WEBVTT 00:00.000 --> 00:04.000 If you flew out to DEFCON, you certainly interacted with someone at TSA. 00:04.000 --> 00:13.920 But do you really know who TSA is, and what those employees and many more really do to maintain the safety and security of our nation's aviation, surface, and space systems? 00:14.240 --> 00:19.960 In this fireside chat with David Pekoske, you'll hear it straight from the administrator himself. 00:20.080 --> 00:33.440 He'll cover the TSA's role among many government agencies addressing these issues, and how TSA partners with hackers to maintain the trust we all have in these vital systems and build a more resilient transportation system. 00:33.700 --> 00:35.680 All right, thank you. 00:39.520 --> 00:45.740 I want to complain and be unhappy for the 30-minute flight, but these are pretty darn comfortable. 00:45.960 --> 00:47.440 But you had no waiting. 00:47.440 --> 00:50.620 Yes, I think it was the boarding process that made it that much simpler. 00:50.960 --> 00:52.860 Well, thank you all for being here. 00:52.860 --> 00:56.260 For those of you who don't know, my name is Steve Luzinski. 00:56.260 --> 00:57.900 I am part of the Aerospace Village. 00:57.900 --> 01:06.460 I'm the board chairman working on the nonprofit side with the smart volunteers that you see around here who are running everything you're seeing today at the village. 01:06.460 --> 01:08.580 And we are very happy. 01:09.680 --> 01:16.140 I have the privilege of having David Pekoske, and I practiced that because Luzinski. 01:16.140 --> 01:17.220 I didn't want to screw that up. 01:17.220 --> 01:26.140 So David Pekoske, TSA administrator with us today, share his thoughts, perspectives on the work that they're doing in the aerospace sector. 01:26.140 --> 01:31.760 So thinking about both aviation that we typically think about, but there's also space elements and more. 01:31.760 --> 01:34.440 So, again, I appreciate y'all's time coming here. 01:34.720 --> 01:42.680 For those of you who don't know your full background, I will throw out the distinguished career in the U.S. 01:42.680 --> 01:48.480 Coast Guard, ending with being the 26th Vice Commandant of the U.S. 01:48.480 --> 01:53.820 Coast Guard, followed by moving over to TSA as the 7th Administrator. 01:53.840 --> 02:01.300 60,000 people across TSA, and has been serving in that role for some time now. 02:01.300 --> 02:02.600 And so thank you for being here. 02:02.600 --> 02:04.520 I really appreciate having you on stage. 02:04.520 --> 02:04.580 Thanks , Steve . 02:04.580 --> 02:05.340 Great to be here. 02:05.340 --> 02:06.100 Absolutely. 02:07.000 --> 02:20.800 So, you know, I've been thinking about this, and as we've been coordinating, and I want to come up with this big, fancy, you heard in the introduction, we think about TSA, we think about, well, what do they do? 02:20.800 --> 02:24.500 It's like, well, it's just the blue shirt screeners, and I know there's more. 02:24.500 --> 02:39.180 So I want to start off with getting a better idea of why, beyond just that part of aviation, what's the full extent of what TSA does, so we understand that background and context in this discussion. 02:39.180 --> 02:40.560 Okay, great question. 02:40.560 --> 02:45.680 And, you know, TSA is the Transportation Security Administration, not the Aviation Security Administration. 02:45.680 --> 02:50.080 So that tips off that, hey, there's a lot more to this than aviation. 02:50.080 --> 02:53.360 But aviation is by far the biggest aspect of what we do. 02:53.360 --> 03:01.080 And, Steve, to your point, what you see in screen checkpoints is the most resource-intensive and people-intensive part of our operation. 03:01.120 --> 03:08.020 But we also have a significant role in air cargo security, in aviation security within the airport environment. 03:08.020 --> 03:18.540 We do a tremendous amount of work on the intelligence and analysis side, the vetting side for all the passengers that go through our screening process or transit through U.S. 03:18.580 --> 03:19.600 airspace. 03:19.600 --> 03:26.740 Additionally, we have a good number of people assigned overseas because we're a presence in many, many embassies around the world. 03:26.740 --> 03:36.020 We inspect last-point-of-departure airports, those airports that have a direct flight to the United States, to make sure they're complying with the requirements that we have put in place. 03:36.020 --> 03:40.080 And, importantly, we have a role in surface transportation security. 