[00:00.910 --> 00:01.770]  Yeah, welcome.
[00:02.090 --> 00:06.290]  This is EOL, really, Ending the Epidemic of Bricked and Abandoned Stuff.
[00:06.490 --> 00:11.650]  And I am the sort of organizer of the panel.
[00:11.750 --> 00:18.190]  My name is Paul Roberts, and I am the president of a nonprofit group called the Secure Resilient Future Foundation.
[00:18.190 --> 00:19.950]  We're actually a fairly new nonprofit.
[00:21.230 --> 00:27.050]  And I've got some amazing folks up here on stage with me that I'm going to introduce.
[00:27.210 --> 00:28.610]  We're going to introduce ourselves in a second.
[00:28.610 --> 00:33.270]  And before we do that, I do want to give a shout out, first of all, to HOPE for hosting us.
[00:33.510 --> 00:45.330]  This is, I think, an ideal audience for us, folks who are really on the forefront of this intersection of civil rights, technology, sustainability.
[00:46.390 --> 00:48.350]  And I think we're going to touch on all those topics.
[00:49.710 --> 00:56.330]  SERF, Secure Resilient Future Foundation, that's a new 501c4 that I set up with John and Ladrina.
[00:56.930 --> 01:06.330]  And Perg, we've got Lucas Guterman from Perg here, also hugely important in a lot of these movements, including the right to repair movement.
[01:08.090 --> 01:09.310]  So who are we?
[01:09.470 --> 01:10.650]  Again, my name is Paul Roberts.
[01:10.870 --> 01:11.810]  I started SERF.
[01:11.910 --> 01:15.290]  I'm also the editor-in-chief of a cybersecurity publication called the Security Ledger.
[01:15.290 --> 01:33.090]  I've been working as a cybersecurity reporter, industry analyst, content creator type person for more than 22 years, and got involved pretty heavily in the right to repair movement about five years ago, six years ago.
[01:33.090 --> 01:46.150]  We've also created a group called Secure Repairs to kind of rally the cybersecurity community around right to repair, get us to kind of counter some of the BS security through obscurity arguments that we're winning today in state houses and on Capitol Hill.
[01:47.270 --> 01:50.730]  And SERF is kind of an outgrowth of that, formalizing it.
[01:50.850 --> 01:55.950]  And also, you know, the conversation is really bigger, as we'll talk about today, is bigger than just repair.
[01:56.270 --> 02:07.130]  It's about really the nature of connected device ecosystems and what our rights are as owners and as consumers and as residents of planet Earth.
[02:08.110 --> 02:12.710]  So, we'll talk a little bit about SERF at the end, but I'm going to go immediately to my left.
[02:13.530 --> 02:15.430]  And John, I want to introduce yourself.
[02:16.550 --> 02:18.110]  Hi, I'm John Bumstead.
[02:18.290 --> 02:22.370]  I have a Apple refurbisher called Roadkill Incorporated.
[02:22.650 --> 02:24.010]  I've been in business for 15 years.
[02:24.010 --> 02:42.330]  I buy tens of thousands of Apple products from electronics recyclers and broken as is conditioned, repair them, refurbish them, and then sell them wholesale, increasingly dealing with software locks, activation lock, that kind of thing.
[02:42.550 --> 02:44.210]  And so that's where I come in on this.
[02:45.950 --> 02:46.730]  Hi, everyone.
[02:46.950 --> 02:47.770]  I'm Lucas Gutterman.
[02:47.990 --> 02:53.230]  I am the Design to Last director with USPIRG, the U.S. Public Interest Research Group.
[02:53.370 --> 03:03.990]  We're a national nonprofit that works on campaigns to protect our environment, our public health, our democracy, and increasingly protect consumers in the new economy.
[03:04.190 --> 03:08.530]  And so we've launched a campaign on right to repair, which has been really successful.
[03:08.530 --> 03:19.030]  And then I direct a new campaign called Design to Last, which is pushing back against the disposability treadmill that just has us replacing our phones and our laptops and our appliances at increasing rates.
[03:19.170 --> 03:23.830]  And recently, we had a really exciting victory getting Google to extend support for Chromebooks.
[03:23.890 --> 03:25.410]  So I'll talk a little bit more about that.
[03:27.670 --> 03:28.210]  Hi, everybody.
[03:28.370 --> 03:29.850]  My name's Ladrina Cherney.
[03:30.230 --> 03:34.370]  I am a SANS instructor where I teach digital forensics.
[03:34.370 --> 03:37.430]  So I'm a big nerd about reverse engineering.
[03:37.810 --> 03:41.330]  My first hope was in the year 2000.
[03:42.070 --> 04:01.990]  And how I got to be here today is a very long path that involves being an intern at the EFF, learning to drive a car that was four times as old as I was at the time, and probably going on a cell phone that is very end of life.
[04:01.990 --> 04:03.950]  It's probably going on seven years now.
[04:04.290 --> 04:06.310]  But I care not just about technology.
[04:06.310 --> 04:10.290]  I care about people impacted by technology and our environments.
[04:10.890 --> 04:15.630]  So that's what I'm going to talk a little bit about today and the security of those devices.
[04:16.290 --> 04:16.770]  Okay.
[04:17.810 --> 04:18.530]  Thank you.
[04:19.310 --> 04:19.790]  Okay.
[04:19.970 --> 04:21.230]  So let's get started.
[04:22.530 --> 04:25.150]  And a couple kind of house rules.
[04:25.290 --> 04:29.770]  First of all, if you've got questions, just like throw up your hand or come up to the microphone.
[04:29.770 --> 04:31.670]  Actually, probably come up to the microphone.
[04:32.310 --> 04:34.390]  We'll try and save time for questions at the end.
[04:34.490 --> 04:38.830]  But honestly, like if somebody says something and it inspires you, just come up to the microphone and we'll take your question.
[04:39.290 --> 04:43.410]  Second of all, I got some of that mate stuff with this T-shirt, but I don't really drink it.
[04:43.410 --> 04:44.770]  So there is a bottle of it up here.
[04:44.890 --> 04:45.790]  If anybody...
[04:46.610 --> 04:47.050]  Unopened.
[04:47.150 --> 04:48.230]  If anybody wants it, help yourself.
[04:48.690 --> 04:48.910]  Okay.
[04:52.190 --> 05:07.530]  So end of life, EOL, if you're not familiar, is kind of the acronym for end of life, is becoming an epidemic problem in our country that affects both consumers and businesses.
[05:07.530 --> 05:09.050]  And we'll talk about that.
[05:09.890 --> 05:11.510]  And it's fueled by a couple of things.
[05:11.650 --> 05:14.390]  One is, of course, just the growth of smart connected stuff, right?
[05:14.610 --> 05:16.030]  Internet of things, as we call it.
[05:16.110 --> 05:18.430]  29 billion devices projected by 2030.
[05:18.430 --> 05:21.350]  I think there are something like, I don't know, 18 or 20 billion already.
[05:23.750 --> 05:37.830]  And there are really no guardrails that govern what can be smart and connected or what companies that create smart and connected devices have to do once they push it out to the public.
[05:38.190 --> 05:39.850]  It's basically the Wild West.
[05:41.330 --> 05:51.950]  And that has created a real short, well, a problem that has been invisible because, to date, almost all the connected smart stuff has been pretty new, right?
[05:51.970 --> 05:54.230]  It's a couple of years old or five years old or whatever.
[05:54.430 --> 06:06.670]  But as the IoT ages, there's this divergence between the life, the useful life of hardware that you might buy and the supported life of the software that runs the hardware, right?
[06:06.670 --> 06:12.690]  And the example I always like to use is like a home appliance, like a dishwasher or a refrigerator, right?
[06:12.910 --> 06:14.430]  Smart connected refrigerators.
[06:14.550 --> 06:15.630]  They got touch screen on the front.
[06:15.770 --> 06:17.430]  They're running Android or something like it.
