"Freedom In My Heart And Everywhere" Keynote by Karen Sandler

Karen Sandler's keynote about Free and Open Source Software and the need for their use in the medical field, as well as in other key sectors of our society, including personal use.

Karen M. Sandler was at the time the Executive Director of the GNOME Foundation and prior to taking up this position had been General Counsel of the Software Freedom Law Center (SFLC). Karen continues to do pro bono legal work with SFLC and Question Copyright and serves as an officer of both the Software Freedom Conservancy and SFLC. Before joining SFLC, Karen worked as an associate in the corporate departments of Gibson, Dunn & Crutcher LLP in New York and Clifford Chance in New York and London. Karen received her law degree from Columbia Law School in 2000, where she was a James Kent Scholar and co-founder of the Columbia Science and Technology Law Review. Karen received her bachelor’s degree in engineering from The Cooper Union. She is a recipient of an O'Reilly Open Source Award and also co-host of the "Free as in Freedom" podcast.

Karen's personal blog, GNOMG, can be found at http://blogs.gnome.org/gnomg/.

How is that, can you hear me?

Can I ask for everybody on the end

who has a seat next to them to move a little bit in

so that latecomers have a place to sit?

Just move in one seat.

As a latecomer often myself, it's a huge gift

if you walk in and there's a place to sit.

But not too much,

because I think they've shut the side doors too, so…

You're good, you're good.

OK.

I am really, really happy to be here.

My talk is entitled Freedom in my heart and everywhere.

As just said, I've been involved

in the Free and Open Source community for a while

I am the executive director of the GNOME Foundation

and we'll get to some of that a little bit later

which is really cool.

And I, for a long time, was a lawyer at the Software Freedom Law Center.

Resulting in eventually becoming general council.

So I had this really lucky opportunity

to get to know a lot of folks

in the Free and Open Source software community

by helping them with all of the crap

that they didn't want to deal with.

Really really fun!

I've been a Free and Open Source enthusiast,

I'd say, since the nineties

And I am also a patient

I have a really, really big heart

I actually have a huge heart.

So you think I work for non-profit

but I actually an enlarged heart

I have a condition called hypertrophic cardiomyopathy.

I always get a little bit nervous when I talk about that

because that sort of say

my heart is a little broken.

But it means that I have…

it's not actual. My heart is very thick

and that means that it has a hard time beating.

It's a little bit stiff.

And it's actually pretty fine.

I don't have any symptoms yet.

I just have a very high risk of suddenly dying.

The term is actually sudden death.

That's what the doctors tell you when you have HCM

and you need to enter in this life-long treatment.

They say you have a high risk of sudden death.

Which is really terrifying as a patient.

I have about a two to three chances per year of suddenly dying

and that compounds, so I've found out about this at age 31

and over the next decade it was sort of 20 to 30% risk of sudden death.

Really, really, just a scary thing to hear…

but there is a solution right now!

which is to get a defibrillator.

And what a defibrillator does is it's in your body

I actually did get one, it's right here.

It looks really huge there,

but it's about like this big

and it's right here.

It has wires that

sneak through my blood vessels

and scour into my heart

and it basically constantly monitors me

and it's like having people

following you around with paddles

and if I go into a sudden death,

it will shock me, and I'll be great!

And I won't die! it's very exciting!

So, all that is pretty well and good.

The electro-physiologist that I saw when I told this

has a bunch of these in his desk drawer,

just so he can pass it to every patient

because I think when you see how little this device is,

it doesn't feel so scary.

He pushed it over the desk at me,

I was sitting here with my mother. I pick it up…

He's like: "Pick it up, see how light it is!"

So I pick it up and I say "Cool, what does it run?"

Laughs

applause

To which I got a blank look.

My mother gave my a blank look.

Surgeon said "What are you talking about?"

and I said "Well obviously, "

"this piece of equipment is only as good as its software"

I mean, it relies on its software to know

when it is that I'm going to have a sudden death

whether it is that I run across the street

when I shouldn't have

or I decided to run a marathon

or for no reason at all.

I'm totally relying on this software to know

when is the appropriate time to give me a shock

and when it's not.

When I need pacing, maybe, or when I don't.

And the electro-physiologist, of course had no answer at all.

He said "nobody ever asked me this."

"I never thought about the software on this device."

"Hang on, there is a representative from Medtronic"

"here in our office today."

"I will get to him, because he is the manufacturer"

"and surely they have thought about this."

So, in walks this representative

and I sort of explain

"I'm a lawyer at the Software Freedom Law Center"

"I care about the software on my device"

"I just want to know: "

"how does it works? what does it run?"

"Can you tell me?"

And he said "Nobody's ever asked me that before".

So, we had this really interesting conversation and he said:

"I see that this is a very serious issue"

"Here is my number."

"Call me and I'll put you through"

"to people to talk about this."

