[00:00.520 --> 00:02.160]  Good evening again, everyone.
[00:02.420 --> 00:03.160]  How are you?
[00:03.240 --> 00:04.000]  Thank you for showing up.
[00:04.100 --> 00:06.020]  We appreciate your attendance here.
[00:06.700 --> 00:08.300]  Some of you probably know me.
[00:08.400 --> 00:09.340]  I'm Alex Urbelis.
[00:09.420 --> 00:11.240]  I'm an attorney with Blackstone Law Group.
[00:11.680 --> 00:19.980]  And I am co-presenting this evening with my colleague and friend, Sebastian Holst, who is the CSO of a company called Preemptive Solutions.
[00:20.260 --> 00:31.380]  And tonight we are going to talk about legal developments with respect to reverse engineering, the Defend Trade Secrets Act, source code obfuscation, and all kinds of fun things with...
[00:31.380 --> 00:40.200]  And if the demo gods are kind to us, hopefully an interesting presentation on reverse engineering by Sebastian here.
[00:40.860 --> 00:45.480]  So, like I said, this will be a kind of quick recap of exactly what I just said.
[00:45.620 --> 00:56.100]  But trade secret legislation has been passed both in the European Union recently and at the federal level here in the United States.
[00:56.320 --> 00:58.060]  And this is a huge change.
[00:58.400 --> 01:06.800]  And it is kind of a conflation now of technical requirements meshing with legal requirements.
[01:07.140 --> 01:16.080]  And that what we are hopefully going to try to impress upon you this evening is that DevOps, because of these developments, really need to change and really need...
[01:16.080 --> 01:20.280]  And the law needs to be thought about during the development process.
[01:20.280 --> 01:24.340]  And you need to choose the right tools for that job.
[01:24.500 --> 01:27.820]  Things that do not impede the development process itself.
[01:29.400 --> 01:36.760]  So, with that, let's kind of step back because I very much hope that you are not all lawyers in this particular room.
[01:37.840 --> 01:40.800]  You know, you guys look too smart to be, I have to say.
[01:41.380 --> 01:41.860]  Handsome.
[01:42.040 --> 01:45.760]  Yeah, and handsome, exactly.
[01:46.660 --> 01:48.300]  Yeah, so what is a trade secret?
[01:48.300 --> 01:56.120]  So, very, very broadly, a trade secret is any confidential information that provides a competitive advantage to a company.
[01:56.600 --> 02:03.060]  And that competitive advantage, it is very important to understand, needs to be derived from its secrecy itself.
[02:03.380 --> 02:09.980]  So, under the Uniform Trade Secrets Act, essentially what they would do is provide a whole bunch of examples.
[02:09.980 --> 02:18.580]  And these were formulas, processes, designs, patterns, methods, practices, and crown jewels for many companies, which are our source code.
[02:18.880 --> 02:38.320]  So, whether something is in fact a trade secret, something that can be considered a trade secret, something that can be sued over if it is misappropriated, really depends on the nature of information, number one, and the means by which it is protected.
[02:40.260 --> 02:49.840]  So, comparing trade secrets with, and here's stepping back a tiny bit, you know, this is a little bit of an IP primer here for, you know, like a third grade level.
[02:50.400 --> 02:57.060]  But trade secret protection differs tremendously from patents and trademarks because its protection is indefinite.
[02:57.060 --> 03:10.200]  And that means so long as it remains secret, it's, you know, and there's economic value being derived from it, it can be something that can be sued over if it is misappropriated.
[03:10.880 --> 03:22.460]  I think a prime example of this, and I defer to Sebastian as well, but I think the secret recipe to Coca-Cola stored somewhere for so many years has been a trade secret.
[03:22.600 --> 03:31.120]  It's not something that's patented because when you patent something, you put it essentially into the public domain because patents only have a 20-year shelf life from the filing date.
[03:31.680 --> 03:38.420]  And, you know, comparing it to trademarks, where trademarks obviously can persist longer than 10 years, but they need to be renewed every 10 years.
[03:38.520 --> 03:44.480]  And when you renew a trademark, you essentially have to file a statement that it is in actual use, that you're really using this thing.
[03:44.660 --> 03:49.900]  Otherwise, it can become available in a particular class in which you're operating for somebody else to use.
[03:50.640 --> 04:00.100]  So, what we have here in the United States recently passed on May 11th, signed into law by President Obama, something called the Defend Trade Secrets Act.
[04:00.280 --> 04:07.700]  And this is extremely important, and it's a huge sea change in the way that trade secret protection has been operating in the United States.
[04:07.900 --> 04:16.780]  Prior to this federal legislation, all we had was a patchwork, essentially, of state-by-state legislation with respect to trade secrets.
[04:16.780 --> 04:26.280]  So, if you wanted to go to court to protect your trade secrets, if you thought they were misappropriated in West Virginia, you needed to rely on West Virginia law.
[04:26.440 --> 04:29.520]  And if you wanted to go to California, you need to rely on California law.
[04:30.000 --> 04:36.660]  And that's a huge problem because state court, especially in New York, can be very unpredictable.
[04:37.380 --> 04:41.560]  Federal courts are much more of a polished proceeding.
[04:42.520 --> 04:52.560]  Not to disparage state court judges too much, but federal court judges are generally a hell of a lot smarter than state court judges, I have to say.
[04:53.860 --> 04:54.800]  And handsome.
[04:56.540 --> 04:56.820]  Exactly.
[04:57.280 --> 04:57.560]  Exactly.
[04:57.840 --> 05:01.760]  There are exceptions to that rule, and I have come across a few of them recently.
[05:03.660 --> 05:05.160]  Not the handsome thing.
[05:05.260 --> 05:05.780]  They're all handsome.
[05:05.780 --> 05:08.160]  But, I mean, I'm talking about the intelligence, obviously.
[05:09.020 --> 05:18.000]  The other big difference here is that prior to the Defend Trade Secrets Act, we had something, federal law, that protected trade secrets.
[05:18.120 --> 05:23.700]  The only federal law that protected trade secrets was known as the Economic Espionage Act.
[05:24.180 --> 05:33.540]  And this allowed a criminal action under Title 18 to be brought by the Department of Justice against a party that misappropriated a trade secret.
[05:35.000 --> 05:44.000]  And that is, you know, to rely on Department of Justice to protect your trade secrets is really something that, you know, is unpredictable.
[05:44.060 --> 05:50.560]  And the case itself would have to be tremendously valuable and important in order for DOJ to get involved.
[05:50.560 --> 05:53.680]  You cannot necessarily rely on the federal government to exercise their own rights.
[05:53.680 --> 06:05.340]  So with the Defend Trade Secrets Act, what they did was create federal law that gives individual plaintiffs or individual companies a private right of action to go into federal court and sue for the misappropriation of their trade secrets.
[06:05.340 --> 06:23.840]  It does not entirely preempt state law on this level, but I think we are going to begin to see very quickly the federal law and federal courts are going to become the forum for the enforcement of trade secrets and lawsuits against their misappropriation.
[06:25.100 --> 06:27.720]  So, as I mentioned, it's not entirely preempted.
[06:27.780 --> 06:28.460]  That is state law.
[06:28.680 --> 06:31.260]  There is still some inconsistency of application.
[06:31.680 --> 06:53.720]  And one interesting thing, I don't want to focus on too much today, but a new wrinkle to this, and we can talk about this after the fact, I'd be happy to, but you can now have an ex parte order to seize the property or the computers or any kind of digital assets or any kind of evidence of misappropriation of another party in an ex parte proceeding.
[06:53.720 --> 07:00.680]  And what that means is, let's say I suspect Sebastian of having misappropriated my trade secrets.
[07:00.820 --> 07:10.520]  I can rush to federal court and make an ex parte application, meaning he does not know that I'm making this application and he doesn't even have an opportunity to be heard about it.
[07:10.520 --> 07:29.720]  And I can make a case to a federal judge that his computers should be the subject of a judicial order of seizure because if they are not seized, he's going to walk away with my very, very valuable trade secrets or he may spoliate electronic evidence with respect to those trade secrets.
[07:29.720 --> 07:36.420]  And, you know, this is an incredibly powerful judicial remedy that is brand new under federal law.
[07:38.240 --> 07:53.400]  One of the things that came out of this, and I think this is actually incredibly cool, is this image here that we have, you now have something that you can literally file in front of a federal judge called a motion for encryption.
[07:54.420 --> 07:55.440]  Which is pretty cool.
[07:55.960 --> 07:59.900]  I think I would love to be, I don't think any of these have been filed yet.
[08:00.100 --> 08:06.220]  So if any of you guys have your stuff seized, I would happily file a motion for encryption for you guys pro bono.
[08:06.220 --> 08:07.100]  I actually mean that.
[08:08.240 --> 08:12.960]  I think this would come into play now if somebody's property is seized.
[08:13.160 --> 08:23.400]  Let's say they take Sebastian's hard drive and a portion of it, actually I would say a very large portion of his hard drive, doesn't relate at all to trade secrets.
[08:23.480 --> 08:29.960]  So he can make a motion to have certain files encrypted so that they are essentially protected.
[08:29.960 --> 08:32.480]  And it's actually quite interesting how you do this.
[08:32.640 --> 08:37.100]  The motion actually says, you know, you have to specify the desired encryption method.
[08:37.280 --> 08:47.700]  I mean, I can't wait to see 70-year-old federal judges trying to deal with, you know, you know, encryption keys and methodologies and elliptical curve and all these fun things.
