[01:04.620 --> 01:05.180]  All right.
[01:05.380 --> 01:06.020]  Hello, everybody.
[01:06.300 --> 01:09.060]  And HOPE 2022 will just roll right along.
[01:09.260 --> 01:10.760]  Hope everyone's having a great HOPE so far.
[01:11.100 --> 01:14.240]  I want to thank everyone for living the idea of being excellent to each other.
[01:14.620 --> 01:16.120]  Please make sure you're staying hydrated.
[01:16.280 --> 01:18.540]  Please make sure you're wearing a mask and keeping it above the nose.
[01:18.920 --> 01:21.100]  And quick reminder, we do have a fourth track going.
[01:21.100 --> 01:25.360]  If you are interested in giving a 15 to 20 minute talk, just check in with the Info Desk.
[01:25.920 --> 01:29.960]  Our next speakers are Distributed Denial of Secrets.
[01:30.040 --> 01:37.140]  This is a collective formed in 2018, and they have shared more than seven 70 terabytes of data released by hackers and leakers.
[01:37.340 --> 01:45.980]  They want the information to be available to the public for dissemination and to journalists as well, while providing hope and inspiration to future hackers and sources.
[01:46.560 --> 01:48.440]  Let's please give them a warm welcome.
[01:48.880 --> 01:49.340]  Thank you.
[01:59.020 --> 02:00.060]  Hey, everyone.
[02:00.520 --> 02:01.260]  Hold on.
[02:02.000 --> 02:03.460]  Do we have a presentation here?
[02:04.040 --> 02:05.600]  We have a presentation here.
[02:11.090 --> 02:13.570]  Can we switch to the slide decks, please?
[02:21.440 --> 02:23.760]  I promise there's a slide deck coming.
[02:25.380 --> 02:28.010]  So, thanks for the introduction, and thanks for having us here.
[02:28.180 --> 02:38.140]  While we've figured that out, you know, the first slide, if you believe me, is what is Distributed Denial of Secrets, and what we are is a transparency organization.
[02:38.820 --> 02:47.580]  We work with journalists, reporters, and really work sort of every day to get information into the public's hand.
[02:47.980 --> 02:50.500]  And that can mean lots of different things.
[03:00.480 --> 03:01.780]  We'll come back to who we are.
[03:02.240 --> 03:03.500]  We'll come back to that, I guess.
[03:05.120 --> 03:07.600]  Do you want to talk about some of the work we've done over the last four years?
[03:07.600 --> 03:08.880]  I can give an overview.
[03:09.340 --> 03:09.380]  Yeah.
[03:09.900 --> 03:10.200]  All right.
[03:10.440 --> 03:10.460]  All right.
[03:10.600 --> 03:12.200]  So, Laura... Go ahead.
[03:13.000 --> 03:19.840]  So, that was Freddie Martinez, a member of our board of advisors, and I'm Laura Axhorn.
[03:20.900 --> 03:26.380]  And I'm a journalist, so when I have trouble telling a story, I like to start chronologically.
[03:27.270 --> 03:35.330]  So, I want to give you a very brief, five minutes, four years overview of Distributed Denial of Secrets, Distributed Denial of Secrets.
[03:36.820 --> 03:41.580]  As people said, we organized in 2018 using the Royal We.
[03:41.740 --> 03:43.200]  I wasn't involved at the start.
[03:43.560 --> 03:55.820]  Emma Best co-founded it with The Architect and some other folks and started publishing data that came from hacks and leaks were our two main categories at the time.
[03:56.320 --> 04:02.240]  Some of the first datasets was F*ck FBI Fridays, an anonymous hack.
[04:03.640 --> 04:09.000]  And that month, December 2018, WikiLeaks cited us in a lawsuit.
[04:10.360 --> 04:22.700]  We also started a category called Limited Distribution, which instead of the main releases that we published via torrent and publicly.
[04:22.980 --> 04:35.620]  Limited Distribution is our category for, if you think of us as a library, LIMDIS is our reserved books section and you have to be a researcher or somebody who publishes in order to access this data.
[04:36.180 --> 04:42.020]  The first dataset in that category was a Tumblr hack, which folks may remember.
[04:42.770 --> 04:46.640]  And we also published our first Russian dataset that month.
[04:46.640 --> 04:49.180]  It was the CyberAnakin releases.
[04:49.700 --> 04:51.800]  And we published our insurance file.
[04:52.740 --> 04:58.660]  2019, January, published a much larger collection of Russian data called The Dark Side of the Kremlin.
[04:59.180 --> 05:07.360]  More than 100 gigabytes of data from several different hacks collected and published on our site.
[05:07.700 --> 05:16.140]  We also started working the next month with Unicorn Riot to capture Identity Europa Discord logs.
[05:17.100 --> 05:23.620]  Discord was a platform that was hosting a lot of far-right and fascist organizing and still does.
[05:25.000 --> 05:30.640]  We also started publishing data under the state sponsorship label.
[05:30.980 --> 05:35.140]  We like to be upfront about our sources when we know that they are state-sponsored.
[05:35.260 --> 05:41.040]  The first data in this category was Maxim Popov's files.
[05:41.660 --> 05:45.380]  This was a Russian contractor who infiltrated Anonymous.
[05:45.620 --> 05:56.260]  If you want to find out more about this, then go to Emma Best and Zan North's talk at DEFCON next month, because they will talk about that, among other things.
[05:58.580 --> 06:07.540]  In June that year was the first time that we noticed that Twitter was censoring some of our URLs after a threat analysis company included us on their blacklist.
[06:08.020 --> 06:13.940]  We were later removed from this blacklist, but this will be relevant later.
[06:14.200 --> 06:18.660]  We also published the first data that came from a ransomware origin.
[06:19.940 --> 06:31.700]  Perceptics Breach was a breach of Perceptics surveillance company that was a vendor to several law enforcement agencies and federal government license plate reader, I believe.
[06:32.200 --> 06:36.120]  They lost their contract with the federal government after this hack.
[06:37.940 --> 06:53.040]  We also started in September of that year the Bankers Box section, which is our name for data that comes from the financial services industries, from tax havens, from countries that are shell companies.
[06:53.260 --> 06:56.600]  Yeah, those sorts of entities that are often hard to get data from.
[06:57.480 --> 07:01.540]  The biggest hack in the Bankers Box section was published.
[07:02.640 --> 07:15.760]  In November, one month, two months later, it was Sherwood, two terabytes of data from the Isle of Man, Grand Cayman National, courtesy of the hacktivist Phineas Fisher.
[07:16.240 --> 07:32.540]  Also relevant in this dataset was Phineas launched the hacktivist bug bounty, because in addition to extracting data from the bank, they extracted $100,000, and they launched a bug bounty for other hacktivists who released data into the public domain.
[07:35.160 --> 07:36.500]  Hunter goes live.
[07:36.900 --> 07:44.260]  Hunter is our name for our search engine that we use to cross-reference and index some of these datasets.
[07:45.460 --> 07:54.520]  It's named after the FBI cryptonym for HT Lingual, which is the CIA's mail-opening program, because a lot of the data that goes into Hunter is emails.
