>>We are going to kick this off with Mr. Jay Healey, a member of the Defcon approval team. And he
is going to talk about some big picture stuff. I think this is going to be a really, really
interesting talk. Yes, sir. Well, I'm going to turn it over to number 2 who has something.
>> Will you introduce the speaker? >> So introduced. This is Jay. [applause] >> So, I'm
hoping this talk isn't going to be as lag as that video was, so you, get, well, good, well,
done. [laughter} Thanks. >> Okay, so raise your hand if you are a first-time speaker at
Defcon. Hey! We have a winner. We have a little tradition here at Defcon. First-time speakers
must do a shot on stage. Congratulations! >> Thank you everyone so much. So, if you
want to know how to be a first-time speaker and be on the CFP Review Board, the answer is
know the dark tangent, so. But the DT wanted something different, something new. New
tracks introduced to Defcon and if you read what was put in the program it won't be a surprise
what he wrote in this year's program. Last year the Dark Tangent wrote in the program
about how offense is overwhelming the defense. And he wrote in this years how this is
leading to a sense of helplessness. The Dark Tangent and others has said we can't
just submit ourselves to this helplessness. We all need to be part of the solution. And when
he says 'hack with us', he's not just saying take out your computers and go have fun, he's
saying we all need to own part of the solution. So a lot of the talks you are seeing in track 1
are about that. How can we get our legs behind responsibility or at least reasonableness and
make things better, because they're not. And so that is what this talk is going to be about,
so. And the reason he asked me to do this talk and be part of the CFP Review Board is, there
are all sorts of great efforts happening in this. Uhm, mine happens to be I work for a DC
think tank. We tend to do national security issues. So a lot of the other talks might be
from IM McCalvary to the CFF and they have their own legs in this. Ours is to look at the
national security lane. And look at the big picture. I have been part of the community, first
came to Defcon 2009, was with military signals intelligence. Did some offense, mostly
defense. Created the first military joint cyber war fighting unit in 1998. Set up
security in one of the big investment banks, went to the White House and was a director
of cyber policy for the president giving advise on these issues. So now I'm in a think
tank so I get to write and talk on these issues. Wanted to start out with a movie, anyone know
what movie this is? Uhm, yes. That's from Zoolander. What's happening here. It's Gas
Fighter! WHo said it first... come on. Come up here you get a free book. I wrote it last year.
It's a history of cyber conflict. Kind of a military history of cyber space. This is
the gas fight in Zoolander. And I wanted to lead off with this mostly because I wanted you guys
to be interested and what's cooler, gas fights are cool. So what happens in the gas fight
scene? >>[off mic] >> Yeah, these moron, male models right... my former colleagues
right but. So they are riding in this convertible and they think it's going to be so much fun
splashing each other with gasoline, and they are hosing each other down. And you know
it's funny, because you know you don't play with gasoline. And you know where this is going to
end up. You know this is going to end up really freaking badly. And of course a couple minutes
into the scene one of them glamorously takes out a cigarettes and paboom. And the
whole thing blows up. You know it's funny because you know what's coming. What bothers me
so much about this field we are in right now, is that all of us knows, in this room, in Blackhat
before this, in Washington DC, at Ft. Meade with cyber commands in NSA, in Moscow, in Beijing. I
think we all know we are covering ourselves with gasoline. We are playing with
gasoline. That we are all just coating ourselves in gas. And it's not funny, we all know
what's going to happen. From the research we did for the book, I can't find anything about anyone
really dying from an online attack. But, we know it's coming. And worse, a lot of the
people that are busiest spraying with gasoline are saying watch out because this is going to be
dangerous. General Alexander, the cyber command folks. It was funny when the models did it,
they were just going burn themselves up, but the world is relying on this stuff that we
built on the internet, cyberspace. So the folks involved in the gas fight aren't
just burning themselves, their going to burn all of us. What I think is very much missed when
I'm talking in Washington DC, it's our job to go around and talk to some of these
Washington, DC policy makers, pentagon, up at Ft. Meade, White House. THe debate is all about
cyber this, cyber that, cyber the other thing. And I always have to remind folks that the
internet is the most transformative thing that's coming out of human brains for
650 years. Since Guetenberg invented the printing press. Yeah, electrical power is pretty
impressive too. We will give the internet the top 2 or 3 alright. The most transformative
technology as we as human beings, all together have done. Because of the printing press,
it gave us the renaissance and the enlightenment and all of the ideals. The real scientific
methods, the Declaration of Independence, all of this wonderful art and science and
rationality that came out of that. But imagine if 20 years after Guentenberg invented the
printing press, it turns out the Pope, the Princes of Europe, pretty much anyone that cared
could know what was being printed, exactly who was printing it, exactly who they
were passing it to. Of course we can say that violates privacy, civil liberties, we can argue if
it's legal and constitutional, and people will. But I think that might be missing a larger
part. If you couldn't rely on that underlying communication mechanism, you probably don't
get the renaissance, and you probably don't get the enlightenment. You've changed
the trajectory of humanity - not for 5 years or 50 but for 500 years. And you've probably
changed the trajectory of humanity from then to every generation for when humans are
in the universe. So, we know how important the internet is. We know the threats it's facing. So
what I want to try and get across in this talk is to get together and bring across in
this track is maybe these threats are moor existential than we think. Maybe privacy
isn't the main thing at risk here? So of course we can argue we've been pushing too far
national security and spying and the cult of the offense and that's outweighing privacy and
civil liberty's. So, who's a Douglas Adam's fan? Alright, you got it first. You get a book.
