[00:01.830 --> 00:03.170] So, this is me. [00:03.370 --> 00:04.170] My name is Greg Newby. [00:04.370 --> 00:05.130] That is my name. [00:06.650 --> 00:15.170] I see I left off a right-hand closed parenthesis here, so this means my talk will not compile. [00:16.770 --> 00:18.170] I'm going to get all kinds of errors. [00:21.870 --> 00:26.370] So, this is like the story of the coppers child that has no shoes. [00:26.530 --> 00:28.970] I've been introducing great talks today. [00:28.970 --> 00:32.970] I actually have tomorrow's talk that I'm doing with Porkchop, really well planned out. [00:33.770 --> 00:44.910] This talk got a lot of thought because it's, I think, a deep talk in some ways, or at least it raises a couple of things that you might have thoughts about. [00:46.050 --> 00:57.430] And when I went to actually try to put it on a few HTML slides, I don't know, I got tangled up a little bit. [00:57.430 --> 01:01.890] It's like one of these moral things where you say, you think you know what you want to say, and then when you start saying it, you say, well, I don't know. [01:02.750 --> 01:03.630] So, here it is. [01:03.890 --> 01:06.110] So, here's what I wanted to do with this talk. [01:06.310 --> 01:08.450] And we're Friday evening, 10 o'clock. [01:08.630 --> 01:10.850] Many of you have been here, you know, all day. [01:11.010 --> 01:11.910] Some folks are coming in. [01:12.010 --> 01:13.610] You're going to be here for the overnight, stuff like that. [01:16.670 --> 01:28.150] What I want you to do is try to think in an unstructured manner, not bring too many assumptions with you here. [01:29.250 --> 01:31.090] I don't like the word terrorism at all. [01:31.170 --> 01:36.530] In fact, usually when they start doing one of those radio stories, you know, when that word comes up, I just shut it off. [01:36.530 --> 01:39.850] You know, it's a pain in the butt. [01:40.190 --> 01:43.950] Not a word that really describes anything in a useful way. [01:45.990 --> 02:01.750] A word that describes things in a very pejorative way that really might be a little more ambiguous, maybe even a little less subject to scorn on further reflection. [02:03.830 --> 02:12.930] But when I was thinking of what I wanted to talk about, what I wanted to propose for this conference, this was really about the first topic that came to mind. [02:13.270 --> 02:25.230] And the reason is that for the last few years, and a few people I'm sure have seen these talks, if not actually here, I think in this room actually, at, you know, on the DVDs. [02:25.230 --> 02:27.390] And I have some web pages and stuff like that. [02:27.550 --> 02:31.130] But I've been talking about hacker ethics, talked about hacker ethics at H2K. [02:31.570 --> 02:33.690] I did something similar at HAL 2001. [02:34.750 --> 02:39.990] Talked about doing a curriculum for ethics instruction at H2K2. [02:40.570 --> 02:42.770] And so I've been thinking about this for a while. [02:43.290 --> 02:52.150] And somehow or other, I thought that we had to put the word terrorism and hacker together. [02:52.390 --> 02:53.810] And talk about what that really means. [02:54.010 --> 03:02.790] And what the result of these types of labels are. [03:03.010 --> 03:05.970] Because we use labels to refer sometimes to pretty complex topics. [03:06.410 --> 03:09.250] And the label hacker is the one that we've all had problems with. [03:09.530 --> 03:09.890] Right? [03:10.470 --> 03:13.390] We don't like the way that label is used a lot of times. [03:15.290 --> 03:19.190] And so this is where I caught some of that synergy and wanted to talk about it. [03:19.730 --> 03:22.790] So that's sort of an overview. [03:23.210 --> 03:24.430] This is a little bit of an outline. [03:24.610 --> 03:27.570] Actually, I just realized I don't think I have my hyperlinks working on this. [03:27.570 --> 03:29.630] I'll upload these to my webpage. [03:29.850 --> 03:32.230] It's petascale.org over the next couple of days. [03:32.550 --> 03:34.070] And feel free to drop me an email. [03:34.310 --> 03:37.070] It's just newbie at petascale.org or gbnewbie. [03:38.310 --> 03:39.110] Either is fine. [03:39.310 --> 03:41.790] Actually, I think almost anything at petascale.org goes to me. [03:45.830 --> 03:46.790] Here's what I want to do. [03:47.470 --> 03:50.870] I want to do extremes. [03:50.910 --> 03:52.270] Then I want to come back to the middle. [03:52.270 --> 03:54.490] And then we're going to have some fun afterwards. [03:54.690 --> 03:56.650] I'm just going to show you some of the recruiting for... basically recruiting for hackers that's happening now in places like the NSA and the U.S. Army. [04:03.370 --> 04:05.250] That's sort of for fun as an afterthought. [04:05.470 --> 04:20.150] But what I want to do is paint a picture of where hackers and terrorists have something in common, where they don't have something in common, and where the sort of moral ambiguity between values and actions can sort of catch us. [04:20.150 --> 04:34.350] Because I've talked, and in 2600 magazine, places like that, we have kind of an idea about what hacker ethics are, what the values of hackers should be, or at least the ones, you know, that we'd like to hold up and say, no, no, hackers aren't that. [04:34.550 --> 04:44.210] They're, you know, they're really curious and talented and maybe not the types of people that follow the rules all the time, you know, questioning authority. [04:44.390 --> 04:46.830] We have these, you know, statements that we'd like to make. [04:50.090 --> 04:52.310] So we have values and then we have actions, right? [04:52.330 --> 04:53.790] And actions sometimes have consequences. [04:54.890 --> 04:56.630] I want to talk a little bit about middle ground. [04:56.890 --> 05:01.850] And what I'm going to do is start with a conclusion, make life easy, and... or a conclusion anyway. [05:02.050 --> 05:05.350] And then work towards a kind of an introduction and a few closing thoughts. [05:06.270 --> 05:07.930] And I'm, I'm easy. [05:08.130 --> 05:12.930] If you, if you want to engage, then it's actually, the lights are bright enough that I can't... [05:12.930 --> 05:14.730] I'm not necessarily going to see you if you raise your hand. [05:14.910 --> 05:22.270] But if you want to say something, then talk, stand up, come forward, and we'll put you on there. [05:22.650 --> 05:25.670] Yeah, we'll put you... yeah, he'll put you on the microphone, or he'll bring the mic to you. [05:26.050 --> 05:27.330] That's okay, I don't mind being interrupted. [05:27.550 --> 05:29.290] That's why I'm starting with the conclusion, right? [05:29.570 --> 05:30.690] Because other than the fun stuff. [05:31.350 --> 05:33.890] All right, so here's something that we probably all agree with, right? [05:34.570 --> 05:36.630] The hackers and terrorists, it's not a synonym. [05:36.950 --> 05:57.790] And I think that it's a real problem, you know, a real problem, that the word hacker is used in the same sentence sometimes with terrorists in places, maybe not the same sentence, but things like the Patriot Act and further enhancements to the United States Code, [05:57.790 --> 06:09.030] where essentially anything that a very short while ago, you know, just a few revisions to the law, but certainly within 10 or 20 years ago, would have been not a big deal, you know? [06:09.210 --> 06:16.130] So prank-like activities, you know, various types of breaking into systems and so forth. [06:16.490 --> 06:20.090] Well, things like the Computer Fraud and Abuse Act have had a bite. [06:20.250 --> 06:22.190] That's been around for quite a while. [06:22.190 --> 06:27.550] But the Computer Fraud and Abuse Act has this escalation, right? [06:27.650 --> 06:37.330] The Computer Fraud and Abuse Act of 1986 has this escalation where if you just break into a system, well, there's not a ton of penalty for that, right? [06:37.530 --> 06:39.670] Depends, recidivism, all these types of things. [06:40.330 --> 06:41.910] But at a relatively low level. [06:42.110 --> 06:50.070] If you break into something like a federal system, a government system, a military system, a bank system, all of a sudden, they skyrocket. [06:50.510 --> 06:54.490] You break into a system in between there, it's going to be like your corporate system for profit. [06:54.650 --> 07:04.810] You know, so if you're doing whatever, industrial espionage, if you're reselling