[00:00.940 --> 00:02.800]  So, we have a good talk coming up for you.
[00:03.020 --> 00:06.300]  We have Legal Practices as Infrastructure Attacks.
[00:07.020 --> 00:10.680]  And ladies and gentlemen, I'd like to present Alex Muentz.
[00:17.950 --> 00:19.260]  Ah, I love this talk.
[00:19.400 --> 00:25.660]  I give this ever so often, and I've modified it, and I promise it's actually a little bit updated because, you know, the law changes.
[00:26.540 --> 00:29.520]  I change too, but really just my sense of fashion.
[00:30.510 --> 00:32.600]  Okay, why am I giving this talk?
[00:33.700 --> 00:46.040]  Because your information, and really it's not just your information, it's the information that you may have been tasked to defend as a part of your job, as a part of whatever you happen to do with an organization.
[00:46.720 --> 00:50.780]  And it's vulnerable to things that you might not get.
[00:51.180 --> 00:59.500]  We all get, oh, I've locked down my box, it's safe, the data, it's only going to go to the people who are authorized to have it.
[01:00.180 --> 01:01.600]  And we think about those things.
[01:01.700 --> 01:04.360]  We think about it as like, okay, it's all corralled, it's all safe.
[01:04.580 --> 01:10.240]  The problem is there are other processes, legal processes, that will crack you open like a walnut.
[01:11.740 --> 01:17.700]  This all stems from a really, really drunken conversation at, well, at a hacker con.
[01:17.900 --> 01:19.500]  You know, those very rarely happen.
[01:19.500 --> 01:24.520]  And I just, people were talking about how secure their boxes were.
[01:24.620 --> 01:26.560]  And I just said, like, look, you know what?
[01:26.640 --> 01:34.980]  In ten minutes, I could have you, I could have all the information I want from your systems, and the best part is, I will make you help me find it.
[01:35.820 --> 01:38.360]  And I thought, and someone's like, that's a talk.
[01:38.440 --> 01:38.800]  I'm like, okay.
[01:38.800 --> 01:48.020]  So, your information is vulnerable to processes you aren't familiar with, and it's being handled by people who don't think like we do.
[01:48.200 --> 01:52.380]  Who assume, well, it has a password, therefore it's safe.
[01:53.200 --> 01:57.980]  Or, no one understands that system, so therefore the data is safe on it.
[01:57.980 --> 02:00.860]  And we, you know, we bristle instantly to that.
[02:00.980 --> 02:04.860]  Like, no, unless it's been audited, or unless I know exactly how it's stored.
[02:05.080 --> 02:06.160]  It's not safe.
[02:06.200 --> 02:07.540]  It's not safe until I say it is.
[02:07.580 --> 02:08.730]  And even then I'm still paranoid.
[02:10.010 --> 02:13.920]  The problem is that this data gets handed off to other people willy-nilly.
[02:15.760 --> 02:27.260]  What I'm hoping to do with this talk, explain roughly how the legal system works vis-a-vis your data, show you how to prepare for these as best you can.
[02:29.040 --> 02:34.980]  So, standard disclaimer, I am an attorney, just not your attorney.
[02:36.510 --> 02:37.980]  That can be remedied.
[02:40.050 --> 02:41.880]  This field of law is in flux.
[02:42.040 --> 02:44.880]  That's my standard disclaimer because, well, things change.
[02:45.430 --> 02:49.760]  The law is whatever a bunch of people in black robes say it is.
[02:51.960 --> 02:54.140]  That's a nice way of saying I may be wrong.
[02:55.430 --> 03:03.930]  So, kinds of attacks, kinds of approaches that legal people like me can take to try to get you to give us your data.
[03:04.770 --> 03:05.930]  First one is civil.
[03:06.150 --> 03:07.930]  This is for civil lawsuits.
[03:08.580 --> 03:16.740]  A and B wish to sue one another about something, and you have two paths to get someone to crack open their systems.
[03:16.740 --> 03:19.460]  You've got civil discovery, and you've got a subpoena.
[03:19.860 --> 03:26.710]  Then you've got criminal, search warrants, and related warrants, wiretap warrants, Stored Communications Act warrants.
[03:26.990 --> 03:32.550]  And third party, and I want to talk about that separately because it's been kind of why I updated this talk.
[03:33.640 --> 03:35.480]  So, what is discovery?
[03:36.080 --> 03:37.920]  It's the middle phase of litigation.
[03:38.710 --> 03:48.640]  First start is something we call a complaint and answer, which is kind of like when we solved problems with violence.
[03:49.100 --> 03:54.200]  And the way you would start a fight is you would show up and smack the other person in the face with a glove.
[03:54.550 --> 03:57.140]  Well, the legal approach to that is a complaint.
[03:57.940 --> 04:00.260]  I am suing you for the following reasons.
[04:00.820 --> 04:03.320]  And the answer, which is, oh yeah?
[04:03.520 --> 04:03.920]  Your mama.
[04:05.920 --> 04:06.400]  Discovery.
[04:06.740 --> 04:09.490]  It's usually in Latin, so it seems classier.
[04:10.640 --> 04:12.140]  Discovery is the middle step.
[04:12.300 --> 04:14.680]  And this is the one I want to talk about.
[04:14.920 --> 04:19.360]  It's information and gathering and sorting from both sides.
[04:19.520 --> 04:36.440]  Each side has to vomit up a certain amount of relevant information to give to the other side, because you're trying to figure out what can we actually show in the complaint and answer is true, so therefore a judge can rule on it and say, you're a douchebag,
[04:36.530 --> 04:37.760]  you owe the other side a lot of money.
[04:37.850 --> 04:39.700]  Or you don't owe the other side a lot of money.
[04:41.740 --> 04:45.830]  And it's also information gathering from both sides and other third parties.
[04:46.140 --> 04:50.530]  And then the third step, the last step, is presentation and settlement.
[04:51.700 --> 05:01.140]  So, trial, arbitration, you show the other side what you have and they decide, wow, they kind of proved their case and we've got nothing.
[05:01.330 --> 05:04.970]  And you go to your client, if you're a lawyer, and say, we've got to settle this.
[05:05.470 --> 05:07.680]  Because unless you want to continue paying me money.
[05:09.410 --> 05:11.680]  I usually actually say things like that.
[05:11.790 --> 05:12.500]  It's kind of a shock.
[05:13.270 --> 05:14.740]  So, discovery process.
[05:14.740 --> 05:23.960]  At the start, each party to the litigation has to identify and disclose the sources of potentially responsive ESI.
[05:24.090 --> 05:26.290]  ESI is electronically stored information.
[05:26.290 --> 05:28.420]  That's the Federal Rule Civil Procedure.
[05:29.580 --> 05:32.680]  That is broad as hell.
[05:34.340 --> 05:39.520]  Electronically stored information is not just emails and Word documents and PowerPoint decks.
[05:39.520 --> 05:42.380]  It is potentially raw data.
[05:42.660 --> 05:48.220]  I have seen cases where there were lawsuits over randomly generated data for signal testing.
[05:48.640 --> 05:50.440]  For, I'm sorry, for circuit testing.
[05:50.640 --> 05:52.500]  And one side sued for it.
[05:52.600 --> 05:57.160]  It's like, it was randomly generated data that went through the circuit and then went to dev null.
[05:57.740 --> 05:58.820]  And it's like, well, we want that.
[05:58.940 --> 06:00.480]  Like, it's random.
[06:00.840 --> 06:01.440]  You know?
[06:01.440 --> 06:03.920]  I can give you a lot of output at dev random.
[06:04.140 --> 06:05.920]  It'll be roughly the same.
[06:06.080 --> 06:06.260]  Like, no.
[06:06.380 --> 06:07.420]  We wanted the ones that you used.
[06:07.520 --> 06:10.220]  Like, it was deleted years ago.
[06:10.350 --> 06:11.790]  We never thought we would need to keep it.
[06:14.860 --> 06:18.520]  So, each party has to tell the other side, here's what we have.
[06:18.940 --> 06:21.180]  You don't have to guess necessarily hand over the information.
[06:21.420 --> 06:23.660]  You have to just say, these are the sources of information.
[06:25.940 --> 06:27.560]  And you have to preserve it.
[06:27.560 --> 06:32.140]  You have to prevent all that data once you know that the litigation is starting.
[06:32.800 --> 06:34.260]  Either you have been sued.
[06:34.520 --> 06:38.840]  You have gotten a letter from the opposing side saying, we have a problem.
[06:38.840 --> 06:42.540]  We are going to contemplate legal action.
[06:42.820 --> 06:45.560]  Something that says, oh, there's a problem.
[06:45.840 --> 06:48.100]  Or something really, really obvious.
[06:48.380 --> 06:53.960]  Like, that thing we built exploded for no apparent reason.
[06:54.120 --> 06:55.740]  Do you think this might end in litigation?
[06:56.380 --> 06:56.740]  Yeah.
[06:56.740 --> 07:03.180]  At that point, you have to now prevent any of the relevant information you hold from getting destroyed.
[07:03.500 --> 07:05.240]  How about accidental destruction?
