[00:37.560 --> 00:39.000]  Have we learned anything yet?
[00:39.140 --> 00:39.680]  Well, let's see.
[00:40.000 --> 00:42.720]  I haven't been to a HOPE conference since the first HOPE in 1994.
[00:43.380 --> 00:44.760]  We've come a long way since then.
[00:44.900 --> 00:48.440]  We have real pretty badges and technology really grew somewhat.
[00:49.440 --> 00:51.880]  But at the moment, let's look at corporate IT.
[00:52.600 --> 00:59.240]  We're talking government IT offices, corporations, CIOs, systems admins, IT managers.
[01:00.400 --> 01:06.620]  And I want to go down a lot of these items to make me stop and take pause and wonder why are we actually doing this this way?
[01:06.800 --> 01:10.880]  And haven't we learned anything yet based on recent news media, news reports?
[01:11.820 --> 01:18.980]  First off, why is it, and this is not going to be a total bashing seminar, so don't take it as such, but why are we sole sourcing at Microsoft?
[01:20.940 --> 01:21.920]  Why is the U.S. government, the U.S. military, putting their most critical resources on a buggy, loaded, operating system?
[01:30.640 --> 01:33.000]  One that they can't get behind to see the source code.
[01:33.200 --> 01:36.680]  They can't tweak it as much as they can under Linux or Solaris.
[01:36.780 --> 01:39.420]  They can't customize it to their particular needs.
[01:40.320 --> 01:44.720]  Why are they sole sourcing their operating environment on Microsoft, number one?
[01:44.940 --> 01:47.960]  And number two is a follow-on, and I think you know where we go with this.
[01:48.900 --> 01:50.640]  Why are we using Exchange?
[01:52.060 --> 01:53.740]  Anybody here get hit by I love you?
[01:54.880 --> 01:55.280]  Anybody?
[01:55.460 --> 01:56.360]  Nobody got hit by I love you?
[01:56.580 --> 01:56.980]  Nobody?
[02:00.960 --> 02:02.220]  Somebody didn't admit it.
[02:02.480 --> 02:02.540]  Okay.
[02:03.080 --> 02:17.480]  Problem is, is that you have an operating system with many applications that because of competing business models, and the theme of a lot of these sessions this weekend has been business models, business interests, driving products and policy designs and decisions.
[02:17.480 --> 02:30.740]  In the case of DVD and DeCSS, you see corporate America trying to push and, you know, censor the spread of knowledge to enable Linux folks who do not have a DVD player to be able to play DVDs.
[02:31.180 --> 02:31.700]  Okay?
[02:31.880 --> 02:43.160]  In this case, you have business interests, Microsoft business interests, forcing out system security, stability, or liability for pure profit.
[02:43.160 --> 02:47.780]  By this I mean, why do you need to have a word processing application to be able to take over a computer system?
[02:48.580 --> 02:50.400]  To be able to touch your registry?
[02:52.260 --> 02:57.080]  Why should a script be able to take full advantage of your Outlook email address?
[02:57.800 --> 03:05.500]  I'm not going to relate to the Microsoft point, but why do we continue to allow these things to be purchased, procured, and deployed in our large enterprises?
[03:06.320 --> 03:11.660]  I've seen companies that were shut down for days because of Melissa and I love you.
[03:12.040 --> 03:15.540]  In fact, I believe it was Motorola, was shut down for almost two weeks.
[03:16.520 --> 03:18.860]  Two weeks without email in corporate America today.
[03:19.540 --> 03:22.360]  That's just on the verge of death as far as I'm concerned.
[03:23.260 --> 03:23.500]  Okay?
[03:23.560 --> 03:25.280]  You can't survive without email in corporate America.
[03:26.480 --> 03:28.120]  One more Microsoft bashing thing.
[03:28.340 --> 03:29.280]  Windows 2000.
[03:30.140 --> 03:31.140]  Anybody play with it yet?
[03:31.800 --> 03:32.680]  One, a couple.
[03:32.820 --> 03:33.040]  Okay.
[03:33.040 --> 03:34.800]  A couple of things about it.
[03:34.980 --> 03:35.560]  It's very interesting.
[03:36.040 --> 03:37.600]  Unique the way it handles DNS.
[03:38.120 --> 03:39.200]  And this scares me.
[03:39.480 --> 03:57.140]  While they're saying they're offering cross-compatibility issues with DNS and, you know, you can talk with the network at Macintosh, the problem with Windows 2000 is that to take full advantage of the enhanced features of Windows 2000 requires you to use Microsoft's version of DNS.
[03:59.520 --> 04:01.440]  Anybody have any ideas what that might do?
[04:03.580 --> 04:15.600]  Microsoft's DNS essentially renders a true Windows model incompatible with Linux, Solaris, or Macintosh in most cases because of how it is implemented at the code level.
[04:16.340 --> 04:32.940]  I'm not that much technically going to be able to pull apart the code and see exactly what's wrong, but the bottom line is that if you take full advantage of how Microsoft's implemented DNS under Win 2K, chances are you're going to exclude certain other segments of your operating system's population.
[04:33.340 --> 04:34.000]  Kind of scary.
[04:35.520 --> 04:37.300]  That brings up the whole question of standards.
[04:37.500 --> 04:38.640]  Whose standards are we going to use?
[04:38.640 --> 04:49.180]  Have we learned, again, that whoever controls the OS, whoever controls the browser, can control standards, can control our content?
[04:49.180 --> 04:53.460]  I shudder when I hear how about Microsoft's foray into the cable TV area.
[04:54.120 --> 05:00.620]  It's hysterical to see there are inroads, forays into content providing, content management.
[05:01.340 --> 05:12.640]  Well, now they're controlling the platform, the device, the computer, or the little set-top box, and the preferred sites that consumers, your average Joe and Jane six-pack, not people in this room, are going to go to.
[05:13.460 --> 05:16.520]  Everybody in this room is a power user, meaning we don't use AOL.
[05:17.520 --> 05:17.920]  Hopefully.
[05:18.960 --> 05:24.060]  But we know how to find information that's not simply presented to us on a sports board menu when we log on.
[05:25.180 --> 05:36.340]  I, for one, would prefer to go to my own web browser and type www.WashingtonPost.com that have whatever my vendor's content partner is provided to me and say, we recommend you go here first.
[05:37.240 --> 05:38.320]  That scares me.
[05:38.740 --> 05:45.060]  Thought about these corporate mergers, merging large companies, Time Warner and AOL, merging companies and content together.
[05:45.400 --> 05:55.000]  Well, pretty soon we are going to get into this Big Brother mentality when the content you're going to see is based, is developed, and produced, and released by business interests and business decisions.
[05:56.000 --> 05:57.420]  CNN is owned by Time Warner.
[05:57.740 --> 05:59.620]  Therefore, CNN is now owned by AOL.
[06:00.360 --> 06:01.560]  That scares me.
[06:05.030 --> 06:12.970]  One area that's really, really interesting at these conferences is the media's perception of hacker v.
[06:13.110 --> 06:15.470]  cracker versus computer criminal versus anybody else.
[06:15.670 --> 06:16.470]  Any media in here?
[06:17.510 --> 06:18.290]  No media?
[06:19.230 --> 06:20.450]  Brock didn't make it, okay.
[06:22.190 --> 06:24.230]  People have a huge misperception.
[06:24.390 --> 06:25.450]  This has always been a problem.
[06:25.450 --> 06:33.110]  We've had, as long as I can remember, been involved in the hacker scene, you have people considering everybody who knows more about computers than they do, a hacker.
[06:34.230 --> 06:37.650]  If you can dance circles around your parents' use of a computer, then you're a hacker.
[06:38.550 --> 06:47.410]  If you can use Microsoft's dial-up networking to dial into your ISP's that AOL's one-click connect-you've-got-mail window, you might be a hacker.
[06:48.810 --> 06:49.510]  That's scary.
[06:49.910 --> 06:51.830]  The media blames everything on a hacker.
[06:51.950 --> 06:53.530]  The guy who wrote the Melissa virus was a hacker.
[06:54.670 --> 06:56.870]  The fellow who brought down eBay was a hacker.
[06:58.350 --> 07:03.830]  Well, conferences like this, and other ones I've been at over the years, may be talking to people who have been old-school hackers.
[07:04.190 --> 07:06.890]  I'm talking old, old-school hackers, and then old-school.
[07:07.650 --> 07:10.850]  What I'm talking about is that hacking is not just how good you are by the keyboard, it's a state of mind.
[07:12.410 --> 07:16.490]  Media all too often plays hackers as somebody who does something evil with the computer.
