Unspoken Security Ep 29: What is DEF CON Hotline?

I made my first DEF CON friend by going to Hacker Jeopardy and on the way picking up a bottle of wine in just like a convenience store or something and a corkscrew. And I know I had the corkscrew because I still have it. And sitting at Hacker Jeopardy and person in front of me, couple of rows in front of me, also has a bottle of wine. And then she realizes she doesn't have a corkscrew. And that's how we became best friends. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. And I've been building and maturing intelligence programs in the private sector for about 9 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership, uh, from Gonzaga University— go Zags— and continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests that have authentic, unfiltered conversations on a wide range of challenging topics. It's not your typical polished podcast. My dog makes occasional appearances and I gotta warn y'all, there's a very good chance there are gonna be two very loud dogs in a, in the not too distant future on the show. Maybe we'll edit it out, but I've got one at the vet on the way home and I have no idea what's gonna happen when she gets here. So, but that happens. People argue, we debate, we swear on here. I certainly do. That's all okay. You know, I want you to think of this podcast as a conversation. It's much like a lot of conversations you might overhear at a bar after a long day at one of the larger cybersecurity conferences. These are those conversations that we usually have when nobody's listening. Now today I'm joined by a good friend of mine, Ada Zebra. Now before you ask yourself, that's not her legal name, that's her Defcon Goon handle, but it's what everybody calls her. It's what everybody knows her as, including me. Ada's background's primarily in data science. She's got nearly a decade of experience to go along with her master's in computer science and a PhD in experimental psychology with a focus on behavioral psychology and quantitative statistics. Basically, Ada's just another friend and guest of mine who's way smarter than I am. So in, in addition to all those credentials though, Ada's also one of the leaders of DEF CON. And DEF CON, as a lot of people probably know, it's a big part of what is affectionately known as Hacker Summer Camp every year in August in Las Vegas. 'Cause where else would you like to be in August but Las Vegas? But this is what we're gonna talk about today is we're gonna dig into the DEF CON component of her career and her life and, and what we can talk about there. Because today's topic is actually what is DEF CON Hotline, which in itself is, is a, a subset of DEF CON, kind of an unknown piece, right? So that's what I want to get into. Ada, I've already spent like 28 minutes, it feels like, on this intro. So let's talk. First, did I miss anything in your introduction and any in your credentials that you want to catch up on before we dig into the topic?

Well, that seems good. Uh, nothing, nothing in particular, you know.

All right, cool. Um, well, good. Let's dig in then. So again, the question, uh, for the show is what is DEF CON Hotline? So before we specifically Hotline, let's talk a little about DEF CON though. Tell me about your journey, you know, with DEF CON. How long have you been with DEF CON? How long has DEF CON been around? How long have you been with DEF CON? How did you get into it? You and you know, you're one of the leaders at this point. You didn't start that way on day one, I imagine. So let's talk a little bit about that. Like how did, how was your journey been with DEF CON?

Let's see. I mean, how long has DEF CON been? The problem is the years of DEF CON don't coincide with the number of DEF CONs, right? So like it's, we're doing DEF CON 33 this year, which means we've been around for 33 years, right? Even the ones that don't count count. Right. Even when it's been canceled, it's not been canceled.

That's the annual joke, right? DEF CON's canceled every year. We've been saying that forever. And then finally there was a year where it sort of was.

Yeah, finally it was real.

Yeah. I guess 1993 is what the internet, the internet will tell me 1993 was the first DEF CON. So.

I didn't join it until DEF CON 18.

Okay.

Which is 2009, 2010. Sometime there.

Okay. Still a lot of DEF CONs. Still. Yeah.

Still a lot of DEF CONs though. It's been a while. Yeah. And I, you know, I go the reason a lot of people go, which is, you know, someone who's like, you should come with. And you're like, guess so. And at the time, like I was just doing psychology. I wasn't computer science yet. I, I have this from way back when I have this thing I used to tell at The story I used to tell when I'd go into job interviews, because they go, you have background in psychology and why are you here?

Right.

Which is I, when I first got into college, they ask you, what do you want to do? Right. Yeah. You can choose one thing to do. What is you going to do? What are you going to do? And I'm like, I like psychology and I like computers.

And they're like, you're not very good at instructions, I guess.

Yeah.

Here's two. Okay. That's a good start.

And I thought to myself, I don't want to be stuck in a cubicle my whole life.

Right.

That was my thought.

Right. How's that working out?

And so I went to psychology instead, but at that time when I was first going to DEF CON, that was the only thing I like, people are like, oh, just come along. It'll be fine. Right. And I think I went to like some talks on social engineering and I'm like, I'm a terrible liar. This is not where I belong. There was one guy who was there doing something about like social networks. And how, I don't even remember. It's been so long.

Hmm.

Cause I remember him talking about like Facebook and security on Facebook and then like how scammers are using Facebook in different ways. I thought that was really neat. And so I was like, this was a fun time. Sure. I'll come back again next year. And then I just kept coming back and back, back again. And it wasn't until, oh, I couldn't tell you which DEF CON. 25, maybe? I think between the two, I watched it all.

DEF CON 15, just for clarification, DEF CON 15 was in 2010. I'm, I have Google, I have Google over me, so I have the advantage of being able to look these things up, 'cause I don't have the memory, I wouldn't know either. It was, it was late July, early August of 2010 would be DEF CON 18. So that gives you a, What landmark?

Um, no, cause I've been, I've been working for DEF CON for 10 years now. So whatever it was 10 years ago between those two DEF CONs. Okay.

Fair enough.

I was watching a YouTube live event that Tara Wheeler put on. Oh yeah. In which she had various DEF CON people on.

Okay.

One of which was CJ.

Now, was this at the Rio or was this at Bally's?

It was a YouTube live event. So I like my first DEF CON, I think was Rio.

Okay. DEF CON 22 in 2014 was at Rio. That's why I asked. As was 21. 23 was in Vegas.

But since it's a YouTube live event, it's after DEF CON, right?

Oh, so it doesn't matter. Just ignore what I'm saying then. Go on with your story. Shut up, AJ. Go on with your story.

And CJ says, that they need more women to be goons.

Now, for those who don't know, who's CJ?