03:40.080 --> 03:58.060 And if you think back to the Department of Transportation, if you go back to 2001, pre-911, the DOT had a number of modal administrations, like the Pipeline and Hazardous Materials Safety Administration, like the Federal Railroad Administration, like the Federal Aviation Administration. 03:58.060 --> 04:09.540 When 9-11 happened and TSA was established in law, the Secretary of Transportation, Norm Mineta, literally took the security functions of all those modes and moved them over to TSA. 04:09.540 --> 04:17.400 So one of the things that TSA has responsibility for is security for pipelines in the United States, oil and natural gas pipelines. 04:17.400 --> 04:19.760 Most people wouldn't assume that. 04:19.760 --> 04:22.320 Or for train systems, mass transit systems. 04:22.320 --> 04:39.840 So the remit is quite large and getting larger all the time because, as you may have seen, we have gotten into the cybersecurity regulation end of our responsibilities, and that really started off in pipelines following the May 2021 ransomware attack of an East Coast pipeline. 04:39.840 --> 04:43.620 So really, it's a big agency, a lot of scope. 04:43.620 --> 04:52.440 What I would offer to all of you at the very beginning of our talk this afternoon is, I'm here and I've got about 30 of my colleagues here at DEF CON. 04:52.440 --> 04:53.700 It's my first time. 04:53.700 --> 04:56.280 For many of my colleagues, it's not their first time. 04:56.280 --> 05:01.740 And what we endeavor to do is to really solicit your help and your expertise. 05:01.740 --> 05:11.400 We're doing a lot of work where we could use another perspective, another point of view, to make sure that we're looking at things in a comprehensive and complete way. 05:11.400 --> 05:28.320 And so as we look at cybersecurity, for example, and I'll talk a little bit more about that later on, but we've changed the way we approach our relationship with the stakeholders, with the regulated parties that exist in the surface transportation and the aviation systems. 05:28.320 --> 05:46.100 We really need your help in helping us define risk and scenarios for cybersecurity because you're in a better position, I think, than certainly I am and than most to say, hey, if I wanted to get into this system, how would I do it? 05:46.100 --> 05:50.860 And we want to make sure that we understand that perspective, benefit from your expertise. 05:51.000 --> 05:56.960 The other thing is that you all represent a lot of talent, and TSA is hiring talent. 05:56.960 --> 06:03.200 So if you go to our booth over in the exhibit hall, you'll see a TSA booth there. 06:03.200 --> 06:07.160 And really, if you're interested in a position, please visit that booth. 06:07.160 --> 06:11.800 There's a quick QR code that will take you right to our open job positions. 06:11.800 --> 06:16.480 And I will tell you, as Steve mentioned, I've been in TSA now for six years. 06:16.480 --> 06:19.200 I spent 33 years in the Coast Guard. 06:19.200 --> 06:22.280 Both tremendous organizations. 06:22.280 --> 06:26.960 I enjoyed immensely my time on active duty in the Coast Guard. 06:26.960 --> 06:30.320 I really, really, really enjoy working in TSA. 06:30.320 --> 06:39.380 I work with an incredible team of people all around the country, all around the world, and we do meaningful national security work every single day. 06:39.400 --> 06:45.760 One of the things that sometimes you hear is, well, TSA really isn't detecting everything. 06:45.760 --> 06:50.300 Let me tell you, we are detecting a lot every single day. 06:50.400 --> 07:02.200 And I know that the aviation system is much more secure as a result of our efforts and getting more and more secure each and every day as we bring more technology into our operation. 07:02.200 --> 07:07.360 And we'll talk about a couple of our technology initiatives where you can also be a tremendous help for us. 07:07.360 --> 07:11.400 So please, we're looking for your expertise to advise us. 07:11.400 --> 07:17.140 And we're open to any opportunities you see that might fit your own personal needs. 07:17.140 --> 07:27.720 And, hey, I think it's a really good thing for somebody to have some time in government, particularly in an agency that I think is one of the most agile agencies in the government. 07:27.720 --> 07:29.400 There are many that I would put in that category. 07:29.400 --> 07:35.300 I would put us up there as well because we've done some pretty incredible things in relatively short time. 07:35.300 --> 07:38.440 And oftentimes very visible to passengers. 