My name is Jeff Man. This is contact information if you care to contact me
anytime. Happy to hear from you,. Happy to answer
questions. Happy to discuss things. I consider myself to be a teacher of some
sorts. I am in the consulting world and again after a brief hiatus in the
meander land, this is my compulsory company slide because they are paying my
way to be here. Pretty cool company, nobody's ever heard
of it. And we have a very large and growing consulting practice. We do you
know, the security and compliance type stuff. We have a pin testing group, so
on and so forth. So that's enough about that. I do want to apologize ahead of time.
Because the things that I describe in this talk that are problems you know.
I've been caught up in a, in a lot of it over the years. As we talk about it,
just keep that in the back of the mind. A friend of mine named Paul Ascendorian.
Anyone know who Paul Ascendorian is? He's given a couple talks. One is called everything
that he learned about security, he learned from kung-fu movies. And another
one he gives is everything I learned about security, gosh what was the second
one he did? Kung-fu and Hip-hop I think is the second one. So, I thought I'd give a talk some day. I haven't put it together yet, but
this is the one that I'm gonna give. Some day. [People laugh].
So, a little bit about me, just to give a little bit of context of why I'm
up here pontificating and talking about what I think is wrong with the security
world. Or are asking us essentially what are we doing here?
37 some odd years in the business. Officially 35. I got my first start in
1984 and I'll tell a little bit about that. Most of my time in terms of my
formative years, was spent at NSA. I started there actually in 1986 and this was
a popular t-shirt back then. And I think NSA might still be behind schedule.
While I was at NSA very briefly, I worked on what was then called the InfoSec side
of the house, the defensive side of the house. And I was in what was called the
manual cryptosystem shop. We dealt with paper. One-time pads. Paper cipher systems.
Things that we usually do in puzzles these days. Go up to cypher village,
you can probably find some upstairs. But one of the first things I did when I was
there 8687 was there was this newfangled thing
called a desktop PC and we had customers that said is there any way you could
write a computer program to do this encryption and decryption on the
one-time pad because it takes hours sometimes to do it and we're like yeah
we can do that so I was actually responsible for as near as I can tell
the first quote-unquote software based crypto system that NSA ever produced in
the process of working with one-time pads I came up with this little
Cryptologic aid this little cycler wheel here that does the algorithm for a
particular type of one-time pad this was used by the US Special Forces for quite
a few years they called it the wizzy wheel I called it the Visionaire wheel I
got a cash award when I when I came up with this and my boss wrote it up and it
was titled man reinvents wheel
I spent a little bit of time on the operation side of the house when most
people know about and I'd say what they think of when they think of NSA is the
operation side the offensive side and it says the ears of the country listening
to all of our adversaries and I happen to be there during the time of the first
Gulf engagement Desert shield/desert storm which lasted Desert Shield was a
series I guess a couple of weeks or months and Desert Storm was over an
hour's and then the last part of my NSA career and I actually do another talk
that goes more into detail of this but I ended up being in an office back on
InfoSec side at the beginnings of sort of the popularity of the internet and
everybody jumping on the internet and I ended up being working for a group that
started to learn how to do pen testing and we did that for NSA this book came
out a couple of years ago called dark territory in that book chapter four is
entitled eligible receivers anybody read this book a couple people recommended
reading in this book in this chapter there's a paragraph here and I will read
it dramatically to you if I'm an indulgent per month starting founded in
the middle during its most sensitive drills the red team worked out of the
chamber recalled the pit which is so secret that few people at NSA knew it
existed and even they could enter without first passing through comedy
booths that cool I actually was part of the pit I was one
of the founding members of the pit the pit existed in a building this is an
aerial shot of some buildings just south just west BWI Airport fall it was
this one and until it was dead actually just a group of hackers group of guys
working there were six of us oh and the audio is there we used to play this when
we were happy two of us still work at NSA four of us around in the private
sector out in the real world the only other one that I have the permission to
let you know who it is is Raoul you may have heard of them he founded this
company called tenable and which just went public and some of my good friends
are still working there it might be of the audience and I wonder why they
haven't retired that's another story and I have to say this and is it too
early to drink because when I say PCI usually somebody puts a drink in my hand
I am due but before you before you dismiss me because the PCI and this is a
list of the customers that I have I was at USA for 10 years and I am allowed to
say that I was the qsa for the TJX companies they were breached and back in
2008 I started with them after that but I was Ark USA for six years up until the
time when I stopped doing in Heartland Payment Systems it's a matter of public
record they were also reached back in 2008 in 2009 I was part of the team that
went we sort of smoked jumped in and helped him get back into compliance as
it were back in the day so I wanted there the diverse experience talking to
lots and lots and lots of different types of companies most of these
companies security is not their core competency never has been never probably
