[00:00.000 --> 00:00.280]  E-note.
[00:02.900 --> 00:05.060]  That's about the... we thought there'd be more, actually.
[00:07.160 --> 00:26.040]  Well, if you have to get up to the... go to the bathroom or something, and you come back and your seat is taken, don't despair, because we'll be streaming this next door in the Serpico room, to the sixth floor, and to the mezzanine area on two screens,
[00:26.180 --> 00:30.620]  and to the first floor down where registration is, where the escalators come to the bottom.
[00:30.880 --> 00:32.880]  So there will be big screens all these places.
[00:33.300 --> 00:38.340]  I mean, if you hear it a millisecond later than you did here, it's not reason to despair.
[00:39.300 --> 00:42.660]  But it will be just as good as being here, I promise.
[00:42.880 --> 00:44.720]  And it probably will smell better.
[00:45.440 --> 00:45.920]  So...
[00:47.620 --> 00:49.840]  This is gonna be a serious crowd control issue.
[00:51.580 --> 00:54.340]  It's... so for everyone, it's really a safety issue.
[00:54.480 --> 00:59.980]  So if you think it's just too mobbed in here, or you can't get in, don't worry about it.
[01:00.080 --> 01:00.840]  Just go next door.
[01:01.480 --> 01:04.060]  Downstairs, sixth floor, mezzanine, first floor.
[01:04.300 --> 01:05.080]  You will see this.
[01:05.160 --> 01:06.000]  It's also gonna be streaming.
[01:06.380 --> 01:07.100]  Go to the website.
[01:07.540 --> 01:09.040]  Click on the Radio Statler link.
[01:09.160 --> 01:10.120]  You'll probably just say stream.
[01:10.520 --> 01:12.600]  And you can see it live in the archive version.
[01:12.900 --> 01:14.180]  So we will all see it.
[01:14.420 --> 01:16.340]  You can all be part of history at the same moment.
[01:16.340 --> 01:21.720]  And no need to be like a Who concert.
[01:22.300 --> 01:26.480]  So, I want to introduce a neighbor of mine in Philadelphia.
[01:26.840 --> 01:27.440]  Alex Muentz.
[01:27.900 --> 01:29.100]  He is...
[01:29.100 --> 01:32.300]  Besides the sharply dressed man in the seersucker suit.
[01:32.960 --> 01:34.440]  Yeah, he told me a good story last night.
[01:34.560 --> 01:35.220]  He was wearing that seersucker...
[01:35.220 --> 01:36.720]  Was it that seersucker suit or another one?
[01:37.300 --> 01:38.620]  A different seersucker suit.
[01:38.620 --> 01:42.100]  When he stood up to an assistant U.S.
[01:42.180 --> 01:53.040]  attorney and made them back down to an action that he was standing for as legal support for a group of concerned citizens.
[01:53.440 --> 01:55.200]  And he's a hacker.
[01:55.380 --> 01:56.080]  Hardware, software.
[01:56.380 --> 01:57.620]  And he's a really good lawyer.
[01:57.820 --> 02:13.280]  And I would like to introduce someone who will explain some of the overlaps between those things when it comes to what you need to know when you are breaking something, hacking something so that they don't break down your door and point the guns in your face and other things.
[02:13.560 --> 02:14.640]  So, Alex Muentz.
[02:22.450 --> 02:22.890]  Okay.
[02:23.710 --> 02:28.030]  This talk, I want to explain why I'm doing it and sort of the purpose of it.
[02:28.130 --> 02:32.850]  I've noticed other law talks tend to be about sort of this like greater philosophy.
[02:32.850 --> 02:34.670]  Where do you see things going?
[02:34.830 --> 02:36.530]  And I'm going to talk a little bit about that.
[02:36.530 --> 02:45.930]  But really the point of this is practical, simple guides to keep your ass out of the crosshairs of law enforcement.
[02:46.210 --> 02:49.150]  So, this is like a practical nuts and bolts kind of thing.
[02:49.330 --> 02:50.690]  Because that's what I like doing.
[02:53.780 --> 02:55.700]  So, why am I giving this talk?
[02:55.960 --> 02:59.740]  It is a very interesting time to be in this community right now.
[03:01.200 --> 03:03.560]  And that's not necessarily a good thing.
[03:04.300 --> 03:04.400]  Right?
[03:04.740 --> 03:05.900]  Remember a couple of years ago.
[03:05.980 --> 03:11.320]  And I remember a couple of years ago when I wasn't getting any calls about helping on criminal defenses.
[03:11.520 --> 03:11.840]  I was...
[03:11.840 --> 03:14.960]  If anyone called me up, it's like, dude, I got this contract.
[03:15.220 --> 03:15.800]  Can you read it?
[03:15.880 --> 03:19.760]  And it was all employment contracts and NDAs and non-competes.
[03:19.880 --> 03:20.980]  And I kind of like that.
[03:21.080 --> 03:21.460]  Like, wow.
[03:21.700 --> 03:26.200]  If that's what I'm going to deal with as a lawyer in this community is like helping people.
[03:26.460 --> 03:28.160]  And it was all about cashing out.
[03:28.160 --> 03:30.320]  It's all about, you know, there's some money to be made.
[03:30.340 --> 03:31.160]  I want to make it.
[03:31.220 --> 03:34.780]  And I want to be cool and fast and agile and all those other buzzwords.
[03:37.060 --> 03:38.340]  That's changing again.
[03:39.280 --> 03:39.720]  Why?
[03:40.980 --> 03:41.860]  It's not...
[03:41.860 --> 03:43.460]  Anyone heard about this one?
[03:44.400 --> 03:45.480]  Listen to the news.
[03:46.500 --> 03:46.940]  And...
[03:49.080 --> 03:54.420]  I'm convinced that my car only gets NPR because I've never heard NPR anything else.
[03:54.580 --> 03:57.740]  I mean, it's a Saab, so of course, you know, it's crunchy and granola.
[03:57.740 --> 04:00.740]  But I realized, like, wait a minute.
[04:00.980 --> 04:02.180]  I'm hearing...
[04:02.180 --> 04:03.760]  And my wife has mentioned this to me.
[04:04.480 --> 04:11.080]  Every day on, like, you know, boring regular news, they're talking about us.
[04:11.560 --> 04:11.980]  Right?
[04:12.900 --> 04:14.180]  Hackers do Target.
[04:14.460 --> 04:15.960]  Hackers are in NASDAQ.
[04:16.090 --> 04:18.530]  Hackers are, you know, haxing everything out there.
[04:19.260 --> 04:32.150]  The problem is that that is not good for us because if the outside world is looking at us, we tend to often show an interesting face that they don't get.
[04:32.670 --> 04:32.770]  Right?
[04:34.020 --> 04:36.290]  And I'm not to call him out or anything on this.
[04:36.760 --> 04:37.350]  Just...
[04:37.350 --> 04:39.200]  Oh, hackers are doing stuff.
[04:39.610 --> 04:39.990]  Boing.
[04:40.110 --> 04:40.760]  There it is.
[04:40.760 --> 04:42.760]  And we do not come across well.
[04:43.520 --> 04:44.260]  You know?
[04:44.530 --> 04:44.990]  We...
[04:45.580 --> 04:55.990]  And while we know why we're doing these things usually, the outside world does not look at us the same way we think we're interpreting up.
[04:56.430 --> 04:58.320]  So, like, let's look at views of hackers.
[04:58.470 --> 04:59.410]  Consumer protection.
[05:00.070 --> 05:06.470]  Why does a white hat go and knock something over and, you know, drop a vuln or drop even an exploit?
[05:06.850 --> 05:08.430]  We think we're doing a good thing.
[05:08.590 --> 05:08.710]  Right?
[05:08.970 --> 05:11.820]  I'm gonna force that company to secure their stuff.
[05:12.090 --> 05:13.930]  And if not, I'm gonna humiliate them.
[05:15.090 --> 05:16.710]  That makes perfect sense to me.
[05:16.820 --> 05:16.930]  Right?
[05:18.130 --> 05:22.960]  Except to the outsiders, it's why are you making things less secure?
[05:24.380 --> 05:28.550]  And as a contrary, like, go back to like Ralph Nader.
[05:29.240 --> 05:30.880]  And he was viewed to be the enemy.
[05:31.020 --> 05:32.700]  Like, why are you trying to hurt General Motors?
[05:32.840 --> 05:35.880]  And he's saying things like, because you're killing people.
[05:36.140 --> 05:39.930]  You're building crappy cars that fold up like tin cans.
[05:41.500 --> 05:44.840]  But, like, up in Sinclair, do you know what you're eating?
[05:44.840 --> 05:48.660]  And the amount of people, like, turn vegan after reading, you know, The Jungle.
[05:49.960 --> 05:52.730]  And then, you know, two weeks later, like, ah, no, I really want a burger.
[05:53.140 --> 05:54.780]  Like reading Fast Food Nation.
[05:55.080 --> 05:57.350]  And there's a part in Fast Food Nation.
[05:57.350 --> 05:58.730]  Who here has read Fast Food Nation?
[05:59.280 --> 06:04.640]  Was there a point where you're like, I won a Big Mac for so, and I can't explain why?
[06:05.520 --> 06:06.790]  That, I went through that.
[06:07.020 --> 06:07.850]  So did my wife.
[06:07.960 --> 06:11.260]  We actually read it about the same time we both went to the same McDonald's.
