I'd like to introduce you our next speaker. She's a teacher of, she teaches developers about application security. She has learned over 20 programming languages. I told her like, she's like a developer polyglot, right? She is a founder of GoldHead Security and now teaches Upsack full time. And she's going to talk about vulnerabilities that hide from your tools. Give a round of applause to Jillian Redleaf. Hi, can you guys hear me? Okay, is this one on? Okay, good. I don't see a volume button, but you can hear me okay in the back. Alright, well thanks for coming. I'm really excited that you're here. And I'm also feeling a little vulnerable along the lines of the talk. So this is my first time speaking in DEF CON and I'm a little nervous, but I'm here to help you and help hopefully make your jobs easier. So thanks for coming. I'm going to start out with, oh, I introduced myself first. I'm going to start out with me. This is a friend of mine that I made in Bali and me, a baby elephant. I started my own company this year because I wanted to teach full time. So I teach application security to developers. And I have over a decade of AppSec experience now. Just by a little bit. And I love to travel and tell jokes. They are not always good jokes, but I will tell them anyway. So nobody brought tomatoes, I'm sure. So I'll give it a try. So first, sorry. Alright, just a quick history lesson. So we know kind of the history of where the tools that we used today came from. So back before I was born, there was the very first static analysis tool called Lint. Now Lint was basically a syntax checker, right? So it didn't check for any security vulnerabilities like SQL injection or cross-site scripting because they didn't exist yet. So they came into existence in the late 90s. And then we started to have some dynamic testing tools. So Nessus came into existence. And I don't know if any of you remember back in the day when you had to use a modem to get connected to the internet. Back then, websites were just pretty much static HTML. And then along came this little site called MySpace. Now for those of you who are kids in this room, MySpace was like Facebook only before Facebook. And it had all these fun features where you could customize your background and put custom JavaScript code if you are the loneliest person in the world to write a worm, make everybody your friend. So this, I'm not blaming MySpace for the state of web application security today, but I did notice there is a proliferation of security tools that came up after this point in time. So we've got Coverity, Fortify, Metasploit, one of my favorites, Burpsuite, another favorite. And then we have open source tools coming into existence to check to make sure that your dependencies are not vulnerable. So things like Blackduck. One note about this, most of the open source tools that you're going to use to scan your open source code are only going to find known vulnerabilities. They don't necessarily find the zero days. So just word of warning there. And then that's more tools, ecunetics, checkmarks, and veracode are sponsors. Made sure I got them on the slide. OASP-Zap came into existence. WhiteSource, another sponsor, thank you. And Snick, I may be saying that wrong. That's one of those things I've never heard said out loud. But also of note, and I'm not going to talk a lot about this because I haven't actually used these tools, but there is in recent years something called I asked. The I stands for interactive. So it's interactive application security testing. It's another option. Since I have not actually used them myself, I can't speak to it much. And when I googled I asked tools, Google was like, did you mean sast? No, I did not. But thank you for the condescending suggestion. So anyway, so a brief history. Now moving right along, I have a Venn diagram for you because I love Venn diagrams. So there's what they're good at finding. And I have some sast and dast vulnerabilities. So they're both pretty good at finding the OASP top 10. And I like to remind people that it is the top 10. It's not all of the vulnerabilities, just the top ones. So things like PCI compliance. Anybody deals with PCI at work? Yeah, so there's more than 10 vulnerabilities is what I'm saying. So sast tools are somewhat good at finding weak crypto. And I have an asterisk there because it's sort of like, they look for the really obvious things. So are you using DES in your code? It's going to kick out an error message that you're using DES. But it's not going to find implementation flaws. And there was a pretty good talk earlier, which talked a lot about that. So watch the recording or some of you were here. They're pretty good at finding hard coded passwords or keys or things like that because you're scanning the source code. Things like memory leaks that might cause a denial of service. And then dynamic application security testing tools. Find things like poor session management. Missing security headers. Default passwords. And insecure server configurations. So there's a little bit of overlap, but obviously it's good to use both, right? Now you're all here to hear about what they're not good at finding, right? And I have a whole list, not a complete list, but some highlights for you. The first one is business logic flaws. And this can be all sorts of different things. My favorite example though is just a poor password reset logic. So personally I have a grudge against cognitive questions.  That sort of thing. So weak password reset functionality is something that your tools just aren't going to find, right? And many other things. You could have, if your process for the call center to identify a customer is weak, then they might be vulnerable to social engineering. Things like that you want to keep in mind. So weak or reused passwords. Now fun fact, 75% of internet users admit to reusing passwords across multiple accounts. Now the other 25% don't admit to it, right? So password reuse is a huge problem and that's not something that any one of your tools is going to find, but with all the data breaches lately, credential stuffing is a thing and something that you need to be concerned about. So just keep that in mind. Next up, configuration whoopsies. There was a very recent data breach in the news in the last week or so that was caused by a web application firewall having too high of permissions. Now I don't know of any tool that's going to find that. It might be out there, but that's one of those things that it was just not using the principle of least privilege that led to a huge data breach.  I have more, okay. Next up, denial of service vulnerabilities. Now with an asterisk. So there are some denial of service type of vulnerabilities that your static analysis and dynamic analysis tools will find. Dynamic analysis tools tend to find them accidentally. Has anybody experienced that? You run a scan and denial of service, yeah. So, but that's not maybe the best methodology for finding these things. So there's all sorts of things that can go wrong. For example, if you have a developer that wrote a very poor SQL query that takes like 17 seconds to run, that's going to bring down your SQL server eventually and then with repeated requests. So anytime you have a server response that takes too long and you can send repeated requests, you can bring down the SQL server and then anything tied to that SQL server will also come down. So that's not something that any tool is going to find, but if you have a good DBA to review all the SQL queries, that will help tremendously. Rogue developers is another one that keeps me awake at night. So, let's see. Oh, so something that you want to consider is that insider threats may actually be coming from nation-state actors. So a lot of times we think about Rogue developers and, oh, well, they're just mad at the company, right? But in fact, if you have a big enough company with valuable enough data, there might be somebody with a Russian accent that applies for a job, say. Not going to pick on the Russians, right? Because I don't want to get hacked. So if there's any Russians in here, you're great, I promise. Okay, anyway. So next up, cryptography disasters. So