[07:06.300 --> 07:07.860]  I will talk about that.
[07:09.740 --> 07:11.460]  So, first you have to preserve it.
[07:11.640 --> 07:20.480]  Then you have to compile it and put it in some kind of format that human beings can look at and go, is this actually useful to the litigation?
[07:20.760 --> 07:23.320]  Is this going to help us or hurt us?
[07:23.980 --> 07:28.360]  Would another side need to see this to figure out what actually happened?
[07:28.800 --> 07:35.200]  This sometimes gets really complicated because I would often get asked, well, I have a database file.
[07:35.280 --> 07:37.160]  How do I make this in a reviewable format?
[07:37.460 --> 07:39.960]  And sometimes they just blow it to a printer.
[07:39.960 --> 07:44.880]  So you have a 19,000-page document that's just the raw database file.
[07:47.360 --> 07:49.520]  It's kind of interesting what I do with that.
[07:49.520 --> 07:53.520]  If I'm billing by the hour, I review every page because I'm paid to do that.
[07:53.900 --> 07:56.080]  Or I don't do that anymore, thank God.
[07:56.080 --> 07:58.620]  But I've seen people clicking through.
[07:59.680 --> 08:01.260]  And it's really amazing.
[08:01.400 --> 08:10.620]  Like, I have a person, a human being, with a high IQ, who is looking at pages and pages and pages of literal crap.
[08:11.300 --> 08:13.280]  And yet they'll bill for it.
[08:15.260 --> 08:17.520]  So think about that when we talk about costs.
[08:17.520 --> 08:19.200]  Okay, so we have to compile it.
[08:19.340 --> 08:23.620]  We have to sort through it to find responsive stuff.
[08:23.940 --> 08:28.720]  This is stuff that happens to be related to the stuff we're suing over.
[08:29.140 --> 08:32.000]  So say, for example, two companies.
[08:32.080 --> 08:37.450]  A and B have a contract to license, to maybe do a cross-licensing of intellectual property.
[08:37.720 --> 08:39.140]  They sue over it.
[08:40.780 --> 08:45.140]  Everything that A and B have about that intellectual property is responsive.
[08:45.140 --> 08:51.140]  Everything they have to talk about about the contract and what their agreement is, that's responsive.
[08:51.520 --> 08:55.960]  Everything they've talked about about the contract to each other is responsive.
[08:56.900 --> 08:58.560]  It may not get presented in court.
[08:58.700 --> 08:59.920]  It's a much broader definition.
[09:00.160 --> 09:01.100]  It's really, really wide.
[09:01.320 --> 09:02.980]  It's anything that may lead to this.
[09:03.100 --> 09:10.320]  So stuff like information about a meeting where we're going to sit down and talk about what we're going to give the other party.
[09:11.160 --> 09:11.640]  Responsive.
[09:14.000 --> 09:16.420]  And you're sorting through it also to find things that are privileged.
[09:16.720 --> 09:21.340]  Things that, while they may be responsive, you don't necessarily have to divulge.
[09:21.900 --> 09:23.280]  Like attorney-client privilege.
[09:23.720 --> 09:25.460]  Some trade secrets are protectable.
[09:27.600 --> 09:30.260]  I'm trying to think of other examples and I can't off the top of my head.
[09:30.260 --> 09:36.740]  But you're sorting through these giant, giant, giant data sets looking for stuff that you have to give to the other side.
[09:37.440 --> 09:42.400]  And you're also, when you're doing this, you're looking through stuff that proves your side's case.
[09:43.240 --> 09:46.320]  While you're handling it like, okay, that's all the crap they get, but wait a minute.
[09:46.380 --> 09:52.840]  Is there anything we have that we want to wave around at a deposition or a trial or an arbitration that says, this proves we are right?
[09:54.280 --> 09:55.820]  So you're looking through that.
[09:59.430 --> 10:01.140]  So, discovery effects.
[10:01.140 --> 10:04.100]  It's a massive exfiltration of data.
[10:04.600 --> 10:07.260]  We're talking gigs and gigs and gigs.
[10:07.430 --> 10:15.710]  The reason why it's an exfiltration of data is, you are handing this stuff off to third party vendors to handle.
[10:16.460 --> 10:34.290]  For example, one of my subcontractors, his job is to go, when a litigation is filed, show up with a stack of USB hard drives and forensically capture the entire hard drives of people at companies.
[10:35.570 --> 10:37.290]  He now holds that data.
[10:38.860 --> 10:50.720]  He's a nice enough guy, he might be bonded, but you're handing all that stuff over to some guy who is like one step up from wearing a chambray shirt that says, like, you're a company's computer guy.
[10:53.210 --> 11:04.980]  And the best part is, he is going to hand it off to a vendor, what we call an e-discovery vendor, who is going to convert all the documents there into TIFFs or PDFs.
[11:04.980 --> 11:05.900]  Everything.
[11:06.140 --> 11:10.790]  Every email, every Word document, every text file.
[11:11.420 --> 11:25.240]  And if they don't parse it right, I've seen people take the entire contents of hard drives, and you're reading Java classes that have been turned into PDFs, and you're looking through going, this is a Java class, why didn't they parse for this?
[11:25.700 --> 11:26.980]  It's like, oh, it might be responsive.
[11:27.120 --> 11:27.420]  No!
[11:27.820 --> 11:29.100]  We're not suing Sun.
[11:29.400 --> 11:30.670]  It's not useful.
[11:31.640 --> 11:32.580]  How do you know?
[11:32.720 --> 11:35.600]  Like, it's, please, trust me.
[11:36.080 --> 11:48.380]  And going through, and usually when you're doing these giant, giant data socks, you get to read through, you get to see all the stuff that's on this user's PC.
[11:48.380 --> 11:52.480]  Now, think of all the cruft that is on your machine.
[11:52.680 --> 11:54.340]  Because I think of all the cruft that's on mine.
[11:54.400 --> 11:55.420]  Because you do what I do.
[11:55.480 --> 12:03.480]  You buy a new machine, and you copy everything that was on the old hard drive over to your new home directory, again and again and again.
[12:04.390 --> 12:10.080]  And sometimes when you do a copy, you just look at the file names and go, oh, Jesus, that's where all that porn went.
[12:10.800 --> 12:13.100]  Sorry, that's where those client files went.
[12:14.240 --> 12:16.540]  But think of, like, think of your users.
[12:16.740 --> 12:22.940]  If those of you who are in, like, customer-facing IT, think of all the stuff you've found on user's PCs.
[12:23.600 --> 12:29.790]  That gets sucked down and dumped to an eDiscovery vendor who takes all that stuff and blows it to PDF.
[12:29.790 --> 12:40.240]  So all that JPEG and GIF porn is now converted to PDF and is searchable for text, if there is text in it, at some cost.
[12:40.240 --> 12:42.800]  But it's handed off to a third party.
[12:42.980 --> 12:45.580]  And how do we select that third party?
[12:47.670 --> 12:49.720]  Answer, the lowest bidder.
[12:51.460 --> 13:00.640]  So it's three guys with a pirated copy of Law 5.0 to convert this crap into PDFs for searching.
[13:01.040 --> 13:01.740]  Awesome.
[13:02.060 --> 13:03.200]  You don't even know.
[13:03.360 --> 13:27.100]  You, as your InfoSec people, generally don't know who that provider is because legal shows up and says, this guy who has, you know, three fingers in one hand because he used to be a shop teacher, but he understands how NCASE works good enough, that he is going to go to your CFO and take the entire contents of their hard drive.
[13:27.940 --> 13:29.600]  How scary is that?
[13:31.800 --> 13:32.900]  Not that scary?
[13:33.100 --> 13:33.290]  Okay.
[13:33.880 --> 13:40.560]  And I remember having this conversation sitting at someone's desk, and it was a CFO for like a Fortune 1000 company.
[13:40.720 --> 13:50.100]  I'm like, you know, I showed up, I'm wearing a suit, I have a hard drive, and I showed you a business card.
[13:50.260 --> 13:50.920]  Well, why?
[13:51.100 --> 13:52.340]  Why wouldn't that be a problem?
[13:52.480 --> 13:54.100]  Like, oh.
[13:54.720 --> 13:59.600]  If there's an InfoSec person within like a hundred feet, and if I just said that, like, yeah, how do we vet you?
[13:59.600 --> 14:02.180]  I'm like, I have a business card, because that's like proof of me.
[14:02.680 --> 14:03.180]  You know?
[14:04.100 --> 14:04.980]  I have a suit.
[14:05.180 --> 14:07.740]  I'm clearly trustable, right?
[14:08.340 --> 14:09.960]  I'm just, you know, taking all your data.
[14:10.120 --> 14:10.540]  It's okay.
[14:11.200 --> 14:12.760]  And they're like, oh, we don't want you to steal anything.
[14:12.880 --> 14:13.940]  Oh, yeah, I'm not stealing anything.
[14:14.120 --> 14:14.520]  You're right.
[14:14.790 --> 14:18.260]  All the pencils and pens, they're going to stay where they are.
