[00:01.310 --> 00:06.570]  ...fitting because the comments that were submitted to the FCC were submitted as express comments.
[00:06.910 --> 00:10.230]  So without further ado, what does this talk about?
[00:10.490 --> 00:24.610]  In 2017, there were 22 million comments posted to the FCC's website in response to the proposed rulemaking for restoring Internet freedom, which would have reversed net neutrality, and we'll get more into the definitions and net neutrality nuances soon.
[00:25.270 --> 00:28.190]  18 million of those were later confirmed to be fake.
[00:28.190 --> 00:34.970]  8.5 million of those involved real names, stolen identities, unwillingly posted, including people who had been deceased.
[00:36.350 --> 00:39.070]  TLDR, I asked the government for data behind the bulk submissions.
[00:39.470 --> 00:45.710]  I sued the government for this data, and then I built a website called yourfakecomment.com with the data to show...
[00:45.710 --> 00:53.490]  So not only could you look up was a fake comment posted in your name, you could see who posted it, who stole the data, and on behalf of who.
[00:53.650 --> 00:54.850]  So we'll get into that shortly.
[00:56.110 --> 01:00.410]  Yeah, so we're going to give a net neutrality 101 and current status in the U.S.
[01:01.130 --> 01:06.870]  These are some slides I actually prepared at the very last second this morning as the only net neutrality talk.
[01:07.010 --> 01:14.430]  As far as I'm aware of at HOPE this year, I think we need to spend some time talking about what the current legal status is, because frankly, it is not encouraging.
[01:15.450 --> 01:21.150]  We're going to run through some, like, relevant history of the FCC and net neutrality.
[01:21.410 --> 01:27.610]  We're going to talk about my lawsuit, Jason Prechtel versus Federal Communications Commission, and later General Services Administration.
[01:28.330 --> 01:32.770]  I'm going to talk about how I matched the data and made yourfakecomment.com.
[01:32.910 --> 01:34.210]  And if we have time, lessons.
[01:34.810 --> 01:37.790]  We're running nine minutes behind, so I'll try to fly through this.
[01:37.790 --> 01:40.190]  So, some relevant anniversaries.
[01:40.450 --> 01:53.690]  It is the 90th anniversary of the Communications Act of 1934, and the arbitrary divisions of that 90-year-old act are still play out to this day and determine the scope of telecom policy.
[01:53.970 --> 01:58.270]  It particularly pertains to Internet, which was clearly invented after the Great Depression.
[01:59.190 --> 02:02.730]  July 4th is the anniversary, 50th anniversary of the Freedom of Information Act.
[02:03.530 --> 02:09.190]  This talk is going to be getting into intermediate and advanced Freedom of Information Act strategies.
[02:09.350 --> 02:12.650]  I think it's followable, but there are multiple workshops today on FOIA.
[02:12.730 --> 02:14.550]  I would highly recommend you attend them.
[02:14.790 --> 02:19.990]  In fact, I got this t-shirt at HOPE six years ago for governmentattic.org.
[02:20.590 --> 02:21.410]  I believe it's .org.
[02:22.030 --> 02:32.090]  Yeah, governmentattic.org, a fantastic resource for government documents, stuff that's been obtained through FOIA, predates MuckRock, predates maybe some other sites you know.
[02:32.850 --> 02:38.090]  But I got this at a FOIA presentation six years ago, so at HOPE, so I figured it was fitting.
[02:38.230 --> 02:38.670]  Give it a plug.
[02:39.050 --> 02:52.990]  And finally, by sheer coincidence, today is the seventh anniversary of the Day of Action to Save Net Neutrality, where pro-net neutrality groups rallied to post comments against restoring Internet freedom.
[02:53.290 --> 02:56.790]  And we will look at some of the data behind that later on.
[02:56.790 --> 02:58.410]  What is net neutrality?
[02:58.690 --> 03:08.010]  I don't care if you feel like you know, we need to at least talk terminology in order to delve into the legal back and forth and the rhetoric behind the anti-net neutrality comments that were posted.
[03:08.950 --> 03:15.250]  Yeah, all Internet treated equally by Internet service providers, regardless of content, access methods, source address, destination address.
[03:16.210 --> 03:19.270]  ISPs can't throttle, speed up, slow down, prioritize.
[03:19.650 --> 03:23.970]  So basically, treating Internet as a public good, utility like water.
[03:24.610 --> 03:31.790]  And it was coined by Tim Wu in 2003 as the term network neutrality, which has since been shortened.
[03:33.010 --> 03:38.870]  So as I alluded to earlier, I want to start off talking about the current state of net neutrality in the United States.
[03:39.590 --> 03:50.930]  Due to recent rulemaking, net neutrality was on the verge of being re-implemented where broadband being regulated under Title II, which we'll explain that in a bit.
[03:51.810 --> 03:56.210]  As of July 22nd, lobbyists and trade groups sued.
[03:56.210 --> 03:59.890]  Those lawsuits got compiled.
[04:00.330 --> 04:05.250]  The way the appeals court circuit works is a circuit court is randomly assigned.
[04:05.570 --> 04:11.070]  This combined suit got assigned to the sixth appeal court, which is notoriously comparatively conservative.
[04:12.330 --> 04:25.750]  And as of yesterday, a panel of three circuit judges put rules in place pausing the July 22nd implementation until August 5th, quote, to provide sufficient opportunity to consider the merits of this legal challenge.
[04:26.190 --> 04:27.910]  And this is what they want.
[04:28.130 --> 04:44.390]  So, what's interesting is what they... part of the pause is they want both sides, both the FCC and the plaintiffs, to consider the rulings and arguments made in National Cable and Telecommunications Association versus Brand X.
[04:44.650 --> 04:50.290]  And that was basically ruled that FCC could use regulator based on the Sheffron deference.
