[00:00.000 --> 00:01.000]  All right.
[00:01.120 --> 00:01.960]  Good morning, everyone.
[00:02.440 --> 00:02.920]  Morning.
[00:04.500 --> 00:04.760]  Okay.
[00:04.980 --> 00:09.000]  Thanks for everyone who got up early, early hacker time to come and join me.
[00:09.720 --> 00:16.980]  And thank you to all the AV people who have been working really hard for the last few days and everyone that's worked hard to put on this amazing gathering.
[00:16.980 --> 00:20.760]  I really appreciate all of the tireless work that goes into it.
[00:20.960 --> 00:24.480]  And I want to say hi to the viewers at home on the live stream.
[00:24.580 --> 00:26.200]  Hi, mom, in California.
[00:26.460 --> 00:29.080]  And hi, everyone else who's in the hotel.
[00:29.080 --> 00:30.820]  But too tired to come out.
[00:31.120 --> 00:34.820]  So my name is Caitlin Kelly Henry, and I'm an attorney and a professor.
[00:35.060 --> 00:36.700]  I'm based out of Oakland, California.
[00:37.400 --> 00:38.940]  And I have a law practice in Oakland.
[00:39.200 --> 00:45.000]  I work on Freedom of Information Act, but a lot of my work also focuses on working with incarcerated people.
[00:45.260 --> 00:52.560]  So I work on prison conditions and post-conviction issues and other things like that.
[00:52.680 --> 00:54.840]  If you have questions about that, you can ask me after.
[00:55.060 --> 01:00.240]  Today won't be a time for legal advice and Q&A about your criminal issues you might be facing.
[01:00.580 --> 01:04.780]  So if you have questions in the Q&A, please keep them broad and about FOIA.
[01:05.060 --> 01:07.600]  I will look at tweets if you send tweets.
[01:07.840 --> 01:08.780]  And I have some cards.
[01:08.880 --> 01:10.200]  A colleague up there, you want to hold those up?
[01:10.940 --> 01:18.480]  If you don't want to ask your question in front of the group, you can go ahead and write it down on the card and leave it and I'll read it.
[01:18.700 --> 01:21.020]  There's no microphone in the audience here.
[01:21.060 --> 01:25.340]  So I'll just repeat the questions for the video and for the viewers at home when we get to Q&A.
[01:25.340 --> 01:27.920]  I'm going to try to leave 10 minutes at the end for Q&A.
[01:28.900 --> 01:31.660]  So today we're going to be talking about FOIA, the Freedom of Information Act.
[01:31.800 --> 01:41.560]  We're going to be talking about the Federal Freedom of Information Act, not the states or the local Privacy Act or Sunshine issues you might be facing.
[01:41.680 --> 01:44.920]  But we're talking about the Federal Freedom of Information Act and Privacy Act.
[01:45.020 --> 01:50.940]  And that applies to agency records for FOIA on the federal level and system records for the Privacy Act.
[01:51.300 --> 01:55.260]  And the Privacy Act is about individuals, records that are kept about you
[02:04.800 --> 02:10.960]  And we will talk about data management.
[02:11.580 --> 02:25.240]  Agencies manage data in certain ways that makes it easy for the agency, potentially, sometimes not, for the agency to get the information it needs and the workers to look for the information via the methods that they can use.
[02:25.260 --> 02:31.860]  But there's a disincentive for agencies to have responsive methods for searching for records for you.
[02:32.160 --> 02:53.440]  So we'll talk about reverse engineering through FOIA, getting information about the topic you want, but also getting information about the processes that the agencies use to collect and maintain data in order to understand how to make better requests and get more information and share information with the hacker community and the public about mass surveillance and infrastructure.
[02:53.440 --> 02:56.720]  So, today we're going to do a few things.
[02:56.940 --> 03:05.980]  I'm going to teach you five steps to the FOIA process, so how to prepare before you draft, and then I'm going to tell you about 15 items to include in your request.
[03:06.260 --> 03:14.020]  And I'm going to go over the items that are not self-explanatory, like telling the agency where to find records, or I'm going to talk a lot about Kafka today.
[03:14.300 --> 03:20.180]  Sometimes you have to prove that records exist before you ask the agency for the records you hope exist.
[03:20.180 --> 03:26.940]  So, I'll talk a little about the Catch-22s and the paradoxes, and there'll be time at the end for questions and for stickers.
[03:27.140 --> 03:29.120]  There's stickers here and in the back.
[03:29.680 --> 03:32.180]  So, why should hackers use FOIA?
[03:32.340 --> 03:33.240]  It's a hacker convention.
[03:33.480 --> 03:36.200]  We're talking about electronic data today.
[03:37.020 --> 03:42.200]  Specifically, there's different categories of data within FOIA and the definition of records we'll go over later.
[03:42.200 --> 03:46.240]  But hackers should use FOIA to get information, right?
[03:46.420 --> 03:46.980]  Like Beyonce.
[03:47.240 --> 03:53.080]  Someone told me I could not play that today and cut out a lot of my bad jokes, so we're going to have a more serious presentation.
[03:53.300 --> 03:55.200]  But, you know, to get information...
[03:56.480 --> 03:57.240]  Yeah, thank you.
[03:57.360 --> 03:57.680]  Thank you.
[03:57.780 --> 03:59.040]  Okay, I'll keep the jokes at a minimum.
[03:59.240 --> 03:59.420]  It's early.
[03:59.660 --> 04:01.120]  So, you want to protect privacy.
[04:01.280 --> 04:02.800]  You want to expose surveillance.
[04:03.500 --> 04:17.040]  You want to educate the public, especially the non-technical public, if you can deconstruct documents and explain to regular people what they mean, the technical documents, and why it's important to understand them, you're doing a great service for the public.
[04:17.280 --> 04:18.900]  And you could be a whistleblower.
[04:19.060 --> 04:21.780]  There's a lot of talk about whistleblowers at this conference this weekend.
[04:22.200 --> 04:26.640]  And because information wants to be free, right?
[04:26.920 --> 04:27.740]  Yes, hackers.
[04:28.120 --> 04:28.300]  Okay.
[04:28.520 --> 04:34.240]  So, you can also think of FOIA as an attack vector, a lawful attack vector against these government systems.
[04:34.240 --> 04:35.460]  You have a right.
[04:35.600 --> 04:38.920]  You are entitled to get records about yourself and about the agencies.
[04:39.440 --> 04:43.580]  And you can try to understand how these data systems work.
[04:43.680 --> 04:49.680]  How the agencies are collecting data about you, about me, and using that data.
[04:49.880 --> 04:54.360]  So, it's a way to understand surveillance and to potentially undermine it.
[04:54.540 --> 05:00.900]  So, when we understand how they maintain the data, how they collect the data, it shows us what the agencies are thinking.
[05:00.900 --> 05:05.940]  And that helps us understand how to fight some of the harmful things.
[05:06.160 --> 05:14.400]  So, organizing information through FOIA and understanding how the agencies organize that information themselves is helpful.
[05:14.740 --> 05:18.900]  And today, we'll be talking about both the records and the way the records are maintained.
[05:19.260 --> 05:23.900]  And we'll be talking about reverse engineering those systems to make more effective requests.
[05:24.020 --> 05:30.020]  Some of you have heard of mosaic theory, the idea of piecing together these bits of information to make a more holistic picture.
[05:30.020 --> 05:33.460]  And you can think of FOIA as a way to do that.
[05:34.280 --> 05:42.240]  And you can think of reverse engineering, an agency that specifically designs its methods to fail.
[05:42.580 --> 05:42.720]  Right?
[05:42.920 --> 05:50.620]  So, Ryan Shapiro, prolific FOIA requester, has a suit right now being litigated by Jeffrey Light out of DC.
[05:50.620 --> 05:53.300]  They're both fantastic FOIA experts.
[05:53.880 --> 05:59.260]  And they have this suit specifically against the FBI, who we'll go into later.
[05:59.380 --> 06:03.760]  Their systems are from 1995 and are purposefully designed to be non-responsive.
[06:03.900 --> 06:09.600]  And we'll go over record requests later on that I did about HOPE and the agency responses about HOPE.
[06:09.640 --> 06:12.500]  And we'll use the FBI as an example specifically.
[06:13.140 --> 06:15.440]  So, let's talk about, well, what is a record?
[06:15.440 --> 06:19.300]  Can you raise your hand if you've done a FOIA or Privacy Act request before?
[06:20.800 --> 06:22.620]  So, a third of the crowd in the room here.
[06:23.100 --> 06:27.900]  So, you might have requested different things that count as a record or don't count as a record.
[06:28.120 --> 06:33.780]  When you do a FOIA request, an agency will look at three steps, more or less.
[06:33.940 --> 06:36.240]  The first is, does FOIA even apply?
[06:36.460 --> 06:36.600]  Right?
[06:36.700 --> 06:38.760]  There are certain things that FOIA doesn't apply to.
[06:38.960 --> 06:41.300]  Things that are secret and haven't been released yet.
[06:41.300 --> 06:43.640]  But, ongoing criminal investigations, right?
[06:44.180 --> 06:47.740]  And then, there are the questions that come later.
[06:48.000 --> 06:52.960]  If something is a record, which is the second question, is it a record or not?
[06:53.320 --> 06:55.780]  Then, the agency goes through that step.
[06:56.140 --> 07:01.840]  And there's a lot of questions and developing law about electronic records, electronic data.
[07:02.180 --> 07:06.700]  And there's a specific definition by the statute, the FOIA statute, 5 U.S.C.
[07:06.820 --> 07:09.980]  552, on what is a record and what isn't.
[07:09.980 --> 07:13.760]  But there's a lot of interpretation for electronic data.
