Thread by @JoeUchill

Next up at #shmoocon (for me, at least) is The Hacker’s Guide to Cybersecurity Policy in 2020, with Jen Ellis, Nick Leiserson, Leonard Bailey, and Kurt Opsahl

Opsahl is general counsel at EFF, Leiserson is LD for Rep. Jim Langevin of Rhode Island, Bailey is special counsel for national security in DOJ's Computer Crimes and Intellectual Property Section. Ellis does policy at Rapid7 and will moderate.

#shmoocon.

.@infosecjen leads off noting that there were 96 bills with the word cybersecurity in the title in 2019 - and that's not abnormally high.
#shmoocon.

@Infosecjen "I'm not going to say that all the 96 bills are good ideas, but at least there is more engagement. " --Leiserson

#shmoocon.

Leiserson notes attempt to reform DOD purchasing of software, 1/2 billion in election security ("probably not enough"), bills on critical infrastructure.

"I want to dispell the idea that congress is getting nothing done."

#shmoocon

Opsahl notes that a lot of motion happens during "must pass" bill season - September, or so, when budget bills come out. That means a lull might be coming for hacker policy - especially w/ election.

"I don't think this is going to be a banner year for cybersecurity policy."

Ellis adds that confirmations in 2021 will probably hold up a lot of policy.

Bailey - we've learned over time to have a little humility in cybersecurity policy because it isn't isn't simple. Gives a shoutout to the cyber solarium commission (report mid march)

Read more about the solarium here
axios.com/cyber-solarium…

#shmoocon

Leiserson - Right now, if DHS sees a problem during an internet scan with vulnerable servers that appear to be critical infrastructure, unless they see malicious activity, can't get a subpoena to contact the owner.

New efforts to remedy that.
#shmoocon.

Bailey mentions that DOJ is trying to do as much as it can through prosecutorial guidance on unclear issues so it doesn't need to be legislation.

This'll raise Ellis's eyebrows - she's typically concerned about the lack of firm protections for researchers under DMCA. #shmoocon

Ellis typically makes the point (though not yet) that violating terms of service could be considered a violation of CFAA, and the only reason it isn't prosecuted is guidance. That's great if guidance holds, but guidance can be mushy.

Bailey - We're going to be engaged on DMCA exemptions for researchers, expanding them. Every 3 years, exemptions have to be renewed at the Library of Congress.

Ellis (to Leiserson) - Why doesn't congress make it permanent? #shmoocon

Leiserson - Call your congressmen. They don't know what people in rooms like this believe.
#Shmoocon.

Ellis raises CFAA.
Leiserson says that the reason the executive branch is thinking of CFAA differently is Bailey. Everyone who isn't Bailey nods.
#shmoocon.

What can people do
--EFF sez: check out our action portal on our website.
--Leiserson sez: the two things are pay attention and make your voice heard. "People greatly underestimate how responsive Congressmen are to their constituencies."
--Bailey sez: "What they said."

In an extremely charming moment, Bailey notes that @Infosecjen is moving back to Britain, and gives her an honorary faux law degree (a “juris friggin doctorate” from the school of lulz and justice).