[00:00.000 --> 00:02.040]  I teach a cyber law course there.
[00:02.620 --> 00:05.300]  And I also work for myself.
[00:05.500 --> 00:09.800]  I have an office in Portland, Maine, and soon to open one in Cambridge, Massachusetts, hopefully.
[00:09.980 --> 00:11.800]  And I help people set up tech companies.
[00:12.240 --> 00:15.260]  But I'm here because of some research I was doing at the university.
[00:15.520 --> 00:22.780]  Over the past two years, I've had students who were writing about the Real ID Act and about security vulnerabilities with RFID.
[00:23.540 --> 00:27.320]  And last year, I had one student do a paper on that.
[00:27.460 --> 00:28.640]  And this year, I had four.
[00:28.640 --> 00:32.920]  So it's a topic that a lot of people in computer science are interested in.
[00:33.480 --> 00:37.780]  And a lot of attorneys from the law school have been interested in these subjects as well.
[00:37.940 --> 00:45.220]  So I thought I'd do a little bit of research and present to you some research that my students brought to me and some of which I did on my own.
[00:46.140 --> 00:47.980]  It's generally not technical research.
[00:48.720 --> 00:53.320]  What it is is I'm talking about the laws, legislation, and privacy issues.
[00:54.200 --> 00:56.800]  I'm really for civil liberty protection.
[00:56.800 --> 00:59.660]  So I'll talk a lot more about that.
[00:59.800 --> 01:07.620]  And I'll tell you a little bit about passports, the new requirements for passports, the requirements for getting a driver's license in some states.
[01:07.900 --> 01:08.740]  It's changing.
[01:09.900 --> 01:12.080]  So I'll tell you a little bit about that as we go on.
[01:14.460 --> 01:15.840]  This is my professional background.
[01:15.840 --> 01:20.960]  As I mentioned, I'm a professor at the University of Southern Maine, and I work for my company's name ELC Networks.
[01:21.960 --> 01:23.660]  This is my educational background.
[01:24.000 --> 01:31.040]  It's not as important to what I'm talking about specifically today, except that I've studied in three countries.
[01:31.240 --> 01:40.060]  So every country that I've studied in, I like to learn about the technical culture there, the legal environment, and policies regarding civil rights.
[01:41.940 --> 01:44.320]  I'll talk about the history of RFID just a bit.
[01:45.260 --> 01:52.240]  This isn't a historical presentation, but it's kind of important, I think, when talking about the tools and how the technology is used.
[01:52.440 --> 02:00.040]  A description of the technology, tracking of goods and packages, such as documents mostly, biological implantations and insertions.
[02:00.180 --> 02:02.220]  Part of my background is also in biology.
[02:02.840 --> 02:09.020]  I love computer science, and I love biology, and back in college, I liked to study a lot about viruses of the biological type.
[02:09.240 --> 02:15.580]  And then in grad school, I started studying a lot more about the digital type, and they're fascinating.
[02:16.200 --> 02:20.640]  The similarities between the biological and digital viruses is really quite intriguing.
[02:21.160 --> 02:34.620]  In the Real Idea Act, what it's going to mean for you, whether you go to get your driver's license or you want to walk into a post office or open up a bank account, it's going to change the way that you do your day-to-day activities and the way that business is done.
[02:35.800 --> 02:38.620]  I'm going to read this to you, because you can't read this.
[02:38.700 --> 02:40.420]  It's, I think, especially in the back.
[02:40.720 --> 02:46.920]  But a blogger wrote about this a few months ago, and I thought it was kind of a, it was fascinating.
[02:47.240 --> 02:52.880]  The State Department today has unveiled plans to improve the National ID Act put into action 20 years ago today.
[02:52.880 --> 03:03.620]  On May 8, 2008, the citizen was required to carry a card containing their social security number, date of birth, physical address, various biometric features, as well as an RFID chip.
[03:03.820 --> 03:07.420]  The RFID chip has made tremendous strides in its ability to help the public.
[03:07.660 --> 03:12.680]  Failure to carry the National ID Card resulted in prompt imprisonment as a sponsor of anti-government actions.
[03:13.220 --> 03:17.000]  These terrorists have been removed from society and pose less of a threat than ever before.
[03:17.000 --> 03:19.660]  Today, the government has made the process even easier.
[03:19.820 --> 03:29.000]  In an effort to prevent pollution from the plastic required to make the National ID Cards, you are invited to get your new compulsory organized RFID regional universal personal tag, corrupt for short.
[03:29.580 --> 03:33.940]  Corrupt will be implanted in your forum and provide you the same great benefits you have grown accustomed to.
[03:34.120 --> 03:36.380]  Some of those benefits you already take advantage of.
[03:36.680 --> 03:43.980]  Using its technology, traffic officials have been able to locate congested driving areas by tracking individual drivers.
[03:43.980 --> 03:47.520]  With this information, they've been able to reroute traffic to other areas.
[03:47.820 --> 03:51.420]  Police officers have used this technology to locate criminals and missing victims.
[03:51.780 --> 03:57.700]  State-run department stores have used information gathered from your purchasing habits to better produce advertisements that are important to you.
[03:58.400 --> 04:01.800]  All debit, credit, and other financial accounts are condensed into one card.
[04:02.700 --> 04:07.360]  The reason I chose this is he's writing as if he were in 2028.
[04:08.380 --> 04:16.040]  There are benefits and detriments to any type of technology, whether it's an old-fashioned or even new lockpicking kit.
[04:16.740 --> 04:23.360]  Lockpicking tools, from what I understand, are generally not legal to possess, especially carry with you if you fly on airplanes.
[04:23.540 --> 04:26.220]  You wouldn't want that coming up when you're going through security.
[04:26.600 --> 04:30.460]  But the lockpicking set in itself is not something I consider to be evil.
[04:30.560 --> 04:31.120]  It's not bad.
[04:31.300 --> 04:33.500]  It's what you do with it and how it's used.
[04:33.500 --> 04:35.460]  And I think the same is true with RFID.
[04:35.780 --> 04:37.460]  It has great benefits that can provide us.
[04:37.540 --> 04:39.580]  Actually, I'm having a fantastic time with this.
[04:40.140 --> 04:42.480]  I got one of the RFID tags here, playing the game.
[04:43.640 --> 04:48.100]  But also, every now and then, I wanted to pop the battery out when I was in the hotel.
[04:48.480 --> 04:49.740]  I have that option, too.
[04:49.800 --> 04:55.480]  But if you're carrying a national ID card that is your driver's license and you're supposed to carry it at...
[04:55.480 --> 05:00.000]  Well, in some states, you have to carry it and show it upon being asked by a police officer.
[05:00.920 --> 05:02.360]  You have to carry it with you at all times.
[05:02.540 --> 05:04.780]  And there isn't a lot you can do to just, you know, turn it off.
[05:05.680 --> 05:08.260]  I'll talk a little bit about passive and active, the difference between the two.
[05:08.400 --> 05:15.860]  But how that technology is applied was what makes it good or bad, not the technology itself, I think.
[05:16.520 --> 05:17.880]  Well, this is a good example.
[05:17.960 --> 05:19.960]  The history of RFID is in 1939.
[05:21.080 --> 05:23.180]  It was used to tell friend from foe.
[05:23.180 --> 05:26.960]  And I guess you could say it was good or bad depending on which side you were on.
[05:28.340 --> 05:29.300]  They invented...
[05:29.300 --> 05:30.440]  There's a...
[05:30.440 --> 05:33.200]  Leon Theron invented the Soviet espionage listening device.
[05:33.500 --> 05:38.040]  And a passive radio transponder with 16-bit memory was invented in 1973.
[05:39.160 --> 05:42.780]  From what distance can these signals be received?
[05:42.780 --> 05:46.040]  And it depends on what type of RFID device you're using.
[05:46.860 --> 05:48.000]  This was interesting.
[05:48.000 --> 05:51.140]  When I was at DEFCON, I think it was maybe...
[05:51.140 --> 05:51.940]  I can't remember.
[05:52.040 --> 05:53.160]  Maybe about four years ago.
[05:53.640 --> 05:59.680]  A couple of guys showed that from a passive RFID device could be picked up from 69 feet away.
[06:00.420 --> 06:01.660]  They had a directional antenna.
[06:01.900 --> 06:03.680]  I have some photos of them I'm going to show you next.
[06:03.840 --> 06:05.120]  But it's...
[06:05.120 --> 06:07.060]  A lot of things that I've read...
[06:07.060 --> 06:09.980]  I don't think a lot of congressmen and senators really get this.
[06:10.120 --> 06:12.120]  That it's not...
[06:12.120 --> 06:20.000]  You can't walk into a building and expect that your driver's license is going to remain in your pocket and yours and your ID is...
[06:20.720 --> 06:22.340]  You know, you can be anonymous or not.
[06:23.440 --> 06:26.080]  It's not something you can take for granted anymore.
[06:26.560 --> 06:35.820]  So, the bad news is, if you work for one of these companies where your RFID security, your card to get into buildings relies upon the physical distance from your reader.
[06:35.940 --> 06:36.400]  That's not...
[06:36.400 --> 06:37.480]  This is not good.
[06:37.580 --> 06:39.260]  And these guys were some of the first to show that.
[06:39.860 --> 06:40.620]  This was...
[06:40.620 --> 06:42.840]  I borrowed these photos from Make Magazine.
[06:43.340 --> 06:47.660]  And I remember when this was done out in DEFCON, and it was a really big deal at the time.
[06:48.340 --> 06:49.920]  These are the directional antennas.
[06:50.340 --> 06:52.000]  That's the box that they put together.
[06:52.140 --> 06:53.060]  It wasn't very expensive.
[06:53.220 --> 06:55.800]  And there was an article in Make about how you can do this yourself.
[06:55.980 --> 06:57.260]  And they're the guys that did it.
[06:58.260 --> 07:02.860]  And just look on Makezine.com if you want to learn how to build your own.
[07:03.360 --> 07:06.460]  The components of an RFID generally...
[07:06.460 --> 07:13.740]  If it contains an integrated circuit for storing and processing information, as well as a modulating and demodulating for an RF signal, and it has an antenna.
[07:14.740 --> 07:20.040]  Chipless RFIDs are printed directly onto paper, onto...
[07:20.040 --> 07:24.120]  I read that maybe the post office might be doing this for some stuff that they like to track.
[07:25.400 --> 07:27.480]  Tracking of goods and social retailing.