various types of things, making some sort of living or some sort of money or potentially some sort of money, then, you know, again, that's sort of raised. [07:06.490 --> 07:08.130] Maybe this makes some kind of sense. [07:08.230 --> 07:10.530] Certainly there's something to be said for the punishment fitting the crime. [07:10.890 --> 07:15.170] But that sort of sense, to the extent that it was sense, has fallen by the wayside. [07:15.170 --> 07:23.590] And now all of a sudden, the, you know, the mere act of testing sometimes, the mere act of penetration, has some pretty severe legal consequences. [07:25.190 --> 07:26.610] So hackers aren't terrorists. [07:28.030 --> 07:45.190] And I don't accept, and I'm sure most people here don't accept, even though sometimes we get tired of correcting it and maybe don't always correct it as much as we should, that the definition of hacker as criminal is not accepted because, as I said before, [07:45.410 --> 07:49.970] you have activities and you have consequences, you have values, right? [07:50.210 --> 08:00.110] So an activity, I don't know, a port scan, something like that, is not the same as an activity like theft or like fraud. [08:00.110 --> 08:11.770] And we have very good ways of, I shouldn't say very good, but I should say pretty well established ways of labeling and punishing and judging and so forth for various types of crime. [08:12.230 --> 08:14.330] And we have good labels for those, right? [08:14.410 --> 08:18.630] You know, we have someone who commits fraud, you know, a felon and so forth. [08:18.730 --> 08:19.730] We have very good labels for criminals. [08:19.890 --> 08:23.910] We don't need to use hacker as a label for criminal or synonym. [08:26.130 --> 08:30.150] I actually meant to grab the book and I made a note to myself and then I didn't grab the book. [08:30.690 --> 08:34.930] How many people in here are CISSP certified or something similar? [08:35.330 --> 08:36.170] Not too many people. [08:36.510 --> 08:37.790] Several people know what it is, right? [08:38.810 --> 08:40.980] There's a couple of different security certifications. [08:41.650 --> 08:44.510] There's actually like a security plus certification now, a couple of other things. [08:45.090 --> 08:54.410] So I'm studying, I'm doing the CISSP class next week, coincidentally, after the weekend spent at the hackers conference. [08:54.790 --> 08:55.970] And they have this form. [08:56.270 --> 08:58.930] Actually, I think I have the form on my laptop, but I won't try to pull it up. [09:00.210 --> 09:05.430] They have this form that you have to apply for, where you have to have four years of professional experience and security related. [09:05.570 --> 09:07.370] So I've been teaching information security, stuff like that. [09:07.750 --> 09:09.370] You have to have a suitable degree. [09:09.530 --> 09:10.930] I had a PhD in information transfer. [09:11.050 --> 09:11.690] I got stuff like that. [09:12.470 --> 09:13.610] And there's this little... [09:13.610 --> 09:14.330] No, I'm okay. [09:14.470 --> 09:14.610] Thanks. [09:14.610 --> 09:18.290] There's this little check box. [09:18.770 --> 09:21.450] And I started doing Alice's Restaurant in my head. [09:21.670 --> 09:27.350] You know, you remember the part where he's sitting at down, where Arlo is sitting on the Group W bench, right? [09:27.390 --> 09:32.490] And they want to know if he's, you know, more... [09:32.490 --> 09:34.690] Yeah, after being a litter bug, right? [09:34.930 --> 09:38.630] So it said on here, have you ever been associated with hackers? [09:41.270 --> 09:46.390] Or been engaged in hacking, either as your name or as some sort of a pseudonym. [09:47.730 --> 09:49.270] And so I was going to check yes. [09:49.590 --> 09:50.090] And you had... [09:50.090 --> 09:51.910] Because I've been running these conferences, right? [09:52.210 --> 09:54.010] So I was going to check yes. [09:54.210 --> 09:57.110] And then you had to... [09:57.110 --> 10:00.530] You had to explain yourself on a separate sheet of paper, right? [10:00.790 --> 10:02.350] So I gave it a little thought. [10:02.570 --> 10:04.530] And this is one of those things where it's like I had registered. [10:04.530 --> 10:11.630] I had paid, my job had paid, you know, like $4,000 already for this expensive certification class and exam. [10:11.990 --> 10:14.090] And then you have to fill out the application form. [10:15.490 --> 10:16.990] And I'm thinking, wow, you know. [10:17.570 --> 10:18.370] So what did I do? [10:18.370 --> 10:20.170] What I do was I said, okay, wait a minute. [10:21.670 --> 10:26.950] If I have to write this letter of explanation, what I'd better do is make sure that we're talking about the same thing. [10:26.990 --> 10:31.030] Because I don't want to have to write a letter that says, you know, really, I do these talks on hacker ethics. [10:31.030 --> 10:36.950] And I go out and I work with 2600 that's really engaged in, you know, education for young people. [10:37.110 --> 10:43.830] And, you know, really at the forefront of, I believe, turning people away from what might be a darker path. [10:44.050 --> 10:48.110] Leading towards some of those real criminal words that I mentioned before. [10:49.950 --> 10:53.170] And I was, you know, running on in my mind with how I would present that. [10:53.170 --> 10:57.770] But then I went and looked up hacker in the index of the CISSP training manual. [10:57.930 --> 11:01.110] It's like this 1200 page hardcover book. [11:01.870 --> 11:03.850] Lot of review questions, stuff like that. [11:05.510 --> 11:07.890] Their definition, and I don't have it right in front of me now. [11:08.110 --> 11:10.410] But their definition is like on page 75. [11:11.790 --> 11:15.770] Was essentially, a hacker is a criminal who breaks into your system. [11:16.730 --> 11:17.170] Okay. [11:17.490 --> 11:18.430] And I said, oh, okay. [11:18.550 --> 11:19.210] So I checked no. [11:20.090 --> 11:20.870] And I was all right. [11:21.070 --> 11:21.670] Sent it in. [11:21.850 --> 11:23.530] I think I take the exam next Saturday. [11:23.750 --> 11:24.250] Wish me luck. [11:26.530 --> 11:27.450] So, yeah. [11:27.610 --> 11:30.910] So this, I mean, it's right there, you know, in black and white. [11:31.230 --> 11:44.430] That if you want to be a security certified professional, one of the things among the many, many, many things that you have to memorize and be able to recite are that hacker equals criminal. [11:44.430 --> 11:46.730] And I was not so happy with that. [11:47.050 --> 11:52.150] They didn't have hacker equals terrorist, but they haven't revised the study guide all that recently. [11:52.390 --> 11:57.330] So the, you know, the hacker is a terrorist that breaks into your system. [11:57.590 --> 11:59.170] You see the effect of language there. [12:00.590 --> 12:08.450] And we know, of course, no use denying that hackers can and do engage in activities that might be good. [12:08.550 --> 12:12.470] They might be evil or bad or questionable or reprehensible and so forth. [12:13.150 --> 12:25.250] And my proposition always has been, maybe because I hang around at conferences like this and talk to people and see what they do and see the speakers interact with all kinds of folks, that good far outweighs evil. [12:25.630 --> 12:30.650] Or certainly there's a whole lot of stuff that doesn't have a whole lot of value associated with it. [12:30.770 --> 12:32.310] You know, port scans, that good or evil? [12:32.570 --> 12:34.010] I mean, I don't think it's evil. [12:35.990 --> 12:39.990] But I just have a belief that there's a lot more good going on. [12:39.990 --> 12:45.350] And part of that, and I talked about this a few years ago at H2K, is we're people, right? [12:45.530 --> 12:47.090] And so we have the whole range. [12:47.350 --> 12:51.510] You know, short and tall and different colors and different backgrounds and different, you know, everything. [12:51.730 --> 12:53.490] You know, different religious beliefs, all that kind of stuff. [12:54.790 --> 12:59.410] And so for people, well, I believe that people on the whole are more good than evil. [12:59.410 --> 13:03.170] So statistically speaking, so are we. [13:04.890 --> 13:09.190] So that's my conclusion to say that just, you know, simple statements. [13:09.270 --> 13:10.070] Hackers aren't terrorists. [13:10.270 --> 13:11.770] You know, we don't