tter of fact, the briefings I used to get on it before I retired was like look, this is nothing that's ever gonna be a worry. Now, I will here to tell you that almost every intelligence organization in the world is looking at these things as a real threat. Because think of it, CEOs can deliver messages to billion-dollar companies. Is it really the CEO? Generals can be delivering messages to battlefield troops. Is it really the general? You get where I'm going with this. That was not around. I'm telling you, two and a half years ago. So when we go to encryption, when we have these conversations, right, to try to figure out which way do we go and how do we do this in a way that we protect the rights of Americans but at the same time protect the national interests of the country, I think some of these talks almost have to be in the theoretical. Because when it comes to encryption, I don't even think how far that we actually understand how far it can possibly go. The last thing I'll say, you can look it up on Google, but there's thousands of encrypted apps out there, thousands. Whether it's text messages, encrypted text messages, encrypted email, right? So the point is this, and I think this is a significant point, these issues are only gonna get tougher on us and I think we have to start the conversations now, especially between the government and the private sectors to try to figure out what's the way forward. We've got like about nine minutes left, 10 minutes left because it's just got the Q card. I'd really like to get some of your guys and gals opinions on this. Yes ma'am, and then we'll go over here, sir. Hello, my question very quickly is about the OPM hack. A lot of people, like myself, we got that letter. We believe that our data should have been encrypted. People, friends of mine were worried that people were gonna find out that they had affairs or blah, blah, blah, but it didn't happen and that data was probably, maybe it was a router, however it happened. Can you just kind of give us a quick update of what's gone on with our data and the government encrypting our personal data that they have collected? I can tell you, I ran the OPM hack. My data's all gone. 23 million of my friends, right? Like you, all of our data's gone. It was definitely hacked by a nation state. It's interesting that none of it's come up for sale. I should tell you what they're at least looking at the data. Let me just give you my honest opinion of the United States government IT infrastructure. And I'm not being sarcastic. The men and women are working tirelessly to protect our country, and I will tell you it's hopelessly out of date. One of the things that I lobbied for and I push for every chance I can is I think the Congress and the Senate really needs to review the laws that how federal government agencies actually bid out contracts to receive updated equipment. In most cases, quite frankly, when you do these bids, and depending on the budget cycle and if the government's shutting down or not, the money that you were given three years in a distance for some update to an IT infrastructure for getting encryption, I just mean updating your email system. Can't even pay for it. And that's a huge issue. And it goes back to the education issue I was talking about. You know, and I'm being bluntly honest up here, by the way, several times I tried to give information, I was the number three guy in the FBI, back to the FBI on breaches and stuff that I would see on my cell phone every day with the clients that were handling, I couldn't get into the FBI system that easily because it was just not meant to take the way that it's responding nowadays. Now they're working on that, but going back to OPM, I will tell you, I think it's a long way out and I'm not being sarcastic, I'm just being honest. Sir, you had a question back here too? Yeah, hi. I work in applied cryptography, so I've thought a lot about these issues. I think one of the things that I feel pretty strongly about is that if there is a backdoor in software that will eventually be something that any sophisticated attacker can get access to. And so I wonder, is there a world where it's ever okay to give the FBI a backdoor knowing that China and Russia and essentially every nation state will have access to it? So, two questions I'll answer in both. First one is, I totally agree with you. Now, on backdoors, I think it opens up severe risk. Even besides nation state attacks, right? Just traditional criminal or hack-to-visit attacks, it's horrible nowadays. So it opens up severe risk. Nation state, forget it. You got somebody like China, Russia, some of these other countries, not so much North Korea. Iran and the banking industry, it's significant. When it comes to giving the FBI whatever, I honestly think that's an independent decision by whatever company or organization that's doing it. But on the backdoor side, and that's really what's changed my opinion on a lot of this, is I don't think it makes it safer. I don't think there's not a need to be able to communicate and try to help each other, especially when it comes to protection of our own country. But I definitely agree that the backdoor issue is significantly, is significant risk. Yes, ma'am? Yeah, you're the boss. Thank you, Sharon Bradford Franklin with OTI here. So you talked about your 180 degree change in views and how you previously, you think looking back, maybe you had a somewhat of a myopic lens that you were looking at things with. Do you have any thoughts on how we can reach those who are still in the FBI and in law enforcement to help them to understand the perspective that you now share? Yeah, I think that's a great question. So one of the things that I think needs to happen is, and I don't know which side it comes from, and I don't think it really matters, but I think there's some major industry leaders both in the phone side of the house, computer side of the house, the app side of the house, the software side of the house, that I think need to extend at least an aisle branch to start talking. And the reason I say that is, and I don't mean, and I mean at high levels, and I'm not being sarcastic, it can't be at the mid-level, it can't be, I mean it needs to be at the director of the FBI, attorney general level, and it needs to be at very high levels at the board of these companies. Not even going into it thinking anything is gonna happen after the first five or 10 or 15 meetings, but I think there needs to be that initial communication. I would highly encourage any side to reach out. I think if you look at everything that's been going on politically and just globally, right, everybody's busy, everybody's got a lot of stuff going on, this issue, I cannot think of an issue that will permeate our society, the federal government, and the USIC more than this issue. And like I said, it's gonna get more complex. And the only reason I know I'm right on this is eight years ago, maybe seven years ago, and people that are cyber people in here will know this.  Nowadays, you could call in whoever you wanna call in, and I don't think it's happening. When I was in the FBI, I told you don't ever pay a ransom. I guarantee you 99% of the clients that I've had in those cases pay ransoms. They just do, because they can't unlock their system. They can't pay 100,000 employees, like they can't. Going to the encryption thing, I see it going that direction. So there's gonna be more engagements, and what I don't wanna see is I don't wanna see another San Bernardino, because I lived it. And I saw the tension on both sides at the highest levels of this government and at the private sector. And I wanna get there before then. And Katie, who's a partner of mine from the Chertoff Group in the back, she's heard me say this in a million meetings, and I would say it to Chris right now, the director of the FBI, or anybody. They need to be that initial dialogue, and we need to talk about how we're gonna make this work. Again, protecting the rights of the people that the companies have, engaging contracts to protect their information. All the way in the back. Hi, Kevin Bankston from New America's OTI. Thank you so much for being here. And for candidly talking about your change in perspective, because it's very rare in this town in particular for anyone to ever say, you know, I thought about it, and I've changed my mind, I was wrong, and here's why. So thank you. But my question, you, I think, correctly cited a key missing piece here, which is a discussion about how do we fill the technical education gap for the tens of thousands of local law enforcement agencies to teach them how to, you know, use other alternative sources of data to fill their evidence gap, like how can they take advantage of all these changes in technology rather than simply being myopically focused on the encryption thing in particular. Do you have any particular thoughts on what the DOJ or Congress or anyone else can do to help make that situation better and actually give local police the tools they need to catch the people. Great question. I think the last one we're gonna have time for, but it's a great question. I highly would advise in any good way to the Congress or Senate, they need to be thinking way out. I briefed the Senate and House Intelligence Committees probably a couple hundred times in my career, right? Starting back with Rockefeller. That tells you how long ago on that board. I really think they need to allocate funding for the training and assistant not only of the federal and state and local law enforcement, but also help the private sector, right? Monetarily provide some of this training because honestly, I'm telling you the truth. 20 years ago, because if you look at my bio, I've arrested a lot of spies. I actually really don't like spies. So back then, right, when people are trying to do this type of like look or training, it was much easier. Nowadays, this changes constantly. So no one's gonna be able to allocate in their budget, right? In their little town and their little sheriff's office or whatever, even in big federal agencies, the ability to keep that training current. And I really believe we need to look way out instead of budgeting the way we budget for a year or two years, maybe three years, and then pulling a lot of that money back. And the reason I say that is in the meetings that I've been in up there, that's not to focus. And I'm not blaming anybody. The focus is the crisis of the day usually, right? That's why I was always up there. But when we talk about budgets, they kind of refer back to their old traditional, the way we do these budgets. And I really think nowadays you can't think like that. That's part of the problem with this. Like when I say, and this is a big deal, when I say we need to be like theoretical, like thinking out, that's not a real good word in law enforcement when it comes to long range. It's usually black and white over a period of time. So I think that really needs to be done. Listen, I really appreciate everybody sitting here and listening to me. I'm sorry, sir, I think, can I have one more? Are we done? We're done. She's telling me we're done. I'll talk to you afterwards. Thank you so much. Thank you, Bob, for your remarks. I think it's a really great way to lead into our last panel, which we'll be focusing on industry and the role that encryption plays in fostering innovation and protecting consumers' data and, of course, enabling companies to do the important work that they do. So with that, I'd like to invite our final panel on to the stage for that discussion. Do you have the term on, or are we good?  They're all on. They're all on. Yeah, it's going to make sure. Good afternoon, everyone. I thought it was morning for a minute still. My name is Jack Gillum. I'm a reporter at ProPublica, where I cover a lot of issues regarding tech and algorithms and civil rights. This panel, I think, is going to be fascinating. I hope it will be. Just because it gets beyond, I think, the area that we normally discuss in the previous encryption debate really about communications and the government prying eyes to your private thoughts. This is more about consumers and innovation and e-commerce, pretty much the things that a lot of ordinary folks interface with every day when they might not realize it. I'm just going to start from the end, down with Jeff. I, everyone, is going to introduce themselves. We're going to go into a little bit of a free-wielding but discussion, and then we're going to save about 20 minutes for questions at the end. So be prepared for that. So I guess we'll start. Great, thanks very much. I'm Jeff Ratner, and I handle cyber policy issues at Apple. So I'm Eugene. I am part of the Android Security and Privacy Team at Google. I'm Kate. I work on privacy and security issues for Engine. We're a nonprofit based here and in San Francisco, and we advocate for pro-startup policies. My name is DeVroote Mitter. I'm the CEO and founder of ArmourText. We provide secure collaboration capabilities for critical infrastructure and other regulated industries. My name is Tom Gannon. I'm on the US Public Policy Team at MasterCard. Happy to be here. So I'm going to start with Tom, for he's the closest to me. Sort of at this area that seems to, I think, get little attention in the common space when we talk about encryption. And that is the area on payments in which the security of which I guess is the linchpin of your business. I'm just wondering if you can talk a little bit about encrypting payment data around the world beyond even shipping pin and how that underpins the financial system in particular your work. Sure.  