[07:17.390 --> 07:19.550]  Haven't we learned by now that hackers are not that?
[07:20.430 --> 07:22.930]  I'm not going to go into the whole hacker-cracker ethos debate.
[07:23.150 --> 07:25.110]  That's a little bit beyond the scope of this exercise.
[07:25.310 --> 07:26.270]  I don't want to bore you all today.
[07:26.690 --> 07:32.570]  But the concern I have, those in my line of work, that we're all hackers.
[07:32.910 --> 07:34.310]  We all think outside the box.
[07:34.310 --> 07:36.130]  We all question authority.
[07:36.290 --> 07:39.210]  We all question why things are a certain way.
[07:39.270 --> 07:45.710]  We all question why we're being forced to use a certain product or a certain set of services when we know we can do better by going elsewhere.
[07:46.830 --> 07:49.230]  But why doesn't anybody above our pay grades listen?
[07:50.510 --> 07:52.690]  That's not for corporate management to think about, corporate America.
[07:53.370 --> 07:56.850]  A lot of my articles that I talk about, this very issue.
[07:57.070 --> 08:03.410]  Why are we being forced into this mold of standards pushed on those by big business?
[08:03.410 --> 08:07.270]  A lot of times those standards are either conflicting or they're notoriously insecure.
[08:09.650 --> 08:13.690]  The second group I want to talk about are consumers, the teachers, and the media.
[08:15.170 --> 08:19.490]  We talk about the media, and we had some sessions today and yesterday about how the media portrays hackers.
[08:19.630 --> 08:20.710]  So I'm not going to reiterate that.
[08:20.870 --> 08:26.910]  But I still cringe whenever I hear the media say, well, hackers defaced a web page or hackers brought down eBay.
[08:27.770 --> 08:28.850]  Not necessarily.
[08:29.830 --> 08:40.830]  The question I always think is how poor was this site's security prior to hacker X or person X finding out that loophole?
[08:41.830 --> 08:43.590]  eBay, this is really funny.
[08:43.590 --> 08:47.410]  And during the weeks after eBay, the question of liability came up.
[08:48.390 --> 08:54.550]  And by that they're saying, well, Amazon, eBay, these companies went down because of widespread denial of service attacks.
[08:55.470 --> 09:01.210]  The question I would raise is, who is liable if the website gets defaced by a 14 year old?
[09:01.950 --> 09:08.290]  I know more 14 year olds who have more common sense and more technical wherewithal than most government systems administrators.
[09:09.690 --> 09:13.110]  But yet the government is saying, no, you can't do this because it's against the law.
[09:13.350 --> 09:18.270]  Well, if the government folks were more technically competent, maybe there wouldn't be a problem at all.
[09:19.090 --> 09:24.150]  But I would propose, I would offer for discussion that close down your own homes first.
[09:24.230 --> 09:28.610]  Make sure your laundry is in order before you start telling us how to work our affairs.
[09:29.870 --> 09:33.750]  I mean, it makes very little sense for me to preach on something that I know nothing about.
[09:34.110 --> 09:36.710]  I would not presume to go in and teach a Unix 101 class.
[09:36.910 --> 09:37.810]  Well, I do a 101 class.
[09:37.930 --> 09:39.010]  I couldn't do a 401 class.
[09:39.830 --> 09:42.850]  I would not go in and preach Unix 401 to you people.
[09:43.030 --> 09:44.150]  I am not a Unix wizard.
[09:44.950 --> 09:49.470]  But I know enough about Unix to be able to give you a good overview of what the operating system is and how to get around it.
[09:51.290 --> 09:54.370]  So, it comes down to knowing your role and knowing your capabilities.
[09:54.370 --> 09:55.430]  It comes down to the schools.
[09:56.690 --> 10:01.670]  Interesting panel that I unfortunately missed was one on our teachers and parents your enemy.
[10:02.270 --> 10:11.270]  And I love some of the stories I hear from people from the underground and around the world saying, Well, my teacher kicked me out of the computer lab because she caught me reading 2600 Magazine.
[10:12.770 --> 10:15.970]  Anybody here have been accused or been evicted or something like this?
[10:17.110 --> 10:17.830]  What happened to you?
[10:26.600 --> 10:28.420]  Someone used NetBus on his school's environment.
[10:28.560 --> 10:29.220]  They thought it was him.
[10:43.880 --> 10:49.940]  This poor guy was tattled on by a friend of his, acquaintance of his, to his school counselor.
[10:50.260 --> 10:51.280]  This only happened off-site.
[10:51.460 --> 10:52.360]  They told the school counselor.
[10:53.580 --> 10:54.200]  What happened?
[10:58.190 --> 11:01.890]  The school counselor called his mom, asked if his mom knew that she was raising a hacker.
[11:04.890 --> 11:06.090]  I don't know if I should do this or not.
[11:06.590 --> 11:06.950]  Okay.
[11:07.590 --> 11:07.830]  Yeah.
[11:08.030 --> 11:10.050]  And my mom was like, yeah, yeah, yeah, blah, blah, blah.
[11:10.390 --> 11:10.850]  Thank you.
[11:11.010 --> 11:13.370]  And then I woke up from my nap and she told me what happened.
[11:13.810 --> 11:16.270]  And I was like, okay, I didn't do anything.
[11:16.830 --> 11:18.030]  And this is a cool counselor.
[11:18.590 --> 11:23.390]  I told my mom that I wasn't in any trouble at school because I had to nap in school time or school grounds.
[11:24.170 --> 11:28.730]  So, but then she sent an email to all my teachers telling me not to allow me to use their computers.
[11:29.770 --> 11:32.510]  to print or putting diskettes in their computers.
[11:34.090 --> 11:36.890]  And I don't know if my teacher, one of my teachers told me about that.
[11:37.030 --> 11:38.110]  And that's how I found it about that.
[11:38.630 --> 11:41.730]  But the counselor was harassing all the kids out here.
[11:42.110 --> 11:43.090]  That's about my story.
[11:45.150 --> 11:46.050]  He's not alone.
[11:46.450 --> 11:51.870]  Simply because somebody is a good person with computers does not make him or her a bad person.
[11:52.510 --> 11:52.910]  Stereotype.
[11:52.910 --> 11:57.910]  Again, I'm going through a laundry list of items that were discussed partially during the rest of the weekend.
[11:58.210 --> 12:01.910]  But I want to bring them up there in the context of, have we learned anything from all of this?
[12:02.090 --> 12:05.790]  We have the same sessions at Beyond HOPE, the same sessions at HOPE.
[12:06.450 --> 12:09.510]  Every now and then they come up at DEFCON, Blackhats and other security conferences.
[12:10.110 --> 12:11.630]  And no one seems to learn.
[12:12.430 --> 12:21.470]  So again, this is just another call for, if I could take a giant hand and kind of just do a little smack smack smack smack to the American public or the world and say, wake up.
[12:21.770 --> 12:23.530]  You've been doing this for 15 years now.
[12:24.070 --> 12:26.030]  Why don't you fully see the light and smell the coffee?
[12:27.030 --> 12:27.570]  Do you want to follow up?
[12:28.070 --> 12:28.150]  Yeah.
[12:28.490 --> 12:29.930]  Another story.
[12:30.090 --> 12:30.730]  We'll take that one offline.
[12:33.570 --> 12:38.750]  A lot of times when I've done investigation reports in the private sector, I tell people, it wasn't a hacker.
[12:39.710 --> 12:41.410]  This person, this adversaire.
[12:42.430 --> 12:46.730]  I really cannot bring us up to the point and say, this hacker did something to my network.
[12:47.090 --> 12:48.290]  That hacker did it too.
[12:48.870 --> 12:50.370]  The CEO, we had a hacker attack.
[12:51.190 --> 12:55.330]  I've pranked my boss on more than one occasion because I don't think that a hacker is all bad.
[12:55.550 --> 12:56.530]  That's all I'm going to say on that issue.
[12:57.170 --> 12:59.630]  So have we learned to differentiate between hacker, cracker, criminal?
[12:59.970 --> 13:00.450]  No.
[13:01.270 --> 13:02.950]  Is the government helping in this area?
[13:03.510 --> 13:03.990]  No.
[13:05.030 --> 13:20.250]  Hackers is a term that if you search the Library of Congress and the congressional record, you'll see is used much more frequently on one minute speeches and congressional reports to describe anybody who has a malware of computers that uses them for adverse purposes.
[13:20.930 --> 13:22.290]  A cyber terrorist.
[13:22.890 --> 13:23.870]  What is that?
[13:25.750 --> 13:29.790]  Anybody who knows the true term of what a terrorist does, they want attention, they want it now.