[06:18.090 --> 06:24.450]  That refrigerator has a useful life hardware-wise, maybe in decades, 20, 25 years, maybe, if you're lucky.
[06:24.970 --> 06:40.250]  The company that sold it to you probably is going to support software for about six years, after which they will declare it end of life or unsupported and stop issuing security updates for it, stop issuing new feature updates, things, features might break or degrade over time.
[06:41.190 --> 06:45.110]  And as a consumer, you really have no recourse.
[06:46.090 --> 06:55.350]  And as the manufacturer really has no requirements on them as to the means by which they do that, it might be five years after you bought the thing.
[06:55.490 --> 06:57.030]  It might be six months after you bought it.
[06:57.370 --> 07:00.410]  It's really no... nothing kind of controlling that.
[07:00.690 --> 07:01.790]  So that's a problem.
[07:01.950 --> 07:04.750]  It's a cybersecurity problem, and it's also an environmental problem, right?
[07:04.750 --> 07:07.850]  Because consumers generally are, well, it's not supported anymore.
[07:07.850 --> 07:11.290]  You should probably get yourself a new refrigerator, or get yourself a new dishwasher, or get yourself a new phone.
[07:12.150 --> 07:15.130]  And the old phone, as John's going to tell you, it's going to end up...
[07:15.130 --> 07:17.130]  or the dishwasher is probably going to end up in a landfill.
[07:17.930 --> 07:20.290]  So there's a huge environmental cost as well.
[07:21.050 --> 07:27.350]  We've actually seen this already play out around the Chromebooks.
[07:28.070 --> 07:30.650]  And in connection, there's a kind of link to the pandemic.
[07:30.970 --> 07:36.270]  I'm going to pass it to Lucas to kind of bring you up to speed on what happened with that whole thing.
[07:36.830 --> 07:36.950]  Sure.
[07:37.450 --> 07:38.970]  So again, my name is Lucas.
[07:39.310 --> 07:41.850]  I direct a campaign called Design to Last.
[07:42.070 --> 07:48.490]  We're pushing back against this disposability treadmill that has us replacing phones and laptops and appliances.
[07:49.190 --> 07:53.850]  And one really egregious case that caught our eye was that of Chromebooks.
[07:54.190 --> 07:57.790]  So we've been working on right-to-repair for a couple of years now.
[07:57.870 --> 07:58.950]  And we've seen some excess.
[07:59.150 --> 08:01.850]  New York State, first state to pass right-to-repair law.
[08:01.990 --> 08:02.450]  Very exciting.
[08:03.250 --> 08:15.950]  But while we were doing this work, we were increasingly hearing from schools and repair technicians that Chromebooks were just ending up in piles in the backs of schools because they were no longer supported.
[08:16.770 --> 08:21.210]  That sort of caught our attention because it was not an issue of repair.
[08:21.490 --> 08:30.670]  Actually, lots of schools have really extensive repair programs where students are learning great skills and actually just repairing the laptops that their peers are using, which is really cool.
[08:30.870 --> 08:43.850]  And we actually, in the picture, you can see when we released the report, we had a student at Worcester Tech High School who was part of her repair program and talked about how excited she was to learn these skills to repair all these laptops, and then how confused she was when there was this huge
[08:43.850 --> 08:49.610]  pile of laptops that her advisor told her, oh, we just can't do anything with those.
[08:49.730 --> 08:50.370]  Those are expired.
[08:51.450 --> 09:00.050]  So we wanted to look into this, and it's particularly urgent because the amount of electronic waste that we are producing in this country is really astounding.
[09:00.050 --> 09:06.290]  We are throwing out over 500 pounds of e-waste per second just in the U.S.
[09:06.550 --> 09:08.670]  It is really outrageous.
[09:09.130 --> 09:15.670]  And so fundamentally, what drives this campaign is the idea that software should not be the reason why something stops working.
[09:15.950 --> 09:21.010]  If it still is working in terms of the hardware, it should be able to work for as long as the consumer wants it to.
[09:21.230 --> 09:22.250]  That's good for the environment.
[09:22.250 --> 09:23.530]  It's also just good for our wallet.
[09:23.730 --> 09:24.750]  The thing we buy should still work.
[09:25.010 --> 09:27.990]  So we found out about this issue with Chromebooks in schools.
[09:27.990 --> 09:29.430]  We did some research.
[09:29.670 --> 09:44.810]  I released a report called Chromebook Churn that found out that across the 48 million K-12 students in the U.S., if Google actually doubled the lifespan of Chromebooks, public schools could save $1.8 billion.
[09:44.950 --> 09:47.030]  So it's really significant.
[09:47.030 --> 09:57.690]  What it turns out is that unlike most other operating systems, there's not some minimum system requirements that Google requires to run Chrome OS.
[09:57.950 --> 10:01.690]  They just actually set a date after which software support ends.
[10:01.850 --> 10:05.110]  They call it the automatic update expiration, the AUE.
[10:05.610 --> 10:09.010]  And this is not when you or the school buys the laptop.
[10:09.070 --> 10:11.770]  It's when Google actually certifies the model.
[10:11.770 --> 10:23.770]  So it might have been certified, and it's sitting in a warehouse, and then it's sitting in the back of the school, then school starts, and then, you know, maybe you only have four or five years left before this laptop reaches end of life.
[10:24.410 --> 10:33.930]  Especially with COVID-19, almost 100% of K-12 schools now at least want to have a one-to-one program where they give every single student a laptop.
[10:33.930 --> 10:36.830]  And so schools are spending a lot of money, and this is a huge problem.
[10:38.430 --> 10:40.130]  So we released this report.
[10:40.290 --> 10:43.210]  We released it in front of Google's headquarters in Cambridge.
[10:43.690 --> 10:46.010]  We got a lot of coverage, which was really exciting.
[10:46.170 --> 10:53.770]  It was covered by the Boston Globe and the Boston Herald, Ars Technica, Vice, and, you know, other tech media like The Verge.
[10:54.270 --> 11:00.210]  People were just really outraged that schools had to throw out laptops that should still work.
[11:01.510 --> 11:09.670]  We also found out that 13 laptop models were actually going to expire by the end of the summer that we had released this report.
[11:09.870 --> 11:14.470]  We collected petition signatures from students and parents and PTAs.
[11:14.570 --> 11:18.310]  They were all calling for Google to extend support for these 13 models.
[11:19.010 --> 11:25.170]  What's sort of even more outrageous, just as a side note, obviously the biggest problem is that schools have these laptops and they stop working.
[11:25.350 --> 11:33.830]  But just as consumers, the kind of people that are in this room, Google and retailers don't disclose necessarily when these end of life dates are.
[11:34.030 --> 11:34.710]  You can find them.
[11:34.830 --> 11:35.410]  They're online.
[11:35.650 --> 11:41.850]  But if you're just a regular consumer and not the type of person to come to this conference, you're probably not Googling that when you buy a laptop on Amazon.
[11:42.210 --> 11:46.150]  And Amazon was selling laptops that had already expired.
[11:47.130 --> 11:52.170]  This is a huge problem, especially for Chromebooks, because Chrome OS is really well-integrated.
[11:52.350 --> 11:55.310]  It's basically entirely just the Chrome browser.
[11:55.890 --> 12:02.850]  And so, because the operating system and the browser are connected, once it reaches EOL, the browser can't get updates.
[12:03.010 --> 12:11.890]  And that actually means that the laptops can't be used for the basic things that you'd expect, even an old laptop that you'd want to maybe just give someone else to borrow to you.
[12:11.890 --> 12:14.210]  So, at a certain point, you're not going to be able to access Netflix.
[12:14.490 --> 12:21.950]  We actually heard from schools that they couldn't use these laptops for state testing websites because there were certain security requirements that state websites had.
[12:22.210 --> 12:24.170]  Anyway, it's a disaster, right?
[12:24.790 --> 12:25.950]  So, this was a huge problem.
[12:26.130 --> 12:27.290]  We were pushing back on Google.