07:38.440 --> 07:40.940 So that's a quick thumbnail. 07:40.940 --> 07:41.180 Thanks. 07:41.180 --> 07:42.140 That's awesome. 07:42.140 --> 07:53.940 And one of the other things in learning, because of the work that I do at the village and talking to your folks, all of those things, and there's still a spaceport element to all of that because that is new and emerging. 07:53.940 --> 07:59.260 So think of all those aviation issues and add the space part of it that's growing. 07:59.800 --> 08:16.240 One of the things, having been in government, worked at the Pentagon while I was in the military, but then also working at CISA, looking at these aviation cyber issues, if you could give a brief, what is the difference in roles and responsibilities? 08:16.440 --> 08:18.200 Because we don't think of TSA. 08:18.640 --> 08:20.160 We think of FAA. 08:20.220 --> 08:23.700 Or we may think of all the things that CISA is known for. 08:23.700 --> 08:30.240 How are the three of you dividing up where you have those shared equities when it comes to aviation and space cybersecurity? 08:30.260 --> 08:30.820 Thanks. 08:30.820 --> 08:39.200 And actually, I would add a fourth, and that would be the FBI, with the great work that FBI does in cybersecurity and investigating cyber incidents. 08:39.800 --> 08:59.060 When I talked about the Department of Transportation modes and them retaining safety responsibility and then us picking up the security responsibility from them, many, many times when you look at an issue and you look at it, something's going on, some particular process you're looking at or some technology you're looking at, 08:59.060 --> 09:03.520 that technology oftentimes has both a safety and a security impact to it. 09:03.520 --> 09:09.780 And so we want to make sure that we're very, very closely connected to our safety co-sector risk management agencies. 09:09.780 --> 09:17.420 So an SRMA is an agency that has regulatory authority for elements of the critical infrastructure in the country. 09:17.420 --> 09:23.040 So for aviation, the FAA and TSA are the co-sector risk management agencies. 09:23.040 --> 09:30.420 For rail systems, for example, TSA and FRA are the co-sector risk management agencies. 09:30.420 --> 09:40.400 CISA, relatively new as CISA, but really not new necessarily because they were largely in existence, although not quite to the degree they are today. 09:40.400 --> 09:52.760 In the Department of Homeland Security's structure, they just moved over to an independent agency, has been an incredible partner for us as a source of expertise, as a source of looking at cross-sector issues. 09:52.760 --> 09:54.780 I look at the transportation sector. 09:54.960 --> 10:00.460 The transportation sector relies on the electricity sector for a lot of its support. 10:00.460 --> 10:03.800 And so we need to make sure that we're looking at cross-sector issues as well. 10:03.800 --> 10:05.520 That's where CISA comes into play. 10:05.520 --> 10:15.940 And CISA is an agency that can provide help, advice, context to owners and operators of critical infrastructure in the country. 10:16.780 --> 10:28.300 Relatively new but incredibly valuable role, particularly nowadays where cyber is much more in the forefront of owners and operators' calculations with respect to the operations of their companies. 10:28.840 --> 10:34.340 And then finally, the FBI does investigations of cyber incidents and does victim notifications. 10:34.340 --> 10:41.360 And that's an important thing that all of the sector agencies that I mentioned are really closely aligned with each other. 10:41.360 --> 10:58.320 Last thing I would say is that as we look at response to an incident as an agency, one of the things that we're all trying to do very, very hard is to present more of a unified position to the owner and operator of a piece of critical infrastructure. 10:58.320 --> 11:10.020 You can imagine if you are attacked and you're dealing with several different agencies, and they're all calling you at different times, asking sometimes the same question or somewhat different questions. 11:10.020 --> 11:13.120 And in your mind, they're not coordinating with each other. 11:13.120 --> 11:20.200 That's creating for you a lot more work, and it's taking you away from the response to the incident that you're facing. 11:20.200 --> 11:25.880 So part of what we are doing very diligently now is making sure that we coordinate amongst the agencies. 