[13:30.590 --> 13:42.650]  If I'm a cyber terrorist, I might have more fun and glory in a soft kill and putting a virus in a power station than I would if I drove a truck bomb up to the front gate and blew it up.
[13:43.230 --> 13:46.490]  A terrorist, by nature, wants instant public gratification.
[13:47.430 --> 13:50.950]  So where does this term cyber terrorism come from and why is it particularly relevant?
[13:51.330 --> 13:53.970]  A cyber terrorist is played in certain government circles to mean hackers.
[13:55.810 --> 13:57.190]  Another food for thought for you.
[13:58.610 --> 14:00.470]  Speaking of the government, any feds in this room?
[14:02.490 --> 14:03.290]  Any feds?
[14:03.590 --> 14:03.850]  Seriously.
[14:04.170 --> 14:04.790]  Government, military?
[14:05.270 --> 14:07.670]  I've been in your shoes before, folks, so I mean, don't be afraid.
[14:08.270 --> 14:10.230]  I have my own sheriff's pocket fed t-shirts.
[14:11.870 --> 14:12.310]  Okay.
[14:13.970 --> 14:15.410]  No, I was not at DEFCON last year.
[14:17.470 --> 14:18.030]  Was I?
[14:19.730 --> 14:25.970]  The lead organization for dealing with computer crimes in the country is the Federal Bureau of Investigation, the FBI.
[14:26.310 --> 14:30.430]  Then the FBI is a subset called NIPC, the National Infrastructure Protection Center.
[14:31.270 --> 14:34.330]  Infrastructure protection is a new buzzword based on what?
[14:34.630 --> 14:40.550]  The government's misperception that computers control everything and there's not a darn thing they can do about it.
[14:42.450 --> 14:47.710]  What scares me, and should scare all of you, is that, number one, the government's rather clueless in this area.
[14:48.070 --> 14:50.270]  But number two, it's not as bad as they think it is.
[14:51.030 --> 14:59.410]  And they're making information warfare, cyber-terrorism, out to be the buzzword similar to what many of us grew up with during the Cold War.
[14:59.590 --> 15:04.050]  Remember doing little bomb drills at school, you know, in the 70s and early 80s.
[15:04.210 --> 15:07.470]  You know, what happens if an attacker, if Russia launches missiles at us?
[15:08.050 --> 15:13.310]  Now here, the missiles are gone, per se, but the interest is on cyber-terrorism.
[15:13.310 --> 15:15.390]  That's what scares us at the kitchen table.
[15:16.330 --> 15:21.810]  Does anybody else feel this way and show hands that they're over-hyping this cyber-terror threat and it's really getting out of hand?
[15:22.770 --> 15:30.470]  It's media hype, it's soundbite, it sounds cool, and it scares to be Jesus out of people because it gets them right where it counts, at the kitchen table.
[15:30.670 --> 15:31.850]  People will buy into it.
[15:31.970 --> 15:32.370]  Hmm?
[15:32.610 --> 15:33.490]  People will buy into it.
[15:33.650 --> 15:36.650]  Right, people will buy into it because, again, it's the next big threat.
[15:36.970 --> 15:39.390]  So therefore, the government's going to jump in and do something about it, right?
[15:39.390 --> 15:40.490]  What are they going to do?
[15:40.650 --> 15:40.810]  There you go.
[15:41.310 --> 15:41.750]  Legislate.
[15:41.890 --> 15:42.710]  Create more bureaucracy.
[15:43.470 --> 15:51.070]  Two years ago, PDD 63 Presidential Decision Directive creates NIPC, within the effect of the FBI, to coordinate infrastructure protection.
[15:51.990 --> 15:57.590]  A big part of what they do, if not right now the only part that they're really having one success at, is computer crimes.
[15:59.370 --> 16:02.330]  Computer investigations, hacker tracking, so on and so forth.
[16:03.890 --> 16:07.430]  I've spoken to almost everybody who's anybody at NIPC.
[16:08.030 --> 16:12.790]  They all say, this role is great, but does not belong in the FBI.
[16:13.590 --> 16:15.790]  I've dealt with the FBI on numerous occasions.
[16:16.170 --> 16:19.130]  All too often, it doesn't work.
[16:19.410 --> 16:20.430]  We're a private sector.
[16:20.690 --> 16:21.590]  They are the government.
[16:22.310 --> 16:27.370]  The government, particularly the FBI, is not like us because we can do things more quickly than they can.
[16:27.570 --> 16:30.530]  And in some areas, we're more technically competent and astute than they are.
[16:31.930 --> 16:38.410]  I'm not going to go into details, but there are some cases, I've worked recently, against computer criminals, overseas folks.
[16:38.790 --> 16:40.510]  They're known criminals.
[16:40.790 --> 16:42.650]  We've tracked them for a good number of years.
[16:43.990 --> 16:46.610]  We tracked them, gave a whole report to the FBI.
[16:46.610 --> 16:47.970]  This is two years ago.
[16:48.790 --> 16:50.350]  And they made the duck move inch more.
[16:50.470 --> 16:52.930]  Even though the losses were in the several million dollar range.
[16:54.050 --> 16:56.590]  When asked, what is the status of the investigation?
[16:57.050 --> 16:58.050]  How are you proceeding?
[16:58.610 --> 17:01.350]  Their response is, well, we're looking into it.
[17:02.850 --> 17:18.130]  Yet this is the same organization that is, on the other hand, and they turn their hat around, begging and pleading with us in the industry, the private sector, to come talk to them, to share our vulnerabilities, share our exploits, share our knowledge with them to make them better.
[17:18.790 --> 17:23.150]  What it comes down to is a giant black hole where information gets sucked in from everybody.
[17:23.570 --> 17:28.350]  But what gets sent out, if any, is relatively minor and useless.
[17:29.570 --> 17:34.130]  Anybody have any similar type of anecdote that you're dealing with the Bureau or law enforcement on this?
[17:35.690 --> 17:36.650]  Mr. Cameraman.
[17:37.250 --> 17:38.490]  Yeah, I called the FBI.
[17:38.650 --> 17:39.770]  I was running a community system.
[17:40.010 --> 17:42.930]  And their basic answer was, tell us what happened.
[17:43.510 --> 17:47.510]  And at the end of that conversation, of course, well, how can you help?
[17:47.730 --> 17:52.090]  And the answer was, well, maybe look at the CERT webpage and, you know, sort of standard stuff.
[17:52.250 --> 17:53.550]  They really gave nothing back.
[17:55.050 --> 17:55.490]  Interesting.
[17:55.910 --> 18:02.390]  It's funny, too, because I'll get calls from the FBI, various field offices around the country, on an almost bi-weekly basis.
[18:02.390 --> 18:05.790]  The first thing they tell me is, you've got a network intrusion.
[18:07.950 --> 18:09.430]  That is their mantra.
[18:09.630 --> 18:10.410]  Network intrusion.
[18:11.130 --> 18:12.430]  Sir, you have a network intrusion.
[18:12.670 --> 18:15.570]  That's just like Microsoft saying that we develop great software.
[18:15.890 --> 18:17.190]  Great software is their mantra.
[18:17.790 --> 18:22.730]  You have an intrusion is how they report 90% of their electric concerns to industry.
[18:23.390 --> 18:25.970]  Well, not all computer security problems are a network intrusion.
[18:26.490 --> 18:26.930]  Correct?
[18:28.170 --> 18:29.170]  There are other ways to do it.
[18:29.290 --> 18:30.550]  You can, you know, hack an application.
[18:30.550 --> 18:35.590]  You can deny somebody services by just attacking a router, a denial of service type of attack.
[18:36.090 --> 18:38.990]  You can actually penetrate the network, compromise it.
[18:38.990 --> 18:41.030]  In which case, yes, that indeed there is actual intrusion.
[18:41.610 --> 18:46.630]  You can have an insider faxing information out to somebody else, similar to how they did in Los Alamos.
[18:46.870 --> 18:57.210]  By the way, if Los Alamos actually did catch fire with those wildfires down there, they could have just gone to Beijing and get copies, backup copies of all their tapes because, I mean, it was just almost a one-for-one copy.
[18:58.270 --> 19:01.530]  So what it comes down to law enforcement is that they have a noble mission.
[19:01.670 --> 19:03.050]  And I do give them credit for it.
[19:03.090 --> 19:06.030]  I have a lot of great good friends with the FBI, with the Secret Service.
[19:06.270 --> 19:08.150]  I'm not disparaging them.
[19:08.510 --> 19:10.330]  But the mindset has to change.
