Okay, well thanks for being here. I don't know if this is actually working that well if you can't hear in the back now. This is just a microphone. Let's put it back down. Can you guys hear me? Okay, I'll try to talk this loud. I'm Terrell McSweeney. I'm a Federal Trade Commissioner. I'm Joe Calendrino. I'm the Research Director of the Federal Trade Commission's OTEC Group, which is their Office of Technology Research and Investigation. I tend to be a little bit of a low talker, so definitely just yell at me if I'm not speaking loud enough for you. Yeah, so do I. I think the title of this talk was originally like, is your internet light on or something like that, but what we wanted to do was really talk a little bit about what the FDC has been doing as it relates to the security of IOT products and then engage in a conversation and answer any questions about the kinds of things that we're really looking to partner with the research community on. I guess we also have to disclaim that we're here speaking in our individual capacities, not on behalf of the FTC, because like that way we get to have a candid conversation about this stuff. So the first thing I would say is the Federal Trade Commission is a consumer protection agency. We're a hundred years old, so what the heck are we doing having to talk at DEFCON about IOT data security? Well, it's a good question. We basically bring cases when we think that consumers are going to be harmed. So we use an authority using the FTC Act to bring cases against unfair deceptive acts and practices. And what that means in the IOT space is if data security is unreasonable and consumers are harmed, we can bring a case. Or if someone is making claims about the security of their product, but those aren't accurate claims, those are deceptive claims, we can bring a case. So we've actually started to bring a number of IOT related cases. We've been studying IOT very carefully and I think it's probably no surprise to anybody in the room that we found that this is a very poorest security environment for consumers. So you want to say a little bit about why you're here? Okay. So I'm here because I'm a technologist like most of the other people in the room. My background is that I have a doctorate in computer science that's focused on security and privacy. And I've been with the FTC about four months now, so I'm still pretty much a newbie. And I'm part of a new group that's kind of like the research arm of the FTC. Our focus is on actually kind of trying to be able to use our understanding of technology to help drive the policy of the FTC. So being able to engage with communities like this is of great importance to us. Also we're still a pretty small group and there's a large amount of things that we need to be able to look into. So we need a lot of help from the people in this room. So one of the things that we've been really working on at the FTC over the last five years especially is really thinking about do we have the resources in-house to be able to protect consumers in an increasingly interconnected world as the wave of IoT products sort of washes out into the marketplace and over all of us. So pretty quickly we realized that one of the key things that we needed to do at the Federal Trade Commission was bring in some expertise in the technology sector in-house but then also form partnerships outside of in the outside community as well. So Joe's living and breathing example of bringing a security researcher in-house. One of the things we also did was start the office of technology research and investigations. Why that's important is that we actually are creating in-house our own capabilities of replicating research and determining kind of what's happening with some of these products. Basically one of the things we need to really find out and this is also where research partnerships really help us is how is the technology working? Does it work the way that the company is claiming it works? Or does it do something different? And if it's doing something different that's actually a target-rich environment for us as enforcers. So we started, we call it OTEC in-house. Am I allowed to say that publicly? I just don't know. I like it. And so one of the important pieces of OTEC is actually making sure that we have people in-house that can help us even translate some of the highway technical work that gets done and presented even at conferences like DefCon because I'm a lawyer. I'm not a computer scientist. And while I'm really interested in the field, there's some things I just don't understand. And so I rely on Joe and the OTEC folks to help me understand how the tech is working or why the issue is even a significant issue if it's coming in our door. Yeah, absolutely. I mean I think it really just is important to be able to clarify technical explanations and so on and to have people in-house who are able to call BS on explanations that are provided that just don't actually make any sense in practice. And even just beyond that, having people in-house that can do things like setting up mid-improxies or stuff like that is really important when you're trying to figure out how IoT devices and other devices are actually working in practice. Also, I think that just generally having people in-house that this type of technical expertise is good for keeping us ahead of the curve. I mean all of us have seen articles before in the news where it talks about some vulnerability in some product and all of us knew about it like three or four months ago if not years before. And we want to make sure that as an agency we're staying ahead of the curve on these types of things and preferably not just a few months ahead of the curve but seeing what's coming years ahead ahead of time. So when we're thinking about bringing an actual enforcement action against an IoT product, say it's something that's vulnerable or it's having some sort of privacy implication that is not clear to consumers or is the opposite of what the company is representing the thing actually does, we look for those cases in a variety of ways. We get them from media reports, we get them from actual complaints that are filed in our complaint database system, and we get them from researchers. One of the things that happens when we see research that's interesting or sometimes people bring in to us is that then we can engage with it and try to understand it. Now it's a little bit of a black box so I thought maybe you could talk a little bit about kind of what that's like when research comes in the door and how we handle it. Sure, absolutely. So even before I joined the FTC I'd actually mentioned issues to them in the past and it was really interesting actually coming to the FTC and seeing what came of things that I told them. In many cases it was just kind of like putting something into a black box. I didn't hear much about it and there's pretty good reasons for a lot of that. We can't just go talking about everything that gets reported to us. Like literally, legally, this is the actual law. This is where I'd be a lawyer on you. These are actual laws that prevent us from kind of revealing investigations. There's really good reason for that right because sometimes we don't end up bringing a case and if we were revealing information about target companies then that could really harm them and if we don't bring a case then that's confusing for everybody. So we are really strict about what communications can come back out once we open an investigation. Yeah, absolutely. Yes, absolutely. So some of our IoT cases have been primarily privacy cases especially in the cases of design where trend net where we had cases where cameras were being turned on in people's homes without them understanding that those the cameras were being turned on that kind of thing which is primarily a privacy problem and then some of them have also been security practices as well. Sometimes the security practices are lead to privacy problems as well. Yeah, absolutely. Yes, so we actually have agreements with a number of consumer protection enforcers around the world that allow us to cooperate with them through various mechanisms. The