Working together to keep the Internet safe and secure
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Mayorkas, Alejandro
Working together to keep the Internet safe and secure Alejandro Mayorkas Deputy Secretary of Homeland Security We all have a role to play when it comes to ensuring the safety and security of the Internet, whether you are a federal employee, the CEO of a company, or a private citizen. Today’s threats require the engagement of our entire society. This shared responsibility means that we have to work with each other in ways that is often new for the government and the private sector. This means that we also have to trust each other and share information. While we have achieved some successes, we have much more work to do. Deputy Secretary Mayorkas will highlight the role that DHS plays in securing the Internet and discuss the challenges and opportunities to collaborate across our society and across borders. Alejandro Mayorkas was sworn in as Deputy Secretary of Homeland Security on December 23, 2013. Since 2009, following his nomination by President Obama and subsequent confirmation, Deputy Secretary Mayorkas served as the Director of the Department of Homeland Security’s United States Citizenship and Immigration Services (USCIS), the agency charged with operating the largest immigration system in the world. In that position, he led a workforce of 18,000 members throughout more than 250 offices worldwide and oversaw a $3 billion annual budget. While at USCIS he oversaw a number of important programs and enhancements, including the implementation of Deferred Action for Childhood Arrivals (DACA) as well as important reforms that safeguard our nation’s security, and ensure the integrity of the immigration system. Prior to his appointment at USCIS, Deputy Secretary Mayorkas was a partner in the law firm of O’Melveny & Myers LLP. In 2008, the National Law Journal recognized Deputy Secretary Mayorkas as one of the “50 Most Influential Minority Lawyers in America.” In 1998, Deputy Secretary Mayorkas was nominated by President Clinton and confirmed by the Senate to be the United States Attorney for the Central District of California, becoming the youngest U.S. Attorney to serve the nation at that time. In addition to leading an office of 240 Assistant U.S. Attorneys, Mayorkas served as the ViceChair of the Attorney General’s Advisory Subcommittee on Civil Rights and as a member of the Subcommittee on Ethics in Government. From 1989 to 1998, Mayorkas served as an Assistant U.S. Attorney for the Central District of California. Deputy Secretary Mayorkas is a graduate of the University of California at Berkeley and received his law degree from Loyola Law School.
 Welcome to DEF CON 23. I'm Russ. I am the chief of operations for the conference. I've been here for 17 years which is why I'm standing here today instead of hungover in my room. How many of you are feeling okay this morning? That's not too bad. How many of you are new to DEF CON? That's not bad either. I got to tell you, after all these years I still can't predict what you guys are going to do. We're almost out of the badges even though we up the numbers. I do my damnedest and you guys surprise me every single year. I wish you'd stop that. So we're going to queue off this year. We're going to show you the trailer. How many of you have already seen the trailer online? All right. So not many. So this is going to be really, really cool. The theme this year is kind of this film noir thing. That's why we're walking around with albums. All the artwork reflects it. It's very cool. If you haven't already started getting involved in lost badge challenge and that sort of thing, please do. We have a ton of stuff going on in the villages and the event center over in Bally's. We've kind of divided everything up. Hopefully every one of you is wearing a Fitbit because there's a lot of stethesies. Yep, me. Go over there. All the actions over there. We have the speakers and the information and the vendors and stuff over here. We tried to separate it out a little bit. The parties are going to be over in Bally's tonight for the most part. If you have questions, ask somebody in a red shirt. Be safe. Have a good time. And let's roll the demo so they can see that, please. There it was again. This must be some kind of prophetic truth. Master coincidence, certainly, but it couldn't be. No, these were not imagined patterns, the mind seeking to connect accidents and thoughts with blurred lines. This was something real or something... Something elegant in its simplicity, dangerous, cinematic, complex, and deniable in all its obscure perfection. And everyone else be so blind. Or were there others who observed this covert conspicuousness able to untangle this perplexity, understood this cypher that surrounds this key, this 23. Woo! All right. Thank you. Thank you. Thank you. Thank you. Woo! All right. So we're here. So we're going to kick things off this morning with our keynote speaker. He's got a very long and rich history in security and also in research areas. So, and in legal. So I hope you'll listen to what he has to say. This is Alhandro Yorkis. He is our deputy secretary of Homeland Security. He was confirmed in 2013. You can hear a lost boy over there starting their video too. He comes from University of California, Berkeley. We have anyone from that area? I heard somebody hooting a holler. He's got a law degree. He's got all sorts of education. And he's got a lot of insight into what the government's thinking about information security, cybersecurity right now. So if you help me welcome the deputy secretary. Good morning. Thanks very much for taking a little bit of time to hear me out. And hopefully you'll ask questions and share your concerns or thoughts with me. And we can have more of a conversation than I just give a speech. I will tell you at the outset that I was instructed by my colleagues not to bring my government phone with me this morning because it might suffer an intrusion. And I said, I don't believe it. Let them take their best shot. And I challenge any of you to make my phone ring during my remarks. And if you do, you'll get a free job with the government. So give it a shot. Give it a shot. You know, I have to tell you, I tend to be retrospective when I experience new things. I tend to reflect on my own past and my own life and the decisions I made. And as I walk through this morning, the lobby area, and I went into the DEF CON swag room and then the vendor swag room, I thought quite frankly of my high school, I thought I'd be in the lobby area and I went into the DEF CON swag room and then the vendor swag room. I thought, quite frankly, of my high school years, and I thought about 1974 through 1977. And it's hard for me to believe that I walked by what was then a very nascent computer room and actually walked by the future. But we are the decisions that we make and there's always days ahead as well as days behind. So I look forward to developing greater skills in this arena than I have now. You know, yesterday I had the privilege and the experience of sharing some thoughts at Black Hat. And I've been looking forward to this morning as well. And I have to tell you, I find the talent that is resident here to be stunning. It is in my view a combination of brilliance, expertise, ingenuity and creativity, and also just a risk tolerance, a tolerance or appetite to experiment and to see what happens. And I want to talk a little bit more about what that means or what it could mean to us in the Department of Homeland Security in a minute. But I also want to express the fact that we have in the Department of Homeland Security in my opinion that same level of brilliance, expertise, ingenuity and risk tolerance, perhaps not in me, but certainly in, for example, the three members of our US