How many of you have ever used a vending machine? Who has ever wanted to hack them? All right. So this talk is for you. So just to introduce myself, I'm a security engineer. I'm from Switzerland. So no, I don't speak Swedish. I don't know, but many Americans think we speak Swedish in Switzerland, but no. I speak French, so excuse my English. I also do a lot of gifs. I love old video games. I brew and I love beer. And as you said, I'm a noob speaker, so if you have any comments, it would be great to appreciate it. So how did I get there? First, some years ago, I created a main cab, so it's basically an arcade machine with a laptop inside, and I play video games using emulators with this. And to be more realistic or to take money from my friends that came to play at home, I started, I searched and I bought a con acceptor on an auction site, and this is the tale of what I did with this. So first of all, any kind of machines that accept coins or bills are used every day, especially I think in casinos or in Vegas, like ATMs, vending machines, slot machines, et cetera. And there are multiple devices that are used to process money and give money back. For instance, coin and bill acceptors that are obviously used to count coins and bills can also detect if you insert a false coin or a coin from another country, et cetera, et cetera. And it uses methods to recognize the money for the weight, for the size, even visually. There are many ways to recognize that, and it's used to send if the coin has been accepted to the main board, and the main board needs to process the events that a coin has been inserted, and it's the machine that process that you have entered, for instance, one dollar or et cetera. Other devices are coin hopers that is used to give money back, so when you need to get the change, so it's pretty much like a big tray that operates using some commands and gives you the money coin by coin back. So if you need to receive back like $1 and this tray contains quarrels, the main board will send a command to release four coins so you can get your change back. All of this stuff communicate with several protocols. They are parallel, serial, another protocol is MDB and the last one is CCtalk. All these protocols are very vendor specific, so one vendor can do normally only CCtalk or only serial devices, so you need to check whether you get the right protocol you want to use. So since I didn't know about this, I just received the Mycon acceptor and it was a CCtalk and this is what we will be talking about. So CCtalk is a name for coin control stock, it's a semi proprietary protocol maintained by a company in England called Money Controls. Semi proprietary because the specs are available on cctalk.org but some parts of the specs are only available after signing an NDA. So you just have parts of the information but not everything so you have to find something and check this. How does it work? It's simply a request and response protocol, so just send a request, the device sends you a response and that's it. It uses an UR data transmission so it's pretty much like a serial communication at 0.6K, 8 and 1 on TTL signals and each device is on a bus and it has its own address, for instance one is the controller, two is the coin acceptor, four T is a coin hopper, etc. So on the same bus you have all the devices that can communicate between each other. A frame, a CCtalk frame looks just like this, so you have one byte for the destination address, one byte for the data length, one byte for the source, one byte for the header, I'll talk about this later. Several bytes of data, it depends on what command you will send to the device and a checksum. The header is the command that you will send to a device and if the header is equal to zero it means it's a response so you don't actually have a response to what. So you need to know what you asked to get the correct answer. The checksum is a simple checksum, it's just a complement to 255 of the whole packet. So all of these headers are commands, as I said and from the documentation you can find, you have the list of all the headers and you have, for instance, all the headers and the corresponding commands and if you get in the documentation you have all the data you need to send when sending a request and all the data that comes back so you can actually see or understand what's going on in the bus. For instance, you have a sample command that is sent, you can see that it's a sample poll so it's kind of like a ping for a device on the bus that is sent from the address one so it's normally the main board. To a device at address number two, normally a coin acceptor and if you send this, you will probably see a packet like this on the same bus which is a response zero to what we don't know from device at address two to device at address one. So just again, just by looking at those packets at the response you cannot know exactly a response to what it is. You have to sniff the bus all with the request to actually see the response and know exactly what it is. The second packet here is header number F6 in X which is request manufacturer ID and in the response you have NRI, it's the manufacturer of the device I bought. So I've been able to ping this device to know some information about this. Now I want to actually know if there was a coin entered, if it was correct, if it was one Swiss franc, two Swiss francs, etc. So in the documentation you have header number 229 that you just send to a coin acceptor and you receive back 11 bytes. The first byte is the counter and you have five groups of two bytes as a result. The counter is actually every time the device has a new event like you inserted the coin, the coin was accepted, was refused, etc. This counter is incremented. So for the main board you have to actually know which was the state of the counter and if there's an increment you know that there was a new information and you have to pass it. The results are sent in two bytes as I said. Normally the first result contains what is called the validation channel. On coin acceptors you have what is called validation channels. It's normally 16 ways or kind of coins it can recognize. So you can make the device learn 16 different coins. And each one of these is assigned an ID and it's that ID that is sent in the response. So there's a nice trick there because since you only have the ID, the coin acceptor only knows an ID. It doesn't know which kind of piece of coin or its value. It only knows an ID. And the main board needs to correlate the ID with the actual value of the coin that has been inserted. We'll check that after. The second byte contains the error code so it's if it's a bad coin if there was an error recognizing the coin or if the coin was accepted. The problem is that all these codes are vendor specific. So if you buy different kind of coin acceptors, they won't be the same error codes or error IDs, et cetera. And even sometimes the two bytes are swapped. So you really need to have the documentation or you will have lots of trouble when doing this. So for my initial project, I implemented the CCTAC protocol on a small TINSI device and it simply pulls a coin acceptor sometimes. And as soon as there is a new coin inserted, it will send a keystrokes to maim the emulator to actually insert the credits in the game. So here you have the board. There's a bus pirate there behind. That's because it was only for debug. You have the TINSI right here. The coin acceptor there. And if I put some money, the game will see that there are new credits. If I put two Swiss francs, there are two new credits, just there, et cetera. So that way I had the first part of my first project was nearly done so I was able to put it in my main cab. It was working. But I was telling me, can we do maybe more because that's a simple project. It only uses the coin acceptor I bought, et cetera. And there are many other machines that use those kind of protocols, et cetera. But the problem is that it's difficult to track those responses. You cannot see them because the header is always equal to zero and you don't know which answer is to which request. And I didn't find any open source sniffer for CC talk. So I created two tools which are called CC sniff and CC parse that I use to sniff data on a CC talk bus. And the other one is used to actually parse the data you sniffed in a way that you can pretty easily understand and learn exactly what happens on the bus. If you want to have a look, can everyone see correctly? Yeah? All right. Sorry? Can't do any more. It's a little bit bigger. Maybe you'll see, bearer. Ah, sorry. Well, so you have on the upper side, the packets, all of them are the packets list that you can select. And when you select a packet, you can see on the bottom the header the corresponding function directly so you don't need to check on the table, et cetera. You have the road up of the packet. And if you take some other packets like the one I showed you before, the request manufacturer ID, when you check the response, you have an automatic payload decoding. And it's the same for nearly all of the CC talk packets and responses. Again, if you check the read buffered credits on our codes, so the one used. Hi, everybody. The audience member, volunteer. Come on. You, sir. This meant you get to watch us. We've been doing this all day. Thank you. All right. Is it your first DEF CON? Anyway. Cheers. I don't know. Okay. Where are you? All right. So, yeah. Okay. So as I said, this is read buffered credits. So I pulled the con acceptor to actually get me the data, the status. And I have all the details. The event counter, which is zero because it was starting. And all the results that are zero. But with this tool, you can pretty much get any information about what happens and what's happening on the CC talk bus. That's cool. But, okay. So now I can read on the bus. But, yeah, why not write it down? I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. I