11:25.880 --> 11:39.160 I think a really good example of that is when we issued our cyber regulations across the sector, the reporting for a significant cyber incident, which is required by our regulations, doesn't come to TSA. 11:39.160 --> 11:40.200 It goes to CISA. 11:40.360 --> 11:44.360 And then CISA sends it out to, in the case of aviation, they would send it out to the FAA. 11:44.360 --> 11:45.860 They would send it out to the FBI. 11:45.860 --> 11:58.060 They would make sure that everybody who had an equity in the issue was getting, importantly, the same information, stated the same way, so that there's no daylight between reporting at the same time. 11:58.060 --> 12:00.240 That's really, really valuable to all of us. 12:01.240 --> 12:08.040 So in the context of these things that you're doing, if you could provide some more detail, I think that would help. 12:08.220 --> 12:13.660 What's driving these what seem like new actions that I think the public's seeing? 12:13.660 --> 12:16.880 And then what are those? 12:16.880 --> 12:18.540 What's the objective? 12:18.540 --> 12:19.920 What's the full extent? 12:19.920 --> 12:25.620 Because there are so many things and initiatives that you all are enacting, I think that'd be very useful for everyone. 12:25.660 --> 12:25.960 Sure. 12:25.960 --> 12:29.040 And what's driving it is the intelligence information we have. 12:29.040 --> 12:30.640 And it's significant. 12:30.640 --> 12:31.800 It's concerning. 12:32.000 --> 12:34.700 I've issued emergency amendments. 12:34.700 --> 12:40.080 You don't issue an emergency amendment to a security plan unless you feel like we're in an emergency situation. 12:40.080 --> 12:42.840 So the intelligence is compelling. 12:42.840 --> 12:44.060 It's consistent. 12:44.060 --> 12:47.800 It's getting consistently more concerning over time. 12:47.800 --> 13:00.260 And one of the things that we did, and I think that it's really important for any government entity to be viewed by the American public and by the companies that we work with as a trusted partner. 13:00.260 --> 13:04.120 Being a trusted partner means that you share as much information as you can. 13:04.120 --> 13:06.140 You share it in a timely manner. 13:06.160 --> 13:13.880 And you respect company proprietary information when you're receiving information from that particular owner and operator. 13:13.880 --> 13:30.340 One of the things we did when we first went down this journey to increase cyber preparedness and cyber resiliency was to bring the CEOs of the companies that we regulate in for a high-level classified briefing on the why. 13:30.340 --> 13:43.380 Why were we about to ask you to do certain things in a relatively quick fashion, generally inside your own company budget cycle, so we shored up some vulnerabilities that we thought were incredibly concerning. 13:43.380 --> 13:49.680 Some CEOs looked at that and said, hey, you really need to talk to my CIO, not to me. 13:49.680 --> 13:51.840 And we said, oh, we will talk to your CIO. 13:51.860 --> 14:03.120 We just wanted you to have the context before we had that conversation, because your CIO most assuredly will be coming to you with a request for resources, for policy changes, things of that nature. 14:03.120 --> 14:12.620 But what we did, and I would credit the industry and our partners for helping us with this in a really substantial way. 14:12.620 --> 14:19.820 When we first started out with cybersecurity regulation, we did what we have been doing for 22-plus years. 14:19.820 --> 14:23.380 Other agencies have been doing for hundreds of years in regulations. 14:23.380 --> 14:31.360 And what I mean by that is you see a problem, you try to make sure that problem doesn't recur again or anything similar to it. 14:31.360 --> 14:38.080 And so you require a whole host of activities to be performed by the party that you regulate. 14:38.080 --> 14:40.500 We initially did that with pipelines. 14:40.520 --> 14:48.480 And the pipeline industry, which was not regulated by us previously, asked us to take another look at that. 14:48.480 --> 14:55.980 They thought that they were being asked to replace what they thought were really good mitigation measures with the specific ones that we were requiring. 14:55.980 --> 15:04.840 So in some cases, their feeling was that we would actually be taking a step backward in security, not a step forward. 15:04.840 --> 15:12.700 Many, many companies, whether it's in aviation or surface, also said, hey, listen, my business operates in a certain way. 15:12.700 --> 15:23.360 You probably don't really fully understand how my business operates, but I'm willing to achieve whatever end goal you want, but I want to have some flexibility in how I get to that point. 