[07:57.100 --> 07:57.860]  Hunter goes live.
[07:57.860 --> 08:08.840]  And then we published the 29 leaks, number 29 leaks dataset, which is from one of these shell company creation companies in the UK.
[08:09.800 --> 08:14.520]  And we published this with the OCCRP, the Organized Crime and Corruption Reporting Project.
[08:14.900 --> 08:18.920]  There was an embargo with a bunch of journalists, and a lot of stories came out at once.
[08:21.300 --> 08:30.220]  December that year, we published Milico leaks with CIPER, Chilean military email inboxes.
[08:30.220 --> 08:44.220]  And relevant because in March, the source for Milico leaks, Matapakos, was the first person awarded a hacktivist bug bounty by Phineas Fisher.
[08:44.460 --> 08:47.600]  Both Phineas and Matapakos confirmed this for us.
[08:47.740 --> 08:48.600]  They got $10,000.
[08:51.420 --> 09:03.000]  February 2020, the United States' new national counterintelligence strategy lists hacktivists, leaktivists, and public disclosure organizations as significant threats.
[09:04.100 --> 09:09.420]  We don't think that we're a significant threat, but we did like the word leaktivists, so we kind of took it on.
[09:14.070 --> 09:21.310]  May, tax evader radar, our first collaboration with a journalism school to dig into the Bahamas corporate registry.
[09:21.650 --> 09:27.050]  And we put out a tool for transcribing the Bahamas corporate registry.
[09:27.250 --> 09:38.750]  And stories came out from the European Investigative Collaborations Consortium of Newsrooms, Der Spiegel Infilibre.
[09:39.510 --> 09:48.210]  Then, the Attorney General of the Bahamas announced a leak investigation, naming me and Emma Best as Persons of Interest.
[09:49.210 --> 09:58.430]  And June 2020, we released Blue Leaks, which is 269 gigabytes from U.S. law enforcement fusion centers, training centers.
[09:59.130 --> 10:00.970]  And this made a big splash.
[10:01.470 --> 10:04.850]  Twitter banned our URL after we released Blue Leaks.
[10:05.630 --> 10:07.530]  Also kicked us off of the platform.
[10:10.610 --> 10:15.590]  We've not been back, but it did free us up and give us a lot of time since we weren't tweeting.
[10:15.590 --> 10:19.770]  So we registered as a nonprofit in July of that year.
[10:19.910 --> 10:21.190]  And we're now a nonprofit.
[10:28.140 --> 10:33.550]  On December, we announced an affiliation with the Harvard Institute of Quantitative Social Sciences.
[10:33.550 --> 10:39.810]  They have a secure drop, and sources can use that to send us data if they want to send to a secure drop.
[10:41.070 --> 10:48.240]  It hasn't been used very much, but that's just because we get a lot of data that's larger than what fits in a secure drop.
[10:49.860 --> 10:59.560]  Forbidden Stories started using Blue Leaks Forbidden Stories as another network of journalists that do cross-border collaborative investigative work.
[10:59.740 --> 11:07.860]  They specifically focus on stories that are causing journalists to be either threatened or murdered.
[11:08.120 --> 11:14.340]  So they used Blue Leaks to report on cartels in Mexico and business with fentanyl in China.
[11:16.100 --> 11:21.800]  January 6, 2021, we announced our ransomware category.
[11:22.140 --> 11:26.960]  This was sort of overshadowed by stuff that happened later in January 6.
[11:27.540 --> 11:38.160]  But the ransomware category was our way to collect data that ransomware groups are publishing to their own leak sites on the Tor network.
[11:38.380 --> 11:46.060]  And we will not grab everything but the datasets that people are interested in or that we are interested in.
[11:46.080 --> 11:47.980]  We scrape them from ransomware.
[11:49.100 --> 11:52.220]  to our network sites and add them to our archive.
[11:52.660 --> 11:57.740]  We published, I believe it was one terabyte of data from ransomware on January 6.
[11:58.340 --> 12:01.010]  And then there was a coup attempt in Washington.
[12:01.600 --> 12:08.400]  And we announced that we would prioritize data that came and taught us about this coup attempt.
[12:09.240 --> 12:16.030]  So shortly thereafter, we received the largest dataset that we have been offered to that point.
[12:16.030 --> 12:25.530]  It was 32 terabytes of video and posts from Parler that was captured by Donk MB.
[12:27.420 --> 12:33.080]  And we made it available on AWS, which was what had kicked Parler off.
[12:36.080 --> 12:40.060]  Because it's hard to transmit 32 terabytes of data.
[12:41.180 --> 12:48.340]  We also received the Donald dot win network posts from the social media analysis toolkit.
[12:49.540 --> 12:56.980]  And both of these datasets were cited in the impeachment trial shortly thereafter, the second impeachment trial.
[12:59.730 --> 13:14.340]  Also that month, Pang, Artist Collective in Germany, put up some billboards outside the headquarters of the headquarters of BioNTech, inviting workers at BioNTech to leak the formula for the Pfizer vaccine.
[13:14.660 --> 13:16.540]  And we don't typically solicit leaks.
[13:16.720 --> 13:23.680]  But if people want to put our URL on their billboard and invite people to submit leaks to us, then we are open to that.
[13:25.200 --> 13:27.240]  March, there was another coup.
[13:27.240 --> 13:41.240]  This one in Myanmar, this one in Myanmar, we received 330 gigabytes of financial data from the Myanmar coup regime, military structure, and learned a lot about that.
[13:41.820 --> 13:43.920]  I'm probably going to skip some.
[13:45.100 --> 13:49.180]  Gab leaks, Give, Send, Go, Jones Day.
[13:49.580 --> 13:57.290]  April of 2021, we started publishing Jones Day, which was another data set in the ransomware category.
[13:57.480 --> 14:06.510]  We added it to the limited distribution first, and then Freddie will talk more about that process of finding what could be publicly released.
[14:07.360 --> 14:24.860]  May, we published MPD leaks from the Metropolitan Police Department and other ransomware from the Babook ransomware group, and including transcripts of the negotiations between Babook and the MPD for deciding how much their data was worth or not.
[14:25.900 --> 14:27.480]  September, Oath Keepers.
[14:28.460 --> 14:42.040]  Next February, we got data from Give, Send, Go, the Christian fundraising site tied to the Freedom Convoy fundraiser in Ottawa that shut down Canada and some border crossings.
[14:42.680 --> 14:54.400]  Two terabytes of data from mining secrets published with forbidden stories because a journalist was threatened and imprisoned in Guatemala reporting on a mine.
[14:54.680 --> 14:59.400]  So we got these two terabytes from the mining company and published it with this consortium.
[15:01.480 --> 15:13.920]  And the most recent and the subject of our talk ostensibly is the Russian data that we started publishing since the Russian invasion of Ukraine.
[15:13.920 --> 15:14.010]  Ukraine.
[15:14.160 --> 15:20.740]  I think the count is more than 10 million documents and every email counts as a document, but there's sometimes attachments.
[15:21.030 --> 15:27.600]  So there's more than 10 million documents of a series of hacks, more than five terabytes.
[15:28.290 --> 15:30.800]  Emma will have a better count of that.