[07:14.420 --> 07:24.140]  And so, in this enumeration, you can potentially ask for software, for compiled data, for file directories, and for a number of other things we'll discuss later.
[07:24.260 --> 07:26.540]  I have a more complete slideshow on my website.
[07:26.920 --> 07:35.360]  And I'm actually doing a four-hour class, if any of you are in B-Sides in Las Vegas, where I'll actually look at your requests, help you type your requests, and go over that.
[07:35.540 --> 07:39.400]  But we don't have time to go over all that information today, but it is on my website.
[07:41.940 --> 07:45.540]  So, agencies try to avoid release through obfuscation.
[07:45.740 --> 07:47.760]  We'll talk a little bit about the FBI system.
[07:48.140 --> 08:01.220]  But, as we're still in the planning stage and giving you context about why hackers, why FOIA, somebody told me that I should give a little context about whether normal people can do this, non-attorneys, and what the results might be.
[08:01.380 --> 08:03.260]  So, how often is FOIA used?
[08:03.360 --> 08:04.620]  How likely are you to succeed?
[08:04.620 --> 08:08.420]  So, this year, there were over 700,000 requests.
[08:08.580 --> 08:12.440]  Some of you might have been in the FOIA 50 panel, where that was discussed.
[08:13.480 --> 08:17.020]  Or in the two other FOIA talks yesterday by MuckRock.
[08:17.600 --> 08:21.800]  And last year, approximately 5% of the requesters were journalists.
[08:22.280 --> 08:24.700]  And 90% of the requesters were corporate entities.
[08:24.700 --> 08:34.960]  So, there are data brokers that mine data through FOIA, release it, a lot about the FDA or the EPA, release it to companies, to brokerage, to firms, things like that.
[08:35.180 --> 08:37.880]  And the average response was 149 days.
[08:38.080 --> 08:42.940]  And in 2016, we had the highest amount of FOIA suits, federal FOIA suits.
[08:43.040 --> 08:44.420]  I'm just talking about federal today.
[08:44.760 --> 08:50.180]  And we had 498 suits last year and 919 over the last two years.
[08:50.180 --> 08:53.180]  So, there's a lot of requests, a lot of suits.
[08:53.820 --> 09:11.040]  And yesterday, I learned in one of the panels that if you include legalese, so include some statutory language, make some legal arguments in your request or your appeals, you are 16% more likely, or you are likely to receive a 16% faster response time.
[09:11.280 --> 09:12.640]  So, I learned that yesterday in one of the panels.
[09:12.700 --> 09:13.640]  I thought that was pretty interesting.
[09:14.340 --> 09:18.500]  Most of the suits are against the Department of Justice, which I put up there.
[09:18.500 --> 09:26.300]  Over the last 15 years, there's been about 5,000 FOIA suits and 1,200 of them against the DOJ, various branches of the DOJ.
[09:26.480 --> 09:39.100]  And so, the DOJ specifically, I put up, not to overwhelm you with too much data, but I put up there, they received nearly 68,000 requests last year and processed over 4,000.
[09:39.440 --> 09:44.260]  And so, most agencies divide now into a simple track and a complex track.
[09:44.260 --> 09:49.800]  So, almost 70% are in the simple track and about 30% are in the complex track.
[09:50.340 --> 09:54.460]  And later on, we'll talk about what makes you get into either one of those tracks.
[09:56.340 --> 10:01.300]  And there are citations for exclusions, which means FOIA doesn't apply.
[10:01.660 --> 10:05.380]  And DOJ claims that only invoke that in 154 cases.
[10:06.020 --> 10:07.800]  And then there's different exemptions.
[10:07.880 --> 10:14.340]  And exemption number five is one that's used a lot, and especially used a lot in the electronic data category.
[10:14.360 --> 10:18.760]  And that's agency communications within the agency or between the agency.
[10:19.200 --> 10:22.360]  And there was a change in July was the 50th anniversary of FOIA.
[10:22.560 --> 10:25.300]  There was a change in the FOIA Improvement Act of 2016.
[10:25.300 --> 10:28.960]  And now that's restricted to records that are less than 25-years-old.
[10:28.960 --> 10:29.840]  So, that's a big change.
[10:30.060 --> 10:31.240]  That's used a lot.
[10:31.360 --> 10:35.320]  You can think of the Hillary Clinton emails or things like that when you're thinking of that.
[10:35.960 --> 10:49.080]  So, in using the example before I get to the HOPE one that I filed to go through as an example of a request and a response, I'm going to talk about a completed response, and that was within this community.
[10:49.340 --> 10:54.420]  So, Aaron Swartz, people requested his records after his death.
[10:54.420 --> 10:57.420]  You lose your rights under the Privacy Act upon death.
[10:57.620 --> 11:01.420]  So, somebody dies, other people can show proof of death and request their records.
[11:01.660 --> 11:04.100]  And you don't have the same right to privacy as you do when you're alive.
[11:04.560 --> 11:07.600]  So, people filed various requests for Aaron's records.
[11:07.940 --> 11:11.940]  And initially, the FBI said, Oh, well, we don't have any records indexed to his name.
[11:12.300 --> 11:14.780]  We found 23 records and that's it.
[11:15.060 --> 11:15.280]  Right?
[11:15.500 --> 11:22.860]  Pretty unrealistic given how high profile the prosecution against him was, how long the investigation was, and all the different agencies involved in it.
[11:22.860 --> 11:35.860]  FOIA applies not just to the records generated by the particular agency, so not just records the FBI created, but any records that are maintained by the agency in the possession of the agency or the control of the agency.
[11:36.960 --> 11:45.260]  So, the U.S. Marshals arresting him, the Secret Service maintaining records, and anything like that would also, if it was maintained by the FBI, be required to be disclosed.
[11:45.420 --> 11:50.680]  And so, the way that the FBI responded, right, they said we only have 23 records.
[11:50.680 --> 11:54.260]  Well, if you've done FOIA before, then you know, well, that's pretty unrealistic.
[11:54.480 --> 11:57.260]  It must be the way that the agency did its search.
[11:57.420 --> 12:02.780]  And so, we're going to go over how the FBI designs its FOIA to not be responsive.
[12:02.960 --> 12:04.980]  Later on, journalists and researchers found his files.
[12:05.220 --> 12:09.680]  They found a case number and cross-referenced materials.
[12:10.140 --> 12:22.780]  So, they found this file number, 228A, WF, bunch more, case number 315THQ, and I have a training on this on my website as well if you're interested in learning about case number and file numbers, but we don't have time for that today.
[12:23.520 --> 12:36.120]  And they did a cross-reference search where they found things indexed to those numbers and then found material about him that was potentially purposefully not indexed to his name in order to obfuscate that, because the agencies don't have an incentive to release it.
[12:36.920 --> 12:38.500]  Okay, what is this picture?
[12:38.760 --> 12:39.940]  A room full of technologists.
[12:40.200 --> 12:45.980]  Well, this is a picture of what the FBI uses to search FOIA, right?
[12:46.300 --> 12:47.080]  Pretty surprising.
[12:47.400 --> 12:49.200]  It's a system designed, when do you think?
[12:50.560 --> 12:51.240]  Ninety-five.
[12:51.240 --> 12:51.420]  Ninety-five.
[12:51.760 --> 12:53.440]  Yes, they use a system from 1995.
[12:54.420 --> 12:58.500]  And it is not a web application-based search system.
[12:58.640 --> 12:59.840]  It's not a powerful system.
[13:00.000 --> 13:01.120]  It's a green screen.
[13:01.380 --> 13:03.520]  It's a terminal connected to the mainframe, right?
[13:03.520 --> 13:08.640]  And they do a search of what they call their central record system using this.
[13:08.820 --> 13:11.060]  And they have a portal to this record system.
[13:11.240 --> 13:12.520]  And the portal is called ACS.
[13:13.280 --> 13:17.800]  And they have different methods of searching through ACS.
[13:17.860 --> 13:20.380]  And those are called the search methods.
[13:20.620 --> 13:24.340]  And they index records on a discretionary basis.
[13:24.640 --> 13:28.840]  So, the record started out as filing index cards.
[13:29.060 --> 13:32.400]  And there's warehouse in Virginia, presumably full of bankers boxes of these cards.
[13:32.400 --> 13:33.980]  They made them electronic, right?
[13:34.380 --> 13:38.020]  But agents have discretion on whether to index and how to index.
[13:38.200 --> 13:41.760]  What terms to use, if they want it to be responsive, right?
[13:42.320 --> 13:46.400]  Do you think agents in the field use the same system as they use for FOIA?
[13:47.740 --> 13:48.120]  No!
[13:48.700 --> 13:48.960]  Right?
[13:49.200 --> 13:50.840]  So, they have all these powerful systems.
[13:51.000 --> 13:54.680]  After 9-11, they got a lot of funding because of this needle in a haystack problem, right?
[13:54.680 --> 13:56.980]  They had all the information about 9-11 and the attacks.
[13:57.620 --> 14:00.320]  But it was not centralized.
[14:00.540 --> 14:01.420]  They didn't have a good way to find it.
[14:01.520 --> 14:05.560]  So, they've gone through various systems, more web application-based searches.
[14:06.280 --> 14:09.140]  And they developed other more powerful ways of searching this.
[14:09.240 --> 14:11.600]  They have something called Sentinel that they won't use in a default search.
[14:11.820 --> 14:13.760]  They have a system called IDW they developed.
[14:14.080 --> 14:15.800]  They have this new system called DIVs.
[14:15.800 --> 14:19.160]  I filed a suit a couple years ago and we got a declaration.
[14:19.360 --> 14:20.680]  It was the first declaration about it.
[14:21.660 --> 14:24.880]  And DIVs contain 122 data sets from different agencies.
