1 00:00:00,000 --> 00:00:02,540 Okay, our two o'clock session is titled 2 00:00:02,540 --> 00:00:04,380 How Can We Encourage More Hackers 3 00:00:04,380 --> 00:00:05,660 to Engage with Policymakers? 4 00:00:06,000 --> 00:00:07,180 And we have two speakers. 5 00:00:08,140 --> 00:00:11,260 Peter Stevens is an experienced policy lead 6 00:00:11,260 --> 00:00:12,080 in the UK and abroad. 7 00:00:12,440 --> 00:00:13,860 From 2018 to 2021, 8 00:00:14,180 --> 00:00:16,320 he led the IoT security policy division 9 00:00:16,320 --> 00:00:18,020 across the United Kingdom government, 10 00:00:18,600 --> 00:00:20,000 responding to the Mariah attack, 11 00:00:20,220 --> 00:00:21,300 delivering the product security 12 00:00:21,300 --> 00:00:23,140 and telecommunications infrastructure bill. 13 00:00:23,480 --> 00:00:25,260 He is an experienced public servant, 14 00:00:25,340 --> 00:00:27,560 well-versed in delivering through government. 15 00:00:27,680 --> 00:00:29,740 He has advised ministers and prime ministers 16 00:00:29,740 --> 00:00:31,120 on the creation and running 17 00:00:31,120 --> 00:00:32,380 of delivery units in government. 18 00:00:33,000 --> 00:00:34,820 While not technical by background, 19 00:00:35,100 --> 00:00:36,480 he brings a rebellious streak. 20 00:00:36,680 --> 00:00:38,460 As a student, Peter hitchhiked 21 00:00:38,460 --> 00:00:39,900 from Buenos Aires to New York City, 22 00:00:40,080 --> 00:00:41,860 and he also spent two years teaching 23 00:00:41,860 --> 00:00:43,520 in an inner-city school in South London. 24 00:00:43,960 --> 00:00:45,280 Experiences like this have left him 25 00:00:45,280 --> 00:00:46,940 with a staunch optimism about people, 26 00:00:47,060 --> 00:00:48,980 and he is a passionate advocate for partnerships 27 00:00:48,980 --> 00:00:50,540 between policymakers and hackers. 28 00:00:50,780 --> 00:00:52,300 To make better-informed policies 29 00:00:52,300 --> 00:00:53,420 that can support policymakers 30 00:00:53,420 --> 00:00:54,700 and citizens around the world, 31 00:00:54,840 --> 00:00:56,460 he's currently a policy advisor 32 00:00:56,460 --> 00:00:57,880 at the OECD, 33 00:00:58,500 --> 00:00:59,580 supporting member states 34 00:00:59,580 --> 00:01:01,640 to navigate the range of challenges economically. 35 00:01:03,240 --> 00:01:07,060 Thomas Krantz is an award-winning 36 00:01:07,060 --> 00:01:07,940 cybersecurity consultant, 37 00:01:08,180 --> 00:01:09,720 a senior security and technology leader, 38 00:01:09,780 --> 00:01:12,100 and an author with more than 30 years 39 00:01:12,100 --> 00:01:13,620 of experience in IT and cybersecurity. 40 00:01:14,200 --> 00:01:16,280 Starting his hacking career in the 80s 41 00:01:16,280 --> 00:01:17,140 in the United Kingdom, 42 00:01:17,280 --> 00:01:19,440 Thomas has also spent the decade since then 43 00:01:19,440 --> 00:01:20,980 involved in lobbying United Kingdom 44 00:01:20,980 --> 00:01:22,520 and European Union policymakers, 45 00:01:23,080 --> 00:01:25,280 and contributed to various government consultants 46 00:01:25,280 --> 00:01:26,880 around hacking and cybersecurity. 47 00:01:27,820 --> 00:01:29,040 He's written two books. 48 00:01:29,040 --> 00:01:30,000 His award-winning, 49 00:01:30,160 --> 00:01:31,680 Making Sense of Cybersecurity, 50 00:01:31,900 --> 00:01:36,200 and How is AI Transforming Cybersecurity for NVIDIA? 51 00:01:36,580 --> 00:01:38,740 And this session is on the record, 52 00:01:38,880 --> 00:01:42,620 which means that it's okay to photograph slides 53 00:01:42,620 --> 00:01:44,260 and share slides on social media, 54 00:01:44,500 --> 00:01:46,960 but the same photography policy applies 55 00:01:46,960 --> 00:01:49,560 in terms of permissions required for photographs of people. 56 00:01:49,880 --> 00:01:50,700 So, thank you. 57 00:01:54,280 --> 00:01:55,360 Thank you very much, 58 00:01:55,460 --> 00:01:57,320 and thank you, everyone, for coming. 59 00:01:57,480 --> 00:01:58,380 And thank you, DEF CON, 60 00:01:58,380 --> 00:01:59,380 for hosting this event. 61 00:01:59,640 --> 00:02:00,800 It's a great pleasure to be here. 62 00:02:02,280 --> 00:02:04,240 And, yeah, thank you all very much for coming. 