 our next speaker. He was a developer of free and open software. Until recently he was a journalist. He is a digital rights lawyer. I've been told that whenever there's anything about privacy digital rights in the news, he gets called to comment on this. And some might describe him a bit as a troublemaker for the government. He defends your digital rights and privacy online. But he's also our harbormaster here at Shah 27. He rescues your rights and privacy online and he even rescued five people from the border during this event already. So now he wants to tell us a bit about what would happen if we would actually treat data leaks as a disaster that they are as we do in all the other industries and all the other capacities and what we could actually learn from them. So please welcome Brenno de Winter. Thank you. Well the rescue bit of course therefore we have our medical team and they are volunteering as well by the way as a lot of people. Today we are going to talk about the Titanic. I'm going to explain to you why the Titanic is the finest moment in history. Maybe the people on the ship have a different opinion but for us it's a very nice moment and in our industry we should learn from that. I fell in love with boating just before the last CCC camp. For the simple reason my wife had a weeping cough and it was unknown if I was infected or not so I could not go to CCC camp. So out of boredom my wife and I started boating a bit. I thought it was so cool that I've been crazy about it ever since and then I discovered very cool things just like the undergoing Titanic in this digital seat of my last book and I will make the link between boating on one hand and IT on the other hand and indeed right here I'm the Sharper master because everybody should be at least in safe harbor and use their own privacy shield. This is the boat that I came with really cool you know it's the final spot in camp and you know you try to do a lot of fun things with kids and if you look at those this morning there's one thing that stands out they all wear a life vest and that they do that because we agreed to do so and it was kind of hard for us to get to this point and we saw a lot of disasters. Let me pick out a couple of them the skilly disasters over 1400 people died because a bad navigation in storm led to ships that broke down and people ended up in the water and got killed and when you look at those incidents there are two things that stand out for the UK people among us I'm sorry but in most disasters you've got two factors it's either a storm or the OK and let me show you a little bit of proof. White ship from England 300 people died and they had a conflict over the throne for over 20 years what happened they got up in the storm and bad navigation and they crashed. In the 13th century during two nights they had kamikazas or what they call a divine storms and more than 100 people died again 13th century just try to extrapolate that to today's times that's a significant amount of people even nowadays 100,000 deaths would be amazing and all of us we just sat there and said like okay and we just left it at that well Her Majesty Sussex in a storm 498 people and in 1703 in the English channel 1500 people died so when people say like we need a big disaster to change something the numbers here show that the Titanic in itself is not a special disaster. This was one set of incidents that occurred all the time then we had a different change of technology. We went from sailing ships to steam ships and all of a sudden ships were going faster than before and we got up in far more incidents than before and one of the things that was really complicated how do I enter a port on the left hand side or on the right hand side now if you don't have an agreement on that it gets kind of complicated because what do you do so what they did in 1889 is throw a big conference and try to change rules and set international rules for everybody so when you're at sea you stick to the same rules well if it's about the treaty one country said no the UK because there were a lot of ship owners and builders that said that it would be very hard to have common rules since if you have common rules there would not be a level playing field and especially the UK said we have our own rules for instance we have something to rescue people on each and every boat for each and every passenger so either a place on our rescue boat or a life vest so we have rules already so far so good you'd say you'd think then came the Titanic a beautiful ship impossible to sink nothing could possibly go wrong and on the first voyage we all know the story story something went terribly wrong they hit an iceberg and long story short the ship sank and one of the crazy things was the British rules did not work because they took away a couple of the life boats the life rafts for the reason that the ship looks nicer without them and people would be concerned if they were to see life boats so they had extra life vests but then when the ship started sinking there were people that would put it on a life vest and get in a boat and that was not agreed this is one of the important reasons why a lot of people died still this doesn't matter because they had a second rescue mean they could shout help by sending signals out they would they would basically shout help and that would end happily people would come to the rescue and fortunately there was a second ship called the SS Californian that would definitely come to rescue however the men controlling the radio room had gone to bed just before the disaster and since the radio was mainly used to get messages across to the shore nobody listened to the emergency signal so then they started to show off some fireworks and reports say that fireworks of the Titanic has been seen at the SS Californian people really enjoyed the fireworks and it took some time for them to realize that maybe this might be an emergency signal so the SS Californian turned around went back and saw nothing so they thought the ship had sailed on after that society said to each other okay this is enough stop we don't want this