a very good talk about that earlier. There's so many things that can go wrong with cryptography. So if you're not comfortable with cryptography, you definitely want to have somebody help you out with that. But basically, never write your own crypto. That is rule number one of Crypto Club is never write your own crypto. And rule number two of Crypto Club is never write your own crypto. And even if you're using a standard encryption algorithm, like AES, if you use ECB mode, for example, then your crypto is insecure. So lots of things can go wrong there. Tools may or may not necessarily find them, right? And then good old layer eight vulnerabilities. Things like phishing, social engineering, or your standard ID10T, or... These are all things that are very much... They can affect the application security of... They can affect the security of your application. That's what I was trying to say. So just lots of things can go wrong there. And then secrets stored in weird places. So my favorite and most trendy example of this lately is a JWT payload. So you have a JWT, a JSON web token, and perhaps you have a developer that sees it in the developer tools, oh look, it's obfuscated, it must be encrypted. It's not, it's base64 encoded, and anything you put in there should not be a secret. So that is something that just have to do some manual testing to find, I guess. Things like text files. So I have seen a text file with usernames and passwords in it that was publicly available on the internet. Not great. Config files, sticky notes, still happens, et cetera. So false negatives, when your code is written in other spoken languages. So this is something that may not seem obvious to most, but for static code analysis tools, some of the rules will look for variable names. So if you are looking for, say, a variable called password, but your coder is speaking Spanish, then it's not going to find that. So that's something that I've actually had happen a lot. So you get the scan results back in, and it says all these, it's highlighting all of these password variables. What do I need to do? Should I change the variable name? So you know, you should remove the password from your code. So, sensitive information and error messages, it's fairly self-explanatory. I don't have an example for that. You know what that means. So insecure APIs, there's still a lot that can go wrong with writing a new API. So it's most of the dynamic application security testing tools have a harder time testing APIs without complete documentation. So you can't just spider an API and figure out everything that's there. And even though we've taught developers to tell people, oh, username and password. So when you have an invalid password, you give them an error message back, invalid username or password. So that's pretty standard practice nowadays. But let's say you write an API that checks if a username is taken. So now all of a sudden, the attackers are able to enumerate usernames. So it's a way around that. It was just a very simple example I had. But next up, third-party integration flaws. So let's say, for example, you are integrating with an identity provider. And the identity provider is configured to allow for open redirects. So what can happen in that case is an attacker can use phishing to have a user enter the username and password on the valid identity provider site, and then it redirects to the malicious site with a token, a valid token. So open redirects are dangerous there. There's many other things that can go wrong. Grab a drink of water, hold on. You with me so far? Everybody still awake? Okay. So how to find them? There's the hard way, which I'm sure most of you are very familiar with by now. So, AppSecPin testing, or just eyeballs on code, code review. And I had a very hard time finding a GIF that would appropriately represent code review. I hope you like this one. I spent a long time just reviewing code, and that was my face most of the time. But I have some suggestions to make your life easier. So the easier way, I call this the Lord Varys approach. Now, for those of you who have not seen Game of Thrones, it's okay, I will explain. So Lord Varys was the master of information in Westeros, and his technique for gathering information was he had all of these spies around the city and around the country, really, that were children. Now, I'm not advocating for child labor. Please don't do that. But what you should do is just use the same approach to gather information within your own organization. So you can have an internal bug bounty, and even if you're not ready for an external bug bounty, you can reward your employees to come to you with vulnerabilities. So the idea here is just to make it as painless as possible to report security vulnerabilities to the security team. Now, a lot of us maybe have a reputation for being difficult to work with, highly opinionated. It's okay, it comes with knowing what you're talking about. But just the point here is that you want to reward people for coming to you and give them props. So, yeah. It's my favorite method for gathering information. No child labor, though, right? Okay. Next up is threat modeling, and I'm not going to break down threat modeling because there is another talk tomorrow that you can come and see at 1330. So highly recommend coming to see the introduction to threat modeling, but for those of you that are in here, I'm going to assume that you're already familiar with the process, right?  I hope. So, when you're doing threat modeling and you gather everybody in a room, say, and you're asking questions about the architecture diagram, and it's like this and that, this will change your life. The art of asking an open-ended question, okay? So, it's a very simple tweak, but it'll make a huge difference. So, instead of is this connection encrypted? Every developer you talk to is going to say yes to that question. Of course it is. Everything's encrypted. So, instead, ask how is this encrypted and where do you store the encryption key? And if they don't immediately know the answer to that, then that's something that you want to dig deeper into, right? So, that's my big tip for threat modeling. So, there's stride and dread and all the other things that spell six letter words. But, this is what you really want to master. I have another example for you. So, instead of, do you have any sensitive data in this database? You ask, well, what kind of data is in this database? And then they have to answer this question, and sometimes developers may not know what's sensitive and what is, what's not. So, instead of asking them to decide, just give them, just get the schema and review it yourself. That's probably the best method. So, I have another tip. Just the, what I call the full circle development life cycle. So, using feedback from all of these methods. So, you have your tools and you've got pen testing and threat modeling and code review and maybe an internal bug bounty. So, what you want to do is you want to find the bugs. And I know how many of you have experienced a situation where you stop there. And that's the only step. It's just finding the bugs. One person admits to it. You're brave, sir. Thank you. So, the next step is to fix the bug. Right? Seems obvious. Doesn't always happen. And then, what you want to do from there is just integrate that back into your automated test. Right? So, write a new test case that has to do with that particular vulnerability. And then, you write some new code or the developers do. You deploy the new code and you find new bugs. Rents and repeat. So, and then preventative care, of course. Just preventing vulnerabilities from getting there in the first place. Now, there's a few things that you can do. The number one is education. So, that's why I love that you asked that question. How many of you are training your developers? So, it's a really important thing to do. That's why I do it. I'm very passionate. I might be a little bit biased, but I really think that if you train your developers in security, then they're going to have the knowledge to just keep from, you know, writing the vulnerabilities in the code in the first place. And let's see. So, the next