[08:47.700 --> 08:52.560]  So there are also whistleblower protections in the federal law that didn't exist before.
[08:52.820 --> 09:00.280]  But not whistleblowing like we ordinarily think of, whistleblowing in the sense that you can talk to courts and you can talk to law enforcement and lawyers.
[09:00.920 --> 09:03.380]  You cannot talk to the media about trade secrets.
[09:03.500 --> 09:10.240]  So this is not the kind of whistleblowing that we are used to in the context of hope and the hacker community.
[09:10.940 --> 09:23.160]  The EU trade secrets directive is kind of a sister legislative enactment that happened in Europe just a few weeks after President Obama signed the Defend Trade Secrets Act into law, 27 May 2016.
[09:24.340 --> 09:34.400]  Again, it's the same patchwork of laws of the member states of the EU that were the reason why they published a new directive on the protection of trade secrets.
[09:34.400 --> 09:38.200]  And it is very much in harmony in many ways with the Defend Trade Secrets Act.
[09:38.380 --> 09:41.600]  But another way is I think the whistleblowing protection goes a little bit farther.
[09:41.920 --> 09:46.020]  But it's all about, you know, preventing this fragmentation of the internal market.
[09:46.040 --> 09:50.560]  I guess an argument that didn't go over all that well in England recently.
[09:51.980 --> 09:54.560]  So definitions are interesting under the DTSA.
[09:55.060 --> 09:57.160]  And I think we'll whiz through these a little bit.
[09:57.160 --> 10:06.100]  The misappropriation of a trade secret essentially is defined as, you know, being done by improper means.
[10:06.540 --> 10:12.460]  And improper means is going to be another defined term, you know, or when there is a duty of confidentiality.
[10:12.600 --> 10:17.200]  So under this definitional term, if you look at B-2-2, we're lawyers.
[10:17.400 --> 10:21.160]  We love rules and then sub-rules and then sub-rules and sub-sub-rules.
[10:21.380 --> 10:22.240]  It's kind of crazy.
[10:22.360 --> 10:23.760]  So I try to parse it out for you here.
[10:23.760 --> 10:29.300]  So misappropriation of a trade secret can occur, you know, if it is done.
[10:29.420 --> 10:39.540]  If it's disclosed without consent of the party to whom it belongs and that the person disclosing it knew that it was protected and was under a duty to maintain that secrecy.
[10:39.540 --> 10:41.040]  So that's going to be somewhat important.
[10:41.340 --> 10:43.200]  And we come back to that a little bit later.
[10:43.320 --> 10:47.000]  And the term improper means is pretty obvious.
[10:47.140 --> 10:52.520]  You know, theft, bribery, misrepresentation, breach, inducement of a duty to maintain secrecy.
[10:52.520 --> 10:56.540]  Or espionage through electronic or other means.
[10:58.120 --> 11:03.920]  But of course, there's one rather interesting exception that we're going to be talking about this evening.
[11:04.800 --> 11:08.200]  So reverse engineering is specifically carved out.
[11:08.340 --> 11:15.940]  The term improper means does not include reverse engineering, independent derivation or any other lawful means of acquisition.
[11:15.940 --> 11:18.080]  So there's a specific carve out.
[11:18.200 --> 11:19.980]  And this created quite a hullabaloo.
[11:21.000 --> 11:23.120]  I can't believe I actually just used that word, hullabaloo.
[11:23.320 --> 11:27.500]  But it really did create a hullabaloo when this law was passed.
[11:27.700 --> 11:34.720]  It did, in fact, actually exist as a kind of comment to a comment under the Uniform Trade Secrets Act, which most of the states had passed.
[11:34.720 --> 11:44.900]  And reverse engineering, as we probably, a large portion of us know, has been protected under the law for a good period of time, going back to at least the 60s and the 70s here.
[11:46.360 --> 11:58.120]  So reverse engineering is allowed, but you really do need a methodology to protect trade secrets that combines legal strategy together with technical foresight.
[11:59.140 --> 12:10.900]  So if, you know, I think what we're going to start to see, and we already see in some context already, is contractual obligations based on kind of minor privity with a party.
[12:11.120 --> 12:19.360]  Meaning, you know, in an end user license agreement, we'll see some kind of a contractual obligation to maintain a duty of confidentiality and to not reverse engineer.
[12:19.560 --> 12:20.820]  And this is one legal strategy.
[12:20.820 --> 12:35.800]  So that when we're talking about B-2-2 before in the definitional section, if you have this duty not to disclose information or to keep it confidential, that can be considered misappropriation if you violate that duty.
[12:36.040 --> 12:47.280]  But what you really need, though, is the foresight during the development process to construct the reasonable means of the protection of the trade secret itself.
[12:47.280 --> 12:51.540]  So you need enhanced development processes and practices.
[12:52.240 --> 12:56.180]  And that is going to be required to be demonstrated in a legal proceeding.
[12:56.640 --> 13:02.880]  Because if you do not do that, you will not qualify as having a trade secret.
[13:03.120 --> 13:09.300]  Because qualifying as a trade secret is really, I think, what most of the battles are going to be about going forward.
[13:11.160 --> 13:14.220]  And this includes the means by which they were protected.
[13:15.820 --> 13:19.560]  So qualifying as a trade secret, as I said, you know, what it is, is actually pretty broad.
[13:19.720 --> 13:21.260]  It's any kind of information.
[13:21.260 --> 13:29.260]  And what's interesting, too, is under the DTSA, under the Defend Trade Secrets Act, a trade secret could be something actually that's stored neurologically.
[13:29.360 --> 13:31.780]  It could be something that's actually stored in your brain.
[13:32.540 --> 13:35.580]  But it is, like I said, physical, digital, and mental here.
[13:35.740 --> 13:39.220]  But it's any type of information, business, scientific, technical.
[13:39.220 --> 13:42.760]  Now, this is the critical piece to understand here.
[13:43.000 --> 13:50.500]  Provided that the information is, in fact, secret, that it's not known or easily obtainable by someone else who can profit from it.
[13:50.740 --> 13:59.240]  And this is the real critical key here that we want to talk about, that reasonable measures have been taken to ensure the secrecy of that information.
[13:59.780 --> 14:02.160]  Generally, you know, trade secrets are not a new thing.
[14:02.300 --> 14:18.400]  Reasonable means of protection, you know, this is the kind of bog-standard stuff that people would do for many decades before economic espionage became incredibly simple because people's and companies' information security postures have been so deficient and lacking over the last decade or so.
[14:18.680 --> 14:39.480]  But we're talking the usual things are confidentiality agreements, NDA agreements, access controls for the trade secret itself, trade secrets, trade secret registries that are kept internally, responsibility for trade secret protection, and monitoring of these particular protections and prioritization of the protection of trade secrets themselves.
[14:40.600 --> 14:46.360]  So, but what is reasonable now is going to be relative to your perception of your threats.
[14:46.600 --> 14:54.400]  And we all have a much greater understanding that intellectual property and trade secrets, especially, are incredibly valuable.
[14:54.580 --> 15:06.780]  We know that, you know, several years ago there was a lot of tension between President Obama and President Xi in China over the cyber security summit that was then quickly eclipsed by the Snowden revelations in June 2013.
[15:07.180 --> 15:08.880]  But there is a lot of tension here.
[15:09.080 --> 15:17.280]  So the more you understand that there are serious threats to an application, the greater the burden becomes to establish those reasonable means.
[15:17.420 --> 15:18.620]  So they are directly proportional.
[15:18.800 --> 15:25.780]  Your knowledge of your threats is going to be directly proportional to what is reasonable under the circumstances in terms of its protection.
[15:25.780 --> 15:37.760]  So if you know that your app is distributed in China and there is a large market for this particular app, and it is likely to be debugged and reverse engineered, then all this is going to come out in court.
[15:37.980 --> 15:54.280]  So especially if you knew about this because of some kind of threat assessment, or you had an infosec audit that was created in an unprivileged context, which is the reason why you would want lawyers to be interjected in this process, one of the things that we help a lot of companies with.
[15:55.000 --> 16:00.680]  But all of this, if there was litigation about what qualified as a trade secret, would come out.
[16:01.100 --> 16:08.760]  And if you didn't take those reasonable means of protecting relative to what you knew were your threats, then you didn't have a trade secret to begin with.
[16:09.280 --> 16:17.120]  So I'm going to hand it off now to Sebastian to talk about this and provide us an interesting demo, if the demo gods will cooperate.
[16:17.500 --> 16:18.120]  Thank you.
[16:19.140 --> 16:20.000]  Thank you, Alex.
[16:20.220 --> 16:20.760]  Thank you, Sebastian.
[16:21.360 --> 16:24.780]  Okay, so one thing I'd just like to point out, if I go, let's see, go back up.
[16:25.240 --> 16:31.160]  Here's one of the big differences between sort of the IT and engineering approach to this topic.
[16:32.200 --> 16:33.400]  There you go, can you hear me okay?
[16:36.000 --> 16:37.460]  And a legal approach.
[16:37.620 --> 16:39.640]  So let's just do a word count.
[16:40.860 --> 16:41.260]  Okay?
[16:42.020 --> 16:43.300]  Basically, it's the same topic.
[16:43.480 --> 16:45.300]  So in any case, what I'd like to...
[16:45.780 --> 16:47.020]  Here we go, right?
