1
00:00:03,020 --> 00:00:08,900
Good afternoon everyone and I hope that you're having a great day. A special

2
00:00:08,900 --> 00:00:14,580
greeting to the specialists who participated in the previous panels. I'm

3
00:00:14,580 --> 00:00:18,340
Isabella Rose, the communications officer for the Inter-American

4
00:00:19,270 --> 00:00:24,580
Committee Against Terrorism of the Organization of American States, CICTE

5
00:00:24,580 --> 00:00:32,280
and OAS. It's an honor for the OAS to attend and share our experiences during

6
00:00:32,280 --> 00:00:40,360
DEFCON 31 this year. With over 15 years of experience, our program is a regional

7
00:00:40,360 --> 00:00:46,800
leader in helping OAS member states develop cybersecurity capabilities at

8
00:00:46,800 --> 00:00:53,820
the technical and public policy levels. Its initiatives and activities aim to

9
00:00:53,820 --> 00:00:54,200
ensure

10
00:00:54,200 --> 00:01:02,500
an open, secure, and resilient cyberspace throughout the Western Hemisphere. The

11
00:01:02,500 --> 00:01:09,120
program's three main objectives are, first, to support the OAS member states

12
00:01:09,120 --> 00:01:15,560
in developing technical and political capabilities to successfully prevent,

13
00:01:16,100 --> 00:01:24,180
identify, respond to, and recover from cyber incidents. Second, to ensure

14
00:01:24,180 --> 00:01:24,960
an open, secure, and resilient cyberspace throughout the Western Hemisphere. The

15
00:01:24,960 --> 00:01:26,660
developing technological and operational infrastructure for strong, effective, and

16
00:01:26,660 --> 00:01:32,540
timely information sharing, cooperation and coordination among cybersecurity

17
00:01:33,560 --> 00:01:40,960
stakeholders at the national, regional, and international levels and, third, to

18
00:01:40,960 --> 00:01:45,820
increase access to knowledge and information on cyber threats and risks

19
00:01:45,820 --> 00:01:53,940
to public private civil society stakeholders and internet users beyond

20
00:01:53,940 --> 00:02:00,360
the breach exploring cyber security policies with hacker perspectives will

21
00:02:00,360 --> 00:02:05,660
be a discussion that explores the role of cyber security policy hackers and

22
00:02:05,660 --> 00:02:11,520
responding to cyber policy challenges that governments and organizations face

23
00:02:11,520 --> 00:02:18,000
in the current rapidly evolving landscape will focus on the importance

24
00:02:18,000 --> 00:02:22,600
of cyber security policy hackers in shaping and advancing cyber security

25
00:02:22,600 --> 00:02:28,040
policy the challenges in developing effective cyber security policies and

26
00:02:28,580 --> 00:02:34,400
the need for collaboration and innovation in the field a special thank

27
00:02:34,400 --> 00:02:39,680
you to the panelists for taking the time to share their valuable perspectives at

28
00:02:39,680 --> 00:02:40,300
this event

29
00:02:40,300 --> 00:02:45,240
today we are joined by three professionals with excellent

30
00:02:45,240 --> 00:02:48,220
international projection first

31
00:02:48,820 --> 00:02:53,980
Mauro Vigetti advisor and digital technologies of warfare at the

32
00:02:53,980 --> 00:03:00,180
International Committee of the Red Cross second Orlando Garces cyber security

33
00:03:00,180 --> 00:03:05,880
officer of the Inter-American committee against terrorism of the OAS and

34
00:03:05,880 --> 00:03:10,120
finally Andres Velasquez cybersecurity expert and the founder of

35
00:03:10,120 --> 00:03:10,280
ProHipHip.org

36
00:03:10,280 --> 00:03:11,300
president of Matica.

37
00:03:13,460 --> 00:03:17,400
So the field of cybersecurity policy is constantly evolving,

38
00:03:17,720 --> 00:03:21,260
and as such, the need to think innovatively and critically

39
00:03:21,260 --> 00:03:23,940
about policy solutions to address

40
00:03:23,940 --> 00:03:25,440
new and emerging threats.

41
00:03:25,980 --> 00:03:28,500
But when we talk about cyber policy,

42
00:03:28,800 --> 00:03:31,460
we can do it from the organizational, governmental,

43
00:03:31,840 --> 00:03:33,020
or international levels.

44
00:03:34,600 --> 00:03:36,620
Andres, let's begin with you.

45
00:03:37,380 --> 00:03:38,940
Tell us a little bit about yourself

46
00:03:38,940 --> 00:03:42,360
and from your experience, share with us the following.

47
00:03:43,500 --> 00:03:45,960
How can Latin America and the Caribbean,

48
00:03:46,980 --> 00:03:48,400
private and public organizations,

49
00:03:49,180 --> 00:03:52,600
foster a cooperative and trust-based environment

50
00:03:52,600 --> 00:03:56,120
to encourage hackers' participation in initiatives

51
00:03:56,520 --> 00:03:58,540
to enhance cybersecurity policies?

52
00:03:59,140 --> 00:04:00,340
Thank you very much, Sabela.

53
00:04:00,480 --> 00:04:02,160
It's a great honor to be here.

54
00:04:03,260 --> 00:04:05,360
Because actually, I attended one of the first,

55
00:04:05,480 --> 00:04:08,760
well, at least six first DEF CONs.

56
00:04:08,940 --> 00:04:12,120
And when I started working after that with law enforcement,

57
00:04:12,280 --> 00:04:13,780
I wasn't able to come here again.

58
00:04:13,920 --> 00:04:17,280
If you're familiar with DEF CON, there

59
00:04:17,280 --> 00:04:19,360
was something called Spot the Fed.

60
00:04:19,860 --> 00:04:23,260
So probably people that were intended

61
00:04:23,260 --> 00:04:27,300
on working with government were not actually allowed here.

62
00:04:29,160 --> 00:04:32,760
This has changed, and I'm very pleased that that has happened.

63
00:04:32,980 --> 00:04:38,520
So pretty much what I have done in the last 20 years is create,

64
00:04:39,600 --> 00:04:43,240
specifically, the cybersecurity and most

65
00:04:43,240 --> 00:04:46,440
of the law enforcement agencies in terms

66
00:04:46,440 --> 00:04:49,240
of digital forensics, digital intelligence,

67
00:04:49,580 --> 00:04:52,560
some of the most important cases in Latin America.

68
00:04:52,900 --> 00:04:55,320
So even that I'm in the private sector,

69
00:04:55,540 --> 00:04:57,680
I have been working a lot with government

70
00:04:58,200 --> 00:05:01,820
in terms of bringing new technology,

71
00:05:01,960 --> 00:05:08,720
new ways of looking and how to find out,

72
00:05:09,560 --> 00:05:12,280
where are the people that are attacking us,

73
00:05:12,400 --> 00:05:14,960
trying to be as clear as possible.

74
00:05:15,360 --> 00:05:18,100
So one of the biggest things and the challenges

75
00:05:18,100 --> 00:05:21,360
that you mentioned is, I think that something

76
00:05:21,360 --> 00:05:24,340
that we should be talking about is mistrust.

77
00:05:25,240 --> 00:05:30,180
Mistrust between government, hackers, and sometimes academia.

78
00:05:30,920 --> 00:05:33,860
So that mistrust is probably one of the first things

79
00:05:33,860 --> 00:05:36,860
that we're having a big challenge,

80
00:05:36,940 --> 00:05:38,600
and we have to do a paradigm shift.

81
00:05:39,360 --> 00:05:42,260
Specifically, if we see the great value

82
00:05:42,260 --> 00:05:44,780
that we can have on the education, on cybersecurity,

83
00:05:45,260 --> 00:05:47,500
and how we can work all together.

84
00:05:48,720 --> 00:05:51,820
Back in the days, one of my first tutors,

85
00:05:51,900 --> 00:05:54,660
the agent Lugo from the US Secret Service,

86
00:05:55,500 --> 00:05:58,160
showed me a book called The Cuckoo's Egg.

87
00:05:58,680 --> 00:06:01,120
I don't know if you have heard about it, Cliff Stoll.

88
00:06:01,880 --> 00:06:05,640
It talks about an astronomer that back in the 80s

89
00:06:06,020 --> 00:06:08,280
from Berkeley, here in California,

90
00:06:08,280 --> 00:06:12,240
was able to, using whatever he had,

91
00:06:13,880 --> 00:06:18,360
a way to find out who and when his server was hacked.

92
00:06:18,660 --> 00:06:22,100
So pretty much, it's a story about a hacking, an intrusion,

93
00:06:22,240 --> 00:06:25,920
and how he was able to figure out where they were doing it.

94
00:06:26,360 --> 00:06:28,320
Long story short, and no spoilers around,

95
00:06:28,560 --> 00:06:30,540
he was able to find out that it was not in the US.

96
00:06:30,920 --> 00:06:33,720
That was the first time that I learned about jurisdiction.

97
00:06:34,460 --> 00:06:37,300
Something that hackers and policymakers

98
00:06:37,920 --> 00:06:38,880
don't really understand.

99
00:06:39,400 --> 00:06:41,060
And that's one of the biggest challenges

100
00:06:41,060 --> 00:06:42,320
that we have right now in Latin America.

101
00:06:43,140 --> 00:06:45,680
Because most of the time, everything,

102
00:06:45,920 --> 00:06:47,900
when we talk technology-oriented,

103
00:06:48,200 --> 00:06:49,480
is based in the US.

104
00:06:50,860 --> 00:06:52,920
Considering that, every single time

105
00:06:52,920 --> 00:06:54,960
that we need information from the states,

106
00:06:55,140 --> 00:06:59,100
we need to go through mutual treaties

107
00:06:59,100 --> 00:07:02,140
in order to get the information.

108
00:07:02,360 --> 00:07:04,660
And that can take five, six years,

109
00:07:05,140 --> 00:07:06,580
just to arrive to the states.

110
00:07:07,300 --> 00:07:08,600
And we need another five years in order

111
00:07:08,600 --> 00:07:11,120
to get back through the normal processes.

112
00:07:11,540 --> 00:07:18,380
So if we look at this context, what we can start,

113
00:07:19,080 --> 00:07:21,820
I'm trying to put some ideas on the table.

114
00:07:22,340 --> 00:07:25,860
I think that another challenge is

115
00:07:25,860 --> 00:07:28,560
how we report vulnerabilities in Latin America.

116
00:07:28,940 --> 00:07:32,140
In comparison to the states, we do not have any policy.

117
00:07:32,420 --> 00:07:37,160
We do not have any regular way of doing it.

118
00:07:37,300 --> 00:07:39,760
If you, hacker, report a vulnerability

119
00:07:40,300 --> 00:07:45,260
into a Mexican, Colombian, Argentinian company,

120
00:07:46,200 --> 00:07:48,860
probably they will try to sue you

121
00:07:48,860 --> 00:07:50,780
and start a criminal case.

122
00:07:51,680 --> 00:07:53,940
Why? Because we don't know what to do.

123
00:07:54,360 --> 00:07:56,500
And that's the real reason of that.

124
00:07:57,560 --> 00:08:00,460
In the other side, we have these legal protections

125
00:08:00,460 --> 00:08:04,360
that we need to figure out how to make it happen.

126
00:08:04,460 --> 00:08:06,900
You know, clear frameworks on how to report

127
00:08:06,900 --> 00:08:08,080
and how to work together.

128
00:08:08,560 --> 00:08:12,220
And that's most or gets into the point

129
00:08:12,220 --> 00:08:16,360
that we need to understand,

130
00:08:17,360 --> 00:08:19,160
as Latin American countries,

131
00:08:19,860 --> 00:08:21,840
that the hacker is not the bad guy.

132
00:08:22,640 --> 00:08:24,780
And that's one of the most important things

133
00:08:24,780 --> 00:08:26,360
that I can share with you.

134
00:08:26,940 --> 00:08:29,140
We could do, and I expect to do,

135
00:08:29,180 --> 00:08:30,620
a lot of collaborative workshops,

136
00:08:31,040 --> 00:08:34,360
recognition and incentives that will motivate

137
00:08:34,360 --> 00:08:36,180
so we can start working together.

138
00:08:36,180 --> 00:08:38,180
The reality, and at the end,

139
00:08:38,200 --> 00:08:39,380
I will finish with that,

140
00:08:39,480 --> 00:08:41,500
right now, our biggest challenge

141
00:08:41,500 --> 00:08:43,720
is that we do not work together.

142
00:08:45,380 --> 00:08:47,520
That's really interesting, Andres.

143
00:08:48,140 --> 00:08:49,500
Thank you so much.

144
00:08:49,900 --> 00:08:52,940
Now, Orlando, you have been involved

145
00:08:52,940 --> 00:08:55,580
in several OAS technical assistance projects

146
00:08:55,860 --> 00:08:57,800
for the formulation and implementation

147
00:08:57,800 --> 00:08:59,880
of national cybersecurity strategies

148
00:08:59,880 --> 00:09:02,860
and policies in multiple countries

149
00:09:02,860 --> 00:09:04,860
in Latin America and the Caribbean region.

150
00:09:05,600 --> 00:09:09,580
What challenges do Latin America

151
00:09:09,580 --> 00:09:12,160
and the Caribbean region governments face

152
00:09:12,160 --> 00:09:14,000
in engaging the hacker community

153
00:09:14,000 --> 00:09:18,080
during the life cycle of national cybersecurity policies

154
00:09:18,080 --> 00:09:19,140
or strategies?

155
00:09:21,620 --> 00:09:22,820
So, thank you.

156
00:09:22,900 --> 00:09:23,760
Hi, everybody.

157
00:09:24,000 --> 00:09:24,840
My name is Orlando.

158
00:09:26,100 --> 00:09:27,220
Hi, Andres.

159
00:09:27,340 --> 00:09:27,900
Hi, Mauro.

160
00:09:27,940 --> 00:09:28,740
Hi, Isabella.

161
00:09:29,860 --> 00:09:32,420
Well, I work for the OAS,

162
00:09:32,560 --> 00:09:34,500
the Disorganization of American States.

163
00:09:34,860 --> 00:09:37,900
We have an Inter-American Committee

164
00:09:37,900 --> 00:09:39,360
Against Terrorism there.

165
00:09:40,680 --> 00:09:44,420
And over the last eight years,

166
00:09:44,500 --> 00:09:47,600
I've been involved in some technical projects

167
00:09:47,600 --> 00:09:50,780
regarding formulation and implementation

168
00:09:50,780 --> 00:09:53,500
of national cybersecurity strategies

169
00:09:54,800 --> 00:09:56,160
in the region.

170
00:09:56,600 --> 00:09:59,600
So, let me...

171
00:09:59,600 --> 00:10:03,180
I have to apologize to Mauro and Andres

172
00:10:03,180 --> 00:10:04,840
because I just want to say

173
00:10:04,860 --> 00:10:06,740
that I just want to share to the audience,

174
00:10:06,940 --> 00:10:09,560
you know, the Latin American experience

175
00:10:10,580 --> 00:10:14,040
regarding this type of, you know,

176
00:10:14,060 --> 00:10:15,820
exercises that we have done there.