63 00:02:04,440 --> 00:02:06,100 And I'm really excited for the conversation 64 00:02:06,560 --> 00:02:07,780 and listening to your perspectives. 65 00:02:08,060 --> 00:02:09,560 Please note that this is not going to be 66 00:02:09,560 --> 00:02:11,760 the two of us talking for 50 minutes. 67 00:02:11,900 --> 00:02:13,820 We will be really grateful and appreciative 68 00:02:13,820 --> 00:02:15,600 of your insights as well and comments. 69 00:02:16,340 --> 00:02:18,140 So, yeah, hopefully we can set that up. 70 00:02:18,520 --> 00:02:19,420 I'll pass it over to Thomas. 71 00:02:19,820 --> 00:02:20,320 Thank you. 72 00:02:22,320 --> 00:02:25,680 Sorry, the acoustics aren't great. 73 00:02:25,860 --> 00:02:26,320 Hi, everyone. 74 00:02:26,380 --> 00:02:27,080 Thank you for coming along. 75 00:02:27,780 --> 00:02:30,080 Peter and I have very, very different backgrounds, 76 00:02:30,260 --> 00:02:31,480 but as Peter said, 77 00:02:31,580 --> 00:02:32,960 we're not going to be here talking about us 78 00:02:32,960 --> 00:02:34,180 or talking about our perspectives. 79 00:02:34,260 --> 00:02:36,320 We want to get your input, your perspectives. 80 00:02:37,220 --> 00:02:40,040 So, one of the reasons that we wanted to hold this session 81 00:02:40,040 --> 00:02:43,120 is that there's several things happening so far. 82 00:02:43,300 --> 00:02:47,240 So, there seems to be a critical mass across governments 83 00:02:47,240 --> 00:02:49,440 and supporting organisations globally 84 00:02:50,080 --> 00:02:53,940 for people trying to put together laws, policies, 85 00:02:54,200 --> 00:02:56,260 frameworks about not just cyber security, 86 00:02:56,260 --> 00:02:58,600 but also other emerging technologies like AI, 87 00:02:59,380 --> 00:03:01,040 like quantum cryptography, 88 00:03:01,520 --> 00:03:03,420 and all of the impacts that those have 89 00:03:03,420 --> 00:03:05,680 on society and technologists in general. 90 00:03:06,560 --> 00:03:07,260 So, one of the things... 91 00:03:10,480 --> 00:03:10,960 Yeah. 92 00:03:11,080 --> 00:03:11,780 Is that easier? 93 00:03:12,060 --> 00:03:12,460 There we go. 94 00:03:12,540 --> 00:03:12,900 Thank you. 95 00:03:13,080 --> 00:03:15,060 It's very difficult to hear from here 96 00:03:16,060 --> 00:03:17,320 whether you guys can hear. 97 00:03:17,520 --> 00:03:21,160 So, what we're looking for is to essentially 98 00:03:21,160 --> 00:03:24,020 have some open conversations about what has worked well, 99 00:03:24,160 --> 00:03:25,200 what hasn't worked well, 100 00:03:25,920 --> 00:03:28,800 which areas people think there needs to be more work on. 101 00:03:29,060 --> 00:03:30,780 One of the things that I'm very keen on 102 00:03:30,780 --> 00:03:33,160 is that hackers and security researchers 103 00:03:33,160 --> 00:03:37,120 should be more involved in supporting policy creation, 104 00:03:37,820 --> 00:03:38,620 supporting governments, 105 00:03:38,820 --> 00:03:42,980 not necessarily in terms of let's hire 50 or 60 hackers 106 00:03:42,980 --> 00:03:44,720 and get them to work full-time in government, 107 00:03:44,820 --> 00:03:47,120 but more in terms of where are the areas of expertise. 108 00:03:47,600 --> 00:03:48,480 You know, we're in the middle of DEF CON. 109 00:03:48,700 --> 00:03:50,720 We're seeing a lot of really great research. 110 00:03:50,840 --> 00:03:53,220 We're seeing a lot of good people coming out and saying, 111 00:03:53,280 --> 00:03:54,820 look at this cool stuff we found. 112 00:03:55,200 --> 00:03:57,320 How do we get those people engaged with policymakers 113 00:03:57,320 --> 00:04:00,260 to make sure that policymakers, decision makers, 114 00:04:01,400 --> 00:04:02,620 politicians as well, 115 00:04:02,780 --> 00:04:06,520 have the best information they need to make informed decisions? 