ALEX STAMOS: Everybody,
the Penn and Teller theater.
My name is Alex Stamos.
I'm here to talk about the ethics
Yeah, so, if you're here
now is the time to go.
So a couple this is supposed
We kicked around a couple ideas,
Could be me dousing my career
Could be a lot of outcomes.
One disclaimer I'm here personally,
up here.
If you're a reporter or are going
or something, just say Alex Stamos
dashingly handsome citizen,
the corporate people not know I'm here.
This is going to be
interactive means not screaming
We have specific interactive points
from you guys so I'm hoping to kick
in over the next couple years,
of where we live in interesting times.
We're going to talk
to think about us as an industry
within the industry.
And then I think
is I'm going
and we're all going to vote
So this is an open discussion space,
with very different backgrounds
about what's going
I just hope everybody is responsive,
to each other
should be.
We're going to talk
You don't have to applaud let.
I'm like Dan Kominski.
I'll stop.
And you can see your applause point.
I'm not here to put moral framework
It's for you
from so you understand my biases.
My first DEF CON many years ago
the hotel room
Like many people I was self taught.
As a teenager,
of what I mean by self taught.
I worked after defensive roles
I started
worked out well.
One of the best parts of my career
with fantastic people and give fantastic
into the industry.
That's one of the things I'm most proud
As part of that job, I've worked
an I've seen what it's like to be
of a nation state who wants
I've been asked to do stuff for the U.S.
government and I've helped in the past.
I have been to places
those who ironed your shirts
will understand where those locations
And my work has put
So I'm just trying to be honest
about where I'm coming
of the DEF CON crowd I'm
I'm a corporate white hat sellout.
This talk about is about the ethics
a sellout how you can do so.
If you're an anarchist or anti info sec
but realize you're not going
So I've been doing this for a while now.
In the last couple years I've had
Like it used to be easy
to get into security.
It was something fun.
It was something you could get paid
Things you would usually do for free.
And that's how a lot of us slipped
these days you need you need
goal and this has come
We live in interesting times.
Good old days there's only one good
Do you want to be on the white hat
Everybody likes to break things.
Everybody likes to look
out how it works and tear it apart.
If you're on the black hat side,
for personal gain, you use it
to get your shoutouts to your friends.
Or you use it for some kind
If you're a white hat,
to make that system better
And you might disagree
but that's what I'm going to use today.
It used to not be that hard.
You could pick one or another
But the definition is simple.
There's a lot of ways to be
You can work for corporate
as a small group of folks,
or getting consulting contracts
with their parents, there's a number
and stay independent.
You can be a consultant
is the environment
an academic, there are a lot of ways
But back in the late night '90s,
It seems like we were children fighting
full disclosure.
The goal of the responsible
I've got a bug, I want to protect
from this bug, what is the best way
It's still an open discussion
Because it 201 he 3
the same outline of why they go
It assumes everybody wants
Also back
a company wasn't that difficult.
Some people didn't want to work
in a world where a lot
on both sides of the fence,
DEF CON,
at the same time they're selling tools
Not just in developing countries
and other western countries.
Back in that day we had little interaction
So, if you were obviously
you would interact
but you could go your entire career
to 2003 and never have to talk
about just what you're doing
That's obviously not true any more.
And there's a lot of gray hat activity.
A lot of people chose
But a lot was harmless.
A lot of people I know holding
of the past making them feel young
or doing something cool but a lot
malicious so it didn't compete too much
So what changed?
A lot of people ask when
When am I getting my fucking robot
And you know, it turns
of different ways, we live
Gibson, Sterling and
about in the '80.
That's amazing, sci fi authors
but the guys
We're in a world with corporate
to corporate info warfare
That's a normal part of our lives
somewhat paid for by nation state
and steal secrets, which
up out of William Gibson novels
We live in a world where our country,
with semi autonomous robots.
I'm not kill people.
I'm just saying James Cameron, way
you really called that one much quicker
We don't make them look
a bipedal titanium robot
to build a killer robot.
Or make them look
They're made more cheaper
We live in a world where
on a massive data surveillance
Preventing criminal activities
by looking at Internet traffic.
And I wish any of these things was
about I don't think anybody here thinks
What are fun things that happened.
We have Stuxnet and flame.
I'm sure most people have heard
Those are pieces
against the Islamic Republic of Iran.
I'm not going
at any governments that were related
a feel who might have been involved
And I feel this is kind
of the no more free bugs movement
a an open marketplace that didn't exist
weaponize it and whoever
We live in a world where cyber war
Almost any corporation
of threat that you only played
in 2003,
and people building planes
Last year I did a project
Right?