Bolded by this, I called him at Medtronic

and he gave me the tech line

and so I kept leaving messages…

eventually, I kept being bounced around.

Nobody would talk to me about this.

I called the other two major medical device manufacturers:

Boston Scientific and St. Jude

and neither of them could give me a real answer either.

Eventually, I started calling and saying

"Look if someone would let me look at the software,"

"I'll sign an NDA", You know, really against my principles

Because, I'm a non-profit activist in the technology world

I don't want to sign any NDA which would prevent me

from sharing what I find with somebody else.

But I though:

"At least, I'll be able to see the source code"

"and I'll feel comfortable about what's put in my body"

But, unfortunately, I was brushed off. I was told no.

I talked with some people at Medtronic that were sympathetic

I had access to good doctors

People said: "Oh, you know, we're Medtronic"

We care deeply about making sure

that there are no bugs in the software that we put on these devices.

Obviously, we wouldn't release it if we didn't think it was safe.

All these things

You must trust us.

Doctor say, the Food and Drugs Administration,

the FDA in the United States,

approves these devices

So clearly, you're over reacting.

And when I was talking to that same electro-physiologist on the phone

and said I'm really troubled by this, because

I think about all the people that have these devices.

Some of them are quite powerful

Dick Cheney had one at the time.

He has a more impressive device now,

that continually circulate his blood

so he has no pulse.

It's a fascinating, fascinating device, yeah!

There are a lot of prominent people that…

the demographic that get this devices

are often in some powerful positions

So you can easily imagine a situation where

someone would be wanting to shut down these devices.

And the electro-physiologist that I spoked to on the phone
someone would be wanting to shut down these devices.

And the electro-physiologist that I spoked to on the phone

got so upset, he got so upset…

that he hang up on me.

He said "I think you're up to something"

"I don't understand"

"I don't know why you're so upset about this."

"If you want to get a device, I'll help you"

"But I think, I just don't, I think you're… you're…"

Hang up.

and I think it was really scary

because he told me at the beginning of talking to him

that he installed these devices all the time

He installs sometime several devices a day.

So the idea that he could be

not even asking questions

about the software that runs on these devices

was pretty terrifying to him.

So I put the whole thing off.

And I just said, you know,

I can't think about this.

It's so terrifying.

Am I really going to get

proprietary software in my body?

I don't know

Plus the whole "mortality thing"

and getting a piece of equipment

sewn into your body.

It's really a lot to deal with

So I kept putting it off

and eventually I couldn't anymore

because friends and family kept asking me about it

and saying "We're so worried about you"

"We know that you can die at anytime"

My mother, you know, off course don't have a land line

and I don't have a great mobile reception in my apartment

and my mother, if I didn't called her back within a hour

would start calling all my friends

saying "Have you speak to Karen today?"

"Do you know if she's OK?"

I went to brunch with a friend, and she asked me

how this process was going.

And I said "Well nobody from medical companies are calling me back,"

"and you know, I'm sure I'll work it out."

And she just burst into tears and she said

"You know, you could die. Today."

"and I just can't deal with that"

"If you don't take care of this,"

"I don't know if I can be friend with you"

"because this is a serious thing"

"and you're ignoring it for…"

what she considered to be an esoteric issue.

I really understood that and I really didn't have a choice

So I got a device

I got it implanted

and it took sometime to…

It took some time to recover from the surgery

and also to really think about

my own situation in a more abstract way

to do some research.

But I swore that if I got the device

I would do some research and I would write a paper

and I would talk about the issues that came up

that the medical profession

or at least the medical professionals that I dealt with

had no answer for.

So, the things that I found out when I wrote my paper were

things that would surprise you and things that would not surprise you.

Software has bugs.

I really wanted a picture of the crickets

that were in my room last night

that fellow keynoters…

*they are cockroaches*

They are cockroaches?

These are cockroaches.

*So where are they?*

But Paul and Jake got them out of my room.

So that was really exciting.

We were joking that I was going to talk about real bugs

instead of software bugs.

But, so, software has bugs.

And medical devices as like as Matthew Garrett said

will have bugs

because the software engineering institute estimates that

there is about one defect for every one hundred lines of code.

So even if a majority of the bugs are caught in testing,

even if three quarters of the bugs are caught in testing,

that's still a lot of bugs.

There's a study that I read that looked at

recalls of devices that were published by the FDA.

Basically, the study looked at all of the recalls

and determined which ones they can tell were from software failures

and then they evaluated those

and the ones that they could tell enough

about what the problem was from the software

ninety-eight percent of them would have been detected

with simple all-pairs testing.

So, basic testing that you would expect

for any kind of technical piece of equipment.

So yes, the FDA has some review over these devices

but if the companies aren't doing basic testing

what are we doing?

So, software has bugs.

We know this, here in this room.

Another thing that most of us here know is

that security through obscurity doesn't work.

And this is something that seems very counter intuitive

for the folks that are not in this room.