I'll sign it afterwards. Yeah, that's someone else's problem. In DC I say I don't care about
privacy and civil liberties. Of course I do. I know Jennifer Granick has that... ah, there's
ACLU, there's a lot of folks that are going to to worry about that. Others have that voice. My
specialty is to say, maybe we are making tradeoffs today's national security at the risk of
our digital economy, our digital future and these future trajectories. Because I can't
walk into a 4 star general or the White House and start talking about privacy or civil
liberties. It seems muling. And you have generals from a militarized cyber power, which I
came from - right? I'm an insider to this, and if you go into these hardcore trying to
protect Americans from terrorists, you're not going to win this by talking about
privacy and civil liberties. If you say this is a stupid national security and why, you
would have a better case. The argument I'm trying to warm them up for is, we're making trade
offs for today's security and the internet as a whole and in fact our trade offs now between
security and the future securities till the end of human kind. And so I try to hit them
with the punch line, is that, when I hear people in Washington, DC folks say, well,
why should we stop if nobody else is going to stop. When I say, well maybe the future is
going to look very different. they say, no, no, no... it's going to be fine. Now how do we
know that. How do we make these tradeoffs. Whether it's in this community with security
researchers, hackers and the rest. In DC, the policy community, everywhere in between
and all the other capitals. How do we make these tradeoffs so security is better now so that
we're not going to miss out on future renaissance and enlightens, if all of us keep
pissing in the pool. So, I say 'saving from cyberspace'. What do I mean by that. It's great
when you do history because it gives you all the other slides, things people have come up with.
this is a slide from 1997, a defense science board. I love this, it's kind of if you go to
a threat talk. People are going to be doing this range. You get the evil hackers that you know
you'll hit with low potential damage, all the way up to state sponsored and not that much has
changed since 1997, [laughter], (unrecognizable) state sponsor, and for you young ones. That is
Sudam Husain in the upper left. If DC21 was your first one you might remember this. But also,
when I'm talking about trying to save cyberspace, it's not just about those kinds of threats. If
some of you went to BH and heard Jeff Moss kick off at BH, he asked the group and asked how
many people think we're going to keep adding complexity to the system. And, pretty much
everyone raised their hands. And then he asked how many silly chuckle heads think that there's
gong to be some limit to complexity. I think I was the only one that raised my hand.
Because he was asking if we think we will regulate or legislate and keep adding
complexity. And I think, I was in the finance sector, I know from 2008. that if you keep
adding complexity to the system and don't understand it, it can all come crashing down. And what
we might end up with, that looks very different. So one of the things I want to leave this
audience with is, be thinking of those discontinuities. The future may look very, very
different for good or for ill. And Dan Geer is one of my favorite folks, he passes gas
and my IQ goes up about 5 points, he has this quote I love. "As society becomes more
technologic, even the mundane comes to depend on distant digital perfection." So the same
time we are connecting everything to the internet, when we are most worried about the
offense running away. And so we need to be thinking of those longer trends. One of my
favorite quotes when I did the book, "Few if any contemporary computer security controls have
prevented a (red team) from easily accessing any information sought." Which by the way, I
think they have in the book store, called 'The Fierce Domain". Few contemporary
security controls can stop a dedicated red team. We know that, you're going to be hearing
that all the time, everywhere. This quote is from 1979. Lt. Colonel Rogers, US Air Force,
was the father of the rainbow series of manuals. You know, the red book, the orange book the
blue book... 1979. What he's actually saying here is the attackers had the advantage.
