 This is State Tech Hawaii, Community Matters here. Aloha and welcome to the Cyber Underground. I'm your show host, Dave Stevens. Dave the Cyber Guy, I guess you might call me. Today we're going to split the show again into two sections because we've had some events that we want to cover, but we also have some stuff going on here, right here in the islands, and we want to cover that as well. So first part of the show, for the first 14 minutes or so, we're going to cover the Hawaii Cyber Security Awareness Month that's going on right now. We have a great guest with us here from an organization called Cyber Huey. His name is Jake Ross. We also have our great co-host with us again, the networking guy, Hal Kolkeren, assistant professor at Kapi'olani Community College. Welcome guys, welcome to the show. Just so our audience knows, if they don't want to watch this, they can skip ahead 14 minutes past the commercial, and we're going to be talking on our rant about the Hawaii gun laws and the gun laws across the nation and talking about that horrible tragedy that happened in Las Vegas and hopefully how something like that could have been prevented. And I think the hospitality industry is reeling in Vegas over this one, that was rough. Let's talk about good news and happy stuff first. Jake, tell us all about Hawaii Cyber Security Month, but first tell us about you, where you're from, where you came from and how you got here, and then what is Cyber Huey? Okay, so I guess I'll start from, I guess the worm from I sort of wrote those down in my remarks, but I'm from Hilo actually. I graduated from Waikia High School, joined the Air Force after high school, kind of got my start there doing networking, long haul transport, got into the networking stuff, transitioned into the cyber thing that we call, what we call cyber today was just mostly information security. A few years ago, five years ago, Cyber Huey is about four years now. We started a nonprofit organization, Cyber Huey, and our mission is to inspire the next generation of cyber security professionals. So primarily we deal with the cyber patriot competition, that's a high school cyber defense competition. It's now rolls up from middle school up to high school. There's a civil air patrol, like Boy Scouts, Girl Scouts kind of thing. JROTC, and it's a huge contest. Right now we have 103 teams registered for Cyber Patriot 10. This is the 10th year of Cyber Patriot, and it's kind of broken up between the middle school, high school. This is a national thing, right? International cyber competition. It's international. There's some international schools as well. And these competitions, they do simulated labs, right? Capture the flag, pen testing, stuff like that. It's more defensive, so it's like the IT guy's worstie at work, right? It's like, hey, you're the IT guy at Company X. Oh, defend the mail server. Right, defend the file server. Critical services that must be 19, you know, Joe Quinn, we don't know what he did. No, I love that. There's a lot of focus on pen testing, and there's not enough on defensive actions that every company needs. It doesn't have to appeal, right? Yeah, well, it's not the matrix, right? You're more like the accountant, but IS. It's not a sexy, right? It's not a sexy, right? It's able to account, and then we win. It doesn't, it's not. So that's kind of the name of the Cyber Patriot competition, like IT Patriot, so there's a lot of marketing going on. But it's a really good competition. Hawaii's fared very well. We had Lele Huo went to the finals last year, so they take about 16 teams out of the, I think it was the 9,400 that enter, and they have a four-day competition, two or three-day competition in Maryland. They fly them all out, the mentors, some mentors, the students, and the coaches, and it's pretty cool. Wow, okay, so they get to see the East Coast and all this stuff, Maryland's like ground zero for CyberCon, right? Right, absolutely, and I guess that whole DC area, there's a lot of defense stuff, there's a lot of big companies out there, so it's nice. Northrop Grum is the primary sponsor, and they put on a good show. I love that you're doing this. A lot of people don't think about this, but Hawaii is right on the edge of the Pacific. We're the furthest south and furthest west state in the Union, and we're right here on the Pacific Rim in the middle of the Pacific Ocean, and target number one for any enemies that might be in the Asian sector, yeah? Which might be coming up due to our great relationship with our new administration and the leader of North Korea. That's going very well. So this is good that we're training people to be aware of this when they're young, right? We don't want them to get into college and say, what cybersecurity, when they're coming up through the ranks, right? I love that you guys are doing this. Yeah, I understand. You mentioned Lerahua. Right. Tell our audience where in the state that is. Oh, Oahua, Lerahua, and Oahua, up on the, I think that the central district of Oahua. So this is on Oahu? Yeah, central Oahua. So they, yeah, they've done fairly well. The last, I think they made it a couple years ago. I think they've been to the finals