FTC has really been a bit ahead of really other consumer protection agencies not just in the U.S. but around the world because we've been bringing privacy and data security cases basically for the last 25 years. It started with concerns consumers were having buying things on the worldwide web and now has expanded as things are increasingly interconnected in our daily lives. So we've been we've been doing this work for a really long time and one of the things that I've really found as I go around the world talking with other enforcers that we work with is that they're very interested in the work that we've been doing and how they can replicate it in their own agencies and the first thing I tell them is get technologists, find ways to build relationships with them and bring them into your organization because you need to understand the tech. Yeah and this is something that we really do want to do just over this past summer we had a safe web fella from the French Data Protection Authority spends several months with us and it was a fantastic experience kind of seeing how he was looking at issues and sharing how we look at issues. So we do a couple of things we provide a huge amount of business education we're not just an enforcement agency we have our start with security initiative we put out a guide about our privacy cases so we put out a lot of business facing information about when we're bringing cases and why we're doing that and what the best practices are that we would like to see industry to adopt and then we make that publicly available around the world. We I mean I think we are we are trying to forge kind of a more collaborative environment it's I find that a lot of agencies and other places are very new to this work and one thing that's really different about the US system here is that we are we are really in this in this country we don't have comprehensive privacy laws we don't have comprehensive data security laws now we do have laws they they're sector they're based on the kind of information for example Graham Leach-Bliley for financial information HIPAA for health information but it's a very sector-based approach and then we have this generalist consumer protection enforcement authority to protect consumers from all these other things and many other countries adopt a different model which is a more regulatory approach at the outset and it's less enforcement based on the back end so it's it's sometimes translating an enforcement-based approach to these challenges to protect consumers into an environment that's more like a regulatory approach. There are no laws pretty much related I think I OD data and no privacy laws in the EU which covers the specific data so are you seeing any moment in the EU or China or any other countries so in the EU of course you're probably familiar with the fundamental right of privacy so usually when I'm in Europe they say there's no privacy laws in the US but we have them here because we have a fundamental right but they also have the European data protection supervisor putting together a whole privacy framework that will go into place in 2018 in the EU so some of our conversation is very much about how we're going to facilitate cross-border data flows between the European framework and the US framework which is why we operate something called privacy shield which I will get into if anybody wants to talk about that but it's super boring about how we move data back and forth important but boring um you know we've seen uh Japan for example is in the process of updating its approach to privacy I think Korea is as well just trying to think of agencies I've talked to recently um you know it's not a conversation we have a lot with China I'm just gonna leave that there and and I think that it's certainly when we think of our ASEAN partners one that we're very engaged in around Asia and I should also note that this is supposed to be basically an open dialogue so yeah that was good let's keep dialoguing no thank you for the questions so the question is are you interested only in IoT things or all things um so we're an IoT village which is why I'm talking a lot about the IoT but we actually um the bulk of our data security and privacy cases um deal with probably software and platforms um more so than than strictly IoT but that's just partly a function of the fact that IoT is relatively new I think um and we have a much longer history of dealing with websites and that kind of thing um we are also a a broad consumer protection enforcer so we work on all kinds of consumer frauds we also police advertising practices children's privacy online um so we handle a whole range of different kinds of issues yeah and you can get some sense for the diversity of issues that we care about even by virtue of the workshops that we have come up in the fall we have ones that relate to ransomware to drones to disclosures which are going to be a big deal on IoT devices um to things like have fraud and other things affect different communities with changing demographics in this country um smart TV smart TVs yeah that's another big one um and we even have a general sort of privacy con that's going to be going on in January that would encourage people to submit work to um and that also kind of emphasizes why we need the people in this room for instance we have people looking into smart TVs and trying to figure out exactly who they're communicating with and what they're communicating and that can be really tricky when you're dealing with fairly locked down devices where you can't actually see the communication directly um and we need the skills of people even if we had a lot of people ourselves with the skills to actually try to figure this out there are so many different devices out there and keeping tabs on any on everything really does require relationships with quite a few people beyond just our own agency we've also this year we've brought some uh we've brought a routers case um involving the lack of security and routers I mean I think that's going to continue to be an area that's for us um we are also looking at fintech issues as well so it's a little bit outside of simply privacy issues but we see um you know a whole range of different consumer protection related issues um coming up in a variety of different sectors right now any uh IoT safety products any website any IoT safety products that ease your career colors to the consumer safety no we don't do safety so we protect consumers sort of generally from frauds and deceptions from making unauthorized payments that kind of thing from advertising fraud but we actually have a separate commission in the U.S. government that does consumer product safety uh now of course as we went through the world of IoT safety becomes a consumer harm so we can take action when consumers are harmed and I think that safety is a big dynamic in IoT so whether or not you can unlock connected blocks and made someone's home uh really exposes them to to a certain kind of harm that's a safety related harm car hacking uh you know the security of cars exposes people to privacy harms but also safety harms and and certainly in that space um you're aware of of these concepts and for us it's it's the harm but we don't test for whether the product is safe that's the consumer product safety position and there also can be deception issues possibly there too like even all the health apps that make certain claims about what they can do if you can't if you actually have the science to back it up even though we don't typically get into health quite as much overall that would be an area that we might get into yeah uh yeah the long and short of it is I I don't work so closely with the consumer product safety commission to know exactly how they're handling the technology issues one of the things that we're really doing with a bunch of the other government regulators that have kind of overlapping interests so um you know if if DOT and FAA are looking at drones and cars the the FDA is looking at medical devices we partner with them when we're thinking about the privacy and data security implications of those products and try to make sure