[14:19.760 --> 14:24.360]  Oh, by the way, sorry, I need the password to get into your Lotus Notes file, because I need to decrypt it.
[14:24.560 --> 14:25.140]  Oh, okay.
[14:26.860 --> 14:29.260]  It's like, you're completely trusting.
[14:29.380 --> 14:30.360]  Well, why would you do that?
[14:30.460 --> 14:36.170]  Like, my God, this is such a security hole, because I said I'm from the legal department.
[14:36.560 --> 14:37.920]  All of a sudden, you trust me.
[14:41.220 --> 14:43.120]  So, other exfiltration data.
[14:43.300 --> 14:43.800]  The exhibits.
[14:43.980 --> 14:53.260]  The documents that you pick out of this giant data stream sometimes become public documents.
[14:53.260 --> 14:55.620]  This is sometimes really embarrassing.
[14:55.860 --> 15:11.600]  There's a case, it came up a couple of weeks ago, where someone put a bunch of trade secrets inadvertently in a motion, which then went onto PACER, which is the docketing system for the entire federal court.
[15:11.860 --> 15:13.920]  PACER documents are public.
[15:14.300 --> 15:16.540]  You don't have to be an attorney to have a logon.
[15:16.540 --> 15:18.120]  You can just say, I want a logon.
[15:18.680 --> 15:22.840]  And you can search through these, and sometimes you find really ridiculous stuff.
[15:23.170 --> 15:26.000]  Because someone didn't think, well, that's not public.
[15:26.140 --> 15:26.540]  Like, yes.
[15:26.790 --> 15:28.290]  It's absolutely public.
[15:28.680 --> 15:34.560]  Many people, in fact, will dump PACER and then just make it Google-able, because it's easier than using the search function in PACER.
[15:35.000 --> 15:36.760]  And it's like, oh, well, how's that?
[15:36.880 --> 15:38.380]  This is all secret.
[15:38.700 --> 15:39.100]  No.
[15:39.760 --> 15:43.260]  Then again, I've also had a client who's like, oh, you can't show this complaint to anybody.
[15:43.360 --> 15:44.600]  Like, it's public.
[15:44.920 --> 15:46.700]  Well, we want to keep it secure.
[15:48.040 --> 15:48.840]  It's public.
[15:49.320 --> 15:51.580]  Like, here, I've downloaded it.
[15:51.680 --> 15:51.960]  See?
[15:52.080 --> 15:53.500]  It's not a secret anymore.
[15:54.120 --> 15:55.170]  Who knows about this?
[15:55.240 --> 15:58.100]  Like, everyone who practices in the federal courts, we have to.
[15:58.100 --> 16:02.760]  So, exhibits are public documents, and sometimes they're really embarrassing ones.
[16:04.000 --> 16:08.800]  Other downside, or other effective discoveries, it's expensive to do.
[16:09.290 --> 16:10.640]  I'll explain why.
[16:11.220 --> 16:15.200]  Go through and take the entire contents of your hard drive.
[16:16.000 --> 16:19.720]  Maybe that's 250,000 to 500,000 documents.
[16:21.180 --> 16:27.860]  Now, imagine we've converted them to PDF, and you read each document to figure out what it is.
[16:29.280 --> 16:31.100]  Who is reading that document?
[16:32.040 --> 16:39.840]  An attorney, billing 14 to 16 hours a day, reading through those documents.
[16:40.600 --> 16:43.480]  How expensive now is that one terabyte hard drive?
[16:46.600 --> 16:47.680]  It's amazing.
[16:47.680 --> 16:59.640]  I've watched burn rates of a million dollars a month on a mid-sized litigation, and I'm like, when is the client going to go, we've got to settle, because we're vomiting money at each other.
[16:59.720 --> 17:07.360]  And I realize, like, most big-sized civil litigation is like playing chicken, except you just have bundles of $100 bills, and you set them on fire and go, oh yeah?
[17:07.600 --> 17:09.340]  I've got two on fire, bitches!
[17:11.290 --> 17:14.680]  And initially, I look at that and go, my god, this is awful.
[17:14.680 --> 17:16.940]  But then again, like, I get some of that.
[17:17.100 --> 17:20.460]  Like, my job is like, okay, yeah, your job is to burn the $100 bills.
[17:20.640 --> 17:22.620]  But you can take a few off the top of the stack.
[17:22.730 --> 17:24.490]  Like, okay, yeah, you should burn some more, man.
[17:25.990 --> 17:28.820]  Can I go into this crate now and burn those?
[17:28.840 --> 17:29.460]  Like, ah, not yet.
[17:30.210 --> 17:32.400]  And it's amazing, because you get someone who's angry.
[17:33.030 --> 17:37.270]  You get some CEO who's like, I'm going to litigate this to the Supreme Court.
[17:37.270 --> 17:39.730]  Like, and there's a part of me like, this is ridiculous.
[17:39.880 --> 17:43.270]  On the other hand, I have a mortgage, and I have student loans.
[17:43.400 --> 17:47.120]  I'm like, yeah, you should take that all the way to the Supreme Court, and I'll do it.
[17:47.250 --> 17:51.120]  But it's money wasted, except that I get some of it.
[17:52.840 --> 17:54.300]  So, I'm biased here.
[17:55.320 --> 17:58.320]  So, it's time-consuming to collect and assemble.
[17:58.640 --> 17:59.750]  This takes time.
[17:59.880 --> 18:00.680]  It's grueling.
[18:00.680 --> 18:12.080]  And you're reviewing it by attorneys who are sitting in dank, airless rooms, angry, because their job is to review these documents.
[18:12.990 --> 18:14.420]  It's really expensive.
[18:15.140 --> 18:16.580]  I need to make that clear.
[18:17.140 --> 18:18.540]  So, discovery defenses.
[18:19.060 --> 18:24.510]  How do you protect your organization from this awful, awful attack?
[18:25.200 --> 18:26.230]  And there's two.
[18:26.300 --> 18:35.730]  I'm going to split this out into legal ones, so you understand what the lawyers are doing or not doing, and then what you can do in the IT and InfoSec departments of your organization.
[18:36.300 --> 18:41.290]  So, a legal approach is what we innocently call a document retention policy.
[18:42.080 --> 18:46.100]  How many of you just kind of felt that your soul left your body when I said that?
[18:47.300 --> 18:50.530]  This is actually... and I'm writing these now.
[18:50.680 --> 18:52.270]  And they're actually a lot of fun.
[18:52.400 --> 18:53.120]  Well, for me.
[18:53.840 --> 18:54.660]  I... yeah.
[18:56.010 --> 19:03.010]  The advantage is, the document that doesn't exist cannot bite you in the ass.
[19:04.940 --> 19:08.360]  As Brad said earlier, what if the documents get lost?
[19:08.680 --> 19:11.600]  What if you are allowed to destroy them?
[19:11.990 --> 19:20.990]  So, that one where someone wrote an email about... and think of all the embarrassing things your users say in email.
[19:21.890 --> 19:24.060]  All the really ridiculous things.
[19:24.200 --> 19:28.490]  Did you catch the rack on the new associate on 13B?
[19:29.230 --> 19:34.600]  Did you... you know, oh my god, the... you know, we completely mangled that project.
[19:35.360 --> 19:38.800]  Oh, by the way, maybe we should reinforce the bumper of the Pinto.
[19:39.100 --> 19:40.620]  I mean, it's only a nickel.
[19:41.410 --> 19:43.860]  People write ridiculous things.
[19:44.530 --> 19:48.620]  One litigation I was on, it was a software litigation.
[19:48.960 --> 19:52.990]  And one person admitted, you know, we've never done this before.
[19:53.200 --> 19:57.750]  We should... we should stop the salespeople from saying we've rolled these out successfully.
[20:00.390 --> 20:08.180]  And I look at that and go, on one hand, yay me, I found the... I found the big glaring document.
[20:08.180 --> 20:10.400]  The problem is it was our client who said that.
[20:10.540 --> 20:14.080]  It's like, well, we found a really interesting document.
[20:14.080 --> 20:17.010]  The problem is, is it kind of is a nail in your coffin.
[20:17.600 --> 20:28.860]  On the other hand, it's better that you know about it now than us just clicking through it and handing to their side and the other side just like blindsiding you with it at a deposition at four in the afternoon.
[20:29.030 --> 20:30.380]  You're like, did you write that?
[20:30.460 --> 20:31.460]  Oh yeah, I guess I did.
[20:31.900 --> 20:35.640]  What does completely screwed the pooch, we f*cked them over mean?
[20:35.640 --> 20:39.530]  It was a colloquial term from upstate New York.
[20:39.640 --> 20:41.730]  It means we look forward to doing business with you.
[20:42.340 --> 20:44.400]  You want to be able to spin that before it happens.
[20:44.660 --> 20:46.840]  But reading this, it's like...
[20:47.400 --> 20:51.030]  So if you can destroy the document legally, it's a nice thing to do.
[20:51.200 --> 20:58.320]  So if you write a document retention policy, it says, any document over a certain date, unless litigation is filed, can be destroyed.