15:23.360 --> 15:31.940 And so what we did for the first time in our history, something that's called for in the national cyber strategy, is we went to a performance-based regulation. 15:31.940 --> 15:41.340 So rather than say and do all these specific things, we said, hey, these are four outcomes in cybersecurity we'd like you to achieve. 15:41.340 --> 15:52.400 Come back to us with a plan within a certain amount of time that will tell us how you, an individual owner-operator, is going to achieve that particular set of outcomes. 15:52.480 --> 15:57.120 And so these cybersecurity implementation plans were all submitted to us. 15:57.120 --> 15:59.520 We looked at them, kind of went back and forth a little bit. 15:59.520 --> 16:03.840 In some cases, in other cases, they were very comprehensive when we approved them. 16:03.840 --> 16:09.820 We finally, on the pipeline side, because that's the furthest ahead in all this, approved all these cybersecurity implementation plans. 16:09.920 --> 16:26.240 But the next step was, and this is an area, too, where you can be of tremendous assistance to us, is when you go to an outcome-based system, you have to be able to objectively conclude that the outcomes you have established are being achieved. 16:26.240 --> 16:40.100 And that can't be just a simple roll-up of all the activities that are being performed, because those activities are certainly just that, they're activities, but are they actually contributing to the achievement of the outcome and to what level? 16:40.100 --> 16:44.640 So we require what are called capability assessment plans. 16:44.640 --> 16:55.280 Basically, you take your implementation plan and then tell us how you're doing against that plan, and then, importantly, how that collectively is doing against the outcome. 16:55.280 --> 17:08.020 And so one of the things that's really important in looking at outcome achievement is, one, prioritizing the threat, because when you're looking at an outcome, some threats are going to be ones that you want to make sure that you've addressed more so than others. 17:08.020 --> 17:23.660 So prioritizing the threats and then looking at different scenarios that are very realistic, that all of you would have a very good idea of what some of those would look like, given your work in hacking or hacking research. 17:23.660 --> 17:40.680 For example, if I wanted to hack into an aviation, let's say an airport badging system, how would I do it and develop a scenario that would allow us to test that with individual owners and operators so that we can kind of look across the sector and say, 17:40.680 --> 17:50.600 hey, to be able to control access, this is how you're doing based on a very realistic and high-priority scenario that you've given us assistance in providing. 17:50.600 --> 17:51.860 So we have a project. 17:51.860 --> 17:53.780 It's called Project Chariot. 17:54.160 --> 17:56.920 Chariot as in the horse-drawn chariots. 17:56.920 --> 18:01.860 Kind of appropriate because we're here at CSER, so it's in the moment, if you will. 18:02.680 --> 18:12.820 But Chariot stands for Critical Infrastructure Hardening Achieved Through Risk Reduction in Information and Operational Technology. 18:13.160 --> 18:27.340 And this project is a project that's between the Department of Science and Technology Directorate, our team at CISA, as well as, in the case of pipelines and rail, FRA and PHMSA. 18:27.380 --> 18:39.420 We're working with the Pacific Northwest National Laboratory to really look at, hey, if we prioritize risk, what would that risk prioritization look like from an objective standpoint? 18:39.440 --> 18:54.320 And then secondly, working with all of you, validating that and saying, hey, I see that, you know, given my ease of being able to access some systems, for example, or when I do what I see and what potential might be there, I might change that priority. 18:54.320 --> 19:09.000 But then give us some scenarios, like I said earlier, that are realistic scenarios, because we want to test those scenarios with each owner and operator to see how they perform against those scenarios to really be able to answer this very simple question. 