[00:00.000 --> 00:00.440] [SPEAKER_01]: Pledging.
[00:00.520 --> 00:02.080] [SPEAKER_01]: I want to go in and answer your phone call.
[00:02.180 --> 00:02.660] [SPEAKER_01]: But you know what?
[00:02.720 --> 00:05.020] [SPEAKER_01]: If the phone lines are busy, don't give up.
[00:05.180 --> 00:05.920] [SPEAKER_01]: Stay with us.
[00:06.040 --> 00:09.280] [SPEAKER_01]: I want to make a last call for this incredible material.
[00:09.480 --> 00:13.260] [SPEAKER_01]: This is Margaret Prescott, host of Sojourner Truth.
[00:13.700 --> 00:15.380] [SPEAKER_01]: Help me to get the truth around.
[00:15.580 --> 00:17.480] [SPEAKER_01]: Teach the truth to the youth.
[00:17.820 --> 00:19.200] [SPEAKER_01]: Thank you for calling and pledging.
[00:19.320 --> 00:23.720] [SPEAKER_01]: I need to raise another $1,500 in the next few minutes.
[00:23.900 --> 00:25.040] [SPEAKER_01]: So help us out here.
[00:25.200 --> 00:25.940] [SPEAKER_01]: Keep calling us.
[00:26.080 --> 00:28.020] [SPEAKER_01]: This is your host, Margaret Prescott.
[00:34.240 --> 00:39.540] [SPEAKER_00]: The number is 516-620-3602.
[00:39.980 --> 00:44.420] [SPEAKER_00]: 516-620-3602.
[00:44.540 --> 00:49.460] [SPEAKER_00]: Or go to give the number to wbai.org.
[00:53.780 --> 00:59.700] [SPEAKER_05]: And you are listening to radio station WBAI.
[00:59.700 --> 01:03.080] [SPEAKER_05]: That's 99.5 if you're listening on a radiophonic device.
[01:03.820 --> 01:05.800] [SPEAKER_05]: WBAI.org if you're listening on a live stream.
[01:06.720 --> 01:09.680] [SPEAKER_05]: And wherever you're listening, it's just about 8 p.m.
[01:10.760 --> 01:11.360] [SPEAKER_05]: Eastern Time.
[01:11.640 --> 01:13.420] [SPEAKER_05]: Time for Off The Hook.
[01:20.640 --> 01:22.580] [SPEAKER_06]: The telephone keeps ringing.
[01:22.900 --> 01:25.100] [SPEAKER_06]: So I ripped it off the wall.
[01:26.080 --> 01:28.100] [SPEAKER_06]: I cut myself while shaving.
[01:28.640 --> 01:30.620] [SPEAKER_06]: Now I can't make a call.
[01:31.440 --> 01:33.320] [SPEAKER_06]: We couldn't get much worse.
[01:36.440 --> 01:37.740] [SPEAKER_06]: Did it bump for the best?
[01:37.940 --> 01:38.900] [SPEAKER_06]: It's back the worst.
[01:39.480 --> 01:41.420] [SPEAKER_06]: I hope that's understood.
[01:41.620 --> 01:42.420] [SPEAKER_06]: But did it bump!
[03:05.350 --> 03:08.150] [SPEAKER_05]: And a very, very good evening to you.
[03:09.430 --> 03:11.190] [SPEAKER_05]: The program is Off The Hook.
[03:11.710 --> 03:12.290] [SPEAKER_05]: Rob T.
[03:12.410 --> 03:13.690] [SPEAKER_05]: Firefly here with you.
[03:13.990 --> 03:16.290] [SPEAKER_05]: And I'm joined in the studio by Alex.
[03:17.310 --> 03:17.750] [SPEAKER_05]: Howdy.
[03:18.510 --> 03:19.570] [SPEAKER_05]: And by Voltaire.
[03:20.050 --> 03:20.310] [SPEAKER_05]: Hey.
[03:21.570 --> 03:24.510] [SPEAKER_05]: And on the phone, we should have Emmanuel and Kyle.
[03:24.730 --> 03:25.110] [SPEAKER_05]: You guys there?
[03:25.930 --> 03:26.850] [SPEAKER_09]: On the phone, Rob.
[03:26.930 --> 03:28.470] [SPEAKER_09]: But we barely have you.
[03:28.670 --> 03:31.290] [SPEAKER_09]: If there's a little knob there, you can turn so we can hear you louder.
[03:31.350 --> 03:32.070] [SPEAKER_09]: That would be so great.
[03:32.990 --> 03:34.210] [SPEAKER_05]: Oh, let me try that.
[03:34.750 --> 03:37.930] [SPEAKER_05]: I turned the knob that says Emmanuel.
[03:38.110 --> 03:38.810] [SPEAKER_05]: Did that work?
[03:39.550 --> 03:40.330] [SPEAKER_09]: Yeah, a little better.
[03:40.350 --> 03:44.770] [SPEAKER_09]: But if you can have whatever knob is by your microphone up to the max, I think that's the best thing.
[03:46.330 --> 03:48.670] [SPEAKER_05]: I believe everything's in that position.
[03:48.910 --> 03:49.990] [SPEAKER_05]: So let's see how this...
[03:49.990 --> 03:51.930] [SPEAKER_09]: Well then, we'll just have to make do with that.
[03:52.350 --> 03:55.510] [SPEAKER_09]: And yes, Kyle and I are out on the West Coast, actually.
[03:55.610 --> 03:56.930] [SPEAKER_09]: That's why we're not in the studio with you.
[03:57.630 --> 04:00.870] [SPEAKER_09]: We are in Southern California, where the temperature is baking hot.
[04:01.650 --> 04:02.950] [SPEAKER_02]: Oh, no, no, E.
[04:03.090 --> 04:03.890] [SPEAKER_02]: I'm sorry.
[04:03.950 --> 04:04.690] [SPEAKER_02]: I have to correct you.
[04:04.790 --> 04:04.930] [SPEAKER_02]: What?
[04:06.110 --> 04:11.530] [SPEAKER_02]: This is the picturesque and scenic Pacific Northwest.
[04:11.790 --> 04:12.230] [SPEAKER_09]: Oh, wait a minute.
[04:12.270 --> 04:12.810] [SPEAKER_09]: Hold on a second.
[04:13.010 --> 04:14.170] [SPEAKER_09]: It's 95 degrees.
[04:14.350 --> 04:15.250] [SPEAKER_09]: It's smoggy.
[04:15.330 --> 04:16.570] [SPEAKER_09]: What do you mean it's the Pacific Northwest?
[04:16.570 --> 04:17.490] [SPEAKER_02]: No, no.
[04:17.710 --> 04:21.710] [SPEAKER_02]: It's... The forecast is actually calling for smoke today.
[04:22.010 --> 04:22.850] [SPEAKER_09]: Yeah, I saw that.
[04:22.970 --> 04:23.330] [SPEAKER_09]: I saw that.
[04:23.430 --> 04:25.270] [SPEAKER_09]: I thought that was what Los Angeles had.
[04:25.610 --> 04:28.770] [SPEAKER_09]: There was a guy running down the street saying it hasn't rained in 52 days, too.
[04:28.930 --> 04:31.730] [SPEAKER_02]: Well, they're saying that Seattle's the new L.A.
[04:32.110 --> 04:32.550] [SPEAKER_02]: Wow.
[04:32.850 --> 04:35.250] [SPEAKER_02]: In more ways than one.
[04:35.350 --> 04:38.050] [SPEAKER_02]: But yeah, that's true.
[04:38.110 --> 04:39.030] [SPEAKER_02]: We're in Washington State.
[04:39.030 --> 04:39.050] [SPEAKER_02]: Great.
[04:39.810 --> 04:40.150] [SPEAKER_09]: Okay.
[04:40.430 --> 04:41.650] [SPEAKER_09]: Well, this is news to me, folks.
[04:41.830 --> 04:43.150] [SPEAKER_09]: I thought I was somewhere else.
[04:43.290 --> 04:45.290] [SPEAKER_09]: But you guys are in New York.
[04:45.390 --> 04:46.090] [SPEAKER_09]: That's what's important.
[04:46.630 --> 04:49.870] [SPEAKER_09]: And we have all kinds of fun things to talk about tonight.
[04:50.090 --> 04:51.370] [SPEAKER_09]: Do we have our special guest on the phone?
[04:51.570 --> 04:52.010] [SPEAKER_05]: We do.
[04:52.230 --> 04:56.170] [SPEAKER_05]: We are also joined on the telephone by noted security researcher Sandy Clark.
[04:56.830 --> 04:57.230] [SPEAKER_09]: Hi.
[04:57.610 --> 04:58.030] [SPEAKER_09]: Can you hear me?
[04:58.030 --> 04:58.450] [SPEAKER_09]: Hey, Sandy.
[04:58.510 --> 04:58.930] [SPEAKER_09]: How are you doing?
[04:59.110 --> 05:00.890] [SPEAKER_09]: Sandy is at the University of Pennsylvania.
[05:01.130 --> 05:05.530] [SPEAKER_09]: She's, I believe, infosec research scientist, cybersecurity analyst.
[05:05.930 --> 05:07.270] [SPEAKER_09]: I'm sure many other things as well.
[05:08.610 --> 05:09.130] [SPEAKER_08]: Yeah.
[05:09.290 --> 05:10.130] [SPEAKER_08]: I'm also short.
[05:12.830 --> 05:14.190] [SPEAKER_09]: Well, it's interesting.
[05:15.630 --> 05:23.150] [SPEAKER_09]: We've been reading the story over the last couple of weeks about what happened at the recent hacker conference, DEFCON, with voter machines.
[05:23.270 --> 05:29.550] [SPEAKER_09]: I'm just going to read an excerpt from USA Today, where basically they said, hackers, five, voting machines, zero.
[05:29.870 --> 05:36.650] [SPEAKER_09]: It took less than a day for attendees at the DEFCON hacking conference to find and exploit vulnerabilities in five different voting machine types.
[05:36.650 --> 05:40.510] [SPEAKER_09]: The first ones were discovered within an hour and 30 minutes.
[05:40.990 --> 05:43.270] [SPEAKER_09]: None of these vulnerabilities have ever been found before.
[05:43.770 --> 05:44.570] [SPEAKER_09]: They're all new.
[05:44.690 --> 05:47.810] [SPEAKER_09]: Now, we all know USA Today can exaggerate and get the story wrong.
[05:48.510 --> 05:50.690] [SPEAKER_09]: So how accurate is that?
