>> Good morning. So welcome. This is the Cavalry Year 0. I'm Nick Percoco and this is Josh Corman. A little bit about myself real quick in my day job I'm vice president of strategic services at Rapid 7. But this is not about my day job I am one of the cofounders of the Cavalry movement along with Josh and my big motivation for being here and working with Josh in this is I want to see a day, I want to live in the future and be able to enjoy life in the future utilizing technology and have my family and my friends my father my wife my kids feel the experience technology and never have to worry about using a piece of technology or being required to use a piece of technology for their own health and being in fear that theirs going to be a software flaw or bug that's going to cause them harm. >> And I'm Josh Corman, in my day job I'm the CTO for Sawn Site and I too am not here representing them I speak for myself as a citizen and a father and as someone who is deeply concerned about our dependence on technology. In our professions right, whether you started this out of curiosity as a hobby and which became your profession, software and security issues now permeates every single aspect of your life and that's increasingly in the case. So if we know how bad a job we're doing as a security industry with 80 billion dollars of spending trying to protect random pieces of plastic and magnetic stripes I believe a higher standard of care and our best and brightest should be focused a little bit on things that effect public safety and human life . So we're really happy to see the change in the DEF CON community toward things of consequence. >>So here's where we where last year. Anybody in the room, were you at the talk last year 10:00 a.m. on Sunday? Oh Wow, Great and thanks for being here today. So last year we started out, you know this was a conversation that we had with all of you in the room. This was not, we didn't know where this was going to be or where we would be but a year later, but we started out the conversation about body, mind and soul were really the planks of the platform we were looking towards. Public good, human safety, human life on the body side. On the mind was security research and as security research I was very concerned about that piece and then soul which was civil liberties and we're going to talk a little bit about where we've moved and settled on but today we have some important announcements. >> One year ago we asked you to suspend your cynicism. I think the soul of the hacker is really curiosity and puzzle but too many of us walk around the halls here with our defining characteristic being cynicism and defeat. And we did not want to go quietly. We wanted to find our spirit again and apply the trade that we've assembled into things that have consequences. And as such we said please don't taze us bro give us one year. If you want to ignore us fine but give us a chance for one year of experimentation and we'll come back to you and we'll say if we should keep trying or not, if there's hope or if we're encouraged or discouraged. So slightly tongue in cheek here, it's too hard, I think we're going to give up. The spirit of the cavalry though seriously was that we looked high and low, we met with as high ranking people you can in the government and intelligence community trying to think naively that if we brought the right message to the right people in the right power they'd fix it and as depressing as it was to realize the cavalry isn't coming they aren't going to fix it, it was also empowering because that means it falls to us. We can be the technically literate voice of reason and become ambassadors to educate them and to frame the issues for them so they'll make smarter choices. But here's the sarcasm tag we couldn't get through the medical devise manufactures and we couldn't get through to the auto manufacturers it's just an untrackable problem so instead we're going to make lots of money selling products. So we're going to unveil right now for the first time ever on stage where going to have a solution to some of our friends medical device problems. So first off I met a woman named Marie who is the Director of Cert in Norway and she is about our age and she has a pacemaker, and she's concerned that it will kill her. And because the medical device manufacturers really don't take this issue seriously because no one has died yet from hacking even though there's no logging to prove if they have or haven't. We've decided to make a line of clothing so, can you please welcome to the stage our model. [Applause] >> Those with a medical condition should not be required to sacrifice their night life. Not only will it keep you shielded from unwanted interference you will shock and amaze your friends at the fashion. Now this is our evening wear but we also have, you should see the lingerie collection. Let's give a round applause for Nicole. And I think we should probably auction that off later to charity. What do you think about that? >> Good idea. Yah. Would anybody buy that? >> No. >> But wait there's more. So we had some money left over from our R & D budget and we spent the last year working with our friends who are diabetics. And Jay Radcliff specifically he put a lot of hard hours work into developing a new product that I'm happy to unveil today. And this is a nine volt intrusion detection system for insulin pumps and they should be available next year around this time. >> As many of you saw yesterday we revealed a five star auto safety program for the car industry. And because we want to hedge our bets and we hope they do the right thing, we're