They've got a dozen IT guys,
job it
and you're like well who cares
Well, they employ tens of thousands
of dollars of heavy industry and
in places like China.
And so, if you just happened to be
then you're going to end up at a level
unimaginable a couple years ago.
And what's really scary from that
for a company that size
to protect themselves.
Like the people doing the best
against the Chinese right now
Google has like 150 security people.
They've got windows kernel experts.
OS10 kernel experts.
They have an intelligence team.
They're not winning,
So tractor company is fucked,
(Laughter) And this
Isn't capitalism what the world
And competition.
I want to get
the interactive part is.
I just want to have enough time.
We live in a world when companies are
Those looking at flame,
out they don't sell those much.
You can't call them and say can I sign
You have to steal that from them
an entirely new way doing
been used before in open literature
a couple millisecond window
license certificate authority
an identical MB5 sub
This is the equivalent
with $10 million
of cyanide would have done it.
This tells you something
This is basically the U.S.
government being like oh, yeah, yeah,
Boom.
Drop mic.
What are you going to do about it?
Right?
(Laughter) It's
with radioactive material.
You could just shoot
saved $9,985,000.
That's by the entire pack
Instead they thought we're going
material over London.
This is the cyber wary equivalent.
Whoever wrote Flame was willing
actual attack against Microsoft.
What does that make you feel
and you have all this relationship
of the world where you're trying
and you're trying to work with them
about your products and by the way,
on the defense side, somebody
like it's open season
We live in a world where these cyber
another blogger.
And I forget exactly who made
a gun at somebody,
out and throw it back at you.
But, if you throw a rock
them, they're going to throw
Using the word cyber without irony
in an info sec communities.
But that seems to be
these days.
These cyber weapons are
For the short period of time
about several critical bugs
controller is United States
if Iran who paid attention
God this guy's Finnish
the other folks who have been finding
in the wild had any other kind
from a society where they're totally
we very well could have seen these
against all the companies we work
So it brings up a question
against cyber war,
who's buying them.
Offensive or defensive teams.
I've never heard
in the way they knew.
There was
that could buy it.
What are they doing with them?
Using it for foreign use
An what goals are being accomplished
about when you sell bugs
the nation's goal or government
at that moment that are being
And if want to know what
is between nation's goal
I see people with white pony tails,
about a man named Richard Nixon
to you what happened.
So we also have a world not
and Justice Department and
a real problem in our world
between prosecution and persecution
For example, there's a lot
from their bosses, which is as old
and taken their customer lists
And this is why we have NDAs, this
This is why we have civil lawsuits
have stolen their trade secrets
people as criminals using
of 1996 because it happens to be
20 years ago if you walked
you would have gotten sued
have had to give it back
These days if you have
on a USB drive that turns you
like these guys,
rap at Goldman Sachs.
Argwal, who left
secrets with them.
I don't think they should walk
those hedge funds to make money
a national security issue.
This
between these folks that now
the soul crushing power
of Justice is being turned
And then of course we know
and Abuse Act people
data out.
I don't consider him
But I don't think he deserves to be
Lori drew, again, not a nice person.
I don't want to hang out with her,
the myspace terms of service
and Aaron Schwartz, the elephant
So where I come to this
Like I said,
times in the prosecution
And these were
like stole a book or something like that.
So you know, as part of my penance,
of pro bono work
my company provided pro bono work
of Sony doing everything possible
in a meeting
a real estate lawyer and
at Internet law.
Okay, that's great.
Maybe if my life is at stake,
But it's like him,
about the case but came just
of the table and me,
is four big law partners who almost
an hour to sit there across from us.
And this is because a guy was able
Sony is willing to bury us in paper.
And obviously that happens.
There's not a lot we can do
on Aaron Schwartz's case
Part of my job for the defense was
the prosecution's expert created
is or what company he worked for.
I don't think he did anything wrong.
This is a guy who worked
company who was approached
on those machine and tell us what
a reasonable workman, like,
ands I found this in the logs
like he changes his Mac address
We had a couple things to hit him
He didn't lie.
He didn't make things
S.
attorney's office and twisted
to turn into Aaron Swartz was
And, if I was him,
been unitized in a way to persecute
What is our role here?
Is our role as technical experts
job to make sure justice is done
a more active requirement
in the technical world?
And obviously we have
all the crazy people basically everything
I apologize,
with like a at a DEF CON party,
that's really interesting.
I got to go.
I got to talk.