[14:25.180 --> 14:28.400]  And what was really remarkable is the FBI can open it in the native environment.
[14:28.660 --> 14:34.480]  So, if I want to go into NYPD and they share it with the FBI and I'm at the FBI, I can just see what's on the screen.
[14:34.600 --> 14:35.680]  They don't filter records.
[14:35.760 --> 14:38.400]  They don't say, here's good information or bad information, right?
[14:38.560 --> 14:43.140]  You can just open it up and things don't get purged as we know from their giant data centers.
[14:43.740 --> 14:46.380]  There's a lot of powerful ways the FBI maintains data.
[14:46.520 --> 14:48.820]  And we're just using FBI as one example for FOIA here.
[14:49.440 --> 14:52.140]  They don't want to use that in their search, right?
[14:52.360 --> 14:56.680]  But regular people wouldn't know what to put in a letter to get the more powerful search.
[14:57.060 --> 15:02.420]  Or when they get a response, they wouldn't know where the FBI searched unless they did a bunch of research.
[15:02.580 --> 15:04.840]  And so that's what you're going to learn today, right?
[15:04.920 --> 15:11.000]  So we went over the FBI system, the CRS, how they manage the data, the portal to the data, which is the ACS, the automated case support.
[15:11.000 --> 15:13.880]  And then there's three methods they can use to search it.
[15:14.160 --> 15:20.500]  The UNI, where they only search an index of identifier's name, social security, birthday, things like that.
[15:20.740 --> 15:21.140]  Right?
[15:21.280 --> 15:22.220]  Does that sound very powerful?
[15:23.380 --> 15:24.340]  No, right?
[15:24.600 --> 15:26.360]  Do you think that's the one that they use as a default?
[15:27.100 --> 15:27.580]  Yes.
[15:27.580 --> 15:27.880]  Why?
[15:28.000 --> 15:28.820]  Because it's not powerful.
[15:29.060 --> 15:29.300]  Exactly.
[15:29.520 --> 15:34.300]  So then there's ICM, which is called Investigative Case Management System.
[15:34.300 --> 15:45.780]  So if you know information about a case, if you have certain numbers, which are, of course, hard to get, and if you don't already know them and you're asking about them and you can't prove they already exist, it's unlikely that you're going to get it.
[15:45.880 --> 15:54.420]  But if you can prove that you have the number and you give a reason why, you attach some documents to show why they should use that instead of the default search, you have the potential to get that search.
[15:55.040 --> 15:56.280]  Same thing with ECF.
[15:56.460 --> 15:59.020]  The electronic case file is a good one to ask for.
[15:59.200 --> 16:00.560]  By default, they won't use it.
[16:00.560 --> 16:01.380]  They'll probably take your court.
[16:01.480 --> 16:02.660]  They'll try to fight it.
[16:02.800 --> 16:05.740]  This one actually can use keywords, right?
[16:05.880 --> 16:07.640]  So it's not just indexed to these identifiers.
[16:07.840 --> 16:09.360]  You can do a full text search.
[16:09.900 --> 16:10.980]  Pretty modern, right?
[16:11.340 --> 16:11.700]  Whoa.
[16:13.000 --> 16:15.860]  So, can regular people succeed in FOIAs?
[16:15.940 --> 16:16.180]  Yes.
[16:16.340 --> 16:21.780]  You just have to look and prepare and do a lot of research and get that in the first request.
[16:21.920 --> 16:28.520]  If you're not used to litigating, last night, the MuckRock panel, they talked about how cases have been lost by putting a comma in the wrong place.
[16:28.520 --> 16:30.540]  And that can, unfortunately, be very true.
[16:30.820 --> 16:36.860]  So, if you don't know that you're going to litigate later, you're a normal person, you know you only got one bite at the apple.
[16:37.000 --> 16:42.140]  So you got to have things right in your first request because you can't really modify it later on in your appeal.
[16:42.280 --> 16:44.700]  They only have to search based on what you put in the first request.
[16:45.240 --> 16:47.280]  You don't have to use all the terms that you suggested.
[16:47.900 --> 16:52.740]  And I'll go into a little bit later about the narrative context versus keywords and what I suggest you use.
[16:53.480 --> 16:59.000]  But if you provide that later on, it's harder for them to refute that you didn't tell them where to look or didn't give them enough information.
[16:59.520 --> 17:02.000]  So, the point of this is to research.
[17:02.420 --> 17:06.100]  So, if you use FOIA drafting websites, there are some security concerns.
[17:06.220 --> 17:14.060]  Obviously, if you're giving over your date of birth and your social, like you have to do for the Privacy Act, you might be concerned about giving that to a third party, how they maintain their data.
[17:14.320 --> 17:15.440]  So, think about that, right?
[17:15.520 --> 17:23.300]  Privacy Act requests, you have to provide personal information about yourself or the person who gave you consent and provide a release from them, a certification of identity form.
[17:23.480 --> 17:26.560]  And those are on my website as well if you want to find them for the different agencies.
[17:27.380 --> 17:39.860]  But if it's just a general request and there isn't private information and you do want to use one of those websites, just get a little more specific and provide extra attachments about why the records exist and how you can prove it.
[17:40.480 --> 17:42.260]  So, now we're going to get into the nitty-gritty.
[17:42.460 --> 17:45.340]  We've got these five steps we're going to go over now that we've done the context.
[17:45.340 --> 17:50.260]  Now that you've seen an example of how to think about, right?
[17:50.360 --> 17:53.300]  The agency obfuscation and the non-responsive default search.
[17:53.640 --> 17:59.180]  And we're going to get into the five steps, which are planning, researching, and then the 15 items to actually put in your request.
[17:59.280 --> 18:01.280]  And I'll talk about some of the ones that aren't obvious.
[18:02.320 --> 18:04.300]  Anticipating responses, tracking progress.
[18:04.580 --> 18:10.740]  If you do a few agencies and they get distributed to sub-agencies, you might have 20 or 30 deadlines to manage.
[18:10.880 --> 18:11.320]  That's a lot.
[18:11.560 --> 18:13.920]  And then thinking about appealing and litigating.
[18:13.920 --> 18:16.040]  So, first step is planning.
[18:16.240 --> 18:17.900]  We talked about Kafka before, right?
[18:18.300 --> 18:26.380]  Not only do you have to prove that things exist sometimes before you request them to ask if they exist, the agencies might not give it to you unless you litigate.
[18:26.580 --> 18:30.260]  And an agency is told by a judge, well, they told you to look in that place.
[18:30.320 --> 18:33.360]  They provided you the information about why you needed to look in the place.
[18:33.680 --> 18:35.820]  I, as a judge, am looking at this.
[18:35.820 --> 18:42.840]  And you actually have a really def... well, a non-deferential standard, a good standard for plaintiffs in FOIA cases, what's called de novo review.
[18:42.960 --> 18:45.580]  The judge looks at it from scratch, from the beginning.
[18:45.680 --> 18:48.860]  Doesn't have to defer to the agencies, which under administrative law is rare.
[18:48.960 --> 18:50.420]  Usually there's a very deferential standard.
[18:51.460 --> 18:59.800]  So, sometimes you need to file a suit, pay the, like, 500 bucks, pay the service of process fees, which can be, you know, a couple hundred, to start your suit.
[18:59.960 --> 19:01.640]  And you can file those suits pro se.
[19:01.880 --> 19:03.680]  And a judge may order it.
[19:04.040 --> 19:05.360]  So, we're in the planning stage.
[19:05.520 --> 19:06.200]  First step, right?
[19:06.500 --> 19:08.200]  And we have five things we want to think about.
[19:08.300 --> 19:08.480]  Who?
[19:08.600 --> 19:10.240]  Who are you doing the request?
[19:10.440 --> 19:13.900]  If it's a Privacy Act request and it's about you, show who you are.
[19:14.020 --> 19:14.580]  Show some proof.
[19:14.760 --> 19:17.740]  If it's about someone else, show that they gave you consent to do it.
[19:18.700 --> 19:28.760]  It covers only, as I mentioned before, agencies, only executive branch agencies, FOIA, not the judiciary, not the senate, and not the close presidential offices.
[19:29.660 --> 19:33.000]  So, what are you asking for if you're asking for personal information?
[19:33.200 --> 19:36.320]  Just remember to include more proof of death if someone has died, for example.
[19:37.280 --> 19:37.420]  When?
[19:37.740 --> 19:39.180]  Timeframes are really important.
[19:39.320 --> 19:41.300]  When you're planning, you want to keep track of the day you send it.
[19:41.500 --> 19:43.980]  You want to keep track of 20 business days after that.
[19:44.880 --> 19:47.660]  Well, after their receipt, not 20 days after you send it.
[19:47.660 --> 19:57.560]  But if you have confirmation of the receipt because you have an electronic confirmation of email or fax, or if you do certified mail, which is what I recommend, especially for private records, you want to keep track of all those deadlines.
[19:57.840 --> 20:04.760]  The FOIA Improvement Act of 2016, which was just passed in July, gave you 90 days to respond on your appeals.
[20:04.880 --> 20:07.060]  And that's more time than agencies previously gave you.
[20:07.200 --> 20:10.900]  A lot of times, agencies write this letter back saying, thank you for your request.
[20:11.320 --> 20:14.900]  Please respond to us if you want us to do something, which is totally ridiculous.
[20:14.900 --> 20:17.260]  It will be on a second page or a third page as an attachment.
[20:17.580 --> 20:20.020]  And you're saying, well, nothing changed on my end.
[20:20.120 --> 20:21.520]  Of course, I still want you to respond.
[20:21.600 --> 20:22.940]  That's why I sent the request, right?