[15:32.600 --> 15:34.040]  Brings us up to today.
[15:34.560 --> 15:42.840]  GQ leaks, Nauru leaks, police from Nauru, the detention center that Australia uses to offshore their asylum seekers.
[15:44.060 --> 15:55.530]  And GQ leaks is from Equatorial Guinea, another very difficult government to get information out of and published with Diario Rombe, who've been doing a great job and I'll talk about them later as well.
[15:56.140 --> 16:01.240]  Can we try to use this one for slides again?
[16:01.420 --> 16:02.060]  For slides?
[16:02.320 --> 16:02.420]  Yeah.
[16:02.800 --> 16:04.460]  I don't know, but the port's issue.
[16:04.600 --> 16:05.860]  Well, there's a USB secure.
[16:06.080 --> 16:06.240]  Okay.
[16:06.380 --> 16:09.960]  Okay, we're going to try slides one more time and we'll see.
[16:10.990 --> 16:13.480]  I'm going to switch the laptops, if that's okay.
[16:22.020 --> 16:23.140]  Lots of clanking up here.
[16:24.000 --> 16:24.440]  So...
[16:35.160 --> 16:36.040]  Does that work?
[16:37.020 --> 16:37.460]  No.
[16:37.780 --> 16:38.720]  Okay, I'll just talk.
[16:39.600 --> 16:41.620]  So what does the DOS publish?
[16:42.200 --> 16:43.040]  It's actually...
[16:43.040 --> 16:57.460]  Lorax did a great job of describing all of the data sets that we have published to date, but there's a lot of stuff that we don't publish or stuff that we will only publish to academics, newsrooms, limited distribution for that, from that point of view.
[16:57.640 --> 17:01.240]  And it's actually not that easy of a job to do.
[17:02.340 --> 17:08.760]  Part of the reason and part of what we do as board, as the advisory board, is to have those discussions.
[17:09.080 --> 17:24.240]  So when Lorax was talking about the Russian data sets that were being leaked as part of the ongoing invasion of Ukraine, that actually sparked quite a bit of conversation within the news, within the collective.
[17:26.320 --> 17:34.460]  Broadly speaking, any data set that's in the public interest that, you know, advances the public right to know about what's happening in the world will release.
[17:35.240 --> 17:42.480]  But it gets complicated when, you know, you have an armed conflict that's changing every single day.
[17:42.800 --> 17:44.700]  You have data that's being released.
[17:44.700 --> 17:48.140]  You don't know who's giving it to you, much less for what reasons.
[17:49.000 --> 17:56.600]  And then there's also complications because the normal sort of don't hack these targets.
[17:56.780 --> 18:03.140]  We're going to look the other way if you go after Russian military targets in a way that we wouldn't do it outside of a war.
[18:03.860 --> 18:10.000]  That kind of hint, hint, nudge, nudge thing that happens that was happening around the world and is still happening.
[18:10.780 --> 18:12.840]  That creates a lot of complicated questions.
[18:13.080 --> 18:17.560]  Obviously, we're not in the business of advancing U.S.
[18:17.700 --> 18:18.580]  military interests.
[18:19.500 --> 18:23.660]  And so, you know, that's challenging.
[18:23.960 --> 18:32.900]  At the same time, we were getting data sets such as there's one about, I think it's the Russian Ministry of Culture is what they call themselves.
[18:32.900 --> 18:40.120]  But it's really is the censorship arm of the Russian government, which will tell you that that news site is...
[18:41.360 --> 18:42.840]  The Russian censorship.
[18:43.240 --> 18:43.560]  Yeah.
[18:43.780 --> 18:51.940]  And so, if that makes its way into our lap and it falls off of a truck, I don't think that we can plausibly say we shouldn't release it.
[18:52.120 --> 18:53.280]  And we did.
[18:54.460 --> 19:07.300]  So, those are the kinds of things that we have to sort of think through and talk about because it's obviously a lot more complicated than just, you know, going to some onion service and just grabbing all the files.
[19:08.880 --> 19:10.960]  In fact, there's a slide here.
[19:11.280 --> 19:13.700]  But if you're interested, NPR did a story.
[19:13.700 --> 19:16.280]  It's just a very short piece about how...
[19:16.280 --> 19:21.140]  And it's just titled How a Nonprofit Group Became the Largest Depository for Hacked Russian Data.
[19:22.580 --> 19:28.580]  And one of the things that we talked about was really how do you go through the data in a way that's tangible and understandable.
[19:29.420 --> 19:43.680]  When I talked to the reporter, Jenna McLaughlin, I sort of described to her the difference between getting, like, an Amazon package and, you know, you open it and you get your stuff versus, like, the actual warehouse that the data, you know, that the package comes from.
[19:43.800 --> 20:00.780]  Like, that's the level of difference of what one human can go through versus, you know, terabytes and terabytes of data, especially when you don't, you know, understand the language, you don't understand the cultural context, you don't understand the slang that people are using and all that sort of stuff.
[20:00.980 --> 20:04.880]  So, yeah, so it is complicated.
[20:06.380 --> 20:10.300]  But I think, you know, there's a reason we like to work with leaked data.
[20:12.200 --> 20:13.160]  First, it's fun.
[20:13.400 --> 20:15.100]  It's a lot like a loot box, right?
[20:15.220 --> 20:19.080]  You really never, like, sometimes we wake up and you're like, wait, we got what?
[20:20.220 --> 20:23.780]  And so you never know what's going to come in through the front door.
[20:24.460 --> 20:26.020]  And it's really interesting.
[20:26.240 --> 20:32.280]  We've gotten everything from, you know, mining companies to tax havens.
[20:32.360 --> 20:33.540]  Like, that's great fun.
[20:34.620 --> 20:48.040]  But it also is the situation where a lot of the traditional avenues for getting information about what's happening in the public are just, like, fundamentally broken, right?
[20:48.040 --> 21:01.080]  Like, if you talk to anyone who is an advocate for the Freedom of Information Act, of which I include myself, it's not uncommon for us to complain about years of delay, excessive redactions, things like that, right?
[21:01.700 --> 21:13.180]  Tools that should be in the public's interest and the way of understanding, you know, what our government is up to and other governments are up to just don't work for the public.
[21:13.840 --> 21:14.980]  So that's quite limiting.
[21:15.260 --> 21:32.420]  Even when you talk to whistleblowers, right, who step forward and, you know, sometimes take huge courageous risks to inform the public, you know, it's often one person's view.
[21:32.800 --> 21:35.840]  And sometimes they come forward for complicated reasons, right?
[21:35.840 --> 21:57.860]  And so, to get a full, like, view of what's happening in an organization or in a data set, it's, sometimes these data releases will have way more and way more points of view that can tell a fuller story in ways that one person sort of can't or, you know,
[21:58.540 --> 21:58.800]  anyway.
[21:59.580 --> 22:04.620]  So, so, you know, those are some of the motivations just to working with leaked data.
[22:08.380 --> 22:11.440]  Yeah, so, but there are challenges.
[22:12.480 --> 22:13.580]  You can't see it.
[22:13.760 --> 22:16.220]  It would be a slide of City Hall, but that's okay.