116 00:04:06,940 --> 00:04:09,580 And also, how can we engage hackers and security researchers 117 00:04:09,580 --> 00:04:13,320 more in some of the sort of NGOs and the lobbyist organizations 118 00:04:13,320 --> 00:04:16,840 to make sure that when there is legislation that happens 119 00:04:16,840 --> 00:04:19,560 that perhaps is not as good as it could be, 120 00:04:20,200 --> 00:04:22,620 then we can tackle that and we can deal with that 121 00:04:22,620 --> 00:04:24,700 in a constructive way and make sure that we fix 122 00:04:25,200 --> 00:04:25,820 the problems that we see. 123 00:04:27,940 --> 00:04:28,540 Thanks, Tom. 124 00:04:28,540 --> 00:04:30,560 And I think just to share back on that, 125 00:04:30,620 --> 00:04:32,620 so from my experience working, 126 00:04:32,880 --> 00:04:37,120 so I used to be the IoT Product Security Division lead, 127 00:04:37,240 --> 00:04:39,460 so heading up the Product Security 128 00:04:39,460 --> 00:04:41,020 and Telecommunication Infrastructure Act 129 00:04:41,020 --> 00:04:43,380 and basically the UK's government response to Mirai. 130 00:04:43,940 --> 00:04:46,500 So I think that in about four years, 131 00:04:46,540 --> 00:04:48,840 we went from sort of an attack, 132 00:04:49,000 --> 00:04:53,540 which encouraged a bit of a response to delivery 133 00:04:53,540 --> 00:04:55,180 not only of a technical stack, 134 00:04:55,200 --> 00:04:57,680 but also of actually the first international legislation 135 00:04:58,200 --> 00:04:59,680 for that to take place in the world. 136 00:05:00,000 --> 00:05:01,860 And I think that the reason we did that 137 00:05:01,860 --> 00:05:03,940 was because we had a really great relationship 138 00:05:03,940 --> 00:05:05,580 and we managed to find some fantastic people 139 00:05:05,580 --> 00:05:07,440 who were able and generous to support us. 140 00:05:07,800 --> 00:05:10,180 And I really cannot testify enough 141 00:05:10,180 --> 00:05:12,300 just how much it meant to us 142 00:05:12,300 --> 00:05:14,000 and also it enabled us as a division 143 00:05:14,000 --> 00:05:16,740 to engage with security researchers, 144 00:05:16,960 --> 00:05:18,700 but also then to engage effectively 145 00:05:18,700 --> 00:05:23,200 with industry and civil society and academics. 146 00:05:23,420 --> 00:05:25,080 And I think it really kind of gained 147 00:05:25,200 --> 00:05:26,140 critical mass and momentum. 148 00:05:26,480 --> 00:05:29,060 So I'm a huge advocate for this to happen more 149 00:05:29,060 --> 00:05:30,840 and for there to be more opportunities 150 00:05:30,840 --> 00:05:32,280 for these kinds of partnerships. 151 00:05:33,240 --> 00:05:35,840 As well as that, I think there's a bit of learning 152 00:05:35,840 --> 00:05:37,400 that we took over that period of time 153 00:05:37,400 --> 00:05:39,220 about how can we adapt what we're doing 154 00:05:39,220 --> 00:05:40,880 to make it more accessible, 155 00:05:41,160 --> 00:05:44,280 to make it something which can be engaged with easily. 156 00:05:44,800 --> 00:05:47,260 I appreciate lots of members of the security community 157 00:05:47,260 --> 00:05:48,480 are very busy, of course, 158 00:05:48,540 --> 00:05:51,680 and don't necessarily fit into the confines 159 00:05:51,680 --> 00:05:54,600 of civil society or industry associations, 160 00:05:54,600 --> 00:05:57,080 which exist and have done for decades. 161 00:05:57,800 --> 00:05:59,260 So how can we do that? 162 00:05:59,520 --> 00:06:01,300 And I think also just something 163 00:06:01,300 --> 00:06:02,640 that I've learned a huge amount 164 00:06:02,640 --> 00:06:03,840 is the importance of transparency, 165 00:06:04,200 --> 00:06:05,720 the importance of engaging with one another 166 00:06:05,720 --> 00:06:07,740 and being prepared to iterate 167 00:06:07,740 --> 00:06:10,840 and sort of have an approach and talk about it, 168 00:06:10,920 --> 00:06:12,860 but be prepared to get feedback on that 169 00:06:12,860 --> 00:06:15,040 and be prepared to maybe like 170 00:06:15,040 --> 00:06:16,040 and not like some of that feedback. 171 00:06:16,260 --> 00:06:18,000 So I'm really grateful for the feedback 172 00:06:18,000 --> 00:06:19,000 that we can get from this experience. 