[00:00.780 --> 00:05.100] Thank you, and for those of you who want to take a nap, go ahead, because I'm with you. [00:07.000 --> 00:21.740] For those of you who don't know me, I'm the jerk who actually reads all the documents, and I've discovered along the way that it is actually somewhat possible to find the surveillance programs that we don't know about, or at least see where they exist. [00:22.000 --> 00:28.820] So the idea behind my title, The Black Holes in the Surveillance Map, and this actually I think I owe to Quinn Norton, sort of. [00:28.820 --> 00:43.220] I was describing her how I guessed in 2009 that they were using pen registers to collect all the metadata of Americans, and she's like, what you're doing is finding the negative space, and pointing to the surveillance program that lives in that negative space. [00:43.340 --> 00:55.720] So I'm going to talk a little bit about 2009, some negative space that other people have identified, and some that we should brainstorm, because if we can figure out what's in there, we're going to understand more about what the government is collecting on. [00:56.560 --> 01:13.800] So as I said, in 2009, this was during the Patriot Act reauthorization, and I got to a point, and I was like, you know, I think first of all, Stellar Wind, when we talk about all these programs, Stellar Wind is really these programs morphed. [01:14.100 --> 01:25.680] And at some point, in the middle of the debate on reauthorizing the Patriot Act, I was like, you know, I think they're using pen registers to collect all the mass data that they did under Stellar Wind. [01:27.240 --> 01:34.780] And I also think that they're using pen registers to figure out how to wiretap, and that goes right into Protect America Act, then FISA Amendments Act. [01:36.360 --> 01:37.260] And I was right. [01:37.580 --> 01:38.900] But I didn't pursue that. [01:39.080 --> 01:40.300] And I'll get to why in a second. [01:40.300 --> 01:45.880] The reasons I got to that guess, a lot of it has to do with the crumb. [01:46.160 --> 01:49.520] There will be a theme here, the crumbs that Russ Feingold and Ron Wyden leave, right? [01:49.780 --> 01:52.760] And also the crumbs that Dianne Feinstein, to her great credit, leaves. [01:52.940 --> 02:04.240] But in 2008, as part of the FISA Amendments Act, Russ Feingold basically had an amendment that would have prevented backdoor searches. [02:04.620 --> 02:24.360] For those of you who don't know the Prism, if you read the Snowden documents, for those of you who don't know, that program targets foreigners, collects a ton of data on Americans, and FBI searches that data any time they open a new investigation, whether it's national security or not. [02:24.500 --> 02:25.840] So if they get the data. [02:25.960 --> 02:34.420] They get all of the data that's terrorist-related, probably Chinese spying data, probably hacking to the extent that they can collect that under 702. [02:34.680 --> 02:47.780] So that just sits there in an FBI server, and can be accessed, not even just for criminal purposes, but even just to, we want to find an informant in a particular community, let's see who is talking to, say, Julian Assange, right? [02:48.560 --> 02:56.040] And he is somebody who I almost guarantee you people we know got backdoor search stuff of, because he's a legitimate 702 target. [02:56.040 --> 03:04.280] So anyway, so Feingold tries to make it, to segregate all U.S. person data, and only permit these backdoor searches. [03:04.480 --> 03:10.400] And he wasn't even, he wasn't even saying you can't do backdoor searches, he was just saying you can only do them for national security. [03:10.980 --> 03:11.640] Veto threat. [03:12.240 --> 03:18.660] And when you see veto threats during surveillance debates, that's a pretty good sign of what they really care about. [03:19.200 --> 03:30.540] After this, I don't know if you really want me to read all of this, but, you know, they basically said, you can't make us segregate national security data from this other data, and you can't make us segregate U.S. person. [03:30.980 --> 03:33.120] This is kind of what Bill Binney has always argued, right? [03:33.220 --> 03:34.900] That U.S. person stuff should be encrypted. [03:35.380 --> 03:36.480] You can't make us do that. [03:36.580 --> 03:39.100] If you make us do that, we're going to veto this legislation. [03:40.060 --> 03:47.340] So that's when I started figuring out they're doing backdoor searches, which was like, what, five years before Edward Snowden told us that that was right. [03:48.480 --> 03:51.920] Some other clues that that Stellar Wind had morphed. [03:52.620 --> 04:05.340] Robert Mueller, the FBI director, had done this timeline of all of the events he was involved with, with regards to, remember, so in 2004, a bunch of DOJ lawyers said, oh, my gosh, we're not going to reauthorize Stellar Wind. [04:07.220 --> 04:19.980] Jim Comey, the current FBI director, ran up some hospital steps, got a lot of great PR for it, then promptly ran to the FISA court, bullied the FISA court judge, telling her, we can't go to, we recognize that this is not legally authorized. [04:20.200 --> 04:22.260] But if we go to Congress, we'll have to tell them what we're doing. [04:22.400 --> 04:25.340] So you have to approve this, this pen register program. [04:26.560 --> 04:29.000] So they're, it's, it's not as heroic as they make out. [04:29.120 --> 04:38.000] But one of the most interesting details is Robert Mueller's own timeline of his events, starts and ends with meetings with Dick Cheney. [04:38.620 --> 04:43.240] And we've never seen this one, which took place on March 23rd, 2004. [04:43.240 --> 04:46.940] So 13 days after the heroic hospital confrontation. [04:47.260 --> 04:49.680] We've never seen this one explained in any piece of journalism. [04:49.920 --> 05:01.880] But we know that the last thing in Robert Mueller's timeline of the things that he did in this quasi historic, quasi heroic Stellar Wind thing was to meet with Dick Cheney. [05:02.360 --> 05:03.720] Which is never a good sign. [05:03.960 --> 05:08.300] And then, and then move forward to the, the actual Patriot Act debate. [05:08.300 --> 05:11.640] And so this was fall of 2009. [05:13.140 --> 05:21.420] Najibali Zazi, if anybody remembers that, it was actually the best preemptive investigation FBI did on terrorism period. [05:21.660 --> 05:27.140] Because they actually got this guy who had ties to Pakistan and was trying to blow up the subways here. [05:27.420 --> 05:28.640] And they chased him down. [05:28.800 --> 05:29.440] It was very heroic. [05:29.440 --> 05:33.080] And so Feinstein kind of pointed to the Zazi investigation. [05:33.940 --> 05:36.660] And said, we can't shut down... [05:37.500 --> 05:42.180] Well, so Feingold and Wyden, but Feingold especially, we're going to get him back soon, right? [05:42.500 --> 05:48.560] Feingold was saying, he just had a lot of language that basically said you can't collect this in bulk. [05:49.380 --> 05:49.800] Right? [05:50.080 --> 05:53.800] And so he was saying, you can only collect somebody who's actually directly related. [05:53.800 --> 06:02.960] He was trying to go after that language, for those of you who don't know, to authorize the collection of all U.S. person Internet and call records. [06:03.140 --> 06:06.520] The FISA court just kind of blew up the entire definition of relevant to. [06:07.280 --> 06:12.600] And Feingold was trying to reign that in at the reauthorization and trying to say, well, it can only be one degree. [06:12.820 --> 06:13.980] It has to be actually related to. [06:14.240 --> 06:18.100] And Feinstein said, you know, we're finally finding stuff. [06:18.100 --> 06:22.120] I believe that finally the intelligence and the transformation or transfiguration of the FBI is now taking hold. [06:22.260 --> 06:23.080] We're preempting attacks. [06:23.280 --> 06:29.020] And what she was basically saying, I mean, she had in 2005 said, we can't... [06:29.660 --> 06:31.080] 2006 is when it actually passed. [06:31.360 --> 06:33.280] That's when they kind of added this relevant to language. [06:33.500 --> 06:39.320] She's like, we shouldn't have that because if we have that, it'll be an invitation for fishing expeditions. [06:39.600 --> 06:43.080] And Feingold in 2009 was like, what happened to your fishing expedition problem, right? [06:43.620 --> 06:53.500] Dianne Feinstein made this big case about like, if we shut down these two intelligence programs we have, which we now know where the pen register Internet metadata and phone dragnet data. [06:53.800 --> 06:59.460] And