 Hello everybody, welcome to DEF CON 30s DEF CON groups VR. I'm your next presenter x-ray and I'll be presenting how to start and run a group. So if you've ever wanted to start and run your own group, whether it's a DEF CON group or any other kind of group, we're going to give you the secret sauce. So let me get to my slides here and I'll be right back. Okay. Can you all hear me okay? I assume so. If you're in the back, raise your hand if you can't hear me. Yeah, that always works. Okay. My name is x-ray. I run DEF CON group DC 404 in Atlanta, Georgia. I've been running that since 2013. I'm one of the co-founders of Atlanta locksport. I've also been an affiliates director of the International Jugglers Association, which is in charge of all the affiliate chapters around the world, kind of like DEF CON groups for juggling. I've also been assistant director of the Tampa Bay Jugglers Club down in Tampa Bay, Florida. Great club if you have one another. I'm also a member of the Atlanta Jugglers Association. We held an annual juggling festival. Now you're probably wondering what has juggling got to do with DEF CON groups? Well, the secret sauce is all groups work the same because all groups have a common denominator. It's called people. So while working at Georgia Tech, I was head of cybersecurity from college computing. I sponsored the student hacking and cybersecurity organization called Gray Hat and their CTF team, the Mad Hatters. I'm also a regular presenter of security hacking conferences and co-developer Network King of the Hill CTF, which by the way is a fabulous way of getting your numbers up in your meetings just to host a CTF. So if any of you would like to learn how to do that, contact me on Discord. I'll be happy to walk you through it. It's quite simple. It's Network King of the Hill CTF is designed for the lazy administrator as the original developer. That's exactly what he said about it. It's really easy to set up. Thank you Charmander. Charmander is one of the people I showed how to do it. And if you talk to him later, he'll tell you just how easy it was to do. Okay, so what we're going to cover in this presentation are the fundamental rules for any group. And these are things that apply regardless of the topic. One of the basic issues is who's in charge of the group. That's something that you have to understand in order to understand the dynamics of the group. Because if you don't handle that, it can cause a group to fall apart rather quickly. Another thing we'll discuss is why to meet what you're meeting about and how you figure out what that is and who your target audience is. And one of the biggest problems that most groups face is finding a place to meet and ironing out that situation. Another issue you'll run into as you start putting a group together is what equipment you're going to use. Should I buy the equipment myself? Should the group own the equipment? Can we borrow the equipment? We'll talk about those issues. Do we do presentations? Some group have presenters come in, DC 404 every month. We have a presenter come in and do presentations for us to the group. Hold on a second. Sorry, I had a spam call. You've got to live spammers. They're so persistent. So presentations, do your group going to have presentations or not? It's not required. Are they going to be formal? They don't have to be formal. We'll discuss all of that. Are there going to be any activities you're meeting? Those are things like are you going to have a lockpick village? You're going to have capture the flag, soldering station where people are to solder. Those are some of those ideas. What about governance? This is one that people commonly want to know about is should we be a 501 3C? We'll get into that and what that entails and why you would or would not want to do that. One of the biggest issues you're going to stumble across is money. What happens if we start getting donations? We have dues. We have things like that. How do we deal with money? We'll talk about that. Swag, that's things like t-shirts, cups, all those sorts of things with your logo on it. We'll talk about getting your logo, creating swag, how you can do that, ways you can do that. We'll also talk about advertising your group, where to advertise it and the most effective ways to advertise it. Let's see. Next slide here is fundamental rules. These are rules that apply across all groups regardless. One of them is the most important rule you could ever have in any group and it's something that nobody ever expects. One is you do not have to be the most skilled expert in the room in the group to run it. There are things you have to do to hold the group together and that's the thing that's actually important and you don't even have to be the best at that. You just have to show up and do the number one thing and let's be consistent. I cannot stress being consistent enough. That means if you have a meeting space, you're the first one to get there, the last one to leave. You're going to have to get there early because there's going to be people who show up five minutes before the meeting time, no one's there, they leave. If you're there, they'll stay or they'll show up and say, oh, I just wanted to know there's a meeting. I can't really come today but I'll try back next time. If they see that somebody's there, they'll show up again. They'll also show up five minutes after the event is over and say, oh, you guys are really here. I didn't know if you'd really be here and I waited until the last minute. I'm sorry I'm late and you're there and you talk to them. Be consistent. If no one shows up to the meeting, fine, watch Netflix on your phone. But be consistent. Show up early, leave late. If you can't make it, absolutely make sure somebody is there to cover for you or notify everybody that you're not going to be able to make it. But if you can all help it, always be there or make sure somebody is there. Being consistent is the absolute number one rule, hands down. The other thing is, when you're starting a group, you have to be patient. It doesn't happen overnight. Now to quote something out of a movie, we've probably all seen, the code is more of what you'd call guidelines than actual rules. So that means none of this is hard and fast. It's a matter of who shows up, how compliant they are as far as showing up. Some people won't show up on time. You set them on fire, they won't show up on time. It depends on what kind of group you get as to how hard and fast you have to hold these basic rules. But they're true in any group. Number one, always remember, be consistent. Now the second one is who's in charge. Since you started the group, you think you're in charge. Yeah, that's not true. What I'm going to cover next are the basics. I'll get into governance of the group, which is not the same thing as who is in charge later in the talk. The group is owned by the members. It's not by the person running the group. That's a hard thing to swallow, but that's the way it is. The purpose of the group is for the group. It's not for me. So although I kind of facilitate DC 404, I see myself as more of a host and a servant than I do as somebody who's running the group because it's not my group. If you make changes to what the group is going to