[00:00.000 --> 00:01.360]  Let me give you a couple of quick announcements.
[00:01.800 --> 00:04.960]  One thing is, some people might be interested in giving a lightning talk.
[00:05.240 --> 00:08.960]  Email your talk and title... your title and topic, rather, to...
[00:11.220 --> 00:11.660]  Sorry?
[00:11.660 --> 00:12.100]  Hello.
[00:14.500 --> 00:14.940]  Hello.
[00:16.320 --> 00:18.120]  My name is Julian.
[00:19.540 --> 00:20.220]  No, I'm kidding.
[00:20.440 --> 00:25.300]  So, if you want to give a lightning talk, please email the title and topic to projects at hope.net.
[00:25.480 --> 00:27.300]  This is for tomorrow's sessions.
[00:30.220 --> 00:33.060]  We have some sessions going on in the Morse Room.
[00:33.280 --> 00:35.520]  There are a few that are signed up already.
[00:35.800 --> 00:38.440]  We'll be announcing those, and be sure to check.
[00:38.600 --> 00:40.860]  That's over by the men's room, up the hallway here.
[00:42.520 --> 00:50.500]  I'd also like to announce, again, that we have a live concert tonight, 11.30 p.m., in the Video Temple Room, which is highlighted in your program.
[00:50.860 --> 00:51.840]  So, we're doing good.
[00:52.060 --> 00:55.060]  Don't forget, there's a lot of stuff to do in Manhattan.
[00:55.140 --> 00:58.420]  Just keep your excursions to, like, 20, 30 minutes.
[00:58.420 --> 01:01.100]  Get a little dinner, get back here, where the action is.
[01:02.540 --> 01:04.260]  Because there's really not that much going on.
[01:06.380 --> 01:11.640]  So, one of the topics that's near and dear to our heart is keeping your job and still being a hacker.
[01:11.960 --> 01:13.560]  And Alex will talk to us about that.
[01:25.040 --> 01:25.440]  Thanks.
[01:25.540 --> 01:26.140]  I'll take the hat off.
[01:26.220 --> 01:27.100]  I'm not actually Amish.
[01:30.400 --> 01:33.560]  This is a talk that kind of grew organically.
[01:35.480 --> 01:44.540]  Some time ago, I, in a drunken fit of whatever, put an ad in the back of 2600 for, hey, I'm a lawyer.
[01:44.720 --> 01:45.680]  I used to be a hacker.
[01:45.840 --> 01:47.680]  I still kind of am a follower.
[01:48.300 --> 01:50.680]  And if you need any help, give me a call.
[01:50.680 --> 01:55.280]  And this has resulted in some of the most interesting phone calls of my life.
[01:57.140 --> 02:00.640]  Quite a few people, like, refusing to ever acknowledge who they are.
[02:01.000 --> 02:05.640]  It's like, I can't really give you attorney-client privilege if I don't know who the hell you are.
[02:05.860 --> 02:07.020]  Could you tell me something?
[02:07.780 --> 02:08.880]  Call me Bob.
[02:08.880 --> 02:08.960]  Call me Bob.
[02:11.140 --> 02:13.220]  So I have multiple clients named Bob.
[02:15.280 --> 02:20.700]  But the one that I thought would be the most useful public service announcement would be a talk on employment law.
[02:21.320 --> 02:31.780]  And here it goes, because it's a lot of, I just got fired, I'm about to get fired, they're firing me right now, I'm putting everything in a box, or I just did something really, really stupid, can they fire me?
[02:33.500 --> 02:35.260]  So, what am I talking about?
[02:36.420 --> 02:43.800]  Staying curious, staying interested in the universe around us, technology, making things do what they weren't designed to do.
[02:44.360 --> 02:47.580]  Staying employed, because, I don't know, I like money.
[02:47.740 --> 02:49.460]  I'm assuming some of you like money.
[02:51.300 --> 02:53.660]  Relevant law, because I'm a law talking guy.
[02:54.580 --> 02:57.080]  And a few case studies, I've anonymized them.
[02:57.920 --> 03:03.980]  So if you do recognize yourself, if you are Bob, I try to anonymize anything you told me.
[03:04.960 --> 03:09.140]  And a few stories from, or a few kind of ideas from the other side.
[03:09.320 --> 03:10.880]  The people that hire us.
[03:11.840 --> 03:13.400]  And how to keep yourself safe.
[03:13.560 --> 03:15.360]  How to keep yourself interested and employed.
[03:15.860 --> 03:17.420]  So, here's a disclaimer.
[03:17.700 --> 03:19.460]  I am a law talking guy.
[03:19.800 --> 03:21.760]  I'm not your law talking guy.
[03:24.600 --> 03:27.240]  I'm going to talk generally about American law.
[03:27.440 --> 03:34.340]  If you are, you know, from Canuckistan, or the UK, or somewhere else, I'm probably making stuff up.
[03:36.640 --> 03:40.480]  I do... I've never worked as an HR person in my life.
[03:41.500 --> 03:43.760]  I do read their emails for a living.
[03:44.020 --> 03:45.520]  It's a really strange job.
[03:45.660 --> 03:46.820]  I'm a professional voyeur.
[03:48.520 --> 03:50.440]  I'm not saying that they're stupid.
[03:53.390 --> 03:56.030]  All the hypotheticals are, of course, based on real people.
[03:56.610 --> 03:59.090]  And I'm obfuscating them protect the guilty.
[03:59.910 --> 04:00.370]  Okay.
[04:01.290 --> 04:02.830]  I'm going to use a few terms.
[04:03.030 --> 04:03.950]  I'm going to mangle them.
[04:04.410 --> 04:06.350]  We have a definition of hacker.
[04:07.290 --> 04:08.270]  Curious person.
[04:08.390 --> 04:09.330]  Interested in stuff.
[04:09.850 --> 04:11.910]  Alternative way of looking at the universe.
[04:13.890 --> 04:15.770]  And then the others.
[04:16.070 --> 04:22.610]  The 99.9% of the population, when you say, when I tell my coworkers, I'm going to a hacker conference tonight.
[04:23.390 --> 04:23.670]  Oh.
[04:25.910 --> 04:28.590]  Could you have them, like, change my credit rating?
[04:31.390 --> 04:31.890]  No.
[04:35.850 --> 04:37.730]  So how do they view hackers?
[04:37.990 --> 04:39.230]  Evil computer criminals.
[04:40.570 --> 04:42.190]  Weird hair, black t-shirts.
[04:42.610 --> 04:44.170]  Well, a few of you did show up anyway.
[04:45.950 --> 04:47.570]  You are not to be trusted.
[04:47.850 --> 04:49.590]  You're not to be trusted around clients.
[04:49.790 --> 04:51.570]  You are not to be trusted around computers.
[04:51.910 --> 04:53.910]  You aren't to be trusted around anything.
[04:54.410 --> 04:55.470]  It's really interesting.
[04:55.590 --> 04:58.570]  When I say I'm going to a hacker conference, I'm fixing their computer.
[04:58.690 --> 05:00.430]  Even though I'm a lawyer, I always get asked that.
[05:00.590 --> 05:02.310]  And it's like, oh, you can't touch it anymore.
[05:02.890 --> 05:03.370]  What?
[05:03.530 --> 05:04.610]  You trusted me before?
[05:05.610 --> 05:06.090]  Anyway.
[05:07.350 --> 05:07.830]  Okay.
[05:08.310 --> 05:09.390]  Now some legal terms.
[05:10.010 --> 05:11.370]  Adverse employment action.
[05:11.570 --> 05:17.390]  This is something bad that happens to you and your relationship to your employer.
[05:17.670 --> 05:19.990]  It can be as limited as a demotion.
[05:20.230 --> 05:21.030]  It can be firing.
[05:21.290 --> 05:23.050]  It could be a failure to hire.
[05:24.610 --> 05:26.230]  An employment agreement.
[05:27.010 --> 05:30.490]  This is the little piece of paper you get when you first start a job.
[05:30.790 --> 05:32.990]  This is not necessarily a contract.
[05:33.390 --> 05:34.250]  There's a difference.
[05:34.590 --> 05:38.130]  An employment agreement is, here are the rules by which you work.
[05:39.030 --> 05:41.430]  None of this is binding on us, the employer.
[05:42.030 --> 05:43.870]  You don't do this, we'll fire you.
[05:44.030 --> 05:46.330]  We don't do our side, eh, you can quit.
[05:48.310 --> 05:49.150]  Employee handbook.
[05:49.290 --> 05:50.990]  That's the bigger, more general stuff.