accept that definition. [13:13.430 --> 13:15.210] I'm not going to try to define terrorists. [13:15.290 --> 13:16.570] As I said, I don't even like the word. [13:16.690 --> 13:19.410] But I think we all have kind of our own definition. [13:19.410 --> 13:26.710] And probably most of us would agree that the usage of the word terrorists is overly broad. [13:27.870 --> 13:32.730] And essentially terrorists is a negative term. [13:33.310 --> 13:35.510] And the definition, I took a look. [13:35.650 --> 13:38.210] I didn't paste it into my talk here. [13:38.310 --> 13:40.090] I took a look in Merriam-Webster. [13:40.250 --> 13:45.110] And the definition is essentially war-like acts. [13:45.110 --> 13:48.410] And I don't think this is, it doesn't actually say war-like in the dictionary. [13:48.810 --> 13:50.010] But essentially war-like acts. [13:50.210 --> 13:53.970] You know, so destroying property, murder, mayhem, stuff like that. [13:55.150 --> 13:57.370] Engaged in by non-state entities. [13:57.830 --> 13:59.090] Or non-government entities. [13:59.790 --> 14:00.110] Okay? [14:00.390 --> 14:04.370] So really the distinction there is not the act. [14:04.670 --> 14:04.890] Right? [14:04.950 --> 14:07.330] It's not whether you're shooting someone, blowing something up. [14:07.550 --> 14:09.610] You know, all these types of things that we can think of. [14:09.850 --> 14:13.110] But it's whether or not you're doing it as part of a state-sponsored activity. [14:13.650 --> 14:15.370] You know, as part of a military. [14:15.750 --> 14:18.950] As part of a, you know, Congress. [14:19.310 --> 14:20.310] That's making decisions. [14:20.450 --> 14:21.370] All that sort of thing. [14:22.010 --> 14:24.790] So right away we see that, what I mentioned earlier. [14:25.150 --> 14:26.510] That the action is the action. [14:26.710 --> 14:26.950] Right? [14:27.050 --> 14:29.810] And then you have sort of the definition and the label and stuff like that. [14:30.030 --> 14:30.670] So what have you. [14:30.770 --> 14:31.670] You know, blowing something up. [14:32.490 --> 14:33.990] Whatever that action might be. [14:34.350 --> 14:35.670] You know, breaking into some sort of system. [14:35.730 --> 14:36.770] Whatever that action may be. [14:37.410 --> 14:38.630] Labeling it one way or the other. [14:38.630 --> 14:44.290] Or as even, I would say, the extreme even as good or evil. [14:44.810 --> 14:49.270] But certainly labeling that as, say, terrorism versus defense. [14:51.210 --> 14:55.150] Might be a separate decision from the action itself. [14:56.230 --> 15:01.650] So at the extreme, we might say that hackers are terrorists. [15:01.650 --> 15:02.610] We might equate that. [15:02.790 --> 15:06.730] And I've heard, and you've heard, you know, news reports and things like that. [15:06.850 --> 15:09.510] Where that equation is certainly implicit. [15:09.930 --> 15:11.250] Maybe not too explicit. [15:11.430 --> 15:12.150] Sometimes explicit. [15:12.390 --> 15:13.130] But certainly implicit. [15:15.050 --> 15:16.130] And at the other side. [15:16.270 --> 15:18.150] And this is part of what got me started on this. [15:18.250 --> 15:18.870] And I was really happy. [15:18.970 --> 15:20.650] I chatted with Robert Steele a little bit. [15:20.750 --> 15:23.470] And listened to his presentation earlier today. [15:24.350 --> 15:26.750] Seems like I should be saying yesterday or earlier this week. [15:26.750 --> 15:28.090] But it was actually about 12 hours ago. [15:29.570 --> 15:34.130] He has this idea of a national security college type of program. [15:34.870 --> 15:40.010] And so the other, sort of the other end of the spectrum is, hey, if we don't have hackers, we're going to lose. [15:40.310 --> 15:40.630] Right? [15:40.710 --> 15:41.770] We've got to have these hackers. [15:41.830 --> 15:45.210] Otherwise, you know, someone else is going to hack into our systems. [15:45.330 --> 15:46.230] We won't have people to defend. [15:46.350 --> 15:50.170] We won't be able to defend ourselves in the cyber war against cyber terror. [15:50.350 --> 15:50.990] Something like that. [15:52.510 --> 15:52.950] Okay. [15:53.110 --> 15:58.550] And these are both little, you know, as I said, at the far end of extremes. [16:02.620 --> 16:05.760] So we have feelings about the word hacker, of course. [16:06.000 --> 16:08.440] And we have feelings about the word terrorism. [16:09.000 --> 16:12.280] And I don't... neither of these makes me feel all that good. [16:12.520 --> 16:15.500] Certainly, I'm not even willing to say that hackers are criminals. [16:15.640 --> 16:18.520] I'm not willing to say that hackers are terrorists. [16:19.060 --> 16:21.040] That just doesn't make a lot of sense to me. [16:22.660 --> 16:24.660] I'm a little more comfortable with the second proposition. [16:24.880 --> 16:29.240] And actually, that's not that far from what Robert Steele was saying this morning. [16:29.360 --> 16:30.460] The idea that... [16:32.800 --> 16:34.020] There's some problems with this. [16:34.100 --> 16:51.020] But really, the idea that getting people into a situation, young people probably, but people with talent into a situation where the talent can be honed for the uses of the state in various types of activities, defensive, offensive, counterintelligence, [16:51.080 --> 16:55.920] all that stuff that all those organizations do. [16:57.120 --> 16:59.200] That maybe has a certain resonance, but there's a problem. [16:59.320 --> 17:00.300] We'll get to that problem in a moment. [17:00.360 --> 17:02.500] You already know what it is, because that's why it's tickling your brain. [17:03.080 --> 17:03.880] Okay, probably. [17:04.020 --> 17:05.980] If it's tickling your brain the same way it did mine. [17:10.620 --> 17:15.700] So, we'll do the side that tickles a little bit less first. [17:16.460 --> 17:18.000] So, hacker terrorists, right? [17:18.240 --> 17:23.920] Well, so, I think this might be one of the things in the movie. [17:24.880 --> 17:34.180] I didn't see the Roger Moore movie yet, but I read one of his books, and he's running on about how the Bin Laden guy, Evan Eliasana, dialysis machine. [17:34.540 --> 17:34.900] Right? [17:35.000 --> 17:40.180] So, he's talking about how, you know, what sort of healthcare do you get in like the caves of Afghanistan and whatnot. [17:40.480 --> 17:42.960] And that got me thinking, what kind of internet do they get? [17:43.680 --> 17:43.980] Right? [17:44.280 --> 17:50.300] Do they have like the direct PC dish and they have to call in the engineer every time when they move from cave to cave? [17:50.540 --> 17:51.120] You know? [17:51.260 --> 18:03.560] So, probably there's, in our vision of, you know, Islamic fundamentalists, you know, typical, you know, hopefully very inaccurate, but stereotypical view of terrorists. [18:04.260 --> 18:09.140] They don't got a lot to offer for your average hacker that likes to sit at home on DSL or faster. [18:09.440 --> 18:09.840] Right? [18:09.920 --> 18:13.820] With a couple of nice gaming systems, couple of big file servers, stuff like that. [18:14.000 --> 18:14.260] Right? [18:14.300 --> 18:14.920] Where's the appeal? [18:15.060 --> 18:15.440] What are you going to do? [18:15.520 --> 18:22.420] Go and move to a cave so you can have, you know, packet radio download speeds? [18:22.560 --> 18:23.100] I don't know. [18:23.360 --> 18:24.940] I don't see much of an appeal there. [18:28.900 --> 18:31.180] The acts that are engaged. [18:31.300 --> 18:32.420] Now, there is some role. [18:32.580 --> 18:37.060] So, if you want to take down a plane, right, hijack a plane, stuff like that. [18:37.180 --> 18:44.840] Well, what would help a lot would be, for example, inside information on the airline, you know, operations. [18:44.960 --> 18:52.540] Inside information on the TSA operations or other things that might help you in your planning. [18:52.540 --> 18:54.220] So, maybe there is a role, right? [18:54.340 --> 18:59.460] Maybe the hacker could be the person that, and again, not to say the hacker is always the person that breaks in. [18:59.620 --> 19:11.200] But the hacker might be the type of person that could break into systems, grab the data that could be used for fulfillment of terrorism. [19:12.620 --> 19:34.360] And yet, you know, with, again, this prototypical, stereotypical, not necessarily all that accurate notion of who the terrorist is, who