173 00:06:19,840 --> 00:06:21,600 But what I'd love to also hear 174 00:06:21,600 --> 00:06:23,220 from everyone in this room 175 00:06:23,220 --> 00:06:24,820 is actually a bit of a show of hands 176 00:06:24,820 --> 00:06:26,840 to see like what kinds of backgrounds are here. 177 00:06:27,520 --> 00:06:28,940 So would I be able to ask 178 00:06:28,940 --> 00:06:31,140 if anyone is from like a government administration, 179 00:06:31,520 --> 00:06:32,760 could I ask to put their hands up? 180 00:06:33,420 --> 00:06:33,860 Okay. 181 00:06:34,840 --> 00:06:35,680 One. Cool. 182 00:06:36,860 --> 00:06:39,380 And from members of the security research community, 183 00:06:39,600 --> 00:06:41,200 so I guess people would define as hackers. 184 00:06:43,160 --> 00:06:43,600 Okay. 185 00:06:45,220 --> 00:06:47,860 And curious as to other organizations 186 00:06:48,440 --> 00:06:50,920 or categories people would say 187 00:06:50,920 --> 00:06:53,060 what they're hoping to get out of this session. 188 00:06:55,820 --> 00:06:56,620 University academics. 189 00:06:56,960 --> 00:06:57,080 University academics. Okay. 190 00:06:57,720 --> 00:06:59,560 I don't think it would be out of this today. 191 00:07:00,820 --> 00:07:02,400 Okay. Cool. 192 00:07:04,100 --> 00:07:04,500 Consultants. 193 00:07:04,760 --> 00:07:05,900 Consultants. Okay. Great. 194 00:07:07,020 --> 00:07:07,940 Super. Thank you. 195 00:07:08,660 --> 00:07:10,500 All right. Cool. 196 00:07:12,940 --> 00:07:14,860 So do you want to add a bit more of a perspective? 197 00:07:16,400 --> 00:07:17,280 Yes. Yeah, yeah. 198 00:07:21,120 --> 00:07:22,740 So I am going to make some comments. 199 00:07:23,880 --> 00:07:26,300 About engaging with governments and policymakers 200 00:07:26,300 --> 00:07:29,220 from the hacker security research side of things. 201 00:07:29,460 --> 00:07:33,120 Now, one of the difficulties that I face 202 00:07:33,120 --> 00:07:34,500 trying to get more hackers involved 203 00:07:34,500 --> 00:07:36,360 and trying to get more security researchers involved 204 00:07:36,360 --> 00:07:39,480 is the length of time for the feedback loop, right? 205 00:07:39,560 --> 00:07:40,780 If I'm trying to break into a system, 206 00:07:40,940 --> 00:07:43,380 it's very, very quick feedback in terms of 207 00:07:43,380 --> 00:07:44,760 am I successful, am I failing? 208 00:07:44,900 --> 00:07:46,540 If I'm defending against an attack, 209 00:07:46,780 --> 00:07:48,420 it's very, very quick feedback loop. 210 00:07:48,600 --> 00:07:50,260 Am I successful, am I failing? 211 00:07:50,640 --> 00:07:52,000 If you're trying to put together 212 00:07:52,600 --> 00:07:54,520 a legal framework or a policy, 213 00:07:54,720 --> 00:07:57,740 especially one, I live in the EU, right? 214 00:07:57,780 --> 00:07:59,140 There's 27 countries there. 215 00:07:59,200 --> 00:08:00,600 There's a ridiculous amount of languages. 216 00:08:01,080 --> 00:08:03,140 Trying to get anything to happen there is a miracle. 217 00:08:03,300 --> 00:08:04,760 And the fact that it does is a testament 218 00:08:04,760 --> 00:08:06,620 to hard work from people involved. 219 00:08:07,020 --> 00:08:10,180 But normally, hackers, security researchers 220 00:08:10,180 --> 00:08:12,240 do not have the patience to sit there 221 00:08:12,240 --> 00:08:15,240 and see through four or five years of conversations. 222 00:08:16,960 --> 00:08:20,320 So where can we meaningfully engage those people? 223 00:08:20,500 --> 00:08:21,520 Where can we get their input? 224 00:08:21,520 --> 00:08:23,780 Where it has the most impact? 225 00:08:24,320 --> 00:08:26,600 Where can we make sensible use of their skills? 