that they have the information that we have about about how the how those products are functioning because some of these older agencies are confronting these issues for really the first time right so the automobile industry for example has we have a very long history of an expert regulator that's handling the safety of automobiles but it has to get very fast now about the safety of the computers that are driving the automobiles right and that's like a whole new world sorry there's a bunch of questions how about in the back first all right sorry I was actually talking to you sir in the fast so this is the question is can you talk a little bit more about the router case and kind of the expectation around it and maybe what we're hoping to achieve do you want to start with it or okay so the router case I mean I can give a brief description of my memory of the case so I don't actually have it all in my mind I've only been with the FTCs over a fairly short period so my recollection of all of our cases is still is still growing but my understanding was that it was a an ASIS consumer or ASIS provided routers or rather ASIS tech and those routers had in them a number of deficiencies that would enable somebody to be able to access things like consumer storage as well as potentially even do things like change sort of the DNS mappings and so on and those deficiencies had been in there for quite a while and people even had reported them to the company and the company had not taken any action and didn't have a program in place to be able to respond to those types of reports so in terms of what actually the standards would be in that case I would say that those were fairly fairly clear harm yeah but so they they didn't have I mean one of the things that really jumped out to me as being unreasonable security practice is the fact that they had known you know widely reported vulnerabilities that were pretty pretty problematic and were very very slow or didn't respond at all to them they were also running some they were adding some offerings to the router package the claiming that they were using the best encryption possible but not properly configuring the encryption which is a big red flag I think as well when you're making that kind of marketing claim about configuring your encryption like do it properly right this is a this is a theme we've done this and we've had a couple of other cases Fandango comes to mind there was one other one credit karma credit karma right where the security certificate verification was like not configured right so just yeah wow that's a big problem so so that was that was a big issue as well for me in that case now as you point out routers are are maybe the the consumers like gaily into their home network so protecting them adequately and trying to make sure that we're in an environment where the data security practices of the folks that are making those routers are good is a really big priority for the FTC and so we've been looking very carefully at some of these different consumer offerings and trying to understand some of the problems that we're seeing I mean I think that's a really good example the aces case of where we were watching very carefully some of the research and discussion about the vulnerabilities and taking it really seriously it takes us a little bit of time to bring a case so sometimes people get frustrated that we can't bring a case you know in six months or something and I think this time it took us about a year to to do all of that work and you both might say yeah so we we actually we put companies under order and within the order they are required to have security programs to have to notify customers but you're you're highlighting a thing that I actually think is kind of the next frontier for IoT products and consumer protection which is how do we make sure that as a part of protecting all of these products consumers are getting accurate information about the how long the product is going to survive as a connected product and a secure one and how do we make sure that consumers are getting information if a company's bricks its product relatively early so we actually took a close look at this for example I don't know if you followed the revolving nest kind of kerfuffle but basically nest brick the revolved product early I suppose you could say we have a closing letter we issue those when we we decide not to bring a case but we've looked at something carefully and in the closing letter it says you know this could have been problem that I'm summarizing so read the closing letter it's like this could have been very problematic you know by the time we issued the letter nested refunded customers and they had a program in place to address the concerns that were raised by the customers and I think that's the kind of thing that that you need to think about in the IoT space that that having a way to make consumers whole when their connected thing is no longer supported especially that's no longer supported a lot earlier than what maybe a reasonable consumer could expect right it's going to be a consumer protection issue for us so we're watching that so we don't have great extraterritorial reach which is too bad I mean probably good overall but so we we can we can't really there are other agencies in the government that can can you know stop importation of things and have have kind of a policy where they can reach things more broadly in other countries we can really only focus on kind of what's happening here in the US so we don't I don't think we probably shut anybody down we I think we're aware of the supply chain issue and yeah I mean we make strong efforts to like freeze assets and do other things such that somebody can't just essentially somebody's committee fraud for instance can't just basically get shut down and then do the same thing again over I mean it can certainly happen but we are aware of that kind of concern it's hard I mean and we can we can go after the conduct that's happening in the US but it's hard for us to reach an entity if it's totally offshore yeah and if it's doing business in the US then we certainly can it's just finding that nexus yeah that one's a really tricky area it's I mean it's the the game of consumer protection and protecting consumers from frauds and scams is inherently a whack-a-mole game unfortunately because one thing we found over a hundred years of consumer protection is that there are bad actors that will find new and exciting ways to exploit people one of the reasons why the FTC got involved in connected technology products relatively early was they became a way for people to steal consumers payment information right I mean our early cases are all about making sure consumers like had enough trust in something called the worldwide web that they would buy something on it right and that's kind of how we got into this business to begin with the question is a really good question which is sort of when do we bring a case against a company because of its security practices am I summarizing that right and the answer is the test that we use is whether or not the security practice was reasonable or unreasonable which turns out to be a very lawyerly thing so as a lawyer on the panel I will translate it for you the bar of reasonable is to be honest not an extremely high bar I kind of sometimes wish it were a bit higher but more or less what we look for are the security practices by the company now breaches and things like that can be really good indications that there was a problem but they're not this positive of whether we would bring a case so when we see something then we start taking a look which is why having people like Joe is really helpful and we try to understand well what was the company's security process what were their procedures we actually have a guide I'll do a little here's a little plug our start with security guide it's actually a 10 step guide in plain English that's really designed to communicate with people who are not security experts but maybe as security experts it could be very helpful in dealing with them where we talk about based on the 16 reasons we brought what the