next to you, raise your hand. It looks pretty full. Anyone know

if this place has a fire code or not? Don't start fires. If you

start a fire, you have to share. People who have their hands up,

have a seat next to them so the smart money goes that way. The

smart money is not in Vegas. All right. Hi there. I'm Bruce

Schneier. Are there any questions? It's good. That was

the easiest talk I ever did. If there are any questions, I'm

happy to take them. There are actually mics here. There's one

there, there's one I can't see behind the camera guy there. >>

Do they work, though? >> Yes, they work. That one works. >>

Thanks for coming out again. The question is, it's an old

question and I'm wondering if maybe you have any new insight

into answer on this. With cryptography becoming more in

the collective consciousness, especially with people who are

less technically savvy, there has been an argument for a long

time trying to explain to people that encryption is not security.

It's very common for people to say we'll just encrypt the shit

and we're secure which obviously is total bullshit. Do you have

any insight on how to better explain to those people why

that's fundamentally flawed? >> I think you're right. A lot of

people think of crypto as a panacea where in fact it is just

a tool. And a very powerful tool, actually it's for a bunch

of reasons, but it doesn't automatically make security on

any data that has to be used. One of the things that the

Snowden documents has brought forward is metadata. So this

cell phone is a great surveillance device because the

metadata where this phone is has to be in the clear. Otherwise it

can't ring. Thinking about that I should turn the ringer off. So

there's a lot of things encryption can't do. Encryption

can protect data at rest, but if you aren't going to make a

target corporation, you have a database of numbers that you're

using, if it's encrypted the key has to be there. I talk about

encryption as a tool, not as security, just like your door

lock is a really important tool but doesn't magically make your

house secure. What encryption does, I think this is real

important, is it NSA surveillance, it forces the

listeners to target -- what we know about the NSA is that they

might have a bigger budget than anyone else on the planet, but

they're not made of magic. They are limited by the same laws of

physics and math and economics as everybody else. And if data

is unencrypted, if they can tap a translated Internet cable,

they can get everything. But if stuff is encrypted, they have to

target who they're listening to. If the NSA wants into your

computer, they are in. If they're not, one it's illegal

and they're following the law and two you're not eye enough on

the priorities list. So what encryption does is it forces

them to go through their priorities list. They can hack

into your computer, that's no problem. They can't hack into

everybody's computer. So encryption is just a tool, but

it's actually a really powerful tool, because it denies a lot of

the bulk access and forces the listeners to do targeted access.

And there's a lot of security benefit in that. >> I wanted to

see your opinion on the back door that Obama wants.

(Laughter.) I'm not sure Obama personally has an opinion here.

It's interesting. This is -- this is the same back door that

the FBI has been wanting since the mid '90s. We called it the

crypto war and now we call it the first crypto war. So number

three, I'm done. It is you guys. I only do two crypto wars per

lifetime. (Laughter.) It's interesting. >> You're referring

to PTP? >> In general. The FBI director gave an interesting

talk at the Aspen security forum. I recommend listening to

these talks. This is a very high level, mostly government

discussions about security, cyber security, national

security, really interesting stuff. He was interviewed by I

think Wolf Blitzer who actually asked a great question. Why

don't you like the term lone wolf terrorist. That was kind of

funny. He was talking about the going dark problem and the need

for back doors and this is the scenario he is worried about.