[05:51.290 --> 05:56.130]  These are the things you shouldn't do, and I do on a daily basis anyway, just to kind of irk them.
[05:57.950 --> 05:58.970]  For cause.
[05:59.370 --> 06:03.890]  This is a discharge, firing, for a breach of the employment agreement.
[06:06.290 --> 06:06.770]  Okay.
[06:07.170 --> 06:08.210]  At real employment.
[06:08.470 --> 06:11.810]  This is the rule in every state in the United States.
[06:12.370 --> 06:16.050]  Lawyers will often say, it's the rule in your state and most states.
[06:16.170 --> 06:19.330]  And I actually went and looked at the laws in all 50 states.
[06:19.490 --> 06:21.590]  Montana has a modified version of it.
[06:21.730 --> 06:27.450]  So if any of you are employed in the state of Montana, ask me later how this is different.
[06:27.790 --> 06:28.510]  It really isn't.
[06:29.710 --> 06:32.810]  The rules are, y'all can break up at any time.
[06:33.370 --> 06:34.470]  You are not married.
[06:34.690 --> 06:38.470]  You are maybe going steady with your job.
[06:38.710 --> 06:39.630]  Your employer and you.
[06:39.950 --> 06:42.630]  Either of you can leave, at any time.
[06:43.350 --> 06:44.430]  For any reason.
[06:45.830 --> 06:48.610]  Including stupid ones, or even incorrect ones.
[06:49.370 --> 06:54.150]  I heard that you stole a car, went across state lines, and molested 12-year-old.
[06:54.450 --> 06:56.450]  No, that was my coworker.
[06:56.830 --> 06:57.810]  Yeah, firing you anyway.
[06:59.510 --> 07:00.730]  Are no reason at all.
[07:01.430 --> 07:03.330]  Hi, there are five of you in this work group.
[07:03.570 --> 07:04.590]  I count six.
[07:04.910 --> 07:06.010]  Not so fast.
[07:09.980 --> 07:13.140]  As long as said reason is not an illegal one.
[07:13.960 --> 07:14.360]  Hmm.
[07:14.940 --> 07:20.280]  We'll just say there are six employees, five white guys, and one who is not a white guy.
[07:21.080 --> 07:22.700]  We fire the person who isn't.
[07:22.860 --> 07:26.920]  Now, if we fire them because they weren't a white guy, that's illegal.
[07:27.200 --> 07:31.100]  If we fire them because, well, just because we wanted to, that's okay.
[07:31.100 --> 07:33.360]  It's proving the difference is the fun part.
[07:36.530 --> 07:37.050]  Okay.
[07:37.290 --> 07:40.210]  There are some exceptions to at will employment.
[07:40.750 --> 07:42.550]  Um, an employment contract.
[07:43.290 --> 07:47.530]  That changes, that says, this is not an at will environment.
[07:47.870 --> 07:55.450]  Um, usually, if even if you ever do have an employment contract, they will say, this is at will, which means either of us can say, up yours.
[07:57.030 --> 08:02.710]  Some states, oddly, imply an employment contract and a good faith bargaining, like Massachusetts.
[08:03.110 --> 08:05.670]  But I don't really understand Massachusetts.
[08:05.670 --> 08:15.170]  Um, also, if you, you may also have a contract with your employer that you, you independently did not write or sign.
[08:15.430 --> 08:16.690]  If you are a member of a union.
[08:17.330 --> 08:20.130]  Um, if you are a member of the civil service.
[08:20.370 --> 08:22.690]  If you are an academic and you have tenure.
[08:25.710 --> 08:26.230]  Okay.
[08:26.730 --> 08:29.170]  So, another term, wrongful discharge.
[08:29.750 --> 08:32.950]  This is a much more limited thing than most people think.
[08:33.410 --> 08:39.610]  I get numerous calls from people, even non-hackers who are, uh, you know, so-and-so's never liked me.
[08:39.750 --> 08:41.290]  They came in, they said I was fired.
[08:41.510 --> 08:42.170]  That's wrong.
[08:42.370 --> 08:43.170]  I want to sue.
[08:44.030 --> 08:45.010]  No, you can't.
[08:45.070 --> 08:47.970]  Well, you can actually, if you pay me and I'll file a frivolous lawsuit.
[08:48.090 --> 08:49.430]  I'll happily do that for money.
[08:49.750 --> 08:54.030]  Um, but this doesn't actually prevent you from being fired.
[08:54.190 --> 08:55.510]  They can still walk you out the door.
[08:55.970 --> 09:00.410]  Uh, it gives you the right to sue for your damages if it truly was a wrongful firing.
[09:00.810 --> 09:02.510]  However, it's much more limited.
[09:02.750 --> 09:09.970]  If you were fired because of your race, sex, religion, age if you're over 40, or sexual preference in certain states.
[09:11.250 --> 09:18.090]  Now, usually I get the question, well, why then do we have to document all this bullshit about the employee who doesn't perform?
[09:18.510 --> 09:20.970]  This is because this is the HR department thinking.
[09:21.870 --> 09:24.310]  Um, the documentation of every incident.
[09:24.530 --> 09:27.810]  Sheila showed up late 19 times that's 20 days of work.
[09:29.350 --> 09:33.030]  Or you've done your job so badly, we're going to give you a performance contract.
[09:33.230 --> 09:34.370]  That usually sounds like a cool thing.
[09:34.470 --> 09:37.930]  I remember when a coworker of mine got a performance contract, like, dude, how do I get one of those?
[09:38.610 --> 09:39.990]  And then he was gone.
[09:40.610 --> 09:42.650]  Uh, so I was like, oh, maybe I don't want one of those.
[09:45.210 --> 09:45.570]  Okay.
[09:46.170 --> 09:50.910]  Another way that you can be wrongfully fired is what we call whistleblower protection.
[09:51.310 --> 09:52.950]  This is also much more limited.
[09:54.050 --> 10:04.890]  If you, as an employee, working for your employer, and you see something wrong, big wrong, capital W wrong, spear deep in the tree of life wrong.
[10:05.910 --> 10:09.230]  Um, thank you, someone who's got that right.
[10:12.150 --> 10:19.670]  You say, wait a minute, you know, um, we work at a nursing home and I've noticed instead of giving them orange juice, we've been giving them cyanide.
[10:23.220 --> 10:25.980]  Um, something tells me that's wrong, right?
[10:26.320 --> 10:32.840]  You go to your boss and say, um, cyanide is not an approved, uh, food substance.
[10:33.500 --> 10:34.940]  They can still fire you.
[10:35.690 --> 10:47.710]  You have to go to the requisite, um, governmental or, um, if there's like a, an ethics board or whatever, and you go to them, you rat out your company, then you're protected.
[10:48.000 --> 11:04.100]  Odd, because I would think you as an employer would like to know, would like to be able to have employees rat them out because you would like to know before, you know, before the cops go, hi, um, cyanide, not approved.
[11:04.380 --> 11:05.400]  It doesn't taste like Tang.
[11:08.500 --> 11:10.920]  There's also this weird public policy thing.
[11:11.080 --> 11:14.240]  It's pretty limited to actually doing criminal acts.
[11:14.530 --> 11:24.820]  Our retaliation for civic duty, namely jury duty, all the cases I was reading for prepping this case, this talk, it's like, wow, like how many people get fired for going to jury duty?
[11:25.480 --> 11:26.380]  Evidently a fair amount.
[11:27.620 --> 11:28.030]  Okay.
[11:28.860 --> 11:30.680]  How do people view the world?
[11:31.300 --> 11:35.240]  This is, um, maybe I should add to this disclaimer, I'm in no way a sociologist.
[11:35.440 --> 11:40.540]  I am married to one, which means that I am, um, well, I'm an oppressor, but nonetheless.
[11:42.800 --> 11:44.760]  Um, okay.
[11:45.340 --> 11:52.080]  Hackers, and I'll count myself one of them, rules, bureaucracy, they're things that get in the way of fun.
[11:52.300 --> 11:55.800]  They're the things that get in the way of actually getting what I'm supposed to be doing, doing.
[11:59.780 --> 12:02.660]  And also, you know, the more eyes find issues faster.
[12:02.840 --> 12:16.020]  Just because I'm, I do this job, if I, while doing this job, notice that the job that one of you guys is doing is doing it badly, or you've misunderstood something, I should jump in and go, hey, dude, um, don't do that.
[12:16.200 --> 12:16.820]  Do it this way.
[12:16.920 --> 12:17.400]  I'll be better.
[12:17.660 --> 12:18.660]  We'll have a better outcome.