[16:47.020 --> 16:48.920]  So I kind of want to step it up.
[16:49.580 --> 16:53.660]  Or step back a little bit and approach it again, though, from an engineering perspective.
[16:53.980 --> 17:07.480]  When you think about compliance, security, general IT governance, the focus of most activities is on first deterring, ideally even thwarting bad guys, right?
[17:07.480 --> 17:10.500]  Or even just opportunistic folks trolling around.
[17:11.280 --> 17:15.620]  And we hope to further impede the skillful, right?
[17:15.700 --> 17:25.200]  The key here is that obviously there's no one security, maybe there's no layered security, that is guaranteed to prevent anything bad from ever happening, right?
[17:25.380 --> 17:33.600]  But this tends to be the focus of the personas, the stories, the roles, and the investments that IT and development organizations make.
[17:33.600 --> 17:34.340]  Okay?
[17:34.740 --> 17:42.460]  What Alex has been talking about, right, is the conflation of engineering technical terms in the law.
[17:42.740 --> 17:50.720]  And so no longer can IT folks sort of interpret guidance from inside counsel.
[17:50.920 --> 17:59.940]  Because inside counsel may not have the expertise to actually understand the implications of reverse engineering in the context of software.
[17:59.940 --> 18:02.700]  So now they need, let's just need to get that, right?
[18:02.980 --> 18:06.580]  We need, now they need to focus on a whole new set.
[18:07.000 --> 18:08.640]  If I can find the right button, it's dark.
[18:11.220 --> 18:12.000]  There we go.
[18:13.780 --> 18:20.780]  What happens now is that focusing on the prosecution of the successful, right?
[18:21.120 --> 18:27.180]  So some, you know, historically you would focus on controls that would prevent bad things from happening.
[18:27.180 --> 18:34.760]  Now there's a new set of controls that come into play when your organization is standing in front of a judge.
[18:35.260 --> 18:43.500]  And that's a whole new set of personas, stories, requirements that will change behavior, set new priorities, and ultimately result in new investments.
[18:44.360 --> 18:50.200]  Now, this is true for all IT, but it's specifically true for application development.
[18:50.200 --> 18:54.460]  And applications themselves are extremely unique, right?
[18:54.840 --> 18:59.860]  So they're not in and of themselves IP, for example.
[19:00.140 --> 19:01.080]  They're a vessel.
[19:01.200 --> 19:04.420]  They include executable code when they're at rest.
[19:04.720 --> 19:08.160]  And when they're running, they almost always include data.
[19:08.800 --> 19:18.720]  And inside both code and data can be patented intellectual property, trade secrets, of course, which we're focusing on this evening.
[19:18.720 --> 19:20.560]  And copyrighted IP.
[19:20.820 --> 19:22.720]  And by the way, they're not mutually exclusive.
[19:23.300 --> 19:31.220]  In fact, the overlaying of trade secrets with soon to be patented IP is quite common.
[19:31.820 --> 19:39.880]  And besides IP asset management, there's all sorts of other governance and compliance issues around privacy, compliance, and other regulatory obligations.
[19:39.880 --> 19:50.440]  And the point here is we've introduced these frameworks, these concepts, these requirements, and we haven't even gotten to the actual point of developing software.
[19:50.700 --> 19:51.000]  Right?
[19:51.060 --> 19:55.940]  Applications are literally the workhorse for 21st century economy, right?
[19:56.300 --> 19:58.200]  Developers just want to develop.
[19:58.420 --> 20:00.820]  They don't want to have to deal with these issues.
[20:01.020 --> 20:04.300]  And so they rightfully ask, do we really need to change?
[20:04.940 --> 20:05.300]  Right?
[20:05.480 --> 20:12.080]  So what I'm going to talk about today, what I'm going to show you now, and now hopefully Alex has not jinxed me by twice praying to the gods.
[20:12.180 --> 20:14.000]  I think you have to do it three times or not at all.
[20:14.100 --> 20:15.680]  I think that's the rule, but we'll see.
[20:16.300 --> 20:20.480]  But so the point here is simultaneously do you have to change?
[20:20.940 --> 20:27.980]  And ultimately that's every organization's choice or subjective decision.
[20:27.980 --> 20:29.320]  What is their appetite for risk?
[20:29.900 --> 20:32.580]  But we want to talk about some of the issues they might want to think about.
[20:32.700 --> 20:34.140]  So I'm going to jump into the demos.
[20:34.460 --> 20:36.140]  And I've got a very simple application.
[20:36.600 --> 20:41.900]  It's an Android application called Account Manager because, I don't know, Account Manager seems like it could be sensitive, right?
[20:41.940 --> 20:42.860]  We're managing accounts.
[20:43.300 --> 20:47.900]  And we're going to start with just a standard APK, standard Android app.
[20:48.440 --> 20:50.460]  It has two sort of modes.
[20:50.620 --> 20:53.480]  You can log in with a Twitter account and there's no real ID.
[20:53.700 --> 20:55.140]  Each session is sort of independent.
[20:55.760 --> 20:57.540]  Or you can log in with credentials.
[20:57.540 --> 21:00.540]  And when you do that, you have access to all sorts of data.
[21:00.540 --> 21:02.700]  And you can change that data and save it.
[21:02.780 --> 21:05.000]  And so in this very simple demo, we're going to start...
[21:05.000 --> 21:06.200]  So there's two parts to the demo.
[21:06.360 --> 21:10.540]  The first part is I'm going to just take this fully formed executable.
[21:10.600 --> 21:12.180]  I'll just generate the source code from it.
[21:13.080 --> 21:19.420]  I'll attach a debugger and I'll show you how you can not only look at the data, but you can change the data and change its behavior.
[21:21.920 --> 21:25.180]  So the first thing I'm going to do is just show you the app.
[21:27.280 --> 21:29.220]  And it's called account manager.
[21:29.740 --> 21:31.660]  And so as I say, I can...
[21:31.660 --> 21:34.440]  Let's see if I can do this.
[21:34.960 --> 21:36.400]  I'm going to type in a password.
[21:36.660 --> 21:39.080]  And by the way, this is not a serious account.
[21:39.100 --> 21:42.940]  So the fact that some of you can quickly read my letters as I type them, I don't care.
[21:43.800 --> 21:44.200]  Okay.
[21:44.620 --> 21:45.460]  But I've logged in.
[21:45.660 --> 21:47.740]  And you can see I've got some account information.
[21:47.940 --> 21:48.740]  Ooh, very impressive.
[21:49.580 --> 21:51.160]  I can, you know, back out.
[21:51.320 --> 21:55.780]  And instead of doing that, I will get rid of my password.
[21:57.400 --> 22:01.220]  I will log in with a Twitter account.
[22:03.300 --> 22:05.360]  Oh, gotta be...
[22:05.980 --> 22:07.040]  Do I have to spell?
[22:09.660 --> 22:10.420]  There we go.
[22:10.580 --> 22:13.720]  And now you'll see as it pops up, you know, there's no information.
[22:13.900 --> 22:14.060]  Okay.
[22:14.200 --> 22:15.040]  So no big deal.
[22:15.420 --> 22:16.240]  That's the app.
[22:18.160 --> 22:22.940]  I am going to first bring up a free decompiler.
[22:24.420 --> 22:29.560]  I'm gonna bring up the actual source for it.
[22:32.670 --> 22:34.390]  Which, of course, I have not seen right now.
[22:34.510 --> 22:35.030]  But that's okay.
[22:36.150 --> 22:37.070]  I'll go to...
[22:46.810 --> 22:47.510]  Here we go.
[22:47.770 --> 22:49.150]  So here's the JAR file.
[22:49.310 --> 22:50.430]  This is the executable.
[22:51.310 --> 22:53.690]  And now I can't really see the bright lights here.
[22:53.830 --> 22:56.190]  Is there anyone here who has no programming expertise?
[22:56.630 --> 22:57.030]  Whatsoever.
[22:58.110 --> 22:59.250]  Can you raise your hand?
[23:00.570 --> 23:01.850]  Is somebody raising their hand?
[23:02.050 --> 23:03.250]  I think that's my wife.
[23:03.370 --> 23:03.590]  Okay.
[23:03.830 --> 23:03.890]  Good.
[23:04.070 --> 23:04.830]  Well, that'll count.
[23:05.010 --> 23:06.030]  So here's what I want you to do.
[23:06.150 --> 23:06.710]  Take your hand.
[23:07.130 --> 23:07.530]  Right?
[23:07.650 --> 23:08.450]  On the count of three, go this.
[23:08.750 --> 23:11.130]  One, two, three.
[23:11.550 --> 23:11.790]  Done.
[23:12.170 --> 23:12.410]  Okay.
[23:12.450 --> 23:16.450]  I've just taught you how to reverse engineer every Android app ever deployed.
[23:16.670 --> 23:16.910]  Okay?
[23:17.070 --> 23:17.810]  I'm serious.
[23:18.290 --> 23:18.690]  Right?
[23:18.830 --> 23:19.430]  Here it is.
[23:21.810 --> 23:22.210]  Right?
[23:22.210 --> 23:22.370]  Right?
[23:22.630 --> 23:23.130]  Here we go.
[23:23.230 --> 23:23.350]  Yeah.
[23:23.750 --> 23:24.290]  That's right.
[23:24.290 --> 23:25.670]  That's a whole other story.
[23:25.870 --> 23:26.250]  Right?
[23:26.370 --> 23:29.570]  So I can go down here and I can just open up, you know, a menu item.