don't know. It writes directly on the same bus. For example, telling the main board, hey, okay. I'm the coin acceptor. I received a new coin. And now a new coin. And now another new coin. That could be pretty great. Oh, God. Sorry. All right. So you see the point. The problem is that you only have one wire for the whole bus. So if, as an attacker, you will If, as an attacker, you will receive the request, the device also receives the same request and responds directly. So if we try to respond just before him or just after him, it won't work. We have many chances that we will jam the signal and make things quite worse. Fortunately, in somewhere deep in the documentation, we have what is called multi-drop commands which is normally used by the control to solve addressing conflicts. Like if you have two or three con acceptors, you can set them different addresses. And it's simply just a comment that you use header 251 address change and you give as a parameter the new address to the device. So you just send that packet and the device will say, okay, fine, now my new address is the one you sent. What is great is there is absolutely no checks made on the device or on the main board that I tested. So you can just connect to the bus and just send one little packet to tell the device to change its address and then you get its address. If I show this, you have the main board there which is address one, the device that's address two, it sends credit read, it sends credit responses, et cetera. I just get on the bus, like I take the address like 77 and just send a packet address change to the device. It will tell the address 99, for example, and I take the address two and the main board will continue to ask me instead of the con acceptor, my status and that way I can respond, okay, I got a new coin. I got a new coin too, again, again, again, again. That's pretty great. But since it's on one wire, you have to be really careful about the timing because if you write something, if the device, another device was also writing on the same bus, it will collide and normally the bus will stop, the machine will reset or they will even be, I could test it, an alarm ringing on the machine and you have to run quickly. I won't say more. So you really have to check for the silence and in the specs it's indicated that the device needs to be pulled every 200 milliseconds. So as the packet needs about 8 milliseconds to be sent, there's normally enough time for us to do. So the thing is to sum it up, to hijack the device, sorry, on the bus, you have to scan this bus to search for a silence period, prepare the injection, create the address change packet, wait for the silence, just send the packet in your silence window and then directly take the address of the device you want to hijack and start respond instead of it. And when you finished, that's also pretty cool to just set the address back so the device is at its old address and you can just leave and everything works. And again, you need to do this while the bus is in use. It's quite complicated. So I created a tool called CC Jack which automates the hijacking process. It cannibulates a device so it scans the bus, it reads every packet that passes on the bus and each packet which is directed to the device you want to hijack, he will record the request and the response. So as soon as he will take over or hijack the device, he will start responding by the last response, the actual real device used to send. So normally it will be pretty much transparent so the main board won't fire an alarm or something like this. It also uses a bus pirate to sniff and inject. And one of the coolest example I have is to inject coins. So as soon as the coin acceptor is hijacked, just start incrementing the counter. As I said, the counter is whenever there is a new event, so just put one coin. If it's accepted, that's okay. Hijack the device and start incrementing the counter and he will see that there is a new event, that is the old one that is a new coin has been inserted, et cetera, et cetera. Another thing that I use also on the same machine is that if there is a glitch, like if the counter value is lower than the one that is set on the main board, there will also be an alarm and again you have to run quickly. So as a demo, sorry, maybe after, I don't know, that's up to you. I'm sorry, I wanted to do a live demo but my coin acceptor just crashed in the speaker room like 20 minute platforms so I only got this loosey video. I hope you will understand it. So what do we have here is a shell obviously and here it's the main emulator that I will use to actually show you what happens. So the tool CCJACK needs several arguments. You give it the interface, the source address of the device to hijack, the destination, so the address you want to send the device to and a time to sniff the packet so it will listen, like I said, it will listen to all the responses, et cetera, and record the new event. I just inserted two strings so I have two credits now and if I send this, I will change the address of the device at address two so the coin acceptor, I will send it to address number seven, it's sent. So now the device, the actual device is on address number seven and I took its place and respond at its place to the main board. If I look at the values, I see that I have actually learned an answer to request 229 so the request, the coin acceptor status and the responses for it's zero one is the counter, zero seven is the coin ID and zero one is that there was actually a new coin accepted. So now what I will do is change the address, let's say, add a 221, I will add two new coins so I will change the payload and now I will have two new credits, great. And what I found also is if I do that again, that will work and normally in the specs, if the counter increments too much like if it increments in 10 to 10, normally it only needs to get the last five results, the one that are actually in the response but as I found in several machine that I tested is that you can just put whatever value, it will just check the last response code so let's put FF as the counter value so we increment by 200 and what happens, no, no, it's afterwards it's another counter that is in the main board, that's only a counter for the coin acceptor, that's it. All right, so since it's nearly over, we'll get to it more quickly, so as the acceptor is offline, so we have ejected it, so we are able to just send commands to it so we can change the validation path so we can just say the path normally that is allowed for the $1 coins, that exists, right? Yeah, okay, so you just tell the coin acceptor to change, to learn a new coin and you set the validation path of the $1 and you just put several quarters or cents, et cetera and it will learn this new coin and when you actually put this new coin, it will send the ID of the $1 and the main board will trade it as $1, so it works, that's great. The other thing that is great is you have several paths for the money, like when the coin is not accepted, normally it will give it back to you so you can trade several times before dropping the coin and you can also change that, so just invert the two so when the coin is not recognized, it will get in the machine and if the coin is accepted, it will get it back to you, so as soon as you win, you just play again, that's great. There are many possibilities and again there are absolutely nothing, no authentication, nothing, you just have to be connected on the bus. Regarding protection and security, there are several things, you can provide a pin code on the device, the only problem is that the pin code needs to be sent in clear text to actually be used, so just sniff the bus, check for header 218, that is provide pin code to a device and just read the four digits that are inside and that's it. You can help by just pulling the power code and boot back the machine and it will actually send the pin code, so yeah, it's in no use. There are also encryption, I didn't actually put a lot of time on this but there are two encryption methods that are used, one is proprietary, it's a 24 bit key, the other one is a desk encryption and they use a pre-shared key between the controller and the device, so you can put it. But the problem is that it's a different header, so you still can request the device using the unencrypted headers and while the machine is in use with the encrypted one, so why not? I just studied that yesterday, I was working in the scissors and there was an open machine, so just to show you exactly where you can see that, you see here the machine is just open here and the bell acceptor is just right here, I don't know if it's a CC talk one, I didn't test it, I wanted to be there and not in jail or something. So it's just there, the connector is just there, so you just can create or put you on the wire, normally it's the fourth one, it should be that red one there, but I'm not sure. So yeah, normally these machines, if they use the CC talk bus, you can just get into them something there. All right, other things, I will get quickly, sorry, other things that might be good points of research is the encryption support, there are many things that I think you can do there because 24 bits is a bit weak. You can also dump the internal memory of devices, you can upload a new firmware on the devices, so you can do pretty much many, many, you can do many things with those and that's just the start. So in conclusions, the specific protocols are quite fun to analyze, it's quite easy, you can find really fun things to do with this. You definitely need to look more in depth in CC talk because since it's money related information, you have interest in applications, right? And just get a bus pirate, it's a fantastic tool for hardware hacking and pretty much all stuff. All the tools are available on my GitHub account and I will post several articles after DevCon on my website, balda.ch. And that's it, many thanks.


