NICHOLAS PERCOCO: Okay, good morning, everybody.
I'm Nick.
This is Josh.
We will do a few introductions and then jump right
into the content here.
I'm Nicholas Percoco.
I have always been and I currently am a hacker.
Yay.
(chuckles).
Let's try that again.
No.
Whew.
NICHOLAS PERCOCO: In my day life, day job, I actually run
a small team called Spider Labs at Trustwave.
And some of the background, I have done a lot of speaking.
This is my eighth time speaking here at DEF CON and I spoke
on stage at TED.
I have also keynoted RSA this past year and here's Josh.
JOSHUA CORMAN: Good morning.
So I'm Joshua Corman.
In my day job, I'm director of security intelligence for Akamai.
My comments today are my own and may not reflect those
of my employer.
I've kind of been wrestling with being a philosopher
in a hacker community, but I think I've come to own it
and I think my research has trended from things like espionage
and malware to things that have affected our lives
and human rights and public safety and that has taken me
down the path for today's topic.
NICHOLAS PERCOCO: A little bit about where we came
from and where we're going.
This talk is actually not a presentation.
This is a discussion.
This is a discussion between me and Josh here on stage
in a discussion with all of you.
This is not a finished presentation.
So if you're expecting at the end of this to have us to solve
the world's problems, that's not the intent.
It is to start the discussion.
In the mid audience we have
a microphone.
It is there for you to use.
If you have a question, you have a comment,
you want something to add to the conversation, please use it.
But also note that we have a finite amount of time here on stage,
45 minutes to be exact, if you can't fit your comments
in 140 characters, please save it for the Q&A session.
We will have a Q&A.
There is no Q&A room.
But afterwards please join us in the Chillout lounge
to continue the discussion.
JOSHUA CORMAN: Part of the impetus of this how many
of you have been to DEF CON before?
Okay.
A lot of new people here this year, I don't know if you noticed.
It is both encouraging and overwhelming.
A lot of us got into hacking because it was our hobby.
And when we weren't paying attention how many
of you noticed that it accidentally became our profession?
Again, we weren't paying attention again.
I.T.
security which was our hobby and job ask now permeating every
aspect of our personal lives and our personal safety and our kids.
We are putting software in places it does not belong
and it is merited.
We have medical devices that are completely pwnable
and are no encrypted at all on their Bluetooth stacks.
When I tried to buy a car, I couldn't find one that wasn't hackable.
You can find default names for hydroelectric dams.
This isn't fun.
This is real.
As we depend on software in places, it needs to be dependable.
And in the presence of attackers, it needs to be defensible.
Every time I want to quit security, I realize that our failures
will be inherited by me, my mind, my family and soul.
Don't think about how do you get better
at our day job, think about how do you hack your personal
life and your personal freedoms.
And that should be the scope of today.
NICHOLAS PERCOCO: A couple of weeks ago I decided to do
a juice cleanse.
Have any of you ever done one before?
You spend three days drinking six bottles of juice and nothing else.
Besides having interesting bowel activity, it also gave me very vivid
dreams when I would sleep.
And so at night I would go to bed and I would wake
up in the morning with these sort of memories, these odd memories.
You know when you wake up from a dream
and you are disoriented and you think it was almost a real experience
within a dream.
I had a few of those a couple of weeks ago.
The first dream I jotted down that I took notes about, I was
on a bus.
The whole dream took place on a bus.
I didn't know where we were going.
I was a little bit confused.
I saw people I recognized.
I saw people sitting with paperwork and computers in front of them.
I started to ask questions.
Where are we?
Where are we going?
And I soon realized that we were all going to apply
for federally issued software development licenses, that each
of us somebody actually showed me they had one that was expired.
They needed to renew their license or they could not even write
a bit of code.
So I thought that was pretty interesting to sort of have that dream.
One of the other dreams I had that I took notes about, I was actually
in a hotel.
I travel quite often.
I actually travel all over the world almost constantly.
And, you know, in the morning when you walk
out of the hotel and the "USA Today" paper is there
on the floor and you see the headlines.
That's how you wake up in the morning.
I glanced down at the paper as I was off to a meeting and saw
on the headlines, it said: Florida man arrested
for hacking tools, possession of hacking tools.