also going to unveil an antivirus product for your car. >> So in all seriousness what we wanted to do with this first portion of this presentation is to really solidify the messaging around what the Cavalry is all about and bring you through that process. Last year when we got on stage and did this we didn't have a solid message, we didn't really know where we would exactly evolve into at this point. So what we want to just walk you through sort of the thought process and walk you through, you know, the various aspects of how we're actually accomplishing and plan to accomplish what we're working towards. So first, our problem statement. >> So, you know I am a big fan of Dan Gear and he often talks of security in terms of our dependence right if we're dependent upon it and if it's worthy of that dependence so really what stuck in it for us and really works in the belt way and with policy makers and the general public is the simple truth the immutable truth that our dependence on technology is growing faster than our ability to secure it. >> And the second half of that is while we struggle to secure organizations connected technologies; really they now permeated every aspect of our lives. They're in our cars, they're in our bodies they're in our homes and even in our public infrastructure. So you know, just think about that. Think about, does anybody in the room disagree with that problem statement? No. >> Alright. So, we're not good at mission statements we're good at security. But not so much mission statements. But this catches the gist of what we want to capture we want to ensure that technology potential impact public safety and human life are worthy of trust. Doesn't means we can go fix them but we're going to do what we can with our power with our talent, with our power of story and research and by teaming with industry to make sure that we can achieve these goals and we've approached this with what we call the four C's or collecting, connecting, collaborating, and catalyzing. When we say I am the cavalry it's not Josh it's not Nick it's all of you, it's our talent pool it's a personal commitment that you say aloud which essentially says I'm going to be part of the solution. If I am a researcher and I know how to break things I am going to be part of that life cycle. If I don't know how to break things but if I know how to securely architect and fix things we need you as well. If you are a project manager we're horrible at logistic but we need to act like a campaign that needs to be managed in multiple phases. And the cavalry was really about acting on these four C's. The general idea was we're not going to invent from whole cloth we're going to collect and connect excuse me collect existing research and researchers this tremendous body of work going back many, many years on things like auto hacking on things like medical devices we do not need to invent from whole cloth. The challenge is we do a lot of solo action and when we combine the medical devise researchers on our first call some knew how to hack devises but couldn't find how to get them. Others knew how to get them but had no idea what to do with them some of them had relationships in the FDA or worked at different manufacturers like a Med Tronic or a GE a Phillips etc. -- so when we connected them together - >> We bring people together, sorry. We connect the researchers with other folks in the entire chain. We spoke last year about something called fuzzing the chain of influence, trying to bridge the gap between security researcher and the executive at a manufacturer and be able to connect those people together, connecting the researchers, connecting those to people in media, people in policy to get the right message out. We found that's going to be very, very effective, it has been effective so far. >> You know, and the collaborating we really have to have a tone of team work. There are multiple methods to get attention. This weekend and in earlier black hat you can name and chain. Right. We can find bugs, throw them over the wall, use that as a catalyst sometimes that works. We chose we wanted to be teammates, and we wanted to ready ourselves to be better listeners, more empathetic and find the right stakeholders in these organizations many of whom want to do the right thing. They just need help. They don't have the knowledge, or they don't have the air cover or they don't have the stimulus to do so, so it's the collaboration where we started brain storming saying how do we get around these intractable problems? We're hackers. If we can jail break an iPhone we can figure a way to get more safety standards through the FDA or through the auto industry. And then we're going to continue fail fast or iterate until we have done so. >> And then the last one is catalyzing. You know, through our efforts and through the public awareness of what we're working on and even awareness within the echo chamber and outside the echo chamber if we're able to fuel additional research and more people to make a decision between say finding an android vulnerability and finding a vulnerability in a medical device that's going to be better for everybody else and just trying to catalyze that and fuel that research in a direction where it's focused on public safety and human life. >> So if they're not coming, will you answer the call? I can't hear you. Will you answer the call? Are you up for the job? Because it falls to you. >> All right. So this has been the monster so we'll go quick through this and talk about some of the development in the last 24 hours. So we believe that we have to be ambassadors, right, this isn't