226 00:08:26,760 --> 00:08:28,480 And where is it important for them 227 00:08:28,480 --> 00:08:29,840 to share their knowledge and educate 228 00:08:29,840 --> 00:08:31,800 rather than physically get involved as well? 229 00:08:34,660 --> 00:08:35,640 Anything you want to add? 230 00:08:35,840 --> 00:08:36,680 Great, okay. 231 00:08:37,240 --> 00:08:40,080 So I think what I'd love to do is, 232 00:08:40,740 --> 00:08:43,860 I think we need to do is get some ideas 233 00:08:43,860 --> 00:08:45,680 of what kinds of questions people are thinking about 234 00:08:45,680 --> 00:08:49,260 and the kind of questions that we put together 235 00:08:49,260 --> 00:08:50,840 of how can we improve the relationships 236 00:08:50,840 --> 00:08:51,880 between security researchers 237 00:08:51,880 --> 00:08:53,320 and also with governments directly 238 00:08:53,840 --> 00:08:55,980 is understanding of what have been the experiences 239 00:08:55,980 --> 00:08:57,700 that people have had of working directly with governments, 240 00:08:57,840 --> 00:08:59,160 the good, the bad, the ugly, 241 00:09:00,100 --> 00:09:01,860 what prevented you from engaging 242 00:09:01,860 --> 00:09:03,280 with policymakers in the past, 243 00:09:03,480 --> 00:09:08,360 but also what you are looking for 244 00:09:08,360 --> 00:09:09,820 from security communities 245 00:09:09,820 --> 00:09:12,620 and how you can bring that into the way 246 00:09:12,620 --> 00:09:13,420 you develop your policy. 247 00:09:14,600 --> 00:09:18,120 I think that something that I am also really interested in 248 00:09:18,120 --> 00:09:20,440 is the effectiveness of some of these additional 249 00:09:22,840 --> 00:09:24,760 initiatives such as Hackers on the Hill 250 00:09:24,760 --> 00:09:25,740 or Hack the Capital 251 00:09:26,400 --> 00:09:28,400 or global forums that take place 252 00:09:28,400 --> 00:09:29,680 which have the stated objective 253 00:09:29,680 --> 00:09:31,480 to bring together people from different, 254 00:09:31,540 --> 00:09:32,720 and even DEFCON policy, 255 00:09:33,200 --> 00:09:34,840 bringing together these kinds of communities. 256 00:09:35,420 --> 00:09:37,780 What kinds of events specifically work? 257 00:09:38,020 --> 00:09:39,840 Have you seen actually be productive? 258 00:09:40,800 --> 00:09:43,840 Introductions or sandboxes 259 00:09:43,840 --> 00:09:45,500 or what kinds of things can people be doing 260 00:09:45,500 --> 00:09:46,800 to help engage that process? 261 00:09:47,200 --> 00:09:49,440 That's something that I really want to learn 262 00:09:49,440 --> 00:09:52,360 and to understand because I think from my experience 263 00:09:52,360 --> 00:09:55,820 I think there's a big spectrum across government. 264 00:09:55,960 --> 00:09:57,260 Some are more adaptive 265 00:09:57,260 --> 00:10:00,080 and some have a very strict series of processes 266 00:10:00,080 --> 00:10:02,840 and if you don't know how to access it 267 00:10:02,840 --> 00:10:04,480 or don't know who to access in particular, 268 00:10:05,480 --> 00:10:06,600 you're going to really struggle. 269 00:10:06,900 --> 00:10:08,960 So that's something that I'd love to hear 270 00:10:08,960 --> 00:10:10,160 from people in this room. 271 00:10:11,040 --> 00:10:14,700 So I think what I would love perhaps to do 272 00:10:14,700 --> 00:10:17,800 is if we maybe split into smaller groups. 273 00:10:17,860 --> 00:10:19,120 I think there's more people on this side 274 00:10:19,120 --> 00:10:19,420 than on this side. 275 00:10:19,440 --> 00:10:21,400 So some people want to move over to here 276 00:10:21,400 --> 00:10:23,480 and then perhaps we can spend 15, 20 minutes 277 00:10:23,480 --> 00:10:24,580 in front of one of these whiteboards 278 00:10:24,580 --> 00:10:26,340 just understanding what kind of it is 279 00:10:26,340 --> 00:10:28,380 to get together a bit of ideas 280 00:10:28,380 --> 00:10:29,900 answering some of these questions 281 00:10:30,340 --> 00:10:31,600 and gathering some of your insight 282 00:10:31,600 --> 00:10:32,660 because I think that's really where 283 00:10:32,660 --> 00:10:34,500 the purpose of the session on this one. 284 00:10:34,980 --> 00:10:35,640 Should we start there? 285 00:10:35,900 --> 00:10:36,040 Yeah. 286 00:10:36,320 --> 00:10:36,860 Okay, great. 287 00:10:36,960 --> 00:10:38,320 So should we move on this side 288 00:10:38,320 --> 00:10:38,940 and I'll take over here? 289 00:10:40,540 --> 00:10:40,900 Okay. 290 00:10:41,800 --> 00:10:44,040 Thank you very much for those conversations. 