[23:29.770 --> 23:31.990]  And, you know, here's all the code and I can see all the logic.
[23:32.150 --> 23:33.270]  So now I've got the source.
[23:33.570 --> 23:33.970]  Okay?
[23:34.170 --> 23:45.530]  And there's plenty of documentation online, widely available, how to take that source and load it up into a development tool.
[23:45.530 --> 23:46.150]  Okay?
[23:46.770 --> 23:50.670]  And so now what I'm going to do is I'm going to attach a debugger to it.
[23:52.470 --> 23:52.830]  Okay?
[23:54.010 --> 23:55.230]  I'm going to come back in here.
[23:57.150 --> 23:57.930]  Still running it.
[23:58.030 --> 23:58.910]  I'm going to type in it.
[23:58.930 --> 24:04.530]  And as you recall, if I type in, you know, just any old Twitter account.
[24:05.490 --> 24:05.890]  Oops.
[24:06.390 --> 24:07.830]  Actually, I want to log back in.
[24:07.970 --> 24:08.770]  That's what I want to do.
[24:09.690 --> 24:10.230]  There we go.
[24:10.950 --> 24:11.050]  Right?
[24:11.170 --> 24:12.330]  There's any old Twitter account.
[24:12.890 --> 24:14.010]  I'm going to log in.
[24:16.290 --> 24:17.870]  But now I've set a break point.
[24:18.250 --> 24:24.030]  Because what I did was I studied the source to figure out after it checks to see what type of account it is.
[24:24.550 --> 24:24.950]  Right?
[24:25.390 --> 24:28.390]  But before, you know, and so I passed the password threshold.
[24:28.610 --> 24:29.950]  But before it does anything.
[24:30.190 --> 24:33.270]  And so I'm just going to simply go over here to where it says user name.
[24:33.390 --> 24:34.230]  This is what I typed in.
[24:34.350 --> 24:35.810]  And I can change the data.
[24:37.950 --> 24:38.350]  Right?
[24:38.410 --> 24:39.450]  So I'm going to set the value.
[24:43.620 --> 24:44.220]  Oh, well.
[24:44.340 --> 24:44.820]  That didn't work.
[24:44.960 --> 24:45.640]  I'll just type it in.
[24:53.060 --> 24:53.460]  Right?
[24:53.520 --> 24:58.930]  So there's no, oh, forgot quotes.
[24:59.990 --> 25:01.570]  That's why I like to do cut and paste.
[25:01.570 --> 25:02.930]  So I don't make mistakes like that.
[25:09.980 --> 25:10.500]  Right?
[25:10.780 --> 25:13.300]  So there, foo, that example.
[25:14.780 --> 25:17.040]  I rehearsed everything but doing it in the dark.
[25:17.440 --> 25:17.940]  Okay.
[25:18.040 --> 25:18.720]  So here I am.
[25:18.880 --> 25:19.180]  Okay?
[25:19.320 --> 25:20.420]  So I've changed that value.
[25:20.700 --> 25:22.480]  And so now I'm just going to say continue.
[25:23.180 --> 25:23.700]  Right?
[25:24.020 --> 25:25.380]  So I come back in here.
[25:25.600 --> 25:37.220]  And lo and behold, instead of after typing in a random Twitter account and getting nothing, by overwriting that value, I'm now in with full privileges to change that account.
[25:38.240 --> 25:38.720]  Right?
[25:38.840 --> 25:39.800]  So I got source code.
[25:39.960 --> 25:40.860]  I got logic.
[25:41.080 --> 25:42.040]  I got data.
[25:42.200 --> 25:43.060]  And I have privilege.
[25:44.800 --> 25:45.280]  Okay?
[25:46.660 --> 25:48.580]  So now let's go back to the PowerPoint.
[25:48.760 --> 25:49.340]  That's part one.
[25:49.720 --> 25:50.940]  So I come back here.
[25:51.940 --> 25:52.420]  Right?
[25:52.780 --> 25:56.660]  So let's go back to Alex's point about reasonable means of protection.
[25:57.900 --> 26:03.520]  Clearly, every business has a right to not be crushed by the burdens of compliance.
[26:03.520 --> 26:04.660]  It has to be easy.
[26:04.760 --> 26:05.680]  It has to be recognized.
[26:05.680 --> 26:10.040]  It has to be, you know, appropriate to the risk and the obligation.
[26:10.380 --> 26:15.900]  So obfuscation is a very basic and one of the things that we'll talk about.
[26:16.060 --> 26:18.440]  But it's a very basic level of protection.
[26:18.660 --> 26:24.200]  And quick definition, it transforms the executable to basically make it harder to do what I just did.
[26:24.320 --> 26:24.720]  Okay?
[26:24.720 --> 26:27.080]  And there's a variety of different transforms.
[26:27.400 --> 26:28.980]  I'm not going to go into that this evening.
[26:29.160 --> 26:33.120]  Again, similar to Alec, if you'd like to offline afterwards, go into it.
[26:33.200 --> 26:33.880]  Happy to do it.
[26:34.280 --> 26:35.800]  The point is there's a bunch of them.
[26:36.020 --> 26:36.220]  Okay?
[26:36.660 --> 26:43.560]  But what's more important is that this gap I just showed you, it's not an accident.
[26:43.560 --> 26:51.320]  It's actually kind of the design of the platform, but any Java, any .NET, any Android, increasingly iOS.
[26:51.660 --> 27:00.420]  And so as a result of this well understood gap, Android, Oracle give away a free obfuscator, ProGuard.
[27:01.480 --> 27:05.720]  Microsoft gives away a free obfuscator, a community edition of obfuscator.
[27:05.860 --> 27:17.920]  And while Apple isn't quite so supportive in that regard, there are plenty of open-source, GitHub base, free obfuscators, PPIOS, rename is one of those.
[27:18.640 --> 27:21.380]  And so, you know, what you see here...
[27:21.380 --> 27:34.720]  I'll interject to say, it's too humble actually probably to mention it, but two of those, he and his company have actually created these two obfuscators, the obfuscator and the PPIOS.
[27:36.840 --> 27:38.580]  He won't say it, but I will.
[27:38.580 --> 27:40.440]  So, there you go.
[27:41.380 --> 27:50.860]  So, the key point though, right, free, widely available, distributed either through GitHub or by the IDE supplier, Microsoft, right?
[27:50.980 --> 27:53.440]  So, in those two cases, and ProGuard through the other.
[27:53.600 --> 27:55.600]  So, but the key, so thank you, Alex.
[27:57.300 --> 27:59.300]  My mom couldn't make it, so...
[28:03.160 --> 28:06.820]  But, you know, the key here, getting back to what a judge might think, right?
[28:07.060 --> 28:09.100]  Imagine saying, look, this is well understood.
[28:09.380 --> 28:10.840]  Everybody knows this is a problem.
[28:10.940 --> 28:12.160]  It's a common practice.
[28:12.920 --> 28:18.400]  It's recognized control so much so that it's given away for free by the very owners of the platform.
[28:18.400 --> 28:33.580]  So, if you don't even care enough to put a two-foot, two-inch wall around any IP that is in the software, don't tell me that it's valuable and you treated it as a secret.
[28:36.720 --> 28:37.040]  Right?
[28:37.260 --> 28:39.560]  So, now we're going to do one more demo, right?
[28:39.820 --> 28:41.080]  So, now we're going to do the alternative.
[28:41.260 --> 28:42.580]  Because remember, there's two criteria, right?
[28:42.620 --> 28:47.420]  We want to stop that from being so easy, but we have to do it in a way that's not burdensome.
[28:47.540 --> 28:53.560]  And so, what I'm going to do is quickly obfuscate, inject the debug detection, and we'll get to the second bullet in a second.
[28:55.020 --> 28:57.900]  So, first thing I'm going to do is I'm going to go to...
[29:02.090 --> 29:03.110]  Is this the right one?
[29:05.230 --> 29:06.230]  I believe so.
[29:06.230 --> 29:10.470]  So, the first thing I'm going to do is I'm going to build a new APK.
[29:12.190 --> 29:12.570]  Right?
[29:12.730 --> 29:13.830]  And so, as it's running...
[29:13.830 --> 29:15.010]  And I'll go into the messages.
[29:16.150 --> 29:17.130]  You can see...
[29:17.130 --> 29:18.270]  So, bottom line is you'll...
[29:18.270 --> 29:20.350]  I haven't touched any code is the key point there.
[29:20.470 --> 29:26.390]  Don't worry about all the little messages, but it's saying the dash o, which is the obfuscator that we're using.
[29:27.430 --> 29:28.510]  It did its thing.
[29:29.150 --> 29:29.530]  Okay?
[29:29.750 --> 29:34.030]  So, now I'm going to go back, clean up my mess, first of all.
[29:34.030 --> 29:36.530]  It's a new version, so I'm going to get out of here.
[29:37.850 --> 29:39.510]  Quickly uninstall it.
[29:41.010 --> 29:41.690]  Dip.
[29:43.430 --> 29:44.510]  Try that again.
[29:46.110 --> 29:47.970]  Quickly is the keyword.
[29:48.370 --> 29:49.030]  Uninstall it.
[29:50.290 --> 29:50.850]  Okay?
[29:51.790 --> 29:55.350]  So, now I'll go back to terminal.
[29:57.290 --> 29:57.770]  Yes.
[29:58.370 --> 29:59.710]  Remember that command at least.