[20:58.320 --> 21:00.750]  So that way you know what's put to bed.
[21:03.770 --> 21:14.600]  Also, once litigation is filed, sometimes you can negotiate down the scope of the data because each side is also looking at this and they don't want the massive data dump to be handed over to them.
[21:15.030 --> 21:25.640]  Because, like I said, the analogy with burning $100 bills, at the end, okay, we found 1.2 million documents that we're not going to hand to your lawyers, and they're going to look through them.
[21:26.200 --> 21:28.030]  The burning continues.
[21:28.960 --> 21:31.160]  Because now they've got to go through all your...
[21:31.160 --> 21:35.040]  You know, the other side's got to go through all your shit and go, is this useful?
[21:35.200 --> 21:37.560]  No, no, no, no.
[21:38.140 --> 21:41.030]  And given your users, how many times...
[21:41.030 --> 21:46.560]  How many times have you seen users download the same attachment over, and over, and over, and over, and over again?
[21:46.820 --> 21:47.700]  I have.
[21:47.860 --> 21:50.740]  Where you see 18 copies of the same document.
[21:52.120 --> 21:53.920]  Someone reviewed all 18.
[21:56.190 --> 22:08.320]  So, like that document, that one-page document about, you know, appropriately funding the coffee fund cost, like, $18,000.
[22:09.080 --> 22:12.780]  Because so many attorneys had to look through that again and again and again.
[22:13.520 --> 22:15.060]  So, negotiate scope down.
[22:15.180 --> 22:16.720]  Figure, like, this stuff isn't relevant.
[22:16.920 --> 22:17.700]  This stuff isn't.
[22:17.800 --> 22:20.560]  These people, we don't need to scour their hard drives.
[22:22.980 --> 22:29.440]  If you can argue that something is just, like, your demand is ridiculous, let's narrow the scope of it.
[22:29.620 --> 22:30.080]  Awesome.
[22:30.080 --> 22:35.000]  And also, you can say things like, a lot of the data you want is not readily accessible.
[22:35.460 --> 22:38.200]  It is in some kind of hard-to-get format.
[22:39.220 --> 22:40.840]  Like, it's obsolete.
[22:41.820 --> 22:42.440]  You know.
[22:43.180 --> 22:51.340]  And sometimes this is my job, which is, turns out that the company used Claris Works as their...
[22:51.340 --> 22:52.400]  Because it was cheaper.
[22:52.620 --> 22:54.940]  And you're like, how do we blow that to PDF?
[22:55.140 --> 22:57.480]  I'm like, let me get back to you.
[22:57.480 --> 22:57.860]  You know.
[22:57.940 --> 23:00.260]  I'm going to, like, an old, old-school Mac shop.
[23:00.440 --> 23:00.760]  Like, yeah.
[23:00.940 --> 23:02.920]  I need a Mac SE with Claris Works.
[23:03.460 --> 23:03.820]  Really?
[23:04.240 --> 23:04.600]  Yeah.
[23:05.260 --> 23:05.840]  Yeah, I do.
[23:06.930 --> 23:09.000]  In fact, I need five.
[23:11.800 --> 23:14.660]  And it's awesome, because I get to, like, I used to play with that stuff.
[23:14.660 --> 23:15.920]  So I'm, like, on eBay.
[23:16.160 --> 23:17.420]  Or calling up old sysadmins.
[23:17.520 --> 23:17.720]  Like, yeah.
[23:17.940 --> 23:19.680]  Do you have any eight-millimeter tape drives?
[23:20.260 --> 23:20.580]  Why?
[23:21.220 --> 23:22.380]  Just, do you have any?
[23:22.720 --> 23:23.040]  Sure.
[23:23.800 --> 23:25.080]  I'll buy them all from you.
[23:25.200 --> 23:26.600]  Because I figure one will work.
[23:26.700 --> 23:27.620]  And I'm setting this up.
[23:27.680 --> 23:29.780]  And, like, it means I don't have to review those documents.
[23:29.940 --> 23:30.760]  And I'm like, oh, wow.
[23:30.800 --> 23:33.020]  I could dork out with some ancient technology.
[23:33.780 --> 23:35.220]  And at the end, it's like, yeah.
[23:35.440 --> 23:46.660]  I managed to convert those Claris work documents via, you know, like, Mac Exchange 2.0 from 1993 into a text file that you could now review.
[23:46.760 --> 23:47.460]  And it's like, you're a genius.
[23:47.600 --> 23:47.940]  Like, no.
[23:48.120 --> 23:51.920]  It's just I have all the trivia from, like, old Mac shops.
[23:52.480 --> 23:59.800]  You know, like, and you get, like, you know, I remember getting a stack of 800k Mac floppies.
[23:59.800 --> 24:01.400]  I'm like, I know how to do this.
[24:02.690 --> 24:03.000]  Eh.
[24:03.640 --> 24:03.960]  Eh.
[24:04.450 --> 24:04.760]  Eh.
[24:04.760 --> 24:04.840]  Eh.
[24:04.960 --> 24:06.160]  And just, like, sticking in and out.
[24:06.240 --> 24:07.580]  I'm like, and I'm billing.
[24:08.480 --> 24:09.380]  I'm going through it.
[24:09.480 --> 24:10.060]  I'm reading this.
[24:10.220 --> 24:13.340]  And it's like, and they're like, how did you know how to do that?
[24:13.400 --> 24:16.440]  Like, yeah, it's Mac.
[24:16.560 --> 24:17.380]  I remember this stuff.
[24:17.600 --> 24:19.060]  But, like, getting, like, crazy stuff.
[24:19.080 --> 24:19.660]  And I loved that.
[24:19.720 --> 24:22.940]  And, like, that was more, because that's more fun than actually being a lawyer.
[24:23.060 --> 24:29.120]  It's like, I've got a problem now that no one can fault me because I took a different path.
[24:29.120 --> 24:31.860]  Because, like, no one else is going to touch that goddamn thing.
[24:33.520 --> 24:38.760]  It's also really fun when you call up a Mac shop and go, I actually need a board from a Mac SE.
[24:38.840 --> 24:40.000]  Because mine just fried.
[24:40.400 --> 24:42.180]  And it's actually, like, real money.
[24:42.280 --> 24:43.120]  Like, oh, it's not economic.
[24:43.360 --> 24:47.040]  Like, dude, it's a $22 million litigation.
[24:47.040 --> 24:48.920]  I need a Mac SE.
[24:49.360 --> 24:50.340]  I will pay.
[24:50.500 --> 24:51.300]  Like, we'll rent one.
[24:51.420 --> 24:52.000]  Like, how much?
[24:52.240 --> 24:52.920]  I don't know.
[24:53.060 --> 24:54.920]  I'm like, how about $100 a day?
[24:55.400 --> 24:55.800]  Really?
[24:56.180 --> 24:56.580]  Yeah.
[24:56.840 --> 24:57.840]  Like, it's not my money.
[24:57.940 --> 24:58.760]  It's a client's money.
[24:59.020 --> 24:59.860]  I'll rent it.
[24:59.980 --> 25:00.860]  I'll rent a Mac.
[25:00.940 --> 25:06.500]  If you can guarantee the sucker works, because at the end of it, I get actually useful data.
[25:06.500 --> 25:11.380]  And that, I knew that that was a Mac SE would work and not an LC.
[25:12.360 --> 25:12.880]  Like...
[25:13.460 --> 25:13.980]  Okay.
[25:14.640 --> 25:15.440]  So, not really...
[25:15.440 --> 25:21.120]  You can say, we don't need Alex to be dicking around with old Mac junk to get those few pieces of data.
[25:21.220 --> 25:22.660]  Just say they don't exist anymore.
[25:22.900 --> 25:24.260]  They are effectively gone.
[25:24.960 --> 25:26.520]  The technical approach.
[25:27.820 --> 25:31.800]  I mentioned that you can have this legal concept called a document retention policy.
[25:31.920 --> 25:35.380]  It says, every document over 90 days gets deleted, no matter what.
[25:35.380 --> 25:39.240]  So, that way you can say, we only have 90 days worth of data.
[25:39.520 --> 25:40.480]  You sued us today.
[25:40.520 --> 25:42.680]  We only have to go back a quarter.
[25:43.930 --> 25:46.180]  We don't have to talk about stuff previous.
[25:47.190 --> 25:56.540]  The problem is, is that you get a paper document that says, all data over 90 days, you shouldn't have.
[25:57.280 --> 26:00.140]  How many of your users are going to follow this?
[26:03.900 --> 26:04.460]  Okay.
[26:04.760 --> 26:06.440]  Both of them may.
[26:07.120 --> 26:14.800]  Or, knowing your users, that means that the documents get printed and put in a binder somewhere.
[26:16.760 --> 26:17.760]  I've done...
[26:17.760 --> 26:18.720]  I've seen that.
[26:18.960 --> 26:21.600]  Because I remember one company like, oh, we're so smart.
[26:21.600 --> 26:23.780]  We have a 30-day document retention policy.
[26:23.920 --> 26:29.880]  And it's like, you know, that's about as dumb as requiring, you know, epic past poems.