[12:27.510 --> 12:28.510]  We got all this coverage.
[12:28.510 --> 12:29.890]  We collected all these signatures.
[12:30.530 --> 12:31.770]  Still, Google would not budge.
[12:32.050 --> 12:38.630]  Finally, we actually did an interview with ABC News where we talked about how schools had to replace all these laptops.
[12:38.630 --> 12:41.530]  And then Google finally listened, which was really exciting.
[12:41.770 --> 12:47.410]  So, Google announced that all Chromebooks, all models will get at least 10 years of support.
[12:47.690 --> 12:49.870]  And this is a huge step in the right direction.
[12:50.090 --> 12:50.770]  Yeah, thank you.
[12:51.030 --> 12:52.150]  It's really exciting.
[12:52.830 --> 12:56.630]  This is going to save schools millions of dollars.
[12:56.630 --> 13:04.510]  It's going to prevent, you know, potentially tens of thousands of laptops or hundreds of thousands of laptops from being thrown out and prevent a ton of e-waste.
[13:04.510 --> 13:06.310]  And so, that's great.
[13:06.490 --> 13:16.730]  But obviously, it's not just Google hardly that has this problem, even though they might have been one of the most kind of popular examples because of how popular Chromebooks were.
[13:17.050 --> 13:20.610]  And so, we can't just rely on companies to do the right thing.
[13:20.630 --> 13:28.770]  And we also can't just rely on corporate watchdogs to kind of make sure that the companies that are the most egregious are doing the right thing.
[13:29.570 --> 13:34.950]  And so, ultimately, we just think that losing features that consumers have paid for is unfair.
[13:35.210 --> 13:36.970]  And in fact, it's deceptive marketing.
[13:37.470 --> 13:45.450]  So, big picture, we need to pass bills at all levels of government that actually make sure that the things we buy are designed to last.
[13:45.630 --> 13:50.010]  We'll maybe talk a little bit about this later in the panel, but some quick ideas are labeling.
[13:50.010 --> 13:55.950]  At the very least, there should be transparency at how long the device is guaranteed to be supported for.
[13:56.450 --> 14:03.930]  We should require tools and methods to make sure that consumers can install whatever software they want on a product that they buy.
[14:04.150 --> 14:15.170]  Once end of life has come, if it's no longer financially viable for the company to keep supporting it, I should be able to install whatever I want right on this laptop or on this IoT device or whatever the thing is.
[14:16.350 --> 14:20.590]  And then, finally, we should also just ban disposable tech.
[14:20.770 --> 14:25.070]  So, we didn't talk about this here, but there's things like disposable vapes with touch screens.
[14:25.070 --> 14:26.590]  That's totally outrageous.
[14:27.110 --> 14:33.150]  We should not be making technology that's designed to be used for two weeks and then thrown out.
[14:33.450 --> 14:37.530]  We just really can't afford to do that for our environment or for our wallets.
[14:37.590 --> 14:41.470]  And so, we should just ban sort of the worst cases of these disposable pieces of technology.
[14:41.970 --> 14:43.150]  And this is really urgent.
[14:43.610 --> 14:49.070]  You know, just in the 10 minutes I've been talking, we have now thrown out 300,000 pounds of e-waste.
[14:49.070 --> 14:52.110]  So, it is a huge problem, again, in the U.S.
[14:52.550 --> 14:55.670]  And so, we're holding corporations accountable to this.
[14:56.010 --> 15:03.810]  But also, if you have been the victim of one of these issues, I encourage you to actually report that to the FTC or to the U.S.
[15:04.070 --> 15:05.730]  Attorney General or the Attorney General of your state.
[15:05.730 --> 15:09.550]  Again, buying a product with features that have been removed.
[15:09.630 --> 15:12.710]  That's just unfair and deceptive marketing and we should not tolerate that.
[15:13.050 --> 15:15.350]  And so, we'll talk a little bit more about how to do that later on.
[15:15.490 --> 15:24.310]  But that's, I think, the kind of next step is just actually holding corporations accountable for removing these features and EOL and devices when they really should still work.
[15:24.890 --> 15:25.550]  Thanks so much.
[15:25.550 --> 15:33.290]  I mean, one of the big challenges is, or questions is, well, you know, why don't we just reuse this hardware, right?
[15:33.390 --> 15:37.270]  I mean, we're producing all of these phones and laptops and tablets and other stuff.
[15:37.350 --> 15:39.270]  So, okay, so we don't want to throw them out.
[15:39.410 --> 15:42.350]  So, let's just reuse them instead of recycling them, right?
[15:43.130 --> 15:43.810]  Why not?
[15:44.610 --> 15:49.210]  And the answer is because there are actually huge impediments to doing that, technical and otherwise.
[15:49.610 --> 15:52.990]  And to talk about that, I'm going to throw the mic over to John Bumstead.
[15:53.750 --> 15:54.630]  Hey, everyone.
[15:55.410 --> 16:00.330]  So, as I mentioned, I buy thousands of Apple devices from electronics recyclers every year.
[16:00.570 --> 16:02.260]  iPhones, iPads, MacBooks.
[16:02.830 --> 16:06.890]  There are a couple thousand recyclers around the country, mostly in rural areas.
[16:07.490 --> 16:12.310]  They keep a very low profile, and the general public really doesn't know much about them.
[16:12.770 --> 16:19.090]  But pretty much all academia, corporations, and government dump their devices to recyclers.
[16:19.090 --> 16:23.150]  It's a huge percentage of the devices that exist out there in the world.
[16:23.410 --> 16:32.430]  So, the troubling thing we're experiencing is an increase in Apple's activation lock feature, making refurbishing almost impossible.
[16:33.050 --> 16:39.410]  Activation lock is an anti-theft feature that is turned on by default, but it requires a manual step to disable.
[16:40.090 --> 16:47.250]  The problem is that institutions dump millions of devices to recyclers without bothering to remove them from their iCloud accounts.
[16:47.250 --> 16:52.610]  They do this out of laziness because removing iCloud is a cumbersome procedure.
[16:52.950 --> 16:56.570]  They assume the devices will be destroyed, so why bother?
[16:56.750 --> 16:57.250]  We're busy.
[16:57.690 --> 16:59.090]  Any given reason.
[16:59.350 --> 17:05.090]  But the result is that the devices are activation locked once they reach the recycler.
[17:05.470 --> 17:12.380]  And for very complicated reasons, recyclers don't have leverage to push back on the donating institutions.
[17:13.660 --> 17:21.440]  The donating institution may not even realize they're locked because it takes days to process a pallet of laptops.
[17:21.860 --> 17:27.340]  And a recycler may not know either if they're locked before they sell them off to a refurbisher like me.
[17:29.040 --> 17:33.000]  It's important to note that these locks are not local to the device.
[17:33.300 --> 17:38.320]  If you look at this slide, it's based on the serial number.
[17:38.500 --> 17:42.660]  And it's enforced by Apple when the device touches the Internet.
[17:43.060 --> 17:44.520]  The device may be wiped.
[17:44.740 --> 17:46.060]  Most of them are actually wiped.
[17:46.160 --> 17:47.860]  It's not a data security issue, really.
[17:48.440 --> 17:54.860]  But when they connect to Wi-Fi on the setup process of an Apple device, they do a handshake with Apple.
[17:55.560 --> 17:56.840]  They reveal their serial number.
[17:56.980 --> 18:02.660]  And if they're associated with an iCloud account, the device's board is effectively bricked.
[18:02.660 --> 18:04.660]  And it's scrap.
[18:04.820 --> 18:05.560]  It's as good as scrap.
[18:06.080 --> 18:08.380]  If it's a clean device, Apple lets you buy.
[18:08.760 --> 18:11.060]  But locked or not, don't be fooled.
[18:11.220 --> 18:16.000]  Apple has a centralized method of control in place for all its devices.
[18:16.000 --> 18:19.820]  Apple is the ultimate administrator of your Apple devices.
