[00:03.300 --> 00:09.220]  My name is Richard Smith and I work in the security and privacy areas.
[00:09.400 --> 00:09.940]  Can't hear you.
[00:11.120 --> 00:11.760]  Can't hear me.
[00:13.540 --> 00:18.180]  Again, my name is Richard Smith and I work in the internet security and privacy areas.
[00:18.880 --> 00:29.000]  I also run a website called Computer Bites Man and it covers sort of issues related to when things computers don't work quite right.
[00:29.500 --> 00:30.860]  And so there's a lot of fun stuff up there.
[00:31.740 --> 00:34.960]  It's obviously www.computerbitesman.com.
[00:37.480 --> 00:47.320]  What I'm here to talk about today is something I've been interested in in the last maybe three or four years is the idea of us doing sleuthing on the internet.
[00:48.640 --> 01:03.460]  And in particular what I want to give you an idea on or leave you with an impression today that when we talk about criminal activity over the last three or four years, a good bit of it in sort of high profile crimes gets planned on the internet.
[01:04.610 --> 01:09.990]  And that makes it something that's then trackable and solvable potentially by the internet.
[01:10.650 --> 01:13.050]  Today I have a whole lot of examples.
[01:13.210 --> 01:19.690]  These are basically news stories which I'll go through and sort of go behind the scenes and talk a little bit about what happened.
[01:20.580 --> 01:31.710]  But we normally think about, you know, if we think about like, I'll use this in quotes here, cyber crime, you know, breaking into computers, viruses, these sorts of things as crimes that we can track through the internet.
[01:31.920 --> 01:34.640]  And that's certainly been the case.
[01:35.120 --> 01:46.840]  We had Rudy two sessions ago in here talking about the bad trans virus sending his computer, you know, keystroke logs from various infected computers.
[01:46.880 --> 01:55.760]  And how the FBI was interested in creating, you know, what IP addresses used to create the email account that received these, you know, and that's an example of a computer crime.
[01:56.340 --> 02:05.850]  Today, though, I'm going to give one computer crime example and then some more, you know, what we'd really consider, you know, hardcore criminals, you know, murderers, kidnappers, arsonists, and so on.
[02:06.460 --> 02:12.500]  But how these crimes also now fit into the mold of being able to track on the internet.
[02:13.050 --> 02:27.700]  I'd start, I want to start off with the Melissa virus, just because I have some personal experience with this situation, but it just illustrates, you know, sort of the basics of tracking on the internet.
[02:28.320 --> 02:38.700]  This email, sorry, this news group message from March 26, 1999 is the original message that was used to release or drop the Melissa virus.
[02:39.420 --> 02:41.060]  And it was a simple little thing.
[02:41.060 --> 02:43.670]  It was put into about five or ten news groups.
[02:43.820 --> 02:44.920]  This one's all about sex.
[02:45.980 --> 02:49.240]  And it was just a little come on message.
[02:49.380 --> 02:53.480]  It said, here's a bunch of passwords of adult sites.
[02:53.860 --> 02:55.720]  And it was a Word document.
[02:55.830 --> 02:57.380]  It was a zip file that had a Word document.
[02:57.640 --> 03:05.200]  And if you ran the Word document and then ignored the security warnings, you would then, you know, send out 50 copies of itself to other people.
[03:05.830 --> 03:07.800]  So this is, this is put up on the internet.
[03:08.000 --> 03:09.830]  Let's see, it says GMT of 1215.
[03:10.100 --> 03:11.540]  So that's seven, seven o'clock in the morning.
[03:11.680 --> 03:12.520]  That's a Friday morning.
[03:13.240 --> 03:16.360]  And it was sent from an AOL account from somebody called skyrocket.
[03:17.560 --> 03:18.820]  skyrocket.aol.com.
[03:21.060 --> 03:26.180]  Now, one thing to consider when you're, in terms of legalities, it's okay to write computer viruses.
[03:26.500 --> 03:28.640]  What it's not okay to do is distribute them.
[03:29.420 --> 03:36.080]  And this is an example here enshrined in a news group of distributing a computer virus.
[03:36.920 --> 03:47.900]  So this particular example here is someone wasn't sort of the brightest, this wasn't quite the brightest thing to do here because it left a record of the virus being actually, you know, set out on the loose.
[03:48.040 --> 03:51.820]  This is a public, you know, the news group, the Usenet news group sort of public forum.
[03:51.820 --> 03:55.360]  So in terms of locating this guy, it's pretty straightforward.
[03:56.240 --> 04:05.360]  What you would want to do is you want to find out who was using the skyrocket AOL account at 715 in the morning on March 26.
[04:06.240 --> 04:21.800]  And so that's what happened here is that once this virus got around, it got in the newspapers, the AOL went back to some of the log files they had and discovered that this account was logged in from an ISP.
[04:21.800 --> 04:22.560]  in New Jersey.
[04:23.460 --> 04:26.080]  And, you know, that's just a matter of looking at some log files.
[04:26.270 --> 04:34.080]  And so they went to the Attorney General's Office of the State of New Jersey and said, you know, we think we have somebody in your state who might have released this virus.
[04:34.720 --> 04:43.470]  And so then the Attorney General's Office took it from there and went to the ISP, which was in Monmouth County, and said, okay, we have an IP address.
[04:43.640 --> 04:47.580]  We want to know at 7 o'clock on March 26 who was using this IP address.
[04:48.020 --> 04:54.080]  Well, all this took about four or five days of going through log files because it's not like pushing a button.
[04:54.240 --> 04:58.650]  Sometimes, you know, it's like you've got to run a rep and write some parole strips or whatever to search some of this stuff.
[04:58.760 --> 05:01.760]  They're not really set up to do this necessarily to, you know, solve crimes.
[05:02.120 --> 05:03.440]  But it wasn't too hard.
[05:03.440 --> 05:06.140]  So this virus was released on a Friday.
[05:06.970 --> 05:13.270]  And the gentleman who released this virus, David Smith, was arrested on Wednesday the following week.
[05:13.400 --> 05:15.650]  So, you know, it's a pretty quick process here.
[05:16.400 --> 05:20.800]  The main thing you want to do is if you're going to release a computer virus, you know, don't do it in a public forum.
[05:21.300 --> 05:23.830]  And don't do it from your own house.
[05:25.000 --> 05:34.740]  You know, ISPs also do things that use, you know, they do, you know, know things about like caller ID or automatic number of identification, which sometimes also gets recorded in those logins there.
[05:34.740 --> 05:37.000]  So it was a pretty straightforward thing.
[05:39.300 --> 05:47.680]  What's interesting... What's kind of fun here is David Smith had released other viruses in the same manner.
[05:47.820 --> 05:54.460]  So what you could just do... I did this on Google Groups, but back three years ago, I had done this on Dajon News.
[05:54.920 --> 05:59.940]  You could just say, give me all the messages that were authored by skyrocket.aol.com.
[06:00.240 --> 06:03.720]  And sure enough, there's 27 messages that pop up on the same sort of thing.
[06:03.720 --> 06:05.720]  These are older computer viruses.
[06:05.960 --> 06:08.640]  You can see as, you know, as early as 1997 here.
[06:09.540 --> 06:13.400]  I guess this was on his Christmas holidays here, December 28th.
[06:14.380 --> 06:16.440]  Where he had released other computer viruses.
[06:16.800 --> 06:20.520]  And there's a variety of ways to go back and look to see what these viruses were.
[06:20.520 --> 06:28.620]  Well, it turns out that they were written by a virus writer who went on the name of Vicodin, ES.
[06:30.420 --> 06:35.140]  And some interesting things about computer... Word files here.
[06:38.010 --> 06:43.090]  We have a little program that'll... you give it a Word document, it kind of dumps out some hidden information in files.
[06:43.090 --> 06:45.930]  And what I'm kind of interested in... this is Melissa itself.
[06:46.650 --> 06:48.450]  You can see down there, it says revision logs.
[06:48.950 --> 06:54.250]  And what it's saying is this file was edited three times here by John Holmes.
[06:54.370 --> 06:56.190]  I don't think that's the right name.
[06:58.190 --> 07:00.470]  Anyway, you can see where it was edited from.
[07:00.590 --> 07:02.390]  And then him was on the last one.