[30:00.450 --> 30:00.530]  Okay?
[30:01.050 --> 30:01.630]  So, we're back.
[30:01.890 --> 30:02.290]  Okay?
[30:02.550 --> 30:07.230]  But before I jump back, let me go into this again.
[30:07.550 --> 30:09.970]  Let me close the source code that was so easy to see.
[30:14.100 --> 30:15.800]  Let me go...
[30:18.040 --> 30:18.480]  Here.
[30:18.680 --> 30:20.320]  I'm going to go to...
[30:20.320 --> 30:21.300]  Let's see at the back.
[30:21.940 --> 30:22.680]  There we go.
[30:23.280 --> 30:23.780]  I believe.
[30:36.680 --> 30:37.120]  Sorry.
[30:37.340 --> 30:38.020]  Lost my context.
[30:38.400 --> 30:40.740]  So, now again, same wave of the hand.
[30:40.900 --> 30:42.560]  All of you reverse engineering experts.
[30:42.980 --> 30:43.360]  Okay?
[30:43.480 --> 30:44.620]  So, that stuff still works.
[30:44.860 --> 30:53.580]  But now, if you look, instead of seeing like menu item, you see, you know, completely candidly obfuscated, things that are hard to read.
[30:54.340 --> 30:54.700]  Okay?
[30:54.960 --> 30:57.340]  Since I can't see exactly what I'm doing, I don't know.
[30:59.580 --> 31:01.120]  You know, everything is obfuscated.
[31:01.140 --> 31:02.200]  You can actually have some fun.
[31:02.400 --> 31:04.220]  You can put unprintable characters.
[31:04.960 --> 31:05.620]  You can...
[31:05.620 --> 31:06.580]  So, you can't even show it.
[31:06.840 --> 31:13.420]  You could put, you know, famous New York Yankee baseball players as your character set.
[31:13.540 --> 31:16.820]  And all of your methods would be named Babe Ruth and Lou Gehrig or whatever.
[31:17.180 --> 31:17.920]  But the point is...
[31:17.920 --> 31:19.440]  So, there's the first part.
[31:19.820 --> 31:20.180]  Okay?
[31:20.180 --> 31:22.360]  But let's just say I could load this up.
[31:22.760 --> 31:24.220]  Or maybe I have the source code somewhere else.
[31:24.380 --> 31:24.900]  It doesn't matter.
[31:25.420 --> 31:29.180]  What I'm going to do now is I'm going to go back in here.
[31:29.980 --> 31:30.600]  I'm going to run it again.
[31:30.740 --> 31:31.280]  It's the same app.
[31:31.380 --> 31:32.560]  It behaves exactly the same.
[31:33.940 --> 31:34.340]  Okay?
[31:34.660 --> 31:40.180]  But before I log in and do my trick, once again, I'll log in to...
[31:40.900 --> 31:42.060]  I'll start the debugger.
[31:45.140 --> 31:46.560]  Let's go over here.
[31:48.760 --> 31:49.240]  Right?
[31:49.520 --> 31:50.920]  So, I'm going to attach the debugger again.
[31:57.040 --> 31:58.040]  Go back here.
[31:58.760 --> 31:58.940]  Right?
[31:59.280 --> 32:01.360]  So, now I'm going to do the same old trick.
[32:01.700 --> 32:06.320]  I'm planning on stopping it, right?
[32:06.440 --> 32:07.120]  At my break point.
[32:07.740 --> 32:11.320]  But now what's going to happen is it stopped me.
[32:11.320 --> 32:16.040]  Because, one, I detected the attachment of a debugger.
[32:16.500 --> 32:17.140]  And you can put...
[32:17.140 --> 32:20.220]  There's default behaviors to random exceptions, bomb, whatever.
[32:20.520 --> 32:24.060]  But you can inject whatever you need to with no programming.
[32:24.520 --> 32:26.500]  So, I've dimmed for sort of fun, right?
[32:26.620 --> 32:28.180]  Run ransomware now or later.
[32:29.060 --> 32:29.160]  Right?
[32:29.660 --> 32:30.520]  Wipe the drive.
[32:30.700 --> 32:32.760]  These are two things we won't actually do on my machine.
[32:34.040 --> 32:35.300]  I don't feel lucky.
[32:35.740 --> 32:36.280]  If I'm feeling...
[32:36.280 --> 32:37.880]  This actually really slows everything down.
[32:38.080 --> 32:39.360]  I'm not going to do that in the middle of a demo.
[32:39.860 --> 32:42.420]  But, just for fun, I can tweet shame myself.
[32:43.440 --> 32:43.520]  Right?
[32:43.720 --> 32:44.560]  Hit it two...
[32:44.560 --> 32:45.260]  There we go.
[32:46.600 --> 32:47.020]  Right?
[32:47.300 --> 32:47.860]  Did it read it?
[32:48.020 --> 32:48.320]  Yes.
[32:48.620 --> 32:49.540]  So, if you're...
[32:49.540 --> 32:50.120]  If you're...
[32:50.120 --> 32:59.960]  Do a quick search on hashtag no Android debug for me, you will see I actually literally just tweeted the fact that I've attached a production debugger.
[32:59.960 --> 33:00.540]  Right?
[33:00.680 --> 33:01.820]  So, you can do notifications.
[33:02.140 --> 33:02.820]  You can do analytics.
[33:03.080 --> 33:04.220]  You can do defensive actions.
[33:04.380 --> 33:05.420]  And you can make them appropriate.
[33:06.700 --> 33:07.100]  Okay?
[33:07.480 --> 33:08.740]  So, let's just jump back.
[33:09.540 --> 33:09.920]  Right?
[33:09.940 --> 33:18.280]  So, the key here is, you know, aside from putting barriers up at every step of the way, I'm doing it in a way that does not impact developers.
[33:19.360 --> 33:20.160]  It's automated.
[33:20.160 --> 33:21.640]  So, that's key for compliance.
[33:21.840 --> 33:27.520]  And if you have multiple development teams, however you want to manage that risk, you do it consistently because that's a critical point.
[33:29.840 --> 33:31.960]  So, I'm going to hand it over.
[33:32.020 --> 33:32.500]  All right.
[33:33.000 --> 33:33.320]  Fantastic.
[33:34.300 --> 33:36.080]  I guess it was two times you say it.
[33:36.400 --> 33:36.720]  Exactly.
[33:37.140 --> 33:37.520]  Yeah, I think so.
[33:37.520 --> 33:37.760]  You were right.
[33:38.320 --> 33:39.060]  I'm amazing.
[33:39.160 --> 33:39.780]  That actually worked.
[33:40.780 --> 33:41.460]  Good job.
[33:41.740 --> 33:42.080]  Thank you.
[33:42.580 --> 33:46.740]  So, you know, what happens when it hits the fan, quite literally?
[33:46.740 --> 34:02.100]  You know, let's say you, you know, your trade secrets have been compromised and you need to start an action to actually try to recover damages from the, you know, let's say it was a breach.
[34:02.200 --> 34:03.080]  Somebody popped your system.
[34:03.200 --> 34:07.780]  Somebody reverse engineered your particular source code and your trade secrets are actually stolen.
[34:07.780 --> 34:25.520]  And the way in which the courts have handled these types of actions have been really sort of lax because ever since really the 70s, the courts have said, well, this isn't the kind of thing where that is immediately susceptible to direct evidence or direct proof that somebody,
[34:25.520 --> 34:30.300]  you know, reverse engineered something or somebody walked away with your trade secrets.
[34:30.520 --> 34:42.840]  So they're very lax about the type of evidence that you can put forward in order to prove that something has been misappropriated, that trade secrets have been misappropriated.
[34:43.540 --> 35:03.660]  And that is actually, I think, extremely important here because you can make a pretty, you can make a very, very valid claim essentially that something had happened just on the basis of circumstantial evidence, that courts would be willing to find in favor of somebody who owns a trade secret,
[35:03.780 --> 35:11.520]  who had it compromised on the basis of something less than direct evidence, less than clear and convincing, just circumstantial kind of clear and convincing evidence.
[35:11.820 --> 35:17.040]  That is, you know, circumstantial evidence basically of similarity should be enough.
[35:17.200 --> 35:31.380]  So it's kind of dangerous to think that you could, or crazy to think you could have a judgment ...against you for reverse engineering a piece of software without any direct evidence that you had misappropriated particular trade secrets.
[35:31.680 --> 35:39.300]  But here's where I think the discovery process and litigation is actually really instructive.
[35:39.640 --> 35:46.400]  And since, as we established, you guys are way too handsome to be lawyers here, we will talk about that a little bit here.
[35:46.400 --> 35:51.780]  But, you know, when you're... let's say your company, you're compromised and you're trying to enforce your rights.
[35:51.780 --> 36:00.000]  If you go into a litigation, you are going to have to be subject to probably, first, a motion to dismiss.
[36:00.340 --> 36:04.420]  And a motion to dismiss will probably say, what you have is not a trade secret.
[36:04.760 --> 36:12.200]  And this was so goddamn easy to reverse engineer that they obviously didn't give a shit about their software.
[36:13.380 --> 36:15.700]  And you don't want to be in that position.
[36:15.700 --> 36:16.920]  You definitely don't.
[36:17.020 --> 36:22.100]  But then, let's say you survive a motion to dismiss, then you're going to have the discovery process.
[36:22.480 --> 36:29.380]  And you're going to have to... and in the U.S. and the U.K., we have very, very wide and broad discovery obligations.