177
00:10:16,540 --> 00:10:21,620
So, the OAS CICTE cybersecurity program

178
00:10:21,620 --> 00:10:24,220
has been the, you know, the regional leader

179
00:10:24,800 --> 00:10:27,480
in Latin America and the Caribbean

180
00:10:27,480 --> 00:10:32,080
in providing, you know, technical and policy levels,

181
00:10:32,400 --> 00:10:34,280
cybersecurity capacities

182
00:10:34,860 --> 00:10:35,240
to the OAS.

183
00:10:35,240 --> 00:10:38,400
These initiatives aim to ensure an open, secure,

184
00:10:38,500 --> 00:10:41,280
stable, resilient cyberspace

185
00:10:41,860 --> 00:10:44,020
throughout the Western Hemisphere.

186
00:10:45,460 --> 00:10:50,480
Out of the 35 member states of the OAS,

187
00:10:50,780 --> 00:10:52,680
19, more than a half,

188
00:10:52,860 --> 00:10:56,480
have formulated a national cybersecurity policy

189
00:10:56,480 --> 00:10:58,780
or a national cybersecurity strategy.

190
00:10:59,700 --> 00:11:02,540
Eleven of them with OAS assistance.

191
00:11:02,540 --> 00:11:05,300
Colombia, for example,

192
00:11:05,480 --> 00:11:08,440
have formulated three national policies.

193
00:11:10,240 --> 00:11:14,960
Chile has formulated two national cyber strategies,

194
00:11:15,140 --> 00:11:15,960
cyber policies.

195
00:11:16,640 --> 00:11:19,720
The Dominican Republic and Panama,

196
00:11:20,060 --> 00:11:23,160
two national cyber strategies.

197
00:11:23,540 --> 00:11:25,740
Currently, in the region,

198
00:11:25,920 --> 00:11:28,020
there are four countries,

199
00:11:28,220 --> 00:11:30,460
most of them in the Caribbean,

200
00:11:30,860 --> 00:11:32,320
Barbados, Guyana,

201
00:11:32,540 --> 00:11:34,580
the Bahamas, and Uruguay,

202
00:11:34,600 --> 00:11:37,800
that are formulating their first

203
00:11:38,540 --> 00:11:40,400
national cybersecurity strategy.

204
00:11:40,840 --> 00:11:42,760
And there are four countries

205
00:11:43,540 --> 00:11:44,860
formulating their second one.

206
00:11:45,600 --> 00:11:47,900
There's Argentina, Costa Rica,

207
00:11:48,240 --> 00:11:50,160
Jamaica, and Trinidad and Tobago.

208
00:11:50,460 --> 00:11:52,640
I have to highlight, you know,

209
00:11:52,640 --> 00:11:54,040
the experience in Costa Rica

210
00:11:54,040 --> 00:11:56,220
because last year,

211
00:11:56,320 --> 00:11:59,140
the country has faced

212
00:11:59,140 --> 00:12:02,120
some major cyber attacks.

213
00:12:02,540 --> 00:12:05,140
So even though, you know,

214
00:12:05,140 --> 00:12:07,800
this is very important for policy action

215
00:12:07,800 --> 00:12:08,960
in the region,

216
00:12:09,160 --> 00:12:11,520
even though OAS has been around

217
00:12:11,520 --> 00:12:13,540
for about 15 years

218
00:12:13,540 --> 00:12:16,220
helping the member states,

219
00:12:16,640 --> 00:12:18,400
nowadays, more and more

220
00:12:18,400 --> 00:12:20,760
international community actors

221
00:12:20,760 --> 00:12:22,720
are getting involved

222
00:12:22,720 --> 00:12:26,220
in cyber policy making in the region.

223
00:12:26,400 --> 00:12:29,820
So we have other global international organizations

224
00:12:29,820 --> 00:12:31,600
such as the United States

225
00:12:31,600 --> 00:12:32,960
through the ITU.

226
00:12:33,080 --> 00:12:34,660
We have regional organizations

227
00:12:36,280 --> 00:12:38,360
such as the European Union

228
00:12:38,360 --> 00:12:41,960
that are very interested in the region.

229
00:12:42,300 --> 00:12:44,760
We have CARICOM in the Caribbean region.

230
00:12:45,600 --> 00:12:47,580
Multilateral development organizations

231
00:12:47,580 --> 00:12:48,860
such as the World Bank

232
00:12:48,860 --> 00:12:51,180
and the IDB,

233
00:12:51,260 --> 00:12:53,320
the Inter-American Development Bank.

234
00:12:54,080 --> 00:12:55,640
Other independent states,

235
00:12:55,860 --> 00:12:57,240
for example, you know,

236
00:12:57,240 --> 00:12:59,300
the United States are providing

237
00:12:59,300 --> 00:13:01,140
a lot of help in our countries.

238
00:13:01,600 --> 00:13:03,960
And a lot of private sector companies.

239
00:13:04,740 --> 00:13:07,580
So, you know,

240
00:13:07,600 --> 00:13:10,840
the policy making processes

241
00:13:11,600 --> 00:13:13,000
in the region

242
00:13:13,600 --> 00:13:16,640
has a lot of, you know,

243
00:13:16,640 --> 00:13:18,920
actors trying to get involved.

244
00:13:19,380 --> 00:13:21,280
So there are, you know,

245
00:13:21,340 --> 00:13:22,920
the capacities there,

246
00:13:23,040 --> 00:13:25,380
there are like intermediate level capacity

247
00:13:25,380 --> 00:13:28,220
and the cyber capacity maturities

248
00:13:28,220 --> 00:13:30,500
in the intermediate level.

249
00:13:30,500 --> 00:13:35,880
So multi-stakeholder approach

250
00:13:35,880 --> 00:13:36,920
is like,

251
00:13:38,540 --> 00:13:41,980
it's been using since 2015.

252
00:13:42,620 --> 00:13:46,460
And right now,

253
00:13:46,560 --> 00:13:48,340
the current generations of policies

254
00:13:48,340 --> 00:13:49,360
are working on,

255
00:13:49,460 --> 00:13:51,200
most of the time,

256
00:13:51,320 --> 00:13:52,700
in governance models

257
00:13:53,410 --> 00:13:55,740
and also working on

258
00:13:57,280 --> 00:14:00,400
trying to get involved

259
00:14:00,500 --> 00:14:03,080
all the multi-stakeholders

260
00:14:03,080 --> 00:14:03,720
in the ecosystem,

261
00:14:04,560 --> 00:14:06,340
in cybersecurity ecosystems.

262
00:14:06,940 --> 00:14:10,040
So that's what is going on

263
00:14:10,040 --> 00:14:10,600
in the region.

264
00:14:11,140 --> 00:14:13,400
We are a very small team

265
00:14:13,400 --> 00:14:15,820
trying to do a lot of things

266
00:14:15,820 --> 00:14:18,080
in Latin America.

267
00:14:18,660 --> 00:14:20,860
And what Andres just said,

268
00:14:21,040 --> 00:14:22,540
you know, there's lack of trust.

269
00:14:22,720 --> 00:14:23,920
And, you know, the main challenge

270
00:14:23,920 --> 00:14:25,340
in the region right now

271
00:14:25,340 --> 00:14:28,780
is that, you know,

272
00:14:28,800 --> 00:14:30,440
the authorities that are in charge

273
00:14:30,500 --> 00:14:32,400
of formulating a policy

274
00:14:32,400 --> 00:14:34,040
or a national strategy,

275
00:14:34,420 --> 00:14:37,620
lack of a technical understanding

276
00:14:37,620 --> 00:14:40,220
of what cybersecurity vulnerability

277
00:14:40,220 --> 00:14:41,720
research entails.

278
00:14:42,200 --> 00:14:45,360
And sometimes our countries,

279
00:14:45,440 --> 00:14:48,720
you know, present only

280
00:14:48,720 --> 00:14:51,440
the malicious hacking point of view.

281
00:14:51,660 --> 00:14:54,220
And sometimes, you know,

282
00:14:54,260 --> 00:14:55,500
they have this narrative

283
00:14:55,500 --> 00:14:57,080
that this type of research

284
00:14:57,080 --> 00:14:59,660
should be penalized.

285
00:14:59,660 --> 00:15:02,640
So the region has facing

286
00:15:02,640 --> 00:15:04,860
a lot of challenges involving

287
00:15:04,860 --> 00:15:06,560
technical communities

288
00:15:06,560 --> 00:15:08,320
like the hacker community

289
00:15:09,140 --> 00:15:10,760
because there are, like,

290
00:15:10,820 --> 00:15:12,460
fear and hostile reaction

291
00:15:12,460 --> 00:15:14,000
from the authorities

292
00:15:14,000 --> 00:15:15,020
and legal sanctions.

293
00:15:15,420 --> 00:15:17,220
We have a lot of legal barriers,

294
00:15:17,600 --> 00:15:20,480
an absence of a safe legal framework,

295
00:15:20,800 --> 00:15:24,520
and lack of coordination

296
00:15:24,520 --> 00:15:26,930
between public officers

297
00:15:27,200 --> 00:15:28,560
and who are dealing

298
00:15:28,560 --> 00:15:30,460
with policy making with,

299
00:15:30,580 --> 00:15:32,500
you know, the hacker communities

300
00:15:32,500 --> 00:15:34,240
and the technical communities.

301
00:15:34,620 --> 00:15:37,460
So that's what I'm about to say.

302
00:15:39,140 --> 00:15:40,880
Thank you so much, Orlando.

303
00:15:42,220 --> 00:15:44,080
Mauro, you have been working

304
00:15:44,080 --> 00:15:46,860
for a while in cyber policy

305
00:15:46,860 --> 00:15:48,560
at the international level.

306
00:15:49,020 --> 00:15:51,360
Please talk to us about your expertise.

307
00:15:51,900 --> 00:15:53,760
How can hacker perspectives

308
00:15:54,620 --> 00:15:56,160
contribute to balancing

309
00:15:56,160 --> 00:15:57,660
cybersecurity measures

310
00:15:57,660 --> 00:15:59,900
and preserving online privacy

311
00:15:59,900 --> 00:16:01,240
and civil liberties

312
00:16:01,980 --> 00:16:04,060
in developing and implementing

313
00:16:05,500 --> 00:16:06,540
cybersecurity policies

314
00:16:06,540 --> 00:16:08,100
for global organizations

315
00:16:08,880 --> 00:16:11,160
like the ICRC?

316
00:16:12,680 --> 00:16:13,680
Thank you very much.

317
00:16:13,780 --> 00:16:14,580
Thank you for having me.

318
00:16:14,720 --> 00:16:16,440
I think I'm the only

319
00:16:16,440 --> 00:16:18,740
non-AOS panelist here.

320
00:16:18,920 --> 00:16:20,100
So the goal here would be

321
00:16:20,100 --> 00:16:21,580
to expand the view

322
00:16:21,580 --> 00:16:23,260
from an international perspective.

323
00:16:23,500 --> 00:16:24,420
So I'm working for

324
00:16:24,420 --> 00:16:25,380
the International Committee

325
00:16:25,380 --> 00:16:26,980
of the Red Cross.

326
00:16:27,160 --> 00:16:27,640
You probably know

327
00:16:27,660 --> 00:16:28,640
the ICRC.

328
00:16:28,880 --> 00:16:30,880
So we are based in Geneva.

329
00:16:31,500 --> 00:16:33,120
It's probably the largest

330
00:16:33,120 --> 00:16:34,660
humanitarian organization worldwide.

331
00:16:35,520 --> 00:16:36,280
We have operations

332
00:16:36,280 --> 00:16:37,980
in more than 100 countries.

333
00:16:38,240 --> 00:16:40,300
And we mainly work

334
00:16:40,300 --> 00:16:42,380
in a situation of armed conflict.

335
00:16:42,580 --> 00:16:44,720
So those are very challenging situations.

336
00:16:45,220 --> 00:16:46,780
It's very challenging work

337
00:16:47,220 --> 00:16:47,860
we have there.

338
00:16:48,040 --> 00:16:50,140
And we are facing situations

339
00:16:50,140 --> 00:16:51,600
that are requesting

340
00:16:51,600 --> 00:16:54,820
a very important response.

341
00:16:55,120 --> 00:16:56,140
So in this regard,

342
00:16:56,260 --> 00:16:57,640
also in the digital space,

343
00:16:57,640 --> 00:16:58,840
we are confronted

344
00:16:58,840 --> 00:17:00,420
with such challenges.

345
00:17:00,800 --> 00:17:04,560
And there are two main aspects

346
00:17:04,560 --> 00:17:05,340
in this regard

347
00:17:05,340 --> 00:17:06,180
when we operate

348
00:17:06,180 --> 00:17:07,140
in the digital space.

349
00:17:07,280 --> 00:17:09,020
First, because also the ICRC

350
00:17:09,580 --> 00:17:12,020
has to digitalize its operations

351
00:17:12,640 --> 00:17:14,140
to provide services

352
00:17:14,140 --> 00:17:15,140
to our beneficiaries.

353
00:17:15,440 --> 00:17:16,320
And as you may know,

354
00:17:16,380 --> 00:17:18,340
the beneficiaries of the ICRC

355
00:17:18,340 --> 00:17:19,840
are people that are suffering

356
00:17:20,440 --> 00:17:21,480
from the consequences

357
00:17:21,480 --> 00:17:22,660
of armed conflict.

358
00:17:22,800 --> 00:17:24,360
So we have to digitalize

359
00:17:24,360 --> 00:17:25,700
our operation to be able

360
00:17:25,700 --> 00:17:26,640
to reach out to them

361
00:17:26,640 --> 00:17:27,980
to be more performant.

362
00:17:28,020 --> 00:17:29,140
And because the society

363
00:17:29,140 --> 00:17:30,100
is digitalizing,

364
00:17:30,220 --> 00:17:32,220
and also the armed conflict

365
00:17:32,220 --> 00:17:32,740
are digitalizing,

366
00:17:33,240 --> 00:17:35,020
so our response must be also

367
00:17:35,020 --> 00:17:35,920
at this level.

368
00:17:36,100 --> 00:17:37,060
And the second one

369
00:17:37,060 --> 00:17:39,140
is because we are facing

370
00:17:39,140 --> 00:17:42,280
an increasing politicization

371
00:17:42,280 --> 00:17:44,220
and polarization

372
00:17:45,140 --> 00:17:46,980
of the digital technologies.

373
00:17:47,160 --> 00:17:48,640
So we know that there are companies

374
00:17:49,280 --> 00:17:51,180
taking stand for one part

375
00:17:51,180 --> 00:17:52,220
of the conflict or the other.

376
00:17:52,400 --> 00:17:54,460
And the ICRC is a neutral

377
00:17:54,460 --> 00:17:55,920
and impartial organization.

378
00:17:55,920 --> 00:17:56,620
So we have to

379
00:17:56,640 --> 00:17:58,160
be able to provide

380
00:17:58,160 --> 00:18:00,400
the services respecting

381
00:18:00,400 --> 00:18:01,620
our independence

382
00:18:01,620 --> 00:18:05,480
and our neutrality.

