[00:03.090 --> 00:03.650]  Awesome!
[00:03.650 --> 00:06.950]  Okay, because I'm a lawyer, I always have to start with the disclaimer.
[00:08.290 --> 00:09.390]  I am an attorney.
[00:09.870 --> 00:10.770]  Not yours.
[00:11.870 --> 00:12.610]  Can't has.
[00:12.850 --> 00:13.430]  Actually, you can.
[00:13.570 --> 00:14.850]  I'm pretty negotiable.
[00:15.370 --> 00:18.010]  This talk is for edutainment purposes only.
[00:19.430 --> 00:21.150]  Contents may settle during delivery.
[00:22.250 --> 00:25.310]  My day job is I'm an information security consultant.
[00:25.890 --> 00:27.270]  I can be yours.
[00:29.030 --> 00:31.050]  Especially if I'm billing this as business development.
[00:31.950 --> 00:36.750]  I am not speaking on behalf of my employer, our clients, any sane individual.
[00:37.230 --> 00:40.830]  It's just the noises in my head that I'm broadcasting to you.
[00:42.090 --> 00:43.930]  So, why is this a problem?
[00:44.150 --> 00:52.410]  We're entrusting more and more of our lives, our data, the stuff about us, to systems clearly just outside of our control.
[00:54.190 --> 00:55.110]  Think of it this way.
[00:55.470 --> 01:03.350]  Your healthcare data is held by health insurers, which is held by their vendors and the vendors' vendors and the vendors' vendors' vendors' vendors.
[01:03.650 --> 01:05.830]  And it's all out there.
[01:06.110 --> 01:09.330]  And you don't have any, you know, you can't get your grubbies on it.
[01:09.870 --> 01:17.970]  Think of the amount of people, say, not in the East Coast, who've heard about Anthem and went, oh, wow, a health insurer in New York got breached.
[01:17.970 --> 01:21.070]  Except that their data traipsed through it as well.
[01:22.310 --> 01:25.210]  Think of social media sites that hold our data.
[01:25.450 --> 01:29.030]  Think of social media sites that we don't have accounts on that still hold our data.
[01:29.190 --> 01:29.770]  Like Facebook.
[01:29.910 --> 01:32.890]  Facebook knows who I am, even though I don't have a Facebook account.
[01:35.710 --> 01:47.170]  Businesses we've never heard of may hold our, you know, think of all the various cookie-providing sites that are tracking to find out what I'm buying, what I'm looking at, what I'm not looking at.
[01:48.530 --> 01:49.930]  All the new startups.
[01:50.190 --> 01:51.070]  We're X for Y.
[01:51.270 --> 01:52.370]  We're Uber for buttons.
[01:55.910 --> 01:57.250]  You know, IoT.
[01:57.530 --> 02:00.130]  We have stuff in our house that connects to the Internet.
[02:00.150 --> 02:05.510]  And it's smart home products, fitness trackers, smartphones, your creepy neighbor's drone.
[02:08.550 --> 02:16.110]  So there's all these kind of things coming into our sense of privacy, sense of self, yet breaches keep happening, right?
[02:16.450 --> 02:20.410]  I'm leaving this blank because why do I need to put this up there, you know?
[02:20.550 --> 02:24.990]  If I did this, there'll be a new breach before I actually got to present the talk.
[02:24.990 --> 02:26.470]  So just, I'll leave this for you.
[02:26.930 --> 02:30.030]  I used to read breach stories, religiously.
[02:30.350 --> 02:31.930]  Now when I'm, did you hear about that breach?
[02:32.030 --> 02:32.890]  Oh yeah, it was horrible.
[02:33.010 --> 02:33.630]  SQL injection.
[02:34.270 --> 02:37.590]  I can give that answer stock and nine times out of ten I'm right.
[02:38.490 --> 02:44.730]  I'd now just check for client names to whether or not I need to go call and go, hey, guess what?
[02:45.250 --> 02:50.810]  You know, because it's nothing like having to call up a client and talk about, have you heard of Brian Krebs?
[02:50.810 --> 02:54.090]  Well, maybe you should check them out.
[02:54.970 --> 02:57.470]  You know, I check for, also I check for my own name in the breach.
[02:57.590 --> 02:59.070]  Like, did I have an account on that?
[03:00.390 --> 03:02.610]  And wait for the free credit monitoring letter.
[03:04.890 --> 03:07.110]  Is this acceptable or is this unacceptable?
[03:07.910 --> 03:11.430]  Like, on one hand, this is the tombstone mentality.
[03:11.430 --> 03:16.630]  This is a concept from airplane manufacturing that there's really, there are two kinds of problems.
[03:17.230 --> 03:20.450]  Things that can result in deaths and non-problems.
[03:20.890 --> 03:25.230]  If it can't result in a death, that's, that's later.
[03:25.450 --> 03:25.950]  Don't care.
[03:26.210 --> 03:26.630]  Right?
[03:27.190 --> 03:29.450]  Who dies from a social media break?
[03:29.610 --> 03:31.530]  Who dies from a health insurance leak?
[03:32.230 --> 03:34.550]  And you can probably find a case or two.
[03:34.550 --> 03:43.250]  I'm thinking of one that my, my, my friend and old colleague Vlad Gostemeski mentions, which is how certificate pinning can kill people.
[03:43.590 --> 03:58.590]  It's the grinder, the grinder flaw that allowed radicals in Egypt to go and intercept communication from the app to, you know, to, to grinder and going, hey, we can beat up people.
[03:59.490 --> 04:06.930]  But is this really an injury or just a flight delay on our bright future, our bright cloud IoT future?
[04:07.830 --> 04:11.810]  On the other hand, this is not the new frontier anymore.
[04:12.070 --> 04:14.970]  We've been making computers for 50 years or more.
[04:15.210 --> 04:19.650]  We've been using computers as consumer devices for 30 years.
[04:19.970 --> 04:22.390]  We've had the Internet for the longest time.
[04:22.630 --> 04:25.490]  Like, we should, we should have some of this stuff nailed down.
[04:26.490 --> 04:28.830]  This isn't like, oh, it's just hobbyists.
[04:29.290 --> 04:34.490]  We're, we work for billion dollar corporations making stuff.
[04:34.530 --> 04:36.330]  We should be able to do this better.
[04:38.110 --> 04:39.370]  And opt out.
[04:39.770 --> 04:41.250]  You can't opt out anymore.
[04:41.730 --> 04:42.150]  Right?
[04:42.590 --> 04:46.050]  Like, think of, think of the point where you say, I'm not using that.
[04:46.210 --> 04:48.530]  You can't apply for a job without the Internet.
[04:49.550 --> 04:53.710]  Pretty soon you won't be able to apply for a job without Facebook, because otherwise you don't exist.
[04:55.270 --> 04:57.490]  So, I want to use an analogy.
[04:58.650 --> 04:59.430]  Products liability.
[05:00.170 --> 05:03.530]  And products liability is not an exciting class in law school.
[05:03.730 --> 05:04.750]  It is dull.
[05:05.070 --> 05:11.250]  But, this was a problem that, that we as a society dealt with.
[05:11.870 --> 05:20.310]  Prior to this understanding, we had to show that a product was negligently designed in order for you to get recompense for an injury.
[05:20.310 --> 05:22.530]  And there's a problem with this.
[05:24.410 --> 05:33.430]  Product manufacturers are, tend to be a, they tend to be a nexus of expertise and capital.
[05:34.830 --> 05:37.590]  General Motors knows more about cars than you do.
[05:38.270 --> 05:40.050]  General Motors has more capital.
[05:40.270 --> 05:41.370]  They have more experience.
[05:41.790 --> 05:42.170]  Right?
[05:42.390 --> 05:45.210]  They have more engineers than we have in this room.
[05:45.210 --> 05:50.250]  You might think you know something about cars, but there's someone at General Motors that knows far, far more.
[05:50.490 --> 05:54.170]  Their entire career has been doing things like designing wheel bearings.
[05:55.530 --> 05:57.670]  They know everything that can happen.
[05:58.270 --> 05:59.110]  You don't.
[05:59.190 --> 06:04.590]  And the problem is that you can't evaluate the product the way they can.
[06:05.330 --> 06:05.850]  Right?
[06:05.850 --> 06:09.070]  You go and, you know, think of, think of your car buying experience.
[06:09.190 --> 06:10.170]  Those of you who've bought a car.
[06:11.030 --> 06:13.850]  You kind of, you know, squiggle around in the seat for a minute.
[06:14.190 --> 06:15.730]  You play with the radio knobs.
[06:16.670 --> 06:19.730]  If you're a man, you kind of thump the steel and go, yeah, it's solid.
[06:20.290 --> 06:21.810]  How do you justify that?
[06:21.910 --> 06:21.990]  Right?
[06:22.090 --> 06:23.210]  You're thumping the eight builder.
[06:23.350 --> 06:24.090]  Like, yeah, that's solid.
[06:24.170 --> 06:24.730]  That'll hold up.
