Chaos Computer Club - recent events feed

*WHY* did I donate a kidney? *H*ow did I donate a kidney? *Y*ou might want to donate a kidney! Donating a kidney is quite a thing. But it also isn't. But mostly, it is. I will talk about all the aspects (personal, technical, logistical, ethical) of the process. Lots of related but entirely different things. How does it affect me? How long did it take? What does everything look like? What do the numbers mean? What does it feel like? Can you do the same? Should you do the same? Who shouldn't do it? WHY? Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/WJQNXZ/

We present EntrySign, a cryptographic flaw in AMD’s microcode patch verification logic, including how we discovered the bug and how you can extend our results. EntrySign lets us execute arbitrary microcode on all AMD CPUs from Zen to Zen 5 and modify the behavior of x86 instructions. We will delve into the format of AMD microcode, how their patches are verified, how we were able to reverse engineer this process, and how we were able to access the key information required to defeat it. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/9WTQU3/

The WHY2025 Capture the Flag competition (CTF) has multiple lockpicking challenges as part of the CTF. Successfully picking these locks gives you one of the flags. To be able to create a solid CTF challenge out of an ordinary lock we had to come up with some kind of solution. We used our past experiences in CTFs as inspiration to see how we could do it better. This talk shows the concepts we came up with and which are currently used in the WHY2025 CTF. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/8VGLJQ/

Zero Trust (ZT) is a security paradigm gaining traction and popularity. In the talk I will show how ZT is the progression of many security ideas that you may already be familiar with, and how you can rebrand and review what you are already doing to show that you are making progress. Zero Trust (ZT) is a security paradigm gaining traction, especially in the US defense community. The underlying idea is to reduce implicit trust as much as possible. This makes great sense from a security perspective. Its implementation is daunting though, because it is not about dropping a new product in the security landscape. Instead, it is more an approach and a process. It is still hard to prioritize ZT and to retrofit it to existing system architectures. In the talk I will show how ZT is the progression of many security ideas that you may already be familiar with, and how you can rebrand and review what you are already doing to show that you are making progress. Outline: As a contributor to the Cloud Security Alliances Zero Trust cert (CCZT), and experienced instructor, I intend to borrow from the (public) body of knowledge and my experiences in teaching that. This will give the audience a good insight in Zero Trust content and trends. This will include - the core idea (never trust, always verify) - the major use cases - business value of ZT - steps in implementing - publicly available maturity models - example implementations and status thereof (e.g. US Airforce) - link to earlier principles - retrofitting ZT on an existing application - experiences Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/BVSMJZ/

Smart devices are deeply embedded in the physical world: they can see, hear, and control things around us, often with zero real limits. When they’re hacked, it’s not just your data on the line; it’s your safety, privacy, and environment. In this talk, I’ll share some new ideas for putting a layer of access control between these devices and the real world, so we stop giving them a blank check. These days, “smart” devices aren’t just watching and listening: they can act on the physical world, often with zero meaningful limits. They unlock doors, adjust thermostats, steer vacuums, and record what’s going on around us 24/7. When these devices get compromised, and many do, it’s not just boring data on the line. It’s your safety, privacy, and physical space. The problem? We’ve handed out root access to the physical world like candy. Any device can sense or actuate whenever it wants. There's no layered control, no boundaries between software and the real world. If malware gets in, it gets full access to your home, office, or anything else the device is wired into. In this talk, I’ll show how we can fix that by treating _sensing and actuation as privileges_,not defaults. Instead of giving every device free rein over what it can hear or control, we can build mechanisms that require software to explicitly request, and be granted, access to the physical world. That access can be temporary, conditional, or denied altogether. We'll look at how to physically separate sensors and actuators from the software stack so that even if a device is compromised, it can’t automatically reach into your environment. We'll also explore approaches that enforce forgetfulness: ensuring that standby devices like smart speakers can’t quietly hoard data or leak it when compromised. If nothing relevant to the device's task happened, nothing should be remembered. The goal is simple: to take back control from black-box devices and start designing systems where physical-world access isn’t assumed, it’s earned. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/AUF93C/

Prins S. en De Geit is one of the most exciting acts in the Dutch music scene today. This trio from The Hague — fronted by Scott Beekhuizen, with Marne Miesen on bass and Daniel Ortgiess producing — creates infectious electro-punk-pop with sharp lyrics and unrestrained energy. Their bold sound and theatrical performances have electrified festivals like Lowlands, Rock Werchter, Pinkpop, and Appelpop. Their WHY2025 show promises to be equally wild and unpredictable. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/S8WQTC/