383
00:18:05,820 --> 00:18:06,720
So that said,

384
00:18:06,860 --> 00:18:08,260
I would like to bring you

385
00:18:08,260 --> 00:18:09,160
a couple of examples

386
00:18:09,160 --> 00:18:10,320
on how we engage

387
00:18:10,320 --> 00:18:11,300
the hackers community

388
00:18:11,300 --> 00:18:13,040
and how we work with them.

389
00:18:13,280 --> 00:18:14,400
So the first one,

390
00:18:14,500 --> 00:18:16,080
you probably may know

391
00:18:16,080 --> 00:18:18,420
the emblem of the Red Cross.

392
00:18:18,520 --> 00:18:19,220
It's a Red Cross

393
00:18:19,220 --> 00:18:21,440
with a white background.

394
00:18:21,740 --> 00:18:22,880
So we use these

395
00:18:22,880 --> 00:18:24,020
to signal the protection

396
00:18:24,020 --> 00:18:26,460
of assets during armed conflict.

397
00:18:26,520 --> 00:18:26,620
So the Red Cross

398
00:18:26,640 --> 00:18:27,460
So we put the emblem,

399
00:18:27,600 --> 00:18:28,020
for instance,

400
00:18:28,100 --> 00:18:28,720
on the rooftop

401
00:18:28,720 --> 00:18:30,060
of our warehouse

402
00:18:30,060 --> 00:18:31,140
not to be bombed.

403
00:18:31,280 --> 00:18:32,480
Or we use these

404
00:18:32,480 --> 00:18:34,220
to put on our vehicles

405
00:18:34,220 --> 00:18:34,980
that we use

406
00:18:34,980 --> 00:18:36,940
to transport goods and people.

407
00:18:37,200 --> 00:18:38,660
So this is a signal

408
00:18:38,660 --> 00:18:39,340
of protection.

409
00:18:39,640 --> 00:18:40,580
So we say

410
00:18:40,580 --> 00:18:41,480
to the parties

411
00:18:41,480 --> 00:18:41,940
of the conflict,

412
00:18:42,020 --> 00:18:43,500
do not shoot this

413
00:18:43,500 --> 00:18:44,440
because it belongs

414
00:18:44,440 --> 00:18:45,840
to an international

415
00:18:45,840 --> 00:18:47,000
humanitarian organization.

416
00:18:47,200 --> 00:18:47,800
So we are trying

417
00:18:47,800 --> 00:18:48,800
to transform this

418
00:18:48,800 --> 00:18:50,160
and translate this

419
00:18:50,160 --> 00:18:51,200
into the digital space.

420
00:18:51,420 --> 00:18:52,660
So we are in a project

421
00:18:52,660 --> 00:18:53,720
where we are digitalizing

422
00:18:54,240 --> 00:18:55,600
the emblem of the Red Cross.

423
00:18:55,600 --> 00:18:58,040
How to signal operations

424
00:18:58,040 --> 00:19:00,420
that are on cyberspace

425
00:19:00,420 --> 00:19:01,200
and say, hey,

426
00:19:01,240 --> 00:19:03,140
those assets are protected.

427
00:19:03,380 --> 00:19:04,300
Please do not attack

428
00:19:04,300 --> 00:19:05,380
those servers,

429
00:19:05,540 --> 00:19:06,240
those networks,

430
00:19:06,400 --> 00:19:07,140
and so on.

431
00:19:07,280 --> 00:19:08,260
So how we do this?

432
00:19:08,480 --> 00:19:09,260
So we engaged

433
00:19:09,260 --> 00:19:10,260
with the hacker communities

434
00:19:10,260 --> 00:19:11,000
last year.

435
00:19:11,160 --> 00:19:12,460
And we suggested

436
00:19:12,460 --> 00:19:14,300
a couple of technical requirements

437
00:19:14,300 --> 00:19:15,500
that they have

438
00:19:15,500 --> 00:19:16,900
to take into account.

439
00:19:17,080 --> 00:19:18,100
And we asked them

440
00:19:18,100 --> 00:19:18,940
to help us

441
00:19:18,940 --> 00:19:19,820
to provide

442
00:19:19,820 --> 00:19:20,920
some prototype

443
00:19:20,920 --> 00:19:22,480
of how to digitalize

444
00:19:22,480 --> 00:19:23,520
the emblem of the Red Cross.

445
00:19:23,680 --> 00:19:24,540
And they come up

446
00:19:24,540 --> 00:19:25,420
with some ideas.

447
00:19:25,620 --> 00:19:26,180
They criticize

448
00:19:26,180 --> 00:19:27,340
our ideas.

449
00:19:27,500 --> 00:19:28,600
They put new ideas in.

450
00:19:28,780 --> 00:19:29,960
And so we are developing

451
00:19:29,960 --> 00:19:30,600
this.

452
00:19:30,800 --> 00:19:31,340
We published

453
00:19:31,340 --> 00:19:31,960
our first report

454
00:19:31,960 --> 00:19:32,460
in November

455
00:19:32,460 --> 00:19:33,720
on the digitalization

456
00:19:33,720 --> 00:19:34,280
of the emblem.

457
00:19:34,440 --> 00:19:35,060
And this is how

458
00:19:35,060 --> 00:19:36,060
we engage with the hackers.

459
00:19:36,280 --> 00:19:37,080
We saw

460
00:19:37,080 --> 00:19:38,380
a very interesting response

461
00:19:38,380 --> 00:19:39,620
because probably

462
00:19:39,620 --> 00:19:41,840
it's one of the first times

463
00:19:41,840 --> 00:19:42,920
that they can work

464
00:19:43,880 --> 00:19:44,840
without thinking

465
00:19:44,840 --> 00:19:45,840
about there is money

466
00:19:45,840 --> 00:19:46,380
in place.

467
00:19:46,480 --> 00:19:47,280
So the goal

468
00:19:47,280 --> 00:19:48,760
is a humanitarian goal.

469
00:19:48,860 --> 00:19:49,740
It's completely different

470
00:19:49,740 --> 00:19:51,080
from a bug bounty

471
00:19:51,080 --> 00:19:53,440
or other situation.

472
00:19:53,820 --> 00:19:54,520
So this is

473
00:19:54,540 --> 00:19:55,740
one first example

474
00:19:55,740 --> 00:19:56,680
on how we engage

475
00:19:56,680 --> 00:19:57,780
with the hacker communities.

476
00:19:57,920 --> 00:19:58,440
Another one

477
00:19:58,440 --> 00:20:00,780
is because

478
00:20:00,780 --> 00:20:01,560
of the respect

479
00:20:01,560 --> 00:20:02,560
of our neutrality

480
00:20:03,200 --> 00:20:03,860
and independence

481
00:20:03,860 --> 00:20:06,840
from digital technologies.

482
00:20:06,860 --> 00:20:08,300
So from digital technologies

483
00:20:08,300 --> 00:20:09,640
of the private sector.

484
00:20:09,820 --> 00:20:10,840
So we opened

485
00:20:10,840 --> 00:20:12,040
a delegation

486
00:20:12,040 --> 00:20:12,880
for cyberspace

487
00:20:12,880 --> 00:20:14,060
in Luxembourg last year.

488
00:20:14,220 --> 00:20:16,940
And one of the main goal

489
00:20:16,940 --> 00:20:17,840
of the delegation

490
00:20:17,840 --> 00:20:18,800
is to engage

491
00:20:18,800 --> 00:20:19,780
the hacker community

492
00:20:19,780 --> 00:20:20,880
to help us

493
00:20:20,880 --> 00:20:21,300
to develop

494
00:20:21,300 --> 00:20:22,420
open source tools

495
00:20:22,420 --> 00:20:23,340
that are independent

496
00:20:23,340 --> 00:20:24,520
from the commercial

497
00:20:24,540 --> 00:20:24,800
one.

498
00:20:24,980 --> 00:20:25,840
To be able

499
00:20:25,840 --> 00:20:26,980
to have a backup

500
00:20:26,980 --> 00:20:27,680
or situation

501
00:20:27,680 --> 00:20:29,340
where we cannot use

502
00:20:29,340 --> 00:20:31,020
commercial services,

503
00:20:31,140 --> 00:20:31,720
commercial product.

504
00:20:31,960 --> 00:20:32,980
But also to respect

505
00:20:32,980 --> 00:20:33,960
the information

506
00:20:33,960 --> 00:20:34,960
and the protection

507
00:20:34,960 --> 00:20:35,500
of information

508
00:20:35,500 --> 00:20:36,500
that our beneficiaries

509
00:20:36,500 --> 00:20:38,020
provided to us.

510
00:20:38,160 --> 00:20:38,980
So we have a duty

511
00:20:38,980 --> 00:20:39,560
of respect

512
00:20:39,560 --> 00:20:40,740
those information.

513
00:20:41,020 --> 00:20:41,780
So we are developing

514
00:20:41,780 --> 00:20:42,720
with the hacker communities.

515
00:20:42,980 --> 00:20:44,140
And we're going

516
00:20:44,140 --> 00:20:45,660
to come in 2024

517
00:20:45,660 --> 00:20:46,900
asking more

518
00:20:46,900 --> 00:20:48,460
from the hacker communities

519
00:20:48,460 --> 00:20:49,300
to help us

520
00:20:49,300 --> 00:20:50,520
to identify venues

521
00:20:50,520 --> 00:20:51,480
to be able

522
00:20:51,480 --> 00:20:53,600
to produce

523
00:20:53,600 --> 00:20:54,340
and develop

524
00:20:54,540 --> 00:20:56,500
such independent tools

525
00:20:56,500 --> 00:20:57,540
that we're going to use

526
00:20:57,540 --> 00:20:58,400
in our daily work.

527
00:21:01,220 --> 00:21:02,420
Thank you so much.

528
00:21:03,220 --> 00:21:04,360
Now, Orlando,

529
00:21:04,580 --> 00:21:07,540
given this international overview,

530
00:21:08,040 --> 00:21:10,700
what are the national policy approaches

531
00:21:11,120 --> 00:21:12,540
in the Latin American

532
00:21:12,540 --> 00:21:14,040
and Caribbean region

533
00:21:14,040 --> 00:21:16,240
to promote ethical hacking

534
00:21:16,240 --> 00:21:18,140
by enabling professionals

535
00:21:18,140 --> 00:21:19,840
to use their skills

536
00:21:20,380 --> 00:21:21,280
to identify

537
00:21:21,280 --> 00:21:23,080
and fix vulnerabilities

538
00:21:23,080 --> 00:21:24,400
in computers?

539
00:21:27,380 --> 00:21:29,720
Well, as I mentioned before,

540
00:21:29,960 --> 00:21:30,100
you know,

541
00:21:30,160 --> 00:21:32,020
the Latin America

542
00:21:32,020 --> 00:21:33,520
is a very special region

543
00:21:33,520 --> 00:21:36,580
in terms of maturity level.

544
00:21:36,700 --> 00:21:38,460
We are at the intermediate level.

545
00:21:39,100 --> 00:21:40,180
Of course,

546
00:21:40,200 --> 00:21:40,900
each country

547
00:21:40,900 --> 00:21:41,660
is totally different.

548
00:21:42,740 --> 00:21:44,840
But we could think

549
00:21:44,840 --> 00:21:46,340
about three approaches.

550
00:21:47,140 --> 00:21:48,340
The first one

551
00:21:48,340 --> 00:21:48,980
would be,

552
00:21:48,980 --> 00:21:49,420
you know,

553
00:21:49,480 --> 00:21:51,220
creating legal frameworks.

554
00:21:51,980 --> 00:21:53,120
That's very hard

555
00:21:53,120 --> 00:21:54,380
because it's not

556
00:21:54,380 --> 00:21:54,520
always the same.

557
00:21:54,540 --> 00:21:54,660
It's not only,

558
00:21:54,760 --> 00:21:55,040
you know,

559
00:21:55,060 --> 00:21:56,640
the executive branch

560
00:21:56,640 --> 00:21:57,720
dealing with that.

561
00:21:57,860 --> 00:21:59,480
It's talking

562
00:21:59,480 --> 00:22:01,200
with the legislative branch

563
00:22:01,200 --> 00:22:02,700
because we need

564
00:22:02,700 --> 00:22:03,560
to modify

565
00:22:03,560 --> 00:22:05,080
or try to create

566
00:22:05,080 --> 00:22:05,700
a law

567
00:22:06,480 --> 00:22:06,820
to,

568
00:22:07,340 --> 00:22:08,200
you know,

569
00:22:08,220 --> 00:22:08,700
to try

570
00:22:09,460 --> 00:22:12,080
to deal

571
00:22:12,080 --> 00:22:13,600
with this situation.

572
00:22:14,260 --> 00:22:14,740
So,

573
00:22:14,820 --> 00:22:16,160
I could

574
00:22:16,160 --> 00:22:16,860
brought here

575
00:22:16,860 --> 00:22:17,740
one example.

576
00:22:18,240 --> 00:22:18,920
It's

577
00:22:18,920 --> 00:22:20,540
the experience

578
00:22:20,540 --> 00:22:21,180
in Chile

579
00:22:21,180 --> 00:22:21,900
right now.

580
00:22:22,500 --> 00:22:23,180
Chile

581
00:22:23,180 --> 00:22:24,160
is working

582
00:22:24,160 --> 00:22:24,520
on

583
00:22:24,520 --> 00:22:25,380
it's,

584
00:22:25,380 --> 00:22:26,080
you know,

585
00:22:26,100 --> 00:22:26,780
there's a law

586
00:22:26,780 --> 00:22:27,720
on cybersecurity

587
00:22:27,720 --> 00:22:28,680
and critical

588
00:22:29,520 --> 00:22:29,980
information

589
00:22:30,520 --> 00:22:31,120
infrastructure

590
00:22:31,120 --> 00:22:32,120
that is about

591
00:22:32,120 --> 00:22:33,160
to be approved

592
00:22:33,160 --> 00:22:34,360
by

593
00:22:34,360 --> 00:22:35,880
the National

594
00:22:35,880 --> 00:22:36,480
Assembly

595
00:22:36,480 --> 00:22:37,380
or Congress.

596
00:22:37,720 --> 00:22:38,440
And

597
00:22:38,440 --> 00:22:40,000
there is

598
00:22:40,000 --> 00:22:40,640
one article

599
00:22:40,640 --> 00:22:41,000
there

600
00:22:41,140 --> 00:22:41,600
that

601
00:22:43,120 --> 00:22:43,580
exempts

602
00:22:44,040 --> 00:22:44,520
from

603
00:22:45,240 --> 00:22:45,720
criminal

604
00:22:45,720 --> 00:22:46,800
sanctions

605
00:22:46,800 --> 00:22:47,980
ethical

606
00:22:47,980 --> 00:22:48,720
hackers

607
00:22:48,720 --> 00:22:49,820
who have,

608
00:22:49,960 --> 00:22:50,680
for example,

609
00:22:50,680 --> 00:22:51,100
committed

610
00:22:51,100 --> 00:22:51,860
acts classified

611
00:22:51,860 --> 00:22:52,600
as computer

612
00:22:52,600 --> 00:22:53,140
crimes.