[06:24.810 --> 06:25.090]  How about?
[06:26.490 --> 06:26.850]  Right?
[06:28.770 --> 06:29.690]  Institutional data as well.
[06:29.690 --> 06:31.690]  Even if you are an automotive engineer.
[06:32.030 --> 06:32.550]  Right?
[06:32.730 --> 06:33.770]  And you go in and you're like, yep.
[06:34.610 --> 06:38.810]  You don't have the institutional data that that shop has, that that company has.
[06:38.950 --> 06:39.070]  Right?
[06:39.190 --> 06:43.630]  That the Siemens versus Hitachi engine control unit.
[06:43.730 --> 06:48.710]  Well, the Siemens run had one in 5,000 had a failure.
[06:49.130 --> 06:50.170]  General Motors knows that.
[06:50.330 --> 06:50.850]  You don't.
[06:51.750 --> 06:58.170]  Like, unless you were an engineer on that project, you do not have the institutional knowledge.
[06:58.170 --> 06:59.450]  Even if you could interpret it.
[06:59.930 --> 07:01.550]  You've got a master's degree in engineering.
[07:02.830 --> 07:05.030]  It's also a problem of asymmetrical power.
[07:05.890 --> 07:07.310]  And I'm talking about power and control.
[07:07.590 --> 07:07.710]  Right?
[07:09.550 --> 07:14.570]  You can't go to the dealership and say, lift up the hood and go, oh, wait a minute.
[07:14.610 --> 07:16.870]  This is a Bosch fuel injection system.
[07:17.110 --> 07:17.590]  Screw that.
[07:17.690 --> 07:18.490]  I want Hitachi.
[07:19.190 --> 07:20.210]  Otherwise, I like the car.
[07:20.370 --> 07:21.130]  I like the color.
[07:21.230 --> 07:21.830]  I like the seat.
[07:21.890 --> 07:22.530]  I like the price.
[07:22.970 --> 07:24.990]  Swap out that electric...
[07:24.990 --> 07:27.510]  Swap out the fuel injection for Hitachi.
[07:27.510 --> 07:31.110]  And the sales guy is going to look at you and go like, yeah.
[07:31.570 --> 07:34.670]  Or actually, back when I sold cars, I'd just go and print up a Hitachi label.
[07:35.150 --> 07:35.510]  Yep.
[07:35.750 --> 07:36.330]  There it is.
[07:36.610 --> 07:37.770]  It's an SS model.
[07:37.990 --> 07:38.750]  Extra hundred bucks.
[07:38.910 --> 07:39.250]  There it is.
[07:40.810 --> 07:42.710]  We have also...
[07:42.710 --> 07:43.290]  Evaluating.
[07:43.430 --> 07:45.250]  How would you evaluate the safety of a car?
[07:46.050 --> 07:51.370]  You know, I mean, I'm thinking, I made this joke once buying the last new car I bought was a Volkswagen Jetta turbo diesel.
[07:52.870 --> 07:53.470]  Ironically that.
[07:54.330 --> 07:56.490]  And I made the joke of, how safe is the car?
[07:56.590 --> 07:57.650]  Can I crash test it?
[07:57.790 --> 08:01.710]  And I'm saying this while I'm driving the car and the sales rep's in the passenger seat.
[08:04.390 --> 08:06.030]  And he was like, yeah, sure.
[08:06.470 --> 08:07.550]  And then I accelerated.
[08:07.670 --> 08:08.330]  He's like, whoa, wait.
[08:08.410 --> 08:08.950]  It was like...
[08:08.950 --> 08:09.710]  So here's the point.
[08:09.810 --> 08:11.650]  Like, can I go, yeah, I would have crash test it.
[08:11.870 --> 08:13.790]  Plowed into a truck and go, yeah, that was pretty good.
[08:13.850 --> 08:14.490]  I'll buy another one.
[08:15.110 --> 08:15.510]  Right?
[08:15.650 --> 08:17.310]  Like, I can't evaluate...
[08:17.910 --> 08:20.590]  It's an inefficient model for evaluating the product.
[08:23.590 --> 08:25.750]  Also, one side has all the power.
[08:25.950 --> 08:30.170]  I can't give a different set of specifications and say, build me that one.
[08:30.650 --> 08:31.130]  Right?
[08:31.270 --> 08:36.850]  Like, I may have been able to get an option for, like, I get different carpeting.
[08:37.050 --> 08:38.790]  Something really, really minor.
[08:39.130 --> 08:41.570]  So, it's not a negotiation.
[08:41.750 --> 08:43.370]  The only thing we're negotiating on is price.
[08:43.370 --> 08:46.230]  I can have no other decision in this place.
[08:48.270 --> 08:50.050]  So, we recognize this.
[08:50.110 --> 08:53.950]  We recognize this imbalance between consumer and producer.
[08:54.410 --> 09:07.290]  And we've recognized that because so much of the power and so much of the information about how to make the product safe or not is in the hands of the producer, it isn't my responsibility as the consumer.
[09:07.290 --> 09:16.690]  It is we put the burden back on the manufacturer and say, if you're going to sell this product as this product, you are more liable than Alex is.
[09:16.890 --> 09:21.310]  Because Alex can't be left to his own devices, let alone determine the safety of a car.
[09:21.310 --> 09:28.890]  So, we permit a diversity of product, but we have an incentive for safe design.
[09:29.070 --> 09:30.870]  We use products liability for this.
[09:32.250 --> 09:34.190]  We have a diversity of enforcement, though.
[09:34.290 --> 09:35.530]  There's not one model.
[09:35.690 --> 09:38.130]  There are three I'm going to talk about in this talk.
[09:39.590 --> 09:42.290]  So, quick overview of products liability.
[09:42.610 --> 09:43.950]  The products liability trio.
[09:44.290 --> 09:45.410]  We have regulators.
[09:46.350 --> 09:50.910]  NHTSA, DOT, National Highway Safety Administration, Department of Transportation.
[09:51.970 --> 10:00.570]  These are bureaucrats who decide they can fine players in the market.
[10:00.570 --> 10:04.510]  They can forcibly withdraw products from sale.
[10:05.810 --> 10:07.330]  That's sort of their big hammer.
[10:07.490 --> 10:09.130]  They can say, you have to leave the market.
[10:10.670 --> 10:12.250]  The problem is they're constrained.
[10:12.750 --> 10:14.450]  They do not have infinite power.
[10:14.590 --> 10:19.930]  They have political and legal constraints on them that do not make them absolute.
[10:22.050 --> 10:24.590]  However, we have a second kind of regulator.
[10:25.410 --> 10:26.270]  Tort law.
[10:27.230 --> 10:33.130]  Which says that even though the product is allowed for sale, the regulators have cleared it.
[10:33.790 --> 10:40.530]  If it is unsafe, if the product is unsafe, you can be sued.
[10:40.890 --> 10:44.890]  The producer can be sued for entering it into the marketplace.
[10:46.310 --> 10:51.910]  And therefore, they are liable for the injuries I suffer because of their unsafe design.
[10:52.350 --> 10:57.650]  And that's two law school classes combined into, you know, 30 seconds.
[10:57.810 --> 11:00.330]  So, I may have skimmed over some stuff.
[11:01.290 --> 11:04.730]  But it essentially says that I don't care what the regulator said.
[11:04.730 --> 11:09.230]  We can still decide that in this case, this product was unsafe.
[11:09.230 --> 11:12.270]  And therefore, injuries caused by it are on the producer.
[11:13.510 --> 11:15.630]  There's a profit motive here.
[11:16.790 --> 11:20.070]  We need clear cases with significant compensable injuries.
[11:20.510 --> 11:34.350]  So, the fact that my product is merely mediocre are, you know, the car doesn't start, may not be a product's, may not raise to the point of an interest to a product's liability attorney.
[11:34.590 --> 11:35.350]  We need death.
[11:35.510 --> 11:38.390]  We need horrible injuries because that's where the money is.
[11:39.170 --> 11:40.690]  Please don't retweet that.
[11:43.460 --> 11:45.780]  And then we have a third regulator.
[11:46.020 --> 11:50.660]  I'm gonna call, I'm gonna sum this up and lump this into the enthusiastic third parties model.
[11:51.120 --> 11:51.560]  Because...
[11:51.560 --> 11:51.920]  Next planet!
[11:52.480 --> 11:52.800]  Yep.
[11:55.180 --> 11:55.700]  Um...
[11:55.700 --> 12:00.820]  Enthusiastic third parties are other, other players that don't have regulatory power.
[12:01.360 --> 12:05.180]  And they don't, they can't sue or they're not going to sue the manufacturer.
[12:05.180 --> 12:07.620]  But they have influence on the marketplace.
[12:08.360 --> 12:12.120]  They can engage their own experts and reduce costs of testing.
[12:12.780 --> 12:15.200]  I can't crash test that VW Jetta.
[12:15.820 --> 12:19.160]  But the Institute for Highway Safety can get one.
