Black Hat’s Jeff Moss: ‘We’re in a Political Situation, Whether You Like It or Not’
Technology doesn’t exist in a vacuum, and by extension neither does cybersecurity.
See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective
While this has always been true, unlike the bygone days of ’80s phone phreaking and pre-internet hardware hacking, as technology has become more essential to the functioning of everyday life, it’s taken on new dimensions, said Jeff Moss, the founder of the annual Black Hat conference.
Taking the stage Wednesday morning in London to open the 25th edition of the annual cybersecurity event, Moss told attendees that in recent years, he’s been “struggling” to acknowledge the “uncomfortable truth” that today, “all tech is political.”
“Just saying it makes me not feel good, because I grew up when tech really wasn’t political. I grew up in an era where there was nothing to steal online,” he said.
Gone are the days when hackers could explore phone networks, “and you really couldn’t do any harm, because there was nothing, really no value, at risk,” he said. Now, that has changed utterly. “As the technology has permeated all of our lives now, any technical decision you make has a political consequence,” he said.
Take a business weighing its use of hyperscalers, and having to decide if it will use one that’s largely centralized in the United States. Look at the question of whether governments will mandate that consumers have a “right to repair” devices they purchased. Listen to some legislators repeatedly calling for strong, end-to-end encryption to be outlawed.
The impact of hacking and data breaches increasingly carries a societal cost, as demonstrated by a Western adolescent hacking group disrupting U.K. automotive giant Jaguar Land Rover, triggering assembly line stoppages and supply chain disruptions forecasted to cost the British economy $2.5 billion. Or look at Finnish hacker Aleksanteri Tomminpoika Kivimäki breaching counseling service Vastaamo and leaking the ultra-sensitive counselling session transcripts of 20,000 individuals. An attorney representing victims said at least two of them appear to have taken their own life as a result.
All technology business decisions, debates, unresolved questions and repercussions now feature a political element. Because technology is becoming increasingly important to the functioning of everyday society, the government is also increasingly looking to regulate aspects of it. “We don’t build this tech in a bubble,” Moss said.
Technology-wise, there’s so much water under the bridge. To be sure, advances have regularly sparked fear and panic, not least among less-tech-astute policymakers. Moss said his hacker generation survived the PGP Wars, when the question of whether publishing an uncrackable algorithm counted as free speech. What about printing it on a t-shirt, or trying to export it?
They also lived through the Clipper Chip era, which would have seen a chip promoted by the National Security Agency get added to phones to encrypt their communications, but with a recovery key in case the government wanted to recover the call. “And that did not go over well, and so now we still have unencrypted voice calls in the United States, and the government never got their backdoors,” Moss said.
Such debates continue today, not least in Europe, where many lawmakers, law enforcement and intelligence agencies regularly advocate for weak encryption, to facilitate government surveillance. This has cryptographers, mathematicians, computer scientists and other cybersecurity experts regularly ripping out their hair, as their warnings over the risk to society continue to be ignored.
In 2009, Moss joined the U.S. Department of Homeland Security as a member of its technology advisory council, which the DHS secretary would regularly task with researching emerging technology, to help inform policy development, but without any political overtones, he said.
Moss sees the 2016 U.S. presidential election as a watershed. Blame Russia’s disinformation campaign and its existential threat to democracy, but also subsequent trade wars, increasing competition with China, and the United States and its Western allies coming to grips with the “clean cables” and “clean telecom” risk posed by inexpensive communications gear being manufactured and disseminated worldwide by the likes of Huawei.
Moss also founded the annual, summertime DEF CON hacker conference in Las Vegas – its name an homage to that classic hacking film, War Games. In the post-Soviet era, how these games have changed. Before the conference every year, he said, his business has “to fill out a form that says we don’t have any Huawei or Hikvision equipment in our networks if we want to have DARPA come and do their AI cyber challenge.”
Not just infrastructure but also cybercrime has become increasingly political. Ransomware in particular “is like a master-class level of every kind of political problem you can think of,” Moss said, from who’s allowed to negotiate on a victim’s behalf to navigating a potential ransom payment. Pending legislation in the United Kingdom, for example, may outlaw ransom payments by public bodies and require other organizations to first submit them to the government for approval. Already, victims who want to pay must try to ascertain if their attacker is on a sanction’s list.
Russians largely feature on this list. Moscow appears to not just tolerate these groups but likely control them directly, wielding them as deniable cyber proxies. North Koreans also feature. The murderous, despotic regime based in Pyongyang is an expert-level user of malware, including crypto-lockers, waging industrialized campaigns that funnel stolen Western funds into its nuclear weapon and ballistic missile program.
Given such geopolitics, why is ransomware even an IT issue? “Shouldn’t the State Department be dealing with that? Why does my small administrator have to deal with ransomware?” Moss said.
“So my point is that we’re in a political situation, whether you like it or not,” Moss told attendees. “I don’t like acknowledging it, but we’re there, that’s where we’re at,” and a world in which there aren’t “any easy choices left anymore” is what’s now in effect.
Rather than being despondent, Moss issued a call to action, by exhorting the audience to help fight the good fight – whether it’s by working with technology projects, getting involved in public-private coalitions that seek to inform better technology and cybersecurity policy, or even direct funding.
“Please support the projects and causes that you believe in. Whether it’s donating to Wikipedia or running a relay for Tor, it’s up to us,” he said.