I remember flipping over the paper and reading page 7
about what that story was about.
And it showed it had a logo of Metasploit and it mentioned nmap
and Nessus and other tools people have in their possession.
I thought that was interesting.
And then another dream I had I started soon realizing
they weren't necessarily dreams.
They were vivid.
But they were actually nightmares.
In this third dream, I was walking down the street in Chicago.
Sort of dusky.
Turned down an alley and walked up to a door and rang the bell.
I remember trying to see a camera shining on me.
I rang the bell and they buzzed me in.
I went in and walked up three flights of stair and walked
into a Chicago apartment.
And there were girls and boys having conversation.
There was a cluster of monitors and in another area there were some
electronics laying about and, of course, a lot of cables all over the floor.
Somebody I recognized actually handed me a beer and said, welcome,
the discussion will start in a little while.
I took my seat and started saying hi to people.
And then all of a sudden the lights went out, electricity went out,
all the power went out in this apartment.
The initial reaction, I remember someone
in the background saying fucking ComEd, the power went out.
Then we heard banging on the front door and banging
on the back door and men came into the room wearing black shirts,
black pants, black boots and they started to say we were
under arrest for violation of some act.
And I can't really recall what that act was.
They lined up against the wall.
And line by one they zip tied us in our arms and legs and carried us
down the stairs.
Now, this was a nightmare that I had.
Obviously it is not real but it is very much grounded in reality,
in the things that we experience today.
If you extend what is going on today, five, ten years from now,
I can see a time when someplace like DEF CON can't exist.
But we don't have to.
There's a better way.
I could see a time when friends are being arrested
for writing tools.
We're being criminalized for research, but we don't have to.
JOSHUA CORMAN:Uh oh.
So when Nick told me his dreams, I had two thoughts.
First, I'm never doing a juice cleanse.
(laughter).
JOSHUA CORMAN: I said this isn't fun.
Let's get real.
These are actually precedents.
Whether you love or hate Weev, Weev's case
is very dangerous precedent for the criminalization of research.
This community does and lives and thrives on our ability
to do pervasively do security research.
If you saw the aggressive prosecution
of the late Aaron Schwartz and all the Aaron's law discussions coming
from this.
There is a state law in Texas that makes it technically illegal
to do a port scam.
Germany and France have already specifically outlawed certain hacker
tools that are really just assessment and nmapy type things.
I learned last night Brazil, after some actress had some nudy
photo revealed, passed a law that makes it criminalized
to have nmap or any port scanning tools at all.
This isn't fun.
These are things that are actually happening.
And it is up to us in lieu of any adults in the room to be the adults.
Now, that should terrify you, right?
(laughter).
JOSHUA CORMAN: But it dawned on me over the last couple years,
I was researching Anonymous two years ago here at DEF CON.
One of the things I was concerned about was
a neo McCarthyism when you had aggressive, high profile demonstrations
of hacking will.
Whether you like them or not, it captured hearts and minds
and scared policymakers.
When powerful people are uninformed, they make powerfully uninformed
knee jerks.
He started off in his intro: He is now and always was a hacker.
I fear the need to say: I'm not now nor have I ever been a hacker
in our near future.
If you are not worried about it, you really, really should be
because policymakers are as technically literate
as this community is.
That's really the thrust of this talk, is that I think a lot
of us even our best and brightest researchers, even our A listers, so
to speak, every time I ask them why
they aren't more concerned they are like, someone will come fix it.
Let me tell you something, no one is coming.
The people who are going to fix it are to the left of you, right of you or
in your own chair.
That was really the bit flip for me.
So another part of this is, you know, for personal reasons I basically hit rock
bottom in January.
I lost my mom at 58.
Had a pretty tough year last year.
It really throws into context what's important
to you and how much time you have.
And I felt like I was diminished, that I couldn't really contribute.
What I realized is people don't really make changes
until they hit rock bottom, right?
If you want to be a science person no one changes
until the pain of exceeding inertia exceeds
the pain of change.
There is a general malaise here.
Yes, we have had a great week the DEF CON.
There were more talks about burnout and suicide
and depression and there were also a lot of talks that had absolutely
nothing to do with security because there is an implicit defeatism.
