Represent! Defcon Groups, Hackerspaces, and You.
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Anch
BlakDayz
Anarchy Angel
Ngharo
Kotler, Itzik
Amit, Itfach Ian
GenericSuperHero
Londo
Roamer
Converge
Fabricating, circumventing, forging, partying, milling, crafting, building breaking - Defcon Groups have risen, fallen, and endured the last 8 years as decentralized and smoldering embers of the local hacker think-tank. This year Defcon sets out to stoke that fire and unite our groups, at and outside of the conference. The talk will consist of a panel of Defcon Groups leaders, uncovering the secrets and follies of several groups: what makes them work, when do they fail, and ultimately .. WTF have these people been doing all this time? Come hear how hackerspaces have influenced these local groups and the cool ways that these groups are propping the hackerspace. What can you break? Anch (DC503) - currently rebooting DC503 after it's near death experience, is a part of the unique hacking scene that is Portland. blakdayz (DC225) - can pwn sh1t from space, master of a harem, original gangster @ Defcon Voicebridge Anarchy Angel & ngharo (DC414) - Brew city nerds coming together under the dc414 flag to hack the planet Itzik Kotler (DC9723) - is killing time till the feds arrive. Meanwhile, he is the CTO of Security Art and co-founder of DC9723. In his former life, he was a Software Engineer. People change. Now, I'm a lamp. Jake "GenericSuperhero" - Representing Black Lodge Research. Hardware, Software, Wetware, Anywhere, Everywhere. converge DCG Coordinator, hermit champion of email harassment and slayer of dead hacker groups; you'll probably see his beard wandering the Defcon landscape in search of booze and fun
 I'm going to turn this over to Converge, who's the DCG main point of contact for all of us. He's going to go through a little bit of a history. I'm going to try to keep up with him on the slides, so we'll see. I'm going to give you a warning that I'm not really a good public speaker. So if you could be a little bit less public, I think it'll work out better. DEF CON groups is kind of an interesting thing. It was an idea that started back on the forums back in, I think, around late 2002. And it was formalized as an idea that was presented at DEF CON 11 back in 2003. It's something that everyone thought was cool, and initially we had, what, 10, 13, a good bunch of groups that had formed up. I was one of the POCs that started a group back in DC 207, back in Maine, and I found... Are you Mainers? Right on, right on. And proceeded to find absolutely no one in Maine that was a hacker. Yeah, so the goal was personally to find a group of people that I could meld with, sit down, work on projects with, and just have a really good time. And that didn't happen. So I set off personally on my own venture across the country and found myself in Portland, Oregon, where I did find a bunch of hackers. And we... Do we have 503 in the house? How many 503 years we have in here? There's one. I know there's at least two of us. And in Portland we had a pretty decent group that met and freaked out people at the coffee shop that we were at while we were drilling holes and shit and whatnot. But it kind of ebbed and flowed. People got busy, people worked, people had personal lives, and I worked. I had personal life-ish. So I moved up to Seattle, and I've been a part of the Seattle crew for, I don't know, a few years now. And the groups, the groups have existed for that time and have really been doing things autonomously. But the question has always been, what are the other groups actually doing? And it's still a question, what the heck are the groups actually doing? So around the time I was starting to ask that question, I was starting to realize, and many other folks were starting to realize, that the DEF CON groups coordinator was MIA, which is kind of a problem if you're trying to coordinate something and the person who's doing it isn't there. Things go quiet. So groups aren't able to make updates, groups aren't able to say, hey, we're out here. Groups that disappear just disappear. And the list of groups that we had went completely out of sorts. When I took it on, there were over 170 groups afterwards. I think we're down to about 90. Out of the 170, over 100 of them just didn't respond. They were just inactive. So the 90 groups that we have now are strong. They're on a big ass email list, a nice big spreadsheet that I keep track of. But the question still remains, now that we know who's out there, what do we do? And I think that's where the panel steps in today. Okay, so we've got a group of point of contacts up here that are pretty diverse. We're in the same branch, I'm in contact for DC 503 to Portland, Oregon. Right now our membership is three. But we died back in 2007. We're starting to grow again. So we're starting to kind of ramp things back up again. We meet at a hacker space. It's pretty cool. As I call your name, kind of raise your hand so people know who you are. Black, he's DC 225. Anarchy Angel and Inji Haro. They're DC 414. Represent. We've got Isaac and Ian for DC 9723. Represent. We've got generic superhero and Lando from the Black Lodge. We've got Romer from the analogated space. Drink motherfucker. And we've got Converge who's the Def Time group key master. With that, kind of how we're going to run this panel is going to be an open kind of discussion. We're going to talk a little bit about how groups operate, what we're doing to get them to grow, how hacker spaces work. We want you guys to participate too. So I'm going to start off the discussion by asking these guys a couple of questions and they'll go ahead and talk about what they want to talk about and answer and bander back and forth. If you guys have questions, please come up, use the microphone, ask a question and we'll just kind of keep this as a rolling discussion. Alright, here we go. Oh yeah, and these will play pictures of the various groups that we have up here as it goes. So I think I'm going to start with Isaac. So you guys recently did an event called a hackathon. Can you guys tell us a little bit about what you did and how it's helped your group and a little bit about your group as well? Yeah, sure. So DC, our DC is actually DC Israel. And we just started like seven months ago and we had a lot of people coming and showing interest, but we couldn't figure how committed they are to the process. Basically what we're doing, our monthly meetings, most of them come, have some lectures, volunteers, people talking, mingle and go home. But we wanted more, we wanted to actually to form a real community with real people that willing to do more than just come sit and learn or say a question here and there. So the hackathon ideas basically have people together, hanged out in a place to do a project. So there is a pretty defined project. Everybody can suggest any idea. And the thing is to find another person who has the same interest, whether it's hardware hacking, software hacking, or out of the box hacking, and just sit together and do something and try to push forward, try to find the time to do it. And then perhaps having a follow up in our deaf committees, talk about it, raise more people to the projects, etc. So the first event that we had was two months ago, it was five hours. It was a great success. We had seven projects, different projects having from mobile botnet up to hardware hacking, etc. And now we're going to do another hackathon. It's going to be a 24 hour event. And we're really excited about it. We have a lot of people coming up. And we're trying to do more projects and hopefully this time we will have some open source project announced and have something with a repository. So that will actually be a real step forward. Thank you. Alright, Romer, it's your turn. I know you like to hear yourself taught. Can you tell us how unallocated space, the hacker space that you attend, how their model is a little bit different than some others? Yeah, one of the things that we've done on Allocated is we actually don't have anything that's a member. There's no such thing as being a member of an Allocated. There's no such thing as a required dues at an Allocated. Our thought process is if we have content that people are actually going to want to come and see and we pack our schedule. There's something on the schedule at least three to four days a week and usually more than that. And we want to see if we've got all this stuff going on, people are actually going to come there and participate and then want to actually donate money to the space to keep it going. We're a relatively young hacker space. We've only been around for less than a year at this point, nine months exactly. And so from that standpoint, even though we've not required anyone to pay us, we've never had any problem meeting rent. We've never had any problem paying the bills. People are actually coming in and saying, this is so cool, I actually want to give you money to help keep this thing running. So it's a little bit different model from what some of the other spaces are doing and something we're trying to see if it's actually going to end up being a viable way to do these things. So to play devil's advocate on that, how do you pay the bills? Well, I mean, we don't have members, but we do have key holders. There are six key holders now or five. Five key holders right now that basically they pledge that if something goes wrong and we can't get enough donations to keep the space going, they're going to pay for it. Hasn't come to that yet, but hopefully it never will. But yeah, that's how we keep it going at this point is if we like this week, obviously every person from an allocated is here. So we're not going to be getting any outside donations. So it's one of those things where we may run into a problem. We'll see. Two kind of roamers point to when we started our space, we kind of did the same thing. We had a dedicated set of a few members that if things went sideways, we would just pick up and make sure it still happens. So we would be there the next month and kind of make it make it work. And then we grew out of that model eventually, but it was what kept us going and moved us to the next step. And I mean, you guys probably saw the same thing. Then if you if you're sitting there and you're putting, you know, as much content as you can out there, we get people that we have no idea how he even heard about these things that show up. Yeah, I mean, you want me to keep going with that? You want to go? You keep going. I'll stop you when I want to stop. Sounds good. I mean, like one of the things we were actually just talking about outside when we were smoking is we do a lot of stuff through Twitter. We just, you know, I'll say, hey, I want to do something. Let's go to an allocated and do it. And people that live in our area will show up. An example being I got a free AT&T microcell a while back and I have excellent AT&T service in my house. I had no reason to use it. So I just threw on Twitter. Anybody want to hack this thing and see what we can do with it? Like 25 people showed up to play with it that night. One of the really cool things was as I'm coming over to an allocated that night, I was just doing a little bit of quick research and I realized that it has a hardware kill switch in it. So if we opened the case, it was