I see many familiar faces out in the crowd, and I'm glad that you're returning to these events. Thank you so much for being here with us. And with that, I'd like to introduce Bob Schieffer. Thank you very much, Andrew. And thank you all for coming. I had a feeling we'd have a big turnout for this one. We try to stay on the news, and we're very much on the news today. Bart Gelman, who's had his name in a paper a lot lately, of the Washington Post. He's a winner of two Pulitzers. He wrote a book, Angler, about Vice President Cheney. It was as New York Times. It was the bestseller. It was also chosen from the Times Books of the Year. Works for the Washington Post, Time Magazine. And of course, he is the one at the Washington Post who had their first story about Edward Snowden. Right over here, my old friend David Sanger. He's been on two Pulitzer teams at the Post. At the Times, you worked there 30 years, right? So he's probably worked at one place longer than anybody on this panel but me, which is really good. And he has two books about the Obama administration. The most recent, of course, is Confront and Conceal. You had some information in that book that had not been known before your book came out. So you have some experience on that kind of thing. And then Jim Lewis, who is, of course, a senior fellow here at CSIS, the acknowledged expert, I think, on cyber war and cyber security. He's been in and out of government most of his career, has a PhD from the University of Chicago. So very long resumes for all these gentlemen, but we'll just stop there. I want to just ask you to start off the threshold question. Why did the Washington Post think it should publish this story? Well, I'll speak for myself and I think that it does represent the Post's view on this. Why wouldn't we? We had a situation in which the Congress passed a law, which everybody gets to read, that says very, very little. The terms are quite opaque. Then the executive makes a secret, highly classified interpretation of what that law says. Then it creates a program. Then it goes to a court and gets this court, the Foreign Intelligence Surveillance Court, which works only in highly classified ways and with no other party present. And the court makes a secret ruling. And all of this is drawing a boundary around, where should the limit be between intelligence gathering and privacy and civil liberties? And that's a conversation that we have not had an opportunity to debate in this country among the general public. And on foundational questions like that of power, because you're talking about the mutual transparency of citizens and the government that's supposed to serve them, I think there were lots of things in this material that needed to be broached. And I think the confirmation of that comes from the fact that there has been an extended, running into several weeks now, and fairly serious public debate about where these lines should be. Did you have any concerns that national security might be damaged with what you published? Yeah, I did. I mean, over my career in journalism, having covered a lot of national security stories, there have been quite a few times when I saw a really hard balance to be struck and when I've had conversations with the government about their concerns. And we had those conversations this time. And I'll tell you how I started the first conversation. I said, I'm not going to hand you this document that I have, but here's the date and title and author. And I know you could find it. And before we start talking, I just want you to know that everything from slides 21 to 27, we're not even thinking about publishing. Let's talk about the rest. And this is the way you presented it to the post? Kind of in that way? Well, yeah. I mean, when I came to the post, I had a similar conversation.  I did for 21 years. I came back to them on contract for this story. I said, you'll make your own decisions about what you're willing to publish and the start of the conversation. This is the part I would not, myself, be willing to publish. David, how is what Bart did with his story? Is it different in any way from when you did your book? Because you talked about, and we learned for the first time about some of the cyber war abilities that the United States has. And this had here before not been known. Did you go through this same kind of a process? Through a very similar process. I think there were a couple of differences, but mostly a similar thing. And I commend Bart both for his enterprise and for exactly the way he handled it, which I think was extremely responsible. The difference was that in the story that we published in The Times and that I was an excerpt from Confrontant Conceal, which was about Olympic Games, the code name for offensive cyber operation against Iran, but also the first sophisticated use of an offensive cyber weapon. The overall journalistic impetus, I think, was very similar to what you just heard from Bart about this. That in both the case of where the US government draws the line between personal privacy and doing the kind of surveillance it feels it needs for defense, and where the government draws the line on the use of offensive weapons, it's all done in secret. And in many cases, you have to ask the question, how much of this needs to be secret because it's keeping operational details secret, and for which I think we all understand the need to go do that. And how much of this are fundamental issues that need to get debated by the US public and perhaps by a broader public, but certainly by American citizens because it's done in their name. And I think the responsible way to do it is exactly as Bart and which was go to the government and say, this is what I have, that the key elements are going to get published. The question is if there are security concerns about individual elements of it that would endanger somebody's life, endanger an ongoing operation, so forth, we're willing to sit down and hear that and make a case. And then I did what Bart did, too. I took some things right off the table that I knew I shouldn't even get into a conversation with because there wasn't a debate. And then in other cases, there were responsible people in the US government who made a case. And I found over the years in doing this, in the case of my book, wasn't the first time as it wasn't the first time for Bart, that usually once you get involved in that conversation, you can narrow the subject matter pretty quickly if you're dealing with relatively reasonable people. And at the moment that you've got the essence of the story, they're not simply going to say, well, we're just not going to discuss it. Now, that raises a more fundamental question, which is the who elected us question. Why is it that the press gets to go do this? And that comes to an understanding that I think many people in the United States have about what the role of the media is. And it's disputed by others. And I don't think there are any absolutes here. The US government would like to say that if it's classified, it should never get published. The fact of the matter is almost everything in the realm that you write about when you're writing about national security is classified in some form. I don't think you can write about Iran's nuclear weapons program or North Korea's or our dealings with China without running into something that is classified somewhere. Now, I didn't have documents. I had a story that was assembled over a course of a year and a half. In Bart's case, he had specific documents. And that kicks in the gear and different parts of the classification laws. So Jim, you have seen these kinds of situations before from both inside the government and from outside the government. What do you think of this story? It's true. I think I'm the only one on the panel who's been inside the veil, so to speak. And actually, one of the things I'm wondering, I just went through my five-year review. And I think, why did I bother? I can just wait. It'll be in the poster of the Times or something. And there's no doubt that people in the community are a little depressed. So I feel a lot of empathy for them. But we will rebuild. In this case, I kind of agree. I think more transparency would be a good thing. If they had given some more information on the program to begin with, it would have been easier to manage the public reaction. But at the same time, I'm all for more transparency. I think the program needs to continue. So I hope the debate doesn't lead us into one of these silly compromises where we set up a new advisory board or somehow put in additional constraints. I think that would be a mistake. Let me just ask you at the top here some of the claims that Snowden has made, that he could listen in on any phone call, even the presidents, if he had the number. I have had people both on the record, on television, and off the record saying he vastly overstated his abilities. Do you think he did? I love those television shows and movies where they show like an ops center in the CIA and the guy says, got me a video on St. Peter's Square. And immediately it pops up. Come on, folks. No, of course you can't. Technically it is possible to target someone and to get their phone calls. But there are many, many legal constraints. You really have to have worked with these legal constraints to know how difficult it is. And it's not that easy. There's operational difficulties. There's legal issues. It's not like the movies. What do you think he overstated what his abilities were? I think he was overselling. I think he had a product and it looked for a while, at least in Hong Kong, like he was dangling. Come to me, bring money, and I'll tell you the good stuff. So I think he was overselling. Art. I'm not his lawyer or his advocate. And I'm printing only what I think is true and that I can verify. I wouldn't be so sure that he's wrong about this. And what he's right about for sure is that the legal constraints that Jim is talking about are either lines of code or policies and rules and regulations and supervisory chains and auditing trails, which, given that the whole thing is taking place in secret, can be changed at any time. His principle point is that there has been buildup without our knowledge, a remarkably powerful surveillance apparatus that is in fact touching every American household, even though they are not listening in on all our calls. All, there are some. We're reading all our emails. And that the main constraints on it right now are what the code says, which can be changed, or what the policies are, which can be changed. And what we do know is that when governments accumulate power over time, they find sort of one more reason why you might want to use this, or you get to adjust it on the spectrum just a little bit. And over