19:09.000 --> 19:17.040 If this specific company is the subject of a successful cyber attack, how well are they equipped to be able to respond to that? 19:17.040 --> 19:22.560 And how well are they equipped to be able to prevent most of the attack from affecting them? 19:22.560 --> 19:42.980 And so your perspective, your help, is going to be valuable, not just to us, but to those owners and operators as well, because they're looking at their own team, they've contracted, I'm sure, with other countries, but getting that additional validation there will make us all feel much more confident that what we're doing is really the right thing to do to protect this critical infrastructure. 19:44.340 --> 19:57.300 One of the things I know, when I was working with Tim and the idea of having you up here and bringing you in for the talk, that was very interesting, just the simple question, why is TSA here? 19:57.440 --> 20:03.660 And you covered that a little bit before, but I think the important part is the background is not just the why. 20:03.660 --> 20:09.720 There are plenty, what we've seen, just the work that the village does, the aerospace village. 20:09.720 --> 20:16.540 We've seen the changing attitudes where government and industry, why would I go talk to those hackers? 20:16.540 --> 20:18.480 Why would I talk to somebody dressed like that? 20:18.480 --> 20:26.520 All that kind of stuff that, in some respects, it's true, but the stereotypes are on both sides. 20:26.520 --> 20:27.600 Why would government be there? 20:27.600 --> 20:31.140 Why would I go listen to government come up and do this? 20:31.140 --> 20:49.480 And so what I'm interested in is your thoughts on, as we see this changing attitude, and clearly it looks like exactly what you all are thinking too, how are you trying to engage, other than coming to events like this, what are the other things that you all are doing to make sure you're able to reach, 20:49.480 --> 20:52.760 to get past those stereotypes and dispel those rumors? 20:53.160 --> 20:55.840 The first is, why are you doing it? 20:55.840 --> 20:57.420 I would come back and say, why not? 20:57.420 --> 20:59.160 You've got all this talent. 20:59.160 --> 21:00.140 Why would you not? 21:00.140 --> 21:03.960 Because you're going to come up with a less perfect solution. 21:03.960 --> 21:12.500 Not that any solution is perfect, but if you don't tap all the talent that's available, you're not going to be doing the best job that you can. 21:12.680 --> 21:34.040 Secondly, the how and how this gets sustained is, I think events like this are the beginning of building trust, of understanding better how you see things, you understanding better how I see things, really establishing that personal relationship, starting to build that trust, 21:34.040 --> 21:44.060 so that when things come up, we feel like we can actually have a good conversation, where we can share some information that's of incredible value to both of us. 21:44.060 --> 21:54.340 The other thing, and I hope you've noticed this when you've gone through our screening checkpoints, is we're working really hard to embed more technology into the work we do in our screening checkpoints. 21:54.340 --> 22:05.420 You see the new credential authentication technology, that technology where, rather than having somebody actually look at your driver's license, it goes into a machine that validates its authenticity. 22:05.600 --> 22:19.420 One of the things that always concerned me when I first got into this job, and even beforehand, was I'd hand off to the TSA officer my driver's license, let's say back in 2020, or even a little bit earlier than that, I'd hand them off the driver's license, 22:19.420 --> 22:25.540 and they would actually physically look at it and try to verify that that's a valid, whatever state you have a driver's license in. 22:25.540 --> 22:43.560 I don't know how you possibly do that across 56 states and territories and be accurate all the time, or you're looking at a very small photograph and visually trying to compare the two, and people's facial features can change to a degree over time, licenses last for eight years, 22:43.560 --> 22:46.540 and a technology assist on that would be hugely beneficial. 22:46.640 --> 23:03.600 Additionally, when the pandemic hit, we wanted to reduce the amount of physical contact that we had with anything that was owned by a passenger or with the passenger themselves, because in the pandemic, everybody was trying not to have physical contact to the greatest extent we possibly could. 