Conference - Jonathan Mayer, Panel - Meet the Feds

### Bridging Government Agencies and the Hacker Community The annual "Meet the Feds" panel at DEF CON 24 brings together technical leaders from major United States federal regulatory and technology agencies to demystify how Washington operates, explore ongoing technology policy initiatives, and encourage direct dialogue with the hacker community. The panel features Jonathan Mayer (Chief Technologist, Federal Communications Commission Enforcement Bureau), Lorrie Cranor (Chief Technologist, Federal Trade Commission), Eric Mill (Senior Engineer, 18F / General Services Administration), and Allan Friedman (Director of Cybersecurity Initiatives, National Telecommunications and Information Administration / Department of Commerce).

### The Federal Communications Commission (FCC) Enforcement Role Jonathan Mayer outlines the FCC's statutory mandate as an independent regulatory agency overseeing communications infrastructure, spectrum, and privacy: - **Broadband and ISP Privacy:** Mayer explains proposed FCC rules establishing comprehensive security and privacy requirements for Internet Service Providers (ISPs), preventing carriers from invisibly injecting tracking headers or monetizing subscriber browsing history without consent. - **Telecommunications Security:** The FCC's enforcement efforts target systemic telecommunications vulnerabilities, including SS7 signaling exploitation, mobile phone spoofing, and the deployment of network-level call authentication standards (STIR/SHAKEN) to combat fraudulent robocall operations. - **Regulatory Independence:** Mayer details the structure of independent agencies, noting that FCC Commissioners are presidential appointees confirmed by the Senate who act independently of the White House, relying directly on public dockets and technical evidence to formulate policy.

### Federal Trade Commission (FTC) Consumer Privacy Enforcement Lorrie Cranor details the FTC's position as the primary federal regulator safeguarding consumer privacy and commercial data security under Section 5 of the FTC Act: - **Unfair and Deceptive Practices:** The FTC enforces baseline cybersecurity requirements by prosecuting commercial vendors that fail to implement reasonable security controls, expose consumer databases via plain-text storage, or mislead buyers with false security marketing claims. - **Consumer Hardware and IoT:** Cranor highlights regulatory actions against manufacturers of connected home cameras, SOHO routers, and smart appliances that ship with hardcoded credentials or unpatchable firmware flaws. - **Empirical Usability Research:** Drawing on her academic background at Carnegie Mellon University, Cranor discusses FTC research challenging outdated security practices, specifically showing that mandatory frequent password expiration policies frequently backfire by inducing predictable user patterns rather than improving security.

### Modernizing Federal Infrastructure at 18F and GSA Eric Mill shares progress from 18F, a digital services agency within the General Services Administration (GSA) dedicated to modernizing federal software engineering practices: - **Federal HTTPS Mandate (M-15-13):** Mill discusses the implementation of White House Memorandum M-15-13, a government-wide policy mandate requiring all public executive branch websites to enforce secure connections via HTTPS and HTTP Strict Transport Security (HSTS). - **Open-Source and Modern Cloud Practices:** 18F demonstrates that federal agencies can bypass cumbersome legacy IT contracting models by leveraging modern agile frameworks, open-source software, public GitHub repositories, and automated continuous deployment. - **Government Bug Bounties:** Mill and panelists highlight the success of pioneering programs like "Hack the Pentagon," which officially welcomed external security researchers to identify vulnerabilities in DoD digital properties under clear legal safe harbors.

### Collaborative Rulemaking and Engaging with Government Allan Friedman of the NTIA emphasizes the power of collaborative multi-stakeholder processes and public feedback: - **Coordinated Vulnerability Disclosure (CVD):** The NTIA's multi-stakeholder initiatives facilitate consensus-building among researchers, healthcare providers, auto manufacturers, and safety regulators to establish standardized, non-punitive vulnerability disclosure workflows. - **Export Controls and Wassenaar:** Friedman recounts the public notice-and-comment process concerning proposed Wassenaar Arrangement export rules for intrusion software, demonstrating how detailed, empirical technical submissions from independent researchers successfully persuaded the Department of Commerce to withdraw problematic regulations. - **Direct Engagement for Researchers:** The panelists issue an open invitation to DEF CON attendees, advising that regulatory dockets are open to everyone and that rigorously documented, empirical technical data submitted by independent researchers carries immense weight in shaping federal policy.

(AI summary — Gemini 3.8 Flash)