Okay.

Katie Masuris, who is also a very old school member of the hacker community, was really one of the pioneers of the entire concept of having a bug bounty and a bug bounty program.

And really bringing hackers over to your side and rewarding them for doing security research and having them help you to secure your products.

instead of having them make your product more insecure and allowing people to exploit it.

One of the downsides of this sort of golden age of bug bounties and bug bounty programs is that a lot of companies instituted bug bounties and bug bounty programs when they weren't really ready to do things with that information.

They weren't ready to deal with the sort of deluge of claims that came in they didn't necessarily know how to test them or how to treat them or how to triage them and this has become an even bigger problem uh in uh in the last year or so when we've seen just like a huge number of uh you know llm generated uh exploits being found and sent into bug bounty programs and reported as vulnerabilities.

And some of those are legitimate, and some of them are noticeably less so.

Can you expand on Stalkerware? Because I think a lot of people would want to know more about that, how it's harmful and what it does to individuals and how they're using it, if you don't mind me asking that.

[laughs]

For example, uh, just got off a plane, uh, from Prague, where I was the keynote for BSides Prague last week, and I talked to, uh, about 500 or 600 hackers, um, about how not to build the Torment nexus.

So we were talking specifically about kind of the, the state of, uh, of security and cybersecurity as it has to do with AI and the ways in which, uh, this empowers us, uh, but also the things that we need to be careful about not building, the things that we need to think about when we are building things, uh, responsibly.

So, uh, that, that was, uh, that was last week.

Um, but I also spend a lot of time, you know, writing blog posts and working on policy and sitting down and working, uh, directly with either organizations that, uh, need help with their privacy and security, uh, policies or operational security practices.

Uh, I work directly with, uh, survivors of domestic abuse who call me up and basically say, "How do I lock down my stuff?" Uh, I help to work on EFF's, uh, privacy and security advice, which you can find at, uh, sur- surveillance self-defense, and you can get there at ssd.eff.org.

Um, but generally what I try to do is, uh, I try to make sure that the things that I am doing are things that other people are not doing.

[laughs]

The threat of tech abuse is often enough to silence victims of intimate partner violence.

It's worth making the point that often when an abuser threatens to engage in this sort of tech-enabled abuse, one of the things that they do is they try to leave their target or the survivor with the impression that they're omniscient and they're omnipotent, that they are comfortable with technology, and therefore, they might be capable of anything.

And so the survivor often comes to me imagining all kinds of very technically complicated scenarios, uh, in which their privacy or security has, has been compromised.

And let me tell you, almost every time that I actually catch an abuser compromising an account or a device or successfully learning where somebody is located or getting access to the contents of their communications, it's pretty low tech.

Abusers are lazy.

Abusers are honestly not terribly competent, and part of that is that they don't have to be.

If they cultivate an aura of, "I could do anything at any moment," often it's enough to cause the survivor to censor themselves and to chill their speech and to not go places simply because they're scared, and they do the abuser's work for them in this way.

[static]