the terrorists are, I kind of doubt that they're doing a whole lot of what I talked about a couple of years ago with the ethical curriculum for hacking. [19:34.360 --> 19:35.240] Right? [19:35.380 --> 19:35.880] They're probably... [19:35.880 --> 19:36.920] Forget about the ethics. [19:37.120 --> 19:45.800] They're probably not teaching a whole lot of even computer science 101 in the training camps that we hear about and are supposed to be fearful of. [19:45.960 --> 19:52.480] So, I'm just not that concerned about the hacker is terrorist scenario. [19:52.900 --> 20:02.740] And yet, as I say at the bottom there, certainly there's some potential, as I mentioned, with getting into secret data that certainly are online and certainly on systems that are vulnerable. [20:03.060 --> 20:05.220] You know, all systems, we heard Schneier today, right? [20:05.280 --> 20:19.700] I mean, he talks about basically associating values with protection and saying, you know, you can have complete protection if you're willing to, you know, give up a whole bunch of other stuff, right? [20:19.780 --> 20:22.900] Take your systems off the network, all these types of decisions that might be difficult. [20:25.340 --> 20:27.640] But certainly there's some possibility. [20:29.320 --> 20:49.620] And just like we've heard a couple of examples since the, you know, the big increase in interest in terrorism with the September 11th attacks, all that stuff, we do hear of people that are not that different than us, you know, people that are living in places like Buffalo and Oregon and stuff like that, [20:49.780 --> 21:04.960] and going to our schools and so forth, that for whatever reason do turn around and engage actively in support of actual, you know, sort of unquestionable, or not too questionable anyway, definition-wise terrorist activities. [21:06.360 --> 21:08.660] So it happens, can happen, could happen more. [21:11.880 --> 21:23.840] If I were, you know, planning these types of activities, I would certainly give some thought to what the dude with the computer could do in addition to the dude with the whatever gun of some sort or explosives talent, that sort of thing. [21:24.560 --> 21:26.280] Alright, so let's go, let's jump to the other end. [21:26.340 --> 21:27.980] This is the part that tickled a little more for me. [21:27.980 --> 21:45.600] So, the one end is basically that hackers equal terrorists somehow, or terrorists need hackers, or hackers, you know, it's like you, in those old movies where you'd have like one marijuana cigarette and then you'd be, you know, shooting heroin or, you know, [21:45.760 --> 21:48.180] LSD and going all crazy and all that stuff, right. [21:48.320 --> 21:51.040] So it's like you try a little hacking and then you're a terrorist. [21:51.500 --> 21:52.580] You know, it's like the next thing. [21:52.580 --> 21:57.540] You can take like two puffs, you know, you can sniff two packets, right, and then that's it. [21:59.560 --> 22:02.160] Alright, so hacker warriors. [22:03.000 --> 22:12.620] So this is the idea that we've got to get these people into the army, into the defense intelligence agency, into the national security agency and so forth. [22:12.760 --> 22:21.440] Because if we don't, the other guys are going to win because their hackers are going to be better than ours and our systems aren't going to be tough enough and our algorithms aren't going to be tested enough. [22:21.440 --> 22:33.080] And we're not going to be able to respond quickly enough to a dire threat where really the only option for whatever reason is to, whatever, break into someone's system, deny, do a denial of a service attack. [22:33.680 --> 22:34.540] That sort of thing. [22:36.700 --> 22:39.340] So could hackers be the secret weapon against terrorists? [22:39.540 --> 22:40.400] Well, wait a minute. [22:41.080 --> 22:41.520] Okay. [22:41.880 --> 22:43.180] What's wrong with this statement? [22:43.360 --> 22:55.460] Well, we said in definition-wise, if you accept my loose memory of Merriam-Webster's online free dictionary, I think they have a better definition on the pay side, actually, but maybe like a picture. [22:55.680 --> 22:59.060] But we said terrorists didn't have a state, right? [22:59.060 --> 23:00.340] So they don't have a state. [23:00.540 --> 23:02.380] Do they have a top-level domain? [23:03.100 --> 23:03.580] Right? [23:03.740 --> 23:05.380] I mean, are they like AOL? [23:05.680 --> 23:06.180] I don't know. [23:06.400 --> 23:11.240] I mean, they're all like using AOL instead of whatever .af. [23:13.360 --> 23:13.900] What's that? [23:15.280 --> 23:15.940] .terror, yeah. [23:16.160 --> 23:16.240] Okay. [23:16.780 --> 23:18.260] Let's talk to ICANN about that. [23:18.800 --> 23:21.840] So, okay. [23:22.060 --> 23:23.820] So there's a little bit of a mismatch there. [23:23.920 --> 23:30.300] But on the other hand, and I'll show you some of the things that the NSA and Army and so forth are actually looking for. [23:30.500 --> 23:41.060] On the other hand, there is actually a pretty good role because the stuff that hackers are good at includes things like putting pieces of puzzles together, right? [23:41.060 --> 23:52.760] Sifting through a whole lot of information, looking for similarities in seemingly disparate or unrelated pieces of information, right? [23:52.960 --> 23:54.860] And what did I just describe? [23:55.060 --> 23:59.360] Well, I described a hacker, but I also described a good intelligence analyst, right? [23:59.440 --> 24:03.940] Or a good person to do signals intelligence, that type of thing. [24:03.940 --> 24:06.340] So there is something there. [24:06.620 --> 24:10.800] And again, the tickling part, if you haven't figured out, at least what's tickling me, I'll get to in just a sec. [24:11.160 --> 24:12.340] At the bottom here, actually. [24:13.680 --> 24:18.140] So a national military school for what you might call the top gun hackers. [24:18.620 --> 24:20.640] The obvious thing, there's a movie that did this. [24:20.720 --> 24:26.160] I can't remember the name of the movie, but it was where there was a kid that played a video game and he got so good that he got recruited. [24:27.440 --> 24:27.840] Starfighter. [24:27.840 --> 24:28.180] Starfighter, thank you. [24:28.280 --> 24:28.940] I'm glad you remember that. [24:29.200 --> 24:33.520] And of course, hopefully everyone's read Ender's Game Trilogy, right? [24:33.680 --> 24:41.200] Where the little kid thought he was playing a video game and actually he was remote controlling all these drones that went and destroyed a planet that was attacking Earth. [24:41.620 --> 24:42.500] If you haven't read it. [24:42.800 --> 24:43.440] Required reading. [24:43.720 --> 24:45.180] Okay, Sci-Fi 101, Ender's Game. [24:45.400 --> 24:46.480] Ender's Game by Orson. [24:47.800 --> 24:49.080] Orson Scott Card, yeah. [24:49.080 --> 24:53.420] It's the first book in a trilogy, so you're not going to be able to finish by tomorrow morning. [24:56.220 --> 25:00.480] The part that tickled me, because I know some military people. [25:01.560 --> 25:04.640] I haven't been one, so don't speak from tremendous experience. [25:05.200 --> 25:08.040] But what did I say before? [25:08.260 --> 25:16.460] And I had a hyperlink here to that hacker ethics talk I talked about and mentioned some of the definition earlier. [25:17.780 --> 25:21.280] Well, hackers are not really all that great at authority a lot of times. [25:21.440 --> 25:22.600] It's one of the characteristics. [25:23.180 --> 25:25.440] Stereotypical, you know, with all the variety. [25:25.700 --> 25:29.300] Some people, yes, some people know everyone's individual, all that stuff, blah, blah, blah. [25:29.560 --> 25:37.760] But by and large, right, hackers are all about questioning that authority, about pushing the envelope, exploring the boundaries. [25:39.220 --> 25:44.240] You know, looking when you see a door, looking around the door, looking under the door, you know, testing the door, that sort of thing. [25:45.040 --> 26:02.660] Does this sound like the ideal candidate for, you know, for boot camp and military service and, you know, sort of a very structured environment that you find, at least in the sort of the military and military-related places, National Security Administration and so forth? [26:03.580 --> 26:05.780] Doesn't sound that consistent to me. [26:05.860 --> 