The next talk will ask the question, will algorithms solve the problems of climate change? More data, let us monitor the Earth, optimize solar panels and generally understand problems. But is it sustainable? Jens Aulig from Algorithm Watch and Friederike Rode, Institute for Ecological Economic Research will talk a little bit about this problem and I'm looking forward to this talk. So I give over to Jens and Friederike. Hello, good morning. I hope I'm audible and thank you so much for having us. So we will talk about our project called Sustain, the Sustainability Index for Artificial Intelligence. And we are very excited because it's about the first time that we are going to present this to a larger audience and I think this is a good way to introduce this to the world. So who we are? As our Harold already mentioned in the introduction, there are two organizations involved but there's actually a third one that is not present today. So there's the Institute for Ecological Economic Studies and there's Algorithm Watch, both based in Berlin. There's also the Technical University of Berlin or rather the Distributed Artificial Intelligence Lab there and we are running this project called Sustain, Sustainability Index for Artificial Intelligence where we want to find out over the course of the next three years how we can measure and index criteria for the sustainability of algorithms. There is funding for that, luckily. The Federal Ministry of Environment funds this project and this is based on the resolution of the German parliament, of course. So when we talk about sustainable AI, there are lots of questions and some of them were already mentioned in the introduction. So will we be able to stop climate change through better monitoring our planet? Unlikely so, probably there's no magical solution to all of that but on the other hand it is very clear that once we have more data and better data we can of course make more informed decisions. So looking at where AI is actually helpful for sustainability is one part of the question and the other part is how does it affect sustainability? So there's a lot of talk about energy consumption, how much energy do data centers suck up and there are already a few numbers that are usually thrown around in that context. I believe that Friedrich will at least mention that later there are numbers that say this algorithm takes about the energy of that many cars etc. Is that all true? Is there something that we can put into concrete numbers that remains to be seen? But sustainability goes a bit further. It's not only about doing something that is good for the environment. A sustainable world is a world that is worth living in and a lot of the magical artificial intelligence solutions that are proposed. Once you look behind the scenes you will notice that the emperor wears no clothes and what is behind all the magic of the AI is maybe good old precarious work conditions. People who are clicking through mundane tasks and maybe don't live in a very sustainable environment. We call these people click workers and a lot of the things that you can see maybe in your speakers that you have at home that answer all the questions are maybe not the result of some nifty algorithm but rather the work of click workers. So if we put this aspect also into the question of sustainable AI the question becomes much larger than what is good for the environment. It becomes a question of how can we live in a livable world and the question is very real and we see things affecting that every day. We see questions of discrimination racial bias in algorithms. We see questions of Google translating things on a databases that perpetuates gendered bias and sexist stereotypes. Is this really the sustainable world that we want to live in just with some AI? I think not. By the way artificial intelligence is a huge word and it sometimes gets used in contexts where people don't seem to understand what they're talking about. So it's easier to narrow it down. Algorithm is another word with an organization like algorithm watch. Of course we don't watch the performance of I don't know quick sort or something like that. We are interested in automated decision making systems. So every time we're based on data and statistical transformation of that data maybe in the form of neural networks or machine learning or maybe not and decisions are made based on that and they have an impact on society. We're interested in that and right now our interest with sustain is sustainability in that context. Sustainability is actually a really really old concept much much older than than a century. Funnily enough it comes from Germany. So nowadays you see it everywhere but in the beginning it just meant a very simple thing from forestry. To be sustainable just don't cut down more trees than you planned. But in 2015 the United Nations picked this up and now sustainability is everywhere in the form of the SDGs the Sustainable Development Goals that were adopted by the United Nations General Assembly. Basically a set of goals that will make our world more livable. We want to have no poverty in this world.  There are sub goals and everything around that. To make a livable planet at least some of these goals have to be considered and a livable planet also includes artificial intelligence and algorithmic decision making. So let's bring these two together. It is all linked and all brought together by these goals interacting. So there are questions of ecological sustainability. Let's not burn the planet. If we fail to do that everything else becomes less important because we don't have a planet to plan all the other steps about. But we also want to make life livable for human beings. Having something that is ecological but requires a lot of people working in precarious work conditions is not the goal. We want to have a society that takes out the full potential of every human being. And certainly if everything crashes the economy we have an ecological sustainable world and a socially just world. But economically we just get more and more poverty that doesn't really work. So everything is connected. Frederike will continue with this. Thank you very much Jens and good morning from my side. Now that we have the question is how do we act if there are conflicting goals between the pillars. For example if the protection of the environment is not appropriate for all social groups because it's more expensive or if there are conflicting goals between ecological social and the economics field which in our current economic system mostly is the case. Then we should come to perspective which allows for a kind of prioritization of the three pillars. And the answer to this question is the perspective of the nested dependencies. Without the environment the society and the economy cannot exist. So our planetary boundaries are the basis of our survival. And as Jens already mentioned there's a codependency of all the three pillars. So in other words this nested dependencies model acknowledges the inherent value of the environment and prioritizes the health of our planet and the viable society over economic gains. Next slide please. But what are we actually talking about when we want to connect A to sustainability. From my point of view there two differing perspectives. The first one which makes up the main motivation of this project is the question of how can we assess kind of all existing AI based system or ADM systems from a sustainability perspective. So with an AI based system as Jens already mentioned we mainly refer to machine learning. A certain area of weak artificial intelligence because not everything is artificial intelligence what is sometimes called artificial intelligence. And we especially refer to deep learning based on artificial neural networks. I will leave it like that for the moment. But what is the aim of our project. We want to develop a framework for assessing the impact of existing AI based systems. And the application with regard to their social ecological and economic risks. That is we want to develop a holistic perspective for assessing AI based systems and showing which screws you can turn to develop drain and apply them in a more sustainable way. That is one perspective. We call it sustainable AI or sustainable AI based system to make it more precise. Another perspective which has recently come up and which Jens already mentioned as well is the question of AI for sustainability. So how can we use develop apply AI based system in favor of our climate or in favor of environmental goals in favor of social goals. Sometimes it's called AI for earth or AI for good. But that's in our point of view that's a kind of different question because these kind of applications only make up a minority of all AI applications that are existing in the world. Next slide please. In a way we want to kind of integrate those two perspectives. The first aim is to create sustainability criteria for principally all AI based system to or at least to bring us a little bit closer to the goal to develop this kind of assessment criteria. And on the other side we will examine three case studies in sectors which are of high relevance for the sustainable development goal such as energy mobility. And we choose which we chose another one which is online shopping because we think the impact is very high and there's very much AI based system used in this domain. So we will examine in the case studies what what can we expect from AI based system for the energy transition the mobility transition and so on for the sustainable for reaching the sustainable development goals. The results of the sustainable criteria and assessment and of the case studies will collected in sustainable AI imports. If our criteria work out very well perhaps we are able to create an index showing like what kind of how is the the the certain AI based system how can we assess it in terms of sustainable sustainability and perhaps we can this can be displayed on a website that dashboard or an app and we want to develop policy recommendations and guidelines for sustainable AI development which mainly are referring to the community who is training developing and the organizations who are implementing and using AI based system. The next slide please. It's a little bit small perhaps you cannot read it but it doesn't matter that much. Our first thought within this project was how can we find a structure out of the universe of impacts related to AI one can imagine. Our first answer was this kind of figure which shows three levels which we consider as appropriate for answering the question on how to measure or to to to look at the the impacts of AI based system. The first one is the algorithm itself or we call it algorithmic system because it's not only the algorithm it's also about not only about how the algorithm is designed but also about how the data is gathered what kind of data is used what is the utility function of the AI based system what in our perspective is a really important question so that's the most inherent impacts you can imagine when it comes to AI then we have the application level here the question is in which sector in which domain is the AI based system used and what social ecological and economic impacts or risks are related to the application of this AI based system so you can for example imagine using AI for medical diagnostics or for advertising you can use it for predictive maintenance or for selecting job applicants and as you can imagine the impact related to this certain area is very different might be very different so that's a no nothing so that's a important question and the the third one is the like the kind of big question of the societal level the systemic level it's like what impact does the application of this AI based system in a certain area does on our societal goals and related to this question is the question of how can it can it help us to change structures practices for sustainable development so I think the question on how AI can help our society to get more sustainable is mostly related to this third level and not to the level of like how do we design the algorithmic system so our first step was to to collect the various literature related to the impacts of AI and work out some preliminary criteria and we tried to find out of the existing literature and we also created some new criteria especially in the domain of economic dimension in the social dimension we found those criteria you can see here it's about transparency traceability fairness and justice harm avoidance non-discrimination a quite important issue for every AI based system with which is interacting with humans or which is making decisions about humans privacy and data protection for sure and respect for human autonomy and freedom human oversight and robustness and accuracy