And there is no scooter sharing, which brings me to the next talk. We tend to need kind of a security concept for not scooter sharing. So the easiest way would be to have kind of a scooter lock. But we have the lock-picking, guys. So that won't work. So the next option would be we can have a GPS tracker. But we have the GPS spoofing, guys. Which isn't also that good. A third option would be an immobilization system. We have Walter Wurzlach. Thank you. Hi. Thank you for the introduction. Thank you, guys, for the warm welcome. I'm really happy to see that still some people have come together here at this ungodly hour to watch my talk about vehicle immobilization. Well, briefly something about me. I'm a Keckoff security master. And the research I will be presenting today, I did as my master's thesis. So I spent about half a year analyzing various systems. Well, I wrote something about that. And if you want to read the full story, you can look at my thesis, which is public since some time now. There's more detail there. Currently working as an automotive engineer. And if you feel like asking me questions beside the Q&A, you can always contact me by mail. So first, responsible disclosure. This kind of stuff is not a joke. Automotive manufacturers think it's very important. And well, they have all reason to think so. So naturally, we contacted them ahead of publication even before my defense. And we laid out the findings. I had a couple of conv calls with the manufacturers. And I even went to one of them to demonstrate the findings on-premise. I need to point out that the research that I did was on fairly old vehicles, like 2009 and around. But for the three cases that I really went in depth, we have been able to confirm that they are still in currently produced models. So this in itself is kind of surprising because you think automotive, cars, electronics, security, it's a fast-moving industry. But well, no, not really. So everything that was in cars in 2009, at least regarding to these three systems, can still be found in currently produced models. I will disclose the vehicles that I've been working on because I think that is relevant. I hope you can forgive me that I'm not going to disclose the vehicles that I have identified these systems in that are still being produced, not really into facilitating theft. And I don't see what would be the added value. So the talk will be structured as follows. I will first introduce some standard stuff about immobilization systems and about computer networks inside vehicles. I will tell you something about how I address the challenge. So for all three models, I kind of follow the similar approach. And I think it's more practical to lay that out once and then skip the details later on. And then I will present the three protocols that I uncovered in a Peugeot, a Fiat, and an Opel vehicle. I will then summarize the findings in a series of takeaways. And there will be some time for questions.  They operate largely independent, but they are all connected through a variety of different buses that talk to each other with different protocols. And there is a plethora of different standards, ISO standards, all kinds of standards. And then the manufacturer wants a lot of freedom to do it in their own way. So even if you read these hundreds of papers of standards, still every vehicle you will look at will be kind of different. There are some practical handles that you can use. And one of them is that every car has an OBG-2 port. Yeah. And this is required by law both in the US and in Europe for quite some time now. And it needs to be conveniently located. And that is very near the driver's seat. So this is a universal connector. And all cars with a combustion engine need to have one. And cars with electronic engines also need to have one. But the functionality that has to be implemented is much more limited. So in regular internal combustion engine powered cars, you have to be able to read out emissions data and that kind of stuff. So many manufacturers thought this was a very convenient thing to also use for garage purposes, for workshops, to read out error codes, to perform all kinds of routines on vehicles. You might need to teach new keys to your car if you lost one or if you just want a third one. If you add a tow bar to your car, you need to tell a couple of ECUs in the car that it now has a tow bar. Depends on the vehicle. But telling this to five individual ECUs is not an exception. And since it is a bus, the CAN bus, it can be directly addressed through the OBD connector on many vehicles. And you can talk to a lot of different components. So the ECM, the inter-control module is one. The body control module is another. That one controls, for instance, powered windows and all kinds of interior stuff. But also the airbag infotainment system, fancy interior lighting, stability control systems. Another feature of it being a bus is that you can also see the inter-component communication. So if the instrument panel cluster, the dashboard, needs to talk to, say, the body control module, you can see that packet going over the CAN bus. All my research has been focused on this OBD2 connector and what you can do and what you can see from this perspective. Immobilized systems are nowadays required to be implemented in vehicles, since the late 19s legislation has been adopted in both the states and Europe, mandating the use of an electronic immobilization system. And the purpose, of course, was to reduce the risk of theft. This is proven to be effective. According to one study, theft rates drop by almost 40% in, I think, seven years span. They base their data on. This is because car theft used to be quite simple. You could just put two wires together and you could power the starting circuit and you could actually start the engine. And the immobilizer system adds another step to that. The engine control module that finally controls the engine wants to have some kind of assurance that the key presented in the system is actually valid and does so by validating a security transponder. First generations of these security transponders have been widely studied and often were found insecure. Of course, this is a problem because, well, if it's insecure, it doesn't add any security and cars can be stolen nonetheless. So there's been kind of an arms race in this domain. And we see that nowadays security transponders have become a lot better. Your car might even use AES to validate that the key you're putting in the ignition is an actual key that is recognized by our vehicle. And this is really necessary because car thieves have shown to be able to wield quite high-tech solutions, procure them from shady companies, or just use official tools that can be used in legitimate ways. A nice example of this is shown here. For certain models of Range Rover, they have a blind spot sensor.  And if you pop up off a cab, then you can connect a 12-volt battery and power the internal issues of the vehicle. Then you can access the CAN bus, put the car into key teaching mode, and hold a blank key to the window, and it will program the key, recognize it as a valid key. Well, needless to say, this was not intended behavior. And this has had consequences for consumers because insurance companies saw a rise in theft for these models. These are quite expensive cars. And they started adding demands before they would allow you to insure your car. So the insurance would get more expensive, or you would not be able to get the insurance, if at least at your own home. You couldn't park it in a secured area. There is a common misconception about how immobilized systems work. And it's actually one of the reasons I want to give this talk and present this, because I think it's important to realize that an immobilized system is a bit more complicated than the single cryptographic step that seems logical. So what you might think is that the engine control module sends a challenge to the body control module, which communicates with the key. It implements the radio layer, and it can then relay the challenge to the key. The key can compute the proper response based on a secret chess with the ECM. Send back the response, which the BCM will and turn forward to the ECM. The ECM can verify the validity. And if this seems to be the right response, immobilization is deactivated, and the car can start. Sounds good, sounds easy, but this is in modern cars no longer the case. Cross. What we see is that there is a second step. The ECM does an authentication with the BCM. The BCM does an authentication with the key. So if your key uses, say, AES for its authentication, then this will be an AES-secured authentication between the BCM and the key. The BCM, if it validates the legitimacy of the key, will then send the correct response to the engine control module. But this is a whole different protocol using different cryptographic primitives, using different keys, sometimes, often, I don't know. And more importantly, it has not yet been covered. So in the scientific literature, I have found absolutely zero reference of this step being identified. And here and there, you find a reference that people know that this happens, but no actual analysis of the security or the cryptographic primitives involved. Right, so that is an open question then, and asks for further research. So how do you do that? You can sniff can traffic from the OBD connector with tooling, and by disconnecting ECUs and placing yourself in the middle, you can also modify can traffic. You can analyze this can traffic, see if you can find immobilizer-related messages. Of course, by the messages, you cannot deduce the algorithm most of the time. So you will need a firmware image or something else. You can reverse engineer to actually find the code that does the magic stuff. If you have that, and if you are able to pinpoint where the algorithm is, then you can start looking at if it's actually decent. And once you're all there, you will want to test if all the assumptions you've made on the way are correct, and if it's actually working as you think it's working. So the first step, protocol identification is actually quite straightforward, because you have some knowledge. You know that this is a message exchange that happens when you switch the ignition to the on position. And you know that there must be at least two high entropy messages, because the challenge has to be different every time. And the response is the output of some cryptographic function, so it may be expected that that