time, you tend to have a one-way valve in which there's more use made of powerful tools for reasons that are stated in good faith and honestly believed, but that changed the boundaries. Well, how can it be that someone can go to work in a situation like this, in a position like this, work there only three months and somehow get away with what he apparently, we know he got away with some stuff because you printed some of it. I mean, that does not seem right to me. It seems to me that's not a good situation. Jim, can that be? How can that be? Gee, I really want to defend the guys up at the fort here, but it sounds like there was a little glitch. You know, one of the rules to just to move a little bit aside, if you're looking at simple things you could do to make your networks more secure, one of them is to restrict administrator privileges because an administrator can pretty much do whatever they want. He was an administrator, and that was probably the mistake. Is this basically, he's the IT guy in the office like we have at CBS, that when the computers break down, that's the guy that comes in and he knows everybody's password. Be nice to your IT guy. Yeah, exactly. You know, that's right. One of the lessons here. But I mean, is that basically what his job was? Someone I know said, he described him as the help desk. The help desk, yep. Yeah, look, I mean, look, there's been a lot of stuff that is out there that's essentially trivializing him or his credentials or the importance of his job. He worked at the Hawaii sort of large sub-branch of the Threat Operations Center run by the NSA. He was the administrator of a very substantial portion of that system and also in charge of defending it. So, I mean, he was there to watch out for incoming cyber attacks, intrusions on the system, and he also administered a lot of the, that sort of, you know, sort of rules, regulations, and firewalls that prevented sort of inside people and out from getting places where they weren't supposed to. Of course, that gives you a lot of power to get in those places yourself. Is there any suggestion, and I know this is your source and, but is there any suggestion that he took this job for the sole reason that he wanted, he had his mind made up about something that needed to be exposed and he went in there and got this job so he could do that? Well, he had spent a lot more years than these or than this last one working in the intelligence community and he had clearly formed views that developed over time. He never told me that he took this job in order to carry out his plan, but it's looking more and more like that based on the external evidence. What do we make of the fact that, you know, once he does this and he goes to Hong Kong now, he's in Russia and all of that. I mean, this is not your standard whistleblower, is it, David? Well, there are a lot of people who would argue he's not a whistleblower at all and, you know, whether or not you think he's a whistleblower probably determines how you come down on the first question you asked about why the press publishes this, what kind of person he is and so forth. I think this has come into an interesting context at a moment when there is a new president in China and the return of a previous president in Russia, both of whom had just met President Obama in separate summit meetings within the past week and a half and both of whom showed a particular willingness to stand up and say, this is not my problem and perhaps enjoy in the case of the Russians how much angst this was causing the United States. In the case of the Chinese, I think they just wanted to get this problem off their plate. The prospect of a year or two years or however long the expedition process took, I think they believed, I know from some Chinese officials who expressed this to me, would be a fairly lengthy process that would erode the relationship at a time that Xi Jinping's got other problems with the United States and that he wants to go deal with and I think they decided that they would take a day or two of heat for letting him out of Hong Kong and that then it would become someone else's problem and that someone else turned out to be Vladimir Putin. Well, do you, Jim, do you think it might have been that they had already gotten everything they needed from it? I mean, is it possible we read all these stories? We don't know, I don't have the expertise to know. Is it possible they could have drained those four computers he had without him even knowing it? I do think he's overstating his position. I do know a little bit about the end talk and he was not like at the center of it. So did he have access to some good data? Yes. Did this stuff come as a surprise to the Chinese or the Russians? No. And so I think one of the problems he had is when he got there he found that the stuff he was flogging, what's attracted a lot of public interest, was not really and started a good debate was not really a surprise to foreign intelligence services. I wanna add something to that. He has said and given me good reason to believe that he's in possession of material that could do extraordinary damage to collections by disclosing things that foreign targets don't know, they may know in principle, but they don't know in practice. And he's not interested in tossing all that out into the public record. He's interested in fostering the debate here. There's been a lot of speculation about whether the Chinese drained his laptops or whether the Russians are doing so now. I wouldn't give a lot of odds on that, but if he gave me even money, I would make a fairly substantial bet against. I know more about the precautions he took and the planning he did anticipating exactly that issue. And I think it would be difficult to do without thumb screws and we haven't seen any sign of that. Do you all think he has done any harm to the national security? Yeah, it's a very hard thing to judge from the outside. And of course, you will always get insiders saying that any revelation of any of these kinds of programs or techniques does harm. And then you hear Jim make a point that he did, which was most of this probably wasn't a surprise to the Russians and the Chinese. Well, if the information is of more surprise to the American people than it is to the Russians or Chinese. Or in the case that I wrote about since the Stuxnet virus had gotten out in 2010 and the Iranians already had the code and they knew somebody had been attacking their systems and they didn't think it was the Swiss. Then the question is, are these programs classified because you're keeping adversaries from knowing about it or you're keeping Americans from knowing about it? And that's a really important base question to go answer. When I looked over the documents that Bart published and that The Guardian published, for some of them, the first question that came into my mind was why was this document classified at all? Let me give you an example. One of the most interesting that got published was one we had written about but not seen called Presidential Decision Directive Number 20 and it was signed by President Obama back last fall. And it was basically the decision directive that lays out the conditions under which the United States would make use of defensive cyber or offensive cyber and who's supposed to go do that and so forth and so on. And each paragraph is marked either confidential or secret or top secret. The entire document was supposed to be declassified in 2037 or something like that. I read through this and I said, gee, I'm almost certain that when the document was signed there were declassified briefings for us on almost all of the major details. And I went back over my notes and there were some interesting, smaller things in the document but most of the big issues we had been briefed on. So I went back to the White House and said, can somebody here just give me the justification for why this document was declassified? And the answer I got back was in short because it was in the interest of the United States to declassify it. That's declassified. That's declassified, I couldn't tell you. So many of these do raise a fundamental question which is would the government find itself in less of a difficult position today if it had said to the world, yes, we have a central repository into which all phone call metadata is poured into and we hold on to it for five years because any terrorist who went to the movies thinks that we can go back and trace a call in 20 seconds. Why the presidential decision directive couldn't have been published at which point it would have become a deterrent for other countries that would see that the president has authorized the use of retaliatory cyber weapons at some point. But no one really wants to engage in that debate inside the US government or at least they don't wanna engage it publicly with all of us. Can I add something on that? Sure. One is that it should not open and close the conversation whether something would improve the public debate and it shouldn't also close the conversation whether something might be damaging or actually could do some damage to national security as one could reasonably define it. I mean, John F. Kennedy's great speech was not that we're willing to pay no price and to secure the blessings of living will bear no burden. That's not what he said. I mean, there's their trade-offs between self-government and self-defense. Constitution begins with six fundamental guiding principles about what we're here for. One of them, the fourth one is to secure the common defense. So there are other issues here and there are balances to be had and sometimes they're easy, sometimes they're hard. I wouldn't, I don't dismiss the security risks that are involved in having this debate. I mean, even when a country or a terrorist organization has good reason to think that the NSA could be listening, you could compare it to the elevator cameras we all know are there every day but we don't all behave all the time as though we'd like to have our photographs in the elevator put on the internet. You forget, you stop thinking about it, you stop worrying about it and so by calling attention there's a chance that you're dissuading people from going there but it's very clear that in the PRISM document, the description of this program which gets information from nine of the largest Silicon Valley communications providers that, and it's explicit in the document and in the markings, the most highly classified portion of the document was the listing of the nine companies, Microsoft, Yahoo, Google, Facebook and so on. That's the number one secret in there and when I had conversations with government officials about what we were gonna print and what we weren't I said, if the harm you envision consists of private companies taking a