And we don't have to accept that defeat.
There is actually a value in hitting rock bottom.
And that value says when no one has come to save us, it falls to us, right?
And if you don't see good things happening, we can put good things in.
So at my mom's funeral, I said the absence of heat cold
is the absence of heat.
A darkness is the absence of light.
And maybe it is not that there is evil in light but maybe there
is an absence of good.
I realized each one of us can take matters
into our own hands and put in that leadership that is sorely lacking.
Nature abhors a vacuum and I can hear
the sucking sound and it is time to fill that vacuum.
Now, what that means is no matter how much we hate certain
things, the alternative is worse.
So we continue to fail.
We don't have to fail in the same way, right?
We're actually suggesting some pretty radically
uncomfortable experimentation.
I can't believe we're at DEF CON and we are actually going
to suggest these things, but we haven't really engaged
in the formal process in how things work in the world.
You know, there is no senators or Congressmen who are experts
on stem cell research.
They rely on subject matter experts, think tanks, lobbies, et cetera.
And as much as we hate these ideas we
will ask you to both tolerate and participate in a series
of very uncomfortable and very unnatural acts.
And this means we already have EFF.
EFF has done fabulous things for our community.
We haven't really had a voice of interest for our profession and
for our talent and expertise.
Now we're actually going to be suggesting and starting we're
doing it with or without your help but we would love your help,
a 501 (c) (3) think tank for a research, number two, a 501(c)(4) for a lobby.
Even though we think they are horrible corruptly,
we believe it is time to have access to the power.
We are also going to professionalize.
We are going to do it very carefully so we don't
become the monsters we fight.
But just like the Bar association for lawyers or
the American Medical Association giving a voice to the priorities
of this community that is public and can give commentary
on public policy and public events, that's credible, literate voice of reason.
And then possibly, most importantly, we need to integrate a media
and PR campaign to win hearts and minds.
We have some of the best social engineers on earth.
We've done a really, really bad job setting the narrative.
I love seeing Nick on mainstream news or on TED stage.
More often we have seen LeGotte (phonetic).
Once again, we can take that microphone
and bully pulpit it and get the right people
with the right messages to actually represent our
community interests.
NICHOLAS PERCOCO: The chain of influence.
Whether we like it or not, what we do, what we say, how we dress,
how we what we do in our everyday lives influences people.
Words that are coming out of my mouth right now
on stage may be influencing you in a positive way,
maybe influencing you in a negative way.
You may take something that Josh and I have said and talk
to somebody else and that message will relay to them.
But that chain continues.
Now, unfortunately we take someone from our community, someone who
is a hacker from our community, and put them in front
of a policymaker or a senator or a global government this
is not just a U.S.
issue, this is a global issue what they see is not someone they trust
and someone who is an expert but they see a hacker.
And so while the research that that hacker
is doing may be vital to our existence, it may have life benefiting needs
behind it, they still see a hacker.
And so what we are doing within this movement is trying
to organize, better organize.
You can have the breakers, you can have the hackers.
They're vitally important to our community.
But then you also need people who go and come up with the fixes.
Now the breakers may be the same people at that come
up with the fixes, but they don't have to be.
So if you're someone out here who likes
to break things how many people like to break things in the room?
Okay.
How many people also like to fix things or like to fix things?
So you are part of this as well.
But it is not just the people in this room.
We also need people to continue that chain
and we need people from all different backgrounds,
also people who represent the various industries.
So when we go follow that chain and we put someone in front
of policymakers or we put someone who is on national television
or international news, they may be someone who has one foot
in our community and one foot in the industry that we're focusing on,
where there is the medical community, or the automotive industry or
the transportation networks, whatever that may be.
JOSHUA CORMAN: So we got to think like hackers, right?
I want to recognize somebody who has done some outstanding work
in the room.
Jay Radcliffe, can you stand up?
(applause) JOSHUA CORMAN: So much like the Hair Club for Men, Jay
is not just a researcher but he is also a client.
Jay hacked his insulin pump a couple years back and has
since done some hacking on several different medical devices.
One of the frustrating things, I look at that and I say that research matters.
It really matters.
It affects public good.