never will be but I'll go down swinging trauma one of my first lessons in
security happened Ashley back when I started working for the government which
was summer of 1984 I got it turn position working for a naval
research facility and my job was simply I was working for a physicist who was
doing research and had been doing research for many years in the area of
what's called any submarine warfare and he had collected all sorts of research
information articles books and put it and put it literally in this filing
cabinet this lock safe and he had gotten some money and was able to buy one of
these newfangled desktop PCs and I'm pretty sure that's the model that he had
bought and he'd bought a database program I think it was debates to if
anybody remembers that and my job for the summer was simply to go through the
the filing cabinet and catalogue everything that was in there and and
produced some sort of rudimentary database of everything in his holdings
what I found amazing at one point when I was going through this material some of
the material he had had been checked out of the research library at the
organization and the date that it had been checked out and had been sitting in
this filing cabinet was before I was born so there was a little and I was
what 20 22 at the time so there's a lot of information in this thing so the
lesson that I learned about security and I won't read it to you you can sort of
read it while I'm talking yeah basically I I committed a security violation and I
left the safe unlocked one night and my boss was nearly apoplectic because it
was so inept enough for anybody to violate the rules because they have all
sorts of rules and procedures of how you check out at the end of the night make
sure that the safe is locked make sure everything's put away and I was sort of
a young careless college kid that didn't think much of it and and quite honestly
my thought was you know what's the big deal I work in a facility that's
protected by a wall barbed-wire fences and perimeter protections to get into
the building that I worked you had to go past the security desk a security
checkpoint to get into the office that I worked
to get through a locked door II had to know the combination and they had guards
all over the buildings that were constantly walking around checking
things in fact that's how I might incident was discovered because they
would come in in the offices in the middle of the night and try all the
safes and they if they found it open they put this pink slip inside and that
said come see us in security and would lock it up and that was the beginning of
the incident so my first lesson in security just for
business the context of this discussion didn't have anything to do with
computers and it didn't really I have to do with any kind of a breach or
disclosure or loss I simply didn't follow the rules and I got into a
significant amount of trouble for it and you guys do lock-picking safecracking
for fun or profit I thought my boss was apoplectic the first time it happened
the second time I happen in the lesson I learned was that when you're locking one
of these safes it's not good enough to just kind of do a quick spin of the dial
you have to turn in a couple times to set all the tumblers so I had closed it
thought it was locks on the dial tried to handle thought I was good second time
had happened if I thought my boss was apoplectic the first time and I can't
begin to describe how mad he wasn't me the second time
lesson learned so in the context of what I'm trying to get at this morning and I
really intend this to be a conversation or at least get all of us thinking maybe
perhaps a little bit differently about this thing that we're doing that we call
security I think we have a problem this is one of the problems I think we have
but the basic problem that I see especially since I've been in this
business so long I've seen this for so many times is all the stuff that we do
all the smart people that are trying to solve security and do all the things
that we do all the effort and all the money that's in the
industry and in the business they're still breaches happening and I given up
trying to keep this slide current it's it's just too hard because every time I
give a talk there's some variation of this slide that I usually work into my
talk it's just too hard you know just this week there's in the last week or
two I didn't try to get it a little bit current Microsoft Patch Tuesday started
breaking things so they had to kill the patch it's not exactly a security issue
or is it this one was really interesting I think this just came out yesterday we
talked about it I do a podcast by the way called security weekly we were
recording last night we were talking about this you know who knew that
something that was designed to be perfectly secure WPA three fixing all
the problems in WPA and wpa2 and then we discovered that it's got problems and
that's kind of the pattern of our whole industry and that's been the way it's
been for many many years but then you have something like dips
all the technical solutions that we pursue all the research and all the
smart people doing all the technology stuff and then somebody's doing
something with passwords and believe it or not and if you've been in the
business a while you might know this but passwords are still kind of one of the
big ways that most bad guys get in and that's certainly the way that a lot of
pen testers you know do the initial breach getting the initial access so
somehow we haven't fundamentally solved some of the basic problems which is what
frustrates me and makes me asked what are we doing here we have we've invested
so much in technology and trying to solve the problems of security and
there's so many aspects and elements and things to do it you've gotten it and I
apologize if you can't read the detail of this search for this diagram that's
out there it's on Google the sea so my map but basically all the fine print is
all the different things that a sea so needs to worry about to secure there