We operate between issuers and acquiring banks, merchants banks or consumer banks on the issuing side. We're essentially a B2B payment network. And so our customers are banks. Security is a top concern of ours. It's something that we spend a lot of time and energy and resources in the encryption space. All of you probably have seen in the US the evolution of physical card payments over the last few years moving to chip cards. The chip on payment card is an encrypted way in which people can use their cards at a point of sale in person environment. It's meant to encrypt the payment card data so that when you're using your card at a store, for example, that chip rather than sending your 16 digit account number over, it sends a random one-time authorization code essentially keeping the payment security information or the PAN with you and your bank. It's not a new technology necessarily, it's new to the US. It's been, I think, an evolution for the US to adopt chip over the last few years. It continues to be an evolution both on the issuing and merchant side. In the online environment, we're continuing to invest in new technology and new security, things like tokenization, which is a form of technology that allows card not present transactions, online transactions to be secure, are more secure than they are today, essentially taking your card data, your 16 digit account number and removing it from the transaction so that cyber criminals can't steal your payment card information. That technology is being deployed more and more in the US and around the globe. Obviously encryption is a big part of that because your card number is encrypted when a tokenized transaction is used with an online merchant, for example. But it's an evolution in the way in which payments are operating for consumers and merchants and issuers and there are other innovations, I think, to come that will have the effect of making payment card data, consumer card data, useless to fraudsters and cyber criminals that are out there that are trying to steal information that they see as valuable, namely payment card information. So when we talk about tokenization, that's something I've always been personally fascinated with in the idea of if there's a way to make credit card skimmers obsolete, maybe that's one way we go about it. Gene, this gets into your realm a little bit with Android Pay, but just beyond that, I don't know if you wanted to talk a little bit about that a little bit, but one thing I was really fascinated with was these other applications that really rely on encryption, whether or not they're medical devices, whether they're mobile driver's license, I just wanted to see if you could touch on that. Yeah, thank you for having me here. The lights, don't look in the lights. So taking a step back, so when you think of encryption, I think Tom made a good example of encryption in transit, there's encryption at rest, but broader cryptography, especially with mobile operating system and device, it's used throughout, right? You boot your device, there's an integrity check that makes sure that it's a trusted known good version of the operating system when it boots up, you type in your PIN, then data gets decrypted, these apps obviously use key material to communicate with backend resources and other people, encryption's used throughout, and prior to this role, I spent time as a product manager on various products, and one of the products that I worked on the most was secure email, specifically for government use, and I always come back to the three use cases when it comes to cryptography are authentication that only you're allowed to access your data and nobody else should be able to access that data. There's non-repudiation, which means you know that that data came from a trusted source that you can verify that they are who they say they are, and then integrity of that data, message integrity where you know that data hasn't been somehow tampered with in the process of it being transmitted to you, right? So with those three things combined, when we start looking at what we can further do with cryptography and future use cases, like Tom was talking about with these mobile devices, it's an interesting space, so one example since I come from a public sector background is everybody talks about two factor authentication, right? You have your smart card, you have your, it's got the something you have and the pin for that card is the something you know, and so when you start looking at smartphones, they become really powerful devices for beyond just two factor, like I look at smartphones as truly multi-factor Swiss army knives, so to give you an example that you can store key material on the phone, right? So that's the something you have, you have a pin to the device, that's something you know, and then you have all these other contextual layers that you can leverage to help figure out at the right time, at the right place to do something. So whether it's where you came from, where you currently are, the health status of your device, whether it's in a good standing, you know, all these things, and actually a lot of folks are starting to implement something like that with the right credentials, where you know, the phone becomes a, you know, could be used for physical, logical network access, right? So these are kind of future use cases, a couple other use cases that are really interesting and kind of coincide with our latest Android OS release with Pi. We introduced two really neat features. One is Strongbox, so Android pretty much all OSes have started relying on more hardware back security, relying on the actual hardware to provide cryptographic operations, and as a result of that, you know, the data becomes, the cryptographic material becomes much harder to exfiltrate, and so with this new API Strongbox, we allow, you know, merchants, app developers, whoever to start storing key material in discrete, tamper-resistant hardware, which makes it much harder to exfiltrate or pull off the device, right? The second piece that we've recently come up with is what we refer to as protected confirmation, and this feature is actually really cool. It's basically a trusted, what we call trusted user interface, and it's actually lower level, so it's not at the OS level, it's below that in the trusted execution environment, and it's a really interesting use case, and this goes to the scenario of controlling medical devices. So what happens is, if you try to use an insulin pump, for example, and you try to say, I only want, you know, this much insulin, if some malicious application was on the device and able to impersonate, it would be able to send the wrong dose and could harm the person, of course, with protected confirmation, and this is something we did a demo at Google I.O. The way it works is, the insulin pump vendor has an application, they call an API, and basically the information, the amount of the quantity that's gonna get put through the insulin pump would basically be shown in this trusted user interface. The user has to hard press a button twice, and then what happens is that information that's cryptographically signed, and then the insulin pump, which is the relying party in this case, would be able to verify that, you know, the intent was correct and it wasn't something that somebody tampered with, malicious, like a malicious application can tamper that information, and at that point, it would send that to the insulin pump and then we'd get applied to the person. And just to back up real quick, so when we talk about an insulin pump and requiring that sort of cryptographic trust, we're talking about, say, I'm just envisioning here a pumping at somebody's house or at a place where it needs to relay remotely to, say, a physician or somebody to review that or... More of a Bluetooth, like, it's like diabetics that have it attached at all times, and they just need to apply it at that time. Sure. But the key is it could be over any network medium at that point because you could verify the dosage amount. Sure. And I think just to piggyback on what you said, I think this gets into a larger and broader conversation that we were discussing backstage about people using devices to really to authenticate into not just, you know, their account information on the device, but applications and devices running in their homes and even critical infrastructure. And I think, you know, especially with Apple, we take encryption so seriously and we wanna make sure that our users are the only one that can get into their devices. And I think increasingly we're seeing the importance of that as the kind of the growth of IoT and the interconnectedness with our devices really just grows, I think, right at the beginning. Well, and to build on that, I was gonna go to you next about the importance, I guess, what you're saying is to trust, right? The idea that it's just really beyond, you know, brand loyalty to a company like Apple and being able to trust that when I purchase an iPhone or I sign up for, you know, when I use iMessage, whatever application it might be that my information is protected. And so I just want you to talk a little about how trust, which seems maybe obvious, how that underpins a lot of what we're trying to do. Absolutely. I mean, it's critically important to Apple. And I think it really, to all of us, and I think to the public at large, trust and security are going to be kind of the pillars of the future development of technology and the internet. And I think we're seeing that play out in debates around privacy here in Europe, that consumers need to trust companies that their information is gonna be protected, that it's gonna be private. And I think encryption is one of the only ways we know how to do that well. And, you know, as we're seeing this explosion of new tech on the market, I think the only way that will continue and the only way consumers will trust these devices and allow them into their homes and into their lives is if it is backed up by the best efforts of the companies represented here and others to protect that information. So I think there's an increasing recognition of that and how important that trust is and really I think encryption just underlies that to a large extent. One key or critical part of that though is also getting tech companies to realize that they have to be very judicious in determining what they are ever going to store or transmit across the network. The encryption is there to protect it from your device to their network. Once it's there, there's still possibilities of leaks and breaches. And we've seen a lot of that take place recently. There's abuse of that trust. We have to start moving towards the world where we're saying, hey, do you really need to hold on to that? And do you ever need to have it in the first place? If not, don't. I would agree. Well, I was actually gonna get to the next. At ArmourText, your clients include defense and critical infrastructure and where these communication protections really have real world effects. I mean, these are in terms of lives lost or saved. I'm just curious if you can talk a little bit about beyond encryption just among from the thought of a prying eyes of a government and more of our government, the US government and more of foreign governments, foreign actors, hackers who really once inside a pretty critical application can do very serious irreparable damage. So we obviously provide secure collaboration capabilities that allow different critical infrastructure and regulated industries to be able to communicate internally and feel secure that both their communications are protected from external threats and adversary that we'd be trying to listen in as well as potential insider threats from the administrators that may have gone through. We've seen examples of that take place here. When it comes to lives lost and or some of those adversaries though, you have day by day more and more examples or more and more warnings being delivered to critical infrastructure industries by places like the FBI and the DOJ and others saying, the adversary is now on your network. They are listening in. And when we think about industries like the nuclear energy industry, electric utilities, places like hospitals or other critical infrastructure, if you know the adversaries on the network, they've compromised privileged credentials and are able to listen in, they're able to potentially do a handful of really harmful things. One, bring the network down. Two, bring down the infrastructure itself which can lead to lives lost. Or three, gain critical intelligence and or compromise IP that would be helpful. So some of our customers include places like defense manufacturers and or government advisory services. We're very literally, they're communicating about technologies and or updates to technologies that they don't want our adversaries in other countries to be able to reverse engineer. And so they're realizing that more and more they have to protect their internal communications but also the communications with their suppliers, their vendors, their manufacturers, their partners because that entire supply chain is Intel that one of those adversaries if they were able to compromise it could use to affect technologies that have real world applications like sniper rifles or the optics used on sniper rifles even to binoculars and other systems that are military uses or government advisory services when they're advising other countries on how to bolster their security but also communicating about what may be problematic today. Where are you falling short? That insight or that knowledge upfront acts as a roadmap or potential adversary. And so more and more companies and governments and others are starting to say, hey, we have to be very protective of this kind of communications even if it's just DevOps chatter that is the roadmap for a hacker to get in. You mentioned a little bit about, say, made not to hospital chains or large infrastructures being hacked and I'm thinking of the MedStar hack here in Washington was a few years ago. This is a big chain. It has a lot of hospitals, clinics, a big IT staff. This is sort of naturally segueing to Kate. There are companies, startups that don't have that infrastructure even if they wanted to. I just wonder if you could talk a little bit about the effects of sort of undermining encryption on those startups, especially when being in a startup environment, you have to deal with the fire of the day or you're still working on sort of like a first tranche of VC funding. The last thing you're worrying about is the people who are on your network. I'm just curious if you could talk about that a little bit. Yeah, sure. So often when we talk about encryption, we talk about kind of the apples of the world and the good stuff they do and that's great. I think that's obviously kind of top of mind for most people when they think about this, but there are so many small companies and startups out there that rely on encryption that don't have kind of the technical or legal resources that a company like Apple does. So if the government were to come to them asking them to undermine encryption, they don't necessarily have the budget to fight it out in court. They don't have the technical resources to hire engineers to build in a backdoor and then hire more engineers to defend that backdoor because the backdoor is not just for the government obviously. If the government can get it then any kind of malicious actor can. And so when we think about the encryption debate more broadly, it's important to remember that not everyone has the resources that these big companies have, but people certainly expect the startups to take their security seriously as someone who, as a user of a startup, you don't want to think that, oh, they're too small to protect my data.  