recommendation is using secure default configurations. So, for those of you using containers and AWS, just don't let your developers shoot themselves in the foot, right? So, just have secure defaults in a template so that that is set up and it makes it easy for them, right? Configuration management. So, with all of the tools that you can use to run the scans, and then I would really highly recommend setting up some automation to basically fix what you can using microservice... microservices. And this one's really pretty important with the nation-state actors nowadays, but just a comprehensive background check for your employees. So, a lot of times it just... the background check makes sure that they don't have a criminal record, but there might be a little bit more to it. So, I don't know if you have a good rapport with your HR department, but I highly recommend that. I've clearly been talking way too fast, because I'm out of slides, but I will take questions. So, does anybody have any questions? Or certainly, there's probably things that I've missed, but yes, that is a fantastic question. So, for those that didn't hear the question, was how do you do a bug bounty without encouraging developers to write bugs? That's a great question. You... I mean, you do have access to the check-in history to see who wrote what code. No, that's a fantastic question. Well, peer review helps a lot, too. So, it perhaps just changing the process so that when you are doing a peer review, the developer does a peer review and they find a bug, that's the only time that you can report a bug, but then there's a potential for hiding bugs. So, it's a really excellent question. I will think about that. I'll come back to you. So, I have done that, too. Yes, I've definitely looked at old code and I'm like, oh, that's embarrassing. So, knowledge is just a... Knowledge is power. So, but that's why you're here. And I'm glad that you're here, yes. Okay. Oh, an internal education program for the developers. First step, it... Well, I've done that myself. So, the first step was creating about 350 slides. And then the next step is talking to the executives in charge of the developers and getting their buy-in. So, that's really the most important part there, because if they don't think they have to go, they won't go, right? It's not optional. You have to go to training. So, getting executive buy-in. Actually, no, that should be the first step before you waste your time on the 350 slides. Yeah. That's a great question. How do you evaluate competency? I'm still talking too fast, because I'm nervous. After training. So, what I've done in the past is have a quiz before and after to see the effectiveness of your training program. So, yeah, just compare results. It'll go up. And then, another thing that I would recommend for an internal training program is keep it in the developer's face all the time. So, not like an annual training, but to have something at least once a month so that it's in their face, they're always thinking about it. And they're always learning more about security. So, some of my favorite metrics to track for what? The number of vulnerabilities is probably the most important one. So, take all the data from all the tools and put them in the same place, and hopefully that number slowly goes down. So, that's probably the most effective way of tracking how effective your AppSec program is, I think. Does that number always go down? No. Because the developers are writing more code. It does not. So, even if you could stop, there's more code. So, if 10% of the code has bugs, you're going to get more and more bugs in the list. Absolutely. So, you could track vulnerability density as well. So, and at my last job, I actually had a competition between the development groups. So, it was just a scorecard that everybody knew where it was. And you take the vulnerability density and whoever was at the top of the list got a prize for the month. And they got really competitive about it. So, that's combining social engineering with AppSec to manipulate people into fixing the bugs. So, yeah. I like this Q&A session. I'm really, I talk so fast. Oh my gosh. I'm going to have to watch the recording and laugh at myself, but... Yeah, anything else? Definitely. Well, yeah, you do have to kind of start with the basics. So, OOSP top 10, as I say, or just the top 10, that's kind of the bare minimum for web developers. But I definitely would advocate for training in more in-depth and especially just whatever somebody needs to know to do their job. So, AWS is one that's being very widely used and there's so many features and there's so much to learn that, yeah, it's still pretty easy to screw up even if you know what you're doing. So, I definitely advocate for role-based training. And, yeah. That's a good question. I see two hands. I saw you first. Oh, that's how to scale finding business logic flaws. Is that your question? Well, it's probably a slow process, but once you find one, then just write new automated test cases to test the new and existing code. But I'm sorry, I'm not sure if I understood all of your question. Oh, to find them? Learn the business. Learn the ins and outs of it. So, as a security person, you should know more about the business than your boss does. It is. It's very difficult to find, but the more you learn about the business and how it works, the more you realize that you'll find things. That's a great question. I have seen, so in design and story development, have a review process where there's a questionnaire. So, when you write a story, there's also a security questionnaire. So, it's a fairly basic way of doing things, but you can scale things and just by having them ask a few questions. Are you dealing with social security numbers in this story? No. Are you dealing with cryptography? Yes. And so, the things that are kind of the low-hanging fruit will automatically get kicked up to the security team for a review. So, that way you don't have to review thousands upon thousands of tickets. So, does that help? Okay. That is a great question. And if you're in an organization where you're working against reputation, I think the best thing you can do is just... Have you read How to Win Friends and Influence People? Read it again. I read it every year, you know. It's a good review, but it's hard when you're already working at a deficit, but to just try to change the perception of the security team. So, you know, do nice things for them. See, and one recommendation is every time you have a meeting with a developer, just start it out with, I'm here to help. Let me know how I can help you. And then just kind of live with that attitude, I guess, and it'll get there eventually. So... But I've dealt with that a lot of... Especially when a brand-new developer comes in, it's, oh no, you're the security team. You're going to tell me I'm doing things wrong. But you'll win them over eventually. Patience. I know it's hard, but... Yeah. Yeah. Sorry. Yeah. I think you have to understand the principles before you can really exploit them or fix them. But, yeah, for sure. So, I love hands-on training, though. So, because that's the best way to learn by doing. That's how I've learned all of this. I didn't go to school for this. So, good question. That's a big bug. Yeah. Yeah. Okay. Well, I wanted to say thank you to Owen and Adarsh and Vivi for helping me with the writing process of this, and I'm so distracted by the bug. I'm sorry. Do we have any bug hunters in here? Five dollars. Yeah.  I also want to thank you for being here and asking such good questions and for all of your hard work in what you do. So, app sex is really important. I'm very passionate about this subject. And I'll be hanging out outside if you want to come talk to me later. But, yeah. Thank you. Thank you for being here.


