BG - And Together We Crossed the River…

please join me in welcoming Josh Corman uh to give a talk about how we cross the river [Applause] together all right now if we can only get this to work again um hi so uh warning I'm feeling a lot of feels today so uh I'm not even sure where we're going to go with this but we'll find out um I can promise you this it'll be authentic um so I probably should explain the title and together we cross the river but I'm probably going to postpone that a little bit um so it was uh August 1st 10 years ago after being rejected from defc con uh Nick and I offered a talk titled the caval isn't coming and it was a conversation it happened in this room configured a little differently and uh Banshee and Jack and Damon moved Heaven and Earth to make sure that this important discussion happened and uh and after some circulation of how the hell did this not get picked uh dark tangent gave us uh the keynote stage Sunday morning a couple days later uh at Defcon and I think we're still in one of the top 10 talks of Defcon um not because it was a flashy OD day but because it really tapped into purpose and a Northstar and how uh important what we do could be to our families our our societies Etc so I'm not going to there were in the buildup to this I had several competing theories one was I wonder if I could give the exact same talk and how it would hit a decade later so I want you to think back to 203 I'm not going to do that um I want you to think back to 2013 okay I don't know where you were living I don't know where you were working I don't know what car you were driving like I don't know what evokes your memory there but people were pretty pissed off there was a trend towards increased criminalization of research hacker was a dirty word uh Snowden kind of shattered trust kind of amongst the community amongst govies uh President Obama said I'm not going to scramble some jets for some hacker um there was a lot of concern and existential dread amongst the hacker community that year um I felt moved to do this for some very personal reasons and when I went and watched the video yesterday um some parts hit me pretty hard and and things I remember saying in that room I never actually said in that room so I might add some color and context today but uh and that will help make sense for why the talk has titled this um but what I did say in the room is that uh our dependence on connected technology was growing much faster than our ability to secure it and areas affecting Public Safety and human life uh and after doing a whole lot of looking high and low in the government and for the adults there weren't any and it was incredibly demoralizing to see that the Cavalry isn't coming to save us after researching Anonymous for a couple years with Jericho and being concerned about the rise of personal power curve of the individual in a hyperconnected world the corollary to that is all right if they're powerful so are we and if no one's coming to save you it's also empowering because then you know it falls to you to you or nobody so you don't feel helpless you make a choice am I going to fight or not so the call to action was what are you willing and able to do can we be that voice of reason that technically literate uh honest broker can we be a helping hand instead of a pointing finger can we transcend the Rockstar culture and the glory and ego culture and instead try to solve real problems and instead of bringing a pointing finger and and anger can we bring empathy and a helping hand instead of taking a tactical view of finding and fixing a single flaw and a single medical device from a single manufacturer in a big uh contested public debate um could we hack the incentives so that all medical devices were safer and we had no idea if any of this would work I I think it was at my feeling my most powerless and shattered when we made the call um and a decade later why does the world look different so I don't know your personal touch point for 10 years ago but to to bounce between then and now quite a few times hackers are cherished in public policy circles we have government officials here today we have a defcom policy track we have a black hat policy track we have hackers on the hill we have hackers in the White House hackers helped write the white house National cyber security strategy hackers have passed federal laws hackers have passed UK laws hackers have influenced transparency regimes across the globe we went from a full disclosure Mantra now to every Federal agency has to have a coordinated vulnerability disclosure program now that was not an easy Journey from 10 years ago where hackers were increasingly criminalized to having good faith research carve outs for dmca and cfaa and being invited to White House meetings and testifying to Congress and I have no idea how we did it I mean we can give you data points you can come to our track today and tomorrow and you can hear some of the success stories and some of the blueprints but Bo woods and I joked that if we ever wrote a book it would be called we have no idea what we're doing but it seems to be working but I think when we reflect on what worked and what didn't um something like this something as transformative this could not have happened outside of the bsides family hackers are not a single tribe we're a tribe of tribes and sometimes Waring factions but this is the community that thinks of their place in the world that wants to Mentor others that wants to give people their first speaking I mean the very birth of besides was that firsttime speakers could never break into the cabal of the gatekeeping of the black hat conference we're hearing the same things over and over from the same name rock stars yes they're accomplished yes they're amazing how do you get new blood and new talent and it's very hard to break through so one of the spirits of besides was to um democratize that power instead of hoarding that power to inform Inspire and influence and help and shape and cultivate and only this community could have given us that Refuge to ask this crazy thing 10 years ago all right I've been rambling this journey for me did not start with this talk some of you know this I'm going to give a little bit of it not all of it a little bit of it so there's a lot of feels in here for a lot of different reasons I had researched the rise of anonymous and activism I was concerned that this was a significant moment that it was going it was the front line of what happens when large groups of postnational use opt out of social contracts and take direct action online it's an emergent property of the internet I