a technical challenge this is a communication and education challenge. We have to be a voice of literacy. We will not get anywhere if Congress thinks the internet is a series of tubes. We will not get anywhere if we let the headlines dominate that there's killer attacker frig's sending spam and oh my god little cats - oh my god, we're all going to die and that's not gonna be the most important prioritized issue. So if we don't fill the void that void will be filled by others, they'll be filled by charlatans, by snake oil salesmen so we need to be that voice, the independent voice and we have to research things that matter. I mean yes a lot of us got in this because we like to tinker with things. Any thing. If you want to tinker with anything why not make it something that can actually affect your family or your future. And most importantly doing these things alone we are easily defeated right? And when you link up with teammate you can do more. And when you form a raid of five different talents you can actually tackle a dungeon. And if you want to kill the dragons it takes a guild so we have the most talented most innovative most creative, most adaptive talent pool in the world right here and we have the knowledge and the power to do something so that's going to come by working together. And most of all, this is probably both our biggest strength and our biggest failure this past year when where introspective, is that this isn't about talking to ourselves. We need to work with each other but this is about getting the hell out of the echo chamber. Screaming at each other, screaming in the darkness and kvetching at the bar is not going to fix anything so this is an outward facing initiative. >> And finally we must team with each other. You know thinking about as an independent researcher you're often sitting there in the dark on your own working on your project but when you pick your head up and look around and find like minded folks who want to help out and want to help out even with aspects of they're not deep technical but they have skills in other ways that can help your research, you find yourself much more powerful and be able to complete even greater tasks. >> We have, so now we're going to switch gears a little bit to some of our year zero activities. You want to call out some people? >> All right so most of this has been about people and one of the bad pieces of disinformation we've had within our echo chamber because we haven't done a good job in communicating is this is not a handful of people. This is not an exclusive club. We have a few hundred people on the mailing you list actively participating, we have several dozen researchers and several dozen people who work in medical, auto, critical infrastructure this is a very large and growing collaboration. And the difference has not been again, it's not been our technical skills, it's people who have stood out and said I'm going to be part of the solution so we're going to call out a few in no particular order. We'll just go back and forth. So Mike Murray quit his own company he started to go take a job in the medical devise manufacturing world and he's single handily driving and defining a very robust secure software development life cycle, for one of the largest devise manufacturers in the world. We're not just throwing a bug at them he changed his career to go directly impact and he's going to pull in all of the talent pool from all of his friends here to do so. Katie Misuris one of the pillars of the research community from mat stake days and what not and who basically caused Microsoft to have the very first bug bounty program in history. She wrote the ico standards on coordinating disclosure to help drive more collaboration between researchers instead of law suits. And she's has recently quit her job and now is the chief policy officer for Hacker One to help create a normalized interface that any organization can use to do bug coordination even if it's not there core DNA. I quit my job at Alcomi and I wanted to learn how to build public policy muscles and talk to Congress so in January I started as a CTO at Sonotype so I could actually drive more security rigor into the software supply chain. And the names are dozens. Morgan Naham has been very prominently profiled is working with people like cloudyo and the citizen lab to help dissidence. We actually have Gloria Spites because he liked the Calvary to be more focused on the surveillance state problem or on civil liberties. And we share many same beliefs and whatnot but we're going to focus on different fronts and we amplify and congratulate his effort and if that's in your heart to do we're asking you to join our movement, we're asking you to do something that impacts your life. And then we're sad we can't watch it but we just met three physicians who are also hackers who right now on a different stage are presenting how to undermine and the risks in the 911 alert system because their concern as physicians is can compromise patient care in the ER and in their various perspective positions. That's a quadian replicate. So we're happy to see that that call spoke to people and lit something in their hearts and people like Zac Lynn Yame [indiscernible] built securely to target the home IMT. >> So we have a lot of other things we've accomplished this year and I think personally you know, one of the most rewarding things that I was able to contribute to within the calvaries was I was invited outside the echo chamber to give talks to people. One specifically there was an event the national association of real estate investment managers. I can tell you it's