All those people were right, which
A lot of people suspected this was
This is from the Washington Post.
You don't have to read it too closely,
We suspected it's different than
The reason that's important
Who here has heard of that?
A couple Poli Sci majors.
There's this guy,
is a political science major who came
the most important thing
is whether it's considered
of acceptable discourse.
Right?
So he talks a lot about the need
to have radicals.
So for example,
is a radical whose ideas were not
by a couple percentage points
the effect of being
of the window and therefore,
of what was acceptable political
in which Martin Luther King
in and be considered again
I think what's interesting
is from a conspiracy perspective,
So this was
I knew the U.S.
government was making malware
I have no moral problem with that.
I have no moral problem with Stuxnet.
If you're the President
to you and say sir,
a bunch
says that we'll probably kill you know
to be children or I can use a virus
obviously the moral choice
Where it gets difficult
to make sure other people are protected
to you go?
It's one thing to do
with the Iranian government
the agricultural department
and now it's agricultural Department
There's a continuum we have
Clearly well knew there was widespread
The fact that every fiberoptic cable
to break every six months,
the Greek and Filipino captains
through there have been drinking too
the Filipino drink of choice
and you do a tap
good and able to get
out of sawed Saudi Arabia or Iran.
I thought there was malware
in a while mobile devices are used.
There's a slight possibility
all of us living through this,
because we know for a fact that stuff
is happening and we know
sniffing happens so it expands our
is a possible something that we'll
I'm now willing to discuss
the NSA has knows how
because they have
for the discreet time
Now I gave a talk about it
before I would have thought that's
If it turns
and Bono still does not age,
Isn't it an exciting time to be
Those exciting times we have
and thoughtful decisions of how we act.
How do we make sense
We're born with only basic moral
I'm not going to get into ethical
I was an engineering major.
You're willing to take
without me participating,
We're born with the most basic,
is and that can be overridden
as every atrocity
You can make humans do everything
they were doing something right.
I was only following orders being
over and over again.
We make decisions
friends, society.
If you want
important to think
Why do I feel this way and do I choose
or am I going to leave it
Frameworks patriotism
Two words that don't exactly mean
but can find 40,000 word treaties
I'm not going to apologize.
I'm American, I'm proud to be
I'm the grandson
to get to this country
from kind
on the side of a mountain
of conditions, right?
My great grandfather came here and
and he's now you're General Stamos.
He's like I love America!
And when you come
of you who understand that understand
down because he busted his ass
for six months so
and do something great.
So that's why I had
out of school in 5th grade, came here.
U.S.
Army took him.
You don't speak English, great,
Learns English in the Army
to do electrical engineering classes
of a huge engineering team at Pac Bell.
And that's like something that's pretty
So I want to be proud of my country.
But what does that mean?
Right?
Which of these is the United States?
Is it the dirt we live on?
Obviously the dirt that comprises
all the time since 1776 and
And you he no, I don't think
to be massively different
in the next couple years.
Is it the government that currently
No, these people work for us.
Right?
I have no loyalty to them.
Their loyalty is to me as a citizen.
I don't think we have any loyalty
I think it's really stupid to put
at the post office.
He should have our faces on his wall.
That's how that works!
(Laughter) Is it the citizenry?
I am proud of fellow Americans.
If you live in Japan, you're proud
that means you're proud
existed for thousands of years
of Americans, you're proud
an American citizen in the last year?
Right.
You guys have just as American
And I'm proud of you guys, too.
So saying you're proud
I'm proud of the idea, right?
The idea of limited government.
The idea of us not trusting government.
The idea if you read
the founders were actually crazy anti
What they realize
into systems that give them power,
to act against the interests of people.
That's why we created
with three parts fighting each other
beings, even
And I don't think the guys doing
government right now are bad people.
So I got dinner
a couple nights ago the night
I didn't know I was going to go
One of the memories I'll take
is Jennifer granite grilling him
over a nice blackened cod.
It was great.
And watching Jennifer take it
really enjoyable.
Right?
(Laughter) So General Alexander,
a big part of his thing is I really want
but where he's coming
during the Euroslavian war.
Don't overestimate how much cohesion
Any society can fall apart
If that kind of attack happens again,
But, if that kind of thing happens again,
He feels he's a good guy and has
a framing that allows him
up to performing military coup.
If your framing
to destroy the constitution
will do almost anything
important my oath
of the United States.
I think this is not
to make your moral decisions
or nationalism but snubbed
in the scope of the people or
up of fallible people that make
Another way you've got to think
the only group you 0 responsible to.