[20:23.120 --> 20:26.220]  But agencies do a lot to delay and put the onus back on you.
[20:27.440 --> 20:33.020]  So, we're going to get into the details that you wouldn't find on a DIY or commercial website later, which is where.
[20:33.120 --> 20:36.180]  How to tell the agency where to look and how to look.
[20:36.180 --> 20:37.160]  So, how to prove it.
[20:37.420 --> 20:41.600]  Attaching news articles, letters, things like that to prove.
[20:41.720 --> 20:43.460]  Well, if it's already in the public, then you can get it.
[20:43.540 --> 20:47.780]  If it's not secret anymore, exemptions or exclusions about secrecy don't apply.
[20:48.360 --> 20:52.780]  So, behind here is a letter I sent requesting records on hope.
[20:53.040 --> 20:59.620]  So, in March, in anticipation of this talk, I said, I'm going to request a few different records, right?
[20:59.620 --> 21:00.680]  I did them about hope.
[21:00.860 --> 21:01.540]  I did them about B-Sides.
[21:01.680 --> 21:02.440]  I did them about DEFCON.
[21:02.600 --> 21:06.860]  And I'll talk at those conferences later about what happened with those.
[21:07.080 --> 21:10.160]  But we're going to do a case study in my FOIA requests about hope.
[21:10.320 --> 21:12.540]  So, here's my request letter in the background.
[21:12.780 --> 21:13.700]  What I asked for.
[21:14.260 --> 21:17.440]  And we're going to have the responses that I did or didn't receive.
[21:17.880 --> 21:18.300]  Dun, dun, dun.
[21:18.700 --> 21:21.160]  From the Secret Service, the FBI, the U.S. Attorney, and the U.S. Marshals.
[21:23.200 --> 21:24.980]  So, first we'll go over the FBI.
[21:25.380 --> 21:28.740]  So, the FBI sends an acknowledgement letter the day after.
[21:28.740 --> 21:30.220]  Sorry, acknowledgement email.
[21:30.440 --> 21:31.740]  I sent this via email.
[21:32.060 --> 21:34.560]  Usually, I send things via certified mail.
[21:34.700 --> 21:35.280]  And I track.
[21:35.660 --> 21:37.140]  Especially if they have confidential information.
[21:37.340 --> 21:39.960]  But this, I was just going to publish on the website.
[21:40.240 --> 21:41.080]  Talk about at the conference.
[21:41.220 --> 21:41.740]  Not confidential.
[21:42.140 --> 21:44.460]  So, the FBI sends an acknowledgement letter to me.
[21:44.820 --> 21:47.140]  Acknowledgement email on March 29th.
[21:47.240 --> 21:49.040]  And then, quickly, it sends a denial letter.
[21:49.780 --> 21:50.740]  What's in the letter, right?
[21:50.780 --> 21:54.760]  This is going to help you with our next step, which is how to draft.
[21:54.920 --> 21:56.260]  What items to include, right?
[21:56.380 --> 21:58.220]  So, they signed a request number.
[21:58.220 --> 22:01.460]  So, up here on the right, they will give you a request number.
[22:01.500 --> 22:02.820]  And then, they'll do a summary.
[22:03.020 --> 22:08.480]  So, the agency will show you what it thinks your request is about.
[22:08.720 --> 22:12.740]  And then, agencies have to do reports every year about FOIA, what they have requests on.
[22:12.880 --> 22:16.600]  Some agencies summarize interesting requests and send out newsletters about them, whatever.
[22:16.600 --> 22:20.020]  So, this one they thought was about hackers on planet Earth, right?
[22:20.240 --> 22:20.980]  Not about hope.
[22:21.440 --> 22:23.720]  In general is a search term, but hackers on planet Earth.
[22:23.880 --> 22:24.960]  They give me a request number.
[22:25.100 --> 22:26.540]  I have to reference that going forward.
[22:27.200 --> 22:28.400]  And they send some stuff.
[22:28.700 --> 22:30.800]  Whoa, you cannot even see the green, can you?
[22:31.480 --> 22:32.780]  Oh, you can a little.
[22:32.960 --> 22:33.160]  Okay.
[22:33.160 --> 22:39.520]  So, if you look on the website, there's a PDF and all the things that I'm talking about in the slides are highlighted in green.
[22:40.140 --> 22:51.880]  So, I also apologize if anybody has accessibility needs or issues and the slides online or this presentation isn't up to standard, please tell me and I'll work to make things more accessible.
[22:51.880 --> 22:55.280]  So, they assigned that request number, right?
[22:55.360 --> 22:57.180]  Which you have to include for tracking in the future.
[22:57.540 --> 23:00.300]  FBI, you can look up those request numbers online and track the progress.
[23:00.560 --> 23:03.020]  You're assigned an agent who you can call or email as well.
[23:03.660 --> 23:05.460]  And then it conducted a search, right?
[23:05.620 --> 23:09.000]  I asked it to do this big robust search of all these systems I know about.
[23:09.480 --> 23:11.820]  And it did more than the standard request.
[23:12.060 --> 23:15.360]  So, standard they just say, we searched the CRS, the central record system.
[23:15.520 --> 23:16.920]  I asked for a lot more than that.
[23:17.080 --> 23:21.020]  In this example, they searched CRS and LSOR, their electronic surveillance, right?
[23:21.020 --> 23:22.620]  They didn't search everywhere that I wanted.
[23:23.120 --> 23:24.480]  They searched those two places.
[23:24.680 --> 23:29.660]  And the FBI told me where they searched, unlike some of the other agencies.
[23:29.980 --> 23:33.060]  And they said, we're unable to identify main file records.
[23:33.180 --> 23:35.320]  Well, I didn't just ask for the main file records, right?
[23:35.500 --> 23:41.640]  As we talked about before, you want to ask for cross-referenced, other things that aren't necessarily indexed to HOPE but might be about HOPE.
[23:41.780 --> 23:43.260]  So, I included different statutes.
[23:43.340 --> 23:44.920]  I included people who were arrested here.
[23:45.100 --> 23:50.140]  I included a few things that would be keywords or a context for a more robust search, right?
[23:50.700 --> 23:54.140]  And then they put the onus back on me, as agencies do.
[23:54.320 --> 24:00.300]  They said, well, if you want to request additional information about a subject of interest, just keep doing more work.
[24:00.380 --> 24:01.360]  We're not going to do the work.
[24:01.480 --> 24:03.680]  Keep appealing or try to litigate, right?
[24:03.760 --> 24:04.840]  They put it back on you.
[24:04.900 --> 24:09.300]  So, you really have to be dedicated and spend some time and plan and know.
[24:09.560 --> 24:13.620]  And know when the agencies are trying to put it back on you, which is presumptively always.
[24:14.260 --> 24:14.580]  Okay.
[24:15.120 --> 24:16.340]  So, I write the secret service.
[24:16.480 --> 24:16.700]  Thank you.
[24:16.780 --> 24:17.180]  I'm so glad.
[24:17.260 --> 24:19.220]  I took out the jokes and I'm getting some laughs.
[24:19.360 --> 24:20.180]  This makes me feel great.
[24:20.320 --> 24:20.640]  Okay.
[24:20.720 --> 24:21.340]  Secret service.
[24:21.560 --> 24:22.840]  I got an acknowledgement letter.
[24:23.000 --> 24:24.720]  Sent it on the same day, March 28th.
[24:24.800 --> 24:26.580]  Got an acknowledgement letter on April 5th.
[24:27.160 --> 24:29.060]  Gave me a file number and gave me a fee category.
[24:29.240 --> 24:31.680]  So, later on, we'll talk about the different fee eligibility categories.
[24:32.700 --> 24:36.080]  That information is down here in green, which, unfortunately, you can't see very well.
[24:36.840 --> 24:40.900]  And then they sent a denial letter later on, on July 8th.
[24:41.000 --> 24:43.300]  And they said, we conducted a reasonable search, right?
[24:43.380 --> 24:44.560]  Did they tell me where they searched?
[24:44.700 --> 24:44.900]  No.
[24:45.060 --> 24:46.020]  They just said it was reasonable.
[24:46.140 --> 24:46.660]  Trust us.
[24:46.760 --> 24:47.640]  We're the secret service.
[24:49.060 --> 24:49.900]  So, thank you.
[24:50.580 --> 24:53.580]  So, then they reviewed their main indices, right?
[24:53.680 --> 24:54.680]  So, they have indexes.
[24:54.780 --> 24:55.340]  It's discretionary.
[24:55.420 --> 24:57.000]  They decide what to index, how to label it.
[24:58.140 --> 24:59.220]  They gave me a file number.
[24:59.300 --> 25:02.080]  They didn't summarize it as about hope or hackers on planet Earth, right?
[25:02.300 --> 25:04.740]  And they said, okay, we searched our main index.
[25:04.880 --> 25:05.260]  Trust us.
[25:06.020 --> 25:06.960]  And then the U.S. Attorney, they usually do a more thorough search, right?
[25:10.540 --> 25:11.760]  The U.S. Attorney maintains records differently.
[25:12.000 --> 25:14.460]  What do you think about when you think about attorney records?
[25:16.000 --> 25:16.440]  Privilege.
[25:16.440 --> 25:17.060]  Privilege, yes.
[25:17.360 --> 25:20.420]  And where might those secret privilege documents be held?
[25:22.080 --> 25:22.520]  Caves.
[25:23.180 --> 25:23.620]  Caves.
[25:23.860 --> 25:25.340]  Because they're paper files, right?
[25:25.560 --> 25:29.140]  Or you need to have a really cold electronic data storage management system.
[25:29.540 --> 25:31.920]  So, you, with the U.S. Attorney, want to think about, well, how would an attorney maintain records, right?