[36:29.600 --> 36:40.280]  Which means that, again, if I was suing Sebastian, he could come back to me and say, well, you survived my motion to dismiss, I'm going to make a motion for summary judgment.
[36:40.580 --> 36:44.620]  Which means that there are no material issues of fact for a jury to decide.
[36:44.860 --> 36:47.320]  This can be decided on the basis of the law.
[36:47.640 --> 36:51.580]  And that basis in law would be, you don't have a trade secret.
[36:51.580 --> 36:57.000]  So he's going to seek discovery from me that is targeted to what my knowledge was about my threats.
[36:57.260 --> 36:59.460]  And that's where that can really work against you.
[36:59.460 --> 37:04.920]  Because if you knew, again, going back to what we had originally discussed, if you knew that your...
[37:05.640 --> 37:07.680]  I hate this word, but I'm going to use it.
[37:07.760 --> 37:24.120]  But that your threat vector was such that you should have anticipated people trying to reverse engineer your software, either, you know, in China or elsewhere, in Russia, that there were going to be people that were very interested in gaining a competitive advantage from your own IP,
[37:24.120 --> 37:29.240]  then you should have had something stronger in place to protect against that.
[37:29.840 --> 37:34.020]  Or, as Sebastian put it, you should have at least had, you know, a two-inch wall.
[37:34.240 --> 37:43.140]  Something that was very, you know, simple for you to accomplish without necessarily impacting, you know, your DevOps processing.
[37:43.740 --> 37:54.100]  So, the litigation at this point, I think really is going to be about, you know, whether or not something can qualify as a trade secret.
[37:54.100 --> 37:55.400]  At the federal level.
[37:55.540 --> 37:58.680]  And I think we're going to see a lot of litigation about that definition.
[37:58.940 --> 38:01.860]  And I think we will probably see circuit splits about this.
[38:02.160 --> 38:11.140]  But I think the common denominator in it is that, you know, everything is going to probably rely upon what were these reasonable means of protection.
[38:12.960 --> 38:14.060]  Did you want to talk about this?
[38:14.380 --> 38:14.480]  Yeah.
[38:14.660 --> 38:14.720]  Okay.
[38:14.840 --> 38:15.180]  Fantastic.
[38:17.740 --> 38:18.280]  All right.
[38:18.460 --> 38:21.920]  So, again, bringing it back to what you can do about it.
[38:23.080 --> 38:24.960]  So, the first thing...
[38:24.960 --> 38:29.620]  And these are fairly generic risk management steps.
[38:29.760 --> 38:31.660]  They can apply to almost any category.
[38:32.140 --> 38:34.720]  But they need to be applied to this category.
[38:35.040 --> 38:35.420]  Right?
[38:35.520 --> 38:51.900]  First, you know, you have to assess the materiality of what trade secrets, what other types of IP is in your software, what other compromises are possible, and what is the actual risk specifically, and what is your company's appetite for it.
[38:51.900 --> 38:52.500]  Right?
[38:52.600 --> 39:00.280]  Because some companies say, you know, smaller entrepreneurial companies, they tend to have, you know, absorb and be comfortable with a lot more risk.
[39:00.480 --> 39:00.920]  Right?
[39:01.020 --> 39:04.140]  Than other types of companies, just as an anecdote.
[39:04.900 --> 39:07.200]  And however you do it, though, you need to be consistent.
[39:07.980 --> 39:08.300]  Right?
[39:08.440 --> 39:11.260]  And you have to, you know, have measured responses.
[39:11.520 --> 39:13.900]  You have to manage those risks proportionately.
[39:13.900 --> 39:15.760]  And again, there's the old cliche.
[39:15.980 --> 39:18.360]  You don't have to be the fastest running from a bear.
[39:18.680 --> 39:18.760]  Right?
[39:18.880 --> 39:19.960]  Just not the slowest.
[39:20.400 --> 39:20.720]  Right?
[39:20.920 --> 39:24.740]  So, this is not, you know, where you want to innovate is in your business.
[39:24.900 --> 39:25.060]  Right?
[39:25.120 --> 39:26.520]  Or in your development processes.
[39:26.820 --> 39:28.520]  And, you know, that's where you want to innovate.
[39:28.520 --> 39:33.500]  Here, you just need to use well understood, accepted practices.
[39:33.840 --> 39:34.140]  Right?
[39:34.240 --> 39:38.700]  The goal here is to facilitate successful prosecution.
[39:39.480 --> 39:39.800]  Right?
[39:39.860 --> 39:42.940]  The goal here, you know, there's other steps to keep bad things from happening.
[39:43.100 --> 39:44.360]  That's not what we're talking about.
[39:44.600 --> 39:45.020]  Right?
[39:45.020 --> 39:48.800]  And you want to minimize the impact of risk management to the rest of what you do.
[39:48.940 --> 39:52.740]  So, it has to fit into your existing development processes, deployment processes.
[39:53.100 --> 39:53.500]  Right?
[39:53.700 --> 39:59.580]  And you have to care about not just the technology and the quality of any technology included in these controls.
[39:59.820 --> 40:00.160]  Right?
[40:00.240 --> 40:02.580]  But also, you know, if it's open-source, great.
[40:02.760 --> 40:05.740]  If it's getting it from a vendor, you know, what's the vendor viability?
[40:06.880 --> 40:18.600]  And, you know, to the extent that this seems like something that, you know, like healthy diet and good exercise, something everybody can agree everyone should do, but just not this week.
[40:19.440 --> 40:23.220]  Keep in mind that no policy is a policy.
[40:24.120 --> 40:27.320]  So, you have done it, whether you like it or not.
[40:27.420 --> 40:28.420]  You have a policy.
[40:28.520 --> 40:32.200]  But when it's no policy, that really never ends well.
[40:32.760 --> 40:33.240]  Right?
[40:33.460 --> 40:36.500]  And I do, we have one more slide, I think.
[40:36.600 --> 40:45.100]  But I do want to just, I was kicking myself as I sat down because on the demo part, I want to point out one other thing.
[40:45.380 --> 40:45.440]  Right?
[40:45.520 --> 40:52.300]  We had this great defense when a debugger was attached.
[40:52.580 --> 40:55.160]  But if I exit entirely and say, I'm never doing that again.
[40:56.160 --> 40:57.940]  I'm just going to go in without a debugger.
[40:58.200 --> 41:02.260]  You can actually, just the way you can brick a device, you can brick your app.
[41:03.400 --> 41:03.760]  Right?
[41:03.820 --> 41:08.660]  So, you can say, hey, literally this app is in the hands of someone hostile.
[41:09.840 --> 41:10.240]  Right?
[41:10.520 --> 41:12.900]  So, I don't really care what they do from now on.
[41:13.140 --> 41:13.560]  They're done.
[41:14.960 --> 41:15.360]  Right?
[41:15.840 --> 41:17.620]  So, anyway, I just wanted to sort of point that out.
[41:17.680 --> 41:27.020]  So, again, however you think you need a control, you just want the technology to be able to support your requirements and your workflow.
[41:27.220 --> 41:29.640]  So, sorry about that, but I thought that was sort of an important point.
[41:30.400 --> 41:35.060]  And I think we had one more slide that I was going to ask, hoping that Alex would cover for us.
[41:35.280 --> 41:35.680]  Sure.
[41:35.980 --> 41:36.160]  Sure.
[41:36.420 --> 41:36.660]  Yeah.
[41:36.840 --> 41:38.440]  I just, he looked way too comfortable.
[41:38.440 --> 41:39.360]  So, I had to...
[41:39.360 --> 41:40.000]  Yeah, exactly.
[41:40.380 --> 41:40.800]  I know.
[41:41.240 --> 41:41.640]  Yeah.
[41:41.920 --> 41:45.280]  That root beer, beer is, I don't know, not the best.
[41:46.980 --> 41:47.380]  Yeah.
[41:48.820 --> 41:48.840]  Yeah.
[41:49.300 --> 41:49.700]  Yeah.
[41:49.820 --> 41:50.580]  And so, apparently...
[41:50.580 --> 41:51.960]  I got lots of America for you.
[41:51.980 --> 41:52.580]  Oh, that's right.
[41:52.700 --> 41:54.160]  America beer we got for you.
[41:54.500 --> 41:55.120]  I don't know.
[41:55.180 --> 41:56.360]  I'm surprised that didn't go.
[41:56.360 --> 41:57.020]  Oh, my God.
[41:58.780 --> 42:02.080]  Anyhow, I do think that was an interesting point that he made, that you can break the app.
[42:02.200 --> 42:06.100]  But he forgot to mention that that doesn't work if you're handsome.
[42:06.660 --> 42:08.340]  So, you cannot break...
[42:08.780 --> 42:10.680]  That's why it would work for me, is what you're trying to say.
[42:10.860 --> 42:11.300]  Exactly.
[42:11.640 --> 42:11.800]  Yeah.
[42:11.880 --> 42:13.120]  For him, it wouldn't work.
[42:14.580 --> 42:15.020]  Yeah.
[42:15.620 --> 42:16.060]  Exactly.
[42:17.280 --> 42:27.140]  Anyhow, I think to wrap it up here, one point in addition to the stuff on the slide that I want to make, too, is that we're constantly using the word company here.
[42:27.520 --> 42:30.280]  And maybe, you know, we should be using other words as well.
[42:30.280 --> 42:33.100]  Because it's not just about protecting companies.