And so trying to deprive big companies but especially small companies of a tool to do that is really short-sighted. And a startup is usually not in a position to kind of bounce back the way a major company can if there's some kind of data breach. We've seen plenty of data breaches over the last couple of years and we all still go to Target. Most people still go to Target. We still use certain financial services, but if you're a startup but you don't have that name recognition, that kind of reputational hit can really take you down. And if you are operating on a bootstrap budget, that could be the end of your company. So I think the effects of this debate are disproportionately large for startups who are usually small and underfunded to begin with. I just wanted to go back a second about the access and availability to encryption. And it seems like a fairly basic conversation but this is something that has always personally troubled me is that there is a sort of technical knowledge debt where people, in other words, who have the ability to understand encryption can make things better than people who don't. And I think there is a host of morality and inequity issues that come up with this. I'm just curious if we can just talk a little bit about whether it's product development on the Android side or more space in the startup side that makes this type of technology more ubiquitous and safer so that anybody, whether they have an advanced degree in computer science or they're just a person wanting to form a startup where they can start and how that landscape has changed to make encryption more available and easier to access. I would say cryptography encryption is a very specific skill set much more above and beyond just a traditional computer programmer. And so I think this is up to the OS providers to really democratize the capabilities. And I think Apple, Google, Microsoft, all the big guys have done that. They have platform APIs for app developers to be able to do all these things and they're continuously making those better so that they don't have to reinvent the wheel necessarily if they don't have the expertise and they can rely on these capabilities that the OS is already providing. And they're kind of future-proofing that some degree because these OS providers are continuously improving those capabilities and making them stronger and more impervious. But what we do need is a level of cooperation to start to occur between the larger companies and the startups as well as the rest of the ecosystem. The reality is, is the reason end-to-end encryption needs to exist in a product signal or in WhatsApp or even I-Message is because the earlier protocols we had like SMS and MMS had failed to deliver a viable security model, right? The telecoms were involved in that. They helped implement those protocols. They helped maintain that. They helped determine what applications were on the handsets of the devices for the good go and yet they failed to solve those problems for so long that it led to Apple implementing I-Message with end-to-end encryption. And it's Apple's I-Message end-to-end encryption that then falls off when the minute you're communicating with someone who's on Android. And then Android has it in certain places but not others and it falls off somewhere when you go and return. WhatsApp starts to implement back-to-back but it's only when you're within the WhatsApp wall to guard it, same thing with signal. We have to start developing a level of cooperation between the big boys that says, hey, guess what? We could build interoperable end-to-end encryption around things like this as well. And that's something that we need to start doing. Two, just to jump on and piggyback on their comments. You know, I think one of the key features of good security is that especially in the consumer device world is that it's easy to use. And that's why I think it's so important that the platform providers are building it in behind the scenes as much as possible. And so a good example of kind of that is, I think before Touch ID, about half of iPhone users had passwords, numeric passwords, the rest just didn't have any security. After Touch ID, that number very quickly exploded to about 90% of users. And Touch ID requires you to enter a passcode. And so you have that extra level of protection that a lot of people were foregoing because we had made it easier. And I think that's really an important point here. One thing that I would add is good security, I agree, is transparent security. It also needs to be measurable security. And that's where the taking a standard approach or having somebody vet it. And I think Apple publishes stats on Touch ID and impersonations with Google. We published some stuff around that as well around false acceptance rate, posture acceptance rate benchmarks that you need to attain to provide that nice measurable security. But it's that ubiquitous, that ubiquitous secure communication, collaboration and other things. That's where that cooperation's gonna have to occur between all the different vendors, the larger vendors especially. When you're talking about consumer applications, you're talking about enterprise, different story you can mandate down that all the people within your organization use technology X. But for the consumers, we have to communicate with everyone and everyone in our network. Everyone and anyone in the network may have all different devices. You're never gonna tell that level of ubiquity and that ease of user experience and knowing for sure that yes, this communication was protected, no matter which person in my phone book I was communicating with until you start to use interoperable security communications. I was just gonna say, I find that statistic Jeff very remarkable, a 40 percentage point increase just with the advent of Touch ID. That's sort of an area, it's not just about getting buy-in and encryption from the public, but it getting a buy-in on just security in general. I mean, an ordinary user of an iPhone in other words might not know that his or her device is encrypted, but they know that they put a passcode on it so somebody else can't get into it in a very rudimentary sense. I'm just curious, is it because it was cool, it was like this new thing that hey, I could put my fingerprint and open my phone and it by extension required a passcode. Is that why you think you saw it? I think certainly the allure of it has some factor, but I think in a lot of ways is just the feedback that Apple was getting was that people just were checking their screen sometimes between like 40 and 80 times a day and they didn't wanna enter the passcode every time and so we came up with a way that they really didn't have to and just making it easier to get into the device but still have that layer of security I think was probably the biggest factor for the increase so there certainly is, and we saw this with Touch ID to Face ID, there certainly is this, the allure of kind of the new product and the new feature, but I think it's also, it really goes back to just the ease of use and the willingness to then actually accept additional security. That's one of the few instances in which you have an improved user experience and get security at the same time, right? Typically we talk about security and user experience and one goes up, the other one goes down, very rarely do they go with tandem and those kinds of technologies are few examples and the few examples where that definitely takes place. I also think that was a good carrot and stick example because once Touch ID was available, same with Vimeo Shackle Android, the OS is able to kind of nudge the user into setting a passcode, politely saying you should really set a passcode because it's easy enough now to unlock it more periodically with your biometrics so it was kind of like hand in hand with that. And that also became easier too to, I mean I have to admit I have an iOS device so that's sort of my question about Touch ID. Is it then that it seemed to extend pretty quickly to the financial world where if I logged in with an American Express or Bank of America or whatever provider, that's how I did it and it seemed like it created this, as you were saying, this sort of ubiquitous security. It really made it easier for consumers. To financial side, I know this is a little awkward that I'm standing right next to you but when it comes to tokenization, I'm wondering if that, if this is sort of the, I'm gonna make a broad brush sort of question here, if that is the future here when it comes to making much better encrypted secure currency or financial transactions. Is there going to be a point where we're just going to soon bypass chip and pin altogether and go to this tokenization approach with a mobile device? Yeah, I think so. I mean, you know, PIN is a way to authenticate yourself and so it's a, you know, it's one way to authenticate a transaction but PIN really kind of only works in the physical world. It doesn't really work in the online world when you're going to buy something with an online merchant. It doesn't work as well. It's also a static way to authenticate yourself. Biometrics, whether it's Touch ID, whether it's you're measuring your heartbeat, whether it's some other facial recognition, some other kind of unique identifier to you is a much, from a security standpoint, is a much better way to authenticate that you are, in fact, the person making this purchase. It's much more secure than, you know, asking for the three digit number on the back of your card. So I think whether it's tokenization or whether it's some sort of other dynamic, more secure way in which to authenticate that you are, in fact, the person who is using the card to make the purchase, whether it's the card's in the device or whether the card is physically with you, I think that's the direction that we're going in. There's always a balancing act between security and kind of the friction that people experience in making payments. Payments is not something that someone gets up every day and wants to make. It's not something that people necessarily get excited about. And so part of the balance that we have is, how do we create a secure environment for people to make purchases, but at the same time, you know, take away some of the friction that exists in doing that everyday task. And so it's a bit of a balancing act, but I think security has to be sort of there and in top of mind in whatever is deployed. It also has to sort of work for the consumer. So not every consumer is gonna wanna authenticate themselves in the same way, for example. So having multiple ways in which to securely authenticate you in making a purchase, whether it's in the physical world or whether it's online, I think it's important because it gives people options. When it comes to this discussion, there's always looming in the background legislation. And I know that Jeff, you and I had talked briefly about these assistance and access bills in Australia and in the UK. Given the fact of the sort of importance to really to e-commerce, to pretty much every facet of our digital lives when it comes to encryption, I'm just curious how those arguments are can sway or not sway legislators who are trying to really create what some crypto folks say is really the impossible to really have good security and that is a fact we're doing encryption. Sure, I mean, the bill that's before parliament in Australia now is contains quite sweeping new authorities for the law enforcement and intelligence services in Australia. We've submitted public comments on our own and in conjunction with others that raising some serious concerns that these powers can be used to undermine security and encryption and really weaken the user experience and the security and the trust of all users in Australia and all over the world. And I think Australia right now, there seems to be quite a rush to pass this legislation and we've pointed out some of the potential ill impacts of it and I think we are hopeful that the government will take a step back and maybe think through some of the long-term implications of this type of law, which would allow them to force providers to make changes to their products in myriad ways. And I think we don't even know the full extent yet of how the