[12:19.260 --> 12:22.300]  That's, you know, the very hacker nature.
[12:22.560 --> 12:24.400]  The, hey, I've got a barn.
[12:24.520 --> 12:25.420]  You've got an instrument.
[12:25.420 --> 12:26.480]  Let's put on a show.
[12:27.720 --> 12:31.920]  Um, new, also, fresh eyes always find the flaws.
[12:32.340 --> 12:34.660]  You know, you've been working on something for three weeks.
[12:34.760 --> 12:37.080]  Someone else walks in and goes, um, there's a problem.
[12:37.180 --> 12:38.640]  You go, oh, wow.
[12:39.160 --> 12:40.300]  So obvious now.
[12:41.320 --> 12:44.220]  However, training is boring.
[12:45.260 --> 12:50.420]  How many people have done, like, the occupational safety training where it's like, fire will burn you.
[12:51.300 --> 12:51.800]  Okay.
[12:52.860 --> 12:55.440]  I remember getting this when I work for a pharma company.
[12:55.600 --> 12:58.800]  It's, to use the virology lab, don't bring in food.
[12:59.720 --> 13:00.120]  Okay.
[13:02.120 --> 13:03.820]  That seemed obvious to me.
[13:06.580 --> 13:06.980]  Okay.
[13:06.980 --> 13:09.500]  Anything you do actually need to know is out there.
[13:09.640 --> 13:10.940]  There's a man page for it.
[13:11.180 --> 13:12.740]  If there isn't, you'll have to write one.
[13:12.840 --> 13:15.620]  But there's a book or there's a, you know, hell, I'll Google it and find it.
[13:16.920 --> 13:17.360]  Okay.
[13:17.360 --> 13:20.180]  So I'll start doing what I'm supposed to be doing before I actually know what I'm doing.
[13:20.400 --> 13:21.300]  That's the way to do it.
[13:22.180 --> 13:22.620]  Okay.
[13:23.140 --> 13:25.600]  Um, the HR approach.
[13:25.780 --> 13:28.880]  And I'll also lump in lawyers because we are trained to think the same way.
[13:30.260 --> 13:31.640]  Compartmentalization keeps us safe.
[13:32.520 --> 13:38.260]  If I don't let you do the thing that I don't think I want you to do, nothing bad can ever happen.
[13:39.700 --> 13:40.920]  We have policy.
[13:41.040 --> 13:41.660]  We have procedure.
[13:41.960 --> 13:45.560]  If we're following the policy and the procedure, nothing bad will happen.
[13:46.660 --> 13:50.700]  If you go outside the box, there be a grue.
[13:53.300 --> 13:55.700]  Risk averse to the nth degree.
[13:56.980 --> 14:01.560]  Um, explaining probability to lawyers, really, really hard to do.
[14:01.560 --> 14:07.200]  The chance that this will actually happen is so minuscule, but we have to predict against it in case it happens.
[14:07.880 --> 14:12.200]  Um, I once actually seriously tried to sell someone, uh, robot insurance.
[14:12.560 --> 14:14.480]  And they're like, there is a chance this could happen.
[14:14.640 --> 14:15.840]  Oh, well, what's it cost?
[14:16.180 --> 14:17.260]  Dude, it's a joke.
[14:19.900 --> 14:21.620]  It is a scary world out there.
[14:22.200 --> 14:23.760]  You can get sued for anything.
[14:23.940 --> 14:25.360]  That's why we hire experts.
[14:26.260 --> 14:27.660]  Trust the experts.
[14:28.900 --> 14:30.220]  That's why they're experts.
[14:30.480 --> 14:32.440]  Because they're experts, you have to trust them.
[14:34.520 --> 14:35.880]  Even when they're mistaken.
[14:37.140 --> 14:39.700]  Even when you're also qualified to be one.
[14:40.000 --> 14:49.980]  I remember, um, personal story, uh, discussing this with a few other people at an electronic discovery company where they said, well, you can't say that.
[14:50.140 --> 14:52.320]  It was some weird point of civil procedure.
[14:52.520 --> 14:54.800]  And it's like, well, actually, I'm, I'm also a licensed attorney.
[14:55.020 --> 14:56.340]  I actually kind of know this stuff.
[14:56.460 --> 14:58.380]  I had to take like a test and all for three days.
[14:58.940 --> 15:02.380]  It's like, well, well, well, they know what they're doing.
[15:02.780 --> 15:03.440]  So do I.
[15:03.600 --> 15:03.840]  Okay.
[15:03.940 --> 15:05.460]  I'll shut up and just go back to coloring.
[15:07.520 --> 15:07.900]  Okay.
[15:08.080 --> 15:10.920]  So you are an employer.
[15:11.380 --> 15:18.060]  How many people here are, um, have worked as sysadmins or network security people or something else like that?
[15:18.160 --> 15:18.680]  Raise your hands.
[15:19.160 --> 15:19.540]  Okay.
[15:19.660 --> 15:24.340]  How many of you view your users, not as people, but individual risks?
[15:24.900 --> 15:27.680]  All they want to do is f*ck your shit up.
[15:29.380 --> 15:30.760]  They're not doing work.
[15:30.940 --> 15:35.160]  They're coming up with new and unusual ways to f*ck your shit up.
[15:37.520 --> 15:38.060]  Right?
[15:42.770 --> 15:43.570]  Guess what?
[15:43.730 --> 15:45.390]  HR looks at you guys the same way.
[15:47.950 --> 15:52.330]  HR looks at you and goes, some of you are going to sexually harass your workmates.
[15:52.750 --> 15:56.710]  Some of you are going to get drunk and run over someone in the parking lot.
[15:59.530 --> 16:00.030]  Come on.
[16:00.550 --> 16:02.150]  The lawyers are trained to think this way.
[16:02.270 --> 16:03.850]  Like, oh, oh, we hired a new person.
[16:04.050 --> 16:06.350]  What if they spontaneously combust?
[16:08.270 --> 16:09.570]  Are we insured for that?
[16:09.770 --> 16:10.210]  I don't know.
[16:10.310 --> 16:11.350]  We need to do due diligence.
[16:13.710 --> 16:25.390]  So, you as hackers, when you come out of the closet to your employer and say, I'm a hacker, they instantly don't go, oh, wow, someone who will be really energetic and creative.
[16:25.610 --> 16:28.730]  No, it's, oh my god, what will this person do to us?
[16:29.170 --> 16:30.470]  They can get us fined.
[16:30.570 --> 16:31.750]  They can get them sued.
[16:32.010 --> 16:33.470]  They could be embarrassing.
[16:34.350 --> 16:36.590]  And they could thrust us into uncertainty.
[16:38.130 --> 16:38.570]  Okay.
[16:40.030 --> 16:41.850]  There's a mess of acronyms out there.
[16:42.050 --> 16:43.750]  I'm sure some of you have seen this.
[16:53.490 --> 17:04.390]  I don't know this, but I'm sure some consultant, at some point, has said, this has to be CALEA compliant, or SOX compliant.
[17:05.010 --> 17:16.430]  And I know, I know consultants have, I mean, I don't know this, but I'm sure some consultant, at some point, has said, this, you know, this power strip is SOX compliant.
[17:16.830 --> 17:17.730]  That's why it's $100.
[17:21.270 --> 17:22.130]  Good on them.
[17:22.630 --> 17:31.370]  But we're, you know, employers and HR people and lawyers who aren't me, look at this and go, oh my god, there's a new rule.
[17:31.470 --> 17:33.030]  And I don't know what it means.
[17:33.050 --> 17:37.630]  So we have to spend money on an expert to tell us that we're okay, because I'm relying on the
[17:40.710 --> 17:41.190]  expert.
[17:41.190 --> 17:45.230]  Just because, though, that they're actually just fodder doesn't mean it doesn't scare them.
[17:46.670 --> 17:50.670]  Basically, though, disclosure sensitive data is bad things, because you're hackers.
[17:51.050 --> 17:56.010]  You are evil people who will want to get those secrets and like, I don't know, put them on Twitter.
[18:00.010 --> 18:06.890]  Ironically, most of these are kind of toothless acts, because the only people that regulate these are the feds.
[18:07.030 --> 18:07.750]  They're busy.
[18:07.930 --> 18:14.030]  They're busy, you know, doing whatever they do, like the SEC watching porn, rather than, you know, regulating Wall Street or whatever.
[18:14.290 --> 18:23.070]  But because individual people can't sue for, you put my credit report and my medical history on Twitter.
[18:24.010 --> 18:25.230]  No, you can't sue for that.
[18:25.390 --> 18:25.590]  Sorry.