[07:28.420 --> 07:31.220]  This is something that I think is pretty interesting.
[07:31.360 --> 07:33.680]  That I think a lot of young people are going to be using this.
[07:34.300 --> 07:39.760]  And when they don't know there's RFID in some of the clothing that kids are trying on...
[07:39.760 --> 07:45.820]  Because I think right now a lot of the really high-end retailers, especially in California, are putting these into their clothes.
[07:46.460 --> 07:53.740]  And you walk into a dressing room, put your stuff up on the hook, and you can tell all your friends, hey, this is what I want to buy.
[07:53.860 --> 07:54.700]  What do you think about it?
[07:55.540 --> 07:57.780]  You can then walk up to the cash register.
[07:57.780 --> 08:00.940]  It'll keep track of all the items that you had in there.
[08:00.940 --> 08:05.100]  And with some credit cards, I don't have any of them right now.
[08:05.620 --> 08:09.100]  Some credit cards, you don't even have to really take it out and have it be scanned.
[08:09.100 --> 08:11.000]  It's paid for if you choose.
[08:11.940 --> 08:16.860]  And there's a... these are some of the clothing, the articles of clothing that contain that.
[08:17.080 --> 08:19.600]  I mean, there are many, but this is just some I found in RFID journal.
[08:21.320 --> 08:26.360]  And now, from social retailing, I'm going to talk a little bit about other types of RFID.
[08:26.360 --> 08:27.940]  This is not RFID.
[08:28.100 --> 08:29.460]  This is radioactive dust.
[08:31.360 --> 08:33.900]  Radioactive dust was used in the 1970s.
[08:34.260 --> 08:38.100]  An airplane would fly low over a bunch of insurgents and drop some stuff onto them.
[08:38.300 --> 08:44.580]  And then all agents would have to do later on is go into a town with a Geiger counter to see what came up.
[08:44.940 --> 08:50.480]  And they can track people later, after an event, after the group has dispersed.
[08:50.480 --> 08:56.980]  And I thought about this when I was looking into RFID powder.
[08:57.600 --> 09:05.540]  And Hitachi said that it's for anti-counterfeit purposes, putting it into dollar bills.
[09:06.100 --> 09:08.160]  But it's... it's really small.
[09:08.580 --> 09:10.300]  And you can't really see it.
[09:10.340 --> 09:12.700]  I have a picture next about how tiny it is.
[09:12.880 --> 09:16.460]  But as if this wasn't small enough, they made it even smaller.
[09:16.940 --> 09:18.100]  And there it is.
[09:18.100 --> 09:26.200]  And if that dust was blown into a room of people or something like that, it would be hard to detect, I think.
[09:26.440 --> 09:30.240]  And then you'd have to wonder about, why is it this small?
[09:30.340 --> 09:32.040]  I don't know what Hitachi's doing with this.
[09:32.160 --> 09:37.100]  I guess it's going into even better anti-counterfeit monetary systems.
[09:37.860 --> 09:40.280]  But I don't... it's pretty small.
[09:40.560 --> 09:42.580]  And it reminds me of the angel dust story.
[09:42.580 --> 09:44.420]  My dad spoke a little bit earlier today.
[09:44.660 --> 09:47.280]  He used to be... he was a CIA agent in the 1970s.
[09:47.340 --> 09:51.380]  And he told me a lot of stories, such as this one, and... about the angel dust.
[09:51.700 --> 10:00.780]  And now in... in my generation, I'm thinking about this when... when I... when we talked a little bit about the angel dust and radioactivity and what can be done with this.
[10:02.540 --> 10:12.800]  The documents... this is something that... that I'm most interested in, is personal identifying information that connects you to all the purchases you make.
[10:13.280 --> 10:21.940]  When you drive on 95 with your transponder, it's RFID, it's connected to... a lot of people... it has to be connected to your credit card.
[10:22.180 --> 10:23.660]  Unless you want to pay cash.
[10:23.780 --> 10:28.880]  And then if you're going through New Jersey, as I've discovered on many trips between... I live in Maine and DC.
[10:29.440 --> 10:30.620]  It's really a hassle.
[10:30.780 --> 10:34.100]  They make you go through a lot if you don't want to use your... your easy pass.
[10:34.380 --> 10:36.660]  You have to pay cash and then you wait in a big line.
[10:36.920 --> 10:40.840]  So it's becoming more difficult to stay anonymous in today's society.
[10:41.500 --> 10:47.160]  And especially documents and credit cards... like this one, for instance.
[10:47.800 --> 10:50.040]  They knew about some of the security flaws.
[10:50.220 --> 10:54.960]  And I think just like a lot of very eager software companies, shall we say...
[10:54.960 --> 10:57.980]  They wanted to get their product out and be one of the first to do it.
[10:57.980 --> 10:59.780]  And then they kind of think about security later.
[11:00.540 --> 11:05.940]  And coming from the engineering department... and... well, computer science department...
[11:05.940 --> 11:08.340]  We talk about how to teach students from the bottom up.
[11:08.340 --> 11:10.640]  How to engineer systems from scratch.
[11:10.980 --> 11:13.120]  And build security into your code.
[11:13.240 --> 11:15.640]  Because if you just put out something that works, you know...
[11:15.640 --> 11:16.060]  Well, great.
[11:16.240 --> 11:17.600]  Maybe you'll get a B on the project.
[11:17.840 --> 11:22.960]  But to make something that is not just... you don't release it into the public...
[11:22.960 --> 11:24.180]  Just because it works.
[11:24.340 --> 11:25.120]  But make it smart.
[11:25.380 --> 11:26.120]  Make it smarter.
[11:27.260 --> 11:29.080]  And include security in your code.
[11:29.180 --> 11:30.000]  Because there are different ways.
[11:30.000 --> 11:31.460]  As I'm sure many of you know out there.
[11:32.020 --> 11:35.180]  How to design hardware and software from the bottom up.
[11:35.280 --> 11:36.980]  To make security part of your design.
[11:37.080 --> 11:38.460]  And not something you just tack on later.
[11:38.880 --> 11:41.500]  And that's one of the criticisms I have from a lot of these companies.
[11:41.600 --> 11:43.340]  They kind of tack the security on later.
[11:45.400 --> 11:49.020]  There's a U.S. patent application that was filed here for American Express.
[11:49.920 --> 11:53.300]  It calls... it's for consumer... tracking consumers.
[11:53.560 --> 11:55.160]  To watch people in stores.
[11:55.560 --> 11:58.920]  And if you thought Walmart's... Walmart was bad enough.
[11:58.960 --> 12:01.580]  They put RFID tags on a lot of their products right now.
[12:01.760 --> 12:03.360]  And they don't tell you about it.
[12:03.680 --> 12:05.360]  There have been a few cases about this.
[12:05.540 --> 12:08.920]  But Walmart says they're using it for management purposes.
[12:08.920 --> 12:12.520]  So that they can tell if a lot of people are around this type of shampoo.
[12:12.520 --> 12:13.600]  Or this product.
[12:14.060 --> 12:15.840]  They can move it out to the end caps.
[12:16.260 --> 12:17.740]  And we learned about this in business school.
[12:17.840 --> 12:18.920]  How this was a really great thing.
[12:19.020 --> 12:20.260]  And also for inventory tracking.
[12:20.440 --> 12:20.800]  It is.
[12:21.260 --> 12:24.280]  But I think when they apply it to people who walk into stores.
[12:25.640 --> 12:29.020]  And they... really what it is is... for privacy purposes.
[12:29.060 --> 12:31.160]  If you walk into a public place like Walmart.
[12:31.800 --> 12:33.560]  And they have surveillance cameras.
[12:33.620 --> 12:36.060]  You don't have an expectation of privacy.
[12:36.920 --> 12:39.060]  Wherever you go in that store, you know their cameras there.
[12:39.200 --> 12:41.700]  That's why they... now in the parking lots they put up those big signs.
[12:41.700 --> 12:43.460]  They say like surveillance cameras in use.
[12:45.100 --> 12:48.400]  Whatever you do in that store, they watch that.
[12:48.540 --> 12:49.340]  They store it.
[12:49.580 --> 12:51.640]  And the question... it's questionable to me.
[12:51.820 --> 12:53.400]  Is how long do they keep that information?
[12:53.660 --> 12:54.640]  And what purpose do they use it for?
[12:54.660 --> 12:55.960]  Is it really for marketing purposes?
[12:56.180 --> 12:59.460]  Because a lot of... your face is on there too.
[12:59.780 --> 13:06.880]  And I read somewhere that some of these surveillance cameras can use geometrics for your face.
[13:06.880 --> 13:08.960]  To be able to determine who you are.
[13:09.200 --> 13:10.860]  It doesn't work very well right now.
[13:11.100 --> 13:12.580]  But it's getting there.
[13:13.920 --> 13:16.220]  Well, for American Express's patent.
[13:16.660 --> 13:19.580]  The businesses would pick up this signal and use it to identify shoppers.
[13:19.680 --> 13:21.320]  Track their movements and observe their behavior.
[13:21.920 --> 13:26.780]  And American Express senior executives vowed that they wouldn't do RFID based consumer tracking.
[13:26.920 --> 13:28.440]  Without providing notice to consumers.
[13:28.440 --> 13:30.600]  And as I'll get to a little bit later on.
[13:30.800 --> 13:41.140]  A couple of states have now passed... passed laws that say that if you're using RFID, you have... in a card or for different devices, you have to tell consumers about it.
[13:41.400 --> 13:43.640]  The problem is more states haven't passed laws like this.
[13:43.740 --> 13:44.540]  But I hope it's coming.
[13:44.720 --> 13:49.780]  And part of the reason I wanted to give this presentation is I... I know that people come to this conference from all over the country, all over the world.
[13:50.540 --> 13:52.520]  Take... go do something about it.
[13:52.700 --> 13:58.820]  Because unfortunately, I believe that most of our senators and congressmen don't have a really good grasp on technology.
[13:59.680 --> 14:01.020]  And... but people here do.
[14:01.600 --> 14:06.800]  And what you can do is write letters to your congressmen and your senator and say, listen, this is not okay.
[14:06.900 --> 14:09.760]  The Real ID Act... it's... we're just not ready for that yet here in America.
[14:09.900 --> 14:11.240]  Do something about it.
[14:12.000 --> 14:15.720]  Wait a little bit before some... you know, until some of the security kinks are worked out of this.
[14:15.800 --> 14:18.840]  Before this becomes something that all of us in America have to carry.