organization there's a lot up there I've been in this business 37 years I know
what most of that stuff is I I don't claim to be an expert on all of it maybe
some aspects here and there but I don't know how anybody any human oughta make
using automation or not can keep up with all this so something's wrong so what I
want us to try to do for a little bit this morning is maybe think differently
about security when I started at NSA one of the lessons that I learned when I was
Duke going through my training courses is even something like the NSA the idea
of encrypting communications protecting communications was problematic
throughout at least our country's history there were people you know
politicians people in government that said why do we need to protect our
messages and communications and there's this quote that was that I learned early
on at NSA the gentlemen don't read each other's mail you know that's just not
civilized well we know that that doesn't work the basics of security and I would
submit to you and I'm chuckling a little bit because last night when we were
recording our segment we interviewed a guy that was talking about this new
thing called the need to focus on data and it's all about the data and I'm like
no it's not that's not new that's how it's been forever anybody ever hear of
CIA the three aspects of data security this is not new
confidentiality keeping secrets you know keeping your sensitive data protected so
the people that shouldn't be reading it can't read it integrity making sure that
the data is real and availability making sure you can get to the data these are
the basic components of data security and this has nothing to do with
technology per se it has to do with understanding what your data is that
sensitive that you need to protect and what in what way you need to protect it
and then figuring out with the use of the technology in your organization
which of these things you need to focus on
did it do its thing okay I just throw that in there because I think it's cool
and I didn't make it I found it anybody know what it is this is from
sneakers there's a scene in sneakers where the the two main characters the
good guy in the back dad they're having conversations anybody know what they're
sitting on a crack very good the the bad guy Ben Kingsley says to the good guy
Robert Redford there's a war out there old friend a world war and it's not
about who's got the most bullets it's about who controls the information what
we see and hear how we work what we think it's all about the information we
all agree that that's kind of hid no argument there
1992 is when this movie came out and by the way when I was at NSA I used to work
on the grave that's where we did all of our number crunching and the Cray that I
worked on you could now see in the National Cryptologic Museum and that
makes me feel really old but if you're ever in the Maryland area of highly
recommend going the National Cryptologic Museum if you're there hit me up if I
happen to be around I'll come give you a guided tour and
I'll point all the things that I used to work on that's now in a museum
oh yeah no no sticker for you here's my contention and this is my grumpy
comments' me or you know old-timers kind of approach to things because when I
learned InfoSec it didn't have anything to do with the computer some technology
I really think technology is our problem at the end of the day you can quote me
on that but that's reinforced like when I was at NSA he's starting to get into
the - I need to learn how to you know fight back the hecklers of the audience
oh I haven't won that when I was at NSA in the latter part when we were starting
to do the red teaming and the pen testing the office that I was in and
initially was called fielding systems evaluation so we were looking at the
systems that we were designing trying to make sure that they were as secure in
use in input implementation is that they had been designed because lo and behold
the way NSA very often would break our enemy's communications is we took
advantage of the fact that they were misused a one-time pad is the most
secure cryptographic system in the world it's cryptographically mathematically
unbreakable if you use it correctly and and the operative part of the name one
time is what makes it unbreakable so if you have a page of a key that you're
using to do a message one time you're good if you're trying to save paper and
conserve resources and use that page for a month or more and for multiple
messages you've introduced a vulnerability that can be exploited and
it can be can be read so there was a lot of
reticence at the NSA at the time to do anything in terms of migrating it over
to software and there was also this belief and when my early lessons was
that if anything is created by man it can be broken by man I've been thinking
about it lately and I think as a society we sort of checked out in terms of
overall data security of privacy when we decided to just put all online and
digitized I mean if we're really honest with ourselves we've already said we're
willing to sacrifice the measure of security of privacy because of the
benefit we get at the speed and and all the information sharing and everything
that goes along with all the cool stuff that technology brings us you can agree
or disagree with me but what I want to get to and what I want to you know sort
of the make the main between what I'm trying to talk about this morning is one
of the things that I learned at NSA was something that was called the risk
equation let me show it to you this is the way I learned it these are words
that we all know these are words that we all use in our in our in our daily lives
and our work lives you go to a trade show look at all that I haven't noticed
so much out here but you go to the large vendor areas very often you'll see
variations of these words out here one of my frustrations is because I go to a
lot of shows and conferences and see these words used in print all the time
is it very quickly becomes clear to me that people aren't using the words at