[18:26.990 --> 18:29.250]  They can get fined like 100 bucks or something like that.
[18:30.210 --> 18:33.550]  So, however, you can get sued for hacking at work.
[18:35.170 --> 18:40.670]  Wiretap, actual damages, profits, or $100 a day for violating 18 U.S.C.
[18:40.970 --> 18:41.470]  2511.
[18:44.010 --> 18:50.350]  The Stored Communications Act, if you leak someone else's email that's stored on a server, that's also illegal.
[18:52.130 --> 18:53.370]  Not much of a fine, though.
[18:55.110 --> 19:03.310]  The fact is the, I think that's also credit reports, private cause of action for negligent or willful disclosure.
[19:03.550 --> 19:04.790]  I don't know what your damages are.
[19:06.730 --> 19:11.250]  But you leak information about a person that you have, you hold their data.
[19:11.450 --> 19:13.050]  Say, for example, you're an insurance company.
[19:13.390 --> 19:17.890]  You leak the information that, I don't know, there's something embarrassing about them.
[19:18.490 --> 19:20.790]  You know, they wanted to ensure their dildo collection.
[19:21.810 --> 19:22.810]  You know, wow.
[19:23.090 --> 19:23.990]  That's kind of an intrusion.
[19:24.130 --> 19:25.750]  There's a clue over that.
[19:27.930 --> 19:33.890]  But the reason why I bring all this shit up is the people, the HR people are like, oh my god, you could do this.
[19:34.090 --> 19:36.650]  You could embarrass us a great deal.
[19:36.710 --> 19:37.430]  You get us sued.
[19:39.510 --> 19:49.650]  And, of course, the organization themselves are liable because, well, they negligently hired you, or they negligently supervised you, or they negligently entrusted you with their stuff.
[19:51.890 --> 19:57.710]  And, of course, if you yourself are negligent in doing your job, they are liable.
[19:57.830 --> 20:01.270]  Which is why we sue companies, not individuals, because you all don't have anything.
[20:01.490 --> 20:04.730]  But if I sue, if you work for Comcast, Comcast has stuff.
[20:08.070 --> 20:08.510]  Okay.
[20:09.030 --> 20:09.470]  Embarrassment.
[20:09.570 --> 20:10.750]  This is actually a bigger fear.
[20:10.750 --> 20:17.090]  Um, it causes discord in the corporate... uh, shaft.
[20:20.070 --> 20:21.110]  Knowing secrets.
[20:21.390 --> 20:29.210]  I mean, who here who has been an assistant admin has not looked through, I don't know, the shares, looking for anything interesting that they administer.
[20:29.610 --> 20:34.170]  I know, I can actually now admit to this, because the statute of limitations has passed.
[20:34.170 --> 20:41.670]  Uh, I remember writing a script that, um, pulled anything out of the print queue, if it had the word layoff in it.
[20:44.130 --> 20:46.170]  Um, that worked really well.
[20:46.550 --> 20:58.140]  It also, mostly to find out which of my really problematic end users would get laid off, so that way I could, like, walk their stuff out.
[21:00.420 --> 21:01.990]  You see now why I'm an attorney.
[21:03.710 --> 21:17.960]  Um, also, think of things like, though, you know, uh, if you were, say, a, you know, you take credit cards in your business, and you end up on data loss DB, or making the nightly news, you know, losing customers, lowering stock prices.
[21:18.560 --> 21:21.560]  Uh, that doesn't really come up, but that's what you got.
[21:25.310 --> 21:26.610]  Sorry, I'm involved in that.
[21:27.350 --> 21:27.990]  Um, okay.
[21:28.470 --> 21:28.870]  Uncertainty.
[21:28.990 --> 21:38.830]  This is really where you do screw things up, because you guys, when you look at stuff, you, you may make the powers that be have to change what they do.
[21:39.230 --> 21:49.370]  If you point out something, like, hey, we're completely unsecured in this, or we're doing this completely broken, now they know.
[21:49.550 --> 21:52.470]  Now they actually have to do something about it, and it makes them have to think.
[21:52.610 --> 21:53.870]  It makes, it gets them out of their box.
[21:55.330 --> 22:11.570]  That will cost a lot of money, a lot of effort, and if people who are, you know, who have vice president or president, or see something O in their name, in their titles, and they champion this, it makes them look stupid, which is far worse than actually losing money.
[22:14.230 --> 22:14.670]  Okay.
[22:15.410 --> 22:17.470]  So, enough ranting about stupid people.
[22:17.670 --> 22:19.250]  I'm going to give a couple case histories.
[22:19.850 --> 22:26.010]  And these are people who were hackers, who had jobs, and let's see how things played out.
[22:26.390 --> 22:26.510]  Okay.
[22:26.750 --> 22:27.030]  Vinny.
[22:28.610 --> 22:31.050]  Vinny works for an IT consulting company.
[22:31.290 --> 22:32.450]  You have heard of the company.
[22:34.210 --> 22:36.970]  He is an, he's a security analyst.
[22:37.370 --> 22:44.770]  His job is to get, you know, to come to your place of employment, and go, yes, this is adequately secure.
[22:45.070 --> 22:46.810]  We've audited it, and it's all okay.
[22:47.910 --> 22:50.010]  He also goes to a hacker conference.
[22:50.330 --> 22:53.490]  This is a hacker conference where there's a lot of alcohol served.
[22:56.510 --> 23:08.730]  While there's a discussion about some aspect of physical security, he points out that one of his company's clients isn't really doing something correctly.
[23:10.010 --> 23:16.490]  Because one of the client's employees is also there, and they're talking over beers, and like, hey, you know, this is kind of broken.
[23:19.190 --> 23:27.690]  The problem is there's another attendee at the conference who's listening in and hears Vinny say, I still have access to your stuff.
[23:28.350 --> 23:33.090]  I no longer am on your project, so I should not have it.
[23:33.230 --> 23:34.130]  But I've tested it.
[23:35.070 --> 23:39.090]  And, well, the other attendee freaks out.
[23:41.270 --> 23:42.390]  Makes a couple calls.
[23:43.610 --> 23:47.230]  And, well, Vinny then calls me and says, I'm in trouble.
[23:48.030 --> 23:48.850]  What do I do?
[23:49.010 --> 23:50.930]  And I tried to help him through it.
[23:51.130 --> 23:54.690]  And he's actually, he's working again.
[23:54.870 --> 23:56.850]  So, but for a while, it was kind of scary.
[23:56.930 --> 24:06.490]  Because it's like, wait a minute, you've, you, by being at a hacker conference and talking about security with someone who should know about it, gets him chitcanned.
[24:06.710 --> 24:07.470]  It's kind of wrong.
[24:07.670 --> 24:14.170]  Because, you know, from my point of view, if I were an employer, I would like people to tell me when I'm doing something wrong.
[24:15.190 --> 24:17.610]  You know, I like criticism, except when it's from my wife.
[24:18.990 --> 24:20.270]  Because I'm never right then.
[24:22.710 --> 24:23.190]  Okay.
[24:23.550 --> 24:24.090]  Another story.
[24:24.310 --> 24:24.590]  Ralph.
[24:25.350 --> 24:30.770]  Ralph is, Ralph's one of those people that you call when you call an ISP.
[24:31.090 --> 24:35.390]  And they ask you stupid things like, is it on?
[24:37.470 --> 24:38.570]  Have you rebooted?
[24:40.170 --> 24:46.270]  And you think, though, that the reason why they're asking you that is not because they have a flow chart in their cube.
[24:46.430 --> 24:47.590]  Because they do have a flow chart.
[24:47.750 --> 24:51.290]  But they have to ask, because 99% of the people, that will actually help.
[24:51.870 --> 24:53.470]  But Ralph is curious.
[24:54.090 --> 24:55.710]  Ralph is also bored.
[24:57.310 --> 24:58.590]  He's also ambitious.
[24:59.470 --> 25:03.510]  He notices a security hole in an application at work.
[25:03.790 --> 25:13.750]  That, well, it allows anyone to obtain all the HR information, like social security numbers, payroll, of anyone in the organization.
[25:15.230 --> 25:17.050]  He is kind of bothered by this.
[25:17.150 --> 25:20.770]  Because if we're doing this, what else are we doing wrong?
[25:23.710 --> 25:24.850]  Plays with it for a while.
[25:25.130 --> 25:26.990]  Says, I think I know what the problem is.
[25:27.130 --> 25:28.950]  I think I know the extent of the problem.
[25:30.170 --> 25:31.150]  Goes to his boss.