[12:19.160 --> 12:25.040]  Because what they're doing is, they're running it into a wall and they're sharing that information with millions of potential consumers.
[12:25.040 --> 12:28.820]  I'm not gonna pay the $25,000 to wreck a car to test it.
[12:28.960 --> 12:35.140]  But one car wrecked to benefit a million people makes the cost fairly small.
[12:36.320 --> 12:39.340]  But they have their own profit and cost issues as well.
[12:40.060 --> 12:43.440]  So, let's first talk about legislation and regulation.
[12:44.100 --> 12:44.720]  Legislation.
[12:45.420 --> 12:47.780]  This is passed by elected officials.
[12:48.160 --> 12:48.240]  Right?
[12:48.440 --> 12:49.860]  Congress passes laws.
[12:50.640 --> 12:51.620]  They are...
[12:52.320 --> 12:54.180]  Congress tends to be generalists.
[12:55.260 --> 12:57.480]  They may listen to expert opinions.
[12:57.800 --> 12:58.620]  And they may...
[12:59.380 --> 13:02.440]  But the problem is, expert opinions are special interests.
[13:02.640 --> 13:06.080]  When you hear politicians saying, we're gonna get the special interests out of Washington.
[13:06.080 --> 13:13.040]  When we go to go whine at Congress to say, don't break crypto, we're the special interest that week.
[13:14.620 --> 13:16.360]  So, it's high-level policy.
[13:16.680 --> 13:21.940]  If you're thinking in like the ISO policy kit thing, this is the policy.
[13:22.680 --> 13:25.940]  Sweeping general statements about what we want to have happen.
[13:26.180 --> 13:31.220]  And I have an aside here, because I saw this license plate and it made me think, I need to come up with a new term.
[13:31.220 --> 13:34.920]  Like, remember we have like ninja programmers and 10x programmers.
[13:35.780 --> 13:37.220]  Full-stack developers.
[13:37.680 --> 13:40.080]  I want to see a full-stack recruiter.
[13:40.220 --> 13:43.900]  But I've thought for policy work, I want to introduce the ISO Yeti.
[13:46.930 --> 13:51.110]  So, if you're an expert in writing policy, like, I'm an ISO Yeti.
[13:51.230 --> 13:52.210]  I'm a professional.
[13:52.710 --> 13:55.310]  So, broader, longer-term statements.
[13:55.730 --> 13:57.430]  Leaving the detail for others.
[13:58.630 --> 13:59.190]  Regulation.
[13:59.770 --> 14:00.270]  Regulation.
[14:00.510 --> 14:02.630]  This is promulgated by appointed officials.
[14:02.890 --> 14:03.390]  Regulators.
[14:03.550 --> 14:04.450]  They are bureaucrats.
[14:04.570 --> 14:05.370]  They are not elected.
[14:05.570 --> 14:06.470]  They are selected.
[14:07.550 --> 14:08.750]  They are experts.
[14:10.290 --> 14:13.950]  Outsiders are given opportunity to comment on potential regulation.
[14:15.510 --> 14:18.010]  And it has to be within the bounds of that regulation.
[14:19.290 --> 14:20.290]  It's mid-level.
[14:20.410 --> 14:22.890]  This would be the standards in an ISO model, right?
[14:23.890 --> 14:25.690]  These change more rapidly.
[14:25.930 --> 14:31.190]  Because as we learn things, we recognize things like, hey, that old standard was insufficient.
[14:31.830 --> 14:37.650]  For example, think of like, for encryption, I would come up with an encryption policy is important data should be encrypted.
[14:38.130 --> 14:38.370]  Okay.
[14:38.790 --> 14:42.270]  And then, if you had an old standard, maybe like MD5 is sufficient.
[14:42.790 --> 14:45.310]  And, you know, then 1989 happened and it wasn't.
[14:47.210 --> 14:52.310]  So, more detailed, shorter term, you can swap these in and out as you learn things.
[14:52.430 --> 14:55.070]  And you kind of wind up more about standards than you do policy.
[14:56.570 --> 14:58.090]  So, issues for regulators.
[14:58.270 --> 15:05.390]  How regulators can see the world, how they can affect product safety, and how they are also limited by what they can do.
[15:06.170 --> 15:07.670]  They have political concerns.
[15:08.390 --> 15:10.930]  All animals are equal, but some have your boss's ear.
[15:11.650 --> 15:17.650]  If I want to go, I'm a national highway safety regulator, and I want to say, well, these cars are unsafe.
[15:18.150 --> 15:20.830]  Odds are, that company knows who my boss is.
[15:21.350 --> 15:25.510]  And a high-powered lobbyist calls up my boss and goes, Alex...
[15:26.090 --> 15:28.230]  Alex is being, you know, being a little whiny.
[15:28.510 --> 15:29.810]  Why don't you settle him down?
[15:30.950 --> 15:31.390]  Right?
[15:32.510 --> 15:33.790]  Public relations issues.
[15:34.590 --> 15:41.250]  If you're stuck in the details, the nitty-gritty, the engineering, the hard, kind of mathy stuff, it's hard to pitch.
[15:41.530 --> 15:44.970]  Versus, them regulators want to take away your stuff.
[15:45.310 --> 15:46.150]  Easy sell.
[15:46.550 --> 15:51.250]  You know, we at Manufacture just want to make a good product for good, hard-working Americans.
[15:51.510 --> 15:54.950]  But this pencil-neck geek over here wants to take that away from you.
[15:55.610 --> 15:56.330]  Easy sell.
[15:57.550 --> 15:59.230]  Regulators have economic issues.
[16:00.090 --> 16:01.010]  Regulatory capture.
[16:01.010 --> 16:07.150]  The idea that the actual regulated industry has more power than the regulator.
[16:07.570 --> 16:10.190]  Primarily, revolving door.
[16:10.490 --> 16:13.210]  You are a banking regulator.
[16:13.470 --> 16:15.160]  You have bills.
[16:15.830 --> 16:17.190]  You're a smart person.
[16:17.490 --> 16:20.810]  You have the ins and outs of, say, GLBA.
[16:21.670 --> 16:31.510]  You can leave your job at a financial regulator and work for a consulting firm or an investment house and quadruple your income.
[16:31.830 --> 16:34.030]  It's really hard to keep them at the farm then.
[16:34.890 --> 16:44.150]  And it's really hard when you realize that everyone in the room, when you're talking about a regulatory issue, is an ex-regulator or a current regulator.
[16:44.150 --> 16:45.570]  Everyone knows the language.
[16:46.930 --> 16:49.390]  So, that's the issues regulators have.
[16:49.490 --> 16:52.930]  They have some power, but they're constrained by politics.
[16:52.930 --> 16:54.410]  They're constrained by economics.
[16:54.750 --> 16:57.450]  They don't have infinite resources to do these things.
[16:58.170 --> 17:00.430]  So, next step, the tort liability.
[17:01.810 --> 17:04.050]  For products liability, there are three main.
[17:04.050 --> 17:06.290]  And really, for IoT and cloud, there's really two.
[17:06.790 --> 17:12.290]  Design defect, which is the product itself is unreasonably dangerous design.
[17:12.430 --> 17:16.890]  The design itself is so flawed that it causes injury in some case.
[17:18.470 --> 17:23.150]  Now, the understanding is it has to fail to meet an ordinary customer expectation.
[17:23.350 --> 17:27.170]  So, it can be reasonably unsafe.
[17:27.170 --> 17:33.990]  For example, firearms, motorcycles, and whiskey all can have side effects.
[17:34.390 --> 17:35.010]  Right?
[17:35.130 --> 17:36.290]  They can all injure you.
[17:37.010 --> 17:42.370]  Some of you, you know, the whiskey, you are personally experiencing that injury.
[17:42.610 --> 17:43.070]  Right?
[17:43.310 --> 17:47.250]  But you, as an ordinary consumer of these products, recognize.
[17:47.910 --> 17:49.070]  Motorcycles can wreck.
[17:49.310 --> 17:50.570]  Guns can go off.
[17:51.250 --> 17:53.990]  Whiskey does not make you smarter or better looking.
[17:59.700 --> 18:01.280]  I'm not even going to respond to that.
[18:05.860 --> 18:07.520]  Well, I have no whiskey with me now.
[18:12.840 --> 18:14.620]  Even if the regulators are okay with it.
[18:14.780 --> 18:15.300]  Back to that.
[18:15.460 --> 18:17.700]  Like, we've entered a product into the marketplace.
[18:17.840 --> 18:19.400]  The regulator is like, yeah, that's good enough.
[18:19.400 --> 18:20.580]  That meets all of our standards.
[18:20.780 --> 18:27.720]  A court can still say, even so, in this case, so they can kind of force the standard up a little tick.
[18:28.960 --> 18:32.400]  Inherently dangerous products may not be unreasonably dangerous.
[18:33.320 --> 18:40.240]  So, back to the motorcycles are, many of the cases I've read are things like prosumer level power tools.
[18:40.480 --> 18:42.180]  The tools like a jackhammer.