three out of the six times, I think they've competed in. They've been doing really well. They've got good manners. They have really good manners. They have, and that's the biggest part of the competition, is getting the mentors out there to, you know, just kind of like spread them and all right. Like, I know all these great things in my head, and it's not just like, how do you do networking, and how do you use security, and how do you windows and Linux hardening. It's like, how do you communicate that to high school medical students, which I think that's probably the biggest challenge. Transitional language is a challenge. It's tough. Yeah, it's tough. So in business, it's good to tell the kids how to use this language to translate from geek to human, right, because someday they're gonna be the cyber guy in a business, and there's gonna be business owners that really don't speak the tech language, and you need to know how to bridge the gap. Yeah, so this is great they have mentors like this. Yeah, it's good. It's really good, and I mean, kind of play into like the Cyber Security Awareness Month. So October is National Cyber Security Awareness Month. Nationwide. Nationwide. What does that involve? It's just a lot of awareness. So there's different groups that put together programs. There's some curriculum out there. The governor signed the Hawaii Cyber Security Awareness Month proclamation this week, and then I think we have a picture of that. We have the proclamation up there. Not that anyone's gonna actually read the whole thing. The picture. Oh, well, there's a picture with the governor right here. It's just a signing, yeah. And for Hal and I, we're so proud just to the right of the governor, Ege, there, is Rochelle Monson-Lugin. She's a president of our ICT club, soon to be part of the HATS club, or Hawaii Advanced Technology Society, and she's up at UH West now studying cybersecurity. Oh, there's the proclamation. There it is. It's great. And what is this? It's a little small. We have a summary. I'll give you the summary. Right, so it's just... We just read it. Cyber Security Awareness Month, there is, if you wanna read the whole thing, it's at the ohs.hawaii.gov slash cyber website. There's the pictures. There's our website up there now. Oh, there we go. It's a bit overlaid. We're gonna be having like 40 plus sessions throughout the state. Sessions to kind of just educate. Kind of like a component. You'll see the older folks at like malls and libraries of like, what is cybersecurity? How to be safe online? Massively important. It's, the big part we're seeing is that, like you were mentioning the students, there's the digital natives, right? And the people who haven't, who didn't grow up with the technology are the most, it's just so hard to... They're the most vulnerable, right? The computers really weren't mature when they were in the workforce. So now they're beyond the workforce and all they see is this wonderful device with the ubiquitous internet and the ability to communicate with so many people and socialize and trade information. And there's so many dangers attributed to that. And it's great that you're telling them, whoa, don't put everything out there. Here's some limits. Here's what you gotta look out for. And I think there's both ends of the spectrum. There's like the digital natives who are just so, I put everything on Facebook, I'm gonna live stream things and they're just not aware that stuff lives forever. So it's... Yeah, look what I'm eating for breakfast. Yeah. That's not everything. Here's my new cat, you know. So primarily it's that, also plays into the ISSA Hawaii has their 24th annual Discover Security Conference that's next week. There's also a ISSA International Conference which I'm going to in San Diego. So what for our audience? ISSA? The Information Systems Security Association. Okay. So that's... One of the certifications in the industry is the CISSP, Certified Information Security, Systems Security Professional, I'm sure I butchered that, CISSP. And ISSA is the organization that kind of like brings all their CISPs together, your security professionals together. So they've been doing this conference for 24 years strong. I'm going to San Diego to the international one and I'd like to plug ISSA Hawaii because they are primarily the financial driver behind CyberHoo and a lot of our efforts. But I was put in for an international award, a volunteer of the year award which I won. So I got a trip off to San Diego. So now you can get a night's sleep every once in a while now? Now that you've won the award? We'll see. We'll see. I can rest now if I can accomplish everything I wanted to. You take deep breath. San. I got the Emmy and then I got the international volunteer of the year award. So. Right. So it's really good. I mean, and ISSA Hawaii has just been fantastic. We just had this past Wednesday, Lieutenant General Nakasone, Paul Nakasone. He is the Army Cyber Commander and he came out and kind of talked to us about a group of about a hundred people or so. I'm sorry, we didn't get it all to you in time. That's okay. We're just a community college out there by Waikiki. We get forgotten every once in a while, but