1
00:00:00,000 --> 00:00:04,920
While you guys are here, right, we'll give some shout outs. We have, um, anyone in a

2
00:00:04,920 --> 00:00:12,400
DEF CON group? DCG? From local area code? Okay, well this one is gonna happen then. Please go

3
00:00:12,400 --> 00:00:19,760
and check out DCG room. These are all DEF CON groups. DEF CON is year round. We have to plan

4
00:00:19,760 --> 00:00:26,480
year round also, but like, we can do great things, right? DCG, 305, go Miami. Um, so yeah,

5
00:00:26,480 --> 00:00:32,440
like, you know, go there after, get inspired. Um, if you guys are new, the room over here is

6
00:00:32,440 --> 00:00:36,180
the LHC room. They were out partying a little bit last night, so there's nobody in there right

7
00:00:36,180 --> 00:00:42,540
now, but, you know, things happen in Vegas. Um, also, we do have a bar over there, um, you

8
00:00:42,540 --> 00:00:47,260
know, so if anyone is needing a refreshment or what not, we have that. Um, if anyone needs the

9
00:00:47,260 --> 00:00:53,600
bathrooms, they're gonna be right over there, just kind of as a heads up. Um, and then also, um,

10
00:00:55,080 --> 00:00:56,460
as we're getting older, we're gonna have a bar over there. Um, we're gonna have a bar over there.

11
00:00:56,480 --> 00:01:01,800
Right? Some of, we've lost a few great hackers this year. Um, there is a memorial room, right?

12
00:01:01,900 --> 00:01:06,440
So if, you know, you want a place that's quiet to reflect and what not, um, that's also there, and

13
00:01:06,440 --> 00:01:11,440
it, it's just a really fabulous spot for just healing, and it's also a good spot, just quiet

14
00:01:11,440 --> 00:01:21,500
and, um, after our, uh, after our, uh, discussion and our, our talk, right, there'll be a question

15
00:01:21,500 --> 00:01:25,180
answer period. We're gonna go over there in one of the rooms, so that way it's a, a more intimate

16
00:01:25,180 --> 00:01:30,140
environment, and if you have any questions and answers, um, for any of the folks up here, so we'll

17
00:01:30,140 --> 00:01:37,280
let you guys know which room, um, is gonna be that. Um, and so, yeah, in the next, uh, minute or so,

18
00:01:37,360 --> 00:01:42,160
we'll, we'll get started. So thank you guys all for coming and, um, waking up early. I know that

19
00:01:42,580 --> 00:01:45,820
might have been a challenge for some of you, and for those who haven't gotten to sleep, this is gonna

20
00:01:45,820 --> 00:01:50,780
be a great talk, and then, you know, then you guys can get some shut eye. So, thank you very much,

21
00:01:50,840 --> 00:01:53,340
and we'll wait. Let's start one time.

22
00:01:53,340 --> 00:01:58,920
Yeah, let's get started. Hey guys, how's it going? All right, come on, let's wake up.

23
00:01:59,560 --> 00:02:06,940
Come on, cheer up, come on, you made it to DefCon. So this is our thirty-first, thirty-first

24
00:02:06,940 --> 00:02:12,440
year of DefCon. Um, thank you for coming. It all works out because of you guys showing up and

25
00:02:12,440 --> 00:02:16,980
spreading the word, and make sure that everyone's, like, gets excited about learning about what

26
00:02:16,980 --> 00:02:23,140
DefCon is, not just a pack of hackers, and doing crazy stuff, but it's more about the community, and, uh,

27
00:02:23,340 --> 00:02:28,180
and the most important thing is talking about, um, how much work it takes to make everything look

28
00:02:28,180 --> 00:02:34,640
kinda simple and working. Um, and, you know, thanks to these guys, it's something that, uh, we all

29
00:02:34,640 --> 00:02:40,520
should, like, you know, remember. Um, so this is our first talk today, uh, for, this is track five,

30
00:02:40,940 --> 00:02:48,880
uh, it's called A Different Uber Postmortem by Joe Sullivan, um, and, uh, enjoy it.

31
00:02:50,480 --> 00:02:51,180
Welcome, Joe.

32
00:02:56,840 --> 00:03:03,180
Hey, everyone. Uh, my name's Joe Sullivan. I'm currently the CEO of a non-profit, um, but for most of my

33
00:03:03,180 --> 00:03:10,020
career, I've worked in cyber security, like a lot of you, um, and I'm gonna walk you through an experience

34
00:03:10,020 --> 00:03:15,100
I've been going through probably since when I started thinking about it, the beginning of my career, that's

35
00:03:15,100 --> 00:03:21,720
still going on. Um, when I, um, had the chance to be the CSO of some really big companies, one of the

36
00:03:21,720 --> 00:03:23,320
things that I came to realize was that, you know, there's a lot of people out there that, you know,

37
00:03:23,340 --> 00:03:29,020
really appreciate is that you can't do security on your own. It has to be a, I think of it as really a

38
00:03:29,020 --> 00:03:35,320
three-legged stool. Like, there's the commitment that you make inside your organization, but you have to

39
00:03:35,320 --> 00:03:40,940
partner with the government also. And then the third thing that a lot of people don't understand is the

40
00:03:40,940 --> 00:03:49,260
importance of partnering with researchers. Um, so I've had a lot of opportunities to talk with security

41
00:03:49,260 --> 00:03:50,740
leaders about my case.

42
00:03:51,260 --> 00:03:53,240
They often reach out to me when they are

43
00:03:54,120 --> 00:03:55,320
getting nervous because they

44
00:03:55,320 --> 00:03:56,960
have a bunch of lawyers showing up to their meetings,

45
00:03:57,760 --> 00:03:59,260
or they're getting together in kind of

46
00:03:59,260 --> 00:04:01,340
closed rooms. And so I've had

47
00:04:01,340 --> 00:04:03,180
a lot of chances to talk with security leaders

48
00:04:03,180 --> 00:04:05,340
about what my case might mean

49
00:04:05,340 --> 00:04:07,280
for them, and how they

50
00:04:07,280 --> 00:04:09,180
could set up their organization, their company, and their

51
00:04:09,180 --> 00:04:11,400
relationships with government to be better

52
00:04:11,400 --> 00:04:13,280
so that what happened to me doesn't

53
00:04:13,280 --> 00:04:15,120
happen to them. But

54
00:04:15,120 --> 00:04:17,160
as I was thinking about it, there was one

55
00:04:17,160 --> 00:04:18,520
story and perspective that

56
00:04:19,560 --> 00:04:21,300
I don't think got enough attention, and so

57
00:04:21,300 --> 00:04:22,640
that's why I asked to do this talk.

58
00:04:23,340 --> 00:04:25,300
And that's the perspective of the security research

59
00:04:25,300 --> 00:04:27,140
community. And so I'm going to kind of

60
00:04:27,140 --> 00:04:29,280
look at this case, not

61
00:04:29,280 --> 00:04:31,200
from my perspective, but from

62
00:04:31,200 --> 00:04:32,880
maybe the perspective of an outside researcher.

63
00:04:33,780 --> 00:04:35,200
And thinking about it, not

64
00:04:35,200 --> 00:04:37,460
just in terms of this case, but what it means for the future.

65
00:04:37,740 --> 00:04:39,200
Because legal cases are always

66
00:04:39,200 --> 00:04:39,880
about precedent.

67
00:04:41,180 --> 00:04:43,100
Um, one note as I'm getting started,

68
00:04:43,740 --> 00:04:44,180
um,

69
00:04:45,120 --> 00:04:46,380
I'm appealing my case,

70
00:04:47,160 --> 00:04:48,660
so the case is still going on,

71
00:04:48,820 --> 00:04:51,160
which limits what I can say in some contexts.

72
00:04:52,280 --> 00:04:53,140
Also, I was an

73
00:04:53,340 --> 00:04:55,120
employee of Uber during

74
00:04:55,120 --> 00:04:57,360
the whole time that the incident transpired,

75
00:04:57,480 --> 00:04:59,160
and so I had an employment contract

76
00:04:59,160 --> 00:05:01,260
and an NDA and all that, so I'm limited

77
00:05:01,260 --> 00:05:03,460
to what I can talk about from that perspective

78
00:05:03,460 --> 00:05:03,880
as well.

79
00:05:05,820 --> 00:05:06,620
Um, so

80
00:05:07,060 --> 00:05:09,340
when I talk about the case, I'm only going to reference

81
00:05:09,340 --> 00:05:11,180
what's in the public record, and

82
00:05:11,180 --> 00:05:13,360
if you hear me talk about something, it's from the perspective

83
00:05:13,360 --> 00:05:15,080
of what I saw sitting in the courtroom,

84
00:05:16,080 --> 00:05:16,480
not

85
00:05:16,980 --> 00:05:18,920
from what I saw inside the company.

86
00:05:22,200 --> 00:05:22,980
So, uh,

87
00:05:25,000 --> 00:05:25,440
I've

88
00:05:25,440 --> 00:05:27,100
been working in computer security

89
00:05:27,100 --> 00:05:29,320
since 1997. I was actually

90
00:05:29,320 --> 00:05:30,980
a federal prosecutor here in Las Vegas,

91
00:05:31,800 --> 00:05:33,340
and I was asked to

92
00:05:33,340 --> 00:05:35,540
become a cybercrime focused prosecutor

93
00:05:35,540 --> 00:05:36,340
while living here.

94
00:05:37,020 --> 00:05:38,560
And of course, that was in the first

95
00:05:39,400 --> 00:05:41,220
few years where DEFCON was starting

96
00:05:41,220 --> 00:05:42,360
to pick up, and that might have been

97
00:05:43,180 --> 00:05:44,940
one of my first DEFCON experiences,

98
00:05:45,820 --> 00:05:47,280
and I might not have been spotted

99
00:05:47,280 --> 00:05:47,780
as a Fed.

100
00:05:49,020 --> 00:05:51,420
Um, but I got to know a lot

101
00:05:51,420 --> 00:05:53,280
about the security community

102
00:05:53,340 --> 00:05:55,300
by coming here and thinking

103
00:05:55,300 --> 00:05:57,320
about the different perspectives, and that's when I started

104
00:05:57,320 --> 00:05:58,800
thinking about, um,

105
00:06:00,000 --> 00:06:01,240
the research perspective

106
00:06:01,240 --> 00:06:03,280
on working with us. And so I'm going

107
00:06:03,280 --> 00:06:05,180
to touch on a lot of that as I go through this.

108
00:06:05,640 --> 00:06:07,320
But each of these stops

109
00:06:07,960 --> 00:06:09,180
kind of taught me a lesson

110
00:06:09,180 --> 00:06:11,420
that led to some of the things that happened in this case.

111
00:06:14,260 --> 00:06:15,300
But the case for me

112
00:06:15,300 --> 00:06:17,220
really got started, uh, it was in November

113
00:06:17,220 --> 00:06:18,100
of 2017.

114
00:06:19,260 --> 00:06:21,420
I got an email, my personal email

115
00:06:21,420 --> 00:06:22,200
from a reporter,

116
00:06:23,340 --> 00:06:25,120
asking me to go on the record about

117
00:06:25,120 --> 00:06:27,300
me being fired from Uber.

118
00:06:27,820 --> 00:06:28,260
And

119
00:06:28,960 --> 00:06:31,200
I think I hadn't even been fired

120
00:06:31,200 --> 00:06:32,920
when the reporter reached out to me.

121
00:06:33,580 --> 00:06:35,160
It's kind of like, it was a really

122
00:06:35,160 --> 00:06:37,400
strange situation where I was learning as much from

123
00:06:38,120 --> 00:06:39,220
Bloomberg as I was learning

124
00:06:39,220 --> 00:06:40,480
from my company,

125
00:06:40,620 --> 00:06:43,300
or ex-company, depending on whatever

126
00:06:43,300 --> 00:06:44,460
moment that day it was.

127
00:06:45,000 --> 00:06:46,520
And I was up in the mountains,

128
00:06:46,680 --> 00:06:49,280
it was Thanksgiving week, I was on vacation

129
00:06:49,280 --> 00:06:51,360
with my family, I was actually in a grocery store,

130
00:06:51,480 --> 00:06:53,260
we were getting food for Thanksgiving,

131
00:06:53,340 --> 00:06:54,680
and I got

132
00:06:55,160 --> 00:06:56,020
kind of these messages.

133
00:06:57,080 --> 00:06:58,100
And I was like, this

134
00:06:58,980 --> 00:07:00,280
must be a big misunderstanding.

135
00:07:01,260 --> 00:07:02,980
I went out, uh, hiking

136
00:07:02,980 --> 00:07:05,160
that afternoon with my family, and I didn't know

137
00:07:08,560 --> 00:07:11,060
almost immediately articles started coming out

138
00:07:11,060 --> 00:07:12,580
talking about how

139
00:07:13,920 --> 00:07:15,080
I'd been part of a

140
00:07:15,080 --> 00:07:17,100
cover-up, and that I was

141
00:07:17,100 --> 00:07:18,400
fired for covering stuff up.

142
00:07:19,440 --> 00:07:21,240
And that I had paid money

143
00:07:21,240 --> 00:07:22,520
to people to delete data.