CERT team, computer emergency readiness team that I interacted with yesterday at Black Hat, our ICS CERT team, our industrial control system CERT team that's resident in D.C. These teams fly all over the country, respond to intrusions not just in the public sector, not just that the government suffers, but also that the private sector experiences and assists companies and entities and institutions in identifying the intruder, expelling the intruder and remediating the system. It's a tremendous core of individuals. What troubles me a great deal and it's something that was quite frankly underscored yesterday and the questions and comments I received during and following my remarks at Black Hat is that there's a divide between the two groups, the two collection or communities of individuals. And it's a divide of mistrust that there's a trust deficit as I called it yesterday between all of you and us in the government. And I know that it's born of quite a number of things over the years and of course in recent past, whether it's an intrusion that we suffered that speaks to the state of our own network security, whether it's some of the practices or principles that we execute or espouse. But I'm very dedicated to doing what we can to bridge that divide. You know, it should be after all a more unified community. If we speak about the internet as a global commons, then I think we have to have a common purpose and a common understanding to achieve at least the level of the community. And I think that's the only way that we in the Department of Homeland Security at least will achieve our primary goal of building an ecosystem of information sharing. This is quite troubling to me. I've actually never seen Nyquil in that bottle before. That's probably not going to happen by the way. I'm sorry. Can I interrupt? You did. Well played, sir. We have a little tradition here at Deafcon. Do you have a little tradition here at Deafcon? Do you all know what it is? I've never seen a person who has a We have a first-time speaker. You know, let me share some thought with you. I'm going to share two things with you. First of all, I'm going to share a story about my landlord when I was a federal prosecutor. His name was actually Jack Daniels. It's true. And every morning, he was 94 years old. He had a beautiful mane of hair. His skin looked as though he was 27. And he lamented the fact that he had to wear reading glasses to read the paper and read novels in the morning and in the evening. And every morning, I left my apartment early. I lived above him. I left my apartment early to go to work to the smell of frying bacon. Every single morning and every single evening, I came home late and had to pick Jack out of the bushes because he used to have a couple very tall vodka tumblers to end each day. It just goes to show you what the key of life is. It has something to do with Jack Daniels. It is very difficult to talk about a trust deficit and how to bridge that deficit and really build trust when I'm a fraud. And this is actually water. That's the official story, and he's sticking with it. So I'll tell you what. As long as you promise to make it small, I'll take a shot at the real stuff. Hey. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. Whoa. And it's got to be small because after this, I'm actually meeting with TSA colleagues. And yeah, it's exactly right. All right. You're a trooper, man. Cheers. Cheers. Cheers. DevCon. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Cheers. Thank you. Thank you. That's my way. That's my way of really actually saluting all of you. I am captivated. I am really captivated by the talent that is here and the potential that it represents for the world. Can we get a round of applause? That's a reason we're a trooper. Thank you. That was my first of the day, by the way. It may not be my last. So what we aspire to is an environment where the cyber threat indicator is not of proprietary value, but is actually something that is exchanged publicly. What we feel we can do more ably than anyone else in the government, because of our unique position as a civilian agency. We're also uniquely positioned at the intersection of the private sector, our responsibility as really the chief network security agency within the federal government, critical infrastructure, and other equity holders in this environment is really receive the threat indicators. And we are building through a sticks and taxi system the capacity in automated form to then disseminate those threat indicators out to the community so that we raise the level of network security. We raise the baseline more ably. And we, at the very least, avoid the replication of an intrusion that one institution or one enterprise suffered. And the only way that we are going to be in a position to receive those threat indicators is if you trust us. If you trust us in terms of our capabilities and you also trust us with respect to the integrity of our actions. And we're also uniquely positioned in the federal government because we're the only department that has a statutorily created office of privacy and a statutorily created office of civil rights and civil liberties. And those equities are brought to bear in everything that we do in the network security arena. And in fact, everything that we do is a department of Homeland Security. Yesterday, somebody said, look, if I've got a threat indicator, if I've got the keys to the kingdom, quite frankly, I'm not going to, my risk tolerance might be high, but I'm not going to experiment and turn that over to you to find out whether you're worthy of our trust or not. And I understand that, and I appreciate it. And what I said was, look, trust is not built or rebuilt or regained overnight. It takes time. And what I would ask, if it's fair of me to do so, is that you start somewhere. Start somewhere where your willingness to take a risk with us is manageable to you. And let us prove to you what our capabilities are. And let us prove to you what the integrity of our actions and our intentions are. And that's what I would ask of you. And let's see what we can do and what we can do together. It's interesting. I heard, and it's very important for you to give us that chance. At least it's important to us in terms of what we are doing. Another comment that I heard yesterday was, you know what? We'd like to validate what you do. It's very difficult sometimes to validate from the outside. And maybe you can have a hacker validate your capabilities and validate the integrity of your actions. And I think, actually, that's a terrific idea. So I've got a couple thoughts. I thought about it a lot overnight. I thought a lot about the day I had had at Black Hat and the people I had met and the ideas that we exchanged. And I thought of two things. And I'll take them back to DC. And I'll share them with you now and see if they fly. And I'd be curious to hear if they fly with you. One is drawn from my experience when I was leading the immigration agency in the government, the agency US Citizenship and Immigration Services that administers the legal immigration system in our country. We administered visas for individuals that wanted to come and join businesses here in the United States from abroad. And it was remarkable how out of touch we were as an agency, out of touch we were with the startup community. Some of the questions and policies that we had would ask questions of individuals like, how many employees does the business have? Can we have the organizational chart? What's the floor plan? How much space do you lease? And the like. And it did not take into account that the next generation of businesses that will reinvent the world could be developing in a cubicle somewhere or in a garage, a basement, or an unfurnished room. And so what we did, what I did was I said, you know