613
00:22:54,520 --> 00:22:54,600
But,

614
00:22:54,600 --> 00:22:55,160
carry on,

615
00:22:55,300 --> 00:22:56,400
for example,

616
00:22:56,420 --> 00:22:56,840
investigation

617
00:22:56,840 --> 00:22:57,540
work in

618
00:22:57,540 --> 00:22:57,840
computer

619
00:22:57,840 --> 00:22:58,340
security.

620
00:22:58,780 --> 00:22:59,380
So,

621
00:22:59,480 --> 00:23:00,100
they

622
00:23:00,100 --> 00:23:01,240
exempt

623
00:23:01,240 --> 00:23:02,900
this type

624
00:23:02,900 --> 00:23:03,400
of actions

625
00:23:03,400 --> 00:23:04,060
as long

626
00:23:04,060 --> 00:23:04,460
as they

627
00:23:04,460 --> 00:23:04,780
comply

628
00:23:04,780 --> 00:23:05,960
with certain

629
00:23:05,960 --> 00:23:06,580
conditions.

630
00:23:06,920 --> 00:23:07,920
For example,

631
00:23:08,260 --> 00:23:09,280
immediate

632
00:23:09,280 --> 00:23:10,000
notifications

633
00:23:11,020 --> 00:23:11,700
among

634
00:23:11,700 --> 00:23:12,040
others.

635
00:23:12,240 --> 00:23:12,300
So,

636
00:23:12,400 --> 00:23:13,100
that's

637
00:23:13,100 --> 00:23:14,060
one thing

638
00:23:14,060 --> 00:23:14,820
that in

639
00:23:14,820 --> 00:23:15,680
Latin America

640
00:23:15,680 --> 00:23:16,120
is going

641
00:23:16,120 --> 00:23:16,420
on.

642
00:23:16,920 --> 00:23:17,460
But,

643
00:23:24,520 --> 00:23:24,700
there's

644
00:23:24,700 --> 00:23:25,360
ethical

645
00:23:25,360 --> 00:23:26,080
hacking

646
00:23:26,080 --> 00:23:27,140
through

647
00:23:27,140 --> 00:23:28,280
the

648
00:23:28,280 --> 00:23:28,760
National

649
00:23:28,760 --> 00:23:29,640
Cybersecurity

650
00:23:29,640 --> 00:23:30,460
Strategies

651
00:23:30,460 --> 00:23:30,980
or the

652
00:23:30,980 --> 00:23:31,300
National

653
00:23:31,300 --> 00:23:31,880
Cybersecurity

654
00:23:31,880 --> 00:23:32,660
Policies.

655
00:23:47,480 --> 00:23:48,800
For

656
00:23:48,800 --> 00:23:49,080
example,

657
00:23:49,080 --> 00:23:49,920
as a

658
00:23:49,920 --> 00:23:50,280
guiding

659
00:23:50,280 --> 00:23:50,820
principle

660
00:23:50,820 --> 00:23:51,480
of this

661
00:23:51,480 --> 00:23:51,840
strategy

662
00:23:52,760 --> 00:23:53,500
in order

663
00:23:53,500 --> 00:23:53,940
to create

664
00:23:53,940 --> 00:23:54,240
a more

665
00:23:54,240 --> 00:23:54,540
secure

666
00:23:54,540 --> 00:23:54,840
digital

667
00:23:54,840 --> 00:23:55,560
environment

668
00:23:55,560 --> 00:23:56,160
to promote

669
00:23:56,160 --> 00:23:57,380
the use

670
00:23:57,380 --> 00:23:57,880
of ethical

671
00:23:57,880 --> 00:23:58,300
hacking

672
00:23:58,960 --> 00:23:59,560
techniques.

673
00:24:00,080 --> 00:24:00,680
So,

674
00:24:00,820 --> 00:24:02,000
of course,

675
00:24:02,040 --> 00:24:02,460
we have

676
00:24:02,460 --> 00:24:02,960
other

677
00:24:02,960 --> 00:24:03,440
countries,

678
00:24:03,540 --> 00:24:03,680
but,

679
00:24:03,760 --> 00:24:05,080
for example,

680
00:24:05,160 --> 00:24:06,140
the Colombian

681
00:24:06,140 --> 00:24:07,180
and the

682
00:24:07,180 --> 00:24:07,960
Ecuadorian

683
00:24:07,960 --> 00:24:08,280
NCS,

684
00:24:08,580 --> 00:24:09,080
they just

685
00:24:09,080 --> 00:24:09,580
mentioned

686
00:24:09,580 --> 00:24:11,080
the establishment

687
00:24:11,080 --> 00:24:12,140
of procedures

688
00:24:12,140 --> 00:24:13,400
for the promotion

689
00:24:13,400 --> 00:24:14,340
and dissemination

690
00:24:14,340 --> 00:24:14,940
of a model

691
00:24:14,940 --> 00:24:16,300
of vulnerability

692
00:24:16,960 --> 00:24:17,240
disclosure,

693
00:24:17,580 --> 00:24:17,740
but,

694
00:24:17,900 --> 00:24:18,920
they have to

695
00:24:18,920 --> 00:24:19,440
comply with

696
00:24:19,440 --> 00:24:19,800
the law

697
00:24:19,800 --> 00:24:20,320
and what

698
00:24:23,720 --> 00:24:24,280
Andres

699
00:24:24,280 --> 00:24:24,920
just told

700
00:24:24,920 --> 00:24:25,400
us before

701
00:24:26,140 --> 00:24:27,080
in Colombia

702
00:24:27,080 --> 00:24:27,440
and in

703
00:24:27,440 --> 00:24:27,760
Ecuador,

704
00:24:27,760 --> 00:24:28,200
is to

705
00:24:28,200 --> 00:24:29,140
penalize

706
00:24:29,140 --> 00:24:29,560
this type

707
00:24:29,560 --> 00:24:30,020
of actions.

708
00:24:30,400 --> 00:24:30,820
So,

709
00:24:30,900 --> 00:24:31,440
they are

710
00:24:31,440 --> 00:24:32,200
trying to

711
00:24:32,200 --> 00:24:33,340
work

712
00:24:33,340 --> 00:24:34,000
from the

713
00:24:34,000 --> 00:24:35,200
executive

714
00:24:35,200 --> 00:24:35,780
branch

715
00:24:35,780 --> 00:24:36,880
to work

716
00:24:36,880 --> 00:24:37,240
on that.

717
00:24:37,380 --> 00:24:37,980
And finally,

718
00:24:38,040 --> 00:24:38,700
some countries

719
00:24:38,700 --> 00:24:40,120
that don't

720
00:24:40,120 --> 00:24:40,380
have

721
00:24:40,380 --> 00:24:41,780
policies

722
00:24:41,780 --> 00:24:42,720
or cybersecurity

723
00:24:42,720 --> 00:24:43,380
policies,

724
00:24:43,600 --> 00:24:44,260
but they are

725
00:24:44,260 --> 00:24:45,000
working on

726
00:24:45,000 --> 00:24:45,340
national

727
00:24:45,340 --> 00:24:45,780
guides,

728
00:24:46,080 --> 00:24:47,400
but just

729
00:24:47,400 --> 00:24:47,680
for

730
00:24:48,800 --> 00:24:49,700
information

731
00:24:49,700 --> 00:24:50,440
sharing

732
00:24:50,440 --> 00:24:51,420
and just

733
00:24:51,420 --> 00:24:52,280
responsible

734
00:24:52,280 --> 00:24:53,040
disclosure,

735
00:24:53,300 --> 00:24:54,640
but not

736
00:24:54,640 --> 00:24:56,360
very well

737
00:24:56,360 --> 00:24:57,060
framed.

738
00:24:57,340 --> 00:24:58,180
So,

739
00:24:58,280 --> 00:24:59,320
that's

740
00:24:59,320 --> 00:25:00,160
what is

741
00:25:03,220 --> 00:25:03,900
happening

742
00:25:04,100 --> 00:25:04,420
Very

743
00:25:04,420 --> 00:25:04,880
interesting.

744
00:25:05,400 --> 00:25:06,080
Mauro,

745
00:25:06,260 --> 00:25:06,860
a couple

746
00:25:06,860 --> 00:25:07,220
of years

747
00:25:07,220 --> 00:25:07,620
ago,

748
00:25:07,700 --> 00:25:08,580
you were

749
00:25:08,580 --> 00:25:08,880
tasked

750
00:25:08,880 --> 00:25:09,440
to create

751
00:25:09,440 --> 00:25:09,940
a vulnerability

752
00:25:09,940 --> 00:25:10,720
management

753
00:25:10,720 --> 00:25:11,360
unit

754
00:25:11,360 --> 00:25:11,960
within the

755
00:25:11,960 --> 00:25:12,260
National

756
00:25:12,260 --> 00:25:12,980
Cybersecurity

757
00:25:12,980 --> 00:25:13,440
Center

758
00:25:13,440 --> 00:25:14,280
in Switzerland,

759
00:25:14,960 --> 00:25:15,640
leading

760
00:25:15,640 --> 00:25:16,100
several

761
00:25:16,100 --> 00:25:16,760
projects,

762
00:25:17,040 --> 00:25:17,280
among

763
00:25:17,280 --> 00:25:17,620
them,

764
00:25:17,700 --> 00:25:18,220
the first

765
00:25:18,220 --> 00:25:18,940
bug bounty

766
00:25:18,940 --> 00:25:19,520
program

767
00:25:19,520 --> 00:25:19,900
of the

768
00:25:19,900 --> 00:25:20,060
Swiss

769
00:25:20,060 --> 00:25:20,700
government.

770
00:25:21,540 --> 00:25:22,080
What are

771
00:25:22,080 --> 00:25:22,860
some successful

772
00:25:22,860 --> 00:25:23,260
European

773
00:25:23,260 --> 00:25:23,860
examples

774
00:25:23,860 --> 00:25:24,520
of

775
00:25:24,520 --> 00:25:25,020
collaboration

776
00:25:25,020 --> 00:25:25,780
between

777
00:25:25,780 --> 00:25:26,380
hackers

778
00:25:26,380 --> 00:25:27,340
and governments

779
00:25:27,340 --> 00:25:28,900
or organizations

780
00:25:28,900 --> 00:25:30,000
in shaping

781
00:25:30,000 --> 00:25:31,100
cyber policies?

782
00:25:31,460 --> 00:25:32,320
And what

783
00:25:32,320 --> 00:25:32,780
was the

784
00:25:32,780 --> 00:25:33,120
key to

785
00:25:33,120 --> 00:25:33,520
success?

786
00:25:34,320 --> 00:25:35,080
Yeah,

787
00:25:35,160 --> 00:25:35,460
thank you

788
00:25:35,460 --> 00:25:35,660
for the

789
00:25:35,660 --> 00:25:35,920
question.

790
00:25:36,040 --> 00:25:36,140
So,

791
00:25:37,360 --> 00:25:38,120
prior

792
00:25:38,120 --> 00:25:38,920
to my

793
00:25:38,920 --> 00:25:39,340
engagement

794
00:25:39,340 --> 00:25:39,700
with the

795
00:25:39,700 --> 00:25:40,500
ICRC,

796
00:25:40,640 --> 00:25:40,900
I was

797
00:25:40,900 --> 00:25:41,460
working for

798
00:25:41,460 --> 00:25:41,800
the National

799
00:25:41,800 --> 00:25:42,340
Cybersecurity

800
00:25:42,340 --> 00:25:43,080
Center in

801
00:25:43,080 --> 00:25:43,300
Switzerland,

802
00:25:43,600 --> 00:25:45,000
and we

803
00:25:45,000 --> 00:25:45,500
decided it

804
00:25:45,500 --> 00:25:45,900
was time

805
00:25:45,900 --> 00:25:46,740
to have

806
00:25:46,740 --> 00:25:48,260
a bug bounty

807
00:25:48,260 --> 00:25:49,140
program inside

808
00:25:49,140 --> 00:25:49,740
the vulnerability

809
00:25:49,740 --> 00:25:50,240
management

810
00:25:50,240 --> 00:25:50,820
for the

811
00:25:50,820 --> 00:25:51,340
Swiss

812
00:25:51,340 --> 00:25:51,720
government

813
00:25:51,720 --> 00:25:52,160
network.

814
00:25:53,020 --> 00:25:53,620
So,

815
00:25:53,820 --> 00:25:54,140
we built

816
00:25:54,140 --> 00:25:54,620
up these,

817
00:25:55,840 --> 00:25:56,740
but it

818
00:25:56,740 --> 00:25:57,420
was not

819
00:25:57,420 --> 00:25:58,740
just using

820
00:25:58,740 --> 00:25:59,760
hackers to

821
00:25:59,760 --> 00:26:00,440
find bugs,

822
00:26:00,620 --> 00:26:01,520
but we

823
00:26:01,520 --> 00:26:01,880
developed

824
00:26:01,880 --> 00:26:02,340
a program

825
00:26:02,340 --> 00:26:02,900
with them.

826
00:26:02,900 --> 00:26:03,220
So,

827
00:26:03,320 --> 00:26:04,340
we gave

828
00:26:04,340 --> 00:26:05,420
them our

829
00:26:05,420 --> 00:26:06,600
necessity and

830
00:26:06,600 --> 00:26:07,140
they come

831
00:26:07,140 --> 00:26:07,780
up with an

832
00:26:07,780 --> 00:26:08,260
idea on

833
00:26:08,260 --> 00:26:08,640
how to

834
00:26:08,640 --> 00:26:09,180
build a

835
00:26:09,180 --> 00:26:10,040
bug bounty

836
00:26:10,040 --> 00:26:10,860
program for

837
00:26:11,360 --> 00:26:12,180
the national

838
00:26:12,740 --> 00:26:13,180
government.

839
00:26:13,340 --> 00:26:13,440
So,

840
00:26:13,500 --> 00:26:13,980
as you have

841
00:26:13,980 --> 00:26:14,520
to understand,

842
00:26:15,220 --> 00:26:16,100
Switzerland is

843
00:26:16,100 --> 00:26:16,240
a

844
00:26:17,000 --> 00:26:17,440
confederation,

845
00:26:17,760 --> 00:26:18,080
so it's

846
00:26:18,080 --> 00:26:18,740
like we

847
00:26:18,740 --> 00:26:19,460
have 27

848
00:26:20,100 --> 00:26:20,540
cantons.

849
00:26:20,580 --> 00:26:20,780
It's

850
00:26:20,780 --> 00:26:22,100
like the

851
00:26:22,100 --> 00:26:22,520
U.S.

852
00:26:22,520 --> 00:26:22,920
with the

853
00:26:22,920 --> 00:26:23,220
states,

854
00:26:23,300 --> 00:26:23,660
so we

855
00:26:23,660 --> 00:26:23,920
have the

856
00:26:23,920 --> 00:26:24,540
same situation,

857
00:26:24,660 --> 00:26:24,960
the federal

858
00:26:24,960 --> 00:26:25,760
government and

859
00:26:25,760 --> 00:26:26,300
then the

860
00:26:27,240 --> 00:26:27,720
cantonal

861
00:26:27,720 --> 00:26:28,460
government.

862
00:26:28,820 --> 00:26:28,880
So,

863
00:26:28,940 --> 00:26:29,940
this was a

864
00:26:29,940 --> 00:26:30,140
little bit

865
00:26:30,140 --> 00:26:30,540
challenging.

