All right, welcome everyone. This is our Second Annual it is becoming an annual tradition what to do this close as possible following devcon, which is very popular for a lot of us. If you are out in las vegas, it would be for you. I am very happy to see so many people in the room, and i know there are more following us online, the internet, twitter, or on cspan. My name is bo woods, i am the director of the diversity initiative. I would like to welcome you to event hosted by the cyber cyber statecraft initiative. I would like to welcome those who are following on the webcast. I encourage you to join the conversation with the twitter hash tagged acccyber. Devcon two d. C. , we hope it will policy forayer of people to understand the significance, urgency and Response Options to the flood of Technical Information from the hacker conference that took place in las vegas. That is devcon, blac chyna black hat, and others. Joinedry pleased to be by a distinguished group of my colleagues and friends. Spacee chris thomas, aka rouge. Still cant call him chris. He is the first Cyber SecurityResearch Think tank. Popular Hacker News Network tv show. Cofounder of the the congressional Cyber Security caucus, one of two Congress Members are joined us at devcon last week. Jessica wilkerson is from the house energy and Commerce Committee where she focuses on Cyber Security and legislation. She joined us last week. And the moderator for todays event, Ariel Robertson is a freelance writer and analyst who specializes in defense, security and technology policy. Whichsts the tech affect, is on ramifications in society. I look forward to this panel discussion. Before we kick it off, here is a short video or presentation that i hope is going to convey some of the excitement and intensity of last weeks hacker conferences viscerally to the audience. Voice slides in 60 seconds. I might hit yet, but i might not. Are you ready . Lets go. We had wonder woman, we had the cyber safety track, panels, congress on panels, the 2000 hackers cheering them. Village, we had a healthy balanced diet. We had serious conversations. We had the oil had. Badges, bash life. We had black badges. 24 karat gold. Tiki gods in our image. 24,000 hackers in a hallway. Some issues but not as many as you think. Cars and trucks. Medical devices. We got technical medical devices. Black voting computers. More voting computers. All the voting computers. We have all the things. We cyber interpreted all the things. We hacked the planet, we did something historic, we had fun. We will do it again. Devcon is not canceled. Now i want to play a video. That was an immense challenge. I look forward to seeing how well i did in this need round. We have got a short video that is from a Facebook Live that congressman heard and congressman landsman did. Let me play that for you now. We will get started. [indiscernible] they are rounding up the distance. This is what all of the hacker understandid to help the vulnerability of our Voting Machines. I with my man jim langevin. The former secretary of state. [indiscernible] what should the secretary [indiscernible] [inaudible] we will be back with you soon. [indiscernible] [laughter] beau woods all right, that concludes the video. A good, quick segment to help transition this into the panel. Without further ado, we would like to invite my panelists to come up. All right, arielle. All for, thank you coming, thank you all for coming. I am honored to be a part of this panel. Such an amazing crowd. First, can you we had three conferences all in the last 10 days. Defcon, we also had black hat, and we had beside las vegas. Can you explain the differences between each of these different conferences, who they are geared towards, who goes to them, who puts them on, and so on . The first conference that started 25 years ago was defcon. It was a gathering in vegas of hackers that wants to hang out and see each other in person. From that, 21 years ago now i think, black hat arose, which is the commercial or vendors sponsored event that is a lot of mostly training as well as a vendor area, but is there a commercial for lots of security companies, the expo floor, etc. , and that is bside grew out of talks that were rejected from black hat and people thought they were still good talks. They created a third conference within the same time span called bside. That has grown into a hackercentric conference. They will talk for a lot of new people. People go there because of the talks that they offer. Bck it would be like the side of a record, for those of you who are old enough to remember records. Terrible to play in your car. The beside refers bside refers to that like a Hacker Family reunion. Go families pay for them to to black past, but they skip on that and go to bside and hang out with their friends. Defcon is huge, 25,000 people. It is hard to meet and run into anyone you know or with any regularity, then black hat is very vendor focused, industry focused, so people go to black hat to look for their new job in the c suite, where as the other has people finding their first job in information security. Ariel robinson what all was everyones role at these conferences . For myself, i was registered as press at black hat, i was an attendee at bside, then i was in and out of defcon very briefly before he went to the airport i went to the airport because for five days in las vegas was totally enough for me. What about you all . There were eight days. I arrived on friday night of defcon, and i had a talk with beds, meet the feds i did on saturday night as part of the evening lounge, two hours designed to be interactive and give the Research Community a chance to talk to friendly feds. They do exist. Well,s was at defcon as thanks to the Atlantic Council. He got to spend time with h. Gressman urd. I got a tour of most of [please stand by] because of the fact that everybody in the industry is in one location at one