[05:51.270 --> 05:56.110] [SPEAKER_08]: Well, it's accurate that the first remote exploit was found within 90 minutes.
[05:56.110 --> 06:01.790] [SPEAKER_08]: There were a couple of others that were local that required access to the devices.
[06:02.650 --> 06:08.230] [SPEAKER_08]: They are similar to vulnerabilities that have been found before, but several of them were new.
[06:09.730 --> 06:10.350] [SPEAKER_08]: Wow.
[06:10.590 --> 06:13.450] [SPEAKER_08]: And every machine got popped multiple times.
[06:14.130 --> 06:17.350] [SPEAKER_09]: So there was no machine that did not get hacked?
[06:17.630 --> 06:24.510] [SPEAKER_08]: No machine that did not get hacked and no machine that did not find more than one vulnerability.
[06:25.070 --> 06:29.810] [SPEAKER_09]: So, can you give us an example of what a typical hack of one of these machines might have been?
[06:30.610 --> 06:38.070] [SPEAKER_08]: Well, these machines, by the way, the ones that we had, with the exception of one, which was a Windvolt that was running Windows 98.
[06:38.410 --> 06:45.830] [SPEAKER_08]: And that's the only machine of all the machines that has been excluded from future elections.
[06:45.830 --> 06:49.090] [SPEAKER_08]: But it was used in 2015 in Virginia.
[06:49.710 --> 06:52.610] [SPEAKER_08]: So that's how recent they've been using Windows 98.
[06:53.190 --> 07:00.090] [SPEAKER_08]: Every one of the devices had the absolute latest firmware and software upgrades that were available to them.
[07:00.570 --> 07:02.770] [SPEAKER_08]: But they are running Windows CE.
[07:02.770 --> 07:04.990] [SPEAKER_08]: They are running old versions of Linux.
[07:04.990 --> 07:12.010] [SPEAKER_08]: They were running a 2007 version of OpenSSL.
[07:13.060 --> 07:19.450] [SPEAKER_08]: And because this is proprietary software, proprietary firmware, this is the latest version that you can run.
[07:19.730 --> 07:29.930] [SPEAKER_08]: So basically, most of the vulnerabilities and the payloads that you have in your tool bag would probably work.
[07:31.530 --> 07:38.310] [SPEAKER_02]: What, across those platforms, what were the kinds of vulnerabilities typical of what people found?
[07:38.810 --> 07:40.350] [SPEAKER_08]: Hard-coded passwords.
[07:41.370 --> 07:46.750] [SPEAKER_08]: Open ports and able to get in to write whatever they wanted.
[07:46.750 --> 07:50.170] [SPEAKER_08]: They were able to download the firmware.
[07:50.650 --> 07:58.550] [SPEAKER_08]: They were able to upload whatever, including a group that rickrolled one of the devices.
[07:58.550 --> 08:03.030] [SPEAKER_08]: But you could basically put anything you wanted on custom.
[08:03.330 --> 08:10.090] [SPEAKER_08]: They also found that some of the machines contained old information, including the results of one election.
[08:10.530 --> 08:15.230] [SPEAKER_08]: The, with Obama winning, but McCain getting a lot of votes as well.
[08:15.550 --> 08:22.670] [SPEAKER_08]: And on one machine, and this was really quite disturbing because it's violation of federal law.
[08:22.670 --> 08:26.950] [SPEAKER_08]: We found the voter records of, I think, 650,000 voters.
[08:29.530 --> 08:33.130] [SPEAKER_08]: And so, yeah, so that was pretty scary.
[08:35.150 --> 08:36.910] [SPEAKER_04]: Hey, Sandy, can I ask you a question?
[08:37.370 --> 08:44.390] [SPEAKER_04]: You mentioned that a lot of these outdated operating systems were required because of firmware.
[08:44.650 --> 08:45.690] [SPEAKER_04]: Could you explain that to us?
[08:47.310 --> 08:49.210] [SPEAKER_08]: I'm sorry, required because of firmware?
[08:49.390 --> 08:56.730] [SPEAKER_04]: Yeah, I thought you mentioned something, that there was a contingency between firmware and outdated OSes like Microsoft XP or old versions of Linux running.
[08:57.290 --> 08:59.330] [SPEAKER_08]: No, I'm sorry, I must have missed.
[08:59.330 --> 09:16.190] [SPEAKER_08]: What I meant was that they were running proprietary firmware and proprietary software such that what we had on them was the latest, and we have no other way to upgrade them because it has to be given to us by the manufacturers.
[09:16.890 --> 09:17.510] [SPEAKER_04]: I see.
[09:17.590 --> 09:20.330] [SPEAKER_04]: So this outdated proprietary firmware...
[09:21.310 --> 09:22.410] [SPEAKER_08]: Here's the latest they offer.
[09:22.410 --> 09:23.150] [SPEAKER_04]: I see.
[09:23.390 --> 09:23.910] [SPEAKER_04]: Interesting.
[09:24.230 --> 09:32.370] [SPEAKER_04]: And this seems to dovetail a lot with some of the security problems that were the root cause of things like the WannaCry and WannaCrypt ransomware event.
[09:32.450 --> 09:33.030] [SPEAKER_04]: Would that be right?
[09:34.450 --> 09:35.390] [SPEAKER_08]: In a way.
[09:36.250 --> 09:46.110] [SPEAKER_08]: Some of the upgrades that would have prevented WannaCry could have been installed if the people had installed it.
[09:46.210 --> 09:51.670] [SPEAKER_08]: But there are other problems with medical, I'm thinking particularly of the hospitals that were brought down.
[09:52.490 --> 09:53.810] [SPEAKER_08]: So many of...
[09:53.810 --> 10:02.130] [SPEAKER_08]: Any time you've changed a device that has FDA certification, you have to jump through a lot of other hoops in order to get it recertified.
[10:02.430 --> 10:06.050] [SPEAKER_08]: So there's a lot of pushback against ever updating any of that.
[10:06.530 --> 10:08.010] [SPEAKER_08]: So it's a different problem.
[10:09.470 --> 10:24.090] [SPEAKER_09]: Sandy, I had a question concerning how you guys were able to acquire these voting machines in the first place, because we've been trying to do this for years, and it seems like this is exactly what we needed to do, was actually get our hands on these things and not be restricted.
[10:25.230 --> 10:27.210] [SPEAKER_08]: Well, where do you get anything, right?
[10:27.430 --> 10:27.750] [SPEAKER_08]: eBay.
[10:31.690 --> 10:32.430] [SPEAKER_05]: That's amazing.
[10:32.430 --> 10:35.230] [SPEAKER_05]: And they're running Windows 98 out of the box.
[10:35.230 --> 10:42.070] [SPEAKER_05]: Now, for those unfamiliar with Windows 98, it came out in 98, which was about 17 years ago now, or something to that effect.
[10:42.910 --> 10:44.270] [SPEAKER_05]: Oh, 19 years ago.
[10:44.410 --> 10:48.930] [SPEAKER_05]: Oh, so it's old enough to vote itself in some states.
[10:49.070 --> 10:49.950] [SPEAKER_05]: Maybe that's why it's there.
[10:50.130 --> 11:01.470] [SPEAKER_05]: But so we've seen this so often in just sort of the Internet of Things exploits and all sorts of things that come about where things aren't easy to upgrade, things are artificially limited.
[11:01.470 --> 11:11.310] [SPEAKER_05]: And so it's not just a matter of manufacturer responsibility of keeping these things upgraded and keeping the latest exploits, you know, quelled.
[11:12.130 --> 11:21.350] [SPEAKER_05]: But it's actually impossible for somebody to conduct good security practices with something as important as an electronic voting machine.
[11:21.990 --> 11:32.970] [SPEAKER_08]: And it's even worse than that, because when we think about the voting, we're thinking about the voting machines that a voter or a poll worker has access to maybe three days a year.
[11:33.130 --> 11:44.830] [SPEAKER_08]: But there are also back-end systems that the ballots are designed on, that the votes are tabulated on, and the final tally and results are kept, that the voter registration databases are on.
[11:44.830 --> 11:56.770] [SPEAKER_08]: And frequently, these also obsolete computers are running and connected to a network and available year-round.
[11:58.610 --> 12:01.050] [SPEAKER_04]: That's somewhat terrifying, I have to say.
[12:01.830 --> 12:20.110] [SPEAKER_04]: You know, one of the issues that keeps coming up here, in particular on this show, is in the wake of the 2016 election, there was an effort to try to have some sort of forensic analysis of voting machines in various districts, but that was stalled in federal court because of this chicken-and-the-egg problem,
[12:20.710 --> 12:26.150] [SPEAKER_04]: where a judge wouldn't necessarily order a forensic examination of a voting machine unless there was evidence of tampering.
[12:26.190 --> 12:29.590] [SPEAKER_04]: And how would you have evidence of tampering if you didn't have a forensic examination?
[12:29.990 --> 12:42.110] [SPEAKER_04]: So, Sandy, given what you've seen at DEFCON and given what you know, if a forensic examination was, in fact, ordered, how likely do you think it was that tampering would have been found?
[12:42.730 --> 12:46.370] [SPEAKER_08]: Well, I think that depends on the sophistication of the attacker, right?
[12:46.650 --> 13:01.530] [SPEAKER_08]: Because we know from our tamper evidence village at DEFCON that it's equally easy to get through all of the basic protections that would provide evidence of tampering, such as stickers over the ports.
[13:01.750 --> 13:07.370] [SPEAKER_08]: It just takes a little bit of alcohol and a syringe to remove that, and then the sticker still works, so you can replace it.
[13:07.570 --> 13:14.170] [SPEAKER_08]: And there's a number of other ways that you could do that, that you could remove stickers as well.
[13:14.590 --> 13:16.410] [SPEAKER_08]: Alcohol is just really convenient.
[13:18.610 --> 13:29.530] [SPEAKER_08]: If the attacker was sufficiently sophisticated, then any evidence that they had of tampering, they could also cover up or remove.
[13:30.650 --> 13:40.050] [SPEAKER_08]: For example, if they were going to change the votes in an election, if the election was close enough, they could just flip the votes.
[13:41.150 --> 14:04.110] [SPEAKER_08]: Because the paper trails are either not used, don't exist, or what is printed out on the printer is whatever the software tells it to print out, anyone who had malicious access to the device itself could change what was printed out on the printed receipt as well.
[14:04.670 --> 14:08.990] [SPEAKER_08]: And that would cover up any sort of evidence that they were there.