best practices are some of the problems that we've really seen lately that I think are relatively unreasonable when we start seeing them in this environment is the extent to which you have some sort of vulnerability reporting program the extent to which you are able to classify those vulnerabilities in terms of their the the importance of patching them and fixing them the response time on those whether you're properly configuring things like encryption if you're using it um whether you're training your employees whether you're keeping passwords in a folder marked passwords in plain text right that's actually a case we brought um so we're looking for uh you know essentially I mean essentially I would say we bring a case when um a security expert would look at the practice and say that's ridiculous how did they let that happen yeah so I mean basically like if there's some flaw in some library that everybody's been using for the past decade and has been looking at carefully and it pops up and it affects a couple different companies products and everybody everybody's been using this and has been looking at it carefully and it was just something random like I would suspect that we're not necessarily going to go after that particular case but also um one thing that's worth noting is that what's reasonable might actually evolve over time um which is part of the reason why we actually are trying to give guidance to companies so that they can figure out what is reasonable even as things evolve um but it's part of the reason also why we need people telling us when norms seem to be evolving based on what they're seeing um and the reason is I mean again I don't know if you tell anybody in this room security is a highly dynamic field so what best practices are today are a bit different than best practices were five years ago we don't expect people to have perfect security but what we're looking for is is reasonable security and what's reasonable given kind of what we know and where we are in the field unfortunately I mean I we also wrote a report and been studying IoT for the last couple of years I mean I think what we've seen is that there's just a wide range here um some companies with relatively mature security systems and and concepts and procedures uh in entering you know the space and then some companies that have never thought about it have been making relatively dumb things and they're making them connected and they and they bring them to market and they still haven't really thought about it yeah that's problematic and it's a tricky area to be is there a lot of sort of mom and pop type shops essentially that are creating their own new IoT devices and don't really have as much experience with security and this is somewhere where once again I keep on pointing this back to the people in the room but people in this room also can play a role in terms of helping to build platforms and so on that help for people that might not necessarily have as much security expertise do things correctly so I think the question is to do are we are we kind of providing guides at the enterprise level or in the sort of business to business market right versus simply just uh yeah so one of the questions that commonly comes up in the business to business space is how accountable are you for your subcontractors and their security practices and one of the things that I think we've been really clear about is that actually you're you're going to be fairly accountable for those practices um so we the security issues for us at the enterprise level um tend to deal more in that space I would say I don't know yeah I would think so I mean it also is worth noting that we are consumer focused in the end so like something that doesn't necessarily have an impact on a consumer yeah we're a little bit less likely to get directly into and also if you're looking for sort of whether we have very specific technical expertise one thing that I'm reluctant to do would be for us to give very very low level like you should have a certain setting in a certain file or use a certain specific language for doing something because I mean that would that would be somewhat constraining on business and we're not here to try to stifle what people are doing right so I mean another way that we say that um especially in the policy debate is we say look it's important to be tech neutral about the advice we're giving because this is such a dynamic field so we're talking about the processes and procedures that we think are the right ones to have but we're not dictating what kind of tech is the right thing because um I you know I think that's just not our role sure we um so in terms of consumer side supporting service um we run a number of websites and put materials together for consumers um the biggest thing that we provide consumers I think probably is our id theft.gov website where we have a one-stop process for remediating identity theft issues um and it's actually tailored with a flow chart so that people can deal with whatever specific identity theft related kind of problem they're having and then get the right information about how to remediate it and a lot of it's automated to make that a easier process for people um and we put out a lot of consumer facing blogs and information about different scams and problems and issues that that we're seeing you know one thing that we lack and I I've actually um was really psyched to see much as presentation this morning is a good way of providing easy consumer friendly information about the risk associated with the product or the level of security of it right so right now in the marketplace especially in the iot marketplace most consumers don't really have a metric by which they can evaluate whether this baby monitor is more secure than this baby monitor and factor that into their choice when they're buying the product so one of the things I really like to see is is more and better availability of that kind of thing so that consumers have a chance to literally you know affect demand based on the security of of the product as well right now that's very very opaque to consumers they have almost no way of knowing how good the security is of a connected product yeah we don't so we don't provide we accept consumer complaint information but we don't have like a call center that takes there I mean we have a call center that takes the complaint but we don't have like a response yes so this is a great question that's what is what is the view of the whether the consumer owns their data and this is actually like a huge topic of debate around the world right now gets really to this core problem of of how how much notice and choice should people have when their data is being kind of consumed taken up in different spaces you know in in the US for example you can passively gather information about people there isn't actually a restriction on that except for children if you're marketing to them I guess and and and so that would actually require a lot of law change really but one of the things that we have done when that's happening is make sure that if the company is making promises about the kinds of choices they're going to offer consumers that they live up to them so we have a case against a company called gnomie that was retailers were using to gather location information about people and you know to understand where their customers were but they said look well we'll provide an opt-out in the retail location that are using this which they didn't do and so we said look you can't say you're going to provide an opt-out and notice to people and then not offer it and so that was that was deception for us but it's important to note that in the US at least the the existence of that technology and the use of it is is not does not require some sort of positive opt-in for the consumers it's an interesting question I mean on the one hand you want the innovation you want the smart cities you want all of the ability to have all of that work really well and on the other hand you want consumers to have some control of the choice it's a fascinating set of challenges we've also been looking at cross-device tracking