authority would be interpreted, but it's clearly quite sweeping. I don't know if anyone else has been tracking this, but we're certainly concerned. Yeah, I'll say from a conservative perspective, obviously it's complicated enough having to deal with one country's rules, but when you add in different authorities in different countries and users in different countries and users who are subject to varying rules, a global landscape of dramatically different and in different ways, privacy invasive and security destroying measures are just something that most small companies can't even imagine being able to comply with. So it's especially damaging if you're a startup who maybe you have a legal team of two and those lawyers are not experts in getting access and assistant requests from the Australian government or whoever it is. I think that's a, yeah, it's hard for everyone, but it's especially hard for small companies. Yeah, I mean, as a startup founder, you oftentimes don't even have a legal team of two. You have a shared lawyer at some large firm that's doing some work for you and you don't have a $3 million legal set aside in your VC financing just to deal with adjudicating every single request that comes from every single new municipality or government or other authority to say, hey, well, guess what? Carl Laulos, you asked me to do the following, please comply right now, you're 48 hours. It's a, sometimes I'm technically feasible from an engineering perspective, but we certainly don't have the kind of financing that a Google or an Apple do to sit down and say, yeah, well, we're gonna tie you up for the next, you know, five months over this issue. This is not happening. So I was gonna ask this and this is a question for folks who may not be steeped in this when it comes to an access bill, say, in Australia or wherever, where you were asked to provide a decrypted message, right? And let's say it's in the case where you as the company don't hold the encryption keys, you don't hold any of the key material on it, basically no physical way that you can unlock that. What happens? Do you just not do business? I mean, what do you not do business in the country?  And I mean, what's the, where does the river hit the road with something like that? That's an excellent question. We have not been confronted with that situation. We have not built any back doors or decrypted communications that we weren't able to. We've held the line pretty firmly on that. I think that, you know, it's very different, I can imagine, for smaller companies and startups than it is for Google or Apple. And, you know, I'll let some of my colleagues speak to that, but we have not been confronted with that stark choice. Yeah, and I think it's almost easier to just say, okay, we won't go to that country to limit your expansion plans. And we saw this somewhat with GDPR in Europe and probably a different debate, but it's sometimes easier to say, we can't play by those rules, so we'll just limit our user base to countries that have rules we can play by. Right, I'm just curious, like what do you do to say, Australia says, oh, you can't sell an iOS device, you can't bring it into the country and be on a, I'm just fascinated about how you actually get that to work. We have about 20 minutes left coming on. Arsa? Oh, we have until four, but that's right, we were put in. I wanted to go back a little bit and talk about these, we talked about access bills in Australia and the UK, and I'm not, I promise I was not gonna go back to the old encryption debate. But when it comes to the area of trust, we had talked about a little bit, about the sort of ubiquity of encryption and how there seems to be sort of two sides of the way the public use it. They look at encryption, especially if they're not steeped and they use this very often as this must be something where the bad guys must use it, they're trying to hide communications, they're trying to keep it from the police. Meanwhile, they don't bat an eye when it comes to say, given their credit card information to Amazon to buy a toaster for a gift or something. They don't really, they think those are two different things. I'm just wondering is the ubiquity of encryption is that going to lead to a better education among the public of why this is so important or is it the other way around? So maybe we, you know, laws are not written in such a, I guess, cryptophobic fashion. Whoever wants to tackle that. I would say like from my perspective, at previous companies where we built products that met certain requirements, at the time the OS providers couldn't meet those requirements, we were able to meet those requirements. So the analogy there is even if the OS providers didn't provide the proper security that provides support to everybody, there's always gonna be a vendor out there that will meet that requirement and they could be set up in a country that doesn't have to apply laws and it's up to the person that's importing that technology in, but somebody's always gonna solve the problem of protecting the data end to end. So it might as well just be the OS providers because it democratizes it for everybody. Yeah, and I think the ubiquity has sparked a demand and I think we've seen, as I mentioned before, we've seen that in the concerns over privacy that have really exploded recently and I think that once the platforms and other providers have been able to provide these services in a relatively easy to use fashion, the consumers are gonna continue to demand that and if companies in the US or elsewhere are not gonna be able to provide that, I think other companies will fill that void and I think that's just the fact that encryption is math, encryption is available all over the world. I think it's, and I haven't checked this recently, but I think almost two thirds of the encrypted messaging apps are developed overseas and so I think it's very important that our companies are gonna be to continue to compete in this area and to be able to offer the best security available. And I do think as encryption becomes more commonplace, there's less and less a sense that it's something for the bad guys and we've, Robin, this is Robin's point, so I'm just gonna steal it, like we've heard of domestic abuse groups who say we wanna protect victims of domestic abuse and they're using encrypted apps to communicate and get to safety and if you undermine encryption, you're undermining their encryption too and it's not something that we work with plenty of companies who have no intentions of providing services to the bad guys, they provide services to plenty of good guys or neutral guys even and they wanna make sure that their security is protected and Jeff's point about competition from abroad is especially true for the big tech companies, but I mean, a small tech company can't compete if another country comes in with a better, more secure service and if the user is interested in protecting themselves, they're gonna go for that more secure service and that means that a startup here who's maybe their security is purposely undermined by the government, they're at a disadvantage. So, but I think your original question was about whether or not the ubiquity of encryption and its day-to-day use cases and its implementation on the operating systems or from the device manufacturers will lead to a world in which our legislation becomes less cryptophobic, right? And I might have a slight different view on this than some of you guys. I actually think it won't because it's not necessarily doing that today, right? We have more ubiquitous end-end encryption communications capabilities through every single major provider of an operating system and or hardware system today that we didn't have five years ago, a little over a decade or two decades ago and yet the push from law enforcement, the push in the last national election here in the United States, we're both presidential candidates from the two primary parties in the US, we're pushing for saying, hey, we want encryption with backdoors, it's technically feasible, we'll get Silicon Valley on our side, we will make this stuff happen. That was still there and the reason that was still there is because enough people who supported those candidates and the people who were talking about this kind of legislation supported their views, right? If it was so wholly unpopular that congressman X or congressman Y or congresswoman Z was going to face a backlash from their constituency because, you know, encryption was so important to their constituency that they were willing to say, hey, you know, we're willing to forego whatever law enforcement or other arguments, you know, their needs potentially into this. Those congresspeople would drop that argument almost entirely. So I'm a cynic on when it comes to Congress. They don't do anything out of the morality of it. Typically they're doing it out of what will work for their voters. So I think, I mean, one, I'm not sure this issue resonates at the ballot box. I think that we've seen past Congress's attempt to pass legislation or at least consider it and those efforts haven't succeeded. I think there was a difference in the question whether it was will the ubiquity impact legislation or will it impact kind of consumer demand? And I think those two things will obviously relate, but I think as consumers get used to having this security available, that demand will increase. And I think it will become something that shouldn't be taken away or weakened. And clearly that will affect the appetite for legislation, but I'm not sure if I, you know, in terms of evaluating the availability of encryption on kind of the voter's choices, I think that's harder to parse out. And so one of the things I think the appetite for encryption is not going to weaken for consumers. They're going to want a better, more protected iPhone, a better, more protected Android device. But will they then turn around and say, hey, guess what, you as a legislator, if you're proposing encryption legislation that might weaken any of this stuff, I'm going to specifically turn that against you. No, because they're going to keep trying to sell it exactly the way they are in Australia, which is that, hey, we can do this without causing any weakness. We're not, we're going to follow the known standards. We're going to follow X, Y, and it's a broad language to get it past the voter. And I don't think that's going to get turned away by the voter at that point, right? They're not going to say, ah, I now understand encryption so well because ubiquitous therefore, I'm going to demand that you make a law that actually makes sense. I just don't see that happening. I think there's still going to be this disconnect unfortunately, because we, while we're making it ubiquitous, we're not necessarily improving the education around how these technologies actually work or where their fundamental failings would be, whether it's the human or some other implementation issue. We're not really educating around that yet. But I'm not sure we've seen that watershed moment yet. Like I think if Congress were to schedule a vote for next week, and I went home and told my mom, by the way, if they approve this, you're more likely to have your iPhone stolen because it'll be easier to break into. Like, I don't know if my mom would call, but like I think that is an argument. Like we haven't had that vote scheduled yet. Like I think it's hard to rally folks about something that's maybe two years away. Which isn't to say, I mean, yes, we should be educating, and I think we are educating to the extent that we can and we can always do more, but there hasn't been that real test yet. I think it's also just, it hasn't hit the broader masses yet. There was somebody who had the proposal for a potential way of doing this, and it quickly got peer reviewed and a lot of negative feedback on that, right? So, but that's a niche audience reading that information. It's not something that gets publicized to the average consumer. So it just hasn't hit them yet. They haven't found a way to personally relate and realize what they would be losing as a result of something like that. So, and that comes back to the education, right? In both those cases, it was the education that's gonna make the difference. And that's why I don't think the ubiquity of the technology itself is gonna solve this challenge. It's gonna really be the education aspect that we all have to start taking on. And I mean, look, I've been able to rile up ordinary people about the Freedom of Information Act. So I feel like things are possible with these things. Anything's possible. And I think in the serious side, the reason why we were able to do that, or I was personally in sort of my own fervor, was that once you were able to sort of draw a line, not like the sort of large policy issue about government records, but basically boiling it down to, they have information that you paid for, you should have a right to access it. You know, it's a very clear thing. The same way that from what I remember covering at the AP, the right after Snowden, the Snowden Disclosures, up until that point, the Bill of Rights, the parts that people were the most familiar with, and speaking of ubiquity, or the First Amendment and the Second Amendment, maybe a couple more. After Snowden, I mean, you could probably do a Google Trend search and keyword searches, Fourth Amendment. I mean, people who had nothing to do, by the way, with policy or even lived in Washington started talking about the Fourth Amendment. Because the Snowden guy was everywhere and there was this huge discussion about what does the government, going down to the local police force, have a right to look at? And maybe, I'm not saying that it takes these big disclosures to push that forward, but you're right, this isn't gonna be like a dinner table issue with mom. But if you frame it in a way of, okay, well, all of your