and at the moment we are about to trying to develop indicators for those criteria or how you can on the basis of which you can assess some systems such like such like were there did they make pre-tests with the AI based system and stuff like this next slide please the economic dimension in our perspective it's the most difficult dimension for criteria because it relates to very different levels of society so in our perspective we collected well we tried to collect some of the criteria which might be feasible foreign assessment which are like texas so is the organization paying texas data protection data collection practices but also aspects like market power anti-competitive behavior privacy policies anti-corruption labor market effects which are like more on the structural level income distribution working conditions as Jens already mentioned the click worker issue and stuff like this and impact on competitive supervision and robustness and accuracy which we had already before but perhaps we can also see it as kind of economic criteria and then there's also going on a kind of growing discussion about the ecological impacts of AI based system and it's mainly about the energy consumption and CO2 emissions for example the share of renewables the ecological but also the ecological impacts on consumption patterns resource consumption or for example waste and recycling do we need ever more devices sensors and stuff like this for applying all this magical AI systems and does this really make our world more sustainable or does this infect harm our environment more than the saving environment at the moment we are thinking about how we can distinguish between different levels of AI deployment because they might entail very different impacts some of you might know as Jens already mentioned at the beginning a study from Emma Strube and colleagues and the results often are cited like this the carbon footprint of training a single AI is as much as 284 tons of carbon dioxide equivalent five times the lifetime emissions of an average car but in fact this number is not true that way because this number refers to neural architecture neural network architecture search so it's not the same as training a common model but it's like the thing people only do for research purposes and which costs like two millions of dollars which no normal organization would do to train like a single model for like showing me what kind of genes I can buy if I because I bought this one so recommendation systems or stuff like this so we really have to look a little bit closer on how do we really want to assess the impacts of AI based system and that's why we are trying to distinguish between like three levels and the one is the network optimization or network architecture research with which mainly refers to the research area then we have the training of the artificial neural network and then we have the inference process so the process where the model really is applied and makes decisions or helps to make decisions so we think we should especially when it comes to ecological dimension it's important to distinguish between these three levels and with our project we would like to open the black box a little bit more and create awareness among amongst the involved actors about the risks and we about the risks we buy into when we try to solve like every optimization problem no matter how small with complex deep learning algorithms and what can we do to avoid those risks and improve AI based system in a sustainable way thank you very much okay okay sorry thank you for your very interesting talk so I think we already know but we know it much better now that the world is really complex so and I think this research is really important for society but for me when I listen to your talk and I think this could be perhaps the first question before people hopefully started to put questions in the pad you can find it in the Fablan and you can also put your question in German there if you want so but for me it was like but what can you know when I listen to these complex things what can I do as a person depending on your research well in the end I think you will have something that for you as an interested person will help you to understand the whole situation better we we started out with a with a very ambitious goal to be honest Frederike said maybe in the end there will be a website or an app or some kind of easy to look at number and we're not really sure if this is the end result what we are sure is that we will produce information and that we will produce both policy recommendations so we want to influence policymakers and we want to hand out something for the hacker community for the developers with the AI development guidelines so this will be something that comes out of that and if you develop software and care about livable planet this this is something that is very concrete for you but I agree yeah that's this is a huge problem and there's no easy answer to that and we are just starting this journey of three years yeah but thank you for starting it so this would be my second question is this the first time that people think about this problem are you the first ones doing research about this or is this is there already a base also a base which is also practical used in in algorithms or the internet well there is research about this issue but it's not like from the sustainability perspective it's we have a really really huge discussion this discussion on the ethical issues which we refer to as a social dimension and we have a discussion on the ecological or a growing discussion on the ecological impact energy demand and stuff like this co2 emissions the economic dimension I think it's a little bit more connected to other discussions like yeah platform capitalism and stuff like this but I think the perspective like bringing all these issues together is not yet really well developed and the other question how it is like how we can see it in reality I think not that much because it's not like the question you you you you said before was like what can I do as an individual but the problem is as an individual you even don't know if you're interacting with an AI based system and that's the first problem so but perhaps you can do stuff like ad blockers or something like this because we we see that AI is really is often used in advertising and that creates really huge amounts of like CPU load and stuff like this but from a personal view I would be happy to have more you know transparency in this and I think your research is could be part of it to find out more as a as a user about these problems and then adjust your own behavior to this to these things if you're interested in so it's a pity but I think your your talk was kind of you know it's so complex and it's kind of overwhelming but really really interesting so we we don't have any questions perhaps the people are still at breakfast and it was like oh I have to think about this so perhaps you have your contacts on on the pipeline or am I right let me see there are the slides and inside the slides you will find contact possibilities are well I will upload something with the contact contact addresses yes so I think that would be this would be great so if people you start thinking about it this and can come back to you later and perhaps there will be also some nice input because there are a lot of clever and smart people at the ccc events and perhaps somebody is coming up with ideas or have another questions and so ask these questions later via email or something like this and I thank you very much for this really important input and I'm looking forward for your research results perhaps last question how long will this research last when will it be finished when will you start publishing papers and stuff like this we will be publishing things throughout the course of the project but it is the the funding goes over three years I think the first sustainability report will come in about February 2020 stuff like this yeah and we will have little events yeah so we're looking forward to this and perhaps you will come back and have another talk and tell us more about your project and yeah thank you very much thank you thank you


My name is Brendan O'Connor. There are three major takeaways from this talk. I want you to remember every single thing that we carry around in our bodies, whether that's the radio to talk to 303 or the i-things we all probably have somewhere leaks way too much data. At every single level, we as a community have forgotten that privacy, not just security, needs to be a goal. Whoopsie, the goons are annoyed. Always. What did I do? So, in fact, we want to change it up a bit. Raise your hand if this is your first DEF CON attendee. You liars. All right. You. The man knows how to speak up. All right. Get up on stage. I got to get somebody tall to do that. All right. The last guy, by the way, slammed it immediately. So cool your jets. I want to introduce you to 2,500 of my closest friends. All right. So please welcome the brand new first time speaker. Congratulations and up yours. Oh, my God, we have to make those smaller. We're doing this all afternoon, man. Anyway, thank you. God, I love DEF CON. Out the gentlemen with the sideburns has left the stage. We've forgotten as a developer community that it's not okay just to protect ourselves and to forget about protecting our users. That is that we spent years and years, many people on the stage of competence that we have to protect ourselves more, the evil hacksores, they are using all of our app zores and ponying all of our boxing. That's true. They have been. It's fun. But we've forgotten that it's also important to protect the privacy and identity data of our users. And it's become somewhat in vogue to dump a huge amount of data into unencrypted data streams that users don't even see or think about in order to ‑‑ I don't really know. It's quite odd, actually. We'll show you some examples of that later. Final takeaway, it's no longer possible to blend into the crowd. Every person in this room is seeing yet another horrifying action movie where they're not doing a fire sale which apparently a cell phone can hook up to a satellite and reroute the encryption in order to turn off whole power plants. Someone's just going, oh, my God, the bad guy has gone into a mall. We'll never find him. There are 10,000 people there. That doesn't work. And it hasn't worked from the government's perspective for a while. It's been relatively easy. Now it's not going to work for everybody in this room. If you can put together a small computer, you, too, can track everyone in your local mall, steal their identities, find out what the most important information in their lives is, and then use it against them. And we need fundamental changes to fix this at every single layer. We need both technical changes, but we also need cultural ones. It's not okay to request too much data and then to store it. And I say this as someone who's worked on software that's being used by millions of people every single day for financial transactions. We can't leak private data of our clients because our clients are the ones under attack, not just us anymore. If we don't do this, we've lost the only thing that we do better than our adversaries. And the only reason anyone should ever trust a software developer. So why are we doing this? Well, these guys have a lot of information on us, right? Every single day you walk through Rio, there's hundreds or thousands of these cameras. And I was just recently told by my sister, who I thought I trained better, that really security is the government's area. We shouldn't worry when the government does things to secure us because after all, they're the government they know best. This means two things. This means two things. One, a lot of people actually believe this, which is a little terrifying. And two, I am a terrible brother. Not just because I told you this, but because obviously I didn't educate my sister well enough while she was growing up. And now she's a great big doctoral student and it's really a little bit too late. Those of us in this room know that the government is not very good at securing things by means other than throwing them in prison for very long amounts of time. But the government has a near monopoly on surveillance. Let's fine, right? The good guys have it. But that's not actually true. When we look at, for instance, blue code boxes found in a whole bunch of countries that are not the good guys, we know that actually we're helping repressive governments. And hey, even after prism, even after every leak that's come since the prism leaks, I'm still hearing, hey, well, the NSA needs that. I'm sure that's okay, right? It's okay as long as only the government can spy on us. We hear a lot that