Offense has had the advantage over the defense since 1979. Before Defcon, since before
there was really an internet. So if you do defense, if you are an internet security guy, what the
XXXX are we doing? When I'm a glass half emptied, I say nothing I have done has
mattered. The billions that we've done, all the pattens that we've done, all the vulms that
you've discovered has been wasted. Now when I'm a glass half full, I at least say we are
keeping up. The attackers are better, but at least they haven't ran away with the field
yet. In Biology they called this the Red Queen affect. From Alice in Wonderland, you have to keep
running faster just to stay in place. But how long can a system stay in place? Keep it's balance
year after year, decade after decade. With one side have a persistent advantage and gain.
And that system can stay in balance. At some point you have to think this can change. So,
I'm a military guy. A lot of military history and it doesn't have to stay that way. That one
side has the advantage all the time, it doesn't have to stay that way. In human conflicts
since we first started, we picked up stone and stick to one another. The balance between
offense and defense changes all of the time. Except maybe nuclear and space. You know
riding a pony on a calvary and the offense would have the advantage until they meant mass
range of fire and then machine guns. It goes back and forth all the time. We can imagine this,
we can imagine that the defenders can have the advantage. We can flip this. So,
there is good news. We know security is getting better. We know there are places where we
are beginning to make a difference. We also know that the bad guys are running away
with the field. I love this Dan Geer quote, 'Whether in detection, control, or
prevention, we are noticing personal bests but all the while opposite is settling world
records.' We're racking up perusal bests but the bad guys are setting world records. But
maybe it's not just a simple straight line that the bad buys are getting better than us.
Maybe they are getting better exponentially than we are. So, I've heard some people make that
case. So where, do we hit that tipping point. When there's more predators than prey. Especially
when it turns out governments seem to be trying to be the most efficient and veracious predator
instead of protecting us from the others and being prey. So now you hear a lot of moaning
and groaning in DC about how it's the Wild West. Go how it's a wild west. It isn't the worst
of things. To wild west, because posse. Things worst than wild west. Right now, have advantage.
You can imagine a place where the attackers have supremacy, every time online strategy,
there's some asshole with an AK47 or machine gun on back of pickup truck rolls by. It might
be Somalia, a stable state, where every time we try and get our act together we get dragged
down. When I get asked for saving, when we talk about security, there's no time for ‑‑
most of us do incident response where time horizon is, how hell get serve back online,
forensics. We live on a timeline of, at best, a couple of hours, a couple of days, a couple of
weeks ahead. In D.C., saying a sustainable Internet. We need to make sure that it's not going on
just about there for awesome 2014. If we want our kids and grandkids and their grandkids to
have a free Internet, an open Internet and resilient an awesome Internet, we need to
start thinking now. That fits in with privacy. There's a lot of good efforts to try to add that
time horizon. When I think, generation or grandparents generation, some in the back
great grandparents' generation, they thought the national technology, jetpacks, vacation
on the moon and Mars. Why wouldn't we? That's the national direction that the technology is
taking us. So of course we are going to have those things in a couple of decades. It reminds me
of e‑Voting. In the mid‑90's, electronic voting, Internet voting, that's going to happen
and give us a new democracy. Where is it? There's all of these possibilities, all of
these technical possibilities that we're not going to get because we can't secure it.
Smart group Internet of things under so much of this unlock embedded medical devices. If we
don't unlock the security component. I'm afraid we're going to look at D.C. 42 and
look back 20 years and say can you imagine that we thought we were going to have those cars.
Good thing we chopped them up and proved how insecure they were, or whatever technology.
We're not going to get what we can unlock with these technologies. When it comes to
solution, to me the only vision, if you care about the future of the Internet is to flip this
around, to get defense better than offense. So the ass holes have the harder job '. What we
want is to get defensive and better. Get superior. We have the supremacy. So, I'll talk
about how I'm helping and some of my programs. Of course I will talk about how you guys might be
able to help. First you've got to believe that it's possible. In Washington D.C., I come
across very few people that think that the defense can ever get better than the offense.