reputational or market loss because the American people don't like what they're doing, that's why we're gonna publish it. I mean, that is a high reason, a very high stake that would make you wanna publish the information. What can we do, Jim? I mean, you have a better fix on this than probably any of us here and I remember before when I was talking to you before the presidential debate and you told me some of the things that we can do. I mean, it is amazing, but I mean, there's a difference, isn't there, in capability and abusing of capability, which is one of the questions that comes up here, but we do have, just tell us a little bit about what kind of capabilities we have. I'd like to know. Ooh, ooh, that's a, that are not classified. That's a tough one, yeah. No, it's fair to say that after September 11th, there was a lot of effort to integrate intelligence sources and expand some collection abilities and one of the things that was most useful was, you capture some guy's cell phone in Afghanistan, you look in the cell phone, there's some numbers. Interesting, one of them's in the US. Who is that person in the US talking to? And at that point, you're kind of stuck. You really need to know this, you really do, but to do it, you're going to have to get essentially what's like your phone bill, right? So that's what they're collecting. And if you don't do that, you may have unhappy surprises. So a lot of it is this ability to collect and combine a SIGINT, a HUMINT, stuff captured on the battlefield. That's where the edge comes from now. This is not new, if you remember, there was the echelon debate in the 1990s where the Europeans suddenly became excited because they thought there was a global system to collect all traffic and they did a big investigation of it in the European Commission. And they concluded, well, you know, it's really not so bad as we think. And I think that's where we're going to end up here. There are trade-offs, we do need to debate them. More transparency would be useful, but we need this collection capability. Do you take issue with my new friend, Jim, on what are two points here? I told him we were going to be fighting all night, so.  Absolutely, you had an intelligence legal framework in which you could spy on the bad guys overseas and you could get warrants to spy on known bad guys or suspected bad guys domestically. But when you got to the scene, which is what you care a lot about if you're trying to protect the country, you had inhibitions, you had barriers that were hard to get through. But what you've just described is really not what these programs that we're writing about now are doing. If you pick up somebody's pocket litter in Afghanistan, and it's got 35 phone numbers and 17 email addresses, that's where you can go out and get individual fies of warrants by going to court and saying, this was in the so-and-so's pocket. And we want to get a warrant to look into that. You can do that. You have to show only that the information you want is relevant to an authorized national security investigation. That is a very low bar. It'd be easy to meet in that case every time. What they're using these programs for is what people conventionally call data mining and what's actually called contact chaining in this context. They're looking for unknown suspects, unknown plots by finding hidden relationships among people. And so if you start with one contact, one, I suppose it's a terrorist contact, you say who's in touch with that person and then who's in touch with all those people. That's called going out two hops. It's an exponential growth in the number of people that you're surveilling that way. Everybody remembers the six degrees of separation idea, which is that once you get six degrees of separation from you or me or anyone else in the room, you've encompassed the whole planet. So two hops is pretty far. It's a big number. But this is such an old technique that when they used to train it, and this is declassified so you can find it on the web. They used to teach you how to do this using mail, using envelopes. Of course you want to find the guys who you don't know about. And you have one person you know and you want to say what is the network that he is involved in. And you have to look at people who are not known, not suspects that you couldn't get a warrant on. And I think the administration probably is a little miffed because they probably feel like they went out of their way to do this in a constitutionally safe manner, not public enough. But this is a traditional technique that goes at least back to the 19th century. I mean they were teaching it to children when I was a boy, so. Jim's a long time friend and I've been agreement with him that this method has been used a lot. The mistake I think that the US government may have made along the way was the judgment that what was declassified for doing it with mail had to remain classified when it had to do with email or with phone numbers and so forth. And it does raise the question that got raised back in the days when Jim Ryzen and Eric Whitblow wrote their story in what 2005 so that the warrant was wiretapping. Or again, you ask the question, why couldn't the government have at least described the outlines of this program? Was they leave themselves open to the same kind of exposure and debate then and the argument about whether or not it really needed to be classified? And what you discover when you go back and you look at some of these cases, including warrantless wiretapping, I would argue even WikiLeaks that the amount of damage that we were told was going to be done probably overstated a bit what damage was actually done. It's very clear why they, one reason why they don't want to have even that degree of transparency is because the more you know about this the more it creeps you out. I mean let's review the bidding of what we now know about these programs. They are collecting all of the metadata involving telephone calls and internet communications which is chats, emails, video, voice over IP. Bart, just to help me understand this, when you talk about the metadata and you say email, does that mean they're getting the email message or they're just getting- No, they're not getting the content and the president has come out and said don't worry, the impact on privacy is modest. We're not reading your email, we're just looking at who you sent to from when. But a lot more than that. NSA calls it DNI, digital network information. It includes also unique device identifiers, locations. On the phone stuff they say they're not collecting location. On the internet stuff they are. And if you gave me the choice right now based on current sort of data management techniques, here's the choice. I will subject myself either to one month of having someone read all my email and listen to all my phone calls or one month of all my metadata I would take the content in a second. You could listen to me and read all my notes. The impingement of my privacy would be much less even though the law says otherwise the whole framework of our jurisprudence is based on different assumptions. With the metadata, you know who someone's talking to when, where they are. And if you start thinking about associating that with everyone's because they are getting all of yours. Then they can tell whether you are negotiating secret business deal. Whether you have a medical condition. Whether you're having an extra matter of affair. Whether you're thinking of leaving your job.  I'm not saying they are doing that. They have now taken all of the information they would need to do that. And they are holding it. And no one is watching. That doesn't make any sense. Because you know there's a limited number of analysts and they can only look at so much.  It might be really interesting. Priority number one is terrorism, proliferation. A couple countries that we have bad relationships with. There aren't that many analysts. No one is reading your stuff. And the idea that your stuff might be being read is true especially for these guys. You're good targets for foreign intelligence agencies. So is China or Russia or people like that looking at your email? Wouldn't surprise me in the least. Is NSA looking at your email? No, right. And so that's a difference. When I hear this, it is not a perfect world. You know it's not a 19th century agrarian republic where men and dinosaurs coexisted. What it is is a place where we have these trade-offs. It creeps you out to have people looking at your metadata. It creeps me out to find unattended luggage in O'Hare Airport. Right. You pick. Did you like Boston? When you collect these phone numbers, okay, and then you connect up two of them and you decide we need to, is there a capability? Is that on what I used to call on tape or is that somewhere recorded that you can play back? I mean the email would be there. But would a telephone conversation be there? When they analyze the metadata, who you're talking to, from where, what device, and so on, they call that the surface analysis and they use it for leads to go get the content underneath the surface.  But would conversations be stored, Vart? I guess that's, I'm saying if you- Telephone conversations, no. But they don't need it. Once they start becoming interested in Yuba, then they can listen to last record and slice and dice their conversations going forward. I do not believe that there's not any present evidence that they're either capable of or actually collecting all communications content so that they can go back and play it back later. And he didn't reveal one dark secret and I guess we should be appreciative of that and the dark secret. So when I started working on this stuff a long time ago, you know, from the State Department with NSA, they kept talking about something called the bit bucket. It's like, what the heck? They, there's too much information and all intelligence agencies suffer from this now. You can, it's easy to collect, it's hard to analyze. So they just park it, right? They just park it. So they used to park it in freight cars over outside Fort Mead, you know, when it was in the olden days. There just, there aren't enough people to read all this stuff. And so the content has to be, and one of the things that's improved is the ability to focus in on persistence of interest. Well they're not enough people to read all the content and listen to all the calls, but there's plenty of people and plenty of processing power to do all the metadata analysis. It does, it's not hard. It's just, again, it's adding a few lines of code, adding a few cycles to a vast computing capability. I want to go to you all for questions. So while you're thinking of questions, let me just go back to Jim. I was very interested in one thing that you wrote. You talked about some of the myths and things now that we're talking about cyber. You said we are not in a cyber war with China right now. And I just thought it was interesting what you had to say. Why did you say that? And I forget who said it, but I think it was you. The Chinese probably couldn't wait to get this guy out of Hong Kong.   