make things worse.
And we want to make sure that we are articulating the right approaches that are going to allow for a risk-based solution.
That are going to allow for nimble solutions.
So I would encourage you, if you are sitting there and saying, maybe in your hotel room, listening on DCTV.
Because I know a lot of people are saying, oh my goodness.
There's flooding.
There's hangovers.
Whatever.
You're not here right now.
Come over to the Policy Village.
Have a chat.
Listen in.
I think you're going to like what you see.
Welcome to DEF CON.
Thank you.
And we've got a few minutes left for questions.
I don't see any mics.
But if we've got mics and mic runners, I'm sure they're coming around.
But while we wait on people to generate them from the audience.
Maybe I'll just throw a couple of questions into the folks here on my right.
So as folks who went into public policy, before that you were kind of in the hacking community.
What was your kind of emotional journey the first time you talked to a policy person?
It was like, oh, they don't get it.
I need to help.
Or maybe the opposite.
Fear.
Yeah.
I mean, the first time, that was probably one of the very first times I'd ever been publicly speaking.
So in 1998 is a long time ago.
It was definitely fear.
And if you ever watched the C-SPAN video, you can see I'm looking at the floor.
More recently, I think it's a feeling of education or trying to communicate what is real.
Or the truth on the ground, the facts of the case.
And trying to make sure that they understand your point of view.
And that's the hardest part for me.
I'll get in a room with a staffer or a policy person and we're having a discussion.
And I'm explaining whatever I think is going on.
And I'm trying to gauge their reaction on their face as to whether or not they actually get it or not.
And sometimes I get that glimmer in their eyes.
Like, oh, this guy understands.
And sometimes I don't get that.
And sometimes I get, oh, this guy has no clue what's going on.
Or gal, excuse me.
So it's a...
That's the feeling that I get anyway.
I don't know if anybody else wants to...
I'd say the first feeling I had was of frustration.
Because I had seen these problems out there.
There would be ways to fix them.
But clearly something wasn't working.
And...
So I wanted to know kind of why this had happened and what we could do to make it better.
I would echo a lot of Space Rogue's points that this really is...
You need to be persistent.
Because policymakers want to learn.
They want to know how to do this right.
And over time you can help them learn.
But it's not going to change overnight.
It's a process that has taken years, decades for us to even get to the point we are today.
And there's still a lot of room to go.
So have patience.
But know that policymakers and hackers share the same goal of wanting to make progress.
And we will get there even if it is slow.
And two things to ask your patience for.
People that are in policy, we tend to say two relatively douchey things.
And thank you for putting up with them.
One is we tend to say cyber a lot.
And thank you for your patience on that issue.
It's a DC thing.
We also tend to say we're speaking on our own capacity and not any kind of official job.
And speaking as a person.
So thanks for letting us get that out of the way.
And one of the things that really struck me, I was a veteran.
So I came up kind of dealing with policy as a little bit more of a natural thing.
I got started in doing this work at the Pentagon helping set up the very first joint cyber command back in the 90s.
And what really struck me, because not long after that I was at the White House
working these issues.
And it really struck me at how much the government folks thought what they did really mattered into this space.
That we were going to solve this by setting up some new office and hiring a couple of civil servants
to do something that I knew the private sector and the hacker community were already doing
and had been doing for years.
And so that's a lot of where I'm in on, and I'm dealing with policy makers now,
to say I hate sports analogies.
I'm like, look, there's a lot of players on the field.
And generally it's going to be a hacker.
It's going to be someone at a tech company, at an information security company
that's in the position to most make the play.
And so that's one of the things I really think that they need some help with, too.
There's a lot of other people that can help.
One other point.
You mentioned frustration.
This is a long process.
I mean, I've been doing this for 25 years.
And the needle has moved.
But you can't jump in.
You can't jump in doing policy work and thinking you're going to solve everything next week,
because that is not going to happen.
So, yeah.
And everybody agrees.
Cool.
Anybody on the policy department team want to answer the same question?
Like Space Rogue said, it was definitely a process,
because I was only there for a year and a half.
But everybody, the first time I spoke to a policy maker
about a cyber issue, why TikTok is a national security issue,
you know, I realized I needed to learn from them who CFIUS was.
I had as much to learn from them as they had to learn from the community.
And the optimism of all the policy makers to make a difference,
to move that needle, even if it's a little bit at a time,
was just off the charts.
