So without further ado, I'll hand it over to Cyber Gibbons to talk about hacking cruise ships if you would great. Thank you very much for the intro Hello people wonderful people today. I'm gonna be talking about hacking ships I'm gonna talk about how ships work how they're put together now. This is the first time I've done this slide deck It's a bit of a mishmash of two different slide decks. So it might get a bit crazy at pace at a few points So who am I? Well, my name is Andrew Tierney my handle cyber Gibbons I'm a professional penetration tester, which is a ridiculous name for someone who tests the security of various devices This is me a few weeks ago on a 747 looking at some of the systems on board I lead the hardware team at a company called pen test partners So we look at planes ships cars IOT hardware industrial control systems We call ourselves the weird stuff team. We just do all of that kind of non-general purpose computer things So what can I talk about ships? Well, this is me 16 years ago. I think give or take 2006 on a container ship in the Suez Canal I used to work on container ships as an engineer. So down in the engine room. I did that for a few years So I've got good knowledge of how ships work Bringing together the IT side of things and the ship side of things allows me to really drill into how they work and find Really interesting vulnerabilities At the end of this I'm going to show you how I was sat in my pants. I'm not actually going to show you that actually I was sat at home on the sofa with remote control of a cruise ship I could steer a cruise ship remotely. So that's where this is going Now all of the work that I mentioned here is carried out with permission We were on the cruise ship with permission to attack those systems So don't go and do this when you're on a cruise. You will get in trouble So what is it like working on a ship? Well, this is the view out of my cabin when I was a cadet on container ships So I worked on kind of 300 meter 350 meter long container ships back in those days They were the biggest container ships. They typically held between six and seven thousand TEUs 20 foot equivalent units. So that's half of a normal container that we're used to so it's a lot of containers You can see there. We're looking forward from the accommodation You can see all of those containers on the deck now most people think about container ships when they go past They look at all those containers stacked up on the deck and that's all they think of But actually the bulk of containers are below the decks in the hold So you take off a hatch lid there's three hatch lids across the width of the ship and down there You can fill it up with containers. So those are 40 foot equivalent units They fill that whole 40 foot gap a 20 footer is smaller on the right hand side there What you can see is something called a bunker barge. You obviously have to get your fuel from somewhere Now a container ship like this holds about 10,000 tons of what's called heavy fuel oil HFO Now that it's expensive. It's $500 per ton So the first time I remember I was helping take bunkers take that fuel on board I did the maths 10,000 tons at $500 a ton is the best part of five million dollars worth of fuel One little mistake and you could cause a real problem This is a picture of a container ship that I worked on whilst it was under construction So you can see that crush section of the ship how deep it goes down in the hold Down the sides those hollow gaps at the sides their tanks they hold ballast water or fuel You've got a thing called the side passageway that goes all the way down at the top all the way from the back to the front And it's quite crazy. You can stand in there in heavy weather Look down that side passageway and even on a container ship this size You can physically see it twisting from side to side and moving up and down Unfortunately 2006 we didn't have camera phones really we didn't carry for you know cameras about this So I don't need videos of crazy stuff like this So what is it that powers one of these well, it's a really really really big engine So it's a two-stroke diesel engine They're huge their three four stories high That red box there is covering one of the exhaust valves on one of what we call the units one of the cylinders Now this is a 10 RTA 96 C 10 means 10 cylinders So it's already got 10 cylinders is bigger than most car engines 96 means that the bore of the cylinder is 96 centimetres across you can fit in the cylinders. They're that big So these things are absolutely massive that huge pipe you see going along the top there the big silver one That's the exhaust manifold The stroke of one of these as well 2.4 meters the piston goes up and down 2.4 meters When you look up at it from what we call the bottom plates right down at the bottom of the engine room you can see the scale We've got three ladders going up towards the top of that engine Now that big round thing there you might think that's a flywheel underneath there, but it's not It's actually what we call the turning gear a massive cog Use a tiny little electric motor to spin the engine round before you start it to make sure it's all lubricated Now just to give you an idea of scale. This isn't my picture That's what a banana is in relation to one of these you can see the little guy stood on the top there by the exhaust valves Now these engines are really different to normal car engines First off the crankcase is so big that it's got ladders inside it You have to climb inside the engine to do some maintenance work. It's really slippery and grim But they're two-stroke What you have to do is you have to pressurize the space underneath the piston So you can force air in at the bottom and then the exhaust goes out of the valve at the top It's like a two-stroke motorbike engine where the crankcase is pressurized It's not technically the crankcase in this situation, but it is quite different So what does a piston and a cylinder liner look like in one of these? So on the left hand side there you've got a piston you carry a spare piston so you can swap it out It's absolutely massive On the right hand side, you've got a cylinder liner. It weighs about nine tons So these are heavy heavy things again. You carry a spare cylinder liner those holes you see around the bottom That's where the air gets forced into the cylinder to push the exhaust gas out Now of course you have to measure to see if the engine gets worn So you take the exhaust valve off Which I made it sound like it's simple. It's not that simple and you climb inside the cylinder Use a very long micrometer as a stick and you measure the wear on the cylinder This is when one of the ships I was on was being built Another crazy thing those pistons need to be kept cool. You need to keep that piston actually physically cool It's not like a car where you can just rely on the oil in the crankcase and the rest of the liner keeping it cool So what actually happens is you oil gets sent up the middle of the piston rod Sprayed through I think about 56 nozzles onto the underside of the piston and then it drains back down into the crankcase Really really cool little system that So how do you get the power from the engine through to the propeller? It's just one big propeller That's it. Well, you've got a gigantic prop shaft and that is the prop shaft on this ship. It's quite long It's quite thick. I think it's about 90 centimeters across again a massive solid chunk of metal to carry the power from the main engine Back to the propeller and how big is one of the propellers? Well, it's about that big This is when one of the ships I was on was in dry dock so you can see the sheer size of this thing It's absolutely massive The edge of that propeller actually moves so quickly that you get cavitation little bubbles of steam forming And one of the ships I served on a Southampton actually had a tiny little window in one of the ballast tanks When they did a study to monitor how that cavitation happens They put a camera in there to watch the propeller go around underwater Now a weird thing about these these ships is the engines don't really go that fast If you're moving a chunk of you know, six tons worth of piston up and down Moving at two and a half meters you can't move it that quickly. So at most they do Sort of about 105 revs per minute. So very very slow compared to a car engine When you're stood on the top plates and the engines running it will shake you it pulses through your body It's that kind of frequency Now the other thing is is that if you want to go in reverse, you don't have a gearbox There's no gearbox to change your direction. You stop the engine And you turn it round and make it go the other way. You literally reverse the engine to change direction So if you need to come to an abrupt halt You're motoring along 100 rpm 25 knots and you need to stop quickly You need to stop the engine bring it back in the other direction and try and slow down Now how much power do these make? Well, it's kind of variable But it's between 80 megawatts and 120 megawatts. So we're talking really really huge amounts of power This is the power meter on the ship Now the cool thing is the way it actually measures how much power is developed on the engine is it's got two sensors on the prop shaft Couple of meters apart from each other and it measures how much that 90 centimeter chunk of metal twists It's actually measuring the twist in that to work out how much power at this moment in time. We're doing 65 revs Quite quite low revs. We're only developing 15 megawatts not that much power I say like that's a token amount of power How do you start one of these things? Well, there's Thousand tons of rotating metal there You can't just turn an electric motor on like in a car. So you start it with compressed air So this is called the start air system It's 30 bar. So that's just over 400 psi give or take. This is scary pressures Most air compressors kind of top out at about 150 psi if you make a mistake at these pressures Bad things are going to happen each one of those tanks the walls are, you know, huge huge thickness But you store that air up and then something like a distributor and pneumatic distributor Admit air into each cylinder one by one and starts the engine You also need to open and close the exhaust valve and you need to inject fuel So this is