[06:12.420 --> 06:14.700]  Like, chapter three, I'm like, I don't know why I'm here.
[06:15.220 --> 06:16.380]  But I won a Big Mac.
[06:16.380 --> 06:23.820]  But the outside world does not view our shenanigans when we're trying to talk about consumer protection the same way.
[06:24.820 --> 06:26.780]  The Folk Devil Folk Hero.
[06:27.670 --> 06:30.020]  We get blamed for a lot of stuff.
[06:30.600 --> 06:37.490]  Like, remember, this might be ancient history, Grand Theft Auto, San Andreas.
[06:37.490 --> 06:39.340]  Oh my God, there's porn in this.
[06:39.550 --> 06:41.320]  I mean, it's bad, blocky porn.
[06:41.460 --> 06:42.790]  So it reminds me of 1987.
[06:43.780 --> 06:47.930]  But, and what was, what was Rockstar Games?
[06:48.280 --> 06:49.020]  Hackers did it.
[06:49.100 --> 06:49.780]  I'm like, really?
[06:51.280 --> 06:57.990]  Someone broke into your systems, understood your, how you were handling software revisions, and added a module?
[06:58.990 --> 06:59.820]  That's Lee.
[07:00.730 --> 07:03.170]  And like, you said that with a straight face.
[07:03.420 --> 07:05.480]  You're willing to blame us for a lot of shit.
[07:05.790 --> 07:06.200]  Okay.
[07:08.000 --> 07:13.220]  But there's, there's the Folk Devil, the, the, you know, bad things happen and it's your guy's fault.
[07:13.460 --> 07:14.760]  It's also Folk Hero.
[07:15.290 --> 07:15.820]  You know?
[07:15.930 --> 07:20.850]  Like, oh, you're so clever and you're outside and, you know, the Tyler Durden kind of-esque thing.
[07:20.960 --> 07:23.220]  And not like we don't play into that shit ourselves.
[07:23.550 --> 07:23.790]  Right?
[07:25.340 --> 07:27.280]  Another trope is the mere criminal.
[07:27.280 --> 07:28.490]  The people hit target.
[07:28.930 --> 07:29.040]  Right?
[07:29.540 --> 07:30.340]  Getting paid.
[07:31.550 --> 07:33.600]  And the, ruin America.
[07:38.820 --> 07:43.980]  So, we have, we're in the middle of what I, what, what I'll, I'll name a moral panic.
[07:44.620 --> 07:48.980]  And there are people and there's, I think it's Stanley Cohen.
[07:49.140 --> 07:50.460]  It's Cohen, something Cohen.
[07:50.780 --> 07:52.200]  I'm sure you can Google it quickly.
[07:53.200 --> 07:54.760]  There's a moral entrepreneurship.
[07:55.040 --> 07:56.740]  People decide to take this up.
[07:56.960 --> 07:57.740]  Take up the banner.
[07:57.940 --> 07:59.640]  And something must be done.
[08:00.220 --> 08:07.840]  And, and the problem is when you hear something must be done about hackers, that kind of sounds like this.
[08:08.040 --> 08:08.160]  Right?
[08:09.380 --> 08:13.100]  And I don't like being like, wait a minute, something's got to be done about us.
[08:13.420 --> 08:13.760]  Uh-oh.
[08:15.000 --> 08:16.780]  I've, I've kind of heard that before.
[08:17.080 --> 08:18.720]  So, the state gets involved.
[08:19.200 --> 08:22.280]  Except the state does a couple weird things.
[08:22.280 --> 08:24.640]  The first one is responsibilization.
[08:24.920 --> 08:29.240]  They actually abdicate their role to protect regular people.
[08:29.700 --> 08:30.360]  Think of it this way.
[08:30.600 --> 08:38.800]  If someone stole, someone vandalized $10,000 worth of your property and you called up the police, would you expect some kind of response?
[08:40.000 --> 08:40.640]  Probably.
[08:40.840 --> 08:41.200]  Something.
[08:41.200 --> 08:41.340]  Something.
[08:41.460 --> 08:46.760]  I'll run over and do a report or do, there'll be some kind of showing your face.
[08:47.480 --> 08:51.380]  If, if you've got $10,000 worth of damage due to malware.
[08:51.920 --> 08:53.960]  Imagine what happens if you call the police.
[08:55.300 --> 08:57.000]  Yeah, you shouldn't have done that.
[08:57.700 --> 08:59.200]  Have you heard about McAfee?
[08:59.660 --> 09:00.720]  If that, right?
[09:00.900 --> 09:02.360]  You know, I've called, I've called law enforcement.
[09:02.480 --> 09:08.200]  Like, I've actually got someone in my systems or my client's systems and they're causing damage.
[09:08.200 --> 09:11.220]  And it's like, if it's not interesting, like, uh, no.
[09:11.540 --> 09:11.660]  Click.
[09:12.260 --> 09:18.480]  So, it's really, the, the idea is that computer crime and, and those, and those damages are really the citizen's fault.
[09:18.980 --> 09:20.320]  Go, go handle it yourself.
[09:20.520 --> 09:21.200]  Not our problem.
[09:21.440 --> 09:22.120]  So, they abdicate.
[09:22.600 --> 09:34.560]  And maybe they give you some ideas, like in, in the, the, the larger sort of enterprise sense, the recent cybersecurity framework where we're going to do something about cybersecurity on a national level.
[09:34.700 --> 09:35.180]  Oh, great.
[09:35.320 --> 09:35.880]  What are you going to do?
[09:36.060 --> 09:41.340]  We're going to generate a framework that references other frameworks, but we're going to color code them.
[09:42.240 --> 09:42.680]  Right?
[09:42.880 --> 09:44.120]  That's kind of my take on it.
[09:44.180 --> 09:50.220]  And like, wow, I, this looks like the Tinky Winky's purse Homeland Security five layer, five color thing.
[09:50.580 --> 09:50.980]  Okay.
[09:51.220 --> 09:51.660]  Great.
[09:52.120 --> 09:53.840]  That's a really going to do a lot for cybersecurity.
[09:55.760 --> 09:58.520]  But also because of this, we need more power.
[09:59.600 --> 10:06.240]  We need the right to be able to look at data held by, by large data brokers.
[10:06.860 --> 10:09.460]  We need more power to be able to face this threat.
[10:09.580 --> 10:12.460]  At the same time, we're recognizing that we're not actually doing much about it.
[10:12.540 --> 10:14.760]  At least we're putting the responsibility back on you.
[10:14.760 --> 10:18.860]  But when we have to show that we can do stuff, we have to show force.
[10:19.080 --> 10:21.540]  We have to be, the state has to be a lot stronger.
[10:21.540 --> 10:27.040]  Now this is, this kind of rambling thing, I want to bring back to how it affects you as an individual.
[10:29.600 --> 10:37.300]  Most of, most hackers, criminal hackers, and I realize this, you might not think you're a criminal, but that doesn't mean the state doesn't.
[10:38.720 --> 10:40.120]  Most will not get caught.
[10:41.380 --> 10:44.700]  The amount of stuff that could violate 18 U.S.C.
[10:44.720 --> 10:51.300]  1030, the Computer Fraud and Abuse Act, and the amount that actually gets prosecuted is, you know, a billion to one.
[10:51.300 --> 10:58.780]  So most people will not get caught, unless you're not doing good OPSEC, or if you're operating openly.
[10:59.940 --> 11:01.500]  Kind of a dangerous precedent.
[11:02.020 --> 11:07.200]  That means that people who consider themselves white hats and do things like, I publish what I found.
[11:07.820 --> 11:09.800]  I want to tell people about it.
[11:09.980 --> 11:11.960]  That's operating openly, right?
[11:12.180 --> 11:15.500]  You are standing out and saying, I did this.
[11:17.480 --> 11:20.520]  So all of a sudden, you're going to get the attention of the state.
[11:20.520 --> 11:26.800]  And they're going to determine whether or not you've done something that warrants prosecution.
[11:27.660 --> 11:32.620]  So if you are kind of caught up in the system, expect greater scrutiny.
[11:33.280 --> 11:38.500]  If they can portray you as a threat rather than a prankster, you're a threat.
[11:38.680 --> 11:39.800]  You're ermagird.
[11:40.020 --> 11:40.640]  You're dangerous.
[11:42.500 --> 11:44.280]  And it's like speeding in a rainstorm.
[11:44.480 --> 11:49.120]  It's harder to catch people doing it, because, you know, it's all dark and hard to find.
[11:49.120 --> 11:51.200]  But when they do, you expect a whooping.
[11:53.400 --> 11:55.240]  So when are we actually going to talk about law?
[11:55.500 --> 11:55.540]  Okay.
[11:55.800 --> 11:58.520]  18 U.S.C., 1030, Computer Fraud and Abuse Act.
[11:58.720 --> 12:06.380]  This bans unauthorized access or excess of authorized access or granted access to a protected computer.
[12:07.200 --> 12:11.740]  A protected computer is pretty much anything that isn't actually powered down in your basement.
[12:11.740 --> 12:23.920]  Because if it affects interstate commerce or interstate communication, well, this, for as little as it works, is a protected computer.
[12:23.940 --> 12:25.960]  Because it's in interstate communication.
[12:26.440 --> 12:28.900]  You know, I sent an email this morning.
[12:29.380 --> 12:30.520]  Went out of state.
[12:30.700 --> 12:31.000]  Great.
[12:31.000 --> 12:32.080]  So...