Saving the prison company of Philip Ullett, Mr. Light, and the great Delight Sieven here, Martha Kosky named me as one of the most significant theorists in international law. The more than that, I don't say he's the greatest public intellectual in the world. I don't say he's the greatest international lawyer in the world, but he is without question the greatest international lawyer who is a public intellectual in the world. We had him here as a good heart professor some years ago, and it was the result of that that the partnership, I don't speak in too strong terms, which led to the Cambridge Companion to International Law developed, and that has been launched this evening at 5.30. You're all welcome to come through that. After the end of the lecture, you are, however, unless you're invited to the conference, not welcome to stay, and I will shiver you out because there's all sorts of logistic arrangements that have to be made. If you want to speak to Martha, there'll be an opportunity to do so this evening at the lunch. I should... is Tara here? She's right in the distance. You can have the flowers. While we're getting Tara, I'll give you the other notices that need to be given. I mean, there are any other notices. I'll go through these. The title of today's talk is The Politics of International Law. Marty has published a book. We authors, Ma'am, on the Politics of International Law, published by Hart, is available to you at a 35% discount, and we promise to sell four copies. You can alternatively use the brochure for the talk today and get a 20% discount directly from Hart, thereby missing out on a 15%. So you'd be most welcome to buy one of these things afterwards and there'll be someone available to take your cash. We'll give the flowers later on. So, Marty, it's a great pleasure to have you back to speak on the Politics of International Law, and I won't give you flowers. Well, it's a great pleasure to be back in Cambridge again, to see so many friends, colleagues, to see James, and the whole operation of the Lauterpath Center once again. So it's customary for speakers to congratulate themselves of the difficulty of the topic they've been given or they've given themselves. There's two specific difficulties with this topic. On the one hand, it sort of points me to summarize everything I've done in the course of my professional life. I wouldn't do that. I'm very bored and will still be sitting here next year. On the other hand, there's been a conference the morning on the Politics of International Law. So many of you are completely inside this topic, have a sophisticated framework being constructed in your minds by this and you will feel that I will just be repeating some of those issues that we discussed in the morning. But it is true that this is also a summary of what I've been saying in different forms in the course of the years. The book, The Politics of International Law, is a collection of essays. Some of you may know some of those essays. They all are obsessively focusing just on that one question about what does the political mean in international law? How does it operate? And how, or other people in this way, how does our intuitive understanding of the politics of international law get articulated in the various professional practices in which we are engaged? But I'm not going to summarize the book either. I'm just going to clear the way to explain to you what is the relationship, finally now, within these walls at this moment, what is the relationship between international law and politics? And I say a few words at the end on where I think the politics might now be going. Okay, so like all good things, or let's say like all intellectual things, this story also has to start in Germany. And it starts with the juxtaposition of two persons, Hans Mogenthal and Herr Schlauterbath. So Hans Mogenthal, the founder of the International Relations, famously in the United States after he migrated, published his dissertation, 1929, on the tasks and limits of international law in German. It was a Frankfurt dissertation. And in that dissertation, he asked himself the question, what is the role of law in the international political world? He particularly wanted to address the question which many German lawyers, including his own supervisor, Karl Strupp, had been asking, how can we accommodate or deal with the famous reservation of vital interests and honor in international arbitrations? Is there a way to professionally deal with that? It's a political reservation, clearly. And Mogenthal said, well, it cannot be delimited or delineated in any specific way, that whether we feel some matter that deals with our vital interests or honor is a function of how intensely we feel about that matter. Politics is an intensity field. We start to feel a thing being political when we feel intensely about that. There is no way we can map out the aspects of the world about which people feel more or less intensely. Which led him to suggest in this book that there is no way to define the limit of international law and politics. That would not be a political decision. So Hans Mogenthal, for him, everything in this... So here is politics, there is law. For him, law is whatever is left once the political has been delineated. The space of law, the little bit in this universe of things here is constantly conditioned by our understanding of the political or our desires and passions, what we feel intensely of. So what we are cool about and nonchalant about that's law and it's this little thing over here is what he said. Now, Herr Schlauterpat 1933 in Britain wrote the function of law in the international community precisely to refute this view. Lauterpat's function also starts with the query about the nature of the reservation of vital interest and honour. Can it be delimited? And he says like Mogenthal, for whom he had great appreciation you can find Lauterpat's review of Mogenthal's dissertation in the British yearbook in the early 1930s. And so Lauterpat looks in particular at three different questions. He asks the general, for the general question that he asks is what is the role of political in law? And he sees political intervene in three different ways. First is the vital interest and honour. He says well, it's true that it cannot be delimited by any criterion but we can all find a place to it in our imagination as legal professionals we have no difficulty in giving room to sovereignty. Sovereignty of which vital interest and honour are an expression is a legal notion and of course there's a role for sovereignty like there is for vital interest and honour but that role is completely delineated by law, by legal argument through judges on an everyday basis. The second question he asked was well, what about the famous distinction between legal rights and political interests? People were saying at this time if a matter deals with political interests lawyers should not touch it or deals with political rights. And again Lauterpat would say yes there is some truth to that but this doesn't mean that lawyers could not delineate a specific area where political interests that is to say sovereignty operates that area is delimited by law and in this way can be dealt with. And the third problem he dealt with was the problem of peace. Many people were saying not least because of the problems related to the Covenant of the League of Nations and the Paris Peace Treaty that peace is not a legal notion and we heard this in the Yugoslavia situation for example that when it's an issue of peace then it has to be dealt with by diplomats or by soldiers, lawyers really mix these things up make life more difficult.  