we don't forget you guys. Yeah, we're doing better. We're doing better about our media marketing. So, and we're always looking for volunteers too. So if you guys want to be our media marketing person, just let us know. Shoot us an email info at cyberguide.org. We volunteer way too much. We're hard to get any sleep ourselves. But yeah, these are worthy causes. We're so glad you're doing it. And it's okay if you don't get in touch with us every once in a while. We jump in the mix and we're all working as a team. We'll try. I mean, there's just so many efforts going on. And one of our big issues is that we work competitively with some of the organizations. So, Cyber Hawaii was just, they had their coming out party or they're unveiling at their future focus conference. Like they're the new big industry in town or nonprofit in town that is doing similar efforts to us. You have the hats organization and your community college organization. And we're kind of working next to each other a lot. We're trying to get more focus and working together. So, we brought in the hats people. We're trying to do more with them with your kits. I think what is it? They are actually going to rename to hats. Oh, okay. Apialani. So, hats was the original, a high tech, what is it? Hawaii Advanced Technology Society. Hats was the original computer club over at Honolulu Community College, right? And they have offered to rename all the other computer clubs at all the other campuses the same thing. But have chapter versions of hats so everybody can be part of the same club so they can do things together and all come under one big umbrella. It's a lot simpler, I think, and I think that's the way it's gonna go. And I think that probably a lot of benefits in doing that too, where it's like you're the kids, you're the hats, you're the, you know who. So having that one name, you kind of build that brand recognition. Oh yeah, that is a very good point. Yeah, yeah. And what we're seeing is that each campus has a little bit different take on cybersecurity. More Infosec over here, more pen testing over here. But if all the kids start coming together, that knowledge is gonna wash back and forth and give our kids a broader breadth of skill sets, right? And that's what we want, you know? And it's the community thing. That's one of the things I always drive back at. Like cyber who is a big community. We're not just inspiring the next generation. We're helping mentor the current generation of maybe you're a networking person who wants to get more into cyber. I've encountered some developers, software developers who are like, how do I get into this field? And we kind of point them in the right direction and hook them up with people who have made that transition. The big thing about cyber is that you come from a diverse background. Oh, yeah. Many, you can't just walk in through school. You have to have a lot of breadth of experience, yeah? Because cyber encompasses everything. Oh, right, absolutely. Physical to social, to programming and networking. You guys are gonna help us out in the industry, right? We got an event coming up this October on the 25th. You guys are gonna come out and have some poopoos with us and it's a big social event on our campus, right? For Wet Wear Wednesday, yeah. It's a pretty good event. Normally, a lot of people come out, so hopefully we can get a good showing and maybe we can kind of help you guys financially on there. So it's a good pitch. You can kind of get the, now that it's all there on air. Yeah, yeah. Hey, now you gotta give us some money now. Right, I got that. Basically, get the checkbook out. Start writing it. Yeah, right here on the show. I got the big check. I should have brought the big check for you. Oh, now that'd be cool. What else is going on? What else is, there's a number of events here. Do you wanna highlight any of them? In the last couple of seconds we got before the break? Yeah, I think we kind of hit on them all. I mean, there's a 40 sessions. You can hit our website. There's cyberhoey.org. We do a lot on Facebook. That's a primarily social media platform to Facebook and Twitter. And we'll try and get out there. If you guys wanna go to cyberhoey.org and there's a Join the Huey site, you can kind of sign up to get on our mailing list and we can get some information out that way. Great info for not only people here, but on the neighbor islands. So that information doesn't filter out to them very much. And that's for me too. Like I'm from Hilo, so I know the pain. You know the pain. I know there's all these great things going on if it wasn't just for that pesky ocean. Right, right. And it's not like you can just paddle over. You could, I'm just not in that shape. Now you'd have to meet some significant shape, right? Okay, we're coming up on a break. I think we got about 30 seconds here, but is there anything you wanna say in the last few seconds to promote you, cyberhoey, the Cybersecurity Awareness Month? No, I think we kind of wrapped it all up. If you have questions, go to the OHS.Hawaii.gov.cyber or cyberhoey.org. Or you can hit us up at info at cyberhoey.org. And there's your email up there too? Info at the- Right, that's