For those who don't know, I'm gonna say CJ is in charge of the SOC at DEF CON, being not what SOC is, right? Like, SOC in, in a company is entirely different because this is like physical security people, right? Yep. At DEF CON. Mm-hmm. And he says he needs more goons. And I sit and I type into the chat, literally like sitting there on my computer, like, listen to this, like, I do that job. And he says, email me at this address. And I was like, all right. That's how he came into it. Like the weirdest way, right? Most people, they know somebody and that person introduces them to somebody and And that's how they become a goon. That is not how it worked for me.

No. Yeah. Usually it's like the mafia. Like you have to be sponsored in, somebody has to know somebody that had to vouch for you and you have to pass a bunch of, yeah. You know, whatever, you know, tests of some sort, uh, social tests to get through the door. And, but not your case though. It was just a virtual event and CJ and you pinged him and he's like, all right, good. You're in.

I, it was in the live chat. I don't even need pinging him. It was just like, I do that job. It was, yeah, it was the weirdest way to get in. But I did my noon year, your first year of gooning. You are a new goon. You are a noon. Noon. That next year. And then I continued to goon after that just because like the community is really fun. Like community at DEF CON is great. And then the community of goons is just, um, makes you feel like you belong. I also love that job because, uh, It helped me with some ability to be, to feel like more confident than usual because I was this kind of more on the shy side person. And it gives you like the permission to just talk to random strangers because you have a red shirt on.

Sure. Yeah, that makes sense. That makes sense. Well, yeah, it's a role, right? It's a responsibility. For those who don't know, like goons Goons run DEF CON, right? And they're, if you've never been to DEF CON, if you ever go, just look for somebody in a red shirt and more often than not it's gonna be a goon. And goon is an affectionate term. Ada may be able to tell us where it comes from, I don't know. But, but folks who work DEF CON are goons and they can be anything.

I think, I think a part of it is that like the people who used to be the, the job they used to do back in the day, back, you know, back the AP, the Lexus Park, right? Was like keeping hackers from getting their computers stolen by random grifters, keeping people from having giant fist fights when they were drunk, patching people up when they get— when they thought something was going to be funny and instead ended up with a knife in their hand, like It was crazy.

It's like a pirate party.

This was like the, you know, things in Vegas stay in Vegas party. It was a very different conference, right? That it is. And as I recall, the reason why they were good is because they're such big guys. First off, like, back then they had to be really big guys so that they could make sure that they were keeping people safe.

You regulate. Well, I, I remember like years, I don't remember my first DEF CON. It was not as far back, I don't think, as you went, but it might be in the neighborhood. I didn't go to everyone since then, unfortunately. But, but it was also, it was sort of like, as I recall, it was like a mixture of a lot of big dudes, as you said, sort of bouncer-esque type. But also it felt like a little like Dick's Last Resort, if anybody's ever been to, to that restaurant. Like goons messed with everybody who was there. Like they would give you hard— if you ask for directions. Yeah. If you ask for help with the information table, there's a good chance you're gonna be singing your alma mater or I'm a Little Teacup or something, or they're not gonna tell you where the fuck to go. And, and that was part of the, you know, it was a thing, right? You just knew, you didn't know until you knew, right? If you're new and it was your first year showing up, you'd be like, what the hell's going on? I'm not singing I'm a Little Teacup, I just wanna know where to go, man. And then you realize it's like, that's the game, right? And then sometimes that shit gets outta control cuz that's what happens to people in general. But it was, you know, people played into it. But, but at the same time, this was, you know, it's always been community and, and like you said, it was, it was fun. So, so to have the opportunity to be part of the DEF CON community in and of itself, is, I mean, I find it to be pretty cool. Like you get to learn new things, you meet new people. I mean, if you ever want to go, if you guys are gonna be in Vegas anytime, anybody listening or watching, if you're somebody who goes to Black Hat, never goes to DEF CON, definitely hang around at least once. Even if it's just for the people watching, like DEF CON's a show, man. I've never seen two people with inflatable dino— dinosaur outfits go sumo wrestling in the, in the hallway before at Vegas until DEF CON. There's a, there's a, there's a whole furry con that's an under, you know, a, a, a subculture. And there's some amazing costumes, but at the same time, if you've ever sat in a lecture with somebody seriously considering what's going on while wearing a fox costume, it's a different experience.

I, I made my first DEF CON friend by going to Hacker Jeopardy and on the way picking up a bottle of wine in just like a convenience store or something and a corkscrew. And I know I had the corkscrew because I still have it. And sitting at Hacker Jeopardy and person in front of me, couple of rows in front of me, also has a bottle of wine. And then she realizes she doesn't have a corkscrew. And that's how we became best friends.

But she didn't have a way to hack her way into that, huh? She actually needed a corkscrew. She didn't— she wasn't gonna come up with some, some formula to hack into it. They just— the right amount of heat and whatever, and it would pop on its own. No. Just went for the corkscrew.

That's just how, that's how we became, became best friends. I had the corkscrew.

That's awesome. And that, and that happens, right? People make amazing friends, you know, just going to these events. It could be anything. I, I've seen it, I've seen it happen over technology. I've seen it over shared pieces like you're talking about. I've seen it over somebody who's just like amazing, right? They've done a thing.

We've never lived in the same town and, but we used to talk on the internet all the time and like I helped her change jobs cuz she hated her job and then like, she was trying to figure out what to do with her love life. And then I was just there with her the whole time, but now she's like happily married with 2 kids. Oh, wow.

That's awesome.

You know, just the people you meet in Vegas, but stay your friends after Vegas.

I don't know. She's happily married with 2 kids. There's a chance she's had corkscrews and more bottles of wine along the way too. So it tends to come hand in hand, I think, for most people at some point, if not the marriage, certainly kids will do that for you. Ask anybody. DEF CON, by the way, hung out lots of times.

We hung out in DC once. I think that was the only time we ever hung out outside of DEF CON. Oh yeah, she lived in the area at the time and I was like, I'm gonna be there for another conference, you wanna hang out and show me around DC? And that was the whole thing.