866
00:26:30,700 --> 00:26:30,840
So,

867
00:26:30,860 --> 00:26:31,220
how to

868
00:26:31,220 --> 00:26:31,560
build a

869
00:26:31,560 --> 00:26:32,500
program that

870
00:26:32,500 --> 00:26:32,980
has to

871
00:26:32,980 --> 00:26:33,480
incorporate

872
00:26:33,480 --> 00:26:34,300
all the

873
00:26:34,300 --> 00:26:35,380
party of

874
00:26:35,380 --> 00:26:36,120
the country.

875
00:26:36,380 --> 00:26:36,440
So,

876
00:26:36,480 --> 00:26:37,180
we come up

877
00:26:37,180 --> 00:26:37,420
with the

878
00:26:37,420 --> 00:26:37,920
idea of

879
00:26:37,920 --> 00:26:38,680
having a

880
00:26:38,680 --> 00:26:39,440
central

881
00:26:40,320 --> 00:26:40,800
platform

882
00:26:42,620 --> 00:26:43,380
paid by

883
00:26:43,380 --> 00:26:43,540
the

884
00:26:43,540 --> 00:26:44,320
government

885
00:26:44,320 --> 00:26:44,840
and then

886
00:26:44,840 --> 00:26:45,780
having the

887
00:26:45,780 --> 00:26:46,060
different

888
00:26:46,060 --> 00:26:46,760
cantons

889
00:26:46,760 --> 00:26:47,720
paying the

890
00:26:49,200 --> 00:26:49,840
bounties

891
00:26:49,840 --> 00:26:50,300
to have

892
00:26:50,300 --> 00:26:51,100
them

893
00:26:51,100 --> 00:26:51,660
testing

894
00:26:51,660 --> 00:26:52,620
several

895
00:26:53,360 --> 00:26:54,000
cantons

896
00:26:54,780 --> 00:26:55,420
assets.

897
00:26:56,360 --> 00:26:56,680
So,

898
00:26:56,760 --> 00:26:57,140
the same

899
00:26:57,140 --> 00:26:58,660
idea we

900
00:26:58,660 --> 00:26:59,000
would like

901
00:26:59,000 --> 00:26:59,520
also to

902
00:26:59,520 --> 00:26:59,800
implement

903
00:26:59,800 --> 00:27:00,700
for the

904
00:27:00,700 --> 00:27:01,580
ICRC.

905
00:27:01,840 --> 00:27:02,240
So,

906
00:27:02,300 --> 00:27:02,540
this is

907
00:27:02,540 --> 00:27:03,380
something that

908
00:27:03,380 --> 00:27:03,880
we can

909
00:27:03,880 --> 00:27:04,300
replicate

910
00:27:04,300 --> 00:27:04,800
also in

911
00:27:04,800 --> 00:27:04,940
other

912
00:27:04,940 --> 00:27:05,260
countries.

913
00:27:05,260 --> 00:27:05,520
So,

914
00:27:06,940 --> 00:27:07,480
having a

915
00:27:08,380 --> 00:27:08,900
central

916
00:27:09,680 --> 00:27:10,200
platform

917
00:27:10,200 --> 00:27:11,540
for the

918
00:27:11,540 --> 00:27:12,180
ICRC for

919
00:27:12,180 --> 00:27:12,400
instance,

920
00:27:12,640 --> 00:27:13,060
but the

921
00:27:13,060 --> 00:27:13,560
ICRC is

922
00:27:13,560 --> 00:27:13,960
not just

923
00:27:13,960 --> 00:27:14,360
alone,

924
00:27:14,660 --> 00:27:15,240
we have an

925
00:27:15,240 --> 00:27:15,460
entire

926
00:27:15,460 --> 00:27:15,920
movement

927
00:27:15,920 --> 00:27:16,580
composed

928
00:27:16,580 --> 00:27:17,040
also by

929
00:27:17,040 --> 00:27:17,160
the

930
00:27:17,160 --> 00:27:17,400
national

931
00:27:17,400 --> 00:27:17,760
societies.

932
00:27:18,000 --> 00:27:18,160
So,

933
00:27:18,200 --> 00:27:18,560
the American

934
00:27:18,560 --> 00:27:19,180
Red Cross is

935
00:27:19,180 --> 00:27:19,520
one of

936
00:27:19,520 --> 00:27:19,780
them.

937
00:27:19,840 --> 00:27:20,360
We have

938
00:27:20,360 --> 00:27:20,920
in every

939
00:27:20,920 --> 00:27:21,400
country

940
00:27:21,400 --> 00:27:21,720
a

941
00:27:22,280 --> 00:27:22,800
society.

942
00:27:22,800 --> 00:27:23,300
So,

943
00:27:23,600 --> 00:27:24,540
one idea

944
00:27:24,540 --> 00:27:25,160
could be

945
00:27:25,160 --> 00:27:25,600
to have

946
00:27:25,600 --> 00:27:26,040
a central

947
00:27:26,900 --> 00:27:27,460
platform

948
00:27:27,460 --> 00:27:28,120
for the

949
00:27:28,120 --> 00:27:28,400
ICRC,

950
00:27:28,560 --> 00:27:28,980
but having

951
00:27:28,980 --> 00:27:29,280
also

952
00:27:29,280 --> 00:27:30,160
bounties

953
00:27:30,160 --> 00:27:30,360
programs

954
00:27:30,360 --> 00:27:30,980
for the

955
00:27:30,980 --> 00:27:31,700
national

956
00:27:31,700 --> 00:27:32,320
societies

957
00:27:32,320 --> 00:27:32,940
of

958
00:27:32,940 --> 00:27:33,800
Red Cross

959
00:27:33,800 --> 00:27:34,420
that can

960
00:27:34,420 --> 00:27:35,260
join

961
00:27:35,260 --> 00:27:35,760
this effort.

962
00:27:35,980 --> 00:27:36,260
So,

963
00:27:36,340 --> 00:27:36,700
having the

964
00:27:36,700 --> 00:27:36,980
hackers

965
00:27:36,980 --> 00:27:37,260
community

966
00:27:37,260 --> 00:27:37,780
working

967
00:27:37,780 --> 00:27:38,860
also for

968
00:27:38,860 --> 00:27:39,040
the

969
00:27:39,040 --> 00:27:39,260
national

970
00:27:39,260 --> 00:27:39,800
societies,

971
00:27:39,860 --> 00:27:40,420
not just

972
00:27:52,800 --> 00:27:53,000
for

973
00:27:53,000 --> 00:27:53,540
the

974
00:27:54,400 --> 00:27:54,720
but also

975
00:27:54,720 --> 00:27:55,500
So,

976
00:27:55,520 --> 00:27:55,660
I

977
00:27:55,660 --> 00:27:55,720
like

978
00:27:55,720 --> 00:27:56,240
about

979
00:27:56,240 --> 00:27:56,700
the

980
00:27:56,700 --> 00:27:56,840
role

981
00:27:56,840 --> 00:27:57,160
of

982
00:27:57,160 --> 00:27:57,440
cyber

983
00:27:57,440 --> 00:27:57,840
security

984
00:27:57,840 --> 00:27:58,340
policy

985
00:27:58,340 --> 00:27:59,020
hackers

986
00:27:59,020 --> 00:27:59,420
in

987
00:27:59,420 --> 00:27:59,540
the

988
00:27:59,540 --> 00:28:00,180
digital

989
00:28:01,640 --> 00:28:02,480
investigations

990
00:28:02,480 --> 00:28:03,540
and

991
00:28:03,540 --> 00:28:03,880
the

992
00:28:03,880 --> 00:28:04,300
associated

993
00:28:04,300 --> 00:28:04,980
challenges

994
00:28:04,980 --> 00:28:05,520
in

995
00:28:24,740 --> 00:28:25,700
most of

996
00:28:25,700 --> 00:28:26,200
our countries.

997
00:28:26,400 --> 00:28:27,020
And I'm

998
00:28:27,020 --> 00:28:27,340
not talking

999
00:28:27,340 --> 00:28:27,840
about the

1000
00:28:27,840 --> 00:28:28,280
technical

1001
00:28:28,280 --> 00:28:28,640
people.

1002
00:28:28,740 --> 00:28:28,880
We're

1003
00:28:28,880 --> 00:28:29,320
talking about

1004
00:28:29,320 --> 00:28:30,880
the people

1005
00:28:30,880 --> 00:28:31,120
that are

1006
00:28:31,120 --> 00:28:31,400
in the

1007
00:28:31,400 --> 00:28:32,140
streets and

1008
00:28:32,140 --> 00:28:32,500
even the

1009
00:28:32,500 --> 00:28:32,780
government.

1010
00:28:33,980 --> 00:28:34,620
The other

1011
00:28:34,620 --> 00:28:35,000
thing that

1012
00:28:35,000 --> 00:28:36,280
is starting

1013
00:28:36,280 --> 00:28:36,860
to happen

1014
00:28:36,860 --> 00:28:37,500
is that

1015
00:28:38,040 --> 00:28:38,520
government

1016
00:28:38,520 --> 00:28:39,700
knows that

1017
00:28:39,700 --> 00:28:40,120
there's a

1018
00:28:40,120 --> 00:28:40,320
threat,

1019
00:28:41,420 --> 00:28:42,040
but they

1020
00:28:42,040 --> 00:28:42,320
don't know

1021
00:28:42,320 --> 00:28:42,720
how to

1022
00:28:42,720 --> 00:28:43,100
stop it.

1023
00:28:43,620 --> 00:28:44,100
So,

1024
00:28:44,100 --> 00:28:44,840
they're trying to

1025
00:28:44,840 --> 00:28:45,320
create these

1026
00:28:46,060 --> 00:28:46,340
national

1027
00:28:46,900 --> 00:28:48,060
strategies that

1028
00:28:48,060 --> 00:28:48,500
most of

1029
00:28:48,500 --> 00:28:48,880
them are

1030
00:28:48,880 --> 00:28:49,780
on a

1031
00:28:49,780 --> 00:28:50,200
preventive

1032
00:28:50,200 --> 00:28:50,400
side,

1033
00:28:50,600 --> 00:28:51,220
but they're

1034
00:28:51,220 --> 00:28:52,520
not including

1035
00:28:52,520 --> 00:28:53,820
how you

1036
00:28:53,820 --> 00:28:54,400
prosecute,

1037
00:28:54,500 --> 00:28:54,760
how you

1038
00:28:54,760 --> 00:28:55,160
investigate,

1039
00:28:55,420 --> 00:28:55,800
how you

1040
00:28:55,800 --> 00:28:56,720
and there's

1041
00:28:56,720 --> 00:28:57,000
a little

1042
00:28:57,000 --> 00:28:57,460
thing here

1043
00:28:57,460 --> 00:28:58,120
that is

1044
00:28:58,860 --> 00:28:59,420
probably

1045
00:28:59,420 --> 00:29:00,040
what I'm

1046
00:29:00,040 --> 00:29:00,720
more concerned

1047
00:29:00,720 --> 00:29:00,900
of.

1048
00:29:01,140 --> 00:29:01,880
That is

1049
00:29:01,880 --> 00:29:03,480
how we

1050
00:29:03,480 --> 00:29:04,540
interact,

1051
00:29:04,920 --> 00:29:05,620
how we

1052
00:29:06,960 --> 00:29:07,520
do

1053
00:29:07,520 --> 00:29:08,840
cross-border

1054
00:29:08,840 --> 00:29:09,640
access in

1055
00:29:09,640 --> 00:29:10,020
order to

1056
00:29:10,020 --> 00:29:10,560
get evidence

1057
00:29:10,560 --> 00:29:11,100
from other

1058
00:29:11,100 --> 00:29:11,540
countries.

1059
00:29:11,780 --> 00:29:12,580
And then

1060
00:29:12,580 --> 00:29:12,900
where it

1061
00:29:12,900 --> 00:29:13,980
comes something

1062
00:29:14,640 --> 00:29:15,420
that is kind

1063
00:29:15,420 --> 00:29:15,840
of different

1064
00:29:15,840 --> 00:29:16,300
from what

1065
00:29:16,300 --> 00:29:16,680
we use

1066
00:29:16,680 --> 00:29:17,060
here in

1067
00:29:17,060 --> 00:29:17,420
the states.

1068
00:29:17,620 --> 00:29:18,360
The states

1069
00:29:18,360 --> 00:29:18,740
is based

1070
00:29:18,740 --> 00:29:19,020
on an

1071
00:29:20,120 --> 00:29:20,640
English

1072
00:29:20,640 --> 00:29:21,480
system,

1073
00:29:21,560 --> 00:29:21,820
so it's

1074
00:29:21,820 --> 00:29:22,420
precedence,

1075
00:29:22,560 --> 00:29:23,480
so things

1076
00:29:23,480 --> 00:29:24,540
move faster

1077
00:29:24,540 --> 00:29:25,020
than what

1078
00:29:25,020 --> 00:29:25,820
happens in

1079
00:29:25,820 --> 00:29:25,960
our

1080
00:29:25,960 --> 00:29:26,360
countries.

1081
00:29:26,580 --> 00:29:27,040
We're

1082
00:29:27,040 --> 00:29:27,920
based on

1083
00:29:37,520 --> 00:29:37,720
a

1084
00:29:37,720 --> 00:29:37,760
that we

1085
00:29:37,760 --> 00:29:38,260
should.

1086
00:29:39,100 --> 00:29:39,980
In the

1087
00:29:39,980 --> 00:29:40,560
other hand,

1088
00:29:40,640 --> 00:29:41,240
the

1089
00:29:42,520 --> 00:29:43,280
malicious

1090
00:29:43,280 --> 00:29:43,880
actors

1091
00:29:43,880 --> 00:29:45,220
are finding

1092
00:29:45,220 --> 00:29:46,300
out that

1093
00:29:46,300 --> 00:29:47,020
that's an

1094
00:29:47,020 --> 00:29:47,320
advantage.

1095
00:29:47,920 --> 00:29:48,680
Why?

1096
00:29:48,920 --> 00:29:49,780
Because right

1097
00:29:49,780 --> 00:29:50,440
now organized

1098
00:29:50,440 --> 00:29:51,560
crime is

1099
00:29:51,560 --> 00:29:52,000
using

1100
00:29:52,000 --> 00:29:53,140
people from

1101
00:29:53,140 --> 00:29:54,340
Mexico and

1102
00:29:54,340 --> 00:29:55,220
other countries

1103
00:29:55,220 --> 00:29:55,840
in order to

1104
00:29:55,840 --> 00:29:56,600
hack from

1105
00:29:56,600 --> 00:29:57,480
Mexico or

1106
00:29:57,480 --> 00:29:58,220
to Mexico

1107
00:29:58,220 --> 00:29:59,000
knowing that

1108
00:29:59,000 --> 00:29:59,460
nothing is

1109
00:29:59,460 --> 00:29:59,620
going to

1110
00:29:59,620 --> 00:29:59,940
happen.