Because these are great powers, they're responsible. Yes, China engages in espionage. I apparently, I read in the papers now that we do too. You know? But espionage is not war, right? And so great powers engage in espionage, but it's not war, it's not an attack. It's not the use of force. It's not even coercive, right, unless you intend it. So the Chinese take advantage of weaknesses. We take advantage of weaknesses, but that's not warfare. And sometimes people say this a lot, that we're in a Cold War with China. It's not the Cold War. They're the second largest economy in the world. They're one of our biggest trading partners. It's not the Soviet Union. So no, I don't think we're in a war with them. Can I just look in on that briefly? Jim is right on the espionage side of this. President Obama's gone to some length to differentiate the kind of traditional espionage from the theft of intellectual property. And so there is something of a commercial war underway. And on the Cold War question here, I don't think we're in one now, but I think we're pretty close on the verge of one. And that is because the cyber issue has now moved to the center of the relationship. And it's made far more complex by all of the issues that Jim raises. China is the world's second largest economy, a very major trading partner and lender of the United States. And that constrains us from doing some things that we did to the old Soviet Union during the Cold War. But that doesn't necessarily mean we're not headed into a Cold War. It just means we're headed into a much more complicated version of it unless this goes off into a different direction. Questions? Right here. Yeah, sure. And tell us your name. That Ron Marks, G.W. Homeland Security Policy Institute. Congratulations, Jim, you kept your clearance. It was a close run thing, I'll tell ya. It's okay, I just had mine done, I understand. I guess the question I would ask, maybe I'll ask it to Mr. Schieffer, which is we lived through, you and I are old enough to certainly remember and you covered Richard Nixon. There was a time in which, under Kennedy and Johnson, a lot of the practices that he engaged in would have been acceptable, or at least they were kept quiet and people ignored them or they were kept down. One of the things that just strikes me about this is we've been at this war now for about 12 or 13 years and there's certainly been a lot of hints along the line and a lot of statements along the line that the press may or may not have picked up on or didn't pick up on. They would indicate that this kind of thing was beginning to coalesce and come together.  Is there just a lot of stuff sort of laying around here that somebody finally coalesced and kicked together or is this something that sort of brand new discovery? It doesn't strike me like that but I'm just curious as to what your view point is. I mean, are you saying that this is somehow has something to do with other things that are going? Well, I'm not so sure the press has done a great job over the last four or five or six years of doing what you're doing right now. Because one of the jobs of the press really, at least as I grew up in the last 40 years was the idea that they would be the watchdog. And there's been a lot of this stuff out there and we've seen a lot of reporting and people have read the Patriot Act and people have heard all of this stuff around but for the most part it's been in bits and rumors in here and there. And we haven't really had the kind of press fall. Do you think the press has failed to some extent in this? Well, the press always fails. I mean, you know. It's intelligence fails. It always, every time one of these things happens we always look back and say, well, the press fell down on the job this time. I mean, I think buying large press has done a pretty good job. But I mean, you know, I think after 9-11 a lot of people including me didn't want to go through 9-11 again. And I am not one who thinks that Edward Snowden is a great hero. You know, sometimes sources are good people and sometimes they're other kind of people and this is Bart's source. But I mean, I have real questions. I mean, I said on television a couple of Sundays ago that people like Martin Luther King Jr. and Rosa Parks were my heroes, but they kind of stayed around. They didn't run off to China. And I think if Edward Snowden had a case to make I don't think he helped his case by his behavior once this came out. I actually think, and Bart knows this, I think the Post acted very responsibly and in the way they vetted this story. I also think that like Jim, we need to know more about what's going on here. But I don't know. We could always do a better job than we do. I guess that's what I'd say. Would you, do you want to say something? I do actually. I really liked the framing of the question about whether there was an intelligence failure by the press. Because I mean, it's a fair question because we're always happy to say there's an intelligence failure. If the US intelligence community is somehow unable to predict every future event, and I don't think that's a fair standard to hold them to even though it's their job to do their best. So did we fail to understand and present as these things were happening that they were happening? Sure we did. But I'll tell you for sure, in my case at least it was not for lack of trying. I mean, my last book on Cheney devoted, I don't know, I guess two and a half chapters to the Bush era surveillance programs. And I turned up a lot, but what I broke my sword on was exactly what was the NSA doing. And especially what was it doing that the Justice Department thought was such a big problem that there was very nearly a mass resignation in March of 2004. And there was a really interesting story to tell if you treat that question as an impenetrable black box. But I couldn't figure it out. And so whether you, whether Edward Snowden is a whistleblower or a cow or a hero or a villain, what he has done among other things is to enable a public debate in which we all get to participate in deciding how much power we want the government to have in the course of our demand that it protect us. You know, and I would just add this, this is all taking place at a time when we're undergoing a cultural change in this country brought on by communications revolution and the capabilities that we now have and with the coming of the social media. You know, people of a younger generation than mine now put on Facebook things that people my age wouldn't have discussed in mixed company back there. I mean, people have a different idea of what privacy is now. And I think that somehow factors into all this in some kind of way. I mean, you know, we see this growing feeling among, especially the younger generation, they don't believe much of anything that the government or anybody else tells them anymore. Well, I think that has to do with more than just the government running this program that it's been running in and on the secrecy. I think that has to do with a lot of things going back to Watergate. If I could just chime in for just a brief moment. Look, on any given day, I figure I'm lucky if I understand two or 3% of what's going on around me in the US government. So I'm sure there's a lot. You got to approach these jobs with a lot of humility that we don't understand a lot and we're putting a lot of effort into it.  You go back to our coverage of the FISA renewal debate. If you go into our coverage of Stuxnet and Olympic Games and the use of offensive weapons, if you go back and look at other work that a BART has done, including in Angler, and there are many other reporters in this town who have broken very big stories along the way. I think there has been a steady drum beat. Has it been as broad as we would like? No, but the only way you get these stories is by beginning to pull on the string and hope that a little more of it unravels along the way. And you know, and the other part is this is one of the most complicated stories that I can recall in recent times.  The government's telling us, you got to trust us, but they can't give us the information that helps us to verify it because that is somehow classified. And it's very difficult to know exactly what the government has done. They do have these enormous capabilities, but have they abused it? You have these people that are supposed to be on the oversight committees on Capitol Hill saying actually no. And maybe they're right and maybe they're wrong. I don't know, but that's just another thing that makes it a very difficult one to cover. Over here, yeah. Lloyd, here comes the microphone. Go ahead. So I can't help but think of Dr. Strangelove's doomsday machine that they never told anybody about when we're talking about this thing. Well, what good is this program if nobody knows about it? You know, why are we keeping this secret? I think that's something you're talking about David, but that's beside the point. I think the most important thing here is I'm 31. I voted for Obama in 08. Definitely did not vote for him in 12. This is the context of this story, that Obama, this story, everything is now, making us, as you just said Bob, my generation is having a very hard time believing traditional news outlets, politicians themselves. We're seeing a degradation of public trust. From me personally and from pretty much everybody that I know and I think, you know, this is what needs to be talked about more in the media. How are we going to repair this? Are we going to repair this? What can we do about it? So what are your thoughts on that? Well it's interesting that you bring that up and I sometimes define it as the legitimacy, which is you accept unquestioningly the authority of the Congress, the courts, the president and you say yes, or the press and say yes, I can trust them. It's a hard problem and so I'm still working through it and I'll just give you an initial hypothesis, which is the internet has had in some, we've seen this before. We saw this with the printing press. Floods of new information were available to new audiences. They could read the Bible and say hey, I don't see any divine right of kings in here, you know? And we're going through a similar process. This is the political effect of the internet. It is degrading the legitimacy of existing institutions. There might be other explanations. Governments over promise, I don't know. So work in progress, but this could take a long time to work through. Well and the