sunlight is the best disinfectant. A recent study showed that cops wearing sunglass cameras were 88% less likely to commit actions resulting in complaints. And 60% less likely to use force at all. When they did use force, those officers wearing these cameras were consistent in using the least amount of force possible in a situation. This effect was not duplicated, shockingly, on those officers in their forces refusing to wear the cameras. If we can see what's going on, if we can look back at our government, we have the opportunity to make sure it works as efficiently and safely as possible. If not, we are subject to blackmail, extortion and threats. See, for example, Aaron Schwartz. So we need sunlight, but we need sunlight quickly. We don't have time to wait for a new dawn. Hey, we know what this photo actually is? What is it? It's the largest nuclear test ever detonated. It's our bomba. We need to blow up this situation to make it clear to every single developer at every single layer that this is no longer an acceptable use of our private information. So I get called a stalker. Not this stalker. This is apparently an adorable kitten that is called stalker. I get called this kind of stalker. But we all do creepy work in this room and we do it because the only way to raise the issue of creeping surveillance and loss of privacy is to make it clear that anyone, not just the good guys such as they are, can use this technology for good or evil. Creepy doll is a distributed sensor network that combines wireless sniffing, distributed to command and control, 3D visualization and grenade-style encryption to do real-time personnel tracking and true identity theft on a major urban area in real-time for almost no cost. It is stalking as a service. That's what we're here today to see. There's one complication, though. And that's Weave or Andrew Ahrenheimer. The United States government has declared a holy war against legitimate security research. And some of us think that's probably not a good idea.  But it doesn't matter. The thing about criminal law is we don't get multiple bites at this apple. Mighty Casey gets three strikes to strike out. We get one in the third circuit and it's pending already. We need to take actions to protect Weave and legitimate security researchers even when they seem like terrible people. Not for them, but for all of us. If everyone in this room isn't going to be in prison by this time next year, we need to start hoping that Weave wins this appeal. Because otherwise, hey, that was only in New Jersey, right? Except that Weave was in Arkansas. They dragged them to New Jersey because they thought they'd get a more favorable hearing. And they were right. Every internet connection goes through every place in the United States. So if we're not going to end up in prison, we better defend Weave. And this affects the way that I do this research. But first is a side note. I wrote this amicus brief in conjunction with all the people on this list and Alex Munce down at the bottom, a great hacker lawyer. 13 big security researchers, a lot of people in this room or at this conference, Dan Kaminski, Matthew Green, Professor at Hopkins, Sergei Brattis, a Professor at Dartmouth, Jericho, Spacerogan, Mudge.  They're people whose work you should be supporting even if you think you don't like Weave. This affects every one of us, whether we're DARPA program managers, professors or itinerant hackers. And in the meantime, we have a chilling effect because we cannot trust legal actions to not be prosecuted anyway. Therefore, Creepy Doll has not been tested on a whole city because even though every court in the United States has consistently said that wireless sniffing is A-OK, it's the same as sitting in a coffee shop and hearing the guy next to you talk too loudly on his cell phone about raising his next round of venture capital funding, which happens way too often, we can't rely as a community on the government not prosecuting hackers for legal actions. I leave the next step of world domination to a braver researcher. Since I'm a law student, we have an extremely serious disclaimer. One more second to let you all read it. Are good enough? This disclaimer is not intended to be ironic. So let's talk about DARPA cyber fast track. Creepy Doll has not CFT work. I've had to make this extremely clear to a few people. DARPA tries very hard not to build stuff that creeps people out because they've had a bit of a PR problem in the last couple of decades. But two CFT contracts did let me build two of the core systems, the radical system which is the distributed commanding control layer and the visualization system for reasons that are not likely to become clear at the moment called NAM. So thanks, Mudge, if he's here and wear those green t-shirts with his face on him with pride. This is the brief road map. First let's talk about the goals we have for this project. First we want to see how much we can extract from passive only wireless. That means I don't want to do man in the middle, partially because I don't want to go to the bad kind of federal prison, but partially because design constraints help us become creative. And it turns out that doing the active attacks like the Pineapple Jessica attack aren't necessary. We can do this without them. As soon as the device turns on that has wireless, it sends out a list of their known networks, all of their known networks for years in the past sometimes, every couple seconds, even when it's connected to a known network. As soon as the device thinks it's connected to Wi-Fi, all of its background sync services will kick off again. That means drop box, that means I message everything. And a lot of those, as they're establishing the SSL connections, we get a lot of cool data from. And because we're sensing in places like coffee shops that have public Wi-Fi, that means we get a lot of cool data pretty often. Over unencrypted Wi-Fi, all the data sent by a device is of course exposed, that's what we mean by unencrypted, which means that we can see everything they're talking about. Sometimes they're talking over SSL, which means that the core data is in theory encrypted. But it turns out that again, lazy developers, that is us, have been leaking all of this cool data outside the SSL envelope, and I don't know why. But especially as they set it up, or as we look at things outside the envelope, we're going to see a lot of neat data. And the cool part about this is because we have a really awesome primary key, we can just sit and wait. So maybe you make one small identity mistake in one cafe, maybe halfway around the world as long as I'm in multiple places with my little boxes, I drop another box, and maybe you make another small identity mistake, and I start to build up a profile of who you are, where you are, because I distribute them, and I know that, hey, Wi-Fi is not that long range. So if I can hear you, you're probably almost on top of me. And then finally, once we get one to ten to a hundred sensors spread out of an area, we have time and place analysis.  I know what things are important to you. And if I really want to blackmail you, I will eventually find whatever it is that's most important to you and that you most don't want exposed. This is what we mean when we say knowledge is power, right? Pretty sure that's what I learned in school. Our second goal is large-scale sensing without any centralized communications. It's really easy to just say, for instance, I'll go to Verizon and buy ten USB sticks. The problem is that it's twofold. One of them is that it's really, really expensive. And these days, I'm a law student, and when you go to your law school and you say hello there, I would like to apply for a grant for my research. Yes, what is your research? Oh, I'm doing distributed sensor networks so that I can spy on people.  My dean is a wonderful woman. I will do the favor of not mentioning her name on stage, but suffice it to say, they're not going to fund my work any time soon. So it needs to be cheaper than just Verizon. The other reason we're not going to do Verizon or any other cell provider is that it provides the bad men with guns, my standard adversary, a way to figure out what to do with the device. Read the ID off the back of the device and say, ah, yes, Verizon. Dear Verizon, who has this device? We would like very much to throw him in Guantanamo, signed United States government. The major telecom providers all have whole offices dedicated to responding to exactly this kind of query. So we're not going to have any centralized communications at all so that they can't track us and also so that there's not one single point of control. They work a lot like Reddicle does. Finally, we have a third goal which is intelligibility. The NSA slides make Tufti cry. It's a very sad thing. What we want is intelligibility on this large scale sensor data so we can prove to people this is a problem. It's the difference between writing a zero day and writing a zero day in Metasploit. When every script kitty sitting down in the basement can stalk his entire city, maybe we'll see some improvement on this one. Let's talk a little bit about background, just a couple slides. One, I'd like to pour one out for all the academic sensor network people everywhere. This works kind of like a sensor network but not exactly because mostly sensor networks are these ultra-low power, beautiful little devices. They work exquisitely. They do wonderful research with them. And they sacrifice everything else to get there. They work in horrible languages and if you've never heard of it, look it up. It's terrifying. But they especially sacrifice cost. Academic sensors cost upwards of $600 a piece. Each. So that's not good. I want something that I can write in a real language that preferably runs Linux. Debian would be nice. And I want it at least in order of magnitude cheaper. And also background, large scale surveillance. I swear my intelligence community has solved all of the problems involved in Creepy Doll before me and they should be cited as prior art which will be happy to do as soon as they publish their results. So thank you, Edward Stoden. You have made it possible for me to give proper academic style due credit to the people who most deserve it. And pour one out for the poor guys at the NSA because a lot of this stuff is really hard and there's a lot of little stuff. This is F-bomb version one. F-bomb stands for the falling or ballistically launched object that makes back doors. It's a terribly tortured acronym because I used to work for DARPA and they love terribly tortured acronyms. I originally presented this at Schmuckam 2012. At the time this was based on the Marvell Shiva board, the same thing that is inside the Pony plug. But this board actually comes out of a thing called a Pogo plug and if this model failed I could buy hundreds of things on Amazon for 25 bucks, a quarter of the cost of the debt board. So that was very nice. I'd like to thank Pogo plug for their contributions to my research. The other thing is that it fits inside a carbon monoxide detector. How many of you guys have recently checked your carbon monoxide detector to make sure they weren't working for me? And this is the old box. This little box holds a whole lot of good hardware. It holds a Raspberry Pi, model A for those of you into those such things because every hacker needs a Raspberry Pi or ten of them. I actually would like to apologize to the Raspberry Pi enthusiasts. I actually bought 10% of the U.S. supply of the first round of Model A's because I didn't know they were only going to bring 100 in the United States. So I'm very surprised. There are two tiny Wi-Fi dongles. There's a small SIM card. There's USB hub. And there's one of those awesome power adapters you can get on eBay for about three bucks that look like Apple power adapters but occasionally electrocute people. This just happened last week and Apple released a thing saying only buy original Apple. Thanks guys. But they cost 25 bucks. So three bucks is better and hey, I plugged them into other devices. Why two Wi-Fi? Because again, I don't want to bring centralized communications. Instead I'm going to use all of your centralized communications. We connect to local Wi-Fi. But Brendan, in this magical place where you live, is there municipal Wi-Fi that actually works? No. There's municipal Wi-Fi that doesn't work, which is kind of typical. But there's a lot of coffee shops and bars and every random dive bar has multiple agreements that make your embedded code sad. So I wrote a library called portal smash. It clicks on buttons so you don't have to. It's available on GitHub right now. And again, thank you, DARPA. Let's talk about the middle wear now. We're building from the bottom up. We talked about hardware. Now we're going to talk about the middle layer called reticle. It's a first of the two DARPA CFT contracts I mentioned. I made a whole presentation on this last year. There has been a full rewrite since then. They still work the same way, but there's not nearly so many swear words in it and occasionally it doesn't break because my cat stepped on my keyboard. Each reticle node runs CouchDB, which is a node SQL database, which works very nicely, plus engine X, which lets nodes combine into what I call a contagion network, somewhat different than a normal peer-to-peer network because it lets nodes exchange data to every other node. This means we can do data exfiltration as quickly as possible to as many nodes as possible in the hope that we get the data out before the bad men with guns shoot the box. To make reverse engineering of a node much easier, you can use the key that contains the full disc encryption key. It reads the key, stores it in volatile memory only.  