Every person who I started to about this in the medical profession said:

"But I don't understand:"

"Why would you want people to be able to see the software?"

"If people can see the source code,"

"it will be that much easier to break into it."

But as we all know, that's not quite true.

And in fact, by publishing the source code,

everybody can see it, it will be a lot safer.

But this is a major point that actually

I address in my paper Killed By Code

which go systematically through a lot of the research

that shows how security professionals agree with that assertion.

So, what we have is actually the worst of both worlds.

We have closed code, so it doesn't have the safety

of having a lot of people reviewing it.

But we also have no security on these devices.

A lot of these devices are broadcasting wirelessly.

That's the standard right now.

When I found out about that, I was totally freaked out.

What do you mean,

my heart device is going to be continuously broadcasting?

Thinking the conferences that I go to,

the people I hang out with,

I don't want my information being broadcasted.
the people I hang out with,

I don't want my information being broadcasted.

So this is one of the things I brought up with

the different doctors that I spoke to.

I actually, as you might imagine,

I got rid of that electro-physiologist that hang up on me.

And I went from cardiologist to cardiologist

to find someone who really understood these problems

or at least why I was so worried about them.

And I finally found a great cardiologist

and a great electro-physiologist.

Who said "I have never thought about this issue"

"but I understand why it could be a problem."

"You need this device. You can't wait another day."

"But I'm going to work with you and see ways"

"that we can at least address some of the things that you're worried about."

So, one of the things that my electro-physiologist did

was that he called around from hospital to hospital

until he found an old device.

So he said that I've got a simple heart condition.

All that I need to do is to have a device that's going to

be monitoring for a dangerous rhythm

and if I get a dangerous rhythm, it will shock me.

It's a much more simple algorithm than what the newer devices do.

So a lot of the newer devices have this

complex pacing algorithm for people who have a wide variety of problems.

You'd understand why the medical companies do this.

They do it because these devices are very difficult to make.

They're precision manufacturers.

And if they can get these devices that work for a broader range of cases

then that's all the better.

And then you never know what kind of additional complications

that people are going to be developing.

So, I don't have any symptoms now

but I might develop them

and it's great to have the pacing technology.

But my electro-physiologist, my cardiologist said

"Great, I now that you have a simple need here"

"so why don't I find you an old device?"

So I actually have an older device

that communicate using magnetic coupling

and not through wireless technology

but my father has a wireless enabled pacemaker

and when he walks into a room in the technician's office

they just change his pulse.

So, before he even sits down

they know so much about him

and they have the ability to really affect him.

It's incredible.

But as you can see at the last point on this slide

these devices have been hacked.

A university think-tank…

actually a think-tank of a couple of universities worked together

and showed that using just commercially available equipment

you can hack into these devices and take control of them.

They were able to not only deliver shocks,

which is terrifying.

I once had my device shock me in error
which is terrifying.

I once had my device shock me in error

and I can tell you it's like being kicked in the chest.

You are basically out of commission

at least for a few minutes

I had to sit down and it was so exhausting

just the surprise of it and the worry

that I went to sleep for a few hours afterwards.

It's pretty enduring.

So not only that.

They were able to deliver the shock,

but they were also able to stop the delivering treatment.

If the device was pacing, they could stop the pacing

and a lot of people require their pacing

in order to just live.
and a lot of people require their pacing

in order to just live.

A lot of people can't walk up a flight of stairs.

My father is of these, if his pacing is disrupted.

They were also able to get key information off

of these devices.

Like medical ID numbers, doctor's names,

serial numbers… a lot of personal information that's broadcasting

and there's no encryption of any kind on these devices.

It's pretty scary.

They were also able to put these devices into test mode.

And what that does is it slowly runs on the battery

Err… runs down the battery at a much faster rate

than in normal circumstances

and these devices are only as good as their batteries.

So if my battery runs out on my device

I need a new device, which means surgery.

So, these devices have be hacked.

It was after I was diagnosed that that happened

but then I called up the doctor and said: "See?!"

Clapping

So the doctor really relies on the fact that

these devices are approved by the FDA

in the United States, and similar regulatory bodies elsewhere.

So, as a good lawyer, I went and researched the FDA

mechanism for approval of software

And what I found, is that the FDA

doesn't even typically review the source code on these devices

Unless there is something obviously wrong with the software

they generally don't even ask to see it

There isn't actually a clear set of requirements for the software even

and there are reasons for all these decisions of the FDA

but we think the FDA is doing a lot more than it turns out that they are.

The fact that they don't have a clear set of requirements

is connected to the fact that

they say that the companies that design these devices

because they are so specialty

and because they are so particular to each manufacturer

There are probably tests that are specific to those devices

and the people who know these devices best are the manufacturer

and therefore they are the ones that need to design what the tests are.

And there is some back and forth

about whether they've done the right tests or not,

but the truth of matter is that at the end of the day,

there's nobody at the FDA that even sees the source code.