you, the info. We spam everyone because we're so busy. One of us will do like committee. Somebody will do like you. You know like committee, absolutely. Right on. Okay, well thanks for being with us today. And stick around because after the break, we're gonna go on a rant. All right. And I'd love to have you be a part of that. Okay. Okay everybody, we gotta take a little break for a minute here and face some bills. We'll be right back with our rant on law and order, gun control, the Vegas tragedy. Okay, stay safe. Son, all the better to see you with my gear. Oh, what are you doing? Okay, cool. Research says reading from birth accelerates the baby's brain development. And you're doing that now? Oh yeah. This is the starting line. Posh. Ah! And this is over. You're dead. Read aloud 15 minutes. Every child, every parent, every day. Ted Rawson here, folks. You're a host on Where the Drone Leads, our weekly show at noon on Thursdays here on Think Deck. Where we talk about drones. Anything to do about drones, drones, remotely piloted aircraft, unmanned aircraft systems, whatever you wanna call them. Emerging into Hawaii's economy, educational framework and our public life. We talk about things associated with the use, the misuse, technology, engineering, legislation with local experts as well as people from across the country. Please join us noon on Thursdays and catch the latest on what's taking place in the world of drones that might affect you. Welcome back on the Cyber Underground. If you fast forwarded in this episode, now we're gonna talk about some things that break our heart. And we're gonna start out with the vaguest tragedy that just happened. The shooting of 58 deaths of some people were just attending a concert and doing something that they loved doing. And somebody who we don't know what the motivations are just decided to open fire on that crowd and randomly kill people. What we're gonna talk about now is some of the gun control measures being proposed by Congress. And why does this have to do with cybersecurity? Well, you'll find out in just a second. Back with us are Jake Ross of Cyber Huey and Hal Cochran of Kapiolani Community College here at the University of Hawaii System. Welcome back guys. Let's talk about some sad stuff. So Vegas. How? And we're just in Vegas. We did Black Hat and Def Con and actually Black Hat was in Mandalay Bay. That was my first trip to Vegas. What did you think of it? It was your first trip to Crazy Town. Yeah. It was an experience, I'm pretty sure. It was nuts, right? And of course they hold these conferences in the summer where it's thermal, nuclear, hot. And so every time we stepped outside, we just almost died. And a couple of times ago, it's stuck outside waiting for folks, right? It was hot and horrible. But right now, this time of year, it's kind of pleasant. And so they have outdoor concerts and they were holding an outdoor concert. And out of nowhere, people start getting shot. First of all, before I go into how this connects to cybersecurity, let me get your thoughts on this guys. I mean, we have pretty loose gun laws in this country. Agree, disagree, grow up with guns, not with guns. I'm just afraid that this is becoming the new normal. Oh, we're getting... Because we'll get desensitized to it because it happens over and over and over again. Sure happens a lot on the news in other countries too. And we've had our fair share and you're right. Is this the new normal? I hope not. I swear, I don't want to go there if this is the new normal. What do you think? I mean, you grew up in Hilo, kind of a rural area. What was a gun ownership like? You grew up wearing guns? I didn't grow up so much wearing guns, but a lot of my friends went hunting. Hunting, yeah. So there's tons of hunting on the beach. Rifles, lever action, stuff like that. All over the place, right? Not a lot of handguns, though. Not too many handguns, but yeah, I think when the gun control laws were starting to heat up, like when they were saying Obama wasn't going to abandon assault rifles, I know there's like a huge pusher when it was like the end of the Mayan calendar, right? Everyone kind of armored up for the end of the world. Oh yeah, 2012. That's right, yeah, yeah. So I thought it was a... Those kind of things that drove that. But yeah, I mean, it's like with anything. I mean, you can use cars responsibly, right? You register for cars, you register for your weapons. Airplanes. I mean, it's like, what this... It's the replacements, I mean, whatever the tool is that they're going to use to... And it's so hard because we don't know what the motive is behind it. So I think that's kind of... Motivations are scary this time, right? We don't know. And you're right, there's other weapons in other countries. We've already had people being stabbed and hacked to death with axes. And so I guess your method just changes based on the accessibility of the weapons. I grew up as a military brat, and we were joking before that, you know, part of my life as a kid, we were living in East Bay, San Francisco, that's Oakland, now it's a very rural community, I mean, urban, sorry. And it was rural back then, and our biggest concern back there was