We have a hierarchy
The core of that for me personally
I've got three kids.
I chose with my wife to bring them
They didn't choose that.
I have a responsibility for them
That responsibilities drops
to kick them out.
But I still have
for the creatures I brought
Who here is a parent.
Everybody understands that.
You hear that when you're 23, fuck, you,
But you live through it
of your responsibility and has
So in the short term there's decisions
Ed Snowden would not have done what
He would have orphaned them.
I cannot do what he did ever
to my family that overrides any other
would happen.
Unfortunately, this responsibility
of totalitarian societies have turned
But that's a responsibility you have
You have a responsibility to friends,
the colleagues you happen to work
the employees you hire turns
an interesting world conundrum.
When you hire somebody you're
I'm going to pay you twice a month,
I offered you a job that was
and I'm not going
That's something you have
When you're a small business owner,
this is your job and you're going
might not make payroll and you realize
50 people who might not make rent
need to do for those folks.
You might feel an obligation
That was the kind
for our grandfather's time.
I'm not going
of them didn't have corporate jobs.
You go and work, you spend 50 years,
the gold watch has changed a little bit.
Other societies.
Not so much
of tribes people have responsibility to.
Tribes that existed much longer than
the British people happened
Our society or civilization.
There's a sci fi author who likes
of a civilization that he's proud
is an interesting argument.
Our nation and our species.
This is not
Clearly if your friend kills somebody
is a dangerous person,
to your society overrode your
Although I don't know a lot
in their kids no matter what happened?
How many kids would turn their kid
Almost nobody.
You did?
Okay.
Are you Robert Moore Moore senior
So I thought he wouldn't be here
We haven't talked about this
the idea that there would be universal
There's Hippocrates and
They have an oath of lasagna.
It's funny but literally
a new oath.
Medicine are the scientific priests.
Scientific priests used observation
to make people better and that put them
gave them some kind of responsibility.
We're the technological priesthood
Everybody here has fixed their family's
reminds you
of the world that underlies our day
of people do not understand.
We do.
Maybe that gives us moral obligation
All people discover their technology
This would be equivalent
in Geneva Conventions if you are go
to be treated just as was as well
Doctors will risk their lives to save
of people their coworkers just shot.
We don't have that kind of thing
But maybe we need to have that.
The idea that the Internet is used
of oppression rather than liberation.
This is dangerous,
to be liberated from the oppression
all the children from the porn,
in a way that can be oppressive itself,
at least you're not going
If you start to go down the ethics,
in a famous paper neither our distance
of people in respects to that evil
as we lessens that ability
He's saying
for not doing something right
or it's physically far away are bullshit
He was making this argument
He was saying who likes it there are
Everybody wants every child
Therefore, if you don't take every dollar
to feed your own children
you're morally repugnant.
You have fallen short
That's a crazy argument that
society would fall apart as we
and there's no idea of a consumer
of thing when you think
of ethics that people have gotten
We're not going to hit it
Another reason is personal legacy.
Some say I'm reducing human
economic benefits.
A lot of people laughed when
doing God's work which I thought was
he honestly believes it.
One of the great things
of people rising out of poverty
because of us shipping them bags
It's because they were able
to sell goods and services that
The guy who started Tata motors took
out in the fields and were
reasonably good jobs.
That's an argument some people have.
Making your own family wealthy.
Building something that lasts.
If you study engineering,
the idea
they're gone the work lives on.
That's building
So something to think about though
down and think
that means you're rich and lucky.
Because the vast majority
they can do
to feed in their family and friends.
The rest
forget about the fact that when we talk
because we have the ability to do so.
Here we're going to get
By fun, probably not fun.
So the way I'm going to do this
up ethical conundrums
I'm going to read the conundrum
please don't hoot and holler
You can laugh if it's funny.
Let's be respectful of each other.
I'm going to poll the audience
This is supposed to be a safe space,
Would be really easy for us
to the hardest anarchist side.
If everybody in here acting that way,
in the problem it is right now.
So let's be honest
Who here played Ultima 4.
Old people.
1985, first video game that basically
the way you generated your character
and you'd make a decision
out of it.
First time you did it you answered them
and got a cheat sheet.
And for a while it was
go through.
So that's what we're doing here.
First question.
Warmup question.
You find a critical remote exploit
What do you do?
Do you publicly announce
Public disclosure.
You wait and build
Perform responsible disclosure
to what you consider reasonable
D, you use it
to sell consulting.
You're laughing but it happens
E, you weaponize it and sell it directly
know is going to give it
F, you weaponize it and sell it
that's going to go after that
than E.