what? Certainly we don't have a monopoly on good ideas. We have a monopoly on very slow ideas, but not necessarily very good ideas. But you know what? Let's bring in the talent into the agency. And what we did was we brought in a number of entrepreneurs who were willing to take their time. They had done well enough, or they were supported by the entities for whom they worked at that time. They came in and joined us full time for six months. And then they extended, so they ended up staying a year. So that was an entrepreneurs and residence program. And what I would ask is how about doing a hacker in residence program in the Department of Homeland Security? And people who are willing to devote their time come in and lend us your talent, your skills, your expertise, your creative way of looking at things, and not only necessarily validating what we do, but actually helping us improve it. The second idea I had was to create, frankly, an advisory council of hackers, individuals who may not have the flexibility to join us on a full time basis, but can take a slice of their time here and again to provide us advice, to take a look at what we're doing, and to essentially achieve the same goal of validating or improving that which we do. I am tremendously proud of being in the federal government. I'm now in my 18th year. I've been in and out of government and the private sector. And I think there's an incredible opportunity to impact the life of many people, just as I think you understand and appreciate and execute that very opportunity. And I'd like to partner with you. We would like to partner with you and see if we can build a bridge of trust and actually develop a community of interest and a commonality of purpose. You know, yesterday I was in a couple meetings with individuals who shared with me their perspective of how Wassonar is a train wreck in their view. And they shared perspectives with me, to which I had not previously been exposed. I had a few thoughts. Number one, I've got to take those perspectives back home. And we've got to take a look at what Wassonar is and what it means. It was, hi, Katie. Good morning. Katie is one of the individuals who provided me with tremendous insights into Wassonar. And while it has its noble intentions of protecting human rights and fundamental human values, certainly I heard a chorus of views that it did not accomplish that goal at a price that proved worthy. I did note that Wassonar received 270 comments. And there were thousands and thousands of people at Black Hat. And there are thousands and thousands and thousands of people at DEF CON. And adhering to the adage that the keystroke is mightier than the sword, if you have a voice that you choose to express with respect to very important government policies and initiatives, I hope you will exercise that voice through the channels that we have available and the channels that you yourselves can create. But I do very much want to build a community. And I'm very dedicated to building that community of trust. And I really appreciate the opportunity to share some comments and thoughts with you, and I'd love to open it up to questions and comments and hear what you have to say and what you think. So thanks very much. Anyone give it a shot? And not this shot. I mean, a shot at a question. And I'll repeat the question. So the question was, do I think that we should be required to demonstrate the effectiveness of the security measures that we take and essentially impose upon the public before we actually impose them? For example, the security measures that we take at the airports, his buddy waited an hour in line because of our TSA processes. Let me say that it's not an all or nothing proposition. I think that with respect to some, we do and we can and maybe we should do more. And take a look at that. With respect to some, I'm not sure that we are able to, by virtue of the fact that some of those security measures are seen and unseen by necessity. But I think it raises a very important point, that trust is very difficult to build if we're not open and transparent. So I think your point is well taken. And we'll take a look at what measures we have and the effectiveness that we can demonstrate publicly. I will tell you that certainly the ineffectiveness of some of our measures was demonstrated publicly in a report that was published by our inspector general. And I think that there are reports available that shed some light on the effectiveness or lack of effectiveness of some of the things we do, whether it's inspector general reports or GAO reports. That's a fair point. And I appreciate the question and the service of openness and transparency. Thank you. Hi. OK. Yeah. So the question centers on, I think, the OPM breach. There are individuals who have provided to the government the most intimate information, the most confidential and private information I have on multiple occasions in anticipation of nominations and confirmations. And should people do that, what is the condition of the government, the government's capability to protect that information? You mentioned, you termed it a leak, which it isn't. A leak is when an individual in the government voluntarily provides information externally. This was an intrusion. And what is the government doing about securing its networks and what's our role in the Department of Homeland Security? I'm sorry. It's the... Oh, and also the contractual arrangements with other companies. OK. So a compound question. The network security of some government agencies and departments is not where it needs to be. Subsequent to the OPM breach, the government embarked upon a 30-day sprint to address some of the more easily accessible remedies that could be instituted. There are, as you know better than do I, there are immediate fixes, there are short-term, medium- and long-term. And all of those efforts are well underway, not just the sprint, which is a blocking and tackling exercise, but medium- and long-term exercises. We are taking a look at our contractual relationships. We are...we have placed in our contractual language requirements with respect to network security of the entities with which we contract. The Department of Homeland Security is one of the leaders in the government in ensuring that other government departments and agencies raise the level of the network security. We have a pivotal role in that. The Secretary of Homeland Security was empowered with the capacity to issue operational directives to other department and agency heads. He issued the first one, I think it was subsequent to the OPM breach, and we are exercising our authority in that regard. So the future is brighter than the past. Thank you. What exactly should be disclosed in the aggregate? I think we should be able to see what the top line is about. The bridges that have been covered within the double-header, what, what are their solicitation tasks or not. Re solicitation tasks, the magnitude, we think it's just not a big thing because it's not what happened. I think that the NACSR program exists and it will probably add to the number of holidays on some aspects of the internet, but we have one in the workspace and we will...with aggregate information about the physical rules, we'll see that happen. So the question, I'm going to paraphrase it and shorten it if you don't mind and tell me if I've captured it in spirit. In terms of voluntary disclosures, are we planning to aggregate information about intrusions that the government has suffered or intrusions about which we learn and disseminate that information broadly so that in the service I think of raising the level of awareness. And yes, we are. Yes, we are. I was going to actually share some remarks about the disclosure regime and quite frankly, you know, candidly yesterday, I learned that I'm ankle to knee