That's funny. That's funny. For most guys, like, yeah, hanging out once a year in person, that's kind of just a normal guy friendship actually. I can live in the same town, you might see the guy like once or twice a year. That's just, a little bit more than normal. But so, all right, so you, you met CJ through a livestream event, chatted, and he's like, yeah, let's do this. And then so that gets you in and you know, you've been going now, you're, now you're a goon. But now, you know, fast forward, you're, you're 10 years down the road. Well, actually no, we'll fast forward, won't go quite that far yet. Fast forward a handful of years at least. You, you're in leadership. How did, how did that come about? How did you move into leadership from just being, well, not just, I don't wanna say, but from being a goon, I, I almost feel like it was just, I was just in the right place at the right time.

I don't feel like I was, I don't know, people are like, but you have the right experience. I'm like, oh, then I thought like, I was just, I always used to write down because you can write down notes about yourself in your, uh, sign up. And I always just write down that I am trained in mental health assistance and suicide prevention because I did 6 years working on suicide hotlines. And so I was like, anytime, anytime you need somebody or something like that, come find me, let me know, and I can help with that. In 2017, we had an incident, incident where a woman tried to come forward and talk to somebody about something that had happened to her, and that goon didn't know how to respond. And so his first inclination was to look for me.

Oh, okay.

He told her to stay there And he came to try to find me. And by the time we returned, she was gone. I mean, very common. Victims tend to try to seek safety. Safety wouldn't have been out on the floor of DEF CON.

Right. Hanging out in a big crowd in Vegas. Yeah.

So she's probably back in her hotel room by that point. We searched all over DEF CON, never found her. It's over, right? Like, that's not gonna— that, that report's gone.

Mm-hmm.

Which the higher-ups were not happy about. They want to be able to know more about these kinds of incidents that are happening at DEF CON so that they can better handle them. So that, you know, women feel safe there. So that any variety of minorities feel safer at DEF CON. Because they can figure out what's happening and try to take steps to reduce it. So I end up in a very— it felt like a really weird meeting because I'd never been in the same room as DT at the time.

Dark tangent for those who don't know who DT is, he's the founder.

These are like a bunch of people who are like way above me on the leadership chain. And I just work for a SOC. Like, I end up in a room with all these people and I felt like I didn't belong there so much so that I can tell you that DT's shoes were very sparkly that day.

You were staring at him the whole time you had your head down?

Yeah, yeah, he had on like these sparkly black tennis shoes. It was great because that's what I was paying attention to, right?

I got you. No, grounding yourself, I can get it.

Uh, and they're like, well, what can we do? How can we prevent this? We talked a little bit about the incident that happened, like why would, why would she disappear? Why wouldn't she stay? And I was trying to explain to him Um, and there was also a nurse who was there, um, who was trying to describe to them the reasons why this would've happened.

Hmm.

And they're like, how do we give people a space where they feel like they can talk to somebody with people who know how to respond to this kind of thing? And that's where the idea for Howling came up. Basically the idea being like, use the premise of a suicide prevention hotline where people are trained in order to respond to these types of incidents and give people a phone number they can call if they have issues. Because then they could be in their hotel room and call us, right? They don't have to be on the floor at DEF CON.

So they can seek safety.

They can talk to them. Yeah. And then they know they can call someplace where people are prepared to respond properly. To their problem and not just like, I don't know how to handle that.

Right, right. I got it.

Let me go find Ada.

Well, plus you're not gonna be scalable. Like, if this gets— people start learning about this and it's available, it can't all be Ada. It's— I mean, it's a, it's a long, it's a long week in Vegas, man, and it can't all be one person handling it. And we'd like to think there won't be a lot of incidents. There's going to be some. There's a lot of people. How many people you think go to DEF CON every year? You probably have a big—

I think the maximum was about 30,000. You dropped off a little bit in 2020. Yeah, and 2021. And it's still kind of ramping back up to pre-COVID numbers at this point, but I think we were almost approaching 30,000, if not a little bit more. Yeah, if you go to the Wikipedia, it'll tell you how many, how many people.

Well, anyway, I mean, you're talking 20, 25, 30,000 people. You're talking 4, you know, days plus, really, because people don't—

a small town, it's like Right.

It's, yeah, things are going to happen. Like that's whether they're nefarious, whether they're unintended, there's going to be things, right? And there's going to be reports that should be taken on those things to understand what was, what was what and what the stories are. And so, yeah, it, and it, and that is definitely not all gonna be you. So, so this was 2017 you're saying was this conversation? Is that, I got that right? Yeah. So 2018 was the first year of hotline.

I'm, I'm the first year of hotline.

Deduce.

It was 7 people. We had, we had so few people working that year that literally if somebody wanted to go to the bathroom, I had to return to the room so that there would be enough people to answer the phones.

Right.

It was really rough. I don't think I slept much that year. I don't think I slept much the first few years of Hotline, really. Yeah.

Yeah. I'm gonna guess you probably haven't slept much until maybe last year.

Maybe last year when we found— when I finally had somebody who helped me out doing the same job, I finally got some good sleep.

Yeah, yeah, yeah. It's a tough— it's a tough gig. Well, plus there's a lot of heavy things going on too, so like that, you know, it's, it's not a lightweight job, you know, forgetting the hours and the lack of people. It's heavy. Like, it's— these are heavy, you know, topics.

And, and but also like I try to explain to people why I like doing this job, why I like being the person people come to. Like, I like feeling like I can be of service. I can be helpful. I can be there for people. I like those things. So listening to hard stories and being there for people doesn't drain me the same way as it might other people. Mm-hmm. It's just, I like it.

I can appreciate that. I mean, I, in the opening, you know, I mentioned, you know, I have a master's in organizational leadership. Don't care about that all that much, but the focus is servant leadership. And so in that way, I think you and I are wired the same. I'm, I'm a big believer in that. You know, I was, I was the kid who never did my own homework, but helped my friends do their homework. I don't get a lot of satisfaction out of doing my own work, apparently. Uh, sometimes you have to, they do pay you as an adult to do it, but I get a lot of satisfaction about helping other people. I'm, I'm notorious for, yeah. Making a deadline, being late on my own deadline because I helped somebody else with something that frankly may not have even been that important. But I get it. Like just the, the want to, to serve others, you know, to help. So, you know, it, it certainly makes sense. And, and listen, I, I haven't said it much, obviously I haven't said anything on the show so far about it. I, I, other than that we're friends. I've known Ada a while. I know Ada because of Hotline. I, I'm a goon and thanks to Ada and I work on Hotline too. So it's something that we don't necessarily talk about much publicly, but it's, it's, yeah, it's what I do. You know, I, I had a friend and had sponsored me. To go be a floor goon. But then COVID hit, and so it wasn't going to happen that year. And then the following year, Ada had a kind of a public all-call, basically. I was like, I think I might be able to do this. I don't have your background or the psychology background, but, you know, that, that desire to serve, right? Desire to help and willingness to learn, which is a big part of this, you know, and not trying to solve all the problems, which I'm still working on my own personal life. So it's, it makes sense. It's, it's who you are and how you're wired, which is also how I know that Ada doesn't sleep. At DEF CON and she did it. This was probably the first year she had.