[04:50.290 --> 05:07.610]  You may recall in the recent news cycle that the Supreme Court recently overturned that precedence, which basically allowed administrative agencies to independently rule in, make calls, and rulemaking with the law was somewhat ambiguous under the presumption that they had the subject level expertise.
[05:10.050 --> 05:11.370]  That's been overruled.
[05:11.370 --> 05:30.570]  It's worth noting that the FCC, and maybe perhaps in anticipation to this, filed a supplementary briefing after this ruling, stating that the current net neutrality rules that they want to have implemented on July 22nd are not reliant on Chevron, and should we be relying on the 1934 Act that we will
[05:30.570 --> 05:32.750]  talk about very shortly?
[05:32.750 --> 05:40.170]  And it's also worth mentioning a previous ruling by Justice Brett Kavanaugh when he was on the D.C.
[05:40.290 --> 05:48.550]  Circuit courts, that he, in a dissent, wrote that he thought that net neutrality was a major rule that lacked authorization in his statute.
[05:48.750 --> 05:53.870]  And more importantly, net neutrality is a violation of Internet service providers' First Amendment rights.
[05:55.590 --> 05:57.270]  And it gets even better.
[05:57.630 --> 06:06.450]  You may have heard a lot about Project 2025, a conservative plan that should Trump or whoever ends up being the next Republican president.
[06:08.470 --> 06:23.850]  Basically, the plan to gut the administrative state independent agency rulemaking so that the president has more direct oversight of all these agencies, will dismantle agencies, revamp, you know, basically give private entities free reign in various respects.
[06:23.850 --> 06:29.310]  It's worth noting that Republican FCC Chair Brendan Carr wrote...
[06:29.310 --> 06:32.170]  There is, like, a Mandate for Leadership is the name of the book.
[06:32.190 --> 06:33.590]  You can find the PDF online.
[06:34.190 --> 06:38.310]  The chapter on the FCC is written by Republican Chair Brendan Carr.
[06:38.570 --> 06:54.790]  And it's basically gonna, like, shift focus to regulating against, you know, big tech rather than reeling in, like, telecoms and, quote, The FCC has addressed, quote, unquote, net neutrality rules in the regulatory framework that should apply to broad rent offerings.
[06:55.330 --> 07:02.290]  He will probably be the next FCC Chair should Trump or a Republican end up in the White House in 2025.
[07:03.570 --> 07:05.750]  So, let's travel back in time, 90 years.
[07:06.990 --> 07:10.470]  Basically, the 1934 Communications Act.
[07:10.890 --> 07:12.450]  Two types of media providers.
[07:12.690 --> 07:21.970]  There's what's called Title I, an information service, and Title II, a telecommunication service under common carrier laws, which goes back to ancient Rome.
[07:22.090 --> 07:35.850]  The idea that some services are so vital that they should not be allowed necessarily to pick and choose their customers and, you know, should be incentivized to, you know, be a common carrier, you know, like, telephone, fright, train, you know, train lines, you know, having run in the United States on public land.
[07:40.350 --> 07:51.610]  And we need to, you know, establish the baseline, Title I, Title II, because that's where all the legal tug-of-war that follows, including the talking points in the fake comments and the real comments come into play.
[07:54.950 --> 07:57.890]  Yeah, so basically, this is like a tug-of-war, you know, back and forth.
[07:57.890 --> 08:12.010]  The long story short with this is the FCC, when they were trying to regulate broadband under other premises than having Internet under Title II, it got overturned by courts.
[08:12.410 --> 08:23.570]  And so that's what led to the Open Internet Act 2015 to formally place broadband as a telecommunication service under Title II as a common carrier.
[08:24.150 --> 08:27.390]  And, you know, we probably all know the story.
[08:27.570 --> 08:30.610]  John Oliver did a story about it.
[08:30.750 --> 08:35.950]  It became extremely popular, viral, tons of comments posted to the FCC's website in support of it.
[08:36.170 --> 08:45.630]  And then FCC Chairman Tom Wheeler, who was expected to be against this order, actually, in response, voted in favor for it.
[08:45.630 --> 08:51.410]  And so in a 3-2 vote, Open Internet Act passed.
[08:51.970 --> 08:53.130]  So let's back up a second.
[08:53.270 --> 08:54.820]  What are FCC comments?
[08:55.350 --> 08:56.870]  Well, we were even tossing that phrase along.
[08:57.090 --> 09:07.250]  So as a agency that regulates telecom, whenever they have a new rule they want to propose, they place it online and people can make comment on it.
[09:07.250 --> 09:11.270]  They can submit written comments and usually these days submit digital comments.
[09:13.010 --> 09:16.830]  And this is, yeah, there's the electronic comment filing system.
[09:17.630 --> 09:23.370]  And usually, you know, there's not many people coming on these, like, relatively, you know, technical proceedings.
[09:23.370 --> 09:25.010]  It's usually industry insiders.
[09:25.530 --> 09:31.090]  You know, the recent net neutrality comments of 2015, 2017 being a major exception.
[09:31.090 --> 09:36.550]  So just for visual context, you go to FCC.gov slash ECFS.
[09:36.870 --> 09:38.070]  This is what you're going to get.
[09:38.210 --> 09:41.890]  You can, you know, search accordingly by parameters.
[09:42.250 --> 09:44.330]  I typed in my last name for kicks.
[09:44.550 --> 09:51.090]  And one thing I will point out is you'll see a number of proceedings with the number 17-108.
[09:51.810 --> 09:57.870]  That was the proceeding for restoring Internet freedom, which are the proceeding comments we'll be talking about.
[09:57.870 --> 10:04.730]  And when you click on one of these comments, this is what you'll see as of this week.
[10:04.850 --> 10:08.030]  It's worth noting that seven years ago, this included more information.