He maybe did it because he didn't want
to die or get hacked at an airport.
But a lot of the research we do is fun but does it really matter?
Are we going to find the 700th piece of Android malware, is that going
to differentiate you as a researcher as you try to find fame and glory
or make a name.
When we throw these over the fence, does it work?
I saw the work that Jay and others have done and also the huge loss
of Barnaby Jack.
Those two were doing some outstanding Jack.
We were already planning to include Barnaby
in this and that's very, very there's no words for that.
When we look, they really have a hard time.
It is hard we thought about the kill chain.
Everybody know how Lockheed kill chained how to get bad things
out of your network?
We need a kill chain.
It was tough for him to get and procure more devices to test.
He did a good job testing and finding the vulnerability,
but the vendor ridiculed, denied, and refused.
We had a hard time affecting that change.
Instead of looking on activities that I found 0day
or I published a pwn or I have
a different presentation at some different conference,
we wanted to see how you pull that to a result.
I went to Kevin Foo and he is an expert in industry.
There is way more medical laws than you can imagine and we are still not
getting there.
F.D.A.
is one of the bottlenecks.
They didn't have the ability to reject devices.
They are not actually putting in framing to allow
for better granularity.
So an individual researcher can have a hard time going
through multiple gates and multiple obstacles.
Really what we want to do is work with people
in industry and map that chain of influence and then fuzz it and try
and iterate a fail fast and focus on we're not done
until we see a substantive change in how we raise the bar and do care
on elective attack surface on life saving technologies.
That's just a deep example of one of these.
These are tractable.
They look overwhelming.
Maybe it is not Jay the one on CNN or maybe he is not
the one that does the driver development to fix it,
but we have the talent in the room for every single step along the way.
NICHOLAS PERCOCO: So there might be some people even when Josh
and I were first talking, thinking, well, this is really hard.
This is going to be very hard.
This is not going to be something that's going to be easy.
But we often do very difficult things, and there's dozens and dozens
of talks here at DEF CON about very, very difficult things that are being done
in a technical world.
So to put it in a little different perspective,
we have we have a clip to show you.
If you can dodge a wrench, you can dodge a ball.
What?
(Video playing.) NICHOLAS PERCOCO: So
if we can hack something, X, fill in something, a iPhone,
a SCADA system, if you can hack anything,
we can hack this.
But we have to be organized.
We have to work together.
We have to put the right people in the right roles to get this done.
Like we mentioned earlier, you can't put a hacker in front
of a senator because they see a hacker.
We have to put the right people.
Every single one of you has a role to play and can use their best skills,
their best techniques to help drive this home.
Jail breaking the system, it is incredibly difficult to find
a jail break and implement it into weaponize something in order
to perform a jail break.
Very, very complicated.
We can do that with this system.
And as Josh mentioned earlier, some of our best social engineers are
in this room or at this conference.
Some of the best social engineers in the entire world are
in the hacking community.
But it doesn't mean we have to be dishonest and try
to deceive people, but we use those skills.
It is exactly the same skills that the best C.E.O.s on the planet have
for selling their investors on something.
We need those people to step up and actually play that role as well.
So how do we do this?
JOSHUA CORMAN: I really like the fact that we're calling that
everything does have a role.
We really mean it.
When I say on Twitter Jay was giving
a presentation and said one of the biggest bottlenecks
is getting devices.
Three people replied and said I know how to get them.
You have something you can do.
I was talking to a young guy from Portland, Maine, he pointed
out one of his first job was doing device drivers and local SCADA operating
system shop.
You don't even have to be a hacker.
You can just write really, really security aware code for one
of those vendors.
I couldn't find a 0day to find my day but I have been accepted in talking
to government people in cross over.
I can take the technical stuff we do here and I can actually make it mainstream
accessible and get in front of policymakers.
There are actually six of us hacker types at an U.N.
meeting in Toronto this spring: Jeff Moss, me,
Nikko Pones (phonetic) and some others.
They were listening to us as the technical voice of reason.
The bad news is we didn't get very organized
but you don't have to be a rock star, A list name to actually contribute
to the research that we're actually carrying to the outside world.