do or how you're going to do things, you do that through consensus. You have to get everybody's input. Now, in the end, people are going to look at you to make the final decision. That's just the way human nature works. They'll make their, what they want known. And then you can say, well, the consensus of the group seems to be this, do you all concur? And I'll say, yeah, some will answer some won't. And then that becomes the decision. But decisions are not set in stone. You can always change something. The whole idea is we're hackers. We try things that work. We keep the things that don't work. We get rid of, feel free to throw away things that don't work. It's okay. Now, one thing that is really hard to swallow, and this happens from time to time, is you're going to start a group that has a particular culture to it. And that group's culture will change and go in a direction that you're not willing to follow. And when that happens, you're just going to have to gracefully bow out, leave it to somebody else to run, do a nice turnover, be friendly, and do a nice turnover, turn a group over to somebody else and go start another group or join a different group. That happens occasionally. It's not often, but it does happen. So don't be surprised if it does. It's not the end of the world. If you started one group, you can start another. It's not that big a deal. Okay, now the next thing is why meet? Well, the reason you meet is very simple. We want to talk to other people, just like we're here. We want to talk and hang out with other people who are like-minded into similar things. We say like-minded. Hacking covers a lot of things. Hacking is actually the art of discovering what something is capable of that the designer did not intend and determining whether that's helping me or hurting me. And if it's hurting me, I have to defend against it or help others defend against it. And if it's help, well, then we're going to tell everybody. Now, as an example of that, if there's anybody here, because we allow all skill levels at DefCon meetings, if anybody here is new and doesn't think that they're a hacker, I beg to differ, because you probably opened a can of paint using a screwdriver. That's not the intended purpose of a screwdriver. They actually make a tool specifically for opening cans of paint. You can get it at home deep on loads. That you don't have one. You use a screwdriver like the rest of us. That's hacking. Hacking is a mindset that applies to all disciplines, from golf to playing in a concert, to hacking networks and security systems. And social engineering, which we were talking about earlier. So one of the key things as the person who's hosting the group is be approachable. A lot of people are going to see about the group online. And when they get there, everyone will want to talk to you. So be available and talk to people. Be friendly, engage with them. If you ask them what they're interested in and point out other people in the room might be interested. Also point out, and this is so important, that all the people are at the meeting because they want to talk to other people. So they should not feel bashful or shy about just walking up to a table, sitting down and just start talking to people. It's okay. That's what we're there for. But people forget that and assume that they're not good enough. They're not skilled enough. I'm a noob. Well, I gotta break it to you. I've been doing this since the dawn of the abacus. And no matter whose backyard I go into, I'm an idiot. So you're, no matter where you go, there's always something you don't know. So that's just the way it is. And explain to them that just being a noob means they're a noob in my area of expertise. So that guy's area of expertise, but in their area of expertise, I'm an idiot. I remind them of that. So be excited. Now, when I say excited, I don't mean you're jumping around like a crazy person at a kid's party. Okay, that's not what I mean by be excited. You show your excitement by your enthusiasm for the subject you're talking about. You don't even have to talk fast. You don't have to talk excitedly. You don't have to wave your hands around. But you'll find that that excitement translates to others and they like being around excited people. And more importantly, get them excited about what they're excited about, not necessarily what you're excited about. That's one of the other key factors in getting a group board. Encourage people to ask the group questions for help. So for instance, if somebody's got a project they're working on or something they're working on, they're stuck, they don't know where to go or, hey, I just want to get started hacking. How do I get, how do I start a group or any question like that? Encourage them to ask the group the question. And the more cross communications and networking you do, the better it works out. The group is going to act like a springboard for members to participate in events outside of the organization. Examples of that are we had this discussion in DC 404. I believe the DEF CON group in Vegas or one of the DEF CON groups actually has their own hacker space. And that's where they hold their DEF CON meetings, their DEF CON group meetings, and they run a hacker space. We discussed that within DC 404 and decided that now DC 404, we wanted to encourage our members to go out into the world and do things as a DC 404 person in the world. So some of the DC 404 members went off and started a hacker space called Free Side Atlanta, still going strong. Many of the members have since moved away, but that group is still continuing because it wasn't a DC 404 thing, it was a hacker space. And it works really well. I go, for instance, I go to the hacker and maker spaces here in Atlanta and teach them basic apps to the flag techniques. I'll do a day of training on how to do web application security and using an attack proxy and all those sorts of things. And the next day we'll run a CTF form and that introduces them to these concepts and encourages them to do that. And then we help them set up their own permanent CTF infrastructure. Okay, so now who's your target audience? First off, be specific. If you just say we hang out and talk about stuff, you won't get people. You have to tell them what you're about and you have to give a description of it. That can be kind of difficult. Why does this stop working? Okay, there we go. Sorry for that interruption. Be flexible. Okay, post requirements about your membership, whatever it is. For instance, DC 404 group, our word DEFCON group, the DEFCON group, we have a webpage where we have our information and our charter on it. And one of the things that specifically says in our meeting post about our meetings is that anybody, any age, any skill level is allowed to come. So we highly encourage that attendance. And then when they get there, we tell them what our group's about at every meeting and encourage that kind of sharing. Now, let's talk about the DEFCON groups for a minute, specifically since we are hopefully you're going to go out and start a DEFCON group. Specifically in the DEFCON charter, it's any age and any skill level. Also, DEFCON frowns on calling yourself a hacking group. Now, despite what was said today, we are hackers. We hack