Thread by @AlyssaM_InfoSec

I've been dwelling on this response from @specterops' @jasonjfrank and whether to respond further. Considering some of the factors you're about to read, you'll see why I chose to take this point by point.

It'll be a thread since I refuse to pay the #MuskRansom.

1/

Let's talk first about the supposed out reach to many diverse speakers. I mean I freaking called it that the "pipeline" excuse would be the first response in my post and you STILL came at us with that response? If you couldn't find a single non-male non-white human,

2/

who could "make it" you weren't trying very hard. This is the lazy excuse we see from conferences and other events time and again when they pull this and it's so tired and phony.

3/

Next you come in talking about supporting your employees with celebrations and benefits. My dude, those should be table stakes for any organization. @mcuban has been giving a master class on how orgs benefit from DEI initiatives so I won't rehash.



4/

https://x.com/mcuban/status/1742690628465484204?s=20

However, how you treat your employees internally is irrelevant when we're talking about an open event your org is charging admittance to and marketing in public spaces (more on that latter point coming up).

5/

You then go on to say "integrity" means not talking publicly about DEI initiatives. That's a fallacy that's perpetuated by people who are afraid of backlash from those with whom DEI is not popular.

If your concern was you didn't want to be seen as "rainbow washing" for

6/

instance, you'd know that because your org lives it (as you state) not just exploiting the concept to win points with people who care about it, that your org does have integrity.

However, not talking about it puts you in a position of a lack of integrity. It says...

7/

"yeah we'll do these things because we know we benefit from it, but we'll keep quiet rather than having to advocating publicly for what's right". Incidentally, no one asked you to speak publicly on those topics, we asked you to have representative diversity in your speakers.

8/

Then you talk about how you "promote people, of all backgrounds". Well it seems looking at the poster and list of speakers for this event, you're not doing so hot in that regard.

You see, however you treat your employees internally, what people see externally matters too.

9/

For the people that speak, events like this can be very powerful in boosting their careers (ask me how I know). They get seen, they get known as experts in the field, and they in turn get other opportunities to speak and grow their brand more as a result.

10/

Your event is promoting people from one very narrow demographic set. Your excitement in displaying this, at another con, sends a message to those who don't see people with their backgrounds reflected in your lineup. How many women do you think walked past this poster?

11/

How many black people? The message your poster sends is that orgs still don't care to see people from those demographics on their stages. That their unique perspectives weren't valuable enough to your org to be shared. Your display of this poster simply normalizes

12/

the problems you claim your org is fighting against. By impacting underrepresented groups and normalizing this further, you do real and actual harm to the cybersecurity community. And that good sir, is why I take this personally enough to write this lengthy response.

13/

You see, this isn't my first rodeo dealing with orgs in situations like this. Each and every part of your response is cliched, including the "actually have a conversation" line. What you mean is, let's talk about it in private so everyone doesn't hear.

14/

Well sir, we can do that, but it won't stop me speaking in public. You see, we need those members of the community that you've harmed to see that someone is fighting on their behalf. That someone, in this case 2 people, with big platforms see this.

15/

That people care enough to speak up, to challenge the behaviors, and to push for better. That sir is the only way to heal some of the harm your organization caused.

I hope you have a better understanding now of why this is important. And yes I'm happy to discuss further.

/FIN