[25:31.270 --> 25:33.570]  His boss is like, you are awesome, Ralph.
[25:34.170 --> 25:36.010]  This is great information.
[25:36.370 --> 25:40.890]  I am going to kick it up the ladder and pat on the head.
[25:44.930 --> 25:47.190]  And he's calling me in the parking lot.
[25:47.290 --> 25:49.450]  Like, hey, I read 2600.
[25:49.670 --> 25:50.790]  I saw your ad.
[25:51.310 --> 25:53.370]  I'm in the parking lot of my old job.
[25:53.410 --> 25:54.650]  Like, I'm sorry.
[25:54.650 --> 25:55.530]  What happened?
[25:56.370 --> 25:56.990]  Goes through this.
[25:57.110 --> 25:59.110]  Like, yeah, you're f*cked.
[25:59.230 --> 25:59.590]  Sorry.
[25:59.850 --> 26:01.850]  You know, I love giving advice like that.
[26:01.850 --> 26:06.890]  I think there's no way in God's earth I can help you other than I would have a beer with you.
[26:10.130 --> 26:13.590]  Because even though, you know, I mean...
[26:14.630 --> 26:19.490]  Even though you were helping them out, you were doing something outside your job description, they can fire you.
[26:19.850 --> 26:23.110]  Hell, that you showed up wearing shoes today, they can fire you.
[26:28.760 --> 26:29.720]  Okay, Sue.
[26:31.160 --> 26:37.220]  Sue is... and I tried to... I spent a lot of time writing this one line because I wanted to concatenate it.
[26:37.720 --> 26:42.960]  She is the IT department, the sole IT department at a branch office of a larger company.
[26:43.200 --> 26:44.960]  So she's the go-to gal.
[26:45.280 --> 26:53.500]  Anything from there's a printer jam, I can't get online, email's broken, we're having a new employee start, all that stuff.
[26:53.620 --> 26:55.960]  You know, the Jack are actually, in this case, Jill of all trades.
[26:57.420 --> 26:58.860]  She's security aware.
[26:59.880 --> 27:05.880]  But the security people, people like CISSP after their name, are in the main office.
[27:06.140 --> 27:06.980]  They're serious.
[27:07.820 --> 27:09.660]  Some of you may... one of them may be in this room.
[27:09.900 --> 27:14.300]  But nonetheless, Sue, though, is, you know, hey, I'm interested in this stuff.
[27:14.680 --> 27:16.180]  I, you know, I want to do my job better.
[27:16.400 --> 27:18.100]  I'd like to go to the main office, maybe.
[27:20.460 --> 27:29.680]  And she also notices, well, because we handle credit card transactions, there's a way I can obtain credit card information over the network.
[27:30.740 --> 27:33.640]  We're on the network, namely the, you know, the Internets.
[27:33.860 --> 27:37.520]  And via this series of tubes, I can grab credit card information.
[27:37.700 --> 27:38.360]  It's not encrypted.
[27:38.700 --> 27:41.340]  This is, well, what I'd like to think of as a bad thing.
[27:44.020 --> 27:46.960]  Unfortunately, the company is in bad, bad times.
[27:48.960 --> 28:00.680]  The headquarters staff, when she kind of reports this and kind of catches the security team flat-footed by saying, um, we're, we're passing credit card information in plain text over the Internet.
[28:01.220 --> 28:02.580]  This is bad.
[28:03.340 --> 28:05.740]  Um, is there a way we can fix this?
[28:06.080 --> 28:08.360]  And there's some, it sounds like there's a little bit of a pissing match.
[28:08.480 --> 28:09.040]  Like, no, it isn't.
[28:09.040 --> 28:09.840]  Here's the trace.
[28:10.080 --> 28:11.160]  You know, I've, I've sniffed.
[28:11.780 --> 28:12.720]  What's that look like?
[28:12.820 --> 28:13.840]  Does that look like your credit card number?
[28:13.960 --> 28:14.640]  It looks like one to me.
[28:17.660 --> 28:32.400]  However, while they're not very good at security, they are good at going to the HR people, powers that be, and basically they reframe it and make it look like she's the one who caused it, not she's the one who noticed it.
[28:32.640 --> 28:38.760]  And so Sue is calling me saying, um, can you help me negotiate like a settlement package?
[28:42.620 --> 28:48.600]  Except, of course, that I changed the name to Sue because those talk about litigation didn't change it later calling her Sid.
[28:48.900 --> 28:49.660]  But nonetheless, sorry.
[28:50.160 --> 28:50.660]  Okay, Bob.
[28:51.760 --> 28:56.980]  Yeah, clearly, uh, uh, taking New Jersey Transit up here while I'm dinking with this last minute, not good move.
[28:57.440 --> 28:58.160]  Okay, Bob.
[28:58.340 --> 29:00.680]  Works as a contract employee for a law firm.
[29:01.280 --> 29:03.180]  Not security curious at all.
[29:03.570 --> 29:04.460]  Doesn't care.
[29:05.260 --> 29:07.400]  Not really even a, not a hacker at all.
[29:09.100 --> 29:13.020]  Intervertently clicks in the wrong link in the Outlook, uh, web mail.
[29:14.420 --> 29:18.360]  Interestingly enough, this company uses Outlook for everything.
[29:19.120 --> 29:25.160]  Like, I've never seen a database function in Outlook that would let you do pull up resumes.
[29:25.460 --> 29:25.900]  They do.
[29:26.040 --> 29:29.340]  And I'm like, whoa, that's weird.
[29:29.640 --> 29:32.200]  But hey, I've never seen it.
[29:32.220 --> 29:35.400]  Um, has global access to sensitive data.
[29:35.700 --> 29:41.260]  Like, every contract this law firm has with another company.
[29:41.960 --> 29:44.740]  Um, all the people that are on it.
[29:45.500 --> 29:47.140]  Their hourly rates.
[29:47.980 --> 29:50.050]  Um, what they're paid.
[29:50.840 --> 29:52.360]  Um, child support payments.
[29:52.550 --> 29:56.540]  Like, just this, this information would be really, really, really humiliating to get out there.
[29:57.180 --> 29:58.200]  And he just clicked.
[29:58.340 --> 30:01.100]  I'm like, whoa, I, I clicked on the wrong thing.
[30:01.280 --> 30:03.550]  And all of a sudden, I found someone's child support payments.
[30:05.360 --> 30:20.170]  Um, informs a security conscious coworker, or a coworker, who, um, basically does everything wrong.
[30:20.810 --> 30:28.370]  Instead of kind of soft peddling it to the powers that be to say, hey, um, I, I have some curiosity.
[30:28.370 --> 30:30.030]  Do you mind if I take a look at this?
[30:30.190 --> 30:31.470]  Oh, look what I found.
[30:31.930 --> 30:39.570]  Instead, said security conscious coworker jumps up, plays with it, and decides, as a joke, um,
[30:42.770 --> 30:51.010]  imagine, because there's one bit where they would, the, the, the, the, the kind of the database where they determined who would get hired for projects.
[30:51.830 --> 31:00.350]  So this, sorry, this security conscious coworker, namely me, says, well, I think Alex will be the only person in this database.
[31:00.670 --> 31:04.950]  So that way, if there's any job ever that comes up, my resume pops up first.
[31:05.370 --> 31:11.610]  I make that joke, pulling the person who's actually heading up the project and go, I think this, we should fix this.
[31:11.710 --> 31:17.470]  Unless you want me to be hired for every project from now on, including ones that I am completely incompetent to do.
[31:18.790 --> 31:20.390]  I actually don't get fired.
[31:20.890 --> 31:22.750]  I think that's pure luck.
[31:22.910 --> 31:25.830]  I would not do, I would not recommend doing this at all.
[31:27.890 --> 31:29.610]  Okay, next story.
[31:30.290 --> 31:30.850]  Janice.
[31:31.870 --> 31:33.970]  She has hired as first level tech support.
[31:34.170 --> 31:38.790]  She is a very proud hacker.
[31:38.790 --> 31:46.190]  She's doing, she's inside doing tech support for customers of the, one of the products that this company does.
[31:46.730 --> 31:49.830]  It's something that you don't want the information to get out.
[31:49.970 --> 31:52.710]  They have a really strange way of distributing the information.
[31:52.910 --> 31:59.710]  They, it's basically dumping large amounts of financial data onto DVDs that they ship via postal mail.
[32:00.210 --> 32:09.570]  And on these DVDs are several thousand to maybe 20 to 50,000 transactions, including things like routing numbers, bank numbers.
[32:11.010 --> 32:16.050]  All the information, I mean, like this is like, you know, information theft, a gold mine.