looks quite random, too. Also, if you switch the ignition on, but no, fellow transponders present, you should be able to detect some kind of difference. And this will probably be the very first moment you observe a difference, because before that point, the car didn't know there is no valid transponder. So with a bit of fiddling and some patience and going through traffic logs, you can probably find this. OK, next step is to get a firmware image in which you hope to be able to find the actual cryptographic protocol. So there are several options. Of course, you already have the firmware, but it's in the microcontroller in an ECU that either laying on your desk or inside some vehicle. So you can try to get it straight out of that device. Debugging headers are a good option. You have JTAG, you have BDM. UART occasionally can be used, but sometimes these are deactivated. Sometimes it just doesn't seem to work. Sometimes the tooling is prohibitively expensive. So if that doesn't work, you can always go to the internet. Some manufacturers provide a means to download a set of information about the vehicle based on its VIN number. You can find all kinds of configurations. You might be able to find actual parts or full firmwares, often encrypted, not always. And then there's the tuning scene. And while you might think of neon lighting and stuff like that, these guys are actually pretty knowledgeable about the internals of engine control modules in particular. And you might just be able to find a full firmware image or parts of it or some model that is highly related. And this is kind of a viable approach to getting your hands on the firmware. But also very practical can be to just leverage the functionality that is implemented in the ECU. The ECU allows for diagnostic commands, such as read memory by address and request upload, which, from the perspective of an ECU, is sending you data. And you might be able to just dump the whole firmware or dump memory or dump at least parts of the internals of the ECU. Then there is some kind of mechanism that's called second bootloader. It's a sort of standard. Not every manufacturer implements it, but quite some do. That allows you to actually send binary code to the ECU and it then jumps to it. So very convenient functionality. It's maybe very painstaking to get it working. But yeah, it's basically free code execution, except for the fact that you often need to authenticate before you're allowed to use such functionality. So that might leave you with some kind of chicken and egg problem, because you don't know how to authenticate. You don't have the algorithm for this authentication. And lastly, there are sometimes firmware updates for ECUs. You might be able to use an official dealer tool. You might be able to sniff CAN traffic. Multiple ways of trying to update the firmware on your ECU reconstructed from the CAN traffic. Once more, you have to go through an ISO standard before you understand how it's exactly chunked in 8-byte messages, but you'll get there eventually. So once you have this firmware, you have to pinpoint the cryptographic algorithm. And ECU firmwares are typically between half megabyte and two megabytes. And that is a lot if we're talking assembly. The information density is extremely low, and if you have to go through it line by line, it's hardly doable. So you need to have some tricks. I think we're at a conference where we've seen a lot of reverse engineering, so this is not going to be my focus during this talk. But a couple of pointers, maybe someone is helped by that. Of course, you know the protocol because you have observed CAN traffic. So you can search for immediate values, for numerical values that are used in the protocol to designate a packet type, for instance. It must be in the firmware somewhere. Also, you know that crypto usually uses XOR instructions, and you would be surprised how little XOR instructions there are in a firmware. Depending on the architecture, you might immediately dismiss most of those as a single bit flip, or maybe inversion of a whole register. And then you will find some XORs with either weird constants or variables. So those are points to focus on. Lastly, you can make some assumptions on the structure of the cryptographic function. So it certainly doesn't do IO. It will not invoke a lot of other external functions, maybe some round function once or twice, maybe some initialization. It will probably have some loops. You can sometimes recognize the length of the challenge. You can sometimes recognize the length of the response. That being said, let's dive in the first case study. So I reverse engineered a Peugeot 207, which is, as I said, not the most recent of vehicles. And this was my test setup. It doesn't look like much, but everything that's relevant to me is there. And you can toggle the ignition, and lights will show, and all the ECUs are connected through a CAN bus, and an OBD connector that you can see on the left side of the instrument panel. And I investigated a tool that had a kind of peculiar function, and that is that you could obtain the vehicle pin, some kind of secret you needed to authenticate for diagnostics, by connecting this tool and toggling the ignition a couple of times. So that kind of gives you a hunch that the immobilization system might be involved, because it's triggered upon toggling the ignition, and that you can drive in some way the vehicle pin from this. So for this Peugeot, and for most PSA vehicles in general, the pin is a four digit uppercase and numeric code, excluding the O and I, because that would be confusing. So that leaves us with roughly 1.3 million keys, which is nothing in terms of crypto. I finally reversed the algorithm. It is obviously in the engine control module and the body control module. And the main part looked like, oh, wait, wait for it. And the protocol looks like this. So if you observe CAN traffic, you will see that some CAN ID 72 on that ID is sent a message that starts with double zero, and then followed by a four by challenge. And if the BCM is able to verify that the valid key is present, it will respond with zero four and a four by response. So this is a very small straightforward protocol, which does the bare necessary. And one of the first things I did was injecting challenges. Just inject a challenge, send it to the BCM with a valid key, and see what the response is going to be. And if I replace the zeros by dots, you see that an extremely apparent pattern is visible. So the ideal case that a single bit flip in a challenge lead to a 50-50 chance of a bit flip in every response bit is not exactly respected. You see that the effect of changing the challenge has a very localized effect on the response. Another weird feature, which is not very clearly visible here, but is visible in the last one, is that on average, when you give average just random challenges, 75% of the bits of the response will be set. So that is a very, very heavy bias. And it was quite puzzling to me what kind of cryptographic primitive would exhibit such behavior. And then it became clear. This is the main function of the algorithm. And there is a transform function that I left out, but it basically does some multiplication, some division, some modulo, but mathematical operations. It splits the challenge in two parts, and it splits the vehicle pin, so the secret, in two parts. And the total of four parts are all used as input for this transform function. And we obtain challenge transformed left, challenge transformed right, and similarly for the pin, a left and right transformed part. And then something interesting happens, because the left transformed part of the challenge is ordered with a part of the pin. And an OR operation will lead to, well, on average, 75% set result. So that kind of explains the weird behavior we saw before. Yeah, strange, and maybe not so smart. Because an adversary will be able to either control or observe the challenge that is used as input for this algorithm. So if you know the challenge, you know the transform challenge. And if you know the transform challenge, you know something about the output. Because if the transform challenge has a 1-bit, then the response will have a 1-bit in that same position. There is another property for the transform function, and that is that if the input is a 0, the further parameters of transform vary a bit, but it doesn't affect this property. If the input is a 0, the output is a 0. So that gives us that if you have a challenge of all 0s, you obtain a transform challenge of all 0s. And that means that when you're doing the OR, you're ORing with nothing, and the response will be entirely determined by the transformed pin. Another property is that the pin, which is an alphanumeric pin, is invertible once. Wait, let me restart. Transform, if it takes a pin as input, then the output can be inverted. There is only one pin part input that maps to one output of the transform function. So if you are able to supply the vehicle with a challenge of 0s, you will get one response, and you can uniquely identify the secret of the car, the pin. And this pin can later be used to, for instance, authenticate for diagnostics, or key teaching, or whatever you want. If you're not able to control the challenge, you can just collect a couple of random challenge responses, and you will still have the pin. So that's bad. What's worse is that there are a lot of collisions, because the bits that are set in the challenge transformed will hide the bits that are set in the pin transformed. So a challenge transformed with a lot of ones set will accept a lot of different pins as proper input and result in the same response. So there is a quite simple attack we can mount here, and that is that we get a challenge from the car without a valid key present, and we then compute for that challenge, for all pins, what response it would yield. And you will see that some responses are generated by a lot of different pins. It could easily be 2,000, 3,000 pins resulting in the same challenge. So you choose the most probable response and you send it. And either the ECU accepts it and disables immobilization, or it doesn't. And if it doesn't accept it, then you know for 3,000 pins that it was not that. In general, this takes far less than 4,000 attempts and far less than 15 minutes. I don't know exactly. I've tried it a couple of times, and I've been able to deactivate immobilization, I'll say, three minutes once, maybe 10 minutes once. And after that, if you toggle