[19:11.670 --> 19:14.710]  A lot of folks I speak with say computer crime is a problem.
[19:14.850 --> 19:15.590]  We have to deal with it.
[19:15.590 --> 19:22.790]  But it should be along elsewhere and not be under this umbrella of the FBI and how the FBI does business.
[19:23.290 --> 19:28.350]  The FBI is very traditional, very, we know it all matter of fact, these stripes, suits, wingtips.
[19:29.090 --> 19:33.270]  They don't wear hats anymore, but they're still the G-Men, you know, portrait.
[19:33.790 --> 19:34.790]  That's got to change.
[19:35.130 --> 19:36.890]  I could have worked with jeans and a golf shirt.
[19:38.550 --> 19:40.930]  So do the folks at NSA, most of them now.
[19:41.610 --> 19:44.350]  The FBI still wears striped shirt, pants, and everything else.
[19:44.830 --> 19:48.590]  That mentality translates over how you deal with your customers and your constituents.
[19:49.550 --> 19:56.930]  So they need to deal with the changing nature of the threat, the changing nature of the environment at hand, the changing nature of their clientele.
[19:57.350 --> 19:58.470]  Who are they working with?
[19:58.670 --> 19:59.850]  How do they interact with them?
[20:00.190 --> 20:02.310]  And the speed at which internet time happens.
[20:02.730 --> 20:06.990]  No longer is it good enough to wait 48 hours or 72 hours for a judge to get a hold of them.
[20:07.110 --> 20:09.530]  You've got to get a hold of them now and go after somebody.
[20:21.120 --> 20:24.140]  He wants to go to work in the Dockers and Polo Pants.
[20:24.580 --> 20:27.280]  The Dockers and Polo Pants are at 9 to 5.
[20:27.620 --> 20:29.600]  It's a million customers in August.
[20:30.000 --> 20:32.720]  And it makes every reason to make it really bad.
[20:32.980 --> 20:33.320]  Right.
[20:34.260 --> 20:36.080]  Now let me focus on one particular event.
[20:36.180 --> 20:38.240]  And this really will drive home what I'm talking about.
[20:38.280 --> 20:39.120]  Have we learned anything?
[20:40.380 --> 20:46.560]  Remember the attacks in February against eBay, Amazon, Yahoo, CNN, the denial of service attacks?
[20:47.140 --> 20:48.900]  And the great fiasco that followed?
[20:49.260 --> 20:51.540]  What happened the week after those attacks?
[20:51.880 --> 20:55.480]  What major public event happened following those attacks?
[20:56.460 --> 20:57.160]  Anybody remember?
[20:59.100 --> 21:02.300]  The week after the attack, there was a White House summit.
[21:03.820 --> 21:05.720]  Who was in attendance at the White House summit?
[21:06.680 --> 21:08.100]  CEOs of several companies.
[21:09.640 --> 21:14.120]  Much from a lot now at stake as the token hacker, quote unquote.
[21:15.400 --> 21:20.640]  And mostly CEOs and senior management from government and private sector.
[21:21.200 --> 21:22.460]  To discuss the issue.
[21:23.760 --> 21:26.160]  Well, if you're going to want to discuss this issue objectively.
[21:27.460 --> 21:29.840]  And actually come up with viable solutions that work.
[21:30.420 --> 21:34.560]  Who are you going to actually really want to talk to to come up with a solution that will work?
[21:34.920 --> 21:35.980]  Not the CEO.
[21:36.900 --> 21:37.960]  Who do you want to talk to?
[21:38.600 --> 21:39.540]  The worker bees.
[21:40.280 --> 21:44.200]  They want to have the systems managers, your IT directors, your CIOs.
[21:44.960 --> 21:48.540]  Bring in some more consultants to discuss this issue.
[21:49.400 --> 21:51.140]  Forget the directors, get the admins.
[21:51.680 --> 21:53.200]  Okay, get the systems admins in.
[21:55.360 --> 21:57.200]  Yeah, CEOs are old men.
[21:57.480 --> 21:58.940]  Okay, I won't look at that far, but some of them are.
[21:59.200 --> 22:00.080]  Yeah, we're not all students.
[22:01.080 --> 22:02.100]  Are you a CEO, sir?
[22:02.380 --> 22:03.520]  No, I'm just an old man.
[22:03.880 --> 22:04.380]  Ah, okay.
[22:04.500 --> 22:06.020]  Well, we're all getting old, so I can't complain.
[22:07.180 --> 22:11.780]  But you want to have people who actually can address the problem, the pros and cons, the realities of the situation.
[22:12.540 --> 22:15.320]  The problem is, if they were really interested in that, think about this.
[22:15.420 --> 22:17.180]  This is February of an election year.
[22:18.280 --> 22:19.080]  Hot topic.
[22:19.300 --> 22:20.280]  Dinner time conversation.
[22:20.500 --> 22:21.340]  Computer security.
[22:21.760 --> 22:22.500]  Cyber war.
[22:22.840 --> 22:23.520]  Hackers crackers.
[22:23.800 --> 22:25.300]  All that kind of great stuff we spoke about earlier.
[22:26.340 --> 22:29.400]  We've got to get a photo opportunity here to maybe get some campaign contributions.
[22:31.060 --> 22:34.440]  So we invite the CEOs and the upper grass to come on board to the White House for a day.
[22:34.620 --> 22:35.100]  A fun and games.
[22:35.200 --> 22:38.000]  A couple of photographs with the President in the conference room.
[22:38.220 --> 22:39.340]  On the west lawn.
[22:39.880 --> 22:41.260]  All this fun and glory.
[22:41.420 --> 22:41.880]  And guess what?
[22:41.960 --> 22:42.500]  Nothing happens.
[22:44.760 --> 22:45.680]  It's all political.
[22:47.040 --> 22:49.740]  You want to have a conference to bring, discuss the issue.
[22:49.920 --> 22:51.740]  Bring people who have a clue about the issue.
[22:51.740 --> 23:03.120]  Not folks who hear about it third and fourth hands from their admin who got it from their CTO person who got it from their IT admin who got it from their systems administrator who got it from WTOP in the morning coming into work.
[23:03.940 --> 23:08.360]  You want to get it from people who can affect the change and tell you what can and can be done technically.
[23:09.220 --> 23:11.520]  Don't just do pie in the sky stuff with your upper management.
[23:12.400 --> 23:13.440]  Why haven't we not learned?
[23:13.640 --> 23:14.920]  Again, why haven't we learned?
[23:15.600 --> 23:20.320]  Why can't we figure out that we need to have the worker base more involved in these types of decisions?
[23:20.320 --> 23:22.620]  Do not leave it to the senior policy folks.
[23:23.660 --> 23:25.480]  It's not about solving the problem.
[23:25.700 --> 23:26.700]  It's about bread and circus.
[23:27.120 --> 23:30.340]  They just wanted to make people feel like the government was doing something.
[23:30.480 --> 23:33.200]  They would never intend to do anything because they don't know what to do.
[23:34.300 --> 23:34.740]  Exactly.
[23:34.860 --> 23:36.600]  The comment was, it's a bread and circus.
[23:37.100 --> 23:38.360]  They can't solve the problem.
[23:38.440 --> 23:39.760]  They don't look like they're solving the problem.
[23:39.920 --> 23:41.220]  They give everybody a warm fuzzy feeling.
[23:41.820 --> 23:42.560]  Indeed they are.
[23:43.120 --> 23:48.720]  But you've got to understand, it's a steep learning curve for most politicians because this is not fair running the floor.
[23:48.980 --> 23:49.540]  That's true.
[23:55.100 --> 24:00.740]  It is a learning curve for the politicians.
[24:00.980 --> 24:02.300]  It's not all easy.
[24:02.460 --> 24:03.420]  It's not all hard for them.
[24:03.600 --> 24:05.300]  But you look at some that are making the jump.
[24:05.540 --> 24:11.340]  I mean, the other day I saw the DVD test doing a master hearings on the Hill with Orrin Hatch.
[24:11.820 --> 24:14.560]  Orrin Hatch and Pat Leahy are two of the older senators on the Hill.
[24:14.560 --> 24:15.780]  These guys have a clue.
[24:16.580 --> 24:19.280]  They're one of the few on the Hill who have a clue about technology and syntax.
[24:19.500 --> 24:20.880]  They're open minded enough to accept change.
[24:21.380 --> 24:21.820]  You're right.
[24:21.940 --> 24:22.900]  It takes time to evolve.
[24:23.560 --> 24:29.460]  I mean, part of me wishes that there were some of us in here who were actually in Congress who would know of what we are talking about.
