1
00:00:05,420 --> 00:00:13,580
So, good afternoon. Welcome to Policy at DEF CON. This talk is a panel titled, all of your

2
00:00:13,580 --> 00:00:22,000
vones are belong to terms and conditions. And it's chaired by David Rogers. Closer to the

3
00:00:22,000 --> 00:00:27,720
mic. The title is all your vones are belong to terms and conditions and it's chaired by

4
00:00:27,720 --> 00:00:33,320
David Rogers. A few announcements. This talk is being hosted on the record, I believe.

5
00:00:35,280 --> 00:00:39,880
Cell phones, we ask that you check your cell phones are silent as a courtesy. If the speaker,

6
00:00:39,980 --> 00:00:44,740
if we take questions at the end, please use the mic so we can hear you and very close to the

7
00:00:44,740 --> 00:00:49,440
mic. As a reminder, photo policy prohibits taking pictures without the permission of

8
00:00:49,440 --> 00:00:54,120
everyone in the frame. And with that, let's get started. Please welcome our panel.

9
00:01:03,360 --> 00:01:09,800
We're going to live down to your expectations, I think. So, welcome, everybody. And thank

10
00:01:09,800 --> 00:01:17,100
you for coming. My name is David Rogers. I guess, why am I here doing CVD? So, I created

11
00:01:17,100 --> 00:01:22,380
the CVD program at the Mobile Industry Association, GSMA, and I had to fight hard for it. So,

12
00:01:22,400 --> 00:01:27,380
I know the pains and tribulations of it. And I'm going to be moderating this panel.

13
00:01:27,380 --> 00:01:34,940
Well, we talk everything from vulnerabilities, through to legal, through to how we can help

14
00:01:34,940 --> 00:01:43,880
hackers and what's going on around the world. So, in flow order, I'd like our speakers to

15
00:01:43,880 --> 00:01:47,760
just introduce themselves and just tell us a little bit about themselves, so, well.

16
00:01:48,480 --> 00:01:57,300
Hi, everyone. I hope you're having a good DEF CON. So, I'm Katie Noble, Katie Trimble Noble for some people, because you

17
00:01:57,380 --> 00:02:03,820
might know me in my previous persona. So, I am one of the four Bug Bounty Katie's. There's

18
00:02:03,820 --> 00:02:09,180
me, there's me. There's Katie Nichols, and there's Katie Masouris. So, I'm half of the

19
00:02:09,180 --> 00:02:15,900
four Bug Bounty Katie's in the world. Yeah, I know. It's great. So, my background, I

20
00:02:15,900 --> 00:02:22,160
worked for the U.S. Government for about 15 years, previously at CISA. I did coordinated

21
00:02:22,160 --> 00:02:27,360
vulnerability disclosure, where I ran the vulnerabilities equities process, the MITRE CVD, and the

22
00:02:27,380 --> 00:02:32,640
program, which I'm still a board member of, the NVD program, the Carnegie Mellon CERT-CC

23
00:02:32,640 --> 00:02:35,220
program, and the ICS CERT vulnerability handling program.

24
00:02:35,440 --> 00:02:40,280
And our claim to fame was that we coordinated and disclosed over 20,000 cybersecurity vulnerabilities

25
00:02:40,660 --> 00:02:41,880
in a two-year time period.

26
00:02:42,120 --> 00:02:47,420
And I currently work for a Fortune 50 tech company where I am the Director of Product

27
00:02:47,420 --> 00:02:52,260
Security Incident Response and Bug Bounty, and we won't name that company because I'm

28
00:02:52,260 --> 00:02:53,060
not really here.

29
00:02:57,420 --> 00:02:58,220
Hi, everybody.

30
00:02:58,380 --> 00:03:01,100
My name is Harley Geiger, and I am a cybersecurity lawyer.

31
00:03:01,520 --> 00:03:04,320
I'm currently with a law firm called Venable.

32
00:03:04,580 --> 00:03:09,900
I, too, am not representing Venable here, and nothing that you hear is legal advice.

33
00:03:10,400 --> 00:03:12,520
You do need a lawyer, but I am not your lawyer.

34
00:03:14,100 --> 00:03:20,940
And prior to joining Venable, I was in-house at Rapid7, and I was also a Hill staffer,

35
00:03:20,940 --> 00:03:22,240
again, working on cybersecurity.

36
00:03:22,240 --> 00:03:26,640
I've been working on cybersecurity and privacy for about 15 years, and now I help people

37
00:03:26,640 --> 00:03:27,260
with compliance.

38
00:03:27,460 --> 00:03:32,980
I help people with incident management and focus a lot on hacker law and vulnerability

39
00:03:32,980 --> 00:03:33,440
disclosure.

40
00:03:35,680 --> 00:03:36,480
Thank you.

41
00:03:37,800 --> 00:03:38,200
Hi.

42
00:03:38,460 --> 00:03:39,300
My name's Casey.

43
00:03:39,500 --> 00:03:43,200
I am the token non-American on the panel, I guess, in terms of the-

44
00:03:43,200 --> 00:03:43,300
That's not true.

45
00:03:43,420 --> 00:03:43,960
That's not true.

46
00:03:44,420 --> 00:03:45,000
Book-ended.

47
00:03:45,180 --> 00:03:45,780
Book-ended.

48
00:03:45,920 --> 00:03:46,020
Okay.

49
00:03:46,080 --> 00:03:46,620
We're book-ended.

50
00:03:47,040 --> 00:03:47,520
That's right.

51
00:03:47,640 --> 00:03:47,800
Okay.

52
00:03:47,880 --> 00:03:48,760
So forget all of that.

53
00:03:48,760 --> 00:03:49,840
He's going to mention the ashes in a minute.

54
00:03:49,940 --> 00:03:50,820
I'm just getting this one in.

55
00:03:50,960 --> 00:03:51,380
There you go.

56
00:03:51,520 --> 00:03:52,220
Let's get this one in.

57
00:03:52,240 --> 00:03:52,720
Let's get this party started.

58
00:03:53,080 --> 00:03:53,480
No.

59
00:03:53,580 --> 00:03:56,180
So I'm the founder and CTO of Bug Crowd.

60
00:03:56,360 --> 00:04:00,420
Bug Crowd, we didn't invent vulnerability disclosure or bug banning program.

61
00:04:00,580 --> 00:04:04,480
That was prior art, but we did pioneer the idea of putting a platform in between all

62
00:04:04,480 --> 00:04:07,980
of the researchers that are out there and all of the potential problems that exist on

63
00:04:07,980 --> 00:04:09,260
the defender side of things.

64
00:04:09,440 --> 00:04:15,060
So that informs my point of view on this subject, because we've seen quite a bit in the course

65
00:04:15,060 --> 00:04:16,880
of the last 11 years of doing this stuff.

66
00:04:17,360 --> 00:04:20,240
Also the co-founder of the Disclose.io project, which-

67
00:04:20,240 --> 00:04:21,600
I can't hear you back there.

68
00:04:25,200 --> 00:04:25,680
Better?

69
00:04:26,600 --> 00:04:30,760
Also the co-founder of the Disclose.io project, which is basically a vulnerability policy

70
00:04:30,760 --> 00:04:36,280
standardization exercise that's been running now for the better part of eight years in

71
00:04:36,280 --> 00:04:36,680
this form.

72
00:04:36,820 --> 00:04:41,040
But I think the prior art there goes back to Rainforest Puppy in 2001 and stuff that

73
00:04:41,040 --> 00:04:41,960
existed before that.

74
00:04:42,120 --> 00:04:50,360
So really the idea of that is to make the adoption of sane VDP language and VDP terminology

75
00:04:50,360 --> 00:04:53,860
easy, or at least as difficult to screw up as possible.

76
00:04:54,540 --> 00:04:58,880
And as a part of that, to actually put positive pressure on top-down legislative change that

77
00:04:58,880 --> 00:05:04,040
have been involved in things like the charging rule changes out of DOJ, election security

78
00:05:04,040 --> 00:05:10,020
administrative guidance out of CISR in 2020, BOD 2001, and so on and so forth.

79
00:05:10,220 --> 00:05:10,640
So yeah.

80
00:05:11,160 --> 00:05:11,600
Cool.

81
00:05:12,040 --> 00:05:15,720
Already I mentioned Rainforest Puppy, so maybe we need to rewind a bit in history.

82
00:05:15,900 --> 00:05:17,260
So just a show of hands.

83
00:05:17,360 --> 00:05:20,040
So first of all, who knows what vulnerability disclosure is?

84
00:05:20,160 --> 00:05:20,340
Yeah.

85
00:05:21,520 --> 00:05:22,280
That's good, right?

86
00:05:22,620 --> 00:05:25,240
Who knows what coordinated vulnerability disclosures?

87
00:05:26,600 --> 00:05:26,980
Okay.

88
00:05:27,360 --> 00:05:28,700
So a lot less, right?

89
00:05:29,300 --> 00:05:30,940
Who knows Rainforest Puppy?

90
00:05:32,680 --> 00:05:34,140
Who's heard of Rainforest Puppy?

91
00:05:34,300 --> 00:05:34,480
Oh, God.

92
00:05:34,600 --> 00:05:35,020
I'm old.

93
00:05:35,200 --> 00:05:35,580
Okay.

94
00:05:35,640 --> 00:05:37,560
So the history is slipping away.

95
00:05:37,800 --> 00:05:38,020
Wow.

96
00:05:40,440 --> 00:05:44,220
Actually, you should look him up, because that whole brinksmanship process is really,

97
00:05:44,320 --> 00:05:44,860
really interesting.

98
00:05:46,120 --> 00:05:47,400
But I'm just going to ask...

99
00:05:47,400 --> 00:05:48,880
Maybe we start with Katie, actually.

100
00:05:49,000 --> 00:05:50,340
Like, just give us the very short story.

101
00:05:50,360 --> 00:05:50,980
Just the short part of history.

102
00:05:51,820 --> 00:05:55,820
We're talking like we're over 20 years in really to all this stuff, right?

103
00:05:56,360 --> 00:05:56,800
Yeah.

104
00:05:56,860 --> 00:05:59,400
That poll just then makes me feel super old.

105
00:05:59,540 --> 00:06:00,360
So thank you for all...

106
00:06:00,360 --> 00:06:01,500
Thank you everyone for that.

107
00:06:02,480 --> 00:06:02,920
Yeah.

108
00:06:03,040 --> 00:06:04,640
I mean, look, I think the history...

109
00:06:05,920 --> 00:06:11,240
There's a talk I give titled The Unlikely Romance, and this is why, basically.

110
00:06:11,520 --> 00:06:15,660
When you think about where we're up to at this point in time, we have reached a point

111
00:06:15,660 --> 00:06:19,200
where hackers and organizations can at least have a productive conversation.