anymore what was the big difference it was the maiden voyage of a ship where there were a lot of important people on board and you know 100 people 100 thousand people dying in Mongolian is not really that bad but 1500 where a lot of prominence are among them that's a big deal so they came to a treaty called safety of life at sea and in safety of life at sea one of the rules was when you have escaped vessels on larger ships everybody gets a place period and if you complain about the bad looks bad luck for you everybody gets a place everybody has a right to a life vest later on we found out that what are around the ship is not enough and we have to have protection as well on the ship why do we know that because we investigate incidents now we look at it and we shout to the world what changed what needs to be changed so we fire protection now and when you have a radio you listen to it it's on it's not voluntarily it's on I have a feature of radio on my ship and my wife once asked me can't you can't you turn it off no why well titanic you stick to the rules and by doing that you can you can come to the rescue and so we learn a lot from ships who remembers this vessel what country is it off what what was it name again health of the enterprise what happened they didn't close the door it was there it was sorry yeah it's stupid if you don't close the door on the ferry I totally agree that's why we at safe harbor always close the door on our ferry but we learned that from this ship what we learned from the study was that it was the wrong ship at the wrong place and because of that it didn't fit the port totally properly so what they did they let water into the ship so sank a little bit and then the cars could go in and then the ship set off since it was late it used the maximum speed of 18 knots and there's one specific thing in say Brugge where this happened there's short waves it's a deep since it's a deep the short waves water went in and within 90 seconds the ship flipped over the we know this all because we investigated and we learn from it and we get people in the audience that say it's stupid not to close the doors do we know it works well one of the things we learned also from and the health of the enterprise was there was no mayday signal they had the radio on board because they had to because of solace but the captain knocked out when trying to grab the radio and basically for that reason there was no emergency signal so what we've learned since that is that we built a system AIS to follow ships and we know it works remember this ship yeah Costa Concordia the Costa Concordia the Italian cruise liner hit some rocks tumbled over and they didn't start to call Mayday first the harbor detected there was something wrong on the AIS system so the ship turn over and they say like would you issue an emergency because the skipper is in charge and he on so if the skipper is in charge he needs to decide if it's an emergency and he refused it multiple times and then when he realized things were wrong he issued an emergency went off board as one of the first and 32 people died this is really a disaster where nobody had to die it was a bad judgment calls and what do we learn from all sorts of disasters when we investigate them there's always one common error we make it's company or corporate culture so far on the Titanic for now let's look at the digital sea let's first make one realization if you look at the digital sea systems are interconnected there is not a single system as soon as you're in the in on the internet you're basically part of the digital sea you're connected and that means that if I have a problem you might have the same problem too if you agree with me on that one you realize that we have got a similar issue as at sea if a different ship an another ship doesn't follow the rules I might have a bad day at the end of the day second thing in it is we write stunningly bad software rewrite crap this is a nice picture I took of myself when I was in the hospital and they decided to measure all sorts of things you have to sleep them for one night so you get a room where you can't close the curtains and then they see how you sleep the next morning I was on my bicycle home driving home and I got a call before I was home that they didn't register anything if I could come back the same night I said no of course but later on I asked okay what was the problem now and they said like well we did a software update and apparently the system didn't work so it went like well there were no indicators no lights how should you know it's working that's a very interesting question so I thank the person I said like okay fortunately you're not in a lifesaving industry so don't worry about it but this software update is similar to for instance sailing in a storm remember this one 37 seconds into the launch the onboard computers decided 501 was 90 degrees off course the onboard computers decided the vessel was off course and the interesting part of it is is what was the root cause of this incident reused software need bad software bad choices and of course these are just two examples you know a lot of examples where you do updates and things don't work so apparently we still have a culture where it's not okay to deliver proper software or to test it properly enough and then let's look at incidents I call it same shit different day we had a couple of big incidents and let's start with a wanna cry um outbreak we had a couple of weeks ago that hit a lot of systems one of the interesting things was that a lot of journalists asked themselves the question if weak leaks were to blame for this because they disclosed that this issue existed so that would be the issue well we hit a lot of um we hit we hit a lot of um systems and all of those systems could have been patched if people would have applied the patch they didn't the patch was found by the way before the disclosement by weak leaks so apparently somebody else found the same mistake the patch of the patch or the non-patch outbreak that came there after had a similar issue based on a similar update and still a lot of companies