the ignition switch, the car will actually start without transponder present. So that was not so good. Next case is the Fiat. I investigated the Grande Punto, and I reverse engineered the BCM. It's based on the V850 architecture, which is a nice 32-bit risk architecture, pre-readable, pre-fair information density. But still, I couldn't really figure out what the actual crypto part was. So I also investigated an engine control module. Surprisingly, I was able to find it there. And then I immediately went back to the V850 because that, at least, is readable code. Protocol is as follows. It has a 32-bit challenge, then a 4-bit, sorry, yeah, 4-bit challenge, then a 2-bit byte proof of knowledge. And that's an interesting feature because that way, the engine control module proves to the body control module that it actually has knowledge of the key. So you cannot just spam a challenge and get a response for that. You have to prove that you know the secret. Then you get back a 2-byte response. And if that is correct, the ECM accepts it and the car can start. And this very, well, seemingly nice security feature that there is a proof of knowledge of the key is actually the flaw in this system as it turns out. The Cypher is a linear feedback shift register-based Cypher. It initializes the state with the key sort with the challenge, sort with some constant. And then it does 38 rounds. If you don't know what an LFSR is, I'll tell you in the next slide. Then it generates the proof. That is 12 rounds, actually 12-bits output. And if you look back in the protocol, you actually see that the first nibble is indeed a zero. So it's not 16-bits, but it's only 12-bits. After generating the proof, it loads an additional 16-bit constant, and then generates the 14-bit response. This is a fairly standard construction in crypto. And there is a fairly standard attack to it. So what you see here is an LFSR. It's a 32-bit register, and it operates in ticks. So it is loaded with this initial secret state at the beginning of the algorithm. And each tick, it takes four bits, and they are sorted together. Then the whole register shifts one position to the left. So bit zero goes to bit one, one to two, et cetera. Bit 31 shifts out, and the previously computed sort bit is shifted in in the zero position. So that way it cycles and continuously updates its internal state. And then there is an output function that takes eight bits of input. And each tick, it computes one bit from an eight-bit input. And on the lower left, you can see the output generation table. So it kind of just counts through this. And if the eight-bits together add up to, say, A2, then you pick bit position A2 in this table. And that is then the bit that is being generated as proof or response bit during that round. Now what we see here is that there is actually eight bits of the LFSR that determine the output bit. And of these eight bits, they generate so 256 different values. Now there are 256 different combinations. And only half will generate the observed output bit. So that means that 128 different options may be valid options for these eight bits to generate a response or a proof that we have observed earlier. And that is pretty interesting. And you can use that to construct a guess and determine attack, which means that you make an assumption on the internal state. We have 128 candidate internal states. And then we do a round. So we shift the guess bits one position to the left. We do the feedback function. And then we are going to evaluate the second bit that was generated. For the second bit, we already have some knowledge because we made assumptions earlier. So the green squares designate the bits that we already know. And you see that throughout the rounds, each round you can eliminate half the candidates because they generate the wrong output bit. And you need to guess less and less bits in order to fill in the state. And this continuous elimination of half the candidate states makes this far more efficient than just a brute force attack. The total complexity of this attack is 2 to the power of 21, which is orders of magnitude less than mounting a brute force attack. Right. So that's OK. That is fairly standard stuff in crypto. Now there is a big problem in the way they implemented this because they did some secret reuse. And the secret that is being used to generate the proof is, in some mangled way, the vehicle pin. If you take this 32-bit secret input value and you take the five rightmost nibbles and then transform the letters into numbers and then replace the zeros by sevens, then you get a five-digit number. And that number is the pin. So what we have now is an attack that observes a couple of challenges together with their proof of knowledge, which is always there. And you get it for free when you just power the ECU. And you run an attack on that. That takes, well, my not so optimized implementation takes six seconds on a single core. You can probably do better. Runs in seconds. And what you get is the pin. So you can still not authenticate towards the ECM. But you do get the pin, which you can then use to authenticate for diagnostic services. You can maybe read memory. You can maybe reprogram stuff. You can maybe enter key teaching mode. There are absolutely ways to leverage this and, well, get the car to start. The third case, I investigated, was an Opel Asta-H. And I've decided to skip the crypto parts in this one because I couldn't break it. And I wouldn't want to bore you with a fairly complicated algorithm and then not present an attack. If you're interested, it's in my thesis, so you can look it up. But there is still some funny things to point out here. I reverse engineered an ECM that was based on a PowerPC architecture microcontroller. And that is very nice because there is a decompiler for that. And Ida Pro will nicely transform the assembly into somewhat accurate, somewhat readable C code. That was good, but it was not enough. So I purchased some tool to use the BDM interface of this ECU, which was active and usable. And it took me a lot of time to get the tools working because virtual machines were not OK, et cetera, et cetera. I installed Windows and did crazy stuff. And then I was able to read memory, modify registers on the actual ECU. And that helped a great deal in debugging and finding the actual functions. So this is the protocol that I found. It has a 2 byte opcode, then 2 byte status data, then a 4 byte challenge. And similarly, 2 byte opcode for the response, 2 byte status data, 4 byte response. No proof of knowledge here, just a 32 bit, 232 bit challenge response authentication. And what was funny when I finally uncovered the algorithm is that this is not an algorithm that was designed by Opal. It is an algorithm that is used by a security transponder. It is used by the PCF7935 security transponder, which is the predecessor of Hitech 2, which you may be familiar with. It uses a 128-bit secret. So that is a really, really big secret. And a 32-bit internal state. And when I saw that, 32-bit internal state, I was like, OK, this is going to be doable. It wasn't. Because it does a lot of rounds between output moments, not as in the Fiat case, one round, one bit output. It does 34 rounds. And then it outputs two bits. And then it does another 34 rounds and two more bits. And during these 34 rounds, it mixes the whole 128-bit secret key into the state. There's so much distance between these moments that it is very, very hard to relate any of this information or have any usable assumption that survives so much new mixing of information. I did my best. I found some stuff, nothing that is usable to mountain attack. You can read my thesis if you're interested in the details. I found it funny to find an implementation of a security transponder in an engine while I, in the beginning of this talk, pointed out that the engine doesn't talk with a transponder. So I went back in time and I analyzed another vehicle, the Corsa model C, and found that this was different. This car had indeed an engine that talked with the key. And what probably happened is that they wanted to decouple development of engines and development of cars. So they could upgrade security transponders without replacing their engines or replacing their engine firmwares. So I think that is how this happened and why they just decided to, well, then implement the security transponder and emulate it in the body control module towards the engine. It seemed like a convenient solution, I guess. It is by far the strongest algorithm I have encountered in these three case studies. And while it is out of scope, because I limited myself to the actual cryptographic primitives, I felt the need to point out that the random number generator is really not very good. They use the tick counter of the CPU as source of randomness. And then they use a couple of constants that, if you Google them, direct you to the Netscape random number generator. So summing it up, we found that Peugeot used a tiny key space with only 1.3 million different possible pin codes. They leak a lot of information in the response. If you can inject a zero challenge, you immediately get the full secret. It has a lot of collisions, which makes it really not very robust against an adversary. Theod has a schoolbook algorithm, and it's vulnerable to a schoolbook attack. It's a nice idea to implement mutual authentication, but it doesn't really work in this context. And worse, they reused that part of the secret as the vehicle pin, as opposed to using the other part of the secret that is used to generate a response. That would have been the vehicle pin would not have been able to mount this attack. And lastly, Opal decided to clone an obsolete security transponder. The successor, High Tech 2, was desperately broken. This one wasn't, not by me. I have a master's degree, not in cryptanalysis. I'm not convinced that it's a secure transponder, but it is certainly better than the other two I analyzed. And also interesting is that all these three systems are still around in new vehicles. Maybe not all models, but they're still being manufactured. So I am curious to see how this relates to other manufacturers, other models. And I think it would be interesting to do some further research in this domain and see what else is out there. So to finish with a few takeaways, don't do your own crypto. It's often said and repeated, you are going to mess it up. Just use standardized cryptographic components and maybe try to get people that are