[14:10.170 --> 14:16.030] [SPEAKER_08]: If they had access to the back-end database systems, they could alter an election-free...
[14:19.950 --> 14:29.490] [SPEAKER_03]: Sandy, you mentioned that these machines are mostly proprietary, and there was recently an editorial by Shane Worsley in the New York Times saying...
[14:29.490 --> 14:31.010] [SPEAKER_05]: I have to cut you off there.
[14:31.210 --> 14:34.230] [SPEAKER_05]: Apparently, we accidentally lost Sandy, so I'll try and get her back.
[14:34.390 --> 14:38.570] [SPEAKER_05]: But in the meantime, Emmanuel and Kyle, why don't you tell us a little bit about your travels?
[14:38.850 --> 14:43.890] [SPEAKER_09]: Well, I kind of want to bore the listeners with our travels, especially that I don't know what state I'm in.
[14:44.050 --> 14:48.390] [SPEAKER_09]: But I do have a letter from one of our listeners on this subject that I think is kind of appropriate.
[14:48.390 --> 14:52.910] [SPEAKER_09]: So while we're trying to reach Sandy again, let's hear from Bob in Minneapolis.
[14:52.910 --> 15:03.030] [SPEAKER_09]: Her writes, While I agree there is a disturbing trend in using insecure technologies in elections in the USA as well as worldwide, there has always been fraud with elections.
[15:03.030 --> 15:05.910] [SPEAKER_09]: One could argue that paper ballots are technology as well.
[15:06.350 --> 15:14.350] [SPEAKER_09]: Paper is one of the most important technological advancements ever, and without paper, we would not have 2,600, along with many other things.
[15:14.730 --> 15:17.030] [SPEAKER_09]: There was plenty of fraud in the paper ballot days.
[15:17.030 --> 15:22.330] [SPEAKER_09]: The problem is only partially related to technology and related more to people and process.
[15:22.670 --> 15:32.190] [SPEAKER_09]: Rob briefly mentioned process and paper ballots, but in the era of paper ballots, there was still fraud because of people, through bribes, breaking and entering to tamper with ballots, etc.
[15:32.190 --> 15:43.650] [SPEAKER_09]: I fully admit that the problem is complex and an important one, as our representative of democracy relies on it, but I believe that technology, when implemented correctly, can be an essential part of the solution.
[15:44.070 --> 15:47.050] [SPEAKER_09]: Thanks, Bob in Minneapolis, for that opinion.
[15:47.290 --> 16:02.470] [SPEAKER_09]: And I have to say, you know, technology, most definitely, and we see this all the time, we see this as kind of a theme of our program week after week, yes, it can be the essential part of the solution when implemented correctly.
[16:02.470 --> 16:16.570] [SPEAKER_09]: And we see constantly, it's not being implemented correctly, there are mistakes being made left and right, and when it's implemented incorrectly, it can cause devastating confusion, compromising of a sort that was never possible before.
[16:17.230 --> 16:28.630] [SPEAKER_09]: It really, it depends on how competent the people are who install this, what their true motivations are, how the software is written in the first place.
[16:29.250 --> 16:32.730] [SPEAKER_09]: So yeah, there's great potential for good and for evil.
[16:32.850 --> 16:34.530] [SPEAKER_09]: And with that, I hope we have Sandy back.
[16:34.890 --> 16:35.190] [SPEAKER_05]: Absolutely.
[16:35.310 --> 16:35.770] [SPEAKER_05]: I'm back.
[16:36.050 --> 16:36.830] [SPEAKER_05]: Welcome back, Sandy.
[16:37.230 --> 16:43.590] [SPEAKER_09]: Sandy, I was just reading a letter from a listener who was talking about fraud that existed back in the paper ballot days.
[16:44.030 --> 16:47.290] [SPEAKER_09]: And I imagine that is a concern as well.
[16:47.490 --> 16:58.650] [SPEAKER_09]: Of course, back then, the most fraud you could really accomplish, would be limited to one particular machine or as many people as you could threaten with bodily harm or whatever.
[16:59.850 --> 17:10.910] [SPEAKER_09]: Whereas today, with the kinds of compromising we're seeing electronically, and tell me if this is an exaggeration, entire elections could be swayed, could be manipulated.
[17:11.650 --> 17:15.210] [SPEAKER_08]: Oh, no, I think you're absolutely right because it's a matter of scale, right?
[17:15.210 --> 17:22.810] [SPEAKER_08]: And a paper ballot attack, while there are ways to even counterfeit ballots, we found one when we did our analysis,
[17:26.370 --> 17:28.450] [SPEAKER_08]: it really doesn't scale.
[17:29.150 --> 17:40.190] [SPEAKER_08]: And the way to use the technology that we have to help us at least to do our elections now would be to use paper ballots with optical scanners.
[17:40.610 --> 17:51.830] [SPEAKER_08]: Because then, even though it's possible to compromise optical scanners just as much as you can compromise any other computing device, you can always go back to the paper ballots if you need to do a recount.
[17:53.490 --> 17:54.010] [SPEAKER_03]: Walter?
[17:54.250 --> 18:02.530] [SPEAKER_03]: Wouldn't one of the problems with optical scanners be that it only triggers a recount where they look at the paper ballots if there's a close enough margin of error?
[18:03.190 --> 18:11.230] [SPEAKER_03]: So, basically, anybody that's hacked the machines can make it so that there's a wide enough margin that it doesn't trigger a recount.
[18:11.870 --> 18:17.550] [SPEAKER_08]: And I think that candidates, if they question an election, can also pay for a recount.
[18:19.570 --> 18:28.450] [SPEAKER_08]: Recounts are triggered if an election is really close, if they think that there's a problem, or if a candidate wants to pay for it.
[18:29.450 --> 18:34.190] [SPEAKER_02]: Yeah, I think that's the difference between, like, an automatic recount, maybe, and then when it is contested.
[18:34.390 --> 18:38.430] [SPEAKER_09]: To me, that's a human problem more than it is a computer problem.
[18:38.610 --> 18:41.890] [SPEAKER_09]: We're saying that it's triggered by a particular percentage.
[18:41.890 --> 18:46.390] [SPEAKER_09]: But we could change those rules, and we could make it so that every election gets counted twice.
[18:46.530 --> 18:47.210] [SPEAKER_09]: Why not?
[18:48.310 --> 18:49.350] [SPEAKER_09]: Computers can do these things.
[18:49.350 --> 18:52.370] [SPEAKER_09]: We count them twice, and the numbers should be exactly the same.
[18:52.450 --> 18:55.830] [SPEAKER_09]: If they're not, then maybe best two out of three or something.
[18:56.430 --> 19:08.770] [SPEAKER_08]: But if you're using a purely digital device, device, and you're not using a paper ballot being counted by a digital device, then the purely digital device will just report the same number twice anyway, and how do you tell?
[19:09.470 --> 19:10.210] [SPEAKER_09]: That's true.
[19:10.970 --> 19:15.830] [SPEAKER_04]: Well, the way around that would be to have a manual recount of the actual paper ballots.
[19:16.510 --> 19:16.710] [SPEAKER_04]: Right.
[19:16.910 --> 19:19.050] [SPEAKER_08]: So we have to have a paper ballot.
[19:19.370 --> 19:33.610] [SPEAKER_04]: Yeah, and this whole idea that we have electronic voting machines in so many districts that are critical districts, and without any paper ballot associated whatsoever just strikes me as completely nuts these days.
[19:33.810 --> 19:49.190] [SPEAKER_04]: Knowing what we know about voting systems, knowing what we know about the certification process, and their susceptibility to compromise, the fact that we have these electronic voting machines with no paper records, to me, and this was an argument that was made in some of the complaints filed by Jill Stein,
[19:49.410 --> 20:00.930] [SPEAKER_04]: almost seems like an equal protection under the law or equal rights violation to those voters in those particular districts because they're at a higher risk of having their right to the franchise completely compromised.
[20:04.200 --> 20:08.060] [SPEAKER_08]: Well, you have to understand, too, how this came about.
[20:08.240 --> 20:27.460] [SPEAKER_08]: It was rushed very, very fast after the 2000 election because of all the problems with the chads, the hanging chads, and the dimple chads, and the whatever, and supposedly they were unable to count the votes in Florida because of how bad the ballots were.
[20:28.040 --> 20:32.100] [SPEAKER_08]: And so the government funded this, which meant...
[20:32.100 --> 20:40.920] [SPEAKER_08]: and the government rarely gives a funded mandate where they will pay for states to buy a whole bunch of stuff.
[20:41.600 --> 20:49.560] [SPEAKER_08]: And in this case, they had to buy electronic voting machines, and if they didn't use the money by a certain period of time, the money would be taken away from them.
[20:50.360 --> 21:01.880] [SPEAKER_08]: At the same time, we had the American with disabilities lobbying for these because a device that can...
[21:02.500 --> 21:15.640] [SPEAKER_08]: you can plug a headphone into and it can tell you what the various candidates are and where they're located allows people with visual problems to be able to vote in secret.
[21:15.860 --> 21:18.860] [SPEAKER_08]: They don't have to bring a friend with them to read the ballot or something like that.
[21:20.340 --> 21:31.760] [SPEAKER_08]: And so both lobbyists for the electronic machines and lobbyists for the Americans with disabilities really pushed this movement forward and it happened very, very fast.
[21:32.680 --> 21:39.060] [SPEAKER_08]: And so no one even had a chance to develop a secure machine.
[21:39.840 --> 21:47.940] [SPEAKER_08]: and most of the voting machines were developed and sold by people who make ATMs like Diebold.
[21:50.480 --> 21:52.660] [SPEAKER_08]: And they have completely other problems.
[21:52.860 --> 21:59.540] [SPEAKER_08]: I mean, they were able to claim, you know, well, we can keep your money safe, so like, you know, of course, we can keep your voting safe, but it's not the same problem at all.
[22:00.240 --> 22:01.340] [SPEAKER_08]: You can't have...
[22:01.340 --> 22:11.180] [SPEAKER_02]: Operationally, yeah, the entirety of the workflows is, it's a different mentality as far as securing it and the trust inherent in that.
[22:11.660 --> 22:13.300] [SPEAKER_08]: And who has access to it?
[22:13.660 --> 22:16.520] [SPEAKER_02]: Yeah, the chain of custody and so on.
[22:17.240 --> 22:17.720] [SPEAKER_08]: Exactly.