when we learned officially about those programs, they kept pointing to the Zazi. [06:59.600 --> 07:00.900] It was kind of bogus. [07:01.060 --> 07:03.680] They didn't actually use those programs to find Zazi. [07:03.820 --> 07:05.900] But nevertheless, they pointed to it and took credit. [07:07.220 --> 07:12.380] So as I said, I was like, I think that they're using pen registers to collect all... [07:12.380 --> 07:14.640] to do mass collection on U.S. person metadata. [07:15.700 --> 07:17.540] And this is my eternal regret. [07:18.160 --> 07:22.780] I told a former prosecutor friend of mine, and she yelled at me for an hour. [07:23.020 --> 07:25.360] And she told me I was absolutely crazy. [07:25.360 --> 07:29.780] It was not technically possible to use a pen register to collect all of the metadata in the United States. [07:29.860 --> 07:31.300] It was not legally possible. [07:31.380 --> 07:33.480] I was the craziest person she had ever met. [07:33.600 --> 07:36.080] And I kind of still pursued it, but I was like, oh, you know. [07:37.600 --> 07:40.420] So that's sort of the backstory of why I'm a jerk. [07:40.420 --> 07:43.300] And those of you who are in the privacy community, I apologize. [07:43.580 --> 07:44.200] It's all... [07:44.200 --> 07:52.060] It's that federal prosecutor's fault for convincing me to stop investigating this theory that I had, which turned out to be completely right. [07:53.420 --> 07:54.460] There is a... [07:54.460 --> 07:55.340] So I was... [07:55.340 --> 07:55.940] I failed. [07:56.180 --> 08:01.320] I did not discover this massive dragnet before it happened. [08:01.460 --> 08:08.100] But there is a very good success story that came from this negative space theory as well, which is stingray, right? [08:08.960 --> 08:10.760] Probably everyone in this room sort of knows this. [08:10.880 --> 08:23.740] But remember, the stingray discoveries, which finally have come to fruition, and we're seeing laws passed, and we're seeing evidence thrown out, goes back to when Daniel Rigmaiden was in jail trying to figure out how he had been busted. [08:24.040 --> 08:27.740] And he's like, well, my operational security is pretty good, but I think they got my air card. [08:27.740 --> 08:31.360] How could they get my air card inside a room? [08:31.700 --> 08:41.440] And from jail, he started researching what technology was possible such that they were able to find his air card and bust him for tax fraud. [08:41.600 --> 08:44.240] Also, the funny thing is people are like, oh my gosh, the IRS has stingrays? [08:44.340 --> 08:53.420] I'm like, we knew that when Rigmaiden got busted and got off on his stingray evidence because they didn't get a warrant. [08:53.420 --> 08:58.000] They basically conducted a search inside his private residence and they didn't get a warrant, so he got off on time served. [08:58.980 --> 09:05.440] But as part of that process, so he had identified a, there's something there that allowed them to get into my air card. [09:08.240 --> 09:17.700] And he worked with an EFF FOIA, which they had FOIA-ed some of the technology from FBI that was pre-existing and had some, you know, that they were cooperative. [09:18.060 --> 09:23.500] He had to keep firing lawyers though, because like my prosecutor friend, the lawyers were like, you're crazy. [09:24.000 --> 09:25.860] Like, there's no magic thing that can go through doors. [09:25.920 --> 09:26.840] And he ended up being right. [09:27.040 --> 09:40.520] But then ACLU, more recently ACLU, of course, has had, has made a consistent effort to FOIA, the non-disclosure agreements from state to state, because FBI always makes local people swear that they won't tell about stingrays. [09:41.820 --> 09:46.620] Lots of people in this room, I'm sure, have chased down their own local police department stingray policy. [09:46.620 --> 09:55.640] And so, in March, in Maryland, just this month in New York, we're finally seeing courts throw out stingray evidence that was collected without a warrant. [09:55.820 --> 10:02.180] And you're seeing states that are requiring, requiring it, requiring a warrant or at least some kind of legal process. [10:02.360 --> 10:06.720] And requiring that the judges understand this kind of magic process that allows you to find phones. [10:07.480 --> 10:12.320] But even there, there are still things about stingray that we don't know. [10:12.320 --> 10:16.760] The DOJ issued a new policy on stingrays last year, this year, I forget. [10:18.580 --> 10:25.640] And there are a number of things that are kind of excluded from their new policy, which is generally we're going to get a warrant with the stingray. [10:26.080 --> 10:32.400] One of those is exigent circumstances, including finding fugitives. [10:32.800 --> 10:37.820] The most common use of stingrays, you hear a lot about drug people getting busted with stingrays. [10:37.820 --> 10:42.840] But the most common use of stingrays is actually U.S. marshals hunting down fugitives. [10:43.040 --> 10:45.200] So they basically swallowed the rule right there. [10:45.320 --> 10:51.120] They said, we can use it in exigent circumstances, which include chasing fugitives, which is how we usually use it. [10:52.100 --> 11:00.160] There's this weird language in the policy that says, this applies to when federal stingrays are used even in local situations. [11:00.520 --> 11:06.640] But it doesn't apply when local stingrays are used with FBI involvement, which happens all the time. [11:06.640 --> 11:08.680] So, again, swallows the rule. [11:09.440 --> 11:14.960] They said, you know, in national security cases, in FISA, we sort of will use the same policy, kind of. [11:15.720 --> 11:17.340] And then there's this really remarkable one. [11:17.960 --> 11:26.480] There may be other circumstances in which, although exigent circumstances do not exist, the law does not require a search warrant in circumstances making obtaining a search warrant impractical. [11:26.680 --> 11:28.820] In such cases, we may expect to be very limited. [11:28.980 --> 11:30.820] Agents must first attain approval, blah, blah, blah, blah. [11:30.820 --> 11:35.600] So, there's this other use, which is exceptional, not exigent. [11:36.540 --> 11:40.480] I suspect, and this is another, this is kind of another black hole. [11:40.820 --> 11:50.100] In the, well, in a lot of the nondisclosure agreements that got liberated by ACLU and a lot of activists, there's language about public safety. [11:50.100 --> 12:02.800] So, and there's that case in Chicago where some, I think it was Black Lives activists or Ferguson, but anyway, where some, some of the leaders of the protest were clearly targeted with a stingray. [12:02.800 --> 12:22.360] So, public safety, aka protests, but in the, the Boston Marathon trial, it was very interesting because all of the FBI agents who came and swore to whatever they were talking about, not all, but many of them, were not the people who actually were involved. [12:22.540 --> 12:24.160] They're like, oh, I've read the forensics report. [12:24.680 --> 12:35.040] And that's, as I'll get to in a second, that's always a good sign that there's a reason they don't want to put the guy who knows everything on the stand because if he was asked an interesting question, he might have to tell the truth. [12:35.200 --> 12:40.420] And so, I think there's good reason to believe that there were stingrays at the, at the finish line of the Boston Marathon as well. [12:40.640 --> 12:46.820] Also, again, you know, Facebook, there's also good reasons to believe that the brothers were facially recognized. [12:47.060 --> 12:59.880] But, so, that's, I mean, one of the, one of the, one of my goals for this talk is for you guys to read this and go, here's what I think exceptional is and start brainstorming it because that's the way we're actually going to identify these things. [13:01.320 --> 13:02.580] So, where do you find these things? [13:02.720 --> 13:04.160] One, I've already talked about legislation. [13:04.740 --> 13:11.400] Veto threats are a perfect place to find black holes because the stuff that they threaten you on. [13:11.600 --> 13:13.240] Court documents and testimony, right? [13:13.360 --> 13:24.820] So, as I just said, if, if the FBI agent on the stand is not the one who actually has personal knowledge, chances are good there's, you know, maybe not good, but it's often the case that the guy is trying to hide something. [13:26.040 --> 13:29.820] Borders and wars, obviously, Stingray started off as a war toy. [13:30.020 --> 13:31.300] Now we're seeing robots, right? [13:31.760 --> 13:36.360] Lethally