[32:16.210 --> 32:20.310]  One of these DVDs would be awesome to have because you just, you know, I mean, screw credit cards.
[32:20.570 --> 32:25.590]  These are actually bank, these are bank statements, bank routing numbers, wire numbers.
[32:25.890 --> 32:28.830]  I imagine you could turn this into a fairly lucrative business.
[32:31.450 --> 32:33.810]  Her customers are concerned about security.
[32:34.730 --> 32:40.830]  These, this information is actually sent unencrypted because no one ever loses postal mail.
[32:44.960 --> 32:47.560]  So they're like, well, we're going to fix this.
[32:47.710 --> 32:49.710]  And the problem is, is that it's okay.
[32:49.860 --> 32:52.380]  Now we're sending encrypted DVDs.
[32:53.210 --> 32:56.780]  Unfortunately, they don't work when they get in the customer's hands.
[32:57.180 --> 32:59.660]  So the customers are then saying, well, we have a choice.
[32:59.860 --> 33:06.940]  We can either get security that doesn't work, or we can go back to the old system, which is insecure, but it actually lets us do our business.
[33:10.330 --> 33:11.620]  Janice comes up with a solution.
[33:11.780 --> 33:13.820]  Like, I've got a different way we can encrypt this.
[33:14.350 --> 33:17.520]  It's I think she described it as like it's auto decrypting.
[33:17.660 --> 33:20.440]  So it sounds like it's like an executable that that packages it.
[33:20.600 --> 33:26.710]  So it's, you know, it's like a stuff it or one of those other uh, uh, thank you.
[33:26.840 --> 33:27.240]  I'm sorry.
[33:27.460 --> 33:28.680]  I'm being interticulate right now.
[33:29.060 --> 33:30.680]  Really, really slick, slick solution.
[33:30.920 --> 33:34.920]  She comes up with this idea, goes to her boss and says, I would like to test this.
[33:35.120 --> 33:37.880]  I have a willing customer who have kind of sold on the idea.
[33:39.980 --> 33:41.320]  And everybody's happy.
[33:41.560 --> 33:43.020]  She is still employed.
[33:43.760 --> 33:48.240]  Um, she's actually like now, like, you know, senior, something, something, something engineer.
[33:48.880 --> 33:56.220]  So she's no longer on the help desk, which I think is probably what many of us who have been on the help desk would really want to do.
[33:59.000 --> 33:59.440]  Okay.
[34:00.210 --> 34:01.440]  Basic, basic takeaways.
[34:03.140 --> 34:09.020]  This is one of the few times in your life that it's better to ask for permission than it is to ask for forgiveness.
[34:09.580 --> 34:11.780]  I hate saying that, but it's true.
[34:13.700 --> 34:16.340]  Better yet, get it written in your job description if you can.
[34:16.760 --> 34:18.060]  I want to hack at work.
[34:18.180 --> 34:19.240]  I want to play with security.
[34:19.580 --> 34:21.860]  Can I have my job description changed?
[34:22.140 --> 34:27.060]  So that way, when you come to me and say, you were screwing around, like, no, it's my job.
[34:29.940 --> 34:36.740]  Or if they're not going to be that much fun, um, get basically just a document that says, this is cool.
[34:39.660 --> 34:41.560]  Document everything you do.
[34:43.900 --> 35:01.440]  Permission, what you did, who you talked to, in case things get funny, which they often do, because you... and the reason why I say this, doing it writing rather than doing it orally, is invariably, what they think they agreed to, and what you think they agreed to,
[35:01.440 --> 35:06.720]  are different, and you never want to get called into HR and have to explain that, because you lose.
[35:09.680 --> 35:10.200]  Okay.
[35:11.180 --> 35:19.560]  Say, for example, you screwed up, or the employer screwed up, and you're now like, oh, God, I am going to get fired.
[35:20.180 --> 35:20.880]  Now what?
[35:21.360 --> 35:23.380]  Because it's not over when you get fired.
[35:23.910 --> 35:26.320]  I mean, how many people in this room have been fired?
[35:27.900 --> 35:28.340]  Wow.
[35:28.600 --> 35:28.980]  That few.
[35:30.800 --> 35:31.240]  Okay.
[35:31.600 --> 35:32.300]  First step.
[35:32.560 --> 35:34.320]  Be very careful what you agreed to.
[35:34.640 --> 35:36.020]  Everything is still negotiable.
[35:38.760 --> 35:44.400]  If it is time to go, you, you either, you're going to get fired, or you have to quit, because they're going to do something nasty.
[35:45.460 --> 35:48.840]  Uh, like, they're going to basically slander your professional reputation.
[35:50.440 --> 35:51.140]  First thing.
[35:51.720 --> 36:00.600]  While you're, while they still have stuff that they want from you, and you have stuff that they, that, that you need from them, consider getting a negotiated letter of reference.
[36:01.100 --> 36:04.720]  It's far better to do this now than it is a couple months from now.
[36:05.160 --> 36:08.380]  So that way, you can still put them on your resume.
[36:10.980 --> 36:12.700]  Um, this is a nice little touch.
[36:12.840 --> 36:20.260]  A non-disparagement clause to your separation contract that says, you won't speak ill of me, I won't speak ill of you.
[36:22.760 --> 36:25.440]  You don't contest my unemployment compensation.
[36:28.500 --> 36:30.660]  An agreement to consult with transition.
[36:30.860 --> 36:42.000]  This is a common one if you are, if you've built something that only you know how it works, or even something as simple as, only I know the passwords to these eight things.
[36:42.980 --> 36:44.660]  Oftentimes, that's what they would like.
[36:45.300 --> 36:48.660]  Um, better yet, negotiate a rate in there.
[36:49.120 --> 36:56.360]  Um, I, I know friends that have actually made more money being fired than they have actually working for the company.
[36:57.120 --> 36:58.980]  Because they would get phone calls back.
[36:59.300 --> 37:03.060]  A good friend of mine, uh, I hate him, um, because he did this.
[37:03.200 --> 37:04.820]  He's like, yeah, they're flying me to San Diego.
[37:05.060 --> 37:06.400]  It's February in Boston.
[37:06.540 --> 37:07.860]  Like, oh yeah, that must suck.
[37:08.620 --> 37:13.000]  Yeah, that, that, that system, that system we built, yeah, they're still maintaining it.
[37:13.240 --> 37:15.660]  I don't, I'm the only one who knows, but you quit there like three months ago.
[37:15.860 --> 37:16.920]  I know, but it's a vacation.
[37:17.460 --> 37:18.420]  I hate you.
[37:20.940 --> 37:21.740]  Don't get cute.
[37:21.940 --> 37:22.580]  Don't get stupid.
[37:23.280 --> 37:26.680]  Um, don't do things like, I'm going to delete everything on the hard drive.
[37:26.960 --> 37:29.420]  Um, that, of my laptop that you gave me.
[37:29.780 --> 37:33.580]  You know, be, be, be absolutely f*cking professional at this point.
[37:33.800 --> 37:35.980]  Because it's gonna, it's gonna work in your benefit later.
[37:37.220 --> 37:39.840]  But, don't let them get cute with your property.
[37:40.480 --> 37:48.540]  They want to do something like, I've seen this, um, we want to audit all your personal systems in case you have customer data on them.
[37:48.800 --> 37:49.160]  No.
[37:49.880 --> 37:51.840]  I'll certify that there's no customer data.
[37:52.000 --> 37:56.980]  If you want, I'll build you a forensic image, give it to you, and you have to send it back to me in a week.
[37:57.360 --> 37:59.220]  Just to prove, just to, so you're happy.
[37:59.720 --> 38:02.400]  But don't let them kind of still own a piece of you.
[38:02.580 --> 38:09.620]  If there's any intellectual property that you're working on, that you think you might own, negotiate it out at this point.
[38:11.780 --> 38:12.260]  Okay.
[38:12.520 --> 38:13.080]  Any questions?
[38:26.600 --> 38:27.080]  Hi.
[38:27.450 --> 38:30.390]  Um, it was interesting that you said not to wipe the hard drive.
[38:30.640 --> 38:37.660]  Because there's a micro... Oh, you, you said not to wipe the hard drives before you give back, uh, corporate property.
[38:38.140 --> 38:41.290]  I've actually made it personal policy to do exactly that.
[38:42.220 --> 38:44.660]  I'm multiple customers.
[38:44.870 --> 38:46.450]  I'm not sure what's on the hard drive anymore.
[38:46.890 --> 38:48.020]  I just zap it.