actually security experts to implement it instead of hoping for the best. Don't reuse secrets. These two case studies revealed that reuse of secret made the attack much more powerful than it needed to be. Minimize the number of cryptographic protocols and cryptographic primitives that you're using. The more different primitives, the more attack service you create for an adversary. And lastly, as I mentioned before, there has been an arms race in transponder security. How is it possible that modern car key may be equipped with AES or other fairly secure cryptographic features? And these protocols that date from 1995 and such are still there, not replaced. Apparently, no one either figured it out or there are other very important reasons to just leave them there. So I hope that was interesting, maybe entertaining. And I'll happily take any questions you have for me. Thank you, Walter Boxlack. Thank you. You know the game, if you have questions. Oh, we already have questions. There are microphones. Microphones number one, two, seven, and two, two, eight. And the internet has questions already. So we start with the internet. Internet, please. Why don't make asthma use offerings of security or a malayet permission system? Oh, well, this is embedded security. This is not a PC or a smartphone security. It's embedded security. And I think automotive manufacturers do their best, but this is just not their game. And yeah, there is plenty of ways you could do this in a more secure manner. But they didn't. I cannot really say why not do it better. Of course, they should do it better. But I think it's understandable that, well, maybe a bit behind on this game that is relatively new to them. Thank you. And microphone number one. Hi. Amazing work. But I have a question. Did you find any simpler, more entertaining mistakes, like storing the pin in the open in other components in the car? Well, yeah, I did do some other stuff besides the three cases I presented here. I also investigated some authentication mechanisms for diagnostic functionality. And I didn't put them in my thesis because it's nice to have a clear message and a clear line of research. But I've seen authentications that are really pretty hilarious, such as challenge, secret, subtract, response. Answered? I think this is a yes. Microphone number two, please. Hi. Thank you for the talk. Two short questions. How did you specifically choose those three cars? And which parts or are parts of these flaws fixable in a later firmware, bootloader, software, coding, update, whatever? Yeah. OK. Yeah, I chose these cars mainly by availability. I didn't really cherry pick models. It was just at the place where I was doing my internship then I had some platforms to play around with. You have seen my very professional PSA setup that was the most professional I had. So yeah, this is what I had. And since I, in the end, found that they're still relevant right now, I think that wasn't really harmful in any way. It's still, it turns out to be a good choice. Your second question was? Can those flaws be fixed and updated? Well, in some sense, except that there is no real infrastructure to roll out updates. So all the cars that are out there, I don't think they are going to recall them to update firmware. Normal servicing? Yeah, you can do that. It takes time. So it doesn't incur costs for the manufacturer. But what you could do, for instance, is just use timeouts in the PSA case. Make sure it's not too easy to try lots of authentication attempts. It's not a fix, because it doesn't really fix it. But well, it's certainly a mitigation. It somewhat limits the impact. In the field case, it's a bit harder because you cannot really change an entire algorithm because there's different engines. And yeah, I think that would be quite unhassful. You really have to change the protocol there. Thank you. Thank you. Microphone number five, please. Are the secrets unique per car? And if so, how do you handle the case when one of the units has to get replaced? Yeah, the secrets are unique per car. And replacement frequently involves a procedure to couple the new ECU in the current system. And you just have to put the ECU there, connect to the ECU, and enter the vehicle pin. So that is quite probably also the reason that they reuse the secret. Because if you use a different secret, you have to have some kind of complicated secret sharing protocol that, well, brings the new ECU up to speed with the key material that's being used inside the vehicle. Thank you. Microphone number one, please. Hello. So what I'm struggling to understand here is why there was the need to decouple the communication in the first place and just split it in two. I can guess that it's so that the ECU can be trained on new keys. But then isn't it easier to just, instead of training like the ECU and telling, hey, this is the new keys key, just load the ECU key on the new transponder. So if I understand your question correctly, is that you wonder why we need two different authentication systems, one for the key to BCM and one for the engine to BCM and not use the simple model of having the key talk to the engine control module? That's correct. All right. You have to understand that engine development is done by different companies. And the same engine may be used in various different vehicles, maybe even from completely different ranges. And it is complicated to give these cars a different firmware. So it's definitely possible, but they just want to build an engine and build a car and have it work together. And another car with the same engine should also work. So it has to do with the process of developing vehicles. But then shouldn't also, I mean, I'm assuming that the part that talks to the transponder and talks to the engine still has to match the engine communication protocol anyway. So I mean, doesn't the car producer still have to match the engine protocol anyway at some point? So why just not implement it on the key in the first place? Yeah. Well, this is all speculation from my side as well. I have no inside information as to why they did this. But I can imagine ways that they could fix this and they don't do it. And my experience is that generally this has to do with legacy and compatibility issues. They could also just embed five algorithms in the BCM or the engine control module and just, by configuration, choose the one that fits for that vehicle. I have no idea why they don't do that. But once again, these are not software companies. These are automotive companies. Awesome. Thanks. Thank you. Microphone number three, please. Thank you for the great talk. Once we have the OBD connected to the internet, and do you see any other complication that could prevent me to hack the car remotely from there? OBD connected to the internet. Now, well, no. Once you have OBD access, so you can use the OBD port, you can do a lot. There are cars that use a gateway that is some kind of filter or you have to authenticate towards it before you can access the internals of the vehicle. So it really depends on the model. It depends on the manufacturer to which extent you have room to maneuver there. For some, it will be super easy. For some, it will be a lot of work. For some, it might be impossible. But you certainly have a very, very good starting point. Thank you. Microphone number one, please. Hello. Did you spot any kind of anti-brute force measures during your analysis? That's question number one. And question number two is, obviously, you had access to the internal communication between the BCM and ECM. But where those attacks that's successful on Fiat and Peugeot, are they doable using just the OBD to port? Or do you actually need to see the internal communications? I tried to point out in the beginning of my talk that I carry out all the attacks presented. And I focused only on functionality that is exposed through OBD. So yes, I did some stuff on the hardware of the ECUs. But that was just for research. So the attacks are absolutely doable over OBD. OK, and the previous question, which was already partially answered, so no locking out after five failed trials of? Yeah, yeah. I think? I did find something that was peculiar in the PSA case. And that is that if you, let me think, there is rate limiting implemented in the PSA on the engine control module. Is that right? No, on the body control module. And that means that if you spam challenges, it will at some point no longer give you the response, which sounds like a good idea, rate limiting. But they did it on the wrong side. Great, thank you. Thank you. Microphone number two, please. Have you spotted some kind of relationship between public identifier of the car and the secret used to authenticate in the service? So if the VIN in some ways could be converted in the secret, the pin code of the car. No, I see where you had it. But I haven't spotted anything like that. OK, thanks. Questions from the internet? No more. No more. In this case, ladies and gentlemen, bedankt Wouter Boxlack. Thank you very much.


What's the address? City City a city is an area where people live that is larger than a town but smaller than a state or country Olympia Tacoma Spokane and Seattle are cities in Washington State a state is a part of a country that has its own government But that follows the laws and rules of the whole country. There are 50 states in the United States Digit a digit is a written symbol for a number from zero to nine both phone numbers and addresses contain digits Phone number a phone number is the set of numbers that you use to call someone on the telephone Phone numbers can be seven or ten digits long Area code an area code is the first three digits in a phone number It tells what part of the state the number comes from the area codes in Washington are five zero nine three six zero two five three four two five and two zero six Address an address is a group of words and numbers that tells where a place is a Complete address includes a number the street name the state the city and the zip code zip code or zip a Zip code is a postal code used by the US post office zip codes can be five or nine digits For example a five-digit zip code is nine eight five zero four and a nine-digit zip code is zero two two zero one dash one zero two zero Abbreviation an abbreviation is a shorter way to write a word using only some of the letters in the word Some examples of abbreviations are st Av and blvd ST ST is the abbreviation for street when we write an address We usually use the abbreviation for street for example eight five six Foss Street Av Av is the abbreviation for Avenue when we write an address. We usually use the abbreviation for Avenue for example nine eight six five beacon Av NSEW NSEW are abbreviations for the direction words north south east and west Some street addresses include a direction word for example 1400 East State Street APT APT is the abbreviation for apartment when you live in an apartment you include the apartment number in your address for example 56 North Plum Street apartment number for B The end