[14:19.340 --> 14:25.140]  And as I'll get to at the very end of the presentation, the Chinese are already carrying RFID identification cards.
[14:25.140 --> 14:31.640]  And it has a lot of very personal information on it that... that people in China don't really know specifically what's in their file.
[14:31.840 --> 14:33.100]  And if they... even if they do, what do they do?
[14:33.220 --> 14:35.020]  How do you get that out with the Chinese government?
[14:36.460 --> 14:43.060]  Well, for example, with this American Express credit card, it reminds me of a scene from Minority Report.
[14:43.800 --> 14:50.800]  But it'll just... you can display a moving or static image, a performance of a sound record, or even emission of a scent while you're walking through a store.
[14:51.100 --> 14:52.340]  That would really annoy me.
[14:52.340 --> 14:58.160]  Instead of just the perfume girls at the department stores, it would just... you know, you wouldn't even know where they're coming from.
[14:58.380 --> 14:59.520]  You wouldn't be able to avoid them.
[14:59.580 --> 15:08.700]  It would be... it would just be, you are John Smith, you must like this particular brand, so we're gonna... we're gonna hit you with this... this cologne.
[15:09.660 --> 15:11.660]  Known security vulnerabilities, as I mentioned.
[15:12.120 --> 15:15.660]  The no swipe credit cards are a bit of a problem.
[15:15.660 --> 15:19.200]  I heard that the security and the encryption is pretty good, but it's not great.
[15:19.780 --> 15:26.360]  A member of the Senate Banking Committee denounced RFID no swipe credit cards at a press conference, and this was in 2006.
[15:26.640 --> 15:29.740]  So, how far have we come, you know, from 2006?
[15:30.040 --> 15:30.900]  Not a great deal.
[15:31.180 --> 15:38.940]  But one of the senators said that contracts for this card should have warning boxes disclosing the known weaknesses of this technology.
[15:39.580 --> 15:44.400]  He pretty much said that you may as well wear your credit card information with a big sign on your back.
[15:45.020 --> 15:51.500]  And there are... you may have heard about these guys at the University of Massachusetts in Amherst.
[15:52.020 --> 15:55.960]  One of them got a new credit card in the mail, and it happened to be RFID enabled.
[15:57.440 --> 16:13.240]  So, he was able to... without even opening the envelope, he was able to determine that his name, his credit card number, expiration date, this was being... he could read this without even opening the envelope, which I read that on Bruce Schneier's blog,
[16:13.520 --> 16:15.460]  someone did this with passports recently, too.
[16:15.560 --> 16:21.380]  You didn't even have to, like, open up the envelope and take the, you know, the passport out, although it must have been open a little bit inside.
[16:21.680 --> 16:30.520]  But they were able to get digital photographs and all that just in the mail by getting it out of someone's mailbox who was part of this, who knew it was happening.
[16:30.520 --> 16:35.160]  And this is... one of the professors here, they... this is one of the experiments they did.
[16:35.280 --> 16:37.320]  They said, okay, how can we make this a little bit better?
[16:39.640 --> 16:45.740]  He got... yeah, the name was being transmitted without encryption, which is... which is really surprising, and in plain text.
[16:47.400 --> 16:50.460]  Coupled together... he cobbled this together for a pretty cheap amount.
[16:50.580 --> 16:52.660]  And this was... this was a while ago.
[16:52.780 --> 16:55.260]  And I think you could probably make this for a lot cheaper.
[16:55.380 --> 16:59.820]  A couple of my students were going to make some RFID readers, and they said they could do it for about $25.
[17:01.000 --> 17:10.100]  Our department didn't want to spend the money on it at the time, but we have more interest in the department now about RFID, and maybe that's something that the students will put together next year.
[17:10.960 --> 17:17.800]  The solution... they came up with a method that uses the concept of random numbers, which are used to encrypt the data that is being sent by the tags.
[17:18.260 --> 17:25.440]  It produces a line of random numbers, you know, that's... that's easy, but RFID tags are the size of a matchbook, and the circuits are really tiny.
[17:25.740 --> 17:28.300]  And they've not been able to handle the random number process.
[17:29.080 --> 17:36.320]  And the method relies on the fact that memory cells in the tag lose all this information that is stored in them when the power supply is removed.
[17:36.580 --> 17:50.480]  Now, I went to a talk last night, and I'll tell you a little bit about how that might change that, but... so the University of Massachusetts solution was when the tag is powered up by the receiver, some of the memory cells fluctuate between the two binary states before they settle.
[17:50.940 --> 17:55.880]  And this is what they use to create a series of numbers that allow the RFID to authenticate itself to a reading device.
[17:55.880 --> 18:01.660]  Well, I went to the talk last night about the cold boot, and this may not be...
[18:02.260 --> 18:05.800]  this may not be something that... that is the solution.
[18:06.160 --> 18:14.080]  But this was their research, and I think it was... it was better than what they got in the mail, which was no protection on their card at all.
[18:15.100 --> 18:15.960]  Tracking of cars.
[18:16.300 --> 18:19.540]  This is something that hit the press recently, I think about a few months ago.
[18:19.540 --> 18:23.660]  I read a lot about this, but RFID is not an OnStar.
[18:24.040 --> 18:29.880]  But if you have a car that has OnStar, really the only way to turn it off is to sever the power to the device.
[18:31.500 --> 18:34.620]  Just getting into the car computer and saying, turn off, it doesn't work.
[18:36.180 --> 18:46.100]  So when people buy OnStar, all they see... I think the general consumers, all they see are the commercials, where if you hit a tree, OnStar signals to EMS, you know, come get me, I'm here.
[18:47.120 --> 18:49.740]  But it can also be turned on by law enforcement.
[18:49.920 --> 18:55.860]  And it can be turned on possibly by... by people that are participating in malicious hacking.
[18:56.760 --> 19:01.300]  And that's one of the reasons when I was looking at a new car, I chose one that did not have OnStar.
[19:02.220 --> 19:05.360]  And perhaps most people would choose an OnStar vehicle.
[19:05.360 --> 19:07.680]  Most people, I think the general consumers would.
[19:07.880 --> 19:12.140]  But they... but thinking about this, like, people ask me, well, what's the problem with OnStar?
[19:12.540 --> 19:13.820]  Do you have something to hide?
[19:13.820 --> 19:15.080]  I get that question a lot.
[19:15.200 --> 19:17.260]  If you're trying to be anonymous in society, why?
[19:17.700 --> 19:19.260]  You know, what's the problem with that?
[19:19.360 --> 19:22.540]  And it's just... it's not the fact that I have something to hide, but it's the fact that...
[19:22.540 --> 19:30.900]  it's a little bit of civil liberties that I want to try to maintain post... with the DMCA, the Patriot Act, all of these combined together.
[19:31.140 --> 19:33.140]  It's becoming harder and harder to do this.
[19:33.540 --> 19:35.060]  And we get a lot more questions.
[19:35.940 --> 19:39.180]  I've talked... I just talked to another lawyer yesterday, Alex.
[19:39.280 --> 19:46.220]  I talked to Alex, and he was saying that it's becoming really difficult to work in the legal profession and be able to say, hey, I go to hacker conferences.
[19:47.020 --> 19:50.640]  Because people first are like, well, you know, that's... a lot of people ask me, like, why would you want to do that?
[19:50.680 --> 19:51.460]  There's so many criminals there.
[19:51.480 --> 19:54.860]  I'm like, I've been going to hacker conferences since, I think, eight years ago.
[20:03.150 --> 20:15.590]  Well, I'll tell you, one of the reasons I got interested in doing this is when I was in undergrad school, I was at Carnegie Mellon, and I just heard a little bit about what was going on with Kevin Mitnick and what was going on with Bernie S.
[20:15.950 --> 20:17.590]  And it really upset me a lot.
[20:18.030 --> 20:19.590]  And I'm thinking, what can I do about this?
[20:19.730 --> 20:24.750]  I was... I felt like... I heard Kevin speak many times, and I'm going to his presentation tonight.
[20:24.930 --> 20:31.890]  But I heard him say, you know, I know I broke the law, I did these things, but I don't believe that the punishment really was fair.
[20:32.730 --> 20:43.010]  I read about the way that the judge reviewed his case, being able to whistle tones to connect to the Internet when you're in jail to launch missiles.
[20:43.230 --> 20:45.130]  I thought that was a joke when I heard it.
[20:45.350 --> 20:52.110]  And I thought, how could... you know, I thought that people in the legal community, I mean, you have to be kind of smart to go to law school, right, and become a judge.
[20:52.110 --> 20:54.850]  I mean, you really got to be really smart to do that.
[20:54.990 --> 20:56.630]  Okay, well, yeah, maybe.
[20:56.910 --> 21:03.890]  I mean, there are very smart people that do these things, but they don't have a lot of background in technology and computer science or with IT.
[21:04.150 --> 21:11.970]  And what scares me is when people like Kevin get into the system, you're in a system with most people that don't have any background in this.
[21:12.010 --> 21:13.990]  So are you going to get a fair trial?
[21:14.890 --> 21:18.790]  I worried that the answer was no in a lot of cases.
[21:18.930 --> 21:21.810]  There are people like Jennifer Granick that... she was one of my inspirations too.
[21:22.110 --> 21:23.550]  I went to... yeah, she's great.
[21:23.890 --> 21:27.110]  I went to law school because these things bothered me.
[21:28.150 --> 21:31.910]  And I wanted to figure out, like, how could... when Bernie S.
[21:32.050 --> 21:36.310]  was in jail, why did they put him in a jail with some pretty hardcore criminals?
[21:36.590 --> 21:39.930]  And I know he had some pretty bad experiences in jail.
[21:40.090 --> 21:41.190]  He was beaten up in jail.
[21:41.390 --> 21:43.090]  I've heard this in a presentation he did.
[21:44.010 --> 21:46.690]  Hackers in jail, the last HOPE that I went to two years ago.
[21:47.130 --> 21:48.210]  And it bothers me.
[21:48.210 --> 21:53.050]  So that's why I've developed the background in technology.
[21:53.410 --> 21:54.370]  And I am an attorney.
[21:54.730 --> 22:00.510]  And what I'm trying to do is to educate people in the legal community, people making legislation.
[22:01.870 --> 22:14.070]  And just to be able to say, hey, there are a lot of people out here, and there are a lot of people that come to these conferences, that if you ask for some help, if there's some aspect of the technology you don't understand, there's some people that care so much about these issues,
[22:14.230 --> 22:16.570]  they'll volunteer to tell you about it.