[12:33.860 --> 12:37.160]  And obtaining information, as simple as that.
[12:37.820 --> 12:44.060]  I, without access, or without authorized access, obtained information.
[12:44.360 --> 12:46.360]  That's a CFAA violation.
[12:46.620 --> 12:47.540]  A felony.
[12:48.480 --> 12:49.660]  Vague as hell.
[12:51.960 --> 12:54.160]  And it's deliberately vague.
[12:54.160 --> 12:59.620]  When this was written, there's a great paper in this by Paul Ohm called The Myth of the Super User.
[12:59.940 --> 13:02.300]  And it's an actually relatively...
[13:03.280 --> 13:08.540]  For a law review article, it's relatively tangible and useful to non-lawyers.
[13:09.400 --> 13:26.300]  And it basically lies out that there's a deliberate point in making this big, broad, vague law, which was a belief that hackers, because they are supernatural creatures, can change their behavior to skirt around the law.
[13:27.320 --> 13:34.500]  And because of this, we should make these laws vague so we can make it kind of bump over and catch them.
[13:34.600 --> 13:42.240]  Well, normally, when we describe behavior as, well, you're skirting around the law, it means that you're not violating the law.
[13:42.780 --> 13:43.320]  Right?
[13:43.320 --> 13:46.980]  Like, do you know that you were driving 44 in a 45?
[13:47.440 --> 13:49.420]  That seems like you were trying to skirt the law.
[13:49.500 --> 13:51.300]  Like, no, I was obeying it.
[13:52.800 --> 13:54.000]  Do you know what you're doing?
[13:54.120 --> 13:55.900]  Not yet, but I think you're going to tell me.
[13:57.640 --> 14:02.920]  So, this belief, and it was just, like, looking through congressional testimony, that was the belief.
[14:03.040 --> 14:09.580]  Like, these people can read the law, and they'll modify their behavior to not violate it.
[14:09.580 --> 14:12.620]  And by reading, like, that's what we call law-abiding.
[14:13.340 --> 14:14.680]  But no, we need...
[14:14.680 --> 14:19.540]  So, this very, very vague language is deliberate.
[14:19.620 --> 14:24.820]  Because there was a belief that we would modify our behavior to skip ahead.
[14:25.080 --> 14:26.020]  Well, okay.
[14:28.900 --> 14:30.320]  So, going through.
[14:30.560 --> 14:34.980]  Obtaining information, causing damage, or furtherance of fraud.
[14:37.760 --> 14:42.780]  You need to have the unauthorized access and one of those three things, or one or more of those three things.
[14:43.920 --> 14:46.740]  Attempt to do so is also criminal.
[14:47.360 --> 14:49.780]  Asking someone else to do so is criminal.
[14:50.300 --> 14:55.600]  There's a case where a lawyer was actually charged under the 18 U.S.C.
[14:55.660 --> 15:02.140]  1030 for issuing a too broad subpoena to gather information held in a database.
[15:03.140 --> 15:06.780]  And it was kind of a douchebag subpoena, but...
[15:06.780 --> 15:11.980]  At least, you know, me growing up in New Jersey, if being a douchebag was illegal, we'd be in trouble.
[15:17.830 --> 15:19.470]  I'll let that...
[15:19.470 --> 15:20.010]  Okay.
[15:20.250 --> 15:25.650]  So, the problem is that there are, in a lot of other laws, there are loopholes or exceptions.
[15:26.530 --> 15:28.350]  And here's one where there isn't.
[15:28.450 --> 15:33.270]  There is no good reason or self-defense exclusion under the CFAA.
[15:34.730 --> 15:41.430]  Every year, I go to some kind of, like, straight suit and, like, not this kind of suit con.
[15:41.690 --> 15:49.150]  And I talk to other lawyers in the space, and someone brings up this old trope of active self-defense, which is hack back.
[15:49.430 --> 15:55.530]  And it's great, especially if you're like Lockheed Martin, where you can sell a $14 million system that will...
[15:55.530 --> 15:59.990]  that has, like, a lot of macho terms, like, kill chain enforcer, you know.
[16:00.610 --> 16:01.050]  And...
[16:01.050 --> 16:07.010]  So, it's like, either the bad metal band I tried to be in in high school or a Lockheed Martin product.
[16:07.450 --> 16:08.530]  And, um...
[16:11.550 --> 16:14.710]  The problem is, is that there isn't a self-defense exclusion.
[16:15.390 --> 16:17.150]  So, doing that, it's like...
[16:17.150 --> 16:20.130]  I know why you want to sell it, because it sounds awesome.
[16:20.130 --> 16:26.010]  Because your upper level management, you go to your InfoSec people, and they're like, yeah, our defenses are okay, but we still get hit.
[16:26.090 --> 16:27.730]  Like, why don't we strike back?
[16:28.070 --> 16:29.130]  Because I'm angry.
[16:29.450 --> 16:31.110]  And it's like, because you can.
[16:31.470 --> 16:32.850]  Because it's not lawful.
[16:32.970 --> 16:34.290]  And I don't want to go to prison.
[16:36.670 --> 16:38.590]  So, those exclusions aren't there.
[16:38.750 --> 16:39.950]  Maybe it's a good thing they aren't.
[16:40.030 --> 16:43.930]  But the no good reason, no First Amendment change to that.
[16:43.930 --> 16:49.250]  No kind of, I was doing it but, none of that there.
[16:50.430 --> 16:53.530]  So, criminal and civil penalties, fairly extensive.
[16:54.370 --> 17:05.850]  Like, a basic CFAA violation, if you're not going out and really trying to screw things up, is still at least three to four years, minimum, in federal prison.
[17:06.590 --> 17:10.390]  And also, many states have equivalent laws that you can also get charged under.
[17:10.390 --> 17:14.010]  So, that's the fear part of this talk.
[17:16.210 --> 17:18.590]  Additional pieces of law that modify this.
[17:18.950 --> 17:20.230]  EULAs in terms of service.
[17:21.110 --> 17:28.590]  These kind of lay out, when we were talking about, you know, earlier, the unauthorized use or excess of authorized use.
[17:28.950 --> 17:30.870]  Well, what sets your rights?
[17:30.890 --> 17:34.510]  What says what you are allowed to do and what you aren't allowed to do?
[17:34.830 --> 17:37.190]  Well, that's in a EULA or a term of service.
[17:38.970 --> 17:41.510]  Who here reads EULAs in terms of service?
[17:43.810 --> 17:44.530]  You're lying.
[17:47.070 --> 17:49.510]  Well, I remember once talking to a lawyer who wrote them.
[17:49.630 --> 17:51.410]  And I remember this because it was, we got one.
[17:51.530 --> 17:52.770]  And it was like 27 pages.
[17:52.850 --> 17:56.350]  And I just grabbed through and said, I'm sorry, when did you guys get bought out by Google?
[17:57.790 --> 17:59.530]  Actually, it was, when did you get bought out by Yahoo?
[17:59.930 --> 18:00.790]  And he's like, why?
[18:00.790 --> 18:03.350]  Because you used Yahoo's terms of service.
[18:04.470 --> 18:08.450]  Like, you should have found and replaced all examples of Yahoo.
[18:09.650 --> 18:11.030]  And he's like, no one reads these.
[18:11.030 --> 18:12.210]  Like, you didn't.
[18:13.150 --> 18:15.310]  You didn't read it when you wrote it.
[18:15.550 --> 18:17.670]  How much did you bill your client for it?
[18:17.730 --> 18:22.190]  And then I'm thinking, this guy's got the best goddamn scam.
[18:22.190 --> 18:26.970]  Like, he billed them like $10,000 to copy and paste it.
[18:27.230 --> 18:29.310]  And it's like, no one's noticed that.
[18:29.370 --> 18:30.370]  And that's three years ago.
[18:30.590 --> 18:32.530]  Like, wow.
[18:35.370 --> 18:38.150]  That's a scam that's so awesome.
[18:38.310 --> 18:39.230]  I mean, on one hand.
[18:39.230 --> 18:40.430]  On the other hand, like, you're lazy.
[18:40.510 --> 18:41.450]  And I hate lazy.
[18:41.450 --> 18:42.270]  Unless it's me.
[18:42.390 --> 18:43.570]  Then I'll justify it somehow.
[18:45.290 --> 18:51.870]  So, other things that set about this vague, what permission have you been granted to do?
[18:53.070 --> 18:55.130]  Vulnerability assessment or pen test scope.
[18:56.190 --> 18:56.850]  And I...
[18:56.850 --> 18:58.370]  God, I hate writing them.
[18:58.630 --> 18:59.690]  God, I hate reading them.
[18:59.850 --> 19:06.610]  And I'm sure those of you who are hiring pen testers and that kind of space are also doing the...
[19:06.610 --> 19:07.690]  I hate doing this.
[19:07.790 --> 19:08.650]  But you really...
[19:08.650 --> 19:13.370]  If you're on the other side, you want to know exactly where you can go.
[19:13.690 --> 19:20.130]  And the good part of this is, the permission granted can also be oral.
[19:20.510 --> 19:29.310]  So, if you don't know, like you're halfway through, three quarters through that pen test and you're poking at stuff, if you don't know, is better to ask.
[19:29.430 --> 19:31.090]  Because that way, if they go, yeah, sure.
[19:31.190 --> 19:31.750]  I'm like, okay.
[19:32.050 --> 19:33.550]  You said I could do this.