[24:30.260 --> 24:32.460]  That will happen sometime down the road.
[24:33.240 --> 24:34.160]  New Congress comes in.
[24:34.300 --> 24:35.200]  New leadership comes in.
[24:35.860 --> 24:42.740]  10, 15 years from now, those of us who grew up with the technology, we are in a position where we can actually support the technology on a national level.
[24:42.740 --> 24:44.880]  We're still in that infancy stage right now.
[24:46.580 --> 24:47.020]  Question?
[24:48.160 --> 24:50.060]  From the guy who's asleep down here, by the way.
[24:59.800 --> 25:02.800]  Why is Bill Clinton signing legislation with a digital smart card?
[25:08.710 --> 25:09.610]  A couple of reasons.
[25:09.830 --> 25:14.050]  He's doing it, number one, to show that he supports the technology and supports the idea behind it.
[25:16.150 --> 25:16.770]  Say again?
[25:19.410 --> 25:26.370]  He wants to be able to show that he supports the technology, therefore you as e-commerce vendors and individuals should as well.
[25:26.610 --> 25:29.290]  You should feel comfortable using it if Billy Jeff does.
[25:29.790 --> 25:30.910]  That's fine and dandy.
[25:31.390 --> 25:35.910]  However, if you read the legislation, nowhere does it define what a digital certificate is.
[25:35.930 --> 25:36.510]  Here's another thing.
[25:36.910 --> 25:42.090]  We're all talking about how great technology is and digital certificates and e-commerce and signatures and authentication.
[25:43.350 --> 25:47.350]  There is no standard to find for what a digital signature is.
[25:47.610 --> 25:52.290]  In fact, do you know what cost is a digital signature in this piece of legislation?
[25:53.370 --> 25:54.310]  A mouse click.
[25:56.110 --> 26:00.050]  You get a shrink wrap software license, you click the agree on the license.
[26:00.510 --> 26:04.110]  Technically the vendor can call that a legal contract.
[26:04.250 --> 26:07.290]  You have digitally signed it by your endorsing and clicking and proceeding.
[26:09.070 --> 26:10.930]  But you can't get around clicking it a lot of times.
[26:12.590 --> 26:19.890]  Now, for a moment, let's stop the clicking side of the house regarding the software license and look at two other issues that were spoken of yesterday.
[26:21.370 --> 26:23.070]  DCMA and UTICA.
[26:24.970 --> 26:26.930]  I keep forgetting how the acronym is.
[26:27.490 --> 26:27.930]  UCDA.
[26:27.930 --> 26:28.250]  UCDA, thank you.
[26:28.690 --> 26:30.470]  UCDA and DMCA.
[26:30.710 --> 26:32.750]  Both of which, this plays into very well.
[26:32.750 --> 26:48.270]  So if you've read what those provisions say, now a vendor can not only hold you to the shrink wrap license that you blindly clicked like you do every other piece of software licensing, but now they can remotely disable that software if they choose to revoke your license.
[26:50.290 --> 26:54.490]  They didn't read the other day that Microsoft is now looking to do ASP technology.
[26:54.930 --> 26:59.150]  Be able to rent OS's and applications over the wire.
[26:59.910 --> 27:04.610]  You pay 50 bucks a year, you can get Windows, 25 bucks you get Word, so on and so forth every year.
[27:04.870 --> 27:05.570]  You renew it.
[27:06.450 --> 27:11.130]  Guess what happens if you decide you don't want that software or you decide you forget to pay?
[27:12.190 --> 27:14.730]  You get charged, but your data is held hostage, literally.
[27:15.370 --> 27:19.970]  Your machine will just cramp up, you can't do a darn thing until you pay that ransom.
[27:21.530 --> 27:26.150]  Now let's go back to the digital signature discussion that bill was signed recently by the President.
[27:26.910 --> 27:33.550]  Single click, any sort of link or acknowledgement, now is a legal binding agreement.
[27:35.850 --> 27:46.150]  Think about how that supports DCMA, DMCA, and it's a very close match, in my opinion, is how one will support the other.
[27:46.730 --> 27:57.650]  No one's really given any of these a lot of review, except for EFF and CPSR, which is kind of scary because as the world gets more digitized, this type of stuff is going to become all too more frequent.
[27:57.830 --> 28:08.810]  If we don't get a grip on it now and read the fine print like this, I mean, very few folks know that that bill that was signed by Clinton does not define what a digital signature is.
[28:10.230 --> 28:11.670]  People don't know that, in general.
[28:12.690 --> 28:13.890]  That's very frightening.
[28:16.330 --> 28:18.950]  Finally, I want to wrap up with where this is all leading.
[28:19.290 --> 28:19.970]  Yes, sir?
[28:20.830 --> 28:29.130]  If there's no standard, then the standards get determined in the marketplace by who's ever secures the software, it's bought them.
[28:29.350 --> 28:29.470]  Okay.
[28:29.890 --> 28:33.790]  Which I assume would be the guys who already had a bigger position in that market.
[28:35.490 --> 28:39.850]  So, how, you know, is Microsoft's EFF and Empire driving?
[28:40.310 --> 28:40.890]  Well, in...
[28:40.890 --> 28:42.030]  Who owns VeriSign?
[28:42.190 --> 28:43.390]  Who owns these guns?
[28:44.770 --> 28:45.310]  Does it fail?
[28:45.610 --> 28:47.030]  I would say, very good point.
[28:47.190 --> 28:51.070]  The question is, who will define the standards going forward, since there are no standards defined?
[28:51.430 --> 28:52.370]  Will it be the big guns?
[28:52.370 --> 28:58.050]  Well, I don't think it may be Microsoft because, as I've said in the past, security and Microsoft are mutually exclusive concepts.
[28:58.930 --> 29:00.430]  So, I see...
[29:00.430 --> 29:01.170]  You're right.
[29:01.390 --> 29:02.010]  Again, why?
[29:02.150 --> 29:03.670]  Because they're marching towards it like Lemmings.
[29:04.030 --> 29:05.050]  We like the GUI.
[29:05.090 --> 29:08.490]  We like the little paper clip that dances around my spreadsheet that drives me up the freakin' wall.
[29:11.290 --> 29:11.690]  Exactly.
[29:12.170 --> 29:13.110]  Can we say CPU hog?
[29:13.770 --> 29:17.090]  So, will VeriSign become the leader in digital certificates?
[29:17.650 --> 29:18.050]  Possibly.
[29:18.250 --> 29:22.890]  They have a large market share, they part them off, they bought Network Solutions, the leader of domain name registration.
[29:24.830 --> 29:26.830]  VeriSign bought Network Solutions.
[29:27.030 --> 29:33.330]  So, you've got the biggest name in digital certificates and the biggest name in domain names merging.
[29:34.050 --> 29:38.130]  They're calling themselves the internet, largest internet trust company.
[29:39.030 --> 29:43.490]  Will their standards be the standards that become, that do become standards across the board?
[29:43.970 --> 29:45.150]  We're too soon to tell.
[29:45.410 --> 29:46.650]  My gut feeling says yes.
[29:46.650 --> 29:50.550]  They will be the driving force behind whatever becomes a standard down the road.
[29:55.250 --> 29:56.580]  I haven't paid him, by the way.
[29:56.700 --> 29:57.780]  He's doing his own free will.
[29:58.780 --> 29:59.580]  Here we go again.
[30:01.680 --> 30:09.020]  You know how you can, I don't remember if you can do this lately, but I dealt with a couple domains about a month ago.
[30:10.120 --> 30:13.160]  And I've actually experimented on hijacking domains.
[30:13.580 --> 30:19.580]  How can you call yourself in a trust company if you verify people through their email address?
[30:19.860 --> 30:21.290]  What if you spoof an email address?
[30:21.290 --> 30:25.810]  I mean, once you file contact, you file forms at Network Solutions.
[30:26.120 --> 30:32.080]  They generate a form for you to email to hostmaster at, I think it's internet.net.
[30:32.880 --> 30:37.040]  And they'll update the new contact for you.
[30:37.100 --> 30:39.240]  And you can just hijack them and do anything that way.
[30:39.780 --> 30:44.440]  So, how can you call yourself a trust company if you verify people through email?
[30:46.810 --> 30:48.900]  I can answer that before we go on.
[30:49.960 --> 30:53.940]  What they do, I mean, they were bought by a security company, okay?
[30:54.440 --> 30:58.960]  VeriSign, I mean, they're closing a lot of holes now that they didn't use to, that they had opened.
[30:59.290 --> 31:02.780]  And I don't think they would have been closed if they weren't bought by VeriSign.