112
00:06:19,960 --> 00:06:25,700
That's really only an advance of the last 10 years through my eyes, and that's partly

113
00:06:25,700 --> 00:06:28,560
through the work that Bug Crowd's done, it's partly through the work that a lot of other

114
00:06:28,560 --> 00:06:30,620
people have done to keep pressure on this.

115
00:06:31,060 --> 00:06:35,640
That effort goes back a long ways, and I think really what it comes down to when you

116
00:06:35,640 --> 00:06:39,840
start looking into some of the stories that come out of the late 80s and 90s, it's this

117
00:06:39,840 --> 00:06:45,600
idea of security not even being a consideration in kind of the early creation of the internet,

118
00:06:45,720 --> 00:06:46,760
the early creation of software.

119
00:06:47,000 --> 00:06:49,040
And all of a sudden, people start to break things.

120
00:06:49,040 --> 00:06:54,780
Because they can, that hacker spirit starts to manifest in this domain, and everyone probably

121
00:06:54,780 --> 00:06:55,380
freaks out.

122
00:06:56,020 --> 00:06:56,960
You've got...

123
00:06:56,960 --> 00:07:03,660
The best example of that's the CFAA, which legend has it, was written after Ronald Reagan

124
00:07:03,660 --> 00:07:09,680
watched War Games at Camp David and freaked out, basically, and went to the DOJ, and the

125
00:07:10,200 --> 00:07:12,560
CFAA was ultimately the product of that fear.

126
00:07:12,740 --> 00:07:16,760
The fact that that prompted the creation of regulation, I think that was important

127
00:07:16,760 --> 00:07:17,300
to do.

128
00:07:17,420 --> 00:07:18,760
But that baseline...

129
00:07:19,040 --> 00:07:19,380
It was like, ah!

130
00:07:19,580 --> 00:07:23,200
Freak out reaction, I think, kind of informed how that legislation was created.

131
00:07:23,520 --> 00:07:27,160
There's lots of different examples of that, and we've had to basically claw back from

132
00:07:27,160 --> 00:07:27,600
that ever since.

133
00:07:28,900 --> 00:07:32,560
Just recall that Ronald Reagan also watched Encounters of the Third Kind, didn't he?

134
00:07:33,360 --> 00:07:34,940
But that's a different story, right?

135
00:07:36,480 --> 00:07:38,480
So Katie used to work for the government, didn't he?

136
00:07:40,640 --> 00:07:42,000
So how do...

137
00:07:42,000 --> 00:07:43,440
So we kind of come all this way.

138
00:07:43,640 --> 00:07:46,720
There's been a lot of pain along the way, particularly for hackers who've been sued,

139
00:07:46,840 --> 00:07:49,020
and badly treated.

140
00:07:49,040 --> 00:07:50,440
They've been treated by companies and so on.

141
00:07:50,620 --> 00:07:56,200
So we've got to the point where, you know, CBD is a thing, and governments are advocating

142
00:07:56,200 --> 00:07:56,720
for it.

143
00:07:56,820 --> 00:08:01,180
So how do governments at the moment handle vulnerability defense and disclosure?

144
00:08:03,540 --> 00:08:11,160
I do not represent the government, but I will represent my own interactions with this

145
00:08:11,640 --> 00:08:12,560
particular topic.

146
00:08:12,760 --> 00:08:18,180
So I will say that in the last, I would say probably 2015 or so, there was a, what I would

147
00:08:18,180 --> 00:08:19,740
like to refer to as a watershed moment.

148
00:08:20,360 --> 00:08:28,360
We really did start to see the U.S. government and other foreign governments start shifting

149
00:08:28,360 --> 00:08:35,660
their mindset from vulnerability disclosure being a terrible thing to, hey, this is...

150
00:08:35,660 --> 00:08:39,200
If you see something, say something, this could be actually really good for us.

151
00:08:39,540 --> 00:08:43,800
And I think one of the big things that made that change was really the DOD's Hack the

152
00:08:43,800 --> 00:08:44,560
Pentagon effort.

153
00:08:44,860 --> 00:08:48,160
I think when Hack the Pentagon happened, it was something that was so...

154
00:08:48,160 --> 00:08:51,980
So groundbreaking, because all of a sudden the Department of Defense, the grudgy Department

155
00:08:51,980 --> 00:08:58,300
of Defense that's got all the guns and scary things, was saying, actually, maybe we should

156
00:08:58,300 --> 00:09:04,120
take these security researchers a little seriously and bring them in and see what they tell us

157
00:09:04,120 --> 00:09:05,040
and test ourselves.

158
00:09:05,300 --> 00:09:05,940
We are confident.

159
00:09:06,140 --> 00:09:07,820
So let's test that.

160
00:09:07,880 --> 00:09:08,420
Let's not be afraid.

161
00:09:08,700 --> 00:09:10,220
And that was a huge moment.

162
00:09:10,320 --> 00:09:15,360
I think that sent a huge signal to private industry and to other governments and other

163
00:09:15,360 --> 00:09:16,060
government agencies.

164
00:09:16,400 --> 00:09:17,540
So again, DOD.

165
00:09:17,540 --> 00:09:20,960
And the federal executive agencies, I know a lot of times we think the U.S. government

166
00:09:20,960 --> 00:09:25,100
or the government, and we just kind of think big government, it's all the same, but they

167
00:09:25,100 --> 00:09:25,660
are different.

168
00:09:25,820 --> 00:09:27,500
And their relationships are very different.

169
00:09:27,800 --> 00:09:28,760
So you have...

170
00:09:28,760 --> 00:09:31,500
So I don't mean to give you a civics lesson, so I'll make it really quick.

171
00:09:31,700 --> 00:09:35,160
But DOD has what we refer to as a parent-child relationship.

172
00:09:35,420 --> 00:09:40,140
So there's DOD, and then there's Air Force, Navy, you get the idea here, right?

173
00:09:40,240 --> 00:09:41,960
So they have a parent-child relationship.

174
00:09:42,280 --> 00:09:45,540
And then the federal executive agencies have really a sibling relationship.

175
00:09:45,980 --> 00:09:46,940
So you have...

176
00:09:47,540 --> 00:09:50,780
It's Department of Homeland Security, Department of Commerce, Department of Treasury.

177
00:09:50,960 --> 00:09:53,360
They all work together, but they're more siblings.

178
00:09:53,560 --> 00:09:59,440
They don't have the ability to force each other to do things, except in slight situations,

179
00:09:59,540 --> 00:10:02,880
particularly OMB has the power of the purse, so they can force most people to do a lot

180
00:10:02,880 --> 00:10:03,160
of things.

181
00:10:03,420 --> 00:10:09,700
But when DOD did that, it sent a very strong signal to the rest of the government that

182
00:10:09,700 --> 00:10:11,300
they should be open to this idea as well.

183
00:10:11,420 --> 00:10:15,940
And then we started seeing CISA really pick it up as well, with the creation of CISA,

184
00:10:16,060 --> 00:10:17,140
which happened in 2018.

185
00:10:17,140 --> 00:10:21,180
And the Homeland Security really picked it up from there.

186
00:10:21,340 --> 00:10:25,380
And so I think that that really did change it and open the door.

187
00:10:25,520 --> 00:10:28,860
And now we have things like Hack Satellite, they hacked the DHS.

188
00:10:30,480 --> 00:10:32,580
It really was groundbreaking.

189
00:10:32,840 --> 00:10:38,020
And it's very exciting because now, instead of the, don't go to the government because

190
00:10:38,020 --> 00:10:41,140
the government's scary and the law enforcement is gonna show up at your door.

191
00:10:41,360 --> 00:10:46,440
Now the relationship is, if you have a problem, if there's an issue, go to CISA, because CISA

192
00:10:46,440 --> 00:10:47,100
will help you.

193
00:10:47,340 --> 00:10:52,480
And that's very different for the individual hacker than it was 10 years ago.

194
00:10:52,780 --> 00:10:57,760
So I like to show that as a really great evolution of the way things could be and should be and

195
00:10:57,760 --> 00:10:58,340
are trending.

196
00:10:59,140 --> 00:11:05,540
I would add on to this, to the question of how the government is treating vulnerability

197
00:11:05,540 --> 00:11:11,120
disclosure now, a couple of other developments just in the past couple years, an important

198
00:11:11,120 --> 00:11:16,320
one is now all federal civilian agencies are required to have a coordinated vulnerability

199
00:11:16,440 --> 00:11:17,260
disclosure program.

200
00:11:17,700 --> 00:11:22,360
So CISA worked with, and it wasn't, so CISA has the power of creating binding operational

201
00:11:22,360 --> 00:11:23,260
directives.

202
00:11:23,460 --> 00:11:29,440
They're usually not really enforceable unless OMB attaches some teeth to it.

203
00:11:29,540 --> 00:11:31,140
And in this case, they did.

204
00:11:31,340 --> 00:11:33,120
So CISA and OMB worked together.

205
00:11:33,240 --> 00:11:36,640
Now all civilian agencies should have a vulnerability disclosure process.

206
00:11:36,920 --> 00:11:42,260
If you look at, pick the Department of Education or HHS or something like that, you should

207
00:11:42,260 --> 00:11:44,180
be able to find their VDP page.

208
00:11:44,460 --> 00:11:46,420
And it is, in fact, a vulnerability disclosure program.

209
00:11:46,440 --> 00:11:51,080
It's a bit more permissive, you know, it provides a measure of authorization that we

210
00:11:51,080 --> 00:11:53,280
don't see as often in the private sector.

211
00:11:53,700 --> 00:11:55,040
So that's one piece.

212
00:11:55,200 --> 00:11:56,320
There are several others.

213
00:11:56,460 --> 00:12:02,260
We are seeing CVD being brought into regulation as well as, and particularly for government

214
00:12:02,260 --> 00:12:08,940
contractors, for IOT devices, and as well as best practices in a variety of sectors.

215
00:12:09,220 --> 00:12:11,740
An important one is the NIST cybersecurity framework.

216
00:12:12,000 --> 00:12:16,060
So the cybersecurity framework is used, it started out for just critical infrastructure,

217
00:12:16,060 --> 00:12:18,160
but now it's being used in a lot of other sectors as well.

218
00:12:18,220 --> 00:12:20,300
It's sort of the gold standard for risk management.

219
00:12:20,520 --> 00:12:21,520
And CVD is in there.

220
00:12:22,180 --> 00:12:26,640
The last thing I'll say about it, it relates to the treatment of hackers specifically.

221
00:12:27,520 --> 00:12:34,500
We have, starting in about 2018, we saw the Department of Justice, on more than one occasion,

222
00:12:34,660 --> 00:12:39,700
step up and create and advocate for specific protection, legal protection, for security

223
00:12:39,700 --> 00:12:40,180
researchers.