personal information, and by the way, mom, you just got your identity stolen a year ago, maybe this is gonna make that problem worse, and maybe that's making it sort of, and I'm not saying dumbing down, but things are complicated, people have a lot to worry about beyond what we do. And maybe it's making it understandable and digestible is the way we go in. I'm just, maybe that's the way we do it. That actually, my own personal life, that's something that paid off quite a bit. Way back when, when I was trying to learn forensics on older operating systems, my wife had to do phone, and I showed her how to recover some data and kind of freaked out a little bit. And then one day, I showed her how to like, was able to man in the middle of her traffic on her phone, I got into her Facebook account, but I love my husband and she replied, I've been hacked, but, you know, but the relevance of that story is that like, that personal impact to her made her very security conscious from that point on, she had a complex password on her phone, she was very conscious about being on guest Wi-Fi somewhere. And so it takes that personal factor of how does that impact me and my own personal life to make them appreciate what potentially they could lose out on in the future. Sure. And to that extension, if I can add my own observation, when at the Associated Press after Snowden, you know, we became very quickly, and I pushed for this even before then, about the importance of using encryption or even just general, you know, operational security when it comes to journalists dealing with sources. I mean, journalists, whether it's in Washington, whether it's dealing with a local police official who's trying to leak you something about corruption, I mean, we primarily deal in source information. And this is not disparaging anybody, but getting very accomplished, even Washington reporters, to not direct dial somebody at work where they don't have to subpoena, by the way, their own phone records, if you know, either in that office, getting them to use something besides, you know, like signal, which was nascent at the time, or iMessage Beyond SMS, to some form of encryption was really foreign to them. And it just, it was just something that required more work. And it's like, I have enough to do, I have my own system of doing it. And now, you know, fast forward a few years, I don't know of a single journalist in Washington that doesn't use signal. So there's signature. Yeah, right. Yeah, they put it in there. It's on my business card, in fact. Well, it had been, and then they were like, we're not putting that on anymore. But at least it's in my email signature. So things change, but even among the most, what should be security conscious of people, or, you know, sensitive, you know, these are journalists. The classic thing we like to say is, you know, which is true, we will never reveal the source, because that's, you know, integrity and trust is important to what we do. But getting them to sort of go that extra mile, it's not that they were, you know, stubborn as a mule, it's just they didn't really know what the, how to, they didn't really know how to process this all. And some of you were like, well, what do I do? I just cover politics, you know. And it's like, well, you can cover politics, but then two years later, you get leaked the Romney 47% video that by all accounts derailed as 2012 candidacy. And someone is surely going to be asking the source of that, or trying to find it out. So, and that started with the relationship you built three years before, so. We have a few more minutes before we get to questions, but I'm just curious, Kay, if we can just talk about startups, what are the biggest issues that you see when it comes to information security or, you know, IT security problems about, you know, groups that may not have like a large budget to take care of these things? Sure, so I think kind of like the top of mind biggest problem right now is, you know, making sure that there aren't state-by-state laws that require different things, which is obviously on the regulatory side of things. And I think I could talk for a whole hour and 15 minutes about the California Privacy Bill, but specifically on this issue, you know, it has a provision about how like, if your customer data isn't redacted or encrypted and it bleeds, you could face statutory damages that could rack up very quickly to be incredibly detrimental to a company who's just getting off the ground. And it's almost effectively creating like a safe harbor if you encrypt your data.  And then to hear from the federal side or from state and local law enforcement, but we don't want you to encrypt your data, like I'm not sure how a company who's getting off the ground can navigate that. There's already so many time and budget costs associated with making sure your user's data is protected, especially in an age where consumers are, granted, you know, my mom doesn't really know that her iPhone is as secure as it is, but she knows that she's had to replace her credit card two times or whatever it is. I do think there is a push to be more conscientious of that, those concerns. You wanna make sure that your users feel safe working with you and that for most small companies, the most effective way to do that is to encrypt their data. That's a pretty accessible way, that's not too expensive. And it's something most companies choose to do if they're being smart about protecting their consumers. So to face on one end, you gotta do this thing, but if you do this thing, the government might come after you. I'm not sure how you can navigate that in a way that isn't incredibly costly and time consuming. To be fair, part of the problem though has to do with the fact that the majority of our business models in any of these tech companies are data-based and so access to that, our ongoing access to that data by the company itself is critical to then be able to generate revenue in the future, right? In some way or fashion, either data mining and or selling that data or doing something else with it, right? So, you know, you can encrypt the data and put safe cards in place for encryption in transit and encryption at rest. We all remember what happened with, was it the Anthem, the big healthcare breach that took place? And what's gonna argue that they weren't HIPAA compliant and what's gonna argue that their systems weren't encrypted at rest and in transit and that they weren't applying appropriate levels of database encryption for bulk encryption. More than likely, you know, I'll bet everything I got to say that they probably did that part correctly. Someone was still at the break end because they still needed access to the data in a healthcare context or an insurance for a context that makes sense. For a lot of these companies out in the valley, the services they provide, except for the fact that they don't want to have to develop a more robust business model, they don't really need access to that data because they're not processing in any way that's gonna add value to you as an end user. It's about their business model and backend. So if instead, they were able to start moving away from that kind of, oh, we give everything away for free but we'll use you as our product on the backend, business model, we'd start to move much further into this realm of, actually, we don't want access to your data, we're getting encrypted in such a way that we can't data mine in the future and if we can't data mine it, we can't be subpoenaed for it, we can't be hacked for it. We can sort of move away from those problems. That requires a shift from the business model side. I think there is more diversity in the business model side. I mean, I do think this idea that, yes, all Silicon Valley startups are simply serving you very specific ads because they know everything about your life is prevalent and that's certainly kind of the narrative that reigns on the hill. But I mean, there are plenty of valid reasons to collect data and keep the data that maybe aren't critical to the company but it's like, yes, it's easier to verify your identity this way than this way and so maybe we decide that we wanna collect this one piece of data and set these three and maybe this one piece is more sensitive but it's easier and it's easier for the customer and it's easier for storage, which isn't to say that, yes, data minimization is great, making sure that companies don't keep or use stuff they don't need, totally makes sense. I just think it's hard to apply of one solution fits all here because every startup can be so different and their data infrastructure can be so different and their business model can be so different and what they need can be so different. So it's hard to say like, yes, everyone should just do this and it'd be fixed because it varies wildly, company to company. So I promised I would leave some time for questions, we have about 20 minutes left until four o'clock. Do we have a microphone to send or it is over there? If you can, just speak up and if you wanna, yeah, sorry, there you are, I'm sorry, I didn't see you, again, complete legs. I wanna note that in 1994 when we enacted Kalea which is the communications assistant for law enforcement officials, that was in response to the FBI worrying about new technical innovations thwarting their ability to access communications and if you look at that and compare that to Sam Bernardino, then there's certainly a progression where perhaps because Kalea was on publicly regulated entities, it was easier to pass but Sam Bernardino did not result in a new law being enacted and I'm wondering if you view that as a progression in the way the American society thinks about these issues or if that's just a lucky artifact of the times. And if I can add on whoever wants to answer that, is it because the FBI was able to use Celebrite successfully in that case that it obviated a need for new legislation too? I don't wanna piggyback too much, but. I think that's orthogonal because if it were a modern iPhone they wouldn't have been able to do that. That's true, right. You know, that's an excellent question. I don't have a good answer about why we're tracing Kalea through Sam Bernardino. I think obviously the issues are a lot more complex now. There is a greater proliferation of devices that I think back then it was, you were talking mostly landlines and I think we've moved quite far away from that. And so the issues are far more complex and I think they implicate a much larger amount of personal data and security. And so I think that certainly plays a big factor into why I think governments have been, have had a hard time approaching this issue. Hi, Sharon Bradford, Franklin with OTI here. So obviously companies like Apple have marketed your products based on strong encryption. It's very much a part of your marketing platform. But I'm curious, particularly for startups or others represented, maybe even in the financial world, to what extent do you see strong encryption and we protect your data as a part of a business strategy and a marketing campaign to consumers? We absolutely see that. I think for a lot of small companies, privacy and security measures are a comparative advantage and they can say, this isn't a hold up in the device space. I don't think that there are a ton of device startups that we work with. But certainly we have seen a lot of online platform competitors come in and say, or we're not gonna sell your data or we're not gonna mine your data or we're gonna make sure that you're not seeing ads that creep you out. We're gonna make sure that your data is protected. So it is absolutely, I think the more, there's like a virtuous cycle here where folks are more interested in being protected and so companies are more interested in providing protective technologies and so folks are more interested in being protected and it's kind of ratcheting up. Obviously, we're not in a perfect world yet and not everyone has secure messaging or secure emails or whatever it is, but I do think that there's kind of an upward trajectory for both. For us, it's absolutely critical to our entire business. Our business would not exist if we couldn't point to the fact that most of your online cloud-based collaboration capabilities leave you wholly vulnerable to both data mining, subpoenas that bypass your legal and or bulk hacks of those because they're becoming the highest ROI targets in the cloud, especially for critical infrastructure regulated industries, they're increasingly aware of that and so when we go and talk to them about the fact that our true end end encryption is user plus device specific and here are the nuances of what that enables. Here's how that allows you to be both a preserve user experience, if not improve user experience around security, while at the same time moving the security bar so much higher up the ladder that it becomes the compelling reason upon which our customers buy. If it wasn't for that security argument, we would have zero customers. If it wasn't for the failings of the other side of the house where they produce really cool technologies that work for other industries that don't necessarily that level of security, we wouldn't have something to benchmark against and say, ah, we can give you that level of cool capability set, but in such a way that you were still protected as an industry, that's our entire marketing campaign. Yeah, I would just jump on that. I would say that in our space, it's very important. We've all probably experienced data breaches. We've all experienced numerous kind of card reissues when there's a data breach that's out there. In the payment ecosystem, your only collectively is secure is the weakest link and so security, I think, is coming upon everyone in the chain to continue to sort of elevate their game when it comes to security. In terms of MasterCard, our transactional data is largely anonymized aggregate