[31:03.000 --> 31:12.460]  Because VeriSign, being a trusted company, has exorbitant standards, in terms of them, quality assurance and security, to make sure that they are indeed trustworthy.
[31:13.200 --> 31:15.100]  And I think, had that not happened, you're right.
[31:15.240 --> 31:16.660]  I mean, this could have gone on for a while.
[31:16.920 --> 31:26.240]  But I think last week or two weeks ago, Network Solutions closed down that hole that allowed you to send an email template in and hijack domains by the thousands.
[31:26.600 --> 31:28.340]  So, hopefully so far so good.
[31:28.480 --> 31:29.220]  You got a question, sir?
[31:29.720 --> 31:35.940]  You know, I was just going to explain, but I didn't want to say, when we could just be right now.
[31:36.560 --> 31:37.140]  Oh, you were?
[31:37.240 --> 31:37.400]  Okay.
[31:38.840 --> 31:41.660]  On to the final segment of this particular meeting here.
[31:41.660 --> 31:44.840]  I want to talk a bit about where we're going as a society.
[31:45.290 --> 31:47.960]  There's a great book out called the Surveillance Society.
[31:48.280 --> 31:52.240]  And particularly, I want to talk about how we're moving into a digital surveillance society.
[31:53.540 --> 32:09.460]  What scares me is that, as technology grows and gets so intertwined with everything we do, from ordering books, to buying DVDs, to which region of the world we can play DVDs, to how we can listen to a music, how I buy a CD.
[32:10.900 --> 32:15.940]  Somebody in big business tells me how and where I can copy and play these tunes for my own personal use.
[32:17.130 --> 32:21.620]  All these things are coming together, and a lot of the models that come up are pay-per-view models.
[32:23.000 --> 32:25.500]  Well, now let's look at privacy in general across the board.
[32:25.680 --> 32:29.810]  Internet privacy, as we've heard several times today alone, is non-existent.
[32:30.400 --> 32:32.480]  Anybody can find out information about anybody else.
[32:32.620 --> 32:33.360]  That's no problem.
[32:33.810 --> 32:34.660]  Or is a problem.
[32:34.660 --> 32:44.400]  However, let's look at the issue of big business getting involved now, and tracking what each of us buys online, or does things.
[32:44.740 --> 32:51.440]  Do we really, really want Columbia Records to know that I bought the Metallic S&M album?
[32:51.860 --> 32:58.480]  And then, okay, now I had to license it to them, license it from Columbia, to put it on my reel player.
[32:59.200 --> 33:04.440]  And then getting unlocked code for two CD copies that I can now put from my car and my wife's car.
[33:05.660 --> 33:08.580]  Do we really want people to know what we buy on Amazon?
[33:08.840 --> 33:10.480]  What we buy online?
[33:11.180 --> 33:12.290]  Forget the cookie issue.
[33:12.980 --> 33:15.240]  We know cookies, they're dead and buried.
[33:15.480 --> 33:21.620]  But we're moving towards a database society where your online emotions are being tracked constantly.
[33:21.680 --> 33:22.260]  What should you do?
[33:22.540 --> 33:30.140]  As I'm hearing the DVD and the Napster debates going on, I don't really want big business to know what my musical interests are.
[33:30.980 --> 33:32.460]  Because that's one thing.
[33:33.500 --> 33:36.340]  Then we get issues like medical privacy and other issues.
[33:36.640 --> 33:45.290]  If you go to the hospital and you're given an antidepressant, let's say a panic attack, and they give you some sort of pill for it, and they give you a prescription.
[33:45.290 --> 33:50.290]  You go to your doctor's office, they fill it, or the pharmacy, you fill it.
[33:51.720 --> 33:55.290]  Where, who knows if you were prescribed antidepressant?
[33:55.500 --> 33:56.080]  Your doctor?
[33:56.260 --> 33:56.580]  Yes.
[33:56.790 --> 33:57.310]  The hospital?
[33:57.520 --> 33:57.880]  Yes.
[33:58.160 --> 33:58.790]  The pharmacy?
[33:59.000 --> 33:59.360]  Yes.
[33:59.660 --> 34:00.280]  Who else?
[34:00.620 --> 34:02.840]  If insurance pays for it, your insurance company.
[34:03.960 --> 34:05.720]  Medical information, you've got to love it.
[34:05.790 --> 34:07.480]  Or you've got to hate it or fear it if you're a patient.
[34:08.640 --> 34:12.860]  I very rarely let insurance pay for any drugs I might get.
[34:14.180 --> 34:15.860]  For prescription drugs, not drugs.
[34:17.140 --> 34:18.360]  I have a problem with that.
[34:18.620 --> 34:29.460]  If I've ever prescribed something for whatever, I don't want it by some marketing wizardry, or by some cyber criminal being able to find out what I am being prescribed.
[34:29.780 --> 34:31.400]  That's an invasion of what I call my privacy.
[34:32.600 --> 34:33.420]  That's a problem.
[34:33.920 --> 34:34.600]  Am I worried about it?
[34:34.680 --> 34:34.920]  Yes.
[34:35.040 --> 34:36.240]  Do I have a lot of faith going forward?
[34:36.750 --> 34:37.550]  It's wavering.
[34:38.360 --> 34:41.550]  But people are being more and more easily tracked around the world.
[34:41.780 --> 34:44.140]  That's why zero-knowledge is coming up with these great tools.
[34:45.320 --> 34:47.360]  You know, BGP was great for securing email.
[34:48.140 --> 34:53.380]  ZKN is going a step further in securing your web sessions, your FTP sessions, your SSH.
[34:53.860 --> 34:54.260]  Wonderful.
[34:54.600 --> 35:00.960]  Great technology coming down the pipes to keep big business and those that hoard the information of who you are, keep them at bay.
[35:01.140 --> 35:01.900]  Or try to keep them at bay.
[35:01.960 --> 35:02.340]  Yes, sir?
[35:02.640 --> 35:03.540]  I understand why.
[35:03.540 --> 35:06.480]  You know, like all those databases, like double click and all that.
[35:06.640 --> 35:08.040]  You know, housing those databases.
[35:08.460 --> 35:12.800]  It's probably not going to be like another seven years before they realize really how to utilize that information.
[35:13.400 --> 35:16.120]  I mean, it's just a hogwash of...
[35:16.120 --> 35:16.600]  Right.
[35:16.700 --> 35:19.000]  The database is the largest collection of...
[35:19.000 --> 35:19.460]  It's a buzzword, though.
[35:19.600 --> 35:21.550]  I mean, it used to be big money...
[35:21.550 --> 35:22.980]  ERP was the buzzword.
[35:23.080 --> 35:24.040]  Now it's CRM.
[35:24.600 --> 35:28.180]  The guts of CRM are not really about keeping people's addresses straight.
[35:29.420 --> 35:36.580]  They're about studying demographics from, like, sales information of how people are navigating sites, what they're buying, what they're not buying.
[35:37.080 --> 35:39.140]  Those systems are built expressly to do that.
[35:39.220 --> 35:40.160]  They're selling like hotcakes.
[35:40.320 --> 35:42.940]  Yeah, I think those systems have been around for years.
[35:42.940 --> 35:44.460]  They're just getting plain in.
[35:44.700 --> 35:45.660]  Well, you look back...
[35:46.120 --> 35:46.740]  And you're right.
[35:46.860 --> 35:48.800]  It'll take them a couple of years to figure out what to do with them.
[35:49.710 --> 35:54.820]  And if you go a step further, now you want the DNA testing and what they've done with that.
[35:55.080 --> 36:06.560]  And now the fact that in a couple of years you may be designing a job based on what you may be prone to get somewhere in your life which your employer may not want to pay for out of pocket to support the insurance costs.
[36:07.590 --> 36:09.620]  That is a gross invasion, in my opinion.
[36:10.000 --> 36:11.560]  That stuff you need to consider going forward.
[36:13.960 --> 36:14.400]  Yes.
[36:18.890 --> 36:21.910]  I have not, as fellas said earlier, I'm a Mac person.
[36:23.450 --> 36:26.290]  And I do not have the Mac data yet.
[36:26.530 --> 36:28.290]  I have the Wintel version.
[36:28.290 --> 36:30.030]  I have not played with it too much.
[36:31.570 --> 36:33.990]  Has anybody got any experience with the zero-knowledge client?
[36:35.230 --> 36:35.670]  Freedom?
[36:36.910 --> 36:37.350]  No.
[36:39.330 --> 36:40.710]  You should try to use it, it's good.
[36:40.870 --> 36:42.130]  First-hand knowledge up here in the front.