[22:16.850 --> 22:21.670]  I mean, Judge Kaplan, maybe he could have... California, he heard the Microsoft case.
[22:22.070 --> 22:29.210]  I think that if he was more open to a lot of people from this community saying, hey, I'll tell you about what this means.
[22:29.410 --> 22:32.370]  I'll tell you what this patent... these patents do to our industry.
[22:32.930 --> 22:37.470]  I think it might... maybe it'll change a little bit of the judicial system and how they handle hackers.
[22:38.330 --> 22:45.470]  So we'll have fewer hackers in prisons, especially in, like, maximum security prisons.
[22:45.530 --> 22:46.670]  I don't get that at all.
[22:47.030 --> 22:48.150]  That's really unfortunate.
[22:48.350 --> 22:48.850]  Did you have a question?
[22:48.990 --> 22:51.270]  I'll take one question now and I'll take the others afterwards.
[22:52.090 --> 22:53.890]  Could you speak up or go to the microphone?
[22:54.350 --> 22:55.330]  I can speak up.
[22:55.430 --> 22:55.990]  Okay, great.
[22:56.530 --> 23:00.570]  The question I have to ask is, one problem I think that there might be is...
[23:00.570 --> 23:01.690]  This is actually a two-point question.
[23:01.910 --> 23:15.130]  Is that, first off, there's not enough training for people who are in the law profession, because most of the people focus on reading the law and understanding what the framers originally thought of what the laws would be and then what other amendments came from that.
[23:15.790 --> 23:34.070]  Is there any process right now or program to try to get, like, a mandatory training program for judges and other lawyers, system DAs, DAs, and all that, to understand in network technology and computer technology, understand how the programming is based in the language and how it's interpreted?
[23:34.370 --> 23:34.570]  Yeah.
[23:34.650 --> 23:37.030]  And a mandatory saying, do you understand this?
[23:37.130 --> 23:37.830]  Do you take a test?
[23:38.150 --> 23:39.950]  You can then, you know, try these cases?
[23:40.190 --> 23:50.210]  Or is there any process of trying to get a separate court system, like the juvenile court system, you know, marriage courts versus criminal courts and stuff like that?
[23:50.210 --> 23:58.510]  Because digital, in that way, you can actually have a jury or a panel of professionals who can say, yes, this is a true cyber crime.
[23:58.730 --> 24:02.070]  Send it to the cyber crime court instead of, you know, the criminal court.
[24:02.310 --> 24:05.990]  Yeah, I'm glad you asked the question, because let me rephrase it for people who didn't hear.
[24:06.490 --> 24:10.150]  The first part of the question was, is there any training for law students?
[24:10.430 --> 24:11.850]  Are there any programs you can do?
[24:11.850 --> 24:12.690]  And the answer is yes.
[24:13.070 --> 24:18.070]  And is there any training for, and I'll tell you, I'll go a little bit more about that in a second.
[24:18.250 --> 24:20.430]  And is there any training for judges?
[24:20.550 --> 24:25.030]  And is there going to ever be a special court system just for computer crimes?
[24:25.090 --> 24:28.450]  And I think no for both of those, unfortunately, but I'll tell you a little bit more.
[24:28.810 --> 24:33.150]  I had the privilege of when I went to, I went to Maine School of Law.
[24:33.510 --> 24:35.770]  And the reason we settled on it was we were in Seattle.
[24:35.910 --> 24:38.530]  My husband was working for a big software company out there.
[24:38.770 --> 24:40.970]  And we wanted to go someplace near the ocean, near the mountains.
[24:41.150 --> 24:43.270]  And I got to Maine Law, and I interviewed there.
[24:43.290 --> 24:45.290]  And they said, hey, we have a technology law center.
[24:45.610 --> 24:46.630]  So I'm like, great.
[24:46.710 --> 24:47.570]  It's near the ocean.
[24:47.670 --> 24:48.070]  I surf.
[24:48.170 --> 24:49.070]  My husband snowboards.
[24:49.210 --> 24:49.770]  It's going to be perfect.
[24:49.770 --> 24:51.790]  So I get there, and it's virtual.
[24:52.790 --> 24:53.950]  It had an email address.
[24:54.230 --> 24:56.470]  And I was like, man, this is really tough.
[24:56.510 --> 24:58.730]  Because, you know, I chose this school for a bunch of reasons.
[24:58.810 --> 24:59.650]  That was a really big one.
[24:59.830 --> 25:04.490]  So when I got there, there was a group, a technology and law student group.
[25:04.690 --> 25:06.970]  And they still exist, although they have a different name now.
[25:07.810 --> 25:09.090]  But we got together.
[25:09.090 --> 25:11.170]  We ordered pizza with our budget, pretty much.
[25:11.470 --> 25:13.090]  And we talked about these issues.
[25:13.090 --> 25:15.790]  And we had some seminars.
[25:16.390 --> 25:21.710]  Once a month, we tried to bring in a speaker to talk to the law school and the students about these issues.
[25:22.110 --> 25:23.990]  And it was pretty successful.
[25:24.210 --> 25:28.650]  From what I hear now, the group grew from five when I was there to their over 20 who regularly attend.
[25:29.030 --> 25:35.090]  Which is great, because we're also getting more people with computer science and IT backgrounds applying to law school.
[25:35.190 --> 25:35.890]  And we need more.
[25:36.130 --> 25:37.430]  We definitely need more.
[25:37.670 --> 25:40.650]  Because I think it's really all of you, when you choose to...
[25:40.650 --> 25:46.790]  If you choose to go into law, traditionally, to study this like I did, you have to take a route in intellectual property.
[25:47.050 --> 25:50.430]  Because a lot of what goes on with computer crimes has to do with...
[25:50.850 --> 25:55.090]  Well, a lot of what you learn about in the cases is when contracts are violated.
[25:55.270 --> 25:57.890]  They're usually intellectual property violations as well.
[25:58.170 --> 26:00.070]  And corporations care a lot about that.
[26:00.370 --> 26:03.650]  But what I'd like to see more is the criminal law developed...
[26:04.250 --> 26:07.630]  The criminal law programs in law school developed to include a lot more with cyber crimes.
[26:07.630 --> 26:13.450]  And at Maine School of Law right now, we went through an email address to now they have a Center for Innovation and Technology.
[26:13.790 --> 26:18.410]  They have clinical programs where people can come in and take cases.
[26:18.550 --> 26:20.170]  They're mostly in IP right now.
[26:20.430 --> 26:29.250]  But I have plans to try to combine the computer science department and the law school into a program where we can take more cyber crimes cases.
[26:29.410 --> 26:29.770]  Federal.
[26:29.990 --> 26:32.310]  We don't have a lot in Maine going on.
[26:32.310 --> 26:37.050]  But for federal cases, I could take people from all over the country to work on that.
[26:37.230 --> 26:43.190]  And I have some people interested, people whom I met at DEFCON last year who are law students.
[26:43.350 --> 26:48.150]  So I've met so many people who are going into law that are from IT and CS backgrounds.
[26:48.310 --> 26:49.090]  It's so fantastic.
[26:49.250 --> 26:56.250]  Because when I applied, I felt like kind of like when we read cases, like we read Evil Corley's cases, Emmanuel Goldstein's case.
[26:56.250 --> 27:03.790]  And I remember when people would ask me about it, I did the presentation for that because I really enjoy that type of law.
[27:04.030 --> 27:07.610]  And after that, the professors, every time they say hacker, they kind of look at me.
[27:07.890 --> 27:10.910]  And I'd be like, yeah, yeah, I know that case.
[27:10.910 --> 27:12.010]  And yeah, I am a hacker.
[27:12.150 --> 27:15.550]  And I'll tell you why that's not a negative term, even in law.
[27:15.630 --> 27:19.830]  When you read a lot of legal cases, they still say hacker, hacker as in a malicious type.
[27:19.830 --> 27:22.150]  But no, it's changing.
[27:22.430 --> 27:25.750]  But we need more people in IT and CS to come into the field.
[27:27.310 --> 27:29.750]  And I'll tell you, you all are smart enough to do it.
[27:29.850 --> 27:36.190]  I mean, if you can do discrete math and do a lot of program, I mean, you're going to be able to handle law school just fantastically.
[27:36.650 --> 27:39.010]  And I'm really glad to hear that they're more going into it.
[27:39.070 --> 27:43.870]  As for the judicial program, I've been working on trying to set up a nonprofit group.
[27:44.190 --> 27:45.730]  I'm trying to name it Hacker Law.
[27:45.730 --> 27:51.810]  I'm having a little bit of resistance in the legal community because there's still this, as I mentioned, the idea that hacker means something illegal.
[27:52.370 --> 28:00.550]  But I wanted to name it Hacker Law and I wanted to set up a judicial training program where judges have to go through continuing judicial legal education just like lawyers do.
[28:00.990 --> 28:09.830]  So in addition to educating some of the older lawyers for their continuing legal education credits about cyber laws, cyber crimes, that's not just intellectual property about patents.
[28:10.070 --> 28:11.990]  It's more about some of the cases.
[28:12.710 --> 28:16.210]  It would be nice if some of the judges actually knew how to analyze code.
[28:16.550 --> 28:24.350]  Because I truly believe that when someone's being prosecuted for a crime, if it's a computer crime, it's kind of like they look at the results.
[28:24.470 --> 28:25.690]  Okay, this is what was broken.
[28:25.830 --> 28:26.570]  This is what was taken.
[28:26.670 --> 28:34.110]  This is the financial amount that is at stake in this case, that, for instance, like Sun in my case claims is the damage.
[28:34.390 --> 28:39.850]  But if you actually look at how the crime was done, I believe that you have to open up the code and take a look.
[28:39.850 --> 28:45.050]  This maybe doesn't apply for the script kiddies, but for people that are being tried as...
[28:45.050 --> 28:52.590]  Because all of you in here, if you committed a crime, and many of you know if you have done some time, you're considered to be experts.
[28:53.290 --> 28:57.950]  So even if you're 17, you might be tried as an adult, because they look at your...
[28:57.950 --> 29:05.510]  The legal system looks at what you can do as being elevating the criminal aspect.
[29:05.670 --> 29:15.610]  So you might actually get more time because you're really good at CS and IT, and if the prosecution can prove that, it's more difficult for you.