[10:08.030 --> 10:12.710]  It actually listed the person's address, city, and ZIP Code.
[10:12.770 --> 10:17.970]  And I think for various reasons related to the scandal we're talking about, that information is no longer public.
[10:18.370 --> 10:20.710]  But you can access it.
[10:21.190 --> 10:23.410]  So this is the forward-facing data.
[10:23.410 --> 10:26.550]  Of course, we all know how websites work.
[10:26.550 --> 10:28.970]  All these comment data needs to be saved as data.
[10:29.590 --> 10:37.570]  So as it turns out, all the FCC comments on the ECFS are saved as JavaScript object notation files, JSON files.
[10:37.750 --> 10:39.070]  And I'm going to show you an example now.
[10:40.330 --> 10:43.210]  I promise this is not entirely going to be PowerPoint.
[10:43.470 --> 10:44.270]  I'm going to be showing examples.
[10:44.410 --> 10:46.550]  This is a sneak preview of data I'll talk about later.
[10:47.730 --> 10:50.450]  So this is an example of...
[10:51.010 --> 10:52.990]  So as you can see, there's a lot of parameters.
[10:53.630 --> 10:57.610]  There's, you know, timestamps, contact email, confirmation number.
[10:57.770 --> 11:01.190]  Each of the comments has an individual number.
[11:01.710 --> 11:03.190]  Or no, it's the ID submission.
[11:03.210 --> 11:06.030]  As you can see, a lot.
[11:06.250 --> 11:12.450]  And this is, you know, this is a batch of comments that were posted on, you know, the day of action.
[11:13.250 --> 11:20.530]  So a lot of these are the fake pro net neutrality comments posted under fake Pornhub email addresses.
[11:22.750 --> 11:24.270]  And so yeah, just so common.
[11:24.370 --> 11:33.510]  So this is the front end, this is the back end, because, you know, we're going to get into the nitty gritty about asking the government for their data and the legal arguments as to how to get that data.
[11:34.790 --> 11:39.050]  So back to our regularly scheduled program.
[11:39.790 --> 11:43.910]  All right, so restoring Internet freedom, the crux of what we're going to talk about today.
[11:45.650 --> 11:50.310]  Yeah, I mean, Ajit Pai will be forever associated with his goofy Reese's mug.
[11:50.550 --> 11:54.290]  So it would be, you know, I'd be remiss to not include that.
[11:54.290 --> 11:58.050]  So basically, formally, you know, reverse the 20...
[12:00.190 --> 12:05.330]  And under Title I, at that point, under Trump, there was...
[12:05.330 --> 12:09.550]  Basically, I mean, the FCC has like a five-person commission.
[12:09.870 --> 12:18.310]  And it's usually, you know, generally two, three, depending on, you know, Democrat appointees, Republican appointees, depending on who's in office.
[12:18.310 --> 12:24.970]  Under Trump, obviously, it was Ajit Pai, Brendan Carr, who we'll talk about later on, and Mike Powell.
[12:25.350 --> 12:29.010]  And so that passed in December 14th.
[12:29.290 --> 12:32.310]  So there were three ways to post comments online.
[12:32.590 --> 12:33.730]  And this is also...
[12:33.730 --> 12:37.810]  So you could post a single comment online in the screenshots that I just showed you.
[12:38.150 --> 12:43.870]  There was a widget at the time on the FCC's website where you could upload to box.com.
[12:43.870 --> 12:48.390]  Basically, just a CSV file formatted with name, address, the comments.
[12:48.810 --> 12:52.190]  And that got converted, obviously, in the JSON we're talking about.
[12:52.370 --> 13:00.230]  And then you could use an API key from api.data.gov and send post requests of formatted data.
[13:00.810 --> 13:09.110]  And if you want to see how the api.data.gov, the infrastructure, and spin up your own version of it in Ubuntu, you know, have at it.
[13:09.110 --> 13:12.150]  API-Umbrella is on GitHub.
[13:12.850 --> 13:22.710]  But crucially, the api.data.gov, since it's meant as an internal API system across the entire government, it is overseen by the General Services Administration.
[13:23.610 --> 13:25.590]  That distinction will play out very shortly.
[13:26.530 --> 13:42.190]  So I think we all know the story, more comments, news stories about fake comments, stories finding that certain fake comments were being posted on their information that seemed to match a leak of RCN's customer data, news stories about famous fake comments,
[13:42.970 --> 13:48.510]  multiple comments under actress Patty Duke who had passed away, multiple senators.
[13:49.030 --> 13:51.450]  So it was a big deal at the time.
[13:51.550 --> 13:56.390]  And here's like a sample of the headlines, you know, surrogate early 2017.
[13:59.270 --> 14:01.730]  And so what do these fake comments say?
[14:01.910 --> 14:04.990]  And I'm going to pull up a website real quick.
[14:05.110 --> 14:24.030]  But the themes are, like, Obama, big tech overreach, leftist billionaires, Soros behind it, overregulation, but also hammering into themes that, frankly, the telecom lawyers had been, you know, been reiterating for, like, the entirety of this debate over regulation of the Internet and how to
[14:24.030 --> 14:40.650]  classify and whether the FCC should, that regulating under Title II was overregulation and was going to stifle innovation and stifle investments and variations of those arguments with various rhetoric and, you know, allegedly hindering choice for Americans.
[14:41.310 --> 14:47.830]  And just, you know, since we're talking about the comments, this is from a Pew Internet research study.
[14:48.070 --> 14:56.870]  You know, so in 2015, Chairman Tom Wheeler's federal communications imposed restrictive Title II utility-style regulations under the guise of an open Internet.
[14:57.170 --> 14:58.270]  Not only are these...
[14:58.990 --> 15:02.070]  I mean, these are all kind of redundant, but, you know...
