 And speaking of challenges, clearly cybersecurity is at the forefront of everybody's agenda. The RSA conference, unfortunately, is this week. See, it's not just us who plans an event over Valentine's Day, all those security people do it as well. But we've been lucky enough to have Bruce Schneier, who will be joining us from the RSA conference via Skype, to give us a talk about security and privacy in a connected world. How many people here know Bruce Schneier? Bruce Schneier is one of those guys who, you know, bestselling author, he's written 14 books. He's a fellow at the Berkman Center. He's on the board of the EFF. His newsletter is incredible. He's one of these kind of folks who, when I meet, I get a little bit of weak need, you know, because he's such a brilliant thinker. And we are very lucky to have him. And here he is joining us via Skype, Bruce Schneier. Hey, thank you. You can see, I can't do, so we'll see how this goes. I'm here at the RSA conference. If you looked outside that window, you'd see the area around the Scone Center. And something like 25,000 people are going to come here and talk about security. And I want to talk about the intersection of us and you and what I see is coming. There's a great quote from Mark Andreessen, 2011, that's so far as eating the world. And I think it's finally coming true. And what we're seeing is that everything is becoming a computer, right? Your microwave is a computer that makes things hot. Your refrigerator is a computer that keeps things cold. An ATM machine is a computer with money inside. Your car is a computer, actually. It's probably a 100 plus computer distributed system with four wheels and an engine. And as everything turns into a computer, computer security becomes everything security. And there are two very important ramifications of that. The first is that everything we know about computer security becomes applicable to everything. And the second is the restrictions and regulations that the real world puts on itself is going to come into our world. And I think that has profound implications for us in software and especially in open source. And we see this coming at the Internet of Things. And I look at the Internet of Things, I see it having three parts. I see it having the sensors that get information about us and our environment. The smarts in the middle that figure out what to do, largely in the cloud. And then the actuators that affect our environment. So a Internet thermostat collects data about the environment, figures out optimal temperature, possibly based on weather and load at the power plant, and then sets the temperature in the house. You can get driverless cars being the same thing. So what this is, is an Internet that senses things and acts, which, if you read science fiction, is the classic definition of a robot. And I think the way to think about this future is that we are building a world-sized robot. Now, this is not a robot in the classical sense. You know, we think of robots as discrete metal boxes with the computers inside and the sensors and actuators at the surface, like data in Star Trek. But that's not the way robots are working today. They're much more decentralized. And then this world-sized robot doesn't have a single consciousness, a single goal, a single creator. It's really an emergent property from this Internet and then this physical Internet that we're building. Think of it as an Internet that affects the world in a direct physical manner. So this means Internet security becomes everything security. And all the lessons we know from Internet security become applicable everywhere, on complexity, on vulnerabilities, on attackers, with one big difference. The threats are greater. As our Internet affects the world, the threats become much more real. And this ranges from decision-making algorithms to large, vertically-integrated systems that increase power to all these massive sensors that erode privacy to the actual physical effects of our computer systems. These cyber-physical systems have real-world effects. And you'll see this in some of the Department of Defense reports. James Clapper, Director of National Intelligence, talked about this at his last briefing to the Senate. Admiral Rogers of the NSA talks about this, that we are now worried about physical attacks. We're worried about denial of service against physical systems. We're worried about hacking against life and property. We're worried about SCADA systems. Confidentiality is a threat, but integrity and availability is now a bigger threat. But it's the same computers. It could be the same operating system, the same apps, the same vulnerability, but there's a fundamental difference between your spreadsheet crashes and you lose your data and your car crashes and you lose your life. For us, it's the same. For the world, it's night and day. So I have five truisms from our world that will affect the physical world. And I'm going to go through them quickly because you've all heard them before. Number one, most software is poorly written and insecure. We have prioritized features, speed, and price over security. And that work great when it didn't matter. It'll work less so when people can get killed. Two, the extensibility of the systems we build means that everything can be used against us. We can't build computers with limited features. They are computers. They can be enhanced. They can run malware. There's a reason you can run malware on your DVR and not your old mechanical toaster because your DVR has a computer that can be reprogrammed. So this addition of features either on purpose or by malice makes these really different systems to secure. Three, complexity. Complexity is the worst enemy of security for a whole lot of reasons. It means one, security is hard. Two, testing is hard. That toaster you bought was tested. It'll be harder to test a computerized toaster. Four, there are new vulnerabilities and interconnections. Security is not composable. You put together two secure systems and create insecurity. The Dynatac from last year is an example of interconnections causing vulnerabilities on that honing story of identity theft, target corporation, how vulnerability in their HVAC contractor led an attackers into their networks. You see this again and again. And the fifth truism is the way that computers and networks fail. They have different types of vulnerabilities because the internet is naturally empowering. It allows all good things to scale. It allows attacks to scale. The notion of a class break that you could actually simultaneously hack a million devices. That things can work until they fail all at once. Doesn't happen with non-computerized systems in the same way. And a lot of the intuition regular people have is based on that world. And of course, this is more dangerous as these systems get more critical. So we actually have to worry about crashing all the cars, disabling all the power plants. And unlike the real world, we're not concerned about the average attacker. We're concerned about the Five Sigma guy, the one smart person who will figure it out and write the software and distribute it to everybody else. That doesn't happen in lock picking in the same way. So these are all things we know about the internet world. That'll be true about everything. This is a lot of tech work being done on Internet of Things security. Lots of companies, lots of researchers