basically going to wipe the firmware. But one of the guys that had sold my Twitter post said, I'm one of the participants in the tamper evident contest at Defcon. I can get it open for you. And he did. So, you know, I mean, stuff like that, that's just really spur of the moment and really, you know, different and cool. We had no idea what we were doing. I didn't have any clue how we were going to start. So when we all showed up was just, hey, who wants to do things? We should start with looking at the network traffic. So we plugged it in and activated and everything and just went from there. And, you know, we made some progress. We didn't get as far as we want to do yet. But I think those kind of activities that are a little bit different from the, hey, it's lock picking night are kind of cool for the spaces to have. Our scheduled events for ours eventually kind of picked up over time. It wasn't really the, it was something we initially kind of drew for, but it was kind of the weird stuff that happened at Hockley where we're all sitting on IRC like, let's go build something real quick. And we end up building something just really random where we end up sitting at the space and going, hey, we're here. We've got some new gear coming in. You guys want to come over and mess with it. Also to an effect with our hacker space, it's kind of uniquely tied to the DC group, whereas we kind of host it and keep it at our space once a month, once twice a month. We do some events there. And we've had random projects kind of just spur out of that. We participated in the Red Bull challenge and that kind of happened just out of one of those meetings. Just all of us kind of made a team real quick and then all of a sudden that became something that we worked on and that space was the place that we hosted it. So just something to kind of add with that. We wanted to do the Red Bull challenge and you would think since, you know, Ryan Clark, the guy that designed your badges and, you know, is pretty decent with electronics is one of the people that comes to an allocated quite often. You would think we would have been able to get something together to get in. Yeah, we failed hard. Yeah. Alright. Hey, Black. Yeah. Can you tell us a little about your thoughts on Group Cohesion? I don't know. You guys have been really successful with that. Can you give us some pointers? Yeah. So like going forward trying to keep together, there's been a lot of issues with groups that fall apart. I mean, if you only meet once a month and an individual misses, let's say that one Tuesday, then they're really going to have less of an incentive to show up again the following month. I mean, there'll be two months behind. It's real easy to fall off the map. And one is we've included social events outside of the ramifications of your typical infosex sort of style, you know, entries. Like for instance, we do trivia as DCT25 on Tuesday nights at the local bar and we'll have turnouts as high as up to 30 people that may not be directly connected with the HACCO space or the group. Playing as a team, being up front, putting out that sort of advertisement helps gain members, people who know nothing about Def Con. I know Ridler came up to us one night as we were playing trivia and said, hey, do you guys actually go to Def Con? And we're like, yeah, you know, have a seat. You know, and we have that Tuesday night. Well, we get together on Saturdays and then we do the infosex stuff. Then we have the regular meets. We meet roughly about, I'd say, three to five times a month just keeping it going. No specific projects like we get together, kind of figure out what the hell we're going to do. Are we going to smash a stack? Are we going to build something, play with an Arduino? You know, just sit around and kind of come up with stuff. But ultimately, I think the infosex box that HACCO spaces put themselves in limits their ability to bring about the true meaning of hacking to the community. Like, we're not just here to make a good root kit, although we do, we make fine root kits. We're here to make our community a better place. If we want to get together and, you know, feed the hungry on a Saturday to do some community outreach, that not only establishes us in the community, drives participation, but it also promotes group cohesion. So there are things that are side channels to your main purpose that help support you, perpetuate you, and gain momentum in your cause. You know, it's one of those things that you really have to look for. Not everybody's going to have the same interests. And, you know, that ad hoc style that Black Lodge does is great. And that fits into the mold of kind of what we do. That, you know, everybody gets together and says, hey, you know, what inefficiencies can we remove today from our lives, from our communities, from this box? How can we open it without it wiping the firmware? It's a challenge, you know, across all facets of life. We kind of extend the meaning of hacking to outside of the traditional ramifications and keeping with that MIT train cub style definition of hacking and applying that to your life and community really enhances the impact that we have as hackers. It gives us not only a positive image in the media, which we're fighting negative images every day, but we actually make real differences. And with that, you know, I think other groups have somewhat Black Lodge. I know for a fact has a good amount of ad hoc style get-togethers. And they support 206, but they're not necessarily 206. The core members of 2G5, we have 10 members here at the stuff con, but we have 59 members total. You know, you have to have those perpetual members, those people who are key holders, those people who are drivers, those people who continually impact the group and their environment every day that they exist. You have to be gung-ho for it. And you can't sit and be introverted and, you know, break a deice this year every Saturday. You know, it's one of those things that you really have to look forward to. If you're trying to get a group started or you're dealing with those first lulls of participation or group management, if you can have an outside event, something that is completely non-infosec-related to co-heize the group in between those times you meet, you'll really move forward. That's really how you get it. I think that's an awesome point. I mean, we do a ton of non-security-related, non-hacking-related stuff. Cryptos stand up for a second. Cryptos is one of the key holders in an allocated. If you look at the back of his shirt, it's Teach Learn Party. We put party right on there at Keyhole for you, yeah. But it's one of the things. We do a lot of parties. Cryptos organizes a LAN party once a month or twice a month now. Once a month. And basically, he throws out to the mailing list, hey, what games do you want to play? He sets the whole thing up. We're not doing anything except for playing games and drinking beer those nights, okay? I mean, it's one of those things that it brings a lot of people in that would, okay, I don't understand about hacking, but I know how to play the shit out of some Half-Life. They'll sit down and they'll come and actually start to talk. The conversations continue. And they're like, oh, that's something I'd be interested in. And it does bring new people. That's a great point. So, Black, when you were talking trivia, are you just talking like Trivial Pursuit or... No, so like, rather than most implementations of trivia, and this is an aside, we don't do the digital sort of Hooters version, play with the little device, that would kind of be fun to target. We play random Ash trivia, is what it's called, rat trivia, where a human sits up front and we play against all the groups in the spar. And what it does is it really gives a personal localized level to a gainful knowledge perspective. Who can think on their feet? You know, hacking is not about a razor-like knowledge about something. It's a general understanding of how the system works, knowing how to manipulate it is the next step. For instance, Riddler just one day set out and said, what the fuck is this smashing the stack stuff? What is this assembly? And he had a point and he had a target. And I think we sat at my house and he sat and annotated the assembly. And we were just drinking beer, bullshitting. I think we just got together to drink beer. And it ended up with him having a fairly good understanding of assembly, how the stack works. And he went into it, not knowing really anything about it. A very intimidating subject to somebody. And he came out of it as an individual. I think he's reading an IDA pro book right now as I talk. Way to go. No, but it amidst the point. In those community events are what's necessary to that are outside the standard. We do do pen test days where we invite people over to build a box and smash the crap out of it. One of our members here, Don, he actually built one of a nice BM servers for us to attack. But one of our other events that's really fun is we have someone over here named Leece who organizes a gaming night where it's all retro arcade. So one floor of our hacker space is a retro arcade. Downstairs is a different set of games. And it's just kind of cool to get everyone together and do that. But I think when you were talking, a couple of points came to mind in terms of hacker space formation. Now for a couple of years now, we've had talks where we had hacker spaces and kind of what people have done with their hacker spaces. And the basic cookie cutter template. And then have you guys felt the need to have to start that way? Or have you for the hacker spaces and groups that are new, have you felt the need to kind of fit that mold? Or did you just kind of do it randomly when you approached it? Yes, like for instance. Wait a second. I want to interrupt you because I want to get a chance for Anarchy Angel and Jiharo to speak. Because that's a great question for them to answer. Then you can answer. Well actually, to expand a little bit on what he said, we also try, we have planned events. We have, to expand a little bit on what he said, we also have planned events. But through research and just getting online, I was able to find there were lots of other social and community groups that are, I guess you could call tech related. We have a Linux user group in Milwaukee. There's regular Reddit meetings and there's MillSec meetings, all different kinds of other meetings. And I kind of encourage our members to hijack those meetings if they can. You know, just go there and represent DC414. And that keeps us together. That way we get outside of our usual mold and kind of go out there and party it up a little bit with the other groups. But yeah, we kind of went for a randomized... Well, we're pretty small. We got like maybe eight to ten regular members right now. And we're only about six months old after it kind of died out. But to get it going, it's not difficult. I mean, all, you know, as Black said, you need to be there. Persistence is the key. Our first three meetings, we were the only guys there. Yeah, so I mean, you just show up at the place, you get the word out, you get your communication channels open, you know, IRC, HTTP, mailing lists, social networking and all that. And people will find you. I know Vlad was just searching, you know, he's in the security biz and one of our