[25:34.920 --> 25:39.020]  Are they going to put all the documents about that particular person in their system?
[25:39.160 --> 25:41.160]  Their system is called LIONS, L-I-O-N-S.
[25:41.300 --> 25:48.280]  And they maintain files by case numbers and by the subject of the investigation or the prosecution, right?
[25:48.760 --> 25:49.020]  No.
[25:49.020 --> 25:52.280]  They're going to have hard copy files in their different offices, right?
[25:52.460 --> 25:53.240]  In their local offices.
[25:53.440 --> 25:55.000]  So, they assigned to four.
[25:55.120 --> 25:56.180]  The Executive Office, the U.S. Attorneys, and they're the most lawsuits against them in the Department of Justice.
[26:00.180 --> 26:01.960]  There's a lot against, well, FBI in them.
[26:01.960 --> 26:05.240]  And then they assigned it to the regional branches.
[26:05.520 --> 26:08.000]  So, Southern District of New York, right?
[26:08.120 --> 26:12.660]  Where we heard yesterday a lot of the prosecutions on cyber prosecutions come out of there.
[26:13.740 --> 26:15.360]  And other geographical divisions.
[26:15.620 --> 26:18.960]  And as I mentioned earlier, different agencies have simple tracks and complex track.
[26:19.220 --> 26:22.140]  They looked at this and said, whoa, this is not a simple request.
[26:22.340 --> 26:23.780]  This is a complex request.
[26:23.780 --> 26:25.440]  We're going to assign it to the complex track.
[26:25.620 --> 26:26.720]  And you know what they did?
[26:26.880 --> 26:28.680]  They put the onus back on me.
[26:28.680 --> 26:30.460]  They said, I know you sent this request.
[26:30.540 --> 26:31.880]  We're going to give it to all these other people.
[26:32.020 --> 26:34.280]  And it's going to just die unless you write back, right?
[26:34.520 --> 26:36.860]  In my request letter, I said, here's how much I'm willing to pay.
[26:36.980 --> 26:38.860]  Here's when I expect a response from you.
[26:39.300 --> 26:40.960]  And they said, oh, thank you for sending it.
[26:41.020 --> 26:41.900]  Do you want us to continue?
[26:42.220 --> 26:44.820]  And so, I had to write back and say, yes, as I said in the letter.
[26:45.020 --> 26:47.180]  I do want this request fulfilled.
[26:47.460 --> 26:50.000]  And here's how much I'm willing to pay, as I said in the first letter.
[26:50.680 --> 26:52.640]  And so, then what do you think the U.S. Marshals did? 
[26:57.370 --> 26:57.690]  Nothing.
[26:58.350 --> 26:58.530]  Right?
[26:58.630 --> 26:59.050]  Very dramatic.
[26:59.850 --> 27:00.250]  Okay.
[27:00.570 --> 27:02.530]  So, now we're in step two of our five steps.
[27:02.750 --> 27:04.450]  We're going to start drafting our request.
[27:04.710 --> 27:07.710]  And I'm going to give you 15 items that you want to include in your request.
[27:08.010 --> 27:09.570]  And you can see the green here.
[27:09.690 --> 27:13.250]  There are some items that seem self-explanatory but are not.
[27:13.410 --> 27:15.570]  And I'm going to focus today on those.
[27:15.790 --> 27:16.310]  There's training.
[27:16.430 --> 27:24.570]  There's a video on my website and more step-by-step slides with lots of images for you to look at about these 15 steps or 15 items to include.
[27:24.970 --> 27:31.230]  And so, I'm just going to focus on talking about the ones that are not obvious and that you wouldn't get from a commercial DIY website.
[27:31.690 --> 27:33.350]  So, you want to put your contact information.
[27:33.530 --> 27:35.670]  The agency will try to contact you.
[27:35.750 --> 27:42.030]  You want to put as much possible information if you have access to a fax, if you're okay getting emails, if you have a phone number, if you have an address.
[27:42.030 --> 27:45.090]  Any of the methods where they could clarify the scope of the request.
[27:45.350 --> 27:49.550]  Or where you could respond in a timely manner because you do need to meet a lot of deadlines.
[27:50.630 --> 27:51.890]  The date of the request.
[27:52.110 --> 27:54.830]  The day that you think the agency will receive it, right?
[27:55.030 --> 27:57.050]  And then the day that they owe you a response.
[27:57.190 --> 27:58.110]  So, dates are really important.
[27:58.510 --> 28:01.090]  The agency address is really important.
[28:01.110 --> 28:06.410]  And I'll get into the substructure of all these agencies in flowcharts and explain why.
[28:06.410 --> 28:11.350]  Not obvious, but a lot of delays if you don't send it directly to, let's say, the cyber unit.
[28:11.490 --> 28:13.210]  And you want that as the unit.
[28:13.770 --> 28:17.970]  You want to talk about your method of transmission because you're going to need to confirm that you actually did send it.
[28:18.070 --> 28:20.370]  So, get a fax confirmation or print out that email.
[28:20.550 --> 28:21.370]  Make a PDF of it.
[28:21.430 --> 28:24.210]  Keep it in your encrypted folders, however you're maintaining it.
[28:25.190 --> 28:28.950]  You want to have a subject line that will be summarized as we saw on the other requests.
[28:29.170 --> 28:31.170]  And once you get tracking information, you want to include that.
[28:31.390 --> 28:35.510]  You want to say if the request is on behalf of somebody else and the permission.
[28:35.510 --> 28:38.730]  Or if it's on request on behalf of yourself and prove who you are.
[28:38.990 --> 28:40.550]  You want to include the subject matter.
[28:40.730 --> 28:42.090]  And that's really not self-explanatory.
[28:42.190 --> 28:45.410]  And I'm going to go into my suggestions about a narrative context.
[28:45.970 --> 28:48.590]  And sort of a sentence paragraph format.
[28:48.730 --> 28:52.250]  And then actually providing keywords, which is discretionary in whether they use.
[28:52.470 --> 28:56.190]  And then indicate what type of records you research the agency by now.
[28:56.270 --> 28:57.550]  And you know what kind of records they maintain.
[28:57.670 --> 28:58.690]  Indicate the type of records.
[28:58.850 --> 29:00.450]  The likely location of the records.
[29:00.690 --> 29:01.710]  And we'll talk about that more.
[29:02.150 --> 29:05.190]  If you have a more narrow date range, then you want to...
[29:06.130 --> 29:08.770]  suggest a more narrow date range because you're likely to get a quicker response.
[29:09.490 --> 29:13.090]  And you're going to want to include any attachments that show why you're entitled to a fee waiver.
[29:13.230 --> 29:15.190]  Mention who you are, but also show who you are.
[29:15.290 --> 29:18.710]  Make it harder for the agency to say, you didn't tell us or it wasn't clear.
[29:19.490 --> 29:21.410]  And talk about the cost you're willing to incur.
[29:22.430 --> 29:24.250]  And the other things are more obvious.
[29:24.430 --> 29:25.590]  Date you expect a response.
[29:25.710 --> 29:26.370]  20 business days.
[29:26.530 --> 29:28.890]  Calculate that out from the day of receipt, not from the day you send it.
[29:28.890 --> 29:31.490]  And your signature enclosures and attachments.
[29:31.790 --> 29:35.850]  So, as I said before, here's the example of my letter to the FBI.
[29:36.150 --> 29:37.750]  Up here in green, which you can't tell.
[29:37.790 --> 29:38.330]  There's a block.
[29:38.510 --> 29:40.250]  Is my contact information, right?
[29:40.330 --> 29:41.050]  So that's highlighted.
[29:41.270 --> 29:42.710]  There's lots of ways to contact me.
[29:42.790 --> 29:44.310]  I've been called before, emailed before.
[29:45.010 --> 29:46.730]  I don't think anyone's faxed.
[29:46.730 --> 29:48.030]  No, I have received faxed before.
[29:48.410 --> 29:53.750]  Local prison-based communication is often fax-based communication.
[29:53.750 --> 29:55.210]  And local agencies also.
[29:55.550 --> 29:58.210]  And then you want to include the agencies' addresses.
[29:58.830 --> 30:08.290]  FOIA Reform Act or FOIA Improvement Act of 2016, passed in July, is creating a portal for all agencies by 2017.
[30:08.350 --> 30:10.470]  So all the agencies will have one online portal.
[30:10.570 --> 30:11.730]  Right now there is a portal here.
[30:11.850 --> 30:15.010]  And you're going to see the overarching larger agencies.
[30:15.010 --> 30:23.150]  But as I mentioned before, you want to know the sub-agency, the organization, the directorate, the branch, the office, is down to the itty-bitty bit.
[30:23.330 --> 30:23.590]  Right?
[30:23.730 --> 30:27.270]  So if you're looking at the FBI, there's a lot of flow on this flow chart.
[30:27.270 --> 30:29.090]  And there's a lot below here that didn't fit on here.
[30:29.250 --> 30:38.150]  So you want to look at the organizational charts and infrastructure and actually send it directly to the sub-agency you want to respond if you want to get a timely response.
[30:38.830 --> 30:44.850]  And I'm jumping now from the first of the 15 items to the other not self-explanatory.
[30:45.090 --> 30:46.770]  Item number seven, subject matter.
[30:46.930 --> 30:50.090]  So when you're describing what you want, you want to be concise.
[30:50.090 --> 30:51.470]  You do not want 20 pages.
[30:51.990 --> 30:54.510]  The people who fulfill these records are like you.
[30:54.710 --> 30:55.390]  They have jobs.
[30:55.490 --> 30:58.530]  They don't want to spend all day trying to decipher your request.
[30:58.830 --> 31:00.190]  That doesn't make sense to them.