[29:16.150 --> 29:20.690]  But if it comes to... I often look at the regular cases of criminal acts.
[29:20.690 --> 29:25.610]  Like if you break into a building, how you got into the building is very important.
[29:25.730 --> 29:26.590]  It can show intent.
[29:27.650 --> 29:31.090]  So there's a difference between, as you all know, just releasing code that other people have written.
[29:31.130 --> 29:32.190]  That's a script kiddie thing.
[29:32.510 --> 29:36.210]  And a lot of them don't really have any idea about the damage it can cause.
[29:36.530 --> 29:39.090]  I guess, you know, Morris is kind of...
[29:39.090 --> 29:41.310]  With the worm is kind of like that in that case.
[29:41.450 --> 29:43.410]  That he really had no idea, and that was a good defense.
[29:43.890 --> 29:45.730]  But that doesn't fly so well anymore.
[29:46.710 --> 29:55.990]  So I believe that it would be great if judges and lawyers could break down the code, or look at the hardware that you used and say, okay, let's see how much intent, how much planning was involved.
[29:56.130 --> 29:57.690]  Because in other crimes, it makes a very big difference.
[29:59.170 --> 30:06.010]  So thank you for asking that question, because I would like to see more education for judges and lawyers, who are kind of from the...
[30:06.870 --> 30:09.910]  A lot of them are in their 40s and 50s, and this wasn't...
[30:09.910 --> 30:11.490]  They're in their 40s and 50s in age.
[30:11.670 --> 30:14.270]  And this wasn't something that they studied in law school.
[30:14.270 --> 30:16.190]  It was all about contracts, property.
[30:17.210 --> 30:20.670]  And now, even when I went to law school, if you were interested in computers, you have...
[30:20.670 --> 30:22.490]  It's really the intellectual property track.
[30:23.250 --> 30:25.090]  So thank you for asking that question.
[30:26.330 --> 30:28.730]  So let me talk a little bit about tracking of cars.
[30:28.930 --> 30:30.750]  I'm going to have to mention that...
[30:32.290 --> 30:39.130]  Review, the 2004, I think it was two hopes ago, nothing faced, presented at HOPE about the benefits of hacking your onboard computer.
[30:39.510 --> 30:42.430]  One thing I've got to say is watch out about the DMCA with that.
[30:42.430 --> 30:46.950]  But there are going to be tire pressure monitoring systems in cars.
[30:47.750 --> 30:49.090]  Well, actually, they're here now.
[30:49.310 --> 30:55.030]  But in 2005, the National Highway and Traffic Safety Administration issued a rule saying they have to be in there.
[30:55.670 --> 31:00.170]  One of the problems is that you can read them using a directional antenna.
[31:00.330 --> 31:03.130]  You don't have to be, like, right up close against the tire.
[31:03.270 --> 31:05.430]  And that concerns me for security purposes.
[31:06.570 --> 31:12.530]  If it does have a unique identifier, you want to know if someone is going to a specific location.
[31:13.170 --> 31:16.850]  If you, excuse me, follow them out when they're driving around in town.
[31:17.210 --> 31:19.410]  Find out what that unique identifier is.
[31:19.590 --> 31:23.190]  And then set up a reader wherever you think they might be going.
[31:24.210 --> 31:26.830]  And you'll see, you know, if you'll be able to tell if they're there or not.
[31:26.950 --> 31:29.890]  Without actually being, you don't have to be there.
[31:29.890 --> 31:33.450]  You don't have to physically approach them and, you know, say, hey, have you been there?
[31:33.630 --> 31:35.130]  The information will be there.
[31:36.750 --> 31:38.410]  Okay, government-issued ID.
[31:38.950 --> 31:41.950]  What were the results of the secure passport trials in the Netherlands?
[31:42.070 --> 31:44.670]  Okay, this is a little bit different than the credit cards that I was talking about.
[31:44.890 --> 31:46.630]  I have a lot to say about passports.
[31:46.650 --> 31:47.330]  I have two.
[31:48.150 --> 31:49.470]  I'm a citizen of the U.S.
[31:49.490 --> 31:51.470]  and I'm also a dual citizen of Latvia.
[31:52.870 --> 31:54.610]  And I have my U.S.
[31:54.670 --> 31:58.370]  passport I renewed right before the RFID came in as mandatory.
[31:58.370 --> 32:00.970]  But my Latvian passport is probably going to contain RFID.
[32:01.530 --> 32:07.250]  So actually yesterday I went downstairs to the second floor and I bought one of those wallets from a nice guy named Michael, I believe.
[32:07.550 --> 32:11.150]  And it's... if my passport... my passport's not going to be open.
[32:11.250 --> 32:14.490]  It's not going to be able to be read if I have it in one of these wallets that they're selling down there.
[32:14.570 --> 32:18.190]  And I got one from my dad, too, because he has a Latvian passport as well.
[32:18.550 --> 32:22.250]  But the secure passport trials in the Netherlands, it was cracked so fast.
[32:22.510 --> 32:24.030]  I think it was in like a matter of hours.
[32:25.190 --> 32:33.070]  It was read remotely and then the security cracked the flaws using... they were built into the system, whereupon all the biometric data could be read.
[32:34.090 --> 32:37.310]  And this skimming exercise was concerning.
[32:37.690 --> 32:39.450]  And this was back in 2006.
[32:41.070 --> 32:42.750]  This is part of the same case.
[32:42.750 --> 32:46.050]  After intercepting the data, the security can be broken on a PC in just two hours.
[32:46.190 --> 32:49.290]  Date of birth, facial image, and fingerprints were all there out in the open.
[32:49.930 --> 32:56.270]  Secret key is made up of the passport expiration date, birth date, and the passport number, stored on the passport's machine readable zone.
[32:56.670 --> 33:03.130]  What was the most bothersome to the computer science students I tell about this is that the last digit of the number is a checksum.
[33:03.810 --> 33:09.110]  That's one... an introduction to programming, that's one of the things you figure out if like all your loops have worked out, right?
[33:09.190 --> 33:10.830]  That's like a really intro thing.
[33:11.070 --> 33:14.370]  How did that get into the encryption for, you know, these passports?
[33:14.870 --> 33:15.270]  Contractors.
[33:15.970 --> 33:16.610]  Contractors, yeah.
[33:17.070 --> 33:18.310]  Oh, I'm going to get to that one, too.
[33:18.410 --> 33:18.590]  All right.
[33:18.950 --> 33:21.710]  My passport is the one on the left.
[33:22.090 --> 33:25.050]  The one on the right is my two-year-old son's passport.
[33:25.050 --> 33:29.510]  It has the RFID, and there's nothing that I can do about it.
[33:29.810 --> 33:34.470]  Although, I'll get to a Wired article that tells... that can suggest something you can do about it.
[33:34.530 --> 33:36.450]  But you know that your passport, your U.S.
[33:36.470 --> 33:37.810]  passport, is not your property.
[33:38.030 --> 33:39.070]  It belongs to the U.S.
[33:39.190 --> 33:39.470]  government.
[33:39.750 --> 33:42.010]  So when you mess with that, you're messing with the U.S.
[33:42.150 --> 33:44.230]  government, just to let... you know, give you a warning about that.
[33:44.230 --> 33:50.410]  But one of the things we did when we renewed our passports is we don't give our Social Security numbers out for anything except for taxes.
[33:51.270 --> 33:58.930]  And even then, I have two kids now, and we did not... we don't want Social Security for them until they're ready to decide on their own.
[33:59.210 --> 34:01.530]  Because it is being used as a national ID number.
[34:01.770 --> 34:06.250]  There's a doctor in Maine who wouldn't treat me because I wouldn't give them my Social Security number.
[34:06.450 --> 34:08.650]  I told them my health insurance doesn't even have it.
[34:08.750 --> 34:09.490]  They don't need it.
[34:09.870 --> 34:11.170]  There's no reason for you to have it.
[34:11.190 --> 34:13.810]  And they said, well, you know, our database, that's the key for it.
[34:13.970 --> 34:14.890]  And I said, you know what?
[34:14.970 --> 34:16.030]  That's not a unique identifier.
[34:16.170 --> 34:18.010]  There are a lot of people who have the same Social Security numbers.
[34:19.070 --> 34:21.730]  And they said, hey, sorry, we can't get you in the system.
[34:21.750 --> 34:22.610]  We can't treat you.
[34:23.230 --> 34:26.570]  So I sent them a couple of letters, you know, a letterhead from the university.
[34:26.590 --> 34:28.990]  And I said, you know, that's really... that's not good.
[34:30.270 --> 34:35.830]  So what I'm suggesting here is you don't always need to disclose your Social Security number.
[34:35.990 --> 34:36.830]  But how about to the U.S.
[34:36.950 --> 34:37.690]  Passport Office?
[34:38.090 --> 34:41.870]  When someone from a government agency asks for your number, they are required to provide...
[34:41.870 --> 34:45.290]  The 1974 Privacy Act requires disclosure.
[34:45.750 --> 34:52.030]  It's a notice, which is required to tell you what law allows them to ask, whether you have to provide your number, and what will happen if you don't provide it.
[34:52.150 --> 34:56.010]  So if you turn over the application for a passport, there's a lot of really scary wording on the back.
[34:56.550 --> 35:07.630]  But actually, there's another computer group, and I was so psyched to say that this was a computer professionals for social responsibility group who have... they have a letter that when you reapply for your passport, you send this with it.
[35:07.710 --> 35:08.990]  And I'll tell you how it worked out for me.
[35:09.230 --> 35:15.730]  When you apply for a passport, you can refuse to review your Social Security number to the passport office and instead mail a notice to the IRS.
[35:16.310 --> 35:25.490]  It's kind of like you're doing business with the government when you have to mail your Social Security number to the IRS because you're... well, that's how the tax law gets in with this.
[35:25.490 --> 35:29.730]  And why the IRS needs it, but the passport office really doesn't.
[35:30.490 --> 35:39.450]  If you... what you do have to do is give only your Social Security number to the IRS and notify the passport office that you're giving this to the IRS.
[35:39.870 --> 35:41.550]  So I'll tell you what happened with us.
[35:41.790 --> 35:42.450]  Here's the letter.
[35:42.690 --> 35:48.370]  If you go to the website for computer professionals for social responsibility.org, they have a canned letter here.
[35:48.570 --> 35:50.630]  And this is the one that we used almost exactly.
[35:51.310 --> 35:52.550]  And don't read this now.