224
00:12:40,580 --> 00:12:43,640
They did this, we mentioned the DMCA earlier.

225
00:12:44,000 --> 00:12:45,480
The DMCA.

226
00:12:45,960 --> 00:12:49,500
The Department of Justice, in two different occasions, issued letters to the Copyright

227
00:12:49,500 --> 00:12:52,700
Office saying, we should not be charging hackers into the DMCA.

228
00:12:52,880 --> 00:12:57,600
And it was very influential in getting strong protection for security research under DMCA.

229
00:12:58,280 --> 00:13:02,080
I think it was about a year and a half ago, the Department of Justice also changed the

230
00:13:02,080 --> 00:13:07,740
charging policy under the CFAA, saying that prosecutors should decline to prosecute good

231
00:13:07,740 --> 00:13:10,000
faith security researchers for good faith security research.

232
00:13:10,180 --> 00:13:14,100
Like they're not going to withhold if you're doing extortion or something.

233
00:13:14,100 --> 00:13:19,680
So, as far as I'm concerned, the federal government has made tremendous strides on

234
00:13:19,680 --> 00:13:22,680
adopting CVD and protection of hackers.

235
00:13:22,960 --> 00:13:27,520
The places that I think we need to catch up now actually are the private sector and

236
00:13:27,520 --> 00:13:28,000
the states.

237
00:13:28,680 --> 00:13:32,700
These things that we've just discussed are not necessarily there in the private sector,

238
00:13:32,780 --> 00:13:36,620
not as much adoption of CVD, and the states still have, like all the things that we've

239
00:13:36,620 --> 00:13:39,080
complained about for CFAA are present in state law.

240
00:13:39,860 --> 00:13:42,160
But there are other countries around the world.

241
00:13:42,780 --> 00:13:43,260
So.

242
00:13:44,100 --> 00:13:47,740
I just want to, I'm being flippant, but I just want to touch, so my own experience,

243
00:13:47,940 --> 00:13:54,040
so I can give you a kind of war story here about how successful really coordinated vulnerability

244
00:13:54,040 --> 00:14:00,400
disclosure as a concept has become, and you see this sort of snowball effect of governments

245
00:14:00,400 --> 00:14:01,800
and understanding and adopting it.

246
00:14:02,000 --> 00:14:10,300
So back in 2017, I wrote a document to create some principles on IoT security, and that

247
00:14:10,300 --> 00:14:11,420
was in a government committee.

248
00:14:12,040 --> 00:14:12,520
And.

249
00:14:12,520 --> 00:14:18,760
I put vulnerability disclosure policy as a key requirement on IoT manufacturers, and

250
00:14:18,760 --> 00:14:23,900
there was a guy in the room and he said, we can't talk to the hackers, we shouldn't be

251
00:14:23,900 --> 00:14:24,440
talking to hackers.

252
00:14:24,880 --> 00:14:30,660
And it was that kind of age old issue that all of us have fought for years and years

253
00:14:30,660 --> 00:14:31,000
and years.

254
00:14:31,460 --> 00:14:38,020
And but I, in that moment, I was really, really confident because we already had two ISO specs,

255
00:14:38,280 --> 00:14:40,820
so two international standards for vulnerability disclosure.

256
00:14:41,300 --> 00:14:42,500
And it was already adopted.

257
00:14:42,520 --> 00:14:46,500
It was adopted as good practice by companies on the West Coast of the States.

258
00:14:47,020 --> 00:14:48,840
So I was, I had that moment.

259
00:14:48,960 --> 00:14:53,020
I was really confident to be able to say, no, you're talking complete rubbish and we

260
00:14:53,020 --> 00:14:53,460
got it through.

261
00:14:53,620 --> 00:14:57,520
But that, that sort of attitude still persisted and it was great to have the reference points.

262
00:14:57,620 --> 00:15:00,640
And I always think that we're sort of standing on the shoulders of giants each time we move

263
00:15:00,640 --> 00:15:01,580
this subject forward.

264
00:15:02,560 --> 00:15:04,500
And you're seeing this thing.

265
00:15:04,580 --> 00:15:08,140
So that, that thing became an international standard and it was adopted across the world.

266
00:15:08,280 --> 00:15:11,160
So in Australia, Singapore, India, Turkey.

267
00:15:11,860 --> 00:15:12,500
And it's been around for a long time.

268
00:15:12,520 --> 00:15:17,440
It's baked in and it's also now law in the UK through the Product Security and Telecommunications

269
00:15:17,440 --> 00:15:19,580
Infrastructure Act, which is a PSTI act.

270
00:15:19,960 --> 00:15:25,480
And that in turn, I know that's not subject to this panel, is starting to create new discussions

271
00:15:25,480 --> 00:15:27,320
about what we define as computer misuse.

272
00:15:28,580 --> 00:15:33,040
And that, so it feels like that's the kind of next step in this story maybe.

273
00:15:33,420 --> 00:15:39,360
So I want to, I want to bring up a couple of things internationally that cast a shadow

274
00:15:39,360 --> 00:15:41,780
over this largely positive picture that we're painting.

275
00:15:42,760 --> 00:15:47,800
So, yes, it is true that CVD is being adopted, I think, not just in the United States, but

276
00:15:47,800 --> 00:15:48,320
around the world.

277
00:15:48,460 --> 00:15:50,820
That's, that's good and helpful.

278
00:15:51,680 --> 00:15:59,200
When Europe, they passed the, the, the NIST 2, NIST 2 Act, we saw an infrastructure being

279
00:15:59,200 --> 00:16:03,220
set up for coordinated vulnerability disclosure we thought was largely positive, applied mostly

280
00:16:03,220 --> 00:16:06,500
to critical infrastructure, like what we think of as critical infrastructure, you know, and

281
00:16:06,500 --> 00:16:10,180
each member state was supposed to have a process for sort of processing vulnerabilities.

282
00:16:11,700 --> 00:16:12,180
Then.

283
00:16:12,520 --> 00:16:15,300
China came out with a vulnerability disclosure law.

284
00:16:15,500 --> 00:16:18,260
I'm not sure how many of you are familiar with some of the details of that law.

285
00:16:18,980 --> 00:16:25,540
But essentially, when it comes to vulnerability disclosure, as a, as a, an individual hacker,

286
00:16:25,720 --> 00:16:30,000
you have the, the ability to disclose your vulnerabilities to the Chinese government

287
00:16:30,000 --> 00:16:34,720
directly or to the vendor who then must disclose to the Chinese government.

288
00:16:35,100 --> 00:16:40,080
And as a vendor, you are required to disclose vulnerabilities that you receive to the Chinese

289
00:16:40,080 --> 00:16:40,380
government.

290
00:16:40,620 --> 00:16:42,500
So you're, you're encouraged to have a view.

291
00:16:42,520 --> 00:16:46,580
If you, a, a vulnerability disclosure policy, you're encouraged to have a bug bounty, but

292
00:16:46,580 --> 00:16:50,400
it's a giant sucking sound of vulnerabilities flowing to the Chinese government.

293
00:16:50,680 --> 00:16:51,740
Within 48 hours, right?

294
00:16:51,820 --> 00:16:52,100
That's right.

295
00:16:52,200 --> 00:16:52,700
That's right.

296
00:16:52,720 --> 00:16:53,780
See, within 48 hours.

297
00:16:53,980 --> 00:16:59,160
Now, the, the other development I just want to highlight here as well is in, in, in Europe

298
00:16:59,160 --> 00:17:03,700
presently, the, the EU is currently considering something called the Cyber Resilience Act,

299
00:17:03,820 --> 00:17:04,700
the CRA.

300
00:17:04,900 --> 00:17:09,760
And the Cyber Resilience Act has, has, is, is flown under the radar quite a lot in the

301
00:17:09,760 --> 00:17:10,280
United States.

302
00:17:10,280 --> 00:17:13,620
I mean, we're only talking about the vulnerability disclosure part of it, but this is a, this

303
00:17:13,620 --> 00:17:14,360
is a huge law.

304
00:17:14,800 --> 00:17:17,940
It will have a GDPR-like effect on security, and it is going to pass.

305
00:17:18,180 --> 00:17:19,040
It is going to pass.

306
00:17:19,160 --> 00:17:20,560
They're actually at an, an advanced stage.

307
00:17:20,740 --> 00:17:21,060
Okay.

308
00:17:21,440 --> 00:17:26,100
Vulnerability disclosure under the, under the CRA, there are three different versions,

309
00:17:26,180 --> 00:17:31,240
but the nut of it is that if you have an actively exploited vulnerability, so for,

310
00:17:31,340 --> 00:17:34,640
you have software in the EU, and you discover you have an actively exploited vulnerability,

311
00:17:34,980 --> 00:17:40,060
you must notify either Anissa or Sizzerts, depending on how it shakes out, within 24

312
00:17:40,880 --> 00:17:41,360
hours.

313
00:17:41,360 --> 00:17:42,140
Within 24 hours.

314
00:17:42,320 --> 00:17:46,880
If you've had an actively exploited vulnerability, 24 hours later, it is likely not patched,

315
00:17:46,880 --> 00:17:47,080
right?

316
00:17:47,160 --> 00:17:48,200
It is likely not mitigated.

317
00:17:48,260 --> 00:17:50,780
And you are telling government agencies about it.

318
00:17:51,020 --> 00:17:53,240
Now, again, there's multiple versions.

319
00:17:53,560 --> 00:17:58,800
They're going to consolidate them, but some of the versions would have that first agency

320
00:17:58,800 --> 00:18:03,880
that you talk to send it to other agencies who then send it to other agencies, leading

321
00:18:03,880 --> 00:18:06,700
to about 55 government agencies in the EU.

322
00:18:06,800 --> 00:18:09,140
If you have software, it's deployed across the EU.

323
00:18:10,820 --> 00:18:14,360
So, it is a rolling list of software packages with unmitigated vulnerabilities.

324
00:18:14,720 --> 00:18:20,680
The point is, so, CVD, great, but we are also sort of seeing that process co-opted in a

325
00:18:20,680 --> 00:18:21,140
way, right?

326
00:18:21,200 --> 00:18:26,260
We're going further left of boom to the point where we are sort of forcing disclosure before

327
00:18:26,260 --> 00:18:29,660
people are ready, and doing it in situations where we are putting those vulnerabilities

328
00:18:29,660 --> 00:18:33,140
at risk of being used for surveillance or tipping off adversaries.

329
00:18:34,160 --> 00:18:38,320
So, what we're seeing is a kind of government's potentially taking advantage.

330
00:18:38,320 --> 00:18:43,580
We've seen companies already take advantage, right, of situations, and, you know, there

331
00:18:43,580 --> 00:18:50,980
are always constant issues of NDAs and private disclosures and sort of almost unwritten threats

332
00:18:51,460 --> 00:18:52,100
against researchers.