time, it is the perfect opportunity to meet other people in other companies. The first three days or so during black hat. Then you go to bside, a volunteer on the committee for bside which means i select which talks are presented at the. Onference call for papers. Ariel robinson i am going to call out all of the acronyms. Cris thomas i apologize for that. Get a staff badge. T bside i cannot spend a lot of time there. Then on friday and saturday, i nick withew with assessing his boss, representative hurd. We visited some of the different. Illages that defcon that was my experience. That is long. I went [please stand by] seemsicy world because it unbridgeable, and is not, so we do everything we can to demonstrate that. Have a great time, but i was not at defcon or black cats. Atlantiche help of my coastal colleagues and the cavalry, we were at the today track at bside which included like a mock congressional hearing which was really fun. Exercisecyber crisis that put policymakers and hackers to empathize with one another and build understanding of educational awareness. Also arranged for currently use ngevin to comea out. Was had like a hacker speed we had like a hacker speed dating. They wanted to pair them up, finding a good personality fit. We did the tour that nick alluded to, interactive exhibits, with workshops and villages. I did a talk called do no harm, which is the one you saw where we showed up half an hour early for the room, we had 100 people in line. We had a rough that the room for 200 and a line out the door. We put together a medical device hacking village, the first time in defcon. It was also one of the contests and events. This is a term for the people that put on the defcon conference. I did not make it over to the black hat. I had a full schedule. Ariel robinson i spent a lot of quality time running between hotels. There was a lot. Speaking of these different villages and grounds for the bside las vegas, the different tracks in the ground, there was the Common Ground and ground resource had the engineering village, the i. T. Village what all, can you describe what all goes on there. There . Like what is that. . Is like birds of a feather meet ups. Vehicles in place. Had vehicles in place. The same thing with the voting machine village, a bunch of Voting Machines set up to experiment with, etc. There was the lock pick village, the industrial village. There was the kids a silent for kids to learn Different Things a silent for kids to learn different a silent asylum for kids to learn Different Things. Handson experience with Different Things. And is allencompassing under the big term hacking. Add,t know if you want to beau. Beau woods it is all about the content and the track, but there were about 12 or 15 tracks over the course of that eight days that went on in parallel to each other. It was pretty intense. The hacking conferences are some of the only ones i know of where people go to say they did not go to see a talk, because they spent most of the time that the villages talking with their friends, having lunch, going to parties. It was really an allencompassing set of events for three different stakeholder types, the kind of the community with these las vegas corporates. More kind of Hacker Community with defcon. Then you will have lots of people who spent all weekend in a room trying to do the capture the flag, to basically do red , theylue team penetration spent the whole weekend doing that or running through a contest for the crypto privacy village, trying to break. Ryptography in real time or exploring social engineering issues. Social engineering village is really popular. Ofting information out anyone. It is my specialty. Beau woods as a journalist, you are topnotch engineer. There is a heavy focus on educational awareness, building new skills, capacities. This year more than ever we tried overtly in some of the content that we created to make it about building policy skills that were compatible with Public Policy issues. They were allowing the hackers to be more cynically minded civically minded. They wanted to pursue pay, unlike two participate unlike years ago when it was more of the active, not quite hostility. Changed, so we are trying to develop capacity as well as awareness of the situation. One of thosen so we will come back to the evolving relationships of the different stakeholder groups. What else was different about and what didear, you expect, did you not expect . This for the Congressional Staff members. It was your first times as well, my first time as well. Las vegas, crazy place. One thing that i think was different, having never been nefore, there were congressme their speaking on panels saturday afternoon and the track to 2000 people sunday. The best of our knowledge, that hasnt happened. Differentf what was about it for me than what i thected, i have spoken at con vegan in washington dc, the local hacker con the convention in washington dc home of the local hacker con, and used that to get the better understanding that there are people in congress that are interested in making sure that they have a seat at the table, and that we have a lot to learn from hackers. But that convention is d. C. s hacker convention, so i thought, they might have some credit relation to policy crenellation to policy that is not known for having the spot the fed bean. I came in expecting a little bit of resistance. I wanted to be an ambassador. I had every Single Person i met, i made a point to say i am from congress. I need your help. , atpected to get a lot of best, neutral, and some negative reactions, and that really wasnt the case at all. People were surprised to see me there. Engaging the. D in they wanted an outlet to make sure the voice of the Hacking Community was heard. They were very receptive to the fact i was willing to come into the 105degrees heat of las vegas to talk to them. I appreciated that to feel like there was no