[31:00.450 --> 31:00.530]  Right?
[31:00.910 --> 31:01.630]  They're lay people.
[31:01.750 --> 31:02.710]  They're not technical people.
[31:02.730 --> 31:05.150]  If you write about file directories, they might know what that means.
[31:05.150 --> 31:05.710]  They might not.
[31:05.870 --> 31:09.450]  If you're talking about a software piece, they may know what that is.
[31:09.590 --> 31:11.750]  If you're talking about source code, they may not know what that is.
[31:11.870 --> 31:17.010]  So you want to explain to a regular person what this information is in a way that's clear.
[31:17.190 --> 31:18.430]  So provide a narrative context.
[31:18.590 --> 31:19.470]  Provide a sentence or two.
[31:19.750 --> 31:19.810]  Right?
[31:20.010 --> 31:21.510]  So I talked about hope.
[31:21.870 --> 31:23.150]  And this is green.
[31:23.350 --> 31:26.430]  I talked about, okay, here's this conference that happens.
[31:26.650 --> 31:29.430]  And here's why I think there's surveillance of it.
[31:29.570 --> 31:29.970]  FBI.
[31:30.250 --> 31:31.250]  I want your records.
[31:31.390 --> 31:31.470]  Right?
[31:31.710 --> 31:33.890]  And then I provided specific keywords.
[31:34.090 --> 31:37.330]  So I provided search terms below that I suggested that they use.
[31:37.410 --> 31:38.490]  They're not obligated to use it.
[31:38.490 --> 31:55.390]  But if later on I get to a court and a judge says, well, here are all the terms that made it clear that you could search a term similar to this in your system because you know how your systems work and presumably on appeal it might get to someone more technical or they might send it to someone who would know how to conduct that search based on the way they maintain those records,
[31:55.770 --> 31:59.110]  then you would have more of an appeal.
[31:59.290 --> 32:04.950]  If you laid out all the steps for them and they didn't follow it and the judge says, well, you know, there couldn't be anything more clear.
[32:04.950 --> 32:13.870]  Yesterday in the muck rock talk, they did talk about a type of hold that was used on Guantanamo detainees and they used one wrong word in describing the hold.
[32:13.970 --> 32:23.010]  And the judge says, well, just because there was one word in describing this procedure, it was pretty obvious what procedure they wanted and you can't just not release it because of that hold.
[32:23.830 --> 32:29.490]  And then here's the question that people thought I should address to regular folks doing FOIA.
[32:29.730 --> 32:36.630]  Well, I'm, you know, I've heard about FOIA and all this stuff sounds good, but I know there are these exclusions and these exemptions and I'm really intimidated.
[32:37.010 --> 32:39.530]  Do these eat up the releases, right?
[32:39.710 --> 32:41.610]  Are these larger exceptions?
[32:41.930 --> 32:42.510]  Swallow the rule.
[32:42.830 --> 32:48.410]  And I would say that, no, you should continue to try and you should anticipate this.
[32:48.590 --> 32:56.070]  So in your steps as you're thinking about, well, what arguments and counter arguments might the agency make about my request?
[32:56.110 --> 32:59.030]  You want to show them why they have to do what you want them to do.
[32:59.030 --> 33:12.190]  So if anybody has made a similar request, request it, find information about why they won, why in certain case they ordered release of something that was similar to what you're doing, cite that case and argue why you don't fit in the exclusions.
[33:12.790 --> 33:15.150]  So exclusions mean FOIA doesn't apply at all.
[33:15.290 --> 33:17.610]  And exemptions mean that FOIA applies.
[33:17.970 --> 33:25.250]  And if you're asking for records that count as systems records under the Privacy Act or agency records, they have to disclose unless there's an exemption.
[33:25.250 --> 33:29.290]  So the exclusions on the left are when FOIA doesn't apply, right?
[33:29.410 --> 33:33.010]  Ongoing criminal proceedings, law enforcement information, classified materials.
[33:33.010 --> 33:36.150]  You can ask for declassification, mandatory declassification review.
[33:36.270 --> 33:38.790]  That's something that's separate from FOIA and I won't talk about today.
[33:39.070 --> 33:44.210]  But if something was classified and it's been released before, you have a better argument to say, well, it's been released.
[33:44.210 --> 33:45.470]  It's not secret anymore.
[33:46.090 --> 33:48.810]  Please release it or the rest of it.
[33:48.930 --> 33:50.170]  And then we have the exemptions.
[33:50.270 --> 33:51.830]  This is when FOIA applies.
[33:51.990 --> 33:53.230]  There's a presumption of disclosure.
[33:53.730 --> 33:59.230]  That was something that President Obama put into effect in 2008, but was codified in the FOIA Information Act...
[33:59.910 --> 34:02.670]  I'm sorry, the FOIA Improvement Act of 2016 that just passed.
[34:02.910 --> 34:04.850]  There's a presumption of disclosure.
[34:05.590 --> 34:06.910]  Presumed to release, right?
[34:07.090 --> 34:11.450]  Unless they have some really compelling reason that it fits under these statutes.
[34:12.350 --> 34:15.950]  And there's still discretion to release if it does fit.
[34:15.950 --> 34:21.030]  And so there are certain ones, national defense, personnel regulations.
[34:21.450 --> 34:25.930]  I've starred the ones that apply mostly in the cases I researched about electronic data.
[34:25.950 --> 34:27.430]  So things that might be of interest to hackers.
[34:28.050 --> 34:32.090]  Other law, NSA uses this a lot about not releasing information.
[34:32.410 --> 34:33.470]  Trade secrets, right?
[34:33.590 --> 34:34.850]  Used a lot in electronic data.
[34:35.350 --> 34:36.970]  Intra- or interagency communications.
[34:37.270 --> 34:38.130]  Think email, right?
[34:38.190 --> 34:40.290]  And as I mentioned before, this is known as B5.
[34:40.290 --> 34:47.030]  And the act passed in July makes that limited to records created within the last 25 years.
[34:47.310 --> 34:48.910]  So it's less expansive than it used to be.
[34:49.610 --> 34:55.230]  Personal privacy, law enforcement, audit reports, and then the weird geological and geophysical data, right?
[34:55.470 --> 34:59.510]  So when the agency does release something to you, if you are lucky enough to get a release, right?
[34:59.590 --> 35:01.050]  They might say, we searched and there was nothing.
[35:01.170 --> 35:03.910]  They might do a GLOMAR, which is we neither confirm nor deny.
[35:04.090 --> 35:05.870]  Or they might release and redact.
[35:06.050 --> 35:21.690]  So when they cite those, they will say over here, if the agency doesn't release information and redacts it, what particular B4, B5 exemption they are claiming applies.
[35:22.090 --> 35:25.230]  And you want to remind the agency that it has discretion to release.
[35:25.330 --> 35:27.230]  It can always release, even if something applies.
[35:27.770 --> 35:29.350]  And that it must segregate.
[35:29.870 --> 35:31.170]  So you cite segrability, right?
[35:31.230 --> 35:32.970]  They have to segregate the portion.
[35:33.130 --> 35:38.690]  They can't withhold all the records because the portion they argue, they can withhold under the law, right?
[35:38.770 --> 35:39.410]  And it's an argument.
[35:39.410 --> 35:39.970]  It's a debate.
[35:40.150 --> 35:47.530]  It's a negotiation with a particular staff person who's working on your request to say, well, I think this falls under this interpretation and you don't.
[35:47.590 --> 35:49.130]  You can go back and forth on your appeals.
[35:49.310 --> 35:50.550]  You have a right to appeal.
[35:50.650 --> 35:55.190]  Now there's an ombudsman and you actually have a right to mediation as well before you go to court.
[35:55.910 --> 35:58.570]  And tell them not to withhold the entire document just because part...
[35:58.570 --> 36:00.850]  They might have an argument that part doesn't have to be released.
[36:01.050 --> 36:03.150]  And if it's an urgent, you need to tell the agency.
[36:04.030 --> 36:04.450]  Okay.
[36:04.790 --> 36:10.030]  So that was number seven in the things to include that's not self-explanatory.
[36:10.290 --> 36:14.070]  Number eight, tell the agency what type of records you want, right?
[36:14.090 --> 36:15.850]  We talked about electronic data a little before.
[36:16.030 --> 36:18.870]  But if it's the FBI, you might want more than that.
[36:18.970 --> 36:25.330]  You might want complaint forms, memorandums of investigation, field notes, reports of investigation, rest reports, things like that.
[36:25.330 --> 36:28.710]  So find out how the agency stores that data and have a little section.
[36:28.850 --> 36:33.210]  Again, there's a green section up here in the slides that says what type of records you want.
[36:34.310 --> 36:37.850]  And when you want electronic data, do a little research online.
[36:37.950 --> 36:40.750]  I have a whole slideshow about that online.
[36:41.370 --> 36:43.530]  And you can say, I want software.
[36:43.530 --> 36:44.230]  I want a database.
[36:44.430 --> 36:45.150]  I want a file directory.
[36:45.290 --> 36:47.510]  I want the products of data compilation.
[36:47.510 --> 36:52.810]  And there's a lot of information that's still being developed in this area of law.
[36:52.810 --> 36:58.690]  And there's statutory language about what is or isn't a data, sorry, an electronic record.
[36:59.790 --> 37:06.770]  And things that are under the statute are data compilation, data processed, are produced by the software or stored in the software.
[37:06.930 --> 37:10.270]  If it's embedded within the software and can't be extracted without it.
[37:10.650 --> 37:13.130]  If it reveals information about the organizations, right?
[37:13.510 --> 37:16.490]  Then there are cases, not just statutes, that say these things were records.