[18:43.140 --> 18:48.060]  I imagine if I don't know how to use that, I will injure everything within about 20 feet of me.
[18:48.520 --> 18:48.820]  Right?
[18:48.820 --> 18:54.440]  But, a competent consumer of that device can use it safely.
[18:54.840 --> 18:57.660]  So, it's unfair to say it's unreasonably dangerous.
[18:57.860 --> 18:59.720]  It is merely inherently dangerous.
[19:01.740 --> 19:02.640]  Manufacturing defect.
[19:02.860 --> 19:04.400]  This is, the design's okay.
[19:04.740 --> 19:06.560]  But this run had some issue.
[19:06.760 --> 19:09.400]  A component of it was manufactured incorrectly.
[19:09.780 --> 19:12.300]  Or, something is wrong with that one.
[19:12.300 --> 19:16.080]  It was damaged somewhere before it got to you.
[19:16.380 --> 19:17.720]  By, at the manufacturer.
[19:18.140 --> 19:18.240]  Right?
[19:18.400 --> 19:19.780]  So, it's, that one is flawed.
[19:21.300 --> 19:23.280]  In IoT, I'm not as concerned about that.
[19:23.340 --> 19:26.060]  Because our concerns are, you made a crappy product.
[19:26.180 --> 19:30.640]  You made a product that had fundamental security flaws in its design.
[19:31.280 --> 19:34.180]  It's not like, oh, that chip was good, but that chip was crap.
[19:34.360 --> 19:36.160]  Instead, it's like, at the start, it was crap.
[19:36.160 --> 19:39.300]  And the third one is a failure to warn.
[19:39.500 --> 19:45.240]  Which is, it is, the product itself has a non-obvious danger.
[19:45.720 --> 19:50.560]  If you had known, if we had told you, oh, by the way, whiskey causes hangovers.
[19:52.880 --> 19:55.980]  Or, that motorcycle has 190 horsepower.
[19:56.460 --> 20:01.160]  If you do that with it, you will maybe die or maybe be awesome.
[20:05.070 --> 20:07.830]  So, tort limitations, it's profit driven.
[20:08.770 --> 20:10.410]  You need a compensable injury.
[20:10.630 --> 20:19.570]  You need to be able to show that because the product was, was, was, was unreasonably dangerous, you were injured by it.
[20:20.490 --> 20:28.310]  We need to prove that the causation of your injury was, it's because of the, of that, of that design defect.
[20:28.690 --> 20:30.590]  And we need to solve and defend it.
[20:31.750 --> 20:33.770]  Because you can't get blood from a stone.
[20:37.280 --> 20:41.980]  The problem, the biggest problem though, with the tort model, is its long feedback cycle.
[20:42.080 --> 20:43.480]  And I'm going to give an extreme example.
[20:44.200 --> 20:44.680]  Asbestos.
[20:44.980 --> 20:47.240]  How many people know asbestos is bad for you?
[20:47.860 --> 20:48.340]  Okay.
[20:49.140 --> 20:52.000]  How long have we known that asbestos was bad for us?
[20:53.500 --> 20:56.080]  Identified as hazardous in the 1890s.
[20:56.760 --> 20:58.760]  Yet, we continued using it.
[20:59.600 --> 21:00.600]  The first U.S. lawsuit about asbestos.
[21:02.160 --> 21:05.900]  Asbestos exposure to people working in asbestos manufacturing plants.
[21:05.980 --> 21:10.680]  Plants using asbestos as an industrial material to put into household products.
[21:11.440 --> 21:12.000]  1929.
[21:12.520 --> 21:14.080]  And they found no liability.
[21:14.420 --> 21:15.620]  And they kept making it.
[21:17.260 --> 21:20.120]  The first U.S. regulation on point was 1970, Clean Air Act.
[21:21.180 --> 21:23.620]  We didn't ban asbestos in 1970.
[21:24.480 --> 21:28.740]  There's still ongoing regulation and use of asbestos.
[21:30.340 --> 21:31.760]  Watch late night television.
[21:32.020 --> 21:33.200]  Do you have mesothelioma?
[21:33.560 --> 21:34.700]  Call this number.
[21:35.600 --> 21:40.040]  And most of that litigation comes out of the third circuit in the United States and Philadelphia.
[21:40.040 --> 21:43.380]  And it's a business model, right?
[21:43.700 --> 21:51.600]  If you have a mesothelioma case, it's worth a certain amount of money to the point where I believe mesothelioma is the most valuable Google ad word.
[21:51.860 --> 21:53.660]  I believe it's something like $72.
[21:55.120 --> 21:55.520]  Yeah.
[21:56.400 --> 22:03.540]  Because if you sign up for a mesothelioma case, all the lawyer really has to do is file some paperwork and you get money out of the fund.
[22:03.620 --> 22:05.920]  As long as you can prove that you have mesothelioma.
[22:05.920 --> 22:13.360]  Because why it's important is that it's the kind of cancer that only happens or generally only happens because of you have been exposed to asbestos.
[22:13.640 --> 22:15.100]  So it's why it's valid.
[22:15.240 --> 22:16.280]  It's a slammed up case.
[22:17.980 --> 22:24.800]  So the problem with this is how do you tell a manufacturer to not make asbestos?
[22:24.880 --> 22:26.420]  How do you give them an incentive?
[22:26.620 --> 22:27.860]  This didn't work, right?
[22:27.960 --> 22:30.440]  Because they still made stuff out of asbestos for years.
[22:30.600 --> 22:33.580]  So it doesn't force the unsafe products from the market.
[22:33.580 --> 22:34.680]  It doesn't stop.
[22:34.940 --> 22:39.080]  It doesn't make the manufacturers change their designs.
[22:39.440 --> 22:42.700]  All it did was it punished them when they were already down, right?
[22:42.840 --> 22:45.160]  There are no manufacturers of asbestos anymore.
[22:45.520 --> 22:48.600]  At least the original ones that happened in the 50s and 60s.
[22:48.680 --> 22:49.340]  They're gone.
[22:49.480 --> 22:50.040]  They all follow back.
[22:50.220 --> 22:51.760]  There's a fund of money.
[22:52.360 --> 22:54.820]  So it wasn't a good feedback loop.
[22:54.820 --> 22:56.260]  It does benefit attorneys.
[22:56.720 --> 23:00.780]  And it kind of benefits the people who died unless their families get some money.
[23:00.920 --> 23:06.140]  But as a how do we have a feedback loop that says don't do the bad thing?
[23:06.280 --> 23:07.180]  It doesn't work.
[23:08.280 --> 23:09.560]  So third party.
[23:10.340 --> 23:11.580]  Enthusiastic third parties.
[23:12.520 --> 23:14.160]  Specialty journalists, right?
[23:14.980 --> 23:17.040]  The best example I have is consumer reports.
[23:17.140 --> 23:22.600]  Consumer reports can do a more in-depth look at a product than you would do and then publish about it, right?
[23:22.600 --> 23:24.000]  They can talk about the safety of the car.
[23:24.080 --> 23:25.080]  They can talk about how it handles.
[23:25.200 --> 23:27.180]  They can talk about the seats and whatnot.
[23:27.620 --> 23:34.460]  Because they can spend more time and it's worth of them because they can then turn around and sell the magazine that says this is a good thing or a bad thing.
[23:37.320 --> 23:39.820]  And I'm also going to give examples of journalists in our space.
[23:40.260 --> 23:44.440]  Steve Reagan of the Salted Hash blog and Brian Krebs.
[23:44.440 --> 23:51.720]  They can go and kind of detail this through and then dump it to a more palatable, easy to understand model.
[23:53.400 --> 23:59.120]  So you can give this to people who aren't technical and say this is a bad thing, this is not a bad thing.
[24:00.340 --> 24:01.400]  Trade rags, right?
[24:01.400 --> 24:09.600]  Think of all the, you know, SC Magazine and the like who can, and automotive and any industry has a couple trade rags.
[24:09.940 --> 24:15.480]  They can go and do the bother of analyzing products and determining if they're good or not.
[24:18.340 --> 24:19.300]  Independent assessors.
[24:22.340 --> 24:26.080]  They spend, they do, they break stuff so you don't have to.
[24:26.400 --> 24:29.660]  You look for the UL logo to see if this will burn my house down.
[24:30.720 --> 24:33.400]  In Germany and the rest of the world there are the TUVs.
[24:33.520 --> 24:35.580]  I can't pronounce it even though I used to work for one.
[24:36.880 --> 24:39.160]  And then us, right?
[24:39.600 --> 24:41.900]  Do we certify products and blog about it?
[24:41.980 --> 24:43.900]  Or hey, I pwned the shit out of this.
[24:44.020 --> 24:46.660]  Let me write a paper or give a presentation or whatever.
[24:47.060 --> 24:57.320]  We're kind of that enthusiastic third party that says, hey, manufacture a big complex product that you have rarefied knowledge and institutional information.
[24:57.320 --> 24:58.920]  Your shit's broken.