members, he's attending DEF CON this year, so he Googles DEF CON Milwaukee and he finds our site and he shows up. And, you know, he's a great asset. And you just got to know, you know, you find these really smart guys and you find those core members and you recognize their skills and you just kind of start brainstorming from there and everything starts to grow. Yeah, I also found it's good to try to cater to their skills. We've had a guy who was strictly a Java programmer, so I personally went out and tried to find, you know, educate myself as much on Java as I could so that he would, you know, feel more at home when he came to meetings. We have a guy who's a locksmith genius. I mean, the guy is just unbelievable. And I went beyond that and tried to learn as much about it as I could so that I would be able to converse with him and keep him interested in the group. It's more than just, you know, doing what you want to do. You have to realize that the group is carried on the backs of your members, you know. So you definitely have to try to keep them as happy as possible. At least I've found that. Yeah, you've got to come up to the mic. I just wanted to say something about the community outreach thing, because we're a fairly new DCJ07, we just kind of restarted out back in October. We're a long way from a hacker space, but one of the things we're looking at is that Poland is a really strong art community. There's a lot of industrial artists that don't have spaces, so we're actually looking at getting space from a studio that already has this type of setup where it's just a big open space or something like that, where we can actually bring some of the industrial artists into it who need access to machines and other things that they may not have access to. You know, people like doing metal smithing in their bedrooms or something like that. So I don't know if you guys have thought about that at all either, or trying to get into something completely not related to technology. Oh, oh, completely. To add to that, we have one of our members who actually studies lapidary, which is watchmaking. Has a whole bench that's just completely made just for that, and it has nothing to do with it. He kind of makes some cool steampunk watches and jewelry and stuff like that. It's kind of neat. Yeah, so I just wanted to throw out there too, though. With that, going back to what you had asked earlier about the templated sort of hack space, a lot of people have this idea that they have to go get these laser etching, laser cutters, just like this shopping list, when in reality they only need whatever they need to achieve their purpose. If you really want to make three or three badges, sure, you need a CNC machine, you need some laser etchers, you need to get through the steps, but you procure those as you need them. Going with your artist question real quick. I really don't have much to say about the artistry thing, but I can give you an analog. For instance, we like to break into things, and so our idea is we have about one and a half million dollars with the hardware that was donated to us through a corporation, and we're going to create an elastic computing environment where members of our DEF CON group and others connected to our DartNet can make a request saying, look, I need an XP-SP3 machine with these patches in order to break. Maybe these groups don't have those resources, but maybe we can offer those resources to give the sort of elasticity to the groups to be able to provide those machines. If you have a CNC machine and there's another group that says, man, I need to cut this or do this, maybe you can lease space to them, make these resources known to other groups. We are much greater than just the sum of our parts. When we communicate, we achieve way more. And remember that, you know, that's the point here. Hackers aren't the people you read about, they're the people you drink with. That is the pure point of all of this. And with that, I'll go ahead and defer to the guy with the mic or the merge. One real quick question. Would any of your groups be interested in resources like that? Anyone? I was going to ask, how many group-pointer contacts do we have in the room right now? I'm one too. Cool. I think as a takeaway item to add to that kind of sentiment is as hackerspace and group owners, I know a lot of us are and members, we need to do a better job of kind of maybe reaching out to those other hackerspaces and groups and creating those connections, whatever they may be. Maybe it's a cool dark net between hackerspaces where you're sharing data, creating these cool little local networks for yourself, and it means that you're in the same city and one shop has a laser cutter and can work out a situation where you're working with that group to share those resources. We should be pulling those resources where and how we can. And to add to that, I would say don't be afraid to go outside the technical realm. Try to find other area groups that just have the same sort of mentality or main goals outside of computer security. We've sought out the candlelight collective in our area, which is I guess I would say a space for punk rockers to hang out at, but they basically have the same, you know, after-man feel that our group has to it. So we communicate with them even though they're not, they're completely outside the security realm. There's a lot of talk about shared resources, like this Smash thing, which is cool. I love doing it too. There's a fine line when you have resources about being a legitimate organization in the lives of the public and still doing cool security resources, security research, whatever you want to do. How do you walk that line? How do you manage it? How do you manage your risk for that? Yeah, so like let's say we had a dark net between every single DEF CON group here and the auspice that someone could exfiltrate data through that dark net on a viable production target that would violate law definitely is consideration and a concern. So while we may espouse the ideas that yes, we do need to connect, we definitely have the finer details of the allocation of resources and what type of rules that we can apply. For that I will defer to the EFF for the comment, but if you have anything regarding like, you know, consider this a call for papers. If you have an idea, if you have a mitigation of that risk in mind, please respond to it. I know there's a question and answer after this. I'm sorry, I won't be able to be part of, but do not, do not, you know, stop from emailing the list with a, hey, here's how we do it. Ideally, we trust one another. I mean, you know, we can have two networks, one for the communication of viable resources, attack resources, and others, and we can have a hygiene network that has no public access available. And yeah, I mean, at the risk of worrying about sound with exclusivity or anything, I mean, it would be very easy for like us and, you know, Black Lodge to work together because the members of your place and our folks, we've known each other for years. So we can start to build those personal relationships in the network that way too. You know, I mean, it's not as quick, but it's definitely something that can be done where you, okay, I absolutely know Londo is not going to do anything to screw me over, so we can work with them on this. Right, but it's not that we can trust every single member that we have because that trust is built up over time. So, I mean, it's just something you have to, I think, deferring to the EFF on that one and deferring to common sense is another thing. I mean, Tor has a great implementation for exit mode protection. I don't know if you've ever run an exit mode from Tor, but you get this nifty little email from EFF saying, while people may be doing illegal things through your client, that machine needs to be sandboxed outside of an accessible area of your network, no one has ever been prosecuted for running a Tor exit mode. And keep that in mind at all times, but that is the number one reason why you should all get a Mohawk and donate to the EFF. I mean, like, to be realistic with it, this is why we donate to the EFF, because we have real risks that directly affect the implementation of a cohesive DEF CON group organization, as well as a community as a whole. We do have ways to mitigate that. So, I mean, mind you, money is one way you can show support of it, and building on trusted relationships is definitely another. I think it's important to note that while we want to mitigate the risk, you shouldn't be doing it through a whole bunch of legalese in your membership documents. I know some hackerspaces like to put in clauses in your membership so that they own everything you do in there, or you're not allowed to do illegal hacking. So, don't put a leash on the people in your organization just because you want to mitigate a little bit of your risk. I mean, you have resources like the EFF. I just felt like it was important to note. But on the other hand, the hackerspaces tend to run as small organizations, and in some ways, to get non-profit status actually form formal organizations. And because of that, they need bylaws. They need to be concerned with legality. Have you guys addressed that at all? Well, once you move past a certain size where it's not the little group club anymore, and you move past the kind of eight members, and you start to get real businesses that you're renting space from, and now you're inviting more people from the community who may not be a part of your space, or may not be a part of your regular group of friends, you need to consider yourself a business and start to treat things a certain way. So, it gets a little sketchy. Of course, you can definitely overdo it. We went a little overboard at first, and then we back down a little bit to what seems to be the right level. It's a tricky thing. You have to look at it, and honestly, small business courses really help in that. So, if you've never taken one of those, it doesn't hurt. Well, you can... When it comes to lodge, rather, hackerspace rules and obligations and leak leads that's getting in the way, you can always protest and vote by not attending. I mean, hackerspaces that are collaborative efforts between groups or within groups, we're not dickbags. Well, yeah, I'm speaking for us, not everybody, but... People like coming to a group that they feel the support network for, that they feel is expanding their knowledge and giving them a free and open space to work. If you're locking all your shit down and people don't want to come to share ideas, they just want to come to leech. You can have a group that will go on with three members, and those three guys will keep paying their dues, and no one wants to go and hang out with the dickbag clan. And then those people, everybody that wants to create a collaborative, like an open space, there's nothing stopping you from starting another hackerspace. Along those lines, you really don't want to fragment your hackers scene too much in your local area, but there's nothing stopping you from having multiple deaf groups or hackerspaces. I mean, you gotta always avoid the drama, Lama, but people that are holding back the sharing of knowledge definitely need to be shut down in my mind. But there's also not just in the group that you belong to or the group that you're thinking about doing, there's other