I will say that a degree in experimental psychology is a degree that doesn't help people. No, not so much. It's a degree, it's a degree where you research people, you know, like, uh, I think it was, it was, um, it was in that last lecture book. The guy said, the guy said, I'm a doctor, but not the kind that helps people.

He was like, he was a professor, right?

That's Randy Pausch, physics or something like that. One of those degrees where like, yeah, I'm a doctorate. I'm a doctor, not the kind of help.

Yeah, but that's not true. I mean, you, you do help people and so did he, for what it's worth. If anybody doesn't know the book, by the way, The Last Lecture. Highly recommend reading it. Dr. Randy Pausch wrote it not long before he died. It's a kind of a heavy book. He's a doctor in computer science. Again, I have Google, so I have huge advantages over here.

Okay. It was paid. It was sponsored.

I've got plenty of screens. So, but anyway, yeah. So I, I get to do those things live as we're going, but no, I, I get it. Like that, that makes, that makes really good sense. So, all right. So 20, 2017 is the, the discussion. 2018 hotline starts. As you said, there's like 7 people. It's, you know, No, we can go to the bathroom without AJ having to come back because you're just short on people. And then it's been building from then. If you had, like, how does the— what'd you guys use for metrics to measure? Like, how'd the first year go? Did you ever have reporting? Did you have metrics? Did you talk to leadership about this is what we did? And, you know, how were you guys able to— how were you able to justify and prove, hey, there's real value to this in terms, you know, statistical terms, so it could grow? You know, what kind of impact did you have?

Obviously without giving away too many, you don't want to talk about specifics, of course, but I mean, most of the time we take down how many calls, how many texts do we get in a year? Um, that grows every year. Every year it gets bigger. That number gets bigger. Um, the first few years, our, our real, um, metrics for word— this is working and we should continue doing it, um, tended to be the types of phone calls that we got. So like, you know, I think that year we had a couple of people come in with restraining orders from different states that they would like to try and see if they could have enforced, but that takes a lot of like legal going through the courts and stuff. But how can you help me with this particular restraining order? What we can, you know, we can try to do some amount of You know, telling the hotel about it, seeing if they want to do anything about it. And can we try and like, if you see this person here, come get a goon. Like we had some phone calls for like sexual harassment, various forms of misconduct while they're, while at, at DEF CON. Some of the things we can help with, some of the things we can't help with, but I think leadership still wants to know that those things are happening. Like, I can't really help if you were at a party offsite and drinks were spiked.

Right, sure. Right?

But it's nice for us to know that there's a problem we might want to think about. So just being able to have an idea what kinds of calls are coming in and what kind of assistance we can, we are giving. I think that really proves our usefulness for the most part. That's what we're on. That's what I'd be using for the most part to say, hey, this is what we're doing.

Well, I mean, it's grown every year, right? Leadership supports it. I mean, I know there's been, there's a report at the end, you know, last, last day of DEF CON at closing ceremonies that where some of these things we talked about.

And so, we try to take all these things that happen and say, here's some numbers so you can say, see what we're doing. And the problem is that even with that, we can't say like, here's the number of people who came forward with sexual harassment claims, and this is the ones we could help. These are the ones we could— like, that's not really useful data. But we can say, you know, what kinds of things came in, how, how, how are we helping as much as possible, and try to use that sort of as a deterrent as well. Like, we see you.

Well, that's a good point.

Stop doing these things.

Yeah. I mean, it's a good point. At least people know this exists, right? I mean, they're, they're there are two points to that, I guess. There's the, the comfort level. I mean, you mentioned earlier, you know, the reason for this, in part at least, probably in whole really. Listen, DEF CON can't just be a bunch of dudes. Like, it just can't be a bunch of, you know, white cis males running around, basically. So, I mean, I guess it could— any place can be— but there's names for organizations that are a bunch of just white cis males running around. And you need that diversity because that's what makes a better community, a better culture, a better business, a better everything, right? It's, is people that think differently, that act differently, that see the world differently, that have different points of view. And in order to do that, you've gotta create an environment where people feel like they're allowed to be there, that they're welcome, right? And, and DEF CON does a really good job of that. But a big part of that I think is, is because of Hotline, right? So that, so you have the one aspect of, hey, I wanna know that I can go someplace where if I'm not safe, I, I have somebody I can talk to who knows how to listen and will and, and can help. The other side is if you're kind of a shitty person, you now realize, hey, there's a place where people can go and get help if I'm a shitty person. So, you know, it isn't just like it's, it's me, them, or the cops, right? There's a, there's a lot of in between there. And it's, again, 30,000 people milling about. It's not like we have, you know, law enforcement all around that place unless they're undercover and has a whole different background of chasing down, chase the, you know, going after, spot the Fed. But, but I think you're right. There's a deterrent component too that, that shitty people might actually understand. They, they, they also could find themselves dealing with problems. They gotta, they gotta know, right? And so hopefully you weed out more of those and you, you make sure we have people that just wanna go and have a good time, man, and just learn and, and hang out and, and listen, if there's people you don't like and they're not your kind of people, fine, don't hang out with them. There's 30,000 people there.

Yeah, right.

There's a lot of people I don't wanna hang out with for various reasons. There's 30,000 people there. It's okay. You, you know, we talk about you find your tribe, right? You find your, your, your people. So I think that's really cool. Uh, and, and I know it's, it's been impactful. You know, I've, I've seen it. I've been lucky enough to see some of it firsthand. And some amazing people that I've gotten to meet and work with and learn from. Starting with you, obviously, which brings me to another question is you, you had 7 the first year, you've grown. How many did you have last year for hotline? How many did we have?

Not enough.

Well, that's gonna be, that's gonna be the third question goes, but how many, how many did you have now? Like, how many did we have?