other part of it is with the coming of the internet, I mean most people, whether they agreed with the editorial policy of David's newspaper or BART, they generally accepted what was on the news pages as the basic facts. Because I mean they generally accepted that mainstream media did a certain bidding. That basically we didn't print anything or broadcast, I mean unless we'd gone to some trouble to find out it's true. Now you're overwhelmed with information from every corner, some of which is true and a great deal of which bears no resemblance to the truth. And I think that is one reason that is so difficult now why people have such questions about what something is true or not. And I think that's part of it. Back here in the back. Just in a quick note on that, maybe the solution in part is more transparency. And that's maybe what, that's a lot of us, you mentioned Dr. Strangelove in the 2008 report we did on cybersecurity, we had that quote in it. And a lot of us have been pushing them, we can talk about nuclear weapons, why can't we talk about the cyber stuff? So maybe the initial step is more transparency. Back in the back. Yes, Steve Benson from CSIS, it's a two-part question. Since the ISP, the internet service providers were acknowledged in the article and so much data is available, was there any impacts when this was made known to the public? Was there any perceived impact based on the public's demise of trust for internet service providers? And the second question is, does my bill go up or down because of the use of my data? Your bill has gone up and up and up, but it doesn't get charged in cash and you never see it. The bill you're paying is the revelation that the revelations that you are giving to a enormous 30 billion plus dollar a year industry of people you've never heard of, like flurry, axiom. Besides, it's the ad-debt works, it's the marketing people, it's the big data brokers, and although it's true that ideas of privacy are different now and people post things on Facebook, we are not losing our privacy primarily because of the things that we reveal. We're losing our privacy because of things that are being done completely without our knowledge or our ability to understand. You click on Terms of Service that are essentially unregulated. The only regulation is you can't say something that is factually untrue, but if you try to read it, it's hard to figure out what fact is even being asserted in those terms. And I've recently been taking a look at what's happening behind your back, just purely on the commercial side, when you tap on Angry Birds. Do you all think we're safer now than we were on 9-11? I'm sorry. I'm sorry. I think he has, I have an answer to your... Where does your money go? Oh, your taxes are paying for that. I mean, there was, I mean, when they first started collecting all this data, there was an emergency appropriation. I reported it, some hundreds of millions of dollars to get bigger pots to put the data in and bigger computers to sip through it at the NSA. So there are some tax costs. Let me just... Do you think, Jim, that for all this, it's expenditure and all this that's happened, you think we're safer now than we were on 9-11? I'll start by saying that I'm happy because I went to a hacker conference and they gave me a bumper sticker that said, NSA, free backup services. So you are getting some value. No, if you compare how... It was a bitter lesson, but if you compare how things worked in the 90s and people were well-intentioned and were trying hard and how they work now, we're better off. There are problems. And one of the problems is that one of the reasons, there is no other way to do national level surveillance. I was in a huge exercise where we did not use communication surveillance and tried to track terrorists who were in the US. We could not find them. So you put all the pieces together, FBI and CIA are working together better. NSA has their stuff. All three agencies are talking. We're better off. NCTC is a plus. We are safer. Are we safe? I leave that to you guys. Lloyd Hand had a question. I guess, Paul, I just... A comment and a question. I agree that a free and robust press is a cynical non for a free society like ours. And I may it always be that way. On the other hand, I agree with what you said earlier, Bob, that Martin Luther King and others who engaged in civil disobedience took their medicine. They didn't run off. Last night, I heard on Paris Morgan interviewing Alan Dershowitz. And they were talking about Green Wall. And Dershowitz said, when the law says that when you knowingly publish classified information, that's a felony. Did you know that you were publishing classified information? Wow, this is an entirely different kind of conversation. You can take the fifth. Of course, I knew I was publishing classified information. It had stamps on it. And I put the stamps in the paper. And there have been available theories of prosecution for many years now. In fact, since 1917, as you know, in the Espionage Act, under which a person who publishes information relating to the national defense, even if it's not classified, it doesn't have a stamp on it. And by the way, there are X number of active divisions in the army down the line that's relevant to the national defense. There have been available theories under which you could prosecute a report or a newspaper for publishing that stuff. And on balance, there has yet to be any administration that thought that that would be the right call to make in terms of how we organize our society. And if they did, then we would have an opportunity to test the constitutionality of an interpretation of that law that would apply it to First Amendment protected activities. And we'll just have to see. I'm not a lawyer and I'm not at all cavalier about this, but it is true what David said, that if you're going to cover foreign affairs or national security or national defense, it is very difficult to write almost any story which could not be interpreted as breaching the lines of the Espionage Act. I mean, just what's made that point, that they could and have always been able to make that choice and have it done it. But just to put comment that we know, no one's commented on, I don't believe earlier, that, and the question is, it's true that Snowden precipitated this debate. My question is, was it a necessary way to precipitate debate? And the other comment is, it's important to keep in mind that all of these programs were legal. There was not, was an illegal aspect about it. The Congress enacted these laws and it's unfortunate that the good many of the congressmen didn't go to the briefings where they'd learned more about it over the last several years. I think one of the, and I'm gonna get you all to quote on this, but I think one of the things that there should be more attention to is this congressional oversight. And the fact, is it not true that when they had the most recent briefing for the Congress, they unfortunately had it on Friday afternoon and they all left town because they had to get back home. And I think that's one thing that deserves a lot more publicity, whatever you'd like. Well, in terms of the oversight side, this is extraordinarily complex stuff, technically, operationally, and legally. And the way Congress works and the way, in fact, senior executives work in every branch of government, you need staff to master the details and advise you on it. And it is a very small minority of members of Congress who have staff with requisite clearances to even get these briefings. If you're not on the intelligence committee and to some extent certain appropriation subcommittees or judiciary subcommittees, you don't have that staff. It's probably one in 10. That's one thing. Is this thing legal? According to every interpretation of the law that's happened so far among all three branches of government, what is happening is legal. There are lots of things that are legal or could be legal, depending on what the law was or what the judicial decision was, that we as a society might like to debate. Right now, the FISA court, we know now and we didn't know until now, the FISA court has radically reinterpreted some of the features of the Patriot Act. For example, Section 215, business records. The FBI's been telling us every year, we get only a few dozen times a year, do we even use this provision to get business records? It used to be that the interpretation of FISA was that a facility against which you collected business records was a phone number or an email address. And now it is all of them. Now it is the entirety of the call database at Verizon and each of the other two or three big companies. No one knew they did that. I'm quite confident that if real lawyers and unlike me get a chance to ever read that opinion, there will be very significant disagreement in the legal community about whether it's constitutional but that can't be tested right now. Just, and this has to be the last comment. Just a very quick one, you raised a very good question which is, do you need these kind of revelations in order to have the debate? History suggests you probably do. Jim mentioned that we managed to have a good debate about nuclear weapons, even though everything about nuclear weapons is classified, how you use them, where we keep them, so forth and so on, but we had a 25 year long debate that sort of ended up at the end of the human missile crisis 50 years ago, including the conditions under which we would use nuclear weapons. In the case of drones, it actually took a very active press writing about the subject every few weeks in order to force the government of the United States to begin to debate out the question of the conditions under which we would use drones. In the case of offensive cyber, it's been the same thing. You've needed revelations in order for there to be a debate and so far it's a very small debate about whether or not we wanna be using this new class of weapons. And I think as the stories that Bart has run as indicated, you wouldn't have the debate unless people can stop and say, well wait a minute, there's a law that was written when the only metadata you could look at was an address on the outside of an envelope, still apply in an era where you're walking around with a cell phone and as you move from one tower to another, somebody could figure out, they say that they don't, but somebody could figure out exactly where you are. So the nature of the data is so much richer today that applying a law that was written even 30 or 40 years ago may not make sense anymore. All right, well we have to end it there. Thank you all very much and thank you all on behalf of PCU and CSI. Thank you so much. Wanna thanks? Thank you so much. Let's go for it. Let's go for it. Thank you. Thanks a lot.