[15:02.070 --> 15:12.130]  I mean, this was the one the unprecedented regulatory power of the Obama administration imposed on the Internet, smothering innovation, damaging the American economy, and obstructing job creation.
[15:12.810 --> 15:21.790]  That was the common thread that initially picked up that was associated with the hacked data that I talked about earlier.
[15:26.260 --> 15:27.680]  And I just want to...
[15:27.680 --> 15:28.240]  There are like a...
[15:28.240 --> 15:34.560]  We can skip over, but there were a number of early investigations that picked up on different hints of who was responsible for stuff.
[15:34.660 --> 15:38.200]  And I plug these because they ended up being right.
[15:38.500 --> 15:42.220]  You know, everyone and their grandmother was trying to analyze the comments at the time.
[15:43.360 --> 15:49.320]  Yeah, found forms from the Center of Individual Freedom, Taxpayers Protection Alliance, Freer Internets, which we'll see later.
[15:50.300 --> 15:54.420]  Jeff Kao studied a bunch of comments that looked like they were bot-generated, sort of ad-lib style.
[15:56.060 --> 16:01.740]  And somebody also found a bunch of anti-net neutrality comment batches posted in alphabetical order.
[16:03.180 --> 16:04.360]  Stay tuned for that.
[16:05.960 --> 16:13.500]  I already went over this, but one thing that will factor into, like, how I match the data is that there were, like, three different timestamps involved.
[16:13.860 --> 16:15.600]  And we'll get into that later.
[16:16.120 --> 16:23.500]  So, at the time, I was reading the news cycle, and I thought to myself, okay, I'm seeing a lot talked about in alleged API.
[16:23.680 --> 16:26.060]  I see people talk about fake comments this, fake comments that.
[16:27.200 --> 16:33.760]  I didn't see anyone in the news media at the time talking about, oh, the box.com submissions, the API submissions.
[16:34.080 --> 16:36.880]  So I thought, let's make a Freedom of Information Act request.
[16:36.880 --> 16:41.880]  So, basically, you know, I filed this on June 4th, 2017.
[16:42.380 --> 16:53.980]  So, part of it was I asked for all the API keys and email addresses that were used to submit comments via the API and logs and times that they were used.
[16:54.580 --> 17:01.140]  I also asked for email addresses associated with all the CSV comment uploads and logs and times of that.
[17:01.140 --> 17:09.400]  And then all emails to the electronic comment filing system at FCC.gov regarding CSV comment submissions.
[17:11.940 --> 17:18.080]  Remember when I said earlier that the GSA technically ran API.gov, the data.gov?
[17:18.420 --> 17:27.380]  Well, I made the same portion of the relevant FOIA request to them because it was unclear at the time, okay, who has jurisdiction over this particular data?
[17:28.120 --> 17:34.260]  And in case both of them said no to me, point to the other one, I can, like, catch them both in a web of lies and contradictions.
[17:34.760 --> 17:35.800]  Stay tuned for that.
[17:37.500 --> 17:55.760]  But basically, I, like, went back and forth with the GSA over email, and they explained to me that it was their opinion that because FCC's IT team did have access to the data.gov servers and logs, that those records should belong to them rather than belonging to the GSA.
[17:58.080 --> 18:02.880]  So, on June 14th, FCC advised that they would extend my deadline to respond to my request.
[18:03.520 --> 18:04.680]  I followed up.
[18:04.780 --> 18:13.020]  To make a very long story short, I had a prior relationship with the FOIA attorney, Matt Topic, of Lovie & Lovie, does a lot of great FOIA work.
[18:14.340 --> 18:23.360]  I had worked with them in a lawsuit in Chicago against the Chicago Transit Authority regarding the Ventra payment system and bids related to that.
[18:23.500 --> 18:24.960]  So, I had this prior working relationship.
[18:24.960 --> 18:27.060]  I told them, hey, I'm working on this.
[18:27.060 --> 18:27.860]  Are you interested?
[18:28.240 --> 18:38.620]  And the way FOIA litigation works often is, like, if you win the lawsuit, the agency has to pay court fees and, you know, that ended up being the payment to my attorney.
[18:38.620 --> 18:45.880]  So, I'm not trying to yada yada this, but it's, you know, starting 10 minutes late and it's 1030.
[18:46.060 --> 18:48.460]  So, I'll try to be as concise as I can.
[18:50.000 --> 18:56.500]  But basically, we said that FCC had violated FOIA by not responding in a timely manner.
[18:58.160 --> 18:59.840]  And on September...
[18:59.840 --> 19:03.980]  So, I can, you know, real quick show, like, what these court documents look like.
[19:08.860 --> 19:12.620]  So, yeah, I mean, this is the complaint, you know.
[19:12.820 --> 19:15.140]  And then we initially just sued the FCC.
[19:16.480 --> 19:21.600]  And we had cited in the argument that GSA said that the API keys...
[19:21.600 --> 19:22.860]  Oh, no, we didn't.
[19:22.940 --> 19:23.680]  Sorry, I'm skipping ahead.
[19:23.740 --> 19:26.920]  We had just asked FCC for the API keys.
[19:27.000 --> 19:28.560]  We didn't mention the GSA sued at all.
[19:28.560 --> 19:33.420]  So, then, FCC responds.
[19:35.920 --> 19:39.080]  And, you know, these are the arguments.
[19:39.340 --> 19:44.140]  So, fundamentally, they claimed that they conducted an adequate search in response to my records.
[19:44.680 --> 19:47.220]  And that they properly withheld records.
[19:47.580 --> 19:49.000]  Okay, sorry, I'm getting ahead of myself.
[19:49.000 --> 19:52.900]  Because after I filed the suit, they did send me a little bit of data.
[19:53.380 --> 19:54.780]  Or they didn't send me data.