[26:30.120 --> 26:31.060]  Like, oh, it's so secure.
[26:31.160 --> 26:31.560]  Like, no.
[26:31.740 --> 26:33.500]  It just means it's on a f*cking Post-it note.
[26:33.980 --> 26:34.260]  You know?
[26:34.360 --> 26:35.180]  It's the same approach.
[26:35.260 --> 26:36.200]  Like, oh, we have a 30-day...
[26:36.200 --> 26:40.660]  Which means you have stacks and stacks and stacks of paper documents that were printed.
[26:41.950 --> 26:44.600]  And that means you've just tripled your cost.
[26:44.780 --> 26:55.720]  Because now, instead of having an easily greppable electronic document, you have a printed document that some schmuck has to stick on a scanner and OCR it.
[26:56.760 --> 27:02.020]  And if they're a little twitchy, that OCR comes out as, you know...
[27:02.640 --> 27:04.280]  Because it'll OCR it.
[27:04.340 --> 27:11.020]  It'll OCR it horribly wrong, which means you have some poor other schmuck, some poor lawyer going, I think it's that.
[27:12.240 --> 27:13.700]  This would take me a long time.
[27:13.820 --> 27:14.680]  And they're blowing it up.
[27:14.720 --> 27:25.380]  And it's like, so it took you 45 minutes to read that Claris Works document that some asshole printed five years ago when it, if you just kept it to electronic, would have been like greppit.
[27:25.520 --> 27:25.700]  Nope.
[27:25.960 --> 27:26.400]  Nothing there.
[27:26.680 --> 27:27.120]  Next.
[27:27.320 --> 27:27.960]  But no.
[27:28.160 --> 27:29.480]  Someone had to get tricky.
[27:29.480 --> 27:38.340]  But a technical approach, if you can actually make it happen, sorry, the life of that document has passed its document retention policy, it go bye-bye.
[27:39.800 --> 27:41.080]  Really, really useful.
[27:41.380 --> 27:46.200]  It's also, though, one of these the technical department has to look at.
[27:47.130 --> 27:53.600]  How many people have a basement in their shop that has old, old machines?
[27:54.320 --> 27:55.260]  All of you.
[27:55.500 --> 27:57.420]  What's on those old machines?
[28:00.240 --> 28:02.360]  Well, actually the answer is, I don't know.
[28:02.840 --> 28:03.240]  Stuff.
[28:04.460 --> 28:05.480]  Why do you keep them?
[28:05.560 --> 28:06.700]  I might need the part.
[28:06.860 --> 28:07.660]  Because God forbid.
[28:08.200 --> 28:12.400]  Oh no, we need the 386 because there's a part to it that we might need.
[28:12.600 --> 28:13.280]  And I get it.
[28:13.400 --> 28:13.760]  You know, it's, you know.
[28:14.800 --> 28:20.180]  On this episode of A&E's Hoarders Technology Edition, we go to Bob.
[28:20.180 --> 28:22.900]  Bob is a eunuch sysadmin with a four-foot beard.
[28:24.700 --> 28:26.740]  You can't take that spark station!
[28:27.140 --> 28:28.080]  I might need it!
[28:29.080 --> 28:30.940]  And, you know, who am I to say that?
[28:31.020 --> 28:33.420]  Because I may have a spark station in my basement.
[28:34.000 --> 28:35.520]  So, it might be me.
[28:35.580 --> 28:36.660]  I just don't have the beard anymore.
[28:38.320 --> 28:42.220]  So, to actually think of the document retention policy as also old machines.
[28:43.400 --> 28:52.860]  And, sometimes you can convince, well, I've tried to convince some people that the best way to get rid of old data is to actually physically destroy the drive.
[28:52.860 --> 28:58.060]  And, the best way to destroy a drive, as we all well know, is a Mosin-Nagant.
[29:03.990 --> 29:05.830]  Or, if you like American stuff, too.
[29:05.950 --> 29:07.570]  I'm not, you know, you know, it's just, it's cheaper.
[29:11.350 --> 29:19.670]  Okay, also, though, the other way you can reduce costs and protect your company is the ability to preserve, identify, and search all this stuff.
[29:21.150 --> 29:21.870]  It's amazing.
[29:22.610 --> 29:31.910]  When I started talking to people about doing project management for these big litigations, because I was also a tech geek, was, well, what tools are you using?
[29:31.950 --> 29:33.030]  I'm like, grep?
[29:33.590 --> 29:35.890]  You know, you want to, I want to search a lot of shit.
[29:36.170 --> 29:36.570]  Grep?
[29:36.930 --> 29:38.250]  Well, what about other tools?
[29:40.650 --> 29:41.050]  Grep?
[29:42.850 --> 29:44.390]  Like, that works, right?
[29:45.170 --> 29:50.650]  You know, like, oh, there are industrial tools that do that, but it's a text file, right?
[29:50.650 --> 29:52.970]  Or, you know, a bunch of text files in a directory.
[29:53.150 --> 29:56.350]  Like, I'm sure there are tools that have nice graphic interfaces, but...
[29:56.990 --> 29:58.210]  It's like, well, why don't you use any of those?
[29:58.270 --> 29:59.530]  Like, I haven't needed to yet.
[30:00.190 --> 30:02.830]  When you do, like, I'll play with them, but...
[30:02.830 --> 30:04.590]  And they're like, well, why would you just use that?
[30:04.690 --> 30:07.510]  Like, because I've not ever hit a need where I've needed something else.
[30:08.550 --> 30:11.330]  And that's, like, a magic to, like, regular lawyers.
[30:11.450 --> 30:13.770]  Like, so you can search over multiple directories?
[30:17.110 --> 30:17.470]  Yeah.
[30:18.110 --> 30:20.210]  Well, wait a minute, but we have multiple systems.
[30:20.210 --> 30:25.650]  We've got these UNIX boxes, and we've got these Windows servers, and these Mac servers.
[30:25.850 --> 30:27.470]  And, like, I have an OS X box.
[30:27.570 --> 30:28.190]  It mounts all of them.
[30:28.270 --> 30:28.950]  Just grep.
[30:29.530 --> 30:30.610]  Well, what's it do at the end?
[30:30.770 --> 30:34.050]  That directory is all the documents that fit those search terms.
[30:34.150 --> 30:35.110]  Like, well, how do you know?
[30:35.290 --> 30:37.690]  Like, uh...
[30:37.690 --> 30:40.690]  And I'm still, like, I keep on repeating, like, grep.
[30:40.850 --> 30:42.990]  And, like, that's some, like, magical talisman.
[30:43.430 --> 30:44.470]  But, like, trust me.
[30:44.730 --> 30:45.450]  That's how it worked.
[30:45.570 --> 30:46.830]  Well, why don't you use these other tools?
[30:46.830 --> 30:48.770]  Like, they wouldn't work on the Mac on my desk.
[30:49.770 --> 30:50.450]  That worked.
[30:50.630 --> 30:51.150]  Like, there you are.
[30:51.450 --> 30:51.810]  There's...
[30:51.810 --> 30:52.790]  Burn it to a DVD.
[30:53.050 --> 30:53.450]  Take that.
[30:53.570 --> 30:54.890]  That's all the discovery you need.
[30:55.070 --> 30:55.330]  Done.
[30:55.690 --> 30:57.390]  I'm gonna go, you know, go home now.
[30:58.750 --> 30:59.110]  Um...
[30:59.110 --> 31:03.470]  But the ability to do that, the ability to say at the end, here's your stuff that you needed.
[31:03.850 --> 31:04.210]  Done.
[31:04.850 --> 31:05.750]  I certify that.
[31:05.850 --> 31:07.370]  Of course, that was a litigation that...
[31:07.370 --> 31:11.370]  I also then did a search against all of our, uh, index files for our backups.
[31:11.790 --> 31:18.630]  And I signed this affidavit that says, like, I promise to give you my firstborn, my soul, and my left nut if I'm wrong.
[31:21.010 --> 31:21.990]  I signed that.
[31:22.110 --> 31:23.470]  This is before I became a lawyer.
[31:23.670 --> 31:24.450]  And I send that off.
[31:24.550 --> 31:25.530]  And I'm like, nah, I'm done.
[31:25.710 --> 31:26.810]  That litigation thing.
[31:26.850 --> 31:28.450]  I get to go do another project.
[31:28.450 --> 31:34.130]  And some guy wearing a coverall shows up with two rent-a-crates full of DLTs.
[31:34.210 --> 31:36.270]  And says, oh, I heard you were looking for stuff.
[31:36.990 --> 31:38.730]  And there's nothing like a sinking feeling.
[31:38.890 --> 31:43.290]  Like, I just certified, like, my left nut that I searched all the data.
[31:43.510 --> 31:45.070]  What the f*ck are these rent-a-crates?
[31:45.190 --> 31:50.210]  And they're filled with DLTs that have things like Blue Backup 3.
[31:50.570 --> 31:52.670]  And that's, like, no scheme that I know of.
[31:52.690 --> 31:53.790]  And I've been working there for two years.