333
00:18:52,380 --> 00:18:56,920
So, it feels like they kind of were blindsided by it originally, and then now they're kind

334
00:18:56,920 --> 00:18:58,160
of getting to grips with it.

335
00:18:58,300 --> 00:18:59,640
I mean, what do you think about that, Katie?

336
00:18:59,780 --> 00:19:00,100
Would you agree?

337
00:19:01,020 --> 00:19:01,460
Yeah.

338
00:19:01,620 --> 00:19:03,540
I think that that's exactly the case.

339
00:19:03,660 --> 00:19:04,820
I think that they're...

340
00:19:06,820 --> 00:19:08,220
And I'm a little bit concerned.

341
00:19:08,280 --> 00:19:08,300
I'm a little bit concerned.

342
00:19:08,300 --> 00:19:11,960
I'm a little bit concerned because as I see the coordinated vulnerability disclosure

343
00:19:11,960 --> 00:19:16,680
principles be adopted across industry, but there are still a lot of big companies that

344
00:19:16,680 --> 00:19:21,240
don't have coordinated vulnerability disclosure programs or that are trying to stand them

345
00:19:21,240 --> 00:19:22,680
up, and these are international companies.

346
00:19:23,400 --> 00:19:26,360
So, as these regulations continue to...

347
00:19:26,360 --> 00:19:31,500
Some are good regulations, some are bad regulations, and as they continue, you start seeing industry

348
00:19:31,500 --> 00:19:32,100
pull back.

349
00:19:32,360 --> 00:19:37,360
And so, that progress that's being made positively is now being pulled back a little bit.

350
00:19:38,300 --> 00:19:40,260
So, think about this from an industry perspective.

351
00:19:40,480 --> 00:19:45,880
If you have a product and it has a vulnerability in it, 24 hours, have you even had an opportunity

352
00:19:45,880 --> 00:19:47,500
to triage that vulnerability yet?

353
00:19:47,520 --> 00:19:48,480
Do you know it's a vulnerability?

354
00:19:48,880 --> 00:19:53,380
And now, the whole idea of coordinated vulnerability disclosure, that was something David said.

355
00:19:53,500 --> 00:19:54,600
Do you know about vulnerability disclosure?

356
00:19:54,820 --> 00:19:56,560
Do you know about coordinated vulnerability disclosure?

357
00:19:57,040 --> 00:20:03,060
Coordinated vulnerability disclosure means that all parties agree that they will treat

358
00:20:03,060 --> 00:20:08,280
this vulnerability under embargoed status until a point where all parties are able to, at

359
00:20:08,300 --> 00:20:11,500
the same time, accurately disclose that vulnerability in a way that doesn't give an adversary

360
00:20:11,500 --> 00:20:15,900
an advantage when a mitigation is developed and disclosed.

361
00:20:16,040 --> 00:20:21,420
So, if you're disclosing vulnerabilities within 24 hours, what you are doing is you are enabling

362
00:20:21,420 --> 00:20:25,080
an adversary to be able to exploit a customer or end user.

363
00:20:25,400 --> 00:20:29,380
And I don't think that's the goal, but you see right there, you have a law that's about

364
00:20:29,380 --> 00:20:36,120
to be passed, and you have the technical details of that, and the impacts of that are so wide-reaching,

365
00:20:36,260 --> 00:20:38,100
you get to a point where you say,

366
00:20:38,300 --> 00:20:40,840
well, why are we even doing coordinated vulnerability disclosure anymore?

367
00:20:41,120 --> 00:20:44,660
Why don't we just put it all on Twitter or simply not have a CVD program?

368
00:20:45,100 --> 00:20:49,780
And that's dangerous, and it's undoing a lot of the progress that's been made over

369
00:20:49,780 --> 00:20:50,660
the last 10 years.

370
00:20:54,060 --> 00:20:59,340
So, I hate to say, you know, it feels like a chill is spreading across the world.

371
00:21:00,140 --> 00:21:01,920
Is that what's going to happen, Casey?

372
00:21:03,820 --> 00:21:05,260
Yeah, sure, let's go with that.

373
00:21:06,620 --> 00:21:07,060
Look.

374
00:21:07,060 --> 00:21:13,640
I think in general, like, the way that I'd kind of render out what's happening as, you

375
00:21:13,640 --> 00:21:19,000
know, someone who lives in the U.S., in San Francisco, but also has a home functionally

376
00:21:19,000 --> 00:21:23,900
in Australia, right, I'm thinking about this through the Western lens, and what I see

377
00:21:23,900 --> 00:21:29,920
happening is that Western countries are trending towards transparency as a mode of resilience,

378
00:21:30,180 --> 00:21:30,500
right?

379
00:21:30,620 --> 00:21:31,920
Transparency is anti-fragile.

380
00:21:32,000 --> 00:21:36,820
That's kind of a design principle that's being used to push this along, and I think that's

381
00:21:36,820 --> 00:21:39,700
a lot of how it's been solved, frankly, you know, within government.

382
00:21:39,780 --> 00:21:43,720
It's a lot of how it's been pushed downhill and how it's been adopted, and that's certainly

383
00:21:43,720 --> 00:21:45,780
something that, you know, we've taken advantage of.

384
00:21:45,880 --> 00:21:50,700
As bug crowd, I've seen, you know, the folks working on the Disclosure Air Project take

385
00:21:50,700 --> 00:21:51,880
advantage of as well.

386
00:21:51,960 --> 00:21:55,200
It's just a security model that seems to make sense, right?

387
00:21:56,700 --> 00:22:03,460
On the flip side of it, you know, non-Western countries do tend to be trending towards control

388
00:22:03,460 --> 00:22:05,480
or aggregation, just in general.

389
00:22:05,560 --> 00:22:06,560
Because they're, you know...

390
00:22:06,560 --> 00:22:11,640
Ultimately, there's a motivation there to build up firepower, like they want resilience,

391
00:22:11,920 --> 00:22:15,420
they want defence, they want to be able to fix the bugs that get found, but they also

392
00:22:15,420 --> 00:22:21,480
want to increase their capability from a sovereign capacity standpoint, and this is a pipeline

393
00:22:21,480 --> 00:22:21,800
for that.

394
00:22:22,160 --> 00:22:25,900
So, you know, I do see it kind of heading in that direction, and obviously that's a

395
00:22:27,200 --> 00:22:28,600
300,000-foot observation.

396
00:22:28,680 --> 00:22:34,300
I do expect that to continue, because ultimately, I think transparency as a resilience strategy

397
00:22:34,300 --> 00:22:36,100
wins in the end.

398
00:22:36,560 --> 00:22:38,220
Fundamentally, anti-fragile, right?

399
00:22:38,420 --> 00:22:44,300
But if the other approach manages to land the first set of punches, that could change

400
00:22:44,300 --> 00:22:45,000
the outcome.

401
00:22:45,980 --> 00:22:50,400
So you touched on something there, which there's been articles about one country

402
00:22:50,400 --> 00:22:52,100
hoarding vulnerabilities recently, actually.

403
00:22:54,320 --> 00:22:59,500
So is this maybe this kind of, I want to say arms race, but it's probably not an arms

404
00:22:59,500 --> 00:22:59,700
race.

405
00:22:59,880 --> 00:23:00,500
It's just a...

406
00:23:01,600 --> 00:23:03,200
I don't know quite what it is.

407
00:23:03,260 --> 00:23:03,860
What is it?

408
00:23:05,240 --> 00:23:05,920
Like governments?

409
00:23:05,920 --> 00:23:06,080
Yeah.

410
00:23:06,560 --> 00:23:11,760
I mean, I think, you know, the international relations environment's gotten progressively

411
00:23:11,760 --> 00:23:16,520
more tense, you know, and it's always been tense, but I think that tension's become more

412
00:23:16,520 --> 00:23:19,280
obvious post-COVID, right?

413
00:23:19,800 --> 00:23:24,320
So I think, yeah, the idea of, yeah, and this is through the lens of an Australian.

414
00:23:24,420 --> 00:23:25,180
You look at what's...

415
00:23:25,180 --> 00:23:26,040
This is all on public record.

416
00:23:26,240 --> 00:23:32,080
Like, there was a budget of, I think, $97 billion in a project called Red Spice, which

417
00:23:32,080 --> 00:23:36,040
is specifically around standoff deterrent capability in case there's something that

418
00:23:36,040 --> 00:23:41,200
goes hot in the region, right, for, you know, reasons that should be sort of fairly obvious

419
00:23:41,200 --> 00:23:42,740
that the Aussies are nervous about that.

420
00:23:43,240 --> 00:23:47,840
I think it's $2.7 billion of that's going into cyber, and that's offensive and defensive.

421
00:23:48,440 --> 00:23:51,420
So it's capability stockpiling is ultimately what it's about.

422
00:23:51,740 --> 00:23:57,800
That's what I've kind of observed is that there's a lot of sort of, you know, endorsement

423
00:23:57,800 --> 00:24:00,840
of offensive now that wasn't there before, right?

424
00:24:01,280 --> 00:24:01,580
Yeah.

425
00:24:01,620 --> 00:24:03,740
I think it used to be a dirty word, and that's...

426
00:24:03,740 --> 00:24:05,320
I mean, you think about these conversations.

427
00:24:05,600 --> 00:24:06,020
Yeah.

428
00:24:06,040 --> 00:24:11,140
I always go back to the FBI versus Apple in the San Bernardino case.

429
00:24:11,200 --> 00:24:11,580
Yeah.

430
00:24:11,580 --> 00:24:12,200
I think it was 2016.

431
00:24:12,720 --> 00:24:19,040
And at the time, you know, to create zero-day and weaponize it for offensive use of any

432
00:24:19,040 --> 00:24:22,560
sort was kind of dirty, but there was this sort of stench around it.

433
00:24:23,360 --> 00:24:24,640
But then you look at the...

434
00:24:24,640 --> 00:24:28,420
There was a lead time between when that happened and when it came out who was actually responsible

435
00:24:28,420 --> 00:24:29,020
for that.

436
00:24:30,500 --> 00:24:34,260
As an organization, it's like four or five years later, they're actually celebrated,

437
00:24:34,340 --> 00:24:35,880
and it was an Australian company.

438
00:24:35,880 --> 00:24:38,500
It was actually celebrated as an Australian startup story.

439
00:24:38,700 --> 00:24:42,940
So in that time, it went from a dirty word to a thing that was kind of accepted, which

440
00:24:42,940 --> 00:24:43,360
is amazing.

441
00:24:43,440 --> 00:24:46,580
And this isn't like, as I said, this sort of dark secret of forensics tools.

442
00:24:47,060 --> 00:24:53,540
These companies try to play off how ingenious they are, but a lot of them are buying vulnerabilities

443
00:24:53,540 --> 00:24:54,820
off the gray market, right?