26:07.020] This is the part that tickled, right? [26:07.020 --> 26:14.020] So if you want to be a, for whatever reason, maybe you're younger, maybe you're a little older, and you say, hey, I want to help my country. [26:14.020 --> 26:17.020] I want to go out and I see these job ads you're going to look at. [26:17.160 --> 26:24.840] I want to become an intelligence analyst for the Army Intelligence Agency, right? [26:24.840 --> 26:34.330] Well, how well is that going to work when you can't question authority as easily? [26:34.690 --> 26:43.330] When the boundaries might be a lot tighter in your, you know, your work environment, computer environment, than they are in your home computer environment, that sort of thing. [26:43.330 --> 26:43.330] posting. [26:43.470 --> 26:56.530] So this is the part that tickled a little bit for me, that the, you know, the, the things that, that make hackers hackers, really, some of the things that make hackers hackers, are probably, pretty opposite. [26:56.810 --> 27:00.650] Certainly, certainly not too consistent with the things that make soldiers soldiers. [27:00.930 --> 27:04.090] The things that make warriors warriors. [27:04.410 --> 27:06.250] And again, take it with a grain of salt. [27:06.370 --> 27:07.490] Everyone's a little different in all that stuff. [27:11.890 --> 27:24.350] So somewhere in the middle ground is where we say that... essentially we say that things are ambiguous and as I said earlier, we separate out the actions from the values. [27:24.930 --> 27:30.470] So I mentioned one or two ways just off the cuff. [27:30.730 --> 27:34.750] There are many ways in which hackers could use their efforts to support terrorist activities. [27:36.010 --> 27:40.270] And you wouldn't even necessarily be a terrorist or talking with terrorists. [27:40.470 --> 27:46.130] You know, you wouldn't necessarily have to go and visit wherever those caves are, wherever those training camps are, things like that. [27:46.290 --> 27:48.130] You might do it indirectly, right? [27:48.350 --> 28:02.170] You might get information about, I don't know, some inside information about where the next Air Force One plane is going, you know, President's travel schedule, I don't know, sets of information. [28:02.750 --> 28:04.850] And distribute that somehow. [28:05.350 --> 28:09.810] Well, that might help terrorists, especially if you sort of think about where you're going to distribute it. [28:09.830 --> 28:16.050] and get it to where you think, for whatever reason, the real terrorists are listening. [28:16.290 --> 28:18.330] So it wouldn't even necessarily have to be all that active. [28:18.750 --> 28:21.310] So we can think of, hey, look at that. [28:24.960 --> 28:26.460] Someone's, okay, wait a minute. [28:27.360 --> 28:31.380] This is why we have a, okay, I'm not going to mess with it. [28:31.520 --> 28:33.280] This is why we have a wired network for the speakers. [28:33.480 --> 28:34.420] I'm not using internet today. [28:38.640 --> 28:43.980] At the other end, there are many ways which hackers can use their efforts to fight terrorist activities. [28:44.280 --> 28:45.640] We mentioned a few. [28:45.960 --> 28:52.240] Certainly just the general area of security, not to say that hackers is equal with security, but certainly there's a lot of overlapping interests there. [28:52.720 --> 29:03.080] Certainly the idea that you're going to be, you know, penetration testing, security hardening, evaluating code or procedures for weaknesses, that sort of thing. [29:03.080 --> 29:09.380] Well, you know, these are things that could make whatever agency, whatever system more resilient to terrorist attacks. [29:09.660 --> 29:13.020] And as we'll see, those are sort of mainstream activities. [29:13.200 --> 29:16.780] We'll see in some of these job ads, another possibility is to expand. [29:17.080 --> 29:28.280] So instead of, you know, pursuing an interest in security generally, maybe you would go and get involved in cryptography or cryptanalysis. [29:28.280 --> 29:29.300] Is that a question, comment? [29:29.760 --> 29:30.240] Yeah. [29:30.440 --> 29:33.640] Grab the mic because we're going to get the question on the tape. [29:38.600 --> 29:39.180] It's okay. [29:39.300 --> 29:39.640] Keep talking. [29:39.800 --> 29:40.340] They'll turn it up. [29:40.700 --> 29:41.000] Okay. [29:41.100 --> 29:49.580] It seems to me those propositions could be equally applied to any form of weaponry from a .22 caliber handgun to an atomic bomb. [29:49.580 --> 29:52.240] Are you equating a hacker with weaponry? [29:54.240 --> 29:55.240] Well, okay. [29:55.880 --> 29:56.780] The simple answer is no. [29:57.120 --> 30:00.860] I'm almost not making any argument here at all other than the fact that hackers aren't terrorists. [30:01.060 --> 30:05.800] But there are things that hackers could do that would both prevent and help terrorists. [30:05.920 --> 30:10.060] I think those are about the only absolute statements I'm looking at today. [30:10.380 --> 30:19.320] But in terms of taking something which, you know, in the case of a gun, you say, okay, I could defend myself or I could go and kill somebody. [30:19.540 --> 30:19.860] Right? [30:19.940 --> 30:25.080] Or I could go and do something that, you know, people have different views on, go hunting or go target shooting, something like that. [30:25.360 --> 30:29.780] From that point of view, I think probably that's a good analogy for what I'm saying. [30:31.020 --> 30:36.580] Yeah, I hadn't thought of using that as a... just because it's like terrorism, right? [30:36.580 --> 30:39.400] You talk about gun control and people start thinking and talking about different things. [30:39.480 --> 30:40.740] And that wasn't really where I wanted to go. [30:40.980 --> 30:42.200] But I think it's a good analogy. [30:45.740 --> 30:57.680] So, the efforts that, like I said, whatever, you know, trying to figure out how to do a denial of service attack to prevent the system of an imminent danger, you know, whatever. [30:58.400 --> 31:00.120] It's hard to imagine what that would actually be. [31:00.280 --> 31:05.740] But, you know, to prevent the system that's involved in some sort of imminent danger from operating effectively. [31:05.740 --> 31:06.400] Right? [31:06.580 --> 31:17.580] Well, that could... what I said could be portrayed as an activity that someone who would be helping terrorists could do or someone that would be preventing could do. [31:17.760 --> 31:22.640] So, the action doesn't necessarily imply the morality, the good or evil. [31:24.540 --> 31:28.280] So, there's moral ambiguity because of this. [31:28.280 --> 31:39.780] And so, I think it's not something that I would want to argue to say that if we're saying that some hackers are criminals, but hackers aren't equal to criminals. [31:41.140 --> 31:51.160] I'm not going to go someplace... I'm not going to make an argument that some terrorists are evil and some terrorists are just terrorists. [31:51.160 --> 31:59.400] Because I don't... I'm not quite sure what the... I actually have a few synonyms, but I'm not quite sure what the difficulty is. [31:59.540 --> 32:04.240] You know, I think terrorism is a... or terrorist is a pretty good label used over broadly. [32:04.240 --> 32:13.220] But certainly, the idea to say that it's people that are, you know, doing things that we would much more likely agree are evil. [32:15.960 --> 32:23.240] Puts it in a different situation where we can say that, well, hackers are doing stuff that maybe they're evil, maybe they're good, maybe they're ambivalent or ambiguous. [32:24.400 --> 32:27.800] Oh, what happened to this sentence? [32:30.100 --> 32:31.240] I'm parsing it. [32:34.160 --> 32:36.360] That parentheses messed me up before. [32:48.280 --> 32:52.580] I'm trying to come up with like a two sentence... I mean a two word thing here. [32:53.080 --> 32:53.520] So... [32:57.440 --> 33:02.600] So we want to think that as hackers, most of what we do is harmless. [33:02.600 --> 33:06.480] And that if we choose to do something which is harmful, we choose to do so. [33:06.680 --> 33:07.040] Right? [33:07.120 --> 33:09.860] We say, okay, I'm going to crash Bob's computer because he's an asshole. [33:11.860 --> 33:16.680] So we know, you know, we have... we walk in with eyes open about the... [33:17.460 --> 33:20.680] whatever, the good and the evil, the appropriateness