144
00:07:23,740 --> 00:07:24,260
And

145
00:07:24,260 --> 00:07:26,400
I didn't really know because

146
00:07:26,400 --> 00:07:29,140
after I was terminated they also

147
00:07:29,140 --> 00:07:30,720
bricked my phone and my laptop

148
00:07:31,340 --> 00:07:31,720
remotely.

149
00:07:32,660 --> 00:07:35,100
So I was kind of up in the mountains with no tech.

150
00:07:38,720 --> 00:07:41,060
But like Twitter and everything else was blowing up

151
00:07:41,060 --> 00:07:43,000
that day, and the narrative

152
00:07:43,000 --> 00:07:44,160
was set, I think.

153
00:07:46,720 --> 00:07:48,740
Jump forward three years later,

154
00:07:49,720 --> 00:07:50,200
uh,

155
00:07:51,180 --> 00:07:52,400
I was, uh,

156
00:07:53,520 --> 00:07:55,240
working as the CSO at CloudFlare

157
00:07:55,240 --> 00:07:56,760
at the time, and

158
00:07:57,400 --> 00:07:57,840
um,

159
00:07:59,900 --> 00:08:01,400
I think my family

160
00:08:01,400 --> 00:08:03,040
and I found out through the news

161
00:08:03,040 --> 00:08:04,140
that I had been charged.

162
00:08:04,820 --> 00:08:07,220
Well, I actually found out because a friend of one of my daughters

163
00:08:07,220 --> 00:08:08,700
heard it on NPR and told

164
00:08:08,700 --> 00:08:10,920
her, and so

165
00:08:10,920 --> 00:08:13,140
it was the second time

166
00:08:13,140 --> 00:08:13,800
I got surprised.

167
00:08:14,980 --> 00:08:16,880
Third time is gonna be on me, I guess.

168
00:08:17,740 --> 00:08:19,380
Um, but it actually wasn't

169
00:08:19,380 --> 00:08:20,420
accurate. I wasn't arrested.

170
00:08:20,680 --> 00:08:23,200
They put out a press release saying I was arrested, but I was actually

171
00:08:23,340 --> 00:08:24,840
at home. And, um,

172
00:08:25,000 --> 00:08:26,740
so they corrected that eventually.

173
00:08:27,680 --> 00:08:29,400
Um, but I did get charged.

174
00:08:29,720 --> 00:08:31,080
And I was charged with two

175
00:08:31,080 --> 00:08:32,900
counts. Uh,

176
00:08:33,020 --> 00:08:34,460
the first count was, um,

177
00:08:36,600 --> 00:08:37,480
basically obstructing

178
00:08:37,480 --> 00:08:39,140
an FTC investigation is the way they

179
00:08:39,140 --> 00:08:41,140
characterized it. And the second count

180
00:08:41,140 --> 00:08:42,880
was something called mis-prison of a felony.

181
00:08:43,840 --> 00:08:45,180
The first count really had

182
00:08:45,180 --> 00:08:47,140
to do with, um,

183
00:08:50,360 --> 00:08:51,400
what our company

184
00:08:51,400 --> 00:08:53,320
said to the FTC and didn't say

185
00:08:53,340 --> 00:08:55,120
to the FTC about our security posture

186
00:08:55,840 --> 00:08:57,140
and whether we were transparent

187
00:08:57,140 --> 00:08:59,040
with them. Uh,

188
00:08:59,140 --> 00:09:00,380
that's a talk for a different day.

189
00:09:00,720 --> 00:09:02,680
What I want to focus on is the second count.

190
00:09:02,840 --> 00:09:03,740
Mis-prison of a felony.

191
00:09:04,560 --> 00:09:06,400
Mis-prison is this really old

192
00:09:07,020 --> 00:09:09,180
common law type thing, and I'm not a legal expert

193
00:09:09,180 --> 00:09:11,160
on this stuff, although I should be

194
00:09:11,160 --> 00:09:12,200
at this point. Um,

195
00:09:13,460 --> 00:09:14,820
but mis-prison is

196
00:09:15,200 --> 00:09:17,140
basically if you help someone else get away

197
00:09:17,140 --> 00:09:17,760
with a felony

198
00:09:19,140 --> 00:09:20,860
in something like that.

199
00:09:21,440 --> 00:09:22,120
And so,

200
00:09:23,340 --> 00:09:25,240
the first part of it, of mis-prison

201
00:09:25,240 --> 00:09:27,080
has to be that there is a different felony.

202
00:09:28,360 --> 00:09:29,460
And in this case,

203
00:09:29,480 --> 00:09:31,060
that different felony

204
00:09:31,060 --> 00:09:32,600
was the actions of the researchers.

205
00:09:33,660 --> 00:09:34,360
And so,

206
00:09:34,900 --> 00:09:37,300
for me to be convicted, the jury

207
00:09:37,300 --> 00:09:38,200
had to believe that

208
00:09:38,960 --> 00:09:40,860
the researchers had committed a crime first.

209
00:09:43,200 --> 00:09:45,220
So, jump forward. We actually, um,

210
00:09:45,860 --> 00:09:46,720
went to trial

211
00:09:47,680 --> 00:09:48,520
last September.

212
00:09:49,140 --> 00:09:51,320
This is a, no cameras in the

213
00:09:51,320 --> 00:09:53,140
courtroom, so this is a picture of one of my daughters

214
00:09:53,340 --> 00:09:55,200
Drew. That's me in my

215
00:09:55,200 --> 00:09:56,960
mask on the left, the judge,

216
00:09:57,060 --> 00:09:58,980
a witness, and a jury on the right.

217
00:10:02,340 --> 00:10:03,060
Um, but

218
00:10:03,760 --> 00:10:05,380
like, I want to narrow down the focus,

219
00:10:05,480 --> 00:10:07,100
so I do want to talk about number one, that

220
00:10:07,100 --> 00:10:08,780
mis-prison count. Um,

221
00:10:09,800 --> 00:10:11,100
but one of the things I really

222
00:10:11,100 --> 00:10:12,440
appreciated when I got sentenced

223
00:10:13,060 --> 00:10:14,720
in May, just a couple months ago,

224
00:10:15,680 --> 00:10:16,440
was the judge

225
00:10:17,040 --> 00:10:19,220
went out of his way to say at the sentencing hearing

226
00:10:19,960 --> 00:10:20,680
to the government,

227
00:10:20,820 --> 00:10:22,480
this was a very unusual case.

228
00:10:23,820 --> 00:10:25,240
There's never been a case like this

229
00:10:25,240 --> 00:10:25,600
before.

230
00:10:26,880 --> 00:10:29,120
He asked the prosecutor, could you think of a case

231
00:10:29,120 --> 00:10:30,480
like this that's ever been brought before?

232
00:10:31,420 --> 00:10:33,480
The prosecutor said, not on all fours.

233
00:10:33,500 --> 00:10:35,040
The judge said, not on all threes.

234
00:10:35,740 --> 00:10:36,960
So they were going at it.

235
00:10:37,940 --> 00:10:39,300
And the judge said,

236
00:10:39,360 --> 00:10:41,300
this is not a white collar case. There was no financial

237
00:10:41,300 --> 00:10:43,360
motivation. Um, it's not

238
00:10:43,360 --> 00:10:44,560
like anything I've ever seen before.

239
00:10:45,000 --> 00:10:47,460
And then he also talked about the investigation

240
00:10:47,460 --> 00:10:48,360
that my team did.

241
00:10:49,540 --> 00:10:51,200
The thing that I was most happy about

242
00:10:51,200 --> 00:10:53,180
from the trial was the way my team

243
00:10:53,340 --> 00:10:55,040
got portrayed, and how the judge

244
00:10:55,040 --> 00:10:57,200
perceived them. What the judge said

245
00:10:57,200 --> 00:10:58,360
was, we're not

246
00:10:59,540 --> 00:11:00,700
the data actually

247
00:11:01,520 --> 00:11:02,980
never got exposed in the wild.

248
00:11:03,200 --> 00:11:05,140
So a lot of times I'll see these lists of biggest

249
00:11:05,140 --> 00:11:07,220
data breaches in history, and up in the

250
00:11:07,220 --> 00:11:08,500
middle of it will be this case.

251
00:11:09,820 --> 00:11:10,780
But those records

252
00:11:10,780 --> 00:11:12,660
were actually all recovered and never

253
00:11:13,220 --> 00:11:15,140
kind of like out on the dark web, if you will.

254
00:11:15,840 --> 00:11:17,120
So, because my team

255
00:11:17,120 --> 00:11:18,620
did a really good job on the investigation.

256
00:11:19,640 --> 00:11:21,060
And the judge recognized that.

257
00:11:21,280 --> 00:11:22,680
The prosecutor even agreed.

258
00:11:23,900 --> 00:11:25,320
Well, the prosecutor I think said

259
00:11:25,320 --> 00:11:25,880
we got lucky.

260
00:11:28,300 --> 00:11:28,780
So,

261
00:11:28,840 --> 00:11:30,480
kind of stepping back again,

262
00:11:31,160 --> 00:11:32,260
I've been thinking a lot about

263
00:11:32,760 --> 00:11:35,140
what I said at the beginning about how security needs

264
00:11:35,140 --> 00:11:37,260
to be a partnership to get it

265
00:11:37,260 --> 00:11:38,080
right inside a company.

266
00:11:38,740 --> 00:11:41,120
And as I think about my case, these are some of the

267
00:11:41,120 --> 00:11:42,200
questions that I worry about.

268
00:11:44,400 --> 00:11:45,220
How do we

269
00:11:45,220 --> 00:11:47,040
tilt against the bias of perceiving

270
00:11:47,040 --> 00:11:48,640
every request by an outside person

271
00:11:49,820 --> 00:11:50,780
as extortion?

272
00:11:54,080 --> 00:11:55,380
And if you talk

273
00:11:55,380 --> 00:11:56,940
to the people at the

274
00:11:56,940 --> 00:11:59,180
bug bounty companies, this is an issue that

275
00:11:59,180 --> 00:12:01,360
comes up on a daily basis, especially with new programs.

276
00:12:02,500 --> 00:12:03,300
And especially

277
00:12:03,780 --> 00:12:05,020
with new researchers.

278
00:12:07,040 --> 00:12:09,100
And we also want to create an ecosystem

279
00:12:09,100 --> 00:12:10,760
where companies feel comfortable

280
00:12:11,380 --> 00:12:12,840
engaging with those researchers.

281
00:12:13,440 --> 00:12:15,500
And one of my biggest disappointments

282
00:12:15,500 --> 00:12:16,380
from the case is

283
00:12:16,380 --> 00:12:18,980
I think I set that backwards.

284
00:12:20,160 --> 00:12:21,240
Because of the way

285
00:12:21,240 --> 00:12:23,000
this case was perceived, because of the way

286
00:12:23,340 --> 00:12:24,820
researchers slash hackers were perceived

287
00:12:25,340 --> 00:12:25,960
and all that.

288
00:12:26,660 --> 00:12:28,620
I've heard lots of stories, especially

289
00:12:28,620 --> 00:12:31,120
in the first year afterwards, of companies

290
00:12:31,120 --> 00:12:32,860
like hitting pause on their bounty programs,

291
00:12:33,160 --> 00:12:34,220
rolling them back,

292
00:12:34,500 --> 00:12:37,040
their lawyers getting very anxious about them.

293
00:12:38,380 --> 00:12:39,120
And then you

294
00:12:39,120 --> 00:12:41,320
layer on top of it kind of the blow up of ransomware

295
00:12:41,320 --> 00:12:42,380
which is, you know,

296
00:12:43,060 --> 00:12:45,120
another level in terms of

297
00:12:45,900 --> 00:12:46,760
intrusion and

298
00:12:47,300 --> 00:12:47,540
extortion.

299
00:12:50,500 --> 00:12:51,180
And then

300
00:12:51,180 --> 00:12:53,160
another question is how do we make sure that

301
00:12:53,340 --> 00:12:54,440
researchers can trust a company?

302
00:12:55,040 --> 00:12:57,280
Like how many people know what a responsible disclosure policy

303
00:12:57,280 --> 00:12:59,020
is? Hopefully a lot of you.

304
00:12:59,080 --> 00:13:00,060
We'll talk about that.

305
00:13:01,640 --> 00:13:03,040
But companies put up these

306
00:13:03,040 --> 00:13:04,820
responsible disclosure policies that says

307
00:13:04,820 --> 00:13:05,860
we won't refer to you

308
00:13:05,860 --> 00:13:08,880
to law enforcement if you give us

309
00:13:10,060 --> 00:13:10,960
all the information

310
00:13:10,960 --> 00:13:12,980
and cooperate and make sure that nobody gets hurt.

311
00:13:13,140 --> 00:13:15,260
That's paraphrasing, I have some examples we'll go through.