291 00:10:44,800 --> 00:10:46,200 Really grateful for those conversations 292 00:10:47,380 --> 00:10:48,600 and appreciative of time. 293 00:10:48,600 --> 00:10:49,780 And we've got about five minutes 294 00:10:49,780 --> 00:10:51,200 of scheduled allocated time left. 295 00:10:51,360 --> 00:10:53,760 So I'm just going to quickly summarize 296 00:10:53,760 --> 00:10:55,140 the conversation which we had over here. 297 00:10:55,560 --> 00:10:57,620 We came across a number of different themes, 298 00:10:57,860 --> 00:11:00,520 really came into challenging perceptions 299 00:11:00,520 --> 00:11:02,920 of hackers within organizations 300 00:11:04,160 --> 00:11:06,160 that can have quite antiquated views 301 00:11:06,160 --> 00:11:08,220 and I can totally assess, 302 00:11:08,340 --> 00:11:09,440 I can totally see that's something 303 00:11:09,440 --> 00:11:10,180 that it's come across. 304 00:11:10,580 --> 00:11:12,320 And we also talked about basically 305 00:11:12,320 --> 00:11:13,280 the need for translations, 306 00:11:13,620 --> 00:11:15,820 the need for translation between an organization 307 00:11:15,820 --> 00:11:18,500 which has potentially an old-fashioned view 308 00:11:18,500 --> 00:11:21,080 of this type of work 309 00:11:21,080 --> 00:11:22,520 and this type of skill set, 310 00:11:22,680 --> 00:11:24,920 but also how can we make it easier 311 00:11:24,920 --> 00:11:27,080 for that community to understand the way it works. 312 00:11:27,360 --> 00:11:28,940 And that was the thing that we talked about, 313 00:11:29,000 --> 00:11:31,280 the need for a potential structure 314 00:11:32,160 --> 00:11:34,200 where there could be a third party organization 315 00:11:34,200 --> 00:11:38,300 or safe space chance to bring that up 316 00:11:38,300 --> 00:11:40,380 and say these are the sort of challenges that we face 317 00:11:40,380 --> 00:11:42,920 and how we can really translate those challenges. 318 00:11:43,160 --> 00:11:45,200 I think we talked about the importance of communications 319 00:11:45,760 --> 00:11:47,660 and the importance of making sort of 320 00:11:48,140 --> 00:11:50,920 how can we support security researchers 321 00:11:50,920 --> 00:11:53,980 to get the top level of the key point 322 00:11:53,980 --> 00:11:55,660 so that it's coming across to ministers 323 00:11:55,660 --> 00:11:57,820 who perhaps don't have the time investment 324 00:11:57,820 --> 00:12:00,320 to be able to engage with it. 325 00:12:00,400 --> 00:12:01,440 So that was what we really came through. 326 00:12:02,700 --> 00:12:03,180 Excellent. 327 00:12:03,280 --> 00:12:05,880 So we've covered two pages. 328 00:12:06,120 --> 00:12:07,200 We got through a lot. 329 00:12:07,360 --> 00:12:09,760 So I'm going to pick out some key points 330 00:12:09,760 --> 00:12:10,620 that really stood out. 331 00:12:10,720 --> 00:12:12,100 So one of the things was 332 00:12:14,320 --> 00:12:16,820 getting the right experts involved 333 00:12:17,660 --> 00:12:18,980 and the difficulty in that 334 00:12:18,980 --> 00:12:22,820 in that the Donald Rumsfeld thing, right? 335 00:12:22,880 --> 00:12:23,400 Known unknowns. 336 00:12:23,480 --> 00:12:24,480 If you don't know technology, 337 00:12:24,880 --> 00:12:27,940 you don't know who you need to get in as an expert 338 00:12:27,940 --> 00:12:30,020 and therefore you can't get expert advice 339 00:12:30,020 --> 00:12:31,620 and you can't engage in the right people. 340 00:12:31,960 --> 00:12:33,700 And so therefore by default 341 00:12:33,700 --> 00:12:35,800 you're falling back on the usual government contractors 342 00:12:35,800 --> 00:12:38,180 and the usual industry lobbying organizations 343 00:12:38,180 --> 00:12:39,840 who are technology companies 344 00:12:39,840 --> 00:12:42,960 who may not necessarily be giving you the right advice 345 00:12:42,960 --> 00:12:44,200 you need to support society 346 00:12:44,200 --> 00:12:46,280 as opposed to industry. 347 00:12:47,700 --> 00:12:52,660 We also covered some talking about barriers, 348 00:12:52,880 --> 00:12:53,840 barriers to engagement, 349 00:12:54,000 --> 00:12:58,360 specifically around motive and consequences. 