[19:33.630 --> 19:34.750]  So, there's no question.
[19:34.990 --> 19:36.190]  And be very clear.
[19:36.190 --> 19:40.110]  Especially if you do this in email, because the advantage of email is you've got a paper trail.
[19:40.870 --> 19:41.630]  So, ask.
[19:41.810 --> 19:43.310]  Say, can I do this?
[19:43.690 --> 19:44.570]  Yes, no.
[19:46.590 --> 19:48.790]  Third-party audit clauses are ugly.
[19:49.030 --> 19:50.470]  And everyone uses them.
[19:51.570 --> 19:52.610]  Because it's...
[19:52.610 --> 19:57.390]  I, you know, I as company A have to worry about company B's holding my data.
[19:58.050 --> 20:00.990]  Company B, though, is hosting their stuff at company C.
[20:00.990 --> 20:12.070]  So, in order for me to know how my data is secured, I have to have that third-party audit clause that allows me to audit C, even though I have no contract with C.
[20:12.330 --> 20:15.850]  But B has to bind C and therefore let me in.
[20:16.510 --> 20:17.510]  That's permission.
[20:17.810 --> 20:20.130]  However, you have to make sure it covers you as well.
[20:20.530 --> 20:24.070]  So, you're allowed to ask and get that in writing in some form.
[20:24.170 --> 20:28.950]  It doesn't have to be, you know, on paper with signatures and, you know, subparagraph C.
[20:29.090 --> 20:31.650]  You just have to have some kind of cover for this.
[20:33.710 --> 20:38.270]  And the final bit of laws that affect you are NDAs, non-disclosure agreements.
[20:41.470 --> 20:43.470]  So, let's walk through a hypothetical.
[20:44.710 --> 20:46.190]  White hat testing systems.
[20:46.310 --> 20:54.690]  And now this could be an authorized, paid, you know, you're working for some company that, you know, we do pen tests better than everyone else.
[20:54.930 --> 20:55.610]  Okay, great.
[20:56.210 --> 20:58.110]  You know, our pen testers are awesomer.
[20:59.950 --> 21:03.590]  I'm sure you'll hear that or make that pitch at DEF CON in a week or two.
[21:05.590 --> 21:06.750]  You're testing systems.
[21:06.950 --> 21:08.730]  And you're testing, say, third-party systems.
[21:08.930 --> 21:16.710]  What if I'm testing, you know, I'm doing vendor management, so I have to audit B.
[21:16.890 --> 21:18.510]  I'm company A, company B.
[21:18.690 --> 21:22.030]  Company B, though, is hosting a lot of their stuff on a third company.
[21:22.030 --> 21:27.310]  Maybe it's a co-location provider that also offers hosted service.
[21:27.490 --> 21:28.530]  Maybe it's Amazon.
[21:28.730 --> 21:29.490]  Maybe it's somebody.
[21:29.650 --> 21:37.130]  And you have to go and say, I have to test your systems, but I don't really know where your systems end and Amazon start.
[21:37.610 --> 21:43.310]  So, it's helpful to kind of get that whole path security, know where...
[21:43.310 --> 21:47.930]  Or get that whole path understood and say, I can go up to here, but no further.
[21:50.650 --> 21:54.210]  Making sure you have clear permission keeps you on the protected side.
[21:54.490 --> 21:56.990]  Now, let's make this one step further.
[21:57.270 --> 22:00.190]  What if you are, we'll just say, the freelance white hat?
[22:00.330 --> 22:03.390]  As in, you aren't doing this to protect your employer.
[22:03.610 --> 22:07.830]  You're doing this out of straight-up curiosity or some kind of consumer protection.
[22:08.970 --> 22:10.830]  You're Ralph Nader-esque.
[22:11.230 --> 22:19.690]  You think you've found a vulnerability in some common, well-supported, well-used platform.
[22:19.970 --> 22:21.350]  And you want to take a poke at it.
[22:21.410 --> 22:24.050]  Now, if you own it, you know, it's a device that you own.
[22:24.350 --> 22:30.070]  And in that 32-page EULA, there isn't something about what you can and can't do.
[22:30.070 --> 22:33.770]  Because more and more, the EULA says what you don't own.
[22:34.070 --> 22:36.910]  You know, I theoretically own my laptop.
[22:37.250 --> 22:41.610]  Because, you know, I own, you know, it's open-source, blah, blah, blah, blah.
[22:41.850 --> 22:44.670]  Somehow there's a GPL that provides what I can do to it.
[22:45.230 --> 22:46.930]  I don't think I own my phone.
[22:47.330 --> 22:50.390]  Because it's interfacing at all times with Verizon.
[22:50.390 --> 22:55.590]  And how far I can go depends on what Verizon lets me do with it.
[22:55.830 --> 23:01.170]  So I might not be able to test everything my phone does.
[23:01.590 --> 23:04.670]  Because it goes back and it actually touches stuff that Verizon owns.
[23:05.330 --> 23:11.730]  So I might not have authorization to test that.
[23:13.210 --> 23:15.510]  And authorization to break that.
[23:15.850 --> 23:25.390]  So that's something I kind of wanted to get out there is to say, it doesn't matter that you have good intentions, if your license doesn't grant you that power.
[23:26.650 --> 23:28.450]  And I'll kind of walk through that in a bit.
[23:29.730 --> 23:30.710]  Second hypo.
[23:32.150 --> 23:32.710]  Hacktivist.
[23:32.910 --> 23:34.750]  Doing web defacement or DDoS.
[23:34.990 --> 23:37.510]  We've all known someone who did that.
[23:38.410 --> 23:44.570]  You're still liable for the damages, even though you're saying, I'm not doing this for profit or malice.
[23:44.610 --> 23:46.930]  I'm doing this to further a cause.
[23:46.930 --> 23:48.330]  I'm doing this as speech.
[23:48.890 --> 23:52.510]  And I don't really like the argument that DDoS is free speech.
[23:52.770 --> 23:53.510]  I'm sorry.
[23:53.710 --> 23:55.130]  Maybe I'm old and boring.
[23:55.310 --> 23:56.990]  But it seems to reduce speech.
[23:57.190 --> 24:04.930]  And the idea, if you go back to Brandeis' marketplace of ideas, is Mar speech is better, even if it's stupid, even if it's evil.
[24:05.930 --> 24:06.890]  So DDoS.
[24:06.990 --> 24:10.710]  But anyway, you're still liable for those damages, even though you're not doing it for malice.
[24:10.710 --> 24:13.990]  There's no free speech exception to 18 U.S.C.
[24:14.090 --> 24:14.650]  1030.
[24:17.290 --> 24:17.870]  Yeah.
[24:18.670 --> 24:19.250]  So...
[24:28.810 --> 24:30.290]  It's a free...
[24:30.290 --> 24:30.590]  I'm sorry.
[24:30.770 --> 24:32.290]  A free pen test to the...
[24:33.350 --> 24:33.930]  Did...
[24:33.930 --> 24:34.150]  Did...
[24:37.600 --> 24:38.610]  As a community...
[24:39.540 --> 24:40.120]  Did...
[24:40.120 --> 24:40.500]  Did...
[24:40.500 --> 24:40.640]  Did...
[24:40.640 --> 24:44.160]  The Hotel Pennsylvania grant you permission to do so?
[24:44.460 --> 24:45.300]  Probably not.
[24:46.160 --> 24:46.720]  So...
[24:46.720 --> 24:48.480]  Your authorization has not been granted.
[24:49.600 --> 24:50.740]  There is no...
[24:50.740 --> 24:50.820]  Yeah.
[24:51.000 --> 24:52.400]  And the additional stuff is...
[24:52.400 --> 24:54.920]  Is fun to think about, and is not a defense.
[24:55.440 --> 24:55.840]  Like...
[24:55.840 --> 24:57.160]  When I've done the criminal defense, like...
[24:57.160 --> 24:58.080]  But they did this!
[24:58.460 --> 24:59.460]  Not relevant.
[24:59.760 --> 25:00.020]  Sorry.
[25:03.180 --> 25:03.760]  So...
[25:03.760 --> 25:04.300]  Third hypo.
[25:04.720 --> 25:05.920]  The mere criminal.
[25:07.120 --> 25:12.020]  The person who just does something, except they do it on a computer, to somebody else's computer.
[25:12.740 --> 25:15.400]  There are sentence enhancements...
[25:15.830 --> 25:17.920]  Extensive sentence enhancements for using...
[25:17.920 --> 25:20.660]  For computer crime, that are sort of built into the system.
[25:20.860 --> 25:22.420]  Every computer crime...
[25:25.520 --> 25:31.280]  Incident I've seen that's been sentenced under the federal guidelines, they're automatic sentence enhancements.
[25:31.880 --> 25:32.460]  Just goes...
[25:32.460 --> 25:33.260]  Sophisticated means.
[25:34.100 --> 25:34.700]  I...
[25:34.700 --> 25:36.680]  One case in Texas...
[25:37.440 --> 25:39.420]  Guy installs log me in on a system.
[25:40.100 --> 25:41.140]  And they go...
[25:41.140 --> 25:41.500]  Oh...
[25:41.500 --> 25:41.940]  That's...
[25:41.940 --> 25:42.300]  That's...
[25:42.300 --> 25:42.560]  You know...
[25:42.560 --> 25:43.820]  That's a sophisticated means.
[25:44.400 --> 25:46.220]  Two levels and a sentencing enhancement.