very different than DEF CON. They, I got in a room with them and we were talking about security, security issues, risks to infrastructure, and literally it was about a 45 minute Q and A session and they asked dozens and dozens of questions about the large buildings they're investing millions or billions of dollars into that have internet of things, technology in them, the HVAC systems, the elevator systems, the security systems, the fire suppression systems are all networked and they were very concerned about the security of those devices. I wasn't actually expecting that conversation to go that way. I was just asked to give an update on the latest threats, you know, targeting individuals and corporations and it shifted very, very quickly to internet of things and the infrastructure of large, large skyscrapers in major cities. >> And when we say conferences we don't mean the echo chamber. Yes, we've been invited to speak to some. We've participated in shmookon, blue hat, absec USA some of the larger, Derbycon gave us room for our 100 person constitutional Congress last September. In fact many of you were there, two days of amazing collaboration and figuring out what we wanted to do and how we wanted to do it. But when we say this, an international cyber treaty, and cyber security for nation states was done at the Hague, the closing key note for Europe's National Cyber Security Conference at the Hague was the Cavalry. So for everyone that says this isn't going to work and no one's going to listen, we're being invited to places that we would never have dreamed of being invited to before. And in September I believe or October, no actually November the Cavalry made it to stage presence at TedEx. So my mother-in-law and my neighbors understand that we have risks in the things we depend upon in technology. But the one that was most mind boggling to me was government. I think most of us think it's a corrupt intractable impossible place to get anything done and that it's a bunch of crusty old guys who think the internet is a series of tubes. I am highly encouraged by that group of people. I've done personally, and there's other people in the audience who have been pushing the Computer Fraud and Abuse Act to reform. I personally did over 70 congressional meetings since January alone bringing technical literacy, an independent voice for you, to Congress. And they're listening. So I'm going to show that in a minute but I have a proof point. >> So let's talk a little bit about what worked well. Obviously the mission statement that we've pulled together, it resonated and it's all about timing as well. I think many people have tried and had similar conversations say five years ago but the timing, it's right now, this is the right time to go in and talk to people about what we're trying to do. It really, really resonates with folks. >> The four Cs was really the key. It's not that we didn't have talent it's that we didn't link it together in the chain towards action and consequences, towards results. We did not want to have random activity. We want to see tangible results. I told the press yesterday, we don't want to fix one flaw in one device for one manufacturer. We want to hack the incentive structure so we can make all devices for a particular industry more likely to be designed safely than otherwise. >> We also, we also learned that it takes a guild. It's not all about researchers. It's not all about the media. It's about people working together. Lots of folks who participated in the Constitutional Congresses and the various meet-ups who would self proclaim that they're not technical at all. But they have background. They're lawyers they have backgrounds in public policy. They have backgrounds in PR and they're able to help work together like Josh said, help slay the dragon. It's not just going to be the deep technical folks who are going to be able to do that on their own we need everybody working together. And we need to learn that. >> Yes. And Brian Keefer did and amazing presentation on why it takes a guild using a world of word craft as the carrying metaphor. But one more point, I don't know what kind of class you are when you do D&D or Warcraft or some sort of game but we noticed we have a lot of assassins and I found myself playing of role of tank this year even though I'm not speced as one but we have very, very few healers so as we've done this journey so if you know any healers that would like to roll one we definitely need some. >> The other piece if finding people within our ranks to educate us. And outside, yes. People outside to come in and educate us. One of the, you know Jen Ellis spent time doing things like media training at Beside San Francisco. Speaking to media is very, very hard. Actually having a conversation with somebody just about something is sometimes very difficult when you know that they don't have the same technical aptitude that you do to be able to hone that message but also, sometimes you can be asked questions when you are speaking to media and it comes off completely different when the article's written and so being able to learn how to hone your message, understand your talking points was extremely important and during those sessions I think it really, really reigned in with who was participating. >> Yep. And we really had fresh blood. So one of the things that's problematic around the echo chamber is our rock star culture. We tend to put people up on pedestals and you have to be a rock star and you have to be extroverted and you have to be entertaining. There are unbelievably talented researchers that came to Derbycon that we had