felt that it erod social contracts cuz I'm a philosopher hacker systems thinker idiot altruist who spent way too long in the hacker Community but I was worried that it may Inspire things like cyber terrorism and it did uh a team poison member from UK named uh janed Hussein a Pakistani UK honor student from Birmingham joined team poison hacked Tony Blair's website got arrested went to jail and in jail was radicalized and when he got out he moved his Anglo-Saxon punk rock wife and child to rock Assyria where he founded the Cyber caliphate and uh was recruiting and inspiring physical attacks in the US and abroad and hiring hackers and I was terrified at the concept of what could someone willing and able to take human life do with Showdown and script Kitty tools and the answer is a lot so I kept these to myself and I tried to find the adults in the room and I tried to whisper to people and government the intelligence community and allies and eventually I'm going to skip ahead for what happened with him but they eventually put him on the US kill list and I think he was number four the most dangerous person for our interests and he was eventually killed by drone strike uh in raqqa but I was worried in a world of 7 billion people it doesn't matter what most of them would do it matters what one of them could do and it was way way too easy to reach out and touch someone so after successfully spotting false flags and predicting movements um the intelligence Community said how are you doing this and we showed them how and I got invited into Fort me for two days and I got to pick five hackers and I figured each one of them are really strong maybe we can form the team of Avengers maybe we can see what we could do and the goal was to help General Alexander figure out his attitude on different legislative proposals for cyber there was no cyber security framework at the time there was no Snowden yet in fact this never would have happened had it happened in the wrong order but we brought um Kaminsky and uh HD Alex Hutton Jean Kim um David etu and we answered some really really important and hard questions like if you could add one sentence of legislation to have the most material impact on Public Safety human life and US critical infrastructure and the Hemorrhage of intellectual property from the uh US economy to China what would that one sentence be and it was amazing to see their powers combined um part of the fs is you know somebody who's been gatee kept and never felt like I had something to contribute here I am talking truth the power to some of the most important people in the world and trying to put on their agenda that we're worried that we could have mass casualties and loss of life in our food supply and our hospitals and our power grids and I'm watching these people that are strong alone be so much stronger together and that's all great but what what else was going on in my life is my mother had had a stroke and uh we knew she'd have some speech pattern things to fix but in between day one and two of the most memorable moment of my life what I thought was going to be the Pinnacle of my impact on the planet if you want to Dent the Universe I go to my car uh grab my cell phone I had 18 voicemails saying I'm so sorry Josh I'm so sorry Josh I'm so sorry Josh and uh finally when I got to my sisters I'm like finally figured out what they were talking about but it basically it wasn't just a stroke it was pretty aggressive aggressive brain cancer so we knew that we'd be um ending her life soon so I sucked it up went and taught a class went back didn't tell my friends tried to do day two and we came up with breathtaking ideas and we answered all the Challenge questions and at the end of it when we did our readout uh the answers were we can't do that one there's no satory Authority for that one people would have to die first for us to try that one you're absolutely right about this one but good luck getting that through Congress and basically at the end of the readout we couldn't do a single one of our transformative ideas not even one so it was both magical and demoralizing and that was at the airport bar when none of us spoke for probably 30 minutes that I broke the silence and I said half of the answer here I said the Cavalry isn't coming and we all got on our airplanes and we all flew home now meanwhile I didn't didn't have the answer to the other half but we start hospices my mom 58 years old trying to watch her die with dignity it came a point where we had to take her away from her home to my sister's house more closely uh close by and all she wanted to do as a superintendent of a school district and very active member of her church to say goodbye to her friends one last time and uh it [ __ ] luck it happened to be be the Sandy Hook shooting weekend so she didn't even get to say goodbye to her friends because everybody was Shell Shocked all the teachers she was responsible for all the students everyone's afraid so for hours in that church we just heard her preacher say why is there evil in the world why is there evil in the world and I just remember being angry and hurt and I'm watching my little girls afraid to go to school I'm watching my little girls hug their grandmother who's dying and it was you know one of the most gutting at bottom moments of my life and then we fast forward and we're hosp in her for a little bit longer she dies in January I have to go back to that church I have to walk back into the place where I last felt angry thank you [Applause] Jack I have to walk back into that place where I felt angry and I don't like to be angry I want to be constructive so I had to metabolize that and somewhere between walking in the front door and getting to the stage to give the eulogy because I was her oldest I uh I realized okay my mom got to be my seventh grade science teacher she was a phenomenal teacher somebody got hurt shouldn't have been allowed they made had to make an exception and of the many things she taught me Darkness isn't a thing it's an absence of light cold is not a thing it's an absence of heat so maybe it's not the presence of evil but the absence of good and maybe that's why I was so angry the last time I was there um so I asked her family her friends her parents her siblings her grandkids what is the absence of of Marie and I didn't have an answer I just looked at him and I said we don't get to find out because it falls to us to do what she was doing now to get to something hacker related um I finished the sentence in my head is that if the Cavalry isn't coming if something's missing it falls to us to put it there so I didn't know if it