in the sense of the traditional idea, discovering what something's capable of, as opposed to what it was designed to do. But we do not tolerate illegal practices. We regularly give talks on ethics. And one of the things that we found is a great benefit was CTFs and teaching people how to build their own training lab at home with little or no resources, very low resources, usually with thrown away computers that somebody set at the curb, so that they can train in a safe environment and do the things that a black hat would do, but do it in a way that doesn't get them arrested. And then they can come back and demonstrate it and share with the rest of the group. So it's a whole lot of fun. And of course, then we run a CTF so they can practice it in real time. I can't stress having a CTF is so much fun. Okay. Well, now one of the things about DEFCON, another thing about DEFCON groups, if you go read the DEFCON charter on the FAQ right now, there used to be something in there that DEFCON groups are not allowed to require any kind of fees or dues to attend the meetings, that the meetings must be free and open to the public. So that's missing from the FAQ. In doing this, putting its presentation together, we found that missing and notified them, so they'll be adding it back to the FAQ. Okay. Now, now you've got an idea. You've got a target audience. You know what you want to do. You know, you've got an idea. You're excited about it. You've got a few friends are going to help you out even. What do you mean? That is a huge problem. So let me give you a list of some of the things that are the most common things people look for. One is free meeting space and parking. Now, that's not an absolute rule. For a while, DC404 met in a comedy club, and the only parking that was there that was nearby was across the street, and that was a pay parking. You could park a couple of blocks away for free on the street and then walk there, but free parking was not readily available. We now meet at Manuals Tavern. Thank you, manuals, for hosting us for free parking. They give us free meeting space. That's a big bonus. I recommend you, if you look for a space, it's going to handle 20 to 50. Now, you're probably not going to start out that big, so it's okay to find a place that's smaller than that to start with, but don't be surprised. You have to start finding bigger places. If you follow what we're telling you today, it'll grow, and it may take a while, but it will grow. Find a place that's centrally located to the audience that you want to meet. Now, that's a problem in the Atlanta area. Because the metro area is so large, we have roughly five DC groups in our area scattered all over the place. Now, what's really interesting is people would think that that's competition. It's not. It actually generates more excitement because people go to multiple meetings because they're just so excited about it. So that's not really a problem. And we all communicate on the same Discord server. We each have our own channel, but we all communicate together. And so there's a lot of excitement for DEF CON group activity in the area. And we all help each other out with what they're doing. So they have centrally located to the area of the city that they're trying to make it easier for people to travel to. Wow, we're having some fun today with some social engineering. Hey, that's to be expected, right? We're a hacking conference centrally located to the group that you're trying to meet with. Now, that can be a challenge. Like here in Atlanta, during rush hour and especially when we meet at manuals Tavern, that's down in the central part of the city. It's not uncommon for them to have some major city-wide event that makes getting the manuals Tavern rather difficult at times. So that becomes an issue in picking where your location is. But for us, that worked out actually pretty well for a majority of the people in Atlanta. But for the other groups, they're far outlying. Some of them are on an hour's drive from where we are. And at rush hour, you just can't get there from here type of problem. So find something that's located centrally in your group. Preferably not too noisy. Because if you want to do presentations, you're going to need someplace quiet. However, that's not in this part. They have two different rooms. One is kind of off by itself. And it's rather quiet. And we can do presentations with no problem. The other one is called the Eagle's Nest. And it is extremely noisy because it's right next to their main dining area. And they have, quote, a soundproofing curtain that they pull across that does absolutely nothing to the sound. But that was supposedly the intent when they remodeled. Hey, it's free space. We make the best of it. We improvise. We adapt to overcome. But that could be a bit of a challenge sometimes. That's why we use a PA system so that we can talk over that. Another one that's kind of important, depending on what you intend to do, what kind of activities you're going to have at your meetings is free internet. If they have Wi-Fi, that's highly advisable, especially if you want to run something like Capture the Flag. Now, another thing you're going to want to look for is do they have any facilities for doing presentations, assuming you want to do them? Not all of our DC groups do presentations at their meetings. A lot of them just get together and hang out and talk about whatever they're working on. Ours, DC404, we promote people doing presentations. In fact, DC404 members regularly present at DEF CON and other conferences. So we always want to have a live presentation. So we make sure that wherever we need has a PA system. And if not, we provide our own. We have one of the members who will bring one with him and we can use their PA system. Look for a free projector and a screen. Our large screen TV also works rather well. In some cases, we found places that they have a projector that they charge for the use of the projector, but the use of the screen was free. No problem. We brought our own projector. Now, I know what you're thinking. I remember thinking this too. I can't afford to buy a projector. Well, Worth would let me check one out. I told him what it was for and they said, oh, yes, we're supported doing that. Sure. Check one out. And so I was able to check out a projector from work and bring it with me and we can do presentations that way. Or if you are a member of a church, a lot of times a church has a projector and you can borrow it from your church. That's an example. So ask your friends, ask around, see what you can find. You don't always have to buy it in order to provide it. Oops. Okay. Another thing you look for is whether or not they have food and adult beverages, meaning beer, wine, that sort of thing. If they have food and they have beer and wine, that goes a whole long way to helping the group congeal together and work together. People can come. They can have lunch or what time of day you're doing it. They can have lunch, have a beer, talk to their friends. It really makes a huge difference. So DC44 always looks for a place that has food and adult beverages. One of the big issues is will they provide separate checks? Ask first up front. What you don't want is having a meeting where