never heard of. They're very introverted and they're very shy and in some ways are as talented or more than the people we put up on a pedestal. So we need to start encouraging, incentivizing and rewarding different kinds of things. But as we started doing this and we started hearing from other people we also learned to reduce our jargon, stop using such internal language and internal speak. We got over the word cyber. Cyber. Cyber. Cyber. Right. If you want to talk to the beltway you have to use that word right and if that makes us [inaudible] to some of you we're just going to have to take that lump. We have to hold our nose and eat our lima beans because if you want to communicate with the people we wish to influence we have to meet them at their language, and in their terms and at their level. >> We were not perfect. >> No. >> We actually you know we actually said last year when we came on stage we really didn't know where this was going to go or what this was going to end up being but one thing we did learn if anybody, you know anybody who does any type of project management or project work for clients you know that when the scope is extremely large or the scope expands it becomes very difficult to deliver. And what we learned early on is that while we had sort of the three pillars or the three planks of the platform of mind body and soul, that was a little too broad. And we began to really hone in and focus on body which is also known as public safety and human life. And when you think about that, that message really, really resonates with anybody. It doesn't necessarily mean people in this room but if you talk to somebody on the street and ask if they're concerned with public safety and human life in regards to technology they're likely going to say yes and they're likely going to start listening to you. >> We've not given up on our fears that there's going to be an increased criminalization research. Many of you see it as an existential threat to what you do. And there is a separate initiative or two that I know of specifically working on CFAA to make it more accommodating to research. But in some of their initial experiments they were basically told it's our right and our First Amendment protected speech to research. Now what do you think a Congress person says to that? They say you guys sound like a bunch of whiney brats. Like, what's in it for my constituents? One of the really nice surprises is when we led with the research happening on medical devices or automotive safety which they did care about either given their prior backgrounds or what their constituents cared about or auto industries in certain states then they're at the edge of their seats and they're asking how can you help us? What can we do? Who can we work with? And then you end with, well there's a bit of a chilling effect because there's the threat of criminalization with really vague laws written in 1984. So it's really been the most resonant and as such, even though it pained up to let go of making those, you need to have a north star. >> Also project management is not always very easy as well. Anybody who's participating or helping out with the cavalry also has day jobs, and they have families and personal lives and this is a grass roots volunteer effort. If someone can give five minutes a month that's great. If someone can give five hours a month that's great as well. But running projects and trying to accomplish things sometimes becomes very, very difficult. Sometimes it's like herding cats. I know we've had to have several E-mail chains in order to try to get people on the phone and there were always 2 or 3 people who couldn't make the call. That just happens. Moving through and trying to take bite size chunks instead of looking at this large project and build accomplishments is something we learned would work better in the efforts we're trying to accomplish. >> So just like we need more healers, if you have project management skills or know how to herd cats please, please come help us. We've also had a very poor balance. We've had some really harsh criticism from some of our best friends that we're too holier than thou or that we're not fixing anything fast enough. That this is doomed for failure. It took nine months before we finally said, you know if you're saying you're not doing anything if you exclude teaching, teachers do nothing and since we're mostly focused on education and awareness outside the echo chamber once we told them we had been to over 70 congressional meetings or that we'd spent full days with device manufacturers in industrial controls environments for free, or that we've been invited into automotive manufacturers to discuss the unique nature of embedded security that's different than enterprise security, then they calm down. But we've done a horrible, horrible job reporting back to our friends what we've been working on. >> So some of the surprises, we talked briefly here, we mentioned this but it goes beyond just the PR aspect of it. It's also the soft skills. Professional media training is one of those but communication empathy. Really eliminating jargon. It's very, very easy for any of us to have a conversation about a technical topic. If you were to record our conversation and play that back to someone who's not within our industry they have no idea what we're talking about and that's sometimes very difficult if someone's trying to communicating to a policy maker or an executive at a device manufacturer because they're not in this room, they're not in this community and they really don't understand technology terms and if you eliminate that jargon and