1 00:00:05,500 --> 00:00:08,060 Hi everybody, we are here in front of the U.S. 2 00:00:08,060 --> 00:00:12,100 Congress to talk with you for a little bit about the policy department at DEF CON. 3 00:00:12,100 --> 00:00:17,340 DEF CON is the annual hacker conference that takes place each summer in Las Vegas, Nevada. 4 00:00:17,340 --> 00:00:20,300 This year it is going to be August 10th through the 13th. 5 00:00:20,300 --> 00:00:25,740 DEF CON has been held since 1993, so this is the 31st DEF CON that is going to be coming up. 6 00:00:25,740 --> 00:00:30,240 And as those years have gone by, cybersecurity policy has become a lot more important. 7 00:00:30,240 --> 00:00:39,260 Both the enterprise as well as society and the policy makers have come to seek out the expertise of the security community that is present at DEF CON. 8 00:00:39,260 --> 00:00:43,360 And the security community has gotten more involved in policy making. 9 00:00:43,400 --> 00:00:49,740 And so this has evolved to become a policy department, an official policy department at DEF CON. 10 00:00:49,740 --> 00:00:53,220 It was featured there last year, it's going to be here again this year and going forward. 11 00:00:53,220 --> 00:01:05,680 The policy department brings together security pros, hackers, as well as policy professionals and government officials to mix because we all recognize that cybersecurity policy making is better when you have community input. 12 00:01:05,680 --> 00:01:23,380 Now last year, the policy department at DEF CON held a lot of bridge building events as well as mixers and fireside chats with White House staff and senior government officials like Jen Easterly, the director of CISA, and Leonard Bailey, the head of the computer crimes division at the Department of Justice, 13 00:01:23,380 --> 00:01:25,620 as well as a lot of great policy content. 14 00:01:25,620 --> 00:01:35,960 Some of that content includes stuff like aviation policy, foreign affairs, hacker law and how it affects security research, and a lot more, election security. 15 00:01:35,960 --> 00:01:53,520 We can't reveal the policy content for DEF CON, the DEF CON policy department this year just yet, but you can expect it to continue to engage with government officials, security pros and hackers, and have deep dive conversations, hilarious conversations about some of the most important cybersecurity policy issues that are being discussed right now. 16 00:01:53,520 --> 00:02:02,780 Those can include the National Cyber Strategy in the United States, which was recently released by the White House, and the implementation plan for that National Cyber Security Strategy is going to be released soon. 17 00:02:02,780 --> 00:02:07,000 It touches on virtually every sector of the economy, including security research. 18 00:02:07,000 --> 00:02:10,540 As part of that, critical infrastructure is going to be a hot topic. 19 00:02:10,540 --> 00:02:23,580 The White House has directed regulatory agencies for sectors like electricity, water, food, aviation and many others to look into ways to increase the resilience of the owners and operators of those critical services. 20 00:02:23,620 --> 00:02:26,000 IoT cybersecurity is going to be another one. 21 00:02:26,120 --> 00:02:36,780 There is going to be a labeling announcement that will be announced by the White House here pretty soon that would create a security label that can be put onto consumer IoT devices. 22 00:02:36,780 --> 00:02:40,040 And the criteria and the details of that have yet to be figured out. 23 00:02:40,040 --> 00:02:42,740 AI, of course, is another extremely hot topic. 24 00:02:42,740 --> 00:02:47,520 The White House has announced that it's going to forge ahead with the National AI Strategy that will include security. 25 00:02:47,520 --> 00:03:01,320 The White House has also announced a partnership with the AI village at DEF CON to work with companies to open up some of the most important generative AI models to independent security evaluation at DEF CON this year. 26 00:03:01,680 --> 00:03:04,940 This is, of course, not just a U.S.-centric audience. 27 00:03:05,440 --> 00:03:11,540 The EU's Cyber Resilience Act, as well as other pieces of legislation from the EU, are also going to get discussed. 28 00:03:11,540 --> 00:03:13,600 The Cyber Resilience Act is an important one. 29 00:03:13,600 --> 00:03:20,580 That would require a lot of security features to be built into the development and deployment of software sold in the EU. 30 00:03:20,580 --> 00:03:24,100 It'll have a GDPR-like effect if and when it passes. 31 00:03:24,100 --> 00:03:25,640 It's already passed the EU Commission. 32 00:03:25,640 --> 00:03:29,040 It's now being discussed by the other two parts of the EU Parliament. 33 00:03:29,040 --> 00:03:33,720 We can expect the passage of that in coming months. 34 00:03:33,980 --> 00:03:37,600 And then lastly, but not least, supply chain and SBOM. 35 00:03:37,600 --> 00:03:40,760 Those requirements are flowing out right now to federal contractors. 36 00:03:40,760 --> 00:03:44,460 SBOM is becoming more and more adopted into supply chain security processes. 37 00:03:44,580 --> 00:03:50,880 We can expect continued discussion about that, as it is a major issue for anyone that is making software, particularly if you're selling it to the U.S. 38 00:03:50,880 --> 00:03:51,520 government. 39 00:03:51,560 --> 00:03:54,020 So, hope to see you at DEF CON this year. 40 00:03:54,020 --> 00:03:55,060 Wear something weird. 41 00:03:55,060 --> 00:03:57,180 Come and stop by the DEF CON Policy Department. 42 00:03:57,180 --> 00:04:00,060 We'd really love to see you, August 10th through the 13th. 43 00:04:00,060 --> 00:04:08,520 And in the meantime, follow us at DEF CON Policy on Twitter, Mastodon, or LinkedIn, or visit us at defcon.org forward slash policy. 44 00:04:08,520 --> 00:04:10,440 Thanks very much and hope to see you there.