312
00:13:16,240 --> 00:13:16,680
And

313
00:13:18,680 --> 00:13:19,400
how do we

314
00:13:19,400 --> 00:13:21,240
make sure that the law protects this engagement

315
00:13:22,020 --> 00:13:23,240
and make sure that

316
00:13:23,800 --> 00:13:24,600
companies can

317
00:13:25,620 --> 00:13:27,280
utilize the researchers and the government

318
00:13:27,280 --> 00:13:29,120
will respect it and then we'll have that really strong

319
00:13:29,120 --> 00:13:31,260
stool for all the consumers who use our products

320
00:13:31,260 --> 00:13:31,820
to stand on.

321
00:13:33,960 --> 00:13:35,280
So, this is where I want

322
00:13:35,280 --> 00:13:36,340
to go way back in time.

323
00:13:36,880 --> 00:13:38,660
So I mentioned I was a federal prosecutor.

324
00:13:41,000 --> 00:13:42,880
I don't know, does anybody remember Napster?

325
00:13:46,020 --> 00:13:47,140
Well, Napster was a

326
00:13:47,140 --> 00:13:49,380
really interesting case from the perspective of me

327
00:13:49,380 --> 00:13:51,240
as the, by the time

328
00:13:51,240 --> 00:13:53,240
the recording industry and

329
00:13:53,340 --> 00:13:55,160
everybody was really upset with Napster, I was

330
00:13:55,160 --> 00:13:57,200
I had left Vegas and I was living

331
00:13:57,200 --> 00:13:58,540
in the Bay Area

332
00:13:58,540 --> 00:14:00,840
and I was working full time

333
00:14:00,840 --> 00:14:03,160
doing tech cases and I think I was the first

334
00:14:03,160 --> 00:14:05,020
federal prosecutor in the country

335
00:14:05,020 --> 00:14:06,780
just like in an office full time

336
00:14:07,180 --> 00:14:08,840
cranking on federal cybercrime cases.

337
00:14:09,820 --> 00:14:11,040
I actually had a folder

338
00:14:11,040 --> 00:14:12,460
in my office that said Napster

339
00:14:13,160 --> 00:14:14,460
because we had been getting pushed

340
00:14:14,460 --> 00:14:15,820
to prosecute Napster.

341
00:14:16,580 --> 00:14:19,180
And I always remember I had this conversation with my

342
00:14:19,180 --> 00:14:21,360
top boss, Robert Muller

343
00:14:21,360 --> 00:14:23,240
who went on from that job his next

344
00:14:23,340 --> 00:14:24,680
one was head of the FBI.

345
00:14:25,340 --> 00:14:26,220
And he said

346
00:14:29,200 --> 00:14:31,200
right now it feels like a bunch of companies

347
00:14:31,200 --> 00:14:33,300
fighting with each other. Let them fight it out

348
00:14:33,300 --> 00:14:35,200
first. And like let's

349
00:14:35,200 --> 00:14:37,120
we need to figure out the dynamic

350
00:14:37,120 --> 00:14:39,240
of our relationship with companies and how

351
00:14:39,240 --> 00:14:41,140
much we should be doing what they ask us to do.

352
00:14:42,500 --> 00:14:43,380
Because cyber

353
00:14:43,380 --> 00:14:45,340
is very different from a lot of

354
00:14:45,340 --> 00:14:46,960
other areas of law enforcement

355
00:14:46,960 --> 00:14:49,280
in that so much of what

356
00:14:49,280 --> 00:14:51,340
happens, happens in third party private

357
00:14:51,340 --> 00:14:53,240
sector hands. So much of the internet

358
00:14:53,340 --> 00:14:54,240
especially in this country

359
00:14:54,240 --> 00:14:56,480
sits in the servers of a bunch of companies.

360
00:14:57,020 --> 00:14:59,260
And so from the government perspective

361
00:14:59,260 --> 00:15:01,220
it's really hard to figure out what the right

362
00:15:01,220 --> 00:15:02,260
dynamic is around

363
00:15:03,160 --> 00:15:05,260
relationships. We need cooperation. If you're on the government

364
00:15:05,260 --> 00:15:07,100
side you need cooperation because you need access

365
00:15:07,100 --> 00:15:08,620
and visibility to protect people.

366
00:15:09,100 --> 00:15:10,400
But if you're on the company side

367
00:15:12,300 --> 00:15:13,140
you're dealing

368
00:15:13,140 --> 00:15:15,040
with like also privacy commitments

369
00:15:15,040 --> 00:15:17,160
and it's a lot going

370
00:15:17,160 --> 00:15:19,100
on there. But then there's also the economic

371
00:15:19,100 --> 00:15:21,100
motivation of the company and wanting to push certain

372
00:15:21,100 --> 00:15:22,940
cases and not push certain other cases.

373
00:15:23,340 --> 00:15:25,180
And so as the government you kind of have to

374
00:15:25,180 --> 00:15:25,860
think through all that.

375
00:15:26,860 --> 00:15:28,220
So we decided not to.

376
00:15:29,000 --> 00:15:31,100
And there were civil suits and it actually

377
00:15:31,100 --> 00:15:33,180
resolved things for Napster and I remember thinking

378
00:15:33,180 --> 00:15:33,740
that was good.

379
00:15:35,000 --> 00:15:35,640
But then

380
00:15:35,640 --> 00:15:38,360
I think it was DEFCON 9

381
00:15:39,320 --> 00:15:40,420
there was a

382
00:15:42,040 --> 00:15:42,480
case

383
00:15:43,300 --> 00:15:45,020
so there was a speaker. This is the

384
00:15:45,020 --> 00:15:47,200
whole agenda of DEFCON 9 by the way.

385
00:15:48,220 --> 00:15:49,300
That's every speaker

386
00:15:49,300 --> 00:15:50,680
for the whole event.

387
00:15:51,540 --> 00:15:53,240
And you can't obviously see it

388
00:15:53,340 --> 00:15:55,200
obviously you can't see it from where you are and I can't

389
00:15:55,200 --> 00:15:56,960
either but I'm pretty sure the bottom left

390
00:15:58,280 --> 00:15:59,180
was a guy

391
00:15:59,180 --> 00:16:01,240
named Dmitry Skylarov speaking about

392
00:16:02,160 --> 00:16:03,320
he was an employee of

393
00:16:03,320 --> 00:16:04,780
a Russian company called Elcomsoft

394
00:16:04,780 --> 00:16:06,680
and they had put out some software

395
00:16:07,340 --> 00:16:09,000
that would break

396
00:16:09,640 --> 00:16:10,880
the encryption on the

397
00:16:10,880 --> 00:16:12,000
Adobe eBook reader.

398
00:16:12,520 --> 00:16:14,940
So it was kind of like Napster 2.0

399
00:16:14,940 --> 00:16:15,540
unfolding

400
00:16:17,280 --> 00:16:19,000
and Adobe was really

401
00:16:19,000 --> 00:16:20,780
pushing hard with my office

402
00:16:21,220 --> 00:16:22,180
to prosecute

403
00:16:23,340 --> 00:16:23,940
a case.

404
00:16:24,020 --> 00:16:24,700
And so they

405
00:16:25,720 --> 00:16:28,260
Dmitry Skylarov came from Russia

406
00:16:28,260 --> 00:16:29,280
he spoke at DEFCON

407
00:16:29,280 --> 00:16:31,840
and if you could look really close

408
00:16:31,840 --> 00:16:34,900
I took a screenshot from

409
00:16:34,900 --> 00:16:36,520
Wikipedia of

410
00:16:38,160 --> 00:16:38,880
noticeable

411
00:16:38,880 --> 00:16:40,480
incidents at DEFCON.

412
00:16:40,860 --> 00:16:42,600
The second one was

413
00:16:42,600 --> 00:16:44,920
when Dmitry came off the stage

414
00:16:44,920 --> 00:16:46,500
from talking about

415
00:16:46,500 --> 00:16:47,900
the Adobe eBook reader

416
00:16:47,900 --> 00:16:49,940
encryption breaking tool

417
00:16:49,940 --> 00:16:52,240
he was arrested by the FBI.

418
00:16:55,060 --> 00:16:55,700
And he

419
00:16:55,700 --> 00:16:56,520
was taken into custody.

420
00:16:57,060 --> 00:16:58,160
And it was a mess.

421
00:16:58,880 --> 00:17:00,600
And a lot of people protested.

422
00:17:00,620 --> 00:17:03,200
The picture on the right

423
00:17:03,200 --> 00:17:04,020
is people from

424
00:17:05,120 --> 00:17:06,400
the security community

425
00:17:07,500 --> 00:17:09,060
protesting against the prosecution

426
00:17:09,060 --> 00:17:09,700
of Dmitry.

427
00:17:11,580 --> 00:17:13,400
And that was at the San Francisco

428
00:17:13,400 --> 00:17:14,320
Federal Building.

429
00:17:19,060 --> 00:17:19,960
So let me back up.

430
00:17:20,060 --> 00:17:22,520
So how did the Dmitry story end?

431
00:17:23,340 --> 00:17:24,620
Everybody realized pretty quickly

432
00:17:25,240 --> 00:17:25,920
that Dmitry

433
00:17:27,500 --> 00:17:29,100
he wasn't intending to

434
00:17:29,100 --> 00:17:30,860
do anything particularly I guess.

435
00:17:31,520 --> 00:17:33,220
His company might have been trying to

436
00:17:33,220 --> 00:17:34,180
monetize the situation.

437
00:17:34,620 --> 00:17:36,400
But the charges were dropped against Dmitry

438
00:17:36,400 --> 00:17:39,120
and they went forward against the company.

439
00:17:39,520 --> 00:17:41,080
I was involved in the case

440
00:17:41,080 --> 00:17:42,020
early on

441
00:17:43,520 --> 00:17:44,760
and then I left

442
00:17:44,760 --> 00:17:46,020
the U.S. Attorney's Office

443
00:17:46,020 --> 00:17:48,300
and I went to go work at eBay so I didn't actually

444
00:17:48,300 --> 00:17:50,980
I was there during the time when the charges against Dmitry

445
00:17:50,980 --> 00:17:52,960
were dropped. I was part of the prosecution team.

446
00:17:53,340 --> 00:17:54,660
And then after I left

447
00:17:54,660 --> 00:17:56,640
the case went forward against the company.

448
00:17:56,840 --> 00:17:58,180
And I think the government lost.

449
00:17:59,880 --> 00:18:01,300
So to me

450
00:18:01,300 --> 00:18:01,700
that was

451
00:18:04,180 --> 00:18:05,380
another chance for me

452
00:18:05,380 --> 00:18:06,500
to think about the research

453
00:18:07,780 --> 00:18:08,660
versus company

454
00:18:08,660 --> 00:18:10,240
versus government triangle.

455
00:18:11,340 --> 00:18:13,340
And I was on the side of the government

456
00:18:13,340 --> 00:18:14,840
and we were

457
00:18:14,840 --> 00:18:15,940
arresting a researcher.

458
00:18:17,860 --> 00:18:18,300
And

459
00:18:19,020 --> 00:18:21,240
at the time I thought that was the right thing to do.

460
00:18:23,340 --> 00:18:24,680
But then I went into the private sector

461
00:18:24,680 --> 00:18:27,040
and I remember almost like a month

462
00:18:27,040 --> 00:18:29,180
after I got to eBay we got this email

463
00:18:29,540 --> 00:18:31,100
and it was from somebody that said

464
00:18:31,100 --> 00:18:32,580
we found a security vulnerability

465
00:18:33,340 --> 00:18:34,880
I will tell you if you pay me.

466
00:18:35,140 --> 00:18:37,120
And I remember I personally had

467
00:18:37,120 --> 00:18:39,240
this like angry reaction to this person.

468
00:18:40,060 --> 00:18:40,420
Like

469
00:18:41,100 --> 00:18:42,240
why do they want to get paid?

470
00:18:42,660 --> 00:18:45,140
I'm fighting inside this company to get them to do

471
00:18:45,140 --> 00:18:47,060
the right thing and protect our users and we need to do

472
00:18:47,060 --> 00:18:49,560
everything we can because that's my job.

473
00:18:50,200 --> 00:18:51,460
And then there's someone on the outside

474
00:18:51,460 --> 00:18:52,980
who could help me and they wouldn't give it to me.

475
00:18:53,340 --> 00:18:54,820
And that was like my

476
00:18:55,100 --> 00:18:57,060
next perspective from a company on

477
00:18:57,060 --> 00:18:58,260
security researchers.

478
00:18:59,300 --> 00:19:00,260
But then I

479
00:19:00,260 --> 00:19:03,200
really got to start learning

480
00:19:03,200 --> 00:19:05,280
more about that different perspective.

481
00:19:05,600 --> 00:19:07,400
This was an article written by

482
00:19:07,400 --> 00:19:08,080
Bruce Schneier in

483
00:19:08,920 --> 00:19:11,020
2001 just a couple of months after

484
00:19:11,020 --> 00:19:12,720
Dimitri's case

485
00:19:12,720 --> 00:19:13,920
while it was still pending.

486
00:19:14,320 --> 00:19:17,140
And there was this big fight between Microsoft

487
00:19:17,140 --> 00:19:18,260
and the research community

488
00:19:19,260 --> 00:19:21,180
because Microsoft had gotten mad

489
00:19:21,180 --> 00:19:23,000
because researchers were publishing

490
00:19:23,340 --> 00:19:23,780
vulnerabilities

491
00:19:25,160 --> 00:19:27,320
and I started really thinking

492
00:19:27,320 --> 00:19:28,520
about it from different perspectives.