kill assassins or whatever. [13:36.960 --> 13:39.700] But borders, I have this joke, my husband's foreign. [13:39.960 --> 13:43.940] And so, when we cross the border together, there's always new technology they're collecting from him. [13:44.520 --> 13:56.100] And, like, two years ago, when he got his irises scanned, I was like, you know, I think it's a three-year process between the time they collect something from my spouse at the border and the time we learn the FBI has a massive database of it. [13:56.220 --> 13:57.460] It took two years in this case. [13:57.580 --> 14:02.920] We just learned that they have, among other, you know, among the other biometrics they have are iris scans. [14:03.180 --> 14:08.620] So, and protests, again, you're seeing a lot of the technology laid out at protests. [14:08.620 --> 14:13.760] If you see that they're collecting information but you don't know where it is, that's where you know it lives. [14:14.180 --> 14:16.640] Devices and purchase orders, that's not something I'm really going to talk about. [14:16.760 --> 14:19.000] That's something technical people are much smarter at than I am. [14:19.460 --> 14:28.340] You know, if you go find the purchase order, again, Stingrays is a real key one, where we've learned, we've gone and seen what Harris Corporation sells and promises. [14:30.420 --> 14:31.880] That's another place to find this. [14:33.260 --> 14:38.600] Short detour, for how many of you guys I can kind of see and know what parallel construction is? [14:38.620 --> 14:39.440] How much do I have to go? [14:39.980 --> 14:41.240] About half, maybe not. [14:41.600 --> 15:07.020] So parallel construction, like 2013 there was a Rutgers, sorry, Reuters article about how the DEA will collect information and then not tell defendants how they collected the information and instead, you know, invent a traffic stop so that they can arrest them off the traffic stop and hide how they actually found the drug dealer. [15:07.020 --> 15:27.360] There was a particular case called Hemisphere where AT&T was using their 27-year database of call record data, including location data, and they would go and find co-travelers or what have you, drug dealers, find burner phones for the government, and the language in the Hemisphere documents that got leaked all say, [15:27.500 --> 15:30.260] make sure you don't tell where this information came from. [15:30.260 --> 15:37.760] Go get a separate subpoena and get the same information again, probably from Verizon because a lot of the data in the AT&T database. [15:38.340 --> 15:47.820] So, again, parallel construction... one of the ways in which we are not learning about these surveillance techniques is because defendants are not learning about them, right? [15:48.360 --> 15:50.280] Rigman did not learn about the stingray. [15:50.420 --> 15:52.660] He had to force the government to tell them about it. [15:54.140 --> 16:00.680] And so, one of the keys to learning where these surveillance things are are how to spot parallel construction. [16:01.440 --> 16:08.200] I mentioned already that if the FBI agent on the stand isn't the one who has the personal knowledge, you should ask questions about why that is. [16:08.400 --> 16:18.120] There was this wonderful case where one of those kids who liked ISIS and got, you know, the FBI, whatever, arrested for material support. [16:18.340 --> 16:34.240] And in that case, and this is a common pattern for young Muslim kids who get busted for ISIS or for Al-Qaeda or what have you, is that in the complaint, the first interaction with the FBI was when he was 15. [16:34.580 --> 16:36.520] And then the narrative goes blank. [16:36.720 --> 16:40.920] And then stuff starts again basically after he turns 18. [16:43.040 --> 16:50.940] But the FBI agent who wrote that complaint up wasn't even working at FBI when almost all of these things happened. [16:51.120 --> 16:56.640] It's sort of like why is this woman writing the complaint rather than somebody who investigated him back when he was 15? [16:56.960 --> 17:01.880] And what happened between the time he was 15 and the time he turned 18 and the investigation seemed to go live again? [17:02.920 --> 17:05.680] That's an example of a gap in time and space as well. [17:08.240 --> 17:21.640] I mean, one of the things you're often missing there is the FBI may throw multiple informants at somebody, but they also may be throwing, you know, different ways to get inside a chat room or different ways to track this person. [17:22.000 --> 17:25.280] And then weasel words about discovery or unexplained data. [17:25.940 --> 17:33.440] You know, you have to... I mean, this is the downside, I think, of many people making plea deals, is they never get all the way through discovery. [17:33.760 --> 17:36.760] And their lawyers never start complaining about the stuff they're seeing in discovery. [17:36.900 --> 17:43.760] Because that's one place to really learn is when the lawyers say, I'm seeing all these emails, they don't make sense. [17:43.840 --> 17:45.260] Where did you get the emails from? [17:46.300 --> 17:52.340] And you may never see... I never see the emails, but I know that there's some emails out there that came from some unknown space. [17:52.640 --> 17:54.120] And it's probably pretty interesting. [17:54.500 --> 17:57.720] So parallel construction is something else you need to be really... [17:58.660 --> 18:02.200] that's what, you know, they're using parallel construction to hide their good stuff. [18:02.440 --> 18:06.720] So when you see parallel construction or suspect it, it kind of makes you into a loon. [18:06.940 --> 18:10.980] Like, defense attorneys aren't allowed to do this, but we are. [18:11.180 --> 18:12.380] So unless you're a defense attorney. [18:13.220 --> 18:14.660] So here's some examples. [18:15.760 --> 18:16.820] ECPA reform, right? [18:17.120 --> 18:22.060] One of the most popular bills in the House in history, billion co-sponsors. [18:22.060 --> 18:31.280] So this past year, we were all loaded to finally fix ECPA such that your old emails will get protection and your old cloud data stuff will get protection. [18:31.680 --> 18:34.700] And it passed on a voice vote in the House. [18:34.980 --> 18:47.320] And then when we got to the Senate, there were a bunch of poison pills put into both ECPA reform in Senate Judiciary, but also they're trying to put one of the poison pills through the Internet... [18:47.320 --> 18:48.820] through the intelligence authorization. [18:48.820 --> 18:57.800] The one that you've heard about, because Ron Wyden is talking about it, is that they want to let the FBI get electronic communication transaction records with an NSL again. [18:58.780 --> 19:03.180] You can go ask Nick Merrill what that means, but they're getting incredibly ton of... [19:03.180 --> 19:07.220] They want to be able to get an incredible amount of information without going to a judge. [19:07.440 --> 19:11.960] When they don't go to a judge, of course, the judge never gets to see how invasive the information is. [19:12.160 --> 19:34.120] But the one that I think is even more interesting is that Jeff Sessions, who, oh, by the way, is the one who blew up the Patriot Act in 2009 when Feingold was trying to fix it, Jeff Sessions introduced an amendment that would allow the government to get stuff with an emergency request, [19:36.260 --> 19:39.860] but not require the government to come back after the... [19:39.860 --> 19:41.100] You know, this happens a lot in surveillance. [19:41.300 --> 19:50.380] You can make an emergency request and then three days or a week or whatever you have to come back and tell the judge what you did and prove that the emergency was real. [19:51.200 --> 19:53.740] A, they want to take the judge entirely out of the process. [19:54.160 --> 19:57.600] And B, they want to make it mandatory. [19:57.600 --> 20:02.580] So the way the law works right now is they can make an emergency request. [20:02.840 --> 20:06.320] A lot of providers are very... as you see, these are the data. [20:06.520 --> 20:13.920] A lot of the providers are very willing in a real emergency to provide data without any kind of process. [20:14.160 --> 20:18.700] And then... but they never have to be shown that there really is an emergency, right? [20:19.080 --> 20:23.460] And so... and this is a point that a number of people are making. [20:23.460 --> 20:27.960] They're already relying on emergency requests to get a ton of data. [20:28.180 --> 20:39.280] And this is... thanks to Edward Snowden, the big push for transparency reports, where some of the providers