[19:54.940 --> 19:56.220]  They argued against giving me the logs.
[19:56.360 --> 19:58.900]  But they did send me an email chain.
[20:00.420 --> 20:03.400]  And these were emails to the FCC.
[20:04.120 --> 20:06.260]  And I want to read some portions of them.
[20:07.480 --> 20:13.320]  Hi, we are working on a campaign for one of our customers that might have us submitting millions of individual comments to a forthcoming proceeding.
[20:13.540 --> 20:15.920]  We don't want to create any technical problems in your environment.
[20:15.920 --> 20:17.660]  Where can I find the API limitations?
[20:17.940 --> 20:19.060]  Web form limitations.
[20:19.420 --> 20:21.620]  Or would you prefer to receive a CSV file?
[20:25.460 --> 20:27.360]  Yeah, thanks for the fast response.
[20:27.600 --> 20:29.320]  The docket will be on Internet privacy.
[20:29.320 --> 20:30.620]  It is not yet published.
[20:30.840 --> 20:32.740]  Note, this is April 18, 2017.
[20:32.740 --> 20:36.000]  This is before Restoring Internet Freedom is announced.
[20:37.040 --> 20:39.220]  And this is from a company called CQ Roll Call.
[20:39.360 --> 20:42.980]  They're known mainly in D.C. as, like, the D.C. insider news source.
[20:43.180 --> 20:48.980]  But, you know, like Politico, like The Hill, you know, the bread and butter is in, like, private government work.
[20:48.980 --> 20:59.100]  And as you can see from this email, they're used to, like, posting comments and regulations on regulations.gov, which is another way to post comments of various proceedings.
[21:01.660 --> 21:03.700]  And, you know, this is, like, back and forth.
[21:06.480 --> 21:09.320]  Don't want to spend too much time, but I appreciate your flexibility to the CSV file.
[21:09.420 --> 21:10.540]  How can I confirm that it's possible?
[21:10.720 --> 21:15.760]  I am looking to deliver about 25, like, 250,000 comments per day.
[21:15.760 --> 21:19.060]  I would need to ensure that each comment is recorded individually, not in bulk.
[21:19.180 --> 21:20.200]  Can you confirm that as well?
[21:21.340 --> 21:30.820]  So, just to be clear, in between the FCC responding formally to my lawsuit in the court, and me finding the lawsuit, this was the one thing they gave me.
[21:31.120 --> 21:39.040]  And in their response letter, they rejected, like, basically the CSV logs and API key logs under various exemptions under the Freedom of Information Act.
[21:39.600 --> 21:40.480]  And so,
[21:44.360 --> 21:47.760]  and then we replied back.
[21:50.880 --> 21:51.920]  Okay, yeah, yeah.
[21:52.160 --> 21:56.280]  So, this was, yeah, they sent me the email on September 2nd.
[21:56.460 --> 22:00.180]  And then I got a formal response on February 16, 2018.
[22:00.680 --> 22:05.920]  So, in this case, the Department of Justice was representing the FCC directly.
[22:06.180 --> 22:08.280]  I mean, all the agencies have their own legal counsel.
[22:08.780 --> 22:20.680]  So, they moved for summary judgment, which basically is like having, instead of me going physically, or my attorney physically going to trial, you know, you send your arguments, everybody sends their arguments to the judge, and then they rule accordingly.
[22:21.320 --> 22:30.180]  I would like it to having, like, a very formal third-person argument with a pen pal, but instead of sending it to the post office, you're sending it to a federal judge.
[22:31.160 --> 22:36.080]  And then, you know, the DOJ argued that, yeah, they argued for the exemptions.
[22:36.080 --> 22:36.880]  And they, yeah.
[22:37.160 --> 22:48.220]  And crucially, they claimed that the GSA, not FCC, had the API key info, and that FCC's system was not linked directly to data.gov.
[22:50.800 --> 22:59.820]  So, in response, we asked for partial summary judgment, which means we wanted a ruling on the box, CSV, and email issues.
[23:00.300 --> 23:07.420]  And then we disputed, you know, we disputed their claims that what I was asking for was exempt, as far as, like, the box CSV submissions.
[23:08.000 --> 23:15.160]  But then we pointed out that GSA told us that FCC not only had access to the API logs, but they should be considered to the info.
[23:15.380 --> 23:20.100]  See what I mean about filing both at the same time and seeing who contradicts each other.
[23:20.980 --> 23:27.500]  You know, FYI, if you ever end up in a FOIA investigation where the jurisdiction of the data may not...
[23:27.500 --> 23:29.680]  is a little bit blurry, plan ahead.
[23:31.500 --> 23:37.780]  And then we filed an amended complaint where we added the GSA as a party.
[23:38.480 --> 23:43.580]  So, you can see that, you know, in underlined, everything's added.
[23:43.880 --> 23:49.060]  So, now it's Jason Prechtel versus Federal Communications Commission, General Services Administration.
[23:49.660 --> 23:52.380]  And, you know, we added portions.
[23:52.840 --> 23:57.800]  You know, it was like the original, like, file complaint, but everything related to the GSA we added here.
[23:59.740 --> 24:04.660]  So, this is where GOing to HOPE, six years ago, makes an appearance.
[24:04.740 --> 24:14.100]  One of the arguments we made against the GSA, because they kept arguing that a lot of the data we were asking for was not segregable from, like, their internal systems.
[24:14.100 --> 24:15.320]  It was too complicated.
[24:15.320 --> 24:25.440]  So, my friend, Freddie Martinez, who, you know, Lucy Parsons Labs, he has secrets, has spoken at HOPE several times in the past.
[24:25.860 --> 24:27.580]  He had worked as a server administration.