493
00:19:30,740 --> 00:19:32,820
Move forward a few years I got to PayPal.

494
00:19:33,020 --> 00:19:35,080
I switched from the eBay side to the PayPal side.

495
00:19:35,560 --> 00:19:37,120
And I helped Andy

496
00:19:37,120 --> 00:19:39,120
Steingruble who's now the CISO of

497
00:19:39,120 --> 00:19:39,880
Pinterest

498
00:19:40,920 --> 00:19:43,200
with the publication of what we did at PayPal

499
00:19:43,200 --> 00:19:44,100
in 2007.

500
00:19:44,660 --> 00:19:46,780
And it got praised I think

501
00:19:47,340 --> 00:19:48,960
by a lot of people in the research community

502
00:19:48,960 --> 00:19:51,120
because we published one of the first responsible

503
00:19:51,120 --> 00:19:52,000
disclosure policies.

504
00:19:53,640 --> 00:19:55,020
This was an article by

505
00:19:55,020 --> 00:19:56,860
Jeremiah Grossman praising it.

506
00:19:57,240 --> 00:19:59,100
And so this was the language that we

507
00:19:59,100 --> 00:20:01,280
published at PayPal in 2007

508
00:20:01,280 --> 00:20:03,060
because we'd gone from that experience

509
00:20:03,060 --> 00:20:05,040
where we were angry at

510
00:20:05,040 --> 00:20:06,540
researchers for wanting money

511
00:20:07,180 --> 00:20:08,640
to completely flipping.

512
00:20:09,260 --> 00:20:10,240
And we said

513
00:20:10,240 --> 00:20:12,860
if you follow our guidelines

514
00:20:12,860 --> 00:20:15,120
we won't refer you to the government

515
00:20:15,120 --> 00:20:16,460
and we won't

516
00:20:18,400 --> 00:20:19,320
bring an action

517
00:20:19,320 --> 00:20:19,860
against you.

518
00:20:21,780 --> 00:20:22,340
And

519
00:20:25,240 --> 00:20:27,300
almost immediately after that

520
00:20:27,300 --> 00:20:29,220
companies started publishing those more

521
00:20:29,220 --> 00:20:31,200
and then researchers started

522
00:20:31,200 --> 00:20:32,720
pushing even harder and saying

523
00:20:32,720 --> 00:20:35,680
you shouldn't just not prosecute us

524
00:20:35,680 --> 00:20:37,160
you should actually

525
00:20:37,160 --> 00:20:38,180
pay us.

526
00:20:38,620 --> 00:20:41,100
And there was the No More Free Bugs campaign

527
00:20:41,100 --> 00:20:43,060
that Dino and a bunch of people did.

528
00:20:46,460 --> 00:20:48,480
So a couple years later

529
00:20:49,220 --> 00:20:50,480
I had moved over to Facebook

530
00:20:51,080 --> 00:20:52,560
I was the CISO at Facebook

531
00:20:53,340 --> 00:20:54,880
and I worked with Alex Rice

532
00:20:54,880 --> 00:20:56,340
who's now the CTO of HackerOne

533
00:20:56,340 --> 00:20:59,300
and we published our own version

534
00:20:59,300 --> 00:21:01,140
of what I had helped write at

535
00:21:01,140 --> 00:21:03,000
PayPal. So we published

536
00:21:03,000 --> 00:21:05,400
the Facebook version in December 2010

537
00:21:05,400 --> 00:21:07,220
and we said basically

538
00:21:07,220 --> 00:21:09,100
the same thing. We won't bring lawsuit

539
00:21:09,100 --> 00:21:11,300
or ask law enforcement to investigate

540
00:21:11,300 --> 00:21:12,880
you if you contact us.

541
00:21:15,600 --> 00:21:16,800
We actually came to

542
00:21:17,220 --> 00:21:18,140
here at DEF CON

543
00:21:18,140 --> 00:21:20,320
we launched our bug bounty program

544
00:21:20,320 --> 00:21:22,160
at Facebook in 2011.

545
00:21:23,340 --> 00:21:25,040
That was a heavy lift for us back then

546
00:21:25,040 --> 00:21:26,440
because we weren't the

547
00:21:26,440 --> 00:21:28,360
mega corporation that it is now.

548
00:21:29,820 --> 00:21:31,340
But we announced and launched

549
00:21:31,340 --> 00:21:33,260
the program here. It got a lot of

550
00:21:33,260 --> 00:21:35,180
good publicity and we paid out for a lot of bugs.

551
00:21:36,080 --> 00:21:36,520
But

552
00:21:36,520 --> 00:21:39,240
the relationship with security researchers from inside

553
00:21:39,240 --> 00:21:41,080
the perspective of the company

554
00:21:41,080 --> 00:21:43,160
wasn't actually that

555
00:21:43,160 --> 00:21:45,200
amazing when we first rolled out the bounty program.

556
00:21:46,220 --> 00:21:47,160
This was an interesting

557
00:21:47,160 --> 00:21:48,960
story about a month after I think.

558
00:21:49,220 --> 00:21:51,200
So we now said we're open for business

559
00:21:51,200 --> 00:21:52,760
we'll pay you for vulnerabilities

560
00:21:54,600 --> 00:21:55,000
This

561
00:21:55,000 --> 00:21:56,940
young man in

562
00:21:56,940 --> 00:21:59,380
the Palestinian territories

563
00:22:00,020 --> 00:22:01,220
at the time

564
00:22:02,140 --> 00:22:03,420
found a vulnerability

565
00:22:03,420 --> 00:22:04,840
on Facebook where he could

566
00:22:04,840 --> 00:22:06,580
post on somebody else's wall

567
00:22:06,580 --> 00:22:09,280
and he tried to report it to my team

568
00:22:09,280 --> 00:22:10,720
but he couldn't figure out how to do it

569
00:22:10,720 --> 00:22:12,400
and there was this whole glitch in communication

570
00:22:12,980 --> 00:22:14,420
because we weren't good at communicating

571
00:22:14,420 --> 00:22:15,780
and he wasn't good at communicating

572
00:22:16,460 --> 00:22:18,380
and we were all trying to figure this thing out

573
00:22:18,380 --> 00:22:21,340
so he got irritated and he went on Mark Zuckerberg's

574
00:22:21,340 --> 00:22:22,540
Facebook page and he

575
00:22:23,780 --> 00:22:24,660
using a

576
00:22:25,310 --> 00:22:26,260
picture of Snowden

577
00:22:26,260 --> 00:22:28,100
posted on Mark's page.

578
00:22:30,560 --> 00:22:31,140
So

579
00:22:31,140 --> 00:22:32,540
first sorry for

580
00:22:32,540 --> 00:22:35,200
this is the first slide. First sorry for violating your

581
00:22:35,200 --> 00:22:35,560
privacy.

582
00:22:36,940 --> 00:22:38,960
And so I

583
00:22:38,960 --> 00:22:40,200
had this dilemma of

584
00:22:40,200 --> 00:22:43,160
we had language in our responsible disclosure

585
00:22:43,160 --> 00:22:45,120
and bug bounty program saying we won't

586
00:22:45,120 --> 00:22:47,140
go after researchers and we will

587
00:22:47,140 --> 00:22:48,860
pay you. And so

588
00:22:48,860 --> 00:22:50,980
we actually talked about this inside the company

589
00:22:50,980 --> 00:22:53,240
and we're like is this an unauthorized

590
00:22:53,340 --> 00:22:55,240
access? Is it illegal what he did?

591
00:22:55,860 --> 00:22:57,120
We decided we're not going to

592
00:22:57,120 --> 00:22:58,860
refer this to anybody.

593
00:22:59,160 --> 00:23:01,280
I mean it was CNN sent a reporter

594
00:23:01,280 --> 00:23:02,520
to interview him in person

595
00:23:03,320 --> 00:23:05,280
and so the case got a

596
00:23:05,280 --> 00:23:07,280
lot of attention and I got a lot

597
00:23:07,280 --> 00:23:09,160
of blowback because I said well we can't

598
00:23:09,160 --> 00:23:10,720
pay you for your research.

599
00:23:11,440 --> 00:23:13,200
The security community actually came

600
00:23:13,200 --> 00:23:14,500
together and created a fund

601
00:23:14,960 --> 00:23:16,860
and a bunch of people from the research community

602
00:23:17,320 --> 00:23:19,200
contributed the fund and so he ended up getting

603
00:23:19,200 --> 00:23:20,600
a lot more money than he would have

604
00:23:21,800 --> 00:23:23,300
if we had just paid him

605
00:23:23,340 --> 00:23:23,600
the bounty.

606
00:23:24,980 --> 00:23:27,080
But you know there are a lot of like these

607
00:23:27,080 --> 00:23:29,080
and I could give you probably a thousand

608
00:23:29,080 --> 00:23:31,320
examples like this. This is just one

609
00:23:31,320 --> 00:23:32,560
that I could talk about because it was

610
00:23:32,560 --> 00:23:33,580
so public.

611
00:23:35,880 --> 00:23:37,160
Another one that was kind of

612
00:23:37,160 --> 00:23:37,680
public was

613
00:23:39,520 --> 00:23:40,280
there was this

614
00:23:41,540 --> 00:23:42,780
researcher Reginaldo from

615
00:23:43,280 --> 00:23:45,260
Brazil and he found an RCE

616
00:23:46,320 --> 00:23:47,200
in Facebook

617
00:23:47,980 --> 00:23:48,420
and

618
00:23:49,120 --> 00:23:51,160
not too long before that one of the leaders

619
00:23:51,160 --> 00:23:52,800
on my team had been quoted as saying

620
00:23:53,380 --> 00:23:55,360
our bug bounty program is so awesome

621
00:23:55,360 --> 00:23:55,960
it's doing great

622
00:23:56,920 --> 00:23:59,180
and someone asked what's the max bounty you'll

623
00:23:59,180 --> 00:24:00,040
pay and he said

624
00:24:00,800 --> 00:24:03,060
we would pay a million dollars for the right

625
00:24:03,060 --> 00:24:05,300
bounty if you found something

626
00:24:05,300 --> 00:24:06,560
that was that

627
00:24:06,560 --> 00:24:07,860
significant and harmful

628
00:24:09,300 --> 00:24:11,220
and this researcher he thought

629
00:24:11,220 --> 00:24:12,980
about it and he's like I've got RCE

630
00:24:12,980 --> 00:24:14,880
on Facebook which is basically

631
00:24:14,880 --> 00:24:15,980
for those who don't know

632
00:24:16,760 --> 00:24:18,100
it's just like straight access.

633
00:24:19,320 --> 00:24:21,260
So he had found something big

634
00:24:21,260 --> 00:24:22,980
but he reported it to us

635
00:24:23,340 --> 00:24:25,440
and we worked with him. We did pay him

636
00:24:25,440 --> 00:24:27,080
I think our largest bounty at the time

637
00:24:27,080 --> 00:24:29,000
I think it was 33,500

638
00:24:30,080 --> 00:24:30,560
but

639
00:24:31,260 --> 00:24:32,840
we also hired him and

640
00:24:32,840 --> 00:24:34,560
he moved from Brazil to work

641
00:24:34,560 --> 00:24:36,100
on my team

642
00:24:37,200 --> 00:24:39,440
and kind of be on the other side of the bug bounty

643
00:24:39,440 --> 00:24:41,320
program and that went really

644
00:24:41,320 --> 00:24:43,180
great. I think he stayed at Facebook

645
00:24:43,180 --> 00:24:43,840
for six years.

646
00:24:45,140 --> 00:24:47,040
I left Facebook in

647
00:24:48,100 --> 00:24:49,340
March of 2015

648
00:24:49,340 --> 00:24:51,360
after seven years there building out

649
00:24:51,360 --> 00:24:52,940
the team and I went to Uber

650
00:24:54,880 --> 00:24:55,840
and within

651
00:24:55,840 --> 00:24:57,320
I think a month of me getting to Uber

652
00:24:57,320 --> 00:24:59,460
we published a responsible disclosure policy

653
00:24:59,460 --> 00:25:00,900
saying the same things

654
00:25:01,800 --> 00:25:03,240
and I worked with

655
00:25:03,240 --> 00:25:05,500
a couple of members of our team to put that out

656
00:25:06,220 --> 00:25:07,360
and we said

657
00:25:07,360 --> 00:25:09,220
we won't take legal or administrative action

658
00:25:09,220 --> 00:25:11,120
against people who report vulnerabilities

659
00:25:11,120 --> 00:25:13,340
and so on just kind of like similar to what

660
00:25:13,340 --> 00:25:13,880
we'd said before

661
00:25:15,960 --> 00:25:16,440
and

662
00:25:17,880 --> 00:25:18,980
one of the cool things

663
00:25:18,980 --> 00:25:20,860
that I appreciated that time was

664
00:25:20,860 --> 00:25:23,180
further down on that page there's a

665
00:25:23,340 --> 00:25:25,180
name Rob Fletcher. We were acknowledging

666
00:25:25,180 --> 00:25:27,300
Rob and Rob was actually one of the people

667
00:25:27,300 --> 00:25:29,280
who was helping push out this policy with me

668
00:25:29,280 --> 00:25:31,200
he had been an outside researcher who

669
00:25:31,200 --> 00:25:32,900
had contacted Uber before I got there

670
00:25:32,900 --> 00:25:35,340
reporting a vulnerability and the team had hired

671
00:25:35,340 --> 00:25:37,060
him even before I got there

672
00:25:37,060 --> 00:25:39,280
and Rob ended up ultimately running

673
00:25:39,280 --> 00:25:41,240
the product security team at Uber

674
00:25:41,240 --> 00:25:42,700
and is a very successful

675
00:25:43,240 --> 00:25:43,940
security engineer.