are now telling you how much emergency requests they're responding to. [20:39.420 --> 20:46.900] And these are... without the Apple detail, these are all just American emergency requests. [20:48.200 --> 20:52.960] And you can see with AT&T and Verizon, the numbers are pretty vast. [20:52.960 --> 20:55.220] Some of these requests include content. [20:56.980 --> 21:00.500] That Google and Facebook are willing to say that 74% compliance. [21:00.760 --> 21:03.080] That, you know, they are challenging some of these emergency requests. [21:03.740 --> 21:08.500] They also go to Congress and brag about the fact that after the Paris attack, they had data... [21:08.500 --> 21:10.660] Facebook and Microsoft have both done this. [21:10.780 --> 21:13.300] You know, they had data to the authorities in France within 45 minutes. [21:13.400 --> 21:15.860] You know, there are good reasons to respond to emergency requests. [21:16.080 --> 21:19.880] But 53,000 emergency requests to Verizon in a year? [21:20.560 --> 21:22.120] Probably not all emergencies. [21:22.460 --> 21:24.120] And there's actually a history of this. [21:24.360 --> 21:31.100] Is that until 2006, there was an exigent letter program in FBI. [21:31.520 --> 21:35.460] And what you didn't... all you need to know is it was incredibly abused and it was bad. [21:35.680 --> 21:39.980] And so we're actually seeing that still in place. [21:39.980 --> 21:46.200] And what we're seeing is one of the reasons that the government doesn't want ECPA reform is because they don't... [21:46.200 --> 21:51.020] They don't want to... they want to expand this gravy train of emergency requests. [21:51.160 --> 21:57.220] And one of the things about emergency requests is if you never have to go to a judge, you never have to prove that there was a criminal investigation. [21:58.260 --> 21:58.560] Right? [21:58.560 --> 22:07.380] And sometimes when people make emergency requests, they... and a provider says prove it, they'll withdraw the emergency request and they never get the request back. [22:07.780 --> 22:15.220] So in other words, the FBI or whoever doesn't... is not interested enough in the data to prove that they had a reason to get the data. [22:15.340 --> 22:21.920] So that's a surveillance... and that's a pretty massive surveillance program that is in place that we don't know about. [22:21.920 --> 22:26.500] This is one I'm going to stick Matt Blaze on because... because he's smart about this stuff. [22:27.820 --> 22:31.500] Post cut through dial digits are what you... like after you make a phone call... [22:31.500 --> 22:35.340] And I suspect they're also doing this under Internet, but he can correct me when I'm... when I'm done. [22:35.920 --> 22:40.540] When you make a phone call and you connect and then they say press one for English and two for Spanish. [22:41.080 --> 22:49.580] Or say, you know, dial the... dial the extension you want to talk to or enter your credit card... your calling card number. [22:49.580 --> 22:52.720] Those are all post cut through dial digits. [22:53.040 --> 22:56.240] And they are in the criminal context... content. [22:56.760 --> 23:02.320] And so when the FBI sets up a pen register, they are not allowed to collect that. [23:02.680 --> 23:14.540] But thanks to an epic FOIA... kind of weird redactions... the... it was... this is... I'm actually kind of... I'm a bit of a defender of the FISA court. [23:14.540 --> 23:18.760] But the FISA court actually does take notice of what's happening in lower courts. [23:18.980 --> 23:24.980] So... what happened here... that this epic FOIA made clear... is that there were magistrates' decisions... [23:24.980 --> 23:29.220] which are the ones that found... post cut through dial digits to be content. [23:29.760 --> 23:36.880] And there was discussion in the FISA court... about how that would affect FISA collection... done on pen registers. [23:38.660 --> 23:40.360] And... and they still do it. [23:40.660 --> 23:48.340] And we... that... we know that they... kind of upped... and... and I... I confirmed that it was post cut through dial digits... [23:48.340 --> 23:53.000] because one of the magistrate judges whose... whose opinion is considered classified... even though it's been published... [23:53.860 --> 23:57.120] uh... was quoted from... and he emailed me... he's like, yeah, that's my opinion. [23:57.400 --> 23:59.900] That... you know, that's... trust me, that's a post cut through dial digit opinion. [23:59.900 --> 24:03.720] Um... but the FBI doesn't want you to know that... that... that they treat this differently. [24:04.020 --> 24:10.640] This... um... beautiful redaction is from the... uh... DIOG, which is the FBI domestic investigations and operations guide. [24:11.720 --> 24:16.020] And... um... you can see that there are two categories. [24:16.180 --> 24:18.940] There's A at the top... and B at the bottom. [24:19.100 --> 24:24.920] So there are two categories of this that they're using... which is one of the reasons I think they may be doing Internet... [24:24.920 --> 24:27.760] They may consider something on the Internet post cut through. [24:28.920 --> 24:31.360] Um... so they can collect it and then they have to minimize it. [24:31.660 --> 24:33.080] Uh... but... but... whatever. [24:34.200 --> 24:37.880] Um... but there are... seven total uses of this. [24:38.120 --> 24:39.700] All of them redacted. [24:39.820 --> 24:43.880] And one was added between the 2008 and 2011 DIOG. [24:44.500 --> 24:46.960] So that's how we know that they're still adding to this purpose. [24:47.220 --> 24:51.800] So if anyone has any really good creative uses... I mean, one obvious one is the calling card, right? [24:51.940 --> 24:56.200] That... that we know that... um... in the phone dragnet they're allowed to get calling... [24:56.200 --> 24:59.900] calling card... not credit card information, but the... you know... [24:59.900 --> 25:02.880] Um... so that's one thing that they're almost certainly doing here. [25:03.080 --> 25:07.440] But... um... that leaves six other applications that if you guys have any great ideas, I'd love to hear about them. [25:08.800 --> 25:10.520] Um... application location information. [25:10.640 --> 25:12.540] This was a Wyden breadcrumb. [25:12.900 --> 25:25.040] In 2014, uh... he's at a hearing with FBI and he's like, by the way, can you tell me what the standard of collection... what the standard for FISA is for... uh... location collection. [25:25.040 --> 25:28.000] And they took forever in responding. [25:28.260 --> 25:35.600] And he said, oh, and I want to know about the standard for collecting location tied to an application... tied to a smartphone app. [25:37.120 --> 25:40.540] And they, um... ultimately responded. [25:41.360 --> 25:44.500] And this... Wyden thinks this is fine. [25:44.680 --> 25:51.040] That the standard is to get perspective content of... and by... by... by location... I mean... right. [25:51.620 --> 26:00.200] So... WhatsApp is gonna... if you give an app... an app permission to collect your location data, then that app will also have... that provider will also have your location data. [26:00.300 --> 26:03.120] And we'll have a bunch of other ways to find your... your location. [26:03.480 --> 26:09.100] And so... um... so... um... so... I talked to a magistrate. [26:09.260 --> 26:13.640] He said, well, I've... I've... I've... I've approved this for WhatsApp for Snapchat. [26:14.340 --> 26:16.840] Um... the Snapchat application was another fugitive. [26:16.980 --> 26:25.000] They thought this guy would... would... um... access his Snapchat from whatever friend's house he was staying with. [26:25.180 --> 26:29.160] And so if they got location from Snapchat, then they would find him. [26:29.300 --> 26:31.200] So that's the kind of application they're using. [26:31.380 --> 26:34.860] But... obviously, you're getting embedded location information. [26:34.880 --> 26:37.620] And you're getting location information for two people. [26:37.620 --> 26:39.920] Uh... often, or at least. [26:40.300 --> 26:43.000] Um... and... this is the language that they gave Wyden. [26:43.340 --> 26:47.840] And... um... what I'm particularly interested in... and you'll see why in a second, is that... [26:47.840 --> 26:52.440] uh... you know... um... questions considered include whether or not the information sought would target... [26:52.440 --> 26:57.820] an individual... an individual... in an area in which that person has a reasonable expectation of privacy. [26:58.780 --> 27:04.820] Which suggests that... they... there may be applications when they would not get... uh... [27:04.820 --> 27:09.040] So in the FISA... so the good news about the FISA court... I was just defending them and here's why. [27:09.360 --> 27:21.380] Is that because of magistrates and now district court opinions that say you need a warrant for location, they've defaulted to requiring the equivalent of a warrant under FISA for location data. [27:21.700 --> 27:23.100] For those same applications. [27:23.340 --> 27:25.800] So perspective, you know, if they want to get GPS data, what have you. [27:26.340 --> 27:37.820] Um... which means... the FBI will actually use criminal... in states where the... where the standard is lower, or the FBI will bypass FISA because the standard is lower in the criminal context than it is in the FISA context. [27:38.040 --> 27:44.800] This is probably one big reason why we got USA Freedom Act is because they weren't able to collect cell phone data under... under those rules. [27:45.000 --> 27:47.420] So... here's... here's where I think it's going. [27:47.960 --> 27:52.640] Um... this was a story from Cash Hill at Fusion... um... less than a month ago. [27:52.640 --> 28:01.640] Um... and some guy who... uh... attended a... help... or a... uh... support group for parents of suicidal teens... [28:02.540 --> 28:03.840] uh... met somebody there. [28:03.980 --> 28:09.020] And the next day was invited to do a Facebook... you know, you may know this person Facebook request. [28:09.300 --> 28:12.400] And he said, I don't have any metadata from this person. [28:12.520 --> 28:15.440] I don't have any... there's no way they could have connected us. [28:15.540 --> 28:16.740] They could tie us together. [28:16.960 --> 28:19.180] And so she called... it was... it's really funny. [28:19.320 --> 28:21.000] If you guys haven't read this story, you should look it up. [28:21.000 --> 28:22.740] Because... um... she called Facebook. [28:22.920 --> 28:23.640] They're like, yeah, we do that. [28:23.880 --> 28:26.760] We... we use... we... we use co-location. [28:26.900 --> 28:32.780] So if you go to this... group... uh... of... parents of suicidal teens... [28:32.780 --> 28:33.220] Right? [28:33.300 --> 28:36.180] If you go to this group of suicidal teens, sure, we'll give you guys friend requests. [28:36.380 --> 28:38.920] Like... the immediate use case is horrifying. [28:39.220 --> 28:41.860] And then, by the end of the day, they were like, no, we don't do that. [28:42.300 --> 28:46.660] And then, the next day, they were like, well, we did a test a little while ago. [28:46.820 --> 28:48.340] Like, these are the famous Facebook tests. [28:50.220 --> 28:52.940] Facebook, of course, is a member... is... is a prison provider. [28:53.260 --> 29:05.580] And you can imagine how this same application would be very useful, both for intelligence services and for the FBI, to be able to go to Facebook and say, give us... [29:05.580 --> 29:10.920] give us everybody who was at this meeting and... and do it if you need with location data. [29:11.080 --> 29:15.020] And, of course, Facebook has multiple ways of getting to location data. [29:15.240 --> 29:18.220] So, again, that's just my hypothesis. [29:18.900 --> 29:23.400] Facebook says they're not doing it for you guys, but that doesn't mean the FBI and NSA aren't doing it. [29:23.480 --> 29:27.620] And NSA has applications like that for other... you know, for the data they collect. [29:27.820 --> 29:32.640] So, the notion that they wouldn't ask NSA for it... I mean... oops... Facebook, not NSA. [29:34.340 --> 29:37.580] The notion that they wouldn't ask NSA Facebook about it is just crazy. [29:37.580 --> 29:46.460] So... USA Freedom Act... I'm... I was a jerk during USA Freedom Act because I... I was the skeptic. [29:46.800 --> 29:51.220] And you've heard over and over again that USA Freedom Act shut down bulk collection, right? [29:51.400 --> 29:52.900] Everyone here... who... who... who's heard that? [29:54.480 --> 30:03.200] The... this is... this language here is the language tied to Section 215, which is what they use to collect everyone's phone records in the United States. [30:03.200 --> 30:08.900] And one of the ways they prevent... I mean... they... they... they used a really stupid way to prevent bulk collection in any case. [30:09.080 --> 30:16.760] But one of the ways they used to prevent bulk collection was by restricting what... you could use as an identifier. [30:17.100 --> 30:23.500] So, in the old days, when the phone dragnet existed, they would go to Verizon and say, our identifier is Verizon. [30:23.720 --> 30:26.040] We want everything from Verizon, right? [30:26.820 --> 30:31.240] And now, they specify here, they can no longer use Verizon as the identifier. [30:33.040 --> 30:36.720] But... we know they also had a financial dragnet, right? [30:36.800 --> 30:43.480] We know that they were getting... it wasn't as extensive as the phone dragnet, but we know that they were getting Western Union's data. [30:43.660 --> 30:46.100] Anything going from the United States overseas Western Union. [30:47.240 --> 30:52.500] There's still... the most recent IG report on this still has the appendix that describes that program. [30:53.080 --> 30:55.620] It's not prohibited by USA Freedom Act. [30:56.400 --> 31:02.100] And remarkably, these are the... this is from the transparency procedures in USA Freedom Act. [31:03.060 --> 31:11.740] When they... when they require reporting on how often Section 215 gets used, the... you have to say how many targets there were. [31:11.860 --> 31:13.640] But a target could be just Al Qaeda, right? [31:13.740 --> 31:15.740] That's... that's who the target was in the old phone dragnet. [31:15.740 --> 31:16.560] That's one person. [31:17.600 --> 31:28.720] But the number of unique identifiers... again, tied to communicate... tied to communications, not tied to the other applications that they use for Section 215. [31:28.960 --> 31:37.880] We also know they've used 215 for collecting beauty supplies that are used as precursors for bombs. [31:37.880 --> 31:40.700] So, things like acetone and hydrogen peroxide. [31:41.560 --> 31:46.140] I would bet a lot of money that they've... that they've used it for pressure cookers. [31:46.280 --> 31:55.040] They... they did, in the Boston Marathon case, get the purchase records for everyone who had bought the kind of pressure cooker used in their bomb in the United States. [31:55.840 --> 31:57.140] And they don't throw that data out. [31:57.200 --> 31:59.500] So, if you buy that kind of pressure cooker, you're in some FBI. [31:59.720 --> 32:02.560] But... but I assume that they do that with... with Section 215 as well. [32:03.900 --> 32:09.860] Also, in USA Freedom Act, some of the other things that aren't in the... that are kind of excluded from the transparency provisions. [32:10.140 --> 32:15.520] One is pings, which means location data, which means... and this is... this makes sense. [32:15.660 --> 32:18.240] They do use stingrays in the FISA context. [32:18.720 --> 32:21.020] A stingray collects on a ton of people. [32:21.200 --> 32:23.760] They don't want to make it clear that they're using stingrays. [32:24.020 --> 32:26.240] A stingray will get reported as one target, right? [32:26.320 --> 32:30.400] It won't get caught... it won't get reported as all the other people who had their records collected. [32:30.400 --> 32:34.460] But that just means we're not going to be able to measure how much location data they are collecting. [32:35.860 --> 32:39.700] It also... they... they pretty much had blanket exceptions for FBI information. [32:39.960 --> 32:44.760] And one of the reasons they did that is because I... I explained earlier about backdoor searches, right? [32:46.300 --> 32:59.280] Again, FBI does these backdoor searches and 702 collected data for criminal cases, for national security cases, if they're looking for informants, if they want to map out the community, the Somali community in St. Paul, Minnesota. [32:59.760 --> 33:02.740] They don't need a criminal interest to get into this database. [33:03.540 --> 33:06.220] And they're getting to content of those backdoor searches. [33:06.460 --> 33:14.080] But the other thing that... that... that they... that they therefore exclude is that the metadata that comes in off the new USA Freedom Act metadata program. [33:14.760 --> 33:19.080] In the old days, under the phone dragnet, it actually was pretty hard to share that information. [33:19.260 --> 33:20.520] Again, now I'm defending the NSA. [33:20.660 --> 33:21.320] Things are getting bad. [33:22.620 --> 33:27.780] But... but... but to share the phone dragnet information, it