[36:42.910 --> 36:47.190]  Okay, so what I wanted to do today was basically go through a couple of...
[36:47.190 --> 36:48.270]  I mean, it's almost like Rick's Soapbox.
[36:49.370 --> 36:50.510]  And, you know, have you learned anything?
[36:51.030 --> 36:54.610]  I mean, the question is, have you learned anything at all in the 15 years?
[36:55.150 --> 36:58.370]  Well, on the legislative policy front, they're learning slowly.
[36:59.350 --> 37:01.490]  At least they have internet access on Capitol Hill now.
[37:02.450 --> 37:02.850]  Okay?
[37:02.990 --> 37:04.110]  I happened to be there when it went in.
[37:04.930 --> 37:05.410]  Alright?
[37:06.050 --> 37:07.470]  They're making progress.
[37:07.770 --> 37:09.450]  They're in the mid-20th century.
[37:09.650 --> 37:10.790]  They're catching up to us.
[37:11.230 --> 37:12.150]  The laws.
[37:12.330 --> 37:16.370]  The laws are changing slowly to catch up with the technology.
[37:17.130 --> 37:20.190]  But the processes in which these laws are enforced.
[37:20.530 --> 37:21.990]  And I'm thinking of law enforcement here.
[37:22.430 --> 37:23.490]  So woefully outdated.
[37:24.750 --> 37:27.750]  At the risk of sounding like a real thing, which I'm not, by the way.
[37:28.170 --> 37:29.690]  And alienating myself here.
[37:29.950 --> 37:33.210]  I want to say, if you want to catch a cybercriminal, how do you do it?
[37:34.270 --> 37:40.930]  You don't send an alert to all 50 field offices and say, be on the lookout for a cybercriminal age 16 to 40.
[37:41.390 --> 37:42.510]  We think he's a male.
[37:42.610 --> 37:43.270]  Could be a female.
[37:44.570 --> 37:45.470]  Be on the guard.
[37:46.230 --> 37:49.510]  We don't then go out and do a press release and say, here's what we're going at.
[37:50.690 --> 37:56.470]  You part half a dozen people, many of which could be sitting in this room, with one federal agent.
[37:57.030 --> 38:08.630]  Let these guys, gals, kids, hackers, in the truest sense, do their work, find out, use their out of the box thinking to go after the bad guy, be it overseas or whatever.
[38:09.810 --> 38:14.770]  Take that information to that FBI agent and say, here's where we think this person is coming from.
[38:14.990 --> 38:16.130]  Here's the corroborating evidence.
[38:16.410 --> 38:17.890]  Go to the judge and do your dirty work.
[38:18.350 --> 38:21.150]  He goes to the judge, gets the subpoenas, the warrants, whatever.
[38:21.690 --> 38:22.690]  Then he goes to law enforcement.
[38:23.310 --> 38:26.150]  You don't throw just bodies at the problem.
[38:26.330 --> 38:26.990]  I expect to solve it.
[38:27.110 --> 38:29.610]  You cannot make a hacker out of a bank robber specialist.
[38:31.110 --> 38:31.850]  Question again.
[38:32.670 --> 38:35.190]  How did they catch someone say, yeah.
[38:45.920 --> 38:54.220]  Question was, how does the FBI track somebody down who is trafficking and stolen credit cards on the net when they're coming for an offshore account?
[38:55.020 --> 38:58.500]  What could the frauds give money off the credit cards for an offshore account?
[38:59.640 --> 39:01.000]  I am not an FBI agent.
[39:01.000 --> 39:02.780]  Question, did anyone here in the room with the FBI want to field that?
[39:04.240 --> 39:04.860]  Can they?
[39:07.080 --> 39:07.720]  Can they?
[39:07.880 --> 39:08.720]  I would say, sure.
[39:08.820 --> 39:09.380]  Anything's possible.
[39:09.840 --> 39:10.140]  Do they?
[39:10.220 --> 39:10.620]  I don't know.
[39:11.540 --> 39:14.660]  I mean, the amount of money the credit card companies lose every year is phenomenal anyway.
[39:15.040 --> 39:17.400]  I'm sure a good bunch of that is cattle to overseas stuff.
[39:18.040 --> 39:21.220]  So again, bringing this back to where we started from.
[39:21.500 --> 39:22.320]  Have we learned anything?
[39:22.440 --> 39:27.020]  Has the media learned enough about the issues at hand, the people at hand, to know what's right?
[39:27.020 --> 39:29.060]  To know how to report the problem.
[39:29.720 --> 39:30.200]  Some do.
[39:30.440 --> 39:31.040]  Some don't.
[39:31.380 --> 39:34.800]  There were some articles written about this conference yesterday that I thought were rather well done.
[39:35.460 --> 39:38.200]  So there's a select few reporters out there.
[39:38.580 --> 39:39.960]  In fact, one of them is actually here.
[39:40.280 --> 39:45.460]  That knows how to talk the talk, walk the walk, and report objectively on what they find.
[39:45.460 --> 39:51.180]  They have no problem calling this a hacker conference and that hackers were in attendance.
[39:51.420 --> 39:55.940]  Because I guarantee you, 95% of the people at this conference are hackers in the truest sense.
[39:56.340 --> 40:03.520]  Whether you're a consult cowboy, a phreaker, college kid just happens to know about how things work at a fundamental level.
[40:04.120 --> 40:05.760]  The reporters are learning slowly.
[40:06.040 --> 40:08.540]  The policy makers are learning slowly.
[40:09.060 --> 40:10.900]  Time is going to be the factor here.
[40:11.520 --> 40:15.640]  We move in the industry so rapidly with new technologies.
[40:16.240 --> 40:19.780]  I mean, three years ago, MP3 was just in its infancy.
[40:20.140 --> 40:23.640]  Now it's the rage and there are commercial business models based on.
[40:24.380 --> 40:32.380]  Now there are legal issues about the Gnutella, Napster, pirating, sharing, hijacking of music.
[40:32.700 --> 40:37.480]  The law has to catch up with technology, but it's never going to get there because we move at light speed.
[40:38.680 --> 40:42.300]  And the legislators are just now beginning to realize that, yes, this is a problem.
[40:42.400 --> 40:43.060]  We need to address it.
[40:43.520 --> 40:45.440]  Napster's been out for, what, about a year?
[40:46.020 --> 40:48.280]  And they finally now had hearings on it.
[40:49.320 --> 40:55.180]  It used to be there'd have to be a problem for three or four years before the Hill would be interested in conducting hearings.
[40:55.660 --> 41:02.560]  When eBay was attacked a couple of months in February, two weeks afterwards, A, there was a press conference at the White House.
[41:02.560 --> 41:05.180]  We spoke about that before, and that was really a photo op.
[41:05.560 --> 41:13.960]  But the Hill had hearings where they brought in a specialist from all over the country to discuss internet security, how dial service and training in TFN worked.
[41:14.240 --> 41:18.720]  So they're now realizing we've got to address these issues now, not wait.
[41:18.980 --> 41:19.320]  Yes, sir.
[41:19.840 --> 41:20.320]  Question.
[41:23.540 --> 41:38.840]  For law enforcement or for the government to be able to harness the creative ability of hackers to track down people that are engaging in criminal activities associated with networking or computing, which is in general form.
[41:39.420 --> 41:47.420]  The thing I wonder about that is, one, I don't think that the strength of the hacker community is in the individual hacker, it's in the fact that it's a community.
[41:47.960 --> 41:52.040]  And information travels quickly within that community in a very informal way.
[41:52.400 --> 41:59.050]  And also, technology changes so rapidly, no one person is to be on everything at any given time.
[41:59.130 --> 42:03.320]  As soon as you take the time to understand one thing, you're coming at a date on something else.
[42:03.460 --> 42:04.240]  You hit the nail on that.
[42:04.240 --> 42:16.180]  I don't know how you harness the power of this web, this honeycomb of talent, because it doesn't fit the model of the sheriff or the bad.
[42:16.320 --> 42:17.240]  It's not like that at all.
[42:17.420 --> 42:19.200]  Well, then one of the two is going to have to change.
[42:19.900 --> 42:20.740]  What's the question?
[42:20.940 --> 42:34.220]  The question was, how do you harness this distributed model of the web where, and I agree with this, hackers, we talk freely amongst ourselves, change tools, techniques, and resources in an informal but true community of individuals.
[42:34.710 --> 42:38.860]  But law enforcement is a very centralized model that does not share information quite a bit.
[42:39.000 --> 42:44.590]  And the question was, how do we harness what's called the hacker web model to apply to law enforcement?
[42:44.780 --> 42:45.630]  Is it even possible?