people come and go and at the end of the meeting, they walk up with one big bill. You don't know who ordered what. Half the people have already left. You don't want that. You want separate checks. Also make sure to make an announcement to the group. Don't forget to pay your tab. We don't want to hunt you down later. It's just a friendly reminder. It also helps if they accept reservations for your meeting space. We've had places where we said, hey, we'd like to reserve this room. They said, well, we really don't do reservations and we get there in our big room, had three people and having a conversation and we were picked off to some side room where there wasn't enough room. So make sure that they accept reservations if you want to make sure you get a space. Places you can go look for a meeting place are things like public libraries. Now public libraries are a good place to start. Problems are they don't typically allow food or drinks. They usually require that meetings be open to the public. Now for DC44 meetings, that's not a problem for F-Con meetings because they are supposed to be open to the public. But if your group wants to have a closed meeting, that's not going to work for you because it has to be open to the public. Another place that people often don't think about are churches. Churches often provide free parking and meeting space. So if any of the members of your group are a member of a church, talk to them and see if they've got meeting space at their church. Quite often they even have Wi-Fi as well and a projector on a screen works out really good. In some cases they have a kitchen and as long as you're willing to clean the kitchen up afterwards, you can make or bring your own food or have your pizza brought in, whatever. Works out pretty well. Hubs and restaurants, those are another good place to look for. Quite often they do support meeting space and they try to host events. Now places that I don't recommend going are things like sports bars. We've had instances in the past where a sports bar had a space that would work perfectly. We told them that we can make sure that that room is completely full and that they have standing room only with our group being large enough and easily meet any requirements for the amount of money they want you to spend to use their space. However, they said that no, our primary clientele is the people coming here for sports and if our room is tied up and they can't get in, well then it gives us a bad name and they don't come back. So we said, oh, sorry, we can't use your space then. That's the way it goes. Some places are going to want to charge you rent for the space and they want a guaranteed amount on the bill. In other words, they want you to spend so much money and if not, there's a fixed amount you're going to have to pay if you don't order enough food and beer and that sort of thing. I would try to avoid those places. It's hard. We had, when manuals have been closed for renovations, it took us a great deal of time to find another place that could host us and it wasn't free, but because we were a group open to the public, they gave us a discount and one of the members went to his company and the company paid for years worth of meeting space for us until manuals finished their renovations. So you can find ways, be inventive, be hackers basically. Another place to look, and this is one that people often forget, are universities, schools, and community centers, especially community centers. Quite often they have free space to use or go to another organization and ask them if you can use their space. An example is the Atlanta Jugglers Association has a space in the Little Five Points Community Center that we pay rent on and that's where we have our meetings. Well, they'll make that space available to other groups and the parking's free. So that's, now in those cases we usually charge the groups, but depending on what the group is and when they want to meet and what it's for, especially if members of the AJA want to be present, the Atlanta Jugglers Association, like myself want to be present, they'll often waive the fee. So that's a place you can look. Local high schools and elementary schools can sometimes have a space available to have meetings, especially if they're open to the public and especially if the kids can come, which deaf con groups can. Universities, usually at a university, depends on the university, you're going to have to have somebody who's at the university sponsor the event. Now, sponsor doesn't mean they pay for anything. It just means they say, yeah, I vouch for them and then you'll be able to have a meeting in one of their meeting spaces. Now meeting spaces quite often allow food and drink, but you'll have to provide it yourself, but they will allow that. Now have all the stuff like projectors and parking, all that. Now, some schools charge for parking. Georgia Tech, there's no free parking anywhere in the campus. Other schools like Kennesaw State, they have free parking everywhere. So those are some examples. Now, one of the things you really have to learn to do is be flexible. You can, for instance, look for, if everything else fails, see if any of the members of your group, if their company can provide meeting space. That happens quite often where a company wants to sponsor a meeting space and we've had companies for some of the groups I'm a member of, we've had the company provide the meeting space and pay for pizza for all the meetings. In the case of 768, I think it is a DC group up in Hardishville. Their meetings up there, there's a member who comes and pays for the first hundred dollars of the bill for whatever they get, just pays for every meeting. And they got free space in the basement of a restaurant they go to. So that is a great benefit if you can get a sponsor. It's not required. Now, one thing I cannot stress enough about meeting spaces is you're going to have to be flexible with the people who provide the space. For instance, because of COVID, we're doing hybrid meetings. We have some online and some in person. And as a result of that, we've had the problem of not enough people showing up to merit the larger space that they have there. So they moved us to the Eagle Center, which is smaller, but a lot noisier. Now, we could try to get upset about that, but no, what we do is the vendor has been extraordinarily gracious to us in providing free space and helping us and working with this, with our group through thick and thin. They've been there for us all the way through COVID, in fact. So we really, really are flexible with them and work with them as ever possible. They'll come to us and say, hey, I know you reserved that space, but we've got this wedding coming in. Could you guys, I know you tend to go past your meeting time at four o'clock. Could you, could you stop right at four? I say, sure, no problem, or even stop early. Whatever their requirements are, we try to be as flexible as possible with them. By doing that and being nice, it's amazing what the vendors will do or the people who provide the space will do to help you out and become the preferential person that they'll deal with. You have a question? Somebody raised their hand over there. Oh, guess not. Okay. Okay. Now, where do you