Once you've done that, unless somebody actually runs cold boot on it, then you're pretty good. If you pull it out from power, you lose the encryption keys. As for cold boot people, dump liquid nitrogen on everything, I would love your house. For the rest of you, as soon as we've gotten every person in society to dump liquid nitrogen on everything in their house, we have one and we can all go to 303's party. Creepy doll is just a mission that reticle runs. They all talk to each other over tour hidden services and as mentioned before, they all do this contagion network thing. As well. It's a creepy doll, right? It should be fairly simple. One underlying principle is we're going to do as much computation as possible on the edges of the networks that is on these little boxes. They're not very powerful, but they're not bad. They got 256 RAM, we don't need that much for couch TV. They work fairly efficiently. And the reason we do that is to be nice to tour. Tour, for those of you who don't know, is usually full PCAPs home, partially because it's route to tour and partially because we're taking coffee shops bandwidth and the guy who's trying to download war is in the corner because no one will track him in a coffee shop will get annoyed at us. So we're going to do distributed querying for distributed data. We process all of the data on the nodes, the PCAPs we save. We get as much actionable intelligence out of them as possible and we just send that home. We never send the PCAPs or we can do really awesome types of questions like where do you usually go for coffee at 8 o'clock in the morning or for those of us in this room, where do you usually go for coffee at about 3 o'clock in the afternoon once you've dragged your butt out of bed? We do these things on the centralized node because even though the distributed nodes have a lot of distributed data, they don't have a hard drive storage. They only got 8 gigs a piece. So we want to be able to distribute as fast as possible. Once it's propagated, we delete it, free up hard drive space, and then we have a centralized point of visualization only. It's not the command and control networks, it's just the place we plug our Xbox into. And I'm serious with the Xbox thing. We'll talk in a minute. The way we extract this actionable intelligence is called NOM for nosiness organization and mining and because it's hilarious. Let's talk first about, oh, the observation filters. In their per application, that means they take in a PCAP and they say, okay, this PCAP is from Dropbox. Flip to the Dropbox filter. Okay. From Dropbox, we can extract the fact, oh, we can only extract that they use Dropbox. That's something good to know. There's another filter that processes Apple iMessage. Look at the last line of this. This is obviously just a screenshot from Wireshark. There's a lot more data there than they should be having outside the nice version. I know exactly what version of iPad I have, which luckily I knew, but if you didn't, that would be useful. I know exactly what version of iOS they're running, which if it's not the newest version means you know exactly which vulnerabilities it has and how to exploit it remotely. And in case I wasn't sure enough, I've got the exact build number as well. In addition to the fact that they're using iMessage, that's a lot of data immediately, right? And this is from one service. They take about five minutes each. It's not very hard. Just look for anything outside the envelope. And the idea is that we build up little tiny bits of identity information and coalesce them over time into CouchDB into one summarized identity. So we get a little bit from iMessage. We get a little bit from Dropbox. We get a little bit from your feed reader. How many of you guys still use a feed reader after Google Reader collapsed? About a third of you, watch the stuff over the wire to make sure it was secure as Google Reader. Nobody. Yeah. Turns out a lot of the ones that I actually personally switched to and the ones I still use transmit everything in the clear. And weirdly, they transmit my real name and my email address in the clear in addition to an authentication cookie because I've never heard of Firesheep because a lot of this stuff got spun up really, really fast as Google Reader was dying. Which means we can get a lot of data.  So back to the NOM filters. Two other things in NOM, right? There's the nosiness filters and the mining filters. Nosiness take little bits of data and they submit it to things like online directory services that look for every account with that user name, that email address usually. So you can submit it to a service. It checks the forgot password forms of 200 different websites and even though we've been screaming about the forgot password vulnerability for years, so now I know every service where you use. And of course, if I were a criminal, a terrible person, I could then break into those services and take all of your stuff. Turns out I can do even funnier things and still be more or less within the law. Finally, there's mining nodes and this is where we do the big data. We only run the M type queries in the back end. This is where we start doing pattern and practice. And I mentioned before where do they go for coffee and do they go for coffee every day. That's one thing. We can do cooler things. The device that moves around the city, I see it everywhere, it goes here, it goes yawn. That's great. What if I see another device that only exists sometimes? Every time it exists, it's in the same location as the first device that I saw. So what happens is the first device goes somewhere, it stops moving, a second device suddenly turns on, works for a while, then the device turns off and I don't see it again, and then the device moves out. That's what we call a laptop being used as a mobile phone. Once I've seen that for a little while, a little bit of data mining, a little bit of fuzzy math, suddenly I've got one profile instead of two. So even if you thought, oh, hey, my mobile phone is trackable, but I only do my creepy okay Cupid stuff on my laptop where I get really freaky, that's okay, right? Because Brendan will never see me. Wrongo. Now I know it's all you and I've seen the shops you go to and I for one am terrified. I didn't know you could buy them that big. On the side of the screens, a few different nodes, they're all connected to every other node is the basic idea. They go to one node I mentioned before, the sync node. The idea of the sync node is just another node that still participates in propagation, but it's not usually encased in one of these boxes, I usually run it in a virtual machine. Its job in life is to pull data off of the wire and send the delete commands to free up the hard drive space on all the other nodes and then store it in another node. This is called shark and shark is actually a all-in-memory derivative of the Hadoop Hive project which means I can store really big things like when I had 600 gigabytes of packet captures I could throw them in shark and do deep queries on them. I store the rest of the stuff in CouchDB which lets me run really fast queries. I combine them together using a Ruby script which is just a Ruby web server which does translation from the shark format into a much shane or JSON format. Finally I run them into a visualization and you can see down in parentheses there if you see it, it's running Unity. That's right, I built a video game. It's my first video game so it's not very pretty but all of my little space aliens are real people which makes it much happier. Finally I pull data because I'm getting GPS location I might as well pull data from cloud beta, nice open street maps provider. So let's talk about that. It's also called NOM, it's a whole other thing. Use the Unity game engine. Two notes, one that's a great toy who's never played with the game engine. Unity is free for indie developers so go ahead and try it, it's cool what you can learn.  Oh, my God. You've never seen where JavaScript errors until you've seen them as interpreted by four other languages in the middle. But the advantage is it works really well at the end of the day. The guys at Unity really know their stuff and this is the cool part about using pre-written game engines. If you've ever tried to write your own visualization you spend three months trying to draw a box on the screen in the right place and then you spend the extra two weeks before your DEF CON talk just works. You just say put this here and it works really well. You've got one simple translation between latitude and longitude and your internal world coordinates and then it runs on an iPad which I love or runs on Windows, Linux, Android, Wii or Xbox 360. I've never written a security tool for Xbox 360 that can pass the developer certification but Unity will which is quite fun. Part of the side effect of this is you said wait Brandon you said 600 gigs of Xbox 360. I don't. That's why we have the servers that I mentioned in the last slide. They do all the heavy query lifting so that you can just run this on an iPad and don't have to do any of the heavy processing. They talk to each other because I love irony over unencrypted HTTP. So we're going to have a demo video and you can watch closely. You can almost see the creepy take place at a real time. But before we do that, whoopsie before we do that as I was saying attention. So we can't spy on everybody in the city which I hate. This doesn't mean we can't do valid testing but if we just stalk me, if I stalk myself in essence, what this means is we only get to see me. So you're going to see a lot of dots on the next screen that represent me in different places. Imagine if instead there were 100,000 dots and I've tested up to that many nodes using generated data or data out of academic sources that have been anonymized. It works incredibly well and I never collected any random stranger at any time because even though it's apparently legal, we can't be sure of anything anymore until somebody smacked down the third circuit. So let's watch it. First we do powered by unity. I'm sure this is not the press release they were expecting to see. And it should be running here. I hope it's running. It's not running on my screen. Is it running? Okay. So you're going to see a few things but I'm not going to say them exactly time. First you'll see the dot move is zooming in and zooming out. Basically it works like StarCraft. Then you'll see I draw a box zoom across it, again just like StarCraft and that zooms the data in and zooms the map in. You can hover over different nodes to see just how many times I saw them or how many nodes are in about the same room at the same time and their MAC addresses. At the end, and please tell me when this happens, you can click on one node and then you see everything in the world. So yeah, real name and email address from a Google readers fault. Photo from an online dating site whose name we're not going to say because I've heard they have angry lawyers even though they haven't heard of fire sheep. All the rest of the data from all the rest of the different sources. You can see that they use iMessage so we know what kind of device this was. You can see that they use log again which is a commercial, basically it's a replacement for every screen sharing site. And we have all this great data. We even have the things it is so I can make sure that my sensors are appropriately placed. They're actually helping me calibrate my own network. It's awesome. So let's talk about future work. Well, the first thing is what other applications could we do besides being decidedly creepy, Brendan? Well, one, we can do counter infiltration. Those of you who participated or even read the news about the Occupy Wall Street and Occupy Everything Else movements have noticed that a lot of times a group, then suddenly somebody throws a rock and then the mysterious stranger is gone. It's amazing how effectively this works. You can use creepydoll for counter infiltration though because you just set an alarm. Say, hey, if anybody new shows up in this area, scream bloody murder.  