Off the charts.
How much they wanted to help.
And so this engagement is wanted and needed,
and we can learn as much from them as they can from us.
So I have maybe a little bit of a different perspective
insofar as I'm not coming at policy as an outsider.
I'm coming at it as an insider.
This is my career, is public policy and living in D.C.
and talking to policy makers.
And my experience has been largely positive.
They've been actually very receptive.
And there are a lot of ways that you can communicate your input to government.
It is not just that there is a lack of technical understanding.
In some cases, you will be surprised by how well they actually understand technology.
And you may be surprised that government is already trying to solve certain problems.
If you do try to communicate your input to government,
I do encourage you to try to look into what government may already be doing about that.
It's important not to just appreciate a problem,
right?
We ask our government officials to solve problems,
and that is actually a much higher level of advocacy than just identifying a problem.
So bringing to them your thoughts on a workable solution.
It doesn't have to be very polished,
but it actually really advances the ball quite a lot.
And then there is one other sort of uncomfortable truth in all of this,
which is, again, not just a lack of technical understanding,
but there will be lobbying groups and parties from, you know,
like corporations,
or from interest groups,
things like that,
that may disagree with your position and run interference.
Don't underestimate the power of that to sort of stall things out
and drag things and problems and solutions out a lot longer than you may anticipate.
It's a very profound influence.
Cool.
All right.
I saw at least one hand over here.
Yes, sir.
I love the idea.
I think it's great.
A lot of us have been doing policy work
in sort of the commercial industrial world for many years,
like many of you.
One of the things I think,
I listen to this Augusta group.
It's fantastic.
And my question is really about,
are you really woke?
Right?
So I hear a lot of you ask.
Yes.
I know.
My friends are traveling in the room.
There's Singapore, UK.
Great point.
And they're doing some incredible stuff as well.
And I think, you know,
to your other point about we all need to work together
and look at other people's work,
I mean,
we're seeing some of this in GDPR last years.
Now in cyber security,
we've got a number of bad things that are happening in Europe.
How are we in depth on taking a more global perspective,
not just the US,
but global perspective?
Yeah.
I'll just repeat the question
and then add a short thing and then throw it open.
So the question was,
a lot of people have been doing policy for a long time,
which I think is awesome.
Thank you.
And a lot of the accidents we've had
on stage here are gringos or Americans.
So what are we doing at DEFCON as well as beyond
to make things more global?
And I'll say this year has been very challenging
for DEFCON in particular because,
you know,
we're still in the aftermath of COVID
and some of the travel restrictions and costs
and everything else.
But we actually do have quite a few folks.
We've got a panel coming up today later
that is an international panel
that has Singapore and UK,
which we've represented.
And we've tried to weave in international perspectives
where we can.
Some of the conversations over in the policy department
are very internationally focused.
So we're trying.
We would love to have more help getting better
at being more international
and maybe bringing the message of DEFCON more broadly
and bringing more international folks here.
So for the rest of the group.
Yeah.
I'll just add that on the,
so I'm on the CFP review board.
So in the people,
that's submit talks through the main process
rather than through the DEFCON.
It comes up a lot also for Black Hat.
I'm on the Black Hat policy
and it comes up a lot of just trying to make sure
that we're not just picking the,
you know,
the US stuff.
It's really difficult.
We're not always getting the talk submitted,
but thanks for helping keep our attention to it.
And so appreciate it.
All right.
I see one way over there.
Can you hear me?
Yes.
I'm curious about
the panel's perspective on the question of policy
and also regulations?
Should it be restricted in terms of the types of controls
that be used?
Or should it be ordered in foiach terms
in this address in the process?
So, for example,
should policy mandate pass words
or a multi-battern application?
OK.
So just repeat the question
and then throw it to the group.
How prescriptive versus descriptive should policies be,
be, for instance, mandating multi-factor authentication?
So I can start with taking a crack at that.
I think that, and especially when we're thinking of,
for instance, law, we have to keep in mind
that something we write today is going
to apply 10 years from now.
And we have to make sure that what we do doesn't lead
to unintended consequences.
So multi-factor authentication might be a best practice
today.
We don't know if it'll be a best practice 10 years from now.
So I think this is very similar in a lot of ways
to what we're seeing with security compliance, where
we don't want to just make something
where it's check off these boxes, and then you're secure.