[22:17.800 --> 22:21.120]  Lorex talked about a data set that we got from Jones Day.
[22:21.300 --> 22:30.300]  Jones Day is one of the largest law firms in Chicago, or, sorry, in the country, and they have offices in Chicago, but they're, they're a huge law firm, right?
[22:30.460 --> 22:44.980]  And so, a lot of the work that they do is privileged legally, and the public would never see it even, even, like, other lawyers who are, you know, in litigation against Jones Day might get some of their data, but not, you know, a full picture.
[22:45.980 --> 22:53.760]  So, Jones Day got ransomwared because some of the groups that, that were working in response.
[22:55.300 --> 22:56.900]  All right, let me start the story over.
[22:57.120 --> 23:01.460]  The Chicago Police Department is, is notoriously corrupt and racist.
[23:01.840 --> 23:11.000]  And as a response to one of the, one of their botched raids, Jones Day was sort of brought in to review what had happened by City Hall.
[23:11.240 --> 23:16.600]  And so, they had all this data that then got ransomwared and dumped that we collected and, and found.
[23:17.980 --> 23:21.260]  So, that's the Jones Day data set, and that's sort of the genesis of it.
[23:21.360 --> 23:33.200]  And we were looking through it, and we couldn't really figure out what, what's the public interest in all of this information, especially since it's, it's like city halls, like emails and things like that.
[23:34.200 --> 23:47.020]  And then, about a year ago, a year plus, the police murdered a young person, Adam Toledo, in the Little Village neighborhood of Chicago.
[23:50.180 --> 24:05.080]  So, for context, I grew up in the Little Village neighborhood of Chicago, and I know every, you know, I know quite a bit of report, quite a few reporters in Chicago, and was sort of working with DDoS quite deeply.
[24:05.320 --> 24:18.160]  So, we started looking at the data, and what we realized is that this kind of stuff that you would normally get through a FOIA release, like I've, I've sued the city of Chicago so many times that I've lost track of it.
[24:18.380 --> 24:27.640]  But the, the kinds of details that were in these emails, you would never get through FOIA, you would never get through discovery, you would never get any other way than through ransomware.
[24:28.320 --> 24:42.180]  So, following the police murder of Adam Toledo, we released this, this data set, and I started working with newsrooms that I knew personally, to, to go through it and pull out information that we thought was relevant.
[24:42.460 --> 24:48.620]  We found things like, um, uh, emails about environmental racism.
[24:48.620 --> 24:56.040]  We found emails about the police response to the uprisings in June of 2020.
[24:56.420 --> 24:59.720]  Uh, we found, we found like... Car chases.
[25:00.100 --> 25:01.420]  Car chases, right, yeah.
[25:01.560 --> 25:10.540]  Policy around not... Yeah, the police will just like go on car chases and like half of the time they were crashing, like... Killing people.
[25:10.680 --> 25:11.540]  Killing people, right?
[25:11.740 --> 25:14.840]  And they had emails saying like, you need to stop this.
[25:14.980 --> 25:15.820]  People are dying.
[25:16.240 --> 25:18.360]  And they didn't.
[25:18.600 --> 25:20.340]  They, they, this went out for years, right?
[25:21.120 --> 25:26.280]  Um... The mayor canceled her subscription to the Chicago Tribune because she didn't like their reporting.
[25:26.480 --> 25:26.620]  Yeah.
[25:26.760 --> 25:27.460]  That was in there.
[25:27.940 --> 25:30.860]  Um, so, so lots of stuff that you would never see, right?
[25:31.080 --> 25:38.100]  Um, and, and that kind of like investigative reporting was only made possible through like the work of DDOS.
[25:38.460 --> 25:50.520]  Um, similarly, when, when we released the information about Parler, um, you know, I think it was a very surreal moment where I, I think I tell the story.
[25:50.620 --> 26:02.820]  I was going through the airport and CNN is on and they have like videos and videos and videos of like hand-to-hand combat between police and rioters in, in the Capitol building.
[26:02.820 --> 26:08.980]  And you have the posts, people being like, we did that, or I did that, or pepper sprayed, and I'm still fighting.
[26:09.860 --> 26:17.380]  Um, and see, you know, being able to see that sort of, um, um, it, it was weird, right?
[26:17.480 --> 26:28.560]  Because like, on one hand, the government, governments around the world are like calling us like litivists and significant threats and wanting to open investigations into the group.
[26:28.960 --> 26:40.280]  Um, and at the same time, you had like U.S. representatives on the floor for impeaching the president, um, using our data sets, um, as evidence.
[26:41.040 --> 26:44.300]  And then that sort of being broadcast across the world.
[26:44.320 --> 26:46.340]  And then I happened to watch it at the airport.
[26:46.340 --> 26:49.960]  I thought I was like, well, what, what, what the f*ck did we do?
[26:50.540 --> 27:06.760]  Um, so anyway, so yeah, you know, these kinds of data sets, um, have so many different like tentacles of like where things can go, uh, that sort of like a traditional investigation using like FOIA projects just don't have.
[27:06.960 --> 27:10.980]  So, um, so yeah, I just wanted to highlight those two data releases.
[27:11.460 --> 27:15.460]  Um, and I can't see this more.
[27:15.600 --> 27:17.020]  We have more releases coming soon.
[27:17.020 --> 27:21.840]  Maybe we can try the video back there.
[27:22.000 --> 27:23.280]  Oh, is Emma, Emma on?
[27:32.490 --> 27:34.230]  I think Emma's on this one.
[27:34.490 --> 27:35.550]  Hold on, hold on.
[27:35.910 --> 27:37.230]  I know how computers work.
[27:45.120 --> 27:46.020]  I don't.
[27:47.280 --> 27:48.920]  That's the division of labor.
[27:49.280 --> 27:49.340]  Yeah.
[27:50.280 --> 27:52.140]  I don't know how computers work.
[27:54.460 --> 27:57.140]  I did go to journalism school though, so I can talk to those people.
[27:57.140 --> 28:02.980]  Well, yeah, it's like the ultimate irony is that like we can release like terabytes and terabytes of data and we can't get the slides to work.
[28:05.720 --> 28:06.460]  Um, okay.
[28:06.620 --> 28:08.060]  I think there we go.
[28:08.340 --> 28:08.540]  Yeah.
[28:13.610 --> 28:13.970]  Yeah.
[28:14.150 --> 28:15.510]  And so we have more releases coming soon.
[28:15.710 --> 28:18.610]  Uh, here's a little, a little teaser trailer.
[28:18.610 --> 28:19.970]  Yeah, there we go.
[29:00.980 --> 29:04.900]  I forgot to mention guacamaya was the source for my Finding secrets.
[29:05.500 --> 29:09.620]  So, this is something to look forward to.
[29:10.000 --> 29:10.060]  Yeah.
[29:11.100 --> 29:12.000]  Let me see here.
[29:12.220 --> 29:12.660]  Sorry.
[29:12.880 --> 29:13.340]  Full screen.
[29:17.000 --> 29:18.260]  So, lessons learned.
[29:18.560 --> 29:25.300]  Emma, do you want to talk about some of the lessons we've learned, especially working with newsrooms, about going through these large data sets?