And he's very explicit. It is an ISIS scenario. ISIS is a new

kind of adversary in the government's eyes, because of

the way it uses social media. Unlike al Qaeda, ISIS does it

with Twitter. And this freaks the government out. So the

story, and they square up and down this -- swear up and down

this happens, ISIS is really good at social media at Twitter

and YouTube and various other websites, they get people to

talk to them who are in the U.S., like you guys, except you

know, a little less socially adept and maybe kind of a little

crazier. But they find these marginal people and they talk to

them and the FBI can monitor this and go FBI, rah rah. They

say go use this secure app and this radicalized American does,

they talk more securely and the FBI can't listen. And then you

know, dot dot dot explosion. So this is the scenario that the

FBI is worried about. Very explicitly. And they've used the

story again and again. And they say this is real, this is

happening. Now -- >> It's not going to work, though. >> It's

sort of interesting. If this is true -- let's take it as it is

true. Another phrase they use, they talk about the time between

flash to bang. Flash is when they find the guy, bang is when

the explosion happens. And that time is decreasing. So the FBI

has to be able to monitor. So they are pissed off that things

like I-message and other apps cannot be monitored, even if

they get a warrant. And this really bugs them. I have a

warrant, damn it. Can can't I listen? I can get the metadata,

why can't I listen? So if you think about that as a scenario,

that it's true, it is not a scenario that any kind of

mandatory back door solves. Because the problem isn't that

the main security apps are encrypted. The problem is there

exists one security app that is encrypted. Because the ISIS

handler can say go download signal, go download this random

fire encryption app I just uploaded ten minutes ago. So the

problem is not what he thinks it is. The problem is general

purpose computers. The problem is an international market in

software. So I think the back door is a really bad idea for a

whole bunch of reasons. I've written papers about this. But

what I've come to realize in the past few weeks is it's not going

to solve the problem the FBI claims it has and I think we

need to start talking about that. Because otherwise we're

going to get some really bad policy. (Applause.) >> Good

morning. So this will probably go less in the direction of for

instance crypto. My question is somewhat twofold but I'm going

to focus more on the first one. >> Do one at a time. >> In the

course of day-to-day interactions, both with security

people and with less security-minded folks, I've come

to the conclusion that operational security is very

difficult to instill. From your experience, is there an easier

approach to getting the understanding through? >> I

think ops sec is pretty much impossible. If the director of

the CIA can't get it right, we're all done. We see that in

the hackers that hack Sony. We see people screwing it up again

and again. I'm not sure there is a solution. Because good op sec

is really and truly annoying. It means not using e-mail for

certain things. I've come to the belief that we're not going to

be able to train people in good op sec. That the best security

is going to be pretty good security that's ubiquitous. And

we saw this in some more of the Snowden documents. How many

people read the recent article that came out of Germany. Okay

article, really great document on how it works, the NSA

flexible database for monitoring the Internet. You can read their

documents and they talk about how they can find people using

encryption and roll up the networks. They can't read the

traffic, but they know who is talking to who. Metadata,

encryption doesn't solve everything. And I'm reading

this, and it's clear you can do this with PGP as well. You want

to find out who's using encryption, it's easy if you

monitor enough of the Internet. And what that tells me is that

someone would be better off not using the great encryption

program they wrote or the really powerful one they just

downloaded, but the average one that everyone else is using.

That you actually are better off using an iPhone with i message,

even though I'm pretty sure the FBI can get at it individually.

But you can hide using it because we're all using it. You

don't stand out. So I think there is a lot of power in that.

You had a second part. Make it quick. >> You answered it. It

was for propers making the use of op sec less obvious. >> Make

it invisible. Think of SSL, good security works if people don't

even know it's there. Encryption from the handset to the base

station, it would be great if it was better but it's working

because nobody knows it's there. >> So in thinking maybe not as

thoroughly or deeply as I should about like cyber terrorist

threats and bad actors that want to do corporations or

infrastructure harm, these sorts of things, or just the public,

right, it seems like all the ingredients are there for people

to do really bad things and there are a lot of holes and

security flaws. What keeps there from being enough motivated bad

actors and people -- what keeps them at bay? >> I think

fundamentally people are good. Right? Society works because

most of us are honest. You kind of look at me funny, but none of

you have jumped up and attacked the person sitting next to you.

(Laughter.) You laugh, but if this was a room of chimpanzees

that would have happened. A room full of a lot of strangers

sitting quietly listening to me. This sounds weird but I think a

lot of what keeps the really bad things from happening is most

people don't want to do really bad things. If that wasn't true,

society wouldn't work. So I think you're right, that all the

pieces, a lot of the pieces are there. There is a couple of

things. Terrorism is harder than you think. Yes, technically it

can be easy, but the whole operation is actually harder.

Which is why you don't see a lot of terrorist attacks. What you

do see these lone wolfs that wake up one morning say I'm

going to do something bad, there's no conspiracy to detect,

there are no mistakes you can make over the course of the

planet that flash-to-bang time is so short. So I really do

think that's why. Something interesting I would mention as

long as we're on this topic, that a new tactic we're seeing

more of, the notion of institutional boxing. You can go

into a company, take all of their stuff and publish it. It's

freaking people out. This happened to Sony, the hacking

team. The guy who did that is in this room, thank you very much.

(Applause.) It's what might have happened to Ashley Madison,

which is a little more awkward for some people. (Laughter.) And

if you remember a few years ago it was HB Gary federal. An I

think this is a really interesting tactic because it

empowers individuals against very powerful organizations. And

it is the first, I think the first real counterargument I've

heard to the increasing practice of hiring a sociopathic CEO. If

you are worried about everything your CEO says becoming public in

three to five years, you might not want to hire a jerk. But I

expect to see more of this. People are noticing that

wikileaks is publishing Saudi diplomatic cables. Someone

hacked in and is dumping all this stuff. So that's an

interesting example of a new bad thing that's being enabled by

technology that's happening more and more of. But in general, I

do worry about the bad things happening, but I think it's less

common than we think, because most people don't do them. It's

the systemic stuff that bothers me. The Internet of things,

being able to hack cars and planes and heart monitors and

other stuff. And the interconnection of those. I

think we're going to see more unanticipated vulnerabilities.

Because remember complexity is the worst enemy of security. It

is nonlinear, tightly coupled complexity and that's really

what the net gives us so we've got to be real careful there >>

I had occasion to look at it recently and at that time you

guys had assessed that our ability to analyze hash

functions was a good ten to 20 years behind our ability to

analyze the other primitives. I wonder if you think that gap has

closed. >> I think we're much better at understanding hash