1111
00:30:00,240 --> 00:30:02,280
So we

1112
00:30:07,520 --> 00:30:08,020
have to be

1113
00:30:08,020 --> 00:30:09,520
the front

1114
00:30:09,520 --> 00:30:09,760
line

1115
00:30:09,760 --> 00:30:10,260
defenders.

1116
00:30:10,740 --> 00:30:11,440
You know,

1117
00:30:11,480 --> 00:30:11,980
right now is

1118
00:30:11,980 --> 00:30:12,380
our only

1119
00:30:12,380 --> 00:30:13,600
option on

1120
00:30:13,600 --> 00:30:14,140
how we

1121
00:30:14,140 --> 00:30:14,620
can work

1122
00:30:14,620 --> 00:30:15,640
together in

1123
00:30:15,640 --> 00:30:16,160
order to

1124
00:30:17,200 --> 00:30:17,840
identify

1125
00:30:17,840 --> 00:30:18,680
those

1126
00:30:18,680 --> 00:30:19,300
vulnerabilities

1127
00:30:19,300 --> 00:30:20,740
and weaknesses

1128
00:30:20,740 --> 00:30:21,640
before the

1129
00:30:21,640 --> 00:30:21,860
malicious

1130
00:30:21,860 --> 00:30:22,740
attackers

1131
00:30:22,740 --> 00:30:23,700
are finding

1132
00:30:23,700 --> 00:30:24,020
them.

1133
00:30:24,500 --> 00:30:25,260
The issue

1134
00:30:25,260 --> 00:30:25,840
here is

1135
00:30:26,720 --> 00:30:27,580
if we

1136
00:30:27,580 --> 00:30:27,940
build

1137
00:30:27,940 --> 00:30:28,980
something in

1138
00:30:28,980 --> 00:30:29,280
each one

1139
00:30:29,280 --> 00:30:29,500
of the

1140
00:30:29,500 --> 00:30:29,920
countries,

1141
00:30:29,920 --> 00:30:30,880
if we

1142
00:30:30,880 --> 00:30:31,600
make a

1143
00:30:31,600 --> 00:30:32,180
collaboration

1144
00:30:32,180 --> 00:30:32,700
in between

1145
00:30:32,700 --> 00:30:33,920
these hackers

1146
00:30:33,920 --> 00:30:34,880
and we

1147
00:30:34,880 --> 00:30:35,480
try to

1148
00:30:35,480 --> 00:30:37,020
get to

1149
00:30:37,020 --> 00:30:37,180
the

1150
00:30:37,180 --> 00:30:37,500
government,

1151
00:30:37,800 --> 00:30:38,680
we need

1152
00:30:38,680 --> 00:30:39,160
them to

1153
00:30:39,160 --> 00:30:39,840
trust us

1154
00:30:39,840 --> 00:30:40,500
as we

1155
00:30:40,500 --> 00:30:40,660
were

1156
00:30:40,660 --> 00:30:41,000
mentioning.

1157
00:30:41,260 --> 00:30:42,060
And then we

1158
00:30:42,060 --> 00:30:42,380
need to

1159
00:30:42,380 --> 00:30:43,240
build the

1160
00:30:43,240 --> 00:30:43,880
way we

1161
00:30:43,880 --> 00:30:44,520
can work

1162
00:30:44,520 --> 00:30:45,600
together and

1163
00:30:45,600 --> 00:30:46,120
will be

1164
00:30:46,980 --> 00:30:47,660
legally

1165
00:30:47,660 --> 00:30:48,020
correct.

1166
00:30:48,220 --> 00:30:48,900
Again,

1167
00:30:49,080 --> 00:30:50,260
the reason

1168
00:30:50,260 --> 00:30:50,660
that

1169
00:30:50,660 --> 00:30:51,640
some

1170
00:30:53,000 --> 00:30:54,120
countries are

1171
00:30:54,120 --> 00:30:54,840
going against

1172
00:30:54,840 --> 00:30:55,300
policy

1173
00:30:55,300 --> 00:30:56,400
hackers is

1174
00:30:56,400 --> 00:30:57,100
because that's

1175
00:30:57,100 --> 00:30:57,660
the way the

1176
00:30:57,660 --> 00:30:58,480
law is

1177
00:30:58,480 --> 00:30:58,780
coded.

1178
00:30:59,140 --> 00:31:00,580
So we

1179
00:31:00,580 --> 00:31:01,000
have to

1180
00:31:01,000 --> 00:31:01,500
change

1181
00:31:01,500 --> 00:31:02,080
that.

1182
00:31:02,780 --> 00:31:04,140
Then we

1183
00:31:04,140 --> 00:31:05,060
need to

1184
00:31:05,060 --> 00:31:05,600
understand that

1185
00:31:05,600 --> 00:31:05,780
there are

1186
00:31:05,780 --> 00:31:05,900
some

1187
00:31:05,900 --> 00:31:06,340
challenges

1188
00:31:06,340 --> 00:31:07,040
outside,

1189
00:31:08,040 --> 00:31:08,860
you know,

1190
00:31:08,880 --> 00:31:09,240
the technical

1191
00:31:09,240 --> 00:31:09,560
side.

1192
00:31:09,900 --> 00:31:10,840
Limited resources

1193
00:31:10,840 --> 00:31:12,300
in terms

1194
00:31:12,300 --> 00:31:12,800
of the

1195
00:31:12,800 --> 00:31:13,100
governments

1196
00:31:13,100 --> 00:31:13,900
and how

1197
00:31:13,900 --> 00:31:14,500
we can

1198
00:31:14,500 --> 00:31:14,960
do that.

1199
00:31:14,960 --> 00:31:16,000
Limited resources,

1200
00:31:16,180 --> 00:31:16,460
I'm not

1201
00:31:16,460 --> 00:31:16,920
talking about

1202
00:31:16,920 --> 00:31:17,460
just money.

1203
00:31:19,210 --> 00:31:19,780
Lack of

1204
00:31:19,780 --> 00:31:20,300
standardized

1205
00:31:21,290 --> 00:31:21,600
cybersecurity

1206
00:31:22,330 --> 00:31:22,640
policies.

1207
00:31:24,260 --> 00:31:24,880
And

1208
00:31:24,880 --> 00:31:25,460
we

1209
00:31:26,560 --> 00:31:27,180
need

1210
00:31:27,180 --> 00:31:27,380
more

1211
00:31:27,380 --> 00:31:27,700
legal

1212
00:31:27,700 --> 00:31:28,060
frameworks

1213
00:31:28,060 --> 00:31:28,560
in order

1214
00:31:28,560 --> 00:31:28,920
to combat

1215
00:31:28,920 --> 00:31:29,200
cyber

1216
00:31:29,200 --> 00:31:29,500
crime.

1217
00:31:29,780 --> 00:31:30,500
If we

1218
00:31:30,500 --> 00:31:31,560
combine

1219
00:31:31,560 --> 00:31:32,500
this with

1220
00:31:32,500 --> 00:31:33,040
the training

1221
00:31:33,040 --> 00:31:33,480
like the

1222
00:31:33,480 --> 00:31:34,120
one that

1223
00:31:34,120 --> 00:31:35,040
OAS is

1224
00:31:35,040 --> 00:31:35,820
doing in

1225
00:31:35,820 --> 00:31:36,240
Latin America

1226
00:31:36,240 --> 00:31:37,080
as well

1227
00:31:37,080 --> 00:31:37,420
as the

1228
00:31:37,420 --> 00:31:37,840
Council of

1229
00:31:37,840 --> 00:31:38,480
Europe.

1230
00:31:38,860 --> 00:31:40,220
So you

1231
00:31:40,220 --> 00:31:40,800
can tell

1232
00:31:40,800 --> 00:31:41,380
that most

1233
00:31:41,380 --> 00:31:41,820
of the

1234
00:31:41,820 --> 00:31:42,460
training that

1235
00:31:42,460 --> 00:31:42,800
is done

1236
00:31:42,800 --> 00:31:43,480
in Latin

1237
00:31:43,480 --> 00:31:43,760
American

1238
00:31:43,760 --> 00:31:44,600
countries is

1239
00:31:44,600 --> 00:31:45,120
not made

1240
00:31:45,120 --> 00:31:45,680
by Latin

1241
00:31:45,680 --> 00:31:45,940
American

1242
00:31:45,940 --> 00:31:46,420
countries.

1243
00:31:46,820 --> 00:31:47,380
We're

1244
00:31:47,380 --> 00:31:47,820
actually

1245
00:31:47,820 --> 00:31:48,360
getting people

1246
00:31:48,360 --> 00:31:48,860
from other

1247
00:31:48,860 --> 00:31:50,340
countries in

1248
00:31:50,340 --> 00:31:50,840
order to

1249
00:31:50,840 --> 00:31:51,060
help.

1250
00:31:51,520 --> 00:31:52,180
And I

1251
00:31:52,180 --> 00:31:52,620
think that

1252
00:31:52,620 --> 00:31:53,680
what we

1253
00:31:53,680 --> 00:31:54,020
should be

1254
00:31:54,020 --> 00:31:54,800
doing in

1255
00:31:54,800 --> 00:31:55,400
the near

1256
00:31:55,400 --> 00:31:56,320
future is

1257
00:31:56,320 --> 00:31:57,240
try to

1258
00:31:57,240 --> 00:31:57,900
standardize

1259
00:31:57,900 --> 00:31:58,440
the

1260
00:31:58,440 --> 00:31:58,840
cybersecurity

1261
00:31:58,840 --> 00:31:59,920
strategies all

1262
00:31:59,920 --> 00:32:00,440
around the

1263
00:32:00,440 --> 00:32:00,680
region.

1264
00:32:01,240 --> 00:32:02,020
And when I'm

1265
00:32:02,020 --> 00:32:02,480
talking about

1266
00:32:02,480 --> 00:32:02,920
the region,

1267
00:32:02,980 --> 00:32:03,660
I'm not just

1268
00:32:03,660 --> 00:32:04,200
talking about

1269
00:32:04,200 --> 00:32:04,900
Latin America

1270
00:32:04,900 --> 00:32:05,760
and the

1271
00:32:05,760 --> 00:32:06,060
Caribbean.

1272
00:32:06,380 --> 00:32:07,320
So we

1273
00:32:07,320 --> 00:32:07,680
need to

1274
00:32:07,680 --> 00:32:07,940
do all

1275
00:32:07,940 --> 00:32:08,380
Americas.

1276
00:32:08,600 --> 00:32:09,040
You know,

1277
00:32:09,080 --> 00:32:09,480
how we

1278
00:32:09,480 --> 00:32:10,020
can work

1279
00:32:10,020 --> 00:32:10,660
together to

1280
00:32:10,660 --> 00:32:11,700
make that

1281
00:32:11,700 --> 00:32:11,960
happen.

1282
00:32:13,480 --> 00:32:14,080
Great.

1283
00:32:14,560 --> 00:32:16,220
Now it's

1284
00:32:16,220 --> 00:32:17,180
time for

1285
00:32:17,180 --> 00:32:18,700
the audience

1286
00:32:25,400 --> 00:32:25,880
to

1287
00:32:25,880 --> 00:32:26,220
ask

1288
00:32:26,220 --> 00:32:27,220
question is

1289
00:32:27,220 --> 00:32:27,380
about,

1290
00:32:28,020 --> 00:32:28,840
as Michael

1291
00:32:28,840 --> 00:32:29,140
said,

1292
00:32:29,780 --> 00:32:30,340
polarization

1293
00:32:30,340 --> 00:32:31,520
is increasing

1294
00:32:31,520 --> 00:32:32,220
in Latin

1295
00:32:32,220 --> 00:32:32,640
America.

1296
00:32:33,000 --> 00:32:33,520
Most of

1297
00:32:33,520 --> 00:32:34,080
these policies

1298
00:32:34,080 --> 00:32:34,820
align with

1299
00:32:34,820 --> 00:32:35,180
the current

1300
00:32:35,180 --> 00:32:35,700
government.

1301
00:32:35,920 --> 00:32:36,340
But when the

1302
00:32:36,340 --> 00:32:36,560
government

1303
00:32:36,560 --> 00:32:36,940
changes,

1304
00:32:37,340 --> 00:32:37,800
that doesn't

1305
00:32:37,800 --> 00:32:38,080
happen,

1306
00:32:38,200 --> 00:32:38,360
right?

1307
00:32:38,480 --> 00:32:38,680
That's

1308
00:32:38,680 --> 00:32:39,500
right now.

1309
00:32:41,280 --> 00:32:42,280
So my

1310
00:32:42,280 --> 00:32:42,820
question is,

1311
00:32:42,840 --> 00:32:43,200
how are you

1312
00:32:43,200 --> 00:32:43,460
seeing

1313
00:32:43,460 --> 00:32:43,820
security

1314
00:32:55,400 --> 00:32:55,520
as a

1315
00:32:55,520 --> 00:32:56,100
part of

1316
00:32:56,100 --> 00:32:56,280
the

1317
00:32:57,320 --> 00:32:57,960
system?

1318
00:32:59,460 --> 00:33:00,340
But we

1319
00:33:00,340 --> 00:33:00,880
still use

1320
00:33:00,880 --> 00:33:01,540
Amazon Web

1321
00:33:01,540 --> 00:33:02,380
Services to

1322
00:33:02,380 --> 00:33:02,760
.

1323
00:33:02,760 --> 00:33:04,040
And this

1324
00:33:04,040 --> 00:33:04,340
connection

1325
00:33:04,340 --> 00:33:04,760
will,

1326
00:33:04,800 --> 00:33:05,240
at some

1327
00:33:05,240 --> 00:33:05,560
point,

1328
00:33:05,580 --> 00:33:05,680
be

1329
00:33:05,680 --> 00:33:06,240
possible.

1330
00:33:06,800 --> 00:33:07,560
If that

1331
00:33:07,560 --> 00:33:07,880
difference

1332
00:33:07,880 --> 00:33:08,220
between

1333
00:33:08,220 --> 00:33:08,580
the

1334
00:33:08,580 --> 00:33:08,900
U.S.

1335
00:33:08,900 --> 00:33:08,920
and

1336
00:33:08,920 --> 00:33:09,200
China

1337
00:33:09,200 --> 00:33:09,520
growing,

1338
00:33:10,040 --> 00:33:14,460
for the

1339
00:33:14,460 --> 00:33:14,900
connection

1340
00:33:14,900 --> 00:33:15,100
between

1341
00:33:15,100 --> 00:33:15,300
the

1342
00:33:15,300 --> 00:33:15,640
systems

1343
00:33:15,640 --> 00:33:15,960
and the

1344
00:33:15,960 --> 00:33:16,080
world,

1345
00:33:18,460 --> 00:33:19,060
how

1346
00:33:21,420 --> 00:33:22,100
do you

1347
00:33:22,100 --> 00:33:22,300
see

1348
00:33:22,300 --> 00:33:22,540
the

1349
00:33:22,540 --> 00:33:22,900
future

1350
00:33:22,900 --> 00:33:23,160
in

1351
00:33:23,160 --> 00:33:23,700
5, 10

1352
00:33:23,700 --> 00:33:24,040
years

1353
00:33:24,040 --> 00:33:24,640
with

1354
00:33:24,640 --> 00:33:24,880
these

1355
00:33:24,880 --> 00:33:25,300
changing

1356
00:33:25,300 --> 00:33:26,100
scenarios?