[07:03.750 --> 07:06.610]  So, you know, this kind of information gets left in files.
[07:07.070 --> 07:09.590]  And you just never know where that stuff's going to pop up.
[07:09.590 --> 07:16.190]  So, a number of myself and some other people started looking at some stuff from Vicodin's website.
[07:16.430 --> 07:19.310]  Again, he had a public website where he'd go up and get information on.
[07:19.570 --> 07:21.970]  And we came up with some interesting files here.
[07:28.180 --> 07:33.480]  As you can see here, it says document summary, the narcotic network, the class poppy construction kit.
[07:33.640 --> 07:38.500]  It's a... it's a... a word macro that builds viruses.
[07:39.440 --> 07:40.620]  Or worms or whatever.
[07:40.920 --> 07:42.840]  But if you look down at the bottom here...
[07:42.840 --> 07:44.140]  Let me scroll this up a little bit.
[07:50.370 --> 07:52.990]  The revision log has a lot more interesting things in here.
[07:53.110 --> 07:55.210]  It does have not me, probably another fake name.
[07:55.390 --> 07:57.770]  But if you go over there, you can see Windows NT profiles.
[07:57.770 --> 07:59.610]  And it says D.A.
[07:59.810 --> 08:00.050]  Smith.
[08:03.750 --> 08:04.570]  You know, and...
[08:05.090 --> 08:08.090]  And then over here, coming down to number three, we see J.P.
[08:08.150 --> 08:08.550]  Morgan.
[08:09.350 --> 08:10.570]  And then we've got D.A.
[08:10.650 --> 08:10.770]  Smith.
[08:11.030 --> 08:11.950]  Now, I thought J.P.
[08:12.010 --> 08:12.910]  Morgan was fake.
[08:13.310 --> 08:17.310]  But the guys that I worked with in Sweden said, oh, no, no, it's that bank in New York City.
[08:17.650 --> 08:17.770]  You know?
[08:18.250 --> 08:22.390]  So apparently, Mr. Smith was writing computer viruses at work time here.
[08:25.830 --> 08:29.670]  Now, I don't know if there's a John Wilkins in the crowd, but we never forgot who he was.
[08:29.790 --> 08:33.590]  That's sort of a very... sort of an interesting mystery of the Melissa virus.
[08:40.300 --> 08:41.980]  And here we have another example.
[08:42.180 --> 08:45.780]  The Vicodin ES VBA string converter, some kind of other utility.
[08:45.900 --> 08:47.860]  But right in here, it just says, flat out, D.A.
[08:47.920 --> 08:48.060]  Smith.
[08:48.540 --> 08:50.120]  Right in the file.
[08:51.800 --> 08:59.000]  So, the bottom line is, if you're going to write computer viruses, probably stay away from word macro ones, because you never know what kind of information is going to be left in the file.
[09:03.160 --> 09:09.640]  And so, you know, recently, here, notorious PC virus puts creator in jail.
[09:10.260 --> 09:15.660]  Now, when my wife first saw his picture, he says, what's such a good looking guy writing computer viruses for?
[09:18.340 --> 09:20.060]  And I said, you know, I don't know.
[09:20.240 --> 09:21.640]  I don't quite understand it myself.
[09:28.380 --> 09:31.140]  Anyway, I want to go on now to real crimes, though.
[09:31.380 --> 09:35.580]  And that's sort of a backdrop here of, you know, leaving information behind on the internet.
[09:36.460 --> 09:46.480]  This is a simple example of a crime that I think illustrates how law enforcement can take a look at tracking somebody.
[09:47.240 --> 09:51.920]  Although this wasn't particularly successful of arresting anyone, it does illustrate how it can be done.
[09:52.380 --> 09:56.710]  It says, one fire gutted a research lab at the University of Washington Center for Urban Horticulture.
[09:57.450 --> 09:59.510]  This is a group called the Earth Liberation Front.
[09:59.630 --> 10:05.090]  They're kind of a loose group of arsonists that go around, you know, burning down things that they don't like.
[10:05.270 --> 10:16.990]  You know, labs that do genetic engineering work, fancy houses in neighborhoods, ski lodges in Vail, Colorado, and so on.
[10:17.350 --> 10:22.930]  But what's interesting to me is I saw this story and I said right off the bat, well, gee, how would somebody locate this place?
[10:23.370 --> 10:27.930]  You know, maybe they live in the neighborhood and they just went, you know, a couple blocks down and, you know, torched the place.
[10:28.370 --> 10:31.730]  But I kind of figured they didn't know, you know, maybe where this was.
[10:31.870 --> 10:33.950]  So one obvious place is you go up on the internet.
[10:34.350 --> 10:42.590]  So I just sort of typed this, you know, whatever it is here at the University of Washington Center for Urban Horticulture into Google to see if I could find a website.
[10:43.010 --> 10:56.120]  Sure enough, I could, and there's actually then, the map doesn't show up, but there's a page at the University of Washington that gives you, you know, complete directions to get to this place.
[10:57.200 --> 11:07.200]  So I said, well, gee, you know, if they did go to this website in order to get directions to learn how to get there, this is, you know, they might have hit, you know, this particular webpage.
[11:07.500 --> 11:14.000]  So I suggested to the University of Washington who just had one of their buildings burned down by some bad guys.
[11:14.460 --> 11:21.720]  They may want to take a look at their server logs to see who was accessing this page, you know, within the, you know, two weeks of the fire to see if, you know.
[11:22.120 --> 11:27.640]  And I don't think this is a high volume page, you know, I suspect there was maybe, you know, two or three hits in that time.
[11:28.600 --> 11:33.060]  As a way, you know, potentially locating, you know, locating the perps here, if you will.
[11:34.140 --> 11:38.000]  As I said before, no one was ever arrested, so I don't think this was a successful thing.
[11:38.000 --> 11:42.320]  But certainly one avenue for the police to look for these folks.
[11:43.200 --> 11:45.800]  Now, the
[11:49.800 --> 11:52.260]  FBI, though, is thinking along the same lines here.
[11:52.460 --> 12:00.800]  This is a story from only a week ago where they said, I like this very vague intelligence alert warns of possible threats to U.S.
[12:00.960 --> 12:01.480]  stadiums.
[12:01.480 --> 12:11.920]  And what it is, is there's a website called World Stadiums you can go to and describes all the kinds of football and soccer stadiums that are out there in the world.
[12:12.400 --> 12:18.220]  And some, they were noticing funny hits from, you know, like Pakistan to this website.
[12:19.420 --> 12:23.680]  So they, the FBI decided this might be a terrorist threat.
[12:25.780 --> 12:30.280]  And so they put out, put out this article and then they actually list which ones they were looking at.
[12:30.440 --> 12:33.580]  So St. Louis and Indianapolis were apparently targets.
[12:34.260 --> 12:35.220]  They're still standing.
[12:36.200 --> 12:45.980]  And I think this does illustrate one of the things here is before, you know, using this server log information before a crime occurs is a little bit hard.
[12:45.980 --> 12:48.520]  Because you really don't know why somebody is coming into the site.
[12:49.500 --> 12:54.660]  You know, after, you know, after one of these stadiums got hit, well, maybe you would want to go and look around at websites.
[12:55.220 --> 13:02.640]  Now, what's intriguing to me though, and I haven't figured this out, is who was looking at those server logs for those people from Pakistan?
[13:03.640 --> 13:06.340]  You know, why was anybody even thinking of that?
[13:06.540 --> 13:13.860]  And the answer must be that there's a lot more sort of vigilantism out there than maybe we think.
[13:13.860 --> 13:27.480]  And there's another story along the same lines of, in the Bay Area, of towns looking at their websites that give directions to, you know, sewage treatment plants and this sort of thing.
[13:27.580 --> 13:30.700]  And they're seeing the same thing, these hits from Saudi Arabia and from Pakistan.
[13:31.100 --> 13:35.460]  So there seems to be a little bit of website vigilantism going on out there.
[13:49.680 --> 13:51.280]  Yeah, this is easier though.
[13:51.460 --> 13:52.900]  I guess that's the point.
[13:53.040 --> 13:56.000]  It's easier to go through the server logs and then scan everybody that's coming in.
[13:56.720 --> 13:57.020]  Yeah.