350 00:12:59,320 --> 00:13:01,580 So there's been lots of instances 351 00:13:01,580 --> 00:13:03,400 that people cited 352 00:13:03,400 --> 00:13:05,060 and that we've seen in the history of DEF CON 353 00:13:05,060 --> 00:13:05,860 and hacking as well 354 00:13:05,860 --> 00:13:08,280 where people would have reported a security incident 355 00:13:08,280 --> 00:13:09,940 or would have uncovered some research 356 00:13:09,940 --> 00:13:11,860 and they would have been punished for it. 357 00:13:12,000 --> 00:13:13,820 And that has a chilling effect 358 00:13:13,820 --> 00:13:15,460 on people wanting to share stuff 359 00:13:15,460 --> 00:13:16,160 especially 360 00:13:16,280 --> 00:13:17,620 when we look at things like 361 00:13:17,620 --> 00:13:18,640 critical national infrastructure, 362 00:13:19,020 --> 00:13:20,640 when we look at IOT solutions, 363 00:13:21,180 --> 00:13:23,780 when we talk about core bits of stuff 364 00:13:23,780 --> 00:13:25,640 that keep our society going. 365 00:13:26,000 --> 00:13:27,400 And it is a, 366 00:13:29,120 --> 00:13:31,420 to use your phrase, 367 00:13:31,560 --> 00:13:32,940 trying to find a safe space 368 00:13:32,940 --> 00:13:35,080 where you can engage and say 369 00:13:35,080 --> 00:13:36,740 we have found these issues, 370 00:13:36,880 --> 00:13:37,940 we have found these problems, 371 00:13:38,200 --> 00:13:40,480 we are reporting them 372 00:13:40,480 --> 00:13:42,040 and talking about them in good faith. 373 00:13:42,280 --> 00:13:43,700 So having that, 374 00:13:44,560 --> 00:13:45,220 you know, 375 00:13:45,220 --> 00:13:48,120 the usual law enforcement mechanism of react 376 00:13:48,120 --> 00:13:50,520 and then deal with the fallout later on, 377 00:13:50,640 --> 00:13:53,320 consider motive after the action has been taken, 378 00:13:53,520 --> 00:13:54,640 you know, having a safe space 379 00:13:54,640 --> 00:13:56,420 where you can consider motive up front, 380 00:13:57,480 --> 00:13:58,560 especially it's because, 381 00:13:58,620 --> 00:13:59,180 you know, 382 00:13:59,220 --> 00:14:00,380 the security researchers 383 00:14:00,380 --> 00:14:01,760 who are coming forwards 384 00:14:01,760 --> 00:14:03,000 with some of these vulnerabilities 385 00:14:03,000 --> 00:14:04,240 on key systems 386 00:14:04,240 --> 00:14:06,320 that may impact national security, 387 00:14:06,820 --> 00:14:09,020 they're not the only people who are finding this stuff. 388 00:14:09,280 --> 00:14:10,660 There are lots of other people 389 00:14:10,660 --> 00:14:11,600 who are adversarial 390 00:14:11,600 --> 00:14:13,120 who are not telling you about this. 391 00:14:13,300 --> 00:14:15,200 So how do we get past that? 392 00:14:15,200 --> 00:14:16,280 And have, as you say, 393 00:14:16,320 --> 00:14:17,600 a safe space where people engage. 394 00:14:19,260 --> 00:14:20,640 We also spoke about 395 00:14:21,200 --> 00:14:23,980 the difficulty and the barriers 396 00:14:23,980 --> 00:14:26,100 of talking to the right people. 397 00:14:26,280 --> 00:14:27,620 So, you know, 398 00:14:28,120 --> 00:14:29,700 not just educating legislators 399 00:14:29,700 --> 00:14:31,220 but finding people 400 00:14:31,220 --> 00:14:32,840 who actually want to do stuff 401 00:14:32,840 --> 00:14:35,460 and are empowered to do stuff 402 00:14:35,900 --> 00:14:37,520 and are willing to do stuff, 403 00:14:37,740 --> 00:14:40,540 but also setting expectations correctly. 404 00:14:40,860 --> 00:14:43,940 You know, it's putting something from 405 00:14:43,940 --> 00:14:44,880 this is a problem 406 00:14:44,880 --> 00:14:46,360 through to this is a law 407 00:14:47,200 --> 00:14:48,620 takes a long time 408 00:14:48,620 --> 00:14:51,040 and it takes a huge amount of effort and commitment 409 00:14:51,040 --> 00:14:55,240 and expecting security research and hackers 410 00:14:55,240 --> 00:14:57,140 to be involved in that entire process 411 00:14:57,140 --> 00:14:58,280 is just not going to happen. 