[37:17.050 --> 37:21.370]  Computer programs, unique to the underlying database used by a scientific researcher.
[37:22.050 --> 37:23.310]  Computer file directory.
[37:23.610 --> 37:25.890]  A software program used to perform audits.
[37:26.290 --> 37:26.850]  And things like that.
[37:27.190 --> 37:28.330]  So do a little research.
[37:28.610 --> 37:31.130]  Figure out, okay, is this the kind of thing I'm interested in?
[37:31.270 --> 37:33.310]  Might be something that does constitute a record.
[37:33.470 --> 37:39.110]  Even though I wouldn't think of a file directory necessarily as something people could print out and put in a file cabinet, right?
[37:40.250 --> 37:41.390]  Okay, so number nine.
[37:42.090 --> 37:43.390]  The location of records.
[37:43.590 --> 37:46.030]  So you tell the agency, here's what I know.
[37:46.230 --> 37:47.350]  Prove that you know something.
[37:47.590 --> 37:49.750]  Make it more likely that they'll find something.
[37:49.750 --> 37:51.030]  Show them where to find it.
[37:51.470 --> 37:52.930]  And there are publications.
[37:53.290 --> 37:58.830]  The National Archives does a lot of publication, Federal Register publication of things that are helpful for FOIA.
[37:58.990 --> 38:02.310]  So you probably want to go on the EFF website, the ACLU website.
[38:02.450 --> 38:03.410]  Look at other disclosures.
[38:04.350 --> 38:06.830]  See where declarations from staff members, right?
[38:07.190 --> 38:10.830]  The letter I had before from the FBI was from David Hardy.
[38:10.970 --> 38:13.030]  He does a lot of their declarations in different cases.
[38:13.770 --> 38:15.510]  You tell them where to look.
[38:15.670 --> 38:17.530]  So there are these systems of record notices.
[38:18.650 --> 38:20.610]  And those are posted in reading rooms.
[38:20.710 --> 38:23.130]  Agencies have different FOIA reading rooms of their releases.
[38:23.530 --> 38:27.310]  And then the Federal Register has these systems of record notices.
[38:27.610 --> 38:31.190]  Under the Privacy Act, if anything is in a system of records, you're allowed to get it.
[38:31.190 --> 38:37.990]  So it's anything that has personally identifying information that's indexable by like social, date of birth or something like that.
[38:38.110 --> 38:40.930]  Or a unique identifier that an agency creates for you.
[38:41.010 --> 38:42.810]  Maybe you're on staff and you have a staff ID number.
[38:43.070 --> 38:43.590]  Things like that.
[38:44.970 --> 38:47.050]  So systems of record notices are helpful.
[38:48.050 --> 38:54.070]  And yesterday there was also a discussion in the MuckRock talk about records disposition schedules.
[38:54.070 --> 38:56.710]  The National Archives has a list of when records are destroyed.
[38:57.030 --> 39:04.050]  And if you have a concern that some of the records might be destroyed, you can watch that talk from yesterday or look that up as well.
[39:04.810 --> 39:07.570]  And we're wrapping up here with a discussion of fees.
[39:07.830 --> 39:11.430]  So you want to include information about how much you're willing to pay.
[39:11.530 --> 39:18.410]  They're going to put you in one of those categories, which are also highlighted in green here, of what category you think you fall into.
[39:18.410 --> 39:29.290]  And if you're asking to be included in one of the categories that's eligible to pay less, make an argument about that and attach some proof that makes it easier for the person to decide in your favor.
[39:29.890 --> 39:36.790]  As I showed earlier, I fell into the all other category in the responses to the request.
[39:37.670 --> 39:39.050]  So, oh, that's exciting.
[39:39.170 --> 39:40.370]  That's not what I intended to do.
[39:41.770 --> 39:43.690]  So we're wrapping up here anyway.
[39:43.890 --> 39:46.890]  It's just a couple steps left in our response here.
[39:47.590 --> 39:50.930]  Anticipating responses is the third step here.
[39:50.930 --> 39:51.810]  Know what you sent.
[39:52.630 --> 39:53.670]  Create a log online.
[39:53.810 --> 39:56.910]  I have a sample of a log of how to track all these different things, right?
[39:56.970 --> 40:07.610]  If you write to the U.S. Attorney and you have four responses already with different log numbers, and you're going to be receiving number responses, and you're anticipating that you'll have to appeal, you have to keep track of all the dates that you send things,
[40:07.730 --> 40:10.270]  all the dates you were entitled to responses, when they sent the responses.
[40:10.430 --> 40:12.630]  If you have certified mail tracking numbers, you keep that.
[40:12.630 --> 40:16.810]  And you keep track of all the different arguments that they make.
[40:17.090 --> 40:19.990]  So step four is tracking that progress.
[40:20.150 --> 40:28.290]  When you get the responses with the dates, the title, the contact information, you might be given to different branches within the same request, right?
[40:28.730 --> 40:43.990]  My request about DEFCON, the FBI released information that had already released to someone else to me, and it told me to start my appeal... sorry, it told me to start the process again, not to appeal, if I wanted information that I asked for in the initial request,
[40:44.150 --> 40:46.610]  which was different than the information that had already been released about DEFCON.
[40:46.850 --> 40:50.850]  And I said, well, of course, I requested in March information that you released in July.
[40:51.390 --> 40:52.830]  Why would I have to start again?
[40:52.870 --> 40:53.630]  I have a right to appeal.
[40:53.710 --> 40:54.770]  This is an adverse determination.
[40:55.170 --> 41:06.330]  So I wrote both the appeal to the people that are listed for the appeal, and I wrote to the underlying new entity that it suggested I ask for the records that had not already been released.
[41:06.810 --> 41:09.190]  And the last part is appealing and litigating.
[41:09.410 --> 41:11.270]  So you want to plan to follow up.
[41:11.370 --> 41:17.250]  You're entitled if you don't receive a response within 20 business days from when they receive it, not that you send it, but when they receive it, to begin litigation.
[41:18.990 --> 41:22.490]  And you want to always appeal, whether you're going to litigate or not.
[41:22.610 --> 41:34.790]  And a lot of people drop things without realizing that they really need to push the agency to get responses, show the agency that they understand how the law works and what they're entitled to, and make it easy for the agents who are...
[41:34.790 --> 41:38.810]  the staff members who are working on this to give them responses.
[41:39.350 --> 41:43.150]  And anything that you seem to think is an adverse determination, right?
[41:43.250 --> 41:48.910]  If they give a partial disclosure, a non-disclosure, procedural denial, challenge it.
[41:49.150 --> 41:52.130]  And look up the information about the new FOIA Act.
[41:52.230 --> 41:53.150]  It's living, it's changing.
[41:53.390 --> 41:57.910]  It gives you entitlement to waive fees if agencies don't meet their deadlines.
[41:58.050 --> 42:02.790]  It extends the amount of time you have for appeal, and a lot of requester-friendly information.
[42:04.090 --> 42:05.910]  Stickers, swag, we're at a HackerCon, right?
[42:05.990 --> 42:06.490]  I have swag.
[42:06.810 --> 42:08.890]  It's on the table here and at the water table.
[42:09.170 --> 42:10.570]  I'm around for questions.
[42:11.350 --> 42:13.010]  You can also tweet questions.
[42:13.270 --> 42:17.150]  I will not take comments that are not actually questions, because we have about 10 minutes.
[42:17.350 --> 42:23.210]  So please, if you're going to ask a question, respect everyone's time here, and make it a question and not a comment.
[42:23.210 --> 42:26.370]  You can also write questions over there and hand them to me.
[42:26.370 --> 42:33.610]  And to respect the next speaker's time, we're going to do 10 minutes, and then I'm happy to chat with people in the hallway, or you can contact me offline.
[42:34.310 --> 42:35.090]  So questions?
[42:35.390 --> 42:35.670]  Yes.
[42:35.890 --> 42:37.990]  And I'll repeat them into the mic for people at home.
[42:38.170 --> 42:38.590]  Thank you.
[42:39.290 --> 42:39.690]  Thanks.
[42:42.270 --> 42:43.390]  Very simple question.
[42:43.530 --> 42:50.250]  You mentioned, I think, your first comment, that when you are entering your personal information, you know, beware of privacy.
[42:51.470 --> 42:55.050]  Isn't that a catch-22 from the very beginning?
[42:55.330 --> 42:59.350]  In other words, what should I worry about in terms of...
[42:59.350 --> 43:00.850]  It's a difficult question, right?
[43:00.850 --> 43:01.670]  Just saying who I am.
[43:01.890 --> 43:03.010]  It's a difficult question.
[43:03.030 --> 43:09.290]  It depends on the context for the agency and how they might have a record about you and whether you need to include all the information.
[43:09.590 --> 43:21.230]  If it's the EPA and you're requesting something related to public testimony you made, you know, you're not necessarily going to need to give them your social security or your date of birth to get information about public testimony.
[43:21.350 --> 43:30.410]  But if you were an employee at an agency and you had information you need to prove who you were to get those sensitive records, the agency already had that information.
[43:30.410 --> 43:33.410]  It's not as big of a deal to give the agency information they had about you.
[43:33.410 --> 43:37.610]  There's obviously concern if you're writing to the FBI wondering, do you know this about me?
[43:37.750 --> 43:40.970]  And provide the information to the FBI that you're concerned about.
[43:41.410 --> 43:49.910]  So, in other words, there isn't a basic, you know, sort of core list, you know what I mean?
[43:50.010 --> 43:50.530]  Oh, yes.
[43:50.570 --> 43:56.090]  So, you can look at the agency's certification of identity form or their Privacy Act form.
[43:56.290 --> 43:59.330]  There's agency-wide ones like the Department of Justice has one.