had not installed the updates if you look at a couple of years ago the big hacker did you know tar or the big hack um at kpn um the story was the same not installed updates old broken software and there are many more examples with a good friend present here um um we went looking where um if there were vnc systems that were online and did not have a password installed and at a certain point we came to a system um where the following screenshot it's a bit hard to read but first off on the left hand side windows xp xp standing for expired it's very hard to read here but it says your updates are ready for installation and behind that there's a screen that says like certification request um successfully completed so they were making certificates for their servers or for whatever whatever on the system that is not being maintained and even the updates that were present were not installed this is basically the industry we work in or we start to maintain our remote controllable uh house systems i just moved into a new house and one of the neighbors said i want to have this system so i went like oh sure when you go to bed i'll turn off the light and the thing is it's not a joke it's true you know you can and then if we look at the all these type of incidents and we're all a fan of owas but i'm showing you an old slide i have a very good reason for that um the 2010 and 2013 list because we are so damn proud that we make top 10 out of um the same mistakes we make over and over again and the real competition is can we find another mistake we keep making and replace number two and three and then if you look what owas states they state like it's nice work and one of the main courses for them is that um 80 percent is libraries and 20 percent is custom code or to put it in a different way and most of the incidents are created by bad shit we buy what do we know of icebergs what have we learned from icebergs we map them each and every day day since 1914 we map icebergs each and every day so back again to so let's sorry so less um we have basic rules we have learned from our mistakes and digitally and we have a hard time doing it so maybe we need to have the same mindset for data you know start to push of things like continuous delivery or continuous monitoring which is not normal by right now um but also have a look at the new rules when i hear people talk about the new general data protection regulation that is going to be introduced or sorry it's been introduced already but going into effect in may next year the most of the complaints i hear it's it's so much so hard to do it hinders the level playing field and basically you get all the pre titanic arguments and i want to remind you of something when people were against a treaty in the uk the ship owners that were complaining the loudest had a certain list on top of that list who were leading the um the actions against a common treaty was the ship owner that would later build the titanic and we've got a lot of standards and options already available where we don't say it's mandatory so maybe we should start to push it off well if we look at history and how we deal with incidents i remind you of this do you remember the hacking team hack of course you do and one of the interesting things was that they made all sorts of common mistakes click on links you shouldn't click on and and basically store data on places that shouldn't be stored so you could see all the offers and all the financial stuff etc including the emails i want to take point you to one email and that was an email where zero day was being sold to hacking team and why was why is it so interesting because we don't update we don't patch so it's worth a lot of money and um what does hacking team say of course when the russian guy says like you promised not to report the zero day to vendor or disclose it for before the patch obviously it is not in our interest so in the underworld it's clear that people are sharing information because it's worth a lot of money if you look at incidents it is not common practice okay we share information after an incident sometimes in the same industry but not publicly so apparently if you've got a blue ship and it seems you only um shared with the people who have a blue ship but if you've got a white ship you don't get the same information and hopefully you still agree with me there's one c and there's one infrastructure and one set of computers so we all have the same or similar problems and when something goes wrong we find it hard to help each other you know what happens on the water when something goes wrong so the captain asks if the competitions comes to the rescue I don't have to explain to you that the answer is always yes why don't we do that in IT how can it be that we try to keep it silent and not ask the competition have you had the same problem what should we do about it you know it's about safety it's about our information society and for some reason it's very hard to do so so this was the point I was I wanted you to take away today to start thinking the same way about IT and dealing with systems as we deal with with the on the water and it's kind of obvious if you look at all the parameters that there will be a day soon where we have a similar incident where something will go terribly wrong maybe not a big incident because you know you can't decide it doesn't say at all but that incident will ultimately be the cause for a change now the fortune thing you can do today there are many programs here there are a lot of people that make important decisions to start with a different mindset don't be afraid if something goes wrong shout for help and start sharing information you know we know that the other side does it already I end with this slide for a very simple reason because you see a lock opening and you see me violating the rules I'm leaving the lock before the doors fully open what I didn't show you is that I took for three and a half hours pictures looking at the lock that wouldn't open anymore because the window computer crashed because an update failed so as soon as the doors opened I thought like