Uh, I don't like to usually go into too many numbers about how hotline works because—

Got it.

You know, it's actually—

We won't go into specifics then. I don't, I don't wanna—

I just like to try to protect my folks as much as possible from certain things.

Yep.

So there's some amount of anonymity, obfuscation involved in that.

Yeah. I gotcha. All right. Well, let's, let's go to the third question.

We do have some good folks this year. Every year I feel like we get better and better people. Like, I think the first year I took whoever was willing and didn't sound like they would burn the place down during an interview. Because everyone interviews the first, right? And this last year I had to pick between like somebody with a degree in psychology who does counseling and somebody who had, who does side work working with people who have, uh, substance abuse problems. Like we had a lot of really good candidates. And so from year to year, I feel like the pool gets more and more competitive. Because we get better and better people that are, you know, just a part of the community who go every year because DEF CON is their tribe and that's where they want to be every year. And they still want to come back every year now and help out and volunteer. I had the issue this year of being like, I think we're almost full because so many people returned. Um, which is a good problem to have. Uh, but we are building in more fail-safes this year for people who get COVID the day of DEF CON.

I was gonna say, I helped you out not making, making sure you didn't have too many people. I went ahead and got COVID, which was delightful. I, I finished Black Hat. I actually went over to register for, for DEF CON, inhuman register, as we call it, for the, for the goons, picked up my gear, went home, and immediately tested positive for COVID. So I got my shirt and then spent the next 4 days in the hotel room, not allowed to breathe on anybody or talk to anybody or be of any real use at all.

And I gotta tell you, I feel like we had almost the right number for this year and then 2 people. Then I screwed it up.

Oh, we had 2 people. Yeah, it wasn't just me. We had somebody else who had an emergency. I remember that.

Yeah.

But yeah, I felt bad.

For DEF CON.

Never had worse FOMO than Vegas last year to be in the, and I was in the hotel. Like if I wandered around, I had a mask on. If I barely left the room for anybody wondering, but if I had to, you know, go downstairs, whatever. And I would see people. I'm like, I can't go over and talk to anybody. Like, I'm just— and nobody probably recognized me because I look like shit. I mean, I don't know how sick people have been, but nobody looks like themselves if you can avoid it. I had a hoodie on and just— I mean, I just looked like a troll who wanted to avoid everybody anyway, which is just slightly worse than what I look like today. But yeah, the whole FOMO was just unbelievable. I would see people, I'm like, God, this is what I should be doing. But nope, I'm gonna go back to the room and sleep for another 12 hours. Yeah, it was delightful. But at least I gave you the opportunity to have the challenge of not having a full staff. So you're welcome. I like to, you know, give you that chance.

We're gonna build in a little more One more question this year to make up for that.

Yeah, it's a good idea. It's a good idea. We, I know we had somebody a couple years ago, we got COVID too. One of our leaders got COVID 2 years ago. So it does happen. I, I felt terrible about it and surprised, frankly. I really didn't think I, I was one of those people, I tested like every day. I was like, I don't have COVID. It's gonna be quick. Every day I was testing, I was like, come on, I wanna get back in the game. Can't do it. I, I know what it's like now to be an NFL player where they take your helmet away and they'll let you back on the field cuz you can't pass your your concussion test even though you wanna go play. But anyway, so, all right, we, we won't talk about the specifics. That's good. Although we, we want a few more. So the question was, the last question I had listed up here was, you know, are we, are you looking for more people for Hotline? Sounds like the answer's yes. And, and based on that, like, how does someone get involved? How does someone volunteer? How, who they reach out to? What's the process and what's the timing if somebody wants to get involved in, in Hotline?

So the call for new people will go out. February 1st, uh, which is common for hotline. We start way earlier than most departments. Um, but it, it will go out. If you know somebody who works for DEF CON already, ask them to make the connection because that helps me have some referral. And if you don't, we usually post it. On, we used to post it on Twitter and we might again, but Twitter is not as good of a place as it used to be.

Right.

So I'm pretty sure we're going to post it on Twitter and Mastodon and Bluesky this year, I think.

Okay.

I think those are the places. So there should be a DEF CON hotline and social media, Thor, all of those places. And I think I also have one. So if you want to find me as well, there's an Ada Zebra, maybe just regular Ada Zebra on Twitter, but it's me. And there's Ada Zebra on social. Yeah. That's John and something similar on Bluesky. Yeah. I, I'm, I'm not a social media person.

Don't worry about it. Well, you know what? I'll, we'll gather it up when this, when the show comes out and, and you said, you know, the call start February 1st, which this show will be out after that. I think I'll get it for the show notes so that we have, you know, we can put in the show notes like, here's, here's some links, etc. Listen, when in doubt, if you guys don't know, like, ping me, like, my, my, and I'll, I won't be the answer, but I'll find you the person who's the answer, right? It's fine. You know, if you just can't find an answer and you're like, I really want to do it, AJ at Unspoken Security, I'll get you me, I'll, I'll get you to the right people. You know, what are you looking for?

That'll end up being, um, Set up for an interview.

Okay.

Because since it's a more sensitive nature job, we do like 30-minute interviews. Sometimes they go a little over, usually they're about 30 minutes. Then I set those up for mid-February, like February, and well, usually mid, because then I like to make choices by the end of February. It's like, can— yeah, it kind of goes fast-ish. But yeah, I think the, the, the call is always something along the lines of, you don't necessarily have to have experience with, with psychology or with this type of hotline because not everybody does, which it is nice to have, but it's not necessary. Um, but you might just be that friend that all of your friends come to when they have problems and they need somebody to talk to. Um, and we do have plenty of people who come through who are just that person, um, who just do an excellent job. And then once selections have been made, class starts. There's a class. It starts usually late March. It runs all the way to DEF CON, but it's like 1 hour a week. Usually we try to figure out when people are available so that we're not like, oh, you have to be there every day, every Wednesday at 2 o'clock Pacific or something. That is just ridiculous for everyone, right? We try to make sure—

Yeah, we have some people that are overseas, so yeah, it's hard to figure out those schedules, right? Everything from the West Coast to Europe, you know, adds up on this.