[13:57.880 --> 14:00.240]  So anyway, here's the website for world stadiums.
[14:00.760 --> 14:08.100]  But if we do, you know, if there is an incident at some stadium at some point, the server logs might be useful.
[14:08.100 --> 14:11.360]  But as I would say, it's a bit, it's a more after the fact.
[14:11.540 --> 14:13.500]  Now, it's not a good predictor of crime.
[14:13.700 --> 14:15.440]  We're going to click on that Pakistani news.
[14:16.940 --> 14:17.480]  Oh, right.
[14:17.640 --> 14:19.360]  Yeah, that's sort of irony here.
[14:19.460 --> 14:21.320]  It's the construction news in Pakistan.
[14:28.540 --> 14:28.860]  Yeah.
[14:29.240 --> 14:31.200]  Well, that's one thing I was going to... that's a good point.
[14:31.200 --> 14:38.980]  Please, nobody, you know, go through an anonymous server or anonymous thing in Pakistan just to fool the FBI.
[14:39.240 --> 14:41.200]  We don't... they've got enough to worry about here.
[14:41.380 --> 14:43.060]  So let's not have them chase their tails.
[14:47.330 --> 14:49.750]  This is another news story that I ran in.
[14:49.810 --> 14:51.650]  This is right after September 11.
[14:51.850 --> 15:03.290]  So it came out on September the 15th, where the FBI was beginning to put together the travels of the September 11th hijackers.
[15:04.350 --> 15:13.730]  And the way they did that after the fact, of course, is to look at all the electronic records that were left behind, some paper records of the hijackers.
[15:13.930 --> 15:17.350]  And since they used their real names everywhere, that was relatively easy to do.
[15:17.510 --> 15:29.030]  And so those electronic records would include, like, you know, cell phone records, landline phone records, credit card records, any kind of web travels they did, any kind of email, this sort of stuff.
[15:29.270 --> 15:34.730]  And so the investigation of September 11 very much is just collecting all that data.
[15:35.210 --> 15:39.390]  Now, one thing that caught my eye in this article in the Times here, let me scroll it down.
[15:44.810 --> 15:53.010]  It says here, it says, according to another FBI document, several made reservations by renting a computer at a Kinko's copy shop in Florida.
[15:53.650 --> 16:00.670]  You know, one thing that you kind of learn, and you'll see this in some other stories I tell, that Kinko's is a favorite for the terrorists on the run.
[16:02.190 --> 16:10.310]  You know, you hear a lot about, you hear a lot about, oh, we've got to worry about encryption for the terrorists and the criminals or whatever.
[16:10.370 --> 16:14.690]  But the thing that I've noticed is they like Kinko's copy shops and they like free Hotmail accounts.
[16:15.290 --> 16:17.990]  Those tend to be the instruments of crime that are out there.
[16:28.650 --> 16:33.590]  So, okay, in the article, a little further down, it gives more details here of what Mr. Atta did.
[16:34.330 --> 16:36.090]  You know, Mr. Atta was the ringleader.
[16:36.410 --> 16:40.390]  And so he ordered tickets from the American Airlines website.
[16:40.650 --> 16:45.530]  He used a frequent flyer number that he had set up on it, and he paid for other tickets.
[16:45.670 --> 16:46.990]  He used a Visa card.
[16:47.290 --> 16:55.970]  And he just began to start, you know, the gears start whirring here in the sense that you're starting to get a lot of data about a lot of different people that you can start connecting up.
[16:56.150 --> 17:00.290]  Because this is, you know, how they've learned probably about the Visa card that he had.
[17:00.610 --> 17:05.730]  And then you would go and subpoena the records from Visa to see what else that Visa card was being used for.
[17:06.530 --> 17:13.130]  And then you start learning the connections between people because he purchased tickets for other people with that same Visa card.
[17:13.570 --> 17:14.130]  Now,
[17:18.300 --> 17:22.520]  I think they were probably taken back.
[17:22.800 --> 17:31.940]  But, you know, here you can see the sign-up page for the American Airlines website that was used.
[17:32.400 --> 17:43.300]  Now, what's interesting here, see, is the way that they learned he was at a Kinko's copy shop is, you know, they went first through their database and said, okay, who was sitting in this seat?
[17:43.440 --> 17:49.960]  What happened was on the airplanes is some of the flight attendants were able to make phone calls on cell phones.
[17:50.300 --> 17:57.920]  And they talked to the airlines, their security department, said, okay, the hijackers on this airplane got up out of these seats.
[17:58.680 --> 18:01.580]  And in a number of the flight cases, they knew that.
[18:01.790 --> 18:04.960]  So they immediately went to their database and said, okay, who was sitting in those seats?
[18:04.960 --> 18:07.420]  Then they said, okay, how do they buy the tickets?
[18:07.820 --> 18:15.290]  So somewhere in here, when you buy a ticket online, they record an IP address where that transaction is.
[18:15.460 --> 18:19.010]  Or if they don't record it right in the database record, it's in a server log someplace.
[18:29.670 --> 18:34.750]  I'll give kind of a little example of something like that, too, in a second here, too, of what else you can do.
[18:34.750 --> 18:41.660]  But the bottom line is they had an IP address, and that IP address belonged to Kinko's.
[18:42.140 --> 18:45.840]  Kinko's does proxy serving, so they had to go to Kinko's and get their proxy logs.
[18:45.990 --> 18:49.340]  But ultimately, they ended up down at that Hollywood Kinko's.
[18:49.560 --> 18:49.640]  Yeah?
[18:50.400 --> 18:51.720]  So a question for you.
[18:51.790 --> 18:53.640]  Why did you sign up for an advantage account?
[18:53.820 --> 18:56.160]  Was it to attempt to evade caps?
[18:56.160 --> 18:59.880]  Or was it because of client required it to use their website?
[19:00.250 --> 19:01.960]  They require it to buy a ticket online.
[19:02.300 --> 19:02.820]  Oh, okay.
[19:03.480 --> 19:05.720]  The Times article said something like that.
[19:05.820 --> 19:07.540]  Yeah, he didn't do Expedia or something like that.
[19:07.840 --> 19:09.640]  So he had to sign up here.
[19:10.120 --> 19:20.030]  So they had an IP address that ultimately, through all the log files and server logs and proxy logs or whatever, that puts them into the Hollywood Kinko's.
[19:20.320 --> 19:24.920]  So then they zoom down with a bunch of agents there, and they rouse the place or look the place over.
[19:26.100 --> 19:33.180]  You know, one of the things that you see in Kinko's also is, I've never seen his cameras everywhere in the ceiling.
[19:33.820 --> 19:36.320]  They're the most camera in store that you go into.
[19:36.580 --> 19:41.140]  So they might have actually had pictures of the hijackers, you know, sort of committing this crime on the internet.
[19:41.140 --> 19:46.530]  The other thing that's interesting is that they asked, well, what else did these guys do here?
[19:46.860 --> 19:50.100]  And somehow somebody figured out they were shipping stuff via Federal Express.
[19:50.120 --> 19:58.160]  So they found that some of the money that was intended for September 11th was Federal Express back to the United Arab Republics.
[19:58.160 --> 20:04.160]  So they were able to tie, you know, by this visit, they were able to tie a Federal Express shipment.
[20:05.010 --> 20:11.840]  So you can see all this stuff sort of tying together here just by being able to get to a physical location and being able to talk to people.
[20:12.360 --> 20:14.880]  Very much how they use IP addresses.
[20:19.660 --> 20:22.760]  Now, another thing that's interesting, and this is something I speculated on.
[20:23.840 --> 20:30.460]  You know, this is sort of, this is some of the stuff that I'm sad actually, but you can see here, this is on the United thing.
[20:30.460 --> 20:37.520]  It was Flight 175, and there's a status report here that you can get the status of a flight.
[20:39.120 --> 20:49.520]  So one of the interesting questions was, was there anybody checking the status of Flight 175 or the American Airlines flight from 8 to 9 o'clock on September 11th?
[20:50.160 --> 20:51.920]  You know, somebody kind of doing it repeatedly.
[20:52.300 --> 21:00.080]  Because that might indicate there was somebody else that was sort of, you know, another member of the team that wasn't, you know, wasn't in the actual airplanes.