So, it is 2025 and mailservers are getting more and more replaced by cloud-based solutions, which promise to be easy and secure... But what if you can just do it yourself? Hosting your private message server and applying common modern mailserver security practices on your own? This talk wants to introduce a few common software solutions and introduce multiplie techniques from an operators toolbox. This talk will cover typical pitfalls you encounter if you try to host your own mailserver solution: Often, those issues are only noticed by users not being able to sent emails successfully - let's go ahead and learn about those beforehand. Starting off with the basics of secure mail transmission using (START)SSL on top of SMTP and advancing into DKIM, SPF for secured mailserver origins. Then mentioning a few nice-to-have tools for delivery monitoring like DMARC and Postmark. Then being careful with DNS configuration and RFC-restrictions quickly overlooked. Furthermore, let's take a look into TLSA for SMTP, BIMI or complex setups with satellite delivery systems. Finally, let's discuss user-based security with locked-down IMAP, PGP signatures and encryption or enforcing secure connections. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/HXDAMY/

Passkeys are a new way to log in without passwords. They solve a lot of the traditional security risks associated with passwords. But passkeys are only secure if implemented well. When implemented incorrectly, they lead to new attack vectors that hackers can exploit. In this talk, we will first study the protocol behind passkeys, called Webauthn. We will then look at some common implementation mistakes, and how we can exploit them. Next, we will present a methodology to carry out pentests on Webauthn implementations, and finally we discuss some vulnerabilities that we detected (and disclosed!) in various web applications. This talk is based on joint research with Peizhou Chen (University of Twente). Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/WD99DB/

Why limit yourself to Ethernet and Wi-Fi when every wire in your house can carry packets? This talk explores alternative physical networking technologies that exist but are often overlooked. From Powerline Networking (HomePlug AV/AV2) to MoCA over coaxial cables, we’ll dive into how these systems work, their encryption and security models, known exploits, and the inherent risks of non-switched cable mediums. Beyond the theoretical, we’ll examine real-world applications, including whole-home audio and video distribution, network segmentation strategies, and the unexpected advantages of leveraging existing infrastructure. You’ll see how HDMI matrices, IP-based video distribution, and networked audio solutions like SONOS Net can integrate seamlessly over alternative backbones. We’ll cover segmentation techniques to isolate security cameras, IoT devices, and AV distribution, ensuring efficiency and security. Expect deep technical insights, practical lessons from years of experimentation, and a fresh perspective on what’s possible when you stop thinking of cables as just power or TV lines—and start treating them as network highways. Whether you're looking to expand connectivity in a complex environment or just want to push the limits of home networking, this talk will leave you with new tools, techniques, and ideas to explore. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/DJ7NXK/

Digital money everywhere, all the time, all at once... isn't it getting a little boring? In this talk you will learn how [GNU Taler](https://taler.net/), a privacy-focused payment system, leverages the properties of digital tokens and blind signatures to enable a wide array of use cases such as discount coupons, subscriptions, and tax-deductible donation receipts; all while preserving untraceability in customer-to-merchant transactions. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/PHGSJC/

Love reverse engineering? You'd be right since you always find something interesting! In this talk we're going to study absolutely every byte of the DNA source of a real bacterium. And in doing so, we'll find bootstrapping code, genes, duplicate genes, anti-viral defense mechanisms, idiomatic/non-idiomatic/borrowed code & much more. It helps if you've also visited the companion talk on DNA, but this presentation is broadly accessible even without prior knowledge. A typical bacterium has around one megabyte of DNA as its source code. And with our digital reverse engineering hat on, it turns out we can analyse this code and quickly learn things. Where do genes begin and end? What is the stuff between genes? How do bacteria bootstrap themselves? And, where do microbes store their immune system? Using digital skills, all this can be found just by looking at the DNA letters. And that is what we'll be doing in this talk. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/LUXFSP/

During the first Pwn2Own Automotive, organised by ZDI in Tokyo in January 2024, Computest Sector 7 successfully demonstrated exploits for vulnerabilities in three different EV-chargers. All three could be exploited to execute arbitrary code on the charger, with the only prerequisite being close enough to connect to Bluetooth. As electric vehicles become increasingly integrated into our transportation infrastructure, the security of their charging systems is becoming paramount. A threat actor hacking EV chargers at scale could have a real life impact on the continuity of our power grid and the transportation sector. Therefore, it is important that manufacturers and operators are well aware of their role in protecting our power grid. During this talk we'll discuss the details on how we extracted the firmware, the vulnerabilities we found and the story of one drunk night of hacking till 07:00 AM in Tokyo that resulted in some much more high-impact vulnerabilities than were needed for the competition... Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/AGVUVM/