[24:59.320 --> 25:07.640]  And I will talk about it and we'll try to talk about it and say, and present that information to other divine public to say, please make your products better.
[25:07.860 --> 25:10.000]  Don't make me come and talk about your product again.
[25:10.800 --> 25:12.100]  Make better products.
[25:12.360 --> 25:14.520]  Because sometimes we say nice things about products.
[25:16.320 --> 25:16.800]  Sometimes.
[25:18.940 --> 25:21.020]  Another third party is insurance companies.
[25:21.860 --> 25:28.600]  Insurance companies collect lots and lots and lots of risk data to determine the relative value, the goodness of a product, right?
[25:29.280 --> 25:30.360]  The safety of a product.
[25:30.500 --> 25:31.480]  You go and you change...
[25:31.480 --> 25:37.280]  When you go and buy a new car and you call up your insurance company, you find out that, oh wow, that is a fast car.
[25:37.400 --> 25:38.540]  Because my insurance has doubled.
[25:38.860 --> 25:41.660]  And I learned this because I recently bought a Ducati.
[25:41.920 --> 25:43.580]  And somehow my insurance doubled.
[25:44.460 --> 25:45.420]  I wonder why.
[25:47.320 --> 25:53.540]  So the problem is that even we, as the enthusiasts, we have some limitations.
[25:55.160 --> 25:55.720]  Journalists.
[25:56.820 --> 25:58.840]  Advertisers don't like it when you pay new products.
[25:59.200 --> 25:59.440]  Right?
[25:59.840 --> 26:08.360]  If you're SC Magazine and you publish it, you know, something like, you know, Cisco's Firewalls suck.
[26:08.720 --> 26:11.520]  Well, guess where you're not getting any ad revenue from for a while.
[26:11.880 --> 26:12.140]  Right?
[26:12.620 --> 26:18.880]  So you have this limitation where you can't say awful things about the products in your space.
[26:19.980 --> 26:20.460]  Unless...
[26:20.460 --> 26:21.700]  Even if you're right.
[26:21.880 --> 26:24.740]  You're not really afraid of a slider suit or a libel suit.
[26:24.840 --> 26:27.380]  You're afraid of, I won't sell that ad.
[26:28.040 --> 26:29.580]  I'm not getting that ad revenue.
[26:30.180 --> 26:32.640]  So I have to be careful about it.
[26:32.780 --> 26:40.020]  And you can either take the approach as a magazine writer to say, I can't let the chips fall where they may, and I don't like money.
[26:40.020 --> 26:42.600]  Or you can say, hey, rah, rah, everything.
[26:42.980 --> 26:44.520]  And feed your family.
[26:46.360 --> 26:47.160]  Maintaining interest.
[26:49.740 --> 26:51.220]  You have to dumb down...
[26:51.220 --> 26:51.980]  Not dumb down.
[26:52.120 --> 26:53.860]  You have to simplify things as a journalist.
[26:54.100 --> 27:02.120]  Because if you give an in-depth critique of a product, how do you make that interest into people who don't eat, sleep, and breathe that?
[27:02.440 --> 27:02.520]  Right?
[27:03.400 --> 27:06.560]  Giving an in-depth article that has PCAPs in it.
[27:06.660 --> 27:08.160]  Most people don't read PCAPs.
[27:08.480 --> 27:08.580]  Right?
[27:08.720 --> 27:12.020]  The amount of value for the amount of reading you have to do is pretty low.
[27:12.300 --> 27:14.500]  So you have to simplify this.
[27:14.640 --> 27:18.160]  And sometimes you lose so much detail, it's not as effective a critique.
[27:20.380 --> 27:21.300]  Independent assessors.
[27:22.440 --> 27:23.380]  Experts in shape.
[27:23.880 --> 27:24.000]  Right?
[27:24.700 --> 27:31.240]  UL isn't going to spend a lot of money grinding through a product if they don't think there's some benefit to it.
[27:32.960 --> 27:36.140]  And many times these certifications are a...
[27:36.140 --> 27:37.960]  Does it meet this minimum standard?
[27:38.040 --> 27:40.320]  It's a compliance function, not a sales function.
[27:40.480 --> 27:42.040]  No one sells their product on...
[27:42.040 --> 27:43.300]  It's UL certified.
[27:43.680 --> 27:44.380]  It's assumed.
[27:44.800 --> 27:44.920]  Right?
[27:44.920 --> 27:49.900]  If there was like a UL double plus good certification, it would be harder to sell.
[27:50.200 --> 27:53.300]  And realize that safety is still a hard thing to sell.
[27:54.080 --> 27:57.100]  The analogy I come up with is the 1950s.
[27:57.400 --> 28:00.680]  Many cars in the sold in the United States market did not have seat belts.
[28:00.860 --> 28:01.660]  They were an option.
[28:01.900 --> 28:03.760]  And they were actually hard to sell.
[28:03.920 --> 28:04.860]  And Ford did this.
[28:04.940 --> 28:09.320]  They attempted to say, we care about safety because we would like our customers not to die.
[28:09.860 --> 28:12.260]  And they offered us the lifeguard package.
[28:12.260 --> 28:16.160]  And they found that sales people were saying, please stop doing this.
[28:16.240 --> 28:20.320]  Because when you say, this car has seat belts, why is it unsafe?
[28:21.760 --> 28:22.200]  Well...
[28:22.200 --> 28:22.680]  It's hard.
[28:22.740 --> 28:25.100]  Because it's hard to have complex conversations about risk.
[28:25.240 --> 28:25.800]  Like even...
[28:25.800 --> 28:28.820]  Even though this product is awesome, it still can hurt you.
[28:29.060 --> 28:35.900]  It's still, if improperly used or configured, or just because it's Tuesday you got owned, it's still a beneficial product.
[28:36.220 --> 28:37.420]  It's like selling...
[28:37.420 --> 28:38.080]  You know...
[28:38.080 --> 28:40.920]  It's like selling whiskey and saying, you know, this is going to give you a hangover.
[28:41.540 --> 28:44.440]  It makes you want that whiskey somewhat less.
[28:45.780 --> 28:47.780]  Funding is an issue for independent assessors.
[28:47.980 --> 28:50.400]  Who's going to pay you for the product?
[28:50.660 --> 28:51.720]  You can make it mandatory.
[28:51.920 --> 28:53.740]  You can make it a compliance function like UL.
[28:54.120 --> 28:56.240]  You can make it a sales offer.
[28:56.880 --> 28:59.120]  It's kind of hard though, if you're trying to sell safety.
[29:01.000 --> 29:04.000]  Insurers are the last kind of enthusiastic middleman.
[29:05.140 --> 29:08.100]  The problem is that they're dependent toward liability.
[29:08.260 --> 29:12.980]  No one buys insurance unless they're afraid they're trying to offload risk of a liability.
[29:13.540 --> 29:17.620]  If there is no liability for a bad product, I'm not going to buy insurance for it.
[29:19.320 --> 29:21.260]  So, this is not perfect.
[29:21.540 --> 29:25.200]  This products liability trio is imperfect.
[29:25.420 --> 29:26.700]  But it works here, right?
[29:27.000 --> 29:28.940]  We still manufacture products.
[29:29.480 --> 29:31.400]  We still sell them, right?
[29:32.060 --> 29:34.960]  There's still an incentive to make safer sale of products.
[29:35.080 --> 29:43.380]  If you have a car that has a certain rate of accidents and a certain amount of products liability suits, you can balance that with how much money you're making.
[29:43.540 --> 29:46.320]  And you're trying to incorporate the risk of the product.
[29:46.540 --> 29:48.080]  The risk of the unsafe use of the product.
[29:48.200 --> 29:52.440]  The risk of the product being unsafe versus how much money am I making.
[29:52.580 --> 29:55.380]  Like, this is a calculus done by drug manufacturers every day.
[29:56.100 --> 29:58.020]  We'll sell the drug, we'll make $10 billion.
[29:58.640 --> 30:01.460]  We'll pay it a billion in products liability suits.
[30:01.820 --> 30:03.300]  $9 billion profit.
[30:03.460 --> 30:04.040]  We're okay.
[30:04.780 --> 30:13.480]  If the drug is more dangerous and has a smaller market, we're going to sell a billion dollars worth of this drug, and it's going to be $9 billion in liability.
[30:14.000 --> 30:16.220]  Someone's going to say, hold on to that for a second.
[30:17.040 --> 30:19.300]  Our will charge nine times as much money.
[30:21.340 --> 30:26.500]  So it's flexible enough to prevent a diversity of products, also prosumer products.
[30:26.880 --> 30:33.480]  You can buy fairly heavy-duty products that will hurt you if you don't know what the hell you're doing.
[30:34.960 --> 30:36.380]  An expensive motorcycle.
[30:38.780 --> 30:39.220]  Firearms.
[30:40.320 --> 30:41.760]  Half horsepower drills.
[30:42.600 --> 30:47.260]  The stuff that has, like, you know, you must have your wife's permission to buy this sign at Home Depot.