deep in my facility with that issue. I know it's a very sensitive issue and there are some strongly held and competing views and I thought, you know what, I'm going to refrain from commenting until I build a greater facility with that particular issue. I will say this, if I may, just a quick other note of admiration. I also found it extraordinarily impressive the...while there are competing views about some very core issues with respect to the internet behavioral patterns and like it's extremely important and profound that the competing views are so grounded in ethical principles about the meaning of the conduct and the meaning of the issues and the ramifications for the creation of opportunities and the ability to actually exploit in the best sense of the term to exploit capabilities and talents. It's a very profound discourse. Sir. Yeah. So I appreciate that. So the point made was that there are...and I'm very eager to capture this fairly, that there are two things at play. There's trust and there's respect and it's very important that our department, if we seek to achieve both, engage with this community and appear at DeafContain and I think interact with this community more fulsomely. And that's why I'm here. And I'm very grateful for the opportunity. And I agree. Sir. I'm a graduate from Calabasas and I'm a watch and I run up to the 4th of July with the... Probably he said it's not going to be on my watch but on the run up to the 4th of July the visa system went down. I wonder if there's time whether that was a system failure or a system failure. I see. Was it a system failure or was it an intentional effort to reduce the inbound flow of individuals? And my understanding is that it was a system failure. Thank you. Thank you for coming up here. A lot of people are politicians and our viewers address the public. But not trust. And what we see in news are like with crypto. The so called crypto is still illegal or something that is illegal. And the other part is the CPFBI and the Unzubbs and the Unzubbs and the Unzubbs and the Unzubbs really have a backdoor system so the crypto is still illegal and the crypto is still illegal. If you think of previous cross-cuting, that's definitely the best way to get into this deal but we can see it. And yet the administration and our own administration want to have us plan backdoor. Here we have the problem with self-healing itself. And yet they totally want to put it backdoor for everyone to start getting into. I would like to have you say that's a bad idea. You don't want to do that. And you can stop that best kind of stuff. If the administration can do that, then we have to go along with it. Because we're trying to handle our wayards over in any other country. The NSA, oh you have the backdoor. The NSA is a privilege that you should never trust. You have the administration totally believe why I'm here and say hey, what do you need to do? This is a secret. This is a secret for the others. We need to have you guys go through the package. Can you say that? So the gentleman, I'm going to summarize and said, you know, the trust quotient is not increasing with our articulation of our position with respect to encryption and the request for a backdoor. And while he thanked me for being here, he challenged me to say that a backdoor is a bad idea. Okay? Let me... APPLAUSE It's the only thing that got an applause so far. I do take note of that. Let me say this. Okay? I know what the problem is and I don't know what the solution is. Okay? There are individuals who wish to do us harm on small scales and by a small scale, I don't think the victimized family would consider it to be small. A small scale and a large scale. And what happens is we lose track of critical communications that enable us to interdict a violent act before it reeks damage and that does have happened and there have been public examples in the last 60 days and we lose the ability to do that. And that is the problem. And I have heard certainly not only yesterday and today, but before this week, the concerns about a backdoor and I understand and appreciate that. And so what I can say is I am well aware of the problem. I am reminded of it every single morning in an information brief that I received with respect to the terrorist threat domestically and abroad and I do not know what the answer is. Can you answer that? I cannot say yes and I cannot say no. And I'm just being honest with you. I understand what people have, the opposition to a backdoor, that it compromises security to a greater degree than our concerns would dictate. That is one of the concerns. I am just not an expert in encryption. I am not an expert in the ramifications. I well understand the concerns and I don't know what, all I can say is I don't know what the solution is. And I am just being candid. I am not asking a lot from these other people to be honest. A lot of tabs, they probably did that in the South Atlantic and they were just obsessed with that. They are trying to bring in certain things like fact-facts and counter-factors. Those are the things that we are frustrated with. But what you are talking about is that that is the purpose of the South Atlantic and the state of the Atlantic. So companies are suffering intrusions. They are becoming increasingly frustrated with the fact that the risk or the threat remains. And they are considering offensive conduct. And what do I think about that sort of vigilante actions which runs afoul of the law? So if it runs afoul of the law, I am not going to support it. At least that is not to say that I agree with every law. But I do not, in this area, I think vigilanteism is far more destructive than constructive and I would strongly urge companies not to engage in that conduct. And the fact of the matter is, it underscores the need for all of us, I think, to work together to strengthen network security. You know, when I travel around the country and I speak to companies and when I travel around the world and I speak to companies internationally and governments, it seems that it is increasingly a given that an intrusion will occur. The question is how quickly can it be detected, expelled and remediated. And what I think we can do is more ably defend against the replication of intrusion. So if one company suffers it, another should not. And that is premised upon the sharing and circulation and dissemination of information. And then sharing best practices and the expertise and talent that resides in this room. I'm getting the hook. I want to thank you all very much for giving me some time this morning and for everything that you do. I hope I come back again. Thanks again. APPLAUSE
 Welcome to DEF CON 23. I'm Russ. I am the chief of operations for the conference. I've been here  for 17 years which is why I'm standing here today instead of hungover in my room. How many of you  are feeling okay this morning? That's not too bad. How many of you are new to DEF CON? That's not  bad either. I got to tell you, after all these years I still can't predict what you guys are  going to do. We're almost out of the badges even though we up the numbers. I do my damnedest and you  guys surprise me every single year. I wish you'd stop that. So we're going to queue off this year.  We're going to show you the trailer. How many of you have already seen the trailer online? All right.  