had to be a counterterrorism purpose. [33:28.000 --> 33:30.420] And somebody had to sign off on it being a counterterrorism purpose. [33:30.660 --> 33:34.900] Whereas here, the data is going to go immediately to CIA and FBI as well. [33:35.100 --> 33:36.840] That... that's what they had to do to share with FBI. [33:37.140 --> 33:41.180] Here, the data will go... will get shared with NSA, CIA, and FBI immediately. [33:41.460 --> 33:46.760] And FBI won't have to count how many times they check that data, because it'll be in the same database as the content. [33:51.840 --> 34:00.620] CISA... CISA, for those of you who don't know, passed last year, which was the U.S. government's effort to... [34:01.100 --> 34:09.960] The generous interpretation is that a bunch of people, including Google, said, we want to... we want to share the information we find when we scan our own networks with the government. [34:10.100 --> 34:11.100] And we should be able to do that. [34:11.200 --> 34:13.220] We should be able to do that legally and protected. [34:14.760 --> 34:23.840] As part of the process, though, they gave companies that did share this information, arguably, very broad immunity. [34:24.380 --> 34:27.520] I've argued, and people have yet to refute me, that... [34:27.520 --> 34:29.260] Well, let me put it this way. [34:29.360 --> 34:33.480] GM did not support CISA... CISA... people pronounce it every other way, so... [34:33.480 --> 34:42.780] CISA... GM did not support CISA until it became clear that security researchers were no longer going to sit on their data for five years, and were instead going to publish it. [34:42.780 --> 34:48.120] The day after that happened, they wrote a letter to Dianne Feinstein saying, we support CISA. [34:48.320 --> 34:59.200] I've argued that it is possible, had Chrysler gone to DHS and shared this information and said, hey, these security hackers just hacked our car, then it would have been... [34:59.200 --> 35:04.740] It would... I think it would be harder for NHTSA to force Chrysler to issue a recall. [35:04.740 --> 35:25.040] And given that NHTSA, which, for those of you who don't know, regulates cars, transportation, and FTC are doing really good, aggressive things to ensure that companies actually do something to keep themselves safe, if they can no longer do that because somebody shared information willingly, [35:25.080 --> 35:25.960] that becomes a problem. [35:26.460 --> 35:32.300] But this data comes in, and it can be used for... it's not just to prevent breaches, right? [35:32.300 --> 35:33.920] So it can be used for cybersecurity. [35:34.320 --> 35:39.860] It can be used for threat of death, serious bodily harm, or serious economic harm, right? [35:40.060 --> 35:41.060] Does that include IP? [35:42.140 --> 35:45.860] There's... and the NSA has some language where they kind of blow up the definition of economic harm. [35:46.080 --> 35:48.940] Somehow... somehow corporate persons became bodies in this. [35:49.140 --> 35:50.200] So economic harm. [35:50.420 --> 35:52.100] Kitty porn, not a surprise. [35:52.580 --> 35:53.840] Fraud identity theft. [35:53.840 --> 35:58.180] Espionage, censorship, AKA... we should assume they're going to use it with leakers. [35:59.220 --> 36:00.480] And trade secrets. [36:00.700 --> 36:03.300] So they can use this data for all of those purposes. [36:05.260 --> 36:07.160] So it's not really a cybersecurity bill. [36:07.280 --> 36:08.300] It's an Internet crime bill. [36:11.100 --> 36:17.080] And what's... so John Tester... oh, this is... I'm going to add John Tester to the Ron Wyden and Russ Feingold list. [36:17.300 --> 36:21.740] So John Tester had this amendment that would have imposed a bunch of transparency provisions. [36:21.740 --> 36:24.300] And they were all basically rejected. [36:24.560 --> 36:25.680] And they're really telling. [36:26.040 --> 36:29.400] So he wanted... it was a great amendment. [36:29.580 --> 36:35.200] He wanted the government to have to say how often CISA uses this information for investigations. [36:35.520 --> 36:40.740] Like the way FISA works now, you only find out if they introduce it into a court case. [36:41.340 --> 36:42.420] His was a great approach. [36:42.600 --> 36:45.900] He said, I want to know if you're using it for... to start an investigation at all. [36:46.020 --> 36:47.060] Or for an investigation. [36:47.360 --> 36:48.320] That got thrown out. [36:48.320 --> 36:51.340] He wanted to know how often a U.S. person... so the standard on FISA is you can't share U.S. person information... or it's FISA and 12333. [36:57.740 --> 36:59.060] The NSA can't share U.S. person information unless that U.S identity is necessary for understanding the intelligence. [37:04.160 --> 37:06.380] The standard under CISA is lower. [37:06.820 --> 37:09.920] It's... they can share it if it's related to the threat. [37:09.920 --> 37:12.700] But by definition, it came in with the threat. [37:12.880 --> 37:14.140] So of course, it's related to the threat. [37:14.240 --> 37:16.140] That goes back to the redefinition of related to. [37:17.480 --> 37:23.340] So they threw out his amendment that would have required... explaining how often U.S. person identities got... got shared. [37:26.540 --> 37:28.020] If it was not necessary. [37:29.300 --> 37:31.240] He wanted them to say how much U.S. person data was getting stripped at the portal. [37:33.020 --> 37:41.120] So basically what happens is the government... or companies go to DHS and they fill out a form and they show this information on this form. [37:41.340 --> 37:45.060] And they, to get immunity, are supposed to strip out all the extraneous information. [37:45.760 --> 37:49.200] And he was basically going to try and measure, are they doing that? [37:49.320 --> 37:50.880] Or are they getting immunity for free? [37:51.280 --> 37:52.220] Can't get that information. [37:52.820 --> 38:00.340] My favorite is CISA, when it was originally drafted, permitted, legalized what were then called countermeasures. [38:00.340 --> 38:01.500] We all freaked out. [38:01.680 --> 38:03.300] They renamed it defensive measures. [38:04.920 --> 38:08.680] And he's like, you need to tell... I mean, this is all just telling Congress. [38:08.820 --> 38:09.980] This is not telling you and I. [38:10.120 --> 38:13.640] This is just telling the overseers of the intelligence community. [38:13.800 --> 38:16.840] So he said, you need to tell us if these defensive measures blow shit up. [38:17.620 --> 38:23.400] And they're like, no, we don't want to be obliged to tell you if we know that these defensive measures are blowing shit up. [38:24.500 --> 38:33.600] And then also, he wanted to require them to say if indicators were getting shared with the FBI or the NSA. [38:33.940 --> 38:35.040] We can't know that either. [38:35.340 --> 38:48.220] And one reason why that's important is CISA, the way, those of you who don't know how Congress works, AKA works, is you can prevent bad surveillance from passing through the House, but not the Senate. [38:48.220 --> 38:52.600] The Senators are all squishy and they love surveillance and they're not enough good people in the Senate. [38:53.080 --> 38:54.460] So CISA passed. [38:54.620 --> 38:56.120] The Senate was going to go to the House. [38:56.320 --> 38:58.080] We were going to be able to muck it up in the House. [38:58.240 --> 39:03.440] And they said, instead of passing it as a standalone bill, we're going to put it on the omnibus, so funding. [39:03.740 --> 39:13.080] And so the same people in the House who might have voted against a bad surveillance bill aren't going to vote against funding, because that's the way members of Congress work. [39:13.080 --> 39:16.500] And in that process, they changed, they did a couple of things. [39:16.640 --> 39:18.180] They stripped out like P-Club oversight. [39:18.640 --> 39:27.560] They, you know, but the most important thing is they said, this whole thing is about setting up this, this, this, this portal at DHS. [39:28.000 --> 39:35.980] And DHS made a fair effort at trying to, you know, trying to ensure that it could protect privacy while it was doing this. [39:35.980 --> 39:45.720] And it said, well, you know, the President can at any time go and tell Congress, Congress is not defined, go and tell Congress that we need a new portal. [39:46.520 --> 39:49.080] And everybody knows FBI wants their own portal. [39:50.460 --> 39:54.840] So the President can at, well, not, it's not at any time, but he can do it now. [39:55.140 --> 39:56.680] It's, the, the timeline is up. [39:56.800 --> 39:57.600] So he can now do it. [39:57.700 --> 40:04.460] Go to Congress and say, skip this DHS portal, which makes some efforts for these privacy provisions. [40:05.180 --> 40:06.460] FBI needs its own portal. [40:07.660 --> 40:10.960] And there's nothing in the bill, there's nothing in the law to prevent the sharing. [40:11.140 --> 40:17.680] I mean, as I've shown, there's, there's really nothing to prevent the sharing of pretty invasive information with the FBI. [40:17.720 --> 40:24.980] So we should expect, and I've asked two members of Congress, maybe three now, and I said, do you think you'll get told? [40:25.940 --> 40:30.060] If, are you part of the Congress that will get told if FBI gets a new portal? [40:30.060 --> 40:37.200] And even people who are on the committees that should get told were sort of like, well, I don't know. [40:38.880 --> 40:41.800] So those are, those are my, those are my black holes. [40:41.980 --> 40:42.500] This is me. [40:43.260 --> 40:45.800] And I will, that's exactly when I wanted to answer questions. [40:46.200 --> 40:47.500] You win the gold star. [40:47.940 --> 40:49.060] I win the gold star. [40:49.200 --> 40:49.740] So questions. [40:49.920 --> 40:52.800] Anyone who has questions or ideas how to, like, the post cut through? [41:01.260 --> 41:04.220] And please ask your question in the form of a question. [41:04.380 --> 41:07.660] We got an illustration of what not to do in one of the earlier sessions today. [41:09.720 --> 41:10.460] Come to the mic. [41:10.960 --> 41:12.220] And microphone, please. [41:17.680 --> 41:19.100] Hi, and thanks for your talk. [41:19.440 --> 41:25.960] So one of the things that I think that stands out to me a lot is the talking you showed from the FOIA request that was essentially completely redacted. [41:25.960 --> 41:29.380] And I'm not 100% familiar with FOIA. [41:29.600 --> 41:39.080] So I'm wondering if there's anything we can do to strengthen FOIA or strengthening the requirements on what can and cannot be redacted. [41:39.160 --> 41:42.660] Because I think in that way we'll be able to find out a lot more information. [41:43.420 --> 41:48.740] Yeah, I mean, that stuff was all redacted on law enforcement sources and methods. [41:48.980 --> 41:56.340] And the government, unfortunately, has gotten more successful of late at hiding stuff behind those sources and those law enforcement techniques. [41:56.620 --> 42:00.460] So that's a very good question. [42:00.620 --> 42:15.180] I think the way to fight that battle, especially for those of you who are Americans and all involved in the political process, FISA Amendments Act will get renewed in the next... they're going to try and do it this year. [42:15.440 --> 42:18.120] Probably won't happen, but it'll get renewed in the next year. [42:18.680 --> 42:21.240] And the notice provisions stink. [42:21.620 --> 42:29.540] So the way in which we can start learning about these surveillance techniques is to really start pushing for notice to defendants. [42:29.720 --> 42:32.060] Because they're the only ones who can do anything about it anyway. [42:33.380 --> 42:38.080] And I mean, you know, one of the nice things about Daniel Rigmaiden is you had a really smart defendant. [42:38.320 --> 42:42.640] And you had somebody who was persistent and willing to fire lawyers to pursue this. [42:43.920 --> 42:48.700] Most people who get caught with surveillance aren't as smart as he is. [42:49.800 --> 42:52.040] Their attorneys don't have the time. [42:52.400 --> 42:54.340] I mean, they see more of this. [42:54.340 --> 43:02.280] Although usually, you know, the public defense in this country being what it is, they're being pushed into plea deals, which means they often don't even get to discovery. [43:02.580 --> 43:10.500] But really, I think we will make more progress at making sure criminal defendants get discovery on all of these techniques than FOIA. [43:10.580 --> 43:14.360] And I'm sad to say that, but that's the reality. [43:16.660 --> 43:17.140] Hi. [43:17.140 --> 43:18.980] Long time listener, first time caller. [43:20.660 --> 43:25.440] I'm really, really interested in the post-cut stuff that you were talking about. [43:25.580 --> 43:40.680] And I was wondering if you might have any more information to elaborate on services like Twilio or other, like, web-based services that provide such services and how that has been looked at within the intelligence community. [43:41.560 --> 43:42.940] I actually don't know. [43:43.160 --> 43:50.340] But, you know, that you're asking the question, I think, is a sign that if you can think of a use, assume it exists, right? [43:51.120 --> 43:57.960] I think that's... like, if there would be a good purpose for intelligence to collect it, assume they're going to do it, at least the NSA, because they have no holds barred, right? [43:58.580 --> 44:03.240] But certainly, that may not be a compelling answer, but I... right? [44:06.040 --> 44:06.440] Hi. [44:06.440 --> 44:07.340] Two questions. [44:07.700 --> 44:23.620] First, on the matter of the post-cut digits, do you think that there may be at least a legal analogy between postal digits and the latter parts of URLs in browser histories that may be usable by the government? [44:24.000 --> 44:37.900] And the second is that there is speculation in the halls that you may, in fact, be a super-intelligent cyborg from the future sent back to save us from the consequences of a mass surveillance system. [44:41.120 --> 44:45.600] And I wonder whether you could confirm or deny that on the record. [44:47.080 --> 44:48.500] Neither confirm nor deny. [44:48.780 --> 44:53.180] But, you know, I actually... I'm sort of curious, Matt, whether you have any thoughts about... [44:53.180 --> 44:56.720] On the criminal side, URL content definitely is content, but... [44:56.720 --> 44:57.500] Did you hear that? [44:57.760 --> 44:59.840] So, on the criminal side... [44:59.840 --> 44:59.920] Yeah. [44:59.940 --> 45:02.460] But would that be counted as a post-cut through? [45:02.880 --> 45:04.160] Probably not, but... [45:04.160 --> 45:05.360] Yeah, so, I mean... [45:05.360 --> 45:06.620] It's probably, it's considered different. [45:06.860 --> 45:09.360] It's treated differently according to the process in your manual. [45:09.560 --> 45:10.280] Did you guys hear that? [45:10.600 --> 45:10.920] No. [45:11.220 --> 45:11.640] Repeat it. [45:13.340 --> 45:15.460] Matt has a great paper coming out that addresses... [45:15.460 --> 45:17.280] Yeah, it's complicated is the answer. [45:18.300 --> 45:19.980] And actually, that's the name of our paper. [45:20.880 --> 45:27.180] But, I mean, one thing that I've sort of been curious on, like, I mean, they're going to get the URL stuff anyway with ECTRs. [45:27.240 --> 45:28.600] We are going to lose that fight. [45:28.920 --> 45:30.360] And, you know, I don't... [45:30.740 --> 45:35.440] Maybe you're more optimistic than I am, but I think we're going to lose that fight, which means they're going to go back to getting... [45:35.960 --> 45:45.240] The things they're going to get with ECTRs, with electronic communication transaction records, include URLs, include log data for websites, include... [45:45.240 --> 45:47.220] Again, ask Nick Merrill, because he's laid this all out. [45:47.320 --> 45:51.900] He, you know, spent years trying to bring attention to this ECTR thing. [45:53.120 --> 46:00.520] But, so, it includes a ton of stuff, which is far more invasive than just email address metadata. [46:00.800 --> 46:03.640] And so, that's where they're going to get the URL stuff. [46:03.640 --> 46:08.640] One thing I'm wondering is if they're getting passwords, because we know that, certainly the NSL... [46:09.160 --> 46:12.840] I mean, with the NSA, one of the things the NSA does is it correlates identities. [46:13.160 --> 46:21.840] So, once you get stuck into their ma, they're like, I want to know all of the identities that this person uses, both on phone and online and on banking. [46:22.000 --> 46:26.900] And so, I did this once for this criminal guy, the guy who got busted with the DEA dragnet. [46:27.020 --> 46:27.700] It doesn't matter. [46:27.920 --> 46:28.740] Just, he got busted. [46:29.360 --> 46:29.800] And... [46:29.800 --> 46:32.820] But, as a result, they showed his subpoena returns from Google. [46:33.060 --> 46:38.060] And he had, just from Google, about... [46:38.060 --> 46:40.180] Including all of the Google services he used. [46:40.400 --> 46:42.060] He had about 20... [46:42.060 --> 46:42.540] No, sorry. [46:42.640 --> 46:44.400] He had about 65 different identities. [46:45.040 --> 46:45.480] From... [46:45.480 --> 