get the equipment? Things like projectors and things like that. Well, one we already talked about, you can borrow or buy it. Now, one of the questions you're going to have to answer, if you buy equipment, things like projectors, screens, PA systems, wireless microphones is, who owns it? In my case, I paid for it all personally out of my pocket. It's my equipment because I wanted to have a meeting and the people who started DC-404, which is Dr. Chaos and Beth, went on the road and gave me the bag of holding and said here, hold this. And I ended up being the host for DC-404 meetings. Well, when they left, they were the ones who brought projectors and screens and mics and that sort of thing. So I said, oh, I guess that's me now. Well, at first, I started borrowing stuff. I signed it out from work. I told them what I wanted it for. And they said, sure, no problem. And I'd borrow it from work. And over time, I collected enough equipment and got stuff together to do that. Now, if you do buy equipment, you're going to have to decide, is it owned personally or is it owned by the group? If it's owned by the group, where do you store it? How do you make sure it ends up at every meeting? You'll have some says, oh, I'll store it at my house. And then they go on vacation or don't tell you and you go to the meeting and you don't have equipment, you can't get it, it's locked in your garage. So you have to make plans for that sort of problem and you have to handle them in advance. Usually whoever the host of the meeting is is going to have to iron those issues out and make sure that it's handled. Quite often, you're going to find that the only person who cares that much about the meeting is the host. You started the group, you should care. However, over time, you're going to have more people come along and help out. Charmander's here today, he's there in the back left corner of the stands. He has been a great help. CommaGur is another one that comes along. We've got about eight people who are core group who come all the time and help out. Smoke and Teebur is another one. They'll step in at a moment and say, I don't even have to ask them. It's more like get out of the way, let me help. It's awesome when people start coming along. It'll take time, but you'll get there. Now, if you get a projector, I recommend a short throw projector. That's one that can sit like two, three feet from the wall and project a full screen on the wall. Sometimes you're living in space and you won't be able to set your projector 15, 20 feet back so you can get an image big enough. So I recommend a short throw projector. Another thing you can look at is in order to set the projector on something, it's quite often you get to the room, the tables have got people at them. There's condiments, there's plates of food, there's water, there's coffee. No place to put your projector. The solution for that is make a flat mounting plate for your projector that the projector bolts, it's just a piece of wood, your projector bolts to it and it's got a quarter 20 screw mount on it to screw onto the top of a tripod. It allows you to just set a tripod on the floor, set a couple of chairs around it so people trip over the chairs and it'll be a projector and set it up so it projects on the screen the lines. It's totally probably to put it in any space, just works. And if you don't need it, you can put it on a table, you just put it on a table. If you need a portable projector screen, one that's excellent, gives you a wide screen, it's very small, very light and portable, it's made by Epson called the Alk Acolyde Duet. I have one of those, I actually saw it because I needed to borrow one for a conference, I borrowed it from work and I was so impressed by this piece of equipment, I wouldn't have bought one. They're absolutely awesome portable screens. Okay, wireless microphones. If you get wireless mics, you're going to need a handheld and a lavalier for the speaker, handhelds for the host and also walking around having people ask questions, lavaliers for the speaker. If you can get PA speakers that have a built-in amplifier, so it's an all-in-one unit, you can just take the two speakers apart, set them up, either stand or set them on the ground or put them on stands, sometimes they come with stands and connect your wife, your microphones to it and go to town. It'll have a mixture built into the back. That's the cheapest way to go if you buy your own PA. Now for us, manuals has a built-in PA system, so we don't have to have it, but when we were meeting at our alternate location, that's the 57th Fighter Squadron, when they were doing renovations, we provided our own PA, one of our members brought it. For now, is equipment required? Absolutely not. DC770, which meets the basements of Jeffersons, doesn't have any equipment, they don't have any speakers, sometimes they'll have a speaker, but they're group solid if he just stands up and talks, no slides, nothing. Now that's highly encouraged because that's the whole point of being there, so we get together and talk about stuff. Well, let's talk about presenters and speakers. They're not required and it depends on your group mission or your audience, whether you want to have speakers. DC404 members speak at hacking and information security conferences, so we use our meetings so that they can do beta runs of their presentations. When we do that, we don't record them or anything, so if you want to say you have to be there, but we do those beta runs there. We also use our meetings to encourage new members to learn speaking skills, so they can stand up in front of everybody and um and on, oh my gosh. All the usual things that they have to learn to get around in public speaking, we give them that opportunity to practice those skills there in front of a friendly audience and also to learn this as a skill that they can use in their profession, whatever that may be. It's a valuable skill, so we encourage everybody to learn how to present at our meetings, but it's not required, but you can decide whether you want to do that or not. Okay, what kind of activities do you have at your meeting? What is it that gets people excited? Well, this is where it gets a little interesting because we discovered this kind of accident in DC404. At juggling groups, we have juggling where they're to juggle. Everybody brings their own props, usually enough props for them and somebody else to juggle together, at least them and one other person. That's typically people who want to pass objects, the juggling club will bring enough objects for them and one other person, because the other person might not have brought enough of the right kind or anything at all, for that matter. So, plan with that in mind. For instance, we host Network King of the Hill CTF. Now, this is a CTF that's very, very easy. If you go to github.com, netcoth, that's November, Echo Tango, Kilo, Oscar Tango Hotel, Net, N-E-T-K-O-T-H, Network King of the Hill. If you go to that github page, it explains what it's about. And if you also go to netcoth.org, there's more information there as well. It'll explain how to set up and run the CTF. If anybody's interested in doing one of these, feel free to contact me. My contact information is the end of the