[24:27.600 --> 24:45.140]  So, he had written an affidavit for my lawsuit, asserting that the arguments that the FCC and DOJ were making about server logs were bunk, that the kind of information we were asking for was standard practice and easily segregable because, you know, a common ghost and, you know, those sort of things would be publicly known.
[24:48.680 --> 24:55.760]  And more importantly, that revealing this information would not be a road map to hackers as the argument that they were trying to present.
[25:00.260 --> 25:03.500]  So, we filed an amendment to include GSA.
[25:06.940 --> 25:13.780]  So, the FCC clarified that the data.gov only received data by the ECFS and they're not directly linked in wool.
[25:14.600 --> 25:16.980]  So, basically, it's, you know, it's a data pipeline.
[25:17.320 --> 25:22.180]  You know, the FCC, you know, the data gets sent via the API and then they still have to extract it into their system.
[25:23.960 --> 25:29.220]  Claimed that they could not clearly tell which ECF comment proceeding on a given API post went to.
[25:29.540 --> 25:41.220]  So, even if you saw the API key logs, you could not necessarily, obviously, direct that to a specifically posted comment because the comments all have numbers because they're two separate systems.
[25:41.600 --> 25:43.940]  And we'll get into that shortly.
[25:47.040 --> 25:47.680]  Yeah.
[25:47.680 --> 25:53.400]  So, September 13th, court partially rules in my favor.
[25:55.900 --> 26:09.520]  You know, some of the redactions and the emails that I got were maintained, but basically, I was given the box.com, not only the bulk files that were uploaded, but a list of who submitted each file.
[26:09.520 --> 26:16.680]  And the court noted that cited in the website was, note, you are filing a document into an official FCC proceeding.
[26:16.880 --> 26:21.700]  All information submitted, including names and addresses, will be publicly available via the web.
[26:22.520 --> 26:31.240]  And that the disclosure in public interest in the data related to groups that were posting the comments in bulk outweighed lingering privacy concerns.
[26:31.240 --> 26:41.540]  And then, I separately settled with the GSA to get server logs, and I ended up getting those server logs with some...
[26:41.540 --> 26:50.380]  So, the redactions in the server logs is the names of the users were redacted, the email addresses were redacted, and all but the first eight characters of the API keys were there.
[26:50.380 --> 26:52.060]  But, as you will see shortly,
[26:55.540 --> 26:55.660]  yeah.
[26:55.980 --> 26:57.680]  So, yeah, everything got settled.
[26:58.820 --> 27:00.160]  My attorney got paid.
[27:00.600 --> 27:04.180]  And technically, the FCC settled and said it was not an admission.
[27:06.760 --> 27:11.040]  Technically, I won partial summary judgment, lost partial summary judgment, and settled.
[27:12.000 --> 27:12.900]  Effectively, I won.
[27:14.220 --> 27:18.420]  I want to bring up a couple lawsuits, and if we have time, I want to go over data related to that.
[27:20.020 --> 27:38.680]  New York Times asked for IP addresses associated with comments because there were a bunch of emails posted with Russian websites, and journalist Kevin Collier, who's now with NBC News, also asked for info related to alleged DDoS attack after the John Oliver episode that kicked off that comment period.
[27:40.160 --> 27:41.920]  So, yeah, let's get into the bread of it.
[27:42.060 --> 27:49.560]  This is what the data looks like, and I'm going to pull up examples, but this is what the data.gov server logs look like.
[27:49.740 --> 27:55.600]  This is what the list of emails submitted via box looks like, and this is an example of a CSV file.
[27:55.860 --> 28:01.260]  Since I'm a cheapskate, I use OpenOffice, and this would be a lot more readable if I were actually using Microsoft Excel.
[28:01.960 --> 28:06.960]  But fundamentally, these are all in CSV comma-separated files.
[28:06.960 --> 28:11.220]  So, yeah, let's dive into it.
[28:11.720 --> 28:16.580]  So, sorry, I have too many file types up here.
[28:17.160 --> 28:17.280]  Okay.
[28:17.920 --> 28:19.860]  So, this is an example.
[28:19.860 --> 28:23.280]  So, on the net neutrality day of action.
[28:23.560 --> 28:29.080]  So, these are the timestamps, time, method host, user ID, user key, user email.
[28:29.080 --> 28:39.040]  So, but crucially, as you can see, you know, fightforthefuture.org, CQ Roll Call.
[28:39.440 --> 28:44.040]  There are keys from my fellow panelists, EFF, on here.
[28:44.600 --> 28:50.760]  So, crucially, though, there are two different sets of IP addresses in these logs.
[28:50.760 --> 29:07.900]  There's the IP address that the key was used at at the time, but then there's also the IP address that was used to register the key, which was often different and, like, played a role in determining who posted what.
[29:08.140 --> 29:16.660]  But then, you know, obviously, I mean, sorry, this is less than readable, but, you know, you could see, you know, yeah.
[29:17.120 --> 29:26.120]  The kind of computer that was used to submit the comment, like, probably standard log stuff to anyone here who's a system admin or familiar with this kind of thing, you know, down to the computer.
[29:28.940 --> 29:29.820]  So, sorry.
[29:33.550 --> 29:33.810]  All right.
[29:36.870 --> 29:40.490]  So, like I said, yeah.
[29:40.910 --> 29:45.870]  So, this is an example of like a CSV file that was uploaded via box.com.
[29:45.870 --> 29:58.990]  You can see all these comments were submitted with, like, you know, the person's name, the docket, their address, and, you know, some comment that was, we must file back the poorly conceived application title 2 in the open Internet.
[30:01.170 --> 30:02.230]  So, let's see.
[30:02.850 --> 30:04.410]  So, I got about 10 minutes.
[30:04.570 --> 30:06.290]  I do want to have some sort of Q&A.
[30:06.450 --> 30:10.550]  I haven't even barely gotten into what it is.