[30:47.800 --> 30:51.080]  Like, look at this, I can cut through four feet of concrete with this.
[30:51.240 --> 30:52.140]  How often do you do that?
[30:52.240 --> 30:52.960]  I don't care.
[30:54.260 --> 30:55.080]  I can.
[30:58.060 --> 31:01.480]  So, safety and security may be a competitive advantage in some spaces.
[31:01.480 --> 31:08.600]  You may think, the example I come up with is Volvo in the 80s said, how do we care about safety?
[31:08.600 --> 31:09.960]  Because we care about it.
[31:10.220 --> 31:11.240]  Can we sell it?
[31:11.320 --> 31:12.900]  Can we make this a sales pitch?
[31:13.220 --> 31:13.640]  Yes.
[31:13.940 --> 31:18.720]  Our cars are as expensive as Mercedes and look like an eight-year-old drew them, but they're safe.
[31:19.380 --> 31:21.180]  And that was their shtick for years.
[31:21.340 --> 31:26.480]  Like, hey, yeah, it's boxy, expensive, not that fast, but it will kill you.
[31:26.480 --> 31:29.860]  And people went, okay, I heard this on NPR.
[31:30.120 --> 31:30.800]  I bought a Volvo.
[31:35.440 --> 31:37.440]  I make fun of Saab owners, but I am one.
[31:39.180 --> 31:40.380]  We make fun of ourselves.
[31:42.060 --> 31:49.720]  But the other problem is, does this place an unfair burden on providers, especially providers of unique or innovative products, right?
[31:50.200 --> 31:55.540]  It's easier to get injured on a product that is yet to be understood by the consumer.
[31:55.540 --> 32:03.900]  It may have been a higher risk to sell Segways than it was to sell cars, because how many people, like, rode Segways off of cliffs?
[32:04.280 --> 32:06.440]  And it almost took out our president once.
[32:07.840 --> 32:08.720]  Didn't do its duty.
[32:10.300 --> 32:10.740]  Sorry.
[32:12.440 --> 32:13.900]  Does it place a risk?
[32:14.880 --> 32:18.700]  Are there producers who said, I would have made this product, but I'm afraid of the liability?
[32:19.120 --> 32:19.560]  Maybe.
[32:19.820 --> 32:23.260]  Or does it make them charge more so their market space is smaller?
[32:23.260 --> 32:27.760]  It is an impact, but we're trying to push the risk back into the producer.
[32:28.200 --> 32:31.020]  So we also have tales of compensated idiocy.
[32:32.400 --> 32:35.860]  This is something that it's more of a PR function than a legal function.
[32:36.020 --> 32:38.240]  We've all heard about the McDonald's hot coffee case.
[32:38.860 --> 32:44.540]  The lawyers in the room are nodding differently than the rest of you, because it actually was a problem.
[32:45.380 --> 32:53.340]  McDonald's did have their coffee at a way too hot temperature, and an ordinary consumer is not expecting, they're expecting morning the beverage is hot.
[32:53.460 --> 32:54.380]  Yes, it's coffee.
[32:54.720 --> 32:58.280]  It shouldn't burn the skin off your thighs.
[32:59.500 --> 33:00.940]  Unless you're into that sort of thing.
[33:01.700 --> 33:02.320]  That's all right.
[33:02.480 --> 33:03.580]  I just had to say that.
[33:04.200 --> 33:05.820]  So why doesn't this model...
[33:05.820 --> 33:06.340]  Okay, great.
[33:06.500 --> 33:08.500]  We've made our products relatively safe.
[33:08.600 --> 33:13.020]  You have to, like, deliberately hurt yourself, or you have to at least, you know, go and do something.
[33:13.020 --> 33:15.700]  Like, really shoddy products are generally off the market.
[33:16.240 --> 33:20.100]  Why does this now fail miserably when we're talking about IoT and cloud?
[33:22.280 --> 33:24.980]  Legislation and regulation is absolutely patchwork.
[33:25.140 --> 33:32.640]  There's no coherent set of rules for data privacy in the United States, for device security.
[33:33.800 --> 33:38.360]  It's where there is some, it's vague, and it doesn't deal with all data.
[33:39.440 --> 33:44.920]  Lawmen actually, when we wrote those laws, we may actually have barred the second part of the...
[33:44.920 --> 33:47.240]  the second regulator, the tort lawyers.
[33:47.680 --> 33:48.600]  Like, for example, HIPAA.
[33:48.800 --> 33:50.500]  HIPAA has no private right of action.
[33:51.380 --> 33:55.940]  I, as your healthcare provider, put a picture of that rash on a billboard.
[33:56.660 --> 33:59.440]  I may get fined, but you can't sue me.
[34:02.670 --> 34:05.650]  Also, we may not have recognized some of the injuries, right?
[34:06.210 --> 34:08.870]  You have a steering wheel through your chest.
[34:08.870 --> 34:10.250]  That's a recognized injury.
[34:10.970 --> 34:16.610]  What's the injury of you having your Ashley Madison log in and...
[34:18.170 --> 34:23.870]  I've never used it, but those of you who have, there's probably some kind of, like, so-and-so chatted or liked or whatever.
[34:24.050 --> 34:27.190]  You had... there's some communications that are likely highly embarrassing.
[34:27.890 --> 34:29.230]  What's the injury there?
[34:29.330 --> 34:32.850]  We've sometimes not recognized this as an actual compensable injury.
[34:33.890 --> 34:38.970]  So, there's a gooey part in the middle, where tort law doesn't necessarily solve this perfectly.
[34:39.790 --> 34:42.250]  Maybe it absolutely curtailed by contract.
[34:42.570 --> 34:51.030]  A EULA or a, uh, Terms of Service may say, even if I completely negligently dumped all your data, I'm not liable.
[34:51.210 --> 34:53.830]  If I am, I'm liable to the tune of $25.
[34:53.830 --> 34:57.290]  Here's your Olive Garden gift certificate, have it next day.
[34:59.510 --> 35:02.770]  Laws may also prevent third-party intervention, right?
[35:02.930 --> 35:04.730]  The third, the enthusiastic amateur.
[35:07.190 --> 35:10.890]  So, why is IoT and cloud different than products liability?
[35:11.190 --> 35:13.010]  And I'm talking about, sort of, the conceptual idea.
[35:13.730 --> 35:16.250]  Products versus software versus services.
[35:17.710 --> 35:20.150]  IoT products aren't products, right?
[35:20.990 --> 35:23.570]  They're computers with software that look like products.
[35:25.470 --> 35:28.070]  The box is sold, but the software is licensed.
[35:28.330 --> 35:29.630]  And this is the example I have.
[35:29.810 --> 35:30.710]  That's my doorbell.
[35:30.930 --> 35:32.970]  Actually, mine is an attractive brush bronze.
[35:33.090 --> 35:33.950]  It's a ring.
[35:35.410 --> 35:36.510]  Is that a product?
[35:37.190 --> 35:40.590]  No, it's a cloud service masquerading as a product, right?
[35:40.790 --> 35:43.630]  It is a device that has software on it.
[35:43.910 --> 35:45.790]  Software is regulated by a license.
[35:45.790 --> 35:47.310]  That I had to click on.
[35:48.930 --> 35:52.590]  And the feed from the video goes to a cloud service.
[35:52.830 --> 35:54.370]  So, it's an ongoing service.
[35:56.090 --> 35:59.170]  Its product liability no longer touches it.
[35:59.310 --> 36:01.330]  Because I have given up my rights.
[36:01.610 --> 36:02.350]  Many of my rights.
[36:02.530 --> 36:05.190]  Because I clicked okay when I installed the damn thing.
[36:05.310 --> 36:06.390]  I want my doorbell to work.
[36:06.570 --> 36:07.090]  Click okay.
[36:07.330 --> 36:08.070]  I didn't read it.
[36:08.250 --> 36:11.570]  So, for all I know, it can let everyone in my...
[36:11.570 --> 36:12.970]  Actually, it doesn't actually open the door.
[36:12.970 --> 36:16.270]  It just lets me see the delivery guy.
[36:16.930 --> 36:22.590]  But, as we move everything into the cloud and everything into IoT.
[36:23.350 --> 36:27.470]  Things that used to be demonstrable products now have licenses.
[36:28.350 --> 36:28.730]  Right?
[36:28.930 --> 36:31.090]  Like, I have to license my refrigerator.
[36:33.010 --> 36:34.290]  Think about that for a second.
[36:34.290 --> 36:35.190]  Like, it's a device.
[36:35.490 --> 36:36.570]  It's on the Internet.
[36:36.850 --> 36:37.110]  Why?
[36:38.110 --> 36:39.730]  Because it did something cool.
[36:39.870 --> 36:44.630]  But now, all of a sudden, I have to sign a contract that regulates what I can do with it.
[36:45.130 --> 36:47.190]  What I can do and what...
[36:47.190 --> 36:51.230]  If it injures me, that contract restricts my rights.
[36:51.230 --> 36:53.310]  So, license to the contract.