Yes, we have 52 and we're growing. I'm Marcy Wingrad, coordinator of Code Ping Congress with Medea Benjamin, my co-host. And tonight's a very special night because this show will be hosted by members of the Youth Peace Collective as we look at abolishing the selective service and not signing women up for future wars, which is what some Congress members would like to do. I will also discuss sexual harassment and sexual assault in the military and how that relates to U.S. foreign policy. I'd like to introduce our co-host tonight on the Youth Peace Collective organized. Danika Katowicz is the Middle East and Peace Collective coordinator. You've met her before on Code Ping Congress. Danika graduated from DePaul University with a bachelor's degree in political science. Since 2018, she has been working towards ending U.S. participation in the war on Yemen. At Code Ping, as I mentioned, she works on youth outreach as a facilitator of the Peace Collective, Code Ping's youth cohort that focuses on anti-imperialist education and divestment. Welcome, Danika. With Danika tonight, we have another member of the Code Ping Youth Peace Collective, Isaac Roth Blumfeld. He is a composer and sound artist living in New York City. Danika is coming to us from Chicago. As an activist, Isaac has worked on focusing on Jewish-American community support for Israel's, for advocating for Palestine and for Palestinian rights. Whoa, and Isaac is thrilled to be working with us tonight and to be part of the anti-war movement. I turn it over to you, Danika and Isaac, thank you. Thank you so much, Marcy. And everyone remember to introduce yourselves in the chat and we're gonna hear from speakers, but to remember to stay after the speakers for our Capitol Hill calling party. But first, for some updates, Al Jazeera reported that Norway's largest pension fund announced that it's divested assets in 16 companies for their links to Israeli settlements in the occupied West Bank, including telecom equipment giant Motorola. From Associated Press, top Biden administration officials hosted a brother to Saudi Arabia's powerful crown prince, Muhammad bin Salman. In the highest level, such a visit known since the U.S. made public intelligent findings linked to the crown prince killing of a journalist, Jamal Khashoggi. And the Biden administration did not make this meeting public and they didn't disclose the meeting in advance. This comes at a time when Saudi dissidents and Saudi prisoners of conscience still remain in prison. Women's rights defender, Lou Jean Al Hathlou is still on a five-year travel ban out of Saudi Arabia and her families also cannot exit Saudi Arabia in the meantime. Meanwhile, today in Santa Clara, California, Hands Off Yemen was outside of Representative Rokana's office asking him that he introduce a war-pourish resolution. And today we also remember Philando Castile who was shot by St. Anthony police officer, Toronto Mo Yanis five years ago today on July 6th, 2016. Philando was a beloved employee of the St. Paul Public School System as a supervisor in the Nutrition Services Department. And Medea, do you have any updates on Cuba for us? Yes, there is a fantastic march that's happening from Miami, the heart of right wing Cuban-Americans, but these are progressive Cuban-Americans and they are marching all the way in the hot sun to Washington, D.C., where they will arrive on July 25th and we're organizing a big gathering to greet them when they come in. I'll put in the chat something about the trip up because if you're anywhere along the Atlantic Coast on the way between Washington and D.C., they might be passing through your city. We're doing events every evening. And so when they get to D.C., we're gonna have a big rally in Lafayette Park and people are coming from different parts of the country. I know there's people flying in from Miami. So if there's any of you that can make it, we're gonna have a lot of events that day and the following week be doing lobbying to try to push Congress and the administration to do something about lifting the blockade on Cuba. We also have a syringes campaign that we've been raising money to help Cuba buy the syringes it needs and now we are over $400,000. It took us two months to get GoFundMe to actually let us put up a GoFundMe because you put the word Cuba in and they suddenly have 10,000 questions for you. So even though we're starting to, it's towards the end of our fundraising, we just opened up the GoFundMe and I'll put that in the chat as well. Even if you can just give $10, $5, $20, whatever you can give, it's good to show GoFundMe that people care about Cuba. And then we also are organizing a flotilla from Key West, I'll put the chat there. There are different organizations, we hope veterans for peace, Adrienne, National Lawyers Guild, some other groups are going to buy very inexpensive votes to make their way from Key West to Havana in case they're confiscated by the Biden administration. So it will be a good challenge to his ridiculous policy. And lastly, I wanna say that there are other travel opportunities. We're organizing a trip to Honduras for the elections there in November. And we have a trip to China that will be happening in the summer of 2022. So those are my updates, thank you. Thank you, Medea. Wow, Code Pink has been busy. That's so inspiring, $400,000 to send syringes to Cuba. I'd like to give an update on the, I'd hate to say defense, well, Department of Defense Department of Energy's submissions for military spending for 2022. Congress right now is the appropriations committees are marking up the bills, writing the bills that will be voted on, I imagine after the August recess, that's when they'll be looking at the details of the National Defense Authorization Act, the NDAA. In the meantime, Code Pink is sending out a petition next week urging everyone to contact members of the House Armed Services Committee to say, we don't want new nuclear weapons. And we absolutely do not want a new submarine, a nuclear-tipped cruise missile submarine. This is a submarine that's capable of carrying both conventional and nuclear weapons and an adversary might not know what this weapon is that's being aimed at them. So it's very scary and could increase the likelihood of an accidental launch. In addition to that, I wanted to report that a number of organizations, including a nuclear watch New Mexico is suing the federal government over the plan for replacing the 400 Minuteman missiles with 600 new underground missiles in Wyoming, Nebraska, Montana and North Dakota. Specifically, they're suing the government over its plan to ramp up production of plutonium pits. Plutonium pit is the core of the nuclear weapon. It's the trigger. And currently, I guess the most that these laboratories, for example, at Los Alamos in New Mexico and Savannah River in South Carolina have produced is 20 plutonium pits. And now they want to ramp it up to 80 plutonium pits. The Department of Energy held some public comment periods on this in 2020, one for Savannah River, one for Los Alamos, but not a comprehensive one. And there are a few more sites that may be involved in the production of these pits. So the point is we want to support them. And I imagine Code Pink will be sending out an alert. I'll send out an alert to the Google group. If you're not on it, please request to be on it in the chat. We will ask members of Congress, for example, Katie Porter, who I believe is a mover and shaker on the oversight committee, to hold some hearings, to look into why haven't we had a period of comprehensive public comment, which they've had in the past on big projects like this. So that's my update. Thank you. Thank you, Marcy.  No. OK. All right, thank you so much, Marcy. So for today's program, we're going to hear from our first speaker, Rivera Sun, and our second speaker, Ed Hasbrook. And then our third speaker, Adrian Kinney, for about seven minutes each. Then we'll have a 10-minute Q&A session. And then make sure to stay for our Capitol Hill calling party. Our first speaker is activist and author Rivera Sun. She's a Code Pink member and also serves on the advisory board of World Beyond War. She's written numerous books and novels, including the Dandelion Insurrection and award winning RERA series. Rivera is the editor of Non-Violence News and part of the network working to abolish the military draft system for people of all genders. And her website is www.RiveraSun.com. And I thank you so much for being here today, Rivera. And I'll pass it over to you. Thank you so much, Danica. And thank you to everyone at Code Pink for hosting this Capitol Congress calling party and putting the issue of the expansion of the draft onto the schedule. So maybe you've heard about this. Maybe you haven't heard about this. But now that the military, the US military, is required to allow women to aspire to all positions within the military if they enlist, a group of anti-feminist men, let's say, pro-men's group, sued to actually expand the draft to women, because they think it'd be fair if women got drafted along with men. Well, that's only one way to look at this issue. So I want you to just think for a minute, if you are a man on this call, thank you for being on this call and just raise your hand if you have actually had to register for the draft. It's probably every single one of you. Right, Isaac's nodding over there, raising his hand.  