23:03.600 --> 23:08.600 Inserting your own card into the machine is a way to do that, but there's a better way. 23:08.600 --> 23:27.160 You can download, in many states now, your driver's license into your Apple wallet, your Google wallet, your Samsung wallet, and then use that digital ID, which is a different kind of transmission, much more secure to our technology, and has some significant privacy benefits to it, 23:27.160 --> 23:39.280 because it shows you, when you pull up your mobile driver's license, exactly what fields in your driver's license that we are going to look at with your driver's license. 23:39.520 --> 23:49.420 Before, I've had some people say, I think you're tracking my movement in terms of home addresses, because I know you're ingesting my home address every time you look at my driver's license. 23:49.420 --> 23:52.860 We never did, but at least this way, you get to see it for sure. 23:52.860 --> 23:59.440 So getting to digital identification, and then eventually to biometric identification, is really where we want to go. 23:59.800 --> 24:02.920 Biometrics is an area that we could use your help in. 24:02.920 --> 24:06.080 How do we make sure the biometric system is secure? 24:06.080 --> 24:14.940 How do we make sure that the biometric system does not disadvantage any demographic group that travels through our system in any way, shape, or form? 24:15.040 --> 24:17.960 We've done a lot of great work on biometrics. 24:17.960 --> 24:28.580 They are much more accurate than a human verification of identity in our own testing, and in testing done by the Science and Technology Directorate in the department. 24:28.740 --> 24:32.760 They're also much more efficient, and we don't transmit that data anywhere. 24:32.760 --> 24:34.360 It stays right on that machine. 24:34.360 --> 24:40.120 As soon as you, as a passenger, leave, and the next passenger begins their process, your data is erased. 24:40.120 --> 24:40.880 We don't keep it at all. 24:40.880 --> 24:42.140 It never leaves that machine. 24:42.240 --> 24:46.020 So that's an area where we could use some help and advice. 24:46.060 --> 24:58.500 The other thing that we're doing is we'd really like to get to the point where all of our technology is developed using open architecture principles and have open architecture requirements in our contracting vehicles. 24:58.500 --> 24:59.840 Because think of this. 25:00.340 --> 25:09.940 If you look at those big x-ray machines in our screening checkpoints, the original equipment manufacturer owns all the software that's in those x-ray machines. 25:10.340 --> 25:18.200 Whenever we want to make a change, we can only go to those vendors, and they're looking at the entire code set whenever we're making a change. 25:18.200 --> 25:21.360 It takes a lot longer to get changes put in place. 25:21.400 --> 25:35.700 You all might remember about three or four years ago, we had a threat stream that talked about people attempting to bring large quantities of powders onto aircraft and then mixing them with liquids and have it gas off and create a toxic environment. 25:35.700 --> 25:42.320 So we needed to detect large quantities of powders, and so we had passengers take out powders out of their carry-on bags. 25:42.320 --> 25:51.920 A much better way would be just to add a software layer onto our existing software technology for detection and have it detect that particular threat. 25:51.920 --> 26:04.160 So if you think of how agile we have to be, whenever you need to be agile, having to revert to a manual process for a long period of time is not good for passengers. 26:04.460 --> 26:06.460 It's really not good for us. 26:06.580 --> 26:12.420 So open architecture is another thing that we're very, very interested in and want to move forward on. 26:12.420 --> 26:23.900 So those are just a couple of examples of things that, from a technology perspective and from making it as error-free and as cyber-secure as we possibly can. 26:23.900 --> 26:28.960 And then the elephant that you talk about a lot here is artificial intelligence. 26:29.140 --> 26:32.640 Think about when you go through a screening checkpoint. 26:32.640 --> 26:36.660 First off, you see officers sitting next to every single x-ray machine. 26:36.660 --> 26:41.740 There's no technological reason why that has to occur because they're now in the noise environment. 26:42.160 --> 26:45.520 They're only able to look at images from that particular lane. 26:45.520 --> 26:47.260 It's a bit inefficient. 26:49.420 --> 27:04.800 The second part of this is that we would really like to take them and put them off in a separate part of the airport and be able for them to have a quiet space and be able to operate any lane in that airport or maybe even in an adjacent airport. 