They've given up hope. The DT wrote in this program, if we accept defense futile offense
wins, we all start trying as hard. I can see this very much in Washington D.C. if we don't
think defense can get better, then there's no reason for us to restrain our own offense. We
might as well be the biggest, baddest player in government, because everybody else is going
to do and we've got nothing to lose. So you have to care and think that you've got something
that can contribute to this. Especially joining. Your time, your brain, your patience. I
will talk about each one of those. Your time, there's so many great groups that are out
there, whether that's EFF, whether that's IM McCalvary, that's trying to get out and
saying we security researchers haven't done anything. We can't keep releasing this stuff
knowing that it's not going to get fixed correctly. We have to start feeling some ownership
over the results. The D T talks about that in the program. Or dedicating your time to some of
the volunteer efforts. Join so many other open source efforts. We might not have to go through
heartbleed. If we had more time, volunteer and monies and evolved in a lot of the open‑source
projects out there. World is pretty much depending on us to get this straight. We have to
feel some ownership for that. Patience, if you are a vulm researcher. We know the first
time you go to a company and say, I found a vulm, they might just brush you off. Have some
patience with them. We need to try and keep ‑‑ we need to have some patience, even when people
don't understand what it is that we're trying to do. Last is always trying to measure. I come
across this with security research as well. Folks that say we need Washington D.C. to
understand the importance of what we do so that they don't criminalize the kinds of things
that we do. That's a great panel, if you see something, say something should apply to our
field too, and we shouldn't run into the CFAA and other laws. The stuff that we're doing
really matters. What you are doing as bone researchers. To me, when I say how do you know
as a security research community that you're making a positive difference? That you're helping
the defense more than you're helping the offense? I get there is this one time, and I knew
this guy, and the role of importance that we're traveling in society in the digital future
and we're all trying to build together, we need to move past anecdotes and showing the
difference that we make. Anecdotes aren't going to cut it anymore. Obviously, not everyone
is going to measure. No everyone can feel ownership. No everyone is going to want to dive into
this. There's a lot of great efforts and ways you can dive. What I am doing in Washington
D.C. is policy makers, push the idea of sustainable cyber space. Defense is better than office.
The way to do that is to try to work on the scale. Have them succeed a million times or a
billion times, and you will see some of that coming up in this track in this room today. For
example, I'm interested multi-compilers - in things where we can take away entire
classes of attack that no longer succeed, instead of just trying to always patch and being
behind. I'm trying to convince D.C. that they are not as much of the solution as they think
they are. That there's nine players on the ball field. We don't need one general running
around every where running around saying, I got it. I got it. There are many that can be
close to the ball and make the play. If they're allowed to, or 'they're allowed to, maybe they
can't see the ball well enough. Maybe they need a better glove have glove. Maybe they need to
be reminded they are on the field. That's how I was when I was on the field as a kid.