He's the Fed. You can also use this with apologies to the grug for operational security training. Hey, if I throw these over a whole network and I just look for devices that I know my agents are carrying, how much data are they leaking? How terrified should I be? Here's a hint, really terrified. And you don't need to control every network and agent accesses. If you're a corporation with a very loose sense of ethics who wants to make absolutely sure that when your employees go home they're not leaking trade secrets, just spread these over the whole town where they live. You'll know it. So we'll have actual operational security through the complete and total invasion of privacy. The thing is this is the trade off that we've suddenly come to live with. I'm not sure why we've done this. We've just accepted that we have no choice of the matter, that our devices are going to continue to leak increasing amounts of data that Mark Zuckerberg is going to be able to go on CNN and say, well, privacy is dead. I don't know why anyone want privacy. Here's one privacy so that I don't want you going into, for instance, a bar, a singles bar that your wife doesn't know about. Not just because, oh, my God, you cheated on your wife, but because if I stalk a whole area, let's say, for instance, since I live six blocks from the state capital, I stalk a couple blocks around the state capital, I don't need any particular person to do anything wrong. I just need one person to do something wrong. And then I get maybe a small change to this for a very long time, right? This is what we call surveillance and creepiness. Here's the difference.  I can throw a few of these around. They're 57 bucks a piece. So for the cost of a really expensive dinner here and actually kind of a medium expensive dinner here in Vegas, I can throw 10 or 20 of these things around and just find the first person to do a weird sex life or just something they don't want everyone in the world to know, except for Anthony Wiener because apparently he's invulnerable. Everybody else, however, is going to have an issue. You can also use this for evidence logging, any kind of fast moving scenario like protests and rallies. There's a real problem with the accidental destruction of electronic evidence during crackdowns. It's very hard to know who is in a kettle when the cops lock you all in and then you're safe from the jails. Since Krivedal uses a contagion network, you could easily strap one of these to your belt, have it scan all of your friends continuously and transmit that off-site immediately. You're constantly offloading and exfiltrating your data so that you always know where your friends are, which on the one hand they lose a little bit of privacy. On the other hand, maybe they don't spend two more weeks in jail than they needed to. And again, unless an adversary already knows what this is going to do, they're going to get off in exactly the right way to allow them to do a cold boot. So again, unless they're just throwing liquid nitrogen onto random protesters, which even like, you know, in Madison we had a cop kill a kid walking while drunk, which is also known as being in college. But even they're not just splashing liquid nitrogen around. We're probably pretty safe from cold boot attacks for a very long time, and that means that we get all the things that we can scale up. The fastest and easiest way is to shard our contagion networks. Because contagion networks aren't connecting to each other directly over RF, they're all connecting to each other over their local coffee shops' Wi-Fi, we can shard a contagion network by having 20 nodes and 20 random places and have five or six overlaid networks that don't actually need to connect to each other in any physical way. This means we can do geographical distribution really efficiently with this. Because, yeah, when that happens, you know, probably about 50 or 60 nodes, if you've got a well-traveled area, then you probably want to start splitting up your contagion networks. Each network then just has one dataset node. They can all throw it into the same visualization. The visualization is good to a couple terabytes at least, more if you've got better RAM. As I mentioned, scaling the backend isn't hard, especially because there's a great script for Shark that lets you run on an Amazon EC2, right? That means that, yes, you can just be here to help us. There's CouchDB servers as well. They even run GeoCouch, which is a modification of CouchDB that I'm using for this. It works really efficiently. The visualization is a little bit harder in that there's a limit how many nodes. A couple thousand I can draw simultaneously. But, luckily, there are hundreds of books by game developers, four other game developers that they don't check your game developer cred at the door in order to buy. They tell us how to do these things like grouping, which I'm already doing if you saw the black nodes versus white nodes, groups versus single nodes. We can do things like a limited field of view or a limited distance of view. The standard things you see in every FPS game, you can't see the entire way to the moon. This allows to scale the visualization pretty much as far as we need. Open street map, of course, goes everywhere in the world. You can stock a whole country at once for just probably 10, 20, like an investment. Won't someone think of the children? And everything they're doing? Every day?  Finally, we can add a lot of stuff to this. How many of you guys have played with software defined radio since the RTL-SDR came out? Quite a few people actually for just kind of a random question. There's these 10 to 20 dollar dongles you can buy on eBay that allow you to sniff from about on this one I think about 75 MHz up to a couple gigahertz. That means you can listen to any wireless protocol, not just Wi-Fi, for not a huge additional investment. Put a tiny antenna in, but hey, we're already talking about tiny antennas. It's a tiny box. So at that point you can listen to anything, whether that's stalking the goons for fun and frivolity until you get thrown in the pool or messing with restaurant pagers or anything else you can think of with an encrypted Wi-Fi, that's obviously trivial to do with tools like Reaver or the other awesome attacks on wireless security, that just gives us more ways to connect home. And at the end of the day, if you're stalking in a city, you don't really need it, but it's something to keep in mind. Finally, of course, we could do active attacks like the Jessica or Wi-Fi pineapple attack to make sure that wireless devices connect to us and run a full man in the middle attack. We don't have to, and frankly it makes us a huge man in Mac address. And I'm definitely 6,000 miles from my home access point, which it says I'm connected to. But we could run it. You could be more subtle with modifying that software. So something to think about. So finally, let's talk about mitigation. The problem is we have to sacrifice the things we love in order to mitigate this. Yes, it's a Bible joke. The leaks are unfortunately at every single level of the entire stack. I do mean every single layer. At the bottom layer, the IEEE has said that beaconing your list of all known networks every second or two is an acceptable way to behave in a crowded noise space. That's a terrible idea, right? But that's in the protocol. We can't ignore the protocol. That would be a bad thing. The IEEE will send out their engineering thugs to hurt us. They have to fix this. But unfortunately, we've said it's so convenient to walk near my phone without having to turn on my phone. It can automatically connect to iMessage and download all of my new messages. Some of them won't be from Anthony Weiner, I'm sure. But the IEEE is not going to be able to promulgate a new protocol to device manufacturers. Hey, it's going to be less convenient and your customers will hate it, but you should really use this because it's more secure. Next. There's also a problem at the operating system level. A lot of systems, and I'm going to pick on Apple here because that's what I use, won't enforce VPNs. What that means is that when I connect to a new Wi-Fi on a laptop, I can have a setting that says turn on the VPN before you allow any packets to go. That is not possible to do on iOS. Which means that you always have those first few messages. And those first few messages are rich with data because before the encryption has been set up, they're already transmitting information. And so the OS too needs to be protected. And finally, again, we have to change the culture. We as developers can't be collecting random data. I found, for instance, a online shopping application that for some reason transmits my location in real time. It's not group-on, right? It's not something that actually involves my location. They just want to know so they can serve me targeted ads. And they serve all their money. And nobody should know. Nobody should have unencrypted access to how much that new pair of monoblonic shoes costs. But for some reason, everyone in the world should have unencrypted access to what OS I'm running and where exactly I am in the world. That's a pretty weird trade-off. And it's our fault because we've forgotten to protect our users in addition to protecting our servers. This is everyone's fault. And so no one's going to take responsibility for us, right? The status quo, right? The status is not quo. Those of you who like Dr. Horrible, we cannot tolerate this level of privacy leakers. There's one Dr. Horrible fan. As consumers, we need to demand better. And as developers, we have a responsibility to the world to do better. One final digression. At Shmukhan 2013, there was a pretty heated panel about the interaction between academics and researchers. I've actually split it up. I have an academic degree in computer science. I'm doing an academic degree in law these days. But I'm also just a hacker without any academic support most of my time. We need to be able to have a way for the two communities to work together. And part of that needs to be that hackers need to find a way, anyway, to stop repeating the same mistakes over and over. Everybody who's done a long-term research project or development project in the past, didn't find it. So a couple days ago, on Tuesday, we launched Hark, a kickstarter for Hark. Hark is going to be a new hacker archive that anyone can publish to. And they can publish whether it's a couple tweets, a blog post, or a formal academic paper. We're going to have mentors who can help you take your work to the next level. Or the next level for you is a new B-Science or it's the use-nix-Woot conference, which is going to be a new market archive so that people know that if they publish their work here, it will live beyond their own time. Which, especially as we start losing hackers left and right, is going to be a very important thing. We want to be able to fail better. In order to do that, we need your help. It's at thehark.net. There's a kickstarter you can contribute to. Finally, thank you to all those who are asked for comments, also I'm finishing law school in 10 more months. And I don't really know what I'm going to do next. If you have an idea that you'd like me to do in about 10 more months, draw me an email. This is right on the slide. And finally, seriously, we want to be able to fail better and to make hackers, not just academics work, live forever. If you too want to believe in immortality, go to thehark.net and join us. Thanks very much. About two minutes for questions. So if I can take some of those cameras, you certainly could do that. This is kind of the minimum viable creepy? Yeah. Repeat the question, is that what you're saying? Yeah, okay. The question was, why don't I integrate cameras? So you can do IP cameras and stock from IP cameras. That would totally work. You just need a new application-specific parser, one of the O parsers. You could also integrate a camera directly into the device, which would be cool, but it costs another 20 bucks per hour. One other question? Yeah. Right. So the question was, have I used Unity's client server architecture to do the networking, especially between independent hackers? I haven't. The reason is it's not incredibly flexible if you're not actually building a game. That said, the way to link them up would actually be one layer beforehand by everybody dumping into the same shared couch GB and tagging. It would be essentially the sharding of the contagion network's work. So that comes off stage in about 30 seconds. Thanks very much.