676
00:25:45,920 --> 00:25:46,400
We

677
00:25:47,300 --> 00:25:49,400
right after that I mentioned publicly

678
00:25:50,120 --> 00:25:51,240
I think this one

679
00:25:51,240 --> 00:25:53,020
was on Quora that we had a

680
00:25:53,340 --> 00:25:54,960
private HackerOne bug bounty program

681
00:25:54,960 --> 00:25:57,040
so we launched so this is literally

682
00:25:57,040 --> 00:25:59,180
within a very short period of time after

683
00:25:59,180 --> 00:26:00,980
I got to Uber and then

684
00:26:02,160 --> 00:26:02,800
you know

685
00:26:02,800 --> 00:26:05,180
a lot of companies launch a private program

686
00:26:05,180 --> 00:26:06,680
now and they never take it public

687
00:26:06,680 --> 00:26:09,240
and there's a big debate whether you keep your bug bounty program

688
00:26:09,240 --> 00:26:10,260
private or public

689
00:26:11,080 --> 00:26:12,980
we decided we wanted to take it public

690
00:26:12,980 --> 00:26:15,120
but we had to sit in private

691
00:26:15,120 --> 00:26:16,760
for a while to fix all the things that

692
00:26:17,200 --> 00:26:18,560
researchers reported to us

693
00:26:19,200 --> 00:26:21,300
because I'll tell you when you launch a bounty program

694
00:26:21,300 --> 00:26:23,140
you really do find things

695
00:26:23,340 --> 00:26:24,500
that you wouldn't find otherwise

696
00:26:25,180 --> 00:26:27,400
from a company standpoint bug bounty programs

697
00:26:27,400 --> 00:26:28,020
are amazing

698
00:26:28,740 --> 00:26:31,400
as a security leader I'd have this huge budget

699
00:26:31,400 --> 00:26:33,260
and I would pay pen testing companies

700
00:26:34,500 --> 00:26:35,620
a set amount of money

701
00:26:35,620 --> 00:26:37,340
up front and then they would

702
00:26:37,340 --> 00:26:38,820
find three vulnerabilities every time

703
00:26:39,280 --> 00:26:41,440
and so it was like no matter how much I paid

704
00:26:41,440 --> 00:26:42,900
them I was going to get the same kind of report

705
00:26:42,900 --> 00:26:45,300
that I would have to look really hard to find a little

706
00:26:45,300 --> 00:26:46,220
bit of important stuff

707
00:26:47,140 --> 00:26:49,180
with researchers you don't have to pay them a dime

708
00:26:49,920 --> 00:26:51,440
until they find something important

709
00:26:51,960 --> 00:26:53,320
and so like from a company

710
00:26:53,340 --> 00:26:55,660
standpoint I really believe

711
00:26:56,100 --> 00:26:56,720
that we

712
00:26:57,210 --> 00:26:59,200
like and I used to say this I would say

713
00:26:59,200 --> 00:27:01,120
it's negligence to not have a bug bounty program

714
00:27:01,120 --> 00:27:02,580
like you have to

715
00:27:03,150 --> 00:27:05,360
have that opportunity for people

716
00:27:05,360 --> 00:27:06,120
to do the work

717
00:27:06,580 --> 00:27:08,200
so we launched our public program

718
00:27:09,620 --> 00:27:11,260
and within a very short time

719
00:27:11,260 --> 00:27:11,820
after that

720
00:27:13,460 --> 00:27:14,940
this came to my personal email

721
00:27:14,940 --> 00:27:15,900
and my Uber email

722
00:27:16,980 --> 00:27:19,140
hey Joe I found a major vulnerability in Uber

723
00:27:19,140 --> 00:27:21,080
I was able to dump Uber database

724
00:27:21,080 --> 00:27:21,960
and many other things

725
00:27:23,700 --> 00:27:25,200
I did what I always do

726
00:27:25,200 --> 00:27:27,500
I've gotten versions of this email hundreds of times

727
00:27:28,320 --> 00:27:29,240
I forwarded it

728
00:27:29,240 --> 00:27:31,420
to our bug bounty

729
00:27:31,420 --> 00:27:32,080
triage team

730
00:27:32,900 --> 00:27:35,060
and Rob Fletcher the same researcher

731
00:27:35,060 --> 00:27:36,840
who had gotten a job at the company

732
00:27:38,980 --> 00:27:41,080
I just put this slide in to remind me

733
00:27:41,080 --> 00:27:43,020
that everything I'm going to talk about now is stuff that

734
00:27:43,020 --> 00:27:44,840
was covered publicly in the trial

735
00:27:44,840 --> 00:27:46,240
so like I was saying at the beginning

736
00:27:46,240 --> 00:27:48,620
I'm only going to talk about the case from what's public

737
00:27:50,980 --> 00:27:53,280
so Rob sent an email back

738
00:27:53,340 --> 00:27:55,060
really quickly

739
00:27:55,060 --> 00:27:56,320
after I'd gotten that email

740
00:27:56,320 --> 00:27:58,400
forwarded it to them and Rob said

741
00:27:58,400 --> 00:28:00,900
hey my name is Rob I work in product security

742
00:28:01,520 --> 00:28:02,340
here at Uber

743
00:28:04,260 --> 00:28:05,220
I understand

744
00:28:05,220 --> 00:28:06,820
you have a vulnerability you want to disclose

745
00:28:07,340 --> 00:28:09,240
our preferred method

746
00:28:09,240 --> 00:28:11,640
is use our public bug bounty program

747
00:28:11,640 --> 00:28:12,240
at HackerOne

748
00:28:12,240 --> 00:28:14,840
but if you'd like to use email

749
00:28:14,840 --> 00:28:16,420
to exchange details let's go

750
00:28:17,340 --> 00:28:18,300
and so

751
00:28:19,340 --> 00:28:20,800
that's kind of the start of the case

752
00:28:22,160 --> 00:28:23,040
during the trial

753
00:28:23,340 --> 00:28:25,180
there was a whole bunch of debate

754
00:28:25,180 --> 00:28:27,120
and testimony and argument about

755
00:28:27,760 --> 00:28:29,200
the interaction with these

756
00:28:29,200 --> 00:28:30,420
researchers slash hackers

757
00:28:30,420 --> 00:28:33,120
I never know what to call them because back at the time

758
00:28:33,120 --> 00:28:34,760
we thought of them as researchers

759
00:28:37,600 --> 00:28:39,040
and now everybody

760
00:28:39,040 --> 00:28:40,360
thinks of them as felons

761
00:28:41,480 --> 00:28:43,100
so there was this whole question

762
00:28:43,100 --> 00:28:43,800
of whether they were

763
00:28:43,800 --> 00:28:45,800
this was a slide from the trial

764
00:28:46,240 --> 00:28:48,160
getting a bunch of quotes from people who

765
00:28:49,680 --> 00:28:50,120
testified

766
00:28:51,240 --> 00:28:53,220
and it was a bunch of people from my team

767
00:28:53,340 --> 00:28:55,280
saying mostly what happened

768
00:28:55,280 --> 00:28:56,940
in this case in terms of our interaction

769
00:28:56,940 --> 00:28:59,320
it was quite typical

770
00:29:03,780 --> 00:29:05,320
we had a lot

771
00:29:05,320 --> 00:29:07,260
of debate internally often

772
00:29:07,260 --> 00:29:08,860
about you know back then

773
00:29:08,860 --> 00:29:10,920
so you have to remember 2016

774
00:29:10,920 --> 00:29:13,340
is a long time ago now in internet

775
00:29:13,340 --> 00:29:15,200
time and especially in bug bounty

776
00:29:15,200 --> 00:29:17,240
program time we had very

777
00:29:17,240 --> 00:29:19,160
generic rules back then companies now

778
00:29:19,160 --> 00:29:21,360
have very long rules of what you can and can't

779
00:29:21,360 --> 00:29:22,680
poke at

780
00:29:23,880 --> 00:29:25,000
and so

781
00:29:25,000 --> 00:29:27,140
like Colin Green

782
00:29:27,140 --> 00:29:29,100
said during his testimony there's no supreme

783
00:29:29,100 --> 00:29:31,200
court of bug bounty rules we just look at each

784
00:29:31,200 --> 00:29:32,880
case and try and figure it out back then

785
00:29:32,880 --> 00:29:35,420
and Rob said our guidelines

786
00:29:35,420 --> 00:29:37,240
were flexible and another

787
00:29:37,240 --> 00:29:38,380
member of the team Matt said

788
00:29:38,380 --> 00:29:40,580
in his testimony look if

789
00:29:40,580 --> 00:29:43,200
in these situations we actually

790
00:29:43,200 --> 00:29:45,060
went and referred someone to law

791
00:29:45,060 --> 00:29:46,160
enforcement can you imagine

792
00:29:46,920 --> 00:29:49,160
how the research community would react and then

793
00:29:49,160 --> 00:29:50,000
our program would tank

794
00:29:50,000 --> 00:29:50,520
...

795
00:29:53,340 --> 00:29:53,440
so

796
00:29:56,200 --> 00:29:56,600
we

797
00:29:58,000 --> 00:29:59,020
and actually the

798
00:29:59,020 --> 00:30:01,160
new CEO of Uber when he testified he said

799
00:30:01,160 --> 00:30:02,360
it was the right thing to do to pay them

800
00:30:04,420 --> 00:30:04,820
we

801
00:30:05,300 --> 00:30:07,280
during the investigation I don't want to spend too much time

802
00:30:07,280 --> 00:30:08,720
on the investigation because I don't have

803
00:30:08,720 --> 00:30:11,160
that much time and this is focused more

804
00:30:11,160 --> 00:30:13,320
on the researcher side we documented

805
00:30:13,320 --> 00:30:15,120
everything on the team we had a large

806
00:30:15,120 --> 00:30:16,120
number of people involved

807
00:30:16,920 --> 00:30:19,140
this is I think 25 members of my team

808
00:30:19,140 --> 00:30:21,100
worked on the investigation we pulled in

809
00:30:21,100 --> 00:30:22,960
the communications team they

810
00:30:23,340 --> 00:30:24,840
communicated all the way up to their exec level

811
00:30:25,340 --> 00:30:26,740
we pulled in legal

812
00:30:28,060 --> 00:30:29,240
they communicated with their

813
00:30:29,240 --> 00:30:31,080
manager who ran the privacy team for legal

814
00:30:31,080 --> 00:30:33,140
so they were all kind of in the loop working

815
00:30:33,140 --> 00:30:34,240
through what we did on the case

816
00:30:35,000 --> 00:30:37,180
we had a data breach response policy we had

817
00:30:37,180 --> 00:30:39,120
a data breach response plan we

818
00:30:39,120 --> 00:30:41,280
had a breach incident response playbook

819
00:30:41,280 --> 00:30:43,240
we had all the documentation you would hope

820
00:30:43,240 --> 00:30:45,300
to have we had specifically the names

821
00:30:45,300 --> 00:30:47,180
of who in legal we were supposed to escalate

822
00:30:47,180 --> 00:30:49,000
things to we did those things

823
00:30:49,540 --> 00:30:51,440
legal was responsible for deciding

824
00:30:52,100 --> 00:30:53,260
what gets disclosed

825
00:30:53,340 --> 00:30:54,580
according to policy to whom

826
00:30:55,280 --> 00:30:57,200
and legal the lawyer

827
00:30:57,200 --> 00:30:58,080
testified said

828
00:30:58,920 --> 00:31:01,100
they gave the advice to my team it's not a

829
00:31:01,100 --> 00:31:02,480
reportable data breach situation

830
00:31:03,260 --> 00:31:04,980
if three things one

831
00:31:06,320 --> 00:31:07,120
you're confident

832
00:31:07,120 --> 00:31:09,120
the hackers no longer have the data two confident

833
00:31:09,120 --> 00:31:11,100
the data was not disseminated further and three

834
00:31:11,100 --> 00:31:13,140
you can get the hackers to sign an NDA

835
00:31:13,580 --> 00:31:15,360
so that was the advice from legal at the time

836
00:31:16,440 --> 00:31:17,260
and then I want to

837
00:31:17,260 --> 00:31:19,120
jump back to my sentencing hearing because this was

838
00:31:19,120 --> 00:31:21,120
again the only time I like the judge

839
00:31:21,120 --> 00:31:23,120
really gave his opinions on the case was at the