[22:18.420 --> 22:21.580] [SPEAKER_08]: Most of the voting machines sit in a closet or in a warehouse.
[22:23.420 --> 22:35.200] [SPEAKER_03]: I think the thing with like ATMs is you have a different threat model than voting machines, like where ATMs would be battling petty criminals, whereas voting machines you have to face down nation-states, which is a lot harder.
[22:36.160 --> 22:40.880] [SPEAKER_09]: On that subject, there's actually a story that just came out on the Washington Post.
[22:41.480 --> 22:49.800] [SPEAKER_09]: Kenyan President Uhura Kenyatta took what appeared to be an unassailable lead today in his bid for re-election, even as his opponent called the results fraudulent.
[22:50.520 --> 22:52.560] [SPEAKER_09]: 93% of the votes have been counted.
[22:52.720 --> 22:59.280] [SPEAKER_09]: Kenyatta leads with about 54%, far ahead of opposition leader Rayla Odinga at about 45%.
[22:59.280 --> 23:08.100] [SPEAKER_09]: Odinga is calling the result of yesterday's election a complete fraud, outlining an elaborate hacking scheme that he said significantly manipulated the outcome.
[23:08.480 --> 23:19.100] [SPEAKER_09]: According to Odinga, a hacker used the login information of a top election official, Chris Zondo, who was mysteriously killed last month to enter the country's electoral database.
[23:19.640 --> 23:31.800] [SPEAKER_09]: You know, it just seems, Sandy, that with every election that's happening from this point on, there is going to be some kind of accusation of the whole process being hacked.
[23:32.600 --> 23:35.080] [SPEAKER_09]: How on earth do we ever recover from this?
[23:36.360 --> 23:43.440] [SPEAKER_08]: That is the question that we're all wondering about right now, and I don't have an easy answer for you.
[23:44.060 --> 23:50.360] [SPEAKER_08]: I think the only way to do this is to use paper ballots and scan them optically.
[23:50.940 --> 23:57.300] [SPEAKER_08]: At least that would give the results quick enough to satisfy the news sources and things like that.
[23:57.540 --> 24:02.380] [SPEAKER_08]: But there's no other way that we can have any guarantees.
[24:02.760 --> 24:03.900] [SPEAKER_09]: Is that done?
[24:04.320 --> 24:10.260] [SPEAKER_09]: I know Canada has a very simple system where basically people just mark things on a piece of paper and they get counted.
[24:10.880 --> 24:13.100] [SPEAKER_09]: Is that the kind of model you're looking at?
[24:13.520 --> 24:15.600] [SPEAKER_08]: That's exactly the model I'm looking at.
[24:16.720 --> 24:20.120] [SPEAKER_08]: But we have the world's most complicated ballots, right?
[24:20.600 --> 24:29.380] [SPEAKER_08]: They're 13 pages long and they're full of all of these other little things because you'll vote for a president of the United States and your dog catcher in the same election.
[24:30.480 --> 24:34.480] [SPEAKER_08]: And the complexity makes things so much worse.
[24:34.900 --> 24:44.560] [SPEAKER_08]: But the only way that we can have any sort of confidence in the results of our election is if we have paper ballots that we can go back to.
[24:46.080 --> 24:50.900] [SPEAKER_08]: Anything that's not entirely digital, I don't think anyone's going to trust anymore.
[24:52.880 --> 24:53.280] [SPEAKER_05]: Absolutely.
[24:54.000 --> 25:02.920] [SPEAKER_05]: So, Sandy, you were at the DEFCON conference, which recently happened in Las Vegas, and you and some other folks had a whole voting village set up there.
[25:03.080 --> 25:04.800] [SPEAKER_05]: Can you tell us a little bit about how that came about?
[25:06.200 --> 25:07.320] [SPEAKER_08]: It was fantastic.
[25:09.620 --> 25:15.220] [SPEAKER_08]: It took us a while to find a number of machines and we weren't sure what we were going to get.
[25:16.600 --> 25:22.120] [SPEAKER_08]: So, when we were setting everything up, we were very unsure whether anyone would find it interesting at all.
[25:22.380 --> 25:27.640] [SPEAKER_08]: We thought people would come and look around and say, oh, voting machines, meh, and go back and do something fun like car hacking.
[25:29.140 --> 25:33.660] [SPEAKER_08]: And instead, we couldn't even set up a full election.
[25:33.840 --> 25:37.920] [SPEAKER_08]: We didn't have the equipment that you would design a ballot on.
[25:38.000 --> 25:39.420] [SPEAKER_08]: We didn't have any of the tallying.
[25:39.580 --> 25:47.720] [SPEAKER_08]: We didn't even have some of the things that we needed to actually erase and reset a machine from scratch.
[25:48.480 --> 25:54.440] [SPEAKER_08]: We just had these boxes that were picked up off of eBay and from a couple of other auctions.
[25:56.560 --> 26:00.180] [SPEAKER_08]: And set them up, got everything up and running the best we could.
[26:00.880 --> 26:08.320] [SPEAKER_08]: And then people just came and went to work, and it was just the reason I love the hacker community.
[26:08.540 --> 26:09.900] [SPEAKER_08]: It was just phenomenal.
[26:12.880 --> 26:21.440] [SPEAKER_08]: And we had people coming in all hours and staying for a while and coming back with, oh, I think I've got another idea.
[26:22.100 --> 26:25.820] [SPEAKER_08]: So I wish I could have been there because it was just great.
[26:27.120 --> 26:29.280] [SPEAKER_09]: Well, this certainly won't be the last time this happens.
[26:29.480 --> 26:34.560] [SPEAKER_09]: In fact, we hope that you're at the Circle of Hope next July helping us to do something similar.
[26:35.380 --> 26:44.600] [SPEAKER_09]: But I'm curious, though, has anyone in the voting machine industry or even politicians reacted in any way to what you guys did?
[26:45.400 --> 26:46.600] [SPEAKER_08]: Oh, didn't you know?
[26:46.860 --> 26:51.520] [SPEAKER_08]: We had two congressmen come and visit during DEFCON.
[26:51.520 --> 26:52.280] [SPEAKER_08]: Oh, my.
[26:52.400 --> 26:54.880] [SPEAKER_08]: And they actually did a podcast.
[26:56.820 --> 26:59.040] [SPEAKER_08]: Also, I'm sorry, I've forgotten their names.
[26:59.740 --> 27:02.100] [SPEAKER_08]: But one was a Democrat and one was a Republican.
[27:02.660 --> 27:05.900] [SPEAKER_08]: But they were both absolutely united in the need to fix voting.
[27:07.680 --> 27:11.180] [SPEAKER_08]: And they were actually very pleased with what they saw.
[27:11.320 --> 27:13.280] [SPEAKER_08]: And then they came and spoke to everybody.
[27:15.320 --> 27:24.220] [SPEAKER_08]: So I was surprised and really pleased at the positive response we got from our representatives.
[27:25.780 --> 27:30.560] [SPEAKER_08]: As for the vendors, you get the response you always get from vendors, right?
[27:31.020 --> 27:31.540] [SPEAKER_09]: Yes.
[27:31.800 --> 27:37.980] [SPEAKER_09]: In fact, a few years ago, we had gone to a demonstration uptown of new voting machines.
[27:37.980 --> 27:43.900] [SPEAKER_09]: And we asked the vendors, hey, do you want a bunch of hackers to look at your machines and tell you how to how secure they are?
[27:44.040 --> 27:45.000] [SPEAKER_09]: They never got back to us.
[27:45.680 --> 27:58.500] [SPEAKER_09]: What I would like to see in the future, I'd like to see those new machines, the ones that are being implemented throughout the country, have them give those to us, let us test those, and report back.
[27:58.500 --> 28:01.380] [SPEAKER_09]: If they are secure, they should have nothing to be afraid of.
[28:02.740 --> 28:03.220] [SPEAKER_08]: Precisely.
[28:04.360 --> 28:15.260] [SPEAKER_08]: When we did our study back in 2007, we were one of a very small group of people that had the luxury, the good fortune to be able to get our hands on these machines.
[28:15.440 --> 28:24.380] [SPEAKER_08]: And even then, the vendors fought for quite a while to try and control what we would be allowed to tell the public.
[28:25.140 --> 28:31.540] [SPEAKER_08]: They wanted a final say on what they could remove from our report.
[28:31.760 --> 28:44.440] [SPEAKER_08]: And we didn't agree to actually sign the NDAs and look at anything until we had control over everything that we could say.
[28:44.680 --> 28:52.860] [SPEAKER_08]: So our compromise was that we would keep the actual proof of concepts in a private appendix, but that the public would learn of every single vulnerability we found.
[28:55.160 --> 28:57.100] [SPEAKER_08]: And we were the second group.
[28:57.220 --> 28:57.900] [SPEAKER_08]: There was another group.
[28:58.160 --> 29:03.100] [SPEAKER_08]: I was part of the Ohio-Everest study that was led by the Secretary of State of Ohio at the time.
[29:03.740 --> 29:05.020] [SPEAKER_08]: Jennifer Burner, her name was.
[29:05.200 --> 29:09.640] [SPEAKER_08]: And there was a previous study that had been done in California, the California top-to-bottom state.
[29:09.740 --> 29:15.660] [SPEAKER_08]: And those were pretty much the only two studies that had been done on machines that are used in the U.S.
[29:18.100 --> 29:24.960] [SPEAKER_08]: So maybe 30 people had had a chance to look at these machines.
[29:25.620 --> 29:30.800] [SPEAKER_08]: And because of DEFCON, now thousands of people have had a look at these machines.
[29:32.300 --> 29:43.440] [SPEAKER_08]: Every voting machine needs to have thousands, tens of thousands, hundreds of thousands of people who understand security getting a chance to pour over them.
[29:43.640 --> 29:48.040] [SPEAKER_08]: They should be all open-source hardware, open-source firmware, and open-source software.
[29:48.780 --> 29:52.100] [SPEAKER_02]: What kinds of criteria did you guys have for hacking?
[29:52.280 --> 29:54.240] [SPEAKER_02]: Was it basically anything goes?
[29:54.560 --> 30:07.360] [SPEAKER_02]: I mean, were people bringing in, you know, bandsaws and heavy equipment or did you see anything that maybe made you have a pause that maybe it might be a bit much?
[30:09.380 --> 30:17.100] [SPEAKER_08]: We only asked that they keep one of each device whole so that anyone who came after them would have a chance to try something.
[30:17.320 --> 30:20.800] [SPEAKER_08]: But at least one of everything got taken apart at some point.