And that should be every single one of you. So this is one of the few privileges, quote unquote, that women have enjoyed, that men have not enjoyed. And now they'd like to create gender justice by get this, drafting women as well. But gender justice is not found by subjecting women to an injustice experienced by men. Gender justice is found by liberating men from an injustice that they bear that women are already free from. So I grew up hearing stories about my dad as a content subjector, as an anti-Vietnam War organizer, as someone who would help people flee the country when they were drafted. And so when I heard that the Congress was thinking about drafting young women, I stood up very boldly and said, this is wrong. It's completely wrong. Now the cool thing is that they have a choice. Congress doesn't have to draft young women and they don't have to keep drafting young men. There is a bipartisan bill that has been introduced in the House and in the Senate that calls for the repeal of the entire selective service system. And it's being supported by feminists like myself, anti-war advocates, people who oppose militarism, and then people who maybe don't care about any of those things but think it's a good example of wasteful government spending because even the former head of the selective service said that this is an outdated and wasteful system that is not doing its job. When we think about what gender justice would look like around this issue, the only just answer is to repeal the selective service for all genders. If we think of this in terms of what the draft actually is, which is involuntary conscription into the military, basically involuntary servitude, which is another word for slavery. And we've already had this conversation in the United States. It wouldn't make it right to enslave yet another group of people in addition to African-Americans in slavery times, right? It doesn't make it more just to subject yet another group to an injustice. The way we find justice is to liberate both groups from the threat of this injustice. So this seems very logical to me. I hope it seems logical to you, but apparently it doesn't sound very logical to pro-war feminists who have been trying to advance the military draft. That's why we need you to call your Congress members and explain this to them very nicely that they have a great out. Nobody really wants to expand the draft to women. They're all kind of tiptoeing around it. They're trying to avoid it. Nobody really wants to like spearhead this charge because they know that both the feminists will get on their case. The peace activists like us will get on their case and the sexists who don't think women can do anything will get on their case. But they need to know there is an out and that they can repeal the selective service and that this is actually the best historic moment for them to do so when the pressure is on them to create gender justice. And when we don't really need a draft, we haven't had an act of draft since Vietnam. We don't really need to use it in the wars that we're fighting. And if you're here for Code Pink, then you already know that we don't want to give them an endless cannon fodder credit card to subject young people's bodies to expanding and fighting their already obscene wars. So the other point to consider, and this comes up a lot and so I'm just gonna bring it right up, is that many times when I'm talking about why it's time to abolish the selective service, people start to say, well, doesn't that put an unfair burden on poor people and people of color who are already subjected to the poverty draft? Wouldn't it be better to draft everyone and then everyone supposedly equally serves? This is yet another one of those examples of false logic. The way to solve the poverty draft problem is not to draft all young people against their will. The way to solve it is to make affordable college education or jobs guarantee opportunities for people in that regard so that nobody is signing up for the military to simply get a college education or employment. We think it's really important that we take advantage of this moment when Congress needs to make a decision about this. They could dance around it for another 10 years but they're probably going to make a decision. They've already put some hints that they're gonna roll the expansion of the draft into the next NDAA. We're trying to stop that. But your Congress people need to hear from you because they need to know that women especially and young women especially and those who are feminists of other genders are really clear that feminism which has historically stood up for the rights of men as well as women for gender equality not just women over men but for men and women and people defining gender differently to share equality says that the way we're going to resolve this situation according to feminism is to end the draft system for everyone. So we will make sure that the bill number gets into the chat box. I'm sure my colleague Edward can help me out with that. I also want to let you know that there are a lot of groups and organizations backing these bills to abolish the selective service. Code pink of course will be on war, center on war and conscious even veterans for peace has now endorsed it. It enjoys the endorsement of Ilan Omar which is wonderful and Eleanor Holmes Norton from DC and Mark Polkin who's the chair of the LGBTQ caucus. And I just want to give a little hat tip to LGBTQ persons because they have really set the bar for understanding the politics of liberation versus the politics of simply inclusion that as feminists we want to liberate everyone from an unjust system which is drafting women and men against their will and we will not accept the notion that feminism can be achieved through enlisting our bodies to fight in unjust wars that cause untold trauma and devastation around the world. So I thank you for this time and I'm just going to pass it over to my colleague Edward which I think Isaac is going to introduce. Thank you so much Rivera for that really great informative overview of this whole situation. Our next speaker is Edward Hasbrook. He's an activist against the draft and for peace human rights and youth liberation. From 1980 to 1991, he worked with the National Resistance Committee and local draft resistance collectives in Chicago, Boston and San Francisco and as co-editor of Resistance News the national journal of the draft registration resistance movement. He was convicted in 1982 of willful refusal to present himself for and submit to registration with the selective service system and served four and a half months in a federal prison camp in 1983 to 1984. He is one of only 20 people who were selected for prosecution for refusing to register in the 1980s before enforcement of the registration requirement was abandoned in 1988. He was prosecuted by ex-Marien Robert S. Mueller III in one of Mueller's first high-profile cases as an assistant US attorney. Ed, we're ready to hear from you. Thank you so much. Thank you so much, Isaac. It's an honor to be here with a group like Code Pink that's certainly been in the forefront of articulating the argument that- But we can't hear you well, Ed. We need you to speak up. Hi, can you hear me now? Much better. Yeah, but even closer, louder. All right, sorry about that. It's an honor to be here with a group like Code Pink that's certainly been in the forefront of articulating the argument that war and militarism are part of the patriarchy. I wanna speak to a question that I think implicitly, Medea was getting at in the chat and that others may have in their minds as to why this even matters if it seems like the draft probably isn't that imminent. Anyway, and why are we talking about this now? Where did this come from? The present requirement for men to register with the draft and actually to report, every time they change their address until they turn 26 so the government knows where to find them, which almost nobody complies with, dates back to 1980 as part of a resurgence of American militarism in the post-Vietnam era. And from the start, it's been a failure. Most young people don't comply and it proved unenforceable as the introduction suggested. It became quite clear early on that it was not going to be unenforceable. Even the former director of selective service as Rivera alluded to said recently that the current database is so incomplete and inaccurate that it would be less than useless for an actual draft. So why has the government put such a priority on continuing a program that's failed? Well, because the government does not want to admit that its actions are constrained by popular willingness to comply. That would empower the resistance, that would empower young people, that would empower the peace movement and it would require the government beginning to incorporate popular support or lack of support for war into its war planning, something that is adamantly opposed to. So for decades, we've had a stalemate where draft registration remained on the books, but there was no face saving way for Congress to end it. So as a result of a court case challenging the current requirement for men but not women to register, this got put back on the congressional agenda. Congress debated it five years ago, stalled by appointing a national commission which I testified before and Rivera and I were part of meetings with them, although it turned out they'd already made up their minds months before they talked to any anti-draft activists. And now this year, bills have been introduced in Congress, one to find the end draft registration but the other officially endorsed both by President Biden and by my unfortunate representative in Congress, Speaker Nancy Pelosi of San Francisco, that would double down on the failure of draft registration for men by trying to expand it to women as well.  