on what we call the middle plates the kind of middle section of the engine On the outside there the two big silver pipes leading up their hydraulic lines leading to the exhaust valves So they're hydraulically actuated a massive camshaft is rotating around underneath pushing Hydraulic fluid up there The bit in the middle is the fuel pump. It pushes fuel heated up to about a hundred and forty degrees Celsius Up through a pipe through to the cylinder head where it gets split into three and it goes in through three injectors So there's this fuel pump covers two units So you've got multiple fuel pumps across the length of the engine Now normally all of this is done automatically All of it's happening in the background by pressing buttons on the bridge But you've got a practice for when systems fail So right in the middle of all of these main engines you have some sticks You literally have sticks that control how the fuel is admitted to the engine So at the moment you can see there we're in remote control position But what you can do is you can take it out into run and start so you put it into run You pull it through to start it will put that start air through into the system You can choose forward or a stern and then on the right hand side You've got something that controls how much fuel is being admitted to the engine So we'd practice this you call it riding the sticks It's really really challenging Normally that control system is metering how much fuel there is 10 times per revolution and you don't have that ability So you're sat there trying to maintain revolutions really really challenging You've got to wear a headset as well the noise in the engine room. It's deafening So you've got to wear a headset to get instructions from the bridge if they need to change speed You remember I said that you need to have that pressure in the crank case to force the fresh air into the piston when it's down at the bottom and The way we do that is with turbochargers. So these are the turbochargers That's the exhaust side of one of three turbochargers. They're about the size of me So not actually that tall The thing is though those turbochargers kind of stop working at low speeds anything below about 25 30 rpm They just don't have the exhaust gas to generate air flow So on the left hand side we have what's called a scavenge blower It's an electric fan that forces air into the scavenge space to take up for the turbocharger The noise at this part of the engine room is deafening. These are like jet engines essentially.  It's a really really clever idea Now the the intake for these it takes the air from the engine room It just sucks the air in through a big filter on the other side So it's coming through the engine room you get a really weird effect called turbochargers surge sometimes It's kind of when the amount of air that the engines bring in doesn't really match up with how much the turbochargers Generating and the turbocharger burps or coughs people say now Having stood next to one of them this big when it coughs Yeah, it's a bit more than a cough to be fair. It's a bit scary Now the next slide and there's a mild picture of a mild injury on it It's just a red arm really okay, but I thought just in case See fairings dangerous There's all of this machinery all of this stuff going on around you and accidents happen And you might recognize that picture on the right-hand side there. It's exactly the same color It is well, it's the forward turbocharger off that very same ship. I was on board when this happened This is an accident report Since she the pipe came off the front of that tank seven bar air Hit him with the the walnuts Sounds a bit strange It didn't actually look that bad to start with it just looked like his skin was wet You know like an abrasion, but then over the course of the next hour or so He was in real severe pain and we actually had to divert to another port to take him to hospital So pretty serious accident that Another thing that that ships this size engines this side have got that's unique is the crankcase It's huge.  It's it's sunk ships before These big round doors on the side They're explosion relief valves if there is an explosion it lets the explosion out But doesn't that air back in so there can't be a secondary explosion Now this main engine it needs power. It needs all those pumps It needs cooling all of these things going on So you need to generate electricity to make the main engine work And you do that with generators So on this particular ship the green one that we see here. We had four three point six megawatt generators So just just over 14 megawatts of power quite a lot and They power all of the pumps they power all of the systems on board. It's quite a lot of power But you do have all of those ancillary systems You've got all the pumps so you've got high-temperature cooling water which transfers heat to low-temperature cooling water Which transfers it into seawater? You've got lube oil systems for the main engine. You've got fuel systems hundreds of pumps firefighting water Just so much stuff going on You've also got these big heat exchangers which are titanium plates Stacked together with rubber gaskets between them sometimes you have to open them up and clean them It's a really really unpleasant job with a pressure washer We've also got to purify the fuel so those those bulbous things are called fuel oil purifiers They're centrifugal purifiers. They spin round at some god-awful RPM and they take water and dirt out of the fuel So it can be used in the main engine And on the right-hand side my favorite piece of engine room equipment the ship tank and When you're the junior one on a ship you look after the sewage plant You're the one who deals with everybody else's poo It's not just a tank though. It's actually a digesting plant. It takes the sewage in it digests it bubbles air through it Chloronates it on the outside and then puts it into the sea. I did actually quite looking after it to be fair The electrical systems on these ships are hugely complex So those generators you saw they run at 6.6 kilovolts. That's a really scary voltage Now the only thing on the ship that actually uses voltage at that level is the bow thruster a massive propeller That sits underwater in the bow the front of the ship that helps you dock Everything else gets dropped down to 440 volts like you'd have in most industrial situations Now the thing is to get those big generators starting those four 3.6 megawatt generators Well, they need loads of pumps running as well So you have what's called an emergency generator now This is a genuinely baby generator 300 kilowatts or so normally in the accommodation sometimes up forwards and That will generate enough power to compress air to get pumps starting to get one diesel generator running Which can then bring up the other diesel generators that will then start the main engine If you lose all of those systems you have what's called a blackout You lose all electricity the ship will stop working for a few seconds There's a few battery-backed things, but nearly everything will stop at that point And if that happens it in an opportune moment the Malacca straights the English channel you lose power If the main engine stops working if you lose electricity You don't have a rudder if you're not moving forward the rudder doesn't work So it's something you really want to avoid This is the switchboard room the left-hand side. You've got what's called a mimic panel It's all the buttons to control that 6.6 kilovolt system on the right hand side You've got what's called a motor control center. It's all contactors and the control systems that control over the pumps and machines in the engine room The 6.6 kilovolt stuff is just scary territory. I remember the first voyage I went on We used to rack these breakers out after making sure they were dead just wearing a boiler suit That's it. Well shoes and stuff as well But there was no specific protection gear But then there was a really serious accident where someone I think lost the front part of their arm because they racked a breaker out Without making sure it was isolated and from that point onwards We had to get these crazy suits on face masks use loads of equipment to make sure we're doing it right That's the bow thruster It's a 6.6 kilovolt motor normally about two two and a half megawatts And all it does is move water from one side of the ship to the other so you can move the front of the ship in and out But the reason for having 14 megawatts of power on those generators is actually these things what we call reefers refrigerated cargo So when you take one of these on board you've got to power it you've got to plug it into the ship You've got to get three-phase power to it now for say the Southampton a ship I was on it took 6,000 T use so 3040 footers But only 700 of those spaces were allowed to be occupied by reefer so they were the ones you could plug the power into It was a hugely time-consuming job monitoring and keeping them all going Now, I don't know if you saw this while back on Twitter There was this this beer map the largest cargo ships can store 745 million bananas in nearly 15,000 containers No, no, this just doesn't make sense what they've done is they've worked out How many bananas if you filled every single container on the ship with bananas? But there are no ships that can take a full 100% banana load There's this news there's new sequences of words happening here But yeah, ridiculous Now container ships like this operate what's called unmanned machinery space or UMS now that means as an engineer I can go to work between 8 and 5 and then at 5 o'clock we put it into UMS and Then I can go and have my dinner chill out in the evening unlike the decades who have to look out the window all of the time So there's loads of alarms and things going on in the background This is the alarm signal light that you get I'm sure it's got a better name than that We just call them lights the top one there the green one. You never want to see that lit That's a lifeboat that means abandon ship if you see that lit It's a bit of a game over situation the one below it the cog and the fire means and fire in the machinery space Again, not great to be honest You don't really want to see that but every now and then it will go off a bit of oily mist some will be welding and something