[31:53.810 --> 31:55.850]  I'm like, I have no idea what this shit is.
[31:57.610 --> 32:02.410]  And I've never been so thankful when I found that they were stored in dead storage.
[32:02.650 --> 32:07.170]  Dead storage that the pharma company I was at was above an NMR machine, which is a big MRI.
[32:07.630 --> 32:09.830]  And I was like, score!
[32:10.490 --> 32:11.790]  Oh, the data's gone!
[32:11.970 --> 32:13.730]  How can you know?!
[32:14.830 --> 32:18.530]  I was like, thank God they were stored there!
[32:18.910 --> 32:19.370]  Like, wow!
[32:19.530 --> 32:24.170]  Like, they've been sitting over a decalcer of God for two years!
[32:25.010 --> 32:25.610]  Yes!
[32:26.650 --> 32:29.270]  Like, because there's nothing like the sinking feeling.
[32:29.450 --> 32:31.830]  I just open these crates like, holy shit!
[32:32.530 --> 32:35.630]  I'm going to be racking tapes for two months.
[32:35.630 --> 32:42.130]  After I explained to corporate counsel that affidavit, it's what we call a lie.
[32:42.670 --> 32:44.830]  You know, I thought I didn't know about these.
[32:45.310 --> 32:47.110]  And after that, like, oh, they've been stored over that.
[32:47.290 --> 32:47.470]  Ah!
[32:48.610 --> 32:49.490]  Never even told her.
[32:49.610 --> 32:51.050]  She's like, oh, yep, done, yep, yep.
[32:51.870 --> 32:54.890]  And just told the guy on the cover, like, take those away.
[32:55.370 --> 32:55.730]  Where?
[32:56.790 --> 32:57.510]  Don't care.
[32:58.590 --> 32:59.310]  Just gone.
[33:00.130 --> 33:06.150]  I wrote another affidavit that said, all the, anything else was destroyed per the document retention policy.
[33:06.810 --> 33:07.370]  That was good.
[33:09.430 --> 33:11.350]  Also, okay, back to the technical approach.
[33:11.850 --> 33:17.910]  Knowing, if you think of, like, user access rules, know which employees have access to what.
[33:18.090 --> 33:26.570]  Because imagine you've got some litigation where they name fifteen people that have access to the data that is important to this litigation.
[33:26.570 --> 33:29.170]  You want to know where they might have stored that.
[33:29.690 --> 33:40.590]  Now, of course, because they've moved around, and we've all found that one server, that one work group used, and you find it, like I did once, where it was behind a panel of Sheetrock.
[33:41.090 --> 33:44.950]  Because the electrician walks in and goes, it's got an Apple logo, it must be yours.
[33:45.110 --> 33:48.530]  And they pull the Sheetrock away, and there's an Apple work group server.
[33:49.230 --> 33:50.890]  I'm like, oh, my God.
[33:51.110 --> 33:55.690]  It's been sitting there for, like, five, for three years since you Sheetrocked this office.
[33:56.170 --> 33:57.530]  And it's still alive.
[33:58.230 --> 34:03.150]  And the worst part is the transceiver, the AAUI transceiver, is blinking.
[34:03.450 --> 34:04.770]  So something's hitting this.
[34:04.910 --> 34:07.890]  I'm like, I have no idea what the hell this is.
[34:07.990 --> 34:11.210]  So, of course, I did what you're supposed to do in this case.
[34:11.310 --> 34:14.290]  You unplug it and wait for someone to phone and call and go, I'm broken.
[34:14.410 --> 34:15.730]  Like, ah, you're a machine.
[34:22.650 --> 34:24.850]  So, know who has access to what.
[34:24.950 --> 34:29.190]  Because I don't want to have to be that guy now as the lawyer going, and grilling an IT guy.
[34:29.310 --> 34:31.270]  It's like, well, what about, you know, is there any other possibility?
[34:31.410 --> 34:31.610]  No.
[34:31.790 --> 34:38.130]  And then having him go, well, there's this, there's this P2 that has a drive.
[34:38.470 --> 34:39.410]  I don't know what's on it.
[34:40.070 --> 34:40.710]  Where is it?
[34:40.850 --> 34:44.290]  Ah, it's in a shed with an Ethernet cable strung to it.
[34:44.750 --> 34:46.090]  Well, how do you know it's still alive?
[34:46.210 --> 34:46.950]  Like, it's blinking.
[34:47.470 --> 34:48.230]  Something's hitting it.
[34:48.330 --> 34:48.970]  I don't know what.
[34:50.090 --> 34:50.970]  What could be on it?
[34:50.970 --> 34:51.590]  I don't know.
[34:51.810 --> 34:54.990]  But it's kind of like, you know, I want to say like, well, who's working on it?
[34:55.130 --> 34:55.730]  Top men.
[34:56.030 --> 34:57.890]  You know, it's like the scene from the Raiders of the Lost Ark.
[34:57.970 --> 34:58.790]  Like, I don't know what's on it.
[34:58.870 --> 35:01.170]  It could be the document that sinks the entire litigation.
[35:01.210 --> 35:03.010]  You'll find it after Discovery's closed.
[35:04.850 --> 35:09.370]  So, having, no, being able to say very quickly what information you actually hold.
[35:09.470 --> 35:11.270]  So, you don't have to worry about what about that.
[35:11.430 --> 35:12.130]  It's like, no, there it is.
[35:12.270 --> 35:12.550]  Bang.
[35:12.790 --> 35:14.810]  I can search through all of our data.
[35:15.090 --> 35:19.330]  And anything that isn't within that searchable zone is gone.
[35:19.790 --> 35:20.590]  How do you know?
[35:20.750 --> 35:23.030]  I pounded the hard drive flat with a hammer.
[35:23.410 --> 35:24.850]  It's been degaussed.
[35:25.630 --> 35:27.290]  I shot it into space.
[35:27.650 --> 35:29.070]  I put it through a wood chipper.
[35:29.170 --> 35:33.410]  That way you can say, all the data we have on this point is right here.
[35:33.630 --> 35:35.110]  There is no other source.
[35:35.550 --> 35:35.870]  Yay.
[35:36.190 --> 35:38.030]  And you go back to your job.
[35:38.130 --> 35:39.310]  And you don't have to worry about that.
[35:39.590 --> 35:40.370]  Really, really nice.
[35:40.370 --> 35:47.530]  Because the attorney wants to also say, because the attorney is going to sign off their affidavit and says, you can freaking disbar me if I'm lying.
[35:48.610 --> 35:49.710]  Kind of scary too.
[35:49.850 --> 35:56.030]  So, they want to have the reassurance when you say, everything that we have on point is here.
[35:56.310 --> 36:02.210]  Everything that may have held data before was destroyed as per the document retention policy.
[36:04.590 --> 36:05.110]  Okay.
[36:05.510 --> 36:08.070]  So, I talk about this and why it's important.
[36:08.070 --> 36:12.550]  But the rule is, what you don't have may not hurt you.
[36:16.880 --> 36:29.160]  Those emails that might prove that awful case against you, if it's legally gone, if you were allowed to destroy it, do so, per the document retention policy.
[36:29.280 --> 36:33.120]  Doing stuff not with the document retention policy gets you in shit.
[36:34.360 --> 36:35.640]  So, destruction.
[36:37.480 --> 36:42.440]  Usually okay, if you don't have some other requirement to keep that data.
[36:42.660 --> 36:47.600]  You don't have some regulatory rule that says you have to hold all this data for two years.
[36:48.400 --> 36:50.540]  One of my clients, I love them.
[36:50.780 --> 36:52.120]  They're a public transit authority.
[36:52.120 --> 36:54.120]  Their rule is 20 years.
[36:57.900 --> 36:58.940]  Twenty years.
[36:59.200 --> 37:00.720]  Some of this is paper documents.
[37:00.980 --> 37:05.220]  And they decided, well, we still hold on to it past the document retention policy.
[37:05.220 --> 37:06.720]  So, we went to the warehouse.
[37:06.960 --> 37:07.820]  And it's a warehouse.
[37:08.620 --> 37:10.580]  Filled with document boxes.
[37:10.900 --> 37:12.300]  Filled with mold.
[37:12.600 --> 37:13.220]  Rats.
[37:14.180 --> 37:14.490]  And...
[37:16.580 --> 37:17.900]  I don't know yet.
[37:18.160 --> 37:19.860]  But mimeograph files.
[37:20.000 --> 37:22.280]  Remember the old purple on white paper?
[37:22.580 --> 37:26.440]  Like, this case was 1953.
[37:26.440 --> 37:27.360]  Why are you holding it?
[37:27.440 --> 37:28.260]  Mike, come back to us.
[37:28.660 --> 37:30.240]  Everyone involved is dead.
[37:32.940 --> 37:33.420]  I...
[37:33.420 --> 37:35.460]  We can shred it.
[37:36.000 --> 37:47.740]  The only value it has now is that some poor schmuck who's got like a really weird train fetish may want to know about someone who fell on a trolley when Eisenhower was president.
[37:50.400 --> 37:50.880]  Okay.