presentation. I'll go over it. I'm on the Discord for the DEF CON groups. You can also get a hold of me there. You can also go to dc404.org and connect through the mailing list or our DEF CON groups. There's an invite there on the email to our DEF CON, our Discord for Atlanta Subsecurity Engineers, where dc404 has a channel. So, connect with me and I'll happily help you get set up and working your own capture of the flag. I cannot stress enough how exciting this was for the group. Part of the reason is you think about it. We come to DEF CON, we hear about all these wonderful things you can do and things you can try, but most of them, if practiced in the wild, would unfortunately get you arrested. We teach you how to set up, the CTF, gives you an avenue to practice these skills in a competitive environment. And when I say competitive, it's a friendly competitive environment because of the way King of the Hill works. I'm not going to go into the mechanics of King of the Hill right now, but it's a really, really fun thing. In fact, as some of the people here who are from DC44, I see Charm Ender over there, for instance, ask some of our members what Never King of the Hill is like. They'll tell you how exciting it is. And it is whoever hosts the capture of the flag is actually a live admin of the event. So, you're acting as a live blue team against people who are part of the challenge. It's a whole lot of fun to both admin it as well as participate in it. We also have a lockpicking village. That also happened by accident. Here's the thing. I like lockpicking. I learned it in the Navy way back in the 70s when you couldn't buy picks. You had to make your own. And I just liked it. So, I went to a B-Sides and at the B-Sides was a lockpick village run by Tool. And they had a lockpick workstation, which is nothing more than two pieces of 2x6 with some dead bolts that you mount in your front door of your house mounted and you could try to pick them. And I went, oh, this is awesome. And Tool was selling this very rudimentary set of lockpick tools. And I said, oh, my goodness, my lockpick's broken. This is great. I can buy a set. I bought it. I was very excited. So, I went home and made my own lockpick work station, started getting a DC4 phone means because I'm interested in lockpicking. Oh, me, hold. Other people tried it. Then all of a sudden people said, oh, there's people here interested in lockpicking. I'm interested in lockpicking too. Next thing we know, smoking keyboard shows up and he is, I thought I was into lockpicking until I met him. He shows up with an entire village of equipment and sets up a village every time. So, he and I together co-founded Atlanta Locksport and now Atlanta Locksport has their meetings inside the DC4 for meetings and hosts a lockpick village at our meetings. This has spilled out all over the place because people who come to the DC4 for meetings also hear about the other DEF CON groups in the area. They also hear about Atlanta 2600. So, all of a sudden, we said, the guy who runs 2600 is the DC4 form member. He starts running the cash in the flag at 2600. All of a sudden, we go from five people sitting in the food court to 35 to 40 people sitting in the food court and, oh, what do you know? They start bringing their locks too. So, now we're sitting in the middle of the food court at this at Lenox Mall, running a CTF and having a lockpick village. So, yes, it will explode like crazy if you give people some way to vent all this experience and knowledge they're getting, especially in DEF CON groups going online and listening to these talks. They can actually do it for real in a safe, legal environment. That's really important because, you know, I kind of get to like you guys and it's really a bummer when I try to send you cookies in jail and they come through just a box of crumbs. It's terrible. Okay. So, I'd rather just sit down and eat dinner with you and drink a beer or something. That's a whole lot more fun. Another thing that started was one of the members came in to DC44 and said, hey, I've got a bunch of stuff that I no longer need. Like, they upgraded some stuff in your home lab. They have some technical books that they no longer need because that was the first edition. They have a second edition now. They said, could we bring that and give it away at the meeting? They said, yeah, sure. So, they brought a big plastic bin with this stuff. Well, then everybody else started bringing in stuff and putting in the bin. And then people will go from all the meetings in Atlanta, all the other DC groups, they'll bring the bin to all the giveaway bin to all the other groups and you put stuff in. You don't want, you take stuff out. You want things like swag stickers. You don't know what to do with it. You got from some other conference. You don't really want, you put them into the bin. All kinds of fun stuff comes out there. I've seen people give away raspberry pies because the upgraded got a new one. They put a raspberry pie in there. All kinds of fun stuff. That's another thing. But posters, books, hardware. I've had people put whole computers in the bin. Laptops, all kinds of stuff. Now, another thing you can do is when you go to a conference, say like Def Conference, since there's a bunch of DC 404 people at Def Con, well, actually there's a bunch of people from all the Def Con groups in Atlanta at Def Con. So DC 404 set up a Google chat channel. And if you want to coordinate with other people at the event to go out to dinner, to go to, go to talks as a group, those sort of things. Everybody can chat. They can use it on their phone. They can use it on their computer. And what's really fun about that is people like myself who can't actually make it to the meeting, I can follow along with my friends that are at Def Con and hear what's going on and be excited with them. So that's one way you can keep the excitement going when people aren't even there. Okay. Another thing, and this is one of our members brought this, is he wanted to teach people how to solder. So he brings a soldering station with him and sits down and teaches people how to do soldering. Another member designs, if you're familiar with the shitty add-ons that go on the badge, like the Def Con badge, that has a little connector on it. So a lot of cons have, it's a standard now, this little connector, you can plug on an additional daughter card onto the main board. And those are called shitty add-ons. There's the actual standard for that interface now, well the standards it gives with hackers. And there's people in our group who design and build those and bring in prototypes for people to try out and play with. DC-404, it's part of swag. One of the members went out and had made some add-on with the DC-404 logo and everything else. And we sold them to people and they were able to take them with them to Def Con and trade them for other add-ons. A whole lot of fun. So those are the kind of activities you can have that just gets everybody excited and gets everybody on board. Now let's talk about governance. And governance is where to get serious. That's the overarching plan of how we're going to govern how people meet. Whenever you get people together, they automatically start forming hierarchies and forming