So not many. So this is going to be really, really cool. The theme this year is kind of this film  noir thing. That's why we're walking around with albums. All the artwork reflects it. It's very  cool. If you haven't already started getting involved in lost badge challenge and that sort of  thing, please do. We have a ton of stuff going on in the villages and the event center over in  Bally's. We've kind of divided everything up. Hopefully every one of you is wearing a Fitbit  because there's a lot of stethesies. Yep, me. Go over there. All the actions over there. We have  the speakers and the information and the vendors and stuff over here. We tried to separate it out  a little bit. The parties are going to be over in Bally's tonight for the most part. If you have  questions, ask somebody in a red shirt. Be safe. Have a good time. And let's roll the demo so  they can see that, please. There it was again. This must be some kind of prophetic truth. Master  coincidence, certainly, but it couldn't be. No, these were not imagined patterns, the mind  seeking to connect accidents and thoughts with blurred lines. This was something real or  something... Something elegant in its simplicity, dangerous, cinematic, complex, and  deniable in all its obscure perfection. And everyone else be so blind. Or were there others who  observed this covert conspicuousness able to untangle this perplexity, understood this  cypher that surrounds this key, this 23. Woo! All right. Thank you. Thank you. Thank you. Thank  you. Woo! All right. So we're here. So we're going to kick things off this morning with our  keynote speaker. He's got a very long and rich history in security and also in research  areas. So, and in legal. So I hope you'll listen to what he has to say. This is Alhandro  Yorkis. He is our deputy secretary of Homeland Security. He was confirmed in 2013. You can  hear a lost boy over there starting their video too. He comes from University of California,  Berkeley. We have anyone from that area? I heard somebody hooting a holler. He's got a  law degree. He's got all sorts of education. And he's got a lot of insight into what the  government's thinking about information security, cybersecurity right now. So if you help me  welcome the deputy secretary. Good morning. Thanks very much for taking a little bit of  time to hear me out. And hopefully you'll ask questions and share your concerns or thoughts  with me. And we can have more of a conversation than I just give a speech. I will tell you  at the outset that I was instructed by my colleagues not to bring my government phone  with me this morning because it might suffer an intrusion. And I said, I don't believe  it. Let them take their best shot. And I challenge any of you to make my phone ring during my  remarks. And if you do, you'll get a free job with the government. So give it a shot.  Give it a shot. You know, I have to tell you, I tend to be retrospective when I experience  new things. I tend to reflect on my own past and my own life and the decisions I made.  And as I walk through this morning, the lobby area, and I went into the DEF CON swag room  and then the vendor swag room, I thought quite frankly of my high school, I thought I'd  be in the lobby area and I went into the DEF CON swag room and then the vendor swag room. I thought, quite frankly, of my high school years, and I thought about  1974 through 1977. And it's hard for me to believe that I walked by what was then a very nascent computer  room and actually walked by the future. But we are the decisions that we make and there's  always days ahead as well as days behind. So I look forward to developing greater skills  in this arena than I have now. You know, yesterday I had the privilege and the experience of  sharing some thoughts at Black Hat. And I've been looking forward to this morning as well.  And I have to tell you, I find the talent that is resident here to be stunning. It is  in my view a combination of brilliance, expertise, ingenuity and creativity, and also just a risk  tolerance, a tolerance or appetite to experiment and to see what happens. And I want to talk  a little bit more about what that means or what it could mean to us in the Department of Homeland  Security in a minute. But I also want to express the fact that we have in the Department of  Homeland Security in my opinion that same level of brilliance, expertise, ingenuity and risk  tolerance, perhaps not in me, but certainly in, for example, the three members of our  US CERT team, computer emergency readiness team that I interacted with yesterday at Black  Hat, our ICS CERT team, our industrial control system CERT team that's resident in D.C. These  teams fly all over the country, respond to intrusions not just in the public sector,  not just that the government suffers, but also that the private sector experiences and  assists companies and entities and institutions in identifying the intruder, expelling the  intruder and remediating the system. It's a tremendous core of individuals. What troubles  me a great deal and it's something that was quite frankly underscored yesterday and the  questions and comments I received during and following my remarks at Black Hat is that  there's a divide between the two groups, the two collection or communities of individuals.  And it's a divide of mistrust that there's a trust deficit as I called it yesterday between  all of you and us in the government. And I know that it's born of quite a number of things  over the years and of course in recent past, whether it's an intrusion that we suffered  that speaks to the state of our own network security, whether it's some of the practices  or principles that we execute or espouse. But I'm very dedicated to doing what we can to  bridge that divide. You know, it should be after all a more unified community. If we speak about the internet as a global commons, then I think we  have to have a common purpose and a common understanding to achieve at least the level of the  community. And I think that's the only way that we in the Department of Homeland Security  at least will achieve our primary goal of building an ecosystem of information sharing.  This is quite troubling to me. I've actually never seen Nyquil in that bottle before. That's probably not going to happen by the way.  I'm sorry. Can I interrupt? You did. Well played, sir. We have a little tradition here at Deafcon. Do you have a little tradition here at Deafcon? Do you all know what it is? I've never seen a person who has a  We have a first-time speaker.  You know, let me share some thought with you.  I'm going to share two things with you.  First of all, I'm going to share a story about my landlord  when I was a federal prosecutor.  His name was actually Jack Daniels.  It's true.  And every morning, he was 94 years old.  He had a beautiful mane of hair.  His skin looked as though he was 27.  And he lamented the fact that he had to wear reading glasses  to read the paper and read novels in the morning  and in the evening.  And every morning, I left my apartment early.  I lived above him.  I left my apartment early to go to work  to the smell of frying bacon.  Every single morning and every single evening,  I came home late and had to pick Jack out of the bushes  because he used to have a couple very tall vodka  tumblers to end each day.  It just goes to show you what the key of life is.  It has something to do with Jack Daniels.  It is very difficult to talk about a trust deficit  and how to bridge that deficit and really build trust  when I'm a fraud.  And this is actually water.  That's the official story, and he's sticking with it.  So I'll tell you what.  As long as you promise to make it small,  I'll take a shot at the real stuff.  Hey.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  Whoa.  And it's got to be small because after this,  I'm actually meeting with TSA colleagues.  And yeah, it's exactly right.  All right.  You're a trooper, man.  Cheers.  Cheers.  Cheers.  DevCon.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Cheers.  Thank you.  Thank you.  That's my way.  That's my way of really actually saluting all of you.  I am captivated.  I am really captivated by the talent that is here  and the potential that it represents for the world.  Can we get a round of applause?  