working on parts of the problem. You see work in secure building blocks, in systems that assume insecurity, all sorts of things. You see about 20 lists of security practices, IT, Internet of Things vendors should be doing. I posted that on my blog earlier this week, sorry, last week. But we have a problem getting these adopted because until now we've left computer security the market. And it's worked more or less okay. And we've been okay with that because the cost of failure weren't that great. But IOT economics is different. There's a couple of reasons. First, your computers and phones are secure because there are teams of engineers at Apple, at Microsoft, at Facebook, at Google working to make them secure. And so this device has a large security behind it. People that patch vulnerabilities, people that update it all the time. And that isn't true for low cost systems like your DVR, your home router, where a team will grab some library, possibly open source, probably some binary, binary blob, no one knows what it does, get it working and then disband. A lot of these IOT devices can't be patched, even if there were engineers who could work on patches which they're not. And also, we replace these devices every year or two. And you replace your DVR every five to 10 years. You're a refrigerator every 25 years. You replace your thermostat approximately never. So we have big market failures here. The buyer and sellers of that DVR don't care about security. They don't care that it's in a botnet. If it's cheap and it works, it's fine. And we're seeing, I mean, Gartner has this number, 5.5 million new devices attached to the internet every day. And so there are two basic paradigms of security. Paradigm A comes from the world of dangerous things. Secure it right and properly the first time. This is buildings and cars and airplanes, medical devices. Paradigm B from our world be agile, patching, updating. These two worlds are colliding in automobiles and medical devices. I guess colliding literally in automobiles. And these paradigms have to collide and we're not doing very well at it. And I think this is a privacy problem. And what we are going to see is increased government involvement. We are going to see in our world people passing laws and putting restrictions on us. Because that's what happens in the world of dangerous things. And governments have a kind of limited toolbox here. They have ex ante things they can do. Regulations on products and product categories, licensing of individuals and products, testing requirements. They have ex post things they can do. Liabilities, fines. There are disclosure things they can do. Product labeling and transparency measures. Consumer reports like ratings agency. An NTSB like forensics agency. And then they can do things in our environment. They can fund research and education. They can use their own buying power to drive security. But that's basically what governments do. US is right now doing nothing. You move to Europe and you're seeing some of this stuff happening. The new general data protection regulations are going to come into force. I think that will make a big difference because they have strong requirements. There are rules on manufactured goods in the European Union. That's CE mark. There's already a CE standard for vulnerability disclosure. They're working on one for patch management. And this stuff gets incorporated through GATT trade protocols into what's being done in the world. And what's interesting about these international considerations is it's software. You fix it one place and it goes everywhere. And that's very valuable. And I think this is coming to the US. And I've been talking about, I'm going to talk about here at RSA, our proposal for a new government regulatory agency that we in the United States need a new agency to figure this all out. That it's not good enough to leave it to the Federal Trade Commission or to the automotive or to the medical agency. These are all computers and distributing it at piecemeal is not going to work. This is a horribly contentious idea. There are huge problems. You could list them as easily as I can. But my worry is the alternatives are not viable any longer. I think governments are going to get involved regardless. The risks are too great and the stakes are too high. Governments are already involved in physical systems. And the physical threats of the IoT will spur them into action. Not to mention actual robots walking down the street. My guess is the courts of the first branch of government that will give us regulations in the forms of liabilities and torts. But I think Congress will follow. Because nothing motivates the US government like fear. Look at 9-11 and the creation of the Department of Homeland Security. So our choice here isn't between government involvement and no government involvement. It's between smart government involvement and stupid government involvement. And when you just start thinking about this, especially how it affects open source software, you can easily imagine a liability regime that will completely kill open source. We have to think about how our community can thrive in a more heavily regulated software environment because it is coming. And I'm not sure what the answer is. I mean I gave you sort of the government toolbox. We're likely to get some of each and all of nothing. And how this balance goes is really up to us to decide. And this is my general plea. We need to start getting involved in policy. As a community, we rarely, if ever, have conversations about our technological future and what we'd like to have. We tend to build technology because it's cool and so we see what happens. We don't design our future. We let it happen to us. Now designing is hard. This is full of emergent properties. We're going to get it wrong. We're going to get it confused, but we need to start thinking about it. We need to start making moral and ethical and political decisions about how technology should work. I know I'm speaking to programmers, but for the past bunch of decades, we've all had this special right to code the world as we saw fit. My guess is that we're going to lose that right because it is too dangerous to give it to a bunch of techies. And that means we need to get involved in policy. As internet security becomes everything security, internet security technology becomes more important and security policy becomes more important. The policy issues, I think, are more important than the tech and we will never get the policy right if policymakers get the technology wrong. Think of the going dark debate. Think of the equities debate and vulnerabilities. Think about voting machines or driverless car security. We're in the process of screwing a lot of that up. And we need to fix this. We as technologists need to get involved in policy discussions. We need to be on congressional staffs in federal agencies, at NGOs, part of the press. We need to be in the middle. This is bigger than security, but this is what security is going to be. So quickly, my main points. I think the computerization of everything will change our profession profoundly. Like it or not, government involvement is coming. I think it's coming faster than most people think and we need to get ahead of it. And finally, we need to bring together policymakers and technologists. It's hard to do, but we need to get involved in the debates. Thank you.