ways of organizing the situation. It all depends on what it is your group needs in order to meet that is going to determine what kind of governance you're going to use. Now the first type we'll talk about is what's called anarchistic. There's no leader. There's no one who's officially even a host. There's the people who tend to be going there along this and people will ask them questions simply because they've been going there the longest. Think of this as people who show up at the same location based on a history of the meeting. An example would be a pickup basket game at the city public court. It's always every Saturday you go out there. There's people playing basketball in the court. You walk on, there's nobody in charge. You want to play, you play. If you don't want to play, you sit by the sidelines, talk, chat, whatever. It's just completely anarchistic. There's nothing formal. Just show up, hang out, and talk. The rules, think of the rules as like kids agreeing on how to play a game. There's no rules on how to do that. You just kind of sit down and kind of give and take and figure out what you're going to do just by who showed up. That's how that kind of works. Now, you'd think that a long term that would never ever work. I beg to differ. The MIT Juggling Club, which is one of the oldest clubs probably in our country, has been meeting that way since their inception. Basically, their organizational principle is this. There's juggling outside this one building and if it's raining, we go inside through the atrium inside. Those are the rules. It happens every Tuesday or something, whatever the day of the meeting is. Why is it like that? Because that's the way it's always been. People just show up. It's been one of the longest running groups in the country. It's amazing. I marvel at their ability to organize despite doing nothing to organize. It's crazy. That's what happens when you show up and you're excited. The next type is loose. Now, loose is what DC 404 does. That means you only need one person to be consistent at a minimum. You have to have one person who's consistent and dedicated to make things going. Decisions are by consensus. Remember, kids playing together, right? But there is one person who's kind of in charge. They don't tell people what to do, but they facilitate the conversation. They act as the moderator of the conversation. You'll end up eventually with a core group that just shows up regularly and helps. You won't be able to tell them no. They'll show up and help whether you want them to or not. They'll help you set up chairs. They'll help you take stuff down. They'll help you load your car. They'll do whatever you need. They'll beg you to help out and try to help out. And if you don't let them, they'll do it anyway. They'll just show up because they're excited. They'll show up with things like Lockpid villages or they'll show up with things like the flags or soldering stations. We do a lot more than that at our meetings. Those are just some of the highlights. You may or may not have an official charter. It's not required. Now, if you're a DEF CON group, there is a charter that you have to abide by in order to be a DEF CON group. It's very minor. It's not very difficult to do. I'll leave the link at the end of the presentation. I'll tell you what it is. And you can always go to, if you look at this URL here that's hanging in mid-space here, you can get a copy of my presentation which has all the links at the end of it. There's no formal rules in the sense of how we do things. It's just a matter of kind of like anarchistic. It's like, well, we get together. We have a presenter. We always give feedback to the presenter on how they can help improve their presentation if they need any help with that. We ask them if they want that kind of feedback and if they do, we give it to them. And we give them a great round of applause. We ask them questions and we make them feel wanted and thank them for their presentation. And we also make time open for people to just share whatever it is they're working on. Nothing formal, no presentation required. You want to get up and ask the question of the group. I'm stuck on something or, hey, I want to know, is anybody here interested in this? Raise your hand. Okay. I'm going to come talk to you. And then they put down the mic and they go over there. We open it to the floor for people just to share whatever they're working on. For instance, when we get back after this DEF CON, our first meeting this is Saturday after we get back from DEF CON, we don't have a presenter. It's all about people debriefing. What did they see in here while they were at DEF CON that really impressed them that they'd like to share with the group? And that's what the meeting's about. Okay. DC-44 is a prime example of a loose governance system. Whoa. I'm in the wrong window. I'm going to try that. Okay. Now, the next one's formal. Now, you may actually have been part of a formal organization, but most of us probably haven't. A formal organization runs like a business. They have elected officers. Regular meetings are the officers that separate from the group meetings. The meetings run, when they have meetings of the officers, they're run according to Robert's rules of order. They take minutes. They publish the minutes. They have published policies, procedures, and membership requirements. And some organizations will decide to be a 501 3C charitable organization. Now, whenever you do that, if you want to be a 501 3C, remember, this is a legal entity. This means there's legal requirements to go along with those. If you fail to live up to those requirements, there are legal repercussions like fines and possibly prison. So, if you're going to be a 501 3C, make sure you understand what you're getting into. There's no doing it like it's a hobby. If you're a loose organization like DC-44, it's more like a hobby. If you're doing it formally, it's more like a business. You can't just decide as the CEO of a business, I'm not going to do that anymore and just not show up. That's not a cool thing to do. So, you have to realize that when you do that, it impacts the other members of the business and can have legal repercussions if you're a 501 3C. Now, the next one, and this is the last one, is what's called hybrid. Hybrid is rather interesting. It's a combination of loose and formal. Now, this example, if somebody asked me if this would work, I'd tell them no. Unfortunately, I've seen it work more than once in practice. Atlanta Jugglers Association is a prime example of this. They are 501 3C3 charitable organization. They do have formal business meetings. There are loose minutes that are published as to the results of that meeting. At that meeting, they vote for the business officers. That's the president, vice president, secretary, treasurer, that sort of thing. You have to have members of the core group who are willing to fill those roles. We jokingly do things like El Presidente for life and things like that, but they might be the president for 20 some years in a row simply because they're doing a good job and nobody wants to have a coup or a takeover. Although, one year we did have a coup, but it was kind of a funny thing because the guy wanted to step