>>We are going to kick this off with Mr. Jay Healey, a member of the Defcon approval team. And he is going to talk about some big picture stuff. I think this is going to be a really, really interesting talk. Yes, sir. Well, I'm going to turn it over to number 2 who has something. >> Will you introduce the speaker? >> So introduced. This is Jay. [applause] >> So, I'm hoping this talk isn't going to be as lag as that video was, so you, get, well, good, well, done. [laughter} Thanks. >> Okay, so raise your hand if you are a first-time speaker at Defcon. Hey! We have a winner. We have a little tradition here at Defcon. First-time speakers must do a shot on stage. Congratulations! >> Thank you everyone so much. So, if you want to know how to be a first-time speaker and be on the CFP Review Board, the answer is know the dark tangent, so. But the DT wanted something different, something new. New tracks introduced to Defcon and if you read what was put in the program it won't be a surprise what he wrote in this year's program. Last year the Dark Tangent wrote in the program about how offense is overwhelming the defense. And he wrote in this years how this is leading to a sense of helplessness. The Dark Tangent and others has said we can't just submit ourselves to this helplessness. We all need to be part of the solution. And when he says 'hack with us', he's not just saying take out your computers and go have fun, he's saying we all need to own part of the solution. So a lot of the talks you are seeing in track 1 are about that. How can we get our legs behind responsibility or at least reasonableness and make things better, because they're not. And so that is what this talk is going to be about, so. And the reason he asked me to do this talk and be part of the CFP Review Board is, there are all sorts of great efforts happening in this. Uhm, mine happens to be I work for a DC think tank. We tend to do national security issues. So a lot of the other talks might be from IM McCalvary to the CFF and they have their own legs in this. Ours is to look at the national security lane. And look at the big picture. I have been part of the community, first came to Defcon 2009, was with military signals intelligence. Did some offense, mostly defense. Created the first military joint cyber war fighting unit in 1998. Set up security in one of the big investment banks, went to the White House and was a director of cyber policy for the president giving advise on these issues. So now I'm in a think tank so I get to write and talk on these issues. Wanted to start out with a movie, anyone know what movie this is? Uhm, yes. That's from Zoolander. What's happening here. It's Gas Fighter! WHo said it first… come on. Come up here you get a free book. I wrote it last year. It's a history of cyber conflict. Kind of a military history of cyber space. This is the gas fight in Zoolander. And I wanted to lead off with this mostly because I wanted you guys to be interested and what's cooler, gas fights are cool. So what happens in the gas fight scene? >>[off mic] >> Yeah, these moron, male models right… my former colleagues right but. So they are riding in this convertible and they think it's going to be so much fun splashing each other with gasoline, and they are hosing each other down. And you know it's funny, because you know you don't play with gasoline. And you know where this is going to end up. You know this is going to end up really freaking badly. And of course a couple minutes into the scene one of them glamorously takes out a cigarettes and paboom. And the whole thing blows up. You know it's funny because you know what's coming. What bothers me so much about this field we are in right now, is that all of us knows, in this room, in Blackhat before this, in Washington DC, at Ft. Meade with cyber commands in NSA, in Moscow, in Beijing. I think we all know we are covering ourselves with gasoline. We are playing with gasoline. That we are all just coating ourselves in gas. And it's not funny, we all know what's going to happen. From the research we did for the book, I can't find anything about anyone really dying from an online attack. But, we know it's coming. And worse, a lot of the people that are busiest spraying with gasoline are saying watch out because this is going to be dangerous. General Alexander, the cyber command folks. It was funny when the models did it, they were just going burn themselves up, but the world is relying on this stuff that we built on the internet, cyberspace. So the folks involved in the gas fight aren't just burning themselves, their going to burn all of us. What I think is very much missed when I'm talking in Washington DC, it's our job to go around and talk to some of these Washington, DC policy makers, pentagon, up at Ft. Meade, White House. THe debate is all about cyber this, cyber that, cyber the other thing. And I always have to remind folks that the internet is the most transformative thing that's coming out of human brains for 650 years. Since Guetenberg invented the printing press. Yeah, electrical power is pretty impressive too. We will give the internet the top 2 or 3 alright. The most transformative technology as we as human beings, all together have done. Because of the printing press, it gave us the renaissance and the enlightenment and all of the ideals. The real scientific methods, the Declaration of Independence, all