[37:51.120 --> 37:53.420]  So, usually okay if you don't have a requirement to keep.
[37:53.420 --> 38:00.560]  You have to keep it if litigation's been filed on this point or you think it might happen or there's a regulatory scheme.
[38:00.760 --> 38:01.740]  Generally, that's okay.
[38:01.900 --> 38:05.860]  There's one case that's different where Louis V. Remington...
[38:06.900 --> 38:13.200]  I don't want to go too much into it, but it's basically complaints about rifles firing when you didn't pull the trigger.
[38:15.020 --> 38:16.140]  Kind of an oops.
[38:18.200 --> 38:22.160]  If you turn the safety, it would fire, which...
[38:22.160 --> 38:26.120]  I think that makes the term safety a really... really bad irony.
[38:30.160 --> 38:30.760]  Yeah, it's safe.
[38:30.920 --> 38:31.140]  Bang!
[38:31.400 --> 38:32.660]  Well, now it's safe.
[38:33.660 --> 38:34.940]  But they had complaints.
[38:35.120 --> 38:38.980]  People wrote in and said, I have this problem with your otherwise fine firearm.
[38:39.520 --> 38:42.560]  And what they did was they read it and then shredded them.
[38:43.360 --> 38:49.180]  So when other people, you know, when it's not a, oh, that was really scary when the rifle went off and the bullet shot out.
[38:49.300 --> 38:55.340]  Instead it's like, oops, I inadvertently was pointing at someone who wasn't a deer.
[38:56.040 --> 39:01.040]  You know, my wife dressed as a UPS delivery man with white gloves or something.
[39:02.660 --> 39:05.180]  And they said, well, we want all the other complaints.
[39:05.760 --> 39:07.100]  And Remington said, we don't have any.
[39:07.920 --> 39:09.180]  Not, we didn't get any.
[39:09.360 --> 39:10.860]  We don't have any because we destroyed them.
[39:10.940 --> 39:12.320]  That's our document retention policy.
[39:12.540 --> 39:13.340]  We get them.
[39:13.500 --> 39:16.100]  We hold them for like 30 days and then we shred them.
[39:16.160 --> 39:16.880]  It's like, well, wait a minute.
[39:17.200 --> 39:18.480]  How many complaints have you had?
[39:18.560 --> 39:19.260]  We don't know.
[39:19.840 --> 39:20.720]  Have you had them?
[39:20.720 --> 39:24.120]  And other people are coming out of the woodwork going, yeah, here's a copy of the letter I sent.
[39:24.260 --> 39:28.400]  I'm like, so you had noticed that this was a problem going back to the 70s?
[39:28.560 --> 39:28.920]  Yes.
[39:29.740 --> 39:33.680]  But we don't have the documents because we destroyed them as per our document retention policy.
[39:33.720 --> 39:36.080]  And the court was like, whoa, wait a minute, wait a minute.
[39:36.200 --> 39:37.380]  You should have known then.
[39:37.380 --> 39:38.900]  You weren't allowed to destroy these.
[39:41.040 --> 39:48.740]  So the other thing that you want to think about, especially in an electronic schema, is never create the document in the first place.
[39:50.260 --> 39:52.100]  I'm thinking about like anonymity.
[39:52.320 --> 40:00.100]  If you want to protect your users, you create a log file about what they've done and then delete it, that's potentially a problem.
[40:00.660 --> 40:06.700]  If you never log the information in the first place, that may be beneficial.
[40:07.120 --> 40:13.020]  Because then you can say, when you get sued, I don't have that data because I never had it anyway.
[40:13.320 --> 40:14.400]  I didn't destroy it.
[40:14.480 --> 40:15.840]  I never took it down.
[40:21.310 --> 40:23.930]  I think you can argue that that's transitory enough.
[40:24.090 --> 40:25.330]  It was never really a document.
[40:25.330 --> 40:26.710]  It was just stored there.
[40:26.990 --> 40:29.830]  You needed it for that transaction, but it went away.
[40:30.110 --> 40:38.670]  I think once you create the document, as in write it to disk in such a way that you looked at it, especially if you held it for any length of time.
[40:38.670 --> 40:41.030]  And by length of time, I'm thinking human terms.
[40:41.350 --> 40:43.370]  A week, a month, a year.
[40:43.730 --> 40:44.810]  Then we have a problem.
[40:44.950 --> 40:53.210]  If it's designed to be in the system in such a way that it's only used for that transaction, 10 seconds, a millisecond, whatever, we're okay.
[40:53.930 --> 40:54.370]  Generally.
[40:55.630 --> 40:57.910]  So, unnecessary logging and retention.
[40:58.270 --> 40:59.550]  Now, spoliation.
[40:59.710 --> 41:04.410]  This is a legal term for you destroyed stuff you shouldn't have.
[41:04.730 --> 41:08.430]  And we do nasty things to people we catch doing this.
[41:09.770 --> 41:18.090]  This ranges from a sanction, as in you're allowed to bring... the opposing side is allowed to bring this up at court.
[41:19.270 --> 41:24.710]  The defendant kept these documents, but destroyed them, because they're trying to hide something from you.
[41:24.810 --> 41:28.690]  So, you make the... you're allowed to bring up the adverse inference that says...
[41:30.930 --> 41:38.210]  The defendant says they've never had any of these documents, but I have proof that they did, which means they must be hiding something.
[41:38.310 --> 41:39.450]  And I can bring that up now.
[41:40.190 --> 41:46.030]  It's a nice... it's a nice argument, because all of a sudden you haven't... the fact that you have no case is actually beneficial.
[41:46.030 --> 41:48.570]  You get to do the conspiracy theory thing.
[41:49.730 --> 41:52.690]  And I've seen others where cases have been dismissed.
[41:53.250 --> 41:56.510]  Like, oh yeah, I'm suing this guy, but I destroyed all my documents.
[41:56.630 --> 41:57.130]  Well, guess what?
[41:57.790 --> 41:58.170]  Dismissed.
[41:58.310 --> 41:58.670]  Gone.
[41:59.010 --> 42:01.750]  And you're like... the client's like, well, what do you mean?
[42:01.990 --> 42:03.030]  I have no claim now?
[42:03.130 --> 42:03.430]  Like, yeah.
[42:03.630 --> 42:06.370]  Because you destroyed... you destroyed the necessary documents.
[42:06.630 --> 42:12.210]  This isn't an idea to hold everything, but like the relevant documents, once litigation was filed, you then destroyed them.
[42:12.430 --> 42:13.730]  You can get spanked for that.
[42:13.730 --> 42:16.250]  It usually depends on how much bad faith is obvious.
[42:16.650 --> 42:17.730]  Intervertent destruction?
[42:18.150 --> 42:22.410]  Like, I held the evidence of a car accident.
[42:22.990 --> 42:24.690]  Or actually, there's a great truck one.
[42:25.350 --> 42:26.870]  A truck rolls over.
[42:27.130 --> 42:28.710]  They believe it was bad maintenance.
[42:29.130 --> 42:36.430]  The problem is, is that later, the warehouse the truck is stored in burns down, destroying the evidence.
[42:36.430 --> 42:42.330]  And the truck manufacturer tries to argue to the owner of the truck, like, look, you destroyed the evidence.
[42:42.630 --> 42:43.830]  Therefore, we shouldn't have to.
[42:43.850 --> 42:47.250]  And it's like, that wasn't really bad faith, because you had no control over the warehouse.
[42:48.090 --> 42:49.730]  Warehouse is held by a third party.
[42:50.170 --> 42:51.270]  Not bad faith.
[42:51.570 --> 42:57.750]  Other stuff, like the destruction of the complaint letters to Remington, is in bad faith, and Remington got spanked for it.
[42:59.850 --> 43:00.270]  Sanctions.
[43:00.610 --> 43:00.730]  Okay.
[43:01.370 --> 43:01.790]  Subpoenas.
[43:02.650 --> 43:05.110]  This is a, this is kind of a, this is more interesting.
[43:05.230 --> 43:09.510]  Because this is where you can go to a third party, and say, I'm suing B.
[43:09.850 --> 43:10.970]  A is suing B.
[43:11.170 --> 43:15.710]  But I want information from C about B.
[43:16.550 --> 43:18.850]  So you can go to a third party and find stuff.
[43:19.950 --> 43:23.990]  You can, it's issued by court, sometimes by a grand jury, or by a litigant.
[43:25.290 --> 43:26.930]  To obtain response information.
[43:27.090 --> 43:28.750]  Same thing as we talked about for discovery.
[43:29.790 --> 43:31.110]  It's similar to discovery order.
[43:31.190 --> 43:32.670]  You can defend on similar grounds.
[43:32.830 --> 43:33.890]  This is overly burdensome.
[43:34.550 --> 43:38.910]  It's too much, it cost me too much to give you this data, narrow the scope.
[43:43.190 --> 43:43.590]  Yes.
[43:43.970 --> 43:44.610]  Yes, they can.
[43:44.750 --> 43:46.970]  But of course, you bill at your rates.
[43:47.910 --> 43:50.870]  So I've seen this, where it's like, yes, we demand this information, fine.