as well and how that's working for because I think that there's a lot of interesting tech that's about making sure that advertisers can know what you want a number of platforms right and the extent to which you know that that how that's operating is the thing that's interesting to us yeah so I think we're we're like two minutes away any last questions see I have one then two I'll do them fast do you want to take that one I'm sorry I didn't get it so you're talking about when there's a widespread vulnerability and something but it's really hard to replace them I didn't quite hear the last part I mean I think it would even depend upon what the consumer's expectation was of the product at that point like if you have like a device that's if you have a 30 year old device in your home and you find out that it isn't insecure or that essentially the firmware and it was insecure or something else like that it would be challenging actually to figure out exactly what the right thing would be to do in that case in particular because the company might not even be around anymore this is part of the reason why I think it is actually useful where at the time when a consumer potentially is purchasing a product to have some idea about what what they can expect in terms of support and so on going on from the product so at the time when I purchased a product I know that maybe 10 years from now this product might might just be essentially bricked or I will need to get rid of it and patches will no longer be provided but essentially the more that the consumer knows the less likely that we are to get into a position like that sorry and you had a question then we'll wrap up so you mentioned voter ability reporting programs so is that pretty important as far as to an IT company doesn't have that it says like I would put it right up there on like my top five like good security hygiene practices right some mechanism I mean I'm not saying everybody has to have a bounding program although I think they're awesome because crowdsourcing is a really good thing to do but having some mechanism to get the reports in and then respond to them is sort of basic and it's really important I don't know yeah I mean if so I mean I could imagine there being like a fairly new for instance website or something else where they just have some general contact information but if somebody says listen your site's leaking social security numbers left and right or something else and you contact that email address I would expect there to be some sort of a prompt response so there should at least be some way of getting in touch if there's something wrong with your product and I think that with IoT devices it seems it seems pretty reasonable to me to expect that there's some way of getting in touch especially if you're dealing with things that are sensitive enough that somebody might need to get in touch with you quickly so thanks a lot for coming to our talk we're happy to continue to answer any questions that remain again if I can make a one big pitch it would be we have an open door policy we're really interested to hear what's happening out there we also are actually completely happy to answer questions and do so all the time from businesses that are trying to do the right thing so our staff is awesome they're accessible we could have put up a slide I guess I'm on Twitter at team xweeney fdc you're in plain text at in plain text right we also have an email address is it research at fdc.gov research at fdc.gov I actually read the things that come to that email address so send you a good research but maybe not too much of it but yes research just singular yeah and we will make an effort like even in the case I mentioned earlier where I reported things and I it appeared to be going into a black box people actually behind the scenes were really looking into those issues I found out when I got there like really really looking into them so we do care when we hear about things fear whatever happened you choose to contact us and sometimes you know the resolution of them is that we open an investigation we go look very carefully we decide we don't have enough to bring a case but in the meantime the fact that we've opened the investigation and and the company's having to look at itself very carefully through that process actually effectuates change as well so sometimes if the research doesn't end up in an actual case then it may very well influence our ability to open the investigation which may in turn result in really good changes for consumers which is everybody's goal all right well thanks very much appreciate your time


Hello everyone, welcome to theCUBE's coverage of International Women's Day. I'm John Furrier, host of theCUBE, been profiling the leaders in the technology world, women in technology, from developers to the boardroom, everything in between. We have two great guests, remoting in from Malaysia. Nancy Wang is the general manager, also CUBE alumni from AWS Data Protection, and founder and board chair of Advancing Women in Tech, advanceawit.org. And of course, Kate Watts is the executive director of advancingwomenintech.org. So it's awit.org. Nancy, Kate, thanks for coming all the way across remotely from Malaysia. Of course, we're coming to you as fast as our internet bandwidth will allow us. And I'm just thrilled today that you get to see a whole nother aspect of my life, right? Cause typically we talk about AWS and here we're talking about a topic near and dear to my heart. Well, Nancy, I love the fact that you're spending a lot of time taking the empowerment to go out and help the industries and helping with the advancement of women in tech. Kate, you're the executive director. It's a 501C3, it's nonprofit, dedicated to accelerating the careers of women in groups in tech. Can you talk about the organization? Yes, I can. So advancing women in tech was founded in 2017 in order to fix some of the pathway problems that we're seeing on the rise to leadership in the industry. And so we specifically focus on supporting mid-level women in technical roles, get into higher positions. We do that in a few different ways, through mentorship programs, through building technical skills, and by connecting people to a supportive community. So you have your peer network and then a vertical sort of relationships to help you navigate the next steps in your career. So today we've served about 40,000 individuals globally and we're just looking to expand our reach and impact and be able to better support women in the industry. Nancy, talk about the creation, the origination story, have this all come together? Obviously the momentum, everyone in the industry has been focused on this for a long time. Where did AWIT come from? Advancing Women Technology, that's the acronym, Advancing Women Technology, or where did it come from? What's the origination story? Yeah, so AWIT really originated from this desire that I had to Kate's point around, well, if you look around, right? And don't take my word for it, right? Look at stats, look at news reports, or just frankly, go on your LinkedIn and see how many women in underrepresented groups are in senior technical leadership roles, right? Out in the companies whose names we all know. And so that was my case back in 2016. And so when I first got the idea, and back then I was actually at Google, just another large tech company in the Valley, right? It was about how do we get more role models? How we get more, for example, women into leadership roles so they can bring up the next generation, right? And so this is actually part of a longer speech that I'm about to give on Wednesday. This is part of the U.S. State Department Speaker Program. In fact, that's why Kate and I are here in Malaysia right now is working with over 200 women entrepreneurs from all over in Southeast Asia, including Malaysia, Philippines, Vietnam, Borneo, so many countries where having more women entrepreneurs can help raise the GDP, right? And that fits within our overall mission of getting more women into top leadership roles in tech. You know, I was talking about Teresa Carlson, she came on the program as well