If a concern of peace is real it can always be articulated as a legal concern. So Lauterpat was making the same argument about the impossibility the impossibility through a criterion of distinguishing the legal and the political. But what he was saying was that well through law we can always leave a space for political decisions for sovereignty. It's just a matter of the jurisdiction of the limitation undertaken by law. So you see at that early moment in the interwar era two German trained internationalists both addressed the issue of the relations of international law and politics. Both said there can be no delimitation but the conclusion that they drew was exactly the opposite. With Morgenthau saying politics determines whatever little role there is to law, Lauterpat saying law determines whatever little role there is to politics and sovereignty. So this leads me and I apologize for those students and friends who have seen this figure sufficiently often. So this leads me to now finally rid ourselves of the question and the problem what is the relationship between law and politics. This image which in the course of decades it has deteriorated very badly. I have to say the animal isn't really very well at present. But this is of course the famous Wittgensteinian duck rabbit. It's supposed to be a duck looking in this direction and a rabbit looking in that direction. So the final answer to the question of the relationship between international law and politics is that it is exactly the same as the relationship between the duck and the rabbit in this image. Now what is that relationship? What can we say about the relationship between the two? On the one hand we can say that the distinction is not something in this image in the world itself, in this image itself. The distinction is something that we operate in our minds. And we of course some of us are better and some of us are worse in this and when I show and as this is going to deteriorate in the course of further years if I still am able to teach this then it will become more and more difficult for audiences to imagine what's going on here. But especially if they followed my career in the past they will train themselves and they will see, they will train themselves to flip the coin and to see well duck, rabbit, rabbit, duck, rabbit, duck and so on. And if you ask small children you will often hear that or see that they don't have that kind of flexibility. They usually say well it's a duck and they say why can't you see the rabbit, can't you see the rabbit? And then slowly they get, oh right. And then they train themselves and then they become suave operators in the international world by being able to recognize from a discourse that they hear from a distance whether it's a lawyer or a political scientist that's speaking. So it's not out there and there is in this sense something quite nonsensical in asking the question about the relationship between law and politics if it's the question about the relationship between the duck and the rabbit. There's another important thing here. It's of course, this is a famous image of Gestalt psychology in which we look at how people visualize things. And the point in Gestalt psychology is that we always visualize things as holes. It's about the holism of our psychological lives. This means that when we see a duck or a rabbit we see always an animal as a hole.  The psychological mechanism always makes the quite imperfect image hole. It makes an understanding of it. And this is also an important aspect of our professional lives. When we act as lawyers, we don't act as 75% lawyers, 25% politicians, or 50% and 50%. No, if we perform a legal task, then it's a legal task from the beginning to the end. It's a hole. And we can compare this with two languages. So there are the languages of rabbits and the languages of ducks. It might, of course, be possible to say that there is a language that's half duck, half rabbit. But this would mean that half of the populations of those animals would always end up misunderstanding or not understanding each other. When we speak a language, we speak a language as a hole. It would be idiotic for me here to start to insert Finnish words in my English sentences. It might be exotic, but it would not enhance our understanding of what it is that I'm saying. The point is that law and politics are whole professions. They are whole forms of our existential lives. They are languages. They have their own rules. They have their own professional engagements. They have their own interests. They have their own agendas. They have their histories, their sociologies, their psychological predispositions, their ways of behavior, their cultural patterns, their kinds of jackets that people wore, the bags they carry, the books they read, the love affairs they wait. All of this comes together as a whole image of what we recognize as what it is to be a lawyer or to be a politician. And we can, to finish with this, we can witness this in our students. And when they innocently come from schools and they all look the same. And then, after maybe six months, maybe one year, we start to recognize those who actually went to the law school. And they recognize that those who went to read political science, they start to seem different. They become different. Ducks separate from rabbits. From some understandable and meaningful standpoint, they are just the same. But from the perspective of their own understanding of themselves, they become different. They start to speak duck and rabbit. And they disagree about it with each other. And they have different preferences. Their politics is slightly different. And we all know how, in which ways, they are different. And this is the final word about the relationship between law and politics. And I could stop here. But as you know, I still have 40 minutes to go, so I can't stop here. And you all come here. So I need to continue. So there is a question, a further question to be asked. Well, why would one want to imagine oneself as a duck or as a rabbit? What specific interest is there for us to be rabbits today? Why are we rabbits? So we have this imagination about what it is that rabbits do in contrast to ducks. So there is a familiar understanding in all of us about what the world is like and what we should do about the world. And it's an image that's portrayed to us always in first year law classes, even at school, when we ask ourselves what this thing law is. So there is this narrative which says that once upon a time it was all dark and dangerous. It was a jungle out there we fought for our lives. It was a bellum omnium contra omnes in whichever vocabulary you want to say it. It was politics. It was dark and dangerous, passionate, uncontrollable, anarchic. It was really a tough place. Law came to take us away from there. So law is in this sense the other of politics. Whatever it is, law is those rules, those institutions, those mentalities, those ways of behavior which are opposite to this. Well, is there more to be said about this? Yes, there is more to be said about that. So there is this understanding about the relationship. But you must see this is a progress narrative. So this is not just a conceptual relationship. This is also a temporary relationship between the political past and the legal future. So one way of thinking of this, the danger of politics is that it's just facts, it's power. It's the tank that came into my country. It's the bomb that fell. It's the fist that hit my nose, etc. And so it's what happens. It's a sociological fact. Some people have power, others people don't have power. That's one understanding of politics, power politics. And so to get away from there, we need that which is not facts. So what's that? So that's ideas. The identity of law as ideas typically has rules, also institutions as principles. Rules such as non-use of force, pristine environment, good ideas, ideas which whatever content they have mark themselves by their contrast to the dark facts of power and present existence. So that's one way of understanding and many political scientists, realists, present this kind of an image, in part to radical law because of the weakness of ideas if we juxtapose them with tanks and fists and power over there. Now Hans Morgenthau is on this side. I am a man who stands strong in the dark jungle that politics is where as you, Hersh, Lauterpaat or we here at the Lauterpaat Center are men and women of ideas who can just be swept away by whatever happens over here. So that's one understanding. Law has some non-factual aspect to it which is, as I put it many times, normativity. That's an aspect that law has. To the facts of power, law poses the normativity of ideas. But there's another understanding of the relationship as well. And it is politics as socialism, capitalism, neoliberalism, old liberalism, law as ideologies, law as utopias in the, sorry, politics as utopias and political ideologies, party programs and so on. Why, in some ways the world could be ruled by ideologies. Why isn't it ruled by ideologies? Well because we think ideologies are