46:45.880] Think about it. [46:45.960 --> 46:49.660] I mean, think about, like, you've got your email address, maybe several email addresses. [46:49.660 --> 46:50.740] You've got... [46:50.740 --> 46:52.220] Home and work phone numbers. [46:52.480 --> 46:54.240] You've got some financial information. [46:54.860 --> 46:56.840] Every identity you have on Google. [46:57.080 --> 46:58.600] And that's before you get to cookies. [46:58.940 --> 46:59.360] And... [46:59.360 --> 47:01.640] And they are getting to cookies on some of this stuff. [47:01.860 --> 47:02.160] So... [47:02.160 --> 47:03.740] And cookies would be another identity. [47:03.880 --> 47:07.760] And so, what the NSA does, and I'm sure the FBI, is they glom all that together. [47:07.760 --> 47:11.400] So, they know who you are and all of your various guises. [47:11.780 --> 47:14.400] And that's when they talk about building a dossier about somebody. [47:14.540 --> 47:15.540] That's what they're really into. [47:15.540 --> 47:22.160] And one of the things that the NSA, at least, correlates identities on, is passwords. [47:22.940 --> 47:23.380] So, if you... [47:23.380 --> 47:31.560] I mean, another reason to change your password is to have a different password for every site, is so that the NSA can't correlate your identity as easily, so... [47:33.360 --> 47:42.200] So, in this talk, and in most of the talks about this topic, I tend to hear people talking about sites that I know I visit, like Facebook or Google. [47:42.680 --> 47:56.220] Have you seen, in the course of investigating this, any indication that ad networks or other kinds of sites that actually, in many ways, have got a wider cast net, are also being co-opted or used as part of these processes? [47:56.480 --> 47:56.900] Yeah, right. [47:57.020 --> 47:58.940] I mean, we don't get transparency reports from them, right? [47:59.500 --> 48:01.420] We're never gonna get transparency reports from them. [48:02.320 --> 48:02.720] I... [48:03.180 --> 48:04.280] Have I seen it? [48:04.280 --> 48:09.220] In terms of things that the national security folks or FBI would go after. [48:09.460 --> 48:10.680] Yeah, they're a third-party. [48:10.920 --> 48:21.380] And so, there's no legal reason why the government couldn't go to them and get, you know, for those of you who were in the Link NYC presentation earlier today, I mean, they're... [48:21.380 --> 48:27.280] That is embedded data, and there's no reason the government can't go and obtain that data. [48:28.420 --> 48:28.940] They... [48:28.940 --> 48:47.100] One of the other interesting things about PRISM is between August of 2007, when they first passed the law and made their first request to Yahoo, and February of 2008, when Yahoo got the actual requests, the scope of what they were asking for was much broader. [48:47.480 --> 48:49.680] So, originally, they were just looking for email content. [48:49.680 --> 48:59.860] And although it's entirely redacted, when Yahoo explained to the FISA court what they were being asked for in February 2008, they made it clear it covered all four of their business areas. [49:00.040 --> 49:05.460] So, it included their news sites, it included their cloud storage, advertising. [49:05.760 --> 49:19.220] So, that's a pretty good example where I assume PRISM is getting that, and, you know, there was no ad network included in the PRISM providers through 2013, but you never know what's happening in secret, right? [49:20.560 --> 49:21.080] Hi. [49:21.280 --> 49:22.140] Thank you for your talk. [49:22.260 --> 49:22.620] That was great. [49:23.800 --> 49:42.980] I do wonder with the number of small instances that we've had here and there of this data being used to go after journalists, protesters, and lawyers, and potentially members of the political political position. [49:43.180 --> 49:43.420] Yeah. [49:45.240 --> 49:53.300] What are the signals that you have seen that are making you worried about the progress they're making towards these use? [49:56.440 --> 50:05.680] For members of Congress, the day after the Snowden leaks, there happened to be a DOJ oversight hearing. [50:06.300 --> 50:12.580] And even Barbara Mikulski, who is Senator D NSA, like, she loves spying. [50:13.080 --> 50:14.120] But she was freaking out. [50:14.260 --> 50:16.280] She's like, how dare you collect all our phone records? [50:16.320 --> 50:16.980] How dare, you know? [50:17.300 --> 50:21.600] And then Eric Holder had a briefing, secret briefing, with members of Congress. [50:21.860 --> 50:25.360] And then, after that, no member of Congress raised this issue again. [50:27.500 --> 50:33.060] If you look at the phone dragnet information, there's reason to believe that people like that get defeat listed. [50:33.760 --> 50:47.580] So, at least the... my guess is, and this is an educated guess, but my guess is that the official phone numbers from members of Congress just won't ever show up on a phone dragnet search, because the NSA kind of hides it. [50:48.000 --> 50:51.120] But that's not true for lawyers... clearly not true for lawyers. [50:51.240 --> 50:57.660] We know, because the minimization procedures are public, we know that pretty much the only lawyer... only... [50:57.660 --> 51:01.040] We know that pretty much the only lawyer... [51:03.410 --> 51:11.070] this format to point members of the public to, who are people who are just getting into this subject for the first time. [51:11.310 --> 51:28.170] And I'm wondering if you know of any book that's good to refer people to, or better yet, an online encyclopedia-style thing that talks about which provisions of which laws are used, are used in which ways, what the potential efficacy is against terrorism, [51:28.290 --> 51:28.730] and so on. [51:28.730 --> 51:41.150] You know, some kind of format like that that would be easier to digest and refer to, and used to debunk false claims made by the national security apparatus, than a blog would be for naive people. [51:41.330 --> 51:41.470] So yeah. [51:44.480 --> 51:50.160] I was wondering, how would you recommend getting our Congress critters, for those of us who have the privileges of U.S. citizenship, to pay attention to you, short of just calling them every time and saying, please vote against the USA Freedom Act, or put teeth in it, as I've done. [52:00.100 --> 52:00.500] Okay. [52:00.680 --> 52:06.480] First, for the wiki, if somebody wants to fund me to do that, actually some of us are talking about doing just that. [52:06.700 --> 52:08.420] So, it doesn't exist. [52:08.840 --> 52:10.800] But, give me money and I'm happy to do it. [52:13.900 --> 52:17.900] And I've got other people who are happy to help me on it, who are smarter on the technical side. [52:17.900 --> 52:20.920] But, like, that's not even been done for the Snowden documents yet. [52:21.060 --> 52:22.100] So yeah, it does need to happen. [52:22.260 --> 52:27.600] On the Congress, the good news is, last week, I have the last track of time. [52:27.880 --> 52:31.320] Last week, we finally rolled out the Fourth Amendment Caucus in the House. [52:31.560 --> 52:38.400] And it's a good left-right, a lot of work from people in the privacy community, a good group of left and right members of Congress. [52:38.800 --> 52:42.860] And I think that's one way we're going to have these conversations. [52:43.160 --> 52:44.920] And I'm on the advisory committee for that. [52:44.920 --> 52:47.040] So, they'll sort of listen to me. [52:47.120 --> 52:49.500] Although, I introduced myself to one of the members of Congress on that. [52:49.640 --> 52:50.500] And he didn't know who I was. [52:50.620 --> 52:51.420] But, so, now he does. [52:52.080 --> 52:52.840] Anyway, thank you. [52:55.860 --> 53:04.820] So, before we give Marcy a really big hand, I just want to say I cannot confirm nor deny that she's a cyborg from the future. [53:04.980 --> 53:12.200] But I will tell you that many more times than I would care to admit, I've read her stuff and said, oh, Marcy's gone off the deep end. [53:12.200 --> 53:16.300] And then, you know, a year later, I found out, oh, Marcy was right. [53:16.800 --> 53:18.780] And that just always happens. [53:18.960 --> 53:19.400] So, I'm voting... [53:19.400 --> 53:20.300] Is that on video? [53:20.520 --> 53:25.980] I'm voting for Cyborg from the future, but I don't actually know. [53:26.140 --> 53:28.000] So, let's give Marcy a chance. [53:28.000 --> 53:28.480] Tack le matern. [53:28.480 --> 53:28.500] is very nice. [53:28.500 --> 53:28.940] So, thank you very much. [53:28.940 --> 53:29.000] rosy and goodness, finally. [53:29.000 --> 53:29.020] Thank you very much.