let's get the hell out of here but every lock every part of information society is basically running on systems that have bad software and bad infrastructure and most of the infrastructure on water is currently maintained from a large distance window systems being poorly maintained sometimes so that was my point I wanted to make today hello it works so I think there's one problem with the analogy and that is that there are at this time billions of sailors and it's not just the boats that are leaking it's the people that don't know how to sail yes but then again there's also the openness of the internet that we want to protect too I would suggest you to start boating because on the water there are a lot of people who don't know jack shit what they're doing that's that's one thing but if you go into a next category your boat goes faster is larger a charismatic people that type of stuff you are bound to different rules and you have to get certified and the funny thing is I have a boat that you can use without any license whatsoever but me choosing to get my phf license to get my ICC license etc is the the choice I made because I realize it's important to do so so it's still for for parts of it voluntarily that will remain the case but so I think the analogy does match more than for instance the the aviation industry but good point that I maybe should have been more explicit about I think basically it's the problem that we're facing it's that it's very and we want it to be very low level to to to get in on to the internet to use computers right I mean that's what we want at the same time it's that single user that can do a tremendous amount of damage and now the funny thing is the group of people here we are the go-to people if somebody has problems with their computer they will come to you you are the ones that can change mindsets you know if you look at for instance politics in the Netherlands there's a new cybercrime law and that cybercrime law now states that if an incident happens it will remain secret so it's very pre-titanic and this is the state we are currently at so it won't change if we wait for politics I think this is the group of people that has the power to do to make that change happen please line up at the microphones if you have more questions in the meantime I have one question so what's the first thing when I got back to work next week what would you say what should I take care of is my ship okay are my systems you know do we stick to the basic rules the basic mistakes that we all know and we all know that in most corporations this is not okay you know even with all our procedures and things we have thought of today we still have systems that we allow on our network that are unpatched that are unsafe that are not properly tested I know one company in the Netherlands that says like okay you're a supplier that's very nice um we will test your your software for free and then we give you one round to patch all the issues if you pass that round we'll buy your software now of course they don't they they are giving money away but they preventing disasters from happening and for some reason it doesn't resonate in our head that when an incident occurs it's a small disaster you know if I if we see at the safe harbor somebody swimming into the fairway and we see a big ship coming we get on the boat and we get that person out it's plain and simple logic digitally we don't do that so I would take away basically two things first back to the basic the thing we complain about to our parents look at our own system keep them up to date and the second part would you know I think most people here have the system pretty much in place and okay it's more or less the the corporate culture you know and if somebody is drunk gets in the car you say you don't drive for some reason digitally we're perfectly okay with that okay yeah okay let's you know yeah um in Germany there are also two new laws uh first uh gdpr so it's the same and also the it's security law which enforces all critical infrastructure to give information about security flaws they had they have but this goes in combination with the gdpr uh for their companies and also otherwise authorities can sue companies when they have data leakage uh beginning in the may next year uh with very huge um fees uh which leads to a very weak situation where at least a leak is a very expensive event for our company so yeah well two things um first of what you what you say is we have you have to report data leaks we've had that law already a couple of years in the Netherlands and we have got thousands of thousands of leaks um that have been reported very good now it's in a database somewhere at a government body and we have no clue what's in it we can't learn from that so um the only thing we know is so many percent is healthcare so many percent is um um government so many percent is industry it is not actionable what do i learn what are the common mistakes that we shouldn't make maybe they are sitting on the top of a pile of information that could really make systems better and now basically we have got no clue so that is the first thing um the gdpr in itself will not change that that's that's not enough second thing the fines uh i'm not that i'm not so sure that the fines will really make a difference one of the things is companies cannot say like okay i hire this company and they will take away all the risk so now what they say is they make contracts and they say like okay you're doing this and this for us if we get a fine i'm going to sue you and the company says oh that's fine and they walk to an insurance company and says and they ask like how much money will that cost per year so there are companies who have insured this risk even though it's not allowed but due to this through this loophole to insure this risk third thing because it's not so that's but it's only in europe um you see you see data um being manipulated in such a way it's not personal identifiable in anymore then it is taken out to for instance the us they will do run a big data process and make it personal identifiable again of course