444
00:24:54,960 --> 00:24:56,300
And there's a healthy...

445
00:24:56,300 --> 00:25:02,080
Like, you can go to the Zerodian website and see their little table of elements and

446
00:25:02,080 --> 00:25:03,740
the prices that attach to them.

447
00:25:05,000 --> 00:25:05,860
I know, obviously, there's...

448
00:25:05,860 --> 00:25:11,260
Obviously, Project Zero has been trying to counter some of that stuff, but not a lot

449
00:25:11,260 --> 00:25:12,920
of people know about that either, do they?

450
00:25:13,360 --> 00:25:18,940
I mean, can any of us sort of discuss that a little bit more about the gray market and

451
00:25:18,940 --> 00:25:22,200
vulnerabilities and, I guess, how that operates?

452
00:25:23,940 --> 00:25:24,820
Who wants that one?

453
00:25:27,200 --> 00:25:27,600
Sure.

454
00:25:27,840 --> 00:25:29,060
Go to the Zerodian website.

455
00:25:29,400 --> 00:25:31,380
I mean, it exists, right?

456
00:25:31,600 --> 00:25:31,800
Yeah.

457
00:25:31,840 --> 00:25:32,880
It absolutely exists.

458
00:25:33,020 --> 00:25:34,840
I think vulnerability discovery...

459
00:25:35,440 --> 00:25:35,840
Yeah.

460
00:25:37,000 --> 00:25:41,400
The way that I try to pass this out to explain it and even to think about it is that there's

461
00:25:41,400 --> 00:25:44,600
defensive and offensive vulnerability procurement, right?

462
00:25:44,780 --> 00:25:50,040
The defensive procurement cycle, basically, you get the bug and you kill it, right?

463
00:25:50,520 --> 00:25:54,860
The offensive cycle is where you get the bug and you actually productize it.

464
00:25:55,220 --> 00:26:00,820
And as a part of that, you work to keep it secret so that your capacity stays operational

465
00:26:00,820 --> 00:26:02,240
in the wild and it doesn't get burnt.

466
00:26:03,540 --> 00:26:05,840
So, everything leading up to that decision of whether or not I'm going to be able to

467
00:26:05,860 --> 00:26:09,600
burn it or keep it alive looks pretty much the same.

468
00:26:10,660 --> 00:26:15,980
It's basically vulnerability research, discovery, like thinking through impact, thinking through

469
00:26:15,980 --> 00:26:20,740
usability, like where the attacker is going to be coming from and what kind of capability

470
00:26:20,740 --> 00:26:24,320
and access they need from that vulnerability because not every vulnerability is eligible

471
00:26:24,320 --> 00:26:26,460
for this type of purpose, right?

472
00:26:27,340 --> 00:26:29,880
But there's a lot of researchers out there that can do that stuff.

473
00:26:30,120 --> 00:26:35,620
I think the thing that I find interesting at this point in time is even with some of

474
00:26:35,620 --> 00:26:40,580
these legislative changes that are happening, gray is the perfect way to describe it because

475
00:26:40,580 --> 00:26:47,440
I think it's becoming less illegal or less tightly regulated in a way that I think will

476
00:26:47,440 --> 00:26:51,820
actually dictate some of the outcomes that we'll see if you think forward 10 years.

477
00:26:54,280 --> 00:27:01,180
Also now a factor in the gray market, a couple of things, one, and Casey alluded to this,

478
00:27:01,240 --> 00:27:05,260
but the profit, the price point for...

479
00:27:05,260 --> 00:27:05,600
Okay.

480
00:27:05,620 --> 00:27:08,780
The price point for vulnerability is being used offensively is going to be higher than

481
00:27:08,780 --> 00:27:09,440
for defense.

482
00:27:09,700 --> 00:27:14,960
It puts defense at a disadvantage and part of the reason, as Casey said, is for defensive

483
00:27:14,960 --> 00:27:19,880
purposes you want to plug the vulnerability, offense can be used multiple times or you

484
00:27:19,880 --> 00:27:24,840
sell it under NDA so that you get a higher price for it so that you can sell it to a

485
00:27:24,840 --> 00:27:25,280
single buyer.

486
00:27:25,400 --> 00:27:26,240
It is an issue.

487
00:27:26,480 --> 00:27:32,640
But the other force also though is we want to encourage this being used, this process

488
00:27:32,640 --> 00:27:33,560
for defensive purposes.

489
00:27:33,560 --> 00:27:39,860
The White House is currently looking at ways to deal with the offensive market.

490
00:27:40,120 --> 00:27:44,200
There was recently an executive order on commercial surveillance brokers.

491
00:27:44,480 --> 00:27:46,980
I think four of them went under sanction recently as well.

492
00:27:47,680 --> 00:27:55,620
And so it is difficult to find that nexus to human rights and be able to distinguish

493
00:27:55,620 --> 00:28:00,660
between the use of vulnerabilities for legitimate police operations versus oppressive purposes.

494
00:28:00,960 --> 00:28:02,820
But that space is being looked at though.

495
00:28:04,660 --> 00:28:09,180
Just really quickly on the pricing piece, Harley is exactly right and this is actually

496
00:28:09,180 --> 00:28:14,580
a phenomena that we see a lot of actually demonstrated in bug bounty, which is defensive

497
00:28:15,160 --> 00:28:15,880
bond procurement.

498
00:28:16,400 --> 00:28:23,200
So on the one side, if you're selling a vulnerability that's going to be productized, that is inherently

499
00:28:23,200 --> 00:28:24,560
more valuable as a transaction.

500
00:28:24,780 --> 00:28:28,020
The thing that works in favor of the defender is you've got the prisoner's dilemma.

501
00:28:28,340 --> 00:28:32,800
So if Harley and I have both found a bug and I'm trying to sell it off to the offender,

502
00:28:32,800 --> 00:28:35,880
the defensive buyer, he's trying to sell it off to the defensive buyer, if he lands

503
00:28:35,880 --> 00:28:41,040
the punch first, then I lose the opportunity for the bounty plus the opportunity to exploit

504
00:28:41,040 --> 00:28:42,740
the bug because it gets burned at that point in time.

505
00:28:42,940 --> 00:28:45,820
So that economic kind of delta works in both directions.

506
00:28:46,640 --> 00:28:49,860
So I'm just going to comment on the, and kind of what Harley was saying.

507
00:28:50,080 --> 00:28:57,120
When we think about vulnerabilities used offensively, I think we're in an age now where we have

508
00:28:57,120 --> 00:29:00,380
to seriously consider the impacts of the things that we do.

509
00:29:00,560 --> 00:29:02,740
And I'll use an extreme example.

510
00:29:02,800 --> 00:29:05,940
But anything can be used for good and anything can be used for bad.

511
00:29:06,120 --> 00:29:07,340
And think about nuclear power.

512
00:29:08,100 --> 00:29:11,280
Nuclear power for power plants, nuclear power for weapons.

513
00:29:11,620 --> 00:29:17,120
And the difference there can be things like regulations and informed decision making and

514
00:29:17,120 --> 00:29:17,980
an informed community.

515
00:29:18,280 --> 00:29:23,420
Because we have the ability to influence the decision making and the legislative process

516
00:29:23,700 --> 00:29:28,740
and the regulations and standards that go around this market.

517
00:29:29,120 --> 00:29:32,120
And I think we're starting to see that with the White House, which is a wonderful thing.

518
00:29:32,120 --> 00:29:36,700
And I'd like to see more of that because we're at a cusp now where it's becoming very

519
00:29:36,700 --> 00:29:39,700
common to understand cyber security.

520
00:29:39,920 --> 00:29:45,960
There is no real world and online world anymore, you know, used to be, oh, my God, my Twitter

521
00:29:45,960 --> 00:29:46,500
went down.

522
00:29:46,580 --> 00:29:48,460
What am I going to do now?

523
00:29:48,640 --> 00:29:50,900
You can't get a job without the Internet.

524
00:29:51,260 --> 00:29:53,860
You know, COVID really accelerated that for us.

525
00:29:53,920 --> 00:29:59,660
So it's becoming more in the forefront of humanity that we understand how cybersecurity

526
00:29:59,660 --> 00:30:00,300
works.

527
00:30:00,480 --> 00:30:02,100
And that we have that informed policy.

528
00:30:02,120 --> 00:30:02,300
And that's part of the process.

529
00:30:02,660 --> 00:30:05,080
Because if we don't, it will pass us by.

530
00:30:05,420 --> 00:30:08,280
And that's something that I would empower everyone.

531
00:30:08,540 --> 00:30:12,180
It's part of the reason the policy village is here, the policy department is here at

532
00:30:12,180 --> 00:30:17,900
DEF CON, to help people who are very technical talk to policymakers so that we can have an

533
00:30:17,900 --> 00:30:19,240
informed decision making process.

534
00:30:20,100 --> 00:30:26,900
And I think to close the loop also on policy and the what we were just discussing

535
00:30:26,900 --> 00:30:29,480
as far as offensive versus defensive use of vulnerabilities.

536
00:30:29,880 --> 00:30:31,780
We should be directing our policy.

537
00:30:32,120 --> 00:30:36,240
We should be directing our developments towards streamlining the ability for people to disclose

538
00:30:36,240 --> 00:30:36,620
vulnerabilities.

539
00:30:36,940 --> 00:30:40,920
And so what we had talked about at the outset, about greater adoption of CVD, that's one

540
00:30:40,920 --> 00:30:41,660
way to do that.

541
00:30:43,340 --> 00:30:47,580
The greater legal protection for hackers for acts of good faith security research is another

542
00:30:47,580 --> 00:30:48,140
way to do that.

543
00:30:48,340 --> 00:30:49,620
There's still room to go, though.

544
00:30:49,700 --> 00:30:52,620
We talked about China's vulnerability disclosure law.

545
00:30:52,760 --> 00:30:57,980
We talked about the EU starting, you know, if you are a hacker and you are disclosing

546
00:30:57,980 --> 00:31:02,040
a vulnerability to a company, and you know that company then has to disclose that to,

547
00:31:02,120 --> 00:31:05,140
you know, a whole bunch of government agencies, you don't know what's going to happen, there's

548
00:31:05,140 --> 00:31:05,620
a couple things.

549
00:31:05,800 --> 00:31:09,580
As a researcher, you may feel conflicted about making that disclosure.

550
00:31:10,120 --> 00:31:14,500
And then as a company, you may not want to have to kick off that process every time someone

551
00:31:14,500 --> 00:31:15,220
discloses to you.

552
00:31:15,320 --> 00:31:19,680
So we are seeing policies that are kind of going in both directions, where we're making

553
00:31:19,680 --> 00:31:24,260
it more difficult or at least a greater moral choice, a moral conflict for vulnerability

554
00:31:24,260 --> 00:31:27,020
disclosure at the same time that we're easing it in some ways.