Because they are not requesting the source code

they don't even have a repository of it.

So if there is catastrophic failure at Medtronic for example

I don't know that there is a canonical repository

for the software that I would have access to

and without being able to update the software on my device

I may get surgery to get a new one.

So, if there is a problem

my doctor, or truthfully some programming-savvy doctor

I can find or would be able to work with

to write a patch for my device, should there be a bug

or should we find it out

I actually spoke on a panel, with a guy

in cyber-security at the FDA

and I was really, really nervous

because I did as much as I could as a lawyer

I did all the research I could about the FDA

but I was not sure if this was actually

the case in practice so I put up the slide and I said

John, tell me if I am wrong, but this is what I think it is.

This is the way I think it is!

And I followed with a slide about Free and Open Source Software

and why is it so much better, and so much safer

and as soon as he came up to speak he said:

"Everybody thinks that the FDA should do this, the FDA should do that"

"but we just don't have the resources"

"and that is not what the FDA is set up to do"

and he paused, and looked at me

and just as I was about to… you know.

And he said: "But you are saying something different"

"You are saying, we let everybody else review the source code"

"That is something very interesting!"

So, making sure that our devices have software published

means that anyone can review it

My dad, who has that pacemaker is also an engineer

and a fortunate programmer.

He probably would have looked over it.

Many of us know people with pacemaker.

we would scour that code, for sure!

One other thing that I found out

which is a little bit weird

is that because these devices in the United States

are approved by a federal agency

patients are preempted from suing under State True Law.

So there is a whole avenue of remedy that patients

normally get, which the medical manufacturers

don't even have to worry about.

So now, I mean, I am not saying that the medical device companies

don't care if their patients die, obviously they do.

But there is a whole part of legal remedies that aren't even available

Really amazing, this research, and I have all of this set out

in this paper I wrote that is available on

the Software Freedom Law Center's website.

All this results in the fact that I don't have freedom in my own body.

I am not allowed to review the software that is implanted in it.

It's literally connected in and screwed into my heart

and I can't take a look at it.

it's unbelievable to me.

My mind is blown at the fact that the situation happened to me

It is a little bit freakish that I was a lawyer

at the Software Freedom Law Center

and I happened to have this weird heart condition, I admit.

but still just mind-blowing.

I didn't even had a choice.

The choice was either, you're extremely likely to die,

or you can get this device in your body

I hope that nobody in this room has to face that choice, but it was

really, really scary.

And then I started thinking about it,

and you know, it's not just the heart devices.

It's anything that our lives in our society rely on.

And as I thought about it, I realized that this actually touches on

a lot more areas of our lives than I thought it was.

For example, cars.

Like the university think tank that worked on those medical devices

and I would say, if you have time in our board, you should totally read that study.

It's fascinating, they implanted that device into a bag of bacon or meat of some kind

to stimulate it and they show all the equipment that you can find anywhere

that they used to hack into it.

But the same process as done with cars.

And a different think tank showed that they were able

to hack into two different brands,

two different manufacturer cars.

So the IEEE says that a premium class car

has close to 100 million lines of code.

So if we think back to what the Software Engineering Institute said

about one bug for every 100 lines of code

that's a lot of bugs, just in your car.

And what this think tank was able to do,

was all the things you might expect.

They are able to cause the car to accelerate, to brake.

They were able to control each wheel of a car individually.

And my favorite part, just for kicks,

I don't know if you can see, but

they're able to put a message on the dash

and so, they said pwnd and there is a little

x-eyed emoticon there.

The idea that they are able to take control over

two different brands of premium class cars

is really amazing to me.

Voting machines is another area that is super critical

and we've actually been talking about.

A lot of security experts have been talking about.

the problems with their voting machines.

In the United States, we rely on Diebold

and a lot of private manufacturers.

We have had problems with calibration.

I don't know if you've seen, but there is this hilarious cartoons

of people trying to vote for the right candidate

and the name of the candidate they want to vote for

moving around the screen, you sort of trying to poke after it

and eventually, whatever you wanted to do it says:

"You wanted to vote for the opposite candidate, right? right?"

And it's very difficult to know because we sometimes

don't have a verification of paper receipt

we don't even know that our vote was counted properly

and we were able to vote candidate in the end.

Really weird, as this is the basis of our society

and the backbone of our democracy.

I love what they did in Brazil.

I don't know if you guys heard about this, but Brazil said:

"We know that software has vulnerabilities and software has bugs."

"So we're gonna invite teams of hackers to come in,"

"we're gonna give you the source code"

"and we're gonna give a prize"

"to anybody who find a way to…"

"who finds a vulnerability to get into the system"

All those teams, two of them were able to find bugs.

They say that neither of them would have affected

an election, but they were able to fix those bugs.

And those hackers got a prize.

Democracy is safer.

Security through obscurity doesn't work.