like that the one below it's actually Unfortunately, I never got any pictures of this the whole engine room can be flooded with co2 if there's a fire You seal all the doors you seal all the vents and you dump co2 into it on this particular ship It had about 120 of those massive co2 bottles wired up to a huge manifold and it would trigger and fill the space If you're in that space and you see that light come on You've got 15 seconds to get out before it gets triggered You'd obviously try not to trigger it with someone in there But you know the other ones the cog and machinery line something's not working quite right the telegraph one That's if you happen to ride the sticks on the side of the engine the next one Unsurprisingly means the phone tringing Now when you're in your cabin when you're having dinner when you're in the bar What you have is panels alarm panels on the walls of those rooms and you'll go in as that duty engineer on watch You asked to monitor those alarms that night and they will come through to this panel So if you're having lunch and an alarm goes off you go and have a look and it will say something like Had a tank low level something like that and then you're going to investigate it You'll go back down to the engine room and see what the problem is Now sometimes you'd go down to the engine room and things would have not gone too well Something bad would be happening something to make your day unhappy and there's this big button Well, the lots of buttons like this you press and what that would do is it would alert every single engineer on board and alert the bridge That there was a problem Now one of these problems that we saw I've got an alarm at lunchtime and I go down to the engine room and That inside that red square there water was spraying out. That's the high temperature cooling system So we're talking water at over a hundred degrees Celsius because it's slightly pressurized Spraying out of here. Yeah, not a good situation So what happened was that header tank at the top there should normally be full It's like a header tank in any system We sprung a leak on the main engine and that header tank was dropping down really really rapidly Now the thing is that high temperature cooling system is shared between the diesel generators and the main engine If we lose that high-temperature cooling system, we lose the main generators Which in turn means that we can't get the main engine started What we actually did was we we got the engine stopped very quickly And we lifted the fuel pump So what you do is you can literally that big fuel pump on the middle plates You can you can turn a handle on the side of it so that cylinder no longer does anything There was no longer an immediate requirement for cooling on that cylinder so we could get underway and then fix the problem The other one and this was like this was the worst worst few weeks of my life. Maybe that's a bit of an exaggeration I was asleep in bed about 10 past seven in the morning and the general alarm sounds which is you know That's when someone hits that assistance required button boiler seat on straight down to the engine room and We've got a real situation About two tons of fuel oil had sprayed out the top of the main engine all over the engine room There was a fine mist of oil everywhere And what happened is this little tiny pipe That circulates fuel around the main engine all of the time just to keep it warm the fuels got to be kept Kept heated up to 140 degrees It just gets circulated around an 8 mil line had come off in the middle of the night and dumped two tons of fuel Across the engine So it's sprayed out It got everywhere It was all the way down at the bottom all over the top plate all over the bottom plates in the bilges It took us weeks and a crew of about 15 Taiwanese women on board Probably not great that we're employing cheap labor like that to be honest, but to clean the ship. It was it was crazy Right, we're actually on track for time So these are just some of the things that like people see about ships and think well, that's cool But that was 16 years ago. I don't do that anymore hack stuff for a living So why hack a ship? Well, I'll be honest with you and I still speed to that's quite a good film You know essentially someone on board the ship hacks the ship and I think a few of you probably last night might have watched hackers Which also involves the plot line of Hacking ships remotely and I don't know if anybody recognizes that Yes bugs. This is so formative in my career. It was just such a major influence to me when I was a kid They they just got involved with all these crazy plots. I don't know if they ever did actually get a ship that they could hack Now the thing is when you look at a cruise ship, they're really really complex. There are hotel their shops they're a ship all these different systems all coming together in one place and Keeping them secure is really really difficult Just when you look at the different networks on board, you've got TV. Everybody wants entertainment. So you've got a TV network You've got your VoIP phones The ventilation system the passenger Wi-Fi the entertainment so that you can watch the what's going on in the theater in your cabin You've got CCTV Hundreds possibly even thousands of cameras on board these days. You've got your business networks You're normal corporate stuff third parties like the shops on board You've got your control networks the things that you know make things move make things do things and you've got safety kneeworks as well Now the thing was when there was a limited number of networks on ships You had discrete networks You had an individual cable going between the bridge and the engine room to do the control systems You'd have a TV cable. You'd have a VoIP cable, but the thing is that takes up lots and lots of cabling and space So ships have done what's called converged networks. So they're using VLAN trunks So they're sending lots and lots of different networks down one physical cable Now from an attackers perspective from a hackers perspective that means quite a lot If I just attack that single network if I plug into the TV socket in my room my cabin I don't get much. I just get access to the TV network However, if I compromise the switch that turns those networks into the VLAN trunk or literally just unplug the VLAN trunk cable And stick my own machine in it. I've got access to all of those networks Crewships are divided up into what's called fire zones. They're also watertight as well So they're vertical divisions and this has an impact on how you design the networks on them You have what are called RDPs remote distribution points massive network switches in each one of those fire zones and To get all of these different signals into the cabins You have what are called cabin switches So every pair of cabins will have a cabin switch that does the TV the VoIP the water the lighting all of those different things So they go vertically down the ship. So you don't have to make holes going across to carry those cables Splitting to port and starboard for redundancy But you've also got other things connected to it. It's a properly converged network. You've got your satellite connection You've got bridge systems engine room systems all going down those cables That's just a patch panel for one of those RDPs on a ship. You can see the number of cables. It's huge So we've got a cabin switch and our cabin switch is just outside our cabin So we can physically inspect it I can open up the panel and I can look at that switch We can see it's got a TV connected to it. It's got our VoIP phone It's got what we call the cabin control system that does lighting HVAC door and water We've got other cabin. That's also on that switch as well Now in the passageways, you've got Wi-Fi access points and CCTV as well So people want to also dangle those off these cabin switches as well Now those black lines on the left-hand side, they're a trunk They carry all of these different networks, which means to me as an attacker. I really want to look at that network So what did we do? Well, we unplugged our TV and our VoIP phone. So now we've got a cable going into our cabin We then took the cables that the TV and the VoIP are on and we patched them into the trunk We then put our own switch in the cabin. So we've looped that VLAN trunk Through the TV and VoIP connections physical connections into our cabin on our own switch And now we can attack those networks at will we can do what we want to them That's the kind of situation we've got there. We've opened up that panel and that's that switch What can we do with that? Well, it turns out quite a lot a lot of the time the TV systems No one set a password on them Now imagine if you could change the image on every single TV on board You could probably cause widespread panic the VoIP phones no password the Wi-Fi and the CCTV quite often insecure So in one instance we had control over all 800 CCTV cameras on board The other things the cabin control system now This is really there to save energy when you're not in your cabin you take your card out The the air conditioning and the lights turn off, but you can also turn that and flip it on its head and attack that system Now a weird thing is the way that this system works rather than the cabins connect through to a server like we're kind of used to With a lot of IOT and things like that the cabin control server connected out to the cabins But that meant as that attacker who's got network connectivity through to those we could compromise the cabin control system Now unfortunately the client they didn't give us permission to do this But what we wanted to do was write something on the side of the ship One of the ships we've been on actually has this as functionality on the bridge There's a web interface that you can draw on the side of a ship. I was really really Saddened to find out that on a lot of ships when they do this It's literally they get a chart and they write down which cabin and then they go and turn the lights on in each cabin Yeah, you don't see behind the curtain Another one that we find really useful on ships is the fact that we have physical access to this equipment Now most Cisco switches most juniper switches lots of equipment's got a console port a serial console And when you connect to that you can do a lot of things one