Because as everyone in this room knows,
compliance doesn't actually equate to security.
So I think it's a very similar model with policy,
where we want to think about what
are the goals we can set out that get us
to where we want to be without having
to be over-prescriptive, without having
to overreact.
And so I think it's a very similar model
to kind of, say, codify these X controls.
But rather, what is the end state?
And then can there be a flexible approach to get there?
Oh, please.
Yes.
Oh, no.
Please, go ahead, Harley.
So the question of whether regulation
should be prescriptive or just very flexible
is actually a perennial problem in DC policy making.
And you see this endlessly battled on both sides.
There's reasons why the process gets drawn out,
as we've discussed.
I think that there is a move now towards more risk-based
regulation, recognizing that one enterprise's risks
or one community's risks are not the same as another.
The problem there, though, is that sometimes it
is easier to fudge enforcement on risk-based security.
And so I think we're also seeing a bit of a movement
towards some minimum baselines.
So that you actually have to do sort of this minimum baseline,
if you want to, to address your risk.
But the rest of it is a process of identifying your risk
and having safeguards around it.
Most of the new regulations around safeguards
seem to be built that way.
But it also depends on what you're trying to address.
So things like incident reporting tend
to be a lot more prescriptive and less risk-based.
So I think it's both.
I think it's a hybrid.
And I think, to that last point,
it's precisely for that reason that we
need you in the conversation.
Because just because there's a lot of folks in the room
that think they're very, very smart hackers
doesn't mean you're always right.
But it does mean that if you listen
to the other side of the equation
and we think about the consequences,
both intended and unintended, we're
going to likely get a better outcome.
And I'll just say, the very first,
as far as we know in the world, national policy document that
really tackled this was 1990, especially
for a critical infrastructure protection,
was 1998, is from the Clinton administration.
And it said, we don't want to regulate,
but if market forces aren't obviously
solving the problem, we might need to.
So that was almost 25 years ago that we came up with that.
And so we're still here.
We're at DEFCON 30, and we know the problems haven't been
solved.
And I think you'll see a difference
between existing regulation.
We've got a ton of regulation.
The finance sector, the energy sector, a lot of them
are already heavily regulated.
You've got things like the SEC going to publicly traded
companies.
So hope that if you do see regulation,
it's going to be locking in and looking
at these different areas.
And especially, it's great to see the frameworks that
are coming out.
Like, the NIST cybersecurity framework is not a regulation.
But boy, it's really helped drive a lot of positive change.
All right.
Yes, over here.
I have a question about, because I was excited yesterday,
it doesn't require MFA, but it's sort of said to ask MFA,
may it be legal?
I think I'm talking to someone else.
I don't know if you're ready to cover that.
I also have a question for the whole panel.
If you could go one by one, your favorite,
female or non-binary or trans, half and half.
Before we do that, for those who didn't hear,
you said tomorrow, 4 PM, or today?
Sorry, today, 4 PM.
Today?
4 PM.
4 PM.
Crypto Privacy Village talking about MFA.
OK.
You want to start?
My favorite female or non-binary hacker,
can I give you three?
Bia, Katie Moe, and Window.
Still one of mine there.
I'll go with Jenny Easterly.
I think Director Easterly has done a great job kind of taking
the helms at CISA.
And yeah, looking forward to see where she continues it.
Sorry, Jenny Easterly.
And I'll add Amelie Curran to that,
especially because Bo and I have done a lot of work
on Hacker Film Festival called D-Frag.
And the knowledge that Amelie brings of hacking
and of just so many other awesome nerdy stuff,
like soundtracks, fabulous.
Yeah, a couple of mine also got stolen,
but that's great.
I'd say Alyssa Knight is another one who's awesome.
And I'll go with maybe a non-member of CISA.
She's a really unconventional one.
I really like Jen Ellis.
She's not a hacker herself, but comes from the hacker community
and has done a lot to really advance public policy
and to bridge those gaps as well.
Anybody up there?
Hey, I'm going to go for Grace Hopper.
I know that's an old one, but she was freaking awesome.
I'll give you three.
I think Grace Hopper is great.
Katie Moussouris and Emily Velasco.
I'm also going to cheat and do two.
I'll say Amelie Curran and Katie Hegemon.
Me.
Yay!