[38:48.760 --> 38:50.600]  Um, I would get permission first.
[38:50.810 --> 38:53.680]  And only this, because there's a great case called IAC v. Citroen.
[38:54.390 --> 38:56.000]  It's a great f*ck you of a case.
[38:56.200 --> 39:04.700]  Uh, I teach this in a class, because it's one of those, um, basically what happens is this guy works for a real estate developer.
[39:04.720 --> 39:06.120]  He has a personal laptop.
[39:06.390 --> 39:09.040]  He decides there's some property that I want to develop.
[39:09.310 --> 39:11.930]  I'm going to use my work laptop to take notes.
[39:12.460 --> 39:13.410]  He gets fired.
[39:13.660 --> 39:14.390]  Or he quits.
[39:14.580 --> 39:15.950]  He sends back the laptop.
[39:16.350 --> 39:18.810]  It's been low level format.
[39:20.040 --> 39:24.160]  Company decides you're going to go off on your own and develop property.
[39:24.390 --> 39:24.980]  Screw you.
[39:25.350 --> 39:36.100]  We're suing you for the value it costs to, um, um, oh, what's the, the, do a forensic image and even to undelete the files.
[39:36.290 --> 39:40.540]  Send it to crawl on track or drive savers or somebody to attempt to recover this.
[39:40.740 --> 39:45.080]  Because you did not have permission to delete that data.
[39:45.260 --> 39:50.520]  Because once you started working on your own, you ceased being an employee of ours, even though we still paid you.
[39:50.700 --> 39:53.580]  And therefore, it was unauthorized access under 18 U.S.C. 1030 to do the, to delete those files.
[39:56.960 --> 39:58.540]  That's actually a criminal act.
[39:58.810 --> 40:01.290]  Evidently, they couldn't get the USD, uh, the U.S. Attorney to, to agree, but they still suit them.
[40:03.850 --> 40:04.500]  And they win.
[40:05.310 --> 40:11.020]  So generally, if you're, if, if it's work, it's work's laptop, they own it.
[40:12.000 --> 40:13.460]  Don't put anything personal on it.
[40:13.580 --> 40:16.370]  Don't put anything that is on your side business or anything else.
[40:16.520 --> 40:20.430]  So that way you can honestly say, everything that is yours is back.
[40:20.830 --> 40:21.460]  I'm done.
[40:22.140 --> 40:22.500]  Alex?
[40:23.000 --> 40:23.120]  Yeah.
[40:23.180 --> 40:32.650]  I follow up to the same, get my new brand new work laptop, yank the hard drive, put one of my, and then go to work on it.
[40:32.750 --> 40:40.110]  End of my employment, I put their nice hard drive back in, that I've saved carefully in a nice antistatic bag, and hand it back to them.
[40:40.930 --> 40:41.370]  Interesting.
[40:41.650 --> 40:41.750]  Okay.
[40:41.890 --> 40:45.390]  Those of you are also for posterity, what if you just swap drives?
[40:45.610 --> 40:48.310]  You, you work forever from your own personal drive.
[40:50.530 --> 40:52.110]  Um... I'm not hurting their property.
[40:52.510 --> 40:53.850]  You're not hurting, well, wait a minute.
[40:54.170 --> 40:55.890]  Their property isn't just the drive.
[40:56.070 --> 41:00.750]  The property is the intellectual property that you have created while you work for them on that drive.
[41:01.390 --> 41:05.910]  I don't think, because it's, it's not like saying, I'm going to bring in my own desk.
[41:06.210 --> 41:09.150]  Therefore, any of the files in the desk are mine.
[41:09.470 --> 41:10.350]  It doesn't work that way.
[41:11.710 --> 41:13.210]  I, I, I'm not sure.
[41:13.450 --> 41:16.890]  I will think on that and come back with a better answer than interesting.
[41:19.650 --> 41:25.630]  Why would I want to agree to let them audit my personal laptop that you mentioned on the last slide?
[41:25.810 --> 41:26.690]  Um, okay.
[41:26.870 --> 41:27.990]  That was a special case.
[41:28.630 --> 41:48.170]  Um, said person was kind of afraid because there's a governmental agency involved, and there was a possibility that the company would instead of, instead of handling it internally, would have just gone to the agency and said, this guy, we have reasonable belief,
[41:48.510 --> 41:52.250]  holds your potentially classified information.
[41:53.430 --> 41:58.250]  That would be a bad scene, because that turns a firing into a search warrant.
[41:58.510 --> 42:00.970]  No one wants a search warrant executed at their house.
[42:01.330 --> 42:04.690]  And it was a very, very, very slim chance that this would happen.
[42:05.030 --> 42:08.150]  But it was enough that it rattled my client.
[42:08.490 --> 42:09.630]  And it kind of got me rattled, too.
[42:09.750 --> 42:11.650]  Like, whoa, that's a, that's nasty shit.
[42:12.010 --> 42:13.250]  Let's see if we can work something out.
[42:13.330 --> 42:15.050]  They actually never took the forensic image.
[42:15.170 --> 42:16.410]  They actually backed off of it.
[42:16.730 --> 42:19.710]  But it was kind of a, like, let's toss that one out there.
[42:19.890 --> 42:25.790]  So that way you could say, this is stuff, I've never worked on client stuff on my personal stuff.
[42:25.910 --> 42:31.430]  The only time I've ever done it was on my hard drive, my hard drive of my personal, I mean, my work laptop.
[42:31.810 --> 42:34.050]  So here's proof that I never did it.
[42:34.250 --> 42:35.730]  Please don't go further.
[42:37.670 --> 42:51.730]  You mentioned this character, Sue, who was like an IT person and didn't, you know, she was kind of, it seemed to be inside her scope of work to some degree or another, but you didn't kind of say whether she was cool or not legally or whatever, it seemed to me.
[42:52.370 --> 42:53.470]  I'm sorry, can you repeat that?
[42:53.990 --> 42:54.390]  I...
[42:54.390 --> 42:56.490]  So the fictitious character, Sue?
[42:56.610 --> 42:56.770]  Yeah.
[42:56.770 --> 43:00.890]  She was like a general IT person and like found some security thing.
[43:01.070 --> 43:05.850]  And I don't remember hearing you say, well, here's what happened to her or what...
[43:05.850 --> 43:06.590]  Oh, I'm sorry.
[43:07.150 --> 43:10.450]  What happened, Sue was the one who finds the security hole.
[43:10.690 --> 43:22.450]  She actually is canned because the company kind of, or the security team at the HR department, or the headquarters, sorry, HQ, not HR, kind of turns around and says, she caused the flaw.
[43:23.450 --> 43:28.910]  So, and because she didn't have security in her title, she's kind of, she's not the expert.
[43:29.030 --> 43:32.490]  In HR's eyes, get rid of the person who exposed us to the flaw.
[43:32.970 --> 43:39.570]  It's kind of a shitty move, but most of it was, look, you know, it got dangerous even though she was helping her company.
[43:43.790 --> 43:44.550]  Unfortunately not.
[43:45.230 --> 43:47.470]  Because she was fired.
[43:48.670 --> 43:51.930]  Actually, they kind of wrote it as she was laid off, which she was.
[43:53.610 --> 43:55.250]  So, she was able to collect unemployment.
[43:55.790 --> 43:58.850]  She was able to go and get other jobs.
[43:59.010 --> 44:02.330]  She was excused from any non-disclosure, I mean, not non-disclosure, non-competes.
[44:02.450 --> 44:04.310]  So, she was pretty much free to go.
[44:04.710 --> 44:08.530]  And they could have fired her for a bunch of different reasons.
[44:08.770 --> 44:17.770]  Instead, they just called, I mean, well, they could have claimed anything, but because they claimed this, that was just a layoff, rather than we're firing you for cause, it actually made it better for her.
[44:20.490 --> 44:23.510]  I had a question about a term over here in the middle.
[44:23.930 --> 44:24.050]  Okay.
[44:24.550 --> 44:27.930]  I've heard people throw around a term, they say, we live in a right-to-work state.
[44:28.310 --> 44:29.490]  What does that mean?
[44:29.650 --> 44:31.450]  Because nobody seems to be able to give me a good answer on that.
[44:33.030 --> 44:44.550]  Yeah, right-to-work, I'm trying to remember, there's, sorry, I'm drawing a blank because I'm trying to remember the exact term here.
[44:44.550 --> 44:45.870]  No, they can fire you whenever.
[44:46.150 --> 44:47.950]  Yeah, they can fire you forever.
[44:52.140 --> 44:52.780]  Thank you.