[42:33.100 --> 42:34.020]  We're hackers here.
[42:34.080 --> 42:34.600]  We're makers.
[42:34.740 --> 42:35.240]  We're doers.
[42:35.280 --> 42:37.100]  We create our own things.
[42:37.100 --> 42:40.240]  And we need to understand where the law and the technology...
[42:40.240 --> 42:43.220]  And another word that I absolutely hate this phrase, where they collide.
[42:43.220 --> 42:43.600]  Right?
[42:43.800 --> 42:45.400]  So, reverse engine...
[42:45.400 --> 42:45.700]  I'm sorry.
[42:46.100 --> 42:56.200]  Software obfuscation, if used by hackers and makers and doers, will help you survive that collision of law and technology, if you understand it, from the outset.
[42:56.740 --> 42:57.760]  And you have...
[42:57.760 --> 43:00.800]  And you're forward thinking about this, and you have the foresight to do it.
[43:00.980 --> 43:14.340]  So, in thinking about that, when we are developing things, when companies are developing things, when individuals are developing things, you really have to think about what the value of what you are developing is, either to your company or to you as a person,
[43:14.480 --> 43:17.280]  to you as an entrepreneur, as a maker.
[43:18.480 --> 43:23.540]  And is it going to be valuable to you to hold onto it as well?
[43:23.640 --> 43:26.900]  So, you really need to identify where those trade secrets are.
[43:27.000 --> 43:27.600]  What are you doing?
[43:27.740 --> 43:30.560]  What's the most valuable in this process?
[43:30.740 --> 43:34.220]  Flag it, register it, and create processes around that.
[43:34.340 --> 43:40.660]  And I think it's very important to understand that these reasonable means are going to be evolving very quickly in the federal court system.
[43:40.660 --> 43:47.440]  No longer do we have this patchwork of state legislation and the unpredictability of state court judges.
[43:47.780 --> 43:51.020]  I think the law on this is going to be developing very, very rapidly.
[43:51.120 --> 43:54.520]  And we need to take account of this, and we need to take advantage of it, frankly.
[43:55.080 --> 44:03.080]  And I think, Sebastian pointed out, it's extremely easy to debug a piece of software and reverse engineer it.
[44:03.080 --> 44:07.140]  And when we are developing our own things, we really need to be mindful of that.
[44:07.880 --> 44:13.000]  And I think that's really about all I have to say at the moment.
[44:13.000 --> 44:18.480]  I think we may have a few more minutes for questions, if anybody has any questions.
[44:18.840 --> 44:20.420]  But I thank you for listening.
[44:20.580 --> 44:22.540]  It's extremely hard to see, but I see somebody big.
[44:22.980 --> 44:23.320]  Thank you.
[44:29.480 --> 44:30.960]  I have two questions.
[44:31.760 --> 44:32.080]  The first...
[44:32.600 --> 44:33.180]  Oh, there we go.
[44:33.420 --> 44:36.960]  The first is, Alex, let's say you have an app.
[44:37.700 --> 44:39.480]  Sebastian is very crafty.
[44:39.680 --> 44:41.600]  He comes to hacker conferences.
[44:42.160 --> 44:44.500]  So what he does is he hires me, George.
[44:45.560 --> 44:46.760]  I hack your app.
[44:46.920 --> 44:47.760]  I reverse engine it.
[44:47.880 --> 44:49.840]  And I publish it everywhere.
[44:50.520 --> 44:52.820]  So now it's not a secret, right?
[44:52.820 --> 44:53.700]  I published it.
[44:54.120 --> 45:00.060]  Now Sebastian, crafty guy that he is, comes up with an app, does the same thing as you.
[45:00.340 --> 45:02.360]  You know, obviously we don't have records.
[45:02.560 --> 45:03.500]  No financial records here.
[45:04.040 --> 45:06.100]  You know, does the same thing your app does.
[45:06.400 --> 45:09.740]  And then you try and sue him because you're, you know, it's the same thing.
[45:09.740 --> 45:12.180]  And he's like, well, it's all over the Internet.
[45:12.480 --> 45:13.600]  It's not a secret anymore.
[45:14.600 --> 45:14.700]  Yeah.
[45:15.200 --> 45:15.400]  Yeah.
[45:15.580 --> 45:18.560]  I mean, that's obviously, that's a, that you just described the exact situation.
[45:18.560 --> 45:23.080]  I think that, you know, it's like the worst case scenario, you know, for, for everybody.
[45:23.360 --> 45:29.780]  And, you know, the person who hired the person to do this would, you know, let's say that they were under a duty of confidentiality.
[45:30.480 --> 45:31.720]  They had access to the trade secrets.
[45:32.040 --> 45:34.560]  They'd be a defendant in the lawsuit, obviously.
[45:34.560 --> 45:40.820]  But let's say that they didn't have deep pockets or wasn't worth pursuing litigation against them because they were judgment proof.
[45:41.480 --> 45:46.800]  You know, then I, you know, I hate to say it, I wish there was a more awful way of saying it, but then the developer is shit out of luck.
[45:47.340 --> 45:49.800]  You know, there's, then what are your damages, essentially?
[45:49.800 --> 45:52.900]  Even punitive damages would really do, do nothing.
[45:53.200 --> 46:03.820]  So, that's why, I think, you know, your first question is, has underscored the need for, I think, really effective source code obfuscation if there, you have something that you want to protect.
[46:04.140 --> 46:13.080]  Because otherwise, it becomes really, really difficult and burdensome and cumbersome and expensive to try to rely on the legal process to recover what was lost.
[46:13.080 --> 46:14.720]  Unless, do you have anything else to...
[46:14.720 --> 46:25.620]  Well, what I'm saying is that it's sort of a, sort of a self-destruct, a mutual self, mutual destruction, because the value of a trade secret is that it's secret.
[46:25.940 --> 46:30.740]  So, if I steal a trade secret, say it's diet, say it's the Coke formula, right?
[46:31.360 --> 46:36.140]  If I were to publish it everywhere, yeah, sure, you know, I've done just what you said.
[46:36.140 --> 46:42.720]  But the real value would be to keep it secret, but just to come up with my own version of Coke, right?
[46:42.860 --> 46:51.440]  So, at some level, yes, somebody could go in and just destroy trade secrets, and it would be an interesting conundrum, right?
[46:52.320 --> 47:00.680]  But the classic trade secret is the person who steals it, or ultimately receives it, wants to keep it secret and get some of that value for themselves.
[47:00.680 --> 47:01.360]  Right.
[47:02.000 --> 47:07.340]  And just kind of, in that example, if you were Pepsi, you wouldn't care if Coke secret was out there.
[47:07.680 --> 47:08.160]  Right.
[47:08.340 --> 47:09.920]  You'd still have yours, you know?
[47:10.160 --> 47:10.320]  Mm-hmm.
[47:10.320 --> 47:11.800]  But, so that's fine.
[47:11.980 --> 47:16.260]  And then the other thing is, is that you haven't really discussed it, which I was a little surprised.
[47:16.560 --> 47:18.800]  What about clean room implementations?
[47:19.160 --> 47:30.200]  Like, for instance, Google Sun, we've probably heard of that, you know, where Google essentially sandboxed a team and said, you know, here's, here's where you got to get.
[47:30.200 --> 47:31.040]  Here's the API.
[47:31.200 --> 47:31.940]  Here's where you got to get.
[47:32.080 --> 47:32.240]  Go.
[47:32.460 --> 47:34.160]  Well, he did it very quickly.
[47:34.360 --> 47:38.500]  It's in the definition of exceptions to improper means.
[47:38.700 --> 47:40.920]  So, reverse engineering was one exception.
[47:41.900 --> 47:43.300]  Independent derivation was another.
[47:44.220 --> 47:44.480]  Got it.
[47:44.480 --> 47:45.920]  So, yeah, we didn't focus on it.
[47:46.020 --> 47:46.420]  It was quick.
[47:46.740 --> 47:46.780]  That's right.
[47:46.780 --> 47:47.940]  But, yeah, that's in the law.
[47:48.300 --> 47:49.160]  Excellent questions.
[47:49.860 --> 47:50.400]  Thank you.
[47:50.680 --> 47:50.980]  Excellent.
[47:51.080 --> 47:51.420]  Thank you.
[47:51.540 --> 47:52.720]  I think we have a couple more.
[47:52.960 --> 47:53.900]  Do we have some more time?
[47:54.120 --> 47:54.760]  I think so.
[47:55.680 --> 47:56.180]  All right.
[47:56.360 --> 47:56.720]  Excellent.
[48:00.060 --> 48:07.180]  So, section 1201 of the DMCA has been used for many things that go way above and beyond the traditional scope of copyright.
[48:07.500 --> 48:20.360]  I wondered if the DTSA, if there's any, if there's any feeling that maybe the DTSA would go beyond the normal scope of trade secret that we consider today, would it become another nightmare in the same way that section 1201 has become?
[48:20.360 --> 48:20.840]  Yeah.
[48:21.200 --> 48:22.620]  I can answer that.
[48:22.760 --> 48:32.900]  I think, I think the, the most dangerous way in which the DTSA can be misused is through the ex parte seizure orders.
[48:33.620 --> 48:55.940]  And that, you know, if the, you know, if you can make an ex parte application to a judge that I should be able to seize your equipment and go into your home and execute essentially judicial order to take your things, that's an extremely scary proposition to have given the competitive nature of the technology industry that exists today.