Now, when I say anybody can play a role, I'm also speaking
to those pillars in our industry, our tribal chieftains, because this
is going to be really, really hard.
And in the leadership role, we are going
to need our toughest battles require our strongest lawyers.
So we really, really need not just grassroots
like yeah, yeah, ra, ra, we need leadership roles
like executive directors on some of these different manifestations.
Now, forget the term platform per se.
This is a strawman.
But we think we have put a lot of thought into this.
We be will using this to take it to the meeting
in eight weeks which we will discuss.
We will really see that there are three ways to secure our future.
We have to keep a very small list of priorities so we don't spread
ourselves too thin.
We can learn how to do this on a few topics and then we can
move out.
But essentially I think we need to focus on public good and safety.
And that's really why I wanted to call out Jay and Charlie miller
and Chris Vlasic.
Did you see their amazing car hack?
Whether they did it for an altruistic hack, it was amazing.
I got a flood of emails from people who don't know anything
about our industry saying I had absolutely no idea how much
of a can be controlled via software.
We have a few people doing research like this.
But I would like to challenge us through this program
to say let's say get a critical mass of rots of you.
If you are going to pick an Android malware, don't.
Pick an auto OS, a medical device, a control system.
Because if we can demonstrate that we are doing a unique public good
for public safety, guess what we can stave off?
We can actually carve off and demonstrate and earn
the permission in the hearts and minds that what we're doing
is critically necessary and, therefore, requires that we can stave
off the criminalization of.
This is your first time speaking at DEF CON?
NICHOLAS PERCOCO: No.
Is this your first time?
JOSHUA CORMAN: No.
NICHOLAS PERCOCO: I don't think we will get away with it anyhow.
(applause) I was shocked.
I was like, I think he has spoken here before.
JOSHUA CORMAN: We are being controlled by PW crack.
You know, even if you don't care about the public good and love
and safety and want to be a narcissistic vulnerability attempt,
to avoid criminalization this is how we will do it.
If you are going to peck something next year,
pick something that matters.
Whether your mother, father, uncle or aunt, it doesn't matter if you want
to help public good, be selfish.
If we do some things that are clearly valuable that no one else can provide
and we do it in an intelligent way, we get the right PR and air cover
for that, we are going to demonstrate that this isn't something
we criminalize.
I don't know if you snow the Obama clip,
he will not scramble jets for a 29 year old attacker, Snowden.
Into my research at the U.N.
and ITU, I'm wear of human rights and civil liberties are not compatible.
We are seeing the battle between the two and civil liberties
and human rights are losing.
They are losing big time.
Part of it is because people are evil.
And part of it people in power.
Part of it is they are just illiterate.
I had people in government say we should empower
the carriers to do deep packet inspection
to stave off intellectual property to China by enabling
the deep packet inspection to do signature antivirus.
And I spit out my drink.
I'm like, you do realize the efficacy of signature is zero.
That's really bad math, right?
I can't stop them from question should we trade civil
liberties and fourth amendment for safety
but I can tell them that it won't grant them safety.
So we need to do that for ourselves because we live
in the world, too.
If you really squint, what we are basically describing
will resonate will almost everybody in the room but everybody
in the mainstream.
What we are talking about is protecting our bodies,
our minds and our souls.
NICHOLAS PERCOCO: So there is some next steps.
As we spoke about earlier, we don't have the answer for you.
But we have some next steps that we want to discuss.
So the first of the next steps is naming the movement.
We don't have a name.
We have some stickers up here that have some phrases,
but we haven't named the movement.
If you have ideas, please let us know.
We are very interested.
We are all ears.
There is also forming an executive and advisory board.
This is not going to just be people from the community.
We want to identify those people.
We want to identify those people that have one foot in our industry
and another foot in another because that's where we will get
the most traction.
Also holding the constitutional Congress,
a meeting of anybody who wants to participate,
let's get these things on paper.
Let's brainstorm how we're going to organize.
JOSHUA CORMAN: And this isn't hand waving.
The guys at Derby have given us
a space eight weeks from now.
We will be holding the first hacker constitutional Congress
at DerbyCon.
We will try to figure out how to remote people in.
Coalition of the willing and the chieftains and the folks that want
to make sure we do this intelligently and we have the right platform and
the right issues to promote, we're going to do this right.