I don't know when we're going to figure this out,

but Brazil has got it done. So it's possible.

Our financial institutions, yeah, it's exciting!

Financial institutions are an other area we've seen recently

how bad it can be when our trusted institutions fail.

A lot of these institutions are running software

and our stock markets

and the operations of our banks.

These are all things that are critical

to just the way we live our lives.

It's more of a societal thing but we've already seen

that there are vulnerabilities there.

So, all this to say, it sounds heavy-handed

but my medical device can be controlled!

Our cars can be controlled and interfered with

and our financial institutions can be compromised.

I think we can all agree that our society and life-critical software must be safe.

But we're in a really interesting time right now.

Because how do we know what software that we use is life and society-critical?

The way that we use computers has totally changed

very very rapidly and very recently.

I've been astounded how people of all ages have started using computers

in a way that they never have before.

It's no longer specific tech-savvy people that are computing.

It's everybody, it's our grandparents, it's everyone.

And we're using our software for everything,

it's become how we do everything

How we communicate with each other.

How we talk on the phone

How we write, how we create art

How we handle our educational institutions

and how we manage our lives

We're building this infrastructure

and we're not really even thinking about it

A lot of people are using their phones to monitor things like their

exercise schedules and their diet

it's very convenient because you're keeping track of what you've eaten

as you go, or what you do

Some phone have pedometers, functionality built-in

and that's kind of basic and fundamental

but there is already software for the iPhone

that can talk to an implanted insulin pump

and compare your exercise and your diet information

with your blood sugar levels on your insulin pump

So now, suddenly, we're back to were I was with my medical device.

You got an iPhone that you're relying on for your life.

So, we're building all this infrastructure,

and we're willing to think about it

which is why the desktop is so important

This is where sort of all this all fits in to

my personal story and why I left the Freedom Software Law Center

which I loved and felt like the luckiest lawyer in the world

for being able to work there and been to the Gnome Foundation

which I also left.

And I say the desktop in quotes because I am talking about

these ways that we interact with our computing

in the ways that we manage our lives through software

We've reached the point where software must be usable by everyone.

I think everybody here

probably knows an older person, who as of a few years ago

probably never did anything with their computer.

My mother was one of these people.

I remember when I was a kid I kept saying

"but mom look at these cool games!"

"Not interested"

And I remember when I was in college and I said:

"Mom if we could talk by email, it could be so much better!"

Nothing…

I remember in Law School, I was saying

"Mom I can do all this great research using my computer,"

"I don't have to sit all day in a library, it's awesome"

Nothing…

Later I tried to say "mom I'm going to organize my travel using the computer!"

Suddenly, she was slightly interested

and now, with everything that has come to pass

she can't do anything without her computer now

Now, her computer has become…

The first thing that she does, she emails and text to her friends

she does her travels, she manages her finances

it's spectacular to me because

I didn't use my father because he was an engineer

but my mother was really a bit of a technophobe

And now she loves Apple

LOVES APPLE

She can use her computer to do… She doesn't have to think about it

It's great, and it's very frustrating to me

But I'm excited for her because she now can use a computer

and it's something she owns now

She doesn't ask me a question, well she does…

But she doesn't think that there is any reason why

these devices are not targeted at her

and she is very much a representative of the majority of our society.

And these are people, only a few years ago, would not have been

that able to do very much with their computer.

We need to appeal to these people because they are the ones

that are making choices like supporting iPhone

to put in their exercise and diet regimes to talk

to their insulin pumps.

These are the kind of things that we need to really worry about.

because if we can't make our software easy to use by everybody,

no one is gonna want to use it.

And we have an opportunity now

a window that is slowly closing

because we're making choices now

that we're gonna have to live with for a long time.

We're building habits, we're building expectations

and we're establishing the metrics in our society for what is

acceptable software and what isn't.

I'm not gonna read these to you, you guys are here,

at LinuxConfAU, you know all the awesome reasons

why you should use Free and Open Source software

You're here for all those reasons

including that it's just really fun.

We've been having a great time here,

and learning about all sorts of really cool things

but the underscore of all that

and where all these reasons can come from is from Freedom

Free and Open Source software is not just good business

it's also the right thing to do

So when we talk about our heart devices, we talk about our voting machines

and then we talk about the way we live our lives

and the infrastructure of how we talk to one another.

We see that Free and Open Source software is just

the right thing to do for our society

and in order to bring that to other people

we need to make sure, it's easy and clear for them to use

These are some screenshots from the Gnome 3 release which

Most of who I would say are probably familiar

with already and are forming your own opinions about whether

you… laughs

Gnome 3 is something that you want to use or not

and I think that no mater what perspective you come from

I think that you can see that the Gnome 3 rewrite is done

to address these issues, it's to make our software

sleek and usable by everybody.

I joined Gnome after the Gnome 3 release

and it was the Gnome 3 release

that made me realize that I had to go work for Gnome

because this is our future.