It's been evading for decades and this is our best chance. If we don't get this address this year, it could go back on the back burner and the government could go along continuing to pretend that the draft is always an option. It's not their first choice. They'd rather use active duty troops or turn to the reserves, the National Guard. But as we heard before the National Commission, they really want to have the draft in their back pocket as a fallback so that there's always something to fall back on. Why? Because they don't want to have to think about limits on their war making or their war planning. And this is why this is so important. I think there's a common misperception that supporting draft resistance is about protecting young people against the draft. But the primary victims of a draft are not the draftees, but the people, primarily civilians, many of the women against whom draftees would be weaponized and deployed in war. And the real phenomenon that's going on here through resistance to draft registration, ongoing spontaneous sustained over decades by generations of young people is that young people are taking leadership in protecting all of us from war. And it's up to us older people to push this across the finish line to get Congress to acknowledge that the draft is not a possibility and more importantly to begin to incorporate that recognition about constraints and limits to war into their war planning. And in an era when the primary peace issue or certainly a primary peace issue is the government's insistence on waging and preparing for endless ever-growing war without limits, this is a concrete place where popular direct action can put constraints on war making and change the narrative about war and war planning to one that begins to take into consideration the constraint that this place is on war. I was at a talk not long ago with Daniel Ellsberg where he talked about, was asked about this. He said, yeah, sure, we've been able to fight wars without a draft, but if we'd had a draft, those wars would have been even larger and worse over the past decades. I'd flip it the same way. We'll have wars with or without a draft, but if we take the draft off the table as part of the war maker's arsenals, we can begin to constrain that ability of the government to wage war. That's why this is so important. And that's why it's so important to take advantage of this opportunity. I've been involved in the anti-draft movement and the draft resistance movement for 40 years. And I say without exaggeration, that the coming month is the most critical month in that 40 years because we have Congress finally being poised to make a decision it's been put off. This is a tremendous opportunity. This is one of the greatest victories of the peace movement in decades, actually, that we've stopped a draft and we've gotten close to getting that prevention of a draft admitted by the government. Let's carry this through the last mile. Let's support young people and their leadership for peace. Let's help them protect us all against war by letting Congress know that the right way to move forward is to end the draft. There's a letter that Rebara and I and leaders of Vets for Peace and other groups sent to the House Armed Services Committee where this is gonna be taken up on July 28th. Earlier this year, we said, this is a choice about militarism, not a choice about gender equality. Expanding draft registration to women would bring about a semblance of equality and war, although women in the military would still likely be subject to disproportionate sexual harassment and abuse. The next topic in this webinar, so stick around, ending draft registration would bring about real equality in peace and freedom. Let's help make that a reality. Thank you. Thank you so much. And I just wanna remind everyone, if you have any questions throughout the event, please put it in the chat. We'll direct them at our speakers after our last speaker is done. Thank you so much, Edward, for that. Our next speaker is Adrienne Kinney. She's the president of Veterans for Peace. She served in the U.S. Army and Army Reserves from 1994 through 2004 as an Arabic linguist in military intelligence. She was activated in the reserves for two years following the events of 9-11 and served stateside in direct support of operations in Iraq and Afghanistan as a voice interceptor. She worked in the Department of Veterans Affairs as a health science specialist in psychology and as the New England Regional Coordinator for Iraq Veterans Against the War. She is currently living in Vermont. And go ahead, Adrienne. Thank you so much for being here. Yeah, thank you. It's been an incredibly fascinating topic and discussion so far. And I was just thinking, listening about the selective service and people trying to push women to have to register for the draft.  Despite the fact that the military has over the past 20 years said that they are doing everything they can to try to address military sexual trauma, it is still a problem. The rates have gone up over the past year. And despite efforts over the past 20 years to remove the chain of command from the investigating process and put it into the competent external hands of an impartial body that has yet again stalled. Unfortunately, Chris Angelo Brand's bill that would have moved the investigations of military sexual assaults out of the immediate chain of command in the military was filibustered. So we yet again hope that perhaps the military will see some sense, but regardless, it's deplorable. I have always thought that it's deplorable that when kids go to join the military, they are not, recruiters are not mandated to give full disclosure about the possible harms that they may experience as a result of their service. And by far and large, the perpetrators are members of the military. So, a lot of this is stuff we already know. Military sexual harassment, military sexual assault in the military in the United States is incredibly high. It is high for women and for men. It's statistically a higher proportion of women are assaulted in the military. If you look at the numbers though, males are more likely because there are more men in the military, there are more males who have been subjected to sexual harassment and sexual assault in the military. So as we know, military sexual trauma comes with a whole host of lifelong repercussions to include depression, anxiety, MST, PTSD, physical problems, chronic pain, problems with weight, infertility. And I would say that for me, I think about this a lot. I was a counselor, my last job in the VA was five years as a readjustment counselor in Vermont. And the numbers of women that I saw serving from the 80s right through today who had experienced military sexual trauma and then retaliation and eventually being kicked out of the military. Some of them losing their military benefits as a result. It's frustrating and infuriating and not taken seriously enough by I think anybody because in the United States we have this hero worship complex where there's this constant bombardment in the media that we have to support our troops and honor our heroes. And essentially acting as if the military and members who serve are godlike. And that requires the people, the Americans to turn a blind eye to the horrors that go on in the military. And the Congress and the Pentagon certainly aided in about that happening as we've seen by them for solving any attempt to bring in some really basic standard external oversight that most of our allies have already embraced and as part of their judicial process within the military they already embrace the idea of external people coming in and investigating and taking it far more seriously than the United States does. And I would say that that is incredibly directed and connected to US imperialism. I mean, the United States we want Americans to think of everybody else as lesser human beings that's certainly part of military training. In basic training they break you down and they build you up in the image of what would be best serving a serving soldier and the goal of the military and the goal of the military is to go along with US imperialism. And as a result, I sought myself in basic training. You, they pet soldier against soldier, unit against unit, squad against squad, heck, the army versus navy. The military uses our own soldiers to get us to dehumanize one another. No wonder that has, just horrific ramifications for everybody involved but certainly for people who are subjected to military sexual assault and rape. And you know what? I have to say that is a member of a veterans organization over the 10 plus 15 years I have been doing peace work. I have seen it within veterans groups that are connected with peace work.  And unfortunately too few peace activists realize the interconnectedness of all of these issues that we face and how, you know, we've had, we've had members of veterans for peace upset that members want to Black Lives Matter rallies because they say we're not supposed to be here to oppose racism, we're here to oppose war. But then they don't see the connection between racism here in our country and the racism that we unleash and use as a reason to motivate people to want to invade other countries. And it's the same with views towards women. It's all about dehumanizing and otherizing people and it is completely connected with everything the United States does in the world. And it definitely, I think hinders unless we're able to talk about it freely and openly our ability to actually work towards lasting peace as peace activists. And so I don't know, I know that there is, there's been a lot of work that has been done. I have been really fortunate to see veterans for peace take a lot of steps to try and address how we all interact with each other and how we treat each other as members of the FD. But yeah, there's pushback, you know? For instance, in the chain of command in the military say some officer knows some guy who some woman says, assaulted her and their friends and they dismissed the case. They don't want to take it because obviously she's lying. You know, I see the same thing in our organization where people will dismiss bad behavior because they're like this person has been a peace activist or this person has been here, I don't believe it or I don't think it is bad enough to dismiss all the decades of peace work that they have done. It's the same, you know, there are other veterans organizations too, common defense has gone through its own issues where they had a whole rash of women, particularly BIPOC women who resigned very publicly because they said they were hired to make the organization look good but when actually came time to them sharing their opinions and being taken seriously, they were ridiculed and dismissed and so they quit. And I unfortunately, yeah, it's a lot of stuff that still kind of, I'm personally working through as a member of Veterans for Peace who is also incredibly committed to our effort to work for peace and social justice in the world forever for everyone. So that is my spiel and I appreciate you all having the space in this time and continuing the discussion. Thank you. Great, thank you so much, Adrienne and to all of our speakers for their great points and a great conversation so far. Now we're gonna open it up for about 10 minutes of Q&A and we have some great questions in the chat already and if you have any more questions that come up, feel free to either raise your hand or put them in the chat. Great, so I think Danica, we have a first question. Yes, this one is from Medea. I think this will be directed to either Ed or Rivera. Don't these new hybrid wars require fewer people in the military, drones, proxy wars, special