data. We collect four pieces of information when you use your MasterCard. The merchant's name, the total amount of the transaction, where the merchant's located, and your 16 digit account number to process the transaction. So none of that in some or in individual parts ties back to who you are, where you live, what you bought, how many items you bought. And so we as a practice, we only capture information in the minimum amount of information we need to make the card work, whether you're at a store or whether you're online. And so that's our practice and I think it's a deliberate practice. But yeah, security is always top of mind and I think increasingly, as we see more and more instances of hacks or data breaches, it becomes even more important. One of the things we're seeing in the startup space, especially in long health tech startups recently, is them wanting to say, hey, you know what, we recognize that we may not hold PII or PHI today, but two years from now we will. And so their DevOps Shatter Today is a roadmap into how do you break into their system two years down the road when they do have something of value. And suddenly we're seeing adoption take place in industries like that where they're starting to say, hey, we just actually start protecting our DevOps Shatter Today beyond just the critical systems that we may have to protect or minimize data on in the future, even for what we do have, otherwise we want to start protecting that as well. And so again, it's that security first marketing campaign has a role to play in a significant portion of the marketplace in the US, right? It's something like 30% of all workers actually work in highly regulated or critical infrastructure industries. And so there's a significant market to go after if you can put that security message forward first. I would just like to add that on the Android side. Also, you know, we've had full description with the file based encryption. We continuously adding new features and security related functionality, you know, leveraging more of the hardware, even the backups are using the screen hardware encryption in the cloud at this point. So I mean, I think encryption is table stakes everybody, right? So, I think this gentleman right here. Hi, I know a lot of you want to use the fact that you can provide at most security set up a marketing tool to create trust on all those things. So, I mean, that makes a lot of sense, but that does not mean all the meta information also have to be encrypted or protected. For example, you know, the data that passed through might be encrypted. How about, for example, for call, who called who? Or for example, in cell phone, the location, okay? So all those information you can still provide to law enforcement so that there'll be less need for providing backdoor for the thing that you could, you see what I'm saying? Essentially, you can still help some legal authorities with the other information, which I normally call meta information, that you're not obligated to protect, am I correct? So I think I can answer your question. I mean, Tim Cook has said that when we have information we do provide it to law enforcement pursuant to appropriate process. And I think we understand the importance of working with law enforcement. They've got an important job, and I think we are looking for ways to be good citizens. And so a couple months ago, we actually announced a couple or three new initiatives. A dedicated training team, we're gonna set up an online training tool for law enforcement and also a dedicated portal, which will help make it easier for law enforcement to make lawful requests. And so I agree with you. I mean, when there is data that's available pursuant to lawful process, we will share that, and I think we have a responsibility to do that. Okay, so that's what I'm saying. There's a lot of meta information, you're not legally promising, or you're not contractually promising to your client that they won't be released. If there is a court order, for example, where the client was when they were traveling. So it depends on, I think you're asking about what we contract with. I mean, so right, I mean, I think so it depends on the different services that people avail themselves of what data is available. We try to be very transparent about that. And we actually publish law enforcement guidance, which has kind of two purposes. One, it tells customers what data is available if they use certain services. And the other purpose is to help law enforcement understand how to go about requesting data that may be available. And so I think you raised an important point, and we certainly understand that we have a responsibility to work with law enforcement. Actually, right, yeah, next. Hi there. These days I've been hearing about the concept of side channel attacks, which are, to my limited understanding, attacks that can exfiltrate data based on electromagnetic consumption, audio power consumption, or other signals. If these types of attacks can exfiltrate data and bypass encryption, what are some of the security solutions that you're seeing especially in the areas of a critical infrastructure and finance to this type of attack, or is this just something that's largely theoretical and not happening very often? I could say from a mobile device perspective, that's one of the things I mentioned earlier. So with Android Pi, we release the ability to generate and store key material and tamper resistant discrete hardware, which is more impervious to these side channel attacks or timing attacks and so forth. So again, it falls upon the platform guys, the OS providers to make it easy for the app community to be able to leverage all this functionality to just further secure their data, right? Their application data on the device, or use that same storage for key material for data and transit as well. Hi, so the conversation earlier about fingerprint authentication reminded me of the fact that under the law with the warrant, the government can force you to open your phone with your fingerprint, but cannot force you to give them your password. And so along the lines of what we're just talking about, and I know it's a little bit of straight from what we're talking about, but I think it goes to the heart of sort of what's gonna happen going forward with tech and encryption and legal requirements. Did you think about that when you were deciding whether to implement that tech? Did you think about advising people? Because as we think about tailoring, you could actually tell people you're actually narrowing your constitutional ability to be compelled by law enforcement to give over information or not. And you can sort of tailor your own comfort level of both of those things by choosing this form of authentication versus that form of authentication. And does that tell us something or do you have an overarching view towards what your company's interests are in protecting this information? In other words, do you have any interests? Are you interested in helping people avoid unwillingly being compelled to give their information to government? Or does that interest only come into play when it represents the cyber insecurity more broadly? So I think we don't make security upgrades to frustrated law enforcement, we just don't do that. When we find that there are weaknesses that are being exploited, it's our responsibility to the customer to patch those and to upgrade them. So I think when we were looking at things like touch ID and face ID, we're looking at the security benefits. We're not doing an analysis on kind of the constitutional trade-offs that those may implicate in kind of, in edge cases. I think we're looking at getting our users from 40% who are putting any type of passcode security to 90% and over. And so that's just for us. I don't know if you want to speak to that as well. I'll say from the Android side, with biometrics introduced, we do give the user the ability to, of course, it's up to the user whether they want to use it or not. And there's also a feature where if they want to temporarily clear biometrics, they can do that. And one of the things that we try to do is, you know, being an open source platform, we kind of try to really be transparent about what features we implement, how they work. So I think we talked about this feature at IO. We published a blog post about it. It's been picked up by the media. You know, maybe we could do a better job of creating FAQs about it as well, but it's something that is available for users. That's a good point. The same functionality with the ability to take advantage of these technologies or not. Yeah, very back. Yeah. Feel quick, Sharon, about that voice of a moderate. I was asked recently to go to a conference and ask questions about Afghanistan and taxpayer spending. And I was told to get the iWatch 4 and the new iPhone before I started asking questions about the issue. And I wanted to ask about the security because I know that the authorities are content of the SOS feature. So you obviously interacted with them when you came to the safety or the security controls. Or I guess it calls 911, my watch if I fall. So you did work, I guess, harmoniously with law enforcement in these devices. Can you talk about that and how you created this SOS function? So unfortunately, my expertise is not on the SOS function. But I mean, essentially 911 is a fairly well-known and public number and getting the device to make that call under certain circumstances. It doesn't require us to work secretly with any government agency or law enforcement. So well, good, good. I hope you don't need it. But it's no, so I mean, I think that's probably the best answer I have for your question. Just one more question, gentlemen, here in the back. Thank you. There was some discussion about possible response if the US considered some kind of legislation to pry open cryptographic features. Does anybody in the panel know what happened in the UK when that was passed and what the discussion is in Australia and why it would necessarily be different in the United States, especially in the wake of a possible terrorist incident or criminal incident? Happy to take it. I think what we've seen in the UK and what the debate right now in Australia is that they were enacting laws to get to the starting point, to give themselves the authority to compel providers to take actions that, in our opinion, could undermine the security of our users. We have not, at least from Apple's perspective, we have not seen in the UK an attempt to enforce that and actually to compel Apple to make changes to the product that we can use security. And so I think it's still very much a concern, as we've said publicly in Australia, that we think it's ill-advised to enact these kind of sweeping surveillance statutes that could be used in a number of different concerning ways. But I don't know when we will face that make or break decision where the government actually moves to compel us to make changes to our product in the UK or in Australia. We did see that, obviously, previously here. And we argued successfully that it was inappropriate of the government to require us to make changes to our products that would undermine user security. Well, I think that's about all the time we have. I just wanted to say thank you to the panelists and for everyone showing up and asking questions. So thank you. And we're very happy and honored to be able to welcome today Congressman Hines. Congressman Hines has been, and we can take seats. I'm terribly awkward with introductions. Congressman Hines has been representing Connecticut's fourth district for the last decade. He spent eight years on the House Permanent Select Committee on Intelligence in the last four years as ranking member of the NSA and Cyber Security Subcommittee on that committee. So thank you so much for joining us today. Thank you. We're so pleased to have you. And so I imagine in eight years on the House Intelligence Committee, you've seen quite a lot among those things that you've seen has been an increased focus on cybersecurity. Every year, the intelligence community provides a worldwide threat assessment. And cybersecurity seems to inch higher and higher each year. Can you talk a little bit about the intersection of cybersecurity and national security and sort of where you're coming from with that and what worries you? Sure, sure. And thank you. Thanks for the opportunity. New America for pulling this together. And we'll have a chat. And if we have time, happy to take questions from the crew here. Yeah, so coincidentally, the 10 years I've been doing this corresponds pretty closely to really a very substantial shift in thinking within the federal government around cybersecurity. So I think I've actually only been on the Intelligence Committee for six years. But I was on the Homeland Security Committee prior to that. And when I was a freshman, senior people in government were just beginning to cotton on to the threat associated with cybersecurity to the government, to the, obviously, the national security agencies of the world, all the letter agencies. But when I arrived 10 years ago, there was just not a high level of understanding, a high level of commitment to really hardening the federal government's systems and data storage. That changed pretty dramatically in that 10-year period, whereas you say the heads of all of the security agencies now always emphasize this as something really important to the federal government, but obviously as a real vulnerability to the country. And there's been a concomitant uptick in resources devoted. Now there are no heads of agencies who I don't think, like in the private sector, don't worry about this issue. And of course, we get the fairly discouraging but regular drumbeat of data walking out of our most secure facilities, whether it's CIA or NSA. And so there is a very high level of urgency around this. Coincidentally, I