of those things is called password recovery mode You can dump the configuration of that switch The thing with a lot of these is they'll quite often contain passwords or information that can attack other systems So it's one kind of core principle of security the compromise of one device should not lead to the compromise of many But the thing was was in this instance We took the config of our switch and we recovered a password. It was encrypted rather than hashed so we could get that password quite easily It was a really good password Good quality and then we thought well, let's see where it works Is it just this switch or is it lots of them and it turns out actually that in this case It was only one of those RDPs that it worked on someone had forgotten to change that password on the RDP But we're now getting to this dangerous position where we're starting to get closer and closer to these engine room and bridge systems The things that let you control the ship Don't you remember I said we've got all these motors and we've got the motor control center They're literally contactors big relays that turn motors on and off now if I'm physically stood next to them It doesn't really matter. I can just start and stop I can press those buttons So as a hacker what I want to do is I want to get further and further away from them I want to do it from outside the engine room. I want to do it from my cabin. I want to do it from my sofa Now most traditional control systems used to be what we call air gap There was no connection from the control systems through to the business networks and the internet And the thing is you come along as an attacker if I can access the contactor I can press a button on it The motor starts, but I'm already there. What's the impact? I could go to the PLC the controller under or I could go to the HMI the display and Trigger something from that perspective, but it's not a great attack The thing is is that people add these jump boxes pivots between different networks They want to get data out from the control system to the business network. They want to be able to monitor things So we're always looking for them because that means that we can start attacking them from the business network and the internet I'm not sure if Ryan's here. He might be yes, Ryan's there. Hi Ryan Ryan said this a few years ago much of hacking is about understanding systems better than those who built them and Using that knowledge to do what is supposed to be impossible and I often find this on ships This was completely unrelated to ships. It was to do with the crypto wallet But we get on those ships and what we want to do is we want to understand those systems better than the people who built them So I'm gonna give you a few examples of how we've done that Now typically we've got this air gap the bridging engine room systems on one side and then we've got the satellite Connecting through to the corporate network. You've got crew welfare network So you can browse the internet in the evenings. You might have third parties on board, but there's a gap between them Now one of the major costs in shipping is fuel you want to make sure your ships are working efficiently So people put remote monitoring systems in they gather things like your speed how much fuel you're consuming What speed the propellers spin at all these bits of data and we could see that there was one of these on a ship We could see it on the network, but we didn't know where it physically was or what it did and it took me a long time Now at the top there you've got the voyage data recorder the black box of a ship That's recording all of those bits of data, but underneath it. You've got a panel screwed onto the wall no label or anything like that Eventually I unscrewed that and we found this remote monitoring system literally screwed in a panel behind the wall No one on the ship knew where it was or what it did So it's got ethernet coming in one side. It's got a connection to the network. Which means we can access it from afar On the other side, it's got serial connections coming into it carrying data from various systems But you might notice something about those connections. There's only two wires on each one of them It's got eight different connections, but there's only two wires Now this is a crucial thing At that point in time you didn't understand how that data was getting between the bridge systems and the monitoring system But it turns out it was using conventional serial you've got a receive and a transmit pair The thing is with a lot of serial systems like this what you can do is you can just cut one of the lines So the data is being transmitted from the bridge systems through to the monitoring system There is literally no way for me to get data back in the other direction So in this case the system was secure. It was just confidentiality. There'd be the worry another one This was on a container ship. We found this little kind of rugged Industrial PC in one of the racks and no one knew what it did We plugged a monitor into it It's often the easiest way to find out what's something doing and we noticed it was running some software again remote monitoring software But it was using these little things that convert between IP and serial So it's converting between that that ethernet world that TCP IP world and that serial line world After a lot of digging and I'm talking a lot of digging we found out where it was physically connected We had one of them going through to the bridge systems and we had one of them going down to the engine room We looked at the bridge systems and it turned out again that they'd cut one of those two lines It was just transmitting position and speed data down to the monitoring system. No security impact So we moved on to the one that went down to the engine room I mean this really was it was a cable going all the way from the server room just underneath the bridge 11 decks down into the engine room and we had to physically trace that cable. It was it was time-consuming But this was using something called Modbus Now Modbus is a different protocol. You'll notice that it says request reply request reply You have to ask for data from the other end before it'll be sent back What this means is you can't cut one of those wires You've got to have the ability to transmit data from one end to the other Now the thing here was was you don't just you weren't just able to request the engine speed We were also able to change settings on the engine by making requests through to that PLC Now unfortunately, we weren't allowed to demonstrate exactly what we could do We think we could have stopped the engine and made it operate strangely But again to do this you'd have to be on the ship But then comes in team viewer Team viewer is everywhere Now the thing was the shipping company wasn't paying for this tracking system anymore So we had a company with team viewer access to a box that had access to main engine systems Who there was no commercial relationship with and it was team viewer So we had that remote access vector so we could really really cause something serious to happen another one a generator on an offshore support vessel in There it had these little yellow routers now We could see they only had one network port on the bottom of them So it was labeled LAN slash one now This is really weird the idea of one network port going into the bottom of a router that's supposed to secure something You can't really properly secure something if the network traffic is going in and out of the same port So again, we tore that ship down We looked at how it worked and we realized that this router was actually completely pointless If you wanted to try and secure the traffic by going through the router fair enough But we could just set our IP addresses to be the same as the controllers on the generators and that was it We can pop those generators How did we do that? Well, we could do it from the cabin. There was little TV boxes in each ones of the cabins We unplugged the network connection on that. We had direct network access Went down into the control room and we could see the brand and make of the controllers there a Little bit of software downloaded for free from the internet And we could now open and close the contactors that controlled the power coming from those diesel generators So onto the cruise ship Cruise ships bridges are really really complex now They have something called an ICMS integrated controller monitoring system. It's all the screens It brings together all of the systems so you can operate them from one central place You also have something called a safety management system the SMS Now what this does is if there's an event on the ship that needs evacuation if there's a fire flooding you control it from here It has access to the watertight doors the CCTV Aspects of the ICMS system. It's glues all of those things together But this was my goal these are called as iPods They're massive electric motors on the bottom of the ship that both steer and control the speed of the ship I wanted to get access to one of those Now we've already secured network access from the cabin so I can access some systems that I shouldn't be able to So from my passenger cabin I've got access to that core network Now the thing is I now want to get to the safety management system or the ICMS, but how am I going to do that? Well, it turns out that when you're evacuating a Massive cruise ship you want that information not only to be in the safety management center But to be available to people at muster points people are involved with the evacuation So there's a series of rugged tablets that connected via Wi-Fi through to the safety management system To allow it to be viewed from wherever on the ship So we had these SMS tablets that access the core network and then through to the SMS network So how did we get the password for this system? Yeah And It's pretty common to find stickers on stuff on ships. This wasn't off that particular situation But you can see that the amazing thing was we told them to make the passwords longer on that and yeah, that's the fix So we've now got access to the safety management system floorpans of the ship CCTV lots of things We had control over the watertight doors So we could move these massive doors that are below the waterline that designed to prevent flooding quite serious