[18:21.340 --> 18:26.380]  Activation lock is supposed to be an anti-theft feature, but these devices are not stolen.
[18:26.740 --> 18:30.400]  And literally millions of devices get locked and bricked every year in this manner.
[18:30.780 --> 18:36.720]  And what makes activism tricky in this area is that the general public has no clue.
[18:37.020 --> 18:38.660]  They just do not see this.
[18:39.360 --> 18:41.740]  Most of the devices are scrapped by recyclers.
[18:41.740 --> 18:48.960]  And if they get out into the world, due to Apple's marketing about activation lock, they're quickly assumed stolen.
[18:51.680 --> 19:00.700]  It varies, but I'd say probably a third to two thirds of the devices I buy are activation locked or remote managed, which I'll talk about next.
[19:00.700 --> 19:02.960]  So it's pretty catastrophic.
[19:04.340 --> 19:06.040]  And yeah, like I said, there's more.
[19:06.340 --> 19:07.380]  There's remote management.
[19:07.660 --> 19:12.700]  In addition to activation lock, we have management lock, MDM.
[19:12.860 --> 19:14.880]  It's not even supposed to be a lock.
[19:15.000 --> 19:20.140]  But when it's activated on a device, it presents a login for the institution.
[19:21.040 --> 19:25.280]  And if you don't have the login, the device is effectively bricked as well.
[19:25.280 --> 19:29.720]  It follows the same path that you see on the slide as well.
[19:30.780 --> 19:33.080]  Remote management is a great tool, actually.
[19:33.300 --> 19:34.000]  It makes sense.
[19:34.260 --> 19:44.600]  It's a powerful centralized tool that lets administrators keep track of users, deploy applications, make restrictions, all sorts of good stuff.
[19:44.740 --> 19:54.480]  But too often, institutions fail to remove their device's serial numbers from the management systems when they dispose of them, leading again to the same situation in the slide.
[19:54.680 --> 19:57.600]  The wipe device does a handshake, reveals its serial.
[19:57.920 --> 20:02.220]  Apple pushes down the institutional login prompt, and the user cannot proceed.
[20:03.740 --> 20:14.900]  So yeah, as a refurbisher, activation lock and remote management lock are an epidemic that is preventing reuse and causing tens of millions of devices to be destroyed.
[20:15.660 --> 20:17.180]  Many only a few years old.
[20:17.180 --> 20:21.900]  I'm regularly offered by a recycler, hey, I have 100 M1 MacBooks.
[20:22.000 --> 20:27.440]  They just need boards because the boards have been pulled out and scrapped because they're locked.
[20:27.620 --> 20:31.520]  So that's the kind of thing that's very common these days.
[20:32.340 --> 20:36.080]  Apple won't remove remote management under any circumstance, period.
[20:36.360 --> 20:42.520]  And the process to appeal activation lock is so worthless that it's basically not worth trying.
[20:43.580 --> 20:52.000]  There's not time to go into this here, but Apple parts pairing you may have heard of recently is also an existential threat, as if we need another one.
[20:53.360 --> 20:57.680]  Parts pairing requires Apple's approval to change out a part on a device.
[20:57.980 --> 21:01.720]  So think of how that affects people who do repair.
[21:04.180 --> 21:07.760]  It's rarely viable for a refurbisher to buy new parts.
[21:08.560 --> 21:13.220]  You just can't... you can't buy a $500 screen to fix a $100 laptop.
[21:13.480 --> 21:15.420]  It's just... it just makes zero sense.
[21:16.100 --> 21:23.920]  So we depend on using parts from broken machines and third-party parts, which parts pairing makes difficult.
[21:23.920 --> 21:28.640]  And whereas, until recently, locked devices could at least be used for parts.
[21:28.820 --> 21:32.020]  You know, the board's scrapped, but at least you can use the other components.
[21:32.740 --> 21:38.300]  Apple is now using parts pairing to push activation lock out onto the parts themselves.
[21:38.820 --> 21:51.520]  So before only a board was locked and unusable, but now all the parts of a device, like potentially even the battery and the screen, are condemned to death because they came from an activation locked device.
[21:52.580 --> 21:57.460]  Meaning that truly all you can do with a locked Apple device is scrap it.
[21:57.960 --> 21:59.700]  So yeah, it's a mess.
[22:00.980 --> 22:01.560]  Question.
[22:14.410 --> 22:14.990]  Yeah.
[22:15.370 --> 22:16.350]  Do I think you're having...
[22:16.350 --> 22:23.590]  Do you think these policies are having an impact, economic impact on Apple by reducing the residual value of all of this product?
[22:23.590 --> 22:26.210]  Because clearly the residual value is reduced.
[22:26.750 --> 22:32.030]  I mean, I think you'd have to say looking at the quarterly numbers from Apple, the answer would be no, that this is not...
[22:32.030 --> 22:37.210]  I mean, and honestly, this is one of the problems, which is that doesn't really figure...
[22:38.170 --> 22:50.310]  The environmental cost of all this discarded hardware is borne by consumers or communities that do recycling and by the planet, not by Apple Corp.
[22:50.310 --> 22:52.270]  So no, I don't...
[22:52.270 --> 23:04.370]  It'd be hard for me to see any residual effect on Apple's, you know, net worth or value as a corporation based on the reuse and resale of its old devices.
[23:04.370 --> 23:05.890]  It's all about selling new stuff.
[23:06.030 --> 23:07.730]  But I don't know if other people have thoughts.
[23:08.210 --> 23:08.690]  John?
[23:09.770 --> 23:12.670]  I mean, there's that whole thing about ignorance and malice.
[23:12.850 --> 23:15.810]  You know, I don't really ascribe malice to Apple.
[23:15.810 --> 23:21.690]  I think they have the same tendency that all of us do, which is to look ahead and not look in the rear view mirror.
[23:22.110 --> 23:25.270]  So I think it's just...
[23:25.850 --> 23:27.750]  It's convenient that the things...
[23:27.750 --> 23:30.270]  The situation is the way it is, largely.
[23:31.630 --> 23:32.070]  Okay.
[23:33.010 --> 23:34.610]  So we're gonna go ahead and just do...
[23:34.610 --> 23:34.770]  We got...
[23:34.770 --> 23:35.090]  We got...
[23:35.090 --> 23:35.950]  We got one more...
[23:35.950 --> 23:36.990]  One more topic to talk about.
[23:37.070 --> 23:37.590]  And then we're gonna...
[23:37.590 --> 23:38.230]  And then we're gonna...
[23:38.230 --> 23:39.210]  Kind of open it up.
[23:39.350 --> 23:39.710]  But...
[23:39.710 --> 23:40.910]  So, I mean, the...
[23:40.910 --> 23:41.550]  The other...
[23:41.550 --> 23:46.410]  The other piece of this puzzle is, of course, that there is risk.
[23:46.670 --> 23:47.050]  No problem.
[23:47.150 --> 23:47.330]  Enjoy.
[23:48.930 --> 23:49.290]  Man.
[23:50.370 --> 23:50.690]  Okay.
[23:52.430 --> 23:52.790]  Reuse.
[23:52.990 --> 23:53.150]  That is...
[23:53.150 --> 23:53.870]  That will not go to waste.
[23:55.170 --> 23:56.930]  Is, of course, that there...
[23:56.930 --> 23:59.450]  These are not merely just economic questions.
[23:59.450 --> 24:00.210]  These are...
[24:00.210 --> 24:05.710]  There is also a public health and safety question around cyber risk.
[24:05.810 --> 24:07.110]  So I'm gonna pass the mic to Latrina.
[24:07.610 --> 24:08.630]  So let...
[24:08.630 --> 24:10.430]  Let no resources go to waste.
[24:10.770 --> 24:12.590]  Thank you for putting that to use.
[24:13.570 --> 24:15.670]  So, I'm a security professional.
[24:15.950 --> 24:18.790]  I'm ostensibly up here to talk about security.