went on the Intelligence Committee literally three weeks before Snowden did his thing. And so here I am sort of just trying to figure out what NSA stands for. And all of a sudden, the world is on fire. And again, discouragingly, we've really seen that while I think the intelligence apparatus is a lot more focused on this than they used to be. They have come to realize that data protection is a really hard problem to solve. And sadly, I don't think they've fully solved it. Yeah, so and I think one of the things that we've been discussing a lot throughout the event today is how encryption is really one of the best tools that we have to protect data. So much so that in previous years, former Secretary of Defense Ash Carter, former NSA director Admiral Rogers, and even more recently, William Evanina, who's the current director of the National Counterintelligence and Security Center, have raised real concerns about the prospect of an exceptional access mechanism and encryption backdoor in technologies. Can you talk a little bit about what concerns there are with national security when it comes to introducing an encryption backdoor? Well, let's start with what I can tell you with some certainty, which is that right now, there's really not much legislative momentum to speak of around the idea of a backdoor. Yes, Senator Feinstein and Senator Burr, I think, have not given up on their efforts now over a couple of years. But even if they come out with something that they call a bill, I think it probably has difficulty getting any traction whatsoever. And that, of course, reflects the substantive concerns around privacy, first and foremost. The left and the right often meet on privacy issues. You saw this with the section 215 and the 702 debates. But there's also, I think, a growing realization that if you deliberately create vulnerabilities, nobody is safe. And not just the good guys, but the bad guys can, who in many instances are less constrained and as talented as the good guys, could exploit those vulnerabilities. And, of course, the reason you hear and Admiral Rogers take the approach that he did is that while there's a limit to how far this discussion can go, it will not surprise you to know that not all of the government's sensitive data and not all of the government's sensitive transmissions occur over proprietary networks or hardened networks, right? We rely on encryption to keep our very sensitive national security information safe. And so if you're an Admiral Rogers, you both appreciate the need, the absolute life or death need to keep secrets within the government through strong encryption. You also, perhaps even more than somebody like Jim Comey, appreciate the offensive capabilities that we have and that we want. And so you're gonna have a slightly different perspective than if you're a Jim Comey who really wants to break into that iPhone in San Bernardino. Yeah, well, and so I think this brings us to some previous statements that you've made about encryption. The idea that encryption is a fact of life, which is I think something that the FBI and other state and local law enforcement have run into and seek solutions for, but at the same time you've said that it's not a problem that's gonna go away simply because Congress passes a bill. Can you, what is your perspective on that? Is this because encryption has gone so global and it's just available to anyone who can access the internet? Where are you coming from when you think about that? Yeah, so again, I don't think there's much danger that Congress is just going to pass a bill and most of that resistance to the idea, any sort of extraordinary access or backdoor is probably driven by privacy concerns and deeply felt privacy concerns on both left and right. The idea that there should be a deliberate vulnerability so that only the good guys can get into my medical records is just that doesn't sit well with most. And I think as time goes by, it sits well with fewer people. Now, this is a representative body I serve in, right? I mean, emotions matter. So if all of a sudden there is a San Bernardino times 100, you saw what happened with the Patriot Act after 9-11, all of a sudden all bets are off. So again, if you saw an event where the FBI could credibly claim it might have been preventable, which I think they've had a hard time claiming to date, sentiment could change and your representative sentiment could change as well. But so right now there's really not much appetite for anything along those lines but then you get into the sort of more technical concerns that people can intuitively understand. Again, if you legally require American technology companies to provide extraordinary access to the US government, well what about the Chinese government? This is the classic problem of who's the good guy that has extraordinary access. I'm pretty sure that's not a position that any of the technology companies want to be put in. It's a no win for them as Google and others will tell you as they try to do business in China specifically. And then again, we've alluded to this. If the vulnerability is there, the bad guys are also pretty good at what they do and that just I think makes people nervous. Then there's a legal question too. I mean, this came up with Apple in the San Bernardino case. It would be a fairly novel thing legally as Apple argued in San Bernardino to actually require for the government to require the construction of a product that was deliberately designed to pick a lock if you will. That's certainly not where Kalea is and it's kind of a novel legal concept. And so I think you'd have a real struggle with that as a concept too for the lawyers to work out and I'm not quite, I'm not a lawyer and I'm certainly not an expert on Fourth Amendment law but that's a novel concept that the government can command somebody to affirmatively build a product that not only serves the government needs but arguably damages the strength and marketability of the company's other product. So there's a lot of, again, you intuitively understand in the San Bernardino situation although again, that was a post facto rather than pre-event situation. You understand the sentiment but I think when you really get into the guts of either the technology, the operational questions or the law, it becomes very, very complicated. And so when we think about the law in the US it doesn't seem like there's a lot of momentum. I think one of the things that we are facing internationally is that you have countries like Australia and the UK that are starting to think through legislation in the case of the UK, the Investigatory Powers Act has already passed and so there's a question about how that gets implemented. In the case of Australia there is a bill that literally this week is being considered that could be interpreted if interpreted aggressively by their governments to allow for those respective governments to compel US tech companies to build their products in certain ways. Do you worry about the effect this could have on US and global cyber security? What is the kind of interplay that the international encryption debate has with this debate here in the US? Yeah, it's a great question and I've represented as of industry here. Australia is scary, in some ways China is scary, right? I mean just the two or three orders of magnitude different market sizes. And of course you've got a spectrum of cultures around privacy. The UK has never been particularly aggressive on the privacy of its citizens. Germany I would argue is on the other end of the spectrum. They're pretty sensitive about anything that gives the government access to citizens' private information. So I guess that is what it is. There are market forces, China will do what they do. It will be very uncomfortable. I know it is uncomfortable for the tech companies. Australia probably a little less so. But at the end of the day again, the reason I feel like this is a little bit of a silly debate, how are you going to keep, let's just use an example, how are you gonna keep an Australian citizen from using WhatsApp? I mean I assume there's probably some technical way to do that, there's probably a workaround to that technical way of doing that. So you get into a world where, and I'm not expert in what Australia is talking about, but there's probably a world where, in some ways it's a scarier world because if Australia somehow succeeds in ending strong encryption in Australia, two groups of people are still gonna use strong encryption in Australia. One is gonna be the sort of hardcore privacy people. The other people are gonna be the bad guys. And so again, I just, I sort of wish we could move beyond this idea of backdoors and you should have Senator Feinstein here to articulate the opposing point of view because I've got a, not a universally held point of view. But let's ask our law enforcement and intelligence agencies to do what they get paid billions and billions, or use their billions and billions of dollars of resources to keep up with the technology, not to try to stop it. I just, historically speaking, trying to stop technology is always a losing bet. So I want the NSA, by the way, I'm sure this is not a universally held sentiment in this room, but I want the NSA to really think hard about how to crack encryption because I want them to do that. But that doesn't necessarily mean the answer of course is to create a technical vulnerability. Yeah, so I think we definitely agree with you on that. And it's certainly not a universally held point of view, but I do think that the debate increasingly moves toward how much information is protected by encryption, how many different types of people need it. Earlier at this event, we had folks from human rights activists, journalists, representative from the national network to end domestic violence, talking about how critical encryption is to protecting all of their different constituencies. In addition to that, I think one of the things that we've seen that relates to the importance of encryption from a national security perspective is how much data is at risk now in our elections. You're about to assume the chairmanship of the NSA and Cybersecurity Subcommittee, I imagine, that the Intelligence Committee in general and your subcommittee in particular will be very focused on meddling by foreign nations in our elections and disinformation and things like that. Can you talk about the role that encryption may play in protecting our elections going forward? At one level, that's an easy question to answer in the sense that technologically speaking, we kind of know what the standard should be for our election systems. They're highly distributed, that's a good thing. There's still 12 or 13 states that don't have paper backup for optical readers. That's a bad thing. They should change that. You heard enough about these machines breaking down that you sort of think to yourself, gosh, they should make better machines. And stuff like voter registration records should be protected and encrypted. That's not hard to say. The harder part of this problem, which is a bit beyond the scope of this conversation, is that to meddle in an election, the dumb way to do that is part of the way that Russians did it. It's dumb to break into the DNC and try to, or John Podesta's email. You're gonna get caught. We're gonna see it. You'll get caught. The smart way to do it is the other thing they did, of course, which was to try to use our very open media environment, our social media environment to pull at threads and try to widen rifts and throw racist red meters right out there and find those cracks in the American body politic and aggravate those cracks. That's a much harder problem to solve because we have a free society in which people can say what they want. So, again, at some level, it's a pretty easy answer. Our electoral apparatus ought to be strong. But the more pernicious stuff is really when somebody decides they have an interest in really lighting fires under a particularly targeted population or something by playing to their prejudices or angers or grievances. Yeah. So, and I think one of the things that, hopefully, people will take account of going forward is the importance of security mechanisms, like encryption, like multi-factor authentication in order to protect against those kinds of attacks. So, you don't get the data that underlies all the thread pulling, right? You don't have those emails to use as ammunition in our electoral processes. So, I think I'm just gonna ask one last question before we kick it to the audience, for some audience, Q&A. But that is just generally when you're looking at the next Congress and many of the issues that you're gonna undertake and conduct oversight of, and it sort of goes beyond encryption, but what do you anticipate being the priorities as you go forward in the next Congress and your subcommittee, but in the House Intelligence Committee more generally as well? I would, some of the, a lot of the tough issues got resolved in the last couple of years to some people's satisfaction, actually to my satisfaction, I like on a lot of things I tend to be in sort of a pragmatic, fairly moderate place on this stuff. I thought the USA Freedom Act was a good compromise. I mean, I'm glad the NSA is not storing our metadata anymore. You know, I'm glad that they'll have access to it through a warrant-like process to the providers. 