groups that were up here, if we can have more of a global, connected, collaborative sharing of ideas, and the reason we're having a panel. It'll give you the thoughts to go out and spread and mutate and make your cool shit in your own time. Okay, let's take some questions. We've got some waiting. I was just, as a quick comment to that, there are a number of lawyers who attend DEF CON every year, and if you get to the point where it matters, talk to the groups, I know a couple of them, some other people here, just go through the network, you'll find somebody. But a lot of the time, you get non-profit status, don't sweat it. You're a disconnected entity, it's the group, it's not you unless you're the guy who went and messed up somebody's system. And this will vary state to state, but in the state of Maine, if I'm volunteering for somebody, I volunteer at a railroad museum every now and then. If I'm driving the train, the thing jumps off the tracks, 20 people die, is it volunteer in that capacity? I can't be civilly sued. Definitely. There are a lot of different state protections when you're in the non-profit world as opposed to being Google. If you're concerned about it, speak to a lawyer, but you shouldn't have to have your members signing like two-page, three-page, 15-page documents. You've gone the wrong way if you get there. I agree. If you have legalese to limit your liability as a group to an individual's action, you definitely have segmented yourself from the path you should have taken. The way federal laws work are a little bit different, and if people talk state to state, we're talking about more or less interstate communications. So when you look to the federal laws, they're more reactionary. So if you do have a non-profit that's associated in performing a function and an individual acts badly, the group is not going to be liable. But ultimately, you should honestly defer to the EFF. The same way Tor exit nodes are operated would directly affect the way your exit nodes are operated within your own VPN. That law is the same. I'm not a lawyer. Like I said, you should ask the EFF, and I agree completely with this point of if you have a disclaimer that reiterates federal law, you're going the wrong way. But if it's your bylaws saying, dude, if you act an ass, you're going to get kicked out, well, I mean, that's appropriate. But like you should even have to write those. If you have to write those, you're still doing it wrong. So from the community aspect, I'm with I3 Detroit founding member and we've had a really positive experience with the high school robotics clubs, especially with high schools continually shrinking budgets. And we actually unfortunately one of them completely lost their funding. Have you guys had good experiences with bringing in high schoolers and we've been running for about two years now. And it's really awesome that we're now seeing this generation of high schoolers who are now 18, you know, going off to college and coming back in the summer. And there are next generation membership. So rather than being a dick to the little kids, like it's really benefiting us to just basically deal with a couple of broken drill bits here and there. And, you know, we deal with that with members that aren't in high school. Yeah, yeah. No, specifically on your point, I think we should shove it down even lower. Defcon kids point, right? I have a 10 year old daughter, Sparkle. She created the first Defcon kids group DCT25 kids. She gets an ruby JavaScript PHP MySQL. She enjoys social engineering. She writes RPGs. And she is 10. She participates in the MIT Scratch Forms as part of the ID Open Source Development Project. The premise is who really, who the fuck cares if they break something? It's nothing you can't fix or replace. What we have to do is train the generation coming up. Listen, we don't naturally perpetuate. This is not something that goes on, you know, without being pushed. Forget high scores. I want Lego Mindstorm kids in the kindergarten classrooms. We're not playing here. We have generations of kids that are going to be growing up in an ever-evolving environment of threats, of areas that they can create. And we have to propagate those interests from the get-go. We have to actually inform them, sit down, take the time, and say, okay, let's play with this Arduino board, let's turn a motor, let me show you how this operates. Let me show you how this, I mean, you know, whatever the kid is, whatever the method is, you cannot be afraid to show children and to show the earlier generations how to protect themselves, how to build, and how to create. If we deny that, I know a lot of people have diverse opinions on Defconn kids, but if we deny the ability of our earliest generations at their prime points with their aptitude set on hacking or evolving our community, then we are doing ourselves a disservice. And as much as people don't like kids running around Defconn, I mean, it is our social scene, you know. You have to remember that they're already kid goons. You know, they're already kids who are not a social engineer. And if you have kids, I would rather your kid know how to detect someone's social engineering them to be victim or subject to it. And it goes along the lines, this is what we are here for. Playing it simple. Plus, you can't knock the feeling you get when you teach someone like kids and stuff like that, how to lock pick for the first time. And you see their face when they bust open that lock, and then you look at the person who's in their 20s and 30s next to them sitting there frustrated, like they can't even believe what just happened next to them. And you see their parents absolutely in fear of what you just did. But it's also very cool to teach people who haven't seen all this stuff, my failures, and my mistakes, and go, hey, look, this is how you can do it a different way. And guess what I learned from it? So it's somewhat selfish in that respect, but it's a good kind of selfish. Even if you're just doing something stupid, like showing a kid how to punch out Funky Town or Mario Brothers on DTMF tones, you can teach them DTMF. Just teach them how to solder it, and then that way you have free labor when you need a giant LED matrix system. It's really nice. And I would agree that getting the younger generation involved is really important. But as far as schools go, I don't know if it's just me, but I happen to get chased off of every school I go to and tired of talking to them about deaf colleagues. Maybe I'm just ugly, I don't know, but I've had bad experiences with school or, I guess, government institutions in general when it comes to DC 414. So... I think it's the mustache. It might be the stash. It scares people, I guess. Can you repeat that? Because he couldn't understand you. It's hard to hear up here. The reverb's pretty badly. Who? What? Tell me who you want to repeat what. Yeah. Energy Angel? Yeah. The guy leaning back who just spoke... What was... Speak this way. We can't hear you. Basically what I was saying was I've had bad experiences with going to schools about... getting the word about DC 414. I wasn't sure if it was just because I was ugly or my mustache, but I get run off of all the schools I've ever been to to try to talk about getting kids to come to DC 414. It's just... I don't know if it's our area, maybe other people in other states have had better success, but just in our schools, they hear the word hacker and I don't know, it turns them off, or even computer security seems to... people in least in our state are timid around it. I don't know why, but... There's some balance that you have to have because at the lodge, would you have some... like 21 and up, we have some adult oriented events, or with the issue with kids. You need to rephrase that a little bit. Well, what? Events with alcohol versus events where no alcohol is there. We have open space for people to come by, check out the place. During normal operation hours, we do barbecues almost every weekend. People can come out and enjoy, talk about projects they're working at home, maybe something they want to get the group involved with, and get community effort. But also we have private stuff. And private, like after our movie nights where they're drinking involved, we took a page out of the book, the 23B guys where we have a projector on the other block of buildings in the industrial space. So we're also parking lot. But there's this balance that you have to have between... there is some stuff that's going to go on that isn't kid friendly, or have something that... granted, there's a lot to say about how you're going to present yourself to adults versus how you're going to present yourself, or what options you're going to present to kids. It's mainly about education. I mean, if the public knew exactly what hacking actually originated as, and if you exhibited those ideals in your day to day above board activities under your group label, we wouldn't be fighting much of the way that we're fighting the wars we are now in the media. The issue comes when you begin to label private activities amongst groups of individuals that would normally gather under your group flag outside of the group. Maybe those things don't need to be put on the front page of the American press. You have to continue. How can someone dislike your hacking group when you're feeding the hungry? I mean... Can you go on the board? Yeah, so, Valk, we're actually running out of time here, so I'm going to kind of wrap you up. I'm sorry, I don't mean to interrupt you, but... Yeah. Alright, we're going to have a Q&A session right after this, so you guys want to join us. I have one question to wrap up, because I asked how many point of contacts we had in here for Converge. I'm going to put you on the spot. What can we do as group point of contacts to help you as the coordinator? Well, moving forward, we're going to be adding a lot. Probably the card of the problem that we've had with all of the groups currently, well, aside from not knowing where they are or who they are, is communication. Like, we really don't have a dialogue going on between the groups, and we're going to fix that. So, we're going to be firing up Twitter accounts, Google Plus accounts, Facebook accounts. We're going to be setting up an IRC server, maybe, like I heard discussion of that. Coming in the near future, probably later this year, we're going to be launching a DEFCON Groups website that is just for DEFCON Groups. It's going to have a forum just for DEFCON Groups that's active, it's focused. And we want groups to interact, we want groups to send us what they're doing that's cool. If you want to be featured and show a cool project or even a dumb project that was just fun, like, be in touch with me, be in touch with the other groups through those means, and we'll get it out there, and we'll start seeing what we're doing, and we'll start showing other people what we're doing. Maybe they'll get interested too. How do we find this group? DCgroups at DEFCON.org. That just email? Yeah, give me an email or hit me up online. Are you actually looking for a list of active groups? It's on the website. Yeah, it's on the DEFCON website. Alright, with that, I think we're going to wrap up and move over to QA. What QA room are we in? Pavilion number four, so this is going to be down the hall. We'll see you guys there.