already So the safety management system has been compromised now An interesting thing on cruise ships is they've got three fire alarms that run redundantly Because fire on big ships like that is a major threat if one of them breaks Nothing's nothing bad's gonna happen if two of them break you've got to go on to fire watch You've got to have people walking around the ship making sure nothing's on fire if all of them break Everybody's gonna get off or the passengers get off. That's gonna be a big problem if you're away on a cruise So we thought let's have a crack at the fire alarm turns out The SMS logged into the fire alarm to pull data back from it That password was stored in a plain text file on the SMS system We could log into it and we could actually get a VNC remote session onto the fire alarms We then look to the voyage data recorder again if that breaks the ship cannot sail So we thought we'd have a look at that of course the default login from the manual worked at the lowest level We could download a configuration file for the voyage data recorder. We got a load of password hashes I'll skip over those Those password hashes quickly gave us a kind of hidden account password That hidden account through the web interface. Let us edit any file on the voyage data recorder Including the shadow password file. We edited the shadow password file to add our own account And then we were roots on the voyage data recorder. We could have bricked it again Things aren't looking great are they we've we've caused a lot of problems from so far, but let's make it worse The officers wanted to be able to monitor what was going on on the ICMS system from their cabins So they built a read-only system So the the officers could connect from their cabins filtered to that network to connect through to the ICMS to view But it was a read-only view. There was no way it didn't matter what login I gave to the ICMS system. I could not take control of anything from that perspective But the problem was was we could do what's called a breakout from that ICMS interface We could break out of it using the print dialogue It's a really common way of doing things and we're now admin on that remote box So I'm no longer using it as it was intended. I'm not using it as a monitoring system I'm using it as a normal computer. This is really useful to me. I can pivot to other networks from it So now we've got control over one of these machines within the ICMS security domain pretty serious at this point The thing was was I wanted to take control of the azipods. That was another system and That was labeled and marked in diagrams as connected by serial Now the thing with Syria is when you've got serial connections going between two devices like this if I compromise one endpoint I can't remote desktop into the other end I can't SSH into the other end. I can only kind of send serial signals down But the thing is lots of ships again to save wiring do something called serial over IP They bundle lots of serial connections down one physical cable Now the thing is again, if I just want to cause something to happen on a motor, that's fair enough But I want to use it slightly differently So I come along I compromise that endpoint the machine that I'm on and now I don't just have to send serial down that TCP IP connection I can do remote desktop I can do SSH and I can compromise the host at the other side So we're abusing that connection that people thought was serial only The interesting thing was the diagrams really did make out that it was serial It literally even physically on the box said serial and then had ethernet coming out of it going to ethernet switches So people thought you couldn't really impact those other systems So we're now several remote desktop connections deep into this system, but we're on the asie pod control system now Again, there were some vulnerabilities. We had to work out there, but we've now got control of that system It's looking quite serious to be honest So yeah, that's me sat there on the ship from my cabin able to control the asie pods not brilliant But I'm still on the ship Let's make this really bad. I was down in the engine control room We've got open access to the ship we can walk about do what we want and I noticed that the cabin control system Which is in a separate control room the hotel control room had team viewer installed and Let's just say the password was not great on that session And I did have to be on board to get the ID and the password But that meant that the people who administer who perform remote access to the cabin control system also had access to it So we demoed that and you could connect remotely So now we've made things really really quite bad. The cabin control system is connected to the internet So we've compromised that but how are we going to get from the cabin control system through to the ICMS? Well, it turns out the cabin control system has to adjust how it operates based on things like sea water temperature and air Where'd it get that from? It gets it from the ICMS So now we've got another connection, but what is that connection? Well, lo and behold, it's Modbus again, but it's Modbus TCP. It's over an ethernet connection So although normally what's meant to happen is you'd say what temperatures the sea water you get the temperature of the sea water back In this case we RDP'd from the cabin control system through to the ICMS and we've now got remote compromise So, yeah Completely remotely we were able to get onto this cruise ship and take control of the ASI pods So from the internet compromise the cabin control system using TeamView Compromise that ICMS remote platform because we know how that works. We can break out of it Compromise what's called a pack of programmable automation control in the engine room another story for another day And then compromise the ASI pod system So, yeah That's the actual screenshot of me on TeamViewer at home connected to the ASI pod system on a gigantic cruise ship I did ask if I could actually steer it and they were like I don't think so. That's a little bit dangerous. Oh well So is this stuff kind of stuff gonna happen we had on board access for days in fact we were on board for 22 man days to work out all of this stuff we found lots of other problems, but We had inside access. We had diagrams. We could unplug stuff. We could trace stuff people weren't asking us what we were doing I think the chance of that long chain of exploits ever actually occurring by someone who wasn't on board Who didn't know the systems is very low, but now our client knows about all of those issues and has applied controls to stop them being problems Should you go on a cruise? Not if I'm on it Interestingly, we've also managed to get pay for food as the captain in restaurants There's lots of other things. We've been a get free Wi-Fi as well on certain cruise lines. They charge a fortune But no, they're complete. They're safe. I Wouldn't go on a cruise personally, but I don't think they're gonna be hacked So, yeah, I was gonna talk briefly about how to get into information security But if anybody is interested come and grab me afterwards to have a chat. I love talking about ships I love talking about hacking that my voice is going a bit. So I do hope you enjoyed that I hope you learned something and enjoy the rest of your EMF camp


Benjamin T. Jones is a historian and social commentator based at the Australian National University. He's published widely on Australian Republicanism, nationalism and citizenship, and I'd like to say that in fact no other academic has done more for the Republican cause in recent years. There have been others in previous years, but as far as I'm concerned, Ben Jones is the hope of the academic side at the moment, and I thank him deeply for that. Ben completed his PhD in 2012 at the ANU's Humanities Research Centre on the granting of responsible government to the Australian and Canadian colonies. He's the author of a number of books, Atheism for Christians, Republicanism and Responsible Government in 2014, and his co-editor of a book that a number of you will know called Project Republic, which was co-edited with Mark McKenna. His next book is titled This Time, Australia's Republican Past and Future, and it will be released on Australia Day 2018. Tonight's lecture is an Australian Republic and the Politics of Hope. Some of you will know that it is a reprise of the Daniel Dennehy lecture, which was given in Melbourne last Saturday night. I think there are one or two people here who are at that lecture, and they say it went over extremely well, and I'm a great believer in, if I can speak as an ARM member, of not just speaking in Canberra, which in some ways is an easy audience, but speaking in Melbourne and other parts of rural New South Wales, so I thank Ben very much for that. So I'd like to call Ben Jones to the podium to give a public lecture on the Australian Republic and the Politics of Hope. Please give him a warm welcome. Thank you for those very kind words. Good evening fellow citizens. May I begin by acknowledging also the traditional owners of this land and expressing what a pleasure it is to speak about this topic that is so dear to my heart and indeed many of us here, and I also thank the School of History and the Humanities Research Centre. And while this is partly a reprisal of the dennehy oration I delivered in Melbourne last week, so there is a lot of attention given to colonial politics in the 1850s and the way dennehy framed the Republican argument in the language of hope. But what I really want to emphasise tonight is the deeper meaning of republicanism, a term which in the 1990s was largely gutted of its ancient and enduring spirit. So perhaps rather than Daniel Dennehy repeat, a better title for tonight's talk is Why Do We Want a Republic Anyway? In 1999, the Australian Electoral Commission released an official referendum pamphlet with the wording and some general information and then a case for the yes and no team. They were given nine pages each and it was colour coded, a blue page for the yes team, a yellow page for the no team and one of the big headings on the yes side was a small step important and safe and then it went on to list not why Australia should become a republic but what would not change. The flag would not change. Australia Day would not change. The running