[25:46.380 --> 25:46.800]  Like...
[25:46.800 --> 25:47.860]  It's log me in.
[25:48.000 --> 25:48.260]  Like...
[25:48.260 --> 25:48.560]  That's...
[25:48.560 --> 25:49.680]  That's not LEAP.
[25:50.100 --> 25:51.480]  But to a court...
[25:51.480 --> 25:52.160]  To a prosecutor...
[25:52.160 --> 25:52.320]  Like...
[25:52.320 --> 25:52.500]  Yeah...
[25:52.500 --> 25:52.720]  That's...
[25:52.720 --> 25:53.960]  I didn't know how to do that.
[25:54.240 --> 25:54.840]  Like...
[25:58.720 --> 25:59.760]  Anything more...
[25:59.760 --> 26:00.560]  Anything...
[26:00.560 --> 26:01.780]  Anything better than that...
[26:01.780 --> 26:02.460]  You know...
[26:02.460 --> 26:04.000]  Sophisticated means...
[26:04.880 --> 26:05.400]  Wow...
[26:05.400 --> 26:06.340]  That's interesting.
[26:06.560 --> 26:07.260]  And it's automatic.
[26:07.480 --> 26:08.120]  It's almost automatic.
[26:08.440 --> 26:09.000]  I haven't seen...
[26:09.000 --> 26:10.820]  I haven't seen a prosecution that didn't have that.
[26:14.820 --> 26:15.340]  Clearly...
[26:15.340 --> 26:16.220]  Anything above that...
[26:16.220 --> 26:16.520]  It's just like...
[26:16.520 --> 26:16.640]  You know...
[26:16.640 --> 26:18.460]  We're enhancing your sentence.
[26:18.540 --> 26:19.860]  And I love that newspeak.
[26:20.080 --> 26:20.200]  Right?
[26:20.780 --> 26:21.060]  Like...
[26:21.060 --> 26:22.640]  We're gonna make your sentence better.
[26:23.180 --> 26:23.700]  How?
[26:23.920 --> 26:25.240]  By making it longer.
[26:26.820 --> 26:27.340]  So...
[26:27.340 --> 26:28.360]  What to avoid?
[26:28.520 --> 26:30.160]  And I wanna make this more practical now.
[26:31.700 --> 26:34.620]  Either own the box before you own the box.
[26:35.180 --> 26:35.900]  Or...
[26:35.900 --> 26:37.040]  Get clear...
[26:37.040 --> 26:37.960]  Clear permission.
[26:39.700 --> 26:41.720]  Because that's gonna be your defense.
[26:42.740 --> 26:44.380]  You exceeded authorization.
[26:44.760 --> 26:45.100]  No...
[26:45.100 --> 26:45.800]  Here's my authorization.
[26:46.140 --> 26:48.220]  You exceeded the scope of that authorization.
[26:49.120 --> 26:49.720]  Well...
[26:49.720 --> 26:51.300]  Here's how I understood it.
[26:52.540 --> 26:53.140]  And...
[26:53.140 --> 26:54.800]  Here's how you're now claiming it meant.
[26:55.060 --> 26:55.360]  Well...
[26:55.360 --> 26:57.540]  At least I've got enough covered that I can argue.
[26:57.840 --> 26:59.440]  I got some space there to wiggle.
[27:00.020 --> 27:01.260]  And most prosecutors...
[27:01.260 --> 27:06.460]  The reason why most prosecutors have like 90 to 98% win rates...
[27:06.860 --> 27:08.640]  Is that they don't take losers.
[27:10.160 --> 27:11.080]  So they will...
[27:11.080 --> 27:12.940]  If there's something that you can go like...
[27:12.940 --> 27:13.240]  Wait a minute.
[27:13.340 --> 27:14.840]  You got a decent argument there.
[27:15.180 --> 27:15.560]  Uh...
[27:15.560 --> 27:17.100]  Can you make this go away?
[27:18.380 --> 27:18.860]  Or...
[27:18.860 --> 27:19.740]  Not prosecute it.
[27:20.080 --> 27:20.560]  Or...
[27:20.560 --> 27:22.960]  Offer some like really stupid plea deal.
[27:23.080 --> 27:23.340]  Like...
[27:23.340 --> 27:24.620]  We want 900...
[27:24.620 --> 27:26.520]  We wanna put this defendant away for 900 years.
[27:26.800 --> 27:27.460]  What's the plea?
[27:27.620 --> 27:28.280]  30 days?
[27:28.920 --> 27:30.240]  You wanted that to go away.
[27:30.380 --> 27:30.960]  You wanted...
[27:30.960 --> 27:32.000]  You want something.
[27:32.240 --> 27:33.520]  And you won't take it to trial.
[27:33.520 --> 27:34.540]  So it will get dropped.
[27:34.920 --> 27:35.480]  But...
[27:35.480 --> 27:36.140]  They're not...
[27:36.140 --> 27:37.700]  They're not even charging people.
[27:37.840 --> 27:39.220]  Unless they've got really good evidence.
[27:40.440 --> 27:42.860]  And that's why I wanna start talking about evidence now.
[27:44.720 --> 27:46.640]  Be careful about disclosure.
[27:47.160 --> 27:48.420]  I'm not saying don't disclose.
[27:48.780 --> 27:50.420]  I'm saying be careful about it.
[27:52.040 --> 27:54.640]  Most of the prosecutions I've read...
[27:54.640 --> 27:56.760]  Are for people who got trouble.
[27:56.980 --> 27:57.920]  And not for what they did.
[27:58.520 --> 27:59.620]  What they did...
[27:59.620 --> 28:01.260]  Didn't get anyone's attention.
[28:01.260 --> 28:04.180]  It's the talking about it that got them there.
[28:04.460 --> 28:07.340]  And if you can make hackers not gossip...
[28:07.340 --> 28:07.800]  I don't...
[28:07.800 --> 28:08.200]  You know...
[28:08.200 --> 28:09.120]  Not possible.
[28:12.370 --> 28:14.610]  Good operational security...
[28:14.610 --> 28:16.690]  Does not stop after the act.
[28:19.390 --> 28:20.070]  Okay.
[28:20.430 --> 28:21.430]  What to avoid?
[28:21.770 --> 28:23.150]  More on operational security.
[28:24.010 --> 28:26.070]  Consider who knows what you've done.
[28:28.270 --> 28:30.170]  Consider what evidence...
[28:30.170 --> 28:31.650]  Your whole track has created.
[28:31.650 --> 28:33.410]  Where that evidence is.
[28:33.610 --> 28:33.690]  Right?
[28:33.810 --> 28:35.230]  You've got a log on your system.
[28:35.370 --> 28:37.090]  There's a log on the remote system.
[28:38.410 --> 28:39.490]  You've got...
[28:39.490 --> 28:40.390]  Perhaps...
[28:40.390 --> 28:42.490]  If there was network monitoring between you and them.
[28:42.530 --> 28:43.790]  What does that say?
[28:44.470 --> 28:46.790]  How does that map back to you?
[28:49.270 --> 28:49.850]  Now...
[28:49.850 --> 28:52.630]  The bigger thing is consider what statements you've made.
[28:53.510 --> 28:54.050]  Either...
[28:55.010 --> 28:56.090]  Pseudo anonymously...
[28:56.090 --> 28:56.950]  Are in real life.
[28:57.290 --> 28:58.490]  What maps back to you?
[28:58.730 --> 28:59.090]  What...
[28:59.480 --> 29:00.630]  What's been said...
[29:00.630 --> 29:02.130]  That can be used against you.
[29:02.270 --> 29:05.690]  And this is one of those things that I try to drill into people...
[29:05.690 --> 29:06.390]  Us...
[29:06.390 --> 29:06.870]  When I...
[29:06.870 --> 29:10.330]  Because I see how the outside world views us in some ways.
[29:11.650 --> 29:12.190]  And...
[29:14.650 --> 29:16.850]  Imagine everything you said...
[29:16.850 --> 29:17.990]  Said...
[29:17.990 --> 29:20.610]  And interpreted in the worst possible light.
[29:21.490 --> 29:22.870]  What did they mean by that?
[29:22.990 --> 29:24.350]  It must mean they hate America.
[29:26.970 --> 29:27.570]  And...
[29:28.530 --> 29:29.530]  Think of...
[29:29.530 --> 29:32.130]  There's the Cardinal Richelieu line about...
[29:32.130 --> 29:32.270]  You know...
[29:32.270 --> 29:36.570]  Give me six lines by the most honest man and I will find there's something to condemn him.
[29:36.570 --> 29:40.810]  Except we say damnable things all the goddamn time.
[29:42.190 --> 29:45.650]  We say things that can easily be misinterpreted.
[29:45.990 --> 29:46.750]  And...
[29:46.750 --> 29:48.790]  We interpret them the...
[29:48.790 --> 29:49.270]  In a...
[29:49.270 --> 29:49.930]  You know...
[29:49.930 --> 29:51.510]  In a jovial, fun way.
[29:52.250 --> 29:53.010]  And...
[29:53.010 --> 29:53.690]  They don't.
[29:55.150 --> 29:55.910]  So...
[29:55.910 --> 29:56.970]  On statements.
[29:57.430 --> 30:00.010]  Statements will be used against you.
[30:01.630 --> 30:04.030]  There's this rule about hearsay.
[30:05.050 --> 30:10.130]  Any out of court statement made for the point of proving it is not admissible.