[48:56.140 --> 48:58.520]  And this is getting more and more competitive as things go on.
[48:59.880 --> 49:13.040]  One of the things actually, Sebastian and I were talking about earlier today was that the Federal Judicial Center over the next several years is going to be thinking about, you know, how this particular ex parte seizure order has been years, used over the last two years,
[49:13.100 --> 49:15.500]  well, two years out from now, they're going to be creating this report.
[49:15.660 --> 49:18.080]  They're going to be looking at how it was used, how it was misused.
[49:18.260 --> 49:26.320]  I think it's extremely important that we all keep track of how this is used and possibly misused because that should go into that Federal Judicial Center report.
[49:26.440 --> 49:30.420]  If it becomes a nightmare, we should expect Congress to change it.
[49:30.880 --> 49:41.700]  I do have to say though, on that point, it is supposedly going to be harder to execute then something like an injunction or a TRO or temporary restraining order.
[49:41.940 --> 49:53.920]  Meaning that, you know, you're going to have to show that those equitable remedies, which are extremely difficult to convince a court to issue, are inadequate in this particular situation.
[49:53.920 --> 49:59.560]  That you need to go in there immediately on an ex parte order and seize this particular equipment.
[49:59.820 --> 50:01.540]  So the burden is set very, very high.
[50:02.800 --> 50:06.060]  Whether or not it will be extremely misused, I don't know.
[50:06.060 --> 50:09.780]  But I think that's the most dangerous portion of this particular law.
[50:10.140 --> 50:10.460]  Okay.
[50:11.060 --> 50:15.200]  I would just say one side effect or one piece of that also is just for intimidation.
[50:15.860 --> 50:18.280]  So clearly if somebody came into your home, that's intimidating.
[50:18.760 --> 50:26.580]  Even at a lesser degree, and the European law tends to focus more on this, keeping people from just leaving and working.
[50:27.200 --> 50:30.020]  I work somewhere for 10 years and I want to work somewhere else.
[50:30.020 --> 50:34.500]  You know, in theory you could de-skill somebody if this was abused.
[50:34.760 --> 50:38.380]  You could just say everything they know, you know, is a trade secret.
[50:38.540 --> 50:40.680]  And therefore anyone who hires them, we're going to sue.
[50:40.920 --> 50:42.560]  And therefore this person can't get hired.
[50:42.800 --> 50:45.980]  So conceivably it's another mode of intimidation.
[50:46.640 --> 50:47.160]  Absolutely.
[50:47.500 --> 50:55.420]  Do you think that the reverse engineering tenets of the DTSA would provide any relief from section 1201 reverse engineering?
[50:55.420 --> 50:57.660]  Well, it's a little bit different.
[50:57.860 --> 51:01.940]  I mean, generally you know software will be copyright and the DMCA deals with copyright issues.
[51:02.200 --> 51:14.840]  I think that there will be some intersection if the EFF is successful with their lawsuit to challenge the section 1201 exception mechanisms as being unconstitutional.
[51:15.140 --> 51:23.820]  There will be some very interesting interplay there as to whether source code obfuscation is something that could be an access control mechanism under section 1201.
[51:23.820 --> 51:27.600]  So I think, you know, it's definitely something to watch.
[51:27.800 --> 51:30.740]  I'll try to grab maybe one or two more if we have time.
[51:30.980 --> 51:35.720]  Could the gentleman that said he could decompile Pokemon Go see me after the talk?
[51:35.860 --> 51:36.160]  Thank you.
[51:37.680 --> 51:39.040]  It's been done by the way.
[51:39.140 --> 51:42.680]  People have already published hacked versions of it.
[51:42.880 --> 51:43.420]  Thank you.
[51:43.740 --> 51:44.540]  Okay, an actual question.
[51:44.680 --> 51:49.900]  I know you were saying that federal judges are smarter than some of the state judges and so on.
[51:49.900 --> 52:05.480]  But I wonder about how it will work, how much the judges will actually understand the concepts, and if the prosecution can actually use the complexity of some of this against one side or the other, so that the ideal of reasonable, they could argue that,
[52:05.600 --> 52:12.600]  oh, it's reasonable to understand, that nobody will figure out you can drag it to decompile this jar.
[52:12.600 --> 52:18.100]  How is it going to be determined where that reasonability level comes in?
[52:18.800 --> 52:18.820]  Yeah.
[52:19.040 --> 52:23.680]  Again, I think it's based on knowledge and it will be based on perception and foreseeability as well.
[52:23.820 --> 52:28.020]  I mean, any kind of reasonable man standard is always going to be very, very tricky.
[52:28.340 --> 52:35.940]  And when you're dealing with technology and you're expecting, you know, older federal judges to understand, you know, what reverse engineering is, well, some of them do.
[52:35.940 --> 52:41.000]  You know, and I do say, you know, I guess I should qualify my statement.
[52:41.220 --> 52:43.300]  I say, you know, most federal court judges are...
[52:43.300 --> 52:47.000]  There's a couple of state court judges that I think are smart.
[52:48.260 --> 52:49.540]  Yeah, there's a few out there.
[52:49.800 --> 52:50.700]  I've met one or two.
[52:50.840 --> 52:52.100]  The ones that you might be in front of in the next couple of weeks.
[52:52.240 --> 52:52.860]  Yeah, exactly.
[52:52.960 --> 52:56.900]  The judges I'm going to be appearing in front of next week are f*cking brilliant.
[52:58.620 --> 52:59.420]  And, yeah.
[53:00.020 --> 53:02.940]  But, Christ, what were you saying?
[53:03.000 --> 53:03.760]  What was your question again?
[53:05.560 --> 53:05.960]  Yeah.
[53:06.360 --> 53:11.900]  I guess what I'm sort of wondering is, I mean, we've seen some cases where it feels like a prosecution is...
[53:11.900 --> 53:12.400]  Oh, yeah.
[53:12.500 --> 53:13.480]  I know exactly what you're saying.
[53:13.880 --> 53:20.900]  Not allowing certain witnesses in or sort of like showing a different picture to the judge that's not how...
[53:21.440 --> 53:21.440]  Yeah.
[53:22.100 --> 53:26.000]  This is like a personal plug for me though, but I think that's where the lawyers come in.
[53:26.000 --> 53:36.820]  And if you have good lawyers, you can essentially transistorize the information or condense it or dumb it down to the level where, you know, a 75-year-old federal judge should be able to understand this.
[53:37.040 --> 53:40.380]  And I would say though that your point is extremely well taken.
[53:40.760 --> 53:45.080]  And so when you're assessing risk, that should be part of your calculus, right?
[53:45.340 --> 53:47.240]  When you're saying, gee, can I do the...
[53:47.240 --> 53:49.080]  You want to do the bare minimum, right?
[53:49.140 --> 53:50.940]  Because this is not innovating, right?
[53:51.000 --> 53:52.200]  This is managing risk.
[53:52.200 --> 53:53.800]  So you want to do the least that you can.
[53:54.140 --> 53:56.000]  But you don't want to do less than that.
[53:56.200 --> 53:56.500]  Right.
[53:56.500 --> 54:08.680]  So if that line of what that minimum effort is, is not clear, certain companies, larger companies, manufacturing, medical device, et cetera, they're going to have to err on the side of being more conservative.
[54:08.980 --> 54:10.780]  They just have to because of that ambiguity.
[54:11.840 --> 54:12.280]  Great.
[54:12.720 --> 54:13.060]  Thank you.
[54:13.220 --> 54:13.500]  Excellent.
[54:13.760 --> 54:14.400]  Next question.
[54:15.100 --> 54:28.320]  So with current trade secret litigation, trade secret theft litigation specifically relevant to this industry, it is almost constant that you see follow-on or fallback claims of civil CFAA issues as well.
[54:28.560 --> 54:34.780]  Do you see anything in this newer legislation that is likely to change that dynamic or render those follow-on claims unnecessary?
[54:36.080 --> 54:37.520]  No, actually.
[54:37.520 --> 54:44.940]  And that's, you know, you bring up, I think, an extremely excellent point, too, because state law is not preempted by this particular federal legislation.
[54:45.240 --> 54:59.260]  So when it comes to injunctions and when it comes to state law claims, some plaintiffs may wish to proceed with other types of state law claims in connection with a trade secret litigation.
[54:59.260 --> 55:09.080]  So, you know, people may forgo this type of federal action in favor of some things at the state level that allows them to bring or shoehorn in additional claims as well.
[55:09.260 --> 55:23.500]  And I don't see, given the nature of the industry and the methods and mechanisms whereby trade secrets are stolen or exfiltrated, I think that, you know, we're going to continue to see CFAA type of claims as well for the foreseeable future.
[55:23.640 --> 55:24.480]  We're just at 11.02.
[55:24.520 --> 55:25.720]  I want to be respectful for that.
[55:25.820 --> 55:26.000]  Okay.
[55:26.200 --> 55:26.460]  Thanks.
[55:26.580 --> 55:27.220]  Oh, I'm sorry.
[55:27.220 --> 55:27.620]  Yeah.
[55:28.180 --> 55:28.480]  Yeah.
[55:29.560 --> 55:30.120]  Oh, no, no.
[55:30.260 --> 55:31.600]  It's so incredibly hard to see.
[55:31.860 --> 55:33.000]  Anyway, thank you so much.
[55:33.080 --> 55:35.020]  We've got one more question and I will talk to you.