of this wonderful art and science and rationality that came out of that. But imagine if 20 years after Guentenberg invented the printing press, it turns out the Pope, the Princes of Europe, pretty much anyone that cared could know what was being printed, exactly who was printing it, exactly who they were passing it to. Of course we can say that violates privacy, civil liberties, we can argue if it's legal and constitutional, and people will. But I think that might be missing a larger part. If you couldn't rely on that underlying communication mechanism, you probably don't get the renaissance, and you probably don't get the enlightenment. You've changed the trajectory of humanity - not for 5 years or 50 but for 500 years. And you've probably changed the trajectory of humanity from then to every generation for when humans are in the universe. So, we know how important the internet is. We know the threats it's facing. So what I want to try and get across in this talk is to get together and bring across in this track is maybe these threats are moor existential than we think. Maybe privacy isn't the main thing at risk here? So of course we can argue we've been pushing too far national security and spying and the cult of the offense and that's outweighing privacy and civil liberty's. So, who's a Douglas Adam's fan? Alright, you got it first. You get a book. I'll sign it afterwards. Yeah, that's someone else's problem. In DC I say I don't care about privacy and civil liberties. Of course I do. I know Jennifer Granick has that… ah, there's ACLU, there's a lot of folks that are going to to worry about that. Others have that voice. My specialty is to say, maybe we are making tradeoffs today's national security at the risk of our digital economy, our digital future and these future trajectories. Because I can't walk into a 4 star general or the White House and start talking about privacy or civil liberties. It seems muling. And you have generals from a militarized cyber power, which I came from - right? I'm an insider to this, and if you go into these hardcore trying to protect Americans from terrorists, you're not going to win this by talking about privacy and civil liberties. If you say this is a stupid national security and why, you would have a better case. The argument I'm trying to warm them up for is, we're making trade offs for today's security and the internet as a whole and in fact our trade offs now between security and the future securities till the end of human kind. And so I try to hit them with the punch line, is that, when I hear people in Washington, DC folks say, well, why should we stop if nobody else is going to stop. When I say, well maybe the future is going to look very different. they say, no, no, no… it's going to be fine. Now how do we know that. How do we make these tradeoffs. Whether it's in this community with security researchers, hackers and the rest. In DC, the policy community, everywhere in between and all the other capitals. How do we make these tradeoffs so security is better now so that we're not going to miss out on future renaissance and enlightens, if all of us keep pissing in the pool. So, I say 'saving from cyberspace'. What do I mean by that. It's great when you do history because it gives you all the other slides, things people have come up with. this is a slide from 1997, a defense science board. I love this, it's kind of if you go to a threat talk. People are going to be doing this range. You get the evil hackers that you know you'll hit with low potential damage, all the way up to state sponsored and not that much has changed since 1997, [laughter], (unrecognizable) state sponsor, and for you young ones. That is Sudam Husain in the upper left. If DC21 was your first one you might remember this. But also, when I'm talking about trying to save cyberspace, it's not just about those kinds of threats. If some of you went to BH and heard Jeff Moss kick off at BH, he asked the group and asked how many people think we're going to keep adding complexity to the system. And, pretty much everyone raised their hands. And then he asked how many silly chuckle heads think that there's gong to be some limit to complexity. I think I was the only one that raised my hand. Because he was asking if we think we will regulate or legislate and keep adding complexity. And I think, I was in the finance sector, I know from 2008. that if you keep adding complexity to the system and don't understand it, it can all come crashing down. And what we might end up with, that looks very different. So one of the things I want to leave this audience with is, be thinking of those discontinuities. The future may look very, very different for good or for ill. And Dan Geer is one of my favorite folks, he passes gas and my IQ goes up about 5 points, he has this quote I love. "As society becomes more technologic, even the mundane comes to depend on distant digital perfection." So the same time we are connecting everything to the internet, when we are most worried about the offense running away. And so we need to be thinking of those longer trends. One of my favorite quotes when I did the book, "Few if any contemporary computer security controls have prevented a (red team) from easily accessing any information sought." Which by the way, I think they have in the book store, called 'The Fierce Domain". Few contemporary security controls can stop