[29:29.990 --> 29:31.230]  Sorry, could you say that again?
[29:31.610 --> 29:38.690]  Do you want to talk about some of the lessons we've learned working with newsrooms about these, like, really large data sets and some of the challenges?
[29:40.350 --> 29:40.870]  Sure.
[29:42.510 --> 29:49.630]  Biggest lesson would be that most newsrooms are really not equipped to go through these kinds of data sets.
[29:51.470 --> 29:55.830]  They haven't invested or prepared to work with these kinds of data sets.
[29:56.810 --> 30:03.390]  And the number one question we get from them is, what do we do with these things?
[30:03.390 --> 30:04.510]  What is the story?
[30:06.290 --> 30:14.830]  And frustratingly, they usually want everything handed to them in a neat little bow, which unfortunately is not what we do.
[30:15.030 --> 30:16.790]  We present the data.
[30:16.950 --> 30:19.050]  We will sometimes highlight data points.
[30:23.390 --> 30:28.290]  But, oh, that's the... Sorry, the slide confused me.
[30:28.350 --> 30:30.470]  I was like, are you on the wrong screen?
[30:34.210 --> 30:42.330]  Yeah, we'll sometimes present data points, but it's up to individual journalists in newsrooms on how to interpret that and what to do with it.
[30:42.330 --> 30:51.190]  Because otherwise, we just have way too much of a say in how huge swaths of data are presented and interpreted.
[30:51.610 --> 31:00.010]  And also, it presumes that we are or can be experts in everything, which is absolutely ludicrous.
[31:01.470 --> 31:07.950]  And really, one of the things that we do is rely on journalists to be experts in what they report on.
[31:08.210 --> 31:13.850]  Their subject matter, their local beats, and when they do that, it works really well.
[31:14.010 --> 31:16.510]  That's one of the things that we're seeing with GQ leaks.
[31:16.670 --> 31:23.030]  We're helping them process the data a little bit, yes, but we're trusting them to report on it.
[31:23.030 --> 31:26.630]  And they're doing a fantastic job of it, far better than we ever could.
[31:29.050 --> 31:34.390]  But the biggest issue that most journalists have is that they're just not prepared to look at this stuff.
[31:34.930 --> 31:41.150]  And they don't know where to start, and the newsrooms aren't giving them the proper training or technical support.
[31:44.910 --> 31:45.530]  Yeah.
[31:47.070 --> 31:47.690]  Yeah.
[31:47.870 --> 31:57.470]  And it's really frustrating, too, because one of the challenges is, you know, when you, like, look through, like, a 40 terabyte data set, for example.
[31:58.550 --> 32:01.530]  Actually, let me give you the BlueLeaks example.
[32:02.030 --> 32:06.850]  It was almost 250 gigabytes of data stored.
[32:06.850 --> 32:12.910]  It was, like, a PHP app with a database that had gotten sort of dumped.
[32:13.090 --> 32:25.870]  And then what the fusion centers would do is every day they would send each other, like, updates, which were then getting put into an Excel file, which were referencing reports that were PDFs in the files.
[32:26.590 --> 32:29.170]  And that's just, like, how the data was structured.
[32:29.170 --> 32:37.910]  And so when we were, you know, working with reporters on BlueLeaks investigations, they would want to know, like, hey, what's happening in my backyard?
[32:38.110 --> 32:43.070]  And then, you know, we would give them the BlueLeaks data, and they're like, I can't do anything with this.
[32:43.150 --> 32:49.630]  And then you have to, like, sort of understand the data enough to walk them through it so that they can do their analysis.
[32:51.510 --> 33:06.010]  But, like, the reason that, you know, we were able to do that is because someone has the capacity to go through and sort of document this shitty PHP app that got hacked and then the database that is attached to it in the Excel files.
[33:06.490 --> 33:08.930]  But, like, who has the capability to do that?
[33:08.930 --> 33:27.510]  And one of the things that kind of is frustrating, which Emma talks about, is, like, a lot of people don't have either the time, the energy, or, most importantly, the editorial buy-in to just go disappear for, you know, a month or two and then come back with a story.
[33:28.010 --> 33:32.130]  Often what we get is, what's the interesting stuff that's in this data release?
[33:32.130 --> 33:44.870]  And, you know, I could tell you things that are interesting to me, but that doesn't mean it's the story that you want to tell your audience or that it actually is true or verifiable or anything like that.
[33:45.110 --> 33:45.790]  Can I jump in?
[33:46.450 --> 33:56.030]  Yeah, I mean, journalists often request, like, data to be embargoed to them for their exclusive use so that they can get a time to look into it.
[33:56.030 --> 34:07.230]  And we have a bias to publish to everyone and to not form these sorts of agreements that are limiting the research that can be done.
[34:07.230 --> 34:14.210]  Because we don't believe that any one newsroom should have exclusivity on a data set.
[34:14.210 --> 34:29.210]  So that's... I know that there's, like, a conflict and there's cross-purposes at times with journalists wanting to sell and monetize the information that they have access to.
[34:30.570 --> 34:39.350]  Models that we are aware of existing and precede us are along these lines.
[34:39.350 --> 34:51.570]  The ICIJ, the Intercept to some degree, do this thing where they keep exclusive access to a data set and then slowly dribble out stories.
[34:51.890 --> 34:53.810]  And we're sort of a different model.
[34:53.970 --> 34:55.750]  But other people can do it differently, you know?
[34:55.910 --> 35:04.310]  Like, that's a lesson that we want to be the takeaway from this talk is that folks should try it and do more.
[35:04.310 --> 35:08.450]  Because we do want to not be the only people doing this in this space.
[35:09.870 --> 35:10.330]  Yeah.
[35:10.770 --> 35:11.990]  So maybe we can go to questions?
[35:12.430 --> 35:13.870]  I think we have time for questions.
[35:14.110 --> 35:16.750]  I did want to mention one final thing.
[35:18.350 --> 35:19.250]  One final thing.
[35:19.490 --> 35:20.270]  Yeah, we have time for questions.
[35:21.630 --> 35:23.030]  I wanted to go back to the beginning.
[35:23.170 --> 35:24.030]  Who is DDoS?
[35:24.410 --> 35:25.450]  There's a few of us.
[35:27.910 --> 35:31.650]  And then there are non-furry animals.
[35:31.650 --> 35:33.490]  But this is the important part.
[35:33.890 --> 35:34.710]  This is who we are.
[35:37.050 --> 35:37.550]  So, yeah.
[35:39.170 --> 35:40.990]  I think, yeah, then we'll just jump to questions.
[35:40.990 --> 35:46.410]  And then if we don't have time for your questions, we're going to plan to hang out.
[35:46.450 --> 35:49.890]  There's a mic there if people want to go to the mic to make sure your questions captured by the stream.
[35:49.890 --> 35:51.570]  And we'll be around, obviously, for the rest of the conference.
[35:53.550 --> 35:55.230]  We should just leave the animals up, right?
[35:55.470 --> 35:56.050]  Like one of them.
[35:56.190 --> 35:56.850]  But which?
[35:57.890 --> 35:58.890]  We'll do a poll.