 I'm going to turn this over to Converge, who's the DCG main point of contact for all of us.  He's going to go through a little bit of a history.  I'm going to try to keep up with him on the slides, so we'll see.  I'm going to give you a warning that I'm not really a good public speaker.  So if you could be a little bit less public, I think it'll work out better.  DEF CON groups is kind of an interesting thing.  It was an idea that started back on the forums back in, I think, around late 2002.  And it was formalized as an idea that was presented at DEF CON 11 back in 2003.  It's something that everyone thought was cool, and initially we had, what, 10, 13, a good bunch of groups that had formed up.  I was one of the POCs that started a group back in DC 207, back in Maine, and I found...  Are you Mainers? Right on, right on.  And proceeded to find absolutely no one in Maine that was a hacker.  Yeah, so the goal was personally to find a group of people that I could meld with, sit down, work on projects with, and just have a really good time.  And that didn't happen.  So I set off personally on my own venture across the country and found myself in Portland, Oregon, where I did find a bunch of hackers.  And we... Do we have 503 in the house?  How many 503 years we have in here?  There's one. I know there's at least two of us.  And in Portland we had a pretty decent group that met and freaked out people at the coffee shop that we were at while we were drilling holes and shit and whatnot.  But it kind of ebbed and flowed. People got busy, people worked, people had personal lives, and I worked. I had personal life-ish.  So I moved up to Seattle, and I've been a part of the Seattle crew for, I don't know, a few years now.  And the groups, the groups have existed for that time and have really been doing things autonomously.  But the question has always been, what are the other groups actually doing?  And it's still a question, what the heck are the groups actually doing?  So around the time I was starting to ask that question, I was starting to realize, and many other folks were starting to realize,  that the DEF CON groups coordinator was MIA, which is kind of a problem if you're trying to coordinate something and the person who's doing it isn't there.  Things go quiet. So groups aren't able to make updates, groups aren't able to say, hey, we're out here.  Groups that disappear just disappear. And the list of groups that we had went completely out of sorts.  When I took it on, there were over 170 groups afterwards. I think we're down to about 90.  Out of the 170, over 100 of them just didn't respond. They were just inactive.  So the 90 groups that we have now are strong. They're on a big ass email list, a nice big spreadsheet that I keep track of.  But the question still remains, now that we know who's out there, what do we do?  And I think that's where the panel steps in today.  Okay, so we've got a group of point of contacts up here that are pretty diverse.  We're in the same branch, I'm in contact for DC 503 to Portland, Oregon. Right now our membership is three.  But we died back in 2007. We're starting to grow again. So we're starting to kind of ramp things back up again.  We meet at a hacker space. It's pretty cool. As I call your name, kind of raise your hand so people know who you are.  Black, he's DC 225. Anarchy Angel and Inji Haro. They're DC 414.  Represent.  We've got Isaac and Ian for DC 9723.  Represent.  We've got generic superhero and Lando from the Black Lodge.  We've got Romer from the analogated space.  Drink motherfucker.  And we've got Converge who's the Def Time group key master.  With that, kind of how we're going to run this panel is going to be an open kind of discussion.  We're going to talk a little bit about how groups operate, what we're doing to get them to grow, how hacker spaces work.  We want you guys to participate too.  So I'm going to start off the discussion by asking these guys a couple of questions and they'll go ahead and talk about what they want to talk about and answer and bander back and forth.  If you guys have questions, please come up, use the microphone, ask a question and we'll just kind of keep this as a rolling discussion.  Alright, here we go.  Oh yeah, and these will play pictures of the various groups that we have up here as it goes.  So I think I'm going to start with Isaac.  So you guys recently did an event called a hackathon.  Can you guys tell us a little bit about what you did and how it's helped your group and a little bit about your group as well?  Yeah, sure.  So DC, our DC is actually DC Israel.  And we just started like seven months ago and we had a lot of people coming and showing interest, but we couldn't figure how committed they are to the process.  Basically what we're doing, our monthly meetings, most of them come, have some lectures, volunteers, people talking, mingle and go home.  But we wanted more, we wanted to actually to form a real community with real people that willing to do more than just come sit and learn or say a question here and there.  So the hackathon ideas basically have people together, hanged out in a place to do a project.  So there is a pretty defined project. Everybody can suggest any idea.  And the thing is to find another person who has the same interest, whether it's hardware hacking, software hacking, or out of the box hacking, and just sit together and do something and try to push forward, try to find the time to do it.  And then perhaps having a follow up in our deaf committees, talk about it, raise more people to the projects, etc.  So the first event that we had was two months ago, it was five hours. It was a great success.  We had seven projects, different projects having from mobile botnet up to hardware hacking, etc.  And now we're going to do another hackathon. It's going to be a 24 hour event.  And we're really excited about it. We have a lot of people coming up.  And we're trying to do more projects and hopefully this time we will have some open source project announced and have something with a repository.  So that will actually be a real step forward.  Thank you.  Alright, Romer, it's your turn. I know you like to hear yourself taught.  Can you tell us how unallocated space, the hacker space that you attend, how their model is a little bit different than some others?  Yeah, one of the things that we've done on Allocated is we actually don't have anything that's a member.  There's no such thing as being a member of an Allocated. There's no such thing as a required dues at an Allocated.  Our thought process is if we have content that people are actually going to want to come and see and we pack our schedule.  There's something on the schedule at least three to four days a week and usually more than that.  And we want to see if we've got all this stuff going on, people are actually going to come there and participate and then want to actually donate money to the space to keep it going.  We're a relatively young hacker space. We've only been around for less than a year at this point, nine months exactly.  And so from that standpoint, even though we've not required anyone to pay us, we've never had any problem meeting rent.  We've never had any problem paying the bills. People are actually coming in and saying,  this is so cool, I actually want to give you money to help keep this thing running.  So it's a little bit different model from what some of the other spaces are doing and something we're trying to see if it's actually going to end up being a viable way to do these things.  So to play devil's advocate on that, how do you pay the bills?  Well, I mean, we don't have members, but we do have key holders. There are six key holders now or five.  Five key holders right now that basically they pledge that if something goes wrong and we can't get enough donations to keep the space going, they're going to pay for it.  Hasn't come to that yet, but hopefully it never will. But yeah, that's how we keep it going at this point is if we like this week, obviously every person from an allocated is here.  So we're not going to be getting any outside donations. So it's one of those things where we may run into a problem. We'll see.  Two kind of roamers point to when we started our space, we kind of did the same thing.  We had a dedicated set of a few members that if things went sideways, we would just pick up and make sure it still happens.  So we would be there the next month and kind of make it make it work. And then we grew out of that model eventually, but it was what kept us going and moved us to the next step.  And I mean, you guys probably saw the same thing. Then if you if you're sitting there and you're putting, you know, as much content as you can out there, we get people that we have no idea how he even heard about these things that show up.  Yeah, I mean, you want me to keep going with that?  You want to go?  You keep going. I'll stop you when I want to stop. Sounds good.  I mean, like one of the things we were actually just talking about outside when we were smoking is we do a lot of stuff through Twitter.  We just, you know, I'll say, hey, I want to do something. Let's go to an allocated and do it. And people that live in our area will show up.  An example being I got a free AT&T microcell a while back and I have excellent AT&T service in my house. I had no reason to use it.  So I just threw on Twitter. Anybody want to hack this thing and see what we can do with it? Like 25 people showed up to play with it that night.  One of the really cool things was as I'm coming over to an allocated that night, I was just doing a little bit of quick research and I realized that it has a hardware kill switch in it.  So if we opened the case, it was basically going to wipe the firmware.  But one of the guys that had sold my Twitter post said, I'm one of the participants in the tamper evident contest at Defcon.  I can get it open for you. And he did. So, you know, I mean, stuff like that, that's just really spur of the moment and really, you know, different and cool.  We had no idea what we were doing. I didn't have any clue how we were going to start. So when we all showed up was just, hey, who wants to do things?  We should start with looking at the network traffic. So we plugged it in and activated and everything and just went from there.  And, you know, we made some progress. We didn't get as far as we want to do yet.  But I think those kind of activities that are a little bit different from the, hey, it's lock picking night are kind of cool for the spaces to have.  Our scheduled events for ours eventually kind of picked up over time.  It wasn't really the, it was something we initially kind of drew for, but it was kind of the weird stuff that happened at Hockley where we're all sitting on IRC like, let's go build something real quick.  And we end up building something just really random where we end up sitting at the space and going, hey, we're here.  We've got some new gear coming in. You guys want to come over and mess with it.  Also to an effect with our hacker space, it's kind of uniquely tied to the DC group, whereas we kind of host it and keep it at our space once a month, once twice a month.  We do some events there. And we've had random projects kind of just spur out of that.  We participated in the Red Bull challenge and that kind of happened just out of one of those meetings.  Just all of us kind of made a team real quick and then all of a sudden that became something that we worked on and that space was the place that we hosted it.  So just something to kind of add with that.  We wanted to do the Red Bull challenge and you would think since, you know, Ryan Clark, the guy that designed your badges and, you know, is pretty decent with electronics is one of the people that comes to an allocated quite often.  