with mistakes but now it's in a different legal zone and there's little we can do okay so uh yeah please what what do you think are the right way to create incentives for good if you look at solace it wasn't we had this treaty and as a result of that everything's great it there's enforcement on that if you're if something happens and someone wasn't following the rules then they can lose their license all all of this sort of thing or so what are the incentives in your mind that need to be in place for the digital equivalent when you ask the question you all nearly give the answer um if your ship is lacking something you're not sailing today so when the other person was talking about the the gdpr uh i get nervous about fines that doesn't that doesn't work but if you say like okay you're not processing data anymore until this and this is fixed you know when we were building up um sha the fire the fire brigade comes and says like if you don't do this this and this this tent will not open period i think that's that's far more authority that would work for better than just say like there's a lot of money i can take from you because i'm going to ensure that and then the issuers away so be far more an authority in the sense that you know if you close me down on data you close me down on business and if you close down a ship or put it on a um on a how do you say it in in english um you know keep it to the dock it's not making money and it that's punishment enough you know and it stops as soon as the issuers fixed yep i agree with that yeah you're saying yeah you could you could go and get into a different um law zone and this is why i'm shouting for so that you know this is something that we should um universally arrange sooner or later and as soon as we as long as we don't do that we will get a bunch of i um iot devices being thrown on the market from from regions where we know that they lose lanes kernel versions that i can't even remember anymore that yes you're you're saying um it would um mean that um the government would um uh determine what we were uh are allowed or not allowed to do on the internet we've seen in the shipping industry that basically um that's uh that's not how it ends up it means it means that we need safeguards just like constitutions but it's a difficult one but the current situation will lead to disaster that is um the system now is broken beyond repair if if we don't do anything fundamentally sorry uh oh mr the winter first like real pleasure to see you live on stage after so many years of hearing you're on the radio um so you know big data leaks it's all bad but in my daily life i just have zero problems with that i mean my credit card gets hacked about once a year um because you know i use it everywhere on the bloody internet um but you know i might i never get cleaned out my just not really big and at the end of the day it's all get solved by basically an insurance model like i pay percentages of fees on like everything and that is used to cover the losses of most of these things and i would say that the reason that people as a whole are not we are very interested in that but people as a whole are not interested in that because we don't have like big disasters that help sort of like focus people's minds like people are very bad at comparing the aggregate of like random low probability events versus a very big even lower probability event so what i'm saying is shouldn't we just continue to write shitty software until like a nuclear power plant explodes or something uh and use that event as our titanic this no it doesn't have never seen a nuclear power plant explode like in my lifetime near me actually or like a plane fall out of the sky or like all Mercedes benzes crash at the same time that shit just doesn't happen shouldn't we just wait until that happens and then make a point of this and just not talk about it in the meantime i have a little anecdote for that this is already 20 years old but i went to a computing congress and was talking to an insurer there about testing software and he said oh yeah i ensure nuclear plants we test the software within the normal parameters whenever it goes outside the parameters is not tested it's allowed to blow up and insurance pays it's that simple yeah it's only too bad if you're living in the near vicinity of such power plant and what was the facility again 300 or 400 kilometers ultimately so that's more than the Netherlands so i think it's it's kind of a risk retake well it's not about personal data alone anymore you know go to the italian village and join the tesla hacking on monday and tuesday i've organized a fire truck that we can hack and the mayor of the city of lochem realizes that when his fire trucks get hacked they have no building plan anymore so they don't know who to rescue or they have no communications that's also very interesting in in rescue so you know it's so so part of everything we do and where should be the we should be the people that realize that more that there is yeah of course you can ignore it but it's basically in every part of technology and then to answer your question should we just wait until the digital titanic happens of course that's that's an option but i choose i rather chose choose not to and you know stand out and try try to make us realize before but maybe you're right maybe it needs to go wrong first but what we also have learned from a lot of disasters is we make the same mistakes over and over again there as well until somebody steps up so one disaster is not enough and after the hack on yahoo after the hack on with with one billion or maybe even more personal identifiers sony the multiple times and there's this long long list we see the ships go down all around us and nothing happens so if you have to wait for politics we'll probably all be dead before we start to realize that it's it's not going to do the trick i'm afraid any more questions please step up to the microphones and educate people so and if there are no more questions every day there are free sailing lessons to educate people on sailing at the safe harbor thank you very much