deer and raccoon. So we always had a lever action and a scatter gun or a shotgun over the fireplace, which, thinking back, probably wasn't the best idea to keep loaded weapons over the fireplace. Right. But you know, grew up in the country, that's the way it was. So I grew up with responsible gun ownership. And as laws become more and more strict on gun ownership, one of the combative issues I guess in the lobby for the National Rifle Association, the NRA, they come back saying we don't want a national gun registry because the government will have ownership of all these records of gun owners. And what if the government should turn fascist, which it might anyway, because of our current administration, but if it did turn actual fascist, they might come after the gun owners, right? And they didn't want a national database identifying all those people. My opinion, that's no longer relevant because all the gun owners in the Midwest are publishing photos with their guns on Facebook. We can go to Google and find out all the searches. Where's my local gun club? What's the best ammunition for my Winchester Model 7? You know, all these searches that can be gone through in big data, we can find out who the gun owners are anyway. Is this relevant anymore, guys? A national gun registry, is this relevant? This just makes sense. It's a tough issue, and partly because this is the cybersecurity side of it. Who's gonna keep that information safe? Yeah, it could be like everything. Equifax just gave it all up. Yeah. And before that, the Office of Professional Management, so our audience need to know that's Department of Defenses and several other organizations use the Office of Professional Management of the federal government to do security clearances. So they know my brother's middle name. They know where my mom was born. They know everything about me because I was a Marine and I applied for security clearance. And now because of them, it's all out there. And whatever wasn't out there because of OPM, Equifax filled in the blanks, you know. And now Equifax is getting a new contract. I was reading that Equifax was just giving a contract to collect and store data for the IRS. Like a seven million dollar contract. Great, that's great. What could go wrong with that? And we were joking that the IRS doesn't need them as a contractor anymore because all the information they're gonna provide is already in the wild. They already let that out, so they just go search the dark web and they get all the information they want. Yeah, the bar's pretty low right now. The bar is really low. So yeah, if we have a national gun database for registry of guns and it's shared nationally, which we're close to anyway, there's gotta be a safety net who's controlling that data. And I don't think it's a matter of if you're gonna get hacked. It's when you get hacked. And then how do you mitigate, right? Equifax showed us they don't mitigate very well at all. They're just more to the challenges. That was the worst. And in fact, the Department of Homeland Security found out through a website that Equifax was vulnerable in March of this year. And told Equifax, you're vulnerable. And apparently somewhere in the organization, the CEO in his testimony said, we issued an order to get this changed and get this vulnerability patch and it didn't happen. So they broke down inside. So the same thing can happen if we have a national gun registry database. Who's gonna manage that? What if it breaks down then? And I think one of the big things is people don't want their mental health records in here. So I guess a lot of states, like 47 states out of 50, say that if you're mentally incapacitated anyway, that includes, by the way, depression, you're not permitted to own a handgun or any kind of weapon until you're cleared by a psychological professional, whatever that is. What do you guys think about putting that kind of information in that national database? Is that dangerous? What could hackers do with that kind of information once they got it? Yeah, I think primary, like the Equifax breach where they're finding out it looks like more of a nation-state kind of attack. So it's not like your criminals or cyber criminals who are gonna monetize that information. Those are the worst, right? Right. They have the most resources, the most time. They can do it. It depends on what effects that they're trying to achieve. So I think something like a national database with medical records and everything in there is gonna be to their benefit if it's released. Or if it's put in one central place, but going back rewind is like, I mean, it's just like, what is the problem that they're trying to solve, right? So if they can kind of address that, I think we're kind of, maybe where we're sometimes at work, we've put the solutions ahead of the problems, right? It's like, oh, have I got a fix for you, right? And this is it. So you can see like, you know, this is the issue. And then these are the things that we can do to get that, the courses of action or whatever plans that we can put together. Maybe it's not a national database that we need. Maybe we just need better communication between the agencies. Then that way we don't have one, you know, big repository of this kind. We have a pretty good, I think Hawaii calls it the wrap back. When you register a weapon, they inform other states. So they share information. 