27:04.800 --> 27:14.000 And so what we're looking to do is to have the image for a carry-on bag only be visible to the operators if it alarms. 27:14.000 --> 27:17.740 Right now, they look at every single image that comes up. 27:17.740 --> 27:20.780 Just take a guess at how many images we see in a given day. 27:20.780 --> 27:22.140 Just take a rough guess. 27:23.340 --> 27:24.580 How many? 27:24.940 --> 27:26.200 You're very close. 27:26.200 --> 27:27.740 It's about 5.5 million. 27:27.740 --> 27:30.280 So 5.5 million images come up. 27:30.280 --> 27:46.140 But when you're reviewing so many images and every one is presented to you with the same level of concern, if you only imaged on alarm, you would pay a lot more attention to that particular one image that came up that you really had to look at more. 27:46.140 --> 27:48.280 And plus it becomes a heck of a lot more efficient. 27:48.900 --> 27:51.580 But artificial intelligence can be spoofed. 27:51.820 --> 28:02.940 It's not good at deducing context to a bag where a human can look at a bag and say, okay, all these things sort of ought to belong in this bag given what else I see here. 28:03.020 --> 28:05.180 But a machine can't yet do that. 28:05.240 --> 28:06.580 And it can be hacked. 28:07.260 --> 28:10.200 And particularly generative AI, which can learn. 28:10.200 --> 28:14.880 If it's learning and we're not tracking how it's learning, it might not be learning what we want it to learn. 28:14.880 --> 28:18.980 So your help in that regard would be incredibly beneficial too. 28:18.980 --> 28:19.580 Absolutely. 28:19.580 --> 28:22.380 And I will put in a plug the talk following. 28:22.380 --> 28:24.460 We'll cover the croissant screening machines. 28:24.460 --> 28:26.460 As I've learned, that's the name of them. 28:26.460 --> 28:29.780 You may be seeing the newer technology that Dave mentioned. 28:29.800 --> 28:34.700 In addition to tomorrow, you're talking with Director Isidore on one of the main stage talks. 28:34.700 --> 28:37.860 So if you're looking forward to learning more, you've got those opportunities. 28:38.280 --> 28:39.940 So I'm going to close up here. 28:40.580 --> 28:42.960 Again, more things to learn. 28:43.160 --> 28:47.520 Hopefully seeing, understanding better what TSA is doing, why they're doing it. 28:48.040 --> 28:48.940 Closing comments. 28:48.940 --> 28:51.340 I know you mentioned it before, but please feel free again. 28:51.340 --> 28:54.760 Where can we go to learn more about careers and if there's interest? 28:54.760 --> 28:55.540 Yeah, sure. 28:55.540 --> 28:56.820 Just go into the exhibit room. 28:56.820 --> 28:57.600 There's a TSA booth. 28:57.600 --> 28:58.880 You can see our logo there. 28:58.880 --> 29:01.400 We've got some really cool stickers there. 29:01.400 --> 29:03.280 And we just encourage you to do that. 29:03.280 --> 29:07.660 Or if you know somebody who is looking for a really meaningful position in TSA. 29:07.660 --> 29:14.100 The other thing just to know is, and if you listen to the Secretary's comments this morning, we're looking for cyber talent. 29:14.140 --> 29:15.920 If you'd like to spend a career, great. 29:15.920 --> 29:19.220 If you'd just like to come in and work for a couple, three years, terrific. 29:19.480 --> 29:25.460 Because that back and forth has a hugely beneficial component to it potentially for all of us as well. 29:25.460 --> 29:28.620 But finally, just hey, thank you for attending. 29:29.220 --> 29:35.580 Thank you in advance for any help that you're able to give us in making sure that we're doing what I think all of you want. 29:35.580 --> 29:40.600 Is making sure that when you get on an aircraft, you have the very best technology solutions. 29:40.600 --> 29:45.260 The very safest implementation of those solutions that we can possibly deliver. 29:45.260 --> 29:46.360 And you're a big part of that. 29:46.360 --> 29:47.360 So thank you. 29:47.760 --> 29:48.060 And I 29:51.440 --> 29:57.480 feel absolutely obligated to make sure your Vegas trip is worth your time. 29:57.480 --> 30:02.640 So the obligatory Vegas dice and drink koozie for whatever drink you want. 30:02.640 --> 30:06.200 But more importantly, our 5th anniversary of the Village. 30:07.700 --> 30:09.860 120th anniversary of the Wright Flyer. 30:10.100 --> 30:14.000 Badge, swag, sticker pack for the administrator. 30:14.000 --> 30:14.320 Enjoy. 30:14.320 --> 30:14.780 Awesome. 30:14.780 --> 30:15.220 Thank you. 30:15.220 --> 30:16.080 Appreciate it.