 Welcome to the socialdashengineer.org, podcast number 120. So audience here just helped me realize that this is actually our 10th year anniversary podcast. Because if you do math. Math, yes. Math. And what one was I on the, as I was in the first year? Yeah, you've been on the podcast. Well, here, let's find out. Anyhow, before we do that, let's just introduce what we have here. Guest Robin Driek and my good friend Penny Carpenter. Thanks, Christy. Christina and Perry are interviewing Robin today. Oh my gosh. Yeah, so for those of you who are listening, the joke was we messed up on Perry's name on our 3,000 schedules that we handed out to DEFCON. And his name is Perry and we spelled Penny. So his whole team at NOBE before has been ragging on him for, I don't know, what, the last five, six days? Yeah, ever since they saw it. Yeah. And then Perry, to get back at me, promoted my books during his speech, which was really kind. But he said, you got to read all the books from Christina Hadnaggy. So, deserved. Yeah, deserved. You know, I kind of... He's a good looking Christina, isn't he? Yeah. Right in that shark wolf. Oh, no, no, that's an Evan thing. There's not even talk about that. That was a great podcast, though, but Evan perverted that image of that podcast into something scary. Have you seen it? No. No. Okay, Evan, I don't want to, but you got to show Perry. Yeah, I know. But Perry should see it. The only thing that would be worse would be seeing Chris in a clam shell. I think that would be great. I mean, personally. Look, here I am searching. Yeah, that's it. That's it. Yeah, there you go. Yeah. Like WWE. The more I look at it, the more it hurts. Yeah. Now you have PTSD. Okay, so I was here. Look at this. I was trying to answer your question, Robin, while doing this. Okay, so you were on... It was 2008. You were on episode 99. Okay. That was early. You were on episode 78. And you were on... Man, I think I have you on this show too much. Yes. Usually it's the fill-in. Look at this. You were on episode 42. There you go. I think that was the first. I don't think that was the first. What year was that? And then let's see your first one. You were on episode 20 in 2000. No, you were on episode 16. Yep, there you go. So yeah, we known each other a while. Boom. Well, that was the first one. 2010. Yep. December 13th, 2010. Yeah, okay. Yeah, we known each other a while. Yeah. That's crazy. Yep. So Robin came here this year to talk about... Sizing People Up. That's actually, yeah, the next book coming out is called Sizing People Up. You know, started, actually the first book, you know, that Chris has made a cult classic was, it's not all about me. And literally, I don't know if everyone knows a story behind that one. That was actually because Chris called me last minute one week and said, hey, we had a cancellation on our podcast. Can you fill in? And he's like tomorrow or actually many of them in this afternoon. It was, it was that, it was that. Same day. Yeah, like a Sunday afternoon, I go, okay, what do you want me to talk about? And he goes, I don't know. How do you develop rapport in 10 minutes? And so I literally came up with my 10 techniques to quick rapport. At the same time, a mutual good friend of ours, Joe Navarro, was pumping me to got to write a book, got to write a book, got to write a book, got to write a book. And so I literally took that, what I did in the podcast and made it into the first book. Wamo Bamo. And you think I would get royalties since the book idea was my, my idea. Yeah, well, you made up for it with unmasking social engineers like half me. I had to get money out of the idea somehow because he wasn't giving me royalties for all the hard work I put into that. No retribution because he credited me with it at least. That's right. See, at least I credit. I didn't get anything. It was very good. Now, but I do, I do, I do promote that book quite a bit. That was good. Oh, yeah. So anyway, the next, so from there we went to Dakota Trust because life's a continuum. Literally when I first started, you know, teaching and working these things, I really thought it was all about rapport. But once you get really good at rapport, what's the purpose of rapport? Repor is actually the purpose of this trust. Because ultimately, you know, what I've learned from Chris, you know, in the world of social engineering, and as you all know, there's, you can't get anyone to do anything without some semblance of trust, whether you're doing a phishing attack or whether you're trying to be a great penetration or illicit information when you're doing, you know, capture the flag type stuff, you're not going to get anyone to divulge anything without trust. And so I realized, well, I'm strategizing trust as all I ever did with my behavioral team when I was running with it. And then, then from there, the next continuum became, wow, if I'm actually so focused on the other person to understand how they want to develop trust, I'm actually able to start predicting behavior. And so, you know, I call it, you know, sizing people up and it says predicting who you can trust. But ultimately, it's not about who you can trust because trust is based on a lot of people's individual morals and ethics, which can be all over the place. In other words, and also people associate liking someone with trusting someone, and you can. So it's all about understanding what I can reasonably expect everyone's going to do in every situation. And really, because the whole purpose of everything I do is building healthy relationships. I never need a quick fix of illicit information. I'm always looking for a longer-term relationship-building factor. And the reason why I like sizing people up and what I did in the next book is so if I can understand and reasonably expect what you're going to do in every situation, I know exactly where to set the bar. So you're going to either hit the bar or exceed that bar. So I will never be disappointed in someone's behavior. And now here's what's really good too. It's because I spent so much time understanding this other person and what I can reasonably expect they're going to do. If for some reason they fall short of that, well, then something's going on in their life. And so now I can reach out and see if I can be a resource for them and what's going on. So yeah, you can use it to behaviorally assess people because I have six signs of predictability with like 10 tails per sign. But the whole purpose of it really is to help you continue to foster good healthy relationships. And then Perry, you came and you give a really interesting packed room speech. What was your speech on here in Essie Village? Yeah, so mine was as somebody that's on the autism spectrum, how I've used different social engineering skills, some knowingly and some unknowingly all throughout my life and career to get to the point that I am now. So kind of breaking through understanding things related to rapport and even some things that kind of I even had to put a warning before one of the slides because they sound kind of sketchy. They sound kind of premeditated, methodical and cold when you put them into practice or when you just read them that way. But for me that the heart was genuine because I did want to build an actual connection. But one of the things that people on the spectrum can deal with is showing emotions well, being able to emote well and then actually feel a genuine connection or be able to read the other person. So I've learned how to kind of in the most genuine way possible mimic that and bring that to whatever relationship that I'm in. So how many of you have become the DEF CON for like more than five years or so? Billy, you ever think you'd be sitting at DEF CON hearing speeches about like rapport building and being on the autism spectrum, right? That's kind of interesting, isn't it? That we've kind of shifted as an industry to really start focusing on understanding us as people and how we work and how we think, which I think is pretty fascinating. It's a nice shift to see that at Hacker conventions that we're having these open discussions. So one of the things with the format, if you haven't done this podcast before here live, so we have a mic there in the middle. This is open format. So if you've got questions for Robin or Perry and you want to come up and ask, if you can do it in the mic, that would be great because then we get it on the recording and people who are listening can hear that. So anytime you want to say something or ask something, please just come on up to the mic and grab it and ask. You know, and to dovetail on what Perry was saying, I have actually had so many people reach out to me because it's a method and a procedure for rapport building with either Asperger's or somewhere on the autism spectrum saying that these things help so much because you make it a process procedure. Matter of fact, there's this great young guy, his name is Philip, literally he reached out to me via LinkedIn I think, probably about six months ago, you know, read one of my books and said oh my gosh, he's helped me so much. He literally just graduated from law school out in Berkeley and he's constantly reaching out, you know, to communicate with me and that's what I encourage