840
00:31:23,340 --> 00:31:24,480
sentencing and

841
00:31:25,240 --> 00:31:27,140
so a big focus during the case

842
00:31:27,140 --> 00:31:29,220
from if you go back to those articles I

843
00:31:29,220 --> 00:31:31,120
showed you that came out in 2017

844
00:31:31,120 --> 00:31:33,240
they all said we gave them an NDA

845
00:31:33,240 --> 00:31:34,700
to shut them up

846
00:31:35,940 --> 00:31:37,260
and the judge said

847
00:31:38,500 --> 00:31:39,380
the NDA

848
00:31:39,380 --> 00:31:40,620
argument the government makes

849
00:31:41,240 --> 00:31:41,960
doesn't fly

850
00:31:42,900 --> 00:31:45,240
this wasn't a cover up it was part of the

851
00:31:45,240 --> 00:31:46,460
ability to solve the problem

852
00:31:47,000 --> 00:31:49,120
in my view in the way that the evidence came in

853
00:31:49,620 --> 00:31:51,400
I was so happy like I said earlier

854
00:31:51,400 --> 00:31:52,980
when the judge said that because it validated

855
00:31:53,340 --> 00:31:55,080
how hard my team worked and what they did on the

856
00:31:55,080 --> 00:31:55,480
investigation

857
00:31:57,760 --> 00:31:59,340
because on my teams

858
00:31:59,340 --> 00:32:01,280
we always had a culture of attribution

859
00:32:01,280 --> 00:32:03,120
in our investigations we always wanted to know

860
00:32:03,120 --> 00:32:04,660
who we were dealing with on the other side

861
00:32:05,160 --> 00:32:07,260
I would love to someday give a talk just on

862
00:32:07,260 --> 00:32:08,500
the concept of attribution

863
00:32:09,130 --> 00:32:11,160
because like security leaders

864
00:32:11,160 --> 00:32:13,260
very much disagree on

865
00:32:14,020 --> 00:32:14,940
philosophically whether

866
00:32:15,460 --> 00:32:17,120
people inside the company should care

867
00:32:17,120 --> 00:32:18,920
who they're to know

868
00:32:18,920 --> 00:32:20,340
who they're dealing with on the other side

869
00:32:20,340 --> 00:32:22,000
we always wanted to know

870
00:32:23,460 --> 00:32:25,260
because we would refer a lot of cases

871
00:32:25,260 --> 00:32:25,980
to law enforcement

872
00:32:26,560 --> 00:32:28,660
but we also sometimes didn't

873
00:32:28,660 --> 00:32:31,220
there was a great example on the wall we had at Facebook

874
00:32:31,220 --> 00:32:33,300
that was mentioned in an article

875
00:32:33,940 --> 00:32:34,340
where

876
00:32:36,020 --> 00:32:37,380
like an 11 year old kid

877
00:32:37,380 --> 00:32:38,780
had done something really stupid

878
00:32:38,780 --> 00:32:40,420
and we were like what are we going to do with this case

879
00:32:40,420 --> 00:32:42,420
so we wrote a letter to his mother

880
00:32:42,880 --> 00:32:43,520
and it was

881
00:32:44,540 --> 00:32:46,740
and asked her to have him apologize

882
00:32:47,560 --> 00:32:48,360
and he did

883
00:32:48,360 --> 00:32:50,620
and we were like that's a good resolution for that case

884
00:32:51,560 --> 00:32:52,760
but you know we also

885
00:32:53,920 --> 00:32:54,720
we also

886
00:32:55,380 --> 00:32:57,000
you know and it's a weird situation

887
00:32:57,000 --> 00:32:58,820
it goes back to the people in the private sector

888
00:32:58,820 --> 00:33:01,040
having a lot of discretion about what to do

889
00:33:01,040 --> 00:33:03,200
and actually being the only ones

890
00:33:03,200 --> 00:33:05,280
who have visibility into what's really happening

891
00:33:05,280 --> 00:33:06,200
in a lot of these situations

892
00:33:08,360 --> 00:33:08,760
like

893
00:33:09,980 --> 00:33:11,300
that culture of attribution

894
00:33:11,300 --> 00:33:13,120
and this could be a whole other talk too

895
00:33:13,120 --> 00:33:14,440
around attribution

896
00:33:14,440 --> 00:33:17,020
I left Facebook in the spring of

897
00:33:17,460 --> 00:33:17,860
2015

898
00:33:18,760 --> 00:33:20,140
and of course in 2016

899
00:33:22,420 --> 00:33:23,280
there was a lot

900
00:33:23,340 --> 00:33:24,460
of stuff happening at Facebook

901
00:33:24,460 --> 00:33:26,520
around the 2016 presidential election

902
00:33:26,520 --> 00:33:28,340
and suggestions of this concept of misinformation

903
00:33:29,780 --> 00:33:31,220
that security team

904
00:33:31,220 --> 00:33:33,700
put out a really detailed

905
00:33:33,700 --> 00:33:35,060
write up publicly

906
00:33:35,780 --> 00:33:37,300
about what had happened

907
00:33:37,300 --> 00:33:39,160
from the Facebook perspective

908
00:33:39,160 --> 00:33:40,500
and chose to be transparent

909
00:33:41,160 --> 00:33:43,260
I think there were a lot of other platforms

910
00:33:43,260 --> 00:33:45,520
that had just as much misinformation on them

911
00:33:45,520 --> 00:33:46,620
but they didn't put out the reports

912
00:33:47,240 --> 00:33:49,260
and so I think Facebook actually

913
00:33:49,260 --> 00:33:50,100
got a lot more heat

914
00:33:51,980 --> 00:33:53,320
so jumping back forward

915
00:33:53,340 --> 00:33:53,860
to our case

916
00:33:53,860 --> 00:33:56,280
my team did an amazing job on figuring out

917
00:33:56,280 --> 00:33:57,700
who these guys were on the other side

918
00:33:57,700 --> 00:33:59,520
it turns out it was two young men

919
00:33:59,520 --> 00:34:00,680
one 19 and 20

920
00:34:00,680 --> 00:34:04,220
the main person responsible

921
00:34:04,800 --> 00:34:06,080
from my team's determination

922
00:34:06,080 --> 00:34:07,560
was a kid named Brandon

923
00:34:07,560 --> 00:34:08,720
who lived in Florida

924
00:34:10,240 --> 00:34:11,480
and he basically

925
00:34:11,480 --> 00:34:13,200
I don't want to talk about his personal life

926
00:34:13,200 --> 00:34:14,140
because I don't know him

927
00:34:14,620 --> 00:34:16,360
but my team got to know him really well

928
00:34:16,360 --> 00:34:18,320
and really came to like him as a person

929
00:34:18,960 --> 00:34:21,120
but they also really appreciated his skills

930
00:34:23,340 --> 00:34:24,880
because it took a lot of effort

931
00:34:24,880 --> 00:34:26,140
to track him down

932
00:34:26,140 --> 00:34:28,020
and this would be an amazing talk also

933
00:34:30,000 --> 00:34:32,140
but the thing that the team did

934
00:34:32,140 --> 00:34:33,840
that was really great

935
00:34:33,840 --> 00:34:34,260
was

936
00:34:34,720 --> 00:34:36,360
you know when you have a situation

937
00:34:36,360 --> 00:34:37,620
where you're trying to get attribution

938
00:34:37,620 --> 00:34:38,960
what we typically do is

939
00:34:38,960 --> 00:34:40,380
trigger a lot of back and forth

940
00:34:40,380 --> 00:34:41,900
and then sooner or later they make a mistake

941
00:34:41,900 --> 00:34:43,060
and expose something

942
00:34:43,060 --> 00:34:44,540
and it could be financial

943
00:34:44,540 --> 00:34:46,060
it could be IP

944
00:34:46,060 --> 00:34:47,520
it could be lots of different things

945
00:34:53,340 --> 00:34:53,500
and so I had to apologize

946
00:34:53,500 --> 00:34:54,680
because I had said to my team

947
00:34:54,680 --> 00:34:58,380
it's not enough to get an NDA signed by someone

948
00:34:59,360 --> 00:35:00,880
we don't know their real name

949
00:35:01,800 --> 00:35:02,280
and

950
00:35:02,840 --> 00:35:04,700
so my team did the attribution work

951
00:35:04,700 --> 00:35:07,080
and the way that they

952
00:35:08,000 --> 00:35:08,860
exposed themselves

953
00:35:08,860 --> 00:35:10,480
was when we sent the NDA

954
00:35:11,160 --> 00:35:12,120
through DocuSign

955
00:35:13,140 --> 00:35:13,940
they kind of

956
00:35:14,620 --> 00:35:16,280
it's not so easy to use your

957
00:35:16,900 --> 00:35:18,240
VPNs and TORs and stuff

958
00:35:18,240 --> 00:35:19,700
in those situations

959
00:35:19,700 --> 00:35:21,740
and so an IP leaked to us

960
00:35:23,340 --> 00:35:24,840
some other stuff that we found on blockchain

961
00:35:24,840 --> 00:35:26,320
and pretty soon

962
00:35:26,320 --> 00:35:28,600
we knew where they were

963
00:35:29,140 --> 00:35:29,880
and then

964
00:35:29,880 --> 00:35:31,500
so we knew it was Brandon

965
00:35:31,500 --> 00:35:33,960
who was the main kid behind this

966
00:35:33,960 --> 00:35:36,760
this was an email from a member of my team

967
00:35:37,340 --> 00:35:38,060
hey Brandon

968
00:35:42,840 --> 00:35:44,820
and there were like three or four things

969
00:35:44,820 --> 00:35:46,900
well first off the email was sent to Brandon's

970
00:35:46,900 --> 00:35:48,760
actual real email address

971
00:35:49,340 --> 00:35:51,380
which is not what he had been communicating with us

972
00:35:51,380 --> 00:35:52,300
and

973
00:35:53,340 --> 00:35:53,580
he said

974
00:35:53,580 --> 00:35:56,700
I wish I could see it

975
00:35:58,260 --> 00:35:59,540
because it's really good

976
00:36:03,920 --> 00:36:04,800
so anyway

977
00:36:05,720 --> 00:36:07,020
in this email

978
00:36:07,560 --> 00:36:08,420
Matt said

979
00:36:08,420 --> 00:36:10,120
a few different things

980
00:36:10,120 --> 00:36:11,120
one of which was like

981
00:36:11,120 --> 00:36:14,140
I really want to meet you and talk to you about attribution

982
00:36:14,140 --> 00:36:16,640
and obfuscation

983
00:36:16,640 --> 00:36:18,860
and how you work this all out

984
00:36:19,640 --> 00:36:21,280
and we invited him out

985
00:36:21,280 --> 00:36:22,800
to come do a talk to our whole team

986
00:36:23,340 --> 00:36:23,560
at Uber

987
00:36:24,180 --> 00:36:25,220
in that email

988
00:36:25,220 --> 00:36:27,420
we also said in the email

989
00:36:28,160 --> 00:36:29,360
one of our team is

990
00:36:29,360 --> 00:36:32,000
in town to interview you

991
00:36:32,000 --> 00:36:33,860
and check to make sure you've deleted the data

992
00:36:34,520 --> 00:36:35,040
and

993
00:36:35,040 --> 00:36:38,800
because we had figured out where in Florida he lived

994
00:36:39,220 --> 00:36:39,860
and we sent

995
00:36:39,860 --> 00:36:42,580
a member of our team

996
00:36:42,580 --> 00:36:43,940
who was a long time

997
00:36:44,980 --> 00:36:46,020
CIA interrogator

998
00:36:49,600 --> 00:36:50,940
we sent him

999
00:36:53,340 --> 00:36:53,900
and we met with Brandon

1000
00:36:53,900 --> 00:36:57,300
and he put together

1001
00:36:57,300 --> 00:36:59,580
a very long personality profile

1002
00:36:59,580 --> 00:37:01,000
and analysis of Brandon

1003
00:37:01,000 --> 00:37:03,260
and said basically this is a 19 year old kid

1004
00:37:03,260 --> 00:37:05,440
maybe he was 20 at the time

1005
00:37:05,440 --> 00:37:07,100
this is a 20 year old kid

1006
00:37:07,100 --> 00:37:08,880
who you know

1007
00:37:09,560 --> 00:37:10,380
he's afraid

1008
00:37:11,940 --> 00:37:13,800
he doesn't leave his house much

1009
00:37:13,800 --> 00:37:14,180
he

1010
00:37:15,300 --> 00:37:17,720
really likes this hacking stuff

1011
00:37:17,720 --> 00:37:18,640
and computer stuff

1012
00:37:18,640 --> 00:37:20,400
he's just gotten involved in it recently

1013
00:37:21,000 --> 00:37:22,480
he's trying to figure it all out

1014
00:37:23,960 --> 00:37:24,400
and

1015
00:37:25,040 --> 00:37:25,800
so we had

1016
00:37:25,800 --> 00:37:28,880
a couple members of my team interact with him

1017
00:37:28,880 --> 00:37:30,760
one had a lot of interaction with Brandon

1018
00:37:30,760 --> 00:37:31,180
and

1019
00:37:32,440 --> 00:37:34,800
we even tried to get him a job at a security company