[30:10.430 --> 30:10.950]  Unless...
[30:10.950 --> 30:11.870]  There's an exception.
[30:12.010 --> 30:13.130]  There are like 15 exceptions.
[30:13.430 --> 30:17.030]  And I won't rattle through all of them because the one that's going to bite us is...
[30:17.030 --> 30:19.630]  Statements against interest are omissions of guilt.
[30:21.250 --> 30:26.630]  And everything you do is a statement against interest or an omission of guilt in these cases.
[30:27.590 --> 30:28.370]  An example.
[30:28.790 --> 30:29.850]  F*ck shit up.
[30:30.710 --> 30:31.870]  I have read that.
[30:31.870 --> 30:34.490]  I've read this line in more indictments.
[30:34.870 --> 30:36.850]  In more sentencing guidelines...
[30:36.850 --> 30:38.170]  In more sentencing briefs.
[30:39.470 --> 30:39.990]  And...
[30:39.990 --> 30:42.830]  I think I say that at least 20 times a day.
[30:43.570 --> 30:43.850]  Right?
[30:44.250 --> 30:44.770]  Oh, man.
[30:44.890 --> 30:46.510]  You can get in there and you're just like, f*ck shit up.
[30:46.810 --> 30:47.110]  Blah.
[30:47.710 --> 30:48.810]  Because you're like...
[30:48.810 --> 30:49.870]  You're doing that...
[30:50.570 --> 30:51.150]  As a...
[30:51.150 --> 30:53.350]  Part of my job as a vulnerability assessor is...
[30:53.350 --> 30:54.750]  I have to threatster bait.
[30:54.990 --> 30:55.110]  You know?
[30:55.570 --> 30:57.790]  If you own this box, what could happen?
[30:58.010 --> 30:59.590]  You're like, total f*cking ownage.
[30:59.710 --> 31:01.790]  But you have to then make it to like a business proposition.
[31:02.050 --> 31:02.150]  Right?
[31:02.250 --> 31:05.450]  It's like, this means that all your clients will hate you forever.
[31:05.770 --> 31:07.450]  They will burn you in effigy.
[31:07.590 --> 31:08.190]  Oh, okay.
[31:08.270 --> 31:08.590]  That would...
[31:08.590 --> 31:09.270]  That would suck.
[31:09.410 --> 31:12.310]  Because you know, I kind of want to have clients or business or whatever.
[31:13.150 --> 31:13.590]  So...
[31:13.590 --> 31:13.910]  You...
[31:13.910 --> 31:14.910]  We use that term.
[31:15.050 --> 31:15.870]  However, that...
[31:15.870 --> 31:17.510]  That gets misinterpreted.
[31:17.570 --> 31:20.650]  Or actually gets interpreted in that negative, ugly way.
[31:20.650 --> 31:31.230]  Like, think of a prosecutor as the person you've been on a four-day road trip in, in a hot car with no air conditioning, and someone spilled a Coke on the seat so it's all sticky.
[31:31.470 --> 31:31.770]  Like...
[31:31.770 --> 31:33.170]  So anything they...
[31:33.170 --> 31:37.730]  Anything you say is gonna get interpreted by someone who just wants you to die.
[31:38.430 --> 31:38.810]  You know?
[31:38.990 --> 31:39.810]  You know when you get that...
[31:40.350 --> 31:40.870]  Like...
[31:40.870 --> 31:41.270]  You...
[31:41.270 --> 31:42.450]  You're thinking things...
[31:42.450 --> 31:43.090]  You're saying things like...
[31:43.090 --> 31:44.290]  You breathe like Hitler.
[31:45.310 --> 31:45.830]  Right?
[31:46.670 --> 31:51.690]  I want you to contemplate everything you said interpreted by someone who hates you at that level.
[31:52.770 --> 32:00.390]  So, f*ck shit up means I want to ruin this machine and everyone connected to it and cause death and destruction.
[32:01.450 --> 32:02.810]  Because that's how it's interpreted.
[32:03.150 --> 32:03.490]  The...
[32:03.490 --> 32:03.650]  The...
[32:05.050 --> 32:07.090]  Jesse McGraw case in Texas.
[32:07.630 --> 32:09.010]  Like, found a HV...
[32:09.010 --> 32:10.430]  A weak HVAC box.
[32:10.610 --> 32:10.870]  You know?
[32:10.970 --> 32:11.670]  That was controlling it.
[32:11.770 --> 32:13.730]  And said, oh, you could really f*ck shit up there.
[32:13.910 --> 32:15.670]  That went into the sentencing enhancement.
[32:16.690 --> 32:20.350]  That earned him an extra 18 months by just saying that.
[32:20.670 --> 32:22.450]  And it was, you could f*ck shit up.
[32:22.610 --> 32:26.010]  That gets interpreted as, he wanted to kill people.
[32:31.010 --> 32:31.970]  Admissions like this.
[32:32.090 --> 32:33.830]  Seeing this in an IRC log.
[32:35.090 --> 32:37.610]  Here's the usernames and passwords to log into this box.
[32:38.250 --> 32:38.530]  Okay.
[32:39.030 --> 32:45.550]  That statement right there shows intent and shows the understanding of the crime and also kind admits to the crime.
[32:46.050 --> 32:46.530]  Boop.
[32:46.750 --> 32:47.170]  That line.
[32:49.970 --> 32:51.190]  And this is my favorite.
[32:51.330 --> 32:52.570]  Like, you're not a cop, are you?
[32:53.330 --> 32:53.810]  That...
[32:54.310 --> 32:58.590]  That goes back to other computer crimes that I've helped defend.
[32:58.970 --> 32:59.350]  Sorry.
[32:59.450 --> 32:59.990]  I want to make sure...
[32:59.990 --> 33:03.270]  I want to make sure that I've parsed this in the most negative light.
[33:05.170 --> 33:09.990]  That line comes up and it shows that you knew you were doing something that you shouldn't have.
[33:09.990 --> 33:12.530]  So it shows intent to commit a crime.
[33:13.230 --> 33:18.270]  Instead of just some part of a negotiation to a later negotiation.
[33:18.770 --> 33:20.050]  And I'll just leave it at that.
[33:20.270 --> 33:20.630]  You know, you can...
[33:20.630 --> 33:26.870]  You can imagine where this statement comes up most often in an IRC chat log with a supposed 14-year-old girl.
[33:30.470 --> 33:31.570]  Interpreting the worst possible way.
[33:31.670 --> 33:34.990]  These are criminal prosecutions I've, you know, helped defend.
[33:35.230 --> 33:36.990]  Not that I'm ever on an IRC log.
[33:37.910 --> 33:40.350]  You know, talking to supposed 14-year-old girls.
[33:41.530 --> 33:42.130]  Okay.
[33:44.690 --> 33:49.210]  Finally, I want to point out about the not making things better.
[33:49.650 --> 33:57.010]  There's a criminal defense attorney I've worked with in the past has this great line, which is, once the bracelets come on, shut up.
[33:57.350 --> 33:59.890]  You are not talking your way out of handcuffs.
[33:59.890 --> 34:01.610]  And it's true.
[34:02.450 --> 34:06.210]  At that point, all you can do is make things worse.
[34:06.310 --> 34:07.710]  And usually we do.
[34:08.030 --> 34:10.370]  Because that's a traumatic experience.
[34:10.790 --> 34:11.930]  Especially for us.
[34:12.070 --> 34:13.090]  Because we're not used to...
[34:13.090 --> 34:20.150]  Like, the only time you have handcuffs put around you is you're down at the tool lockpick village going, I think I can do this.
[34:20.430 --> 34:20.930]  Right?
[34:20.930 --> 34:22.030]  It's fun.
[34:22.390 --> 34:28.050]  Because oftentimes they've got like some kind of nice, cute layer around them.
[34:28.170 --> 34:31.470]  So that way, you know, you know whose handcuffs there are.
[34:31.950 --> 34:38.090]  Not, you know, the Smith and Wessons being, you know, whacked on you by a burly cop who doesn't want to, you know, really hear any shit out of you.
[34:38.090 --> 34:40.610]  So, we tend to panic.
[34:40.870 --> 34:44.210]  And we tend to try to figure out, like, what can I do to get out of this?
[34:45.050 --> 34:47.290]  And they exploit that fact.
[34:49.430 --> 34:59.070]  And a friend of mine who works for the FBI has pointed out that they'll deliberately try to rattle people once arrested because then they'll try to talk.
[34:59.230 --> 35:00.270]  They'll want to spill things.
[35:00.410 --> 35:00.770]  They want to...
[35:00.770 --> 35:04.170]  And it's the worst time ever to talk when you're scared.
[35:07.190 --> 35:10.930]  So, consider making statements that are recorded.
[35:11.190 --> 35:13.230]  This goes back to the good OPSEC rule.
[35:15.230 --> 35:17.570]  On IRC, you're being logged.
[35:17.870 --> 35:21.650]  Anyone else in that chat may be logging it.
[35:22.090 --> 35:24.310]  You know, your chat client may be logging it.
[35:24.830 --> 35:28.830]  That's leaving evidence behind that's going to get interpreted.
[35:29.010 --> 35:30.550]  So, consider what you're saying.
[35:30.550 --> 35:34.190]  And yes, the whole bit about surveillance causes self-censorship.
[35:34.370 --> 35:34.870]  Yes.
[35:35.050 --> 35:35.430]  Yes.