everyone to do. If anyone ever wants to reach out to me, I'm probably going to kill me now, you know, but I'm really available and so he literally reached out to me the day before he was taking his bar exam, looking for motivation and you know, to do this and I'm like, how can I motivate you? He's got six languages, he's about to take the California bar exam and I said how the hell can I motivate you? And he's like, I'm really nervous, really nervous. I said, well, you know, are you passionate about what you do? And he goes, very passionate. I said, well, you're not about to take a test, you're all you do is about to share your passion with a bunch of people that can't wait to pass you. You know, because one thing I love about what we do, you know, whether you're sitting in a booth or you're speaking to a large audience, like you're talking Perry, you know, how you struggle really to shift our context about how we see the world around us. You know, and just the other day, you know, when we kicked off the speaking thing and I had, you know, we had sitting room only in the front, you know, for, you know, my speech the other day, some people could get nervous at that because everyone's always feeling they're going to be judged, but it's actually not. You have the power to say, instead of, you know, I have a thousand people about to judge me, no, all I'm about to do is have a great conversation with a bunch of friends, you know, and that's what it means to hear you share your information and sharing knowledge. Yeah, I agree. So one of the things that if you're ever on a stage like this or you're put in a position where you're leading a roundtable, people want you to succeed. That's what I had to realize is if they put you there and you're on the stage, they don't want to have this excruciating 45, 50 hour long time of somebody that's just struggling. They want that person to succeed, so they're behind. They also believe that you're an expert and that you have something valuable to share, otherwise they wouldn't be filling the seat. So everybody's on your side, and it is a conversation, so if you look out, you can get a lot of feedback from the audience that's valuable on where you can take the next piece. That's a really valuable point, and I think especially like in the different, such different topics, when you look out in the audience, you can really connect with people who are staring at you like, oh my gosh, I identify, I was sitting over here and every time you would talk about some discomfort you had in your life, there was just like, these people were just doing this, and I'm like, yeah, they identify. I was hearing you, and I don't have the same issues, so I hear you and I'm like, wow, that's really interesting to hear that, but those people were identifying with your feelings, your emotions. And I'm like, yeah, you're connecting with all sorts of different people. It makes it really easy too. I love speaking in large audience, because what you do is that you're scanning, you're looking for, I'm looking for smiles. I'm looking for heads, nods, and smiles. I'm looking for the positive and courageous. I remember years ago, when I was doing a lot of undercover work in New York, when I was with the FBI, someone asked me, so you have a big room full of people that you need to go engage. How do you choose who to engage? I said, that's the easiest thing in the world. Look for someone who's smiling, because these are the people, even the other day, doing the capture to flag stuff, the first thing, remember, I can't be a receptionist that gave a giggle. I said, hang up that phone, talk it from anywhere, let's go back to the giggle girl. Because there's someone who's looking forward to engage. So I'm always looking for those positive social encouragers that you're going to see, head tilt, nod, smile. I've done the same thing, so one of the things that I learned several years ago was street hypnosis. Really informal. If you're starting to think about stage hypnosis, you can tell who some interesting people might be, because as soon as they bring up the word, they're going to lean forward and they're going to start really trying to soak in. It's like, all right, if I'm going to do an experiment, I might want to find those few people and start with them rather than the big process that everybody else always goes through. As a matter of fact, I can tell you exactly where Stephanie sat the entire time, because she was the big one right there. Smiling though. Big personality going. I think we have a question. I have a question about sizing people up and building trust digitally. You're never going to meet this person face to face. How does that work? Believe it or not, I think it's easier. When I have a longer than 50 minutes, when I do my full two, three, four hours, if you come to S.E. Village in Orlando, you'll see some of this. What I have is I actually demonstrate through emails exactly my methodology for making sure that every single statement I make is completely about the other person. When you're doing it live, it can be challenging because you've got to really slow yourself down. And I said during my talk the other day what you basically need to demonstrate in everything you say, either verbally or in writing, every single statement has to be about the other person where you're demonstrating affiliation and you're demonstrating their value. And the way you do that is every single statement has to either seek their thoughts and opinions, talk in terms of their priorities, and who they are as human beings without judgment and empower them with choice. So a great example, so I'll just use my kids. So there was an instance a number of years ago, my son's a sophomore in high school and one of the teachers had misgraded an exam of the entire class and we think it was the wrong grading key. And she was really dug in, she did not change in her mind. So my son, my wife asked me, he said, Dad, can you help? I said, sure. What's our goal and objective? She said, how can we inspire her to want to check or craft, put together an email you want to send and all I'm going to do is go line by line and make sure that every statement is about her. And they had an opening statement that was okay that said something to the effect that Kevin really enjoys your biology class. And I said, Kevin, do you? And he said, yes. I said, why? He said, because I like how she expands upon a material and make it about real-life scenarios. I said, so that's good. That's a specific validation of one of her priorities because she said it began the year. She was appointed in his midterm grade. There's not one thing in that statement that is about the other person. And so what I added to it was, you know, Kevin was really excited to take the exam because he wanted to demonstrate his passion for science like you said you wanted to share in the beginning of the year and he was hoping he would have done better on his midterm grade. What do you think you might be able to do to maybe work with him in extra credit? So all he was doing was validating her, seeking thoughts and opinion and empowering her with choice. So I added that into the statement which made it about her. The other thing that she did there is you didn't invalidate the fact that she was digging in. You didn't say, I think he used the wrong key. You said, is there something extra he can do? And so it was really funny. So the whole theme of the entire email was seeking her thoughts and opinions about what he can do to improve himself. Yeah, that's great. And so it triggered her to want to take a look at his test score to actually see what he got wrong. And so he went from a 69 and the rest of the class had failed to a 99 and got one wrong because now she went back and checked the grading key and I talked about it in my speech also. I'm never about convincing people to do things because convincing is about what we're trying to get someone to do. How can we inspire her to want to? So that's why I'm always thinking in terms of inspiring people for things because when you inspire someone to do something, it means it's about them, about their priorities and you're talking in terms of that. You took the defensiveness away. Absolutely, because people are here's a guarantee in life. There's so many guarantees with human beings. I can guarantee what every human being is doing today. You're always going to act in your own best interest. Safety and security and prosperity for yourself is our number one genetically and biologically coded thing. It's just up to us to understand what they think is in their best interests. And one of the things that people always talk in terms of is their own priorities. We had all those dopamine and oxytocin conversations going on before, which is really, really pure because when we're talking about our shelves and sharing our own thoughts and opinions, which is roughly 40% of every day, our dopamine is being trusted in relationships, takes that 40% and gives it over to the other person and seeks those thoughts and opinions, talks in terms of their priorities, validates them without judgment, empowers them in choice. Even when I was still working with the FBI, one of the last statements I'd always leave someone