555
00:31:27,420 --> 00:31:32,100
Another great one that, you know, we are hopeful that the U.S. government will take on is, you

556
00:31:32,100 --> 00:31:32,740
know, sanctions.

557
00:31:33,380 --> 00:31:39,800
So there are questions about the extent to which vulnerability disclosures are a sanctioned

558
00:31:39,800 --> 00:31:41,520
event or sanctioned transaction.

559
00:31:41,820 --> 00:31:45,100
You know, if you are a U.S. company and you're receiving a vulnerability disclosure from

560
00:31:45,100 --> 00:31:49,480
an individual in a comprehensively sanctioned nation or somebody that is two hops removed

561
00:31:49,480 --> 00:31:54,760
from the SDN list, and you are asking follow-up questions but not paying or anything like

562
00:31:54,760 --> 00:31:58,460
that, you know, and there's no money exchanging hands, that should not be a sanctioned event.

563
00:31:59,020 --> 00:32:01,280
As of now, this is in a gray area.

564
00:32:01,280 --> 00:32:04,520
But this is something that we are hopeful that can change, and it is for the purpose

565
00:32:04,520 --> 00:32:08,940
of, you know, greasing the skids for defensive use of vulnerabilities, taking away incentives,

566
00:32:09,320 --> 00:32:11,520
taking away that easy path towards offensive use.

567
00:32:11,860 --> 00:32:17,380
I guess for some researchers, especially, you know, some of the more naive ones, they

568
00:32:17,380 --> 00:32:21,300
might not even realize that they were talking to a nation state as well.

569
00:32:21,380 --> 00:32:27,180
So there was the infamous conversation, the George Hott's zero-day iPhone recording that

570
00:32:27,180 --> 00:32:27,480
happened.

571
00:32:28,700 --> 00:32:30,660
And it could have been naivety.

572
00:32:30,660 --> 00:32:33,700
But was he trying to sell a vulnerability to China?

573
00:32:33,880 --> 00:32:35,540
That was the debate at the time.

574
00:32:35,980 --> 00:32:41,540
And I guess nation states might get a bit smart and just false flag the researcher,

575
00:32:41,960 --> 00:32:42,220
right?

576
00:32:43,080 --> 00:32:45,220
Or host a phone contest.

577
00:32:45,500 --> 00:32:46,180
Oh, yeah, yeah.

578
00:32:47,420 --> 00:32:52,920
So I just want to, like, so frequently when I talk about this with companies, they get

579
00:32:52,920 --> 00:32:55,220
mixed up between bug bounty and vulnerability disclosure.

580
00:32:55,540 --> 00:32:58,140
They also get mixed up with vulnerability disclosure as well.

581
00:32:58,220 --> 00:33:00,640
So I was doing a deposition to a government.

582
00:33:00,640 --> 00:33:07,020
And clearly, they didn't understand, they thought vulnerability disclosure was forcing

583
00:33:07,020 --> 00:33:09,800
companies to disclose vulnerabilities publicly.

584
00:33:10,420 --> 00:33:13,640
So I just want to, so let's start on the bug bounty thing.

585
00:33:13,800 --> 00:33:18,620
So I guess, Casey, first of all, just explain the difference, please.

586
00:33:19,340 --> 00:33:27,120
Yeah, so when I speak to this, I think there's an added piece there that bug bounty is often

587
00:33:27,120 --> 00:33:30,380
used interchangeably with crowdsourcing at this point in time as well.

588
00:33:30,380 --> 00:33:32,600
So it's, like, words are hard, basically.

589
00:33:33,300 --> 00:33:40,300
But I think for the purpose of, you know, like, the regulatory kind of renderings of

590
00:33:40,300 --> 00:33:45,060
this, and I think how, you know, most people coming into it think about it, the definition

591
00:33:45,060 --> 00:33:50,920
I go to is NIST 800-5305, which is basically that a vulnerability disclosure program is

592
00:33:50,920 --> 00:33:52,560
a, it's an intake point.

593
00:33:52,660 --> 00:33:59,040
It's a policy, and it's a process that allows people from the outside world to submit a

594
00:33:59,040 --> 00:33:59,880
vulnerability into.

595
00:34:00,380 --> 00:34:04,680
An organization, and to have some sort of expectation of what happens next, effectively.

596
00:34:04,980 --> 00:34:08,340
And that's a butchered version, but that's the cliff notes of it.

597
00:34:08,500 --> 00:34:11,880
But what it also does is it distinguishes it from a bug bounty program.

598
00:34:12,320 --> 00:34:16,360
So it basically says a bug bounty program is if you do everything that we just said,

599
00:34:17,240 --> 00:34:23,420
but what you also do is you reward someone with cash if they do this, and they're first

600
00:34:23,420 --> 00:34:25,900
to find and report a unique issue.

601
00:34:27,320 --> 00:34:29,580
Usually the way it works is that's kind of the model.

602
00:34:29,700 --> 00:34:30,360
So the first to find.

603
00:34:30,380 --> 00:34:33,320
The second to find is the one who gets paid, and the more impactful the issue, the more

604
00:34:33,320 --> 00:34:33,780
they get paid.

605
00:34:33,920 --> 00:34:37,740
So what you're ultimately doing, you know, on the proactive side is incentivizing the

606
00:34:37,740 --> 00:34:41,620
things that you want, and actually mimicking kind of some of the economic, you know, incentives

607
00:34:41,620 --> 00:34:42,720
that exist for the adversary.

608
00:34:43,000 --> 00:34:45,000
So that's the purpose of it and how it works.

609
00:34:45,360 --> 00:34:49,380
But you know, the thing, the reason that confusion happened, because obviously I've had a box

610
00:34:49,380 --> 00:34:55,140
row seat for a lot of this story, bug banties just got sexy really fast.

611
00:34:55,300 --> 00:34:59,540
Like the thing that happened with Hack the Pentagon, which was huge, hugely valuable,

612
00:34:59,620 --> 00:34:59,980
I think.

613
00:34:59,980 --> 00:35:05,440
I think for, you know, reforming the public perception of what a hacker is and actually

614
00:35:06,020 --> 00:35:10,000
helping tell a story of their place in the safety of the Internet, it's like if the apex

615
00:35:10,000 --> 00:35:16,240
predator of the planet relies on 16-year-olds to give them security feedback, then maybe

616
00:35:16,240 --> 00:35:17,140
I should do that, too.

617
00:35:17,260 --> 00:35:17,480
Right?

618
00:35:17,540 --> 00:35:20,320
Like that was a pretty massive shift in thinking that happened at that point.

619
00:35:21,620 --> 00:35:24,280
But it was all talked about in terms of it being a bug bounty.

620
00:35:24,920 --> 00:35:29,660
And I think, you know, like us as an organization, I think some of the other platforms that joined,

621
00:35:29,980 --> 00:35:35,420
after we started the category, you know, hackers getting paid money and being able to celebrate

622
00:35:35,420 --> 00:35:38,380
that, that's a thing that's exciting to talk about and it's fun.

623
00:35:38,600 --> 00:35:44,520
So all of this led to most of the focus of terms of art actually being around bug bounty.

624
00:35:45,060 --> 00:35:47,620
Even though, like frankly, it's actually the minority.

625
00:35:48,620 --> 00:35:53,960
From my own perspective, like VDP is something that absolutely every, like that is a cost,

626
00:35:54,120 --> 00:35:59,260
it's a bar of entry, you know, must be this high to ride the Internet type of thing at

627
00:35:59,260 --> 00:35:59,840
this point in time.

628
00:35:59,940 --> 00:36:03,200
You know, bug bounty in the public sense is discretionary.

629
00:36:03,500 --> 00:36:06,720
Some organizations are ready to do that, others aren't, because they're just not ready to

630
00:36:06,720 --> 00:36:08,900
remediate or listen to the Internet in that way.

631
00:36:11,640 --> 00:36:15,840
One other distinction is authorization, right?

632
00:36:15,880 --> 00:36:20,300
So for a bug bounty, you are authorized to, you know, to try to find vulnerabilities

633
00:36:20,300 --> 00:36:23,220
and use certain testing methods against a defined scope of assets.

634
00:36:23,640 --> 00:36:27,400
A vulnerability disclosure policy can do that.

635
00:36:27,760 --> 00:36:29,240
You can provide authorization.

636
00:36:29,260 --> 00:36:30,220
But many don't.

637
00:36:30,320 --> 00:36:33,940
Many are just a channel saying, look, if you have, if you find a vulnerability, disclose

638
00:36:33,940 --> 00:36:34,400
it to us.

639
00:36:34,460 --> 00:36:37,460
But we're not guaranteeing that, you know, we are, you know, to get out of jail free

640
00:36:37,460 --> 00:36:37,780
or anything.

641
00:36:38,680 --> 00:36:43,200
In fact, the U.S. governments for civil agencies does provide authorization.

642
00:36:43,580 --> 00:36:48,480
They're, it is the more advanced form of VDP where there is some authorization, which

643
00:36:48,480 --> 00:36:51,220
provides, and the reason authorization is so important is because it provides legal

644
00:36:51,220 --> 00:36:54,640
cover for the security researchers that are trying to find the vulnerabilities.

645
00:36:55,300 --> 00:36:59,240
But to Casey's point about VDP being a, should be a fundamental, fundamental part of the

646
00:36:59,240 --> 00:37:04,160
mental practice at this, at this stage, you can have a very basic VDP that does not provide

647
00:37:04,160 --> 00:37:04,800
that authorization.

648
00:37:04,920 --> 00:37:07,680
And you are still, you know, edging into that world.

649
00:37:07,760 --> 00:37:08,420
It is still helpful.

650
00:37:09,480 --> 00:37:10,500
I'm going to jump in real quick.

651
00:37:10,660 --> 00:37:14,320
So to simplify, a VDP is a see something, say something.

652
00:37:14,980 --> 00:37:17,100
A bug bounty is an invitation to hack.

653
00:37:18,080 --> 00:37:19,560
So there's a difference there.

654
00:37:19,720 --> 00:37:24,940
And I like to think of bug bounties, payments, or rewards, I don't like to think of them

655
00:37:24,940 --> 00:37:25,360
as rewards.

656
00:37:25,520 --> 00:37:28,100
I like to think of them as reimbursement for your time.

657
00:37:28,100 --> 00:37:34,520
Because how much time and effort was spent in researching that vulnerability, triaging

658
00:37:34,520 --> 00:37:39,060
that, or not triaging, developing the proof of concept, submitting that vulnerability

659
00:37:39,060 --> 00:37:45,920
to a company, going through the friction of even filling out a submission, because each

660
00:37:45,920 --> 00:37:50,600
company wants it a little different, and going through that whole process, and then

661
00:37:50,600 --> 00:37:55,340
working with that company, maybe that company has follow-on questions, that back and forth.