Saw you pay in a picture of a face A face that wasn't even close to mine I know I shouldn't be in love But it's so hard to move on You haven't changed, you've stayed the same But if you did, I'd still love you anyway I miss my world the same Conversation more than death I wish you were in days Cause I've been up till 6am Well, five songs are just for you Three of them I can't bear listening to


I'm so sorry guys, I doubted him, I doubted him. What did dogs and coffee have in common guys? Well, it's something that I like, both of them I like very much. If you guys enjoy coffee and dogs as much as I do, make sure you guys keep watching this video as I react to rescuing animals while enjoying coffee to see whether they're the real deal or not, whether this is a fad, whether it's something that we can learn from. Hello friends, my name is Wilson, your friend in helping you build a thriving small business and a profitable food business. If you enjoy these type of analytical videos, these videos where I just break down whether they're the real deal or not, then go ahead and smash that like button because that just shows me and Jason, this is the type of video you enjoy. So in that way, I can create more of this for you. Now, let's dive right in. 20% of the profits back to animal rescue organizations. Interesting. You know what? These things oftentimes it just, I just don't sit too well with me because it just feels like a gimmick altogether. I don't know if it's the real deal or not, but for me, I'm just like, why am I working so hard? Why am I selling my home, my furniture and everything just to create a coffee shop? Just so that way I can give away 20% of my profits. I don't know. It's just probably not something that I would do, but. I view a real successful and viable business over the next 50 years being a company that is addressing concerns in the communities. And I love what I do and I love helping animals. And if you can make it as a viable business, then it's even better. I found her at a random little adoption in Santa Monica in 2012. I was just going to breakfast and saw some Dalmatians and little brown and white Dalmatian crawled in my lap. And the next thing you know, I was leaving PetSmart with $1,000 in pet supplies, a new best friend and no breakfast. She opened my world to animal rescue and she's always been right by my side. That's actually really cool because I have a very close friend of mine actually rescued a dog from Thailand, flew her all the way from Thailand to Vancouver and now it's part of our best friends too. So definitely can relate to this. I started the company just kind of first conceptually. How can I make a difference? What are some lateral solutions to helping with animal rescue? Once I had a general concept and I thought a viable idea, I felt like I had to do something and I wanted to get after it right away. I was on student loans, I was living in a little $700 rental home, didn't have income, didn't have money. And I just started thinking about like, all right, well, what do you have? And I said, well, I got furniture and I got clothes then I have the internet. And I was like, well, I can sell some stuff online. So I started selling my couches and bookshelves. It just kind of kept getting a step by step a little further. I have a different view when it comes to trying to provide help and there's many ways that you can help something or support a cause. And it all comes back down to your basic needs first being fulfilled. And if you do not, and if you cannot even take care of yourself, how can you have the ability to take care of other people? It just doesn't work. So I truly believe in being able to establish yourself a little bit more before working on things that you're more passionate about and more driven to that has a mission. I am not doubting Jordan at all. I'm just sharing my philosophy and it's okay if you're building a business to make money. There's no shame in doing that. Yeah, I truly believe there's no shame. And on top of that, it doesn't mean that the only way you can support organizations and causes and mission is through monetary values. You can actually invest your time in mentorship, doing volunteer work, raising funds through pop-up events. There's so many different other ways to do so other than to sell all your furniture is just to create a coffee shop and to give away 20% of their profits. I don't know. I really don't know. Eventually we progressed far enough down the road that one of my professors coincidentally was part of the founding team of Curie and had an interest in coffee and I pitched him the idea. So year one, we went live with the website. We did about 100,000 in revenue that year. The following year I was wrapping up grad school and we had a little bit more emphasis on growth. That year we jumped up to about 350 in revenue. The last year I think we finished around 700 and then this year we're on track for about 1.2 million. I'm so sorry guys. I doubted him. I doubted him and that's the reason why I wanted to share with you my thoughts before I actually watched this. Over a million bucks selling coffee?  I'm so sorry, Jordan. Great job. We've done it from a bootstrap position but we think as we keep growing and as we keep making an impact and our company grows, that we can become one of the more significant or more important companies in the space of animal rescue funding. The Grounds and Hounds, I think we're gonna continue to evolve as a business. We're creating more products and we're really using feedback from our customers to deliver more products that they want and we're continually trying to make a better cup of coffee. We'll do whatever is necessary to help improve our impact on the animal rescue world. So if more people want to engage with us and be part of our mission, we're gonna try to find ways for them to be involved and that's always kind of at the core of what we do. So hopefully we just continue to evolve with the customers who love us and bring more people into our community. There's two points that I wanna make. First of all, great job, Jordan, great job. First of all, when we look at numbers like this, right, this is my skepticism, really kind of my spidey sense is coming out. When we think about coffee and dogs and stuff like that, we're just thinking about like, hey, you know what, this guy selling coffee, making a million dollars in revenue. Really, honestly, I don't think it's as simple as that. And obviously with a three minute interview, he has to say basically the short version of what he's doing and he's not really diving into the details. So if we can actually understand a little bit more about his business model to dig a little bit further into, hey, are they doing any kind of like online direct-to-consumer selling? Are they doing any wholesaling? Are they doing any collaborations with other businesses? This will allow us to have a better judgment of whether this is a great business or not. So I came to a conclusion with what I'm watching, but if I were to do a little bit more digging, I would look into these aspects to see whether it is actually a good business or not. Oftentimes we see what other people are doing, have these soundbite moments and all of a sudden we're just like, wow, that's a great idea. For example, dogs and coffees, great hook, but now we have an impression knowing the fact that or thinking of the fact that, you know what? Dogs and coffee is a great business idea. They make over a million dollars, but without really understanding the nuances behind an under the hood of what truly is happening. So definitely we do not want to make these assumptions and really dive deeper into what is making this business successful. Second thing that I want to raise is the reason why they're so successful, I truly believe is because of their mission. By them identifying something that people can relate to, people who are dog lovers. And dog lovers tend to have this really big community sharing with others dog lovers what they do on a regular basis. What are things that they would actually do with their dogs? And this is a very tight community that only the dog lovers would be able to feel included with. And being able to actually tackle this from this angle is such a smart and I feel strategical move on his part. So I don't know. I think I might be reading a little bit more into this. I don't know if I'm just being a skeptic, but you know what? Great job, Jordan. You definitely are the real deal making over a million bucks selling coffee online or selling coffee with grounds and hounds. So there you go guys, real deal. I hope you guys enjoyed this video. And if you guys would like more of these reaction videos of me seeing my thoughts on these types of other businesses and stuff that we can learn from it, we can pull stuff we can learn from it, share with you guys so you can take these lessons what other people are doing to apply it into your own business. Then make sure you guys smash that like button, go ahead and smash that like button. It shows us that this is the type of video you enjoy. So once again, we create more of this for you. Otherwise, I'll see you guys in the next video.