with that I did a first contact with or I'm hoping to do something patriotic, I'd always say and if you never want to hear from me again, please let me know and I'll make a little note never to bother you. I always let everyone completely off the table and say good, get away. Why? Because that entire conversation was completely about them. I mean one of my favorite questions ever is think about the healthiest relationships, the strongest relationships you have. Even right now, just listening, think about it. When during that last conversation you had with the best friend in your life, either your spouse or anyone, just great strong relationship, how often during the last conversation did you seek their thoughts and opinions, talk in terms of what was important to you about judging them and if appropriate you gave them choices. Anecdotally I say roughly 5 to 10 percent. Now when you increase that to 100 percent how strong you think that relationship is going to get. That's why people when you offer them an opportunity to walk away from you, they never will. Because you get their dopamine flowing more solid than anything else. And the cool thing is, you know, on my side, I don't lie, I don't use deception because I have found, you know, it's easy to elicitation, you know, why you feel misstatement and everything, but if you have time and you can benefit from that longer relationship, I never use deception. Because once it's discovered or even suspected, you'll never go anywhere. I can't stay away from the microphone, you know me. So along the lines of those thinking, I don't need a microphone, you know I'm loud, but along the lines of those thinking, like serious question here, when I told people I was part of this competition and kind of what it's about, I would often get accused of, well, you're just manipulating people. All you're doing is, like, you're just being manipulative and even, like, talking to people at the conference when they found out I was part of the social engineering village, they get a little bit like, oh, I don't want to talk to you. So, like, what's your response to that, like, you know, as far as, like, you know, using in business or interpersonal relationships, you know, how do we address that when people, like, you're just being manipulative almost in presentation all the time. So I'll give mine and then, you know, if you want to, because I'm taking all Chris's time, sorry, Chris. So, and I struggle with that. Matter of fact, my first book, it's very manipulative and here's what I mean by that. So, if you're controlling time thoughts or actions of another human being, you're manipulating them. So first, come to grips with that because, you know, in the booth the other day, we were manipulating. But in order to get the skills and abilities, things do in the effect of them because, you know, we did no harm, we did no foul and what mitigates manipulation is transparency. That's why I love, you know, after, you know, the time in the booth, you know, going through these exercises, Chris publishes everything. So that's transparency because transparency and open-on communications mitigate any attempt of control of anyone because you're saying, hell, here's what we did. You know, if you want to learn from us, you know, if the company wants to learn from us because that, so great transparency and openness mitigates any of those attempts. But yes, in order to understand the effect that people have using these techniques negatively, you actually have to practice them and understand them. So that's what I'd say. Yes. In those moments when you're not having open-on communication, it is manipulation. There's no doubt. But the purpose of it is what? To get the skills needed so you can understand it so then you can use it. Does that answer that, Chris? Yeah, I mean, I agree. I agree mostly. I mean, we maybe differ on the definition between influence and manipulation, but I'd say it's influence then. Yeah. Yeah, I think, I think when you look at your intent, like, what am I doing this for? So if I, if I saw you and you were a target and I came across and my intent was to steal something from you or to, you know, get something that's one sided from you, that to me feels very manipulative. Having a conversation, you know, I mean the end goal of the competition is education. Yep. And it's not about proving, you know, we say this all the time, it's not about proving that Sally or Joe, whoever you were speaking to is dumb, that's not the goal. But if that was the goal, we'd be going for flags about that person. You know, who they are, where they live, what their kid's names is, and that's not what we're doing. We're asking about the company. We're saying, are you training your people enough to say, you're a liar? Oh, that was so good. I mean, and she didn't even have a conversation. So what did that tell us about that company? The previous conversation probably caught on to him and then shot an email out to the whole organization saying, there's something going on, this guy, whatever name he was using, this guy named Dave is calling, and he's Rob Green. Rob Green, that's what it was. Rob Green, you're a damn liar. Yeah, that's what he said. He was using Rob Green on every call, and she emailed out probably to everyone, this guy named Rob Green is calling, and he's not who he says he is. That was a drop the mic moment for her. Oh, it was great. As soon as he picked up and said, hey, this is Rob Green, she's like, you're a liar. Nice. Now that, to me, is a great lesson, right, because that company was doing it right. So whatever they were doing, they taught their people exactly what should be done, and that's going to go into the report that we actually saw companies this year for the first time, that we're doing the things that we want companies to do. We want, I want every one of my clients to be that company. Yeah, I thought it was a fascinating study, you know, because, you know, the industries that you chose, you know, we actually saw, you know, were actually, some of them were pretty buttoned up, pretty dang good. I mean, it was funny, for some of the contestants that didn't do as well, it wasn't because they didn't do well, it was because they actually had a company that was just really, really good. And also, most of the, we saw in some of the alcohol ones, they get off at two o'clock during the summer. That one beer company, the summer hours are seven to two, and it's like, oh my gosh, we got to work there. And that's actually a good, we should mention this, because I usually do that on the podcast here at DEF CON, as the theme this year was alcohol, tobacco, and firearm companies. So if you weren't talking about this, and the government agency, somebody actually mentioned that, I think on Twitter, like no, no, no, that's the wrong thing to say. Because that's what you said. That is true, I didn't say that. No, I didn't say that. I didn't know, I didn't say it was, I said it was ATF, the theme, and someone was like the agency, and I'm like, oh no, it's not that. So we were doing alcohol, tobacco, and firearm companies, and yeah, day one we saw, there was a lot of them that were buttoned up really tight, and they were not very good, regardless of the pretext. And then we saw a large number of, I think this is like a correlation we see every year when contestants come with a ton of numbers to call. So those who come on the stage and they have a hundred numbers on their sheet, they generally do really good in the calls, because if we get burned in one location, we can move to another, or they have many places to call if we're getting hang-ups or no answers, and then we'll come with like four or five numbers. Those are the ones where we're sitting here for 20 minutes going, ooh, this is going to be rough. Especially if we get the Rob Green, you're a liar. That was so good. It's just over at that point, you know, they're telling everyone in the company there's nothing you can do. So it was a fascinating year, maybe the first since we have been doing this for a decade that we had that much shutdown. Did you notice any trends between the industries on which one seemed more buttoned down? You know, it was interesting, the first day, I made a comment that it seemed like that alcohol was the most prolific. Tobacco was next, and then the firearms industry was giving us nothing. But that got disproved on day two. On day two, everything changed. We didn't see the same trend. So I don't know yet without analyzing all of the stats what we will see when we look at it. But I don't think there was one industry that was failing constantly. I think it was interesting. I think the people that stood out the most that were the most open were either the ones that worked from home because they didn't have as much connection with others. The connection of recently giving birth to someone I thought was really good. And then hitting good old boys from the Midwest. I thought that was really easy going as well. Getting an older gentleman on the phone that didn't quite understand how this computer thing, like the electronic devices worked and he was being walked through by us on the phone. I thought that was good. Basically you get good open people on the phone with