We need to cross the bridge, we need to be able to provide software

to people who otherwise wouldn't be able to use it.

We need to make sure our desktop are accessible by everyone

because we are not going to be able to build

the right infrastructure for a whole society

if we don't bring these people on board too.

This is a second screenshot.

It happens to be Marina from the Gnome community

and she's the head of the Gnome outreach program for women

which is an awesome program and is a kind

of thing that you can do in a non-profit.

But what you may not have seen is that

But what you may not have seen is that

we launched, very recently, an extension website.

extensions.gnome.org

where third-parties can upload

extensions for the Gnome Shell and it's a simple point-and-click

for Gnome 3.2

So you can install all those customizations

and we're trying to build the ways

that Gnome 3 is going to develop over time

So, even though we have a single Gnome Shell vision,

with what I think are great choices,

if you disagree with them, there is a way to implement changes.

Gnome, I think, and I think many agree.

I've actually had a lot of people looking at my computer

I've actually had a lot of people looking at my computer

over my shoulder and say

"Oh my God what is that, that's so great!"

"It's not a Mac, but it looks so good"

"What's the story with that?"

So it's beautiful, but it's a lot more than beautiful

It's non-profit driven

And in the Free and Open Source software space

we have a lot of different ways that we develop our software together.

Some of our projects are more on the Android

or Unity side of things

where they're mostly controlled by a single company

and there are communities that build up around that

but at the end of the day, the ultimate control

of the project is by a single company.

And then we have projects like Gnome that are non-profit focused

and this actually touches on some other stuff that Bruce

was mentioning in his keynote.

What you get for non-profit development, or having a non-profit

that unifies the development in the community is a lot.

And one of the main things that you get is to keep other trust

So the Gnome community for example,

the Foundation is composed of members

there is over 300 members and it varies depending

on where people are and renewing their membership.

But in order to become a member, you have to be a contributor

to Gnome and it's only available to individuals

and if you're a contributor to Gnome

you can become a member, which allows you to vote for

the Board of Directors which influences the direction of the project

help spread infrastructure to support development

and decides to hire people like me.

So who are out there advocating for the ideology of Free and Open Source software

and helping to organize this kind of effort

So if you imagine the situation now,

the Gnome community does not require copyright assignment

but if a non-profit community like the Gnome community were to require,

or were to accept copyright assignment,

those copyrights were to be held by a Foundation

that had an oversight by the contributors

by everyone who has a stake in the community,

by everybody who invest in it.

There is a certain assurance to knowing that the control

of a community is in a non-profit that is

focused on what the contributors want, diversely,

over companies.

I want to stress that I'm not saying

that companies don't have a very important place

in Free and Open Source Software of course.

Companies must be able to develop products

in the Free and Open Source community but we need to

encourage these non-profit structures which are focused on the ideology

and work with companies to help them accomplish their goals.

But under the rubric of non-profits the way that we have in the Gnome community

We have a lot of companies that are involved in Gnome,

on any Advisory Boards,

and are just good participants

but the overall mission of the Gnome Foundation and the community

is the public good.

We are a public charity, so we are focused on the public good

not on our profit.

We care about our profit but for participants in our community

but what it means at the end of the day

is that we want to make the World a better place.

Sounds a little bit hokey

but let's be honest, that where a lot of this

Free and Open Source software came from originally

ideologically that's why we have such great and cool software

We have to start thinking about making the World a better place.

So we, at Gnome, recently launched an accessibility campaign

We want to make 2012 the year of accessibility

This is a perfect example

Yeah, it's really cool work, it's super important.

*crowd clapping*

So this is exactly the kind of thing that a company

might not be able to afford to do

because it's not necessarily in the interest

in increasing the bottom line to work on specific accessibility initiatives

for smaller populations of people.

But we at Gnome understand that this is

incredibly important because a desktop that's not usable by everybody

is one that fails our mission.

So this guy is Robert Cole, he is super awesome

That's a picture of him in his family,

he was kind enough to come forward and let us use

his testimony for accessibility campaign

He was born with a vision defect

So he has no vision in one eye,

and very limited vision in the other eye

He was relying on some proprietary assistive technologies

at one point that were really working for him

he got a grant from his local government in order to

get those technologies and they were assisting him to work.

But then when his system upgraded, he applied for more funding

to get the upgrade of his assistive technologies and he was denied

additional funding.

And he was just out of luck.

Fortunately, Gnome has been a very accessible desktop

and he was able to use Gnome technologies,

and through that he became a very active member of the Gnome community

but with Free and Open Source software technology

whatever we develop is going to be out there,

it's going to be available, you don't have to rely on

expensive proprietary upgrades to know that

you're going to continue to be able to use your software,

should your overall system upgrade.

So making sure that this kind of work is done in a Free and Open Source software environment

is extremely important so we just launched

this accessibility campaign if you donate to Gnome

while this campaign is going on we pledged to use the money

to help develop assistive technologies.