NICHOLAS PERCOCO: The other piece is to share the results.
This is not we're not forming a secret society here.
We want to share these results with people.
We want you to have feedback into those results and understand
what's going on at all times.
And so we do have a Twitter account you can follow.
We're working on ways to better communicate and a lot
of that will be figured out at the hacker constitutional
Congress and the protocols we will be using.
Of course, executing projects, building the think tanks, take
the medical research and put it in front of the right people that can
change the way change the way they think about what we're doing.
JOSHUA CORMAN: So if we we're not going to teach you
to be experts on all the different international
and domestic legal organizations.
But what we can do and hope to do is just flip that one bit.
If you thought someone was going to come fix this for you, we want you
to realize that the cavalry isn't coming.
It's you.
Now, it's going to be difficult.
It's going to take time.
We're going to have struggles.
We are also are a fairly cynical group so we
will point out all the ways this won't work.
But it's time to start failing fast and iterating.
I'm willing to take the bumps and bruises.
I'm looking at this as a marathon, not a sprint.
And if not, when?
If it is not you, then who?
Yes, we have stickers.
Yes, we have Twitter handles.
What we really need is you.
I have a question and I know you are itching to get to the mic.
But how are you going to make this real and who's in?
Stand up.
NICHOLAS PERCOCO: Stand up if you're in.
(applause) JOSHUA CORMAN: The adults.
NICHOLAS PERCOCO: The microphone, yes.
Hi there, Gary Reimer.
This is my first DEF CON and I have been coming here
because I want to get full blown into the security world.
And while I'm not an uber geek like a lot
of the people here I can communicate with anybody from a C.E.O.
to a janitor and if I can understand it, I can help them understand it.
And you had me sold five minutes ago which is I why I wanted to be first
on the mic.
I want to get your cards and be a part of this.
I don't know how I can contribute but darn, I want to.
(applause) NICHOLAS PERCOCO: Yes?
I just want to say the Fourth Amendment is already
the middle ground between the government can do
anything it wants and the government can't do anything at all.
We set rules this he have to follow, a warrant based
on probable cause and witnesses.
That's as far as we should go, period.
The second part of that is more rules and more laws
and more regulations are not going to fix this.
JOSHUA CORMAN: You know, we had I appreciate your comments.
We had some cognitive dissidence about this because we tend
to be a fairly libertarian group.
We tend not to like formal structures.
That's why I hearing aid we need to hold our knows and lead lima beans.
When you are jail breaking a iPhone you don't think
about how it should or shouldn't be, you find a way to get it done.
And I still carry cognitive dissidence over this.
I'm the guy that called out No Child Left Behind act.
The last thing I want to do is push more rules.
But it is using every available mechanism.
We haven't tried these yet.
I am not sure they will work.
I had some very critical people say you need to be transgressive.
You need to break the law.
You have to take Anonymous up ten notches or something like that.
I thought historically about things.
I'm not trying to equate this but Black Panthers were
very aggressive.
They were scaring people.
They weren't causing substantive legal change.
And then you had the civil rights movement which was
more moderate and engaging in system.
And it is unclear if one could have succeeded
about the other.
But I don't want to leave these options on the table.
Even if I get my butt kicked and we're ridiculed and made fun of,
that's okay because we have to try something.
That's why we want to have the hacker constitutional Congress.
I'm hyperconscious of your concern and I share it.
I also want to connect the dots on some things that are happening.
EFF does their part.
There is also FORKDA (phonetic) laws and amicus briefs written for Weev
and there is a whole bunch of law professors.
The thing that broke my heart is none of those little groups were talking
to each other.
So some of the pieces contradicted each other.
Even if it is just aligning and getting critical mass
on the existing initiatives to force multiply them,
that's reasonable.
I think some of us are more angry and more aggressive than others
and I hope that's why we're going to figure out what we can agree
on and make sure that we keep ourselves honest.
It is going to take a lot of work.
I do share your concerns.
Thank you.
Hi.
My name is Sara Jeffrey and I actually am really very,
very grateful that you brought up Weev's case.
I do prison support for Weev I mean, Jeremy Hammond, Barrett Brown
and Bradley Manning.