least in the context of the way I learned the words and that's a nice way
of saying they don't know what they're talking about so very basically I know
there's lots of variations of actual risk equations because people like
mathematicians and accountants they actually try to assign real values but
just at a conceptual level at a high level this thing that we call this is a
function of three different things let's call them variables vulnerabilities
threats and countermeasures that's the way I learned
if you notice security isn't even mentioned in this risk equation so hold
that thought the risk parameters at a high level
again it's the way I learned it and I'm sharing this with you because did you
know it occurred to me at some point I get sort of irritated when I hear the
terms misused but then it occurs to me people don't know because they haven't
been taught so I'm trying to teach you not necessarily the right way to think
about this but the way it was learned classically and we can decide later on
if there's something to be learned here if there's still a take away from
learning the classic meanings of these terms so your vulnerabilities are simply
I'll ask people what is the vulnerability and people struggle with
giving me a definition think of it as a weakness just a weakness one word a
weakness threats the way I learned number PT threats are the bad guys
threats are the ones that want to do harm to you and then countermeasures are
the things that you do to try to protect or minimize or reduce the likelihood of
success of threats taking advantage of the vulnerabilities to do something bad
to you with me so far we'll go back into we will drill down to this a little bit
in the next couple slides my source by the way is what use well it's still
called the national information systems security intersect glossary the version
that I used came out probably in the 80s it's been updated over time I believe
it's available on the internet so search for that you might be able to find a
copy this is where I'm getting the actual sort of dictionary definitions of
these terms to share with you so the way I learned at the InfoSec manual this is
the definition of race okay see how the words are in there but they mean
different things like vulnerability and threat I'm avoiding and reading it to
you as I hate it when people read slides I
assume y'all can read this is the definition of threatened this as far as
I can remember and this just might be my mind feeling and I should be in the
museum the way I learned to threat as I said was people the definition that
shows up in the manual these days is more like what I hear people talking
about threats these these days which are the bad things that happen to you the
things that we use usually call threats in this industry I call them a tax it
makes more sense to me hopefully it'll make more sense to you as we drill down
on this this is a I pulled this slide from a deck that's literally over 20
years old this is when I first came out into the private sector and was trying
to teach companies that had never done security before about security this is
how we would describe threats and we would talk about threats being
essentially people but there's a there's other things in there but most of that
is people and then there was also the motivation I'm open to suggestion but is
there anything missing from this that applies today that isn't up here has
this changed the whole lot or is this pretty much still to still the way
things are anyone have a strong opinion one way or the other
somebody say something something thank you no it hasn't changed but you'll hear
a lot of conversations from a lot of vendors and a lot of the and I'm not
going to pick on the sales and marketing people but they've got to find ways of
spinning all this and make it sound new you know I've seen in the last couple
months you know there's new idea that insider
threat is something we need to worry about anyway then we get to
vulnerability and again vulnerability is a weakness and it's a weakness in
systems and systems are not just the technology systems by definition or
anything that goes in its the people it's data flows it's the work flows
again hard to keep the slide current but it's particularly jaw-dropping to me
when we find vulnerabilities that have been there for 20 years especially in
the things that hacker in the hacker communities things that we value and
still we think okay this is good this is safe we can use this we it's protected
and then lo and behold oh we've been using something that's been vulnerable
all this time and then finally the last variable of the equation something
that's called countermeasures the things that are done to when you can't
eliminate all the vulnerabilities and you can't eliminate all the threats
what's left you countermeasure if you do something to mitigate you do something
to minimize you do something to offset the vulnerabilities and the threats and
that all wraps up into this thing we call risk so my question to you is what
then is your hold that thought
don't listen to me if you don't want to but let's go back to the risk equation
this is one's slightly different I added one that I think is more applicable to
the commercial world the private sector that we live in and essentially the
original risk equation that I showed you the risk in terms of national security
of the DoD the way I learned it the risk was all about human life in one way
shape or form protecting our troops protecting our forces protecting our
diplomatic corps in our citizens traveling abroad but it all loosely had
to do with protecting human life in the commercial world I will submit to you
that there are only two risks that organizations face and that's the
ability alternately to earn revenue to make make a living and the second aspect
is the cost of doing business the cost of doing everything that they do to run
the business or to make the business quote unquote air-quote secure
so what's missing from this equation man which is what makes it hard is that