their guards down. People that want to help. That's exactly what it came down to. I really loved the theme too about the job search. I thought that was really effective. That made it about them and what they were doing. They were doing an assistance theme which all human beings respond to because of their genetic coding. They made it about them by seeking their thoughts and opinions. Go keep going back. Seek thoughts and opinions of others, talk in terms of their priorities, validate them and empower them with choices. I thought the theme was good. We did. We had some interesting pretext this year that I think were also very effective. We had high effects on people and which ones didn't. Again, I think what we saw was internal employees' pretext tend to be the best. They tend to be the ones that make people the most comfortable. But the one that Rob was talking about, I thought it was great because when this guy got on the phone, he actually didn't sound like he was going to be helpful. He sounded a little bit like I was like, why are you calling me? And then he said, look, I'm not really even a contestant. She said, oh, I just gave birth to my baby three months ago. And it was a literal tonal change. It was like, oh, congratulations. And now they're in this tribe of new parents. And he was just like, okay, let me boot my computer. It wasn't even on. So let me boot my computer and answer every flag you have. I mean, basically it was like, literally, she was just like flag, flag, flag, flag, flag, flag, flag. I'm like, what is happening? You literally sit there and say, give me more flags. What do you want? She could have been like, hand me a new list because I'm done. It was unbelievable. Which was striking to me because this is my first year witnessing this. And we make a really big deal about the ability to communicate in the booth and just being great listeners of information. But the thing that struck me is you can teach a lot of people to do those kind of things. And if you're just being true to yourself, as we were talking about 70, but I thought the most striking thing was the people that did the best had the most accurate phone I can't do. That I thought was really impressive. So it definitely is, you know, to be effective at doing this, you need a great blend of your ability to do research and then your ability to employ that research productively. So I thought it's just not one skill that you have to be the master of both. And our top three contestants, the first place, second place, and then the third place winners, all had within a 30 point spread of their report scores. All like the top, the top report score this year was a perfect score. Wow. It was 220 points. She got every flag that could possibly be got. And the professional writing of the report, it was like bedtime reading of joy. Christy cried. I teared when I got an email because first it was a huge file. So it was like a 10 meg PDF and I'm like, whoa, what is this? And I open it and right away I see like page one of 127 and I'm like, oh god. So you know, usually when I see that it's like people, what they've done is they went to like Facebook pages and copy and pasted. And I'm like, this is going to be horrible. But the first page I'm like, oh, this is really well written. And the second page is really when I'm like, she knows how to write. And then she did some crazy things like social media pages, right? Go to the employee social media pages and they're like, hey, look mom got my new job, click. Zoom in on the background, which was their computer screen and circle the icons in the task bar. Oh, so they have Chrome open. Oh, they use Outlook. Like this is how she got the flags. And I'm like, what a genius way. Like not just looking for someone saying it, but analyzing the pictures that they would post and then getting the flags by looking at the icons or looking at their desktops or what type of badges identifying the badge. It was, she was mind blown. I found not just with her, but a few of you all on that did it. The most effective technique for listening is use what I call you must be. You must be this. You must be, in other words, an intentional misstatement. Because then you're not asking questions then, which are alerting. They're making statements and either the person will either validate the statement or correct you. And so that's what, you know, that's what the good OSINT folks were doing. They're making statements. So you must be on your Dell computer right now, yes? They didn't correct it. There's the flag. You must be using Chrome again today. Oh no, you're not using, so again they're not asking questions or making statements and the human condition we all have is we want to correct others. We have an incessantly need to correct other people. So that's what they're playing on, which is great. Because they did that great research. And it worked really well. So actually, we'll just tell you, small group here, we're a block badge contest again this year. So I'm really excited about that. And Elythe is our winner. Yeah. And Joe is our second place winner. Yeah, thanks. They're not here. But really, really excited. So this is another year with two women. Two women. Stephanie wanted to know who was third place. Oh, third place was Ruben. Yeah. Yeah. It was so close between Ruben and Joe that it was like they could, I said to a man if you had just like literally sped up that last call and got one more flag, it would have been a different story here. Because it was literally that close. It was like a few points away, which is always worse. Now I'm going to lose, I'd rather lose by like a landslide. Because then it's like, yeah, yeah, you really beat me. But when it's two points, I'm like all I had to do was one thing, like now I'm ticked at myself. I should have hung up that phone with that other person quicker or just let it not ring as long. Yeah. And it's a unique vantage point because they're in this booth and there's 20 minutes. And that's a lot of pressure, right? I mean, when we do fishing professionally, we have endless amounts of time. We can take as many breaks as we want. You can get up and walk around, you can refresh yourself. And there's not 700 or 1000 people watching, you know. So you get people in this booth and they have all these people watching and there's so much stress and then you have, you have like Shelby sitting up there with the clock or whatever, you know, like this time or counting down in your face and the pressure, it's just so much. Because you keep dialing numbers and no one's picking up? Yes. And that's the worst. I think that happened a few times. So it was, yeah, this year to have again, the more proof to women taking the top slots that happened to me in last year. I think since it's been now six years that we've had women dominating this competition. We had a couple of guys win, but they're always in the top three or four or taking the winning place which is great to see. And it's fascinating too because, you know, going back to some of the techniques for building that rapport, you know, the second technique I talk about is accommodating nonverbals. And our vocals are nonverbals as well. And so you know, you had, you know, two women that had great vocals that were going and then Ruben his nonverbal vocals were very smooth, very, you know, and that's why, you know, anytime you can stay as close to the truth in your own life as you can, there's less ums, there's less pauses. You know, when you're asked a question, you're very fluid with the answer, and that's what exactly what he was doing. He was being real to himself. And so his nonverbals vocally were spot on. So you're not alerting to other people. You know, I mean, I remember you know, even just doing what I did for a career with trying to recruit people. You know, if you come in there, you know, say, hey, I need you to do this, and you're showing a lot of tenseness in your voice and aggressiveness. Like, oh, geez, forget it. I don't want to work with the government. I don't want to do anything. But as you kind of go in or kind of lack of days go, hey, if you want to do this great, if not, I'm fine. You know, whatever you want, it's completely about you. You know, that's when you get people to want to engage because you obviously are taking it easy. It's not a big deal. And yeah, this is just a thing that everyone does. And so when you're nonverbally kind of casual like that, you're less alerting. So at those top three we're definitely like that. Now, there's something primal in that. I mean, it's the same reaction with dogs. People go to a dog and they're all tense. The dog reflects that back. But the looser they are. And our vocals definitely display tenseness or non-tenseness. Yeah, I'm always tense. And then we had Mission SD Impossible here too. And our winning person was a young lady who did it in a minute in 27 seconds, which was amazing. She got out of handcuffs, picked a lock, read three facial expressions, and then traversed a laser grid in a minute and 27 seconds. So yeah, it was quite an interesting year. Nice. Before that, we were hitting like three minutes, four minutes. We were hitting a bunch of different times. And then we had one guy get up and he did it in a