for this year, this next season we're going to do, and she mentioned the decision in the U.S. progress and international, and she's saying as much as it's still bad numbers, it's worse than outside the United States and needs to get better. Can you comment on the global aspect? You brought that up. I think it's super important to highlight that it's just not one area, it's a global evolution. Absolutely, so let me start, and I'd love to actually have Kate talk about our current programs and all of the international groups that we're working with. So as Teresa aptly mentioned, there is so much work to be done not just outside the U.S. and North America's where typically tech nonprofits will focus, but rather if you think about the one-to-end model, right? For example, when I was doing the product market fit workshop for the U.S. State Department, I had women dialing in from rice fields, right? So let me just pause there for a moment. They were holding their cell phones up near towers, near trees, just so that they can get a few minutes of time with me to do a workshop and how to accelerate their business. So if you don't call that the desire to propel oneself or accelerate oneself, not sure what is, right? And so it's really that passion that drove me to spend the next week and a half here working with local entrepreneurs, working with policymakers, so we can take advantage and really leverage that passion that people have, right? To accelerate more business globally. And so that's why Kate will be leading our contingent with the United Nations Women Group, right? That is focused on women's economic empowerment because that's super important, right? One aspect can be sure, getting more directors, vice presidents into companies like Google and Amazon, but another is also how do you encourage more women around the world to start businesses, right? To reach economic and freedom independence, right? To overcome some of the maybe social barriers to becoming a leader in their own country. Yes, and if I think about our own programs and our model of being very intentional about supporting the learning development and skills of women and members of underrepresented groups, we focused very much on providing global access to a number of our programs. For instance, our product management certification on Coursera or engineering management, our upcoming Women Founders Accelerator. We provide both access that you can get from anywhere and then also very intentional programming that connects people into the networks to be able to further their networks and what they've learned through the skills online, so. Yeah, and something Kate just told me recently is these courses that Kate's mentioning, right? She was instrumental in working with the American Council on Education. And so that our learners can actually get up to six college credits for taking these courses on product management, engineering management, on cloud product management. And most recently, we had our first organic, one of our very first organic testimonials was from a women's tech boot camp in Nigeria, right? So if you think about the worldwide impact of these upskilling courses where frankly in the US we might take for granted, right? Around the world, as I mentioned, there are women dialing in from rice patties from other, for example, outside the corporate buildings in order to access this content. You think about the idea of, oh, sorry, go ahead. No, go ahead, Kate. I was going to say, if you can't see it, you can't become it. And so we are very intentional about ensuring that we have, we're spotlighting the expertise of women and we are broadcasting that everywhere. So that anybody coming up can gain the skills and the networks to be able to succeed in this industry. We'll make sure we get those links so we can promote them. Obviously, we feel the same way getting the word out. I think a couple of things I'd like to ask you guys cause I think you hit a great points. One is the economic advantage. The numbers prove that diverse teams perform better. Number one, that's clear. So good point there. But I want to get your thoughts on the entrepreneurial equation. You mentioned founders and startups and there's also different makeups in different countries. It's not like the big corporations. Sometimes it's smaller business in certain areas. The different cultures have different business sizes and business types. How do you guys see that factoring in outside the United States? I'll say it's the big tech companies. Okay. Yeah. The easy lower the access to get in education than stay with them in other countries. Is it the same or is it more diverse in terms of business? So what really actually got us started with the U.S. State Department was around our work with women founders. I love for Kate to actually share her experience working with AWS startups in that capacity. But frankly, we looked at the content and the mentoring programs that were providing women who wanted to be executives. You know, quickly realized a lot of those same skills such as finding customers, right? Scaling your product and building channels can also apply to women founders, not just executives. And so early supporters of our efforts from firms such as Modrona up in Seattle, Emergence Ventures, Decibel Ventures in the Bay Area and a few others that we're working with right now, right? They believed in the mission and really helped us scale out what is now our existing platform and offerings for women founders. Those are great firms by the way and they also are very founder friendly and also understand the global workforce. I mean, that's a whole nother dimension. Kate, what's your reaction to all that? Yes, we have been very intentional about taking the product expertise and the learnings of women and in our network. We first worked with AWS startups to support the development of the curriculum for the recent accelerator for women founders that was held last spring. And so we're able to support 25 founders and also brought in the expertise of about 20 or 30 women from advancing women in tech to be able to be the lead instructors and mentors for that. And so we have really realized that with this network and this individual sort of focus on product, expertise, building strong teams, we can take that information and bring it to folks everywhere. And so there is very much the intentionality of allowing founders, allowing individuals to take the lessons and bring it to their individual circumstances and the cultures in which they are operating. But the product sense is a skill that we can support the development of and we're proud to do so. That's awesome Nancy. I want to ask you some, normally we talk about data storage and AWS cloud greatness and goodness. Here it's different. And you also work full-time at AWS and you're the founder and the chairman of this great organization. How do you balance both? And do you get it? They're getting behind you on this. Amazon getting behind AWS, getting behind you on this. Well, as I say, it's always easier to negotiate on the way in but jokes aside, I have to say the leadership has been tremendously supportive. If you think about, for example, my leaders, Wayne Duceau who's also been on the show multiple times, Bill Vass who's also been on the show multiple times. They're both founders and also operators entrepreneurs at heart. So they understand that it is important, right? For all of us. It's really incumbent on all of us who are in positions to do so to create a pathway for more people to be in leadership roles, for more people to be successful entrepreneurs. So no, I mean, if you just looked at LinkedIn they're always up voting my vote. So they reached to more audiences and frankly they're rooting for us back home in the US while we're in Malaysia this week. That's awesome. And I think that's a good culture to have that empowerment. And I think that's very healthy. What's next for you guys? What's on the agenda? Take us through the activities. I know that you got a ton of things happening. You got your event out there which is why you're out there.  