412 00:14:58,500 --> 00:14:59,960 So where can we get them involved 413 00:14:59,960 --> 00:15:01,860 in key stages to help define, 414 00:15:02,080 --> 00:15:02,660 to help steer, 415 00:15:02,860 --> 00:15:03,620 to help give input, 416 00:15:03,860 --> 00:15:05,280 but actually have people 417 00:15:05,280 --> 00:15:06,960 whose focus is on creating 418 00:15:06,960 --> 00:15:08,300 this legislative framework 419 00:15:09,080 --> 00:15:11,460 have them focus on what they're good at 420 00:15:11,460 --> 00:15:13,060 and have them use hackers 421 00:15:13,060 --> 00:15:14,020 and security researchers 422 00:15:14,020 --> 00:15:14,760 and what they're good at. 423 00:15:15,400 --> 00:15:16,900 And there's a bunch of other useful stuff 424 00:15:16,900 --> 00:15:18,580 and we'll be typing this up 425 00:15:18,580 --> 00:15:20,200 and sharing it later on. 426 00:15:20,320 --> 00:15:21,960 But one of the things 427 00:15:21,960 --> 00:15:23,340 that's very close to my heart, 428 00:15:23,440 --> 00:15:24,540 being self-employed 429 00:15:24,540 --> 00:15:26,480 and a couple of people touched on it as well, 430 00:15:26,640 --> 00:15:29,060 is cash, right? 431 00:15:29,740 --> 00:15:31,720 Security expertise is not cheap. 432 00:15:31,920 --> 00:15:33,360 And we found this in industry 433 00:15:33,360 --> 00:15:35,420 that the organizations in industry 434 00:15:35,420 --> 00:15:37,300 who tend to have the best security 435 00:15:37,300 --> 00:15:38,220 are the ones who said 436 00:15:38,220 --> 00:15:41,820 this is a business resilience issue. 437 00:15:41,940 --> 00:15:42,880 This poses a threat 438 00:15:43,060 --> 00:15:44,260 to our continued business function 439 00:15:44,260 --> 00:15:45,780 and therefore it's acceptable 440 00:15:45,780 --> 00:15:47,320 to spend X amount of our profit 441 00:15:47,320 --> 00:15:48,760 on getting the best security people 442 00:15:48,760 --> 00:15:51,060 testing that, utilizing it. 443 00:15:51,900 --> 00:15:57,700 There is an unfair distribution of funds, 444 00:15:57,780 --> 00:15:59,140 shall we say, across governments 445 00:15:59,140 --> 00:16:02,040 and you only need to walk down the street 446 00:16:02,040 --> 00:16:03,160 and look at the mess of the roads 447 00:16:03,160 --> 00:16:04,720 outside in Las Vegas 448 00:16:04,720 --> 00:16:06,740 to understand that money is not being spent 449 00:16:06,740 --> 00:16:08,640 on maintaining basic transport 450 00:16:08,640 --> 00:16:10,420 and yet defense budgets 451 00:16:10,420 --> 00:16:12,040 and policing budgets are through the roof. 452 00:16:12,160 --> 00:16:13,040 So there does need to be 453 00:16:13,060 --> 00:16:15,180 a shift in terms of everyone says 454 00:16:15,180 --> 00:16:16,180 this is a real problem. 455 00:16:16,420 --> 00:16:16,900 Brilliant. 456 00:16:17,060 --> 00:16:18,720 Put your money where your mouth is. 457 00:16:18,940 --> 00:16:20,880 Start showing that you're taking it seriously 458 00:16:20,880 --> 00:16:22,040 by allocating budget, 459 00:16:22,380 --> 00:16:24,120 empowering people to spend money, 460 00:16:24,320 --> 00:16:26,500 bring the best people to the table as well. 461 00:16:28,460 --> 00:16:29,160 Thank you. 462 00:16:30,040 --> 00:16:31,880 I'm afraid that that's all the time 463 00:16:31,880 --> 00:16:32,880 we have for this session. 464 00:16:33,000 --> 00:16:34,620 But thank you all very, very much. 465 00:16:34,780 --> 00:16:37,020 And that was, you know, 466 00:16:37,020 --> 00:16:37,660 a very provocative 467 00:16:37,660 --> 00:16:40,200 and very interesting chats here. 468 00:16:41,460 --> 00:16:44,660 As Tom said, we will need to be writing this up. 469 00:16:44,700 --> 00:16:45,760 We'll have a conversation after this. 470 00:16:46,060 --> 00:16:47,000 Please do feel free, 471 00:16:47,040 --> 00:16:48,540 if you'd like to get in touch with me directly, 472 00:16:48,800 --> 00:16:49,860 I'm happy to give out 473 00:16:49,860 --> 00:16:50,680 your business cards with me 474 00:16:50,680 --> 00:16:52,820 and more than happy to try and signpost 475 00:16:52,820 --> 00:16:53,820 the right kind of policymakers 476 00:16:53,820 --> 00:16:55,560 to help demystify this a bit more. 477 00:16:56,480 --> 00:16:58,380 And looking forward to more future discussions. 478 00:16:58,660 --> 00:16:59,420 So thank you very much. 479 00:16:59,500 --> 00:17:00,620 Yeah, thank you very much.