[30:21.440 --> 30:24.840] [SPEAKER_08]: Nobody actually brought in a spectrum analyzer or an arc welding land.
[30:26.380 --> 30:28.040] [SPEAKER_08]: So, maybe next time.
[30:29.220 --> 30:29.760] [SPEAKER_09]: Wow.
[30:30.240 --> 30:49.980] [SPEAKER_09]: Sandy, what you've done, I think, what you guys all have done is a tremendous service to the entire public, not only in this country but worldwide, because these are exactly the things that we need to know, and it's that hacker ideology of opening it up and full disclosure that is the honest truth,
[30:50.280 --> 30:54.340] [SPEAKER_09]: and you have to wonder about anyone who doesn't want that to be known.
[30:54.460 --> 31:01.660] [SPEAKER_09]: So, I think what you guys did as far as revealing all of that and trying to get as much information as possible really did a lot of good.
[31:02.300 --> 31:04.780] [SPEAKER_08]: Well, but it wasn't us, it was the whole hacker community, right?
[31:04.880 --> 31:08.120] [SPEAKER_08]: It was everyone who showed up and stayed to mess with something.
[31:11.240 --> 31:13.120] [SPEAKER_08]: That's the only way we're going to be secure.
[31:14.100 --> 31:19.860] [SPEAKER_09]: Is there any site you would recommend where people can remain updated on this?
[31:20.580 --> 31:50.600] [SPEAKER_08]: I would go to EFF, and they pretty much, and I think ACLU, and probably the Center for Democracy and Technology, CBT, are good sites that always have the latest information of what's going on, and many of the people who had a chance to work on both the California and the Ohio studies publish or tweet with those hashtags.
[31:51.300 --> 31:55.740] [SPEAKER_08]: So if you're watching or following any of that, you'll hear whatever's latest going on there.
[31:57.880 --> 31:58.280] [SPEAKER_05]: Excellent.
[31:58.520 --> 32:02.000] [SPEAKER_05]: And, Sandy, where can folks who are interested find more of your work online?
[32:03.080 --> 32:09.480] [SPEAKER_08]: Most of my work is on my site at UPenn, that's center at C's.
[32:09.820 --> 32:10.880] [SPEAKER_08]: I'll send it to you.
[32:11.980 --> 32:12.380] [SPEAKER_05]: Okay.
[32:12.380 --> 32:17.040] [SPEAKER_05]: So if they go to UPenn.edu and search for Sandy Clark, would they find it?
[32:17.060 --> 32:20.200] [SPEAKER_08]: And I tweet as S-A-3-N-D-E-R.
[32:21.620 --> 32:22.020] [SPEAKER_05]: Excellent.
[32:22.820 --> 32:25.920] [SPEAKER_05]: Well, Sandy, we'll let you get back to your life, but thank you so much for joining us.
[32:26.460 --> 32:27.620] [SPEAKER_08]: Well, thank you for asking me.
[32:28.420 --> 32:28.700] [SPEAKER_05]: Absolutely.
[32:29.800 --> 32:30.160] [SPEAKER_08]: Cheers.
[32:31.620 --> 32:32.020] [SPEAKER_09]: Good night.
[32:32.400 --> 32:32.760] [SPEAKER_09]: Bye.
[32:34.640 --> 32:35.000] [SPEAKER_05]: Okay.
[32:35.780 --> 32:37.320] [SPEAKER_05]: That was really cool.
[32:39.520 --> 32:46.500] [SPEAKER_05]: So, Emmanuel and Kyle, I don't know if you guys want to hang out as well or get back to what you're doing over on the left coast, but...
[32:46.500 --> 32:51.840] [SPEAKER_09]: Well, seeing as how I'm not in the state I thought I was in, I need to do some adjusting.
[32:52.420 --> 33:04.420] [SPEAKER_09]: But I know you guys have a lot to talk about with some other fallout from that conference and the hacker world, as well as I understand you need to be raising some funds for this.
[33:04.600 --> 33:08.300] [SPEAKER_09]: What we're now told is really the final week of the summer fundraiser.
[33:09.040 --> 33:19.680] [SPEAKER_09]: So I think it would be best if we send it back to the studio for that and encourage people to write to us, oth@2600.com, with any feedback or questions or things like that.
[33:20.080 --> 33:22.480] [SPEAKER_09]: And we'll join you again next week.
[33:22.500 --> 33:23.640] [SPEAKER_09]: We don't know where we're going to be.
[33:24.880 --> 33:25.920] [SPEAKER_09]: wherever that happens to be.
[33:26.780 --> 33:31.020] [SPEAKER_05]: Okay, well, Emmanuel and Kyle, good luck with your travels over the next week.
[33:31.200 --> 33:33.360] [SPEAKER_05]: Thank you very much for joining us tonight.
[33:34.420 --> 33:35.060] [SPEAKER_02]: Thank you.
[33:35.380 --> 33:35.620] [SPEAKER_02]: Good night.
[33:40.040 --> 33:40.480] [SPEAKER_05]: Okay.
[33:42.820 --> 33:46.460] [SPEAKER_05]: Well, after all that, we do have to raise a little fund.
[33:47.560 --> 33:49.200] [SPEAKER_05]: So, we're going to go through this quickly.
[33:49.260 --> 33:59.180] [SPEAKER_05]: We know we've heard from some listeners out there who kind of kind of get kind of get a bit fed up with all the fundraising we have to do.
[33:59.480 --> 34:04.180] [SPEAKER_05]: But the fact is, we have to do it because it's the only thing that keeps these lights on in here.
[34:04.400 --> 34:10.080] [SPEAKER_05]: It's the only thing that keeps these radio waves coming to you from the top of the expensive state, the Empire State Building.
[34:11.340 --> 34:16.080] [SPEAKER_05]: And it's the only way that we can keep doing what we do here at Off The Hook and here at WBAI.
[34:16.080 --> 34:27.120] [SPEAKER_05]: So, I will give you the pledge line, which is 516-620-3602, or the website, which is give2wbai.org.
[34:27.800 --> 34:33.660] [SPEAKER_05]: And we have a few things that we're offering in return for your support this week.
[34:33.940 --> 34:39.640] [SPEAKER_05]: We have a few left of the historic data storage painting by...
[34:39.640 --> 34:40.980] [SPEAKER_05]: I can't read this name here.
[34:41.060 --> 34:41.760] [SPEAKER_05]: Oh, it's me.
[34:42.240 --> 34:43.640] [SPEAKER_05]: Rob Vincent, a.k.a. Rob T. Firefly of WBAIs Off The Hook.
[34:45.660 --> 34:49.960] [SPEAKER_05]: I am, as you may know, an artist in my other life.
[34:50.140 --> 35:13.020] [SPEAKER_05]: And as part of my art pursuits, I am doing a set of paintings, acrylic paint on canvas, 5x7 inches, of historical data storage paintings, historical data storage devices from all over technologies, history, from all over human history, basically various ways and means that people have stored data.
[35:13.640 --> 35:17.660] [SPEAKER_05]: And there's some stuff from the computer age, there's some stuff from the pre-computer age.
[35:17.780 --> 35:18.700] [SPEAKER_05]: It's going to be interesting.
[35:19.020 --> 35:22.940] [SPEAKER_05]: I'm going to be live streaming the painting of some more of these.
[35:23.060 --> 35:24.640] [SPEAKER_05]: I did that with one of them and it went over well.
[35:24.880 --> 35:30.080] [SPEAKER_05]: So keep an eye on our Twitter at Hacker Radio Show for word on when that happens again.
[35:31.000 --> 35:38.980] [SPEAKER_05]: But for a contribution of $50 or more, you can get one of these historic data storage paintings.
[35:40.540 --> 35:43.640] [SPEAKER_05]: And there's a very limited amount left, just a few left.
[35:43.900 --> 35:47.520] [SPEAKER_05]: And after that, the set will be complete and locked and loaded.
[35:47.820 --> 35:52.100] [SPEAKER_05]: And I've already got a great deal to paint and just a few more left.
[35:52.480 --> 35:57.920] [SPEAKER_05]: And yeah, so we've totally appreciated all your support over the last few weeks.
[35:58.260 --> 36:02.980] [SPEAKER_05]: And the response to this has been pretty mind blowing for me personally and for us here.
[36:04.320 --> 36:11.820] [SPEAKER_05]: So yeah, I won't go over this too much because we also have some other stuff.
[36:12.320 --> 36:15.920] [SPEAKER_05]: We have some things from the Hope Conference.
[36:15.940 --> 36:18.960] [SPEAKER_05]: We've been talking about conferences and the things that happen at them.
[36:19.120 --> 36:31.000] [SPEAKER_05]: And we have, once again, a series of flash drives or with video files or DVDs, your choice of the Hope Conference keynote addresses.
[36:32.320 --> 36:39.840] [SPEAKER_05]: As well as some other popular featured talks from all 11, from all 11 of the Hackers on Planet Earth conferences that have happened.
[36:40.420 --> 36:48.240] [SPEAKER_05]: People like Edward Snowden, Steve Wozniak, Corey Doctorow, Kevin Mitnick, Jello Biafra, cartoonist Aaron Magruder, who else?
[36:48.900 --> 36:50.180] [SPEAKER_05]: I've said Richard Stallman.
[36:50.300 --> 36:51.340] [SPEAKER_05]: I have not said Richard Stallman.
[36:51.420 --> 36:52.320] [SPEAKER_05]: Richard Stallman, you guys.
[36:52.440 --> 36:52.740] [SPEAKER_04]: That's right.
[36:52.860 --> 36:55.620] [SPEAKER_04]: And remember a long time ago, Siva Vadianathan.
[36:56.100 --> 36:56.500] [SPEAKER_04]: Yes.
[36:56.500 --> 36:58.900] [SPEAKER_04]: And you've pronounced that better than I ever could.
[36:59.000 --> 36:59.340] [SPEAKER_04]: Try that again.
[36:59.680 --> 37:01.080] [SPEAKER_04]: Siva Vadianathan.
[37:01.280 --> 37:12.220] [SPEAKER_04]: I remember that specifically because he was at NYU at the time and I think I was partly responsible for getting him into the keynote position and I had to learn that name quite regularly.
[37:12.740 --> 37:12.980] [SPEAKER_05]: Excellent.
[37:13.140 --> 37:14.980] [SPEAKER_05]: So you're in charge of pronouncing that for the rest of the show.
[37:15.300 --> 37:15.700] [SPEAKER_04]: Vadianathan.