soften it it's amazing how many light bulbs you can get to go off in people's heads and you can able to connect with them much better. >> Yah, I suffer from empathy deficit disorder. I think many of you may as well. And I had an argument with Katie Misouris who has been unbelievably wonderful part of the Calvary since pretty much day one. She said Josh, what we lack is empathy. We don't listen very well, we don't think about who we're talking to. We don't understand the dilemma and challenges that an auto maker might have. And as such, we don't connect with them and our advice is not useful to them. And the thing that she said that really stuck with me is, if we want to change the world the first thing we need to change is ourselves. And it's really shocking how the killer app for this entire one year initiative has been empathy. Listening skills, communication skills, mirroring, it's almost like if you took the social engineering and took out the malfeasance many of those skills have become critically necessary and she was right. And she really put us morally on the right path that we need to look and listen twice as much as we speak and understand the dilemmas of those people we're talking to. And you know people have been talking about this for a long time and we haven't taken advantage of it. Jamie Erland has been giving free workshops on presentation skills and soft skill and I have been at certain CONs where there's one person in his audience. So he was right and this makes him jaded. McCurl has been doing this and he's been right, he was just early. So if you want to be more effective, the huge surprise and huge delight is even though we asked you to put some of your heart and mind outside of your day job, the soft skills we've developed have made us better husbands and wives and have made us more effective with our bosses because we're learning to talk on their level instead of just complaining when they don't listen. >> We have one more fashion show today. Public policy. I thought this one was going to be interesting and I bet the farm on this, that's why I changed jobs to one I could go work with Congress. I'm shocked to see what we found. On my very first day of the very first try I encountered a 27-year-old working on the commerce committee in the office of Senator Rockefeller and he actually knew he was in the midst of writing a kill chain analysis of the target breech on par with anything that any one of you have written. I'd like to say he's the anomaly but in many of the offices of both the house and senate we found people of our generation or millenials understood this creative craftware and were asking intelligent questions and can tell fact from fud. And we're asking - I am highly encouraged so for our second fashion show I'd like to bring out to the stage counter evidence to the idea that all that Congress critters are grumpy old white guys. This is Andrew Ruffin. Until a few weeks ago he was on the Senate staff and now he's going back to grad school. He's modeling a lovely attire. [Applause] >> I have a token for you. Thank you. Finding people like him gives me hope. They're not going to necessarily find an oday in a home alarm system but they understand the consequences of it and they've really helped us to understand that this public safety message is the one that's going to most resonate and most push through what looked like an intractable problem. >> So the other piece here, the other surprise was industry reception. I can tell you last year when Josh and I were walking out and getting ready to come on stage Sunday at 10:00 a.m. last year we said we're maybe going to get 30 people in the audience. Maybe if we're lucky 50. And it was a room like this where there were hundreds of people who came out to hear what we had to say. And then after our talk hundreds of people followed us into the chill out lounge to continue the conversation for several hours and the conversations continued for weeks ahead. And so that was very, very shocking to us. >> And what shouldn't be surprising is these targets that we wanted to hit, it did surprise us but it shouldn't, many of them are already here at DEF CON they just didn't raise their hand or try to stick out. There are auto makers here right now. I talked to two of them last night. There are people in medical device companies who have been dying to do the right thing but their business doesn't listen to them. They have mostly the right idea, in some cases they have the exact right idea but they needed air cover and help and as we started getting media coverage in the Guardian and Washington Post and Wall Street Journal they can point at those to their management chain and say I have been asking this for three years it's finally in the published consciousness. Can we finally get in front of this? And the answer they're getting is yes. There's a guy working in a device manufacturing in Germany who every single time we have mainstream media hit he gets a new project approved. And I didn't even know this until a month ago. So this is finding willing teammates who will both get on a phone with us to tell us where the bodies are buried and what not to do. And we're actually able to help them get done what they already wanted. >> And the other surprise was the mission. Talking about human life and public safety we found instantly resonated with people who were in media and in policy. Very different then taking the message to them like Josh mentioned earlier, about trying to - we're all about doing security research and we want to change laws. When we talked about human life and public safety people