[35:59.150 --> 35:59.590]  All right.
[36:00.330 --> 36:00.650]  What?
[36:05.620 --> 36:06.680]  Maybe that's Maurice.
[36:07.180 --> 36:07.380]  All right.
[36:07.900 --> 36:08.400]  All right.
[36:08.500 --> 36:09.580]  We'll take questions now, I guess.
[36:13.000 --> 36:14.840]  I see one question, maybe.
[36:15.960 --> 36:16.160]  Yeah.
[36:17.240 --> 36:18.760]  Well, hey, I was just sitting in front of you guys.
[36:18.760 --> 36:19.930]  But I do have a question.
[36:20.340 --> 36:20.500]  Great.
[36:20.740 --> 36:28.860]  So, I understand the frustration with collecting this data and then delivering it even with the high points and having someone say, so now what?
[36:28.860 --> 36:38.300]  Have you thought about adding an analytical kind of wing to the organization to address that, to sort of package it up with that pretty bow and hand it off?
[36:40.060 --> 36:40.620]  Yeah.
[36:40.920 --> 36:54.140]  I mean, the thing that we found even with, for example, GQ leaks is a data set that has been really worked, worked really well, which we released to a newsroom with an expertise in Equatorial Guinea.
[36:54.340 --> 37:13.060]  Like, and they have a list of like names and everyone that is either in the power structure, connected to the power structure, family, this sort of institutional knowledge, it's very difficult to develop for every single entity that we might get a leak from.
[37:14.000 --> 37:24.980]  And yet there are folks out there, obviously, who have a lot of knowledge about the Russian nuclear program, which is one leak that we got, the Russian nuclear entity.
[37:27.080 --> 37:33.300]  So, Emma does a lot of the initial analysis and is great.
[37:33.600 --> 37:38.080]  And I wish that we could have 10 Emmas.
[37:40.320 --> 37:43.480]  And yeah, we're always looking for more energy and ideas.
[37:43.880 --> 37:55.600]  We're going to add the search engine again, because we lost this when our server was seized after blue leaks, which helps folks to just throw in a keyword and find which data set it might be in.
[37:55.900 --> 38:05.040]  This empowers a lot of folks, newsrooms who might not have the capacity to search, to run searches on their end.
[38:06.040 --> 38:09.500]  But yeah, there's always room for more energy.
[38:10.280 --> 38:11.100]  Next question.
[38:12.440 --> 38:13.240]  Hi, thank you.
[38:13.320 --> 38:13.760]  Great talk.
[38:13.980 --> 38:15.180]  Glad you got your slides fixed.
[38:15.500 --> 38:17.940]  If you could flip through them really fast again, that would be great.
[38:17.940 --> 38:20.900]  A question I have for you is I'm a fan of 2600.
[38:21.020 --> 38:22.020]  I'm a writer for 2600.
[38:22.140 --> 38:23.180]  I do a lot of community stuff.
[38:23.380 --> 38:25.780]  I also like analyzing breaches and looking at stuff.
[38:25.940 --> 38:27.560]  I've looked at some of the stuff you guys have done.
[38:27.680 --> 38:28.380]  I've been really great.
[38:28.580 --> 38:35.340]  And so my question is, how do we get access to more of it, even if I'm not like a big journalist working for a big media outlet and whatnot?
[38:35.580 --> 38:39.920]  Because there's certainly some other stuff on there that's really interesting that I would like to play with or look at.
[38:40.080 --> 38:49.520]  For example, one of my research projects was analyzing and correlating data between the OPM breaches and Ashley Madison and some really interesting data points that come out of that.
[38:50.040 --> 38:53.180]  So much so that I was specifically told at work to stop the research.
[38:53.440 --> 38:56.620]  So with that being said, I do like looking at some of this stuff.
[38:56.840 --> 39:01.040]  How does a normal person, like a 2600 writer, get access to some of this?
[39:01.040 --> 39:04.020]  And I think Ashley Madison is in our limited distribution.
[39:04.020 --> 39:04.860]  I already got that one.
[39:05.380 --> 39:05.860]  Yeah.
[39:06.380 --> 39:14.100]  And you don't have to be a journalist or an academic researcher to request access to our limited distribution data.
[39:14.360 --> 39:21.320]  Send us an email with links to research that you have published wherever 2600 or your own blog.
[39:21.540 --> 39:30.400]  Like we'll read it and see if your request is genuine or if you're actually publishing research to the public, that's a big plus.
[39:30.620 --> 39:32.100]  Is that a requirement?
[39:32.420 --> 39:35.080]  To publish research to the public for...
[39:35.080 --> 39:43.680]  Yeah, we get a lot of requests from like, I'm a private investigator and I want your data so that I can like sell it to my clients.
[39:43.860 --> 39:45.880]  And we don't usually prioritize those.
[39:46.020 --> 39:46.560]  Of course.
[39:46.780 --> 39:46.900]  Yeah.
[39:47.080 --> 39:49.560]  But we do work with academics.
[39:49.560 --> 39:51.100]  We do work with individuals.
[39:51.100 --> 39:52.940]  We do work with reporters.
[39:53.320 --> 39:56.200]  It's actually much broader than we kind of focus our talk on.
[39:56.980 --> 40:05.720]  You know, typically, you know, it's like, our collective is fairly...
[40:06.800 --> 40:12.660]  We try to be very open and work in a very horizontal manner.
[40:12.900 --> 40:27.920]  So, you know, sometimes we'll have other members say, here's a person that I know that is trustworthy with this data that I know is limited distribution, but I know that they're a researcher working on interesting things and they could use access.
[40:28.260 --> 40:31.100]  And so, you know, that also happens quite frequently.
[40:31.440 --> 40:32.080]  So, it's not impossible.
[40:32.340 --> 40:35.400]  I've messaged you guys a few times and it's worked and then a couple times I got nothing.
[40:35.640 --> 40:36.960]  So, that's why I asked, you know.
[40:37.200 --> 40:37.520]  Okay.
[40:37.780 --> 40:37.940]  Yeah.
[40:38.260 --> 40:41.180]  I also will point out that most of us are volunteers.
[40:41.540 --> 40:41.560]  Yeah.
[40:43.340 --> 40:43.780]  So...
[40:43.780 --> 40:44.180]  I understand.
[40:44.360 --> 40:45.720]  It's not a personal thing either.
[40:46.500 --> 40:46.940]  So...
[40:46.940 --> 40:47.080]  Thank you.
[40:47.080 --> 40:47.840]  Try again.
[40:47.840 --> 40:48.460]  I will.
[40:48.720 --> 40:49.780]  We do want to work with everyone.
[40:49.980 --> 40:50.540]  Thank you very much.
[40:50.620 --> 40:51.080]  Appreciate it.
[40:53.960 --> 40:55.420]  Do we have time for more questions?
[40:55.660 --> 40:55.820]  Oh, yeah.
[40:56.060 --> 40:56.600]  Go for it.
[40:57.540 --> 40:57.920]  Hi.
[40:58.040 --> 41:06.660]  Could you go into a little bit more detail about the process that you guys go through when you are evaluating whether a data set is in the public interest or not?