[37:15.700 --> 37:16.660] [SPEAKER_05]: Well done.
[37:16.880 --> 37:29.860] [SPEAKER_05]: And you can get all these great talks on a set of either DVD discs or a flash drive containing video files, totally DRM-free, for a pledge of $75 or more.
[37:30.340 --> 37:44.960] [SPEAKER_05]: Ask for the Hope Conference Keynote Series flash drive or the Hope Conference Keynote Series DVDs when you call 516-620-3602 or search for those items when you go to give2wbai.org.
[37:45.480 --> 37:59.480] [SPEAKER_05]: This is the final week of this fundraiser and it's a critical week because basically the amount of support that we get here at Off The Hook directly affects us here at Off The Hook and our ability to keep doing what we do on the station.
[37:59.720 --> 38:10.180] [SPEAKER_05]: And it affects directly how much we can do at the station in general, just with WBAI's continued existence in this bizarre and wonderful experiment that started in 1960.
[38:10.180 --> 38:25.200] [SPEAKER_05]: It's been going on for 57 years now, just based on what we're doing now, which is asking you, the listeners, for your help and your generosity and for you to basically come out and say that, yes, this is worth supporting.
[38:25.340 --> 38:27.420] [SPEAKER_05]: This is worth continuing to happen.
[38:28.740 --> 38:34.300] [SPEAKER_05]: So 516-620-3602 or give2wbai.org.
[38:34.960 --> 38:45.580] [SPEAKER_05]: And yeah, if you're not into any of these premiums or if you want to donate a lower amount or a different amount or a random amount or what have you, any amount helps.
[38:45.940 --> 38:55.060] [SPEAKER_05]: Just let the person on the phone or select the item on the menu that says you're donating in the name of your favorite show, which we hope is Off The Hook.
[38:56.100 --> 38:57.720] [SPEAKER_05]: It's certainly among my favorites.
[38:58.480 --> 39:00.020] [SPEAKER_05]: You can also text.
[39:00.100 --> 39:06.060] [SPEAKER_05]: You can text the letters WBAI to the short code 41444.
[39:07.340 --> 39:12.720] [SPEAKER_05]: And you'll get a text back with the next step to process a donation.
[39:13.000 --> 39:18.340] [SPEAKER_05]: And that way does not get you our special premiums, but that way does get you other things.
[39:18.460 --> 39:28.020] [SPEAKER_05]: You can support the station just with any amount you can give, whether it's a few dollars or whether it's a big pile of dollars or anything.
[39:28.020 --> 39:36.380] [SPEAKER_05]: So, yes, give2wbai.org 516-620-3602 or text 41444.
[39:37.300 --> 39:46.580] [SPEAKER_04]: Well, I'll be the first to say I can't wait to get my two happy little historic data storage devices that are going to be painted by our very own Rob T.
[39:46.720 --> 39:47.040] [SPEAKER_04]: Firefly.
[39:47.240 --> 39:49.000] [SPEAKER_04]: I think that's a fantastic deal.
[39:49.000 --> 39:51.720] [SPEAKER_04]: Everybody should consider it if they haven't already.
[39:52.180 --> 39:53.540] [SPEAKER_04]: We've been on the air fundraising.
[39:53.540 --> 39:58.820] [SPEAKER_04]: I guess this is our fourth week right now, and please don't make us do this any longer.
[40:00.300 --> 40:02.420] [SPEAKER_05]: We try and limit how much of this we do.
[40:02.560 --> 40:11.840] [SPEAKER_05]: It is a reality of what we're doing here because, frankly, it's expensive to run a radio station in a frighteningly major media market like New York City.
[40:12.840 --> 40:20.380] [SPEAKER_05]: And, yeah, I mean, we could basically just stop paying for all this, just let it go.
[40:20.460 --> 40:27.160] [SPEAKER_05]: But if that happened, we would not ever get anything like this back, not here, not in New York City, not in the middle of the FM dial.
[40:27.800 --> 40:32.220] [SPEAKER_05]: This is just like, it's a complete fluke that this place even happened in the first place.
[40:32.520 --> 40:44.620] [SPEAKER_05]: So the fact that it's on such tenterhooks, such a tenuous grip on its continued existence, really, really means something because if we lost this, we would not be getting it back.
[40:46.140 --> 40:52.620] [SPEAKER_04]: And there's so much important stuff that goes on at the station, so many important things to talk about, which maybe is a good segue.
[40:53.220 --> 40:54.200] [SPEAKER_04]: What do you think, Rob?
[40:54.400 --> 40:55.500] [SPEAKER_05]: I think that's a very good segue.
[40:55.780 --> 40:56.140] [SPEAKER_04]: Fantastic.
[40:57.040 --> 41:09.380] [SPEAKER_04]: One of the really important things that happened last week to get back to the meat and potatoes of our show here, and thank everybody for their support, by the way, if you are calling in and pledging, once again, 516-620-3602.
[41:10.880 --> 41:19.400] [SPEAKER_04]: Malware Tech, also known by his real name as Marcus Hutchins, was arrested last week in Las Vegas after the DEFCON and Black Hat conferences.
[41:19.680 --> 41:29.380] [SPEAKER_04]: He is best known as the guy who stopped the WannaCry slash WannaCrypt ransomware attack by registering a domain name that he found when he was analyzing the malware.
[41:29.580 --> 41:31.880] [SPEAKER_04]: This turned out to be a sort of sinkhole.
[41:32.040 --> 41:43.080] [SPEAKER_04]: It was a kill switch for the domain name and it stopped the worldwide spread of this particular ransomware attack that we had tangentially referenced in our earlier discussion with Sandy Clark.
[41:43.760 --> 41:52.420] [SPEAKER_04]: This was a ransomware attack that was affecting places like the National Health Service in the UK and just spreading all around the world, causing mayhem.
[41:52.620 --> 42:00.260] [SPEAKER_04]: So he was hailed as basically a hero of the information security community and a guy who didn't really want a lot of the praise.
[42:00.260 --> 42:06.820] [SPEAKER_04]: He seemed very demure about it and was very casual and came off looking, I think, incredibly classy, in my opinion.
[42:07.060 --> 42:18.700] [SPEAKER_03]: I think we should say he was... he had been anonymous before this time, or pseudonymous, like running the blog, and so... but some tabloid journalist in the UK after he stopped it, like basically doxed him.
[42:19.360 --> 42:20.560] [SPEAKER_04]: That's exactly right.
[42:20.680 --> 42:31.680] [SPEAKER_04]: Yeah, he didn't want his name out there, but in any event, last week he was arrested by federal authorities while in McCarran Airport in Las Vegas, attempting to leave the country and head back to the UK.
[42:31.680 --> 42:38.980] [SPEAKER_04]: And he was arrested on an indictment that had actually been... I believe the indictment came down on 11 July.
[42:39.440 --> 42:41.720] [SPEAKER_04]: So that's something interesting right there.
[42:41.900 --> 42:49.540] [SPEAKER_04]: This indictment came well before he... well, actually shortly before he entered the country, which raises a lot of questions here.
[42:50.600 --> 42:56.180] [SPEAKER_04]: Namely, what did the UK government know about this, if anything, at the time?
[42:56.740 --> 43:01.840] [SPEAKER_04]: And was Marcus Hutchins being surveilled while he was over at DEFCON?
[43:01.940 --> 43:03.760] [SPEAKER_04]: Who were the people with whom he was consorting?
[43:03.840 --> 43:07.780] [SPEAKER_04]: I'm sure everybody in all of his associations are probably a little worried here.
[43:07.960 --> 43:16.320] [SPEAKER_04]: Part of the big problem with what happened with malware tech is that there's a tremendous fallout from this in the information security community.
[43:16.560 --> 43:20.920] [SPEAKER_04]: And this divide, in my opinion, frankly, is intolerable.
[43:21.520 --> 43:22.860] [SPEAKER_04]: It's also unnecessary.
[43:23.420 --> 43:36.580] [SPEAKER_04]: And it's also really destructive because after the Snowden revelations in 2013, there was a big divide between, I would say, the private sector, the government, and the information security community because nobody had any trust of each other.
[43:36.700 --> 43:54.500] [SPEAKER_04]: And here we are in another situation just a few years later, after that divide has slightly been healed, where we now have somebody who is a security researcher arrested on what is arguably a rather flimsy indictment, alleging he violated the wiretapping app,
[43:54.660 --> 43:57.880] [SPEAKER_04]: alleging various things about the Computer Fraud and Abuse Act.
[43:58.880 --> 44:16.220] [SPEAKER_04]: And this sort of rift is going to cause a dearth of information sharing between the private sector and the government again, just at the time when it's incredibly critical that we have such collaboration happening, for all the very reasons that Sandy Clark had mentioned with respect to voting machines earlier in our program.
[44:16.720 --> 44:23.040] [SPEAKER_03]: Yeah, a lot of researchers have actually gotten record and say that they're not stopping it sharing information.
[44:23.260 --> 44:25.860] [SPEAKER_03]: So it's this rubber cousins have already started.
[44:26.240 --> 44:28.540] [SPEAKER_04]: Yeah, that I think that's that's exactly right.
[44:28.700 --> 44:32.360] [SPEAKER_04]: And, you know, we have the indictment here and everybody talks about the indictment.
[44:32.600 --> 44:33.680] [SPEAKER_04]: You know, Rob, what do you think?
[44:33.760 --> 44:36.020] [SPEAKER_04]: Do you think we should read it into the record?
[44:36.220 --> 44:37.300] [SPEAKER_04]: We've got a couple of minutes.
[44:37.400 --> 44:39.840] [SPEAKER_04]: It would probably take about four or five minutes if I read it quickly.
[44:40.000 --> 44:40.460] [SPEAKER_04]: What do you think?
[44:41.400 --> 44:44.200] [SPEAKER_05]: I think I think, yeah, let's let's do this.
[44:44.340 --> 44:45.380] [SPEAKER_04]: OK, let's give it a shot.
[44:45.580 --> 44:46.760] [SPEAKER_04]: I'm going to read really, really quickly.
[44:46.880 --> 44:53.880] [SPEAKER_04]: And when I say redacted, that means that this is the name of the unindicted co-conspirator that is missing from this particular indictment.
[44:54.080 --> 44:54.320] [SPEAKER_04]: OK.
[44:54.900 --> 44:55.280] [SPEAKER_04]: Indictment.
[44:55.380 --> 44:57.480] [SPEAKER_04]: Case 17-CR 124.