dangerous. Ideologies are intangible. Ideologies are merely smoke screens for the passions and selfish desires of the speakers of the languages of those ideologies. So we can't rule the world. It's intangible. We can't rule the world through ideologies. So we need, instead, we need the police. We need facts. We need legal facts, institutions. We need a court system. We need the fact of there being a rule book in which we can find out what the law said instead of consulting Father Lenin about what it is, how we should live. And there are dozens of narratives that link to both of these stories. This is the story of law as wonderful humanitarian ideas that intervene in the dark jungle of power politics. This is the story of law as policemen order institutions of society that intervene against the endless blabber of ideologues. Now, of course, this thing creates a perpetuum mobile in which one of the things that can be said about it is that for every idea that the law presents, somebody is able to say that, oh, that's only ideology. That's your humanitarian or you an ideology. It's a constitutionalist ideology, in which case you fall into being just an ideologue from the perspective of that speaker and he or she can then juxtapose your ideology. With the facts of the politics. So on both sides we move with facts and ideas and on both sides we constantly juxtapose the opponent's ideas with our facts and the opponent's facts with our ideas. This was the perpetuum mobile that triggered or that was constructed in the course of my writing from Apology to Utopia now a very long time ago and that appears and reappears over and over again in the various essays of this more recent book on the politics of international law. Now why do we still feel that law is able to trump politics? Because of the reason that we think that law enshrines ideas that are valuable against the dark facts of politics. But also because we think that law has a concreteness, a solidity about it, a verifiability. Look at all these books which I hear in order to show the concreteness of the legal world in juxtaposition to the endless debates in parliament and at political rallies. To rely on this we are on safe ground just to go by what the politicians say. And so on. So law has this rhetorical power that seduces us over and over again to imagine ourselves as lawyers instead of as politicians. So why do we go to law? Law is the language of rabbits as against the language of politics, the language of ducks. Why should we want to choose one language over another? Well this is because languages are instruments or languages are ways of life through which we come to see some things very clearly. Law enables us to see society in a particularly sharp fashion. That's useful for us. Law's insights tell us about society things that non-lawyers do not know. We know this from everyday experience. Lawyers in some aspects of their phenomenological lives are more capable operators of the world than other people are. So that's a plus. But it comes with a minus. There's a blindness about law too. And we see this in some of the colleagues who even at moments of friendship in the evening we've already left our jackets we've had a couple of drinks and they keep on and on about these cases they've read and about the new legislation etc. The inability to look at life without the legal spectacles on. That's a huge human problem often but it's also I suggest a big social problem. We don't want lawyers to rule the world not because we wouldn't think lawyers would be as good as any others but they are after all lawyers they are the people who find a problem for every solution. We don't want them. We don't need other kinds of people. So the legal vocabulary enables us to operate but it also makes us hopeless operators in situations where we should just live. But we're also called upon to be lawyers to become rabbits instead of ducks because it offers us a profession and a profession empowers us to be a legal professional is or goes together with a number of things that we want to have. The paycheck is usually well it could be better but it's okay the places we travel the conferences we go to the way in which people listen to how we speak in moments when the lawyer speaks we enjoy that. So it empowers us. So that's the plus. Now what's the minus? Well it makes us irresponsible. So it enables us to say oh it's not me who decides it's you know the decision comes from this book and off you go 30 years to life or whatever it is we say so it's not we it's the law. That kind of an attitude in some social circumstances is precisely what we want to inculcate. But and the German history would be just one example it would not be the only mindset that we would want to inculcate. The legal mindset is a mindset of personal irresponsibility. So again a plus and a minus. Thirdly to become a rabbit is to choose a set of projects. Law in addition to being a vocabulary and a profession is also historically situated in the advancement of some projects. The lawyers preferences are not the common citizens preferences. Law comes with a definite normative baggage. In the international world we can mostly pick out very rapidly five six seven kinds of preferences. It's a constitutionalization project. It's an institutionalization project. It's a project for empowerment of particular kinds. There are bureaucratic practices that are being advanced of certain types. There is an optimization of social collectivities of a particular kind and so on. Law is instrumental towards these kinds of projects. My own historical research now looks at how the idea of an individual right emerged as spread and was attached to various kinds of social problems to various projects of exercise of power in the world. It's instrumental, but it's also limiting and many of us especially in human rights classes when we lecture students on David Kennedy's writings we lecture to them about the various ways in which the legal language limits our ability to operate and help out those whom we want to help. It's instrumental useful, but it's not a panacea. There's a final question about this aspect of law, the goods that law brings. It's a philosophical question. It's a question that is often raised in Europe, seldom elsewhere than in Europe, or at least, well, it's raised because the Europeans think they have some response to this and this concerns the inner value of law, that there is some morality that automatically is attached to rabbits, but that ducks lack. I'm agnostic about this. I think it's for all rabbits it's extremely important to imagine that they, alongside being rabbits, are also moral animals. That they read books, educate each other in moral vocabularies and imagine that the ducks vary business in the various ponds in which they exercise duck kind of authority. I realize I'm mixing now ducks and rabbits, which actually is a mistake, it's a terrible mistake that one should never do, but you get the point. So there is, I think, a value to it that lawyers think of their profession as having a morally articulable core or aspect to it. Now, but I do have something more to say about the legal project, and this something more has to do with why it is that I find it so difficult to think that rabbits, no, rabbits is lawyers. So that rabbits are actually engaged in a moral project, and that has to do with the narratives that rabbits tell about what the kind nature of the project is. And I already earlier pointed out that there's a chronology about it, that it's a progress narrative in which there is a starting point which is an experience and then there is an objective somewhere there. So as the saying goes, in a world of angels no law would be needed. We need law because we somehow feel that the present world is insufficient as it is, unacceptable in some aspects of it, and of course we widely differ in our sense of how intensely we feel that the world is unacceptable or disastrous or slightly problematic, however we want to put it. Anyway, we need law in order to get us away from that experience, the negative experience to some sort of a goal that's out there. Now, that's fine. That's an aspect of law. It's also an