barrier that i was welcomed right away at my first defcon. Ah and its a good thing. The hackers want to work with government. Want to work with hackers. In e seeing programs government. Whats going on . Who are these people . Im, like, oh, these are the congressmen. Cool. It was really interesting to see that reaction from folks. More positive than i was expecting. Thats the f big surprise for me, how engaged people want to be in this community and we realize that if say nt step forward and something and make our voices known, things will be done our input and we want to intosure we have our input that process. I have this thing where to put the word hack or hacker into a press release or report i immediately with research or researcher. [laughter] but apparently that might not thing. Tally bad thats good. My researcher. I think it was amazing how accepted we were. Excited that we were there. People would find out that i was like, oh, d theyre, my god, thats so cool. But i think the thing that i ound surprising and i think this shows, you know, i think of d. C. As this bubble that lives beltway and have you to get out of the d. C. Bubble to really understand how the rest world is working. Do i kept asking me how get involved. Who do i talk to . What do i do . Me. As surprising to in my mind, i was, reich, your obviously already involved and were re here talking to you and we seek your so i think it was striking to me that i think at perspective, i dont know if weve done a good enough job of advertising. Like, you dont need to be part of any special group. With using for us centralize point where we can go we need to talk to vehiclesho knows about or medical devices and specifically we need people who can hack them. To say you can reach out directly to us, you can email directly. You can call the main line and have them connected to me. Love to talk to you. There was some kind of special permission or pass needed in congress, in myo mind, im, like, join in the queue. You mentioned im the calvary. I think one of the things theerent this year was that lasary had its own track at vegas; right . Yeah. Calvaryd so i am the is a global Grass Roots Initiative that was started exactly four years ago. Happy birthday, by the way. You. Ank its something ive been heavily involved with and its i joining the Atlantic Council because we found we were badly needed in we wanted to have a d. C. Platform and a d. C. Outlook for some of that. Third year, yeah, third year with the track. And its grown every single year and its been Pretty Amazing to along e what has grown with it. We this year was much more focused on Public Policy things. One of the things that surprised me like everybody else was the hackers and ch the Security Researchers were not just tolerating people from d. C. Actively engaging them and jessica, i knew you would be we talked ide when that. I thought it was a huge relief i think it ut also shows the turnover in the Security Researcher community. This year as every year the 20 andnce grew by about i think that it actually grew more than that because i think a older people have started not going to defcon and events. The other technical. As so i think were actually guard ng some of the old who are really and still have a lot of the battle scars from talking to congress, agencies, being threatened with arrests, a lot of those folks have kind of aged out of the community and we have whom e crop of people for this is their first or second year in the Security Research community and theyre very eager to engage. One of the things that one of at the keynote speaker he bside i am the calvary track was karen alizzari and she talk. Ted she met a lot of people who were realizedsitive and she at that point that we have permission to engage more broadly in society. Just havent given ourselves s a community, individual selves, permission to engage. So i think this year was an helped on point that unlock some of the people who go and ose types of events engage more broadly in Public Policy and other discussions chamber. That echo many ar cry from not that years ago when they were actually uninvited. They were for reasons that we talk about. Yes. We can move on from that. Google it. Yes, google it. [laughter] so some of this and actually of the reason that they were uninvited was about trust. The technology cosystem is critical and ever evolving. Has trust between the betwe community and etween or industry executives, how have these different relationships changed . Has driven think that change . Question. A tough go. I mean, i think one of the was whenons that i had the sony hack happened and president obama said we need to this on tv. This on tv. It felt almost like a call for the adults in the room. And as the original call for i am the calvary is realizing ome of the people at the top werent going to come in at the last minute and save us and i in we had to be the adults the room. I think that was the feeling for a lot of Research Communities the case. We also saw a lot of activity cyber policy. And what i realized is right the lines of what was said earlier which is that if we positively and proactively, other people will void. The some of the initiatives in years, the last 30 child unlock protection act, the act, the digital act, these opywrite are laws that have kind of turned hackers into criminals. Been a large distrust of law makers from the hacker side. To ink what were starting ee is theres there is a the trust level is starting to on both sides is starting to that you. Starting to see as evidenced by weve had met for years and theres usually, you get a couple of law makers on stage the audience but the number of people in the audience interested in that sort has grown dramatically as evidenced this year. Whether its through just having a program in the first place. Thats Part Congress selfinterest is driving the need to be, like, we need to build some trust with the