[44:57.680 --> 44:58.380] [SPEAKER_04]: Count one.
[44:58.540 --> 45:00.880] [SPEAKER_04]: The grand jury charges at times material to this indictment.
[45:01.020 --> 45:02.680] [SPEAKER_04]: Defendants, defendant, redacted.
[45:02.760 --> 45:04.880] [SPEAKER_04]: Use the online aliases redacted.
[45:05.200 --> 45:07.920] [SPEAKER_04]: Defendant Marcus Hutchins was a citizen resident of the United Kingdom.
[45:08.120 --> 45:11.480] [SPEAKER_04]: Hutchins used various online aliases, including malware tech.
[45:11.860 --> 45:12.680] [SPEAKER_04]: Relevant terms.
[45:12.820 --> 45:23.860] [SPEAKER_04]: A protected computer was a computer in or affecting interstate commerce, commerce or communications, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communications of the United States.
[45:24.520 --> 45:24.960] [SPEAKER_04]: Malware.
[45:25.240 --> 45:27.500] [SPEAKER_04]: It's interesting to see how these things are defined, by the way.
[45:27.720 --> 45:29.360] [SPEAKER_04]: Was a term used to describe malicious
[45:35.220 --> 45:42.340] [SPEAKER_04]: Cronos was the name of a particular type of malware that recorded and exfiltrated user credentials and personal identifying information from protected computers.
[45:42.620 --> 45:46.140] [SPEAKER_04]: Cronos malware was commonly referred to as a, quote, banking Trojan.
[45:46.420 --> 45:51.940] [SPEAKER_04]: Crypting was a term used to describe computer code used to conceal the existence of malware from antivirus software.
[45:52.280 --> 45:53.180] [SPEAKER_04]: The conspiracy.
[45:53.660 --> 46:00.160] [SPEAKER_04]: Between in or around July 2014 and July 2015 in the state and eastern district of Wisconsin and elsewhere redacted.
[46:00.340 --> 46:01.660] [SPEAKER_04]: And Marcus Hutchins, a.k.a.
[46:01.780 --> 46:19.520] [SPEAKER_04]: Malware Tech, knowingly conspired and agreed with each other to commit an offense against the United States, namely to knowingly cause the transmission of a program, information code, and command as a result of such conduct intentionally and as a result of such conduct intentionally cause damage without authorization to 10 or more protected computers during a one-year period in violation of Title
[46:19.520 --> 46:25.000] [SPEAKER_04]: 18, United States Code, Sections 1030A5A, C4B1, and C4A16.
[46:25.000 --> 46:27.020] [SPEAKER_04]: Six, manner and means of conspiracy.
[46:27.180 --> 46:38.980] [SPEAKER_04]: The manner and means sought to accomplish the object and purpose of the conspiracy included advertising the availability of Cronos malware on Internet forms, selling Cronos malware, receiving and distributing the proceeds obtained from selling the Cronos malware,
[46:39.180 --> 46:43.720] [SPEAKER_04]: and acts done in furtherance of the conspiracy, concealed and hidden, and caused to be concealed and hidden.
[46:44.000 --> 46:52.020] [SPEAKER_04]: Overred acts in furtherance of the conspiracy, in furtherance of the conspiracy, and to accomplish the act and purpose of the conspiracy, the following overred acts among others were committed and were caused to be committed.
[46:52.500 --> 46:54.860] [SPEAKER_04]: Defendant Marcus Marcus Hutchins created the Kronos malware.
[46:55.200 --> 47:01.560] [SPEAKER_04]: On or about July 13, 2014, a video showing the functionality of the Kronos banking Trojan was posted to a publicly available website.
[47:01.960 --> 47:05.320] [SPEAKER_04]: Defendant Redacted used the video to demonstrate how Kronos worked.
[47:05.420 --> 47:06.600] [SPEAKER_04]: Let me just interject something here.
[47:06.780 --> 47:10.800] [SPEAKER_04]: There's a lot of redaction coming in these next paragraphs, and that's mostly about the criminal conduct.
[47:10.800 --> 47:17.620] [SPEAKER_04]: In or around August 2014, on an Internet forum, Defendant Redacted offered to sell the Kronos banking Trojan for $3,000.
[47:18.020 --> 47:24.340] [SPEAKER_04]: In or around February 2015, Defendants Marcus Hutchins and Redacted updated the Kronos malware.
[47:24.500 --> 47:32.220] [SPEAKER_04]: On or about April 29, 2015, Defendant Redacted, using the name Redacted, advertised the availability of the Kronos malware on the AlphaBay market forum.
[47:32.480 --> 47:38.340] [SPEAKER_04]: On or about June 11, Defendant Redacted sold a version of the Kronos malware in exchange for approximately $2,000 in digital currency.
[47:38.340 --> 47:47.460] [SPEAKER_04]: On or about July 17, 2015, Defendant Redacted offered crypting services for Kronos, all in violation of Title 18, United States Code, Section 371.
[47:47.680 --> 47:54.860] [SPEAKER_04]: Count 2, the grand jury further charges between in or around July 2014 and August 2014 in the state and the eastern district of Wisconsin and elsewhere.
[47:55.420 --> 47:56.900] [SPEAKER_04]: Redacted and Marcus Hutchins, a.k.a.
[47:56.920 --> 48:13.780] [SPEAKER_04]: malware tech, knowingly disseminated by electronic means and advertisement of any electronic, mechanical, or other device, knowing and having reason to know the design of such device renders it primarily useful for the purpose of the surreptitious interception of electronic communications and knowing the content of the advertisement and having reason to know that such advertisement will be
[48:13.780 --> 48:21.160] [SPEAKER_04]: transported in interstate and foreign commerce in violation of Title 18, United States Code, Section 25121C1N2.
[48:22.160 --> 48:29.100] [SPEAKER_04]: Count 3, the grand jury further charges the honor about June 11, 2015, in the state and the eastern district of Wisconsin and elsewhere.
[48:29.540 --> 48:31.160] [SPEAKER_04]: Redacted and Marcus Hutchins, a.k.a.
[48:31.160 --> 48:37.680] [SPEAKER_04]: malware tech, intentionally sent electronic, mechanical, or other devices, devices, or other devices, in interstate foreign commerce.
[48:37.760 --> 48:51.880] [SPEAKER_04]: Knowingly and having reason to know the design of such device renders it primarily useful for the purpose of the surreptitious interception of electronic communications in violation of Title 18, United States Code, Sections 25, 1, 2, subparagraphs 1A and 2.
[48:53.420 --> 48:59.880] [SPEAKER_04]: And counts 4 and 5 and 6 are all very similar.
[49:00.640 --> 49:05.860] [SPEAKER_04]: I don't think it's worth reading the entirety of those into the record since we only have about 10 minutes left here.
[49:05.960 --> 49:07.200] [SPEAKER_04]: But you get the gist of it.
[49:07.320 --> 49:15.020] [SPEAKER_04]: And the gist of this indictment primarily has to do with this unnamed co-conspirator here.
[49:15.680 --> 49:19.000] [SPEAKER_04]: We can't say unnamed and unindicted because he's in the indictment.
[49:19.140 --> 49:19.940] [SPEAKER_04]: He's just redacted.
[49:20.080 --> 49:22.100] [SPEAKER_04]: So this brings up a lot of issues, too.
[49:22.240 --> 49:23.760] [SPEAKER_04]: I mean, who the hell is this guy?
[49:24.660 --> 49:28.960] [SPEAKER_04]: And for me, I wonder if he's cooperating with the government at this particular time.
[49:28.960 --> 49:31.260] [SPEAKER_04]: And perhaps that's the reason why his name is redacted.
[49:32.120 --> 49:35.240] [SPEAKER_05]: That seems to be a solid theory.
[49:35.460 --> 49:38.200] [SPEAKER_05]: I mean, the fact that this is an indictment, it is indicting both of them.
[49:39.340 --> 49:42.400] [SPEAKER_05]: But they're withholding the name of one of them for some reason in the published version.
[49:43.220 --> 49:48.160] [SPEAKER_05]: Yeah, they want to cover this person, whoever he or she may be.
[49:50.040 --> 50:05.000] [SPEAKER_05]: And, yeah, if this is such a high-profile case and such a big deal, a big enough deal to follow Hutchins around a hacker conference and then nab him as he's trying to go home, yeah, that seems like... it seems pretty heavy.
[50:05.000 --> 50:08.800] [SPEAKER_05]: And it seems like a strange way for the powers that be to go about it.
[50:09.000 --> 50:10.520] [SPEAKER_04]: I think that's absolutely right.
[50:10.520 --> 50:14.200] [SPEAKER_04]: And there's a lot of questions that remain unanswered from this particular indictment.
[50:14.200 --> 50:18.260] [SPEAKER_04]: And, you know, namely, what is really the government's theory of the case here?
[50:18.360 --> 50:19.600] [SPEAKER_04]: We don't know a lot of facts.
[50:19.780 --> 50:30.060] [SPEAKER_04]: You know, a lot of what they're alleging rests on this July 11, 2015 act of the sale of this particular malware, the alleged sale of Kronos, supposedly.
[50:30.360 --> 50:36.440] [SPEAKER_04]: You know, on the other hand, there were posts all over Twitter about malware tech posting, I think in...
[50:36.440 --> 50:38.840] [SPEAKER_04]: I actually don't remember the year, maybe Voltaire.
[50:38.840 --> 50:45.760] [SPEAKER_04]: Do you remember the year where he posted a Twitter message where he was looking for particular snippets of the Kronos malware?
[50:46.480 --> 50:46.840] [SPEAKER_04]: No.
[50:46.920 --> 50:47.620] [SPEAKER_04]: You don't remember that?
[50:47.720 --> 50:47.860] [SPEAKER_04]: Okay.
[50:47.940 --> 50:49.060] [SPEAKER_04]: Sorry to put you on the spot there.
[50:49.240 --> 50:52.600] [SPEAKER_04]: But in any event, there's a lot of indications that he was...
[50:52.600 --> 51:02.640] [SPEAKER_04]: that malware tech Marcus Hutchins was actually looking for this particular code, which, you know, may be exactly the type of thing you would want to have on the record if you actually did, in fact, create the code.
[51:02.820 --> 51:04.260] [SPEAKER_04]: I mean, that's one running theory.
[51:04.500 --> 51:07.940] [SPEAKER_04]: But we don't know a lot about the facts that are really underlying this.