[21:01.020 --> 21:03.100]  I speculated that might be true.
[21:04.560 --> 21:15.260]  And I gave a talk about two months ago, and somebody said, I'm from the Boston area, that their company had FBI agents coming in because there was somebody in the office checking.
[21:15.980 --> 21:19.780]  But if you stop and think about it, the sad thing was probably nothing to do with the hijackers.
[21:19.900 --> 21:22.600]  It was more like a family member or something like that.
[21:23.880 --> 21:34.260]  But, you know, pretty clearly, the FBI in this investigation very quickly did use a lot of web trowels to investigate this crime.
[21:40.380 --> 21:44.660]  This is another sort of, this guy, he hasn't killed anybody.
[21:44.860 --> 21:58.780]  I mean, the worst he kind of did was sent out some 500 fake anthrax packages that were Federal Express, I don't know where he got the money from, but to Planned Parenthood and other, you know, other types of organizations like that.
[21:58.780 --> 22:02.560]  You know, and he also would like rob people and hijack their cars and stuff like this.
[22:02.700 --> 22:07.500]  You know, he sort of saw himself as a kind of an anti-abortion Robin Hood guy.
[22:07.940 --> 22:09.780]  He's got nine kids.
[22:10.500 --> 22:11.640]  He's about 45.
[22:13.340 --> 22:21.760]  And he's, you know, sort of a self-righteous guy.
[22:21.960 --> 22:28.620]  I just think that if he had nine kids that he probably ought to be taking care of them instead of sort of worrying about this little campaign he's on.
[22:28.620 --> 22:30.520]  Anyway, he escaped from jail.
[22:30.980 --> 22:36.020]  And then he threatened to begin killing people at anti-abortion clinics.
[22:36.180 --> 22:38.020]  Sorry, at abortion clinics.
[22:38.480 --> 22:42.000]  And so they were pretty concerned about this guy, Clayton Lee Wagner.
[22:42.900 --> 22:46.560]  And what's interesting is how he got caught.
[22:47.460 --> 22:53.120]  Which is, the FBI had put out a wanted poster for him, but they sent it to Kinkos.
[22:54.140 --> 22:56.420]  So he went to all the Kinkos around the country.
[22:57.120 --> 22:59.620]  Remember before about terrorists, you know, liking Kinkos.
[23:00.040 --> 23:04.660]  Well, the reason they knew he liked Kinkos is because they were monitoring his email account.
[23:05.480 --> 23:13.660]  And they were seeing him check his email as a fugitive on the run at various Kinkos.
[23:13.880 --> 23:18.220]  And they never kind of got to those cities quick enough, but they knew that he liked to go in there.
[23:18.300 --> 23:21.900]  So they said, we'll just send a wanted poster, you know, to all the Kinkos around.
[23:21.900 --> 23:24.860]  And if anybody sees them, we'll grab them.
[23:24.940 --> 23:25.940]  And that's exactly what happened.
[23:27.280 --> 23:36.580]  You know, one of the things that happened, when I first got into sort of this whole idea of internet sleuthing and IP addresses and things like this, everybody said, oh, you can't use an IP address to track people.
[23:37.060 --> 23:38.400]  They're two easily faked.
[23:38.820 --> 23:45.100]  And all you learn about is, you know, you know, if they're proxied, you don't know who's at the computer keyboard.
[23:45.260 --> 23:48.120]  And all these reasons why IP addresses aren't valid.
[23:48.120 --> 23:54.700]  But if you're in law enforcement, you kind of understand, you know, 90% is good enough.
[23:55.020 --> 23:58.080]  It's not like you've got to get 100% accurate stuff on this stuff or whatever.
[23:58.360 --> 24:05.300]  That when you're trying to solve a crime, it's like public solving, and you can use any trick in the book.
[24:05.460 --> 24:09.040]  And I thought this was sort of a clever use of things.
[24:15.540 --> 24:18.340]  This is another pretty sad story here.
[24:18.740 --> 24:24.000]  This is the kidnapping and murder of Daniel Pearl.
[24:24.680 --> 24:32.900]  And there's just going to be a court trial going on right now in Pakistan for the folks behind this.
[24:32.900 --> 24:34.760]  And the judge is going to rule on Monday.
[24:34.960 --> 24:36.000]  So this is pretty topical.
[24:36.980 --> 24:43.660]  But he was... Daniel Pearl was a reporter for the Wall Street Journal, very much hands-on.
[24:43.780 --> 24:49.160]  And he had gone to Pakistan to investigate Richard Reed, who he might have been working with.
[24:49.240 --> 24:51.860]  So he was obviously going to be talking to some bad folks here.
[24:52.500 --> 24:55.260]  Probably wasn't, you know, sort of the safest thing to do.
[24:55.260 --> 25:00.100]  But anyway, he was stationed, he worked out of India.
[25:00.260 --> 25:01.820]  And then he went up to Pakistan.
[25:02.260 --> 25:03.440]  And he was kidnapped.
[25:04.600 --> 25:16.160]  And what happened is, there was an email message that was sent to a whole bunch of different newspapers, by the kidnappers, saying, we've got Daniel Pearl, and we think he's a CIA agent.
[25:16.320 --> 25:17.560]  You know, as you can see in the article here.
[25:25.330 --> 25:29.350]  So, and again, you know, back to this, you know, this is sort of a bad place to have the joke.
[25:29.350 --> 25:35.370]  But anyway, the guy who, the kidnappers used the email address of KidnapperGuy at Hotmail.com.
[25:36.130 --> 25:40.150]  You know, so again, you want to think, you know, you hear a lot about encryption and all the things you have to worry about.
[25:40.250 --> 25:42.410]  But, you know, here Hotmail's being used.
[25:51.710 --> 25:52.950]  Just real quick here.
[25:53.950 --> 25:57.850]  This is, this is the actual headers from the message.
[25:58.210 --> 25:59.630]  You know, you can see KidnapperGuy.
[25:59.770 --> 26:00.930]  And it went to all these newspapers.
[26:01.670 --> 26:06.190]  And there's an IP address associated with it, because Hotmail always puts it in.
[26:11.160 --> 26:14.620]  The IP address chases back to a company called New Skies.
[26:14.740 --> 26:18.320]  What they do is offer internet service around the world through satellites.
[26:19.440 --> 26:22.500]  And so Pakistan is one of the big countries that they service.
[26:24.080 --> 26:30.680]  So, you know, just right off the bat, there's a fairly strong indication, you know, besides the pictures, that this did probably come from Pakistan.
[26:31.880 --> 26:37.560]  And this is about the limit of what somebody can sort of look at without being the FBI.
[26:37.840 --> 26:46.980]  The FBI can go into this company with the appropriate subpoena or the cooperation of this company and say, okay, you have a proxy server.
[26:47.420 --> 26:53.040]  We want to know who is accessing this particular Hotmail URL at a particular time.
[26:53.040 --> 26:55.340]  You know, they know when the email came through.
[26:55.840 --> 26:57.820]  So that obviously kind of all kind of happened.
[27:01.480 --> 27:14.740]  The other thing that's kind of interesting is if you look, if we go back on the email headers for one second, you can see down at the bottom here, there's all sorts of email addresses to the Times.
[27:14.980 --> 27:18.360]  You know, letters at New York Times, editorial, executive editor, and so on.
[27:18.360 --> 27:21.300]  Well, those email addresses had to come from some place.
[27:21.700 --> 27:25.860]  And so one obvious place is like a contacts us page at the New York Times.
[27:26.040 --> 27:27.240]  So we take a look at that real quick.
[27:33.710 --> 27:34.590]  Let's see.
[27:37.830 --> 27:43.870]  I don't remember the exact things here, but when I originally looked at this, you could just see he literally copied it off this page and used this page.
[27:44.030 --> 27:50.690]  So there's another server logging go to that would potentially have the kidnappers, you know, researching this crime.
[27:50.690 --> 27:52.210]  It would be at the New York Times.
[27:52.470 --> 27:54.750]  And again, at other papers, the same sort of thing.
[28:02.580 --> 28:16.260]  Now, the bottom line is that there were some stories here in May about, at the trial, an FBI agent went over to Pakistan to testify to talk about all this tracing of the email messages that was done.