or inappropriateness. [33:20.860 --> 33:22.780] And it's something I talked about in my previous talks. [33:22.960 --> 33:27.400] You know, the desire here is to be thoughtful and reflective. [33:27.960 --> 33:28.220] Right? [33:28.320 --> 33:32.760] And if you're being thoughtful and reflective, then you're leaning towards the ethical side. [33:32.960 --> 33:40.740] If you're being thoughtless and not reflective, then you're not being ethical. [33:41.500 --> 33:50.320] Or you might be behaving in an ethical fashion, but the moral processes, the intellectual processes behind those aren't consistent with what I would call ethical behavior. [33:50.320 --> 33:58.540] And again, separate discussion, because I know ethics is a topic with a lot of different things that can be said about it. [34:04.170 --> 34:04.650] Um... [34:04.650 --> 34:06.530] So if you're doing... [34:08.470 --> 34:09.430] Oh, I don't know. [34:09.610 --> 34:11.770] So you're... you're helping the man. [34:11.930 --> 34:16.630] You know, you're working for the army intelligence, looking at data that came from... [34:17.910 --> 34:23.090] or looking at human intelligence that came from spies and interrogations and stuff like that. [34:23.250 --> 34:25.230] Well, you might not feel that the... [34:25.230 --> 34:26.730] the activity... [34:28.450 --> 34:28.890] is... [34:28.890 --> 34:29.450] that... [34:29.450 --> 34:29.990] that... [34:29.990 --> 34:30.570] that was engaged... [34:30.570 --> 34:33.590] that happened to get the data is consistent with moral behavior. [34:33.890 --> 34:36.130] It's consistent with ethical behavior. [34:43.820 --> 34:45.120] Not sure that part made sense. [34:45.300 --> 34:45.820] But we'll go on. [34:46.240 --> 34:46.480] Okay. [34:46.540 --> 34:48.140] Because what we need to do is get to the introduction. [34:48.660 --> 34:50.360] We did the conclusion earlier. [34:53.180 --> 34:54.160] Oh, I did mention... [34:54.160 --> 34:54.320] I... [34:54.320 --> 34:56.060] I thought I put CISSP in the... [34:56.060 --> 34:56.800] in the slide there. [34:57.280 --> 34:57.660] So... [34:57.660 --> 34:59.480] So terrorism is kind of a catch-all phrase. [34:59.640 --> 35:00.320] We know this is a... [35:00.320 --> 35:01.280] is a problem. [35:01.500 --> 35:02.470] We also know that we... [35:03.020 --> 35:03.440] um... [35:03.440 --> 35:07.580] portray things that a few years ago probably wouldn't have been thought of too much as... [35:07.580 --> 35:08.320] uh... [35:08.320 --> 35:08.840] uh... [35:08.840 --> 35:10.300] being associated with terrorism as terrorism. [35:10.460 --> 35:11.360] And unfortunately hackers... [35:12.060 --> 35:12.380] uh... [35:13.000 --> 35:13.420] hacking... [35:13.420 --> 35:15.360] seems to be falling at least somewhat... [35:16.620 --> 35:17.460] in that... [35:18.000 --> 35:18.420] uh... [35:18.420 --> 35:19.260] in that group. [35:20.140 --> 35:21.240] You know, that... [35:21.240 --> 35:21.700] that group of... [35:22.660 --> 35:23.220] uh... [35:23.220 --> 35:24.960] phrase which is over broadly... [35:24.960 --> 35:26.640] associated as being... [35:26.640 --> 35:28.240] somewhat equivalent with... [35:28.240 --> 35:28.860] uh... [35:28.860 --> 35:29.460] with terrorism. [35:30.660 --> 35:32.440] So hacking isn't equal to terrorism. [35:32.620 --> 35:33.520] And unfortunately the word... [35:33.800 --> 35:34.940] I'm thinking of... [35:34.940 --> 35:35.280] uh... [35:35.280 --> 35:38.440] in my mind it had this map of how closely related... [35:38.440 --> 35:39.640] terms are to one another. [35:40.360 --> 35:40.600] Right? [35:40.680 --> 35:41.060] A little... [35:41.060 --> 35:42.700] latent semantic indexing... [35:42.700 --> 35:43.300] semantic differentials... [35:43.960 --> 35:44.260] index... [35:44.260 --> 35:44.840] something like that. [35:45.040 --> 35:45.340] Right? [35:45.460 --> 35:48.360] And I see the word hacker creeping closer to the word terrorism. [35:48.360 --> 35:49.160] Right? [35:49.380 --> 35:49.940] Not good. [35:50.160 --> 35:51.300] Not something we'd like to see. [35:53.140 --> 35:53.620] Um... [35:53.620 --> 35:54.100] So... [35:54.100 --> 35:54.480] and we have... [35:54.480 --> 35:55.660] we have some great signs... [35:55.660 --> 35:57.660] you know, great posters around here that are... [35:57.660 --> 35:58.480] uh... [35:58.480 --> 35:58.580] uh... [35:58.580 --> 36:00.200] essentially saying that if you're... [36:00.200 --> 36:01.440] if you're thinking for yourself... [36:02.100 --> 36:04.860] and questioning authority and all these things that... [36:04.860 --> 36:06.360] we would like to characterize as... [36:07.580 --> 36:08.060] uh... [36:08.320 --> 36:10.500] both ethical and hacker oriented... [36:11.080 --> 36:13.640] activities or outlooks on life... [36:13.640 --> 36:14.540] um... [36:15.560 --> 36:16.060] uh... [36:16.060 --> 36:17.740] we have the mockeries of the posters... [36:17.740 --> 36:20.000] but then you see the real posters and the real messages a lot... [36:20.000 --> 36:21.320] and again sometimes they're implicit... [36:21.900 --> 36:23.080] that are saying that... [36:23.080 --> 36:23.200] uh... [36:23.200 --> 36:24.300] those activities are... [36:24.300 --> 36:25.400] something that are... [36:25.400 --> 36:26.350] maybe not terrorism... [36:26.860 --> 36:26.980] right? [36:27.140 --> 36:28.320] but they're... they're on the side... [36:29.180 --> 36:29.440] right? [36:29.520 --> 36:30.700] If you're questioning authority... [36:30.700 --> 36:31.080] you're... [36:32.040 --> 36:32.540] uh... [36:32.540 --> 36:32.960] uh... [36:32.960 --> 36:34.640] you know, speaking dirt about the... [36:34.640 --> 36:35.160] um... [36:35.160 --> 36:36.280] uh... government and so forth... [36:36.280 --> 36:36.540] then you're... [36:37.320 --> 36:37.760] you're... [36:37.760 --> 36:38.220] supporting the... [36:38.220 --> 36:38.460] uh... [36:38.460 --> 36:38.960] the terrorists. [36:41.880 --> 36:42.320] Um... [36:42.320 --> 36:43.620] As I mentioned before... [36:43.620 --> 36:43.900] uh... [36:43.900 --> 36:44.340] and this is... [36:44.340 --> 36:44.840] this is... [36:44.840 --> 36:46.660] uh... pretty close to a direct statement... [36:46.660 --> 36:46.940] uh... [36:46.940 --> 36:48.700] I mentioned I'd just make a few... [36:48.700 --> 36:48.760] uh... [36:48.760 --> 36:50.460] this is something that Robert Steele and I... [36:50.460 --> 36:51.740] just chatted about really briefly... [36:51.740 --> 36:53.000] but I got out of his talk... [36:53.000 --> 36:53.300] uh... [36:53.300 --> 36:55.960] treating hackers as an actual valuable national... [36:56.600 --> 36:57.040] asset... [36:57.040 --> 36:57.540] uh... [36:57.540 --> 36:57.760] uh... [36:57.760 --> 36:59.320] you know, people that can have a... [36:59.320 --> 36:59.520] uh... [36:59.520 --> 36:59.660] uh... [36:59.660 --> 37:00.640] important role... [37:00.640 --> 37:00.860] in... [37:01.880 --> 37:02.380] uh... [37:03.080 --> 37:03.580] uh... [37:03.580 --> 37:04.900] various types of defense... [37:04.900 --> 37:05.860] various types of offense... [37:05.860 --> 37:06.520] not just... [37:06.520 --> 37:07.200] uh... [37:07.200 --> 37:08.580] not just terrorism... [37:08.580 --> 37:09.120] oriented... [37:10.000 --> 37:10.500] um... [37:10.500 --> 37:12.180] and I'll give a couple of examples of that... [37:12.180 --> 37:12.780] as I said... [37:12.780 --> 37:15.460] from... from the actual recruiting materials that are used by... [37:15.460 --> 37:16.260] by the... [37:16.260 --> 37:17.750] uh... army and so forth... [37:18.280 --> 37:18.600] uh... [37:18.600 --> 37:21.060] the computer is a tool for social and political change... [37:21.060 --> 37:21.960] not the same as... [37:21.960 --> 37:22.380] uh... [37:22.380 --> 37:23.660] necessarily saying it's a weapon... [37:24.520 --> 37:25.020] and... [37:26.640 --> 37:27.140] um... [37:27.140 --> 37:27.740] uh... [37:27.740 --> 37:37.920] We talked a little bit, a couple of years back, when I talked about the ethics of computing, is fewer sheeple, right? [37:38.280 --> 37:43.660] More people that are willing to think for themselves, fewer people who are willing to not think for themselves. [37:43.900 --> 37:58.720] For the most part, the hackers are the folks that think for themselves, that think out of the box, and I was pleasantly surprised to see the desire in places