1357
00:33:28,660 --> 00:33:29,260
The

1358
00:33:29,260 --> 00:33:29,680
future

1359
00:33:29,680 --> 00:33:30,520
that I

1360
00:33:31,380 --> 00:33:31,980
foresee

1361
00:33:31,980 --> 00:33:32,480
is

1362
00:33:32,480 --> 00:33:33,240
not very

1363
00:33:33,240 --> 00:33:33,520
good.

1364
00:33:34,360 --> 00:33:35,240
The thing

1365
00:33:35,240 --> 00:33:35,660
is what

1366
00:33:35,660 --> 00:33:36,300
we can

1367
00:33:36,300 --> 00:33:36,700
do right

1368
00:33:36,700 --> 00:33:37,500
now in

1369
00:33:37,500 --> 00:33:38,400
order to

1370
00:33:39,100 --> 00:33:39,980
not get

1371
00:33:39,980 --> 00:33:40,160
into

1372
00:33:40,160 --> 00:33:40,780
that future.

1373
00:33:41,900 --> 00:33:42,580
The experience

1374
00:33:42,580 --> 00:33:43,100
that I had

1375
00:33:43,100 --> 00:33:43,560
in Brazil

1376
00:33:43,560 --> 00:33:44,300
was amazing.

1377
00:33:44,620 --> 00:33:45,560
Brazil actually

1378
00:33:45,560 --> 00:33:46,320
found out

1379
00:33:46,320 --> 00:33:47,160
that there

1380
00:33:47,160 --> 00:33:47,700
was so much

1381
00:33:47,700 --> 00:33:48,100
corruption

1382
00:33:48,100 --> 00:33:48,700
inside the

1383
00:33:48,700 --> 00:33:49,300
federal police

1384
00:33:49,300 --> 00:33:50,120
that what

1385
00:33:50,120 --> 00:33:50,600
they did

1386
00:33:50,600 --> 00:33:51,100
is pretty

1387
00:33:51,100 --> 00:33:51,720
much they

1388
00:33:52,740 --> 00:33:53,500
created a

1389
00:33:53,500 --> 00:33:54,500
new entity,

1390
00:33:55,300 --> 00:33:55,900
specifically

1391
00:33:55,900 --> 00:33:57,080
with academics

1392
00:33:57,080 --> 00:33:58,240
and people

1393
00:33:58,240 --> 00:33:58,640
from the

1394
00:33:58,640 --> 00:33:59,240
private sector

1395
00:33:59,240 --> 00:33:59,560
that were

1396
00:33:59,560 --> 00:34:00,140
willing to

1397
00:34:00,140 --> 00:34:00,680
change that.

1398
00:34:01,040 --> 00:34:01,920
And when

1399
00:34:01,920 --> 00:34:02,260
they did

1400
00:34:02,260 --> 00:34:02,580
that,

1401
00:34:11,380 --> 00:34:12,340
Talking about

1402
00:34:12,340 --> 00:34:12,940
cyber security

1403
00:34:12,940 --> 00:34:13,620
is even

1404
00:34:13,620 --> 00:34:13,860
worse.

1405
00:34:14,520 --> 00:34:16,040
Because as

1406
00:34:16,040 --> 00:34:16,620
you know,

1407
00:34:16,640 --> 00:34:16,940
there are

1408
00:34:16,940 --> 00:34:17,400
not enough

1409
00:34:17,400 --> 00:34:18,140
cyber security

1410
00:34:18,140 --> 00:34:19,240
experts in

1411
00:34:19,240 --> 00:34:19,620
the region.

1412
00:34:19,900 --> 00:34:20,580
Right now,

1413
00:34:20,680 --> 00:34:21,760
the last

1414
00:34:21,760 --> 00:34:22,960
report from

1415
00:34:23,700 --> 00:34:24,380
ISC

1416
00:34:24,380 --> 00:34:25,440
squared is

1417
00:34:25,440 --> 00:34:25,820
that we

1418
00:34:25,820 --> 00:34:27,720
need 130,000

1419
00:34:27,720 --> 00:34:28,440
specialists

1420
00:34:28,440 --> 00:34:29,400
this year

1421
00:34:29,400 --> 00:34:30,080
in Latin

1422
00:34:30,080 --> 00:34:30,400
America.

1423
00:34:30,800 --> 00:34:32,480
So I

1424
00:34:32,480 --> 00:34:32,820
don't know

1425
00:34:34,000 --> 00:34:35,360
how to

1426
00:34:35,360 --> 00:34:35,660
answer

1427
00:34:35,660 --> 00:34:35,880
that

1428
00:34:35,880 --> 00:34:36,540
specifically.

1429
00:34:40,160 --> 00:34:40,580
myself,

1430
00:34:40,860 --> 00:34:41,400
we're trying

1431
00:34:41,400 --> 00:34:41,740
to do

1432
00:34:41,740 --> 00:34:42,520
stuff in

1433
00:34:42,520 --> 00:34:42,880
order to

1434
00:34:42,880 --> 00:34:43,120
make

1435
00:34:43,120 --> 00:34:43,440
people

1436
00:34:43,440 --> 00:34:43,720
understand.

1437
00:34:44,700 --> 00:34:45,940
My personal

1438
00:34:45,940 --> 00:34:46,620
experience

1439
00:34:46,620 --> 00:34:48,180
is if

1440
00:34:48,180 --> 00:34:49,820
I train

1441
00:34:49,820 --> 00:34:50,780
the DA,

1442
00:34:51,040 --> 00:34:52,240
if I train

1443
00:34:52,240 --> 00:34:53,540
the expert

1444
00:34:53,540 --> 00:34:53,880
witness

1445
00:34:53,880 --> 00:34:54,640
in each

1446
00:34:54,640 --> 00:34:55,060
one of the

1447
00:34:55,060 --> 00:34:55,500
Latin American

1448
00:34:55,500 --> 00:34:56,160
countries,

1449
00:34:56,380 --> 00:34:57,460
at least

1450
00:34:57,460 --> 00:34:58,060
they're

1451
00:34:58,060 --> 00:34:58,280
going to

1452
00:34:58,280 --> 00:34:58,440
start

1453
00:34:58,440 --> 00:34:58,900
doing

1454
00:34:58,900 --> 00:34:59,700
their job

1455
00:34:59,700 --> 00:35:00,140
correctly.

1456
00:35:09,240 --> 00:35:10,140
But I

1457
00:35:10,140 --> 00:35:11,380
work for a

1458
00:35:12,140 --> 00:35:12,660
political

1459
00:35:12,660 --> 00:35:13,860
organization.

1460
00:35:14,360 --> 00:35:15,200
We are,

1461
00:35:15,380 --> 00:35:16,400
you know,

1462
00:35:16,420 --> 00:35:16,980
the OAS

1463
00:35:16,980 --> 00:35:18,080
has member

1464
00:35:18,080 --> 00:35:18,900
states and

1465
00:35:18,900 --> 00:35:19,760
we work

1466
00:35:19,760 --> 00:35:20,260
by their

1467
00:35:20,260 --> 00:35:20,840
mandates

1468
00:35:22,020 --> 00:35:22,800
for the

1469
00:35:22,800 --> 00:35:23,000
whole

1470
00:35:23,000 --> 00:35:23,500
Americas.

1471
00:35:24,700 --> 00:35:25,980
But one

1472
00:35:25,980 --> 00:35:26,820
thing that,

1473
00:35:26,860 --> 00:35:27,360
you know,

1474
00:35:28,260 --> 00:35:29,540
what you

1475
00:35:29,540 --> 00:35:30,000
are saying

1476
00:35:30,000 --> 00:35:30,940
is something

1477
00:35:30,940 --> 00:35:31,360
that is

1478
00:35:31,360 --> 00:35:31,940
happening in

1479
00:35:31,940 --> 00:35:32,340
the region,

1480
00:35:32,420 --> 00:35:32,680
that,

1481
00:35:32,680 --> 00:35:33,480
you know,

1482
00:35:33,520 --> 00:35:34,100
cyber security

1483
00:35:34,100 --> 00:35:35,240
is not a

1484
00:35:35,240 --> 00:35:35,960
state

1485
00:35:35,960 --> 00:35:37,200
problem,

1486
00:35:40,140 --> 00:35:40,780
you know,

1487
00:35:40,820 --> 00:35:41,120
there's a

1488
00:35:41,120 --> 00:35:41,500
lot of

1489
00:35:42,880 --> 00:35:43,160
countries

1490
00:35:43,160 --> 00:35:44,980
that as

1491
00:35:44,980 --> 00:35:45,580
soon as

1492
00:35:45,580 --> 00:35:46,140
they switch

1493
00:35:46,140 --> 00:35:46,960
government,

1494
00:35:47,240 --> 00:35:47,740
they change

1495
00:35:47,740 --> 00:35:48,680
everything.

1496
00:35:53,260 --> 00:35:54,380
And that's

1497
00:35:54,380 --> 00:35:55,200
very costly

1498
00:35:55,200 --> 00:35:56,020
for the

1499
00:35:56,020 --> 00:35:56,560
region and

1500
00:35:56,560 --> 00:35:56,840
for the

1501
00:35:56,840 --> 00:35:57,400
country.

1502
00:35:59,940 --> 00:36:00,500
What,

1503
00:36:00,640 --> 00:36:01,480
you know,

1504
00:36:01,540 --> 00:36:01,960
the OAS

1505
00:36:01,960 --> 00:36:02,680
is focusing

1506
00:36:02,680 --> 00:36:03,180
right now

1507
00:36:03,180 --> 00:36:03,660
is trying

1508
00:36:03,660 --> 00:36:03,960
to,

1509
00:36:04,020 --> 00:36:04,960
you know,

1510
00:36:04,980 --> 00:36:05,480
work on

1511
00:36:06,080 --> 00:36:06,640
robust

1512
00:36:13,900 --> 00:36:14,900
governance

1513
00:36:16,120 --> 00:36:17,120
model.

1514
00:36:23,200 --> 00:36:24,700
We don't

1515
00:36:24,700 --> 00:36:30,540
you know,

1516
00:36:30,560 --> 00:36:31,780
a robust

1517
00:36:31,780 --> 00:36:32,640
governance

1518
00:36:32,640 --> 00:36:33,140
model.

1519
00:36:33,320 --> 00:36:34,080
We don't

1520
00:36:34,080 --> 00:36:34,260
have,

1521
00:36:34,360 --> 00:36:37,340
you know,

1522
00:36:37,340 --> 00:36:37,620
that type

1523
00:36:37,620 --> 00:36:37,920
of,

1524
00:36:37,940 --> 00:36:38,220
of,

1525
00:36:38,220 --> 00:36:38,720
of,

1526
00:36:38,720 --> 00:36:39,320
of,

1527
00:36:39,320 --> 00:36:39,440
of,

1528
00:36:39,440 --> 00:36:39,980
of,

1529
00:36:40,120 --> 00:36:40,460
of expertise.

1530
00:36:40,680 --> 00:36:41,560
So we are

1531
00:36:41,560 --> 00:36:42,160
working right

1532
00:36:42,160 --> 00:36:42,800
now with

1533
00:36:42,800 --> 00:36:43,660
trying to help,

1534
00:36:43,760 --> 00:36:44,080
you know,

1535
00:36:44,120 --> 00:36:44,600
the countries

1536
00:36:44,600 --> 00:36:45,500
in order to

1537
00:36:46,900 --> 00:36:48,160
bring everybody

1538
00:36:48,160 --> 00:36:49,000
to the table,

1539
00:36:49,180 --> 00:36:50,200
everybody to

1540
00:36:50,200 --> 00:36:50,520
discuss,

1541
00:36:51,910 --> 00:36:52,520
even if

1542
00:36:53,120 --> 00:36:53,600
it's,

1543
00:36:53,600 --> 00:36:54,120
you know,

1544
00:36:55,930 --> 00:36:56,260
the

1545
00:36:56,260 --> 00:36:57,120
international

1546
00:36:57,120 --> 00:36:58,320
community and,

1547
00:36:58,320 --> 00:36:58,780
you know,

1548
00:36:58,780 --> 00:36:59,160
the international

1549
00:36:59,160 --> 00:36:59,940
community is

1550
00:36:59,940 --> 00:37:01,040
very broad

1551
00:37:01,040 --> 00:37:03,120
and it

1552
00:37:03,120 --> 00:37:03,620
covers

1553
00:37:03,620 --> 00:37:04,440
the whole

1554
00:37:04,440 --> 00:37:05,080
globe.

1555
00:37:05,320 --> 00:37:05,500
So

1556
00:37:07,620 --> 00:37:08,280
each

1557
00:37:08,280 --> 00:37:08,820
country is

1558
00:37:08,820 --> 00:37:09,060
independent.

1559
00:37:09,500 --> 00:37:10,280
For example,

1560
00:37:10,360 --> 00:37:11,180
we have to

1561
00:37:11,180 --> 00:37:12,140
take into

1562
00:37:12,140 --> 00:37:12,720
account

1563
00:37:13,580 --> 00:37:14,740
best practices

1564
00:37:14,740 --> 00:37:15,420
in the region.

1565
00:37:15,580 --> 00:37:16,080
For example,

1566
00:37:16,800 --> 00:37:17,380
Dominican

1567
00:37:17,380 --> 00:37:18,240
Republic has

1568
00:37:18,240 --> 00:37:18,780
a very,

1569
00:37:18,860 --> 00:37:19,100
very,

1570
00:37:19,120 --> 00:37:19,720
very good,

1571
00:37:19,720 --> 00:37:21,060
you know,

1572
00:37:21,760 --> 00:37:22,340
governance

1573
00:37:22,340 --> 00:37:23,300
structure

1574
00:37:23,300 --> 00:37:23,940
there.

1575
00:37:24,100 --> 00:37:24,480
They have

1576
00:37:24,480 --> 00:37:25,620
cybersecurity

1577
00:37:25,620 --> 00:37:26,440
agents.

1578
00:37:26,580 --> 00:37:26,940
It's one

1579
00:37:26,940 --> 00:37:27,140
of,

1580
00:37:28,280 --> 00:37:29,240
one of the,

1581
00:37:29,340 --> 00:37:30,340
I think

1582
00:37:30,340 --> 00:37:30,660
it's the

1583
00:37:31,740 --> 00:37:32,640
one out

1584
00:37:32,640 --> 00:37:33,100
of

1585
00:37:33,100 --> 00:37:33,700
five

1586
00:37:34,780 --> 00:37:35,360
countries

1587
00:37:38,280 --> 00:37:38,500
in the

1588
00:37:39,660 --> 00:37:40,560
Right now

1589
00:37:41,080 --> 00:37:41,520
there are

1590
00:37:41,520 --> 00:37:41,840
some

1591
00:37:41,840 --> 00:37:42,900
countries

1592
00:37:42,900 --> 00:37:43,800
such as

1593
00:37:44,820 --> 00:37:45,420
Chile

1594
00:37:45,420 --> 00:37:46,260
and Colombia

1595
00:37:46,260 --> 00:37:46,860
that are

1596
00:37:46,860 --> 00:37:47,960
trying to

1597
00:37:47,960 --> 00:37:48,840
pass bills,

1598
00:37:49,160 --> 00:37:49,640
you know,

1599
00:37:49,660 --> 00:37:50,340
cybersecurity

1600
00:37:50,340 --> 00:37:51,040
bills,

1601
00:37:51,240 --> 00:37:52,100
trying to

1602
00:37:52,100 --> 00:37:53,260
design

1603
00:37:53,260 --> 00:37:53,880
this type

1604
00:37:53,880 --> 00:37:54,140
of

1605
00:37:54,140 --> 00:37:55,240
agencies.