Last year we had to do one of those, so I think we were noon on Sundays because that was what worked for the majority of people. No, no. So we try to work around people's schedules as much as possible. That being said, there's always, you know, you can always miss a day if you need to, just as long as you let me know, cuz we, you can make it up later. It's fine. But it is, you know, several weeks of training and then practice calls all the way up to DEF CON. And then that's when the big show starts.

That's right. Well, yeah, and it's no joke. Listen, I, you know, the first year, so when I interviewed, it's funny you mentioned, you know, some people are, are just the friend people come to. And I'd say that, you know, that was where I fit in, right? I said, I don't have a degree in psych— psychology or psychiatry. I haven't, I haven't, you know, worked trauma hotlines or anything like that before. But I'm one of those people, or that a lot of people come to with stuff, I guess. And I, and I want to, to listen. I wanna be those people. But, you know, being transparent, we went through the whole interview process. I wasn't selected originally. I was, I was the first alternate essentially, or one of the first. I'll go with first. You might, you may have actually gone further on the roster.

I, I think, I think that every year I pick a couple alternates and almost every year each one of those alternates becomes full-time because somebody drops or something happens.

Yeah, well, they said this, you know, it's good competition. There's, you know, there's good candidates, right? And I remember, I remember our conversation. I remember the interview very well. And I also remember when you had to tell me I wasn't, I wasn't selected. And, you know, and I remember saying at the time, like, that's good. You know, obviously I'm disappointed, et cetera, but it means you got good people. Like, that's, that's the goal. The goal is get the, you know, the best people. And best is subjective, but you get good people, right? And if, if I wasn't good enough, well, if I didn't meet the mark, then that's good news. You know, like, I want people to get the best service and support they can get. It's not about me. I frankly, if somebody said, you know, got really mad about it, I think maybe that explains why they shouldn't probably have, you know, this opportunity or responsibility because it's not about me. But I remember having that conversation and then, and then I remember not, not long after when you reach out and like, hey, are you still interested? Like, and we had, we had somebody fall back and I, I was like, yeah, this is great. I'm, you know, I was excited. But it also, for what it's worth, I haven't even shared this with you. It, it probably was good for me cuz it, it allowed me to stay a little more humble too. Like, listen, I'm not even supposed to be here. Like, you know, in the positive way, not the, you know, this is not clerks.

I wouldn't put it that way.

No, no, you wouldn't put it that way.

No, you wouldn't put it that way. I say that because because I feel like we get a lot of good candidates nowadays, like a lot, right? And if you don't, I always, I'm always telling people is if you don't make the cut at first, it's not because you're not a good candidate. It's just because there's so many to choose from. And so someone might just have, you know, something special about them specifically that helps our team be able to do something specific better. It is the way all jobs are, right? Like if you're interviewing for any job, it's like, we went with a different candidate. Well, why? Because that guy knew JavaScript. I don't know, something, right? Like who knows what. And so a lot of the times that's the reason for rejections, that it's because, you know, I only had 2 seats and these 2 people had something specific about them. Yeah. Right.

No, absolutely. And for me it was good because, well, again, because the training, I mean, you know, you talked about training and And training's no joke. Like, this is, this is not, this is a serious business. You know, you get in and I remember the first year, you know, the training, it's, it's, you know, ADA has immense amount of experience and, and materials and it's, it's, it's a, it's a class, right? It's college. You know, it's, there's, there's, and you get to take it again this year. Oh no, do I? I thought I just had to do a role play this year.

Why?

Oh, it was a refresher.

Every 3 years.

Oh, damn it. Uh, it's good. I shouldn't say damn it. Now I said that live. Listen, this is good. I'm sure you're raving about it now. You could tell I hate school, but No, the point was it was really educational and it was good. And, and because I—

It's not graded.

You're fine. No, of course it's not. But because I think because I was the alternate, it made me go, hey, this is, you know, I probably took it more seriously. I feel bad saying that. Maybe I didn't, but I felt like I got things to learn. Like I'm, I'm lucky to be here. I got things to learn. And, and it was a really impressive, you know, course and it was, and it was, I learned a lot. And, and then you go through the role play and the role play, by the way, for anybody who doesn't know, of course, if even, even if you've been a goon, you've done the training, you've, you've been a hotline goon. Role plays every year. We all have to do the role play. So you do the book Europe every 3 years apparently, and then the role playing we all have to still do. So, and that's a ton of it, and that's where we challenge each other and we come up with great ideas. And in my case, you can be sure that I'm definitely gonna role play one character who's drunk and has lost their pants, cuz that's my typical thing for the moon every year is to give them one of those. I'm, I'm lost and I don't have my pants on and I don't know why.

I don't know why you picked that one as the one you do every year.

Cause it's funny and people like it. Listen, I think this year I had one that suggested there might've been a murder involved too, but It was like an abduction. It was a very weird one because it's hard, frankly, because they have to start with nothing, right? You're starting with the least information from somebody. First you have to figure out, are they in danger? Are they really, is it really a serious thing? Are they just drunk? Are they a goofball? Are they, you know, because people do prank call and all that stuff. It forces somebody to ask the questions, kind of root it out. And I have fun with it as a, when we do role play. But, but no, the point here being it's real training. This is legitimate work. This isn't a bunch of people who just come in and screw off and, and they're like, okay, now you're going to go help a bunch of people. Like I got a lot smarter. And, and better and more empathetic. And I still do working with people because of this role though. And you, you get to, and then sadly we hear some real stories as we go through and you really have to learn how it's, how it's done in real life. But I, it really matters. I, and that's kind of the point is that the training is important. It does matter. And as you said, yeah, the skills can be varied. You know, we have some people from all walks of life that do this and, and with various, you know, educations and skill sets. But I think everybody to my knowledge I think the thing that unifies them is what you said. Everyone wants to help, you know, it's, it's that servant's heart, that servant mentality in the room, which means we don't have like internal bickering and stuff. It's, you know, nobody's, nobody's trying to be right. You know, everybody's just trying to help each other, which, which is 'cause of you, frankly, to be honest.

You know, you created this. 'Cause you say so.

Oh yeah, no, it definitely starts with you.

I think that Hotline is amazing because of all of you, because the team is so great.

But you know, who created the team? Who selected the team? Who had the process? It's all right. I know you're not going to take credit. That's fine.

And you're right.

It's everybody, but it started with you. Like this didn't exist until you had the idea and put it forward. And it makes, it makes DEF CON a better place in my opinion.