like, as I said, Army Intelligence Agency, places like that, to get such people, right? [37:58.900 --> 37:59.560] And an openness. [37:59.740 --> 38:02.960] And it's going to be a big change if something like National Security College were to happen. [38:05.020 --> 38:15.660] If you change the, let's say you get a, maybe not a seven or eight year old, let's say you got a preteen, going through something like a boot camp, going through something like an indoctrination, right? [38:15.780 --> 38:20.900] So they're going to be an effective, essentially an effective warrior, you know, fit well into the chain of command. [38:21.100 --> 38:26.840] Well, they might have gone in because they had great aptitude for all these think out of the box type of things, but what are you doing? [38:26.960 --> 38:28.580] You know, you're putting them in in a mold. [38:28.800 --> 38:30.420] So that's not going to work, right? [38:30.620 --> 38:35.640] Or at least it might work for some purposes, you know, like I said, it's all possible outcomes. [38:35.900 --> 38:42.720] But that would be something that would at least partially squash what you were looking for in the first place. [38:44.560 --> 38:46.960] Okay, and I heard a few other things, different talks. [38:47.140 --> 38:50.520] We heard a couple good ones tonight about getting out there, being active. [38:51.020 --> 38:53.400] And that's one thing that I encourage. [38:54.000 --> 39:00.400] I'm not quite sure what hacktivism is, but you know, again, different definitions. [39:00.740 --> 39:03.000] But it's basically getting off of your butt, right? [39:03.280 --> 39:05.100] And I encourage that always. [39:05.680 --> 39:07.480] Okay, one more slide. [39:07.620 --> 39:09.380] Go ahead and comment or ask a question. [39:09.920 --> 39:10.880] Yeah, it's okay. [39:10.960 --> 39:11.300] Keep talking. [39:11.400 --> 39:11.720] They'll turn it up. [39:11.740 --> 39:17.400] Yeah, we already have national security colleges, excluding the regular military academies. [39:17.540 --> 39:25.940] There's also American Military University, which is already doing the national security studies, and they already have hacking and stuff. [39:26.140 --> 39:30.060] And Robert Still should have known known that because this book is used as a textbook. [39:30.660 --> 39:30.780] Oh, yeah. [39:30.860 --> 39:34.200] The second thing is Israel trains hackers. [39:34.600 --> 39:36.840] And I do believe that Cuba did at one time. [39:36.960 --> 39:37.940] I don't know if they still do. [39:38.200 --> 39:38.320] Yeah. [39:38.460 --> 39:43.920] Do you think how do you know if that was the military that was doing the training or in Israel? [39:45.460 --> 39:47.560] Oh, I don't know. [39:47.640 --> 39:49.860] And I assume that in England, they're trained at Cambridge. [39:50.220 --> 39:50.460] Yeah. [39:51.520 --> 39:51.920] Yeah. [39:52.160 --> 39:53.820] So and from my point of view, [39:57.100 --> 40:03.060] it's almost like the saying about the safe sex or something, you know, do you want your kid to learn this stuff on the street? [40:03.760 --> 40:04.000] Right? [40:04.100 --> 40:07.560] Do you want to learn everything you know about drugs from your friends when you're out doing drugs? [40:07.720 --> 40:17.460] Or do you want to get something, you know, that can be a little more intentionally presented? [40:18.080 --> 40:18.400] Right? [40:18.580 --> 40:19.960] And I think that's part of the same thing. [40:19.960 --> 40:33.060] You know, you say, all right, do you want to be learning about breaking into systems without being given a pretty good opportunity through dialogue and reflection and so forth to give reflection to the meanings of those actions? [40:33.080 --> 40:43.960] So when you go out and do it, then you're doing whatever it is that you do, whatever it is, you know, everything from port scanning to whatever extreme you can think of, you're doing it in a thoughtful manner. [40:45.100 --> 40:45.500] Yeah. [40:45.700 --> 40:45.700] Yeah. [40:45.700 --> 40:48.720] So, yeah, there are definitely intelligence colleges. [40:49.480 --> 40:51.960] There's several, you know, where they're going to have different classes. [40:52.180 --> 41:08.200] And there's actually some training stuff in the couple of job ads I'll show you in a minute where they say, you know, you do like 11 weeks of intense training in, yeah, 11 weeks in this topic, you know, whatever, cryptography or something. [41:09.980 --> 41:10.340] Okay. [41:10.560 --> 41:13.620] So, as always, question your assumptions about what terrorism is. [41:14.720 --> 41:16.500] Confirm your understanding of what hacking is. [41:16.620 --> 41:29.120] I know not all of you have heard me talk about this before, so you might want to just go and if you want to follow up and link to my page and see the, or email or whatever, and see the sort of more expanded notions there. [41:29.120 --> 41:38.220] But confirm your understanding of what the actual, or what you hope are the actual ethics of hacking. [41:39.040 --> 41:45.200] And take a look at the, I suggested this word substitution game, right? [41:45.360 --> 41:49.480] And these are just sort of common things that you hear about in media criticism. [41:49.480 --> 41:53.900] So, what's the difference between a freedom fighter and a guerrilla, right? [41:54.160 --> 41:56.100] Well, you know, essentially nothing. [41:56.280 --> 42:03.260] It's just a label that's used to apply to, you know, one group or another group whether you want to give a positive impression or a negative impression. [42:03.360 --> 42:05.540] The actions aren't going to be all that different. [42:07.260 --> 42:12.660] You know, terrorists versus separatists, or terrorists versus what have you, you know, someone that's trying to escape. [42:12.880 --> 42:23.100] So, were the American revolutionaries, you know, in the 1700s, were these terrorists that were revolting against, you know, the proper and righteous government. [42:23.380 --> 42:25.440] So, labels are important. [42:28.000 --> 42:32.520] And again, because I believe that most of what we're talking about is good, most of the activity is good. [42:32.520 --> 42:39.060] I believe that the...essentially, the more hacking, the better. [42:39.440 --> 42:41.340] That's, I think, the conclusion there. [42:42.260 --> 42:48.760] Let me...we have a comment, and you'll talk, and while you're talking, I'm going to navigate to the couple of web pages that I'm going to show. [42:49.000 --> 42:49.240] Go ahead. [42:51.240 --> 42:52.340] Yeah, it's okay, keep talking. [42:53.000 --> 42:53.360] Yeah. [42:54.120 --> 43:07.760] Do you believe that the current security classification and regulations exclude a majority of people that may be interested in computer security and hacking because they're so stringent? [43:07.760 --> 43:28.160] And the nature of hacking and computer security lends some people at an early age to maybe get in trouble with law enforcement or exploit systems at an early age that may restrict them later on in life or being excluded from things like helping natural security or home and defense or any of these things? [43:29.840 --> 43:30.780] What sort of regulations? [43:31.000 --> 43:33.160] You're asking, you know, essentially, if regulations... [43:34.060 --> 43:34.280] Secure clearances. [43:34.460 --> 43:40.100] I mean, if you have a, you know, say a DUI or you were arrested for a minor offense at an early age... [43:40.100 --> 43:40.820] Oh, for clearances. [43:41.020 --> 43:41.240] I'm sorry. [43:41.280 --> 43:48.000] That may, you know, exclude you from participating in some sort of program or being an asset to... [43:48.000 --> 43:51.080] So whether early trouble will haunt you later sort of inappropriately. [43:51.260 --> 43:52.060] Yeah, it certainly does. [43:55.240 --> 43:56.080] That certainly happens. [43:56.220 --> 43:58.780] I mean, your bankruptcies stay with you for 10 or 12 years or whatever it is. [43:58.860 --> 44:00.440] I mean, mistakes have a way of coming back. [44:02.800 --> 44:06.980] And records tend to not be forgotten, even though they should have been. [44:08.140 --> 44:13.420] Yeah, so, but the security clearance process, and it sounds like you're familiar, not everyone's necessarily familiar. [44:13.540 --> 44:16.100] I had to go through a little bit of this from my current job. [44:17.820 --> 44:20.180] It's