minute and 47 seconds. And I was like, whoa, that's the time to beat now. I completely nailed it. She also was the single lifeline for every person that couldn't pick the lock. She would jump up and like, she was magic. She was like, she would touch the lock and go, and literally I don't know what she was doing. She would put a rake and go like this and it would just turn. I'm like, that doesn't make sense. You know. Someone to keep away from your stuff. Someone you want as a friend, not an enemy, that's for sure. Don't touch my things. So that was an interesting. She probably just remembered to go counterclockwise. It seemed like there were a lot of people there. Oh my gosh. So we had this big sign on top of the lock box that says go counterclockwise because previous years we had people and I mean we even drew arrows. We even drew arrows to say like, this is the direction and we have one guy get up there and like put the tension wrench in and treat it like a crowbar and he turned the lock upside down. Like oh my gosh, this is ridiculous. But yeah, we tried to make it as easy as possible with that. So it was a good year. Thursday we were on one of two villages that were open. That made me look like a rock star. Yeah. You are. But it was interesting because we had so many people in this room. I thought when I walked in here Wednesday to set up, I'm like there's no way we're filling this room. How many of you were here last year? Okay, so you know double the size. This room is double the size from last year and I'm like we're just going to be good. We'll be almost full. But Thursday there was people sitting on every square foot of carpet that we had. That blew my mind. And then Friday I thought okay, that's just because we're the only ones open. But then Friday it was like the same thing. People were just pouring in here. Crazy. What a good year. And difficult too because four hotels, right? Four hotels you guys get. You have to walk all over the universe just to get to different places. These funky little badges are everywhere. I had a guy that came in and he said someone told him there was something else here, some kind of contest. And he's like isn't that here? And I'm like no, that's not here. And then we pulled the map out and it was like sorry, hey good news. It's only 106 today. It was 113 yesterday so but it was a dry heat. And the locust plague left. So I guess that's good, right? I mean it's not the book of revelations anymore so we're okay. It's because you showed up Chris. We do have flooding in the room so I'm not sure what that says. It's a little crazy. But yeah we had some great speeches this year. It was just phenomenal. And I think I don't know what you guys think but this year we ended 40 minutes earlier than normal and I still think it was maybe a little bit too late. But I'm just curious because like what you all think because we were ending like at 8 or something last year and then this year we ended at like 720. And I just see that last speech people are like getting hungry and they want to go out to dinner. It was an extra stand in line to get on the elevators. Oh my gosh. Those elevators were nuts. I literally think I saw 100 people come off one one morning. It was like a clown car elevator. Wow. That sounds like a safety violation. Oh yeah. I was thinking about our little thing we do we get people to turn around in the elevator. I was literally standing on that one and I said there's no way you could get 100 people to switch around in the face of a rear. I don't think you could make the move because they probably were packed in there with sardines. They were shoulder to shoulder man. Yeah. Hit it up so we get it on the recording so people listening could. So I love the I mean the whole security through education and the positive I guess culture or our idea behind the social engineering in our company though it's probably multiple companies there's this culture of our data is more important than training the people and I have a hard time siding with any of the the stick the the termination because you you clicked one too many times do you have any I guess ideas on how to I guess help influence that type of I guess a more positive culture regarding security education. That's a that's a that's an awesome question by the way Lee and also a very loaded question because you should have asked that like 40 minutes ago so we had the whole time to talk about it. You know that the interesting part is I think and Perry would probably agree with this with what no before does we see that that culture and attitude prevalent everywhere and companies because you can protect data with a blinky box right so all you need to do is just put a box in the network and data is protected so the person gives it away the person gives it away and a culture change this is not the answer you're looking for but this is the start the culture change has to start from the top down you can't start it from the bottom up so if you're if you if you and your company are at the bottom you wanting that sadly is not going to do much because you have no power right the culture change in every company I've worked with that we saw massive shifts in that thought process it came because someone in the top went we need that attitude but you just said we need to be more security conscious and then they start making that effective change because if you start from the bottom up what ends up happening is eventually you hit that one manager that just hates your guts and then it all goes it all falls down but when you start from here no one can argue the same thing Perry yeah I absolutely agree and the other thing I'd add just on the the stick piece is that organizations that use the the stick just kind of blindly probably don't understand some of the psychological components related to fishing because if you're trying to to deal with behavior umbrella like I don't want my people susceptible to fishing you can make it them to where they're not susceptible to typos and that they know how to look at the header but you hit them with a different psychological hook then it's different and clicking on a link is different than downloading an attachment not submitting credentials is different than not BEC is different than all of the above and so if you're blindly saying if this person falls for three fishing emails and they're out of the company and me it could be that you're hitting different psychological things that you need to train on and they've actually probably got seven or eight different behaviors that you need to work through and then I take it from the from an overarching thought process and that is you know definition of crazy and that is you know if your company keeps getting scammed and keeps getting taken advantage of then keep on doing the same thing you will not get a change in the results and so if you if you don't like the results of what we're doing you know that we're getting hacked a lot well then you got to change something up and so then you empower them with choices well we can do training we can do this we can do this because if we don't change something we're doing it's going to continue to happen it's just a guarantee and think about you fire a person for failing you replace them with another human with no training they all of a sudden superhuman and they're not vulnerable and that's so the follow-up to my that's not the answer you want is that if you have that thought and you have any power at all it's making that argument with the people in power is that it's better to keep the human there that can be trained than to keep replacing the humans that are just going to bring in more vulnerability so it's you know and then the ROI is what they need to see so let's use phishing training since you know we have Perry and I do the same thing up here the ROI for any one in power is let's look at that those metrics and it's not click ratio Perry nailed it it's not click ratio is useless I'm just going to change the tactic and you're going to fall for it the ratios are how many people are reporting these how many people are reporting these and either clicking or not clicking let me show you that statistic and that's the ROI because if I can show that that reporting stats going up every month you're spending your money wisely click ratio is stupid who cares about it right you know there's there's another component to this that people making purchasing decisions seem to ignore or just be blind to which is firewalls secure email gateways in point protection they they all have a failure ratio involved and you look at the money that people are spending on those technologies that have natural gaps in effectiveness that we're extremely aware of and they're not willing to say all right well it's up our security awareness budget by however many percent because they feel like it's a losing game we've already proven that the technology has a gap as well so why not try something different what's the worst that could happen is oh you you upped it by you know two hundred percent now you're spending fifty thousand years opposed to to whatever you're you're spending a lot more on the bleaky lights things that are have already shown to have some weaknesses we have another question all