Any even remotely advanced tasks on unixoid systems will inevitably lead to an encounter with one of the systems oldest components: The shell. An ancient artefact that is in equal parts being feared, mystified, or possibly even glorified. In an effort to demystify origins, development, and current role of shells, this talk tells a tale deeply rooted in the earliest days of UNIX development. In the process, several (historic as well as current) shells will be introduced among their notable features and impact on contemporary systems. To finish of, the talk discusses the legacy of historic shells and their influence on modern operating systems with or without UNIX heritage. While technical in parts, this is first and foremost a historical presentation with a bit of an outlook. Less tech-savvy audience members should thus still be able to enjoy this. In fact, newcomers to the shell may find some useful hints. **Keywords:** *computing history; unix; multics; posix; linux* Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/CB7A9V/

A brief retrospective over the past 16 years of organized voluntary repair initiatives and a look at the breakthroughs for the right to repair movement When Martine Postma organized her first Repair-Café in Amsterdam, would she have imagined the kind of traction that her initiative would gain worldwide? With rampant enshittification of services, but also products ("planned obsolescence") comes resistance from consumers and politics. I'll show a few blatant examples and outline the recent progress in EU legislation. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/BDQESV/

You’ve released your code under a free license, but your project runs on proprietary platforms like Slack, GitHub, Notion, or Zoom. What’s the harm? In this talk, we’ll explore how relying on closed tools contradicts open source values, excludes contributors, locks your community into corporate ecosystems, and drives away idealistic contributors who care deeply about freedom. We’ll also tackle common justifications, like convenience or popularity, and show how they often mask deeper trade-offs. My goal with this talk is to spark reflection and conversation about the tools we use to build open source projects, not just the code we write. I hope it encourages both new and experienced maintainers to think critically about how proprietary tools may be limiting their communities and values, even unintentionally. The audience will leave with a better understanding of the trade-offs involved, practical alternatives they can explore, and the motivation to make small changes that lead to more open, inclusive, and resilient projects. If more projects switch to even one open alternative, it strengthens the entire open source ecosystem by reducing dependency on tech giants and supporting community-owned infrastructure. Whether you're starting a new project or maintaining a mature one, this talk will challenge you to think critically about the tools you use and advocate for open, community-controlled alternatives that align with the spirit of FOSS. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/WPGMJU/

IPv6 has been talked about a lot since a very long time. It never really caught on... or did it? Where are we right now? Where are we heading and what can you do about it? What is the matter with IPv6? How did we go from something that was supposed to be the future of the internet to where we are today? Is it still like that? What plans are currently unfolding? Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/VBR7DQ/

It started with a simple idea in 2016: make the state of security of our government transparent/public. The simple idea has become national government policy. Using transparency we've helped fix tons of security issues, reduce costs and increased control on IT. This year we've rolled out in Belgium and started measuring accessibility of websites in the same fashion. Learn how we've achieved extreme impact with a minimal budget and keep on doing so. Security and accessibility must be commodities. (We're planning a couple of nice surprises during this talk exclusive for WHY2025. As always: it will make some people nervous, yet it will make society better.) A transparent and accountable society creates trust. We're currently monitoring all important organizations in the Netherlands on about 25 security, privacy and sovereignty metrics. You can see openly where organizations are doing great or where they are even (unknowingly) breaking the law. With the EU requiring accessibility on multiple sectors this year, we've also starting measuring accessibility in the same fashion. You can clearly distinguish organizations with and without an accessibility policy. We'll show what it looks like, the impact it has, the awesome cyber tokens and certificates we make and the sets of open data we create. The project is at its peak right now. If you want to make an impact on society: this is where it's at. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/3ZMKFQ/

A Domain-Specific Language is a computer language that’s made and suitable for a specific domain — *dûh*. But what happens when that domains is inhabited and operated by people that are – **gasp**! – not developers?! This is when a DSL has the opportunity to shine, and even outshine generic AI. The field of Domain-Specific Languages has been going through a quasi-perpetual, reincarnating Gartner hype cycle for decades. Nevertheless, there are many DSLs out there, with many aimed squarely at software devs, and some at non-devs. In this talk, I’ll explain what a DSL is and is made up of, and why you‘d want to make one – especially for non-devs! –, why and how to do that using something called “projectional editing”, why and how DSLs are better than AI, and why DSLs should be a standard tool in our dev-toolbox. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/LXNXVK/