[35:52.650 --> 35:56.930]  I'm just saying that when I post this, if you want to take a look at the letter, there it is.
[35:57.130 --> 35:57.290]  All right.
[35:57.650 --> 35:58.750]  How did this work for us?
[35:58.890 --> 36:03.630]  At the same time, my husband and I, we didn't do the joint application because we wanted to do a little bit of experiment.
[36:04.230 --> 36:09.650]  We both mailed our separate passport renewal applications without disclosing our Social Security number on the form.
[36:10.010 --> 36:19.350]  Included in the envelopes was a letter to the IRS and certified mail with return receipts so that we could confirm that the letter disclosing our Social Security numbers to the IRS was unopened by the U.S.
[36:19.430 --> 36:22.770]  Passport Office and was put back into the mail and sent to the IRS.
[36:23.530 --> 36:23.930]  All right.
[36:23.990 --> 36:25.210]  Did we get the return receipts back?
[36:25.390 --> 36:25.630]  Yes.
[36:25.790 --> 36:25.910]  Okay.
[36:25.930 --> 36:30.030]  My husband's return receipt was returned to us three weeks after mine was returned.
[36:30.810 --> 36:31.490]  His looked great.
[36:31.730 --> 36:35.590]  It actually was sent and received, you know, sent to the IRS and received by the IRS.
[36:35.670 --> 36:37.570]  You can see the stamp, the stamp there.
[36:38.010 --> 36:38.450]  Okay.
[36:38.510 --> 36:39.330]  Now, here's mine.
[36:40.210 --> 36:43.750]  Citigroup somehow got mine, and I have no idea how or why.
[36:45.010 --> 36:46.810]  There was also a big boot print on it.
[36:46.930 --> 36:48.210]  I guess it didn't scan very well.
[36:48.390 --> 36:49.670]  I don't know where this thing went.
[36:49.810 --> 36:51.890]  What I suspect happened is someone at the U.S.
[36:51.990 --> 36:53.890]  Passport Office actually did open up my envelope.
[36:54.010 --> 36:56.070]  This is why we sent the application separately to see.
[36:56.510 --> 36:58.650]  And then they looked and they said, oh, oh, no.
[36:58.810 --> 36:59.270]  Like, oh, crap.
[36:59.430 --> 37:01.010]  We got to put this back in the mail.
[37:01.130 --> 37:03.510]  Like, do you know anyone who can stamp this with something just to...
[37:03.510 --> 37:06.210]  So this person's happy when they get the return receipt back.
[37:06.370 --> 37:08.670]  So maybe someone said, hey, I know someone who works for Citigroup.
[37:08.790 --> 37:09.350]  Let's stamp it.
[37:09.570 --> 37:10.370]  And that's what happened.
[37:10.370 --> 37:13.810]  And mine came back very strangely, very late.
[37:14.390 --> 37:23.490]  So I guess I'm going to write to the guy from the Computer Professionals for Social Responsibility, or maybe send him a DVD of this.
[37:23.630 --> 37:27.230]  And tell him, like, hey, we had a 50% return on this.
[37:27.850 --> 37:30.190]  But it's a start.
[37:30.190 --> 37:33.990]  So if more people know about this, you can give it a try.
[37:33.990 --> 37:37.570]  But hey, this isn't legal information I'm giving, so don't take it as such.
[37:37.730 --> 37:39.690]  But we gave this a try.
[37:39.850 --> 37:41.270]  We have other experiments that we've tried.
[37:41.290 --> 37:43.350]  If I have time, I'll tell you about a few more of them.
[37:43.690 --> 37:45.830]  About carrying IDs through airports, too.
[37:46.470 --> 37:50.850]  With the Real ID Act and Citizenship, just talking a little bit about citizenship and the passport.
[37:51.090 --> 37:51.730]  Check this out.
[37:51.790 --> 37:57.570]  A guy in New Hampshire claims that he's a citizen of New Hampshire, not of the U.S., and got a U.S.
[37:57.730 --> 37:58.090]  passport.
[37:59.030 --> 38:01.570]  So he did this so he didn't have to pay federal taxes.
[38:02.230 --> 38:04.170]  He disagreed with the way our tax money was spent.
[38:05.230 --> 38:08.390]  This is... he said that when he took... if you watch this video...
[38:08.390 --> 38:11.610]  If you go to this URL, there's a video, and he tells how he did it.
[38:11.750 --> 38:14.350]  He said that he took his application to the passport office in Boston.
[38:14.490 --> 38:18.550]  They said this is not the first time we've had to do something like this with people claiming...
[38:18.550 --> 38:20.990]  You know, they live in the... excuse me, the live free or die state.
[38:21.790 --> 38:22.750]  So... which is New Hampshire.
[38:23.930 --> 38:26.530]  And so that is one way that someone's gotten the passport.
[38:26.530 --> 38:28.350]  A different way than... than I did.
[38:29.190 --> 38:29.730]  All right.
[38:29.870 --> 38:30.850]  What's on your passport?
[38:31.310 --> 38:32.830]  It depends on the issuing country.
[38:33.050 --> 38:36.250]  American passports contain name, gender, birth date, and birthplace.
[38:36.530 --> 38:40.010]  Your passport number, its issue date, expiration dates, and a digital version of your photo.
[38:40.690 --> 38:43.730]  They say that your Social Security number and address are not on the chip.
[38:43.990 --> 38:49.070]  And the State Department says that the chip's range is about four inches, and they can't be read when the passport is fully closed.
[38:49.230 --> 38:52.770]  Yeah, I went to Render Mann's... I think it was... yeah, his presentation last night.
[38:53.330 --> 38:59.310]  But if your passport's open just a tiny bit in your pocket, that's when there is some security vulnerability.
[39:00.130 --> 39:03.290]  On my Latvian passport, a digital photo is on it right now.
[39:03.610 --> 39:06.050]  But by 2009, my fingerprints are going to be on it.
[39:06.130 --> 39:11.730]  So I'm going to renew before that happens and wait... eventually in 10 years, I'm going to have to renew again.
[39:11.870 --> 39:14.090]  And by then maybe the security flaws will have been worked out.
[39:14.090 --> 39:23.190]  Other biometric data, if you get arrested now for a federal crime, the FBI is going to take a lot of pictures of your tattoos and other identifying information.
[39:23.470 --> 39:25.770]  And they're storing it in a facility in West Virginia.
[39:27.010 --> 39:36.850]  And what they're doing with that, as the guy gave a presentation this morning about surveillance devices, it's in your FBI record.
[39:37.390 --> 39:41.190]  What's in it and how to change it, he claims it's not possible.
[39:42.070 --> 39:43.910]  I don't know the truth in that.
[39:44.010 --> 39:45.650]  I don't personally know any FBI agents.
[39:45.670 --> 39:49.030]  But I do know it's very hard to find out what's on your record.
[39:49.030 --> 39:51.370]  Unless it's a criminal record and you know what you've been charged for.
[39:51.710 --> 39:54.230]  But other data that they've collected on you, it's there.
[39:54.490 --> 40:02.050]  So one of the things that I've been cautious about is there's some airports in Europe that when you go through, they take biometric scans.
[40:02.050 --> 40:04.110]  And I know one of them is Frankfurt in Germany.
[40:04.690 --> 40:06.830]  And I've been trying to avoid that airport.
[40:07.250 --> 40:14.150]  I fly other places when I need to go to Europe because I don't really want that data in some database about me right now.
[40:14.510 --> 40:22.710]  But it's getting to the point where if I don't want this, it's going to be really tough to fly through Europe because some of these scans are really difficult to trick.
[40:23.070 --> 40:24.250]  In fact, near impossible.
[40:24.590 --> 40:29.250]  So if you travel Europe a lot, it's going to be on someone's database.
[40:29.250 --> 40:33.850]  And it might even go into some artifact, you know, part of your passport if you go through those countries.
[40:34.130 --> 40:35.110]  But that's an update.
[40:36.090 --> 40:36.830]  That's an update.
[40:37.010 --> 40:39.770]  You only have to give you a biometric if you want to skip the security.
[40:40.310 --> 40:41.230]  Right now, yeah.
[40:41.290 --> 40:43.850]  He's saying that you only have to give biometric if you want to skip it.
[40:43.990 --> 40:47.650]  I have an EU passport, so I might be able to get around some of these.
[40:47.850 --> 40:54.290]  But for those of you that don't have dual passports, well, when I travel, I don't show both of them.
[40:54.350 --> 40:55.030]  That's really bad.
[40:55.270 --> 40:57.650]  But it's not illegal, but it's just not a good thing.
[40:58.370 --> 41:00.170]  Who wrote the encryption for the passport?
[41:00.370 --> 41:03.410]  Okay, this is something that I was shocked when I read this in the Washington Times.
[41:03.530 --> 41:03.930]  But the U.S. government outsourced encryption development to a European company.
[41:07.370 --> 41:10.390]  And that European company had a company in Taiwan write the encryption.
[41:11.670 --> 41:15.970]  Yeah, this is about when Bob Steele was talking about outsourcing some really important security stuff.
[41:16.110 --> 41:17.510]  This is a great example of that.
[41:17.670 --> 41:18.170]  But the U.S. government said that the U.S. didn't have the technology to do it here in the U.S.
[41:21.790 --> 41:22.270]  Yeah.
[41:22.790 --> 41:27.590]  I happen to think it was more for financial reasons, just like why a lot of jobs are outsourced.
[41:29.290 --> 41:29.770]  Bangladesh.
[41:29.910 --> 41:30.750]  Yeah, Bangladesh.
[41:31.030 --> 41:31.410]  Okay, yeah.
[41:33.170 --> 41:34.910]  Passport encryption was stolen.
[41:35.270 --> 41:36.010]  All right.
[41:36.310 --> 41:46.110]  It was divulged in a report in October 2007, filing at The Hague, that China had stolen the patent technology used for the e-passport chips.
[41:46.630 --> 41:48.210]  I believe it was the algorithm.
[41:49.450 --> 41:52.410]  GPO was using the unsecured...
[41:52.410 --> 41:53.190]  Oh, this is another thing.
[41:53.290 --> 42:01.470]  Once it's back here in the U.S., they were using unsecured FedEx courier services to send blank passports to State Department offices until security concerns were raised.
[42:01.990 --> 42:07.990]  And the blank passports are really hot on the black market because you can make that and you can be anyone you want with those.