That's a reason we're a trooper.  Thank you.  That was my first of the day, by the way.  It may not be my last.  So what we aspire to is an environment  where the cyber threat indicator is not of proprietary value,  but is actually something that is exchanged publicly.  What we feel we can do more ably than anyone else  in the government, because of our unique position  as a civilian agency.  We're also uniquely positioned at the intersection  of the private sector, our responsibility  as really the chief network security agency  within the federal government, critical infrastructure,  and other equity holders in this environment  is really receive the threat indicators.  And we are building through a sticks and taxi system  the capacity in automated form to then disseminate  those threat indicators out to the community  so that we raise the level of network security.  We raise the baseline more ably.  And we, at the very least, avoid the replication  of an intrusion that one institution or one enterprise  suffered.  And the only way that we are going  to be in a position to receive those threat indicators  is if you trust us.  If you trust us in terms of our capabilities  and you also trust us with respect  to the integrity of our actions.  And we're also uniquely positioned in the federal government  because we're the only department that  has a statutorily created office of privacy  and a statutorily created office of civil rights  and civil liberties.  And those equities are brought to bear in everything  that we do in the network security arena.  And in fact, everything that we do  is a department of Homeland Security.  Yesterday, somebody said, look, if I've got a threat indicator,  if I've got the keys to the kingdom, quite frankly,  I'm not going to, my risk tolerance might be high,  but I'm not going to experiment and turn that over to you  to find out whether you're worthy of our trust or not.  And I understand that, and I appreciate it.  And what I said was, look, trust is not built or rebuilt  or regained overnight.  It takes time.  And what I would ask, if it's fair of me to do so,  is that you start somewhere.  Start somewhere where your willingness  to take a risk with us is manageable to you.  And let us prove to you what our capabilities are.  And let us prove to you what the integrity of our actions  and our intentions are.  And that's what I would ask of you.  And let's see what we can do and what we can do together.  It's interesting.  I heard, and it's very important for you to give us  that chance.  At least it's important to us in terms of what we are doing.  Another comment that I heard yesterday was, you know what?  We'd like to validate what you do.  It's very difficult sometimes to validate from the outside.  And maybe you can have a hacker validate your capabilities  and validate the integrity of your actions.  And I think, actually, that's a terrific idea.  So I've got a couple thoughts.  I thought about it a lot overnight.  I thought a lot about the day I had had at Black Hat  and the people I had met and the ideas that we exchanged.  And I thought of two things.  And I'll take them back to DC.  And I'll share them with you now and see if they fly.  And I'd be curious to hear if they fly with you.  One is drawn from my experience when  I was leading the immigration agency in the government,  the agency US Citizenship and Immigration Services that  administers the legal immigration system in our country.  We administered visas for individuals  that wanted to come and join businesses here in the United  States from abroad.  And it was remarkable how out of touch we were as an agency,  out of touch we were with the startup community.  Some of the questions and policies that we had would ask  questions of individuals like, how many employees does the  business have?  Can we have the organizational chart?  What's the floor plan?  How much space do you lease?  And the like.  And it did not take into account that the next generation of  businesses that will reinvent the world could be  developing in a cubicle somewhere or in a garage, a  basement, or an unfurnished room.  And so what we did, what I did was I said, you know what?  Certainly we don't have a monopoly on good ideas.  We have a monopoly on very slow ideas, but not necessarily  very good ideas.  But you know what?  Let's bring in the talent into the agency.  And what we did was we brought in a number of  entrepreneurs who were willing to take their time.  They had done well enough, or they were supported by the  entities for whom they worked at that time.  They came in and joined us full time for six months.  And then they extended, so they ended up staying a year.  So that was an entrepreneurs and residence program.  And what I would ask is how about doing a hacker in  residence program in the Department of Homeland  Security?  And people who are willing to devote their time come in and  lend us your talent, your skills, your expertise, your  creative way of looking at things, and not only  necessarily validating what we do, but actually helping us  improve it.  The second idea I had was to create, frankly, an advisory  council of hackers, individuals who may not have the  flexibility to join us on a full time basis, but can take a  slice of their time here and again to provide us advice, to  take a look at what we're doing, and to essentially  achieve the same goal of validating or improving  that which we do.  I am tremendously proud of being in the federal government.  I'm now in my 18th year.  I've been in and out of government and the private  sector.  And I think there's an incredible opportunity to  impact the life of many people, just as I think you  understand and appreciate and execute that very opportunity.  And I'd like to partner with you.  We would like to partner with you and see if we can build a  bridge of trust and actually develop a community of  interest and a commonality of purpose.  You know, yesterday I was in a couple meetings with  individuals who shared with me their perspective of how  Wassonar is a train wreck in their view.  And they shared perspectives with me, to which I had not  previously been exposed.  I had a few thoughts.  Number one, I've got to take those perspectives back home.  And we've got to take a look at what Wassonar is and what  it means.  It was, hi, Katie.  Good morning.  Katie is one of the individuals who provided me with  tremendous insights into Wassonar.  And while it has its noble intentions of protecting  human rights and fundamental human values, certainly I  heard a chorus of views that it did not accomplish that goal  at a price that proved worthy.  I did note that Wassonar received 270 comments.  And there were thousands and thousands of people at Black  Hat.  And there are thousands and thousands and thousands of  people at DEF CON.  And adhering to the adage that the keystroke is mightier  than the sword, if you have a voice that you choose to  express with respect to very important government policies  and initiatives, I hope you will exercise that voice  through the channels that we have available and the  channels that you yourselves can create.  But I do very much want to build a community.  And I'm very dedicated to building that community of  trust.  And I really appreciate the opportunity to share some  comments and thoughts with you, and I'd love to open it up  to questions and comments and hear what you have to say  and what you think.  So thanks very much.  Anyone give it a shot?  And not this shot.  I mean, a shot at a question.  And I'll repeat the question.  So the question was, do I think that we should be  required to demonstrate the effectiveness of the security  measures that we take and essentially impose upon the  public before we actually impose them?  