of our everyday government would not change. And while the no camp used all nine of their pages, the yes camp used just four so towards the end of the pamphlet there was page after page of monarchic propaganda followed by blank blue pages offering no rebuttal. So why did the yes side take this approach? It was entirely defensive in its structure. The no camp had been waging a unabashed scare campaign for the better part of a decade with some frankly outlandish claims. A republic would destroy the stability of Australia's Westminster system. It would give inordinate power to politicians at the expense of the people, divide the nation, be an assault on Australia's Christian heritage, be disrespectful to the Anzacs and leaders, inevitably down the road to becoming some South American style banana republic. And with all of these falsehoods and wild rhetoric and hyperbole lost in a sea of fake news as it were, you can understand the strategy of wanting to emphasize the smallness of the republican movement and the safeness of it. But the problem is the debate ended up being on monarchist terms. If you were intentionally trying to make the Australian republic seem like some second tier issue, some inconsequential minor bit of tinkering, you could hardly come up with a better slogan than small and safe. Another header from the yes camp read, becoming a republic simply means having an Australian header state instead of the queen. And once again, this is a very defensive statement. And it's true, of course, in a legal sense, but it ignores what would be the broader social and cultural significance of having an Australian head of state. A republic, I put to you, is the key to breathing new life into our common wealth. It is an investment in civic currency and nurturing a culture of active citizenship. And I mentioned at the denuhi oration that Golben perhaps has the best claim to be the home of Australian republicanism. And back in the 90s, when spirits were high, when republicans had a spring in their step and some wind in the sails, there was even talk of creating a great museum of Australian republicanism to be based in Golben. And it's still a very worthy goal, in my opinion, because civic education is at the heart of classical republicanism. And it's worth imagining the subtle and not so subtle differences it would make to our body politic if we reconceptualised the way we show national honour. Australia excels at public veneration of soldiers and of royalty. If you go to any major city, and indeed most minor towns and other areas, there will always be some public monument to those who fought for king and country in the First World War, and a litany of streets and buildings named George, Victoria, Elizabeth and other royal names in honour of people, many of whom never stood foot on this ancient land. Would it make a difference if school kids making their U6 excursion from Sydney to Canberra as I did more decades ago than I care to name at the moment if they stopped in Golben on the way and visited the Museum of Australian republicanism? And what would it look like? Statues and portraits of colonial republicans. Dennehy, of course, is the star attraction with his speeches and various artefacts. Perhaps the paintings and the letters of Adelaide Ironside would be on display. Perhaps an actor with a long fake beard would dress up as Charles Harper and would be there to read The Tree of Liberty and other poems. There could be a first edition copy of John Dunmore Lang's Freedom and Independence for the Golden Lands of Australia behind glass and then a reproduction for sale in the gift shop. I often mention how ironic I find it that there is a first edition copy of Tom Paine's Rights of Man in the Museum of Australian Democracy, but this seminal work by John Dunmore Lang from 1852 sits in the dusty bowels of the National Library, waiting to be caught upon by the odd historian. And this museum could work its way through the bulletin writers of the late 19th century, Jeffrey Dutton, Donald Horn, the republican revisionists of the 1960s, Keating and Howard and the campaign of the 90s and perhaps a room at the end for the future, a place to imagine our republic, to think about new flags, new coins, a new preamble, and perhaps also a new date for Australia Day. A museum of this kind would be significant, not only as an exercise in national storytelling, but a form of nation shaping also. There is no neutral history. By highlighting certain people and events from history, we are necessarily making a value statement. What we choose to cherish from the past cannot be unchained from our hopes for the future. Australia's constitution, its national symbols, its roads, its cities, its honour system, all combine to tell a story of benevolent monarchy, a ubiquitous presence that cannot be challenged or criticised. For my new book this time, we went through the usual process of securing the copyright to use the various images throughout, including an image for the front cover, and only very late in the production did the copyright holder realise that the design, our cover designer had come up with, is sort of meant to represent a museum where the Queen's portrait is being carefully taken down, placed on its side, on the door of the way out. And we received angry correspondence. This individual was aghast that we would contemplate to present the Queen in such an undignified position sideways, and they withdrew our rights to use the image. And we probably would have been within our legal rights to go ahead with it anyway at that stage, but happily we were able to find another similar image where the copyright owner was a less dutiful servant of the crown. But I couldn't help but contemplate during the whole saga, where does this veneration come from? And is there a single Australian who that person who denied us the copyright would also say, no, there's no way you could dare to even slightly disrespect. Is there a single Australian who they hold in the same regard? In a thoughtful article in The Guardian today, Julianne Schultzard argues that Australian needs a new narrative, and she quotes the Irish writer, Fintan O'Toole, who says, nations tell themselves story. They're not fully true. They're often bitterly contested. They change over time, but they are powerful. And perhaps the Irish have thought a little more seriously than us about what a story of democracy and independence really looks like. In 1948, the enormous statue of Queen Victoria that sat outside the Irish parliament was removed. How inappropriate it was felt to have a foreign monarch announce the entrance to this temple of democracy. After decades in storage in 1987, the statue was unveiled outside the Queen Victoria building in Sydney. Conscious of the irony, the organizers of the 1988 bicentenary were quick to point out that this wasn't actually part of the celebration. But the problematic nature of celebrating Australia's biggest birthday, as it were, with the dour face of an imperial monarch from centuries past, was not lost. What difference might it make to our body politic if the same level of public commemoration devoted to foreign monarchs was given to those who fought for democracy, those who fought for the eight hour day, our suffragette movement, our freedom riders, those who have championed racial and sexual equality and stood for social justice, those who believe that citizenship is a verb. The concept of the citizen lies at the heart of republicanism. Citizenship matters. And of course, with Section 44 of the Constitution, this has given us an opportunity to consider what citizenship really means. Is it as hollow and mechanical as someone who happens to live and pay their taxes here, and possibly not even the latter? The republican tradition screams against this base interpretation. Whenever the citizenship test is debated in public, many people dismiss it as a worthless exercise. And inevitably, it is debated, what do Australian values really mean? But through it all, the trident that both conservative and progressive Australians seem to agree on is democracy, meritocracy, and community. But if these three are the values we hold dear, then there is a fundamental disconnect between what we stand for as a nation and what is stated in our constitution, between what we say we believe and the national symbols we hold. What would Dennehy make of all this? He was small in stature, but his ideas were large. His voice was soft, but his words were powerful. Universally acknowledged as a brilliant orator, he was eulogised as the vehement voice of the South. He was not interested in small, safe, constitutional tinkering, but rather the great work of nation building. As his friend Dr. Lang stated in 1853, the goal of colonial republicans was to see Australia counted, quote, among the mightiest nations on the face of the earth. In a famous letter to Lang penned on 6 June 1854 at his office in Mandelson's hotel, site of the future Museum of Australian Republican history, perhaps, he said, my eye is fixed on one point, doing my duty and establishing republican institutions and advancing in every genuine method my native land. In one of his last speeches, he called for native born Australians to be filled with minstrel fire. And I firmly believe it is time for republicans today to also get some fire in their bellies. For too long, Australian republicans have been walking on eggshells, constantly afraid, afraid of offending monarchic sensibilities, afraid of appearing strident or arrogant, afraid of seeming disrespectful or scaring off potential allies if we state plainly what we believe in the essential equality of all people and the utter rejection of the validity of hereditary birthright. And let me tell you something, small and safe does not win people to the cause and does not get referendums over the line. Passion and conviction do. In 2013, I put together a book called Project Republic, and it was the first call for an Australian republic in about a decade. And back then, it was difficult at times to muster the energy. And there was a sense that some of the contributors could barely bear to lift their pen or get to the keyboard one last time to reprise the arguments they'd been making over and over again for the better half of a decade. As a movement, republicans were still licking their wounds