down. So we said, we're going to have a coup. We're a problem. Charles is president who didn't want it, so Jay ended up doing it. But anyway, the meetings themselves, however, are completely anarchistic, just like MIT Juggling Pond. Jugglers are kind of that way because the idea is you want to just show up and juggle with each other. The only way to do that is just cooperate. And we've been showing up and doing it for over 30 years at the same location. So everybody just expects there's jugglers out on the lawn. If it's not raining, if not, they're indoors in the kitchen area. And if not there, they're up in their juggling space up by the theater. We, they meet at a, the, what do you call it, not Civic Center, the, I said it at the first slide. What was that? I can't remember what it is. It's a Civic Center, like a Civic Center, local Civic Center, that's there in little five points and you can rent space in it, but it's also open to the public for free events. And so there's all kinds of stuff going on there. There's a lot of artistic groups there and there's even a theater group that meets there. And Atlanta, Atlanta Governor's Association runs as a hybrid group. Even though they're 501c3, they're a very loose organization. They run mostly by consensus. They do have a president, a dictator for lifetime, a title who's the official president. When somebody says, I need to speak to somebody official, that's the person who answers that. They have all the legal requirements. They meet all the legal requirements. They do all the bookkeeping that's required, all that sort of thing. But as far as the meetings go, they're just anarchistic, just like the MIT Jugglers Club does. And it works. They're not the only organization that runs that way. That's what's so amazing about it. Now let's talk about money. Now this is true regardless of any kind of governance type. If you have money involved, you must be transparent. Open a bank account from the group. You have to have multiple people able to access the account and you must have regular financial reports and it must be made to the group. Money or resources can be donated. You can have dues or pass the hat at meetings. Just remember that by charter, DC-404, but DEFCON groups cannot have dues or fees as their meeting. Now that doesn't mean that people can't just decide to donate money to your DEFCON group. But if you do that, make sure that you do the formal accounting so that people see transparently where the money is and what's being done with it. You can get a corporate or private sponsor for your group. That's quite doable. We have a sponsor paid for our space as an example. Swag. This is something I'll tell you. If you create a logo, do it as a work for hire or have somebody assign this copyright to you because if you don't, it can get a little sticky when you start selling swag. DC-404 is kind of in that vein. We have a very famous local artist or more like infamous local artist who was the progenitor of our logo. It was based on something he did. He gave us permission to use it as long as we only sold t-shirts and swag to DC-404 members. That means I can give you something that has our swag on it that I paid for but I can't sell it to you. We can't sell it publicly. In order to do that, there's two ways you can do it. You can either have somebody to group, knows somebody who makes that kind of swag, go get a big pay up front with their own money, get a big order and then try to sell it. We had a member do that recently with our challenge coins, which by the way are Prima. They look so good who just bought them up front and is selling them to all the members of the group. The other is we have a Zazzle account where we go in and create things like cups and magnets and t-shirts and things for conventions and we make those available to DC-404 members to buy but those links are not open to the public. So you can have all kinds of swag and you can go either bank it yourself with the money up front or use a service like Zazzle and there's more than one, that's just an example one, to make it available to anybody who just buy them whenever they want and you just put them up there. Okay advertising, we're running out of time here so let me get going. You need to feed relevant content and encourage discussions on the topics and issues that your site is about or your group is about. Things that I would recommend. For instance, we have an email list, we have a discord channel, we have an IRC server although there's myself and one other guy in the IRC server so it's kind of dying. There's a Twitter page if you want somebody to have somebody who admins that and responds to things, you can also have Facebook, Slack and really this is the big one is Meetup. Now Meetup costs a lot of money but every time I ask at a meeting who here is here the first time, a bunch of hands are going, like five to ten hands are going, I'll say how did you find out about us? Nine out of ten will say Meetup. So Meetup is where people seem to be going to find things of interest. The problem is Meetup is hideously expensive. It's like ridiculous money. Now the way we got around that is one of our members started a Meetup channel for doing some security training he was doing and he moved and he turned that over to us and said here you can have it till the thing runs out. Well one of our members took over paying for it and instead of just being for DC404 it's for all the groups in Atlanta that's on our Discord server have advertisement for their group thing so we were able to amortize that across the entire thing. All of us kind of chip in money to help the guy pay for it. So I can't tell you how impactful Meetup has been. I hate to say that because the service is so darned expensive but man do they pull people in like nobody's business. Okay that's pretty much a wrap up. Sorry I had to rush the last slide there. If you want to contact me I'm xrayatnoboxlabs.com that's n-o-b-o-x-l-a-d-s.com that's xrayatnoboxlabs.com you can also contact me at AtlantaLockSport.org or netcost.org you can contact me through those and if you're looking for resources the link to my presentations is right up there and one of the things that's on my website is a thing on how to get started hacking there's also a connection to all the Atlanta information security resources in the Atlanta area there's links to capture the flag and pentasty training tools as well as a link directly to somebody raised their hand had a question no okay there's also a link to the DEF CON groups page and that's hctbsforum.defcon.org slash social-groups all over the case so that's forum.defcon.org slash social-groups and that's where you can find out the information and sign up for a DEF CON group now if you have any questions feel free to reach out to me I'll be happy to help you and getting started help work through finding a place to meet whatever you need to help out you're getting your group started even if it's not a DEF CON group give me a call I'll be guide to help you out or if you're interested in learning how to do capture the flag or starting a lock group big village or whatever in your group give me a call I'll be happy to help any questions wow I must have been a really good speaker okay so okay let me