Game randomizers can breathe fresh air into your favorite video games by changing where things are, what enemies you fight, or even what the win conditions are. But how do they work? Let's embrace chaos and learn about them! Game randomizers can breathe fresh air into your favorite video games by changing where things are, what enemies you fight, or even what the win conditions are. But how do they work? In this talk, I'll share my experience building a randomizer for the Gameboy Advance version of Final Fantasy 1. I'll tell you about the stumbling blocks I hit, and how I solved them. I'll also share the lessons I learned building my project, and how I'd do it better next time. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/YXDFYP/

Belgian creative technologist and artist Dries Depoorter, based in Ghent, creates thought-provoking work about technology, surveillance, AI and social media in a playful way that makes people laugh while delivering serious messages in an accessible way. His projects explore digital culture that can inspire marketers: privacy challenges, artificial intelligence applications, surveillance and authentic social media projects. With his unique background in electronics and digital innovation, Dries has become a voice for forward-thinking brands and marketing professionals looking to navigate today's complex digital landscape. His artistic approach can directly inspire brands to think differently and develop original marketing concepts that stand out. Through his work, Dries demonstrates how combining creativity with technological insight creates viral moments. His award-winning "Die With Me" app, accessible only when a user's phone battery drops below 5%, demonstrates how scarcity and unique user experiences can create powerful engagement. On Black Friday, he doubles the price of his app instead of offering discounts, showing brands how breaking marketing rules can create attention. In his viral project "The Follower," Dries leverages open cameras and AI to reveal the reality behind curated Instagram moments—offering marketers an unfiltered look at consumer behavior and content creation. Meanwhile, "The Flemish Scrollers" uses AI to automatically identify politicians using smartphones during parliamentary sessions, highlighting how technology can create accountability and transparency in public spaces. Dries has exhibited at prestigious venues including the Barbican in London, Art Basel, Mutek Festival in Montreal,ZKM, Bozar, WIRED and Ars Electronica. As a speaker, he's shared insights with innovative organizations including TEDx, MoMA, SXSW, Chanel, Adidas, Samsung, Deloitte, KBC and Adobe. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/XMMXBC/

Building entrance systems for prisons, hospitals an tv studio's should be secure. But is this really the case? After "Knock knock who's there 1.0" at MCH2022, we will again look at some high-tech lockpicking, this time at more sensitive locations. The responsible disclosure is a tale of it's own! And why exactly is a 3-letter agency in the US interested in the disclosure? Feeling safe at home and at work is one of the most basic requirements for living. Part of being, and feeling, safe is the physical access system of the building. Since the last talk at MCH2022 more building entrance systems have been researched. The findings will be presented in this talk. And these findings have led to multiple CVE's and the discovery of single DES encryption and Mifare classic access card systems. One manufacturer who makes building entrance systems used at very sensitive objects such as tv studio's and airports managed to leak the private key of a CA they use to manage the building access. In another case we were able to generate license key files under the name of a very well known person. In all cases we will look at the vulnerability disclosure and how to make sure you do not end up in prison (although with these locks....) Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/VZDSF3/

I developed a 100% open-source (Quad core A7, 512MB RAM) Linux-enabled Flipper module for WiFi pentesting and ethical hacking! This talk covers how and why I developed the Flipper Blackhat: starting at the hardware level through the bootloader, kernel and up to user space. On the hardware side, I'll detail the power supplies, the DDR3 routing, radios, and the A33 processor itself. I'll show the build system, device trees, Python scripts and the penetesting suite I ship with it. I'll provide an overview of the exploits I've written for it and how to control them from the Flipper app. I will also do a live demo of the device in honeypot mode, RAT driving, AP scanning, embedded exploit etc... Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/TQTUTQ/

ORM's and/or developers don't understand databases, transactions, or concurrency. After the [Air France-KLM dataleak](https://media.ccc.de/v/37c3-lightningtalks-58027-air-france-klm-6-char-short-code) I kept repeating this was not a real hack, and confessed I always wanted to hack a system based on triggering race conditions because the lack of proper transactions. This was way easier than expected. In this talk I will show how just adding `$ seq 0 9 | xargs -I@ -P10 ..` can break some systems, and how to write safe database transactions that prevent abuse. In this talk I will explain what race conditions are. Many examples of how and why code will fail. How to properly create a database transaction. The result of abusing this in real life (e.g. free parking). Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/EYKRPS/

So you have a new microcontroller, how do you get started programming it? This is going to be the talk I wished already existed when I first got into microcontroller programming. Getting started with a new microcontroller can be daunting. They do come with datasheets, but these are often hundreds if not thousands of pages long and assume you already know the basics. So that's what I will be explaining: how to get started programming these thing, from `Reset_Handler` to blinking LED. This talk will cover the following things: * How to read datasheets * How to write a simple linker script * How to do basic initialization of a chip, enough to get a LED blinking * How to get the binary you created onto a microcontroller. I will assume you have some programming experience, but experience with embedded software is not required. Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/HBMWXL/