You would think we would have been able to get something together to get in. Yeah, we failed hard.  Yeah.  Alright. Hey, Black.  Yeah.  Can you tell us a little about your thoughts on Group Cohesion?  I don't know. You guys have been really successful with that. Can you give us some pointers?  Yeah. So like going forward trying to keep together, there's been a lot of issues with groups that fall apart.  I mean, if you only meet once a month and an individual misses, let's say that one Tuesday, then they're really going to have less of an incentive to show up again the following month.  I mean, there'll be two months behind. It's real easy to fall off the map.  And one is we've included social events outside of the ramifications of your typical infosex sort of style, you know, entries.  Like for instance, we do trivia as DCT25 on Tuesday nights at the local bar and we'll have turnouts as high as up to 30 people that may not be directly connected with the HACCO space or the group.  Playing as a team, being up front, putting out that sort of advertisement helps gain members, people who know nothing about Def Con. I know Ridler came up to us one night as we were playing trivia and said, hey, do you guys actually go to Def Con?  And we're like, yeah, you know, have a seat. You know, and we have that Tuesday night. Well, we get together on Saturdays and then we do the infosex stuff.  Then we have the regular meets. We meet roughly about, I'd say, three to five times a month just keeping it going.  No specific projects like we get together, kind of figure out what the hell we're going to do.  Are we going to smash a stack? Are we going to build something, play with an Arduino? You know, just sit around and kind of come up with stuff.  But ultimately, I think the infosex box that HACCO spaces put themselves in limits their ability to bring about the true meaning of hacking to the community.  Like, we're not just here to make a good root kit, although we do, we make fine root kits.  We're here to make our community a better place. If we want to get together and, you know, feed the hungry on a Saturday to do some community outreach,  that not only establishes us in the community, drives participation, but it also promotes group cohesion.  So there are things that are side channels to your main purpose that help support you, perpetuate you, and gain momentum in your cause.  You know, it's one of those things that you really have to look for. Not everybody's going to have the same interests.  And, you know, that ad hoc style that Black Lodge does is great.  And that fits into the mold of kind of what we do. That, you know, everybody gets together and says, hey, you know, what inefficiencies can we remove today from our lives,  from our communities, from this box? How can we open it without it wiping the firmware? It's a challenge, you know, across all facets of life.  We kind of extend the meaning of hacking to outside of the traditional ramifications and keeping with that MIT train cub style definition of hacking  and applying that to your life and community really enhances the impact that we have as hackers.  It gives us not only a positive image in the media, which we're fighting negative images every day, but we actually make real differences.  And with that, you know, I think other groups have somewhat Black Lodge.  I know for a fact has a good amount of ad hoc style get-togethers. And they support 206, but they're not necessarily 206.  The core members of 2G5, we have 10 members here at the stuff con, but we have 59 members total.  You know, you have to have those perpetual members, those people who are key holders, those people who are drivers, those people who continually impact the group and their environment every day that they exist.  You have to be gung-ho for it. And you can't sit and be introverted and, you know, break a deice this year every Saturday.  You know, it's one of those things that you really have to look forward to. If you're trying to get a group started or you're dealing with those first lulls of participation or group management,  if you can have an outside event, something that is completely non-infosec-related to co-heize the group in between those times you meet, you'll really move forward.  That's really how you get it.  I think that's an awesome point. I mean, we do a ton of non-security-related, non-hacking-related stuff.  Cryptos stand up for a second. Cryptos is one of the key holders in an allocated. If you look at the back of his shirt, it's Teach Learn Party.  We put party right on there at Keyhole for you, yeah.  But it's one of the things. We do a lot of parties. Cryptos organizes a LAN party once a month or twice a month now.  Once a month. And basically, he throws out to the mailing list, hey, what games do you want to play?  He sets the whole thing up. We're not doing anything except for playing games and drinking beer those nights, okay?  I mean, it's one of those things that it brings a lot of people in that would, okay, I don't understand about hacking,  but I know how to play the shit out of some Half-Life.  They'll sit down and they'll come and actually start to talk. The conversations continue.  And they're like, oh, that's something I'd be interested in. And it does bring new people. That's a great point.  So, Black, when you were talking trivia, are you just talking like Trivial Pursuit or...  No, so like, rather than most implementations of trivia, and this is an aside,  we don't do the digital sort of Hooters version, play with the little device,  that would kind of be fun to target. We play random Ash trivia, is what it's called, rat trivia,  where a human sits up front and we play against all the groups in the spar.  And what it does is it really gives a personal localized level to a gainful knowledge perspective.  Who can think on their feet? You know, hacking is not about a razor-like knowledge about something.  It's a general understanding of how the system works, knowing how to manipulate it is the next step.  For instance, Riddler just one day set out and said,  what the fuck is this smashing the stack stuff? What is this assembly?  And he had a point and he had a target. And I think we sat at my house and he sat and annotated the assembly.  And we were just drinking beer, bullshitting. I think we just got together to drink beer.  And it ended up with him having a fairly good understanding of assembly, how the stack works.  And he went into it, not knowing really anything about it.  A very intimidating subject to somebody. And he came out of it as an individual.  I think he's reading an IDA pro book right now as I talk.  Way to go. No, but it amidst the point.  In those community events are what's necessary to that are outside the standard.  We do do pen test days where we invite people over to build a box and smash the crap out of it.  One of our members here, Don, he actually built one of a nice BM servers for us to attack.  But one of our other events that's really fun is we have someone over here named Leece who organizes a gaming night where it's all retro arcade.  So one floor of our hacker space is a retro arcade. Downstairs is a different set of games.  And it's just kind of cool to get everyone together and do that.  But I think when you were talking, a couple of points came to mind in terms of hacker space formation.  Now for a couple of years now, we've had talks where we had hacker spaces and kind of what people have done with their hacker spaces.  And the basic cookie cutter template. And then have you guys felt the need to have to start that way?  Or have you for the hacker spaces and groups that are new, have you felt the need to kind of fit that mold?  Or did you just kind of do it randomly when you approached it?  Yes, like for instance.  Wait a second. I want to interrupt you because I want to get a chance for Anarchy Angel and Jiharo to speak.  Because that's a great question for them to answer. Then you can answer.  Well actually, to expand a little bit on what he said, we also try, we have planned events.  We have, to expand a little bit on what he said, we also have planned events.  But through research and just getting online, I was able to find there were lots of other social and community groups that are, I guess you could call tech related.  We have a Linux user group in Milwaukee.  There's regular Reddit meetings and there's MillSec meetings, all different kinds of other meetings.  And I kind of encourage our members to hijack those meetings if they can.  You know, just go there and represent DC414. And that keeps us together.  That way we get outside of our usual mold and kind of go out there and party it up a little bit with the other groups.  But yeah, we kind of went for a randomized...  Well, we're pretty small. We got like maybe eight to ten regular members right now.  And we're only about six months old after it kind of died out.  But to get it going, it's not difficult. I mean, all, you know, as Black said, you need to be there. Persistence is the key.  Our first three meetings, we were the only guys there.  Yeah, so I mean, you just show up at the place, you get the word out, you get your communication channels open,  you know, IRC, HTTP, mailing lists, social networking and all that.  And people will find you. I know Vlad was just searching, you know, he's in the security biz and one of our members,  he's attending DEF CON this year, so he Googles DEF CON Milwaukee and he finds our site and he shows up.  And, you know, he's a great asset. And you just got to know, you know, you find these really smart guys  and you find those core members and you recognize their skills and you just kind of start brainstorming from there  and everything starts to grow.  Yeah, I also found it's good to try to cater to their skills.  We've had a guy who was strictly a Java programmer, so I personally went out and tried to find, you know,  educate myself as much on Java as I could so that he would, you know, feel more at home when he came to meetings.  We have a guy who's a locksmith genius. I mean, the guy is just unbelievable.  And I went beyond that and tried to learn as much about it as I could so that I would be able to converse with him  and keep him interested in the group. It's more than just, you know, doing what you want to do.  You have to realize that the group is carried on the backs of your members, you know.  So you definitely have to try to keep them as happy as possible. At least I've found that.  Yeah, you've got to come up to the mic.  I just wanted to say something about the community outreach thing, because we're a fairly new DCJ07,  we just kind of restarted out back in October. We're a long way from a hacker space, but one of the things we're looking at  is that Poland is a really strong art community. There's a lot of industrial artists that don't have spaces,  so we're actually looking at getting space from a studio that already has this type of setup where it's just a big open space  or something like that, where we can actually bring some of the industrial artists into it who need access to machines  and other things that they may not have access to. You know, people like doing metal smithing in their bedrooms or something like that.  So I don't know if you guys have thought about that at all either, or trying to get into something completely not related to technology.  Oh, oh, completely. To add to that, we have one of our members who actually studies lapidary, which is watchmaking.  Has a whole bench that's just completely made just for that, and it has nothing to do with it.  He kind of makes some cool steampunk watches and jewelry and stuff like that. It's kind of neat.  Yeah, so I just wanted to throw out there too, though.  