[44:55.970 --> 44:56.450]  Okay.
[44:57.390 --> 45:03.810]  At work, I mean, it's at-well employment, free to, right-to-work is they cannot force a union upon you.
[45:05.690 --> 45:10.230]  So, if it's a union shop, actually, there's no such thing as a union shop.
[45:10.350 --> 45:12.210]  You do not have to be a member of a union.
[45:12.830 --> 45:14.890]  You don't have to accept union representation.
[45:14.950 --> 45:21.410]  For example, the people who just sent me an email, one of my employers, Temple University, I actually have union representation.
[45:21.870 --> 45:26.350]  It does f*ck off for me, but it's there if I want it.
[45:27.150 --> 45:33.690]  I cannot choose to not pay, or I can't choose to have someone else negotiate on my behalf.
[45:34.650 --> 45:37.850]  That's the difference between right-to-work and at-will employment.
[45:37.850 --> 45:39.990]  That varies from state to state, though.
[45:40.170 --> 45:40.610]  Yes.
[45:41.330 --> 45:43.270]  Some states are right-to-work.
[45:43.430 --> 45:44.510]  Some states are not.
[45:45.350 --> 45:50.150]  I'm not... I mean, union law, that's a weird specialty unto itself.
[45:50.690 --> 45:53.890]  I'm only kind of speaking like the 50,000-foot level.
[45:54.050 --> 45:55.590]  Like, some allow it, some don't.
[45:57.330 --> 45:58.150]  Quick question.
[45:58.310 --> 46:01.610]  My work requires that we encrypt our laptops and all our devices.
[46:01.850 --> 46:09.170]  What if I, when leaving, forget my password for whatever reason, and they don't have it, or they don't remember it, they didn't document it, whatever the case may be?
[46:09.750 --> 46:12.630]  I'm sorry, your work requires you that you what, your laptops?
[46:13.130 --> 46:13.330]  Encrypt.
[46:13.330 --> 46:13.610]  Encrypt.
[46:13.610 --> 46:14.910]  Okay, so encrypt a drive.
[46:15.170 --> 46:15.310]  Yeah.
[46:17.790 --> 46:21.570]  And you... Or if I just say I forgot, per se.
[46:23.150 --> 46:30.850]  Well, if they were bright, they are using something like Apple's file of art or some equivalent, where there's a master and then your password.
[46:31.910 --> 46:41.930]  Having dealt with this when I was in IT, where I would have people call me up, say, I had to argue with the secretary, I fired her, now I need to get into the drive, it's encrypted.
[46:42.490 --> 46:44.810]  She set it all up, and I'm like, make nice.
[46:45.430 --> 46:49.850]  Make very, very nice with this woman, because she's the only source of information.
[46:50.030 --> 46:51.490]  Like, no, you've got to know some way.
[46:51.550 --> 46:52.510]  I'm like, call the NSA.
[46:52.870 --> 46:53.790]  What's their phone number?
[46:53.870 --> 46:55.350]  I'm like, dude, joke, bad joke.
[46:55.550 --> 46:56.210]  Do not call.
[46:56.350 --> 46:59.290]  If you do call the NSA, do not mention me, please.
[47:03.990 --> 47:04.770]  Here's the problem.
[47:04.910 --> 47:07.450]  If you honestly forgot it, that's okay.
[47:07.690 --> 47:15.350]  If you forgot it, forgot it, just to say, f*ck you, that might be okay.
[47:16.790 --> 47:22.970]  If you, I forgot it, but I could remember it for fill in the blank.
[47:23.710 --> 47:25.190]  That may be extortion.
[47:25.790 --> 47:28.350]  That then goes from civil to criminal.
[47:30.570 --> 47:32.310]  I would just say that's a bad thing.
[47:32.750 --> 47:33.850]  I wouldn't go there.
[47:46.810 --> 47:49.590]  Well, I'll repeat it.
[47:49.850 --> 47:51.270]  You're talking about 1099s.
[47:52.110 --> 47:52.670]  ICs.
[47:52.810 --> 47:57.430]  Most abused section of employment law I have ever seen.
[47:57.710 --> 48:01.810]  About 80% of 1099s are not actually independent contractors.
[48:02.010 --> 48:06.290]  It's a way to say, screw you, I'm not paying employment taxes.
[48:08.010 --> 48:16.450]  You have less rights as a true independent contractor, because you are not solely employed by them.
[48:16.450 --> 48:18.130]  You are a freelancer.
[48:18.370 --> 48:21.730]  Like, when I represent people, you know, I represent a client.
[48:22.870 --> 48:24.890]  I'm not employed by them.
[48:25.050 --> 48:25.930]  I am a contractor.
[48:26.070 --> 48:27.390]  They can fire me at any time.
[48:27.630 --> 48:29.470]  They can fire me because I'm white.
[48:30.670 --> 48:31.410]  It's okay.
[48:32.230 --> 48:36.930]  Of course, they would have probably known that once they talked to me, because, you know, like, my God, I'm practically silver.
[48:42.120 --> 48:42.880]  Any other questions?
[48:43.040 --> 48:46.500]  I, I mean, I'm blinded here, so it's like, literally deer in the headlights.
[48:49.640 --> 49:02.420]  If you work as an IT department or a sysadmin and you have passwords upon being fired or leaving the job for whatever reason, what should you do other than just notify them, hey, I still have a password?
[49:02.740 --> 49:05.600]  Especially if you realize that your password is still active for whatever reason.
[49:05.780 --> 49:06.960]  You accidentally logged in.
[49:07.000 --> 49:08.240]  You had some script that was running.
[49:08.440 --> 49:10.560]  For whatever reason, you realize your passwords are still there.
[49:11.040 --> 49:13.760]  But you can't, what should you be doing at some point?
[49:14.700 --> 49:15.640]  Ooh, interesting.
[49:15.860 --> 49:19.260]  Because, I mean, there's a great article on how to fire a sysadmin.
[49:20.740 --> 49:27.860]  Well, no, I mean, it's, it's a problem because you, you, if you are in the position to hire sysadmins, eventually you may have to fire them.
[49:28.120 --> 49:35.680]  I have been a part of that cleanup crew, where it's go and lock them out before they realize in case they screw something up deliberately.
[49:37.040 --> 49:44.920]  So say, for example, you do a, you know, you do what a, a mature adult sysadmin should do because your reputation is more valuable than any other asset you've got.
[49:45.420 --> 49:47.580]  Is to, like, here's all my passwords.
[49:47.960 --> 49:48.780]  Have a nice day.
[49:49.060 --> 49:49.640]  I'm out.
[49:49.900 --> 49:58.180]  If you notice, though, that the passwords haven't changed, it would be helpful to let them know that, you know, your security is still broken.
[49:58.300 --> 50:00.620]  The problem, of course, is why did you notice?
[50:01.480 --> 50:03.020]  You know, like, dude, your doors are unlocked.
[50:03.420 --> 50:04.660]  Why are you in my house?
[50:09.600 --> 50:12.280]  It depends on the level of rapport you have with the company.
[50:12.680 --> 50:18.720]  If they fired you because if there was a screaming match and shit got thrown, don't ever mention to them again.
[50:20.300 --> 50:22.360]  If you're on still good relations,
[50:26.820 --> 50:31.060]  it would probably, the safest way would be to use an intermediary.
[50:31.280 --> 50:39.900]  I mean, the absolute, you know, complete safe thing is to retain an attorney who would then say, a client of mine happens to know something about your security.
[50:40.380 --> 50:41.920]  Would you like this information?
[50:43.040 --> 50:48.040]  Um, that's, you know, I'm not recommending that you call me and, like, I have passwords, you know.
[50:50.400 --> 50:51.340]  I mean, come on.
[50:51.400 --> 50:56.660]  One of the advantages of hiring a lawyer is that way you can just have completely bizarre conversations.
[50:58.960 --> 51:00.600]  Hypothetically, this, this, and this.
[51:00.840 --> 51:12.040]  But if you still know someone there and you're still friendly and you don't think that it's going to get turned around into, you know, Bob was hacking our systems and noticed that he still could.
[51:12.960 --> 51:17.120]  If there's some way you could come across as not completely creepy would be the best way.
[51:17.240 --> 51:18.620]  Otherwise, just keep your mouth shut.
[51:20.120 --> 51:20.600]  Okay.
[51:21.220 --> 51:22.280]  Thank you so much.
[51:32.450 --> 51:34.310]  I mean, let me unpack and then I'll do it.
[51:34.490 --> 51:35.550]  Because I need to set up.
[51:35.870 --> 51:36.190]  Yeah.