Use it for fun or profit.
Who would do A.
Only two full disclosure people.
B, build a black hat talk.
Okay, excellent.
C, perform responsible disclosure
Wow, awesome.
D?
Okay, excellent.
I know you who you are.
E, you'd weaponize and sell it
F, weaponize it and just sell it and G,
Decent number of people.
That's fine.
It seems like disclosure crowd.
That's my answer, C guy.
Your job
you successfully uncover
like an actual break in.
Not a stupid violation and figure
for the company full time or contractor,
You write a report give it
to the U.S.
Attorney and you find
for extreme penalties.
Whatever it is,
Do you A say I'm adjusting go
to assist the prosecution.
It's there is an adversarial process here
B, you do nothing, try to stay
You've done your part.
C, you gently work
but you don't do anything past that.
D, you outright say I'm not going
You cannot put me on the stand.
Do not call me again.
E, you call the defense and volunteer
This may or may not be legal
You can ask Kurt.
You publicly take a stand,
that protects witness.
Whenever you do expert witness stuff,
fuck you federal judge, I'm going
A is a hard 1
B, C gently work
Largest so far.
D outright refuse to participate.
E, volunteer to the defense.
And then F, go nuclear on Twitter.
Okay.
So I think it was C or D in a lot
That's actually where I am personally.
Somewhere between C and D.
In just am I little bit
off a federal judge is a world
I'm not going to put my kids
Volunteering for the defense
what you guys said, which is good.
You're approached by a member
apparatus in a fend friendly matter.
You haven't done anything wrong,
this is just a chat.
Do you A say yeah, let's go grab a beer,
the girl thing and slip them
C, say feel free to send me
by e mail or we can set up a time
D (Laughter) Or E.
Okay.
So A, who would do A?
Take the meeting?
Decent number of people.
Probably about a quarter of the room.
B, politely try to get out of it.
More than a few women.
I understand that.
C.
D?
And E.
Let's hear you're weaving, sir,
So here's one I have to admit.
I did A, people
a beer, we'd love to hear
I bought them beers and we sat
for two hours and talked
But this year no, I'd be a C,
isolate ourselves.
I don't think we need
I'll never talk to anybody
Because that kind
to educate them.
Again, they work for us.
But especially
with somebody who works
the tiniest little mistake could be
And so I don't think we're
of us can interact
in any way without attorneys present.
It's just not safe.
Okay.
We'll do this a little more quickly.
You work for respected cloud company.
Course of duties you find a back door,
without giving you any more
Do you drop it, escalate
for a new jock, publicly quit or pull
Okay.
Yeah, I mean, I'm probably
on what I think the enforceable
whether there's criminal penalties.
I'm hoping people at Google feel
You work
Your boss hands you an order
from the government.
That is considered legal
Do you comply and just forget drinking
B, refuse
going to do it you have
but do nothing else.
C, quietly look for a new job.
D, publicly quit in protest,
Or E, I would be happy to do that sir,
of us using hardware security module,
and somebody
and our implementation
me doing this
you'll like.
Please decide whether or not you'd
to proceed now that I'm informed you
to the world that you've asked me
So obviously I'm telling you E
(Applause.) But E requires forethought.
So that's why I brought this up.
If there's a backup key
I'm building a service for people
So I am backing myself
out of and I will leave it
to come to me to force me
to decide which poison they want.
Either violate certificate
in there or putting a certificate
the whole world knows.
(Applause.) Don't plan for that.
You work
like an IDS and you find
on their citizens, do you do nothing, B,
the company selling it to these folks, C,
dual use.
A, that's a reasonable thing.
Gun manufacture you think
I build a gun.
A gun is not a moral object.
People use it in a good or bad way.
B, change corporate culture.
That won't happen.
Good luck.
C work from a technical perspective.
D, quietly quit and E go nuclear.
This is a tough one.
People that work
day apparently.
So we don't have time
like you guys to do, you don't have
I have no moral authority here
a good thing to do.
Try to live an examined life
Think about what you want to do now.
Don't get caught being asked
and not against your means
It's easy to say yes when you're
Teach people.
People with pony tails have lots
Teach people about how
Be open and honest with themselves.
Something you can do right now
for supporting reform
This letter has been signed
Who else?
I'm blanking, Ari, Schwartz.
Avi Ruben.
Security researchers and academia
private world have signed this.
You don't have to sign it on behalf
This is just you.
If you'd like to get
before it goes public
There's folks up here from the EFF
We're out of time so, if you want
thank you very much for listening.