[24:19.010 --> 24:39.890]  But to pull on what Paul mentioned about costs that are borne by communities, I really want to focus on that and state for the record and address maybe people who are outside of this room right now and say that if we had, one of us up here on stage, some kind of smart device,
[24:40.250 --> 24:59.090]  like, say, a smart home speaker that suddenly stopped functioning due to end-of-life updates, which I have had happen to me, you know, I could say pretty confidently that within the first three rows of this audience, I could find somebody to help me fix that device and keep it running and keep it
[24:59.090 --> 24:59.710]  playing music.
[25:00.070 --> 25:14.250]  So whether it's your smart speaker, your smart vacuum, or something a little bit more elaborate, you know, I do want to acknowledge that I see a lot of sympathetic and supporting faces in the audience here.
[25:14.250 --> 25:21.410]  And that we are some of the people in the minority who acknowledge that this is an issue.
[25:21.670 --> 25:25.210]  But our community is broader.
[25:25.810 --> 25:45.320]  So shout out to, if anybody was at the Crypto Harlem talk this morning, we want to think about the broader issues in our community and how to educate people about this issue and how to make people care, how to think about other people who are outside of the English-speaking world,
[25:45.710 --> 25:53.850]  outside of North America, and that a lot of these problems really compound when we start looking at other communities.
[25:54.130 --> 25:57.430]  So I just want to set that as table stakes for the record.
[25:58.550 --> 26:13.730]  I wonder if you would care, if you had, say, a smart refrigerator that was running a botnet to, I don't know, attack domestic resources.
[26:14.670 --> 26:18.010]  Hands up, does anybody think this is a realistic scenario?
[26:19.870 --> 26:20.990]  Oh, my gosh.
[26:21.170 --> 26:27.650]  Okay, so for folks online, that was a whole lot of the audience who raised their hands just now.
[26:28.050 --> 26:29.150]  So here's the thing.
[26:29.150 --> 26:35.450]  We actually saw something like this not with smart refrigerators, but with end-of-life routers.
[26:35.730 --> 26:52.330]  So if you look up research from Lumen Technologies, there was a campaign that they researched to show that end-of-life routers were being used in a worldwide botnet to hide malicious traffic.
[26:53.010 --> 26:55.430]  So basically, people...
[26:55.430 --> 27:04.650]  attackers were using infrastructure in your homes and offices to basically attack other resources.
[27:05.970 --> 27:12.050]  So for those who kind of said, well, yeah, I know my smart refrigerator can do more than I want it to.
[27:12.790 --> 27:14.810]  How many of you who said, yeah, this is possible?
[27:15.010 --> 27:16.670]  How many of you, raise your hands, do you care?
[27:20.270 --> 27:21.210]  How about this?
[27:21.410 --> 27:27.990]  If as long as it keeps your food cold, that's good, right?
[27:27.990 --> 27:30.710]  If your smart refrigerator's running a botnet, whatever.
[27:32.230 --> 27:36.370]  I can see there's a few of you who are like, okay, well, it's degrading my network traffic for streaming.
[27:36.550 --> 27:37.690]  Yes, I definitely care.
[27:37.690 --> 27:38.750]  I see you right here.
[27:39.590 --> 27:39.990]  Okay.
[27:40.310 --> 27:41.730]  So here's the thing.
[27:43.730 --> 27:46.110]  Most people don't care.
[27:46.610 --> 27:47.070]  Right?
[27:47.590 --> 27:55.790]  And I think we should, because we can think about routers, we can think about refrigerators, but what about when we get to other devices?
[27:55.970 --> 28:00.510]  What about when we get to industrial control systems and there's those components that are end of life?
[28:00.750 --> 28:11.790]  What about when we get to medical devices and security of medical devices and obligations of manufacturers to keep updating these devices?
[28:12.250 --> 28:20.410]  So I just want to acknowledge, one, this is a bigger problem beyond our community that is in the room and that is online watching this live.
[28:20.730 --> 28:23.570]  And that this is an actual threat.
[28:23.730 --> 28:30.490]  And maybe I haven't seen anything about a refrigerator botnet yet, but it certainly has happened with other devices.
[28:31.150 --> 28:31.390]  Yeah.
[28:31.570 --> 28:32.330]  Thank you.
[28:32.670 --> 28:32.890]  Yeah.
[28:34.070 --> 28:34.570]  Absolutely.
[28:34.790 --> 28:40.930]  I mean, this is a huge impact on the ecosystem, the overall ecosystem.
[28:41.410 --> 28:45.430]  But where does the responsibility lie and how do we address this problem?
[28:45.530 --> 28:49.890]  That's, you know, one of the questions that we're here to answer, right?
[28:50.030 --> 29:08.310]  Which is, what is the solution to this problem around, whether you want to call it abandoned ware, which is a term that actually generally is usually more, or it applies to like games, but frankly, it could apply to anything, or end of life devices.
[29:10.030 --> 29:18.210]  And, you know, in some ways, we're kind of bringing this to this group for thoughts and ideas about solutions to this problem.
[29:18.410 --> 29:19.830]  There are examples.
[29:21.850 --> 29:31.350]  One is, you know, the Pebble watch, which was an early smartwatch that was, you know, end of life.
[29:31.510 --> 29:35.890]  The company that made it was acquired, and they discontinued support for the Pebble.
[29:36.090 --> 29:52.790]  But the response was to open-source the software for the Pebble watch and for the infrastructure that supported it, basically turn it over to the commons to, you know, GitHub, and allow the user community to step up and continue to support that watch.
[29:52.910 --> 29:56.890]  And to this day, you've got people wearing Pebble watches, and Pebble watches continue to function, right?
[29:57.130 --> 30:01.490]  The flip side of that, I think, are the stories that we've seen recently, right?
[30:02.370 --> 30:10.310]  Or, and Lucas can speak to some of these, you know, Oral-B's smart toothbrush or the, I don't know if you read about the Spotify car thing, right?
[30:10.470 --> 30:16.030]  Which was a touch screen to do Spotify, use Spotify in a dumb car.
[30:16.990 --> 30:28.050]  You know, Spotify is end of life that thing about 18 months after they launched it, you know, and killed it, decided they were going to brick it shortly thereafter.
[30:28.530 --> 30:34.370]  So if you bought that device for a few hundred dollars, you know, three years later, it is worthless.
[30:34.570 --> 30:36.890]  It's basically destined for the landfill.
[30:37.770 --> 30:43.890]  So the question is sort of from a policy standpoint, how do we address this problem?
[30:44.570 --> 30:46.150]  And what are the fixes?
[30:46.850 --> 30:50.790]  One is to just say, well, let's just require manufacturers to open-source stuff.
[30:51.870 --> 30:52.850]  Great idea.
[30:53.690 --> 30:56.970]  Good luck getting it done from a legislative standpoint.
[30:57.810 --> 31:00.970]  But there are other options as well.
[31:01.350 --> 31:06.410]  And, you know, I mean, I'm sort of interested in the audience's thoughts.
[31:06.410 --> 31:10.910]  As to what some solutions that they would recommend are also our other panelists.
[31:11.350 --> 31:19.030]  So maybe we'll start up here on stage and talk about some of the possible solutions that we've seen out there and things that we want to see.
[31:19.030 --> 31:31.310]  Right now in the EU, there is a proposal that smart devices need to be supported for seven years with hardware and five years for software.
[31:31.770 --> 31:43.930]  So there should be some kind of consumer confidence in the big fancy device that you are buying to be productive, to live your life, to take care of your health care, for transportation.
[31:45.050 --> 31:47.730]  That's just one thing that we're seeing out there.
[31:49.270 --> 31:55.650]  Yeah, I think transparency is something that a lot of policy bodies are looking at.
[31:55.870 --> 31:58.330]  You know, we have warranties when we buy a car.
[31:58.330 --> 32:06.090]  It seems like we should have some expectation for how long a phone or a laptop or an appliance is going to last before we lose support.