[28:16.380 --> 28:18.300]  There's like a 50 page report that he put together.
[28:18.300 --> 28:24.460]  I'd love to see that, to see all the different things they did, because we can only speculate here of all the steps that they went through.
[28:25.400 --> 28:34.400]  But you can see we have what is considered a very traditional crime of kidnapping and murder now very much being solved by the traces on the internet.
[28:40.970 --> 28:42.670]  I have another example here.
[28:44.610 --> 28:45.650]  Again, with the headlines.
[28:46.090 --> 28:47.430]  And I just look for these nowadays.
[28:47.950 --> 28:52.850]  You know, I look for websites or I look for emails, reports of emails and this sort of thing in the press.
[28:52.850 --> 28:57.450]  This is purported bin Laden email, a tax Saudi plan for Middle East.
[28:57.570 --> 29:05.730]  So this was back in March of this year, where the Saudis had some kind of proposed police plan with Israel.
[29:06.350 --> 29:09.830]  Bin Laden supposedly blew a cork and had to say something about this.
[29:11.050 --> 29:19.690]  So he had one of his buddies send an email message to an editor of a magazine or a newspaper in London called Al-Quds.
[29:20.690 --> 29:23.270]  Al Arabi, I'm probably not pronouncing that right.
[29:23.810 --> 29:24.850]  Apparently an old friend.
[29:25.570 --> 29:27.470]  Bin Laden was talking to this guy before.
[29:27.930 --> 29:30.410]  And he said the editor thought it was a genuine email.
[29:31.230 --> 29:36.290]  So the question is then, well, what do those headers look like for that email message?
[29:36.830 --> 29:40.090]  It's probably unlikely that bin Laden sent it himself.
[29:41.890 --> 29:46.770]  But it was probably sent by a cohort of some sort or other.
[29:47.030 --> 29:48.730]  And where would that trace back?
[29:48.730 --> 29:59.330]  Again, it's not going to lead directly to bin Laden, but it potentially could help locate, you know, where he is in, let's say, in Pakistan, where it's just sort of the guess where most people think he is.
[29:59.330 --> 30:09.010]  Well, one of the interesting questions is, so we have Al-Quds is, well, who provides your internet service?
[30:11.410 --> 30:19.610]  You know, if the newspaper doesn't want to cooperate here in the investigation, you can go to the ISP and you sort of hit them up.
[30:19.610 --> 30:30.090]  So, like, if the editor of the paper says, oh, I don't know, I erased the email message already, I can't say, there might be information in an email server log file someplace.
[30:41.770 --> 30:42.290]  Right?
[30:42.650 --> 30:47.990]  There's no requirement that I know of, but computer people love to log stuff.
[30:49.630 --> 30:59.430]  There's talk about, there's talk about in Europe, for example, of doing requirements, of passing laws, because the FBI or the law enforcement around the world is seeing the value of all this.
[30:59.430 --> 31:09.970]  But traditionally, computer programmers say, I want to keep all this information just in case, and now, so what we're seeing now is law enforcement come in and using it.
[31:10.450 --> 31:17.250]  But there's some talk of, like, yeah, keeping all email headers for the last six months, that sort of thing, all login records for the last six months, and so on.
[31:17.630 --> 31:27.730]  And ISP has a business reason for keeping some of the stuff around, you know, like login records for two or three months in case there's any kind of billing dispute or password problem or something like that.
[31:29.630 --> 31:34.170]  So, anyway, Ben, this outputs a newspaper.
[31:34.390 --> 31:36.290]  They have actually three different hosting services.
[31:36.330 --> 31:37.130]  I'll just go through them.
[31:37.230 --> 31:37.990]  They're kind of interesting.
[31:42.710 --> 31:44.870]  One is Rackspace in Texas.
[31:45.730 --> 31:46.270]  Spammers.
[31:47.950 --> 31:48.490]  Ooh.
[31:49.650 --> 31:50.730]  They cavort.
[31:51.010 --> 31:51.410]  Yeah.
[31:52.070 --> 31:56.990]  So, anyway, I asked, we see Robert Marsh there, head surfer.
[31:57.210 --> 31:58.610]  You see his picture over there?
[31:58.870 --> 31:59.410]  Spammer.
[32:00.550 --> 32:04.890]  So, I think he just rents out space to spammers, but I don't know.
[32:05.110 --> 32:06.150]  I don't want to get into that.
[32:06.390 --> 32:07.650]  But anyway, I did ask him.
[32:07.810 --> 32:08.810]  I sent him a little email.
[32:08.990 --> 32:10.970]  I said, hmm, you know, I saw this news story.
[32:11.510 --> 32:16.270]  Has the FBI come to talk to you about that reported Bin Laden email message?
[32:17.470 --> 32:22.490]  And he gave me a no comment, which is what you kind of expect, which is the right thing to say.
[32:22.490 --> 32:27.010]  But my feeling was, just the way he said no comment was the answer was yes.
[32:32.730 --> 32:38.270]  I have another hosting service, which is in Ramallah, Palestine, as it says here.
[32:38.270 --> 32:43.050]  Now, I think the FBI probably has some problems getting cooperation from these folks.
[32:44.990 --> 32:50.870]  But I wouldn't be too surprised if there's a packet, you know, the wire that comes into Ramallah is probably going through Israel.
[32:51.030 --> 32:52.550]  There might be a big old packet sniffer there.
[32:58.650 --> 33:00.790]  And then the third company is Webstar.
[33:01.010 --> 33:02.110]  They're based in the UK.
[33:02.110 --> 33:05.110]  Most likely the email probably came through this one.
[33:06.030 --> 33:17.830]  You know, given that Bin Laden is arguably the number one wanted criminal in the world today, you know, I'm sure that the FBI was going through all these sources here to try to track him down.
[33:18.310 --> 33:22.270]  And he still seems to be on the run, so again, I don't think he's successful, but they certainly were looking.
[33:28.900 --> 33:35.280]  This is another case that's been in the news a fair amount from last fall, of course, is the anthrax attack.
[33:36.890 --> 33:46.380]  Where somebody mailed five or six or seven letters that contained anthrax to various media people, as well as Senators Leahy and Daschle.
[33:47.320 --> 33:51.460]  What I've got on the screen here is this is from the FBI website.
[33:51.640 --> 33:53.320]  They released pictures of the letters.
[33:55.030 --> 34:01.360]  More specifically, the envelopes that were used to send the anthrax.
[34:02.950 --> 34:05.300]  And, you know, you can see a lot of interesting things on there.
[34:05.710 --> 34:09.920]  The first thing that stuck out in my mind was just that whoever wrote these, you know, used all caps.
[34:10.140 --> 34:14.000]  You know, they used big caps for capital letters, but they used no lower case.
[34:14.560 --> 34:20.640]  So it's sort of a very sort of methodical writing of letters here.
[34:20.640 --> 34:26.420]  You also notice there's, like, a nine-digit zip code.
[34:26.740 --> 34:28.860]  Anybody in this room use nine-digit zip codes?
[34:30.680 --> 34:31.080]  Okay.
[34:31.400 --> 34:33.640]  Well, the FBI would like to talk to you afterwards.
[34:40.810 --> 34:41.850]  I have one, too.
[34:41.950 --> 34:48.610]  I don't know what it is, but I find it interesting that just somebody took that level of care, you know, to write it out.
[34:48.610 --> 34:57.830]  And if you go, and if you look down here on the Leahy letters and the Daschle letters, the Daschle letters somehow got wet.
[34:58.010 --> 35:02.330]  But there's pretty clearly a nine-digit zip code on there also.
[35:03.870 --> 35:06.490]  So, and these turned out to be the correct addresses.
[35:06.830 --> 35:09.410]  You know, they just didn't write, like, Senator Daschle, U.S.
[35:09.510 --> 35:10.090]  Senate, whatever.
[35:10.330 --> 35:15.470]  Somebody went through the trouble of getting the correct addresses for these two, for the two senators.
[35:15.950 --> 35:20.270]  So the question is, well, gee, you know, what directory or how did they go about doing that?
[35:22.910 --> 35:25.970]  And anybody got some suggestions of where you get addresses for senators?
[35:40.130 --> 35:41.510]  Okay, but that's a different question.