702, again, I was more or less happy with the way that came out. It wasn't perfect, but good, we're sort of past that, those big issues, which were hard because like on a lot of issues, the American public doesn't spend a lot of time getting into the intricacies of 702. And so people have very strong emotions that are often based on imperfect understandings of what's really going on. By the way, that's true members of Congress too, but that is what it is. So I think some of the hard stuff has been dealt with. I would say that, you know, we're gonna continue to invest in our agencies in ways that will make them incrementally better around attacking other people's networks. A lot of us, most of us, all of us, will continue to work hard to make sure that that technology does not get turned on to the American people and is used carefully internationally. That's a big deal. There are some really interesting things out there technologically like AI, like quantum computing that could sort of change the environment in fundamental ways that may require kind of a rethink. And of course there's always the possibility of another, as I said, sort of San Bernardino times 10, so that it spends, you know, 10 weeks in the public imagination rather than two weeks that could change the weather around these questions. But I do think for the Democratic majority in the House election security will be much more of a priority. My Republican friends were a little constrained from really going hard on election security because it pointed uncomfortably at the whole question of why and did Russia help Donald Trump? And so they were a little bit constrained by that. We're not constrained by that. So I do think we'll be much more aggressive in the area of election security. It'll be interesting to watch this debate. I don't know who's here from the social media organizations, but there's gonna be continued pressure on the technology on Twitter, on Facebook, on the platforms, to police themselves that candidly will be uncomfortable. I've struggled personally, again a little scope, a little beyond the scope of the conversation, but, you know, Alex Jones, who's this monster who denies that Sandy Hook happened, my house is 25 miles from Sandy Hook Elementary School. I mean, nobody gets angrier at what Alex Jones says than I do. But I watch with some discomfort the position that Twitter is put in, you know, you got to take them off the platform. And my discomfort stems from, I sure don't want the government controlling the information I have access to, and even less do I want Jack and his buddies controlling, so you see my problem here, you know? And I don't have a good answer for that. I sort of do. It's not one that's satisfying to my constituents. You know, hey, you're citizens of the United States, right, that comes with some responsibilities, including being a good and thoughtful and critical consumer of information. You know, please God, don't look to the government or to Jack or to Mark to curate the information you get. Now, there's a line, right? You know, I don't, you know, incitements to violence, et cetera, but that's going to continue to be a debate that'll probably be uncomfortable for the tech industry, and even for those of us who would like to see more of the solution lie on the shoulders of American citizens to be critical consumers of information as opposed to being protected from stuff that's uncomfortable. Yeah, I think that's really important. And I think we've got an audience who's eager to ask questions, so I'll open it up to you in the middle of the room. And if you could just state your name and your affiliation, and instead of offering statements, be sure to ask questions. I will offer a statement, no, I'm kidding, I'm not. I'm Justin Lynch, I'm a journalist with Defense News and the Military Times, and I'm also a fellow at New America. Congressman, thanks for coming. In the Trump Administration Cyber Security Act, it's a strategy that was released three months ago. It talked about, and I quote, modernizing electronic surveillance and computer crime laws, and it talked about working with Congress to do that. I'm wondering if they discuss this with you, if you kind of know what they're talking about, if you ever need to update what they mean by modernizing electronic surveillance and computer crime laws. Thank you. I don't know what they mean by that and that has not been an area of particular engagement with the Congress. Sadly, my committee, those kinds of questions would live probably primarily in the Judiciary Committee but to some extent in the Intelligence Committee. My committee sadly spent the last two years under the soon to be ex-chairman, trying to find exculpatory and confusing data around the President. So we were sort of out of the game on a lot of this stuff. But no, to answer your question directly, no, I don't know what they mean. I can imagine what I, let me tell you what I hope they mean. There's lawyers in the room who understand this a lot better than I do, but we have a bizarre patchwork of privacy protections and that should be modernized and reformed. I mean, as you know, an awful lot of the law is built up around the old twisted pair, wire line technology that doesn't really work for the IP world. Somebody smart, which probably rules out much of Congress, but somebody smart needs to think about the fact that we wanna treat information in a more uniform way with respect to privacy as opposed to what kind of wire it happens to travel over. And so, there's relics. Turns out, I'll get this wrong, but emails that have been held for 60 days, 100 days, all of a sudden they're subject to less fourth amendment protection and emails held 99 days, why? And so I do think, again, I'm not answering your question because I don't know the answer to your question, but I do think that there is a lot of room to be a lot more thoughtful about how we protect data that is not based on the technology over which it travels, but it's just based on it being, you know, my medical records versus my shoe preferences. To me, that feels like a more logical way to think about what kind of protection should be afforded rather than is it in an IP world or a twisted pair world? Hi, Congressman, I'm Alan Wheeler with the Cherdoff Group. My question is basically about your thinking on the sort of vulnerability equities debate. And as you alluded to, the NSA needs to have vulnerabilities or looking for vulnerabilities in platforms, encryption, in order to sort of do their work. But as we sort of discovered somewhat recently, the NSA doesn't necessarily keep a hold of all their tools as well as they perhaps should, which is led to some of the industry to sort of talk about or call for some level of those vulnerabilities, some level of knowledge sharing there. And I was sort of curious as to what your thoughts were on sort of the balancing act there and sort of the correct approach and if there needs to be sort of a more codified standard, but obviously acknowledging the limitations of sort of intelligence conversations. Thanks. Yeah, yeah, great question. And I'm not sure I have the right answer. When NSA discovers a flaw in somebody's operating system, do they keep it and exploit it or do they let people know? Industry will always be on one side of that and the security apparatus will probably always be on the other. Given the nature of my job and appreciation for the things that really help us in our national security, I probably have a bias towards, let's have those guys up at Fort Mead really working hard to find the vulnerabilities. And then when there is a sense that it's no longer a particularly valuable tool, let's share it in such a way that fixes it. And it is kind of a Machiavellian way to think about it, but we happen to be better at this stuff than most people, so that works if you're better than others at it. That's not necessarily an ethical structure, but it's a practical structure if your job is to keep people safe. So I would probably have a bias in that direction. I also think it's incumbent on organizations like the NSA to keep policy makers like me and folks within the executive and elsewhere really up to date on advances in this area. And when I say in this area, I don't just mean breaking into networks and code breaking, but in much more broadly speaking, technology that could revolutionize the field. I talked about AI and quantum computing earlier. Those two things feel to me like they might be, this is I'm sure a tired metaphor, but they might be akin to nuclear weapons in the sense that they change the way you think about security and encryption. So again, I wish I knew what exactly the right answer is. I probably have a bias towards making sure that they find those vulnerabilities and exploit them right up to the time that it is no longer a proprietary advantage for the country and it's national security to do so. I think we have time for one or two more questions. Hi there. I'm Sean Lingus with Cyberscoup, a reporter with Cyberscoup. Thanks for being here, Congressman. I'm wondering how with the new Congress, how you might set the tone in terms of cyber security, sort of at least policy signals, specifically around encryption. You might have seen that the, I mean the so-called crypto wars, the discussion over whether law enforcement should have backdoor access was kind of renewed when the US and the Five Eyes partners released a statement a few months ago expressing concern about the proliferation of encryption. Given those signals from the administration, I'm wondering if Congress sees a need to step in and at least put some legislation out there, have a conversation about the importance of encryption and that sort of thing. Thank you. What kind of legislation are you alluding to? Well, there's been legislation in the past. I mean, Representative Liu has put out a bill kind of preempting states from tackling this issue when in policy ideas in that realm. Anything that sort of affirms the positive value of encryption given that there haven't sort of mixed signals from administration stretching back years from both parties. Yeah, I'd be surprised if you saw legislation per se, you know, advancing the cause of encryption. I think rather there will be a sea change in the house. You know, Jerry Nadler is a very different guy than his Republican counterpart. Adam Schiff is a very different guy than Devin Nunes. Both of them are your sort of classic left-leaning liberals who will be much more concerned with privacy protections, I think, than their Republican counterparts were. That doesn't necessarily mean that legislation will move. I do think it means that it is that much less likely that a Feinstein Burr effort is gonna gather any momentum at all. I do think this is something of personal interest to me. I do think there will be a renewed emphasis on trying to jumpstart the establishment of international norms in whatever form that might take. That is not something that's been prioritized by the White House or the Republicans. So I do think that a lot of us will be very interested in saying, hey, there are common interests between us and our worst adversaries whoever you wanna put in that blank, the Iranians. We all have an interest in going after rogues, non-state actors who have offensive capabilities, just to name one area of common interest. So I think it's gonna be more a defensive play against the whole concept of access and a higher premium put on privacy concerns and probably an emphasis on working with the world to come up with a better set of articulated norms around cybersecurity. One last question. Yes, in the back. Hello, I have a question about, this is mostly about digital security. What about health security? Is there an overlap? Like 25% of the economy is healthcare and there's gonna be a lot more telehealth. You think there's a way to get a public option in there and maybe use some of the money for, encryption, upgrades as well as health insurance upgrades. Just wanna snuck in an undermain question. Let me address that very quickly. So here's my best guess on healthcare. You're gonna see a major effort to shore up the Affordable Care Act. You're gonna hear a lot of talk about a public option and an optional buy-in to Medicare. The single payer, the Medicare for all is a little bit contentious within the Democratic Caucus so I don't think that's gonna come steaming right out of the gate. I am pretty sure that getting healthcare right, at least in the near term, is not gonna generate revenue. It's gonna, having lived through the Affordable Care Act wars, it's going to require more money to better cover more people so I don't see that as a likely revenue source. There is a tangentially related really important thing which is the protection of our healthcare records, particularly in this day and age of just remarkable ability to read the genome, to predict diseases that individuals might be susceptible to. I mean HIPAA was always critical in this world where the genome may tell us a lot more about ourselves than we can even imagine. I think we really need to be focused on, I mean everybody focuses on their credit cards and that's good but I don't know about you guys but as interested as I am, I have not done 23 in me because I just, to me, that feels like information that is at the very core of our privacy interests and it probably would be well worthwhile our taking another look at compliance and security around our medical records. Yeah and for what it's worth, I haven't done 23 in me either for that exact reason and I do think this ends on a really good note which is when you think of the kinds of information that we're protecting with encryption, our healthcare records, our times DNA records, our familial trees, this can be some of the most personal information to us and I think encryption is a critical tool to protecting those data just as it is to protecting our communications, trade secrets information and information that's absolutely essential to national security and to the agencies that you oversee in your role in the House Intelligence Committee. So thank you so much for taking the time to speak with us today. We really appreciate you coming out here and having this conversation with us. Thank you. Thank you so much. Thank you very much. Thank you so much. And I just invite you to go out and enjoy your phone at the atrium. Thank you everyone for coming.