[32:06.090 --> 32:13.850]  That being said, to me, the thing that transparency requires is also still what happens once it reaches end of life.
[32:14.010 --> 32:27.190]  And that's why we advocate for what's written here as a sort of graceful default, or making sure that consumers have the ways and methods to continue to use the device even after official support ends.
[32:27.190 --> 32:32.690]  And so that could mean making sure the device actually has physical buttons so you can still use it.
[32:32.950 --> 32:36.190]  If this is a smart appliance, that software support ends.
[32:36.810 --> 32:44.990]  And that we can install whatever software we want on a device, return it to a general computing device once the official software support has ended.
[32:47.610 --> 33:06.390]  I mean, John, I'd be interested in asking you, like, if you were recycling czar in the next administration and in charge of, or reuse czar, and could just sort of declare, like, here's how we're going to manage device reuse and recycling, I guess, if you have to.
[33:07.350 --> 33:09.290]  And we really want to promote this.
[33:09.290 --> 33:10.830]  We want to encourage reuse.
[33:10.890 --> 33:13.110]  What would you propose?
[33:14.430 --> 33:36.090]  Oh, well, you know, I teach people to replicate my business because I think one of the big answers to the problem is, well, it solves the problem in one of the only ways that I've been able to figure out how to do it, which is to start a business, you know,
[33:36.210 --> 33:40.490]  start a repair business, declare your independence, make your own money.
[33:41.270 --> 33:45.210]  And to do that, you can go buy broken stuff, fix it, and sell it.
[33:46.390 --> 34:02.930]  So I try to train people, you know, there's the policy perspective, there's all the other perspectives which are very important, but I try to, on the ground, just get people to replicate my business and be independent and have a refurbishing business themselves,
[34:02.930 --> 34:05.450]  solving the problem.
[34:05.730 --> 34:11.510]  You know, maybe one person in their basement can repair 10,000 machines a year and then push them out.
[34:11.570 --> 34:13.350]  And that's a big deal.
[34:14.370 --> 34:16.410]  That would be great to see.
[34:16.770 --> 34:22.530]  But the first thing that we're going to need is the ability and the authority to do those repairs.
[34:22.530 --> 34:23.090]  Right.
[34:23.310 --> 34:28.710]  So it's both the ability to do this and being able to interface with devices.
[34:28.710 --> 34:30.350]  It's having the parts available.
[34:30.550 --> 34:34.810]  And we talked about how parts pairing is a much longer discussion that we could have.
[34:35.170 --> 34:38.150]  But it's also having people to do this.
[34:38.290 --> 34:47.890]  And I think that I've been in a number of talks this week where we've talked about upskilling people to support new initiatives as another bottleneck that we have.
[34:48.770 --> 34:49.330]  Yes.
[34:49.850 --> 34:56.650]  So what about requiring that devices that you'll be able to, like, flash your own firmware to them?
[34:56.670 --> 35:01.730]  Because that's something you can do with phones sometimes, but you can't, definitely can't do with every device?
[35:03.010 --> 35:04.350]  Yes, absolutely.
[35:04.650 --> 35:17.370]  I mean, I think that that would be, you know, so being able to sort of liberate your device from the manufacturer and say, yes, Apple, I bought this hardware from you or, you know, whomever, Microsoft or...
[35:18.710 --> 35:22.090]  But, you know, I want to run different software on it.
[35:22.170 --> 35:22.290]  Right.
[35:22.390 --> 35:27.070]  I mean, in certain contexts, right, the laptop desktop market, like, we take that for granted.
[35:27.110 --> 35:28.390]  Like, yeah, it's got Windows on.
[35:28.410 --> 35:30.730]  I bought it with Windows on it, but I'm going to run Ubuntu on it.
[35:30.830 --> 35:31.470]  And like, whatever.
[35:32.110 --> 35:38.830]  But in the IoT space, right, we don't have that same freedom or assumption of freedom.
[35:39.570 --> 35:39.970]  Yeah.
[35:40.570 --> 35:41.390]  And sometimes you can.
[35:41.630 --> 35:49.010]  I have seen projects where they're like, oh, yeah, you can modify this IoT thing, but it's definitely not universal.
[35:49.290 --> 35:49.430]  Right.
[35:49.730 --> 35:51.750]  And there are some folks working on stuff like that.
[35:51.750 --> 36:02.170]  Well, I just wanted to go back to what Ladrina said, which is that we all may be, or the people in this room can flash some products, but we have to make sure that regular consumers and people can do that.
[36:02.170 --> 36:08.950]  And so part of, we have a petition up on Spotify Carthing, which is going to release End of Life in December.
[36:08.950 --> 36:10.250]  It was released three years ago.
[36:10.430 --> 36:14.570]  There's a really active hacking community that's coming up with really cool stuff to put on Carthing.
[36:14.830 --> 36:21.790]  But we're asking Spotify to release a tool that allows regular consumers to install the software of their choice.
[36:21.910 --> 36:24.410]  Because the flossing process is actually quite difficult.
[36:24.650 --> 36:28.630]  And moving that barrier to entry is going to just keep more stuff out of the landfill.
[36:28.850 --> 36:29.610]  So that's the idea.
[36:29.610 --> 36:32.910]  So, yes, kudos to that.
[36:33.510 --> 36:50.730]  I want to add one quick personal anecdote to the question that was just asked, which is, so I'm a motorcycle rider, and we were having a conversation in the hallway before this about, like, motorcycle vests that require monthly subscriptions or they will not inflate when you have an accident.
[36:51.050 --> 36:54.790]  If you want to have a side conversation about that, catch me in the hallway afterward.
[36:55.170 --> 36:56.950]  But here's a real example.
[36:56.950 --> 37:11.130]  I went to get my bike serviced at my dealership the other day, and I had to sign a waiver that said, if you have installed any customized software on your bike, we will not service it.
[37:11.270 --> 37:24.030]  So we will not continue to do the important safety and maintenance work that must be done if you have, you know, boosted whatever turbo setting there is that you have personally unlocked.
[37:24.290 --> 37:30.570]  So just a personal anecdote that I've run into myself, and I think you could pull examples like that in other areas.
[37:31.150 --> 37:32.550]  I wonder if that's legal.
[37:32.870 --> 37:33.350]  Yes.
[37:33.870 --> 37:35.830]  I have a feeling it isn't, but anyway, go ahead.
[37:36.010 --> 37:36.270]  Sounds like time.
[37:36.270 --> 37:45.390]  So I just wanted to appreciate everything that you've said, but I want to say the wave is coming, and it's going to get more electromechanically complex.
[37:46.170 --> 37:54.870]  We are about to see, I'm not joking here, billions of robots coming onto the marketplace.
[37:54.870 --> 38:05.130]  I mean, like, it's one thing for me to go into a university and remove one of a few score PR2 that were ever made from a botnet.
[38:05.390 --> 38:17.990]  It's another thing for me to deal with the 750,000 AMRs that Amazon Robotics has built, or the 10,000 a year digits that are about to be built for humanoids.
[38:19.090 --> 38:24.990]  We're going to see a lot more of this, and the primary business model for these companies is robot as a service.
[38:25.570 --> 38:26.050]  Yes.
[38:26.230 --> 38:28.270]  It's not selling the robot to you.
[38:28.370 --> 38:32.310]  It's leasing it to you and bricking it when you stop paying.
[38:32.570 --> 38:35.570]  I think that's fine as long as they lease it to you, right?
[38:35.710 --> 38:37.670]  In other words, you are not owning it.
[38:37.950 --> 38:44.030]  The problem I have is when they sell it to you, but then you find out actually it's leased.
[38:44.270 --> 38:46.610]  I can, as you know, Mike, right?
[38:47.510 --> 38:51.570]  Because with the automobiles, you have as an automobile, as a driver, you have a choice.
[38:51.570 --> 38:59.470]  You can buy a car, in which case you want to pull it out in your driveway, put it up on Jack and, you know, work on the undercarriage or replace parts or whatever.