[36:53.550 --> 36:54.450]  Generally upheld.
[36:55.790 --> 37:00.610]  Click browse or use wrap where, because you've used it, you've signed the contract.
[37:01.670 --> 37:04.970]  And cloud services, they're contracts, not purchases.
[37:05.390 --> 37:10.330]  So, that contract, that contract you didn't read, controls your rights.
[37:11.850 --> 37:13.490]  Other laws can affect evaluation.
[37:14.130 --> 37:19.330]  And the two I'm going to use are DMC, Digital Millennium Copyright Act, and the Computer Fraud Abuse Act.
[37:19.510 --> 37:20.450]  I can...
[37:20.450 --> 37:21.470]  If I buy a...
[37:21.470 --> 37:22.770]  I buy a product.
[37:22.930 --> 37:23.290]  This hack.
[37:24.090 --> 37:25.990]  I can disassemble it.
[37:26.110 --> 37:27.050]  I can tear it apart.
[37:29.850 --> 37:33.160]  Can I do so with my doorbell?
[37:33.910 --> 37:36.910]  Can I decompile the code in it that tells it what it does?
[37:37.450 --> 37:37.960]  No.
[37:38.980 --> 37:40.290]  Can I...
[37:40.290 --> 37:41.100]  Okay.
[37:41.620 --> 37:46.330]  Can I take a look at the cloud backend?
[37:46.720 --> 37:47.080]  No.
[37:47.700 --> 37:49.620]  So, what's wrong with contracts?
[37:51.290 --> 37:54.850]  U.S. law tends to privilege contracts or software, using privilege in an odd way.
[37:55.080 --> 37:57.560]  But it highly privileges them.
[37:59.140 --> 38:00.770]  It's a right to binding contract.
[38:01.060 --> 38:07.270]  And there's an old case that says, there is no reasonable ground for interfering with the liberty of a person or the right of free contract.
[38:07.560 --> 38:09.390]  You can hear the sound in the background.
[38:09.680 --> 38:09.830]  You know?
[38:10.450 --> 38:14.450]  Because that was a case where it said, you're allowed to die from white loan.
[38:15.720 --> 38:16.080]  Right?
[38:16.140 --> 38:18.370]  You signed a contract that said you've got to be a baker in New York.
[38:18.500 --> 38:19.290]  Oh, well, you died.
[38:19.560 --> 38:19.930]  Sorry.
[38:20.140 --> 38:23.520]  Can't sue the place you work at because you signed a contract.
[38:24.200 --> 38:25.910]  It's a right to give up all your rights.
[38:26.250 --> 38:29.410]  It's a right to exempt sale from consumer protection law.
[38:29.410 --> 38:38.660]  So that doorbell that burns down my house, there's a contract that says, I've limited my liability to the price of the doorbell.
[38:39.500 --> 38:42.870]  The $100 doorbell is slightly cheaper than my house.
[38:44.120 --> 38:45.770]  The warranty of merchantability.
[38:45.910 --> 38:50.080]  The idea that says, I bought a product and I assumed it was going to do the thing it was supposed to do.
[38:50.660 --> 38:54.620]  You give that up when you, you know, think of two tools you may use for work.
[38:54.770 --> 38:57.000]  A truck and Microsoft Excel.
[38:57.680 --> 38:59.790]  One of which says, it's a truck.
[39:00.450 --> 39:00.540]  Right?
[39:00.830 --> 39:03.980]  The other which says, I make no promises what this will do.
[39:05.060 --> 39:09.460]  You bought it, but if it doesn't do that thing, well, up yours.
[39:10.560 --> 39:11.390]  Restricted rights.
[39:11.750 --> 39:12.060]  Right?
[39:12.500 --> 39:13.350]  Arbitration clauses.
[39:13.700 --> 39:16.040]  Which may say, yeah, you can't sue.
[39:16.200 --> 39:17.220]  You can go to arbitration.
[39:17.350 --> 39:18.600]  And the rules are a little different there.
[39:19.560 --> 39:21.100]  And, you know, class action.
[39:21.350 --> 39:24.910]  So you, 100,000 people suffer a $10 loss.
[39:25.620 --> 39:27.660]  You're not, none of you are going to go to ARB for that.
[39:28.160 --> 39:29.700]  But it would be a good class action.
[39:30.100 --> 39:32.060]  So, wait for class action rights.
[39:32.350 --> 39:33.960]  We can also restrict your liability.
[39:34.750 --> 39:39.450]  Even if I do, even if you find that the product is bad, I'll give you a note.
[39:39.450 --> 39:39.680]  $10,000.
[39:39.930 --> 39:40.430]  There it is.
[39:41.000 --> 39:41.560]  Yep, you're right.
[39:41.620 --> 39:41.980]  You got me.
[39:42.040 --> 39:42.520]  Here's your buck.
[39:42.850 --> 39:43.200]  Go away.
[39:44.720 --> 39:46.120]  And I make, this is not a joke.
[39:46.310 --> 39:48.890]  Like this, we have so restricted the rights because it's software.
[39:49.060 --> 39:49.700]  It's licensed.
[39:50.000 --> 39:51.220]  So what about the regulators?
[39:52.160 --> 39:55.620]  We don't have a lot of legislation enabling the regulators to get step in.
[39:55.930 --> 39:58.410]  Or split the regulatory power between agencies.
[39:58.660 --> 40:02.890]  For example, think of like a health device.
[40:02.890 --> 40:06.660]  Is that FDA or health and human services?
[40:07.000 --> 40:07.750]  Good question.
[40:08.640 --> 40:10.410]  Possibly conflicting goals.
[40:11.140 --> 40:15.140]  We can provide inconsistent or variable requirements between administrations.
[40:15.450 --> 40:22.890]  Do you think a Trump administration might have different beliefs of who should be liable for a data breach?
[40:24.910 --> 40:29.040]  Third parties are constrained from testing without the express permission because it's a license.
[40:29.520 --> 40:29.600]  Right?
[40:29.870 --> 40:37.950]  I can, you know, you buy the Ford, run into a wall, and you don't have to ask Ford for permission to do that or to publish your findings.
[40:38.600 --> 40:43.330]  You want to re-decompile software or you want to take a look at cloud service.
[40:43.480 --> 40:44.680]  You better have permission first.
[40:45.000 --> 40:46.870]  And they may say, you can do it.
[40:48.080 --> 40:50.640]  You don't get to publish until we like it.
[40:52.200 --> 40:55.850]  So, EMCA and anti-circumvention, you just can't decompile it.
[40:55.910 --> 40:58.040]  You can't look at it if it's encoded.
[40:58.370 --> 41:01.270]  And unauthorized access, you can't look at our cloud service.
[41:01.830 --> 41:02.680]  You can't even add map it.
[41:03.480 --> 41:04.060]  Trust us.
[41:04.500 --> 41:05.980]  We promise we won't screw up this time.
[41:07.180 --> 41:08.620]  So, brooches that may work.
[41:10.540 --> 41:11.540]  Enabling legislation.
[41:11.810 --> 41:15.040]  We may actually have to rewrite laws that allow this to happen.
[41:15.180 --> 41:17.600]  To say, you are liable to this extent.
[41:18.410 --> 41:23.250]  The problem is, like say, preventing private right of action for breach is due to bad security.
[41:23.480 --> 41:28.060]  I can sue Amazon if they, their idiocy causes a leak of my data.
[41:28.560 --> 41:29.520]  Okay, that would be interesting.
[41:30.410 --> 41:33.450]  Restricting or eliminating waivers of liability and damages.
[41:33.450 --> 41:34.790]  We might want to do that by law.
[41:35.890 --> 41:39.480]  Permitting consumer protection testing under DMCA and CFAA.
[41:39.720 --> 41:41.120]  I would love to see that happen.
[41:41.580 --> 41:43.310]  I would love to see a lot of things happen.
[41:44.850 --> 41:47.220]  Stretching existing legislation in the courts.
[41:47.560 --> 42:02.270]  For example, we might see the FTC extending the finding after Wyndham that said, really, really crappy security, like laughably bad security is actually unfair competition.
[42:04.690 --> 42:05.500]  That's the case.
[42:05.660 --> 42:08.250]  The FTC is kind of in the catbird seat after that.
[42:08.390 --> 42:08.850]  It's interesting.
[42:09.430 --> 42:16.960]  Or, the other I would like to see, because in Pennsylvania there's a rule that says an unfair contract is not enforceable.
[42:17.680 --> 42:26.080]  So, if we decide, if the court decides that your waiver is too broad, they get to scratch the whole thing out of the contract.
[42:26.370 --> 42:28.460]  So, it's called the red pencil rule.
[42:29.120 --> 42:42.120]  So, we can then say that limitation of liability is itself unfair and you can actually then go after the cloud provider or the software manufacturer or the IoT device that allows random hackers to swear at your children.
[42:43.150 --> 42:43.750]  Right?
[42:43.750 --> 42:45.430]  So, what are we hoping to accomplish?