I mean, you have your first year, right? And that's your noon year. Cause everybody still has to have their noon year.

Oh yeah.

And then not everybody makes it after their first year. Right. Uh, I don't think I've had a year yet where I've accepted all applicants. Um, and occasionally it's just, we sit in a very small room together for 8 hours and you were not a good fit for that.

Right?

Right. Like you annoyed every single person you worked with and everyone said no. That's why, like, I can't say it that way.

No, but it's true sometimes how I say it, right?

But like, that has happened in the past. It is like, it has been a reason for a candidate rejection.

And so you miss all your shifts, you show up late constantly, things like that. You're partying a lot. We haven't— I don't think we have that one, I guess. But, but no, you're right. I mean, it is tough. You got to be able to get along with people in close quarters for long periods of time, and oftentimes when we're very cold Or, cause the room's been cold.

Talk about that.

That was nice.

That's something they could have done either. I don't know how that was here with that one room.

Oh, it's so cold. It's ironic to be in Vegas and believe me, if you've never worked in Vegas, you know, I mean, everybody knows Vegas is hot obviously, but imagine going to work and it's 112 outside and then when you get to work you have to put on a hoodie and sweatshirt or sweatpants or whatever. I mean, we were, people were carrying other gear with them to work cause it's like 48, like what it felt like.

But I literally just walked into vend and was looking for sweatshirts, and I grabbed like 3 sweatshirts and brought them back to the room, and I was like, here guys, have sweatshirts.

I remember that. Yeah, that's true. Yeah, it's— I mean, listen, we get, we get good spaces, we're lucky to have them, but yeah, sometimes it's cold. But I mean, the point you make is, yeah, we spend a lot of time around each other, so there is something about being able to work with each other. And this is multiple shifts, so there's a chance that, you know, some people just work better with others. You can create it, but like you said, it's, it's a combination of being able to be good.

I can't always care do that, right? Because there's only so many shifts. And so, like, if somebody's not getting along a lot, then it's not like I can guarantee them they'll be somewhere else, right? And so that's kind of an issue we have with— yeah, because it's a small group, it's still not that big, like.

So that's true, and it's good. And, and so this isn't really part of the question, but I'm going to throw it in as a kicker anyway. How have you seen So 2017 was the idea, 2018's the first year. So now we're like, like 2025 here. So you're talking 7 years in. How have you seen the relationship between like the traditional SOC goons, the floor goons specifically? And by the way, for those who don't know, SOC, you know, goon is everything. Like vending is goons. If you're selling, you know, sweatshirts, they're goons. And there's people who, you know, information booth are goons and, and ticketing. It's all over the place, right? Everybody with a red shirt. But the SOC goons, the, you know, old school, like physical security, keep everybody safe, break up fights, guys, you know, guys and gals and, and, and hotline. Cuz a lot of these folks have to work together, right? These calls come in, they're security related a lot of times. How have you seen that relationship?

Technically, we're the same department.

True, true. We're a subset, but we don't sit around.

Yeah, because we're all security. We're all trying to make sure that the attendees stay safe.

Right.

That's the basic idea. Right. And we work with them a lot and they work with us a lot. Right. So like, we get a call that needs SOC, we call SOC, SOC sends people. Same vice versa, right? They have an issue that comes in, they don't think they can handle, they call on it. And so that's a very close relationship that we keep, like not even considered technically your own department.

Mm-hmm.

Because we are alongside the floor. And I think it's only gotten better over the years because when I first started, they kind of knew what, that we were there. But like not why.

Hmm.

Not everybody knew what Hotline was for, but over the years I've kind of built it up. Technically Hotline's only had 5 years.

Mm-hmm.

Because—

Oh yeah. Right.

Didn't run 2020. It didn't run 2021. Not that I wasn't working those years.

Aw, yeah.

Cause I still worked those years for various reasons. But over the years they've gotten an what we are, what we do. This last year we tried to do a lot more with making sure they knew who was on their shift because the year prior, I guess we had an issue where some of the hotline folks showed up to help with something that they'd been called for and people were like, who are you?

Right. So better coordination still. Yeah.

Like we're hotlines. Yeah. So we're trying to make sure that people know who each other are kind of.

And well, you also do an interesting program. Yeah.

It's one SOC, right? It's one team. Yeah.

You also do an interesting program that's, that helps with some of that cross-pollination, right? Because Hotline, yes, we're part of SOC, but we, we, we're in a different room because of, you know, confidentiality reasons, right? These are, these conversations are often separate, but we have a cross-pollination program that, that you started up with at least one of the other SOC leaders where, you know, Hotline goons do walk, walk on the floor with, you know, floor goons and get to learn what floor gooning is about and how that process works. And there's, there's that cross-pollination of learning. And we've had the same in reverse. I know some floor goons, you know, have been involved in, in our training. Exactly. Took the class. So I, I think that's been in the, I'm less time, obviously, but in the few years I've been involved now, to me, I think that's been the biggest change that I've seen is it, it's starting to feel more like it's unified, right? And, and people understand each other because this matters. Like you said, there are times when both sides, everybody's gotta be involved and it doesn't help if you show up and first you have to introduce yourself to the people you're, you're working with on the same team. That might not be comforting to the person we're trying to help if we don't even know each other.

It's also hard if like you're hotline and somebody calls up and you don't realize that SOC could help with this, like the floor could help with this, right? So if you're like, I don't know how to help with this, but the thing to do would be to call and be like, hey, can you send some people over to this? Like, you need to be able to know that. And the floor needs to know when they approach a certain kind of situation they can just be like, call hotline, make sure hotline gets down here. And so that has been part of it, right? It's easier to utilize each other's talents if you know what the other person does.

Exactly, exactly. I agree. I, I think it's improved a lot. I've seen it improve a lot over the last few years, and, and we'll continue.

We did lose one person to the floor though.

That, that can happen.

Yeah, yeah, because we had one person who did a ride-along, missed the call for hotline because they didn't know what their situation was at the time. And they finally decided to join back up. They asked if they could do the floor, and they liked it so much they stayed. And I'm like, they messaged me, they're like, is it okay if I go work for the— like, dude, do what makes you happy. Like, I used to do that job. I understand why it's exciting. I get it. I know.