We're born out of a jet age to represent airmen and to inspire the next generation. More than 65 years later, what this team has become is much more than airshow performers. We are leaders demonstrating the capabilities of America's Air Force to our great nation as well as spreading goodwill to nations abroad, yesterday, today, and tomorrow. The Korean War was still going on and the F-84G was a frontline fighter and some called it the workhorse of the war. The first Thunderbirds team would fly five of these aircraft.  Crazy as it may sound today, he had only three weeks until their first airshow, so the Thunderbirds were quickly formed, jets were painted, and by June of 1953 they were performing. As the years passed, the aircraft changed. Thunderjet, Thunderstreak, Super Saber, Thunderchief, Talon. All these aircraft represented a different generation of Thunderbirds, different advancements in technology. Technology that in 1983 brought us the jet that revolutionized the fighter aircraft world and today remains a dominant force in the sky. The mighty F-16 fighting Falcon. Thunderbirds have flown the F-16 for more than 30 years now. Minus the red, white, and blue paint scheme, they are the same as the jets flying missions around the world today. It only makes sense that when people think of the Thunderbirds, they more than likely think of our F-16s, while those jets are our most visible assets and project the strength of our Air Force. It is our airmen that make it all possible. The Thunderbirds are comprised of more than 130 airmen. There are 12 officers each known affectionately by their number, with one exception, number one, our commander. We call him boss. He and Thunderbirds 2 through 8 are highly experienced fighter pilots. Thunderbirds 1 through 6 are demonstration pilots. Thunderbird 7 oversees Thunderbird operations and Thunderbird 8 acts as our advanced pilot and narrator during shows. Thunderbirds 9 through 12 are support officers who perform expert medical, administrative, maintenance, and public affairs functions. There are also more than 120 enlisted personnel representing nearly 30 career fields. Enlisted team members are selected from units across the Air Force. Each enlisted member plays a crucial role maintaining this well-oiled machine at home and on the road. Our time in this uniform is short and each one of us is charged by making the most of it, by inspiring and encouraging others by representing our amazing Air Force. So while the faces and jets have changed, the mission remains the same. We are the United States Air Force Air Demonstration Squadron. We are the Thunderbirds.


You know what I never talk about on this channel? And that's, someone literally just yelled some weird profanity. I never talk about what I wanna do in life or with this channel. And that's what today's about. So I'm gonna go shoot some stuff around town and talk to you guys. If you've been following this channel for any amount of time, you know that I'm a dreamer and I'm a doer. Like, and I don't think, I don't take those two things lightly at all because I'm such a doer that I get stuff done and I chase after my dreams. And I think that's what people like about me, I hope. I think, yeah, that sounds right. I've been daily vlogging and putting out daily videos for 10 days now. Dude, that stuff is hard, bro. I keep pushing myself and I'm like, I'm always thinking, ah, I don't wanna do today. Today's video is gonna be, ah, I don't know what I'm gonna do. But I just, something about it just makes me wanna keep uploading something about daily videos and YouTube just pumps me up. I don't know, I'm just pumped. I'm really pumped. Because of that drive, because of that tenacity that I have, it's led me to here. Starting this YouTube channel and doing what I wanna do with no reserve. Also, I've been trying to get myself to totally get rid of the word like, like just purge it out of my system because I hate that word. It makes me sound so unprofessional and I don't like it. I'm gonna start using the word like when it's needed. So, because of this tenacity that I have and the way I grew up and that's always been doing more work and it seems like this generation's all about do more work, create more and all this stuff and put it up on social media and do more, right? I think I owe it to myself and this channel to really tell you guys what I want in life. And it's somewhat selfish. And I don't think we talk about the selfishness that we all want or need. I think, right? Yeah, I think that's right. So, here's the thing. Let me explain. I want to be selfish on this channel. I want to make it about me and about my family and don't take it as a negative thing and by no means is this a negative way it's gonna be all about me. I want to become a YouTuber. If you go back and watch my first videos it was about playing bass and traveling the world and being a tour person, right? And I did some of that and that was a big part of my journey. But now it's becoming more of putting out daily videos and doing all these different things and like starting a family vlog and in the face of adversity of people saying, hey, you're not gonna do anything with your YouTube channel. You're not gonna grow it.  You're not gonna get different things. I guess I don't care about those things. I never started this YouTube channel for the fame. But first of all, let's just not do anything in life to get fame or get money out of it. You should do things to enjoy them, to be prosperous and making those things better and making yourself better. I truly think that.  So that's Johnny Q in like a super short and nutshell. I kind of want to tell you guys that I'm doing this for hopefully the betterment of other people and overall just me. I love creating videos. I love putting out content that hopefully inspires you guys to go out there and create more, get more. Get more stuff done. That's why I started this hashing. Well, I didn't start it, but I've kind of coined it as my own on my Instagram post nets. Hashtag, what is, what is, hash, hashtag a keep on creating of doing that. Just creating, keep creating for the sake of creating. And not that it has to be like, oh, I have to create again today. What am I gonna do? I want that to be a place of inspiration.  And the platforms that we have right now, I'm trying to really be me in all the platforms I can. So that's what I mean when I say I'm gonna be selfish with this channel.  I want you to comment. And you know, right now I'm not getting a lot of views and that's totally fine. I'm okay with not getting any views. I'm getting tens of views. Not hundreds or thousands, I'm getting tens, okay? And I'm thankful for those tens because those tens of views hopefully got something out of it. But I'm also pumped about the tens. That's what we need to figure out as a whole right now is people who want to create for platforms. It's not about the thousands. It's about the people who are watching you right now. So there's only one person watching this. Thanks for being here. Him or her, thank you for being on this channel. I hope my words bring inspiration to you and I hope they bring meaning and action. So that you can go out and take action for yourself because it's not about someone else. No one's creating this content for me, but me. I'm creating this content for me and for other people to be inspired. Yeah, I like that. I'm gonna use that. I like that. Like I said, that is Johnny Q in a nutshell and I appreciate your support right now. Thank you so much for watching and I'll catch you next time on the Johnny Q channel. Peace. Nailed it, love it. I could go home right now. Ah, thanks guys.