[51:07.940 --> 51:10.080] [SPEAKER_04]: We don't know who this person is.
[51:10.300 --> 51:23.540] [SPEAKER_04]: You know, at this moment in time, as of, I believe it was Friday, yeah, I think it was Friday that malware tech was actually granted bail.
[51:23.700 --> 51:24.960] [SPEAKER_04]: It was $30,000 bail.
[51:25.140 --> 51:28.680] [SPEAKER_04]: And the conditions of his release at the moment are pretty tough.
[51:28.960 --> 51:31.000] [SPEAKER_04]: I mean, he's not allowed to leave the country.
[51:31.120 --> 51:32.020] [SPEAKER_04]: He had to surrender his passport.
[51:32.040 --> 51:33.800] [SPEAKER_04]: He's not allowed to use a computer.
[51:35.200 --> 51:39.520] [SPEAKER_04]: And that raises a lot of issues about the participation in his own defense.
[51:39.860 --> 51:39.960] [SPEAKER_05]: Right.
[51:40.100 --> 51:42.660] [SPEAKER_05]: And that went through at 3.30 p.m.
[51:42.660 --> 51:46.980] [SPEAKER_05]: on Friday, which meant it didn't get brought back by the 4 p.m.
[51:47.240 --> 51:48.960] [SPEAKER_05]: deadline to get it done by the business day.
[51:48.960 --> 51:52.840] [SPEAKER_05]: So Hutchins had to spend the weekend in jail and was freed Monday.
[51:52.840 --> 51:52.840] Okay.
[51:53.160 --> 51:54.440] [SPEAKER_04]: That's exactly right.
[51:54.560 --> 51:55.400] [SPEAKER_04]: You're exactly right.
[51:55.500 --> 51:55.980] [SPEAKER_04]: Sorry about that.
[51:56.700 --> 52:05.180] [SPEAKER_04]: And then that caused, I believe, he's going to be heading over to Milwaukee, to Wisconsin, to be arraigned on 14 August, which is this coming Monday.
[52:05.180 --> 52:09.540] [SPEAKER_04]: So he hasn't pleaded guilty or not guilty to any of these crimes yet.
[52:09.580 --> 52:10.800] [SPEAKER_04]: That's what the arraignment is for.
[52:11.000 --> 52:17.120] [SPEAKER_04]: He will go in front of a federal district court judge on Monday in Milwaukee, and they will read to him the charges.
[52:17.320 --> 52:23.800] [SPEAKER_04]: There probably won't be much more information coming out of that, but in all likelihood, he's going to plead not guilty.
[52:23.800 --> 52:40.340] [SPEAKER_04]: All that being said, according to some of the reports that have covered the hearing last week, while he was in custody, after he was arrested, I believe it was last Wednesday, he spent about 24 hours in FBI custody, during which he was interrogated without a lawyer.
[52:41.340 --> 52:45.660] [SPEAKER_04]: He, in my guess, voluntarily spoke to the FBI.
[52:46.400 --> 52:55.500] [SPEAKER_04]: Most people, even UK citizens, are generally aware of the Miranda rights, and according to the FBI, he confessed to writing some of the code of Kronos.
[52:56.260 --> 53:08.140] [SPEAKER_04]: I really wonder, however, about whether that's a real confession, because in the security community, people write snippets of code all the time that could be maliciously used in subsequent malware.
[53:08.400 --> 53:11.800] [SPEAKER_04]: So admitting to that hardly seems like a confession to me.
[53:11.800 --> 53:12.800] [SPEAKER_03]: Yeah, certainly.
[53:12.960 --> 53:30.060] [SPEAKER_03]: In fact, somebody, there's another old tweet of Malware Tech, where he was saying that somebody, he found an example of a piece of malware using an open-source code he wrote, and he basically saying, like, that's kind of, like, how the industry works,
[53:30.080 --> 53:33.640] [SPEAKER_03]: and it's very problematic that they'd be charging him for that.
[53:33.640 --> 53:42.800] [SPEAKER_04]: And this has a major effect on our community, on the hacker community, on the information security community, because of the chilling effect this is going to be having on free speech.
[53:43.000 --> 53:47.540] [SPEAKER_04]: I mean, we saw how important it was at DEFCON to have this voting booth, hacking village.
[53:47.760 --> 53:50.040] [SPEAKER_04]: We've got the Circle of Hope coming up next year.
[53:50.360 --> 53:59.240] [SPEAKER_04]: I mean, how reticent and how reluctant are people going to be now to come to the United States when they perform research and analytics like this?
[53:59.240 --> 54:11.180] [SPEAKER_04]: I mean, how worried are people going to be about there being some sort of sealed indictment out somewhere, you know, where they can be arrested when they're trying to leave the country or leave a particular conference?
[54:11.320 --> 54:21.280] [SPEAKER_04]: I mean, this is going to have a major chilling effect on the freedom of association and the general sharing of critical security vulnerability information.
[54:21.920 --> 54:26.840] [SPEAKER_05]: So definitely, the InfoSec community is taking this as a stab to the heart, which it rather is.
[54:26.840 --> 54:35.400] [SPEAKER_05]: There's a story on the register.co.uk discussing the case and talking about how Hutchins was very widely respected in the security community.
[54:35.720 --> 54:43.620] [SPEAKER_05]: And experts all over the place basically are withdrawing their participation in the open community in response to what's happened to Hutchins.
[54:43.840 --> 54:54.020] [SPEAKER_05]: Because, you know, no one else, you know, others are starting to fear for their liberty and safety and stuff if they continue to do their job, which is to research security.
[54:54.940 --> 55:08.780] [SPEAKER_03]: Also, the fact that the FBI waited until after he was down in Vegas and on his way out, as opposed to, like, navigating him on his way to DEFCON, makes you feel like maybe they were on an information fishing exposition.
[55:09.900 --> 55:11.840] [SPEAKER_04]: You know, it's really quite true.
[55:11.980 --> 55:14.400] [SPEAKER_04]: I mean, we just don't know right now.
[55:14.400 --> 55:20.680] [SPEAKER_04]: And I think it's very easy for us to simply dismiss this indictment as really flimsy.
[55:21.320 --> 55:25.200] [SPEAKER_04]: But I think we have to wait to see what the facts are when they pan out.
[55:25.320 --> 55:26.860] [SPEAKER_04]: I don't want to pass judgment on this at all.
[55:26.980 --> 55:34.620] [SPEAKER_04]: I do think that there are some sort of novel and very tenuous legal theories upon which it's based.
[55:35.180 --> 55:41.600] [SPEAKER_04]: This is going to be an extremely interesting story, really interesting litigation, and we wish him the absolute best.
[55:41.600 --> 55:42.500] [SPEAKER_04]: We're here to support.
[55:42.780 --> 55:43.180] [SPEAKER_05]: Absolutely.
[55:43.180 --> 55:44.940] [SPEAKER_05]: We're going to be keeping a sharp eye on this.
[55:44.980 --> 55:45.980] [SPEAKER_05]: We encourage you to as well.
[55:46.800 --> 55:48.880] [SPEAKER_05]: Hutchins' own site is malwaretech.com.
[55:49.040 --> 55:57.240] [SPEAKER_05]: You can find his tweets at malwaretechblog is his Twitter screen name with the at sign in front of it, as is traditional on that site.
[55:58.160 --> 55:58.560] [SPEAKER_05]: Fantastic.
[55:59.140 --> 56:01.460] [SPEAKER_04]: Do we have one minute to share some interesting stuff?
[56:01.480 --> 56:03.620] [SPEAKER_04]: There was just some news that came out about North Korea.
[56:03.620 --> 56:05.140] [SPEAKER_05]: We have a very short minute.
[56:05.240 --> 56:05.380] [SPEAKER_05]: Okay.
[56:05.600 --> 56:10.700] [SPEAKER_04]: I would like to share with you guys some interesting stuff that we mine generally at my firm.
[56:10.720 --> 56:13.820] [SPEAKER_04]: We do a lot of intelligence related to the domain name space.
[56:14.000 --> 56:20.820] [SPEAKER_04]: And I just wanted to share with you, over the last 24 hours, some of the domain names that were registered in the .com space.
[56:21.840 --> 56:27.360] [SPEAKER_04]: Interestingly enough, we've got some very, very curious data sources that we can get this from.
[56:29.820 --> 56:46.660] [SPEAKER_04]: Northkoreavusa.com, Northkoreaminiaturenuke.com, Northkoreaminiaturenuclearwarhead.com, thenorthkoreanwar.com, dprknorthkorea.com, and weirdly enough, northkoreacasino.com.
[56:46.800 --> 56:49.820] [SPEAKER_04]: Although I think that was updated and created in April.
[56:50.120 --> 56:53.220] [SPEAKER_04]: But one of those rings very close to our heart.
[56:54.140 --> 57:00.240] [SPEAKER_04]: Thenorthkoreanwar.com was registered right here in Brooklyn, just a couple blocks away from the station.
[57:00.240 --> 57:03.600] [SPEAKER_04]: As a matter of fact, let's see what happens.
[57:03.940 --> 57:05.160] [SPEAKER_04]: Let's wish the world the best.
[57:06.060 --> 57:06.440] [SPEAKER_04]: Absolutely.
[57:07.600 --> 57:13.320] [SPEAKER_05]: And with that, we've, we put the, we put the cap on another week here at Off The Hook.
[57:13.540 --> 57:16.520] [SPEAKER_05]: Send us email, oth@2600.com.
[57:16.780 --> 57:20.300] [SPEAKER_05]: Follow us and ping us on Twitter, at Hacker Radio Show.
[57:21.120 --> 57:27.040] [SPEAKER_05]: And continue to keep your eyes open, continue to support what we do here on this program and this station.
[57:27.200 --> 57:36.320] [SPEAKER_05]: give2wbai.org or 516-620-3602 or text WBAI to 41444.
[57:36.880 --> 57:38.520] [SPEAKER_05]: Thanks again to our guest, Sandy Clark.
[57:39.020 --> 57:42.400] [SPEAKER_05]: Thanks to Emmanuel and Kyle for pitching in from across the country.
[57:42.960 --> 57:47.260] [SPEAKER_05]: And thanks to you, the listener, who, who this is all for.
[57:48.120 --> 57:50.180] [SPEAKER_05]: For Off The Hook, this is Rob T. Firefly.
[57:51.640 --> 57:52.660] [SPEAKER_05]: Have a very good week.
[01:00:46.180 --> 01:01:00.280] [SPEAKER_07]: We'll see you next week.