[Laughter]. But pushing this as a private sector, not saying the private sector doesn't have its
own problems. I'm tired of hearing in Washington D.C. that the private sector is the
problem. Last, or I'm trying to push hard in D.C. for a single ‑‑ right now we have
three strategies for the Internet. The state department talks all about Internet
freedom. They get involved in I can an some of those issues. You have department of commerce get
involved, good broad band. They vaguely own the I K relationship. They're focused in
on those issues. And of course you have the military and espionage. If you have three
different strategies in your life, tough when you have competing priorities. Our
leadership in D.C. needs to understand that right now whenever there's a competition
between these priorities, between the military and espionage tend to be winning
out. They have the most money and the post competence. They have the best lawyers willing to
get T S. The lest bureaucratic friction. We need to change that around. I'm going to try and
help break that. The tagline is going to be prosperity first and foremost. Thinking about how can
we make sure the Internet is going to be there? I do think distruptive technology as has
its place. This is a point I made more rat pack than here. We have community vendors that have
a new box, script and software for a particular solution and we keep adding complexity on type
of the complexity, so disruptive technologies can work, but they have to be the kind of
technology that works at scale. Thank you very much. (Applause). So that gives more time for
shots and for Q and A. I think Bob, who is running the room, go to the mike so we can make sure
we get it on the video. I will go to my right. If you are all buying me shots, try and
coordinate on the same kind of alcohol. [Laughter]. >> So a question is whether or not we're
asking the right question. Defense or offense. The first thing you learn in the military
history is a doctrine that says anybody that does merely defense is inevitably going to lose the
battle or the war. We've stuck with this for a long time. We have issues about realtime in
gang meant. That seems to be shifting with the cyber command starting to attack some of the
nation's data base, A P T teams. So I think that the entire formula changes once you start
going with offense yourself. It's the offense that's attacking you, and you can also,
to use an example from military history, do what China always did, don't try to stop them at
the perimeter. Let them come in and exhaust resource to take over. There's all kinds of ways
to create resource exhaustion. >> Certainly, we want to change the work factor between the
offense and defense. One way to raise it is to try and disrupt them. On a ‑‑ when I'm in my
month moments that says an armed society is a polite society. I'm not convinced that we get
at‑scale defense better by attacking them. Defense doesn't have to be hard. We just suck at
it. One of the reasons, now, why the Department of Defense is being more authentically minded
is they can't defend their own systems. I am not a fan of saying, as an enterprise, as an
individual corporate enterprise or as an armed military with uniformed people with an
American flag patch on their shoulder saying we should that we should do destructive attacks
because we are not good at defense. It has a role. I'm cyber war fare, cyber, cyber,
cyber, so it got a role, but we're defaulting to it because we suck at defense. That pisses
me off. We got to go back and forth. I'll be outside here. >> The technology we should be
develop, this, you have any particular recommendation? Are we thinking large scale? Should
we look at very sophisticated intelligent, automated analysis of code, before it gets deployed
to? What do you feel is the best way forward that we can help develop? >> It's a great
question. Some of you guys that are closer to the technology than I've gotten in D.C. can
have better answer. The kinds of things we can taken tire class of attack. I'm not convinced the
inspection for that. If the world's ISP run as cleanly as Scandinavian ISP, we would have
a lot less problems. We would have a lot fewer problems. I'm interested in ‑‑ we've got a
couple of other talks that will be in this track that are hitting that, I think, focussing
on ISP's. It doesn't have to be technology. It's ownership and a willingness for responsibility
to no longer pass the trash. It's not crazy in Washington D.C. to talk about zero nuclear.
We won know we can't get there. I like to set goals that we can get to zero (unclear). If we
said everybody come to the table and try to get buttons out of the systems, we could do it. One
of the reasons I'm here is to find out what are some of these other changes of attacks that
will ‑‑ I'm sorry, attacks that we can just take ‑‑ whether it's. >> If you are interested
in getting the private sector, how are you incentivize the public to security over
functionality? >> That's a great question. One is to look that we've got different parts of the
private sector. Washington D.C. tends to paint ‑‑ there's a couple of things that I would
do. One I would launch the department of home land security set up a program. You can take
$10 million dollars to look at group like open source vulnerability database. These
groups that are actually on the ball‑field and making the plays and making due with $10,000 a
year. So, one, let's find out who is playing on the field. Who is close to the ball and help
them out'. Two, this is if I were D H S in the White House, I would be convincing Warren
Buffet and ‑‑ these people that are shareholders in the companies that are making these
bad‑risk decisions. We still see Washington D.C. say we to have convince the system
administrators or chief information officers to do the right thing. Screw that. In
American style capitalism, it's the shareholders at the end of the day holding the risk. They
own the company. We are board directors of representing them. I say don't let the government
try to convince the board directors, go to the shareholders. Before Y2K, the
California pension retirement system, $250 billion went to all of their companies and said, how
are you getting ready for Y2K? Let's get Warren Buffet and say I'm not going to invest unless
they are getting cyber security right. We have a couple of ideas we can incentivize using
process. We can talk about that. >> Earlier you said that when you tell the military to obey
the laws in the United States, it seems muling, and in your response write will you said the
shareholders of the corporation hold the board of directors responsible and do what they do.