from 1999. There was a Tony Abbott prime ministership to deal with. There was the reintroduction of knights and dames and a sort of gloating monarchist movement saying that with the popularity of the photogenic young royal family, Caden Will, and their children that republicanism was doomed and we might as well all just give up. So I would like to honour those who kept fighting during those difficult years and John Warhurst's name certainly comes to mind as someone who's been indefatigable over many decades now. But today things are pretty different. And I'm sure the current prime minister will not mind me plagiarising him when I say there has never been a more exciting time to be an Australian republican. The ARM has expanded fivefold in recent years. Every state and territory leader is now a republican including almost all the opposition leaders apart from actually our own Alistair Co here. But anyway, we have a republican prime minister, a republican opposition leader and we now have an opposition leader promising a republican plebiscite should he win the next election, which may well come sooner than 2019 if you're following the news. Along with that we have for the first time ever the portfolio shadow minister for an Australian head of state. And I was quick to get in touch with Matt Thisaway and congratulate him on this historic appointment. And I'm pleased to say he's gonna be launching my new book next year. But really if you can't get excited about an Australian republic now you need to check your pulse. This is a good time for republicans. And can I please urge you, there are a number of ARM people around sign up if you're not part of it and if you are get someone else. Talk about this stuff to your friends and your family. It is all about momentum. If we all get one person to join the republican movement it doubles in a day. And get involved as well. Turn up to events like this. Use your social media platform. Give people ARM memberships as their Christmas presents. Turn your thoughts into words and let your voice be heard. So to return to my theme, why do we want a republic anyway? What does a republic really mean? In his genealogy of morals, Frederick Nietzsche posits that it's only that which has no history, which can be defined. In other words, concepts with a long and colorful history are inevitably going to be contested. And so it is with republicanism. Perhaps for some republicanism really is just a small step. Simply replacing the queen with an Australian head of state and as a result, nothing else happens. Monarchists love this kind of republicanism because it prompts the question, well, why bother then? Why is it such a big deal? This is not the republicanism of denihie. And I put it to you, it's not the republicanism we should strive for either. For denihie, republicanism was not just a system of government but a system of values. It was a political philosophy that championed virtue, patriotism, seeing yourself not simply as an individual with rights, but as a citizen with duties. The republican project is not just about having an Australian head of state, but building civic currency, fostering a sense of community, encouraging people to emotionally invest in a shared future. As the classically educated denihie was aware, the roots of republican thinking go back to the Hellenic Hills. The policy of classical Athens was driven not by a monarch or oligarchic clique, but by a community of citizens committed to civic virtue and the common good. The surviving records of classical Athens speak of a culture of active participation. Citizens were not merely permitted but required to attend the public assembly, the Ecclesia, and take pardon policy debates. A special police force roamed the streets when the Ecclesia was in session and would lasso absent citizens with a rope dipped in red dye. The resulting stain on their tunic was a mark of shame. And I kind of wish we had something like that for donkey voters today. I think it would be wonderful if there was some sort of exploding die pack or something whenever someone donkey votes and they go out covered in paint and everyone goes, aha, there is someone who is not taking their civic duties overly seriously. It was Plato's student Aristotle who famously described people as politicon zoon, political animals. Humans are inherently social creatures with a necessary interest in the welfare of greater society. The Ecclesia met regularly to discuss and debate matters of importance to the polos. All citizens had the right to vote and to speak and nine citizens were chosen by lot to serve a term as prodigy and oversee the assembly. The appointment by lot was an article of faith in Athenian democracy because it was predicated on the firm belief that all citizens were equal but also that service to the polos was a responsibility. In 1993, a philosophy lecturer at Western Sydney University, one of my old teachers, Michael Simons, published this idea saying that if Australia becomes a republic, we should also choose our president by lot. Everyone's name on the electoral role who's not in prison or medically unable goes into a big lottery. The name is pulled at random and they become the head of state. And a lot of people laughed. They thought it was a very wild idea. But like the ancient Greeks, the root of this idea is that citizens should be willing and ready to serve the nation whenever they're called upon. And how often do we hear it lamented that people, especially young people, are politically ignorant and apathetic and we bemoan that they're not interested in anything, but that is exactly the type of attitude Monarchy is designed to produce. Leave the problems of governance to the king, to the aristocracy, and to your better. The spirit of republicanism is one of active participation. It is a citizen's duty to be informed, to be looking at the welfare of others and to be ready to step up into a public position when called upon. And of course, if Simon's idea was adopted, Australia would be the only nation in the world who could say it and really mean it that any one of our citizens can rise to the very top. The ancient republican theorists were drawn upon by many influential writers, Machiavelli in Renaissance Italy, James Harrington in 17th century England, James Madison in the United States of the late 18th century all took inspiration from the classical republican tradition when looking for the best form of government. From the Latin res publica, it literally means a public matter. Republicanism places citizens at the heart of the polos. It is the act of political participation, the pursuit of the common good and the placement of legitimate authority in the hands of the people that distinguishes it. Monarchy by contrast focuses on the king or queen. From public ceremonies, festivities, the passage of law, the naming of streets, all aspects of life are filtered through the unearned power of the monarch. It is the king's birthday the nation celebrates, the king's highway that has traveled, the royal assent that is given and sacred indigenous land is renamed Crownland. A royal subject is passive. Their duty is to cheer as honor is poured on their sovereign. A republican citizen by contrast is active. They seek honor for the nation they belong to and are empowered to participate in the process of governing. To use Isaiah Berlin's terms, republicanism is a positive theory of liberty. It's not just the absence of oppression that makes a society free, but the presence of democratic institutions geared towards active participation in the common good. An ideal republican state should have programs and processes in place to encourage active citizenship and the pursuit of civic virtue. And Australia already has many republican features. I was recently in the United States and while I was there a terrible shooting took place in Las Vegas. And it was called the worst massacre in modern US history with 59 dead and hundreds wounded. And in the aftermath, listening to the news and just talking to people, there was a palpable sense of hopelessness and despair. Yes, this is terrible, but there's nothing we can do because it simply is an individual right. And I couldn't help but contrast this with Australia and the approach we took to Port Arfa under a conservative government, no less. And what becomes clear to me is that our nations understand freedom in very different ways. While the US has been so profoundly shaped by liberalism and the primacy of individual rights, Australia has looked to republicanism and asks first what serves the common good. And this is at least part of the answer why Australia has no bill of rights. And apart from a few academics and legal people here and there, there's no great movement to gain one either. This is why as the 2016 election demonstrated, Medicare is the sacred cow of Australian politics. This is why mateship is seen as a national totem. This is why the Eureka Stockade used a communal rather than individual oath. Not I stand for my rights, but we stand and we swear by the Southern Cross to stand truly by each other, to stand and fight to defend our liberties. But republicanism is not just about the common good and active citizenship. It is also about the essential equality of citizens. It is about judging people on their actions, not their lineage, and it shows admiration not for material wealth a person may have inherited, but the social wealth a person can contribute to their nation through acts of service, philanthropy and civic mindedness. And no one knew this better than denihie. In the early 1850s, New South Wales was a society in transition. The colonial masters in London had acquiesced to long running demands for a democratic constitution. Given the freedom to draft it, the colony faced an existential crisis. What kind of society did they want to become? On the one hand, the powerful squatter class wanted to cement their own oligarchic position through legislation. Led by the native born William Wentworth, the squatocracy proposed a bill that not only discriminated against the urban metropolis of Sydney through fixed unequal electoral boundaries, but would confer hereditary title and reserved up a house seat upon themselves and their descendants. Wentworth and denihie epitomised two very different responses to classism, elitism, snobbery and inequality. Both