aspect of the fact that rabbits do think of themselves as moral animals where would they not be inculcated in this kind of a progress story, they would find it harder to think of themselves as acceptable as they come with the paycheck back home at the end of the month. But the experience that they have of the unacceptability of the world is problematic. Many people would say that the experience, this is a standard international law point, that the experience of unacceptability can be enshrined in sovereignty. Sovereignty. Hershlautopat was typically one of these people. Many human rights environmental activists, many people in the cause of fight against impunity feel that sovereignty is the problem. Sovereignty they feel is a problem because it's a kind of egoism. It's a way of turning inside. It's a way of keeping the world outside. It's just being obsessed about me and my power and my values and my preferences, however, whatever their nature. And if that is the negative experience, then of course the experience itself suggests what the project should be. The project should be community, international community. So we're all familiar with that kind of an understanding of the world. So here it is, we as lawyers are in the business of turning an unacceptable world of sovereign egoists into a wonderful world of communitarian sitting by the campfire and singing we shall overcome every evening. And if it were like that, if that were the way people felt about the world, then rabbits would be fine and all they would need to do was to get out there to the pond and transform the then egoistic small communities into a big community of the forest, for example. So not everybody feels this as the problem. As a matter of fact, many people feel that something they might call, for instance, empire is the problem. And this might be empire felt in many different ways. It would be the empire of, let's say, neoliberalism or American empire or the empire of capitalism, empire of a suffocating ideology of some kind, a totalitarian thing, some aspect of the world that doesn't allow us to express our identity, our identity in small groups or our identity as individuals. It's an experience that we are being not allowed to express ourselves. We suffocate inside this homogenizing world. And from this, we, of course, then this analysis of the situation, this malaise immediately suggests another project which is the project of autonomy. Now here it is, the international lawyers that we are feel the world in terms of two different kinds of experience. On the one hand, the experience of untrammeled egoism. They do just what they want there. We need to build a community. We need to tie us and take hands with each other. That's what we want to have. On the other hand, there are those people, well, there's too much taking of hands here, dammit. I want to take control of my own hands, of my life, of everything that's special about me. Of course, these are both part of the problem and part of the solution. The experience that we as human beings have of the world isn't homogeneous. It is different. We feel the world's weight in different ways. We feel the weight of the world as alienated individuals bumping into each other like ships in the night, only obsessed about themselves. Or we feel the world as this religious sect in which we are all compelled to sing the same hymns, to think the same thoughts, to dress the same way, etc. And those opposite experiences give us two opposite projects. Now, however, again, these opposite projects aren't transparent. It's not obvious what autonomy and community mean in their positive descriptions to those who aren't involved in the describing business itself. So every autonomy, every call for autonomy is a call for sovereignty. My personal sovereignty, the sovereignty of my tribe, the sovereignty of my country, etc. In which case it starts to feel terribly egoistic and a part of the problem. Every community will sooner or later start to feel suffocating. We feel the imperial weight descending upon us. Yesterday it was all fun, but we can't keep on singing this song day in, day out. There have to be other songs and other ways of life. And so the game starts all over again. Now, international law or being a rabbit is a wonderful experience to the extent that it allows us to think of a moment that's outside of our present existence. To think of ourselves as involved in a real effort, perhaps a collective effort in which the negative experiences of the present would be transcended in a future that's bright and shiny and into which our institutions are taking us. The problem with that is that we feel as I said, the world's weight differently. But in opposite ways, in ways that enable us collectively, but perhaps more interestingly, individually to both want and not want what we intuitively first would like to have as our world-changing project. So the awareness of this awareness of the ambivalence of the world and of myself, of every rabbit has made it for me impossible to think that there actually is in some way an internal morality to being a rabbit that would make being a rabbit somehow in some evaluative scale more important, meaningful than being a duck. So I said moments like for instance when you want to run away from somebody that you want to be a rabbit rather than a duck and then it's good fortune if you happen to have that education and those ears and you were able to go that fast, but it's not always like that. And if there's a pond and you have to cross then you know what you have to do. For best of my students I recommend that they are prepared to be both one and the other, that they can flip the coin that they can immediately see both sides of those professional alternatives that are being offered to them. There is one final thing I promise to say something about the politics of international law today. So I want to set up a use corgans prohibition to those of my left friends who in the course of the years together with me have insisting on the politicization of this or that. We know it's a regular left theme to look at the politics of international law of economics to say it's political. Having said that often enough and having gone through these images often enough it has, I can report to you come to transpire that that evocation of the political is meaningless. It doesn't mean anything. If you catch me still doing this in the future, well I'll give you 50 euros to put it no higher than that but so I want to invoke a prohibition of ever to look at the politicization of this because to call for the politicization of this or that would be to insist on it being a duck or a rabbit. But there are questions of of importance out there questions of preference questions of distribution questions of good and less good choices how do we go about them. So one prevalent phenomenon in my professional life has been the fragmentation of international law and I don't want to go into this in any detail but I've come to understand fragmentation as a professional worry among ambitious operators that the legal vocabulary that speaking rabbit no longer carries the kind of authority that it used to and therefore we have to speak trade law, economic law security law, human rights law environmental law sports law you have it. Now that development has been conventionally discussed in terms of the politics of expertise we become more and more technical in our expertise in our demand of expertise in our recognition of what is authoritative in the languages that parade in the international political field. Now it seems to me that the relationship between law and politics is not the only relational thing in the world that can be articulated in terms of an analysis like this what is environmental law what is the law of the sea what is chemical law for example. In the course of the fragmentation project I look at some examples and I found that for instance if one imagines a carriage of chemical substances in to take an almost random example in the Baltic sea one can articulate that in legal terms in nine different languages nine different if you wish rule schemes nine different professional sensibilities nine different