For example, the security measures that we take at the  airports, his buddy waited an hour in line because of our  TSA processes.  Let me say that it's not an all or nothing proposition.  I think that with respect to some, we do and we can and  maybe we should do more.  And take a look at that.  With respect to some, I'm not sure that we are able to, by  virtue of the fact that some of those security measures are  seen and unseen by necessity.  But I think it raises a very important point, that trust is  very difficult to build if we're not open and transparent.  So I think your point is well taken.  And we'll take a look at what measures we have and the  effectiveness that we can demonstrate publicly.  I will tell you that certainly the ineffectiveness of some  of our measures was demonstrated publicly in a  report that was published by our inspector general.  And I think that there are reports available that shed  some light on the effectiveness or lack of  effectiveness of some of the things we do, whether it's  inspector general reports or GAO reports.  That's a fair point.  And I appreciate the question and the service of openness  and transparency.  Thank you.  Hi.  OK.  Yeah.  So the question centers on, I think, the OPM breach.  There are individuals who have provided to the government the  most intimate information, the most confidential and private  information I have on multiple occasions in anticipation of  nominations and confirmations.  And should people do that, what is the condition of the  government, the government's capability to protect that  information?  You mentioned, you termed it a leak, which it isn't.  A leak is when an individual in the government voluntarily  provides information externally.  This was an intrusion.  And what is the government doing about securing its  networks and what's our role in the Department of Homeland  Security?  I'm sorry.  It's the...  Oh, and also the contractual arrangements with other  companies.  OK.  So a compound question.  The network security of some government agencies and  departments is not where it needs to be.  Subsequent to the OPM breach, the government embarked upon a  30-day sprint to address some of the more easily accessible  remedies that could be instituted.  There are, as you know better than do I, there are  immediate fixes, there are short-term, medium- and long-term.  And all of those efforts are well underway, not just the  sprint, which is a blocking and tackling exercise, but  medium- and long-term exercises.  We are taking a look at our contractual relationships.  We are...we have placed in our contractual language  requirements with respect to network security of the  entities with which we contract.  The Department of Homeland Security is one of the leaders  in the government in ensuring that other government  departments and agencies raise the level of the network  security.  We have a pivotal role in that.  The Secretary of Homeland Security was empowered with the  capacity to issue operational directives to other  department and agency heads.  He issued the first one, I think it was subsequent to the OPM  breach, and we are exercising our authority in that regard.  So the future is brighter than the past.  Thank you.  What exactly should be disclosed in the aggregate?  I think we should be able to see what the  top line is about.  The bridges that have been covered within the  double-header, what, what are their solicitation  tasks or not.  Re solicitation tasks, the magnitude, we think it's just  not a big thing because it's not what happened.  I think that the NACSR program exists and it will  probably add to the number of holidays on some  aspects of the internet, but we have one in the  workspace and we will...with aggregate information  about the physical rules, we'll see that happen.  So the question, I'm going to paraphrase it and  shorten it if you don't mind and tell me if I've  captured it in spirit.  In terms of voluntary disclosures, are we planning  to aggregate information about intrusions that the  government has suffered or intrusions about which we  learn and disseminate that information broadly so that  in the service I think of raising the level of  awareness.  And yes, we are.  Yes, we are.  I was going to actually share some remarks about the  disclosure regime and quite frankly, you know,  candidly yesterday, I learned that I'm ankle to knee  deep in my facility with that issue.  I know it's a very sensitive issue and there are  some strongly held and competing views and I  thought, you know what, I'm going to refrain from  commenting until I build a greater facility with  that particular issue.  I will say this, if I may, just a quick other note of  admiration.  I also found it extraordinarily impressive the...while  there are competing views about some very core issues  with respect to the internet behavioral patterns and  like it's extremely important and profound that the  competing views are so grounded in ethical principles  about the meaning of the conduct and the meaning of  the issues and the ramifications for the creation of  opportunities and the ability to actually exploit in the  best sense of the term to exploit capabilities and  talents.  It's a very profound discourse.  Sir.  Yeah.  So I appreciate that.  So the point made was that there are...and I'm very eager  to capture this fairly, that there are two things at play.  There's trust and there's respect and it's very  important that our department, if we seek to achieve both,  engage with this community and appear at DeafContain and  I think interact with this community more fulsomely.  And that's why I'm here.  And I'm very grateful for the opportunity.  And I agree.  Sir.  I'm a graduate from Calabasas and I'm a watch  and I run up to the 4th of July with the...  Probably he said it's not going to be on my watch but  on the run up to the 4th of July the visa system went down.  I wonder if there's time whether that was a system failure  or a system failure.  I see.  Was it a system failure or was it an intentional effort to  reduce the inbound flow of individuals?  And my understanding is that it was a system failure.  Thank you.  Thank you for coming up here.  A lot of people are politicians and our viewers  address the public.  But not trust.  And what we see in news are like with crypto.  The so called crypto is still illegal or something that is  illegal.  And the other part is the CPFBI and the Unzubbs  and the Unzubbs and the Unzubbs and the Unzubbs  really have a backdoor system so the crypto is  still illegal and the crypto is still illegal.  If you think of previous cross-cuting,  that's definitely the best way to get into this deal  but we can see it.  And yet the administration and our own administration  want to have us plan backdoor.  Here we have the problem with self-healing itself.  And yet they totally want to put it backdoor  for everyone to start getting into.  I would like to have you say that's a bad idea.  You don't want to do that.  And you can stop that best kind of stuff.  If the administration can do that,  then we have to go along with it.  Because we're trying to handle our wayards over in any other country.  The NSA, oh you have the backdoor.  The NSA is a privilege that you should never trust.  You have the administration totally believe why I'm here  and say hey, what do you need to do?  This is a secret.  This is a secret for the others.  We need to have you guys go through the package.  Can you say that?  So the gentleman, I'm going to summarize and said,  you know, the trust quotient is not increasing  with our articulation of our position with respect to encryption  and the request for a backdoor.  And while he thanked me for being here,  he challenged me to say that a backdoor is a bad idea.  Okay?  Let me...  APPLAUSE  It's the only thing that got an applause so far.  