listened. And that was something that was a surprise as well. >> And a recent proof point of this is on Tuesday this we had an invite only 50 person event over at the Four Seasons and we had medical manufactures present, a law professor from George Washington University, a law professor and special counsel to the FTC who's working on public policy work. Some of the best researchers like Billy Rios and Mark Stanislav and we pulled the right researchers for the right topics, we had the guy who designed and implemented the vehicle to vehicle protocol securely for 13 years. Not only is it resonating, they flew all the way out to Las Vegas for a meeting to build teams and trust, a basis of trust that they're going to then take into the next year together. This isn't a hypothesis anymore. We have tested the hypothesis and it is time. >> So people often asked us, even last year I think even leading up to this, what is the cavalry going to become? And obviously the one thing we've been thinking about and we've been thinking about very, very hard is, what type of legal entity should we become? Because there's advantages of becoming various types of legal entities. We can do more, we can extend our reach more. So some of the choices we had were obviously for profit, that's not something we're interested in. But then there's the other 501 organizations. Things like professional organizations, lobbying organizations and then educational organizations and what we settled on is a 501C3 educational foundation. >> Yah, this really is the path forward. If we only try to change policy without getting hearts and minds it's not going to work. And if we only professionalize our trade even though we're anti-professionalization, that's also not going to work. The real bottle neck here is there aren't enough people who understand the implications of dependence on technology that can put them in harm's way. So we have to make some changes going forward. Right now we're in active negotiations to be adopted by a large C3. If it does not come to terms we're tired of waiting, it's been one year and we'll file our own but this will give us the ability to have tax exempt status and take donations from anywhere, to drive public service announcements, summits with medical, auto, industrial controls and home automation systems. So some of these changes and we'll end with our announcement from yesterday, some of the changes are, we want to be much more self-service. When people ask us what can I do to help? If we're not there to manage them it's been a missed opportunity. So far the best collaboration is someone says can I come lead this effort? Or when Mark Sandinslav said we're to start build it secure it dot LY. So the go getters has been easy but we're going to make it easier for someone to grab a kit and present at a local conference or get white papers, or what not. We have to get better communication transparency. But really it's not, we don't want someone to come to us and say what we can do for the cavalry? Instead we want to flip it and we want to say, here's what the Cavalry will do for you. So if our mission focus is on public safety and human life, any one of you that wants to do that is going to get an entire polished set of resources with connections to the right people and media. With knowledge of the landscape in Congress. With relationships at the FDA or FTC. Beau and I just met with the FDA last week and we're going to go again. In fact we're going to do a siren boot camp for Congressional staffers at the end of August. Anyone who wants to help in any single way great but if we can help you amplify your message and get your message to the right people or the right introductions, we'd like to do so. We need to be more service oriented. >> So this happened yesterday. You may have seen news about it. This is the front page in the technology section of Reuters and it has hacking group wants to play nice with auto makers. And if you actually read that article you would see that we announced yesterday we've released an open letter to the auto industry on collaborating for safety. So we're going to talk a little bit about that. We only have a couple of minutes left. But one of the big things, if you go to the Cavalry.org website, IamtheCavalry.org website you can see more details on this and there's also a call to action for you which we'll talk about in a minute. But we announced within that letter the five star automotive cyber safety program. And there's five points, five stars to that program, it's safety by design, third party collaboration, evidence capture, security updates and segmentation isolation. >> These are critical capacities. These are not going to be a PCI list. Checklists don't work. This isn't going to be telling them what to do and how to do it. These are five foundational capabilities we think every car manufacturer is going to need to have and we'll help them interpret, define and attest to them. Number one, we recognize safety is important to our customers as such we've published an overview of our security software development life cycle for how we design, develop, test our products and our supply chain. So tell us what you're doing to factor security into your design. Number 2, you'll like this one. We know we're going to miss things so we invite the participation of third party researchers acting in goodwill with our published coordinated disclosure policy. How would you like to avoid 12 years of adversarial relationship with the auto industry? Number 3. Failures will happen so we need to actually study and understand and learn from our failures therefore we're asking for tamper evident forensically sound evidence capture. Now this is not plain speak for my neighbor, but think in terms of a black box. You cannot simultaneously claim there's no evidence of hacking when you lack the ability to capture any evidence of hacking. So this has to be in place going forward. 