With that, going back to what you had asked earlier about the templated sort of hack space,  a lot of people have this idea that they have to go get these laser etching, laser cutters, just like this shopping list,  when in reality they only need whatever they need to achieve their purpose.  If you really want to make three or three badges, sure, you need a CNC machine, you need some laser etchers,  you need to get through the steps, but you procure those as you need them.  Going with your artist question real quick.  I really don't have much to say about the artistry thing, but I can give you an analog.  For instance, we like to break into things, and so our idea is we have about one and a half million dollars  with the hardware that was donated to us through a corporation, and we're going to create an elastic computing environment  where members of our DEF CON group and others connected to our DartNet can make a request saying,  look, I need an XP-SP3 machine with these patches in order to break.  Maybe these groups don't have those resources, but maybe we can offer those resources to give the sort of elasticity  to the groups to be able to provide those machines.  If you have a CNC machine and there's another group that says, man, I need to cut this or do this,  maybe you can lease space to them, make these resources known to other groups.  We are much greater than just the sum of our parts.  When we communicate, we achieve way more.  And remember that, you know, that's the point here.  Hackers aren't the people you read about, they're the people you drink with.  That is the pure point of all of this.  And with that, I'll go ahead and defer to the guy with the mic or the merge.  One real quick question. Would any of your groups be interested in resources like that? Anyone?  I was going to ask, how many group-pointer contacts do we have in the room right now?  I'm one too.  Cool.  I think as a takeaway item to add to that kind of sentiment is as hackerspace and group owners,  I know a lot of us are and members, we need to do a better job of kind of maybe reaching out to those other hackerspaces and groups  and creating those connections, whatever they may be.  Maybe it's a cool dark net between hackerspaces where you're sharing data, creating these cool little local networks for yourself,  and it means that you're in the same city and one shop has a laser cutter and can work out a situation where you're working with that group  to share those resources. We should be pulling those resources where and how we can.  And to add to that, I would say don't be afraid to go outside the technical realm.  Try to find other area groups that just have the same sort of mentality or main goals outside of computer security.  We've sought out the candlelight collective in our area, which is I guess I would say a space for punk rockers to hang out at,  but they basically have the same, you know, after-man feel that our group has to it.  So we communicate with them even though they're not, they're completely outside the security realm.  There's a lot of talk about shared resources, like this Smash thing, which is cool. I love doing it too.  There's a fine line when you have resources about being a legitimate organization in the lives of the public  and still doing cool security resources, security research, whatever you want to do.  How do you walk that line? How do you manage it? How do you manage your risk for that?  Yeah, so like let's say we had a dark net between every single DEF CON group here  and the auspice that someone could exfiltrate data through that dark net on a viable production target that would violate law  definitely is consideration and a concern.  So while we may espouse the ideas that yes, we do need to connect, we definitely have the finer details of the allocation of resources  and what type of rules that we can apply.  For that I will defer to the EFF for the comment, but if you have anything regarding like, you know, consider this a call for papers.  If you have an idea, if you have a mitigation of that risk in mind, please respond to it.  I know there's a question and answer after this. I'm sorry, I won't be able to be part of, but do not, do not, you know,  stop from emailing the list with a, hey, here's how we do it. Ideally, we trust one another.  I mean, you know, we can have two networks, one for the communication of viable resources, attack resources, and others,  and we can have a hygiene network that has no public access available.  And yeah, I mean, at the risk of worrying about sound with exclusivity or anything, I mean, it would be very easy for like us and, you know,  Black Lodge to work together because the members of your place and our folks, we've known each other for years.  So we can start to build those personal relationships in the network that way too.  You know, I mean, it's not as quick, but it's definitely something that can be done where you, okay, I absolutely know Londo is not going to do anything to screw me over,  so we can work with them on this.  Right, but it's not that we can trust every single member that we have because that trust is built up over time.  So, I mean, it's just something you have to, I think, deferring to the EFF on that one and deferring to common sense is another thing.  I mean, Tor has a great implementation for exit mode protection.  I don't know if you've ever run an exit mode from Tor, but you get this nifty little email from EFF saying,  while people may be doing illegal things through your client, that machine needs to be sandboxed outside of an accessible area of your network,  no one has ever been prosecuted for running a Tor exit mode.  And keep that in mind at all times, but that is the number one reason why you should all get a Mohawk and donate to the EFF.  I mean, like, to be realistic with it, this is why we donate to the EFF, because we have real risks that directly affect the implementation of a cohesive DEF CON group organization,  as well as a community as a whole. We do have ways to mitigate that.  So, I mean, mind you, money is one way you can show support of it, and building on trusted relationships is definitely another.  I think it's important to note that while we want to mitigate the risk, you shouldn't be doing it through a whole bunch of legalese in your membership documents.  I know some hackerspaces like to put in clauses in your membership so that they own everything you do in there, or you're not allowed to do illegal hacking.  So, don't put a leash on the people in your organization just because you want to mitigate a little bit of your risk.  I mean, you have resources like the EFF. I just felt like it was important to note.  But on the other hand, the hackerspaces tend to run as small organizations, and in some ways, to get non-profit status actually form formal organizations.  And because of that, they need bylaws. They need to be concerned with legality. Have you guys addressed that at all?  Well, once you move past a certain size where it's not the little group club anymore, and you move past the kind of eight members,  and you start to get real businesses that you're renting space from, and now you're inviting more people from the community who may not be a part of your space,  or may not be a part of your regular group of friends, you need to consider yourself a business and start to treat things a certain way.  So, it gets a little sketchy. Of course, you can definitely overdo it. We went a little overboard at first, and then we back down a little bit to what seems to be the right level.  It's a tricky thing. You have to look at it, and honestly, small business courses really help in that.  So, if you've never taken one of those, it doesn't hurt.  Well, you can... When it comes to lodge, rather, hackerspace rules and obligations and leak leads that's getting in the way,  you can always protest and vote by not attending. I mean, hackerspaces that are collaborative efforts between groups or within groups,  we're not dickbags. Well, yeah, I'm speaking for us, not everybody, but...  People like coming to a group that they feel the support network for, that they feel is expanding their knowledge and giving them a free and open space to work.  If you're locking all your shit down and people don't want to come to share ideas, they just want to come to leech.  You can have a group that will go on with three members, and those three guys will keep paying their dues,  and no one wants to go and hang out with the dickbag clan.  And then those people, everybody that wants to create a collaborative, like an open space, there's nothing stopping you from starting another hackerspace.  Along those lines, you really don't want to fragment your hackers scene too much in your local area, but there's nothing stopping you from having multiple deaf groups or hackerspaces.  I mean, you gotta always avoid the drama, Lama, but people that are holding back the sharing of knowledge definitely need to be shut down in my mind.  But there's also not just in the group that you belong to or the group that you're thinking about doing,  there's other groups that were up here, if we can have more of a global, connected, collaborative sharing of ideas, and the reason we're having a panel.  It'll give you the thoughts to go out and spread and mutate and make your cool shit in your own time.  Okay, let's take some questions. We've got some waiting.  I was just, as a quick comment to that, there are a number of lawyers who attend DEF CON every year, and if you get to the point where it matters,  talk to the groups, I know a couple of them, some other people here, just go through the network, you'll find somebody.  But a lot of the time, you get non-profit status, don't sweat it.  You're a disconnected entity, it's the group, it's not you unless you're the guy who went and messed up somebody's system.  And this will vary state to state, but in the state of Maine, if I'm volunteering for somebody, I volunteer at a railroad museum every now and then.  If I'm driving the train, the thing jumps off the tracks, 20 people die, is it volunteer in that capacity? I can't be civilly sued.  Definitely.  There are a lot of different state protections when you're in the non-profit world as opposed to being Google.  If you're concerned about it, speak to a lawyer, but you shouldn't have to have your members signing like two-page, three-page, 15-page documents.  You've gone the wrong way if you get there.  I agree. If you have legalese to limit your liability as a group to an individual's action, you definitely have segmented yourself from the path you should have taken.  The way federal laws work are a little bit different, and if people talk state to state, we're talking about more or less interstate communications.  So when you look to the federal laws, they're more reactionary.  So if you do have a non-profit that's associated in performing a function and an individual acts badly, the group is not going to be liable.  But ultimately, you should honestly defer to the EFF.  The same way Tor exit nodes are operated would directly affect the way your exit nodes are operated within your own VPN.  That law is the same.  I'm not a lawyer.  Like I said, you should ask the EFF, and I agree completely with this point of if you have a disclaimer that reiterates federal law, you're going the wrong way.  But if it's your bylaws saying, dude, if you act an ass, you're going to get kicked out, well, I mean, that's appropriate.  But like you should even have to write those.  If you have to write those, you're still doing it wrong.  So from the community aspect, I'm with I3 Detroit founding member and we've had a really positive experience with the high school robotics clubs,  especially with high schools continually shrinking budgets.  And we actually unfortunately one of them completely lost their funding.  