[38:59.990 --> 39:00.510]  It's yours to do.
[39:00.610 --> 39:01.890]  If you lease the car, you can't do that.
[39:01.990 --> 39:02.870]  You got to bring it back to the dealer.
[39:03.030 --> 39:04.090]  That's actually part of the attraction.
[39:04.310 --> 39:05.610]  I don't have to worry about any of this stuff.
[39:05.690 --> 39:06.510]  It's all covered by the lease.
[39:07.930 --> 39:10.130]  But the cost, of course, is usually different, right?
[39:10.210 --> 39:19.210]  You have a huge upfront cost to buy the car, but actually over the lifespan of that car hardware, it's a lot more expensive to lease it, right?
[39:19.270 --> 39:23.710]  You amortize that cost of purchase over 20 years or 30, however long you can keep that car on the road.
[39:23.890 --> 39:28.730]  So if that is the deal with the robot model marketplace, fine.
[39:28.970 --> 39:39.750]  Because if 10 companies out there are leasing at an exorbitant price per month or per year, then there's a business opportunity for a company to say, well, I'll actually sell you the robot and you can fix it yourself.
[39:39.750 --> 39:44.430]  And you can amortize that cost over three decades or four decades.
[39:44.590 --> 39:52.530]  Whereas these other people are going to have to renew their robots every three years at the request of the bequest of the manufacturer.
[39:52.930 --> 39:54.630]  So that's fine.
[39:54.930 --> 39:59.390]  But don't sell me the robot and then tell me actually, no, you don't own it.
[39:59.910 --> 40:00.230]  Yeah.
[40:00.550 --> 40:00.670]  Right.
[40:01.310 --> 40:02.190]  That's the problem.
[40:02.810 --> 40:02.890]  Yeah.
[40:03.570 --> 40:09.930]  We're trying to figure this out too, because consumers don't want to pay subscriptions for everything in an item forever.
[40:10.230 --> 40:10.330]  Right.
[40:10.510 --> 40:12.810]  But sometimes it does make sense to have a subscription service.
[40:13.210 --> 40:19.270]  The thing when it crosses the line is when you have to pay a subscription to access features that are already in the hardware that you bought.
[40:19.410 --> 40:19.650]  Right.
[40:20.030 --> 40:23.970]  So I shouldn't have to pay a subscription to use the seat heater in my car.
[40:24.090 --> 40:24.270]  Right.
[40:24.470 --> 40:25.230]  I bought the car.
[40:25.350 --> 40:26.550]  It has the seat heater function.
[40:26.830 --> 40:27.250]  That's right.
[40:27.330 --> 40:28.330]  That was part of the purchase price.
[40:28.510 --> 40:29.450]  That's when you cross the line.
[40:29.650 --> 40:30.710]  Some people want to lease their car.
[40:30.890 --> 40:31.150]  That's fine.
[40:31.330 --> 40:31.450]  Right.
[40:31.550 --> 40:32.670]  So that's sort of the line.
[40:32.750 --> 40:32.850]  Right.
[40:32.850 --> 40:39.230]  So, I mean, I think we need clarity around whether you own something or whether you lease it.
[40:39.310 --> 40:41.710]  Because right now, it is very fuzzy out there.
[40:41.890 --> 40:42.110]  Yes.
[40:43.590 --> 40:44.990]  I think I've got a solution.
[40:45.570 --> 40:46.790]  It's in two parts.
[40:47.030 --> 40:47.490]  Thank God.
[40:47.890 --> 40:48.130]  Okay.
[40:48.470 --> 40:53.270]  One part is open services that I'll be talking about here at 10 a.m.
[40:53.450 --> 40:53.710]  tomorrow.
[40:54.030 --> 40:58.690]  So, the idea here is you have an account at one vendor, you take it to another.
[40:58.690 --> 41:05.850]  So that instead of having to connect up all my IOT things, and I have hundreds of them.
[41:06.050 --> 41:06.330]  Right.
[41:06.410 --> 41:10.330]  And I have hundreds of apps on my phone, you should be able to go to just one.
[41:10.770 --> 41:11.030]  Right.
[41:11.130 --> 41:13.750]  Now, that part's the easy part.
[41:14.070 --> 41:18.870]  The hard part is persuading manufacturers to do stuff to that model.
[41:19.010 --> 41:22.170]  Because American companies don't want to do that.
[41:22.550 --> 41:24.930]  Well, you know who do want to do that?
[41:25.070 --> 41:25.410]  They're brilliant.
[41:25.410 --> 41:28.790]  If you only want to do that, Chinese manufacturers.
[41:29.210 --> 41:29.410]  Yeah.
[41:29.530 --> 41:32.470]  And what else that Chinese manufacturers don't want to do?
[41:33.010 --> 41:34.430]  Research and development.
[41:34.850 --> 41:34.930]  Okay.
[41:35.370 --> 41:57.910]  So, all we have to do, and I'm serious here, is to build some open-source stuff like the open-source doorbell hacked together from a camera and a Raspberry Pi, some open-source software on it, and present that as a Kickstarter in a form that the Chinese copycats know exactly how to copy.
[41:58.170 --> 42:05.090]  And then we will have open-source doorbells for 50 bucks and less.
[42:05.090 --> 42:08.150]  Yes, I'm completely serious.
[42:09.890 --> 42:12.250]  Of course, if they watch his video...
[42:14.390 --> 42:19.250]  And by the way, we don't just need Kickstarter and open-source software.
[42:19.630 --> 42:22.370]  We need people who will bring that message to the masses.
[42:22.590 --> 42:27.970]  We need the people who will go on morning talk radio shows and promote and evangelize.
[42:28.110 --> 42:31.830]  So, just to acknowledge again, it is not just a security problem.
[42:31.830 --> 42:33.570]  It's not just a technology problem.
[42:33.590 --> 42:34.330]  It's broader.
[42:34.990 --> 42:35.130]  Yeah.
[42:35.530 --> 42:35.750]  Yeah.
[42:36.390 --> 42:36.850]  Yes?
[42:38.030 --> 42:54.810]  So, one of the things I was thinking about, and, you know, and I was thinking about this for a bit, is that maybe we should have some sort of mandate for, like, product lifecycle legislation where they keep the source code for the firmware and maybe even the schematics in escrow.
[42:54.910 --> 42:55.630]  In escrow, right.
[42:55.750 --> 42:55.930]  Yes.
[42:56.030 --> 43:02.790]  And just, you know, hey, if you go out of business, if you stop selling the product or whatever, that gets released automatically.
[43:03.090 --> 43:03.190]  Right.
[43:03.410 --> 43:05.310]  And it's just, you know, you just do that.
[43:05.410 --> 43:06.990]  And that gives you a couple of things.
[43:06.990 --> 43:12.790]  Because, one, it means no matter what happens, people are going to be able to do whatever they want to do with it anyway.
[43:12.950 --> 43:24.370]  But also, two, it gives manufacturers an incentive to keep a product in active service, in the active service of its lifecycle longer.
[43:24.910 --> 43:37.930]  So that, you know, maybe they make it extendable or modular or something, so that they don't have to keep eating in the technical debt that usually comes with, like, product design for, like, one specific use case.
[43:38.350 --> 43:38.830]  Right.
[43:38.830 --> 43:44.510]  And that saves a lot of time and energy to, you know, manufacturing materials and whatnot.
[43:44.990 --> 43:57.910]  I mean, I think it's a great idea, and other folks have suggested that, too, like putting the software in escrow or, you know, requiring manufacturers, if they're going to end a life of product, to maybe designate a company to come in and pick up support,
[43:58.070 --> 43:59.110]  right, to keep it working.
[43:59.310 --> 44:12.470]  I mean, I think in the big scheme of things, what we need is a number of checks and balances to decisions by manufacturers about whether to make a smart, connected thing.
[44:12.470 --> 44:15.930]  Because right now, it's only profit for them, right?