a dedicated red team. We know that, you're going to be hearing that all the time, everywhere. This quote is from 1979. Lt. Colonel Rogers, US Air Force, was the father of the rainbow series of manuals. You know, the red book, the orange book the blue book… 1979. What he's actually saying here is the attackers had the advantage. Offense has had the advantage over the defense since 1979. Before Defcon, since before there was really an internet. So if you do defense, if you are an internet security guy, what the XXXX are we doing? When I'm a glass half emptied, I say nothing I have done has mattered. The billions that we've done, all the pattens that we've done, all the vulms that you've discovered has been wasted. Now when I'm a glass half full, I at least say we are keeping up. The attackers are better, but at least they haven't ran away with the field yet. In Biology they called this the Red Queen affect. From Alice in Wonderland, you have to keep running faster just to stay in place. But how long can a system stay in place? Keep it's balance year after year, decade after decade. With one side have a persistent advantage and gain. And that system can stay in balance. At some point you have to think this can change. So, I'm a military guy. A lot of military history and it doesn't have to stay that way. That one side has the advantage all the time, it doesn't have to stay that way. In human conflicts since we first started, we picked up stone and stick to one another. The balance between offense and defense changes all of the time. Except maybe nuclear and space. You know riding a pony on a calvary and the offense would have the advantage until they meant mass range of fire and then machine guns. It goes back and forth all the time. We can imagine this, we can imagine that the defenders can have the advantage. We can flip this. So, there is good news. We know security is getting better. We know there are places where we are beginning to make a difference. We also know that the bad guys are running away with the field. I love this Dan Geer quote, 'Whether in detection, control, or prevention, we are noticing personal bests but all the while opposite is settling world records.' We're racking up perusal bests but the bad guys are setting world records. But maybe it's not just a simple straight line that the bad buys are getting better than us. Maybe they are getting better exponentially than we are. So, I've heard some people make that case. So where, do we hit that tipping point. When there's more predators than prey. Especially when it turns out governments seem to be trying to be the most efficient and veracious predator instead of protecting us from the others and being prey. So now you hear a lot of moaning and groaning in DC about how it's the Wild West. Go how it's a wild west. It isn't the worst of things. To wild west, because posse. Things worst than wild west. Right now, have advantage. You can imagine a place where the attackers have supremacy, every time online strategy, there's some asshole with an AK47 or machine gun on back of pickup truck rolls by. It might be Somalia, a stable state, where every time we try and get our act together we get dragged down. When I get asked for saving, when we talk about security, there's no time for ‑‑ most of us do incident response where time horizon is, how hell get serve back online, forensics. We live on a timeline of, at best, a couple of hours, a couple of days, a couple of weeks ahead. In D.C., saying a sustainable Internet. We need to make sure that it's not going on just about there for awesome 2014. If we want our kids and grandkids and their grandkids to have a free Internet, an open Internet and resilient an awesome Internet, we need to start thinking now. That fits in with privacy. There's a lot of good efforts to try to add that time horizon. When I think, generation or grandparents generation, some in the back great grandparents' generation, they thought the national technology, jetpacks, vacation on the moon and Mars. Why wouldn't we? That's the national direction that the technology is taking us. So of course we are going to have those things in a couple of decades. It reminds me of e‑Voting. In the mid‑90's, electronic voting, Internet voting, that's going to happen and give us a new democracy. Where is it? There's all of these possibilities, all of these technical possibilities that we're not going to get because we can't secure it. Smart group Internet of things under so much of this unlock embedded medical devices. If we don't unlock the security component. I'm afraid we're going to look at D.C. 42 and look back 20 years and say can you imagine that we thought we were going to have those cars. Good thing we chopped them up and proved how insecure they were, or whatever technology. We're not going to get what we can unlock with these technologies. When it comes to solution, to me the only vision, if you care about the future of the Internet is to flip this around, to get defense better than offense. So the ass holes have the harder job '. What we want is to get defensive and better. Get superior. We have the supremacy. So, I'll talk about how I'm helping and some of my programs. Of course I will talk about how you guys might be able to help. First you've got to believe that it's possible. In Washington D.C., I come across very few people that think that the defense