every aspect of it has a price tag on it and ultimately the risk that a
organization is thinking about is how much do they want to spend versus how
much they think they're going to make that's what it boils down to but as you
look at this risk equation here's the real question that I want to ask you to
think about if you agree that there's these four components or three
components that produce a product in this equation the math a little bit I'm
not a mathematician and if there's this thing called Vaughn abilities and
there's the Saint called threats and there's this thing called counter
measures and for the sake of our discussion let's say counter measure is
synonymous with security which we haven't figured out what it is yet but
my question is think about this whole industry and how so much of what we do
revolves around discovering vulnerabilities the conference here
other conferences all the products that are out there all the technologies out
there how do you get 90% of this industry in some way shape or form is
focused on vulnerabilities okay but if that's a component a variable in an
equation where there's another variable or component that is something that's
called security then what if everything that we're doing in terms of
vulnerabilities isn't security at all what if it's just our job
we're admins we're supposed to keep boxes secure we're supposed to update
the cache we're supposed to have secure configurations we're developers writing
code that is supposed to be impervious to attack what if all that isn't
security I'm not saying it's not I'm just saying this does that might want
mind works think about it and the second part of that question is if everything
that we do our industry and all these hacker
conferences and all these measures that focused on vulnerabilities and to some
degree threats because insider threats are a new thing we need to worry about
what else is there what if all all that we think about
that's associated with all facilities with threats isn't security what is
security that's the takeaway essentially and
that's essentially the slide that's talks about what is just and agree with
me disagree with me all I'm asking is think about it what is security if it's
not everything we think of in terms of vulnerabilities and everything that we
everything we think of in terms of threats what else is it I think there's
an answer and I think it's something that's worth discussing and I don't know
that it ultimately helps us in the end in the long run but I think defining and
agreeing on our terminology and what things are hopefully is something that
we is a way to apply sort of the classic thinking of information security and
maybe that will help us to be a more secure society moving forward because I
don't know what else to try essentially yes with me somebody laughs or something
so if you're at all intrigued about what I'm saying would love to talk to you
please feel free to disagree with me probe deeply if I defended your but
that's what I do I'm sorry but if you want to if you want
to hear me talk more if you want to continue continue the conversation I
mentioned earlier I knew a podcast called Paul security weekly we recorded
our 600th episode last night
I am known as a Jedi Master don't ask me why it has something to do with
communication skills I'm in a book that was published a couple months ago if
anybody happens to have a copy I'd be happy to sign it for them I am a member
of the of an austere group called the Cabal of the curmudgeons which is mostly
people that have dinner with jeans Baffert once a year at the RSA
Conference raise your hand if you don't know who gene Spafford is okay I am
failing as an educator and the people my age are failing because there's
something to be learned from the history genes Baffert was one of the authors of
what was I considered to be the Bible back at the beginnings of this thing
that we call cybersecurity but back in the day we called it internet security
so he was one of the authors of a book called basic and I forget the title of
that really basic UNIX and internet security so big thick volume everything
to do because everything was Unix back then UNIX is the operating system that
existed before Linux it was closed source Linux was open source again it's
a history lesson anyway G Stafford one of the offers he's been in the business
probably 50 years brilliant mind and we get to hang out with them and they let
me into the group a couple years ago I'm also on a game called Freaker life
one of the one of the in hacker anism cars is me and this is a fundraiser for
hack for kids they happen to be downstairs and if you're interested they
actually have a couple copies in my car that I've autographed for and they're
they're selling them in a silent auction is again it's another form of the
fundraiser so I'm saying downstairs go upstairs I'm sorry we're in the basement
find the cypher village it's in the room of all the different villages find the
hack for kids table and feel free to sign up for the silent auction and raise
a little bit of money to try to help kids learn all about this thing that
we're doing called hacking it's my contact information if you're into
and if I have any questions don't really want to ever get in one my wife has a
car that if you put on cruise control a little like brake automatically if it
gets too close I hated because you know not that I'm a tailgater or a bad driver
or an aggressive male driver or anything but I hate that it slows down because I
like the approaching a part of pass it I'm like you know I was approaching that
car and I'm not ever overtaking it it's because I keep going slower and slower
it also irritates you it like vibrates that you start straining out of the lane
I figured out how to turn that off and I don't know what it's monitoring the
occasional it'll pop up and say driver needs coffee driver needs coffee and
pull over take a break I'm not a big fan of technology in general that's my true
confession and self-driving cars being one of them
I'd rather take my it's gonna say I'd rather take the bus but that'll be