[44:16.190 --> 44:22.650]  The valuable subscription services, cool, smart features that will attract consumers, right?
[44:22.830 --> 44:28.730]  And no requirements around how long to support the software, what to do, you know, how, you know, any of that stuff.
[44:28.970 --> 44:37.050]  The second they've determined it's not profitable for them, they can kill the product, end of life it, brick it, walk away, and there's no cost to them.
[44:37.430 --> 44:40.890]  But there's a huge cost for consumers, there's a huge cost for the planet, right?
[44:40.890 --> 44:47.410]  So I think the solution is to balance that and sort of say, okay, we can make a dumb toaster or a smart toaster.
[44:47.470 --> 44:51.990]  If we make a smart toaster, we get all these benefits, here are the costs for us.
[44:52.050 --> 44:53.290]  Here's what we need to do.
[44:53.510 --> 44:53.690]  Right.
[44:53.830 --> 44:57.250]  And we need, like, you know, robust regulators and robust regulations.
[44:57.690 --> 45:06.110]  Like, you need Magnuson Moss to be heavily enforced so that you don't have to pay a subscription to inflate your motorcycle jacket or keep your seat heaters on.
[45:06.110 --> 45:11.690]  Like, that's just the whole thing, and being able to service those in third-party repair and things like that.
[45:11.770 --> 45:12.370]  It's just...
[45:12.370 --> 45:16.470]  I think, ultimately, a lot of these problems are systemic, and it's going to take a change to the system.
[45:17.050 --> 45:17.150]  Yep.
[45:17.630 --> 45:23.490]  So thank you for giving us a segue to our policy slide in our last four minutes here.
[45:24.970 --> 45:29.130]  So, hey, you know, we are at an inflection point, right?
[45:29.390 --> 45:38.610]  And there has to be, at some point, where the canary in the coal mine has to get up and say, hey, folks, we have a problem.
[45:39.230 --> 45:46.550]  So just like, again, I'm going to echo such an amazing crypto Harlem talk that was this morning.
[45:46.550 --> 45:48.510]  Go watch the recording if you haven't already.
[45:48.510 --> 45:52.990]  But we can solve new problems.
[45:54.010 --> 45:59.310]  Don't reinvent the wheel and try to solve problems that have already been solved.
[45:59.410 --> 46:01.110]  So we know what some of the levers are.
[46:01.430 --> 46:03.510]  You know, Lucas mentioned some of them.
[46:03.850 --> 46:03.970]  Yep.
[46:05.870 --> 46:09.210]  And I know you have thoughts about, you know, we're here in New York State.
[46:09.210 --> 46:12.230]  You actually have an electronics right to repair law in this state.
[46:12.510 --> 46:16.090]  So when you encounter things like this, you actually kind of have recourse.
[46:16.090 --> 46:22.610]  So, yeah, we have to pass new laws, but a lot of this is actually already illegal under current laws.
[46:22.930 --> 46:32.990]  And so if you have been, you know, harmed by a purchase that has reached end of life and you have a device that no longer works, please let us know.
[46:33.630 --> 46:35.690]  Please reach out to PIRG.
[46:35.810 --> 46:38.170]  You can complain to the Federal Trade Commission.
[46:38.290 --> 46:40.190]  The FTC can file a complaint online.
[46:40.190 --> 46:47.810]  If you're here in New York, we have the first national or the first state right to repair law, which came into effect July 1st, which we're really excited about.
[46:48.110 --> 46:49.950]  And you should complain to the Attorney General.
[46:50.570 --> 46:56.870]  She has a form online as well to complain about not having access to the parts, tools, or information that you need to fix your stuff.
[46:57.210 --> 46:57.430]  Yeah.
[46:57.690 --> 46:59.390]  And so that's the first step.
[46:59.570 --> 47:02.090]  Please reach out to us if you have these stories.
[47:02.270 --> 47:03.050]  We're trying to collect them.
[47:03.050 --> 47:09.970]  And we're going to use that to actually pass further legislation and also to hold accountable manufacturers that are already violating our current laws.
[47:10.230 --> 47:12.990]  And then there's CERF, the Secure Resilient Future Foundation.
[47:12.990 --> 47:20.050]  So the tag up there is to give us your email and we'll let you know about what we're involved in.
[47:20.150 --> 47:21.610]  We're going to be speaking at DEFCON as well.
[47:21.890 --> 47:25.910]  It's secure-resilient.org if you want to check us out online.
[47:25.910 --> 47:45.270]  But really we're looking for folks, like the folks in this audience, to help us devise policies, to advocate for policies, to educate the public, which is just a huge piece of this, is educating the public, and to, of course, lend your amazing skills,
[47:45.490 --> 47:51.610]  expertise, knowledge to this conversation because it is not a straightforward, simple conversation.
[47:51.610 --> 47:57.270]  So, you know, if you get a chance, check out our website and we'd love to have you.
[47:57.730 --> 47:58.090]  Yes.
[47:58.270 --> 47:58.970]  Final question.
[47:59.490 --> 48:10.110]  So I want to ask a maybe difficult question about some of these features or some of these lockdowns are in response to real concerns that manufacturers and the consumers have.
[48:10.350 --> 48:21.430]  So, for instance, Apple's blocking those stolen devices is meant to decrease their value on the secondary market so that there's less of an incentive to steal them.
[48:21.610 --> 48:36.930]  Or, for instance, a motor vehicle manufacturer like Energica or Xero might say that allowing the user to modify the code on their vehicle could put the vehicle occupants or other drivers on the road at risk.
[48:37.150 --> 48:37.250]  Right.
[48:37.330 --> 48:44.550]  So how do we balance these very real concerns against, you know, obviously all of our support for a right to repair?
[48:45.990 --> 49:07.710]  Well, you know, given the what independent security researchers have shown us about the quality and integrity of the software that is running on smart connected vehicles, I'd say that, you know, and other connected products, it's a difficult argument to swallow that,
[49:07.730 --> 49:12.930]  you know, there is tremendous integrity and quality that would somehow be violated by this.
[49:13.230 --> 49:13.670]  But I...
[49:14.930 --> 49:21.370]  And the second... and the second thing is, you know, our... you know, when you buy that device, you own that device.
[49:21.490 --> 49:32.770]  So when... if you want to choose to run other software on it, of course there are, you know, with things like automobiles or medical devices, there are regulations involved, there are agencies involved that must oversee that.
[49:32.770 --> 49:49.130]  So that's kind of a different quality, but I mean, when you're talking about consumer electronics, when you're talking about home appliances, then I think, you know, those arguments don't... they make that argument frequently, but they're... they're not standing on very firm ground when they talk
[49:49.130 --> 49:51.330]  about their commitment to security and quality.
[49:51.850 --> 49:58.850]  So there's a lot of improvements to be done, and, you know, I think it's... I think it's kind of a canard.
[49:59.070 --> 49:59.630]  I think it's...
[49:59.630 --> 50:00.070]  It's...
[50:00.070 --> 50:00.410]  Yeah.
[50:00.410 --> 50:03.070]  Isn't it still a liability issue for the company, though?
[50:03.410 --> 50:04.090]  Is it what?
[50:04.410 --> 50:07.050]  Isn't it still a liability issue for the manufacturer?
[50:08.470 --> 50:19.050]  I think this argument has been discussed thoroughly when we talk about, say, the use of a crowbar or a hammer in the space of encryption and other places.
[50:19.050 --> 50:25.330]  So I would say, I think we can learn from these previous discussions, and same thing applies here.
[50:25.730 --> 50:25.870]  Yeah.
[50:26.650 --> 50:27.710]  Thank you for the question.
[50:28.310 --> 50:28.770]  All right.
[50:28.950 --> 50:29.690]  Thank you, everybody.
[50:30.010 --> 50:30.890]  Round of applause, please.
[50:30.890 --> 50:31.470]  Thank you.
[50:31.670 --> 50:32.550]  Really great question.
[50:32.690 --> 50:32.950]  Thank you.