[35:41.630 --> 35:44.430]  I was asking if you just want to get the whole address, ignoring the nine digits.
[35:44.430 --> 35:44.510]  Is this?
[35:44.670 --> 35:45.350]  No, no, no.
[35:45.470 --> 35:47.070]  Senate.gov slash totally late.
[35:47.650 --> 35:48.050]  Okay.
[35:49.910 --> 35:50.270]  Okay.
[35:50.490 --> 35:51.150]  Find a book, yeah.
[35:52.230 --> 35:54.850]  Go to the library and find a directory there or something like that.
[35:55.450 --> 35:58.470]  Okay, so those are, those, they're out there.
[35:59.150 --> 36:04.830]  Well, what's kind of interesting is, if you go to Senate.gov, they only use the five-digit zip code.
[36:07.510 --> 36:09.790]  Okay, okay, okay, okay, slow down.
[36:10.570 --> 36:11.890]  You're ruining my pitch here.
[36:16.610 --> 36:22.970]  Except that each senator has their own five-digit, own unique nine-digit zip code.
[36:23.070 --> 36:24.210]  So I don't think that's in there.
[36:24.830 --> 36:25.330]  I don't think in there.
[36:25.610 --> 36:29.030]  So yeah, you go in, well, you go in Google and here's some things you learn.
[36:30.330 --> 36:33.730]  There's lots and lots of different ways of writing an address to your senator.
[36:33.950 --> 36:34.790]  There's a lot of variations.
[36:35.230 --> 36:39.050]  You know, the five-digit versus nine-digit zip code is one thing.
[36:39.170 --> 36:44.350]  But how you write that Russell Senate office building, there's like six or seven variations on that.
[36:44.470 --> 36:48.570]  So anyway, there's about a dozen variations on how you write an address to your senator.
[36:49.990 --> 36:58.110]  First of all, about 90% of the addresses on the internet, and this is proven by Google, use five-digit zip code, not the nine-digit zip code.
[36:58.770 --> 37:08.470]  And only a small number of places spell out the address the same way that's done here, like 433 Russell Senate office building.
[37:09.310 --> 37:18.550]  One of those places is called Congress.org.
[37:18.590 --> 37:20.150]  Now, this is a private company.
[37:20.330 --> 37:22.410]  It's a company called Capital Advantage.
[37:23.330 --> 37:28.490]  So they have, if you look down here, sort of in the middle of the page, you'll see the same format.
[37:28.710 --> 37:32.030]  433 Russell Senate office building, Washington, D.C., and so on.
[37:32.030 --> 37:39.250]  So it turns out there's only about three or four websites that use this same format for the address that the anthrax letters do.
[37:40.910 --> 37:47.410]  So what you're looking for is the Senate anthrax letters were mailed on October 9th.
[37:47.710 --> 38:01.670]  So you're looking at somebody who was poking around, say, at Congress.org on the 7th or 8th or maybe even the 9th, who looked up both Daschle and Leahy on the same day because we have individual pages for those folks.
[38:02.190 --> 38:06.170]  And then there's a couple other websites that have the same thing for 9-digit zip codes.
[38:06.470 --> 38:12.570]  Again, there's been no arrest here, so this is unclear if this works or not, but I think it's worth a real good shot.
[38:13.090 --> 38:14.950]  I think the FBI thinks a good shot, too.
[38:21.610 --> 38:27.070]  This is sort of another interesting story, a little bit less about the web, but I think it's still an interesting thing.
[38:27.070 --> 38:34.230]  As we go back to the return address, it says fourth grade, Greendale School, Franklin Park, New Jersey, 08852.
[38:35.990 --> 38:37.710]  Well, there's no Greendale School.
[38:39.070 --> 38:43.410]  There is a Franklin Park, New Jersey, but its zip code is not 08852.
[38:43.610 --> 38:47.370]  That's the next town over, Mammoth Junction, I believe.
[38:48.910 --> 38:53.850]  But there is, in Kendall Park, which is right next to Franklin Park, a school called Green Brook School.
[38:53.850 --> 38:56.790]  And it happens to go from K through fourth.
[38:59.030 --> 39:01.170]  And it doesn't go higher than that.
[39:01.410 --> 39:09.310]  So we have this address, which has all these components from all these little towns in New Jersey, north of Trenton.
[39:12.170 --> 39:20.110]  And, you know, maybe the guy made up this address, you know, clearly the address is on there to hopefully get the Senate staffers to open up the envelope.
[39:20.110 --> 39:26.190]  Because this was sent out after he had sent out media letters where nobody seemed to be opening the letters.
[39:26.370 --> 39:33.110]  So he put on this school, fake school thing, assuming that the Senate staffers would, you know, not ignore something from an elementary school.
[39:33.970 --> 39:43.470]  Now, either this guy got extremely lucky and had, you know, got all these hits for this little area in New Jersey, or somehow he knew about this area.
[39:44.470 --> 39:46.970]  And the question is, how did he know about it?
[39:47.530 --> 39:49.090]  Well, there's a couple possibilities.
[39:49.530 --> 39:54.550]  You know, one is he lived in that area or worked in that area and kind of remembered stuff.
[39:54.750 --> 39:56.270]  And then he constructed this address.
[39:56.930 --> 40:00.130]  Remember, the postmark on this here and the letters are from Trenton, New Jersey.
[40:00.230 --> 40:03.030]  So he wanted to come up with a return address right around that area.
[40:03.610 --> 40:09.450]  So that's one possibility, is he somehow had some association with the area and just remembered this stuff.
[40:09.450 --> 40:14.970]  The other possibility is he went on the internet and dug up this information somehow.
[40:15.890 --> 40:23.810]  Well, if you kind of plop all that stuff into Google, you plop in like, you know, Franklin Park or Greendale or whatever, or Green Brook.
[40:24.230 --> 40:29.970]  If you type in Green Brook, Franklin Park and that zip code, you actually get a hit on the internet.
[40:30.090 --> 40:33.230]  You come up with one page on the internet that has all the information on it.
[40:46.930 --> 40:52.770]  And what it is, there's a mobile home park about five miles away from that Green Brook school.
[40:53.070 --> 40:54.550]  And it has a round town.
[40:54.670 --> 40:59.150]  You know, a directory of all the schools in the area and churches and shopping centers and that sort of thing.
[40:59.290 --> 41:01.710]  So all that information is on this one page.
[41:01.970 --> 41:05.810]  So did this guy get a hold of this directory somehow and then construct stuff?
[41:06.070 --> 41:10.450]  And there's also a second page that has almost all the same information, but not quite.
[41:10.730 --> 41:13.050]  Just it's a webpage of schools in that area.
[41:13.050 --> 41:18.370]  So again, he might have constructed the return address off the internet.
[41:18.790 --> 41:21.190]  You know, that he knew he was going to mail from Trenton.
[41:21.370 --> 41:25.550]  He said, I need to get a, you know, sort of a valid school from that area and made it.
[41:25.670 --> 41:27.170]  This is all speculation, though.
[41:27.310 --> 41:32.570]  I mean, this, you know, we won't know until somebody is arrested here what that connection is.
[41:32.650 --> 41:36.450]  But it's sort of this very intriguing thing of how he created this address.
[41:36.450 --> 41:38.790]  Now, what's interesting is...
[41:48.590 --> 41:50.010]  This is very interesting.
[41:51.970 --> 41:57.030]  Well, I don't know if anybody's had experience talking to the FBI, but it's usually one-way communications.
[42:00.230 --> 42:03.590]  I mean, Rudy was talking in an earlier thing today.
[42:03.590 --> 42:04.390]  He's a little intimidated.
[42:04.590 --> 42:05.950]  I sort of feel less intimidated.
[42:06.130 --> 42:08.490]  But in general, it's one-way transfer information.
[42:09.690 --> 42:10.090]  So...
[42:10.730 --> 42:19.330]  What's interesting, though, is if you go back and we talk about that Green Book School and we talk about that zip code and we talk about Kendall Park, it turns out there's two roads that meet.
[42:20.830 --> 42:24.490]  One's called Beekman Road and State Road 27 in Kendall Park.
[42:24.490 --> 42:26.690]  It's a T intersection where they meet.
[42:27.390 --> 42:31.410]  And all the components of that address, that return address, are only about a quarter mile away.