And they have a CFAA charge in their rap sheet.
I was at the defense of Bradley Manning.
For about six hours of the first day they were discussing
the difference between an exe file, an installable file, and shortcut
of a CD on a given drive.
(speaker off microphone.) What?
More action, less talking.
Okay.
This is part of the court marshal, one of the biggest leaps Okay, get
the fuck out.
This is important.
(applause).
The reason I'm not backing down is because every single one
of you here are being persecuted like the actual activists.
And Weev has had 60 days of admin segregation
for tweeting from prison.
Barrett Brown has detoxed opiates without medication.
Jeremy Hammond has been in over 80 days of confinement
for making inmates make anonymous paraphernalia during art projects.
Bradley Manning has been tortured naked 23 hours a day and
they called them a hacker like the way they did with Snowden.
And they are using WGET as a hacker tool.
These are all in the actual court proceedings.
You can read them from the Freedom Press Foundation.
They are coming for all of you, so you guys need to put the egos aside.
That's all I wanted to say.
Thank you.
NICHOLAS PERCOCO: Thank you for your comments.
(applause) NICHOLAS PERCOCO: That's falls directly in line
with the discussion of the preservation of security research.
As a security researcher, I have done things in the last couple
of years which I may not want to do today just
because of the chance of the broad application of CFAA.
So thank you.
Hi.
You guys have talked a lot about the legislation that you don't
want governments to institute against hackers.
What about any legislation that you might want
to institute that would provide a counteracting effect like, for example,
holding vendors of vulnerable systems
more accountable.
JOSHUA CORMAN: I'm not sure people had that.
I had a little echo there.
Again that cognitive dissidence is ever present
in my mind that I don't necessarily want to add a ton more legislation.
It is more about fixing existing ones
whenever possible.
I think we should use it sparingly.
One of the things we've realized there is a lot of things that divide us back
to the prior comment.
Some people are like, why are you talking
about an amicus brief for Weev.
He's a raging troll asshole or something like that.
I think it doesn't matter if you think he is a raging troll asshole.
It is like People versus Larry Flynn.
You didn't have to like pornography.
It was about free speech.
We have to participate in the working groups that are looking
to rev CFAA.
It is not even for criminalization research.
People are looking at defending themselves
with other things that are also controversial.
One of the things that a lot of people do
is application security research.
They realize there is no liability whatsoever.
So if a toaster burns your house down, you can sue
the people who make the toaster.
If a device gives you too much chemo, you can't sue and win.
We don't want to hurt GDP and competitive edge, but there
is plenty of precedent.
In the medical devices, you have the FDA.
Or in cars, you have the five star crash system.
It is not about shoehorning laws but tweaking them
instead of creating them from whole cloth.
Doug?
Two quick questions.
Pick which you want.
Most of the populations you are talking about trying to channel here tend
to prefer true democracy, one person, one voice, one vote.
What we work in for the most part to do legislation
is representative democracy which is a very different system.
How do you plan to resolve that without alienating people?
The other one is got a lot of people standing up here.
It is awesome.
I love to see that.
Who you do you keep those people enthusiastic at 6 months, 12 months,
18 months, 24 months?
JOSHUA CORMAN: Great points, great questions.
The reason I want to have that constitutional Congress
is so we can decide how to make decisions.
We decide how to decide.
There will be trade offs to all those.
Anything volunteeresque will have its ups and downs.
I think the reason this will have some staying power,
especially if we have early movement and wins
is regardless of your motivation if, you are altruistic, there
is plenty of motivation.
If you are a narcissistic vulnerability pimp I was talking to somebody
and they are like: I don't care, I want to be famous.
How much relationship do you have with CNN or Vanity Fair?
We could be a platform as a service for broadcasting good work.
So there's some built in incentives regardless
of your motivational structure to get some benefit out of this.
And I think because we're so frustrating and because there is no other line
of defense and it falls to us, I'm hoping that that gets
a little bit of movement.
Plus we just need to get an early win.
I think we have a couple in mind.
We have done a lot of prehomework.
Did I answer the second question?
So I just wanted to say while it is easier to subvert existing processes,
we can use the same lobbyist organization
or professional board or whatever to advocate repeal
of existing law that we disagree with.