Thanks for checking this video out. Your mountaintop news video is coming up in just a minute.  Why is it your ad here? Call me. Mountaintop media recently hired Matt Holbrook as its new director of visual communications. For several years I've had a passion for video creation and since 2019 I've produced a variety of videos ranging from wedding and sports videography to more corporate videos for different organizations. Coming to mountaintop media seemed like the obvious choice. It put me within a team that had the similar desires and passions as I do that would allow me to grow as a video producer. Holbrook is eager to begin working to produce content both for mountaintop media and its clients. So one of the things I look forward to most here at mountaintop media is seeing how creative we can get with video, whether it's social media, our new app or even for different clients that need commercial work. We really want to push the limits to see what we can do with video and take it to another level. Holbrook encourages those with a passion to invest in themselves and pursue their dreams through hard work and dedication. For mountaintop news, I'm Kelsey Dean.


is Think Tech Hawaii. Community matters here. Aloha, and welcome to Talk Story with John Wahid. For those of us that enjoy the football season, the last few years, actually, that's couple of years, we've seen something interesting happening on the field. We've seen people like the quarterback, Copernac, I think his name is from the family of the San Francisco 49ers, Neil doing the playing of the national anthem. And yesterday, and then we've seen our president comment on those kinds of antics, and yesterday we saw entire teams take a stand and use the moment of this national anthem as an opportunity to say something. And it seemed to me, for many of us, we really would like to understand how this process works, you know? And it's all part of our guaranteed freedoms in this respect. The United States Constitution guarantees us freedom of speech and freedom of the press, freedom of all of many things. And I thought it would be interesting to sort of explore this very current phenomenon. And so, this afternoon, I have with me, probably Hawaii's foremost First Amendment attorney, and I've known Jeff Portnoy for a number of years. In fact, it's very possible he might have even sued me a couple of times for my involvement with the First Amendment. So, I appreciate your coming on the show, Jeff, and discussing this issue with us. Well, thank you, John. I probably did sue you a few times. Well, we're not going to go back to that. You wouldn't be the only governor actually. You know, here's the strange thing about your suits, though, which you ought to know. And then, I know we defended it vigorously, but now that I've left office and moved on and in this current age, I really hope I lost. Well, you were one of the more, I would say, you know, we all know about your efforts to pass Hawaii Chapter 92. So, going back over the last five governors, I think you were the most aggressive in trying to promote access, at least, to government meetings. You know, and I think we need that more than ever, more than ever. I agree. But also, just what's interesting now is it seems like the exercise that what we take for granted of saying things that we believe in, doing things that we believe in, have come under attack, or at least they're being, you know. Well, I mean, this whole thing with the National Football League and now the NBA, it's really kind of unfortunate in one respect, in that these are sporting events and they're being translated into political events. And I think there's a issue as to whether, as the result of the president weighing in now in the last 48 hours, and team owners now responding in the public kind of torn, we've kind of messed up, I think, the distinction between what should be a football or a basketball game, and what are clearly the athletes' free speech rights to protest in any way they think is appropriate. And Colin Kaepernick, as you pointed out, started this a year ago, and then because of the political reaction to it, it's just encouraged, literally, hundreds of other athletes to take a stand. Well, you know, just getting down to the basics, though, it seems to me like when you say, when you use the word free speech, you say something. And in these cases, it seems like, but then we realize that there's an element of free speech that has to do with symbolism. Yeah, speech can be symbolic, and the United States Supreme Court has made that clear, the Tinker case where a high school kid wore a peace-arm band and got expelled, they went to the United States Supreme Court, they reversed that conviction, or In other words, they're saying that you don't have to use words. Speech can be symbolic, it could be a sign, it could be an arm band, it could be a number of things that express a point of view. But in that, the Tinker case, it was a youngster that was being disciplined by his school because what he, his symbol, in the sense, did not meet the dress code. Well, that was the argument. That was their argument. But what the Supreme Court ruled was that that symbolic gesture was protected. Right, and what these athletes are doing, I mean, many of them are speaking out, but what they do is, for some reason, the National Anthem, which is an interesting side discussion as to why the National Anthem is being played at the athletic events. They don't play God Save the Queen in soccer games in England, you know, they don't play the German National Anthem, I don't believe. So, you know, we have this tradition of playing the National Anthem before sporting events, and it's a legitimate question as to why you even do that. But having done it for decades, there are now athletes who believe that they want to express their concern about certain political issues in one way they know is going to get millions of people's attention, and that is to sit during the National Anthem, or yesterday, not even come out of the locker room. Right, and so the point, though, is that the ability, that its freedom of speech is more than just words. Right. It's conduct, it's gesture. Now, what, in my opinion, would make yesterday interesting, or make the current situation interesting, is the fact that we have one branch of our government, the President of the United States, talking about the incident, which is okay. I mean, how far does a person like the President, how much latitude does he have with freedom of speech? Well, he's got plenty, but I mean, you know, he should have not gotten involved in that. Oh, that should have.  I mean, you know, he has a small base of 30 percent of the people who probably agree with him 100 percent, and I think he forgets that he's President of the entire United States, and he's just aggravated the entire situation, and now you see the reaction. The reaction yesterday, there are only a couple of athletes who were kneeling or whatever during the national anthem until yesterday, then entire teams in reaction to Trump, not in reaction to police brutality or whatever Kaepernick was originally protesting. That wasn't a protest the last 24 hours. That's not why LeBron James went after the President. It's because the President is weighing in. A lot of people think it's racist. A lot of people think it's inappropriate, but 30 percent of the people are probably cheering him for working on these athletes. I think you just described the politics very well with the situation. But I was looking at it from another point of view, where you have a branch of government in a sense dampening political expression.  He's not dampening anything. He's ratcheting it up, and I think that's what he doesn't realize. But if somebody actually got fired, and they came to see Jeff Portnoy, and they said, he interfered with my freedom list. Yeah, but John, the Constitution only applies to government. It applies to government. It doesn't apply to private people. But is the President a private person or the government? He probably has immunity, unfortunately. Well, for the lawsuit, yeah. But what you have is here. What you have is the government of the United States, or at least a branch of the government, talking about people's... Not in a way of saying, like, I disagree with you. I disagree with you. I don't think you're getting anywhere with this. But saying, you ought to be fired.  It's toothless. But I mean, we have a century of jurisprudence where city councils, state legislatures have tried to make certain speech illegal, goes back to World War I, and it continued up until even today. And many times, most times, the Supreme Court will say that speech in and of itself, you cannot prohibit. There are certain types of speech which aren't protected. Pornography, for example. Certain types of commercial speech have a limited type of protection. But when it comes to political or social issues, the court has repeatedly found that ordinance is overbroad or unconstitutional, with some rare exceptions, because they're based a lot on the political times. In World War I, they convicted a bunch of people for a treason for making statements about America's entry into the war. We saw it with the communists in the early 50s. Fortunately, we have a court that has been able to say, no, speech is protected. Doing the Vietnam era. Unless it's inciting people to violence, by the way. Right. Well, let's get clear on that. Because, well, just before I left that, and doing the Vietnam era, the Supreme Court upheld the idea that one could even burn the American flag, which many people felt found disgusting. Well, and a couple of justices did too, but still upheld the right of a person to do that. Right. And so in this case, if you're not standing for the National Anthem, it seems to me... Well, first of all, without getting too philosophical, who says you have to stand for the National Anthem? Where is that? Where is that in the Constitution or in statutes? It's just tradition that people... Who says you got to put your hand over your heart? You know, a lot of people still do. A lot of people don't. You know, I mean, these are just things that have occurred. As custom. Yeah. So there's no law that says you have to stand. That would be interesting, John. If some state would pass a law, you have to stand for the National Anthem. Obviously. And then somebody said, no way, I'm sitting. Well, one of these days, you know, I don't know. I don't know if he's done it yet. But it seems to me that at some point, the President needs to understand that he is a branch of government. Well, you know, that's not going to happen. You know, that is where somebody might be doing it. Okay, so having covered some of that, what are the... What's protected and what's not? Well, I mean, as I just said, you can't end somebody to violence. You know, speech only goes so far. There's a fine line, first of all, between speech and action, all right? But even speech that could incite violence can be on occasion and under the appropriate narrow ordinance could be prohibited. But we see that even that is... Who determines whether it's inciting violence? Is it the speaker or is it the listener? We saw this in Charlottesville. The city did not give the permit for the Nazis and the Klan to march, claiming that they could not protect the people that might otherwise want to counter-demonstrate. The court said no. You know, you have police powers. You can separate people. You cannot stop people from exercising their free speech rights no matter how repugnant that conduct is. But if someone said, let's go shoot the President, they'd probably be arrested and they would not get off on free speech. They're inciting someone to violence.  