1020
00:37:36,600 --> 00:37:38,180
so I think about this case

1021
00:37:38,180 --> 00:37:39,900
like I've given you some facts

1022
00:37:39,900 --> 00:37:42,200
think about it from the researcher perspective not mine

1023
00:37:42,740 --> 00:37:44,380
you know there's the version on the left

1024
00:37:45,400 --> 00:37:46,920
Uber paid 20 year old hacker

1025
00:37:46,920 --> 00:37:49,340
who lives with his mom to cover up massive data breaches

1026
00:37:49,340 --> 00:37:50,020
kind of like

1027
00:37:51,160 --> 00:37:51,920
one version

1028
00:37:53,340 --> 00:37:54,320
Nicole Pearlroth

1029
00:37:54,320 --> 00:37:56,940
who was a reporter at the New York Times

1030
00:37:56,940 --> 00:37:59,480
an excellent cyber security reporter

1031
00:37:59,480 --> 00:38:01,020
she did a detailed review

1032
00:38:01,020 --> 00:38:02,820
and published something with Mike Isaac

1033
00:38:04,440 --> 00:38:05,380
who had been

1034
00:38:05,380 --> 00:38:07,260
the main reporter for the New York Times covering Uber

1035
00:38:07,260 --> 00:38:08,700
and they actually

1036
00:38:09,160 --> 00:38:10,960
somehow got access to a bunch of the emails

1037
00:38:10,960 --> 00:38:12,640
between Brandon and my team

1038
00:38:12,640 --> 00:38:14,640
and kind of looked at it from a different perspective

1039
00:38:15,280 --> 00:38:15,800
and

1040
00:38:17,060 --> 00:38:19,120
but that didn't happen until

1041
00:38:19,120 --> 00:38:19,920
a few months later

1042
00:38:19,920 --> 00:38:23,220
and of course like the stories that come out the first week

1043
00:38:23,340 --> 00:38:25,260
are the ones that get read more than the ones that come up

1044
00:38:25,260 --> 00:38:26,020
a few weeks later

1045
00:38:27,720 --> 00:38:29,240
so now I'm going to

1046
00:38:29,240 --> 00:38:30,520
jump forward

1047
00:38:31,640 --> 00:38:33,380
to the trial again

1048
00:38:34,280 --> 00:38:34,840
and

1049
00:38:35,980 --> 00:38:37,600
the government presented its case

1050
00:38:37,600 --> 00:38:39,400
my team presented its case

1051
00:38:39,400 --> 00:38:40,540
I didn't testify

1052
00:38:42,000 --> 00:38:43,680
the jury was instructed

1053
00:38:43,680 --> 00:38:45,440
about a violation of

1054
00:38:45,440 --> 00:38:46,840
1030 which is

1055
00:38:46,840 --> 00:38:48,720
18 U.S.C. 1030

1056
00:38:49,200 --> 00:38:50,920
is kind of one of the core

1057
00:38:50,920 --> 00:38:53,320
anti-intrusion laws

1058
00:38:53,340 --> 00:38:55,580
in federal law in the United States

1059
00:38:55,580 --> 00:38:56,640
and one of the

1060
00:38:57,110 --> 00:38:58,140
fundamental thing is

1061
00:38:58,140 --> 00:39:00,760
did you access a computer without authorization

1062
00:39:01,820 --> 00:39:02,600
and so

1063
00:39:02,600 --> 00:39:05,000
it went to the jury

1064
00:39:05,560 --> 00:39:06,440
and the jury

1065
00:39:07,110 --> 00:39:09,340
was debating for a few days whether I was guilty

1066
00:39:09,340 --> 00:39:09,720
or innocent

1067
00:39:09,720 --> 00:39:12,340
and they sent out these two notes to the judge

1068
00:39:12,340 --> 00:39:14,820
the jury is allowed to send notes out to the judge

1069
00:39:15,340 --> 00:39:16,940
and in this case

1070
00:39:16,940 --> 00:39:17,760
the jury asked

1071
00:39:19,580 --> 00:39:21,280
could Uber give authorization

1072
00:39:21,280 --> 00:39:22,540
after the access

1073
00:39:24,220 --> 00:39:25,420
because that's the advice

1074
00:39:25,420 --> 00:39:27,380
if you remember the advice that the lawyer

1075
00:39:27,380 --> 00:39:28,780
testified he gave was we could

1076
00:39:29,440 --> 00:39:30,720
authorize it after the fact

1077
00:39:31,260 --> 00:39:33,440
I think he used some Latin phrase

1078
00:39:33,440 --> 00:39:35,020
nunc pro tunc during the trial

1079
00:39:35,020 --> 00:39:36,680
but the idea was

1080
00:39:38,100 --> 00:39:39,540
if somebody trespasses

1081
00:39:39,540 --> 00:39:40,760
in your yard and then you say

1082
00:39:41,340 --> 00:39:43,160
okay you're welcome

1083
00:39:43,160 --> 00:39:45,100
here there was no trespassing

1084
00:39:45,100 --> 00:39:45,800
sign but you're

1085
00:39:45,800 --> 00:39:49,140
and I didn't personally invite you yet

1086
00:39:50,080 --> 00:39:51,140
but you came in

1087
00:39:51,140 --> 00:39:52,680
and then I can authorize you after the fact

1088
00:39:53,580 --> 00:39:54,980
I've never researched the law

1089
00:39:54,980 --> 00:39:57,120
on that specifically but that was the advice

1090
00:39:57,120 --> 00:39:58,840
that I think that bounty companies

1091
00:39:58,840 --> 00:40:00,700
and a lot of programs have always had

1092
00:40:00,700 --> 00:40:03,020
because if you think about the first time a researcher

1093
00:40:03,640 --> 00:40:05,160
finds a vulnerability in a company

1094
00:40:05,160 --> 00:40:07,380
they probably haven't signed up for the bug bounty

1095
00:40:07,380 --> 00:40:09,180
program they probably haven't clicked through

1096
00:40:09,180 --> 00:40:11,120
any of those terms that could be

1097
00:40:11,120 --> 00:40:13,060
presented as quote unquote authorization

1098
00:40:13,780 --> 00:40:15,200
like that's how the companies try

1099
00:40:15,200 --> 00:40:17,120
and say that they gave authorization as you publish

1100
00:40:17,120 --> 00:40:17,640
these policies

1101
00:40:20,940 --> 00:40:23,200
the decision during the case

1102
00:40:23,340 --> 00:40:25,240
was the jury just

1103
00:40:25,240 --> 00:40:26,160
has to go back and read

1104
00:40:26,160 --> 00:40:28,400
the statute which says

1105
00:40:28,400 --> 00:40:30,820
a felony starts

1106
00:40:31,160 --> 00:40:32,700
at the time of the unauthorized access

1107
00:40:32,700 --> 00:40:34,000
or a felony is committed then

1108
00:40:35,180 --> 00:40:37,080
so the jury came back with

1109
00:40:37,080 --> 00:40:38,220
a guilty verdict for me

1110
00:40:38,900 --> 00:40:40,520
but this isn't what I'm showing you

1111
00:40:40,520 --> 00:40:43,100
I'm showing you a different

1112
00:40:43,900 --> 00:40:45,260
judgment in a criminal case

1113
00:40:45,960 --> 00:40:47,200
this is a judgment of

1114
00:40:47,200 --> 00:40:48,420
United States versus Brandon

1115
00:40:48,420 --> 00:40:49,640
the researcher

1116
00:40:50,720 --> 00:40:51,200
he

1117
00:40:53,340 --> 00:40:55,200
now also is convicted of a

1118
00:40:55,200 --> 00:40:56,380
felony as of

1119
00:40:57,090 --> 00:40:57,840
June of this year

1120
00:40:59,860 --> 00:41:01,020
so there

1121
00:41:01,020 --> 00:41:02,380
are lots of other different

1122
00:41:03,400 --> 00:41:05,180
situations I don't think I have time

1123
00:41:05,180 --> 00:41:06,460
to go into them but

1124
00:41:06,460 --> 00:41:09,220
these two researchers slash hackers

1125
00:41:09,220 --> 00:41:11,120
slash felons had

1126
00:41:11,800 --> 00:41:12,380
actually

1127
00:41:13,190 --> 00:41:14,980
gone and accessed other companies

1128
00:41:14,980 --> 00:41:17,060
in the same way and found their

1129
00:41:17,060 --> 00:41:18,800
vulnerabilities and contacted them as well

1130
00:41:19,440 --> 00:41:20,460
one of them

1131
00:41:22,000 --> 00:41:22,780
linked in

1132
00:41:24,180 --> 00:41:24,640
just

1133
00:41:25,140 --> 00:41:26,000
called it a breach

1134
00:41:26,840 --> 00:41:29,160
called in the FBI the FBI was not able to

1135
00:41:29,160 --> 00:41:29,620
find them

1136
00:41:31,440 --> 00:41:32,780
like my team was

1137
00:41:35,160 --> 00:41:37,220
we were actually in touch with the team at

1138
00:41:37,220 --> 00:41:38,460
StubHub because I think

1139
00:41:39,180 --> 00:41:41,280
the person on the StubHub team used to work

1140
00:41:41,280 --> 00:41:42,520
for me back when I was at PayPal

1141
00:41:43,130 --> 00:41:45,400
and they were dealing with a similar situation

1142
00:41:46,320 --> 00:41:47,240
they confirmed

1143
00:41:47,240 --> 00:41:48,700
to us that

1144
00:41:50,260 --> 00:41:51,180
they resolved

1145
00:41:51,180 --> 00:41:52,360
their situation as well

1146
00:41:53,340 --> 00:41:53,740
and so

1147
00:41:54,840 --> 00:41:56,580
from the outside it looks like they

1148
00:41:56,580 --> 00:41:58,940
they reached out to a bunch of companies

1149
00:41:59,580 --> 00:42:01,160
one company declared a

1150
00:42:01,160 --> 00:42:02,980
breach one paid them and

1151
00:42:02,980 --> 00:42:05,000
tried to explain bug body programs to them

1152
00:42:06,040 --> 00:42:06,480
and

1153
00:42:07,340 --> 00:42:09,320
others just kind of did different things

1154
00:42:10,540 --> 00:42:11,280
but did the

1155
00:42:11,280 --> 00:42:13,020
researchers slash hackers slash felons

1156
00:42:13,020 --> 00:42:15,340
take the data of those other companies and dump it

1157
00:42:16,020 --> 00:42:17,080
or monetize it

1158
00:42:17,080 --> 00:42:19,220
no they just deleted it actually in those cases

1159
00:42:19,220 --> 00:42:21,300
too because I think they were

1160
00:42:21,300 --> 00:42:23,240
trying to help the companies that's the way I thought about

1161
00:42:23,340 --> 00:42:25,120
it at the time and that's what like I'd love to

1162
00:42:25,120 --> 00:42:27,140
learn more about what actually happened at these other companies

1163
00:42:28,240 --> 00:42:28,680
so

1164
00:42:29,240 --> 00:42:30,720
to kind of wrap it up I think we

1165
00:42:31,560 --> 00:42:32,740
really need to

1166
00:42:33,820 --> 00:42:35,160
look at cases like

1167
00:42:35,160 --> 00:42:37,180
this from the perspective of the researcher and I

1168
00:42:37,180 --> 00:42:38,980
feel like it's hurt things a lot

1169
00:42:39,600 --> 00:42:41,160
from everything I've heard so

1170
00:42:41,160 --> 00:42:43,020
we need to get more proactive in

1171
00:42:43,020 --> 00:42:44,660
communication about

1172
00:42:45,280 --> 00:42:46,780
the realities and expectations

1173
00:42:47,160 --> 00:42:49,100
between the public researchers

1174
00:42:49,100 --> 00:42:51,140
and companies I remember

1175
00:42:51,140 --> 00:42:52,500
when this case blew up my

1176
00:42:53,340 --> 00:42:54,260
dad called me

1177
00:42:55,700 --> 00:42:57,240
that day in 2017

1178
00:42:57,240 --> 00:42:57,940
and he's like

1179
00:42:58,940 --> 00:43:00,880
nobody understands bug body programs

1180
00:43:00,880 --> 00:43:03,140
and my dad's like I think he was like

1181
00:43:03,140 --> 00:43:04,120
76 at the time

1182
00:43:05,420 --> 00:43:07,260
I was like yeah dad I know

1183
00:43:11,340 --> 00:43:11,820
we

1184
00:43:11,820 --> 00:43:15,320
we need to get better

1185
00:43:15,320 --> 00:43:17,040
at having like consistent shorter

1186
00:43:17,040 --> 00:43:17,720
policies

1187
00:43:19,040 --> 00:43:21,140
so that and we need to make sure like

1188
00:43:21,140 --> 00:43:22,920
I still don't know what the right answer

1189
00:43:23,340 --> 00:43:24,740
for guidance for people is on

1190
00:43:24,740 --> 00:43:26,860
that unauthorized access question

1191
00:43:26,860 --> 00:43:28,100
so like

1192
00:43:28,100 --> 00:43:31,140
I was talking to somebody and they said

1193
00:43:31,140 --> 00:43:33,180
I should put a slide into this presentation listing