operations? Do they require less people? Basically, yes, but again, keeping, as I said, keeping the draft in the arsenal of policy options is not because they can come up with any plausible scenario. When the National Commission was questioning me, the best scenario they could come up with for when they would want a draft was suppose we're being invaded simultaneously from Mexico and Canada and there aren't enough volunteers to defend the country. It's not realistic, but it's not about actual wanting a draft, it's wanting to be able to plan for war without limits. Just the very, it's the idea of putting any constraint that's the problem for them. So another question that came up for Rivera is how do you think we can best mobilize young people to resist the draft and call for the abolishment of the draft? Yeah, great, great question. So in my personal experience, it's not hard to get young people fired up about this. Particularly young women, as soon as they hear about it, they're like, what? Say what? The challenge to all of us in our peace organizations is to make sure that we're saying this, that we're making sure our membership knows about it, that we make sure that our membership reaches out to the young people in their life and that we work with young people to come up with strategic actions which seem viable and successful, including legislative pressure, but also including sharing stories like Edwards and other people who have been draft resistors to know that, if we want Congress to ditch this idea, we want them to abolish the selective service, we have a long history of draft resistance and we know how to do it and we know how to raise that specter up high enough, but it makes possible the realistic threat that was lifted in the 80s when Edward was resisting that people will not just go along with this blindly. So yeah, trust the young people, they have a great sense of justice. Make sure that we're doing the groundwork as allies across intergenerational organizing to get the message out there because we know that if you wanna reach draft age people, their moms or dads or aunties, their teachers in public universities, college institutions are gonna be really important allies and make sure the key points about why it is important to stop the draft, get made, thanks. Thank you. I'll direct this one from Richard to Adrienne asking about sexual trauma perpetrated by US military onto civilian populations and countries occupied militarily by the US. So I guess this question is about like, how do we hold the military accountable for sexual violence kind of as a whole? I think that's what the question's asking. I would say that we get the United States to withdraw troops and close our bases overseas, period. My experience in Okinawa, despite any effort that the military has to try and be a good neighbor to the communities that they're nearby, it's hogwash. And honestly, very few times have I ever seen or heard of somebody who is perpetrated or rape against somebody in the civilian, in the local environment being prosecuted. I don't know if that's change, but certainly it seems like the military has always been there about saying that this is somebody who has to be subjected to the military code of justice, which is code for nothing happens. And I don't know if that has changed, but considering how little military chain of command takes seriously military sexual assault and rape against our own soldiers, I doubt that is very different in bases overseas. And another question that came up kind of for whoever has an answer for this is, does the training that service people go through that includes dehumanizing the enemy also lead to dehumanizing women or dehumanizing others general? I mean, when you go through basic, they don't say this is the enemy. Like there's no way to target that dehumanization process to an external other. Heck, even a station in the United States, we were told what areas in our local neighborhood like off post not to go to, because it was deemed unsafe or unfit for service members. So, there's the idea that even Americans are somehow ill fit or unsafe to be around and to be thought of less. Thank you, Adrienne. This next question is from Leonard. This can either go to Rivera, right? I think Elizabeth Warren comes from a military family, but is on our side on most issues. What is her position on this one? I assume that means that's about abolishing the draft. And I see some chatter about Elizabeth Warren in the chat, so it would be a good thing to address too. Yeah, well, Elizabeth Warren is one of those who's undecided. She's actually in a key position, so I'd particularly encourage those of you in her district. She is somebody to target. She's on the subcommittee on military personnel of the Senate Armed Services Committee. There are a large number of key people who are undecided, some of whom have said to activists that they're looking for input. And I think it's partly trying to get arguments, but it's much more, they're trying to do sort of assess which way the political wins blow. And they may not be persuaded not to like a draft, although I think most of them know that really it's not that realistic. What they need to know is that there's political support for their taking a position against the draft that it's not gonna be something that they're gonna get flayed on. And they also need to know that if they support expanding draft registration to women, that there are people that there are young women who will resist and that there are old people, men and women who will support them. They're really taking the temperature of what the political opposition to trying to force women to sign up for the draft would be, they need to hear from people saying, look, are you prepared to lock me up? Are you prepared to put our movement on trial? Are you prepared to face the kind of sympathetic defendants that that would create? And what exactly is your enforcement plan? Given that you haven't been able to get this to work for men, you think that women are pushovers and it'll be easier to drag them in to fight a war they don't wanna fight. What are you doing? So they really do need to hear from you on that and Warren is certainly among those. This is another kind of question on the same topic from Toby saying, many people, including sometimes people who are activists against war and for peace argue that we should have a return to the draft because there would be more citizens who would protest and resist US wars, which would decrease the US government's success. And even if you don't agree with this, what is your response to that idea that a draft could maybe create more anti-war sentiment? Yeah, thank you. It's a great question. It gets raised a lot. The challenge with that thinking is that historically it hasn't always been true. It certainly was true with Vietnam, but it wasn't true in other wars that we've had drafts with. So first of all, it's a risky strategy for the peace movement. Second of all, it's a morally bankrupt strategy for the peace movement. Because what that means is that we are accepting that something like 30,000 young people if we're gonna use Vietnam as an example are gonna get drafted and killed in the process of pursuing peace. That is morally bankrupt of us to assume and prepare for as a peace movement. It is not an okay strategy to let stand to replicate to say that we're planning on this. Of course, if there's a draft, probably people are gonna get upset about it, but we need to be better activists than that.  And even beyond that, if we want to really fight militarism, really fight the war machine, then we need to make sure that our young people are not having to sign up to be participant in it as a right of passage. This is literally language they use on this commission as a right of passage to becoming adults, right? So we need to challenge ourselves as a peace movement to push back on that one. Thanks for that question though. Thank you, Rivera. Basil has tied his hand up. We'll have this be our last question. Basil, if you wanna unmute and ask your question, you can go ahead.  Oh, I can't, you're, oh, there you go. First of all, hello, everybody. How are you doing? I was invited to this by Hennett and I and Marcy. And I must say, this is what war looks like. For those who can't see it closely, that's what it looks like. I'm not for war at all. One of my issues, I just have to be currently the vice chair of the Democratic Party of Independence Caucus.  Let me give you an example. When you have a private, maybe you have a sergeant. And let's say a sergeant male has sexually hit a female. Well, where does that female go? She can't go to the next one up or the one before him. And if she tries to go above him, he gets railroaded. So I'm totally against that. And I would love to work with Adrian as I text you, you are absolutely right. Everything you have said is absolutely correct. I just got on and I heard part of it. And so whatever I can do as activists as well, I would love to help. I go to 55 million people daily. My wife and I are different blogs. I really appreciate what I've been hearing since I've been on. I didn't realize we had so many people my age on this. I'm so happy to see that as well. But you are correct. We have to address the young ones. When I went in, it was like G.I. Joe, G.I. Joe, G.I. Joe.  But no one told us about the after effects until years later. And I think that our women that are there now, they need to be protected. And this draft system, man, I need more information, but I came from the war where take me I'll go. But what I've seen of war and what I have on my arm, I'm definitely for veterans for peace. I would like to be part of that organization as well. And anything that I can do to help. I'm in guys, I'm in, I'm all in. Just someone call me and tell me what the deal is. I was surprised that you only have one African-American audience, which is me. There are a whole lot of African-American men and women who've been there who would love to have been on this to voice their opinion, but. Basil, this is Marcy and you can help us expand. Oh, Marcy, where are you? Oh, you're the one with the people? Oh, Marcy and Jamie, I support at 100%. Okay. Come on in, Marcy, come on in. Anyway, thank you so much, Basil. And have a great week. Thank you. I think now what's happening, Danika, we're gonna go to the calling part. Yes, that sounds good. I'll pass it over to you. Okay. Thank you all, our guests. Let's unmute and thank our guests. Thank you.