Have you guys had good experiences with bringing in high schoolers and we've been running for about two years now.  And it's really awesome that we're now seeing this generation of high schoolers who are now 18, you know, going off to college and coming back in the summer.  And there are next generation membership.  So rather than being a dick to the little kids, like it's really benefiting us to just basically deal with a couple of broken drill bits here and there.  And, you know, we deal with that with members that aren't in high school.  Yeah, yeah.  No, specifically on your point, I think we should shove it down even lower.  Defcon kids point, right?  I have a 10 year old daughter, Sparkle.  She created the first Defcon kids group DCT25 kids.  She gets an ruby JavaScript PHP MySQL.  She enjoys social engineering.  She writes RPGs.  And she is 10.  She participates in the MIT Scratch Forms as part of the ID Open Source Development Project.  The premise is who really, who the fuck cares if they break something?  It's nothing you can't fix or replace.  What we have to do is train the generation coming up.  Listen, we don't naturally perpetuate.  This is not something that goes on, you know, without being pushed.  Forget high scores.  I want Lego Mindstorm kids in the kindergarten classrooms.  We're not playing here.  We have generations of kids that are going to be growing up in an ever-evolving environment of threats,  of areas that they can create.  And we have to propagate those interests from the get-go.  We have to actually inform them, sit down, take the time, and say,  okay, let's play with this Arduino board, let's turn a motor, let me show you how this operates.  Let me show you how this, I mean, you know, whatever the kid is, whatever the method is,  you cannot be afraid to show children and to show the earlier generations  how to protect themselves, how to build, and how to create.  If we deny that, I know a lot of people have diverse opinions on Defconn kids,  but if we deny the ability of our earliest generations at their prime points  with their aptitude set on hacking or evolving our community,  then we are doing ourselves a disservice.  And as much as people don't like kids running around Defconn, I mean, it is our social scene, you know.  You have to remember that they're already kid goons.  You know, they're already kids who are not a social engineer.  And if you have kids, I would rather your kid know how to detect someone's social engineering them  to be victim or subject to it.  And it goes along the lines, this is what we are here for.  Playing it simple.  Plus, you can't knock the feeling you get when you teach someone like kids and stuff like that,  how to lock pick for the first time.  And you see their face when they bust open that lock,  and then you look at the person who's in their 20s and 30s next to them sitting there frustrated,  like they can't even believe what just happened next to them.  And you see their parents absolutely in fear of what you just did.  But it's also very cool to teach people who haven't seen all this stuff, my failures,  and my mistakes, and go, hey, look, this is how you can do it a different way.  And guess what I learned from it?  So it's somewhat selfish in that respect, but it's a good kind of selfish.  Even if you're just doing something stupid, like showing a kid how to punch out Funky Town  or Mario Brothers on DTMF tones, you can teach them DTMF.  Just teach them how to solder it, and then that way you have free labor when you need a giant LED matrix system.  It's really nice.  And I would agree that getting the younger generation involved is really important.  But as far as schools go, I don't know if it's just me,  but I happen to get chased off of every school I go to and tired of talking to them about deaf colleagues.  Maybe I'm just ugly, I don't know, but I've had bad experiences with school  or, I guess, government institutions in general when it comes to DC 414.  So...  I think it's the mustache.  It might be the stash. It scares people, I guess.  Can you repeat that? Because he couldn't understand you.  It's hard to hear up here.  The reverb's pretty badly.  Who?  What?  Tell me who you want to repeat what.  Yeah.  Energy Angel?  Yeah. The guy leaning back who just spoke...  What was...  Speak this way.  We can't hear you.  Basically what I was saying was I've had bad experiences with going to schools about...  getting the word about DC 414.  I wasn't sure if it was just because I was ugly or my mustache,  but I get run off of all the schools I've ever been to to try to talk about  getting kids to come to DC 414.  It's just...  I don't know if it's our area, maybe other people in other states have had better success,  but just in our schools, they hear the word hacker and I don't know, it turns them off,  or even computer security seems to... people in least in our state are timid around it.  I don't know why, but...  There's some balance that you have to have because at the lodge, would you have some...  like 21 and up, we have some adult oriented events, or with the issue with kids.  You need to rephrase that a little bit.  Well, what?  Events with alcohol versus events where no alcohol is there.  We have open space for people to come by, check out the place.  During normal operation hours, we do barbecues almost every weekend.  People can come out and enjoy, talk about projects they're working at home,  maybe something they want to get the group involved with, and get community effort.  But also we have private stuff.  And private, like after our movie nights where they're drinking involved, we took a page out of the book,  the 23B guys where we have a projector on the other block of buildings in the industrial space.  So we're also parking lot.  But there's this balance that you have to have between...  there is some stuff that's going to go on that isn't kid friendly,  or have something that... granted, there's a lot to say about how you're going to present yourself  to adults versus how you're going to present yourself, or what options you're going to present to kids.  It's mainly about education.  I mean, if the public knew exactly what hacking actually originated as,  and if you exhibited those ideals in your day to day above board activities under your group label,  we wouldn't be fighting much of the way that we're fighting the wars we are now in the media.  The issue comes when you begin to label private activities amongst groups of individuals  that would normally gather under your group flag outside of the group.  Maybe those things don't need to be put on the front page of the American press.  You have to continue.  How can someone dislike your hacking group when you're feeding the hungry?  I mean...  Can you go on the board?  Yeah, so, Valk, we're actually running out of time here, so I'm going to kind of wrap you up.  I'm sorry, I don't mean to interrupt you, but...  Yeah.  Alright, we're going to have a Q&A session right after this, so you guys want to join us.  I have one question to wrap up, because I asked how many point of contacts we had in here for Converge.  I'm going to put you on the spot.  What can we do as group point of contacts to help you as the coordinator?  Well, moving forward, we're going to be adding a lot.  Probably the card of the problem that we've had with all of the groups currently, well,  aside from not knowing where they are or who they are, is communication.  Like, we really don't have a dialogue going on between the groups, and we're going to fix that.  So, we're going to be firing up Twitter accounts, Google Plus accounts, Facebook accounts.  We're going to be setting up an IRC server, maybe, like I heard discussion of that.  Coming in the near future, probably later this year, we're going to be launching a DEFCON Groups website  that is just for DEFCON Groups.  It's going to have a forum just for DEFCON Groups that's active, it's focused.  And we want groups to interact, we want groups to send us what they're doing that's cool.  If you want to be featured and show a cool project or even a dumb project that was just fun,  like, be in touch with me, be in touch with the other groups through those means,  and we'll get it out there, and we'll start seeing what we're doing,  and we'll start showing other people what we're doing.  Maybe they'll get interested too.  How do we find this group?  DCgroups at DEFCON.org.  That just email?  Yeah, give me an email or hit me up online.  Are you actually looking for a list of active groups?  It's on the website.  Yeah, it's on the DEFCON website.  Alright, with that, I think we're going to wrap up and move over to QA.  What QA room are we in?  Pavilion number four, so this is going to be down the hall.  We'll see you guys there.
DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_0_311.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_312_467.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_468_515.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_516_5807.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_5808_5915.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_5916_5963.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_5964_6407.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_6408_7799.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_7800_9191.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_9192_14399.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_14400_14975.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_14976_15023.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_15024_18227.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_18228_18335.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_18336_19595.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_19596_20135.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_20136_20375.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_20376_21059.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_21060_21203.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_21204_21263.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_21264_26123.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_26124_26267.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_26268_26699.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_26700_27995.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_27996_30119.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_30120_31787.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_31788_31835.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_31836_32063.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_32064_40703.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_40704_40907.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_40908_41015.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_41016_42179.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_42180_43571.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_43572_45647.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_45648_46139.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_46140_46379.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_46380_48527.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_48528_49031.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_49032_57683.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_57684_62135.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_62136_63623.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_63624_67043.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_67044_68159.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_68160_68615.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_68616_68711.png DEF_CON_19_-_Panel_-_Represent__Defcon_Groups__Hackerspaces__and_You__dJoWgjowJWU_1_68712_71332.png