[42:31.550 --> 42:34.710]  You can stand at this corner and you can kind of look at all the pieces of that return address.
[42:34.870 --> 42:35.370]  It's sort of eerie.
[42:35.690 --> 42:41.330]  What's really weird is this sign that's hanging up there on a telephone pole right next to it, right at this intersection.
[42:41.430 --> 42:42.750]  It says, Murder Mystery Dinners.
[42:42.750 --> 42:47.030]  And it gives that phone number, which I didn't call, but some reporters have called.
[42:47.830 --> 42:50.590]  But I just thought it was sort of a fitting thing when I was there.
[42:50.690 --> 42:53.070]  And I kind of looked up and there was that sign.
[42:59.390 --> 42:59.750]  Yeah.
[43:01.470 --> 43:03.130]  Right, it's in Trenton where it was mail from.
[43:03.310 --> 43:03.530]  I didn't know.
[43:03.750 --> 43:14.070]  Yes, a reporter actually from the Wall Street Journal did call this number up and they sort of said, oh yeah, we're just running a little, you know, little home business here helping people set up murder mystery dinners.
[43:14.250 --> 43:15.810]  You know, no, nothing to do with anthrax.
[43:25.420 --> 43:26.200]  Yes, exactly.
[43:27.240 --> 43:33.300]  Some of this stuff with the anthrax, if you go to www.computerbytesman.com.
[43:34.700 --> 43:36.600]  At least some of the anthrax stuff is up there.
[43:37.460 --> 43:43.380]  That's pretty much my presentation, so what I can do is we have about ten minutes for questions.
[43:43.940 --> 43:46.240]  And I saw two hands go up here first.
[43:47.560 --> 43:48.060]  Yes.
[43:48.320 --> 43:48.360]  Yes.
[43:48.360 --> 43:48.380]  Yeah.
[44:09.700 --> 44:11.140]  Where's the S video in?
[44:17.230 --> 44:18.370]  There it is.
[44:19.350 --> 44:20.330]  SCS video out there.
[44:21.510 --> 44:22.190]  Okay.
[44:27.790 --> 44:28.470]  Okay.
[44:32.010 --> 44:40.550]  Well, one thing that's happened, what's interesting with 802.11B networking is your computer broadcasts its MAC address.
[44:43.670 --> 44:44.070]  Yeah.
[44:44.250 --> 44:46.290]  Well, maybe they can, but right now it is.
[44:46.490 --> 44:49.910]  So you actually have this built-in tracking device that's kind of watching you as you go around.
[44:53.630 --> 44:54.030]  Yeah.
[44:54.890 --> 44:55.290]  Yeah.
[44:55.650 --> 45:00.390]  So the question is, is an access point, what kind of logging it does.
[45:00.610 --> 45:05.830]  And if it logs MAC addresses, then that's a pretty interesting piece of information.
[45:08.070 --> 45:08.870]  Sure you can.
[45:09.010 --> 45:09.950]  You spoof IP addresses.
[45:09.950 --> 45:11.110]  Oh, definitely.
[45:11.150 --> 45:11.550]  Yeah.
[45:11.970 --> 45:12.930]  There's people in jail now.
[45:13.750 --> 45:14.150]  Yeah.
[45:14.310 --> 45:15.210]  That's all very true.
[45:15.370 --> 45:21.330]  And that's why when you're investigating a crime, you just can't say, oh, we've got an IP address and blah-bity-blah, this is the end of the story.
[45:21.430 --> 45:22.650]  That's not how it works at all.
[45:23.010 --> 45:24.630]  You go out and you've got to do legwork.
[45:24.710 --> 45:28.930]  You've got to match up here and you've got to start figuring out how the pieces of the puzzle fit together.
[45:29.250 --> 45:32.470]  An IP address or a MAC address is only one small part of that puzzle work.
[45:33.190 --> 45:35.790]  And that's sort of the main message here in this.
[45:36.030 --> 45:38.550]  But IP addresses offer you very good leads.
[46:17.030 --> 46:25.770]  The question is, when somebody makes a plane reservation, can we go look at other databases and profile that person in order to see if he's a risk?
[46:25.950 --> 46:28.070]  He or she is a risk is the basic question.
[46:28.390 --> 46:31.810]  And we do that already a little bit and we're looking to do a lot more of that.
[46:32.490 --> 46:34.210]  Well, it's already being done today.
[46:34.390 --> 46:41.790]  I don't know how many folks ever get phone calls from your credit card company and say, you know, Mr. and Mr. and Mrs. Smith, did you lose your credit card?
[46:41.930 --> 46:44.290]  We have some suspicious purchase patterns here.
[46:44.470 --> 46:46.130]  And that's all being done by software.
[46:46.450 --> 46:53.510]  It turns out the same companies who do the credit card stuff are looking in to expand their business and go into airline profiling, too.
[46:54.370 --> 47:02.290]  The discussion right now is mainly to use publicly available databases, you know, what are called public records, you know.
[47:03.250 --> 47:08.790]  And I just wonder, you know, I understand how the credit card fraud systems work.
[47:08.970 --> 47:10.650]  In my case, they've been pretty inaccurate.
[47:10.850 --> 47:14.550]  I've probably been called 20 or 30 times and actually only lost my card once.
[47:16.690 --> 47:19.070]  But at the airport, you've got an issue here.
[47:19.190 --> 47:21.730]  A policy is, okay, so you have software.
[47:21.810 --> 47:23.730]  No matter how good it is, it's going to make some errors.
[47:23.850 --> 47:25.330]  But how do you deal with that person?
[47:25.590 --> 47:34.110]  What they're saying is they want to choose the quote-unquote high-risk individuals for the extra searches, which are now being done more randomly.
[47:35.690 --> 47:44.130]  You know, but I'm not sure of the usefulness of it.
[47:44.250 --> 47:48.610]  I mean, I can sort of see why they're looking for some kind of silver bullet here to try to read people's minds.
[47:48.750 --> 47:50.030]  I mean, that's what they're kind of looking for here.
[47:50.070 --> 47:51.410]  How can we read people's minds?
[47:52.050 --> 47:54.810]  So I, you know, I kind of wonder.
[47:54.950 --> 48:01.990]  I mean, it would be much better to maybe look at who we let in flight schools, you know, or why don't we have better cockpit doors, you know.
[48:01.990 --> 48:05.150]  There's lots of ways of building more secure systems.
[48:05.370 --> 48:06.730]  But in general, security is hard.
[48:06.810 --> 48:07.890]  But that's what they want to try to do.
[48:08.030 --> 48:09.090]  We'll have to see how it works.
[48:10.730 --> 48:11.110]  Yeah.
[48:13.150 --> 48:13.530]  Yeah.
[48:13.910 --> 48:21.130]  I've been told that if you have a publicized status, you have a publicized status, you have a publicized status.
[48:22.230 --> 48:24.850]  Well, I'm not a PI, and I haven't...
[48:25.710 --> 48:27.250]  All I can tell you is I read...
[48:27.250 --> 48:32.730]  I used to be able to buy this magazine at Barnes and Nobles, and there's all sorts of stuff you can supposedly buy.
[48:33.230 --> 48:37.390]  I think there's a lot of it was done under pretexting, which is sort of lying to get the information originally.
[48:37.530 --> 48:38.750]  But there was stuff about phone records.
[48:38.890 --> 48:41.050]  I've heard definitely stories about getting phone records.
[48:41.650 --> 48:43.850]  I'm just not an expert in that area.
[48:45.050 --> 48:47.610]  But there is a lot of data out there on this, obviously.
[48:48.010 --> 48:51.410]  You know, credit card records, phone records, all this stuff.
[48:52.390 --> 48:54.770]  You know, who can get to it under what circumstances?
[48:54.770 --> 48:55.530]  I'm just not sure.
[48:57.090 --> 48:57.430]  Yeah?
[48:57.550 --> 48:58.050]  Is that a room?
[48:58.590 --> 48:59.150]  Oh, wait a minute.
[48:59.210 --> 49:00.210]  Let me get the other side of the room here.
[49:01.350 --> 49:01.590]  Yeah?
[49:01.870 --> 49:05.030]  How easy would it be to get that sort of information?