But my hero is Dr. Laurie Cranor.
A pastored researcher at Carnegie Mellon.
All right.
I saw another hand.
Here's one.
Hi.
So I work in policy.
I used to go to work in Congress or, you know,
a conference.
And it would have been very frustrating
and times.
Would I stick with it?
Yes.
But, you know, I'm friends with many people.
You know, they just don't think about the policy
because they're afraid of what we do.
And they're so interested in different crafts.
And, you know, how do you get people like that
to provide their input knowing that
I have to stick with it, right?
Because it isn't going to be easy.
And we're willing to convince them
that it is worth their time
and that it could, you know, help them.
Great question.
So the question for the cameras is
there's a lot of really good technical people in here.
How do you convince them to get started
talking with policy folks and stay with it
since it can be a long, drawn-out process?
A lot of it is getting to know the staffers, right?
A lot of times you're working with a member of Congress
or your local equivalent.
Like, do this thing at your city council.
Do this for your town or your village.
Do this for your legislature,
for your state or your region.
The attention of the policymaker is going to drift, right?
If something happens that day, right,
they're not going to have your attention.
It's really the staffers, like Harley had mentioned,
like Moss Fed have been helping,
that they are there year in, year out,
and they need to know to ask the right questions.
And so I think staying in with them.
And I always try and tell myself, like,
please have, you know, to help you on the patience, right?
I always, I suck at billiards, right?
And so whenever I'm playing pool with a buddy,
my job is just to get the ball a little bit closer to the hole.
Because if I actually try and hit it in the hole,
I'm never going to get it.
And it's just going to ricochet off.
So, like, just trying those half measures
and being happy with a half measure
that the ball is a little bit closer to the pocket
and then a little bit closer after that.
And then the third time, I'm hopefully going to be able to sink it.
If you go in thinking, I'm going to just roll in,
and we're just going to get this done in one,
it's almost never going to happen,
unless you get really lucky, right?
Sometimes at that political moment,
like we had this report called the Cyberspace Hilarion Commission,
the political moment was there,
and shit just lined up and it happened.
So when you have those moments,
be ready for them, right?
When we have the bad thing happen,
as always does, right,
and you have the attention of these policymakers,
that's when you need to be ready with your ideas
so that you can come in and say,
here's what we need to do,
rather than beating them up with,
we told you this is what was going to happen.
Yeah, and I'll say,
I helped organize an initiative called I Am the Cavalry as well,
and one of the things that we found was the most effective
at bridging the gap,
and I think is actually really helpful
for encouraging people to stick with it,
is starting with, like, building empathy.
Right?
Get to understand the person,
why they're doing something.
For me anyways,
it's a lot more interesting,
keeps me a lot more encouraged to go back
if I understand their motivations,
if I understand them as a human being,
and it gives me a lot more patience
to be able to stick with them,
to work with them,
to know what they're going through.
So maybe just start with,
with not just diving into the technical content
or the policy content,
but hear what's going on,
and understand what they're trying to achieve
with either the particular thing they're working on,
or overall as a longer-term career goal or life goal.
I would just add super quickly
that I think where we see, like,
some of the most tangible effects
is where we kind of create either programs or venues
to really foster these types of conversations
and bring both the policy and the tech folks together.
So whether it's I Am the Cavalry,
whether it's DEF CON Policy,
whether it's programs like Tech Congress,
or Hackers on the Hill,
you know, these are the types of kind of venues and opportunities
where we can really have these meaningful conversations
that can help drive impact.
So wherever we can create more of these types of opportunities,
programs, events,
that's really, really increasing the opportunities
for these types of things to happen and manifest.
And just on the global side,
since a lot of this is just digital piece now, right?
So if you're interested in this digital piece now
as kind of a youth movement to say,
we need to do better on these,
and they can use a lot of tech expertise,
and it is a global movement.
All right.
So we got the five-minute sign a few minutes ago.
So unfortunately,
I think we're not going to be able to take any more questions.
But I've got a question for you.
How many of you are going to come and see us
at the Policy Department today, tomorrow, or Sunday?
All right.
Thank you, everybody.
Let's continue the conversation over there.
What's that?
Oh, yeah.
Follow at DEF CON Policy on Twitter.
We're trying to get to 1,000 by the end of CON.
So you can help us make that happen.
Thank you very much.
Thanks, everyone.