What good is all of your policy and talking if the United States military will not obey the laws
that exist? Aren't your words just weak aren't you just dust of nothing if Clapper and
Alexander Congress, lie to us >> I'm not saying ‑‑ >> Of nothing, if Clapper and Alexander lie to
Congress, lie to the court and us. Shouldn't we start with accountability at the type
instead of creating a bunch of tracks in the dessert. >> It's a mix. All of us, from whatever
angle we're trying to take, have the decks stacked against us. I'm not saying I'm coming win
the strongest argument. I am coming with an argument that is more likely to win in Washington
D.C. So I came out probably a year ago now and said General Alexander, forced to retire
earlier. We need to separate at least the leadership of NSA and cyber command as a start. We've
got to start from that. And it ended up that the ‑‑ the president made other decisions
on that. When I came out with that piece, I had people all over Washington D.C. saying, you
can't use my name with this. But good job. Don't tell anyone I said this. So there is a
groundswell of folks who said we have been going in this direction and it's not
necessarily the right direction. Folks that say, let's talk to four‑star generals that have
said, how we got where we are is like a French Post painter like Georges Seurat. The guy that
mask all the dots on the canvas. We never stepped back to look at the painting that we were
actually making, especially the way others saw. I'm not saying we're going to have an easy
time, but there's a lot of folks that believe the way that I do in Washington D.C. that think
we're badly off track. It's a part of my job. In fact the DarkTangent job, senior
associated with my program. We're out trying to make this case. We'll try and, we'll tell
you next year how we're doing. Alexander Clapper's in jail. >> How do we take the example of
Switzerland as a nation state defense great e than offense in history, cure the, Defcon, to
use that model to make a better and cleaner internet. >> I like that, that hadn't come up
before. Switzerland has made themselves undevourable. Great chocolate but. I love this, your
laughing at all my jokes. They're absolutely between a mystery of terrane, weaponry
saying we are too difficult to target. Individual companies have been able to do that in the
Internet. I'm saying we're too tough. Look some where else. That doesn't work quite so well.
I love that as a model. How can we take that and read out and see if we can make that work on
the scale. >> It seems like a combination of apathy and ignorance. >> Yeah. >> There's a
saying that if creditor is too successful in the short term, he's going to starve to death in
the long term. I'm wondering whether that concept has been part of your research when
you're evaluating what the tipping point is going to be? Is there going to be a tipping
point or after a certain point, is it just going to come into equilibrium? >> That's what
happens to predators, too voracious, resource depletion. We're the ecosystem. It destroys
it. That's what I'm worried about at the end of the day. They're not going to exhaust
each other. They will eat our servers out of existence. I was talking to one of the four‑star
generals and they say, Jay, I get it. If I'm fighting a naval battle or an air battle, not
given civilian ship to sail or fly through my battle zone. I get there there's a difference.
I say to them I'm sorry. That's the wrong analogy. You are sailing or flying through an
Internet that we built, that companies built using our own money. They're not sailing or
flying through your battle field. You're sailing in our ‑‑ in the sea that we built. And
that's what's going to get that resource depletion. I'm interested to know about what
that looks like. Go to my right here... >>Here at DEF CON you have an army willing and able to
implement technical solutions to this problem, but on the societal and political fronts,
what does the army look like? Is it strong with their strategy? >> There's not a strategy yet.
That's part of what I'm trying to bring together. That's part of what the DarkTangent is
trying to bring together. When he's talks about why he spent time in D.C., trying to social
engineer Washington D.C. Kind of learn their ways so he can manipulate them. You have a lot
of folks from the White House and home land security and other places, so it's starting to come
together. But I think at this time's still, it's still not an army yet. And the more that we
can hear the voices from the community, like, for example, in Germany you have the computer
club, I was told the other day has a much stronger role. In other countries, some of the
companies have their own governance and we're not going to get that there. >> So is a
technical solution enough? >>I don't think we can invent our way out of this, because the
government, all governments ‑‑ I got the one minute. The coercive power of government right now is
winning. I'm not saying, by the way governments are the only threat. They are amongst the
threat that we're facing. But the coercive power of governments is showing itself
begin and again to be superior here. It isn't just in the field. If you look for example
across the average spring, if you look across all the revolutions, it was people
spouting liberty and freedom and force cannot bring us down and nothing was ever won with a
bayonet, now they are finding in Egypt and Libya and other places, the bayonet does
sometime have the last say. We as a community can not sit back and say well, our free speech is
going to win out in the end, because it's not. The government has a lot of coercive powers.
China and other governments have way more. I don't think we are gong to talk our way out. Thank
you very much. (Applause) [End of session]