frames law of the sea, human rights chemical law, Baltic law laws of the coastal states etc etc. And each of these articulations carried with it a slightly different suggestion as to how one should deal with that problem. I suggest to you that this problem is endemic and that everywhere every aspect of our contemporary lives can be recounted in easily half a dozen doesn't really matter how many expert languages and each of those languages comes with it's own cultural, sociological historical and of course economic biases. The task for active left leaning by not also not so left leaning lawyers to trying to operate in this world in a fashion that would be politically effective would today it seems to me call for what I've called the politics of re-description. Politics of re-description would be about looking at a problem out there in the world and describing or in this case re-describing the problem in terms of the language of which we, me and my friends feel that we are authoritative to deal with that problem in the way we want to deal with this. The politics of re-description is made all the easier because those who are responsible for the fragmentation for the rise of the rule of technical languages are usually committed to believing that each language is an ontology or addresses an ontological aspect of the world that each language is the authentic representative of what it is that it purports to represent. If there is one thing that rabbits learn in rabbit school it is that there are no such languages and that rabbits are that the special professional ability of rabbits is to jump from one language to another to be native language speakers in as many languages as they have political projects and I end with that ambiguous note. Thank you.


Thank you for coming to the meeting of the month we're just for people, but I think that's enough to make important decisions So this next month we should focus on financial issues in this house That's the priority because we're spending too much money and yet Some people here are left with no money at the end of the month because they're not receiving more than they are part of the bills So maybe splitting with percentages is fair So those who have lower incomes can have money for personal purposes and if they get more money eventually They will be able to put more money into the house. I can do a chart to split bills proportionally. Great Well, I think right now chores are a priority because basically only the guardians are the ones for doing the entire job While the rest are just enjoying their lives Which leaves us with less time and I think time is more valuable than money I can do a chart for chores, too question No couldn't come up with anything just wanted to participate. Well, actually I do have a question. What happens with the pizza? What about that? Because ESJ gave the idea of eating pizza today. So you will pay that right? No, I just decided what we were going to eat since no one had ideas And what about the dishes? Will that also be your responsibility or will it be in the chores chart? It will be in the chores chart. Yes Hmm, what do you think? I think we should consider both issues Are we having pizza? Yes, she's paying. We're all paying. Can I have banana stopping? That is not a bad idea. Oh and also some chocolate. Oh, I like chocolate good idea in FB I'm so excited. I don't know if we will get married here. What song we will dance to there's so much to play it You know what? I'm so sure and I think that's all that matters the moment I saw her was enough for me to say she is the one for me Have you ever had those moments? Hmm. I even the flowers I see them and they remind me of her. I can't stop thinking about her Am I crazy? Yes, you are you met this girl five minutes ago, and I just asked you if you water the plants What? Oh no Bye We could really talk about this, you know, you could propose your own availability to be considered in the chores chart You know, it's all about communication and being clear with your problems. I Don't want them to know my availability. Why wouldn't you that would solve the problem? No, because I don't want to be part of the chart. I will do what I want when I feel like doing, okay? Yeah, that's enthusiastic No, no, I'm just thinking what to do now. Don't you want to relax here in the couch? We can chill in silence All right No, I can't do this. I want something else with this. Oh, no, no No, no, no, no, tell them that we're flexible. Yeah, tell them that it doesn't matter when they have the job done Just that they have it and the quality matters more than a schedule, right? Right now I'm watching very insightful videos. Yeah, can you hear the music? Yeah, it's just one of those Motivational kind of video. Yeah Yeah, you know what? I'm gonna call you later I'm I really I really need to watch this right now. Okay, great. Thanks. Bye What a great day so many possibilities we can do the best out of it perfect for my glass of fresh chocolate milk Who drunk my chocolate milk? Do you know ISTP?  Sorry How long ago? Like two hours ago. Why is that important? Just curious. Don't worry. I Will have to go back in time Time travel outfit check Activating portal check. What are you doing INFJ? I'm looking at ISTP. Do you think that behind his strength? There are emotions craving to be unleashed I think he's doing pretty good at unleashing whatever he feels like unleashing Hey Hey, some dancers the beats is getting cold You know why we're here in the face and chairs of self-intervention You my friends have been putting others before you and I have seen how you act different with everyone Who are you? Are you real with me? Yes, I am real How can I be sure? I Promise I'm being real Well, I believe you aren't you adapting to my energy not now Okay, so I'm excited. We should play a game now. Okay Hmm see Can't help it Okay, guys, we will make cookies for everyone aren't you excited? So what is a secret ingredient? Of course, I don't know what the secret ingredient is. It wouldn't be a secret if I knew That's not the answer. But okay. I'm DJ a Baby's tears. No I'm sp Love Very good. Now the first thing we need to do is la la la la la la la la la la I've always loved standing next to wild waters. It's something relaxing and healing. I Like to imagine the strong power from water cleansing my soul and flushing away all negativity and blockages and To help me heal and let go of all the heavy things and thoughts No longer certainly So I noticed how the vibe was different today. Everyone was acting very stereotypical They were very dramatic important decisions were made like there was a camera recording them or something I'm sure something is off today. Yes. DJ decided to eat pizza Entie jay agreed on banana as topping, which is not something I'm complaining about. I think it's awesome I really wanted to participate in ESJ's cookie baking, but she didn't invite me. That's all right. It's okay I can organize my own cookie party and it will be much better and I will invite everyone I had to be was really pessimistic today. So, you know what I did. Oh, I made her follow a path without her noticing Which was super easy. I made her open the time travel door in the kitchen and she opened it I was so happy that probably made her happy. I'm sure I want to see her face. I probably made her day better Why did you enter my time travel door? Why wouldn't I? No time for a bake answers. I Don't have a better one Are you having a good time at least the time of my life? Hello, everyone. Welcome to my blog today. I have no idea what to do So I decided to go to the street, you know, I'm walking on the street Like I'm a wild animal and I want to share with you some insights. I have had the couple of days So the thing is that I'm thinking about moving out because in this house There are a lot of crazy people and you know what? They're all look the same I don't know what the hell. So I'm not sure what to do. Like I'm just moving out because I don't want to deal with this Weirdos Thank you so much for watching my video. Hope you liked it. Please subscribe I I hope I didn't show you all the corona, but I'm going to make a video and then I'm going to go back No