47 states do this. I did not see on the list, Montana or Wyoming. And big surprise, Arkansas. Arkansas's got their own deal going on. And there's four states that don't share information with anyone else. So you could do something criminal or stupid or be mentally incapacitated or be formally committed to a mental institution in that state, go to another state and register your gun and get a new gun. And they don't check that. That's a little bit of a problem. Here's another one that came up to me, and this is an NRA proponent, came to me and provided this argument. I want to know your opinion. They said, okay, say we have a national gun database registries. It's all 50 states participate, right? If I'm a nation state and I want to attack the mainland of the United States, I'd hack that database to find out where the guns are gonna be, right? The heaviest concentrations of guns are where I will avoid in my attack. I will go someplace else where there's not a lot of guns. What do you guys think about that argument? I would think if I was a nation state and wanted to plan an attack, I'm not really that worried about the civilian guns. I'm worried about the army and armed forces, and more so than I am, you know, the civilians who are gonna come out with a handgun or a shotgun or something and try to fend off my army. Less red dawn, right? Less Wolverine. Yeah, well I love red dawn, that's the old one, yeah. No, I made the same argument, and this person came back with a little factoid that they found out afterward or two that, and I can't remember the general's name now, wrote a famous memo saying, we should not invade the US mainland because there's a gun behind every blade of grass. So it did affect their plans to take us over. There was a similar memo, rumored to have been in the Kremlin. We will not attack places like New York because, well, the Bronx, and back then it was a pretty hairy place. You don't wanna attack that kind of a city because a lot of people will rise up and fight that aren't in the army. So people you don't even expect, right? And what do you guys think about that argument? I mean, I think today the modern war is different from what it was in World War II. It's gonna be less kinetic, maybe more cyber stuff, right? Maybe cyber first, more cyber. Then maybe an EMP class? Oh, an economic. Like dime, right? The diplomatic, whatever, what it was, dime, military and economics. So that's really gonna play into it more than moving massive troops around. Because we have so many satellites in the sky, drones flying around, like you're gonna see that kind of troop movement. This is gonna be more of a remote war if we have a war at all. It's not gonna look like it did before. It's probably just little pockets of conflict rather than the whole world going to war, I hope. We don't need a World War III now. Wow, this is a lot of stuff to think about. But in our last minute or so, why don't you guys just give me what your chief concern is with these prospective new normal attacks that we're experiencing? Hal, why don't you go first? I mean, what's your chief concern? Besides being the new normal, what's your biggest concern about these kind of attacks? My concern is just the frequency. It seems like, I mean, they're happening so often now, more and more, and again, as I said earlier, I'm afraid that we're just gonna become numb to it. And it's gonna be just a normal thing. Oh, there was another mass shooting this week and we're gonna lose the outrage. Yeah, and we won't solve the problem now. This is the kind of thing that you should be outraged about. And if we lose that outrage, then I think we really lose something as a people and as a culture. As a culture, man. Jake? That's a tough question. I was thinking about it. I was trying to listen to Hal, but yeah, I think a lot of it too is that we live in this 24 hour news cycle and we get a lot of information. So I mean, I think part of it too is like, there's probably not more shark attacks, just more reporting of shark attacks. That's very possible. So I mean, I think there's a lot of factors. I mean, it definitely is, there have been, I mean, statistically more gun violence recently. And it's, I don't know what it's attributed to. It's culture plays a lot into it. You know, what are societal norms? And I think you kind of, we kind of hit on a couple of things about mental health, right? It's like, if I'm depressed, then if I get clinically diagnosed as depressed, I can't get a firearm. We had a lot of- So it might prevent you from getting exactly the help you want. So my biggest fear is that me or someone I love might be in that theater or watching that concert or at that event. And somebody I love might perish in one of these horrible attacks and it just seems like our law enforcement is not able to prevent only respond. And that concerns me. What's the solution? Okay, we're out of time. Thanks guys. I know it goes fast, right? That's pretty good. Okay. All right, everybody. Stay safe.