I think you guys call it the Advancing Women Tech Week. Yes, this week we are having a week of programming that you can check out at advancingwomenintech.org that is spotlighting the expertise of a number of women in our space. So it is three days of programming, Tuesday, Wednesday and Thursday if you are in the US. So the seventh through the ninth but available globally. We are also going to be in New York next week for the event at the UN and are looking to continue to support our mentorship programs and also our work supporting women founders throughout the year. All right, I have to ask you guys if you don't mind get a little mark of data so you can share with us here at theCUBE. What are you hearing this year that's different in the conversation space around the topics, the interests? Obviously I've seen massive amounts of global acceleration around conversations, more video, things like this. More stories are scaling. A lot more LinkedIn activity. It just seems like it's a lot different this year. Can you guys share any kind of current trends you're seeing relative to the conversations and topics being discussed across the community? Well, I think from a needle moving perspective, right? I think due to the efforts of wonderful organizations including theCUBE for spotlighting all of these awesome women, right? Trailblazing women and the nonprofits, the government entities that we work with. There's definitely more emphasis on creating access and creating pathways. So that's probably one thing that you're seeing is more women and more investors posting about their activities. Number two, from a global trend perspective, right? The rise of women in security. I noticed that on your agenda today you had Lena Smart, who's a good friend of mine, Chief Information Security Officer at MongoDB, right? She and I are actually quite involved in helping founders, especially early-stage founders in the security space. And so globally, from a pure technical perspective, right? There's more increasing regulations around data privacy, data sovereignty, right? For example, India's in a few weeks about to get their first data protection regulation there locally. So all of that is giving rise to yet another wave of opportunity and we want women founders uniquely positioned to take advantage of that opportunity. I love it. Kate, reaction to that. Founders, more pathways. Sounds like a neural network. It sounds like AI enabled. Yes, and speaking of AI, with the rise of that, we are also hearing from many community members the importance of continuing to build their skills, upskill, learn to be able to keep up with the latest trends. There's a lot of people wondering what does this mean for my own career? And so they're turning to organizations like Advancing Women in Tech to find communities to both learn the latest information but also build their networks so that they are able to move forward regardless of what the industry does. I love the work you guys are doing. It's so impressive. I think the economic angle is new. It's more amplified this year. It's always kind of been there and continues to be. What do you guys hope for by next year this time? What do you hope to see different from a needle moving perspective to use your word Nancy for next year? What's the visual output in your mind? I wanna see real effort made towards 50-50 representation in all tech leadership roles. And I'd like to see that happen by 2050. Kate, anything on your end? I love that. I'm gonna go a little bit more touchy-feely. I want everybody in our space to understand that the skills that they build and the networks they have carry with them regardless of wherever they go. And so to be able to really lean in and learn and continue to develop the career that you wanna have. So whether that be at a large organization or within your own business that you've got the potential to move forward on that within you. Nancy Kate, thank you so much for your contribution. I'll give you the final word. Put a plug in for the organization. What are you guys looking for? Any kind of PSA you wanna share with the folks watching? Absolutely. So if you're in a position to be a mentor, join as a mentor, right? Help elevate and accelerate the next generation of women leaders. If you're an investor, help us invest in more women-started companies, right? Women-founded startups. And lastly, if you are women looking to accelerate your career, come join our community. We have resources, we have mentors and we have investors who are willing to come in on the ground floor and help you accelerate your business. Great work. Thank you so much for participating in our International Women's Day 23 program. And we look to keep this going quarterly. We'll see you next year, next time. Thanks for coming on. Appreciate it. Thanks so much, Shawn. Okay, women leaders here. Thanks for having us. All over the world coming together for a great celebration, but really highlighting the accomplishments, the pathways, the investment, the mentoring, everything in between. It's the cube bringing in as much as we can. I'm John Furrier, your host. Thanks for watching.


What's up everybody, Jason here with JasperCaseBricks.com Happy new release day guys, 2022 Balmain Draft is here guys. This is the Jumbo Edition, eight box case break, pick your teams number one. Remember all cards shipped, 12 packs per box, 32 cards per pack, collect the entire 200 card base set, and then of course three autograph prospects per hobby box. And let's get this day started. So that's the case right there. If you have a little character thing, they mean you won those from a team random. Everybody else of course bought them straight up. So that's everybody there. And let's cut up in this case. Oh, that was the one I really expected. You get a really good workout with these boxes honestly man. Don't lift weights, lift jumbo and super jumbo boxes with Balmain. You're gonna start to get a little warm in here. All right, most likely guys, I'm going to like rip open like four boxes.  Rip open four boxes, go through the four and then. So this should probably take me like an hour. The good thing is that there's a pattern to this. So, you know, we can kind of skim through and fly through a lot of the base cards and just kind of stop for the chromes and number of cards and stuff like that. And everything does ship guys, so don't worry. We do have a top little list. It's a pretty small one. I think it's fairly similar to what we did for Balmain first draft and Jackson Holiday, Tamar Johnson, Elijah Green, you know, et cetera. So like I said, everything ships. Unfortunately, we can't always pen and sleeve and topple at every single prospect. Kind of have to go by a certain couple that most people are doing on average. Some people might disagree with it. Like, hey, this guy deserves it, but all the more expensive stuff, like, you know, numbered cards, autos, of course, all that always gets top loaders. Just more for like the, it's more like for the base rookies and like, or base verse and stuff like that. So, you know, I don't know, did you? I want to say, I thought I'd seen a super fracture in this sack, but I don't know, I could be wrong. Full of Valkasar Super and Balmain Chrome, HTA, a couple weeks back. That was my first super fracture in a while. Last box, actually just moved this one back a little bit. Now you can put that other one right there. All right, I'm pulsing up number two now for Super Jumbo. That way you guys can run back the next one too. These two are two base refractors in every Neto. So 499, Neto, Waffer, or Ford, sorry. Just took base there. They're the Jackson Holiday and J.R. Richie's, the first auto for the Braves going out in Comberman. Invicta, era parent, Dylan Beavers. Those are one per box, Kevin Alcantara, Vera, Jared McKenzie, Amador, and Tyler Schwetzer. Oh, and Murphy Green. Ben Joyce to 150 for the Angels, the third auto. Cole Phillips and Sterling Thompson for the Rockies. There's Johnson. All right, so you have two autographs on this side. Chereo and Kay Dowdy to 499 for the Blue Jays. Mikey Romero, William Kempner for the Giants to 499, and Victor Scott, the second little wave to 