can ever get better than the offense. They've given up hope. The DT wrote in this program, if we accept defense futile offense wins, we all start trying as hard. I can see this very much in Washington D.C. if we don't think defense can get better, then there's no reason for us to restrain our own offense. We might as well be the biggest, baddest player in government, because everybody else is going to do and we've got nothing to lose. So you have to care and think that you've got something that can contribute to this. Especially joining. Your time, your brain, your patience. I will talk about each one of those. Your time, there's so many great groups that are out there, whether that's EFF, whether that's IM McCalvary, that's trying to get out and saying we security researchers haven't done anything. We can't keep releasing this stuff knowing that it's not going to get fixed correctly. We have to start feeling some ownership over the results. The D T talks about that in the program. Or dedicating your time to some of the volunteer efforts. Join so many other open source efforts. We might not have to go through heartbleed. If we had more time, volunteer and monies and evolved in a lot of the open‑source projects out there. World is pretty much depending on us to get this straight. We have to feel some ownership for that. Patience, if you are a vulm researcher. We know the first time you go to a company and say, I found a vulm, they might just brush you off. Have some patience with them. We need to try and keep ‑‑ we need to have some patience, even when people don't understand what it is that we're trying to do. Last is always trying to measure. I come across this with security research as well. Folks that say we need Washington D.C. to understand the importance of what we do so that they don't criminalize the kinds of things that we do. That's a great panel, if you see something, say something should apply to our field too, and we shouldn't run into the CFAA and other laws. The stuff that we're doing really matters. What you are doing as bone researchers. To me, when I say how do you know as a security research community that you're making a positive difference? That you're helping the defense more than you're helping the offense? I get there is this one time, and I knew this guy, and the role of importance that we're traveling in society in the digital future and we're all trying to build together, we need to move past anecdotes and showing the difference that we make. Anecdotes aren't going to cut it anymore. Obviously, not everyone is going to measure. No everyone can feel ownership. No everyone is going to want to dive into this. There's a lot of great efforts and ways you can dive. What I am doing in Washington D.C. is policy makers, push the idea of sustainable cyber space. Defense is better than office. The way to do that is to try to work on the scale. Have them succeed a million times or a billion times, and you will see some of that coming up in this track in this room today. For example, I'm interested multi-compilers - in things where we can take away entire classes of attack that no longer succeed, instead of just trying to always patch and being behind. I'm trying to convince D.C. that they are not as much of the solution as they think they are. That there's nine players on the ball field. We don't need one general running around every where running around saying, I got it. I got it. There are many that can be close to the ball and make the play. If they're allowed to, or 'they're allowed to, maybe they can't see the ball well enough. Maybe they need a better glove have glove. Maybe they need to be reminded they are on the field. That's how I was when I was on the field as a kid. [Laughter]. But pushing this as a private sector, not saying the private sector doesn't have its own problems. I'm tired of hearing in Washington D.C. that the private sector is the problem. Last, or I'm trying to push hard in D.C. for a single ‑‑ right now we have three strategies for the Internet. The state department talks all about Internet freedom. They get involved in I can an some of those issues. You have department of commerce get involved, good broad band. They vaguely own the I K relationship. They're focused in on those issues. And of course you have the military and espionage. If you have three different strategies in your life, tough when you have competing priorities. Our leadership in D.C. needs to understand that right now whenever there's a competition between these priorities, between the military and espionage tend to be winning out. They have the most money and the post competence. They have the best lawyers willing to get T S. The lest bureaucratic friction. We need to change that around. I'm going to try and help break that. The tagline is going to be prosperity first and foremost. Thinking about how can we make sure the Internet is going to be there? I do think distruptive technology as has its place. This is a point I made more rat pack than here. We have community vendors that have a new box, script and software for a particular solution and we keep adding complexity on type of the complexity, so disruptive technologies can work, but they have to be the kind of technology that works at scale. Thank you very much. (Applause). So that gives more time for shots and for Q and A. I think Bob, who is running the room, go to