would work I didn't know if anybody would say yes didn't know he'd have a single accomplishment but I knew it was worth trying okay so the song um I was shattered um I was given the keynote at bside San Francisco and I nothing in the tank um and Jack my brother who just gave me a hug uh he had to scoop me off the emotional floor and take me to Wine Country at the end of this RSA week I couldn't even speak we just played music couldn't speak I didn't know if I'd stay in security I didn't know if I had any energy left and that pfer song came on The Humbling River is where this is coming from and the whole idea of The Humbling River is this guy can conquer everything conquer climb the mountain win the more do all these things but there's one River he can't cross and over and over he tries and he's humbled cuz he cannot cross the river and as I'm listening to it feeling shattered and Powerless and that I've done everything I can and I don't see a path forward there twist the line at the end and says the hands of the many will join as one and together will cross the river so I didn't know what to do what to call it but I'm like all right I'm not done we've been doing this as so solo artist let's see what we can do as a as a team so I'm not doing good on time management I told you I had a lot of feels but that different approach where we weren't looking for permission from rockstars where we weren't looking to point fingers or have combat where we weren't demanding something but we were offering something had transformative results and I'm not going to show everybody's face or everybody's name but I asked Nick initially Nick Boko you know if he'd try this crazy experiment with me a law professor andan mition have been coming to Las Vegas a lot during the rise of anonymous and Def conon she helped nudge me during Thon the prior year space Rogue whose cold dead heart had closed off started like saying his heart grew three or four sizes that day so space Rogue kind of became yes that's a huge boot full of beer at Thon uh no beard you might not recognize them um but you know we're talking about what did and didn't work with Loft and maybe could we try something like that again um didn't even know Bo Woods Bo missed my talk he was giving a talk on how to dodge us tax codes by being a digital Vagabond and traveling the world didn't even see the call to action um and has become the first and most dedicated and longest last recruit that has helped to change the world that's cause by the way you know we met people like Craig Smith who wasn't the Chris and Charlie Rockstar hacker but it had written more tools and democratized more access and helped start the car hacking Village we traveled the world got sworn by camels um we own we thought that that was our last dinner there on the on the left uh we started entering the halls of think tanks in DC as uh secret Invaders he became Dr Horrible to do the biohacking village we eventually ended up you know briefing and inside the White House on more than one occasion because they started to realize they needed help so people that were afraid of hackers a decade earlier are now completely embracing us Jan Ellis was starting her own thing she also didn't see the talk although she knew I was going to do it she was over at black hat trying to like say that hacking its first amendment protected speech and she was deeply concerned that her friends might go to jail and she decided she had to do something about it so she started on her own journey to try to reform CFA and dmca and very quickly we combined forces we started investing in junior staffers this is one of two this is Nick lerson he's been here this is one of two Congressional staffers that first year with a computer science degree tomorrow you're going to see the other of the two Jessica werson but we built trust with Junior staffers that most people would have turned their nose up to that man is now running most of oncd the office of national cyber director in the White House more Jen some of these became family Jen was my best man my wedding last year August 3rd aie um Jack married us um not me and Jen my wife does not like her photo online uh but Jack has been a brother and a often the one picking me up off the floor when I'm emotionally shattered I have a lot of feels lots of hugs we're going to make the calendar for charity uh we befriended sitting congressmen we brought two sitting congressmen to Defcon 25 uh bipartisan will herd of Texas who's now a presidential candidate so I've had shots with a presidential candidate uh and uh Jim Lan who ardently fought to advance cyber security in the Congress he was founded the cyber caucus in the house he drove the formation of sisa I want to remind you we are 10 sisa is five sisa was in part fashioned after some of the Cavalry mission to do defensive work for critical infrastructure for cyber physical systems and he helped birth sisa cyber space sarment commission and fought to the end of his administ uh he just retired but to the end to advance hacker rights accordin to disclosure and as been incredible teammate we befriended hackers who grew up going to Defcon and became Physicians and we started cyber Med summit.org a nonprofit to do ER hacking simulations and crisis simulations with doctors we worked with patients like Marie Mo who was both a cryptology PhD hacker and a heart patient who engendered empathy and gravity when we tried to reform public policy we befriended nurses like molinaa internet of dongs uh International hacker celebrities like Karen who'll be here Billy Rios who hated this idea at first um and was the one doing the prolific research and angry with the with the FDA learned that coming to the table and finding common cause and common purpose took his previously ignored research and caused the first recall in history of a medical device for cyber reasons an unmitigated Pathway to harm the prior standard of care was somebody had to die first there' be proof of harm and enough proof of harm to Merit a corrective regulatory action but we convinced them that in cyber security an unmitigated Pathway to harm was enough and nobody had to die first Mike Mike left his own company to go to GE to make medical devic is safer cuz he heard the call and he led and he built teams and he mentored people and he trained stuff and he led by example and when he thought he'd done as much as he could and went to look out he heard a talk after our Congressional task force and he's like no one's going to fix this I got to fix it he started scope security left his career again to put his neck out and Advance Medical and was also like