pretty darn thorough at the higher levels. [44:20.380 --> 44:22.080] You know, you're talking about a full background check. [44:22.260 --> 44:22.840] You know, there's different... [44:22.840 --> 44:28.100] Unfortunately, I think unfortunately, maybe not, but the different agencies have different classifications, stuff like that. [44:28.560 --> 44:34.000] We were interviewing for a job I had where I work for a position. [44:34.140 --> 44:39.420] We had people from the Sandia labs in the X Division, right? [44:39.460 --> 44:44.840] These are people with what's called acute clearance doing nuclear weapons research, okay, for the Department of Energy. [44:45.460 --> 44:54.200] I have a feeling that maybe a DUI at some level might have been okay, but I have a feeling that a prior conviction might have been a problem. [44:54.560 --> 44:59.340] Getting into trouble after you have a clearance is probably a little bit safer within reason. [44:59.500 --> 45:11.200] Getting into trouble earlier, even at a younger age, is, you know, as you go higher and higher, it's more likely in the clearance system, you're more likely that it's going to come back and haunt you. [45:11.620 --> 45:11.940] Yeah. [45:12.380 --> 45:13.120] So, what's that? [45:13.420 --> 45:14.200] Didn't stop Bush. [45:14.380 --> 45:14.880] No, right. [45:15.040 --> 45:18.500] Yeah, it didn't stop Bush and it didn't stop Poindexter and all, you know, I mean, there's... [45:18.500 --> 45:19.820] And what's his name? [45:20.660 --> 45:20.980] The... [45:20.980 --> 45:22.600] Who's the radio guy? [45:22.760 --> 45:22.900] G. Gordon Liddy. [45:23.620 --> 45:23.940] Right? [45:24.000 --> 45:26.440] He's doing pretty well with seven felonies or something like that. [45:26.600 --> 45:27.060] I don't know. [45:27.080 --> 45:30.240] I don't know if he can get an X Division clearance or not. [45:30.400 --> 45:32.300] But yeah, so this is a problem because... [45:32.300 --> 45:40.600] I mean, the implicit question there, I think, or sort of the direction is, you know, some people are getting trouble breaking the rules at an early age. [45:40.740 --> 45:41.860] Maybe some people are getting caught. [45:42.060 --> 45:44.560] Some people are getting inappropriately punished. [45:44.860 --> 45:49.620] Some people are getting let off the hook because they're, you know, whatever, their dad had money, that type of thing, right? [45:49.780 --> 45:50.680] Maybe we're missing out. [45:50.840 --> 45:52.780] And I think the whole message here is maybe... [45:52.780 --> 45:53.160] Or part of... [45:53.160 --> 46:01.380] I shouldn't say the whole message, but I mean, definitely part of the message is, yeah, we're missing out because hackers can or could be an actual asset. [46:02.240 --> 46:02.300] Yeah. [46:06.770 --> 46:08.230] Why do I not see... [46:18.320 --> 46:19.580] Let's see if that does a trick. [46:20.200 --> 46:21.380] So, no, go away. [46:21.560 --> 46:23.720] I actually hate Safari, but whatever. [46:25.120 --> 46:26.380] So, you go to... [46:26.380 --> 46:27.720] I think this is GoArmy.com. [46:29.700 --> 46:30.560] Almost out of time. [46:30.740 --> 46:31.900] You go to GoArmy.com. [46:32.820 --> 46:33.620] Very inspirational. [46:33.740 --> 46:35.060] Has anyone been there recently? [46:35.060 --> 46:36.560] You see the ads, right? [46:40.740 --> 46:41.340] Advertising a lot. [46:41.440 --> 46:43.220] They make it look like a lot of fun in some ways. [46:44.640 --> 46:45.000] Anyway... [46:45.000 --> 46:46.880] Actually, I have a very brief, funny story. [46:47.120 --> 46:48.180] A friend of mine that works in the military. [46:48.300 --> 46:51.220] We have a big base in Fairbanks where I live and work. [46:54.600 --> 46:56.680] He was teaching some new recruits. [46:56.800 --> 46:58.500] He's a career, you know, captain or something. [46:58.660 --> 47:00.360] Career army guy. [47:01.440 --> 47:04.340] And was talking, giving a talk to some new recruits. [47:04.340 --> 47:06.120] And he said, why did you join the army? [47:06.280 --> 47:07.200] Tell me why you joined the army. [47:07.440 --> 47:09.140] Went around the room and everyone said... [47:09.540 --> 47:11.440] Essentially, everyone said they got money for college. [47:12.380 --> 47:12.740] Right? [47:14.020 --> 47:14.600] Which is... [47:14.600 --> 47:17.100] It's pretty prominent on these pages as a reason to join. [47:17.820 --> 47:20.440] And the guy, of course, he's closer to my age. [47:20.540 --> 47:23.640] So, you know, maybe 15 or 20 years older than some of the people he's talking to. [47:23.640 --> 47:27.000] And he said, well, I joined it to defend my country. [47:28.660 --> 47:29.260] I don't know. [47:29.840 --> 47:33.640] So, look, this is what happens when you do a keyword search for hacker. [47:34.940 --> 47:39.760] One of the things that comes up is electronic intelligence interception analyst. [47:40.780 --> 47:41.620] Another one. [47:48.490 --> 47:52.770] This is actually, I think, the list of results with the word hacker. [47:53.190 --> 47:54.450] Of course, hacker is not... [47:54.450 --> 47:55.370] We're not looking for hackers. [47:55.650 --> 47:56.770] It's defending against hackers. [47:57.010 --> 48:00.630] But as we know, this skill set is often pretty similar. [48:01.170 --> 48:02.710] Information system operator analyst. [48:02.850 --> 48:04.310] Telecommunications operator maintainer. [48:04.310 --> 48:05.990] So, basically, systems types of guys. [48:06.750 --> 48:07.770] Field artillery. [48:08.850 --> 48:10.870] Automated tactical data system specialist. [48:12.670 --> 48:14.030] Counterintelligence agent. [48:14.670 --> 48:16.590] Electronic intelligence interceptor analyst. [48:17.210 --> 48:18.990] Human intelligence collector. [48:19.570 --> 48:22.170] Human intelligence analyst, IA. [48:23.150 --> 48:25.150] Psychological operations specialist. [48:25.370 --> 48:25.810] Psych ops. [48:26.010 --> 48:26.850] Psy ops, rather. [48:28.270 --> 48:30.730] These are some pretty heavy jobs, right? [48:30.730 --> 48:40.310] Where they're looking for people that have at least some elements of the skill sets that make hackers hackers. [48:40.950 --> 48:43.030] I have just one more because we're just in the last couple of minutes. [48:43.130 --> 48:44.410] You can find these yourself, of course. [48:45.330 --> 48:50.510] I'm not going to resize this because it's in a live web page that might not resize properly. [48:50.990 --> 48:52.270] National Security Agency. [48:52.470 --> 48:58.090] They don't have quite as full-featured a list of jobs. [48:58.210 --> 49:00.050] They don't list, like, all the classifications, all the jobs. [49:00.050 --> 49:02.050] I guess maybe you're not supposed to know that stuff. [49:02.530 --> 49:10.410] But cryptanalysis, cryptographer, cryptologists, all those things figure pretty prominently. [49:10.850 --> 49:21.390] So, the point here is that there actually are job opportunities that are consistent in many ways with what makes hackers hackers. [49:21.390 --> 49:31.090] I think they're inconsistent, as I said before, about the part that tickles in the fact that maybe the stuff you need to do, clearances, right? [49:31.470 --> 49:38.470] A lot of saluting and uniforms and stuff like that might not be really all that much the sort of thing that your hacker is going to want to do. [49:38.470 --> 49:40.470] So, that's sort of the end of the talk. [49:41.490 --> 49:45.290] We're going to get the next session in here, so I'm not going to stand up here too much longer. [49:45.510 --> 49:48.270] I'll step out of the way if people want to chat a little bit about it. [49:49.230 --> 49:52.750] So, we know that hackers are not criminals. [49:53.130 --> 49:54.670] We know that hackers are not terrorists. [49:56.030 --> 50:11.610] One of my points is that hackers could be and in some ways should be at least more, not all of us of course, but should be more available as a resource, you know, this potential tool. [50:11.750 --> 50:12.690] He's calling people tools. [50:12.890 --> 50:18.730] But, you know, a potential part of the fight for good, the fight for defense, and so forth. [50:20.230 --> 50:20.970] And that's it. [50:21.110 --> 50:22.170] So, thanks for coming out tonight. [50:22.630 --> 50:26.870] Tomorrow's talk is on hacking the terror grid, totally different with pork shop, with much better slides.