the mike so we can make sure we get it on the video. I will go to my right. If you are all buying me shots, try and coordinate on the same kind of alcohol. [Laughter]. >> So a question is whether or not we're asking the right question. Defense or offense. The first thing you learn in the military history is a doctrine that says anybody that does merely defense is inevitably going to lose the battle or the war. We've stuck with this for a long time. We have issues about realtime in gang meant. That seems to be shifting with the cyber command starting to attack some of the nation's data base, A P T teams. So I think that the entire formula changes once you start going with offense yourself. It's the offense that's attacking you, and you can also, to use an example from military history, do what China always did, don't try to stop them at the perimeter. Let them come in and exhaust resource to take over. There's all kinds of ways to create resource exhaustion. >> Certainly, we want to change the work factor between the offense and defense. One way to raise it is to try and disrupt them. On a ‑‑ when I'm in my month moments that says an armed society is a polite society. I'm not convinced that we get at‑scale defense better by attacking them. Defense doesn't have to be hard. We just suck at it. One of the reasons, now, why the Department of Defense is being more authentically minded is they can't defend their own systems. I am not a fan of saying, as an enterprise, as an individual corporate enterprise or as an armed military with uniformed people with an American flag patch on their shoulder saying we should that we should do destructive attacks because we are not good at defense. It has a role. I'm cyber war fare, cyber, cyber, cyber, so it got a role, but we're defaulting to it because we suck at defense. That pisses me off. We got to go back and forth. I'll be outside here. >> The technology we should be develop, this, you have any particular recommendation? Are we thinking large scale? Should we look at very sophisticated intelligent, automated analysis of code, before it gets deployed to? What do you feel is the best way forward that we can help develop? >> It's a great question. Some of you guys that are closer to the technology than I've gotten in D.C. can have better answer. The kinds of things we can taken tire class of attack. I'm not convinced the inspection for that. If the world's ISP run as cleanly as Scandinavian ISP, we would have a lot less problems. We would have a lot fewer problems. I'm interested in ‑‑ we've got a couple of other talks that will be in this track that are hitting that, I think, focussing on ISP's. It doesn't have to be technology. It's ownership and a willingness for responsibility to no longer pass the trash. It's not crazy in Washington D.C. to talk about zero nuclear. We won know we can't get there. I like to set goals that we can get to zero (unclear). If we said everybody come to the table and try to get buttons out of the systems, we could do it. One of the reasons I'm here is to find out what are some of these other changes of attacks that will ‑‑ I'm sorry, attacks that we can just take ‑‑ whether it's. >> If you are interested in getting the private sector, how are you incentivize the public to security over functionality? >> That's a great question. One is to look that we've got different parts of the private sector. Washington D.C. tends to paint ‑‑ there's a couple of things that I would do. One I would launch the department of home land security set up a program. You can take $10 million dollars to look at group like open source vulnerability database. These groups that are actually on the ball‑field and making the plays and making due with $10,000 a year. So, one, let's find out who is playing on the field. Who is close to the ball and help them out'. Two, this is if I were D H S in the White House, I would be convincing Warren Buffet and ‑‑ these people that are shareholders in the companies that are making these bad‑risk decisions. We still see Washington D.C. say we to have convince the system administrators or chief information officers to do the right thing. Screw that. In American style capitalism, it's the shareholders at the end of the day holding the risk. They own the company. We are board directors of representing them. I say don't let the government try to convince the board directors, go to the shareholders. Before Y2K, the California pension retirement system, $250 billion went to all of their companies and said, how are you getting ready for Y2K? Let's get Warren Buffet and say I'm not going to invest unless they are getting cyber security right. We have a couple of ideas we can incentivize using process. We can talk about that. >> Earlier you said that when you tell the military to obey the laws in the United States, it seems muling, and in your response write will you said the shareholders of the corporation hold the board of directors responsible and do what they do. What good is all of your policy and talking if the United States military will not obey the laws that exist? Aren't your words just weak aren't you just dust of nothing if Clapper and Alexander Congress, lie to us >> I'm not saying ‑‑ >> Of nothing, if Clapper and Alexander lie to Congress, lie to the court and us. Shouldn't we start with accountability at the type instead of creating a bunch of tracks in