[42:09.850 --> 42:19.830]  The GPO was forced to use an armored car company, but the agency proposed using a foreign armored car company vendor before the State Department, you know, diplomatic services objected.
[42:20.090 --> 42:21.050]  This was concerning.
[42:21.270 --> 42:24.730]  I mean, our government, if they're really that concerned about security, let's try...
[42:24.730 --> 42:37.410]  I mean, unless these companies are checked out really, really well, and I'll tell you, if a European company had a lot of business with a Chinese company that was doing the coding, I would say, if I was working for the government, let's be a little bit more cautious about that.
[42:38.030 --> 42:38.610]  China's great.
[42:38.790 --> 42:41.850]  I think they're going to be the next, you know, first world country up and coming.
[42:42.670 --> 42:45.010]  But they have a lot of security issues over there.
[42:45.090 --> 42:47.210]  I studied law over there for a summer.
[42:47.910 --> 42:51.350]  And, gosh, we had two Chinese agents in our group.
[42:51.510 --> 42:53.730]  There were American law students, Chinese law students.
[42:53.850 --> 42:55.930]  We didn't know who the Chinese government agents were.
[42:56.470 --> 43:01.990]  But they were kind of there to make sure that we weren't working for the CIA or Naval Intelligence or something like that.
[43:02.790 --> 43:05.530]  But China's not exactly our friend just yet.
[43:05.770 --> 43:08.390]  So I would have said, keep this stuff in the U.S.
[43:08.510 --> 43:10.150]  for companies that have been checked out really well.
[43:10.230 --> 43:11.070]  Don't outsource that.
[43:11.730 --> 43:13.650]  And how are the passports made?
[43:13.650 --> 43:18.930]  This is important when you're thinking about what happened with those blank passports being sent by FedEx and the couriers.
[43:18.930 --> 43:24.710]  The computer chips are inserted into the back covers of the passports in the Netherlands by this company, SmartTrack.
[43:24.850 --> 43:30.050]  And blank covers are shipped to a factory in Thailand and to be fitted with an RFID antenna.
[43:30.390 --> 43:32.950]  And blank passports eventually are transported to Washington, D.C.
[43:32.990 --> 43:33.850]  for the final binding.
[43:34.390 --> 43:34.770]  Wow.
[43:35.090 --> 43:35.570]  That's cute.
[43:35.870 --> 43:36.250]  Yeah.
[43:37.110 --> 43:39.370]  Well, I think a lot of you heard about this.
[43:39.390 --> 43:43.590]  And this is one of the concerns I have when I carry my passport, if it would come up in my pocket.
[43:43.690 --> 43:45.290]  Because I do travel to some countries.
[43:46.150 --> 43:49.990]  I've spent a lot of time in South America where I don't want people to know I'm American.
[43:50.410 --> 43:53.050]  And I don't know which speaker was saying it, but I do try to blend.
[43:53.270 --> 43:53.890]  I really do.
[43:54.710 --> 43:58.470]  And I was worried when I read about this.
[43:58.590 --> 44:01.410]  I don't have an RFID passport, but my two-year-old son does.
[44:01.570 --> 44:03.570]  And I'd probably be carrying it for him now anyway.
[44:03.930 --> 44:08.990]  But when I saw this, they pulled this dummy along a clothesline.
[44:09.150 --> 44:13.230]  And when it got really close to this trashcan, a bomb, a simulated bomb went off.
[44:13.230 --> 44:17.230]  It was actually model rockets that were sent to fire when an American...
[44:17.230 --> 44:20.470]  When a passport went by and it got the RFID from that.
[44:20.970 --> 44:23.190]  And that was shown at Black Hat a while ago.
[44:23.450 --> 44:26.750]  And that bothered me a bit when I saw that.
[44:26.950 --> 44:29.990]  So I bought one of those wallets today... yesterday.
[44:30.750 --> 44:31.630]  I don't want...
[44:31.630 --> 44:34.650]  Well, I guess the odds of this happening are pretty slim.
[44:34.890 --> 44:36.550]  But I didn't like it when I saw that video.
[44:36.630 --> 44:39.970]  If you want to watch the video, go to their website too, the company's website.
[44:39.970 --> 44:40.990]  And you can get it on YouTube.
[44:41.970 --> 44:42.290]  All right.
[44:42.430 --> 44:43.770]  I can't tell you how to do this.
[44:43.850 --> 44:45.790]  Because like I said, your passport's not your property.
[44:45.950 --> 44:46.270]  It's the U.S. Government's.
[44:46.850 --> 44:47.070]  But...
[44:47.070 --> 44:48.170]  Wired did an article.
[44:48.690 --> 44:49.790]  And this is it.
[44:50.950 --> 44:52.870]  Best approach, they said, is if...
[44:52.870 --> 44:56.450]  You know, to do something with the antenna is use a heavy blunt object on it.
[44:56.590 --> 44:59.950]  But I can't say that that's a good thing to do because it's illegal.
[45:00.590 --> 45:04.170]  But Wired published this, so I wanted to pass along this information to you.
[45:05.050 --> 45:05.630]  Washing it.
[45:05.770 --> 45:07.650]  Someone asked me yesterday about putting it in a microwave.
[45:07.950 --> 45:10.510]  Huge burn marks result in that.
[45:11.150 --> 45:13.990]  I don't know from personal experience, but that's what it says here.
[45:15.770 --> 45:16.650]  Human implantation.
[45:16.810 --> 45:25.170]  I have a little bit about this in here because a couple of states just passed laws saying it's illegal for your employer to require you to be chipped.
[45:25.170 --> 45:31.630]  I remember at the HOPE two years ago, I think Anna Lee got in, like, she was like way more dedicated than I was.
[45:31.670 --> 45:33.390]  She actually got chipped for the presentation.
[45:33.390 --> 45:38.710]  And she showed how easy it was in an elevator for someone to come up and get her information off her arm.
[45:39.850 --> 45:41.550]  But these chips are still out there.
[45:41.690 --> 45:44.470]  There's a company in New England that does require this...
[45:44.470 --> 45:46.710]  If you want to work for this company, they make you get chipped.
[45:46.770 --> 45:48.030]  And I think that that just...
[45:48.030 --> 45:50.850]  It's just a violation of a lot of things.
[45:51.570 --> 45:54.210]  But there are health risks associated with this.
[45:54.210 --> 45:57.670]  And they, you know, VeriChip knew about this from the beginning.
[45:58.270 --> 46:01.290]  You can get a lot about companies from their SEC statements.
[46:01.430 --> 46:02.510]  Like, when they're...
[46:02.510 --> 46:05.330]  They have to disclose certain information to investors.
[46:05.650 --> 46:09.590]  And one of the things that came out in this were the health risks associated with this.
[46:10.510 --> 46:11.090]  There it is.
[46:11.210 --> 46:12.150]  That was really scary looking.
[46:12.270 --> 46:12.910]  But that's how...
[46:12.910 --> 46:14.530]  That's the device they use to chip people.
[46:16.550 --> 46:20.910]  And question, is this a dog chip or is this a VeriChip that goes in people?
[46:20.910 --> 46:24.250]  There's a grain of rice below the two chips a dime for...
[46:24.250 --> 46:26.530]  I got this from Spy Chips.
[46:26.990 --> 46:28.470]  Someone wrote a really good book about that.
[46:29.430 --> 46:31.350]  And the top one is for humans.
[46:31.350 --> 46:32.690]  The bottom one is for animals.
[46:32.910 --> 46:34.110]  It looks the same, doesn't it?
[46:34.950 --> 46:36.090]  It's pretty big.
[46:36.190 --> 46:41.750]  And I also heard that when you want to get it out, they don't really have that technique really well done yet.
[46:41.750 --> 46:45.390]  So it hurts a bit to take it out.
[46:45.830 --> 46:51.090]  This guy here, it hasn't been proven exactly yet that it could possibly cause cancer.
[46:51.210 --> 46:57.490]  But this is the dog here that they do claim died of cancer from something from the RFID chip.
[46:57.590 --> 46:59.670]  And also, you can't have an MRI done on that part of your body.
[46:59.670 --> 47:04.250]  So if you have it put in your hand, what do you do if you break your hand and need an MRI done?
[47:04.250 --> 47:05.370]  It'll hurt.
[47:06.110 --> 47:06.990]  It'll burn.
[47:07.250 --> 47:10.450]  But they've had some problems with...
[47:11.250 --> 47:15.090]  I wish they would have disclosed this a little bit easier before they chipped a lot of people.
[47:16.710 --> 47:22.030]  Some people in Las Vegas got chipped at a medical convention, I guess, just to see what it was like.
[47:23.110 --> 47:26.270]  And there's the insertion site for one of the chips.
[47:26.570 --> 47:30.610]  This guy's kind of saying, well, you know, this is something that's up and coming.
[47:30.610 --> 47:34.610]  You just have to get used to this idea.
[47:35.510 --> 47:36.390]  So, okay, thank you.
[47:37.510 --> 47:37.950]  Oops.
[47:39.330 --> 47:41.110]  Okay, this is what I mentioned to you.
[47:41.210 --> 47:44.790]  Wisconsin says they can't mandate implantations if you live in that state.
[47:45.190 --> 47:48.410]  And there's a huge fine for your employer if they make you do that.
[47:48.730 --> 47:52.790]  Other states, New Hampshire and Texas protest Walmart's usage of this.
[47:52.930 --> 47:58.610]  It's not generally about implantations, but it's about walking around and getting products and having them track you.
[47:58.610 --> 48:02.450]  Pre-crime detectors, this was another thing that I looked around a lot for.
[48:02.730 --> 48:04.390]  There are two of them that I wanted to mention.
[48:05.070 --> 48:11.070]  One of them is if you work in Las Vegas, in particular casinos, you're going to get a wristband.
[48:11.070 --> 48:15.750]  And if your heart rate goes up, management's triggered that there might be something going down.
[48:16.870 --> 48:23.650]  And, you know, what's concerning to me is someone could just be thinking about a stressful event that doesn't have anything to do with them stealing from the house.
[48:23.650 --> 48:25.930]  It just could be they're sick.
[48:26.190 --> 48:28.790]  There could be a lot of reasons why this would trigger.
[48:28.930 --> 48:31.690]  But it's associated with their name, all of that.
[48:32.070 --> 48:35.130]  And maybe they track how many times someone's heart rate went up.
[48:35.250 --> 48:36.590]  And how that's a predisposition.
[48:36.690 --> 48:38.770]  Does that suggest a predisposition to committing a crime?