[49:05.230 --> 49:08.610]  Do you have to be a government or one of the ISPs cooperates here?
[49:08.610 --> 49:10.150]  In what situation?
[49:10.510 --> 49:10.590]  In what situation?
[49:10.590 --> 49:11.350]  It depends on the situation.
[49:11.610 --> 49:11.750]  I think.
[49:11.870 --> 49:13.610]  Say you're a private agent or whatever.
[49:17.630 --> 49:18.150]  Yeah.
[49:18.510 --> 49:21.270]  The question is, when will ISPs turn over data?
[49:23.070 --> 49:25.630]  I can answer that question because I deal with this all the time.
[49:26.090 --> 49:29.890]  ISPs usually require either search and seizure warrants or subpoenas.
[49:30.310 --> 49:34.590]  Although if you're a customer and you can speak the bill, they'll give you detailed billing.
[49:35.910 --> 49:36.430]  Okay.
[49:37.130 --> 49:39.310]  I'll tell you another quick story along these lines.
[49:39.470 --> 49:41.730]  And it's another one of these really, really sad stories.
[49:41.910 --> 49:49.970]  But I got an e-mail once from a couple out in Michigan saying, we think something's funny with our niece.
[49:50.130 --> 49:53.010]  We get an e-mail from her, but it just doesn't seem like it's her.
[49:53.910 --> 49:59.870]  And is there any way using web bugs and other stuff that we can somehow determine if it's really her writing e-mails?
[50:00.570 --> 50:05.910]  And I looked at this and I sort of said, this is overprotective aunts and uncles, you know, and I don't know what the situation is.
[50:06.210 --> 50:07.730]  But I said, well, send me the e-mail.
[50:07.830 --> 50:08.490]  So they sent me the e-mail.
[50:08.590 --> 50:10.410]  I said, okay, well, here's the IP address it's from.
[50:11.010 --> 50:12.370]  It belongs to this ISP.
[50:12.510 --> 50:15.670]  Go with your lawyer to these people and try to get whatever data you can.
[50:15.810 --> 50:16.990]  So I said, go in with the lawyer.
[50:17.670 --> 50:23.090]  Well, about four or five months later, then I read about her in the newspaper that she was a victim of sexual murder.
[50:23.090 --> 50:32.170]  And so the aunts and uncles feeling about the e-mail messages were unfortunately right on target.
[50:33.650 --> 50:35.330]  But I said, go in with the lawyer.
[50:35.450 --> 50:36.190]  That was my advice.
[50:36.750 --> 50:36.830]  Yeah.
[50:37.110 --> 50:39.450]  I have a question regarding web logs.
[50:39.770 --> 50:46.610]  In terms of the logging of this data, is there any evidence that that's actually reliable data in terms of prosecution?
[50:46.970 --> 50:49.470]  In fact, it's quite easy to rewrite a log.
[50:49.950 --> 50:57.350]  And therefore, over time of actual prosecution, even if you can catch the criminals, isn't there a certain amount of doubt that logs might actually be fake?
[50:57.530 --> 51:02.250]  And therefore, is that not actually creating the secondary problem if you start to alarm these logs?
[51:03.090 --> 51:05.730]  Well, I think it goes back to what I was saying before.
[51:05.830 --> 51:07.530]  You have to corroborate the evidence.
[51:07.770 --> 51:13.710]  So certainly a defense attorney can attack maybe on those grounds or attempt to attack on those grounds.
[51:14.510 --> 51:18.030]  But I think there would be corroborating evidence that would sort of say otherwise.
[51:18.410 --> 51:23.130]  So I don't think you just rely on a log file and that's it and send somebody off.
[51:23.290 --> 51:25.190]  I don't think you can go after the anthrax guy.
[51:25.710 --> 51:28.070]  It's just because he looked up Leahy and Daschle.
[51:28.950 --> 51:38.430]  It's just that if you start to see a world in which the ISPs are expected to log the data, then that brings up the expectation that that's going to be used in the trials.
[51:38.590 --> 51:41.510]  But you've got to also assert that there's some way to prove that.
[51:42.270 --> 51:42.670]  Right.
[51:45.470 --> 51:50.030]  Well, when I was at the Privacy Foundation, we looked at Carnivore and what it does.
[51:50.030 --> 51:57.450]  And so one of the things we said is in order to... we thought that the log files produced by Carnivore should be digitally signed.
[51:57.810 --> 52:01.850]  You know, so that it gets away from any kind of questions about it.
[52:01.930 --> 52:10.250]  So in that case where you're absolutely using that file in a criminal investigation or in court, you know, that should have those kind of protections.
[52:10.470 --> 52:11.750]  You know, the FBI should just do that.
[52:12.150 --> 52:20.250]  These other kind of log files, yeah, I mean, if we get into all... you know, if the government starts requiring people to store them and whatever, maybe we'll get to that level, but...
[52:23.670 --> 52:24.230]  Yeah.
[52:27.520 --> 52:28.860]  Okay, any other questions?
[52:29.140 --> 52:29.240]  Okay.
[53:00.140 --> 53:00.700]  Yeah.
[53:01.940 --> 53:03.480]  That's absolutely true.
[53:03.680 --> 53:08.760]  And that's... when you're investigating a crime, you have to consider those situations.
[53:09.260 --> 53:12.560]  It's good you brought that up, because I'm personally looking a lot at the anthrax case.
[53:12.560 --> 53:15.260]  And they actually have some guy who's sort of a suspect.
[53:15.520 --> 53:17.940]  And they're saying now they can't place him in Trenton on the dates.
[53:18.260 --> 53:20.940]  So I said, ah, mail forwarders, just like you said.
[53:21.160 --> 53:24.980]  And I haven't really found anybody in Trenton that will do it on the internet.
[53:25.140 --> 53:32.300]  If you go in under remailers in Google, you can find people who mail stuff, but not from Trenton.
[53:33.920 --> 53:34.900]  Right, exactly.
[53:35.040 --> 53:35.120]  Yeah.
[53:35.460 --> 53:38.940]  I found people in Daytona and Pennsylvania and Anchorage, Alaska.
[53:39.280 --> 53:45.480]  The guy in Alaska stopped doing it, though, after the anthrax letters, because he was afraid somebody might send an anthrax letter through him.
[53:47.980 --> 53:48.420]  So...
[53:48.420 --> 53:49.400]  Uh-huh.
[53:50.680 --> 53:51.120]  Yeah.
[53:52.080 --> 53:53.480]  Okay, I think we're out of time here.
[53:54.000 --> 53:55.380]  Okay, one more quick question.
[53:59.320 --> 54:00.320]  Way in the back.
[54:01.960 --> 54:06.860]  Do you know the mechanism, how Hotmail keeps track of the users?
[54:07.420 --> 54:10.460]  See, I opened an account once on there like a while ago.
[54:10.750 --> 54:13.420]  And then when I went back there, I recognized who I was.
[54:13.420 --> 54:15.480]  Well, it's cookies on the computer.
[54:15.750 --> 54:17.250]  No, I didn't use cookies.
[54:18.140 --> 54:19.380]  I wiped them out.
[54:20.400 --> 54:20.600]  Uh-huh.
[54:21.290 --> 54:29.500]  Well, I don't have enough data here, but normally the way that Hotmail or any website remembers who you are from one day to the next is your cookies.
[54:30.140 --> 54:32.730]  I want a data way of reading somehow the registration.
[54:33.700 --> 54:36.480]  Yeah, no, it definitely is cookies.
[54:36.600 --> 54:39.520]  And you can turn that on or off within Hotmail itself.
[54:42.600 --> 54:42.920]  Yeah.
[54:43.960 --> 54:44.270]  Yeah.
[54:55.670 --> 54:55.990]  Hmm.
[54:56.170 --> 54:56.690]  That's not for me.
[54:57.570 --> 54:57.890]  Yeah.
[54:59.770 --> 55:03.050]  In the case of Wooden Media Player, I agree, there is some numbers in there.
[55:03.110 --> 55:04.430]  But the Hotmail, it's got to be cookies.
[55:04.510 --> 55:05.610]  I don't know any other way.
[55:05.770 --> 55:05.810]  So.
[55:06.230 --> 55:07.270]  Okay, well, thank you very much.