[30:10.610 --> 30:23.430]  I will say for when I made your fake comment real quick, I focused on the anti-net neutrality comments, in big part because there was never a news story about a pro-net neutrality fake comment being posted under a real person's name without their permission.
[30:24.070 --> 30:35.910]  A New York Turnover January report found that a 19-year-old student posted 7.7 million comments with fake names, and an unknown party posted fake comments with European, including the Russian, email URLs.
[30:37.770 --> 30:38.470]  All right.
[30:38.470 --> 30:41.630]  So, how did I identify who posted what comment?
[30:42.530 --> 30:57.830]  So, the one-on-batch of comments was posted by the former executive director of Project Veritas, and that was easy to identify because in the logs that showed his email address, you know, Shane at MediaBridge, and I even emailed him, and, you know, he made excuses,
[30:58.110 --> 31:02.870]  but like the generative ad-lib fake comments that were posted...
[31:03.890 --> 31:05.230]  Let's see if I can find a good example.
[31:06.030 --> 31:07.410]  You'll just have to take my word for that.
[31:08.650 --> 31:10.350]  So, identifying CQRollCall.
[31:10.590 --> 31:23.410]  Some of the email addresses had an at CQRollCall.com, but a lot of the API keys used were registered in the email addresses by, you know, people who work for CQRollCall or other URLs, but because they...
[31:24.110 --> 31:34.330]  all the API key requests were being posted from two different IP addresses, I was able to find all the CQRollCall submissions that were made through their offices.
[31:37.290 --> 31:39.690]  Oh yeah, and there's another fun email.
[31:39.850 --> 31:44.290]  Remember when I said earlier about the alphabetic posting of the CQRollCall emails?
[31:47.010 --> 31:48.950]  Here's another fun one worth reading.
[31:49.470 --> 31:50.630]  Because I actually...
[31:50.630 --> 32:01.710]  So, I made another FOIA request after I won against the FCC for the rest of the CSV data, and, you know, asking... asked for emails that I did not get earlier.
[32:03.970 --> 32:04.490]  And...
[32:04.490 --> 32:05.670]  I probably should have had this...
[32:05.670 --> 32:05.910]  Okay.
[32:07.630 --> 32:08.150]  Hi.
[32:08.270 --> 32:14.630]  Any idea why these filings are displaying as if an alpha order by first name when they should be displaying according to date posted?
[32:14.630 --> 32:18.890]  These are comments we collected and posted via the API, but they were not submitted in this order.
[32:19.130 --> 32:20.590]  Also from CQRollCall.
[32:20.750 --> 32:33.450]  And as you can see, the unprecedented regulatory power of the Obama administration comment, the first comment batch associated with the RCN data link, proof that CQRollCall was posting at least this particular batch of comments.
[32:35.130 --> 32:35.730]  Um...
[32:35.730 --> 32:36.510]  All right.
[32:36.730 --> 32:39.450]  I got about seven minutes, technically, so...
[32:40.830 --> 32:41.730]  And then...
[32:42.030 --> 32:50.630]  So, there were another batch of comments uploaded by Box by someone named Ethan Elon, like, long-time conservative operator, you know, operative.
[32:50.910 --> 32:57.730]  He posted comments under FCCFree at hideemail.com and a personal email address.
[32:58.790 --> 33:10.190]  One of the ways I was able to figure out that this email address, like, the Mac email address was his, is, you know, you know, open-source intelligence, typed his email address into Skype, and that identified him.
[33:10.830 --> 33:11.270]  Um...
[33:11.270 --> 33:22.030]  I don't have time to get into the social engineering I do to talk an employee of a certain company that I hope doesn't work at, somewhere to kindly tell me who was associated with that address.
[33:22.630 --> 33:24.870]  But, you know, it's a hacker conference, use your imagination.
[33:25.990 --> 33:26.430]  Um...
[33:26.430 --> 33:45.090]  So, there are also API keys that this individual, Ethan, used to, under a ProtectInternetFreedom.com, and because the keys were registered in the Virgin Islands, and because he had news articles about having controversies in the Virgin Islands, I was able to identify him.
[33:46.950 --> 33:47.510]  Um...
[33:47.510 --> 33:47.850]  All right.
[33:48.090 --> 33:50.510]  So, real quick...
[33:51.190 --> 33:51.870]  All right.
[33:52.190 --> 34:01.410]  Real quick, okay, long story short, to match the data, you take the CSV files, you associate them with all the posting emails, you filter out, you match that with the JSON, filter that out.
[34:01.730 --> 34:13.470]  The API keys are a little tricky because one thing I didn't get into is that it is true that the data.gov API and the FCC's common system are not connected directly.
[34:13.750 --> 34:17.930]  In fact, there's anywhere from a half-second to two-second gap in the timestamps.
[34:17.930 --> 34:28.910]  So, long story short, I used fuzzy matching, you know, in Python Pandas Library Merch as of, and, you know, did some data cleaning and a lot of back and forth.
[34:29.670 --> 34:35.950]  Explored all the data to MySQL, and then I built YourFakeComet.com, which will be the last thing I talk about.
[34:40.610 --> 34:42.050]  Basically, I am not actually...
[34:42.490 --> 34:50.170]  So, this is not actually the website, because, quite frankly, I do not want to log into the Internet at a hacker conference on my personal laptop.
[34:50.170 --> 34:53.210]  So, this is just spun up on my Apache and PHP.
[34:54.070 --> 35:02.110]  And so, Patty Duke, this will just be the last example, and I think I'll wrap it up here, because this was the bulk of the talk.
[35:02.110 --> 35:05.470]  So, you could type in your, you know, type in a name.
[35:05.690 --> 35:08.270]  It takes a few seconds, because, you know, it's 8.5 million comments.
[35:10.770 --> 35:13.410]  And so, very shortly, we will see.