[48:39.210 --> 48:40.450]  I don't really see that.
[48:40.510 --> 48:43.050]  And look how far away, 300 feet, that they can pick this up.
[48:43.830 --> 48:45.090]  Digestible RFID tags.
[48:45.090 --> 48:46.210]  Well, I was reading...
[48:46.210 --> 48:48.230]  I guess Kodak's diversifying.
[48:48.650 --> 48:53.870]  When I would think about digestible things, I wouldn't think about Kodak, first of all.
[48:53.990 --> 48:55.350]  But they say that these are fragile.
[48:55.450 --> 48:59.490]  And I can see how there could be really great medical purposes for this.
[49:00.170 --> 49:05.130]  But I could also see how if you're on probation, you're not supposed to drink any alcohol or do drugs.
[49:05.330 --> 49:09.390]  You have to sit by a reader, swallow something, and this thing dissolves in your stomach.
[49:09.390 --> 49:13.810]  And it can say what type of drug is in your body and how long it's been there.
[49:14.510 --> 49:18.530]  So I kind of consider that to be like a pre-crime type of device.
[49:19.190 --> 49:19.590]  So...
[49:20.150 --> 49:23.690]  But there are good applications in medical research for this.
[49:24.190 --> 49:25.470]  Personal RFID security.
[49:25.670 --> 49:26.730]  I'm going to go through this quickly.
[49:27.050 --> 49:29.370]  If you're interested in a jammer, just be careful.
[49:29.510 --> 49:32.270]  What I don't know about this technology I'm going to tell you about is how it jams.
[49:32.430 --> 49:33.350]  It's a different...
[49:33.350 --> 49:35.150]  The FCC has some requirements.
[49:35.350 --> 49:36.030]  You can't just...
[49:36.030 --> 49:37.090]  There are different ways of jamming.
[49:37.550 --> 49:41.290]  There is something that you can carry that will jam your RFID devices.
[49:42.210 --> 49:43.190]  It's called the Guardian.
[49:43.650 --> 49:43.950]  Okay.
[49:44.030 --> 49:45.070]  This is a little bit about that.
[49:45.170 --> 49:46.270]  And let me show you a picture of it.
[49:46.290 --> 49:49.650]  And if you're interested in reading more about this, email this professor.
[49:49.650 --> 49:51.230]  She's a computer science professor.
[49:51.530 --> 49:54.890]  I emailed her a couple of times and said, my department would like to test out one of these things.
[49:54.990 --> 49:55.910]  And I didn't hear back from her.
[49:55.990 --> 49:57.790]  And I think it's because I'm in the U.S.
[49:58.190 --> 50:04.510]  Those of you that are in Europe, you might be able to get a free or cheap one for her for research purposes to test it out.
[50:04.510 --> 50:07.470]  And there is the URL if you're interested in that.
[50:08.270 --> 50:09.310]  The Real ID Act.
[50:09.430 --> 50:09.570]  Okay.
[50:09.710 --> 50:11.190]  I have some time to talk about this.
[50:11.330 --> 50:13.430]  It passed in 2005 unanimously.
[50:14.150 --> 50:16.690]  And there was limited debate, unfortunately.
[50:16.690 --> 50:23.910]  It was part of a bunch of bills that if you were a Senator or Congressman said, I didn't want to go with this, you'd look pretty bad to your constituents.
[50:24.830 --> 50:31.550]  It would be required when you drive a car, board a plane, get on a bus, or if you go into a post office.
[50:31.830 --> 50:32.950]  I live in the state of Maine.
[50:33.170 --> 50:43.990]  That was one of the states that said, and New Hampshire, one of four states that said, we are not going to pass the RFID, or we're going to actually pass legislation saying we'll never have the RFID for the Real ID Act.
[50:44.390 --> 50:47.190]  But unfortunately for Maine, when you read why, it's financial.
[50:48.450 --> 50:51.810]  Privacy is listed as a number two concern, but financial is number one.
[50:51.810 --> 50:59.110]  And this is from a state also where Senator Susan Collins just proposed one of the first thought crimes bill, which is worrisome to me.
[50:59.470 --> 51:05.970]  She's really involved with Homeland Security Department, but I feel like she may be a little bit misguided with some of her concerns about the homegrown terrorism.
[51:07.150 --> 51:15.010]  So what the federal government said to people in Maine is, sure, if you go through Portland's airport in Maine, you're going to have to go through supplemental screening.
[51:15.270 --> 51:17.030]  And I want to tell you something briefly about this.
[51:17.150 --> 51:20.710]  If you're flying domestically, you do not have to.
[51:20.710 --> 51:23.030]  Okay, it is not required by U.S.
[51:23.130 --> 51:24.650]  law that you have to carry an ID.
[51:25.110 --> 51:30.130]  TSA wants you to have one, and when you check bags, you have a contract with your airline carrier.
[51:30.410 --> 51:32.250]  They may require you to have ID.
[51:32.550 --> 51:36.450]  But if you go up to TSA and say, hey, I don't have my ID with me.
[51:36.630 --> 51:38.510]  Can you just check me?
[51:38.750 --> 51:41.150]  What they'll do is they'll pat you down, do extra screening.
[51:41.150 --> 51:44.390]  They're okay with that, except about three weeks ago.
[51:44.950 --> 51:53.930]  They said that they can, if you don't have ID, they can deny you passing through security for reasons that are not known and not published.
[51:54.350 --> 51:57.090]  It's part of whatever screening that they use.
[51:57.490 --> 51:59.810]  And we've tested this.
[52:00.530 --> 52:01.870]  This was in December.
[52:02.390 --> 52:11.230]  You walk into perhaps a gas station, buy one of those credit cards, put $250 on it, immediately go to your car, log online, buy an airline ticket.
[52:12.310 --> 52:14.110]  Perhaps you're traveling under a pseudonym.
[52:14.290 --> 52:17.590]  It's John Doe, because maybe you don't want to get served or whatever state you go to.
[52:17.810 --> 52:21.270]  For whatever reason, you can travel under pseudonyms, as long as it's domestic.
[52:21.270 --> 52:23.750]  I mean, we live in a union.
[52:24.170 --> 52:28.350]  We're not traveling over country borders when we pass between, like, Maine and New Hampshire and Vermont.
[52:29.210 --> 52:31.230]  And John Doe got on...
[52:31.230 --> 52:32.070]  Actually, he didn't use Joe.
[52:32.170 --> 52:33.630]  I think it was Jay Smith who traveled.
[52:33.850 --> 52:40.890]  He got on plan in Portland, got off in Baltimore-Washington Airport, went through supplemental screening, did not have ID, and he traveled that way.
[52:40.990 --> 52:42.110]  And there was no problem.
[52:42.230 --> 52:44.610]  And he just wanted to remain anonymous.
[52:45.070 --> 52:50.050]  He was not a threat, but there was just no reason for him to be required to carry that.
[52:50.050 --> 52:56.710]  But the government tell people in Maine, you're all going to have to go through supplemental screening if you don't have one of these Real ID Act driver's licenses.
[52:57.170 --> 53:04.290]  Better idea, maybe an RFID card that you actually have to make contact with something, instead of it being scanned.
[53:04.470 --> 53:10.310]  I know the TSA thinks it would be great to go through security and just be scanned that way.
[53:10.430 --> 53:13.690]  Easier for them, but maybe you don't want to travel that way.
[53:14.530 --> 53:16.270]  Some states have an opt-in provision.
[53:17.650 --> 53:25.410]  Skimming of others' RFID in Washington State just passed one of the first laws that says it's a crime to skim others' RFID cards remotely.
[53:25.830 --> 53:29.350]  But it says here for the purposes of fraud, identity theft, or some other illegal purpose.
[53:30.130 --> 53:32.250]  Traveling, by the way, under a pseudonym is not fraud.
[53:32.610 --> 53:34.890]  There's no monetary theft going on.
[53:35.150 --> 53:37.690]  So I just wanted to mention that with...
[53:38.290 --> 53:43.210]  As with this bill, if you do skim someone's RFID card, it's ten years.
[53:43.410 --> 53:46.630]  If you use it for criminal purposes, they'll add on to...
[53:47.490 --> 53:49.810]  They'll add on to that for your jail time.
[53:50.610 --> 53:53.330]  Okay, the last two slides is RFID usage in the UK.
[53:54.110 --> 53:59.890]  Police requests for information for London's RFID best transit cards went way up last year.
[54:00.450 --> 54:03.390]  And pair that with the information they get from all those cameras in the UK.
[54:03.390 --> 54:07.590]  They may be able to find out who you are, just not your number on your transit card.
[54:08.270 --> 54:10.430]  And I like the RFID tracking at HOPE.
[54:10.950 --> 54:12.810]  This was a lot of fun playing this game.
[54:13.390 --> 54:14.490]  It was voluntary.
[54:14.770 --> 54:17.610]  You could take the...you know, give it to someone else if you didn't want it.
[54:17.690 --> 54:20.230]  You could alter...you could set your preferences once.
[54:20.230 --> 54:22.130]  I had a theory about why they did that.
[54:22.250 --> 54:27.810]  But I...this is an interesting way to use RFID, this way.
[54:28.910 --> 54:35.150]  This is one of the ways that I worry about RFID technology could be used, is the cards in China that they have right now.
[54:35.290 --> 54:39.030]  The government is installing RFID readers throughout this big, huge city in China.
[54:39.650 --> 54:42.130]  And it's going to be tracking the movements of citizens.
[54:42.450 --> 54:44.850]  And U.S. companies are helping deploy this technology.
[54:44.850 --> 54:50.950]  But they track your work history, education, religion, ethnicity, police record, and your reproductive history.
[54:51.250 --> 54:54.170]  This is a type of information I don't want to see go on our cards.
[54:54.310 --> 54:59.370]  If it does, I at least want to be able to find out what information is on my card about me.
[55:00.910 --> 55:02.770]  So...all right, that ends my talk right now.
[55:03.030 --> 55:05.110]  And do I have any time for questions?
[55:05.330 --> 55:05.990]  No, I don't.
[55:06.110 --> 55:06.490]  Okay.
[55:07.310 --> 55:08.950]  I'll be around the conference.
[55:08.950 --> 55:10.470]  I'm going to Mitnick's talk later.
[55:10.690 --> 55:11.890]  So I will...I'll see you later.
[55:11.990 --> 55:12.270]  Thank you.
[55:12.270 --> 55:12.350]  Thank you.