[35:35.670 --> 35:36.430]  Yes, it does.
[35:37.150 --> 35:38.130]  Accept that.
[35:40.970 --> 35:46.010]  Forums, Facebooks, Reddit, all those statements.
[35:47.510 --> 35:56.150]  After an arrest, prosecutors are going to go through everything you've done, anything you've said, and that's coming back at you.
[35:56.910 --> 36:05.670]  So, that annoying little argument you got in because someone was wrong on Reddit, is coming back at you.
[36:06.970 --> 36:12.550]  And I really don't ever be prosecuted for the stupid arguments I've gotten in on Reddit.
[36:12.550 --> 36:15.070]  So, but those are going to come in.
[36:15.610 --> 36:20.390]  And the idea like, oh, why are they doing this?
[36:20.470 --> 36:21.210]  That's intrusive.
[36:21.330 --> 36:22.270]  Like, yes.
[36:22.570 --> 36:30.230]  But they're looking for every statement you've made, and they're looking to use that to enhance their case as the prosecution.
[36:30.630 --> 36:33.850]  They're looking to find intent of malice.
[36:33.850 --> 36:37.370]  You aren't just an amusing little prankster.
[36:37.510 --> 36:40.790]  You're an evil bastard coming to take America away.
[36:42.650 --> 36:43.930]  And they're looking for that.
[36:44.050 --> 36:50.170]  So, all those dumb statements, you know, that dumb joke you cracked, imagine that in its worst interpretation.
[36:53.070 --> 36:54.110]  Jail conversations.
[36:54.770 --> 37:06.750]  The amount of, when I worked with the public defenders, the amount of people who did not remember five minutes into a phone call conversation, that there was a recording.
[37:07.050 --> 37:10.690]  And it's not just the recording, you know, yeah, yeah, the whole NSA recruiting, everything.
[37:10.930 --> 37:18.510]  No, there's recording, and then there's recording that we're actively going to listen to, to find stuff that you've admitted to.
[37:21.570 --> 37:30.410]  So, if you're arrested, or you're in jail, pending prosecution, do not say things like, I want you to dox the prosecutor.
[37:31.870 --> 37:34.390]  I want you to dox the judge.
[37:36.350 --> 37:38.810]  This is coming in against you.
[37:39.230 --> 37:40.330]  Sentence enhancement.
[37:40.970 --> 37:41.910]  Good job.
[37:42.230 --> 37:45.250]  You've just turned a four-year sentence into an eight-year sentence.
[37:46.590 --> 37:52.070]  So, this is the, you can't make things better, but you can always make them worse.
[37:52.230 --> 37:56.590]  You can always turn a bad situation into an ugly situation.
[38:00.990 --> 38:03.510]  Also, consider when there's an informant.
[38:04.230 --> 38:11.650]  And I'm thinking of a manual's observation a couple hopes ago, that one in five is an informant.
[38:12.370 --> 38:16.610]  And that still scares me, because I see more than five people in the room.
[38:19.470 --> 38:33.190]  And I don't know if this is true, but it seems to be, because every prosecution I've seen, there's a lot of information about very, very nitty-gritty things that aren't in all those other evidentiary forms I've talked about.
[38:33.350 --> 38:35.170]  Like, it's not a log on a PC.
[38:35.610 --> 38:38.170]  It's not a server log somewhere.
[38:38.310 --> 38:39.350]  It's not an IRC log.
[38:39.530 --> 38:42.150]  There's like intimate knowledge about what happened.
[38:42.310 --> 38:45.690]  And this is kind of the nature of breaking up any form of organized crime.
[38:45.690 --> 38:52.350]  You get one person, you get your hooks into them, and you get them to inform on everybody else.
[38:52.530 --> 38:54.230]  And maybe even you egg them on.
[38:55.850 --> 38:58.210]  You know, the Cebu's case.
[38:58.430 --> 39:01.770]  Like, clearly, he was not merely a passive informant.
[39:01.770 --> 39:02.830]  He was an active one.
[39:03.350 --> 39:05.110]  So, contemplate that.
[39:05.350 --> 39:09.170]  Contemplate that the person egging you on might have another interest.
[39:12.730 --> 39:13.690]  So, takeaways.
[39:15.570 --> 39:20.790]  If you can, beforehand, consider the legality of what you're about to do.
[39:21.430 --> 39:27.290]  Just like a, you know, a basic, and maybe this sounds a little too namby-pamby, but it's something you should think about.
[39:27.930 --> 39:29.850]  And the evidence you're leaving behind.
[39:31.470 --> 39:32.870]  Who will know about it?
[39:34.730 --> 39:38.330]  And that's like pre-incident planning.
[39:38.610 --> 39:47.730]  Post-incident planning is, if you get legal attention, you get the business card of an agent on your door.
[39:48.030 --> 39:54.110]  At this point, you're now in the, I can't make things better, but I can make them a lot worse.
[39:54.110 --> 40:10.150]  So, and I hate sounding like, you know, the bar association with the shut up and lawyer up, but the amount of people who have turned a matter of interest into being a defendant at this stage is too high.
[40:11.950 --> 40:15.130]  Yeah, I've watched smarter people than me fall into the trap.
[40:15.290 --> 40:20.770]  I've watched people say, like my favorite line is, they said I sent malicious code.
[40:20.770 --> 40:23.310]  I just did a sequel injection.
[40:25.090 --> 40:29.150]  Now for me, that makes me itch because that's an admission of a 10-30 crime.
[40:29.290 --> 40:29.590]  Right there.
[40:29.790 --> 40:29.910]  Boom.
[40:30.090 --> 40:30.390]  Yes.
[40:32.070 --> 40:40.090]  And my FBI friend has pointed out that they will send the biggest, dumbest looking agent to talk to a suspected hacker.
[40:40.250 --> 40:48.950]  And this is someone who's, as he says, I have to get him new band-aids every week because the old ones fall off because they're just dragging, his knuckles are dragging behind him.
[40:48.950 --> 40:51.270]  And the guy is actually fairly company.
[40:51.410 --> 41:00.470]  It's like the, as he says, the agent has, you know, extensive training, might not have a couple degrees in computer science, but is not a dumb guy.
[41:00.650 --> 41:03.210]  Like made a Roomba lawnmower.
[41:03.930 --> 41:04.350]  Okay.
[41:04.590 --> 41:11.150]  So, so clearly like someone who's on our wavelength, like I don't have a lawn, but I would love to have a lawn.
[41:11.150 --> 41:14.310]  You know, I would love to have like whirling blades of death that are autonomous.
[41:16.050 --> 41:21.530]  So, and they send him in and he does the best dumb act possible.
[41:21.670 --> 41:23.650]  I don't know shit about computers, man.
[41:24.070 --> 41:26.070]  So what, what happened here?
[41:26.070 --> 41:30.890]  And there's an innate reaction among us because who doesn't like an ego stroke?
[41:32.490 --> 41:36.430]  So there's a temptation to explain things.
[41:38.150 --> 41:46.950]  This is dumb when the explanation, when you think of this way, we've all done help desk, even if it's not been our job description, we've all helped people.
[41:47.110 --> 41:48.670]  We've all explained to people.
[41:48.830 --> 41:52.990]  And there are times when you do explain things to people and it's good for you.
[41:53.750 --> 41:57.450]  There are times you explain things to people and you talk about what you did.
[41:57.670 --> 42:02.990]  And what you're doing is you're going from person of interest to, will the defendant please rise?
[42:05.610 --> 42:07.350]  That's something to be worried about.
[42:08.330 --> 42:17.830]  So at that point, you're like, I need to have someone parse everything I'm going to say, just to make sure I do not walk myself into the trap.
[42:19.450 --> 42:19.970]  Okay.
[42:20.210 --> 42:20.690]  Questions.
[42:20.910 --> 42:22.190]  Ask him now or ask him later.
[42:27.330 --> 42:28.530]  There's, oh, no mic?
[42:33.850 --> 42:35.550]  I'm not messing with the AV system.
[42:35.690 --> 42:36.470]  So, Bello.
[42:41.590 --> 42:44.750]  Can you comment about the fact that...
[42:44.750 --> 42:46.370]  I was seeing, oh, there we go.
[42:46.850 --> 42:53.210]  I was seeing some numbers recently where it was, on average, computer crimes were 15 years, but rapists were getting five.
[42:53.690 --> 42:55.810]  And just the absurdity of that situation.
[42:57.550 --> 43:01.710]  Why are there more enhancements for the computer crimes than actual, like, physical harm?
[43:01.710 --> 43:08.810]  Actually, the observation I want to make, because the whole, like, rapists get less time than hackers...
[43:10.510 --> 43:12.570]  No, I'm not saying anything about legitimate rape.
[43:12.710 --> 43:13.690]  No, that's a stupid thing to say.
[43:14.010 --> 43:25.750]  The observation under the federal sentencing guidelines, you get more of an enhancement for causing damage to a bank than you do putting people at risk of death.
[43:27.550 --> 43:33.870]  I had the notes, and unfortunately, they're in... I don't... I didn't actually print... I didn't actually, like, write them down.
[43:34.030 --> 43:35.150]  They're sitting on my desk at home.
[43:35.270 --> 43:40.910]  But there is a belief that we are more dangerous than regular criminals.
[43:42.150 --> 43:46.250]  So, it's not what you did, it's what you could have done.
[43:46.790 --> 43:49.890]  That comes into a sentencing memo.