[35:14.050 --> 35:16.670]  And it turned out, all of them were posted.
[35:17.010 --> 35:33.310]  So, the design consideration was, I didn't want to post other people's addresses again, and also, there's no reason for me to be posting comments, like in all the text data, when you multiply that by 9 million, when I could just link to each comment directly on the FCC's website.
[35:36.110 --> 35:37.690]  I have about four minutes for questions.
[35:37.810 --> 35:38.750]  I'm just going to wrap it here.
[35:38.890 --> 35:39.730]  There's more to be said.
[35:39.850 --> 35:41.910]  So, if anyone has any questions, let me know.
[36:00.290 --> 36:02.030]  I believe there's a caption now.
[36:02.210 --> 36:06.270]  In the emails that I saw, like, I think they had asserted...
[36:06.970 --> 36:15.650]  The argument at the time, at least during the 2017 fake comments, was a Captcha would interfere with the FCC's ability to receive comments, and would interfere with free speech.
[36:15.750 --> 36:17.830]  I think they've since changed that.
[36:18.010 --> 36:21.310]  I haven't tried leaving a comment yet, but I believe there is Captcha now.
[36:21.410 --> 36:22.410]  But that was not the case.
[36:22.410 --> 36:33.430]  Hence, you could just upload, like, literally millions of comments unverified, including, like, over a million with, like, Pornhub.com, and they couldn't, like, restrict it per their policy.
[36:33.830 --> 36:46.470]  And frankly, I don't think the powers that be, the Republican powers that be at the FCC wanted it, because if they were pro-fake comments, if they were anti-net neutrality comments, they could pretend there was more support against net neutrality than there was.
[36:46.850 --> 36:51.270]  And they could also point to the Pornhub comments or the Russia comments, be like, oh, look at the fraud.
[36:51.290 --> 36:54.570]  It's coming from the pro-net neutrality side, and conveniently ignore the anti-stuff.
[36:59.960 --> 37:01.320]  That is the...
[37:01.320 --> 37:05.820]  Yeah, you just go to yourfakecomment.com, and then you just...
[37:05.820 --> 37:08.340]  You can type in your name or your email address.
[37:09.360 --> 37:09.720]  And...
[37:09.720 --> 37:11.120]  Because the thing is, there's, like, a lot of...
[37:11.120 --> 37:13.800]  Like, one thing I didn't talk about and get into is...
[37:14.280 --> 37:18.460]  It turned out there were groups that, like, harvested comments from, like...
[37:18.460 --> 37:21.300]  Let me see if I can show it real quick, because I think...
[37:21.300 --> 37:26.740]  Basically, a lot of these fake comments came from people signing up for dick pill advertisements.
[37:27.860 --> 37:28.220]  And...
[37:29.920 --> 37:33.640]  And so I didn't get a chance to talk about the New York Attorney General's report from 2021.
[37:33.640 --> 37:37.080]  But basically, people kick on banner ads, and...
[37:38.020 --> 37:44.580]  Basically, like, all these groups that posted the comments were allegedly being told that these were real comments, but the comment...
[37:44.580 --> 37:49.320]  The people that they were hiring and subcontracting just kept filtering up stuff that they were taking from other campaigns.
[37:50.440 --> 37:50.860]  So...
[37:50.860 --> 37:52.240]  For example, there's, like...
[37:52.240 --> 37:55.020]  Oh, I think, like, at least 50 different John Cena's.
[37:55.400 --> 38:05.520]  But they all have different, like, email addresses, so that's why, on yourfakecomment.com, you can search by your first and last name or email address to see if a comment was posted under your name.
[38:08.810 --> 38:14.590]  It seems like a lot of this, the way that you've found this, is just because the people who were doing it were, I don't know, really dumb.
[38:14.810 --> 38:15.650]  Like, they used John Cena.
[38:16.210 --> 38:17.450]  So, is there...
[38:17.450 --> 38:20.230]  If they had been smarter, would it have been a lot more difficult?
[38:20.390 --> 38:27.890]  You know, if they used proxies, if they didn't use the same copy-and-paste body, if they didn't use such bad, you know, made-up names and use the same ones?
[38:28.270 --> 38:32.770]  You know, if they got smarter in the future, would it be that much harder for you to find a campaign like this?
[38:33.890 --> 38:34.210]  Plausibly.
[38:34.450 --> 38:36.570]  I mean, I'd say fake comments are everywhere.
[38:37.970 --> 38:38.610]  Quick anecdote.
[38:39.110 --> 38:40.550]  I was at a...
[38:40.550 --> 38:42.930]  I was watching a friend DJ a month ago at a bar.
[38:43.130 --> 38:43.790]  I met somebody.
[38:44.770 --> 38:47.190]  Told them at the conference, like, oh, yeah, I used to be a hacker when I was a kid.
[38:47.290 --> 38:48.710]  Yeah, taught me about social engineering.
[38:48.970 --> 39:00.710]  When I started my company, yeah, I just made all these fake LinkedIn profiles, use AI-generated profiles, auto-generated texts so that they would indirectly refer to my company, but in a way that would be detected by their filters.
[39:01.590 --> 39:10.270]  And it's just like, okay, if some guy at a techno club is telling me this, God knows what else people are doing and how often and how prevalent it is now.
[39:10.470 --> 39:14.290]  So it's more than just this specific issue in 2017.
[39:14.290 --> 39:17.950]  This is the Internet now, and don't trust any comment you can't verify.
[39:20.970 --> 39:22.290]  And I guess that's my time.
[39:22.470 --> 39:23.410]  Thank you so much.
[39:23.610 --> 39:25.090]  Sorry again for the technical difficulties.
[39:25.090 --> 39:25.190]  All right, cheers.
[39:25.190 --> 39:25.330]  All right, cheers.