The European electricity network has become a ‘smart grid.’ This offers many opportunities for sustainability but also makes our energy system more vulnerable to digital attacks. DIVD has been conducting research into vulnerabilities in charging stations, solar panel inverters, home batteries, and Energy Management Systems. In this talk, we will demonstrate how we could have generated power outages using these zero-days and how we prevent this by disclosing them responsibly. The European electricity network has become a ‘smart grid.’ This offers many opportunities for sustainability but also makes our energy system more vulnerable to digital attacks. In a time of increasing threat of hybrid warfare, the government and the energy sector realize that we as a society must prepare for possible disruption of the energy system and do everything we can to prevent it. Various institutions test smart devices, set safety standards, and monitor compliance with these standards. However, parties such as our grid operators only have control over the energy grid equipment up to the front door. They are not allowed to look beyond the electricity meter, where most smart equipment is located. DIVD is allowed to do this because we are volunteers and a nonprofit. By identifying devices that can form a botnet, DIVD helps to make the smart grid more secure. DIVD has been conducting research into vulnerabilities in equipment of the energy system, such as charging stations, solar panel inverters, home batteries, and (Home) Energy Management Systems. Previous findings have led to several parliamentary questions and follow-up actions by authorities such as RDI, the Dutch Authority on Digital Infrastructure. With the CVD in the Energy Sector program, DIVD conducts research at its own hardware hacking lab in collaboration with the energy sector to reduce the digital vulnerability of our energy system. We also organise hack events. During WHY2025 we also give demos at the Vulnerability Disclosure Village. In this talk, we will demonstrate how we could have generated power outages using zero-days we found in solar converters, electric car chargers and energy management systems. Still, we also did it with just one user-password combination… Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/AREWXH/

To understand the inner workings of Kubernetes and to prepare for the K8s certification exams, I decided to create a K8s cluster from scratch, the hard way, on premises (“de meterkast”) on virtual machines all using Alpine Linux. This talk is how I tried to do it, how I succeeded, failed and added a CEPH cluster and ETCD cluster along the way. It includes a lot of technical details, but if there is one thing that you should learn during this talk, it’s not about K8s at all: Containers are not VM Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/TQXDPD/

De Tweede Kamerverkiezingen komen eraan en de digitale vraagstukken liggen op tafel. Wat moet het volgende kabinet doen op het gebied van cyberveiligheid, AI, privacy en digitale autonomie? Welke keuzes zijn écht nodig, en wie durft ze te maken? Tijdens WHY2025 organiseren we Het Grote Cyber Debat waar politici het gesprek aangaan met de mensen die dagelijks aan de knoppen zitten: ethische hackers, open source-ontwikkelaars, securityprofessionals en AI-tinkerers. Scherpe vragen en eerlijke antwoorden, van en voor een publiek dat weet waar het over gaat. Onlangs presenteerde het huidige kabinet de vernieuwde Nederlandse Digitaliseringsstrategie. Maar de toekomst? Die wordt straks geschreven in partijprogramma’s. Daarom nodigen we juist nu Kamerleden, bestuurders en beleidsmakers uit om te luisteren, te leren en te debatteren met de tech-community vóór de verkiezingskoorts losbarst. **Astrid Oosenbrug (GroenLinks/PvdA)** Voormalig Tweede Kamerlid voor de PvdA (2012–2017); speerpunten cybersecurity en LHBTI’ers, daarna oprichter van het Dutch Institute for Vulnerability Disclosure, en nog steeds werkzaam in cybersecurity. **Erik Kemp (Volt)** Fractievoorzitter van Volt in de gemeenteraad van Enschede. Doet een master Cybersecurity aan de Universiteit van Twente. **Haitske van de Linde (VVD)** VVD-raadslid te Hilversum, bij het Waterschap Rijn en IJssel programmamanager Wetgeving Data en Informatie. En in een grijs verleden nog even lijsttrekker van Leefbaar Nederland. **Janarthanan Sundaram (D66)** Directeur van glasvezel-leverancier Bright Access en lid van de Landelijke Verkiezingscommissie van D66. **Sebastiaan van ’t Erve (GroenLinks)** Volgens zijn LinkedIn “inwoner van de gemeente Lochem” - maar hij was er ooit ook burgemeester, was IT-politicus van het jaar, en promoveert nu op cybercrisis-management bij gemeenten. En meer! Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://program.why2025.org/why2025/talk/CJZV8J/