We don't necessarily have to just roll with whatever's there.
A voice is a voice.
And we can use that to repeal law whole cloth.
So for people who have reservations about that ...
JOSHUA CORMAN: That's true.
Absolutely.
NICHOLAS PERCOCO: Thank you.
(applause).
Again, the choice between two questions.
One is: We know we can save people.
Okay, we can swoop in and rescue the public.
How do we make this more public?
How do we let shoutout that we've done this?
And the second is if you could if you are familiar
with the 501 medical device registration and where that fits
in in the class 2 F.D.A., could you speak
to how we can get software elevated to even a class 3 device?
JOSHUA CORMAN: Okay.
So I'm not the expert on the medical device pump.
But that's why we've sought out people like Kevin.
Kevin does a great job within his scope and remit.
When I talked to him about Bluetooth tiny anecdote
before we run out of too many I said why do you need
Bluetooth on an insulin pump.
He said, it is not like it is a pace maker.
He said it is the bacon principle.
Everything is better with bacon, everything is better with Bluetooth.
One manufacturer did it and then they all had to do it because it was cool.
What you have is something that's not medically
relevant that's highly attackable in a life saving situation.
So we need those subject matter experts to answer the spirit
of your question and that's what we mean by mapping these.
I think the roles and responsibilities we are hoping you can do,
once we map that kill chain for that particular industry,
then we can start iterating.
The pushback I gave him, he said, Josh, the F.D.A.
had a choice between failing to approve
a medically life saving technology or being afraid of a theoretical hack.
And I said, okay, fine, they had to rubber stamp it
but they could have also said by 2015 anyone putting elective remote
technologies on a device could have more validation
and testing.
There is ways to look at this as a marathon even
if they couldn't do it with current things.
I'm not trying to trivialize it.
I know it is far more complicated.
Keeping at it and being the tenacious hacker that fuzzes that
kill chain, we will win.
First of all, I think that a lot of people
like my mother couldn't put together that hacking is related to safety
and it was a matter of teaching her, well, you know, you have
to find these vulnerabilities.
When you find them, then they can be fixed.
And until that point, somebody could exploit them
without you being aware.
So putting the spin on it, being about the safety of our families
is super important.
JOSHUA CORMAN: I agree.
Second of all, how will you prevent an organization
of hackers from being open to abuse?
Because I feel like every time I see hackers organize,
they do things like hoard exploits that it just doesn't
work out so well.
JOSHUA CORMAN: That's a concern that's come up often, is,
you know, one of the things we actually said
in our Anonymous research it was very prone to infiltration and hijacking.
There were several political and government groups infiltrating.
One of the things that's interested about hackers, they are prone
to influence but you can't control them.
We are really hard to control.
It is almost the virtuous being so chaotic.
I think this is going to be hard.
I think keep bringing these criticisms.
This is a good time for probably one more question.
Then we will go to the room.
We want to flag every single one of these because we don't want
to just try something.
We want to actually succeed at something.
So keep raising these concerns.
Oh, look, it is Jay.
Last question.
How fitting is it that it is Jay Radcliffe.
This week I spent all week talking to media about a talk I gave
at Blackhat and BSides.
A software flaw put me closer to death than I would have liked.
And when I approached the vendor about this, they said,
you should have read the manual.
And we're not fixing that.
If you think that, you know, these things are in the future
and that they're coming, they're not.
They're here right now.
And we need to change these things right now.
And I can find a hundred medical device flaws
and I'm still going to get the same response.
It's going to take a mass movement.
It's going to take all of us getting on the same page
to make this problem change.
I can do all these things, but I'm not going to move the rock
an inch forward without more help.
Exactly like Josh is talking about.
In the media, in lobbying groups, in places that we haven't been
before and there is no reason that we can't get together
and move that system.
(applause).
JOSHUA CORMAN: Thank you.
NICHOLAS PERCOCO: So we're out of time
but this conversation doesn't have to stop.
Please join us for Q&A in the Chillout Lounge immediately
after this talk.
Thank you.
We also have stickers up here on stage if you're interested.
(applause) NICHOLAS PERCOCO: They're on the chairs at the end.