were native born and both were made to feel inferior because of it. Both were the children of convicts. Wentworth remained hurt and bitter his entire life because it didn't matter how many mountains he crossed or how much wealth and land he accumulated, he was never accepted by the Sydney elites and even his beloved daughters were deemed unsuitable for marriage into respectable Sydney families. So what do you do when faced with this kind of discrimination? Well, you can either beat them or join them. And Wentworth fantasised about joining them. If only he were ennobled as the Lord of Vore Clues, if not he, then at least his descendants would command, respect and deference based on birthright. Denihie approached this in a different way. Opposing Wentworth's vision of an antipodean nobility was a growing class of urban liberal Democrats, many of whom were Republicans or supportive of eventual separation. And in this heady atmosphere, Daniel Denihie first came to prominence at a protest meeting in Sydney's Victoria Theatre on 15 August, 1853. There had been five speakers already and in the typically verbose manner of Victorian-era speeches, the event had gone on for about six hours before Denihie had a chance to say his bit so you can appreciate that even with their somewhat larger attention spans, back then the crowd was a bit restless. And his speech didn't begin well either. His first sentences were uttered in a small whispery voice and he was frequently interrupted with cries of speak up. But Denihie's volume did increase as did his confidence and soon the audience was transfixed. Wentworth and his allies defended the proposed unelected upper house and hereditary title with the simple logic that it would be recreating the system in Britain. Denihie went against a sacred cow in saying that we don't want to just recreate British institutions. Australia is different and our system should be different also. And his speech is now a part of Australian political folklore. He ridiculed hereditary title out of any serious contention when he dubbed the squatters a banya paristocracy. And there were rules of laughter as Denihie described the mushroom order of nobility, the harlequin aristocrats and the botany bay magnificos. And he imagined what would MacArthur's royal crest be perhaps say a barrel of ramen, all that sort of stuff which. Take my word for it was funny then, maybe not as much now, but. And he finished by saying if Australia is to be blessed with an aristocracy, let it be based on Jack the Strapper, not William the Bastard, which again was funny at the time, was a reference to William the Conqueror and also a subtle jibe at Wentworth who was rumored to be illegitimate. But it's significant that Denihie was not against people rising in a society as far as their talents would take them. This is just in the short aftermath of Marx and Engels communist manifesto. But these were not the ideas that interest Denihie. He was okay with people rising, but if we're gonna honour and celebrate individuals, let it be based on what they contribute. He was a rising star at this point and on 7 September, he spoke to a crowd at Circular Key, estimated to be the largest ever at that stage assembled in Australia. More generous newspapers put it at 12,000, but again, this is over hours and hours of lectures and would have oscillated between maybe three and 5,000 at any one time. And he repeated his zinger about the Banya Paristocracies. If you've got a good joke, he might as well use it a few times.  And he said, there is an aristocracy worthy of our ambition. Wherever man's skill is eminent, wherever glorious manhood asserts its elevation, there is an aristocracy that confers honour on the land that possesses it. That is God's aristocracy. That is the aristocracy that will grow and expand under free institutions and bless the land where it flourishes. Reading these words today is obviously jarring. The language is obviously sexist and there's a presumption of whiteness and who should be included in this group of active citizens was much smaller in the mid 19th century than what we would want today. But we also see the seed of meritocracy and the part of the speech that is timeless and is worthy of celebration is this idea of a fair go.  And it speaks to the incredible culture defining power of language. Words matter. And it is worth considering what are the words we speak over our nation every day? What are the words we speak over our children? When we look at our coins, the word that screams out, not just to us but to every foreign visitor is subject. When we look at our flag, the word that is whispered as it flutters in the breeze is dominion. When we read our constitution, we don't find the words prime minister and cabinet. When we read the preamble, we don't see the word democracy. The word that is used to describe our nation, our states and territories is Her Majesty's possessions. Subject, dominion, possession. These are not words worthy of free people. And of course, pragmatists will say, well, what does it matter? They're just words. It doesn't reflect how we really live. No one thinks of themselves as a subject. We don't think of ourselves as a dominion. Who really cares what these words say? I had the honor of being in Parliament House in 2008 when Kevin Rudd delivered his apology to the stolen generations. I saw First Nations people from around the country breaking down in tears, embracing, all because of the power of one word, the word sorry. You can't tell me that words do not matter. That symbols do not matter. Words seep into our consciousness and shape our attitudes and our behavior and our actions. Let's become a Republic that cherishes the ideals of freedom and equality, not servitude and elitism. Let's invest in civic currency. Let's choose our words carefully. Let's speak words of hope for ourselves and the generations to come. And the good news is, we don't really need to convert a whole bunch of monarchists to make an Australian Republic a reality. Overwhelmingly, Australians already agree that an Australian should be the Australian head of state and that all public positions should be chosen on merit. In 1996, one poll found 76% said yes when just asked plainly, should Australia have an Australian head of state? We don't need to convince Australians by and large that egalitarianism is right. What we need to do is reignite the flame. We need to motivate others to be proactive and to fight for our Republic. And that begins with motivating ourselves and reminding ourselves that so long as we persevere under an unelected foreign European monarch, as long as we tell our children that their talent and effort will only take them so far but they will never be worthy of achieving the highest position of constitutional honour, the system is most certainly broken and we should fix it. The year 2026 will mark the Quasque Centenary of Australian Federation. For 125 years, this indissoluble Commonwealth of Australia has for all its faults been a beacon of stability and democracy in an uncertain world. How will this event be marked? It may well be that the Queen at 99 years of age still reigns over us and her approaching centenary on 21 April would likely be anticipated with even greater enthusiasm than Australia's occasion. Certainly for monarchic sycophants but for Australia's reactionary mainstream press as well, every royal rumour, every taxpayer-funded tour, every new outfit for future sovereigns, adult and child alike, is deemed important news. Like the Queen's Diamond Jubilee in 2012, 2026 may just be another year where Australia basks in the reflected glow of a non-Australian monarch. Should the Queen shuffle off her mortal coil before then, 2026 might look very different. It could be a year in which Charles is our King, the King of Australia, every new coin will bear his likeness, schools and government departments will hang his portrait, monarchist groups will sing his praises and the disconnect between our values and our symbols will continue. But there is another vision of 2026 worthy of our ambition. Instead, imagine Australia is an independent republic elected or appointed, imagine if nearly two and a half centuries after dispossession, an indigenous woman or man becomes the first Australian head of state. As the celebrations continue, the streets are lined with flags that signify a proud and free nation, one that includes all and privileges none. Coins, statues, streets and buildings are named in honour of citizens, not foreign monarchs. The national ethos of Australia in 2026 is that a life lived in service to others is a life truly worth living. This is a nation mature enough, confident enough to honour its own heroes. And the greatest celebration of all is saved not for 26 January, the day the British flag was hoisted but for a true Australia day, the day our republican moment finally arrived. On this day, we'll not look nostalgically to Europe or anywhere else to find a mother country. If you are one of our citizens, Australia is the mother country. There will be no Australian republic though without passion. It is not enough to support a republic in principle and then excuse yourself from the hard work of debate and agitation. As republicans, our starting point must be to overturn the pervasive idea that the declaration of an Australian republic is a second order issue. Now is the time to recognise the republic is in fact the key to our national renewal. To reinvigorating the spirit of our commonwealth, we need to first reveal the fundamental incongruity at the heart of our body politic. Our head of state no longer represents or embodies the society we have become. The 17th century republican theorist James Harrington claimed that unless someone from the lowest can rise, the commonwealth is not equal. Australia's challenge is to draw a line in the sand and declare that in this nation, any one of our citizens has the opportunity to rise to the highest post. That in this nation, all citizens are equal and worthy of the same respect and opportunities. That in this nation, democracy, meritocracy and community represent our standard. That in this nation, we bow to no monarch and that in this nation, the only legitimate source of power is the collective will of the citizens of Australia. Long may they reign over us. Thank you.