right so for somebody like me who has a teaching and psychology background what sort of company should we sort of pursue to look to if we were getting into this field as a job you mean or so you want to do a career change you know that's a question I think I don't know if you get that all the time Perry but we we get that question probably like once every week through email because this you know look this is a great field to be in and it seems to right now at least be like recession proof and stuff so it really depends on and maybe Perry have a different answer but it really depends on what you want out of the future but you need to find a company that will allow you to use the skill set you already have and apply it to one area of probably info security or cyber security so when people say they're teaching and psychology my mind automatically goes to social engineering of course I'm a little biased but companies that do security awareness training and I'm not talking about CBT's CBT's to me is not security awareness training unless you apply it with something like like what know before does right so you fish a person and then you educate them that's a great way to use those tools but just slamming people with 20 minute videos it's not going to make an effective change yeah the context of somebody's life and their psychological position at the time is the key to whether a CBT or a video or any other kind of interventive tactic is going to work at the time so if you say you've got a teaching background and a psychology background there's great potential for you on the SE side there's great potential for you on the awareness design side because it is all about understanding population groups and figuring out the best intervention for a population group at any given time and all that comes down to training that you have that most of us in the security field are blind to and so you bring an immense amount of value into either of those two contexts and a great way to do it is by coming to conferences like this bringing a stack of business cards and handing them out to companies that you hear that you like and you say hey if you're ever looking to hire you know like bam here I am you know you don't want to blank at DEFCOM with your business cards that's a bad idea but you know listen listen yeah yeah my name isn't here's my phone number please don't hack me you know then you're going to be on the wall of sheep and that may be like Stephanie gave out her cell phone number the other day yeah I mean people like Stephanie do that but you know normal people don't I mean you weren't normal but you know you don't want to do that Stephanie's got a DEFCOM drop phone yeah yeah nice but you know when you listen to speeches or people talk and you're like ooh that company sounds like something that resonates with me that's a great time to be like hey here's me let's have a conversation sometime I've hired people because of that right because I met them at a conference I've got a card watch them grow listen to some things they do read some articles they wrote and like yeah this actually can work I'm sure no before has done the same oh yeah I mean so here's the thing that I would do too is if you're interested in social engineering or just what's technically called awareness which I know we all know is broader than that but that's the market term go out and and look and when you see things that say well you need 5 years of security experience or 15 years kind of ignore that and try to have a conversation get in front of a recruiter so that your resume is not auto filtered out because it's companies that are willing to kind of have a forward thinking way of approaching this that are going to start to have behavior change in their organization it's not doing it the same way we've done it forever which is give this the technical guy the reins on this it just doesn't work I think another thing you can do if you're into it is write about it yeah you know writing builds credibility you know people ask me you know like how you know how is it people find you to hire you it's like because I'm published you know publishing is a great way to market yourself and your ideas and that way you know when you start handing out a business card and they Google you or you go on LinkedIn they can see articles you've written about the topic they're going to care about your thoughts and opinions and your passion for it that you bring accessories if it's uniqueness you know like I think as a I went through adult education you know the IDC you know lesson design plans you know you like they're saying you bring that to the field and you combine that with your knowledge of psychology you know you can bring a lot to the field by talking about it and publishing it and then one last thing that ties in with Robin is giving a speech at a conference joining a contest like what we do here those things also get your name out there I mean there's so many people that have competed in SCCTF that were not in the industry at all and now own companies that do social engineering in second place Kevin you know she said she started this less less than a year ago yeah yeah yeah I mean you know people always I literally get this question on time aren't you like upset that you're creating your own competition and I'm like no because to me competition is like free sales people right because the more people out there talking about social engineering makes it it's not my mission in life it's all these other people are talking about it and then everyone else is hearing and they're like hey maybe we should listen to the social engineering thing so it works right so getting involved in some things like that could really help you build a reputation that will make it easier for you to find a job within that so I'm going to ask kind of an interesting maybe not rabbit trail question but kind of technical question I'm familiar with what's called adult learning theory which is taking a group of people and using facilitated guided discussion to help provide an education model so it kind of uses the wisdom of the masses and filling in those gaps is there anybody doing that for end user training that you've ever seen because it's kind of it's longer but on the other side it tends to change in the process more and by all accounts it looks like that's a very effective means to train somebody I don't know I don't know if it's the this exactly fits the model you're talking but I would say in like let's use fishing education our model and I think you guys follow the same thing is when you fish people and they get trained you're not asking them to keep it quiet this discussion around the water cooler and then at least with some of our clients we try to incentivize positive by rewarding the positive and training the negative instead of punishing the negative so incentivizing and rewarding program we have some really stupid ones it could be a small bag of sweetest fish that go out to people who do the right thing every month those incentivizing get people to talk the talking about it is what's like oh wait you caught the fish this month and it creates an environment where people want to do the right thing and one client literally had like 1800 people in this one department and they bought a plush Nemo doll and they sewed a crown on its head and the first person to not click and report the fish every month got the Nemo doll at their cube so it was like and you would see 1800 grown adults fighting for the stupid stuff fish at their cube because they were the king or queen fisher for the month right and it's really silly it sounds really silly but in my mind when you ask the question it kind of fits that model where now there's a group of people all teaching each other and discussing the education because you incentivized the positive perhaps you just described a decentralized learning theory model across an entire company you're looking to shift a social consciousness and social conversation across an organization so I actually had the idea of a book in my head called conversational security awareness which is just all about the social aspects of it a different one from the transformational security awareness I'll stick with the IAL that's Perry's book oh that sounds from oh I look over and it's transformational security awareness copyright we have another question yeah I'm from the Carolinas so I'll take 115 degrees of dry heat any day over 90 degrees of 90 percent humidity so I love this my hotel is two miles from here and I walk there and back every day it's wonderful dear god sir you need help my question is this in sales engineering and have for eight or nine years that's 50 percent technical and 50 percent social engineering it's all about relationships and it's all about convincing the other person on this other table that you're their friend and that they like you at the end of the day and I still haven't gotten over this so what I'm asking is advice at the end of the day it still feels somewhat disingenuous to me because I have good friendships with my customers my customers are people that I work with and try to help them find solutions now I'm not trying to deceive them at all I want them to find the best solution for their company