So all this to say: let's choose freedom!

We can choose freedom, we in this room are a very special group of people.

While I'm focusing on what our users are doing and how we must bring our users all…

and I say the broad of users,

we have to think big, we have to think giant!

While we need to do things that bring our user base in,

people in this room are making choices everyday

I can't tell how many iPhones I have seen at this conference

how many Macs I have seen in this conference.

You know we have the technology, it's good.

I don't really tweak my desktop very much anymore at all

I've switched over to Gnome-shell and it's so sleek

and great and I barely use the command line

for things that are connected to my computing environment

and only then when I really feel I can't

It's not for everybody, but we need to choose

free an open platform, we need to develop on them

because it's the only way we're gonna create

these safer and better societies

It's the only way we're going to create a World

where we know that our software can be reviewed

and that it will have integrity

We need to build our communities in the non-profit space

Because we need to create those really good degrees of trust

We need to bring our ideology back into Free software.

Going a little bit out there, I'd say:

It's not about terminology, it's about ideology.

We really need to think about

making the World a better place because we can,

and we should.

I have this picture from the original Apple campaign.

Because it really strikes me that this woman

coming and taking her hammer and,

flinging it against the establishment and the machine

for individuality and our freedom,

and it really speaks to me now.

Let's choose Free and Open Source software

for ourselves, and for our society.

So the Gnome Foundation is a charitable organization.

We accept donations.

And my talk is freely licensed so feel free to quote it

and republish it.

Does anybody have any questions?

*crowd clapping*

Good day.

I guess I personally see it as a really positive future

because I think there is never going to be a year of

the leading desktop where everyone suddenly converts

but it would just be this gradual process.

in the same way that most of us have come to Linux

after some other proprietary process

I'm wondering how you see us engaging with not

the entirety of society, cause that's way to difficult

but what's the next age of the people

that we can engage with and that can then convert

their friends and their parents and so forth?

I also think that the next wave is that we need to get

into schools as much as possible

I think there are a lot of great initiatives to bring

our various free distros into schools

what really strikes me is that, in the United States in particular,

there are a number of non-profits that are set up as technology charities

and what they do is they bring Microsoft licenses and other proprietary licenses

to underprivileged communities and to schools.

They get tax breaks for doing that

What they're actually doing is creating a dependency

on proprietary software and it's a very clever,

very very clever technique

because we're training people to use certain kind of software.

We need to do the same thing.

I know there are a lot of great initiatives already.

Gnome has a number of initiatives that would do this.

And I'd say everybody get involved in your community

and start bringing our software into schools.

I think that a first step.

I think the next step is writing really cool

applications for our Free and Open platforms

If we've got the next cool thing,

then people would want to use it.

There are lots of different steps. I think you're right.

There is no easy answer to make

this the year of the GNU/Linux desktop

it just doesn't happen as easily as that

but there are things that we can do in the schools,

It's, I think, the first place we should start.

Thanks you.

Two things if I could. One is,

for us in Australia and other countries,

if the FDA has approved it, is that it?

Is that accepted here without us having our own standards and rules

setting the software, any of that?

So I haven't actually looked into Australia.

I should have.

I actually thought this morning that I really needed

to check the situation in Australia.

But I know that in any UK and other countries there are comparable bodies

the ones that I've looked in so far

also don't review the source code.

So they have similar review processes.

The FDA only applies in the United States

So each region has its own approval process.

But from what I've discovered, so far in the regions

that I have looked at, they are similar.

The other thing is that there are other areas

where software is extremely important

that you've mentioned during your talk

like avionics and gambling machines, and so on.

And in some places in the World there are

different rules, there is review of code and that

sort of things.

Two things out of that. One is it seems a shame

that there aren't general government standards for

software where it matters. Have you got any thoughts

on how we could make that happen?

We have to become real advocates

and what does really strike me is that

proprietary software companies have such an amazing lobby.

They have so much money that they can pour in

to making sure that the government is deeply

concerned about their innovative edge.

For their products that

they keep they proprietary incentives
For their products that

they keep they proprietary incentives

Medical devices is a really good example

of how that breaks down.

When you think about the business case

of medical devices, you sort of search and see:

OK, well I'm not buying my heart…

I'm not choosing the brand of my heart device

because it has the best software on it.

I'm choosing Medtronic because they have a good track record.

Because they are a precision manufacturer of really detailed equipment

and they have been for a long time.

If they published their software,

even if they've published their hardware specs,

it's not like Nokia is going to go and start producing medical devices.

And if they did, it would take some time

to get doctors comfortable that the fact

that they will be relying on them.

They're going to get support.

There's this whole issue of the fact that

these proprietary software companies have

a really strong lobbying force.

The only response I got from Medtronic so far

is saying: "Our business case relies on"

"keeping ourselves for proprietary"

In the United States there were a bunch of

Breathalyzer cases, with drunk drivers.