662
00:37:55,340 --> 00:38:00,600
So I see it as a reimbursement for your time, rather than a reward.

663
00:38:00,860 --> 00:38:05,500
And I will tell you, I work at a Fortune 50 tech company, and this is becoming a very

664
00:38:06,280 --> 00:38:10,420
common way of reframing the narrative of what's actually happening.

665
00:38:11,200 --> 00:38:17,740
It is a way to offset the dark market and give people an opportunity, those who want

666
00:38:17,740 --> 00:38:23,240
to do good in the world, and those who have an intrinsic motivation to be positive and

667
00:38:23,240 --> 00:38:24,000
to help defend.

668
00:38:24,240 --> 00:38:25,320
It's an outlet for that.

669
00:38:25,340 --> 00:38:25,400
It's an outlet for them.

670
00:38:25,640 --> 00:38:30,240
But also, it's a mechanism of saying, thank you, and we appreciate your time, and recognizing

671
00:38:30,240 --> 00:38:30,960
your time.

672
00:38:32,800 --> 00:38:36,580
That's a really good point, and I've forgotten to raise this topic, but the value

673
00:38:36,580 --> 00:38:42,720
of labor is a real big question, right, for security researchers, that people, many hackers

674
00:38:42,720 --> 00:38:48,160
feel they're essentially being exploited by governments and companies for their time,

675
00:38:48,420 --> 00:38:50,860
and that there's not a recognition of that.

676
00:38:51,040 --> 00:38:52,640
But is that a fair statement?

677
00:38:52,800 --> 00:38:55,320
Or do you guys have a say in that?

678
00:38:55,320 --> 00:38:56,520
Do you guys have different views to that?

679
00:38:59,040 --> 00:38:59,560
Sure.

680
00:39:02,320 --> 00:39:09,240
I think that the other piece, like frankly, this goes back to one of the reasons I founded

681
00:39:09,240 --> 00:39:16,480
Bug Crowd in the first place, is that it does distribute access on both sides to the

682
00:39:16,480 --> 00:39:19,760
answer to the question that they've got, which is, is this thing vulnerable or not?

683
00:39:20,060 --> 00:39:23,040
So you think about that, you switch that into the defender side.

684
00:39:23,040 --> 00:39:28,560
You know, previous to crowdsourcing, previous to bug bounty, you're basically held hostage

685
00:39:28,560 --> 00:39:33,460
to whatever hourly rate you're getting to get consulting, and ultimately, like one

686
00:39:33,460 --> 00:39:36,740
person being paid, so you've already got a supply-demand imbalance there.

687
00:39:37,440 --> 00:39:42,260
And then you've got the problem of one person being paid by the hour, probably never being

688
00:39:42,260 --> 00:39:46,940
able to actually outsmart all the potential adversaries that could figure the solution

689
00:39:46,940 --> 00:39:47,780
out before they can.

690
00:39:48,040 --> 00:39:52,940
So I think there's a counterbalance to that, what you just brought out.

691
00:39:53,040 --> 00:39:58,720
In that, you know, I think the security consulting industry has been incredibly overpriced in

692
00:39:58,720 --> 00:40:02,260
different areas, with very much a caveat emptor approach to quality.

693
00:40:02,520 --> 00:40:05,060
What this does is it actually brings quality to the fore.

694
00:40:05,760 --> 00:40:08,600
So I think there's that part of it that's pretty important to call out.

695
00:40:08,860 --> 00:40:14,740
But also, you know, on the payment side, it's an interesting one, and obviously I'm going

696
00:40:14,740 --> 00:40:20,500
to have some bias in my answer here, but people don't have to participate, like there's no

697
00:40:20,500 --> 00:40:22,620
arm being twisted in terms of their own participation.

698
00:40:23,040 --> 00:40:28,500
And I would add to that, like I partly agree with Katie how you were rendering what the

699
00:40:28,500 --> 00:40:29,340
purpose of payment is.

700
00:40:29,400 --> 00:40:31,660
I actually think about it more in terms of the value of the data.

701
00:40:32,520 --> 00:40:37,320
Like if, you know, the organization running a program has a question, whoever ends up

702
00:40:37,320 --> 00:40:41,220
giving the answer has that answer, then there's a value to that transaction that's more tied

703
00:40:41,220 --> 00:40:43,400
to the data in terms of the payer, right?

704
00:40:43,500 --> 00:40:46,800
On the researcher side, maybe it's got to do with the amount of time and effort they

705
00:40:46,800 --> 00:40:51,260
put into it, but ultimately, that doesn't really matter in terms of the marketplace

706
00:40:51,260 --> 00:40:52,500
dynamic there, if that makes sense.

707
00:40:53,040 --> 00:40:53,180
Yeah.

708
00:40:53,260 --> 00:40:56,900
And I guess it depends where you come from in the world and what the cost of living is,

709
00:40:57,020 --> 00:40:57,080
right?

710
00:40:57,180 --> 00:40:59,100
You know, the value might be huge.

711
00:40:59,160 --> 00:40:59,960
It might be life-changing.

712
00:41:00,340 --> 00:41:02,700
So I just really, we don't have much time left.

713
00:41:02,800 --> 00:41:08,080
I just really want to give the audience the opportunity to ask any questions if you'd

714
00:41:08,080 --> 00:41:08,260
like.

715
00:41:08,400 --> 00:41:12,480
I know Casey has to dash off to deliver a talk, so I don't want to hold him back.

716
00:41:12,680 --> 00:41:18,200
But you have a great opportunity to speak to some of the world's greatest minds in vulnerability

717
00:41:18,200 --> 00:41:18,640
disclosure.

718
00:41:18,820 --> 00:41:19,320
So, David.

719
00:41:20,200 --> 00:41:20,840
Good afternoon.

720
00:41:21,420 --> 00:41:22,220
Super interesting.

721
00:41:24,000 --> 00:41:29,000
What are folks' thoughts about, I'll say, U.S. government, because we've got multiple

722
00:41:29,000 --> 00:41:33,920
governments sort of represented here, U.S. government coordination as it relates to very

723
00:41:33,920 --> 00:41:43,520
recent regulations put out by our good friends at the SEC that can actually end up driving

724
00:41:45,380 --> 00:41:52,200
victims to disclose, like, really sensitive stuff in the mainstream?

725
00:41:52,200 --> 00:41:54,280
And the SEC is in the middle of their trial.

726
00:41:54,660 --> 00:41:55,820
I totally agree.

727
00:41:56,000 --> 00:41:57,640
I think the SEC has made a very bad move.

728
00:41:58,340 --> 00:42:02,640
So for those of you that are not familiar, the Securities and Exchange Commission has

729
00:42:02,640 --> 00:42:07,140
actually historically been a very forward-leaning agency when it comes to cybersecurity.

730
00:42:07,520 --> 00:42:12,780
And they actually have done some really great work in trying to push public companies towards

731
00:42:12,780 --> 00:42:18,820
being more transparent about their security posture and securing their systems of control

732
00:42:18,820 --> 00:42:20,120
for financial reporting.

733
00:42:20,900 --> 00:42:22,180
So, yeah.

734
00:42:22,200 --> 00:42:23,500
So I want to have that caveat.

735
00:42:23,720 --> 00:42:25,960
So they recently came out with a rule.

736
00:42:26,180 --> 00:42:27,480
The rule does a lot of things.

737
00:42:27,940 --> 00:42:30,420
And much of the rule, I think, is positive.

738
00:42:30,800 --> 00:42:34,840
There is one aspect of the rule that's getting a lot of attention, and rightly so, and this

739
00:42:34,840 --> 00:42:35,840
is on incident reporting.

740
00:42:36,240 --> 00:42:44,020
And so what that does is it requires all publicly traded companies to report their cybersecurity

741
00:42:44,020 --> 00:42:48,500
incidents within four days of determining that those incidents are material.

742
00:42:48,800 --> 00:42:52,060
And what that means is materiality means, like, that you determine that a significant

743
00:42:52,060 --> 00:42:52,280
incident has been reported.

744
00:42:52,280 --> 00:42:54,380
And that's not significant enough that you, you know, somebody ought to know about it.

745
00:42:54,520 --> 00:42:59,900
But as we discussed with regard to vulnerabilities, with that four days, you may or may not have

746
00:42:59,900 --> 00:43:01,600
contained or mitigated your incident.

747
00:43:01,900 --> 00:43:05,880
Now that reporting through the SEC is public, it's public by default.

748
00:43:06,240 --> 00:43:11,780
So it goes, you report it through your 8K form, your 8K becomes public as an investing

749
00:43:11,780 --> 00:43:12,260
document.

750
00:43:12,660 --> 00:43:17,260
And that is the Securities and Exchange Commission's purpose is to provide information to investors.

751
00:43:17,400 --> 00:43:21,400
It is not really to, you know, with this regulation, to strengthen cybersecurity.

752
00:43:21,400 --> 00:43:27,540
We, you know, the SEC has heard that, and they heard it not just from private industry,

753
00:43:27,760 --> 00:43:33,160
but from consumer groups, as well as I know from other government agencies, U.S. government

754
00:43:33,160 --> 00:43:33,480
agencies.

755
00:43:33,740 --> 00:43:36,640
I was surprised that they kept that timeline in.

756
00:43:37,120 --> 00:43:41,600
Arguably, companies were already supposed to disclose their cybersecurity incidents.

757
00:43:41,880 --> 00:43:45,460
What's new is this timeline, this four-day timeline after materiality.

758
00:43:46,140 --> 00:43:51,000
I thought that they were going to have something about, you know, maybe if you haven't contained

759
00:43:51,000 --> 00:43:55,040
or mitigated your incident, perhaps you can delay disclosure, you know, and have some

760
00:43:55,040 --> 00:43:55,840
other things on top of it.

761
00:43:55,920 --> 00:43:56,280
No dice.

762
00:43:56,740 --> 00:43:59,760
Instead, what they said was, well, here's our exception.

763
00:44:00,660 --> 00:44:06,520
If the Attorney General asks the SEC in writing to delay because there's a threat to national

764
00:44:06,520 --> 00:44:09,560
security or safety, then there can be a delay.

765
00:44:09,780 --> 00:44:11,200
It's like that is not going to happen, right?

766
00:44:11,260 --> 00:44:13,200
That is a very, very low number of incidents.

767
00:44:13,500 --> 00:44:17,840
So for those of you that work at public companies, you will probably, functionally what's going

768
00:44:17,840 --> 00:44:20,980
to happen is if you have a cybersecurity incident, you're going to have to draw on more parts.