the dessert. >> It's a mix. All of us, from whatever angle we're trying to take, have the decks stacked against us. I'm not saying I'm coming win the strongest argument. I am coming with an argument that is more likely to win in Washington D.C. So I came out probably a year ago now and said General Alexander, forced to retire earlier. We need to separate at least the leadership of NSA and cyber command as a start. We've got to start from that. And it ended up that the ‑‑ the president made other decisions on that. When I came out with that piece, I had people all over Washington D.C. saying, you can't use my name with this. But good job. Don't tell anyone I said this. So there is a groundswell of folks who said we have been going in this direction and it's not necessarily the right direction. Folks that say, let's talk to four‑star generals that have said, how we got where we are is like a French Post painter like Georges Seurat. The guy that mask all the dots on the canvas. We never stepped back to look at the painting that we were actually making, especially the way others saw. I'm not saying we're going to have an easy time, but there's a lot of folks that believe the way that I do in Washington D.C. that think we're badly off track. It's a part of my job. In fact the DarkTangent job, senior associated with my program. We're out trying to make this case. We'll try and, we'll tell you next year how we're doing. Alexander Clapper's in jail. >> How do we take the example of Switzerland as a nation state defense great e than offense in history, cure the, Defcon, to use that model to make a better and cleaner internet. >> I like that, that hadn't come up before. Switzerland has made themselves undevourable. Great chocolate but. I love this, your laughing at all my jokes. They're absolutely between a mystery of terrane, weaponry saying we are too difficult to target. Individual companies have been able to do that in the Internet. I'm saying we're too tough. Look some where else. That doesn't work quite so well. I love that as a model. How can we take that and read out and see if we can make that work on the scale. >> It seems like a combination of apathy and ignorance. >> Yeah. >> There's a saying that if creditor is too successful in the short term, he's going to starve to death in the long term. I'm wondering whether that concept has been part of your research when you're evaluating what the tipping point is going to be? Is there going to be a tipping point or after a certain point, is it just going to come into equilibrium? >> That's what happens to predators, too voracious, resource depletion. We're the ecosystem. It destroys it. That's what I'm worried about at the end of the day. They're not going to exhaust each other. They will eat our servers out of existence. I was talking to one of the four‑star generals and they say, Jay, I get it. If I'm fighting a naval battle or an air battle, not given civilian ship to sail or fly through my battle zone. I get there there's a difference. I say to them I'm sorry. That's the wrong analogy. You are sailing or flying through an Internet that we built, that companies built using our own money. They're not sailing or flying through your battle field. You're sailing in our ‑‑ in the sea that we built. And that's what's going to get that resource depletion. I'm interested to know about what that looks like. Go to my right here… >>Here at DEF CON you have an army willing and able to implement technical solutions to this problem, but on the societal and political fronts, what does the army look like? Is it strong with their strategy? >> There's not a strategy yet. That's part of what I'm trying to bring together. That's part of what the DarkTangent is trying to bring together. When he's talks about why he spent time in D.C., trying to social engineer Washington D.C. Kind of learn their ways so he can manipulate them. You have a lot of folks from the White House and home land security and other places, so it's starting to come together. But I think at this time's still, it's still not an army yet. And the more that we can hear the voices from the community, like, for example, in Germany you have the computer club, I was told the other day has a much stronger role. In other countries, some of the companies have their own governance and we're not going to get that there. >> So is a technical solution enough? >>I don't think we can invent our way out of this, because the government, all governments ‑‑ I got the one minute. The coercive power of government right now is winning. I'm not saying, by the way governments are the only threat. They are amongst the threat that we're facing. But the coercive power of governments is showing itself begin and again to be superior here. It isn't just in the field. If you look for example across the average spring, if you look across all the revolutions, it was people spouting liberty and freedom and force cannot bring us down and nothing was ever won with a bayonet, now they are finding in Egypt and Libya and other places, the bayonet does sometime have the last say. We as a community can not sit back and say well, our free speech is going to win out in the end, because it's not. The government has a lot of coercive powers. China and other governments have way more. I don't think we are gong to talk our way out. Thank you very much. 

(Applause)
[End of session]