that's my goal but the relationship I think it feels lopsided they feel like we're much better friends than I feel like we are and so I go out of those meetings and those interactions sometimes feeling I don't know just uneven if you know what I mean it could easily be the same thing I worked with confidential human sources some people call them snitches or whatever you want but people I worked with are great patriots and when I retired I'm in touch with every single one of them still because they are good friends as well because here's the difference if you take the time during these engagements you're doing really well so one thing I always have people do is discover people's strengths write them down every individual you're working with because when you take the time to figure out their priorities and you take the time to figure out what their strengths are you're going to start forming a deeper understanding of them and it's going to start feeling less lopsided because you actually are understanding them at the same level you understand the other people in your life and then you're making those human connections and when it comes to selling selling is nothing more than understanding someone else's priorities and offering them resources in terms of those priorities so when you understand what their priorities are it becomes very congruent and it becomes very genuine and very sincere and that's what comes across I also think it's I can't answer this for you I don't want you to say it here but if you love your product and you really believe in what it is that you're selling and you believe that it's going to benefit the person it's also a reframing of your thought so for me and my whole team will admit this I am the worst sales person on the planet earth I don't even know how to market things that I'm doing presently like I got my team saying can you mention this more and I don't because I always feel like it's self-serving but we just hired a sales engineer and he says the same thing you have to believe this is the best thing for people we're actually helping people we're changing lives, we're making a difference and if you believe that and it's not fate then you should be proud to talk about these things but you should be proud about it because if you go out to a great restaurant and you have an awesome meal you're going to tell people man I went to this place down the road it was unbelievable why are you not afraid of that well it's the same thing with your product if you believe it you love it your services then telling people about it helping people connect with that makes the frame of your conversations much different I agree totally and I do feel that way are the best and the best option for our customers it's the friendship side of it or the relationship side of it that I struggle with because they'll tell me all about their kids and their boats and their fishing and whatever they're doing and a lot of that stuff I don't care about I avoid people I know when I see them in the grocery store I just don't want to talk to them either and my wife says I'm a hermit but yet I work in a sales field and I have to be a people person and for me that's not me I very much like to not talk to people but so it's kind of a weird maybe I'm in the wrong career field but it's kind of a weird dynamic but I understand what you're saying and I agree it's really funny though but what do they see you're giving them what they need though too I mean you're giving them validation you're talking in terms of their priorities you're giving them choices you're engaging they're obviously driving great joint benefit from engaging with you you just need to recharge your batteries because you're introverted and you need to recharge them somewhere else I wouldn't feel bad about it because again you're not are you being a shyster are you being manipulative no so you're giving them the best you've got in those moments is just you recharge your batteries not with them so it's okay I mean I do the same thing to people one-on-one or in big groups professionally and if you see me in Walmart I'll put my phone to my ear so that nobody bothers me or I'll put a set of headphones in and look like I'm having a conversation on the phone because I don't have the mental energy to deal with that right then that's exactly how I feel I don't have the mental energy to deal with that doesn't make you a bad person don't feel bad about being an introvert it's okay I will do the very same thing when I get on a plane I put headphones in because I know for me that if I start a conversation with the person next to me that three hours is going to be their life story and I just don't want it I would much rather save that mental energy for my wife and kids the people that really matter when I'm however old I'm going to be in a deathbed hopefully not hit by a car then I want to be thinking through the investment of time with my family and not necessarily all the frivolous conversations with people that have come and gone through my life it doesn't make you a bad person because we all have to figure our way to recharge got to manage your energy no problem I think I saw a guy coming down hey guys over the years I've had a lot of red teamers suffer from fatigue related to social engineering specifically I was wondering if you've had any experience with this on your own teams and if you have any tips for how to manage to that I've had a ton so every type of social engineering has its own stressor so right now we have a team of people that their main job is vishing so phone, social engineering and we do approximately 200 or so hours of vishing a month for our company so it's not a little bit, we're not talking like six or eight calls a week we're doing six or eight calls an hour per person and what we found before because I don't experience that fatigue so for me it was like well I don't experience it so everyone should be able to do these things and we were like burning through people like they were paper and it was like okay something's not going right here realizing that everyone needs a different conversation we just had a different way to refresh to recharge what we have done is reduce the amount of hours that they're allowed to spend vishing to recharge so you will not ever find a person who their full time job is vishing because it's too stressful, it's too much they have to take breaks they have to go do OCN or do other things or write or research because it's too mentally draining to do that additionally what we found is the strain of what we said before when you're social engineering you're pretexting you're being a different person your job is to get information from complete strangers you know I was doing a vishing call a few months ago and a guy was telling me about some problem he had with his computer I thought to myself I can fix this for him I actually can do it so I did it I walked him through replacing his printer drivers he was so appreciative he was like you're the best IT guy ever and then in my head I'm like I did and I got his share point credentials we used his whole account to fish the whole company and put a malicious document on his share point and send it out to the whole company this guy thought I was his best friend he invited me to his daughter's wedding shower when I hung up that phone I felt like the biggest loser on the planet earth right I mean this guy was like thanking me and invited me to a family event that weekend you're a very bad person yes after that call I don't I don't go yes more hacking I'm like I'm going to take a break I need to go maybe drink some whiskey I know it's 10am that's fine but I think it's a long story and I'm sorry for that but I think the answer is allowing your people to tell you when they feel that and then helping them find an avenue to do something else for a short period of time a few hours in that day to take a mental break from it because there is a stressor and being a different person and playing a different role and if you value your people you'll give them that ability to do other things so they can recharge refresh just the listening skills alone when you're listening to a listen is different than listening for a lot of normal relationship stuff the other thing that I would do is to constantly remind them that what they're doing has a greater purpose than them and it's for a positive purpose that way you can help them resolve the cognitive dissonance that's probably causing a lot of fatigue on top of that as well that's a great point yeah it's a very good point because when the other weather we're talking about before there's no dopamine flow there's no oxytocin there's no pleasure center in the brain going at all if all you do is you're thinking you actually have a sociopath and that could be a bad thing so that's a really great point because I got asked recently by a research group do I think that sociopaths would make better social engineers and the answer to me is no 100% no a great social engineer is someone who feels empathy they feel that connection with other people and someone with a large amount of empathy and I know this I have so many of them on my team they can't just do this 8 hours a day, 5 days a week and not break