769
00:44:21,600 --> 00:44:26,000
You're going to draw in your corporate attorneys who should be familiar with the concept of

770
00:44:26,000 --> 00:44:29,960
materiality as well as your corporate communications because you will be disclosing this incident

771
00:44:29,960 --> 00:44:31,000
publicly within four days.

772
00:44:32,280 --> 00:44:32,980
Go ahead.

773
00:44:33,740 --> 00:44:34,260
Hi.

774
00:44:34,480 --> 00:44:36,460
I have a question about Safe Harbor.

775
00:44:37,140 --> 00:44:41,960
One of the things I've noticed recently is that it's pretty common for Safe Harbor language

776
00:44:41,960 --> 00:44:46,360
to exist in programs launching now, but I've noticed a trend of them including request

777
00:44:46,360 --> 00:44:49,420
per second limitations, and I would like to know where I'm wrong in my logic.

778
00:44:49,420 --> 00:44:54,500
If you, for instance, take Visa, they launched a program recently with a one request per

779
00:44:54,500 --> 00:45:01,460
second limit for testing, you can't load a web page and you're exceeding that automatically.

780
00:45:02,000 --> 00:45:07,540
Why is Safe Harbor not meaningless in that scenario?

781
00:45:08,060 --> 00:45:12,160
Sounds like poorly written rules by people who are uninformed.

782
00:45:12,700 --> 00:45:13,240
Yeah.

783
00:45:13,240 --> 00:45:16,360
But you see, like...

784
00:45:16,360 --> 00:45:17,440
Maybe that's you.

785
00:45:17,960 --> 00:45:19,400
I mean, one of the things that I've noticed is that it's a little bit more complicated

786
00:45:19,420 --> 00:45:19,940
than what Katie said.

787
00:45:20,520 --> 00:45:21,580
I think there's...

788
00:45:21,580 --> 00:45:26,280
Basically, I think there's a bunch of things like that that you see.

789
00:45:26,460 --> 00:45:32,760
A lot of the recommendations and policy kind of guidelines that exist in bug bounty programs

790
00:45:32,760 --> 00:45:39,720
in particular are basically copypasta that's like 20 years old or more, right?

791
00:45:39,860 --> 00:45:45,040
So there might have been a point in time where some organization or some program at

792
00:45:45,040 --> 00:45:48,460
some point in time that said, okay, here's a particular rate limit that we want to put

793
00:45:48,460 --> 00:45:49,060
on this program.

794
00:45:49,420 --> 00:45:51,580
And we're gonna do this and this and this because of blah, blah, blah, it made sense,

795
00:45:51,760 --> 00:45:51,900
right?

796
00:45:52,440 --> 00:45:55,860
But the idea of that being a useful way...

797
00:45:55,860 --> 00:45:58,520
Like really what they're saying is please don't hammer our stuff, right?

798
00:45:58,680 --> 00:46:02,860
Like the idea of actually putting a specific number on that's a bit silly, but I kind of

799
00:46:02,860 --> 00:46:03,840
get the intent behind it.

800
00:46:04,000 --> 00:46:08,520
I think with the Safe Harbor component of it, if...

801
00:46:08,520 --> 00:46:14,680
Because usually Safe Harbor clauses are written as if this, then that and the this is if you

802
00:46:14,680 --> 00:46:19,400
follow the rules, these conditions, then that will authorize your...

803
00:46:19,400 --> 00:46:25,720
against CFAA exempt you from any circumvention for the DMCA will exempt

804
00:46:25,720 --> 00:46:29,800
you from TOS violation and we'll just say that what you're doing is a good

805
00:46:29,800 --> 00:46:33,220
thing right that's generally how it works and yeah your point around like

806
00:46:33,780 --> 00:46:39,400
that this actually being pretty important alongside the that it's well

807
00:46:39,400 --> 00:46:43,200
understood I think you know Harley would probably be better to jump in on the

808
00:46:43,200 --> 00:46:46,100
legal side but I can what I'm trying to do here is paint a picture of why that

809
00:46:46,100 --> 00:46:50,560
happens and why that exists and often times it is a balancing act between like

810
00:46:50,560 --> 00:46:54,600
getting you know creating comfort on on the side of the organization putting

811
00:46:54,600 --> 00:46:59,480
these policies out there and it being like fully complete from that side so

812
00:46:59,480 --> 00:47:03,620
before we take the next question or before Harley comments and I'm gonna

813
00:47:03,620 --> 00:47:08,520
give you your your fleeing rights to leave the room so and please thank Casey

814
00:47:08,520 --> 00:47:10,340
for joining us and good luck with your talk

815
00:47:14,640 --> 00:47:15,600
so sorry

816
00:47:16,100 --> 00:47:21,800
you all don't have to leave you can stay and talk to us so next question thank

817
00:47:21,800 --> 00:47:25,140
you I'll be cognizant of time but I think this is pretty relevant okay so

818
00:47:25,540 --> 00:47:29,000
government's starting to mature and enable their citizens to report

819
00:47:29,000 --> 00:47:31,880
vulnerabilities we think that's naturally a good thing everyone on the

820
00:47:31,880 --> 00:47:35,500
security researcher front you can think hey I have a little extra protection

821
00:47:35,500 --> 00:47:38,800
here than I had before and can sleep a little easier when you report something

822
00:47:38,800 --> 00:47:43,580
but as governments start to kind of wisen up and like all around the world

823
00:47:43,580 --> 00:47:45,860
not just ours or any other particular ones

824
00:47:46,100 --> 00:47:51,060
and encourage people to report vulnerabilities what's to stop governments from starting to

825
00:47:51,060 --> 00:47:55,320
really emphasize other countries you know citizens of other countries reporting vulnerabilities to

826
00:47:55,320 --> 00:47:59,680
them because we might be friendly with some folks in public but behind the scenes there's

827
00:47:59,680 --> 00:48:03,360
always an information War Race going on and I was curious if everyone had a take on that

828
00:48:04,180 --> 00:48:12,720
I I can't hear very well oh I'm so sorry so yeah yeah so basically as this becomes I guess sort of quite

829
00:48:12,720 --> 00:48:15,900
nationalized reporting uh to these schemes

830
00:48:16,620 --> 00:48:20,320
does that then have sort of blow back on the individuals and their nationality

831
00:48:20,320 --> 00:48:24,240
so for example in the mobile industry we have this pan industry reporting scheme

832
00:48:24,240 --> 00:48:27,780
we have people from all different countries from all you know individually

833
00:48:27,780 --> 00:48:32,880
and companies that are in different countries are are they going to be kind

834
00:48:32,880 --> 00:48:39,060
of do you think that some companies countries may start to restrict people from nationalities

835
00:48:39,060 --> 00:48:45,880
that just because of where they're from basically so I think so I think the answer is yes uh but I

836
00:48:46,100 --> 00:48:50,940
also think it different differs by country so uh China's vulnerability disclosure law that we we

837
00:48:50,940 --> 00:48:56,640
touched on earlier uh does in fact uh have a restriction on reporting your vulnerability outside

838
00:48:56,640 --> 00:49:02,360
of outside of China um I I don't have the exact language in front of me but there is that is in

839
00:49:02,360 --> 00:49:07,960
there um how I'm actually very curious to know how how companies are are you know actualizing

840
00:49:07,960 --> 00:49:13,100
this particularly multinational companies that are based outside of China but have operations in

841
00:49:13,100 --> 00:49:16,000
China um but uh but yes so if you are

842
00:49:16,100 --> 00:49:20,600
an individual there like like I said you do report to the vendor who reports to the government or

843
00:49:20,600 --> 00:49:24,980
you report to the government you are not authorized it's in fact there are criminal penalties if you

844
00:49:24,980 --> 00:49:30,400
make it public or if you report to some other government outside of China um for but most other

845
00:49:30,400 --> 00:49:36,800
most other nations that I'm aware of even the the law that I would describe as as negative on

846
00:49:36,800 --> 00:49:41,840
vulnerability reporting uh this the cyber resilience Act in the EU that that included

847
00:49:41,840 --> 00:49:45,840
most other laws are are not do not really require

848
00:49:46,100 --> 00:49:52,140
to report directly to government as an individual right so uh you report to the vendor and then the

849
00:49:52,140 --> 00:49:56,060
vendor has certain obligations but you're not punished or restricted generally as an individual

850
00:49:56,060 --> 00:50:02,020
from reporting outside I don't see that as a trend so much outside of outside of China and

851
00:50:02,020 --> 00:50:05,800
um you know maybe there are other countries that are more authoritarian that I'm you know that

852
00:50:05,800 --> 00:50:10,060
have something like that I'm sure I'm sure there's some unspoken codes in certain countries but I'm

853
00:50:10,060 --> 00:50:15,480
I'm not really aware of them personally now the other sorry the other restriction is uh

854
00:50:16,100 --> 00:50:20,520
on the exports or sorry the um uh the sanctions side um I'll let I'll let Katie talk about that

855
00:50:20,520 --> 00:50:23,700
but that is that is the other way that you know they can discriminate against individuals based

856
00:50:23,700 --> 00:50:30,460
on their geography yeah we'll just let me finish the and we'll go ahead um so there is one other

857
00:50:30,460 --> 00:50:35,560
way and Charlie just said it when we think about sanctions U.S government sanctions specifically

858
00:50:35,560 --> 00:50:41,220
and this happens across the world there is there are a couple ways sanctions impact but one of them

859
00:50:41,220 --> 00:50:45,700
is if you are in in a researcher in an embargoed country if you try to

860
00:50:46,100 --> 00:50:50,820
commit a vulnerability to a U.S company that U.S company may not be able to receive it and

861
00:50:50,820 --> 00:50:56,100
may simply IP block you so they can't actually even receive the information from a sanctioned

862
00:50:56,100 --> 00:51:02,080
company because they don't want to have the possibility of having a sanctioned event happen

863
00:51:02,080 --> 00:51:08,380
so they simply do IP blocking and so that means that you can't prove a negative I don't know how

864
00:51:08,380 --> 00:51:14,840
often that's happening because it's being screened and so that's a perfect Avenue where you're

865
00:51:14,840 --> 00:51:15,940
having individual research

866
00:51:16,100 --> 00:51:19,960
researchers who in some cases may be taking great personal risk upon themselves for trying

867
00:51:19,960 --> 00:51:25,080
to do the right thing and report it to the vendor prior to reporting it to their highly oppressive

868
00:51:25,080 --> 00:51:31,880
or government you know so sanctions clarifying sanctions and upgrading sanctions U.S sanctions

869
00:51:31,880 --> 00:51:36,060
and sanctions for other countries across the United States is something that should be taken

870
00:51:36,060 --> 00:51:44,100
very seriously those regulations should be should be updated to apply to reality as we understand it

871
00:51:44,100 --> 00:51:45,700
and I think Lynn's going to kick us off now

872
00:51:48,600 --> 00:51:50,480
so thank you thank you everyone