automated she's something yes sir oh sure because we all know who Alberto
has done is you're welcome that was an easy one yes way in the back and I
didn't do it the first time the question is how do I feel about companies
replacing security with automated security not a big fan of that either
although I understand that because of the volume of data and traffic that's on
networks today we just sort of created this mess
there's no way to handle it without automation but I would my old way of
thinking is you've still got to have human eyes somewhere along the way use
the automation to handle that handle the volume of data and cull it down to
something that's manageable but you need you still need a set of eyes on over the
years the organizations that I've worked with
the ones that I have found to be the most pure went back when I did Pintrest
penetration testing the ones that were more difficult to break into or they
detected you more early ultimately every one of those companies that were sort of
doing things right or doing things well they had one person at least one person
whose attitude was more or less not on my box not on my watch so they kind of
took it personally and what they did ultimately was they knew everything
about their box they knew what was normal they knew what was normal
behavior they knew what all the different indicators of monitoring the
same results would look like they knew what the network traffic flow was
supposed to look like and they had a sense a knack for seeing the anomalies
it wasn't always scientific but they knew what was normal and so they were
more likely to detect what was that more automation takes you there to some
degree but I don't know that it were there yet in terms of automation it goes
back to me to the old movie wargames where if you actually remember the
premise of the movie they were trying to turn the missile defense system that had
controlled all the nukes in America over to a computer and let the computer
decide when to fire the missile or not because they were concerned that humans
wouldn't pull the trigger because humans would would be too illogical and be too
emotional and not want to willfully kill millions of people and destroy the world
so they wanted to turn that decision-making over to a machine and
that's the whole a AI and machine learning argument and all the fiction
you know there's dozens of movies and stories out there that sort of ask this
whole question of you know when the machines take over you know are other
machines going to protect humans or or the machines going to think that
worth where the problem that is creating all the problems in the world so we must
be destroyed that's right it was fighting I was driving around the
other day and whoever the DJ was in the radio station I was listening to he was
talking about this Alexa his Alexa had said happy birthday to him when he woke
up that morning and he was kind of freaked out that Alexa knew his birthday
it's one of the other people in the studio I told him about it and they went
and asked Alexa Hey look so when's my birthday and Alexa didn't know what was
freaky about the conversation was she was referring to Alexa as if Alexa was a
person in the entire conversations I thought was just amazing what Alexa
notices like that's it it was just disturbing on so many but that was cool
it was me but also profoundly disturbing at least to me any other questions I
have no idea that we're doing on time it's magical
so a very long question and I'll try to repeat it for posterity it's again in
government terms the the risk equation I'd said is in terms of human life the
risk to human life I've been in commercial terms it's really funny so
the question was have I ever seen organizations that do sort of take into
account human life and care and do they spend more or less money on that that
pretty much it yeah I'm old and blind so I think you were giving me a thumbs up
now that I've repeated the question I mean you can actually think about
answering the question you know so my initial statement both parts are
generalizations I mean there's a sections to everything
there are certainly companies that are more caring about humanitarian efforts
and things like that or they're improving over time I don't personally
use Apple devices I don't have an iPhone and I have two reasons the first of
which is I'm sort of a militant left-handed person and there was some
iPhone I forget which version it was they came
out that didn't work for left-handed people whose left-handed people who hold
the phone in the right hand where's everybody else hold it in their left
hand and apparently however they put the antenna in the phone it was covered up
if you were holding it in your right hand so I was like apples dead to me
because they don't think about left anything but the other reason more to
your question is the use of conflict minerals and how conflict minerals are
attained and I have to go way off the rails the conflict minerals are minerals
that are basically either acquired through slavery or some sort of illegal
activity where humans aren't really regarded too well and one of the key
ingredients of the screens and your phones that make them available make
them able to be touched and used as instead of you know in the old
days where there used to be buttons is I forget what the name of it is somebody
shouted out no but it's a mineral that's a conflict I know and they're sorry
sapphire I think there's organizations that track you know the major phone
manufacturers and keep track of sort of their record on how closely they pay
attention to where they're getting their materials from or who's assembling the
phones for them you know in third world countries and of course you know what do
we do in our industry we do offshore development in many cases because it's
yeah it's cheaper not saying it's a human rights abuse or anything but it's
a complex question it's a complex world we live in but you know the motivation
at the end of the day very often this money so thank you very much I'm around
all day and
you