4th. Secure updates. Imagine heart bleed in your car unpatchable. Would it scare you to know several manufacturers use vulnerable versions of open source components and their remote connectivity? We have to be better and we're going to start being better. So the ability to update your software. Lastly segmentation and isolation. We believe that there should be - oh I was listening to the [inaudible] too much, but you've got to keep them separated right? You need to have separation of critical systems that affect life, like your braking, your steering column, your air bag, from systems like infotainment, noncritical systems. A hack of your stereo through your blue tooth should never disable your brakes. And unfortunately through shared circuitry like on a can bus, right now they're sharing the same circuitry, the same memory map. And we really want to see [inaudible] of what logical and physical isolation techniques they're using. And again we're going to help them to do so. So if any of you have driven a car, ridden in a car or intend to ride in a car we would like you to go to the following site and sign. >> So if you visit this site, it's a bitly link five star auto, so bitly/fivestarauto. Put it in your phone now, everybody in this room take five minutes after the presentation, read the letter, read the petition and sign it. We need everybody in this room's support. >> I know you're going to be concerned about privacy. I love privacy. You can fill out that change order thing even though it asks you a few simple questions. I love privacy, I'd like to be alive to enjoy it. >> In all seriousness in the last few moments here some people think this is a waste of time, it's not going to work. I'm willing to try and waste my time. And I hope you are too. Some people think nothing will get better until we have accidents, bad outcomes, dead babies. I hope they're wrong. But here's the deal. We can either wait for these catastrophic triggering events because we always have a sane and rational response to catastrophic events right? So rather than avoiding like the polarizing emotional ones Andrea reminds us that the Cuyahoga River in Ohio had to catch on fire and stay on fire before very aggressive major laws were put in place to do something. Twice. So before we have our cyber Cuyahoga moment we believe that if we start the education and start the collaboration now and we raise the threat IQ of policy makers, then that knee jerk will be slightly less severe. So if you think we're early we've chosen that now is the time to start. And the last note I'll say is attitude is everything. I'm going to remind you what we said at the beginning. At my first DEF CON the defining characteristic of this demographic, our zeitgeist was curiosity. We passionately loved to figure out how things worked. When I walked around last year it was cynicism and defeat. Cynicism is a choice. And for many reasons we've come to that point. But we can choose to do something that gives us fulfillment and purpose and we can choose that the timing is right and we can choose to hit reset. It's not going to be for everybody. If you want to watch us fail, that's fine but you have a choice about your attitude and I would encourage you that the timing is now. People are ready. The consequences are severe so please choose wisely. >> So how can you get involved? One of the big things is if you have the opportunity you can get a job in the target industry. Medical device manufacturers are looking for security people. Automotive industry is looking for security people. You can get jobs there. Innovative things companies are looking for security people. There's plenty of startup companies popping up left and right that need security people to work for them. You can research some of the target technologies. If you have that choice between a mobile device or a medical device, choose the medical device. You can speak at target industry events. And that's not DEF CON, that's not Black Hat, that's not besides. That's medical device manufacturing events. That's internet things types of events. Automotive conferences. You can speak at those conferences. They're looking for people to speak on security. And then you can help educate policy makers and media. When you have an opportunity to speak to those individuals you can explain the risks and explain it in clear easy to understand language so that the message is clear and broadcasted to the public in the right way. And of course you can join the mailing list. If you want to become and active, active member or participant, join the mailing list or visit the website and Beau Woods has done an amazing job over the last several months building a website that has clear messaging on it and information and it's just going to grow as we have bodies of evidence to publish and place on that site. So the Cavalry isn't coming so it falls to us. It fall to you. Can I hear an I am the cavalry? Can I hear I am the cavalry? Oh. I am the cavalry. Thank you for caring and thank you for giving us that ear of experimentation. So I think should we do another year? Should we? [Applause] >> All right. Thank you. >> Thank you. >> I don't know. So if anybody has questions for these fine gentlemen we're going to escort them out to the foyer and you will be able to talk to them out there.