I do take note of that.  Let me say this.  Okay?  I know what the problem is and I don't know what the solution is.  Okay?  There are individuals who wish to do us harm on small scales  and by a small scale, I don't think the victimized family  would consider it to be small.  A small scale and a large scale.  And what happens is we lose track of critical communications  that enable us to interdict a violent act before it reeks damage  and that does have happened and there have been public examples  in the last 60 days and we lose the ability to do that.  And that is the problem.  And I have heard certainly not only yesterday and today,  but before this week, the concerns about a backdoor  and I understand and appreciate that.  And so what I can say is I am well aware of the problem.  I am reminded of it every single morning in an information brief  that I received with respect to the terrorist threat domestically  and abroad and I do not know what the answer is.  Can you answer that?  I cannot say yes and I cannot say no.  And I'm just being honest with you.  I understand what people have,  the opposition to a backdoor,  that it compromises security to a greater degree  than our concerns would dictate.  That is one of the concerns.  I am just not an expert in encryption.  I am not an expert in the ramifications.  I well understand the concerns and I don't know what,  all I can say is I don't know what the solution is.  And I am just being candid.  I am not asking a lot from these other people  to be honest.  A lot of tabs, they probably did that in the South Atlantic  and they were just obsessed with that.  They are trying to bring in certain things like  fact-facts and counter-factors.  Those are the things that we are frustrated with.  But what you are talking about is that  that is the purpose of the South Atlantic  and the state of the Atlantic.  So companies are suffering intrusions.  They are becoming increasingly frustrated  with the fact that the risk or the threat remains.  And they are considering offensive conduct.  And what do I think about that sort of vigilante actions  which runs afoul of the law?  So if it runs afoul of the law,  I am not going to support it.  At least that is not to say that I agree with every law.  But I do not, in this area,  I think vigilanteism is far more destructive than constructive  and I would strongly urge companies not to engage  in that conduct.  And the fact of the matter is,  it underscores the need for all of us,  I think, to work together to strengthen network security.  You know, when I travel around the country  and I speak to companies and when I travel around the world  and I speak to companies internationally and governments,  it seems that it is increasingly a given  that an intrusion will occur.  The question is how quickly can it be detected,  expelled and remediated.  And what I think we can do is more ably defend against  the replication of intrusion.  So if one company suffers it, another should not.  And that is premised upon the sharing and circulation  and dissemination of information.  And then sharing best practices and the expertise  and talent that resides in this room.  I'm getting the hook.  I want to thank you all very much for giving me some time  this morning and for everything that you do.  I hope I come back again.  Thanks again.  APPLAUSE
DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_0_2987.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_2988_5819.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_5820_5963.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_5964_6323.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_6324_6623.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_6624_6803.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_6804_7355.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_7356_7415.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_7416_10283.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_10284_12215.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_12216_14891.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_14892_15455.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_15456_15515.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_15516_16199.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_16200_16343.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_16344_16835.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_16836_16895.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_16896_17483.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_17484_17699.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_17700_17819.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_17820_18935.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_18936_18983.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_18984_19823.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_19824_20111.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_20112_20555.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_20556_23807.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_23808_23903.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_23904_23975.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_23976_24035.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_24036_24359.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_24360_24575.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_24576_27263.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_27264_28055.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_28056_28679.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_28680_28847.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_28848_29555.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_29556_29663.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_29664_29831.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_29832_31331.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_31332_32591.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_32592_34007.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_34008_34067.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_34068_34151.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_34152_35315.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_35316_35639.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_35640_37487.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_37488_41159.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_41160_42359.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_42360_43691.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_43692_45107.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_45108_49823.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_49824_51323.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_51324_51443.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_51444_52451.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_52452_52643.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_52644_55511.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_55512_56435.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_56436_56531.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_56532_61535.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_61536_64403.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_64404_64607.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_64608_64691.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_64692_65507.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_65508_67079.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_67080_69467.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_69468_69551.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_69552_69611.png DEF_CON_23_-_Alejandro_Mayorkas_-_Working_together_to_keep_the_Internet_safe_and_secure_u6dHxhPXcNM_69612_69733.png