[43:50.710 --> 43:55.770]  And think of all the tools, those evil hacks or tools you have.
[43:56.350 --> 43:58.830]  Like, weird operating systems.
[43:59.610 --> 44:00.250]  Right?
[44:00.670 --> 44:02.750]  And I remember...
[44:02.750 --> 44:04.630]  one, like, they had Nmap.
[44:04.890 --> 44:07.470]  And I'm, like, looking at my... I'm looking at my... I'm like, really?
[44:08.350 --> 44:09.150]  And Metasploit.
[44:09.290 --> 44:10.350]  Like, oh, okay.
[44:11.450 --> 44:16.510]  And they had other operating systems, like... And I'm actually saying this to a U.S.
[44:16.570 --> 44:17.730]  attorney and just shooting this shit.
[44:17.790 --> 44:21.110]  Like, I have an OS2 VM on my... on my laptop.
[44:24.070 --> 44:24.470]  Why?
[44:24.470 --> 44:27.150]  Once, because I actually was using it for a test.
[44:27.390 --> 44:31.790]  And another time, just to mess with somebody, like, the help desk came up and I put that in full screen.
[44:32.250 --> 44:35.670]  And I'm watching the help desk guy going, what the hell am I looking at?
[44:36.150 --> 44:45.160]  Like... You know, are the... the great line I have about, you know, getting... trying to get tech support on Intuit.
[44:45.400 --> 44:46.460]  And it's like, what are you...
[44:46.460 --> 44:48.240]  you know, well, what operating system are you using?
[44:48.360 --> 44:49.220]  Like, Windows 7.
[44:49.560 --> 44:50.640]  Because it's, you know, VM.
[44:51.020 --> 44:51.680]  It's like, no, exactly.
[44:52.020 --> 44:58.980]  Like, it's a Windows 7 service pack 0 running in open box on a Ubuntu 1204 system.
[44:59.300 --> 45:01.420]  And he's like, I'll put it into Mac support.
[45:03.800 --> 45:05.240]  Yeah, but... but...
[45:06.520 --> 45:11.700]  all that sophisticated knowledge gets interpreted in really ugly, weird ways.
[45:11.920 --> 45:14.020]  He had many, many malicious tools.
[45:14.160 --> 45:16.020]  And I remember, like, one was like, he had Nmap.
[45:16.220 --> 45:18.160]  Like, Nmap is malicious?
[45:19.200 --> 45:21.800]  I can come up with a lot more malicious tools.
[45:21.960 --> 45:23.740]  And I was like, I shouldn't say that.
[45:23.920 --> 45:24.960]  Because it's...
[45:25.480 --> 45:33.680]  like, the... to kind of map this back into something more sane is, I remember doing a grand jury.
[45:34.120 --> 45:37.520]  And as a citizen, as a... you know, not as a lawyer, but just as a citizen.
[45:37.720 --> 45:39.980]  And they said, well, what evidence did they have that they were dealing drugs?
[45:40.120 --> 45:43.340]  And it was an O house, three beam scale, and three books on chemistry.
[45:43.640 --> 45:45.860]  I'm like, I have that in my house.
[45:47.320 --> 45:48.440]  I'm like, what are you doing?
[45:48.560 --> 45:53.420]  And I'm like, well, I need to accurately measure high... accurately measure brewing sugar.
[45:54.600 --> 45:55.000]  Really?
[45:55.280 --> 45:57.100]  I'm like, I'm not dealing drugs.
[45:57.520 --> 45:59.800]  And of course, it's really hard to... you know, my voice goes up.
[45:59.960 --> 46:01.720]  I'm like, I'm not... God damn it.
[46:02.280 --> 46:03.740]  Now I'm a person of interest.
[46:04.000 --> 46:04.720]  God damn it.
[46:05.040 --> 46:06.200]  You know, but think of all the tools.
[46:06.340 --> 46:07.260]  Because we love tools.
[46:07.680 --> 46:09.780]  And it's like, this is an incredibly dangerous tool.
[46:09.940 --> 46:10.960]  Like, that makes it better.
[46:11.480 --> 46:11.880]  Okay.
[46:12.120 --> 46:18.420]  So the takeaway is, if you want to get revenge on someone with a computer, you should beat them to death with it rather than using it electronically.
[46:18.700 --> 46:18.820]  Gotcha.
[46:25.450 --> 46:28.590]  I think that's... I think that's Lenovo's next ThinkPad commercial.
[46:30.890 --> 46:31.330]  Yeah.
[46:32.150 --> 46:34.750]  This... this is a silly... sort of a silly question.
[46:35.270 --> 46:48.890]  If you go back to the ugly days of the 90s, where things like strong encryption were considered armaments, has anyone ever tried using a Second Amendment defense for a computer crime?
[46:50.270 --> 46:51.110]  Kind of.
[46:51.510 --> 46:53.650]  The self-defense argument I talked about earlier.
[46:55.610 --> 47:00.430]  The problem is, is that the CFAA is... is broadly written with very few protections.
[47:00.910 --> 47:04.150]  So common law defenses, the... it's self-defense.
[47:04.470 --> 47:05.770]  I've heard it argued.
[47:05.910 --> 47:09.570]  There are like four law review articles and no one successfully raised it yet.
[47:09.870 --> 47:15.090]  So I might try to raise the Second Amendment one, but that's what we call desperate.
[47:15.830 --> 47:24.330]  I... there's... there's a line I have, and why mine... I try to do more nuts and bolts stuff, is... appellate cases.
[47:24.450 --> 47:28.690]  This is a case that gone to trial, didn't come out the way someone liked it, and then appealed.
[47:28.870 --> 47:30.230]  And that makes our law.
[47:30.770 --> 47:35.910]  And that's your name versus the United States, or your name versus the Commonwealth of Massachusetts, or whatever.
[47:36.430 --> 47:49.530]  The problem is that, yes, you're... you're historical, because you've made the law and you've changed it, but it meant that you spent way too much time hanging out with dickheads like me for weight... you know, like... talking about fine points of law that affect your life.
[47:49.850 --> 47:56.230]  I would like you to not have to make appellate... you know, make appellate history, and like, let you steer clear of that.
[47:56.510 --> 48:08.710]  So while it's an interesting argument to bring up the Second Amendment, that's both desperate, and it means that you've been charged, and all the good arguments didn't happen, because there's such damning evidence against you.
[48:08.850 --> 48:16.610]  It's like, I'm winging with this, you know, and that... and that... you'll get the curse from the judge, which is, counsel, you make an interesting argument.
[48:18.170 --> 48:24.790]  And we're good at giving really backhanded compliments, like, my learned colleague, which means, idiot.
[48:26.750 --> 48:35.530]  So that's an interesting argument means, I'm gonna... I'm gonna make you brief that, and I'm gonna make you write 40 pages about how much of an asshole you are.
[48:36.830 --> 48:42.290]  And I'll raise that, because that's like desperate, and I'll try to make something, but it means that I'm... it's like, dude, that's all I got?
[48:42.470 --> 48:43.250]  It's a loser.
[48:43.990 --> 48:44.430]  Yeah.
[48:45.190 --> 48:50.850]  Can you comment on the Supreme Court's responses to anything tech?
[48:50.970 --> 48:52.530]  My understanding is they're kind of idiots.
[48:57.190 --> 49:01.470]  I realize that judges have to... have to be generalists.
[49:02.570 --> 49:08.450]  A judge has to rule... you know, like, the Supreme Court has to rule on patent cases about technology they don't get.
[49:08.590 --> 49:15.210]  They also have to understand... they also have to rule on... you know, most judges have to rule on things they don't fully understand.
[49:15.370 --> 49:22.670]  And the point of the... the advocates on both sides is to educate them well enough that they can.
[49:23.670 --> 49:27.570]  There's like this idea, like, the way you go to senior management and talk about what you do.
[49:27.650 --> 49:37.550]  If you ever... if you're in a corporation, you have senior management that is, you know, generalists, and they're supposedly hyper bright people that can only... they can only consume PowerPoint.
[49:40.090 --> 49:41.270]  Um... and I've learned this.
[49:41.390 --> 49:45.310]  Like, you've done a 22 point... 22 slide deck that explains this.
[49:45.690 --> 49:47.450]  Boil it down into three bullet points.
[49:47.590 --> 49:52.050]  Like, um... it would suck to be sued because that'd be all expensive.
[49:52.470 --> 49:55.150]  Is that the level of detail you're looking for?
[49:55.350 --> 49:56.510]  Well, make it better.
[49:57.250 --> 49:59.290]  I... it's an... it's an art form.
[49:59.710 --> 50:01.770]  But... I'm not gonna say they're dumb.
[50:01.950 --> 50:05.130]  I'm gonna say that they're generalists who don't get it at the level we do.
[50:05.270 --> 50:08.470]  Our narrow... our knowledge is narrow and deep.
[50:09.250 --> 50:10.450]  Theirs is broad.
[50:12.330 --> 50:12.810]  Cool.
[50:13.510 --> 50:14.250]  Thanks much.
[50:14.430 --> 50:15.890]  I have cards if you need them.
[50:24.490 --> 50:25.650]  We'll do more heads up on them.
[50:25.670 --> 50:26.070]  Oh, good.
[50:26.070 --> 50:26.150]  That's cool.
[50:26.150 --> 50:26.350]  I'm out.
[50:26.370 --> 50:26.730]  That's cool.
[50:27.090 --> 50:27.210]  Yeah.