[42:45.840 --> 42:46.610]  Is it even possible?
[42:46.740 --> 42:49.110]  My answer is yes, but one of the two has got to change.
[42:49.220 --> 42:50.610]  I guarantee it ain't going to be the hacker community.
[42:53.340 --> 43:01.180]  You're going to have a situation where you need to have law enforcement, and again, I say law enforcement generally, but I'm focusing this mostly at the federal level.
[43:01.880 --> 43:14.090]  Law enforcement needs to be able to talk to each other, again, as a community, not as, I'm a federal agent of the FBI, you, sir, are state police in New York, you are local police in Maryland, and, you know, there's this hierarchy here.
[43:14.260 --> 43:19.680]  If you work on a computer crime case, the techniques I'm using as an FBI person might be the same techniques you're using.
[43:19.880 --> 43:20.610]  They may not be.
[43:20.880 --> 43:29.840]  However, we both need to know what our techniques are going to be, what the threat is, and how do we go about resolving it without stepping over each other and causing bad crime.
[43:30.110 --> 43:33.840]  None of them may be as good as a 13-year-old kid in North Jersey, but they don't even know about it.
[43:34.090 --> 43:34.320]  Exactly.
[43:34.570 --> 43:35.220]  No, you're absolutely right.
[43:35.680 --> 43:38.110]  I mean, and again, this is the model.
[43:38.340 --> 43:39.570]  The mindset's got to change.
[43:40.760 --> 43:45.220]  When I first graduated from college, I wanted nothing better to work for the intelligence community.
[43:45.680 --> 43:46.240]  Nothing better.
[43:46.420 --> 43:47.280]  It was very cool.
[43:47.880 --> 43:53.120]  Well, I went to a couple of conferences, and all these NSA people, you know, they showed their badges at the Department of Defense.
[43:54.480 --> 43:56.800]  And they'd be wearing striped suits and, you know, everything.
[43:57.180 --> 43:58.400]  Now I go to a conference.
[43:58.580 --> 44:00.480]  I was at DEFCON two years ago.
[44:01.220 --> 44:02.740]  There were some NSA folks there.
[44:03.180 --> 44:05.480]  They had shirts that said National Security Agency.
[44:06.560 --> 44:08.980]  Their badges had their real names, and I said NSA.
[44:11.180 --> 44:13.100]  So their mindset's changing.
[44:13.740 --> 44:17.920]  Again, you know, this spooky, dark agency up before me in Maryland, they're changing.
[44:18.300 --> 44:19.040]  Why can't the bureau?
[44:20.660 --> 44:21.120]  Question?
[44:21.500 --> 44:26.220]  The federal bureau investigation, but there's some agents there that are probably not noticed here.
[44:26.820 --> 44:33.240]  I don't want to go into pointing fingers, more fingers at the bureau, but I mean, yeah, I've heard similar stories from elsewhere.
[44:33.960 --> 44:34.860]  What else is going on?
[44:34.960 --> 44:36.540]  But again, the mindset's got to change.
[44:36.960 --> 44:52.560]  Whether they have more meetings like this, to bring more people in to talk and learn at these types of sessions, or whether they just have a giant catharsis and realize, let's pick up a point and say, Director Freed, we've got to really rethink how we're talking about our colleagues and compadres and law enforcement.
[44:53.520 --> 44:54.380]  It's got to come.
[44:54.520 --> 44:59.740]  But again, it probably won't come from the outside, because again, that's a very closed society at the federal level.
[45:00.040 --> 45:00.920]  It's got to come from within.
[45:01.140 --> 45:05.920]  And you can come in here and talk to people who are standing outside and watching who's going in and out the door.
[45:05.920 --> 45:10.140]  Well, and again, it comes down to how they perceive their own self-importance.
[45:10.720 --> 45:20.520]  I mean, they apparently know enough all about what we're talking about here today that they don't need to be in here to interact with us and get some face time with us.
[45:20.700 --> 45:22.180]  They know all about social engineering.
[45:22.500 --> 45:26.220]  They know all about getting information on other folks here.
[45:26.360 --> 45:28.060]  They know all about these great things.
[45:28.060 --> 45:28.760]  Yeah, right.
[45:29.020 --> 45:40.120]  And I guarantee you, there might be a handful of FBI folks or other law enforcement who are actually sitting in this conference who actually are going to walk away thinking, how screwed up are we?
[45:41.060 --> 45:44.700]  And then realize, wow, we've got to start affecting change from the inside out.
[45:46.020 --> 45:48.240]  If there's any FBI folks in this room, please go away with that message.
[45:48.320 --> 45:49.320]  I really want you to think that.
[45:49.700 --> 45:51.180]  But I'm talking about more offline than I can.
[45:51.560 --> 45:52.480]  I love you guys.
[45:52.580 --> 45:53.420]  You guys have a great mission.
[45:53.540 --> 45:54.420]  You're trying your hardest.
[45:54.420 --> 45:59.500]  It's just you're caught up in this web of bureaucratic self-righteousness.
[46:00.480 --> 46:01.940]  And it's going to go around and bite you where it hurts.
[46:02.160 --> 46:03.320]  And you're not going to get much stuff done.
[46:04.080 --> 46:06.020]  So finally, I want to close real quick here.
[46:06.040 --> 46:08.600]  So I do have a flight to catch back to the happy nation's capital.
[46:09.900 --> 46:10.100]  No.
[46:10.500 --> 46:10.900]  Amsterdam!
[46:11.820 --> 46:12.380]  Say again?
[46:12.720 --> 46:13.120]  Amsterdam!
[46:14.880 --> 46:16.240]  No, I'm not going to Amsterdam.
[46:17.520 --> 46:20.840]  I'm going a hundred and some miles south of here to our nation's capital.
[46:21.760 --> 46:22.700]  I'm just about to ask.
[46:22.820 --> 46:23.040]  But anyway.
[46:23.740 --> 46:25.240]  What it comes down to is this.
[46:25.560 --> 46:36.160]  What I've tried to do, outside of getting out of the soapbox and kind of just going off from these various tangents, is to illustrate a couple of concerns that I see as someone who's deeply involved in this whole internet thing.
[46:36.400 --> 46:36.880]  Fang.
[46:37.720 --> 46:49.520]  There are problems endemic in the legislature, in law enforcement dealing with computer crimes, at the personal privacy level that affects each of us individually, and as a nation.
[46:50.120 --> 46:53.340]  I mean, I don't want to go to all the information warfare and want this great deal.
[46:53.840 --> 46:55.400]  I mean, that's overblown too in certain areas.
[46:55.520 --> 46:58.040]  There's no such thing as a silver bullet information warfare thing.
[46:59.860 --> 47:00.920]  Okay, as a side note.
[47:01.620 --> 47:06.220]  Last year, we went after Slobodan Milošević in Yugoslavia.
[47:06.580 --> 47:12.640]  There was a couple of reports that said, the Pentagon was talking to various folks that could have gone after Slobodan bank accounts.
[47:14.480 --> 47:16.520]  Information warfare is going to do that and make it happen.
[47:17.140 --> 47:17.500]  Incredible.
[47:17.720 --> 47:20.600]  Would that have had a serious impact on the outcome of the conflict?
[47:20.780 --> 47:21.400]  Probably not.
[47:23.460 --> 47:24.280]  They're going to use AFWIC.
[47:25.400 --> 47:28.060]  They're going to use Air Force IW folks to do it.
[47:28.300 --> 47:32.900]  And if you follow the Moonlight and May stuff, AFWIC has stepped on themselves on more than one occasion as well.
[47:33.240 --> 47:35.520]  So, I don't hold them in too high of a regard either.
[47:36.200 --> 47:37.500]  With that, I want to close.
[47:37.500 --> 47:39.320]  I want to thank you for your attention here.
[47:39.480 --> 47:40.700]  I mean, it's kind of free-flowing.
[47:40.700 --> 47:41.860]  I wanted to get a little discussion going.
[47:41.980 --> 47:42.480]  We had that.
[47:43.360 --> 47:44.120]  You can get a hold of me.
[47:44.200 --> 47:47.440]  My email address is in the back of the program on my website.
[47:47.600 --> 47:48.100]  I've got some articles.
[47:48.280 --> 47:49.660]  You can cite them, quote them, do whatever you'd like.
[47:49.740 --> 47:50.240]  It'd be wonderful.
[47:51.780 --> 47:52.500]  Thanks for your time.
[47:52.580 --> 47:53.540]  Hope you had a great conference.
[47:53.660 --> 47:54.980]  I look forward to seeing you guys in the future.
[47:55.180 --> 47:55.380]  Thanks.