[42:46.080 --> 42:49.220]  We want to incentivize secure products and services.
[42:49.960 --> 42:53.220]  I'm not doing this because, yay, I want to have tort law in this space.
[42:53.370 --> 42:55.120]  I don't want to make my money that way.
[42:55.700 --> 42:57.890]  And I don't think a lot of you want to make their money that way.
[42:57.980 --> 43:04.270]  But I want to punish the people who are weak because it makes the ones who want to be good a little bit better.
[43:04.370 --> 43:09.830]  It gives them internal ammunition to go to their heads of engine and go, look, fix these things, please.
[43:10.790 --> 43:17.500]  Have the cost of the products and services reflect the actual risks.
[43:18.000 --> 43:19.750]  Other approaches that may work.
[43:20.410 --> 43:22.620]  Voluntary self-regulation and certification.
[43:23.140 --> 43:23.500]  Right?
[43:23.620 --> 43:28.560]  The fear of regulation may require IoT manufacturers to hit a standard.
[43:29.180 --> 43:30.770]  Certified, not pre-owned.
[43:31.020 --> 43:31.850]  I like that one.
[43:32.270 --> 43:36.890]  With easily recognizable logo and clear standards that say we adhere to this level.
[43:38.100 --> 43:40.350]  Pledge permitting recovery for failure.
[43:40.580 --> 43:49.000]  As in, if we've signed on to this, if we're wrong, we will recompense you for your damages.
[43:49.120 --> 43:51.320]  That's a part of the agreement.
[43:51.480 --> 43:59.220]  So it's essentially a private version of the tort law in a little bucket that says we signed on to this, we let you do this.
[43:59.820 --> 44:02.020]  Possibly permission to test and publish.
[44:02.340 --> 44:08.220]  Some kind of patent escrow and granted permission under certain conditions.
[44:09.960 --> 44:12.120]  Unintended consequences of all this, though.
[44:13.060 --> 44:14.920]  New legislation may weaken privacy.
[44:15.400 --> 44:15.840]  Right?
[44:16.080 --> 44:23.620]  If you're writing new laws on this, we may add a tickler that says something like, oh, by the way, national security is also allowed to look at all this data.
[44:23.960 --> 44:27.300]  Because it's 2 in the morning, we just wrote that law in.
[44:27.980 --> 44:28.060]  Right?
[44:28.620 --> 44:31.320]  Liability for free stuff is not a profitable business model.
[44:31.460 --> 44:38.380]  Does this punish people who want to launch and say screw it, we'll see if we have users?
[44:38.380 --> 44:51.290]  Well, if we're now liable, even for free stuff, does that make it harder to launch that initial going between 3 people, a good idea in a dorm room to 500 employees?
[44:51.560 --> 44:53.000]  Does this stifle creativity?
[44:54.640 --> 44:56.660]  What about free and open-source software?
[44:56.820 --> 44:56.900]  Right?
[44:57.000 --> 44:57.600]  Same problem.
[44:58.120 --> 45:05.250]  We have stuff that we would like to produce and get out there, but it doesn't happen because we're afraid of liability.
[45:06.860 --> 45:11.250]  Component liability, what if my product is used in your bad cloud system?
[45:11.400 --> 45:13.620]  Should I be liable for your bad implementation?
[45:14.720 --> 45:17.000]  And who's going to determine that standard?
[45:17.880 --> 45:21.160]  So, that's my talk.
[45:21.440 --> 45:23.180]  Any questions in the last two minutes?
[45:31.240 --> 45:32.560]  I have a question.
[45:33.000 --> 45:33.400]  Okay.
[45:34.060 --> 45:40.800]  Okay, we all recognize that there are third parties that we do not know, including companies like Axiom.
[45:41.720 --> 45:51.680]  Epsilon and others that have our information, was to prevent us from suing them to get them to quit making judgments about us.
[45:52.520 --> 45:57.240]  Right now, you're going to have to argue that they are liable to you.
[45:57.560 --> 45:59.080]  There's no contract between them.
[45:59.120 --> 46:01.140]  The only way you can do that is tort.
[46:01.940 --> 46:05.380]  Odds are, if they haven't beat it, you don't have it tort.
[46:05.380 --> 46:07.020]  They sell it, actually.
[46:07.200 --> 46:07.860]  They sell it.
[46:07.960 --> 46:14.000]  And if you want to buy the information from any of those 800 third parties that are out on the Internet, you can.
[46:15.740 --> 46:20.760]  Right now, very few states even have a private right of privacy.
[46:20.760 --> 46:23.780]  How about the people that are victims of identity theft?
[46:24.680 --> 46:31.200]  If you can show that Axiom sold that data to the perpetrator of that identity theft, you might have an argument.
[46:31.900 --> 46:33.180]  You have to show it, though.
[46:33.340 --> 46:35.500]  You have to show that Buckford Axiom's act.
[46:35.500 --> 46:40.820]  If you guys were interested in who I am, right on the Internet is Tread Belix.
[46:41.020 --> 46:42.460]  I want to sue these bastards.
[46:42.700 --> 46:43.800]  I'm tired of this shit.
[46:50.590 --> 46:59.610]  I would be happy if we could get rid of installation passwords, default passwords, and backdoors in all products as a product defect.
[47:00.050 --> 47:06.270]  What do you think is the likelihood that legislation could address that narrowly focused area?
[47:06.270 --> 47:08.290]  Just like weak defaults.
[47:09.190 --> 47:13.290]  I think what will likely happen is we'll probably have voluntary standards before then.
[47:13.430 --> 47:14.350]  It's faster and easier.
[47:14.630 --> 47:18.770]  IOT people, IOT manufacturers, many of them want to do the right thing.
[47:18.950 --> 47:24.570]  And if there's enough incentive of a market incentive, I'm not going to buy that thing because it got panned on Krebs.
[47:24.770 --> 47:25.930]  I think that will be faster.
[47:26.270 --> 47:27.330]  Legislation will be slower.
[47:31.190 --> 47:32.110]  So Lochner.
[47:32.570 --> 47:35.630]  So you cited Lochner and said we can do infinite contracts.
[47:35.890 --> 47:37.830]  There's at least one other lawyer laughing.
[47:37.830 --> 47:37.950]  Alright.
[47:39.230 --> 47:45.210]  Lochner was overturned, famously, because the FDR threatened to kneecap the Supreme Court if they didn't overturn it.
[47:45.750 --> 47:53.970]  What do you think the opportunity is for overturning the Federal Arbitration Act when we replace four Supreme Court justices, assuming that Cheeto Jesus doesn't win?
[48:00.370 --> 48:09.350]  I think low, because I believe there is a pro-business candidate in both parties that would like to see arbitration remain.
[48:12.410 --> 48:15.110]  So I want to go back to the doorbell example.
[48:15.490 --> 48:15.650]  Okay.
[48:16.170 --> 48:21.070]  If you're required to accept the license to use the doorbell, isn't that duress which would void the contract?
[48:21.870 --> 48:23.210]  It wouldn't be duress.
[48:23.330 --> 48:27.070]  It might be a contract of adhesion because no one's forcing me, right?
[48:27.410 --> 48:30.330]  No one's holding a gun to my head and said, store this doorbell.
[48:30.330 --> 48:36.070]  It's instead a... because usually the license also says, if you don't agree with this, ship it back.
[48:37.210 --> 48:38.510]  It's... duress wouldn't work.
[48:38.610 --> 48:43.910]  You could use a contract of adhesion which says, I was not able to negotiate my contract with Ray.
[48:47.230 --> 48:49.510]  What do you think about Pokemon Go?
[48:50.070 --> 48:50.210]  Woo!
[48:52.030 --> 48:53.970]  I haven't tried it yet.
[48:55.090 --> 48:56.610]  No liability perspective.
[48:57.230 --> 48:59.090]  Do you opt out of arbitration clause?
[49:01.470 --> 49:02.890]  I got one more question.
[49:03.290 --> 49:04.570]  So, Pokemon Go...
[49:05.090 --> 49:16.030]  I think there's actually an ongoing debate on the lawyer subreddit, our lawyers, about Pokemon Go and the amount of people who think that Nintendo will be held liable for injuries.
[49:18.730 --> 49:21.970]  And there are people who are now going to be like, I'm a Pokemon Go lawyer.
[49:23.370 --> 49:24.350]  I... you know what?
[49:24.490 --> 49:26.790]  That means that I'm that much less of a clown.
[49:27.070 --> 49:28.290]  So, I kind of like that.
[49:28.290 --> 49:29.450]  I kind of like that outcome.
[49:30.190 --> 49:30.630]  I...
[49:31.810 --> 49:33.250]  I think it will be interesting.
[49:33.530 --> 49:37.910]  I imagine the first couple will be arbitrated out.
[49:40.170 --> 49:45.970]  And likely... likely Nintendo has enough money bankrolled now to handle suits on that.
[49:49.200 --> 49:50.200]  I think that's it.
[49:50.200 --> 49:50.220]  I think that's it.