Well, the court said no in the Skokie case. The court said no. You had to allow the Klan to march. So what's the difference? I mean, at what point does something turn into...  Well, that's the latest kind of debate.  That's the whole political correctness thing. I just have to say that I don't agree with that. I don't think words can hurt. And if words hurt, just give words back. So I've always been a proponent, even when they thought at University of Hawaii a decade ago of maybe putting in a speech code, I advised the president at that time privately, don't do it. It's supposed to be a place where ideas are communicated. Even ideas that are repulsed. Right.  You don't know what it means to be this or that. And I said, you're right. I'm a white male, but I believe in speech. I don't think speech should be censored. I remember when the free speech movement began. In Berkeley. In Berkeley. And the word was just the F word right across the chest. Sure. And most of the people that were espousing what would be considered at least controversial speech or out of where from the, I guess you would call them progressive with the left today. We're going to be taking a short break and we're coming right back with this very interesting conversation. And we're going to talk more about what is appropriate and what is not regarding the free speech debate. Thank you. This is Think Tech Hawaii, raising public awareness. Ted Rawlsson here folks. You're a host on where the drone leads our weekly show at noon on Thursdays here on Think Tech. Aloha. My name is Mark Shklav. I'm the host of Think Tech Hawaii's Law Across the Sea. Law Across the Sea comes on every other Monday at 11 a.m. Please join us. I like to bring in guests that talk about all types of things that come across the sea to Hawaii. Not just law, love, people, ideas, history. Please join us for Law Across the Sea. Aloha. Guys, don't forget to check me out right here at the Prince of Investing. I'm your host, Prince Dykes. Each and every Tuesdays at 11 a.m. Hawaii time. I'm going to be right here. Stop by here from some of the best investment minds across the globe. And real estate, finances, stocks, hedge funds, managers, all that great stuff. Thank you. Welcome back to Talk Story with John Waihe. Our special guest today is First Amendment Attorney Jeffrey Portnoy, our, actually our legal expert on the First Amendment. By the way, if anyone has any questions, call us at<PHONE_NUMBER>. Jeff, we were just talking about the idea of hate speech and freedom of the speech and the controversy that universities are following all over the nation, finding all over the nation by speakers coming in and now from the left as opposed from the Berkeley types which carried the F word on their chest. And now we're having people instead talking about things that are hateful. And universities are trying to stop them from doing that. How would you distinguish if you tried, as an attorney, between speech that would be considered hateful and something that would be considered just a matter of opinion? In your opinion, any speech is free. The problem with that, and it's a good question, is it's in the eye of the beholder. I mean, what's hateful speech to you may not be hateful to me. It could be political. It could be social. That's the problem these days. And I don't know where it's going to lead. Well, let me do, you know, I, but let's say, pornography, the Supreme Court said, when you see it, you'll know it. So it's totally subjective. And that's one standard. But there's also, in law school, I remember, there was a standard. Well, there's a time, place, and manner standard. That's right. And it was that you're not supposed to yell fire in a crowded theater. Well, you can't defame somebody. That's not protected speech. You can't make false statements about people. So what's the difference between... Well, the fire in the theater is, you know, is creating a situation. It's an objective standard. Creating a situation in which you may be causing some action to occur that is damaging.  But the problem these days is that there is a vocal minority of people. On the left, which is very, very curious, who want to ban any speech which they find offensive... Which they... To the listener. ...to establish... Which they find offensive to the listener. And I think that is a slippery slope that our country for 240 years has tried hard not to permit. It's still speech. I know there are people you could have on this show that will tell you that speech can be as hurtful as a right cross to the chin. But in my view, it's simply speech and people should be able to express their views with certain limitations. And we've talked about a couple of them, but just because it's hateful to me is not the appropriate test. How much does... I can... Well, some of the arguments would be, okay, we're both two private parties. You say what you like. I say what I like. If we go get carried away, we duke it out or whatever, we end up being processed, blah, blah, blah. But does government participation in a forum that allows hate speech to occur, does that make government this underwriter of that speech? For example, if the University of Hawaii was to invite the leader of the Ku Klux Klan. Well, they wouldn't. The university wouldn't do it, but some student group might. And they would like to use taxpayers' facilities to hold it. Does that make a difference?  That's what the police are for.  In terms of protection, what I'm talking about more in using the words of the First Amendment, is that establishing something? Is that in some way endorsing it? No, because I think the law has made it pretty clear to governments, whether they be city councils or state governments or Congress, that in order to pass any kind of law or ordinance that is going to attempt to restrict speech, it has to be very narrowly drawn. It's going to undergo strict scrutiny. I don't want to get legal here, but the government is going to have a very difficult burden in trying to establish... So the government can't just say, you can't use my facilities. No, you're going to have a very difficult time convincing a court that there was a significant reason to limit someone's speech rights. And they've carved out various classifications, information, pornography, some types of commercial speech, things that are directed to kids, the so-called vice-verses. You can't have a meeting of... ...punographers of America. You probably could. Unless they try to show some pornography. Unless they actually show pictures. Yeah, and then they might get... It's so tough because... One reason why I'm asking this line of questioning, we got that pretty much, I think, established. Now we get to the press, okay, and the freedom of speech, the corollary of that is obviously the freedom to be able to report things, and the freedom to say things. And I can understand discussing the difference between the star advertiser and... what's the name? Breitbart? One is obviously very much an opinion piece, but they both covered what I would consider the freedom of speech. Again, going back to government's action in all of this. It seems to me that there is something challenging to the First Amendment when the president of the United States can favor news sources. It's one thing to allow newspapers to say anything they want, but I am in competition. I'm in competition as a business, and I need to survive as a business. This president's made it pretty clear that he has media that he trusts and hates. He talks about fake news. He's banned reporters from Air Force One if he doesn't like stories. I mean, we are in an era that challenges the First Amendment. We are in an era never before really seen with a president that is so outwardly hostile to the media. His comments about the New York Times, the Washington Post, CNN, even though he's not very presidential. Comments are one thing. They haven't done anything yet. They might prosecute reporters for source issues. So did Obama. Obama's administration would have been the most anti-media when it came to prosecuting or attempting to prosecute media for leaks. That's a different issue. We don't have criminal libel anymore. That was the government's effort to do what you're talking about to try to impinge on the press. By the way, I agree with you we shouldn't have that kind of libel. But when I'm talking about something a little bit more subtle and that is that media, whether we like it or not what we consider to be media today are businesses. There are important businesses because they're carrying out an important mission, but they are businesses. They need to be able to survive. But actually, John, a lot of people would say media today is something we've never seen because of the Internet. There are bloggers. They're not businesses that don't charge. What happens when I agree with you that most of the mainstream media are businesses. And so what happens when a branch of government says I'm not taking any reporters with me on this trip to XYZ, but I'm going to call back Fox News and tell them what happened. Now, what that does is that it chooses winners and losers. Well, and it delegitimizes the press. I mean, you know, presidents have always governors have always had issues with the press, but it's always been at a level that is essentially civil. It's not anymore. I mean, this president is out to destroy anyone who doesn't agree with him, whether it's a newspaper or a politician or an NFL football player. And all this country can hope is that it survives the next two plus years. Or does he call the press? Of course he calls it the line. But he's not doing anything illegal. No, at what point does it become illegal? At what point does government sponsorship of the press, of any press, affect the freedom of it? Well, I don't think the government sponsors the press very much. I mean, the press is kind of independent. It kind of weaves its way through things and tries to overcome. Well, I hope so. But it seems like when you choose somebody to give news to, you pretty much... But you can't help that, Sean. There are some access cases. We start both in the press. Now we're talking about it. In Hawaii, what we had was, I remember Richard Borreca. That's exactly right. And you took the case. Now, what that did was it made sure that everybody had equal access. Not that it changed Frank's opinion of Richard and everybody else. The state constitution can be broader than the federal constitution. I don't see the Washington Post suing, I don't think they have to force the president to put one of their reporters on Air Force One. But it's not a good environment. I mean, I'm teaching at the law school now. I'm teaching constitutional law, teaching speech. This is a fascinating but very disturbing time for those of us who believe in speech. And one justice, one more justice on the court, who knows what will happen. It's very spooky. And I'm really sorry we don't have enough time to get to the religious aspects of freedom of the speech and how that's starting to clash. I hope to do that. But Jeff, I want to tell you we've got to have you back. It was very interesting. Thank you. Aloha everyone. Join us again for Talk Story with John Whitehead.