[43:59.390 --> 44:00.450]  I think it's called a Form 201.
[44:00.750 --> 44:01.470]  It's on my website.
[44:01.470 --> 44:02.810]  DHS has one.
[44:02.990 --> 44:07.110]  And you can see what they require or suggest as basic identifiers.
[44:07.250 --> 44:10.970]  And some of the agencies have a form where things are required and where things are suggested.
[44:11.210 --> 44:14.230]  And I would say look there for the summary.
[44:15.170 --> 44:15.330]  Mm-hmm.
[44:15.430 --> 44:16.050]  Good question.
[44:16.770 --> 44:18.070]  I hope this is relevant to that.
[44:18.330 --> 44:28.770]  I've always believed since public records and made up of utility bills and medical histories and stuff, if you actually have an inaccurate or missing public record...
[44:28.770 --> 44:29.170]  Great.
[44:29.710 --> 44:29.830]  Yeah.
[44:30.050 --> 44:31.130]  So, that's a statement.
[44:31.470 --> 44:32.410]  Not a good question.
[44:32.570 --> 44:33.370]  I'll turn that to a question.
[44:33.710 --> 44:39.070]  Privacy Act gives you a right to correct records about yourself or somebody else that gives you permission, right?
[44:39.430 --> 44:42.330]  So, freedom of information is general records the agency maintains.
[44:42.610 --> 44:45.390]  Privacy Act, you can say, what records do you have about me?
[44:45.630 --> 44:46.930]  You also have to correct them.
[44:46.970 --> 44:49.890]  You also have to tell me what you gave to other people about me.
[44:50.230 --> 44:51.070]  So, yeah.
[44:51.730 --> 44:51.890]  Yeah.
[44:51.890 --> 44:56.210]  I just wanted to know where the domain name is for your website.
[44:56.570 --> 44:56.570]  Yes.
[44:57.290 --> 44:59.970]  CaitlinKellyHenry.com/foia.
[45:00.170 --> 45:01.170]  F-O-I-A.
[45:01.290 --> 45:05.390]  There's videos, training material and electronic data, things like that.
[45:05.890 --> 45:06.230]  Yes.
[45:06.810 --> 45:08.950]  I'm someone who's affected by the OPM breach.
[45:09.110 --> 45:09.290]  Yes.
[45:09.670 --> 45:13.170]  What do you expect to get back from FOIA?
[45:13.170 --> 45:13.590]  Yeah.
[45:13.810 --> 45:17.150]  So, this is a question about OPM, the Office of Personnel Management, right?
[45:17.250 --> 45:17.770]  There's a hack.
[45:18.010 --> 45:28.950]  All the information and what should be in the most secure system in the government, all of the confidential clearance information, privacy about everybody's families, social security numbers, what to do, right?
[45:29.010 --> 45:35.630]  So, my understanding is people that were affected by it got a letter from the agencies saying that you can file their internal redress.
[45:35.630 --> 45:46.310]  But you can also request through the Privacy Act information about yourself and then figure out, well, in this, not just what was breached, get the records of the information that was collected and then breach.
[45:46.510 --> 45:53.510]  Also figure out if anything happened after that breach where they had to disclose to other agencies and see if there's anything you need to follow up and correct on.
[45:53.650 --> 46:01.770]  If you have a correction, the agency also has an obligation under the Privacy Act to notify the other entities that it's released to that you have a correction.
[46:01.770 --> 46:08.250]  So, it is a fairly powerful in theory and in writing mechanism that I don't think that many people do access.
[46:08.670 --> 46:10.630]  But I'm happy to talk to you offline as well.
[46:10.910 --> 46:10.970]  Yeah?
[46:11.910 --> 46:18.430]  Did you get anything back from your own point or was that the U.S. version was nothing and if you didn't...
[46:18.430 --> 46:21.650]  What's the juiciest you've ever gotten back from any point you've done?
[46:21.970 --> 46:24.190]  Well, I'm an attorney and I can't tell you that.
[46:25.350 --> 46:25.790]  Right?
[46:25.870 --> 46:27.570]  You wouldn't want me to tell other people if it was you.
[46:27.910 --> 46:29.650]  No, they were all denials for hope.
[46:30.730 --> 46:45.230]  And if somebody wants to talk to me after about being a plaintiff to try to get records on surveillance of them specifically for hope or B-Sides or DEFCON and you have any access to the fee exemptions or waivers and things like that, I'm happy to talk about that.
[46:45.410 --> 46:46.810]  I didn't get anything juicy yet.
[46:46.950 --> 46:52.690]  I hope that the FBI one that I mentioned about DEFCON will release things that haven't already been released on Muck Rock or to other places.
[46:52.690 --> 46:54.630]  But there are denials and in process.
[46:54.770 --> 46:56.030]  The U.S. Attorney is still processing it.
[46:56.130 --> 46:57.330]  Maybe I'll get something from Marshall.
[46:57.650 --> 46:57.930]  Maybe not.
[46:58.230 --> 46:58.490]  Questions?
[46:58.670 --> 46:58.730]  Yes?
[46:58.990 --> 47:03.670]  You mentioned that data brokers are actually making money off of FOIA requests.
[47:03.830 --> 47:03.950]  Yeah.
[47:03.950 --> 47:08.190]  So is it better to open an LLC in Delaware or something and then to make a request?
[47:08.350 --> 47:14.330]  And what's the likelihood of a company getting a request back positive as opposed to denial?
[47:14.930 --> 47:19.170]  Well, I would watch the talk from yesterday, the FOIA 50, where they talked about that in more detail.
[47:19.170 --> 47:21.110]  I don't have a percentage likelihood.
[47:21.370 --> 47:37.210]  They argued, Jamil Jaffer argued that it's clogging up the system and the more professional requesters know how to do it and regular requesters whose requests are often harder for someone to answer who is used to getting certain kinds of things, like a regular person writes and they don't know exactly how to format it.
[47:37.390 --> 47:38.170]  They have a harder time.
[47:38.330 --> 47:43.550]  So I'd say in general, that requesting, filing an LLC will cost you a few hundred dollars.
[47:43.550 --> 47:45.610]  I do file LLCs for people, not for FOIA.
[47:45.730 --> 47:47.690]  I've never had anyone ask me to file an LLC, right?
[47:47.690 --> 47:52.450]  Because I can just file it under my name either about them as a business or not about them as a business.
[47:52.590 --> 47:56.590]  You know, I file for people, businesses, and don't mention who they are specifically if it's not relevant.
[47:56.810 --> 47:58.190]  They're not entitled to any fee waivers.
[47:58.650 --> 48:01.730]  But depending on where you incorporate, you know, it's a few hundred dollars and then taxes.
[48:01.930 --> 48:11.770]  So I'd say that probably will cost you more than working with an attorney to do it or someone who can do it on your behalf if you want information that doesn't require personal identifiers.
[48:13.250 --> 48:16.650]  Oh, well, yes, then that's a personal assessment for your attorney.
[48:16.650 --> 48:17.310]  More questions?
[48:17.990 --> 48:22.490]  At what point can or should you litigate for non-responsiveness?
[48:22.710 --> 48:23.550]  For example, the U.S. Marshals apparently haven't even acknowledged...
[48:25.810 --> 48:26.550]  I should have already.
[48:26.990 --> 48:27.090]  Yeah.
[48:27.470 --> 48:28.830]  Should have filed that already.
[48:29.110 --> 48:36.190]  So after 20 days earlier on, because if they haven't conducted a search and they're in front of a judge and the judge is going to tell them to do a search, what kind of a search do you think they'll do?
[48:37.490 --> 48:37.810]  Minimum.
[48:37.810 --> 48:39.330]  A better one than the minimum, right?
[48:39.430 --> 48:49.410]  Because they have to show in front of a judge, well, this is a pretty comprehensive letter, and it's an attorney, and they're bringing it before me, they're going to be pretty embarrassed if they do a substandard search and later on they're wasting all these agency resources.
[48:49.410 --> 48:52.450]  If you win, the agency has to pay your fees.
[48:52.610 --> 48:57.550]  So the attorney fees are hefty that the agency will have to pay if they lose.
[48:57.830 --> 48:58.930]  I'll take two more questions.
[48:58.930 --> 48:59.310]  Yeah.
[48:59.710 --> 49:05.970]  Can you do an anonymous thing or a job bill so that the world doesn't find out that you bought this?
[49:06.050 --> 49:06.190]  Yeah.
[49:06.410 --> 49:08.830]  Create an email and do it through that.
[49:08.850 --> 49:12.450]  If it's not about anybody's personal information or if it's about someone who's dead, sure.
[49:12.590 --> 49:13.550]  You can't misrepresent.
[49:13.690 --> 49:17.710]  You know, it's a federal offense to misrepresent under 18 USC, something like that.
[49:17.830 --> 49:18.470]  One last question.
[49:20.310 --> 49:21.730]  Can you say it louder?
[49:26.410 --> 49:28.010]  Mugrock has 23,000.
[49:28.170 --> 49:29.210]  There's the FOIA project.
[49:29.590 --> 49:31.510]  There's a listserv out of Syracuse.
[49:31.970 --> 49:35.410]  A lot of those are on my website as places you can go to to look.
[49:35.870 --> 49:39.810]  And then you can look for all the different guides, national security archives and places like that.
[49:39.910 --> 49:45.550]  And you can look at who's been cited in those guides and track them that way.
[49:45.950 --> 49:49.890]  So I want to wrap up to honor the time of all the people working and the next speaker.
[49:49.890 --> 49:52.170]  And I'm happy to take questions out in the hall.
[49:52.310 --> 49:54.370]  My stickers and cards are up here as well.
[49:54.570 --> 49:55.170]  Thanks for your time.