[41:07.080 --> 41:12.760]  It seems like a really hard question sometimes and I'd be curious to sort of hear a little bit more about that process.
[41:12.980 --> 41:13.660]  Yeah, I'm still there.
[41:14.300 --> 41:15.500]  Emma, do you want to take that?
[41:16.800 --> 41:22.000]  Yeah, I actually just got asked that a couple of days ago by a reporter.
[41:23.180 --> 41:26.040]  And the answer is, it varies.
[41:26.420 --> 41:29.980]  It's different for every data set and every situation.
[41:30.780 --> 41:37.560]  And I think the answer I wound up giving was, I know it when I see it.
[41:38.440 --> 41:44.140]  You know, I hate to make any Supreme Court reference right now.
[41:46.100 --> 41:47.900]  Pretty much f*ck SCOTUS.
[41:48.280 --> 41:52.560]  But it's, I know it when I see it.
[41:52.720 --> 41:57.200]  And I mean, we don't always all agree on it within the collective.
[41:57.340 --> 42:04.720]  There are times where we have disagreed on it and there are times where I don't know it when I see it.
[42:04.720 --> 42:10.620]  And, you know, I initially review it and I'm just like, oh, I don't know.
[42:10.620 --> 42:15.080]  Or this could go either way or I don't know what to make of this.
[42:15.300 --> 42:19.220]  And we'll have, you know, more of a discussion than usual about it.
[42:19.220 --> 42:24.780]  And it really just varies from situation to situation.
[42:24.780 --> 42:28.260]  Because the math is always different.
[42:28.940 --> 42:33.280]  Especially if there's a lot of personal information in it.
[42:33.420 --> 42:38.780]  Or, you know, it's a corporate data set versus a governmental one.
[42:38.780 --> 42:40.060]  It's...
[42:41.420 --> 42:42.780]  They're all different.
[42:43.620 --> 42:46.180]  You know, they're all different situations.
[42:48.560 --> 42:54.480]  If we get requests for it, it's a good indication of public interest in the data set.
[42:54.480 --> 42:54.780]  Yeah.
[42:55.380 --> 42:55.740]  Yeah.
[42:55.920 --> 42:57.380]  With, like, private info...
[42:57.380 --> 43:05.740]  Or stuff that we identify as personal information in there, we always take much longer to deliberate on that sort of stuff.
[43:09.440 --> 43:15.160]  Typically, we have, like, a sentence about... that we usually go to.
[43:15.240 --> 43:21.720]  But if you can make a prima facie, like, sort of showing that it's in the public interest, usually that bar is fairly clear.
[43:24.240 --> 43:26.380]  When it's clearly in the public interest.
[43:26.960 --> 43:29.380]  Whether or not we release it is a different thing.
[43:29.560 --> 43:32.160]  Or, like, will we prioritize it or anything like that.
[43:32.860 --> 43:34.660]  Those are secondary questions.
[43:34.840 --> 43:45.600]  But for the most part, everything that we've released, we can make a sort of, like, two-sentence, like, yes, this is in the public interest because X, Y, and Z.
[43:46.880 --> 43:54.520]  But it's often very complicated with personal information, which we usually take a much longer time frame for.
[43:56.040 --> 43:56.820]  I don't know if that ends.
[43:56.820 --> 43:57.620]  Does that answer your question?
[43:57.900 --> 43:58.460]  It does.
[43:58.660 --> 43:59.360]  I really appreciate it.
[44:00.720 --> 44:01.060]  What time?
[44:01.200 --> 44:01.840]  What's our time?
[44:02.340 --> 44:02.800]  Hey.
[44:02.980 --> 44:06.140]  So we have time for a couple more questions and answers.
[44:06.300 --> 44:08.560]  We've got about seven minutes, so we'll just try again through quickly.
[44:08.560 --> 44:09.000]  Okay.
[44:09.340 --> 44:11.300]  I do have a question from the matrix chat.
[44:11.520 --> 44:11.840]  Oh, great.
[44:11.840 --> 44:12.420]  I was going to just check it.
[44:12.420 --> 44:21.640]  Hypothetically, would a 10-year archive of a previous president's tax returns be publishable by DDoS via unlimited distribution?
[44:22.240 --> 44:26.820]  And what are some, if any, PII constraints that that DDoS would face?
[44:29.020 --> 44:32.500]  I don't think that that would be a limited distribution data set.
[44:33.820 --> 44:34.980]  I mean, we might...
[44:34.980 --> 44:35.000]  Yeah, no.
[44:35.140 --> 44:38.380]  I think that would be a public release, but...
[44:38.380 --> 44:43.820]  Like, the social security number or, you know, something like that, but...
[44:43.820 --> 44:47.060]  Yeah, we'll redact out the date of birth, date of birth or something.
[44:47.060 --> 44:54.100]  Yeah, like, the identity theft stuff, sure, we'll get rid of that, but...
[44:55.060 --> 45:06.640]  Yeah, no, tax returns of presidents and other basic financial disclosure stuff, hypothetically speaking, seems like it's definitely in the public interest.
[45:08.140 --> 45:20.380]  Yeah, the limited distribution stuff was like, I mean, give, send, go, where there was fundraisers for, like, church bake sales in addition to the Proud Boys and the Oath Keepers.
[45:20.620 --> 45:27.320]  So those sorts of, like, mixed value data goes to the limitless category pretty easy.
[45:27.440 --> 45:31.780]  But when it's tax returns of a public figure, then that is not limited distribution.
[45:32.900 --> 45:33.680]  Next question.
[45:33.680 --> 45:34.040]  So...
[45:34.040 --> 45:34.280]  Hi.
[45:34.520 --> 45:36.100]  Gus Andrews, Disarm Foundation.
[45:36.700 --> 45:41.540]  It sounded as if you would like to clone Emma's skill set among many, many people.
[45:42.320 --> 45:50.320]  I'm wondering, for those who are in the room who might like to learn how to do analysis, or to journalists who might be listening, where do you suggest they go to learn more about doing that?
[45:53.860 --> 45:55.460]  I think that might be an Emma question.
[45:59.680 --> 46:01.540]  Oh, Emma, I can't hear you.
[46:01.540 --> 46:01.980]  Emma's on mute.
[46:02.660 --> 46:03.060]  Oh!
[46:03.240 --> 46:03.720]  There, you're back.
[46:05.280 --> 46:14.580]  If I knew, I would be trying to teach other people how to help me do this stuff.
[46:14.780 --> 46:17.980]  But I am an absolutely terrible teacher.
[46:20.040 --> 46:25.260]  I mean, some of the advice that I give is, like, learn mosaic theory.
[46:25.260 --> 46:29.000]  And I feel like that's pretty useless advice for most people, honestly.
[46:30.340 --> 46:42.280]  Yeah, I mean, I think that the one skill set that I found invaluable is just looking through previous data sets and, like, trying to make sense of, like, how are the files formatted?
[46:43.100 --> 46:47.180]  Or also trying to, let's say that you didn't know where it came from.
[46:47.300 --> 46:54.820]  Try to, like, figure out from, with no information, where it could have come from.
[46:55.520 --> 47:00.600]  And I've found that, you know, sometimes when we're talking about, like, what's the value of a data set?