1194
00:43:33,180 --> 00:43:35,360
20 different scenarios and ask whether

1195
00:43:35,360 --> 00:43:37,260
it's an authorized or unauthorized

1196
00:43:37,260 --> 00:43:39,240
access if it's an employee inside

1197
00:43:39,240 --> 00:43:41,240
the company who accidentally stumbles

1198
00:43:41,240 --> 00:43:43,200
on an exposed database and then

1199
00:43:43,200 --> 00:43:45,400
the employee goes into it is that an unauthorized

1200
00:43:45,400 --> 00:43:47,140
access that it's now a felony

1201
00:43:47,140 --> 00:43:49,200
if it's a pen

1202
00:43:49,200 --> 00:43:51,260
tester and they go outside

1203
00:43:51,260 --> 00:43:53,140
the boundaries of the contract and they find

1204
00:43:53,340 --> 00:43:55,080
something is that an unauthorized access

1205
00:43:55,080 --> 00:43:57,080
that needs to be reported if a bug bounty

1206
00:43:57,080 --> 00:43:58,660
person does it like

1207
00:43:58,660 --> 00:44:00,740
where you draw these lines

1208
00:44:01,260 --> 00:44:03,140
is not as clear as it should be

1209
00:44:03,880 --> 00:44:05,360
and I haven't seen any

1210
00:44:05,360 --> 00:44:06,840
I mean I don't know I don't get

1211
00:44:06,840 --> 00:44:09,200
cc'd on notifications to the government about

1212
00:44:09,200 --> 00:44:10,620
exposure but

1213
00:44:10,620 --> 00:44:13,340
I do often hear about them and talk to the security

1214
00:44:13,340 --> 00:44:15,360
leaders beforehand and they don't

1215
00:44:15,360 --> 00:44:17,320
feel like they have clarity on these issues

1216
00:44:19,660 --> 00:44:21,200
I hope that the department

1217
00:44:21,200 --> 00:44:23,080
of justice continues to invest in

1218
00:44:23,980 --> 00:44:24,460
dedicated

1219
00:44:25,380 --> 00:44:26,680
lawyers who understand

1220
00:44:26,680 --> 00:44:29,120
cyber security and that they get

1221
00:44:29,120 --> 00:44:30,780
all over the country and that they

1222
00:44:30,780 --> 00:44:32,360
that they're involved in all these cases

1223
00:44:32,360 --> 00:44:35,200
you know there's that one really good thing that DOJ has

1224
00:44:35,200 --> 00:44:36,780
is a policy that anytime

1225
00:44:37,300 --> 00:44:39,160
a security researcher is

1226
00:44:39,160 --> 00:44:40,160
to be prosecuted

1227
00:44:41,040 --> 00:44:42,920
by one of the districts out in the country

1228
00:44:42,920 --> 00:44:45,220
they're supposed to run it by the computer crime section

1229
00:44:45,220 --> 00:44:47,260
in Washington DC so I think that's

1230
00:44:47,260 --> 00:44:49,040
a good thing and I'd like to see more

1231
00:44:49,040 --> 00:44:49,820
stuff like that

1232
00:44:51,440 --> 00:44:51,920
um

1233
00:44:53,340 --> 00:44:55,400
the thing that bothered my team

1234
00:44:55,400 --> 00:44:57,080
the most was a lot of people

1235
00:44:57,080 --> 00:44:59,360
telling them if they'd just

1236
00:44:59,360 --> 00:45:00,200
done the right thing

1237
00:45:00,960 --> 00:45:02,960
like none of this would have happened that's not the

1238
00:45:02,960 --> 00:45:05,220
that's too simplistic a perspective on

1239
00:45:05,220 --> 00:45:06,580
these complicated dynamics

1240
00:45:08,320 --> 00:45:08,880
um

1241
00:45:08,880 --> 00:45:11,300
I want companies to be able to launch

1242
00:45:11,300 --> 00:45:12,680
these programs I want researchers

1243
00:45:12,680 --> 00:45:15,280
I want somebody to get that million dollar bounty

1244
00:45:16,080 --> 00:45:17,480
and so we need

1245
00:45:17,480 --> 00:45:19,100
to create an environment where companies

1246
00:45:19,100 --> 00:45:20,960
are comfortable launching these programs

1247
00:45:20,960 --> 00:45:21,720
more than ever

1248
00:45:23,380 --> 00:45:25,260
and I want to make sure we educate

1249
00:45:25,260 --> 00:45:27,060
young people on the right ways

1250
00:45:27,060 --> 00:45:28,060
to do these things

1251
00:45:29,140 --> 00:45:29,540
um

1252
00:45:30,460 --> 00:45:33,260
I wish Roots still existed as part of

1253
00:45:33,260 --> 00:45:35,240
DEFCON cause my daughters got to go to that

1254
00:45:35,680 --> 00:45:37,220
growing up and they learned a lot about

1255
00:45:37,220 --> 00:45:39,100
this stuff and we need to have programs

1256
00:45:39,100 --> 00:45:41,260
like that like when we talk about cyber education

1257
00:45:41,260 --> 00:45:43,080
for kids in schools and stuff like that

1258
00:45:43,080 --> 00:45:44,740
it should actually be teaching them about

1259
00:45:44,740 --> 00:45:46,920
bug bounty programs and how they could go make money

1260
00:45:46,920 --> 00:45:47,760
while they're in high school

1261
00:45:49,180 --> 00:45:50,500
cause then they'd really learn

1262
00:45:52,020 --> 00:45:53,260
cause they'd be motivated

1263
00:45:53,340 --> 00:45:55,120
so anyway

1264
00:45:55,120 --> 00:45:56,180
I think um

1265
00:45:58,000 --> 00:45:58,840
that's basically

1266
00:45:59,680 --> 00:46:01,200
um the stuff that I've been

1267
00:46:01,200 --> 00:46:02,480
thinking about we need to

1268
00:46:03,060 --> 00:46:04,900
really harmonize our program policies

1269
00:46:04,900 --> 00:46:07,340
we need to engage people we need to talk about this stuff

1270
00:46:07,340 --> 00:46:09,320
we need to kind of change so that my dad

1271
00:46:09,320 --> 00:46:10,300
doesn't have to say again

1272
00:46:10,300 --> 00:46:11,780
people don't understand

1273
00:46:13,760 --> 00:46:14,640
um so

1274
00:46:14,640 --> 00:46:16,820
why am I doing this talk why am I taking

1275
00:46:16,820 --> 00:46:19,120
risk standing up here and talking about this stuff

1276
00:46:19,120 --> 00:46:20,160
it's because um

1277
00:46:20,880 --> 00:46:22,540
I think this stuff is really important

1278
00:46:23,340 --> 00:46:25,280
and I think we should be looking at it from

1279
00:46:25,280 --> 00:46:27,240
the researcher perspective as well as everybody else

1280
00:46:27,240 --> 00:46:28,040
um

1281
00:46:28,900 --> 00:46:31,440
I since I'm on stage I want to use this opportunity

1282
00:46:31,440 --> 00:46:32,180
to pitch

1283
00:46:32,180 --> 00:46:34,760
my non-profit work for one second

1284
00:46:35,340 --> 00:46:37,000
uh I'm the CEO of a non-profit

1285
00:46:37,000 --> 00:46:38,340
I go to Ukraine and help

1286
00:46:38,340 --> 00:46:41,220
I originally tried to

1287
00:46:41,220 --> 00:46:43,040
volunteer to do cyber security work there

1288
00:46:43,040 --> 00:46:45,300
because when I was the CSO of Cloudflare

1289
00:46:45,300 --> 00:46:46,980
last year we did a lot of work to help

1290
00:46:46,980 --> 00:46:49,260
and so I really enjoyed that and when I left

1291
00:46:49,260 --> 00:46:51,180
Cloudflare at the end of last year I wanted

1292
00:46:51,180 --> 00:46:53,220
to stay involved turns out that

1293
00:46:53,340 --> 00:46:55,280
our non-profit we focused more on medical

1294
00:46:55,280 --> 00:46:57,280
equipment and then we started a new program in

1295
00:46:57,280 --> 00:46:59,120
January that I initiated

1296
00:46:59,120 --> 00:47:01,320
we get companies to donate their used

1297
00:47:01,320 --> 00:47:03,500
laptops and I bring them over

1298
00:47:03,500 --> 00:47:05,260
these two pictures on the right

1299
00:47:05,260 --> 00:47:06,460
were me delivering laptops

1300
00:47:07,300 --> 00:47:09,460
to kids in the Bucha region

1301
00:47:09,460 --> 00:47:11,320
north of Kyiv that had been

1302
00:47:11,320 --> 00:47:13,280
devastated in the initial days of the

1303
00:47:13,280 --> 00:47:14,800
invasion I was in Ukraine

1304
00:47:15,340 --> 00:47:17,300
last month and so these pictures

1305
00:47:17,300 --> 00:47:19,380
are from there on the left side was on the 4th of July

1306
00:47:19,380 --> 00:47:21,420
we were with some troops who just got back

1307
00:47:21,420 --> 00:47:23,220
from Bakhmut and we were doing

1308
00:47:23,340 --> 00:47:24,360
medical training on

1309
00:47:25,680 --> 00:47:26,700
how to use

1310
00:47:27,180 --> 00:47:28,960
tourniquets the right way it's the most important

1311
00:47:28,960 --> 00:47:30,440
thing they need to know medically

1312
00:47:31,120 --> 00:47:32,760
and so we were there and

1313
00:47:33,840 --> 00:47:35,240
if you work in a company

1314
00:47:35,240 --> 00:47:37,140
go find out what you do with your

1315
00:47:37,140 --> 00:47:39,260
used laptops and send me

1316
00:47:39,260 --> 00:47:40,640
a note every

1317
00:47:41,280 --> 00:47:43,340
laptop that I've brought to Ukraine

1318
00:47:43,340 --> 00:47:45,200
has become has come to

1319
00:47:45,200 --> 00:47:47,180
my organization because of somebody in the security

1320
00:47:47,180 --> 00:47:49,100
community worked to

1321
00:47:49,100 --> 00:47:50,540
get the people inside their company

1322
00:47:51,500 --> 00:47:53,260
and I can't tell you how

1323
00:47:53,340 --> 00:47:55,200
happy you can make a 13

1324
00:47:55,200 --> 00:47:57,260
year old who's doing remote

1325
00:47:57,260 --> 00:47:59,080
schooling on their parents

1326
00:47:59,080 --> 00:48:01,260
phone feel when you show

1327
00:48:01,260 --> 00:48:02,460
up and give them a MacBook Pro

1328
00:48:03,080 --> 00:48:05,280
it was like that the girl on the bottom

1329
00:48:05,280 --> 00:48:07,320
right and her mom we had to wait 20 minutes

1330
00:48:07,320 --> 00:48:09,160
to take this picture so that they could stop crying

1331
00:48:10,300 --> 00:48:10,940
it's like

1332
00:48:10,940 --> 00:48:13,140
what we take for granted you know they're

1333
00:48:13,140 --> 00:48:15,080
trying to live a normal life in a war zone

1334
00:48:15,520 --> 00:48:17,200
kids can't just like hide in a

1335
00:48:17,200 --> 00:48:18,880
bunker for years they need to actually

1336
00:48:18,880 --> 00:48:21,160
you know they had to go through COVID

1337
00:48:21,160 --> 00:48:23,200
there too and do remote schooling and now they're

1338
00:48:23,340 --> 00:48:25,380
still in remote schooling half the kids

1339
00:48:25,380 --> 00:48:27,180
in the country are in remote schooling and half of those

1340
00:48:27,180 --> 00:48:28,940
kids don't have a laptop so

1341
00:48:29,640 --> 00:48:31,260
the other reason I'm doing this is

1342
00:48:31,260 --> 00:48:33,300
because I told the judge in my

1343
00:48:33,300 --> 00:48:35,500
case I wrote a letter to him before my sentencing

1344
00:48:35,500 --> 00:48:36,940
and I said if you don't send me to prison

1345
00:48:37,700 --> 00:48:39,240
I will stand up and I will

1346
00:48:39,240 --> 00:48:41,160
talk about the things we need to do

1347
00:48:41,160 --> 00:48:43,300
better and I think this

1348
00:48:43,300 --> 00:48:44,820
is one of those things that we need to do better

1349
00:48:45,220 --> 00:48:47,180
so I told him I would

1350
00:48:47,180 --> 00:48:49,100
put my name on the list for every conference

1351
00:48:49,100 --> 00:48:50,300
and go and talk and

1352
00:48:51,780 --> 00:48:53,140
the government the prosecutors

1353
00:48:53,340 --> 00:48:54,660
were asking that I get 15 months

1354
00:48:55,800 --> 00:48:57,040
and the judge said

1355
00:48:58,500 --> 00:48:59,220
no thankfully

1356
00:48:59,800 --> 00:49:01,100
so I'm here to give this talk

1357
00:49:01,680 --> 00:49:03,340
but I have to live up to my commitment

1358
00:49:03,340 --> 00:49:05,200
to the judge that I will talk about

1359
00:49:05,200 --> 00:49:07,240
these things right now so thank you

1360
00:49:07,240 --> 00:49:07,780
for your time