There is a driver who said:

"If you're gonna convict me on the fact that"

"this Breathalyzer said my blood alcohol level was very high,"

"I want to be able to see the source code"

"in order to determine whether or not"

"that was accurately drived"

The company fought it and said

"this is our proprietary technology"

"blablabla".

Eventually the Court said you must produce

the software, the source code and

what the Court found through their experts was

that the results couldn't be relied on.

Amazing stuff, and this happens in a lot of different jurisdictions.

In the United States, some jurisdictions say

you must produce the code, others say no.

But I think at the end of the day

we need to keep it in our dialog, keep asking these questions

throughout our different areas from

breathalysers to medical devices.

And being a really vocal community

about these issues is going to help.

We also need to organize from a lobbying perspective as well,

because there is just so much funding on the other side.

There was a question back there.

Oh, you've got the mic, OK

So first of all, I think that your talk was totally awesome

and thanks for expressing basically the core

of the Free software ideology which is that

Free software is about freedom including

the freedom to know how you're kept alive.

Which I think is really important, so thanks for doing that!

clapping

As far as the remote car exploit stuff, that's

actually from Alexei, Karl and Franzi in the lab

at UW where I work.

And those exploits were done remotely

through the telematics units in the cars so just

like cardiac-implants people can crash you car remotely.

It's like through a telephone.

Actually, I meant to get that into a little bit more detail,

but yes the control of the cars were remote but

I also want to mention that the HP printer exploit

that happened recently, where

over the Internet, folks were able to take control of

HP printers which not only were able to do all

kind of terrible things like being able to know what

you are printing including monitoring to see if you

are printing text documents and so determining

what information was included in particular boxes

but they were also able to set printers on fire.

laughs

They weren't? They were!

"There was a guy at the CCC that had a printer set on fire this year"

"Yeah!"

mumbling

"You should either talk into the microphone or ask a question"

The question I was gonna ask you is

You're talking about accessibility

and one of the things I've noticed is that

people that are blind are totally fucked

when it comes to using computers

and if you want to get a Braille terminal

it can cost somewhere like 6 or 8 thousand Euros to get them.

And there is one group in the UK that are looking at

building affordable ones, I think coming in

somewhere at a thousand dollars.

But I wonder what Gnome can do to make it

so that computers are really accessible in terms of

alternate methods of interfacing with computers

especially for people who are blind or unable to see

and I wonder if you can talk a bit about

Braille terminals and maybe making them accessible and so on.

I was gonna say this actually as a separate talk.

There was a talk on accessibility at this conference,

but I don't want to get into too much detail

about the particular initiatives, but with Gnome 2

there are a lot of assistive technologies for

vision or magnification.

Other types of software that are very helpful but…

and actually Gnome won several awards for

the accessibility of their desktop.

But while we rewrote Gnome 3,

we actually broke a lot of our assistive technologies,

as part of the necessity of starting all over again

and starting new.

So actually our campaign is much more basic than that.

I'd like for us to get there over time.

But we have some great software

but it needs help just to get working.

So the accessibility campaign

that we're running now is really fundamental

If we get a huge level of support from it,

we can hire developers to work on the stuff and

start exploring some of those particular initiatives.

But it's sort of like, now the accessibility

team at Gnome, at our annual general meeting

I asked them to give a little presentation

of where we stand, and the first slide was

a set of stairs.

So right now, we have a lot of work to do.

We need to bring our new system back to

where we were with Gnome 2,

and then we need to go beyond.

We're much further now, with Gnome 3

than where we were when we launched Gnome 2

and Gnome 2 went really far

but we really have along way to go.

So there was a question for someone right over there

who had put his hand up, and I'll be really fast.

If we can have one more question,

we'll have to wrap it up after that.

Thank you.

I am concerned that should your implant fail,

and you collapsed to the floor, I don't know what to do.

Is it just CPR or is this something else I should do?

That's a great question.

Everybody should be trained in CPR,

and I've became aware of this and hassle

the people close to me to get trained in CPR

when I found I had this heart condition.

So if somebody collapse in the front of you,

you should commence CPR,

you should check their life signs and follow that procedure.

For me, if I've collapsed now my device

will most likely shock me and if it doesn't,

if somebody performs CPR,

hopefully we can keep my blood circulating until help comes

and I can be shocked with an external defibrillator.

The truth is, it often takes so long

to get an external defibrillator

and to get people's heart starting again

that there is often some brain damage by the time that happens.

So that's part of the reasons.

There is one in the lobby.

And it's funny because when I walk by those

now I think: "Those are for suckers!"

I've got my own!

clapping

So, all this to say I am really glad

that I have this piece of technology,

and I'm glad that I can rely on it.

I just think it can be better and safer.

Thanks you.

Unfortunately, we're running out of time,

but a huge round of applause for Karen.