[47:01.140 --> 47:03.920]  And I'm like, what company based in what country?
[47:04.420 --> 47:16.080]  And then, you know, I'll start digging a little bit deeper, and I'll see, like, okay, no, it's not, it's not just, like, some random person's, you know, information.
[47:16.080 --> 47:23.700]  Information is a media conglomerate with a subsidy that's based in this country with a history of, you know, attacking activists.
[47:24.100 --> 47:32.680]  And so that kind of, like, level of going deeper into the data with no information sort of starts to give you both information about, like, what's the value of the data set?
[47:33.140 --> 47:42.960]  But then also gives you a good sense of, like, when you get to see new data sets, like, how should you be thinking about going through them to authenticate it and also to find the value of them?
[47:44.880 --> 47:45.920]  Hopefully that helps.
[47:46.440 --> 47:46.720]  Thanks.
[47:48.800 --> 47:50.900]  Hello, Jason Palladino, Grid News.
[47:51.540 --> 48:01.540]  I just had a question, you know, once upon a time, there was another group that became very well known for putting out information that it received in various ways.
[48:02.460 --> 48:07.000]  How does your group distinguish itself from that group?
[48:07.280 --> 48:15.300]  And, like, are there lessons from that whole episode that you guys learned and why want to let everyone know about?
[48:15.620 --> 48:18.620]  Well, that's a quick one, eh, for the end of the talk.
[48:18.960 --> 48:26.360]  I mean, I think that we are aware of this group that you allude to.
[48:26.360 --> 48:39.560]  And that several of us have supported over the years or been involved with and moved away from.
[48:39.560 --> 48:43.740]  I think that how we distinguish ourselves.
[48:44.120 --> 48:44.780]  Thank you.
[48:45.380 --> 48:48.720]  We try to build checks and balances into the group.
[48:48.900 --> 48:53.100]  We try to not centralize in any one member.
[48:54.400 --> 48:57.280]  We requested multiple speakers for this talk.
[48:57.280 --> 49:00.940]  And also, at DEFCON, it's not just one person.
[49:03.960 --> 49:10.620]  Redundancy, if there's a task that only one person is doing, find other people who can also do that task.
[49:12.600 --> 49:13.120]  And...
[49:16.180 --> 49:17.080]  I don't know.
[49:18.120 --> 49:18.640]  What...
[49:18.640 --> 49:19.920]  Anything else?
[49:21.960 --> 49:23.420]  Without using four-letter words.
[49:23.600 --> 49:24.980]  No, I think this covers it.
[49:25.800 --> 49:29.080]  I think we have time for one more question and then we'll be hanging out outside.
[49:32.040 --> 49:37.620]  A lot of the decisions that you've described have been around the ethics of what you do and what you don't do.
[49:39.260 --> 49:47.220]  To me, I find this really surprising because my mental model of the world we live in is when you start messing with people who are powerful, they're going to come after you.
[49:47.920 --> 49:49.540]  And you haven't mentioned that at all.
[49:49.720 --> 49:56.500]  And so I'm curious about, like, how do you think about not getting arrested or not having evidence planted on you?
[49:56.700 --> 49:58.960]  Or, like, how do you stay safe?
[49:59.640 --> 50:01.300]  Is that not something you think about?
[50:01.960 --> 50:02.220]  Mm-hmm.
[50:03.540 --> 50:03.960]  Am I?
[50:06.180 --> 50:06.660]  Yeah.
[50:06.900 --> 50:10.580]  I mean, it's always a concern to a degree.
[50:12.740 --> 50:16.960]  But paranoia doesn't create safety.
[50:17.460 --> 50:23.220]  Screaming about bogeymen doesn't create safety.
[50:25.460 --> 50:30.420]  And talking about all the ways that people can screw you over doesn't create safety.
[50:30.420 --> 50:35.960]  What it creates is mental instability in yourself and in your supporters.
[50:38.080 --> 50:44.560]  You prepare for the things you can prepare for, and that's the best you can do.
[50:44.920 --> 50:48.080]  Sometimes you will have the rug pulled out from under you.
[50:49.020 --> 50:52.420]  You know, a server was seized in Germany.
[50:52.840 --> 51:01.480]  And we were once called criminal hackers by the Department of Homeland Security.
[51:02.260 --> 51:05.940]  But we got a good lawyer, and we were patient.
[51:06.380 --> 51:23.380]  And with a lot of research and the Freedom of Information Act, we were able to follow the trail of paperwork on that and basically debunk the Department of Homeland Security's story on how they got to that.
[51:23.380 --> 51:28.240]  And it's even more ludicrous than you might think.
[51:28.760 --> 51:30.560]  You can find that on Twitter.
[51:30.560 --> 51:34.740]  I got into that on Juneteenth, the two-year anniversary of Blue Leagues.
[51:35.520 --> 51:47.740]  Like Lorax mentioned, we were both singled out in the Bahamas Attorney General's ludicrous story about how things were supposedly hacked.
[51:47.880 --> 51:51.320]  They got all sorts of details wrong aside from mentioning us.
[51:52.280 --> 51:55.040]  People can always try to come after you.
[51:55.200 --> 51:59.620]  But if you let it stop you, nothing will ever get done.
[52:00.820 --> 52:04.120]  So, again, we prepare the best we can.
[52:04.660 --> 52:08.320]  And we're doing as much as we can.
[52:08.580 --> 52:10.900]  And we'll take this as far as we can.
[52:12.940 --> 52:17.620]  And one day, hopefully, we'll retire and someone else will fall.
[52:18.860 --> 52:20.700]  And keep going further.
[52:20.700 --> 52:23.940]  Hopefully, other people will pick up the ball while we're still doing this.
[52:23.940 --> 52:26.360]  Because we don't want to be the only ones doing it.
[52:27.160 --> 52:29.740]  Because there should be other models that are doing this.
[52:29.920 --> 52:32.440]  There should be more than just one target.
[52:34.480 --> 52:40.700]  But, you know, we're just going to do what we can as best we can for as long as we can.
[52:40.860 --> 52:43.040]  And whatever happens, happens.
[52:43.820 --> 52:47.800]  But, yeah, we're going to do it as ethically as we can.
[52:48.760 --> 52:50.380]  Because what's the alternative?
[52:52.880 --> 52:55.140]  Played by the rules that we're objecting to?
[52:57.140 --> 53:01.300]  It also helps to have transparency both internally, externally.
[53:01.700 --> 53:05.680]  And, like, because of how egalitarian the group is, there's a lot of solidarity.
[53:05.680 --> 53:08.940]  And I think a lot of us find solace in that.
[53:09.660 --> 53:11.580]  I think that provides safety, too.
[53:11.780 --> 53:12.000]  Yeah.
[53:12.200 --> 53:17.500]  Like, solidarity offered by others, like, in the space.
[53:17.780 --> 53:21.140]  This event is really exciting for me to come to.
[53:21.360 --> 53:32.200]  Because it's a place where I think that there's support for the idea of using hacked data and leaked data for research.
[53:32.200 --> 53:34.300]  So, thanks for having us.
[53:34.900 --> 53:35.680]  Thanks.