because if you can then you're probably not a very empathetic person so we have to find ways to recharge that empathy center for them and that is group discussions joking we like our group our corporate chats I think that's probably like 99% memes you know I think my team they speak in meme it's a whole language you know and having their ability to share their successes with each other and creating an environment where it's non-competitive right so like we don't make the team compete to see who's the best but they can share and their success they share each other's pretext they reward each other with positive comments creating that kind of a culture helps them build that empathetic center back up and then they're not so drained and tired and feeling bad thank you the most common feedback I get for the source of the burnout I feel like I'm being disingenuous I really appreciate it and they will burn out from that because there's nothing positive going on in the brain and you combine that with like you said being someone you're not the most psychologically strenuous thing I've ever been through the bureau, the FBI's got a 2 week under cover certification school and it's 2 weeks of being nothing but someone else I had to sleep for 3 days after that physical exertion, my brain was exhausted and so you combine that with no dopamine flowing because you're taking care of someone else in your own mind because you're doing these phishings, that's exhausting and it's traumatic on the system absolutely, thanks guys you're welcome, great question by the way okay so we are hitting just about a little over an hour here which is a pretty long podcast for us if you listen to it you know so maybe Perry just tell people about your book and where they can find out more information about you sure so I work at no so since this is a podcast you don't see what's going on Rob and just prop that up so the audience can see it so thank you for that yeah so the book is all around security awareness and security behavior management it's called transformational security awareness if I remember the subtitle is what neuroscientists storytellers and marketers can teach us about driving secure behaviors and so it's all about reframing what we mean when we talk about awareness and we're constantly dealing with this fact that there's a thing that I call the knowledge intention behavior gap which is that there's a gap between whether somebody knows something and whether they care enough to act on it and there's actually a gap between even when we care enough to do the right thing we might not do it because we fall into normal patterns of behavior or we're just human we've had a New Year's resolution that's fallen through you knew the thing that you wanted to do you knew why it was beneficial but you just didn't do it well security's the same way a lot of people know the right thing to do but in the moment for one reason or another they don't do it so this is figuring out the psychological and the behavioral levers around moving that behavior to where you want it to go and so that's available where all fine books are sold and then somebody hit me up on LinkedIn Perry Carpenter, Twitter, Perry Carpenter and then you know anything I've known before I think you should start a new Twitter call it Penny Carpenter I'll call it Penny at Vegas I'll have a whole I'll have a lot more followers than I've been right now you definitely will and Robin how can people find out more about your company and follow you yeah sure I'm easy I'm all one word that's my company and then on there you have links to lots of videos I do on podcasts and then on Twitter it's at rdreak, r-d-r-e-e-k-e and LinkedIn same thing Robin and Dreek and you can follow us like we have the SOC Engineer, Inc. Twitter account mine's humanhacker if I don't say this I think Jay's gonna come running over and punch me we have our SC Village Orlando conference coming up in the February of 2020 which you will see both Robin and Perry there because NoB4 is one of our sponsors for that conference and Robin is giving a workshop there all about how to profile people and size people up so some really exciting stuff going on I have a great lineup of folks there too I got my goosebumps now because this is literally the coolest lineup of people that are all my friends I've never seen all in one place it's like that Seinfeld episode where the worlds collide some of these guys I've known for like 20 years that are going to be there and the fact that Chris is able to get us all in one place at the same time I'm so excited not just to be presenting but also be attending so it will be awesome really cool, so I met Ian Roland, he's the guy from the UK who kind of invented the whole study into cold reading who trained my team 10 years ago and that's the part of it, it was cool Andy looks like Steve Martin I met him on the podcast I was a big fan of his books and I emailed him along with a few others saying I'm doing this conference, would you want to come and he says yes and I tell Robin hey I'm having this guy, I'm really excited I don't know if you've ever heard of him, he's like yeah I sat in his training class in the FBI like 10 years ago and I'm like well that's a small world right so he's doing a whole day workshop on cold reading and he said Robin's coming and doing like three hours on profiling this one I wish I wasn't running the conference I want to sit through this one he's coming to Varro he's coming and doing a body language workshop those workshops are phenomenal you can't get him anywhere that guy does like three things a year because he's so busy with lectures and speeches and he is being so gracious he's like he I don't want to ruin it because we just recorded this but I'm going to tell you anyway so he got permission from the government to talk about a process he used in recruiting and helped him catch three spies with just one technique he won't tell me what it is until you go to the conference you have to come to the conference and get what it is and I'm like you're killing me man we have Nick Furno coming from the UK also he's doing an OSINT workshop he's amazing our Paul Wilson which if you were here this was really cool because he was doing a show in Vegas he came to DEFCON and did a live demo with the card Monty how many people were sitting through that were you not guessing and still getting it wrong I was like no I just saw you put the card in the middle I'm like how did it move and then he folded a corner of one card and he's like now we have the card marks and now you know where the queen is somehow in midair he unfolded that card and folded another I'm like no we had a GoPro on the screen and I'm like that doesn't make sense to me and he was like I'm going to slow it down a lot here and he still did it he's doing that Stephanie Paul she's an actress a lot of really cool B-rated movies and she does a lot of studies in neuroscience she's talking about that Brittany Caldwell is a method actor she's coming in and doing a whole class on that and then Amanda Berlin is coming and doing a class on mental health mental health awareness for people in our community something that we were talking about so it's just a ridiculous lineup you know to have them all together at one place the biggest complaint I'm getting I think it was you Lee was saying I hate it because I don't know what to choose and I'm like yeah I get that but here's what I'm saying you know if we can make it successful these people will all come back next year and then you can just take the next course then right cause he treats people really well doesn't he I try I try I come for the food I gotta bribe them somehow food, money, hugs whatever it is so I hope to see you guys there in February I can't thank you enough for this year this was our 10th year anniversary at DEF CON this is our 10th year anniversary podcast 10 years ago if someone had asked me if this is what we'd be doing I would have never in my life guessed that 10 years later that we'd be sitting here with this size room with Rob and Dreek you know talking about this kind of stuff with a team like what I have so just it was such an amazing journey to know Chris right at the very beginning when after the podcast we get on the phone literally talking about how he wants to put a social engineering class together him and I doing it together launching the first one together he's known nothing and him taking loss so just so he could give the students great binders which I still have pens coins yet it's just amazing the amount of passion he puts into everything and brands and who he is as a human being taken care of I mean that's why I come anytime Chris asks me to do anything yes I don't you want to think about it no don't have to and then he regrets it after though I've worked hard these last three days last year after the first day of the SEC to have he's like so what's tomorrow and I'm like the same thing and he's like oh crap I'm retired I don't do this I guess my own company that's easy but it's just been a great ride 10 years and I look forward to seeing what happens in the next 10 so thanks for coming out you know we're cleaning up and stuff but stick around ask questions and see you travel safe thanks