199, and Dominic Keegan. All right, third box, is that a variation? I think it is a variation, ending in 46. Also they have even base variations this year. Nice one there for Chris Butler. Ivan Melendez, gold wave to 75, or more like a yellow, I guess. Jared McKenzie first for the Washington Nationals, Jordan Sprinkle, Bergola. Dylan Lesko to 50, maybe that's what I saw. I thought I'd seen a Superfractic, but maybe it was that. Gavin Cross, I haven't seen that insert. Just gonna get it out there. Paulino. Dominguez. Fabian, Judd Fabian. All right, last box, and then we'll go to the next four. Tomorrow Johnson, Neto. Yeah, he thinks all right, and I left it here to the side, but there's not even no color to it, not even a refractor. It's kind of sad. Marcel Mayer, mood rings. So one in every 60 packs, oh, one in every 60 boxes. Okay, so then that is kind of a shard of a print card. Let's go. Okay, well, packs, that's still good amount then, right? Because there's only, how many packs in a box? 12 packs, so one in every four boxes probably? No, one in every five boxes, right? Yeah, one in every five boxes. That's pretty good. I mean, that's still one per case kind of deal. Maybe you can probably get two, but five out of the eight boxes will have one of those. So I guess you can consider that a case, kind of hit. Not to be with him with swings. Orange, Mikey Romero, who in fantasy is in the quarter of semifinals this week, like this guy, and has Jalen Hertz, like this guy. Green parallel, Henry Bolt. For the Oakland Athletics. I'm playing Nick this week, right? And I know Nick did this on purpose. Nick already has his two quarterbacks. And I don't understand, I'm like lower in the waiver wire than him, but he was able to get Garner Minshew and steal him from me, so I don't know. Tactic, I guess. I mean, he has Gino Smith and Brock Purdy.  I have a pretty good team. I scored a lot of points this year in fantasy. I just had bad matchups. But I haven't had to use, I think I had Mario for a little bit, and then I switched to Russell Wilson, but I never had to use any of my quarterbacks. And I think the one weekend I did use Mario when the bi-week, I didn't have to worry, because he actually had a pretty good game in fantasy. So I picked up Baker, because our league is like a 12 league, but we have a lot of like extra flex players, no kickers or anything like that. So everybody just stockpiles on a lot of good players. So like every team that's in the playoffs has like three quarterbacks. This is just kind of a waste of time to do that during the break, while I'm breaking it. Like way too high. We're not breaking on the 25th, the 26th, sorry, we're not. The biggest schedule in the year is we all have, as employees here, we have the 24th and the 25th off. So there shouldn't be any breaking those days. And then I believe on Monday, there's possibly no breaking as well. So I don't think we get back to normal schedule on Tuesday. And then we'll break Tuesday, Wednesday, Thursday, Friday. And then Saturday, New Year's Eve, we will be breaking, but it's kind of like a shorter day.  So, and then same thing, New Year's will be off on the first. And then I believe we should have someone here on the second on Monday. And then I'll get it back to normal schedule after that. So hopefully some big stuff on this side. It's my first case of the day, so I'm not sure what to expect fully. But hopefully we do have some good stuff here. And we'll kind of skim through the paper base. Like I said, our shipping team has the top load list for like the base part and stuff like that. So if I miss any, don't worry. Dunhurst blue with a Justin Boyd for the Reds. Reds is going to Ryan Harrell. Andre Mendez, little speckle. Whoa, what a red color match, Justin Boyd. And not bad, second round pick, 73rd overall. At a Parker, Colorado.  Look at that. There you go, Ryan. Got that from a team random. Oops, sorry, wrong stack right there. Did you just call that Deporter? Damn. 10 seconds before you pull, so you put on filling a red out of this half and then 10 seconds later. Predict the winning numbers for the Lotto Deporter. I'll go buy some tickets. Caden Wallace, paper, gold. We got Balthazar, Ruffella. All right, did you mean a red autograph or a red auto? Like a Cincinnati red. Either way, he got both, whichever one he meant. So I guess it doesn't really matter. Those jacks in the holidays this time though. So these are one in every 60 packs. That's still one in every five boxes, so. Poly on average, you get one to two a case. Yeah, you were just like, yeah, it's gonna be a Justin Boyd red. And Brooks Lee, Chrome Prospect autograph for the Minnesota Twins Redemption. Twins is Peter. Peter, that's what she said, Ryan. Sorry, I couldn't pass up that opportunity. Tanner Schruble to 250. Minnesota Twins, Peter. I might not rate it G. Not even P.G., just rated G. Usually Elijah Green and Jackson Holiday Bates are kind of in the same pattern. Cracker Jack, does he really? I guess I've never heard that. I had a feeling I was lying, because I know we try to be P.G. here with Cracker Jacks. That was definitely not one of them. Whoa, class of 2022. I didn't notice these redemptions like that. I mean skimming through them. That's a gold refractive parallel for Jordan Beck and the Colorado Rockies, which is EA. Jordan Beck, young Q. That was a good one, nice. Yeah, the second half has been better than right. I've got two and a half more boxes. Jacob Marcy, that's a refractive to Merrick Johnson. Jose Ramos, blue, and then Sean McLean for the Dodgers base auto. Neto, I feel like we got a lot of this guy. 1999, Holiday, that's our first refractor. Speckle, Gavin Cross. All right, two more boxes, guys. Jacob Marcy. It's a 99 for the Pozries. Can't remember what that one. Brooks Lee, purple base, paper base at the end of every box like that. Cunha, Robert Moore. DeAndre Smith for the Mets to 4.99. Mark Bicelli, Oscar Colas. We have Slovak, and we got Gabriel Hughes, a 71 speckle. That is for the Colorado Rockies. And EA, Gonzalez, purple. You know what I've noticed? I think this bowman is more hitters than pitchers, right? Like hitters galore. All right, last box. That's a base right there. Yeti, Eric Hernandez, and Cole Phillips to 4.99. Boyd, and then Robert Hassel. Just probably not a bad goal. Gainer Cueva. So that's all base right there. We'll skim through it at the end right now. Ryan Ritter, or Gola. And a Douglas Hood of Black. I've always loved the Black first. I wish those were one-on-ones. 18 out of 75, and that is for the Baltimore Orioles, Aaron Billingsley. And they need to make an HTA version of Draft, don't they? There's like so many base. There's like so many base cards. Or so many paper base. All right, so I'm going to just skim through this, guys. But we're pretty much done here. It took me about an hour. So I figured it takes me an hour. It should take Joe maybe just a little bit longer. He could get a pack stacking hop later, though, depending on who's here to help or not. But about an hour is what it takes, usually. Super Jumbo actually has way more cards, but it's probably quicker, because you don't have to rip so many packs. There's only like five packs. It might actually be like a quicker rip. All righty, guys. So do a quick little autograph recap. We're going to top it all this, so don't worry. Douglas Hood, Ritter, Phillips for the Braves, which is announced to the team. Rocky's out of there. Metz, Padres, that's just a refractor there. Dodger's out of there. So Jordan Beck, Gold for the Rockies. Twins, Twins, Reds, Aes. I'm sorry, not Aes. Angels. Orioles, Padres, Washington Nationals, San Luis Cardinals. We've got Blue Jays, Rockies, Angels again, White Sox, Braves. Then we have a couple of these little case hits there. Short print, red autograph. Little Jackson Holiday right there as well. So I appreciate it, folks. Again, this was break number one. Number two and three are actually part of a team random. So it's looking pretty similar to what we had here. And get chances at some pretty nice teams there. And it sells out two and three. I appreciate it, guys. JasperysCaseBrace.com.