1606
00:37:56,040 --> 00:37:56,640
So

1607
00:37:56,640 --> 00:37:57,440
what I,

1608
00:37:57,480 --> 00:37:58,300
what I have

1609
00:37:58,300 --> 00:37:58,780
to say

1610
00:37:58,780 --> 00:37:59,160
is that

1611
00:38:00,380 --> 00:38:01,300
we look

1612
00:38:01,300 --> 00:38:01,500
for,

1613
00:38:01,700 --> 00:38:02,200
as an

1614
00:38:02,200 --> 00:38:02,540
OAS,

1615
00:38:02,680 --> 00:38:03,000
we look

1616
00:38:08,320 --> 00:38:08,880
for

1617
00:38:08,880 --> 00:38:09,100
that

1618
00:38:09,100 --> 00:38:09,880
could build,

1619
00:38:09,940 --> 00:38:10,240
you know,

1620
00:38:10,260 --> 00:38:11,020
strong

1621
00:38:11,860 --> 00:38:12,420
national

1622
00:38:12,420 --> 00:38:12,920
cybersecurity

1623
00:38:12,920 --> 00:38:13,760
strategies

1624
00:38:13,760 --> 00:38:14,400
and policies.

1625
00:38:18,360 --> 00:38:18,920
Yeah,

1626
00:38:18,980 --> 00:38:19,860
can,

1627
00:38:20,000 --> 00:38:20,780
we have

1628
00:38:20,780 --> 00:38:21,000
time

1629
00:38:21,000 --> 00:38:21,340
for one

1630
00:38:21,340 --> 00:38:21,520
more,

1631
00:38:21,620 --> 00:38:21,780
yes.

1632
00:38:26,660 --> 00:38:27,220
Thank

1633
00:38:27,220 --> 00:38:27,460
you.

1634
00:38:27,840 --> 00:38:28,400
My

1635
00:38:28,400 --> 00:38:28,680
name

1636
00:38:28,680 --> 00:38:28,860
is,

1637
00:38:28,980 --> 00:38:29,420
is

1638
00:38:29,420 --> 00:38:29,920
Ira Victor.

1639
00:38:30,100 --> 00:38:30,480
I'm an

1640
00:38:30,480 --> 00:38:30,780
ambassador

1641
00:38:30,780 --> 00:38:31,460
for the

1642
00:38:31,460 --> 00:38:31,920
Center for

1643
00:38:31,920 --> 00:38:32,520
Internet Security

1644
00:38:32,520 --> 00:38:33,480
Controls.

1645
00:38:34,780 --> 00:38:35,460
We've,

1646
00:38:35,520 --> 00:38:36,420
the CIS

1647
00:38:36,420 --> 00:38:36,780
controls

1648
00:38:36,780 --> 00:38:37,860
have been

1649
00:38:37,860 --> 00:38:38,360
used

1650
00:38:38,360 --> 00:38:39,120
in the

1651
00:38:39,120 --> 00:38:39,700
United States

1652
00:38:39,700 --> 00:38:40,400
to create

1653
00:38:40,400 --> 00:38:41,420
a legal

1654
00:38:41,420 --> 00:38:41,880
incentive

1655
00:38:41,880 --> 00:38:43,380
for public

1656
00:38:43,380 --> 00:38:43,860
and private

1657
00:38:43,860 --> 00:38:44,480
entities

1658
00:38:44,480 --> 00:38:45,140
to adopt

1659
00:38:45,140 --> 00:38:46,600
information security

1660
00:38:46,600 --> 00:38:47,260
and privacy

1661
00:38:47,260 --> 00:38:48,120
best practices.

1662
00:38:49,100 --> 00:38:50,280
Have you,

1663
00:38:50,300 --> 00:38:50,980
have you

1664
00:38:50,980 --> 00:38:51,560
or the people

1665
00:38:51,560 --> 00:38:51,980
in your,

1666
00:38:52,060 --> 00:38:53,180
in your world

1667
00:38:53,180 --> 00:38:53,720
been looking

1668
00:38:53,720 --> 00:38:54,980
at an

1669
00:38:55,300 --> 00:38:55,940
incentive-based

1670
00:38:55,940 --> 00:38:56,420
approach

1671
00:38:56,420 --> 00:38:57,160
for public

1672
00:38:57,160 --> 00:38:57,580
and private

1673
00:38:57,580 --> 00:38:58,040
sector

1674
00:38:58,040 --> 00:38:59,020
to adopt

1675
00:38:59,020 --> 00:38:59,760
an international

1676
00:38:59,760 --> 00:39:00,360
standard

1677
00:39:00,360 --> 00:39:00,960
for information

1678
00:39:00,960 --> 00:39:01,500
security,

1679
00:39:01,820 --> 00:39:02,500
either the

1680
00:39:02,500 --> 00:39:02,900
CIS

1681
00:39:02,900 --> 00:39:03,300
standard

1682
00:39:03,300 --> 00:39:03,900
or one

1683
00:39:03,900 --> 00:39:04,120
of the

1684
00:39:04,120 --> 00:39:04,560
other ones?

1685
00:39:09,760 --> 00:39:10,400
Well,

1686
00:39:10,580 --> 00:39:11,240
of course,

1687
00:39:11,320 --> 00:39:11,540
we,

1688
00:39:11,620 --> 00:39:11,860
we,

1689
00:39:11,860 --> 00:39:12,980
we encourage

1690
00:39:12,980 --> 00:39:14,200
the member

1691
00:39:14,200 --> 00:39:14,600
states,

1692
00:39:14,740 --> 00:39:15,260
you know,

1693
00:39:15,300 --> 00:39:15,480
to,

1694
00:39:15,480 --> 00:39:15,560
to,

1695
00:39:15,580 --> 00:39:17,240
to be involved

1696
00:39:17,240 --> 00:39:18,180
in this type,

1697
00:39:18,200 --> 00:39:19,100
type of initiatives.

1698
00:39:23,040 --> 00:39:24,540
When we go to the,

1699
00:39:24,560 --> 00:39:25,440
to the countries,

1700
00:39:25,560 --> 00:39:26,360
to the member states

1701
00:39:26,360 --> 00:39:26,780
in,

1702
00:39:26,780 --> 00:39:27,520
in Latin America,

1703
00:39:27,680 --> 00:39:28,320
we try to,

1704
00:39:28,400 --> 00:39:29,640
to invite,

1705
00:39:29,960 --> 00:39:30,400
you know,

1706
00:39:30,420 --> 00:39:32,020
people with a lot

1707
00:39:32,020 --> 00:39:32,460
of expertise

1708
00:39:33,000 --> 00:39:33,480
on,

1709
00:39:33,600 --> 00:39:34,160
on the subject.

1710
00:39:34,300 --> 00:39:34,440
So,

1711
00:39:35,640 --> 00:39:37,180
we try to bring,

1712
00:39:37,320 --> 00:39:37,600
you know,

1713
00:39:37,680 --> 00:39:37,820
as,

1714
00:39:37,920 --> 00:39:38,300
as,

1715
00:39:38,300 --> 00:39:38,720
as,

1716
00:39:38,720 --> 00:39:40,500
as much as we could,

1717
00:39:40,600 --> 00:39:40,880
you know,

1718
00:39:40,900 --> 00:39:41,720
technical people,

1719
00:39:41,860 --> 00:39:42,160
technical,

1720
00:39:45,480 --> 00:39:45,560
technical work

1721
00:39:45,560 --> 00:39:45,620
on,

1722
00:39:45,700 --> 00:39:46,280
on those type

1723
00:39:46,280 --> 00:39:46,960
of standards

1724
00:39:46,960 --> 00:39:47,940
and procedures.

1725
00:39:48,460 --> 00:39:50,060
And what we

1726
00:39:50,060 --> 00:39:51,360
try to do

1727
00:39:51,360 --> 00:39:51,940
is try to

1728
00:39:51,940 --> 00:39:53,140
open the discussion,

1729
00:39:53,500 --> 00:39:54,540
try to debate,

1730
00:39:54,800 --> 00:39:55,860
bring everybody

1731
00:39:55,860 --> 00:39:56,180
to,

1732
00:39:56,240 --> 00:39:57,060
to the region.

1733
00:39:57,600 --> 00:39:58,120
And,

1734
00:39:58,260 --> 00:39:59,140
of course,

1735
00:39:59,140 --> 00:39:59,580
we,

1736
00:39:59,680 --> 00:40:00,660
we are going

1737
00:40:00,660 --> 00:40:01,340
to take a look

1738
00:40:01,340 --> 00:40:02,480
at what you are saying

1739
00:40:02,480 --> 00:40:03,500
and,

1740
00:40:03,500 --> 00:40:03,960
and,

1741
00:40:04,100 --> 00:40:04,620
and,

1742
00:40:05,200 --> 00:40:05,720
and,

1743
00:40:05,720 --> 00:40:06,020
and,

1744
00:40:06,020 --> 00:40:06,160
and,

1745
00:40:06,160 --> 00:40:07,220
and try to,

1746
00:40:07,280 --> 00:40:07,860
to show it

1747
00:40:07,860 --> 00:40:08,360
to the region.

1748
00:40:09,140 --> 00:40:10,420
I know that Argentina

1749
00:40:10,420 --> 00:40:11,160
actually

1750
00:40:15,480 --> 00:40:16,320
is part of the,

1751
00:40:16,360 --> 00:40:17,100
of the group.

1752
00:40:17,740 --> 00:40:18,680
But it didn't

1753
00:40:18,680 --> 00:40:19,060
went through.

1754
00:40:19,260 --> 00:40:19,600
So,

1755
00:40:19,740 --> 00:40:20,940
it's a matter also

1756
00:40:20,940 --> 00:40:21,600
on how,

1757
00:40:21,600 --> 00:40:22,740
how things are presented

1758
00:40:22,740 --> 00:40:24,260
to the decision makers,

1759
00:40:24,480 --> 00:40:24,840
the government,

1760
00:40:25,040 --> 00:40:26,080
and how we can

1761
00:40:26,080 --> 00:40:26,640
make it happen.

1762
00:40:27,080 --> 00:40:27,960
Most of the,

1763
00:40:28,060 --> 00:40:28,580
the ways

1764
00:40:28,580 --> 00:40:29,700
that in Latin America

1765
00:40:29,700 --> 00:40:30,100
works,

1766
00:40:30,260 --> 00:40:31,220
it will work

1767
00:40:31,220 --> 00:40:32,140
after they have

1768
00:40:32,140 --> 00:40:33,060
a catastrophe.

1769
00:40:33,500 --> 00:40:34,080
You know,

1770
00:40:34,100 --> 00:40:35,400
something that affected

1771
00:40:35,400 --> 00:40:36,520
not the,

1772
00:40:36,620 --> 00:40:37,880
the company,

1773
00:40:38,220 --> 00:40:38,920
but really

1774
00:40:38,920 --> 00:40:39,400
the government.

1775
00:40:39,740 --> 00:40:40,160
So,

1776
00:40:40,200 --> 00:40:40,840
we're talking about,

1777
00:40:40,960 --> 00:40:41,360
you know,

1778
00:40:41,900 --> 00:40:42,420
if,

1779
00:40:42,420 --> 00:40:42,660
if,

1780
00:40:42,660 --> 00:40:44,180
if we're talking about Mexico,

1781
00:40:44,260 --> 00:40:44,540
it,

1782
00:40:44,600 --> 00:40:45,500
it should be Pemex,

1783
00:40:45,640 --> 00:40:45,860
you know,

1784
00:40:45,920 --> 00:40:46,200
or,

1785
00:40:46,400 --> 00:40:47,240
or the CFE that is

1786
00:40:47,240 --> 00:40:48,640
the electrical grid.

1787
00:40:48,940 --> 00:40:49,380
So,

1788
00:40:50,100 --> 00:40:51,500
until we don't have that,

1789
00:40:51,600 --> 00:40:51,920
and,

1790
00:40:52,000 --> 00:40:52,160
and,

1791
00:40:52,160 --> 00:40:53,080
and probably I'm going

1792
00:40:53,080 --> 00:40:53,980
to say something that,

1793
00:40:54,600 --> 00:40:55,880
I didn't want to say it,

1794
00:40:55,900 --> 00:40:56,420
but I'll say it.

1795
00:40:57,160 --> 00:40:58,280
Most of the times,

1796
00:40:58,300 --> 00:40:59,140
it's a matter on

1797
00:41:00,380 --> 00:41:01,220
their thinking

1798
00:41:01,220 --> 00:41:01,880
like this.

1799
00:41:02,140 --> 00:41:03,400
If I do not

1800
00:41:03,400 --> 00:41:04,020
have the

1801
00:41:04,020 --> 00:41:05,060
electric grid

1802
00:41:05,060 --> 00:41:06,280
connected to the internet,

1803
00:41:06,420 --> 00:41:07,080
why I should

1804
00:41:07,080 --> 00:41:07,820
bother?

1805
00:41:08,060 --> 00:41:08,480
You know?

1806
00:41:08,600 --> 00:41:09,400
And we know

1807
00:41:09,400 --> 00:41:09,920
it's an issue.

1808
00:41:10,340 --> 00:41:10,780
But,

1809
00:41:12,420 --> 00:41:12,580
it's very boring

1810
00:41:12,580 --> 00:41:13,420
in terms of

1811
00:41:13,420 --> 00:41:14,600
we need to

1812
00:41:15,200 --> 00:41:16,420
generate so much

1813
00:41:16,420 --> 00:41:16,820
awareness

1814
00:41:17,420 --> 00:41:18,220
on those levels

1815
00:41:18,760 --> 00:41:19,640
that probably

1816
00:41:19,640 --> 00:41:20,960
one of the best

1817
00:41:20,960 --> 00:41:21,700
ways of doing it

1818
00:41:21,700 --> 00:41:22,100
is waiting

1819
00:41:22,100 --> 00:41:22,920
when the new

1820
00:41:22,920 --> 00:41:23,680
generations start

1821
00:41:23,680 --> 00:41:24,520
getting into the

1822
00:41:25,400 --> 00:41:26,200
decision making

1823
00:41:26,840 --> 00:41:27,900
inside the companies

1824
00:41:27,900 --> 00:41:29,040
so we can change that.

1825
00:41:30,220 --> 00:41:30,880
Thank you.

1826
00:41:30,920 --> 00:41:31,180
Thanks.

1827
00:41:33,440 --> 00:41:33,960
Okay.

1828
00:41:34,080 --> 00:41:34,980
Thank you very much.

1829
00:41:35,300 --> 00:41:36,000
Thank you.