Yeah. I, and I, I mean, I, I've done the ride along. I've also, I'm one of those people who, who often finishes shift and, and then walks the floor cuz I wanna be involved. I still wanna do it too. It's, it's tempting, right? So I, yeah, I totally get it and, you know, good for them that they're still contributing and they're involved and, and now they have this skillset too and they have this training that they bring to the floor too. And, and so that, you know, that cross-pollination helps because they can, better understand, you know, where, when do we need hotline, or maybe I can handle this thing, or, you know, where maybe it fits in. So I think that's actually a good thing. So, all right, listen, we're running out of time. We're getting close to the end here. So everybody in the show, every guest has the same question to close, and you don't get a pass either. So you're on board now. So the name of the show is Unspoken Security. And if, with that in mind, you know, tell me something you've never told anyone, something that's been unspoken. Don't, please don't confess to a murder or anything.

You asked me right before.

I know. I didn't give you any heads up on this one.

I didn't think about this.

Yeah.

I still haven't too. Um, I wish I was better at holding grudges.

Oh, that is the first, not only on this show, but probably in all of human history, I think, that somebody said that out loud. I wish I was better at holding grudges. Okay, I gotta hear more about this one.

Because like, I'll get in an argument with somebody, right? And maybe they hold it against me for a really long time. But like a week later, I've forgiven, I'm done, right? Like, it's fine. And some of the times, like, me trying to interact with that person later on is really weird because like I'm trying to be friendly because I'm like, no, I'm done, I'm done, pass it, we're friends now, right? Like, we're friends again, it's fine. And they're not. And I wish I could be more like No, I'm still angry about this.

You just want to be on the same page.

I just, I like, I'm, I'm over it. I like, I'm past the anger.

You're fine too. Where sometimes like you wish you could hold a grudge because like you regret forgiving somebody too soon. Like, I, I just can't hold this grudge, but I, I know I should. They're probably gonna hurt me again. They're probably gonna do things like, they have some of those.

I've had to literally set rules in my brain to not interact with certain people. I had a friend at one point in time that I didn't realize was a pathological liar. Yikes. Until I started to catch them in their lies. Not useful lies, really dumb ones, right? Like saying they were somewhere and they're definitely somewhere else. And I kept being like, it's fine, but it was not only hurting me, but people around me, that like I was just being okay with this. And so finally I had to set it in my brain that I can't be friends with this person anymore. I literally said it to them. I said, you told me this, that's not true. I need you to tell me that you were lying to me or we can't be friends. I don't care that you're lying to me, I just want you to tell me the truth, right?

Yeah, sure.

Trying to give them the benefit of the doubt that they could like give it to me for real. Like, literally, you were telling me that they were somewhere and the application that we were using to chat with each other gave me their location and it's not that place.

Oh God, that is pathological.

Like you said, tell me that this isn't true, that, that, that's not true. And tell me the truth this very moment and we can be friends. And then they couldn't. And so finally I was like, okay, I have to say we're done. And I have to set a rule in my brain that I'm not going to talk to you anymore because like, this isn't just hurting me. This is literally hurting my friends. I can't do this anymore. That's fucking really hard for me to do, to write someone off. I wanna be able to say like, it'll be fine. We can get over this. I can forgive almost anything. Right? Like I wanna be able to do that, but I can't always.

Well, you've taught me a lot in the time we've known each other. Maybe I can help teach you how to hold some grudges. Cause I, I can hold grudges with the best of them, I think. Maybe not something I should be proud of, but there are certainly some people who can attest to this who know me well.

I'm sure there are literally people in this world who think I'm mad at them.

No, I'm not. No.

Like, sorry, I'm just not.

Yeah. I, I think that's probably a good thing. Listen, your, your way's probably a lot healthier to be honest. Like you're over it. You're not carrying a lot of this, you know, anger and, and, and whatever it is that just poisons us. I've got, you know, a whole slew of grudges out there that I carry around with me. And so we should probably swap. Maybe you can try this on for a while if you want. You'll find it's not necessarily the right fit. And maybe I can learn how to let go of things a little bit better. Something I'll probably work on this year. Maybe I can slide that into Hotline training and see if you can help me with that during the classes someplace. Maybe that'll be my character this year when I call in as a caller. I'll be somebody with a grudge. Like 7 years ago at DEF CON, this thing happened and I'm still upset about it. I might write that down. All right, so listen, I appreciate this. This has been a great conversation. I, I think, I hope, I think a lot of people will enjoy it as well. I think people don't know enough about DEF CON, and certainly not a lot of people know a lot about DEF CON Hotline specifically. So it's a chance to, to, to let people know what this is and what we do and, and reach out if, you know, to, if you're interested in being a part of this and, you know, Ada will happily set up interviews and have discussions and, and maybe you can join the team and, and help a lot of people in a very unique and interesting way. Even within DEF CON, it's something that's just different from everything else. And I can tell you it's, it's been very rewarding and, and, and a I appreciate working with you and working with the whole team. You know, it's just an amazing group of people. So before we wrap up, just any last things you want to add before I just close out the show and, and go have dinner that smells really good? It's cooking over there someplace. That's true.

Uh, our signups for interviews start February 1st.

All right.

And we'll continue for a week, maybe two. Uh, and then, you know, you can always call Helen. Phone number is like everywhere at DEF CON.

So that's true, lots of stickers, all the bathrooms, all the— well, all the places we're not supposed to put stickers, they show up as well. But lots of, lots of, lots of stickers and handouts for people.

Program, usually it's on a billboard somewhere. It's— there are postcards at every info booth with the phone number on it.

Yeah, yeah, it'll be all over social media as well. All right, well, listen, with that, I'm going to close it up here. Again, thank you, Ada. I really appreciate you coming on and talking about this for, for basically an hour with us. It was great. For those listening, I hope this was, you know, entertaining and useful for you. And, and if so, please, you know, please follow and subscribe and tell your friends how much you love the shows. We can keep it going. If you don't like the show, just keep your mouth shut. Nobody wants to hear that shit. No, I'm, I, I say that every time, but really, if you don't, if you have issues or, or ideas to make it better for that matter, feel free to, to reach out to me and let me know, 'cause I am always looking for feedback. But with that all said, this has been another, uh, episode of Unspoken Security. Thanks for joining us.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts.

See you next time.