[43:50.870 --> 43:53.350]  I bill $250 an hour to do this work.
[43:53.530 --> 43:57.510]  And you, of course, sometimes will go, no, we think that data is actually worth it.
[43:57.610 --> 43:58.250]  We'll pay it.
[43:58.330 --> 43:59.210]  And you're like, okay, wow.
[44:03.250 --> 44:04.510]  Issues of standing, though.
[44:04.690 --> 44:06.510]  Here's where things get really, really fun.
[44:09.010 --> 44:15.270]  You subscribe to a service that holds your data.
[44:17.010 --> 44:20.050]  I can go after you, I can sue you for that data.
[44:20.050 --> 44:21.750]  Or I can go after your service.
[44:24.730 --> 44:27.050]  Sometimes, you may not be able to step in.
[44:27.430 --> 44:29.770]  Say, for example, I go after the service that holds your data.
[44:29.870 --> 44:31.190]  And you say, no, no, no, that's my data.
[44:31.410 --> 44:33.970]  There are cases where the court have said, no, it's not.
[44:34.790 --> 44:37.350]  It's data about you, but it is not your data.
[44:37.550 --> 44:41.930]  So therefore, you have no standing to file a lawsuit to protect that data.
[44:45.070 --> 44:45.950]  So, warrants.
[44:47.230 --> 44:48.290]  This is a criminal.
[44:48.470 --> 44:49.650]  This is kind of related.
[44:49.850 --> 44:54.770]  I throw this in because I like this part, because I find this is something valuable to hackers.
[44:56.210 --> 45:01.910]  Requires probable cause that the item seized, container R, evidence, fruits, instrumentalities, or contraband.
[45:03.210 --> 45:08.890]  Usually, 95% of the time you do this, as an IT person, we're looking for child porn.
[45:11.130 --> 45:12.170]  Or it just seems to be.
[45:12.410 --> 45:13.610]  Those aren't the cases I do.
[45:13.730 --> 45:15.450]  Those are just most of the cases I've read.
[45:15.670 --> 45:17.990]  Maybe because people will litigate child porn stuff.
[45:21.370 --> 45:24.250]  This is a different standard than what you need for a discovery order.
[45:24.370 --> 45:25.990]  A discovery order, there's a litigation filed.
[45:26.110 --> 45:28.510]  You actually have to show that there's some proof.
[45:28.690 --> 45:33.590]  There's some evidence that the data we're looking for is out there.
[45:33.790 --> 45:34.670]  And you have it.
[45:35.250 --> 45:35.970]  Wiretap warrant.
[45:36.150 --> 45:38.090]  This allows you to put a sniffer on a system.
[45:38.330 --> 45:40.150]  Probable cause and no alternative matter.
[45:40.330 --> 45:42.410]  It's a slightly higher standard than a warrant.
[45:43.070 --> 45:43.530]  Okay.
[45:43.730 --> 45:44.850]  Story Communications Act.
[45:45.010 --> 45:45.730]  Same thing.
[45:46.850 --> 45:48.570]  Same thing as just a regular warrant.
[45:48.730 --> 45:50.630]  You don't have to show that there is no better alternative.
[45:51.750 --> 45:52.990]  So, dealing with warrants.
[45:53.130 --> 45:56.490]  This is something you may have to do, especially if you run a data center or the like.
[45:56.790 --> 45:58.090]  There are two approaches.
[45:58.510 --> 46:01.050]  I like to call them helpful or silent.
[46:01.390 --> 46:04.370]  If you are a large institution, say for example, AOL.
[46:05.770 --> 46:06.610]  You don't actually...
[46:06.610 --> 46:09.610]  Law enforcement doesn't actually show up to AOL and say, we have a warrant.
[46:09.750 --> 46:10.630]  They fax it.
[46:11.470 --> 46:15.010]  Because AOL's response is, that looks like a warrant.
[46:15.010 --> 46:16.170]  That's sealed.
[46:16.410 --> 46:16.730]  Okay.
[46:17.230 --> 46:18.050]  How do you want the data?
[46:18.250 --> 46:18.630]  DVD?
[46:18.950 --> 46:19.410]  Thumb drive?
[46:20.590 --> 46:21.510]  Here you go.
[46:22.410 --> 46:22.930]  Helpful.
[46:25.190 --> 46:26.770]  The silent, helpful.
[46:26.990 --> 46:29.330]  So you give the nice officers what they've worked for.
[46:29.570 --> 46:31.470]  So they don't take everything.
[46:32.970 --> 46:43.090]  If they have a warrant, they can take everything that they believe, they have a probable cause, is contraband, fruits, evidence, or contraband.
[46:43.830 --> 46:47.910]  So they could say, we're taking everything that stores data in the data center.
[46:51.340 --> 46:54.280]  Most of you went, holy shit, that just f*cked my uptime.
[46:56.160 --> 46:57.940]  You know, where's the data center?
[46:58.080 --> 46:58.700]  In a truck.
[46:59.760 --> 47:04.880]  And I've read warrants where they've taken stuff that I didn't think held data.
[47:06.340 --> 47:07.420]  Like, thumb drives?
[47:07.680 --> 47:07.900]  Gone.
[47:09.300 --> 47:10.240]  Anything electronic.
[47:10.480 --> 47:12.120]  Like, they took the alarm clock.
[47:12.340 --> 47:12.780]  Gone.
[47:13.180 --> 47:14.480]  Because it's like, it might.
[47:14.700 --> 47:15.040]  Fine.
[47:15.400 --> 47:15.760]  Shoop.
[47:15.960 --> 47:17.260]  And you just clear it out.
[47:19.100 --> 47:20.840]  And I've heard about this.
[47:20.960 --> 47:21.840]  I've not seen it.
[47:21.920 --> 47:27.020]  But I've heard rumors that they'll send like the biggest, meanest cops who act dumb.
[47:27.020 --> 47:29.500]  Like, okay, I'm going to take these boxes.
[47:29.780 --> 47:32.140]  And the only tool they have is a pair of bolt cutters.
[47:32.340 --> 47:34.140]  And at that point, you're like, whoa, whoa, whoa.
[47:34.280 --> 47:35.020]  What do you want?
[47:35.560 --> 47:36.160]  I'll play.
[47:36.360 --> 47:38.140]  I'll stop being, you know, Sergeant Douchebag.
[47:39.200 --> 47:44.120]  The problem is, when you're helpful, you are now admitting, when it's like, oh, we want all of this stuff.
[47:44.260 --> 47:44.980]  Hold on a second.
[47:45.140 --> 47:46.200]  I'll get it for you.
[47:46.440 --> 47:49.660]  You've just admitted that you knew it was there.
[47:50.360 --> 47:51.740]  I want all the coke in your house.
[47:51.820 --> 47:52.560]  Oh, hold on a second.
[47:52.920 --> 47:53.620]  Here you go.
[47:54.260 --> 47:55.880]  Now you can't say, oh, that wasn't mine.
[47:55.880 --> 47:56.840]  Like, how'd you know it was there?
[47:57.640 --> 47:59.480]  Well, it said cocaine on the front.
[48:02.280 --> 48:03.680]  The silent approach.
[48:03.900 --> 48:05.400]  I don't know nothing about nothing.
[48:05.680 --> 48:06.420]  Take it all.
[48:08.200 --> 48:10.240]  You can claim that that stuff isn't yours.
[48:10.700 --> 48:13.600]  They may be able to prove it another way, but you're not admitting to it.
[48:13.740 --> 48:15.280]  The problem is nothing's yours.
[48:15.740 --> 48:16.600]  They take everything.
[48:18.100 --> 48:24.500]  And the fun part is what happens if other people store their stuff on your boxes.
[48:25.660 --> 48:31.860]  When they take the box, they can search the box, not just the target of the original search warrant.
[48:33.120 --> 48:34.860]  So think about that for a second.
[48:35.960 --> 48:36.980]  So, warrant defenses.
[48:37.220 --> 48:37.480]  Legal.
[48:37.760 --> 48:39.000]  File suppression motion.
[48:39.380 --> 48:40.920]  That the warrant was illegal.
[48:41.180 --> 48:42.000]  You've got to take it away.
[48:42.580 --> 48:43.300]  After the fact.
[48:43.480 --> 48:44.360]  You can file suit.
[48:44.540 --> 48:47.300]  Give us that stuff back when you're done with it, please.
[48:47.300 --> 48:49.140]  Are a civil rights action.
[48:49.260 --> 48:50.320]  A 1983 action.
[48:51.180 --> 48:51.520]  Technical.
[48:51.820 --> 48:53.240]  Off-site backups.
[48:54.320 --> 48:55.780]  In a different jurisdiction.
[48:56.400 --> 48:57.980]  So you can go live eventually.
[48:58.880 --> 48:59.580]  Mirror sites.
[48:59.820 --> 49:02.400]  So you can go live when you switch over DNS.
[49:03.560 --> 49:04.720]  Encrypted containers.
[49:04.980 --> 49:07.680]  So you can say, I didn't know it was there.
[49:07.900 --> 49:12.240]  All of my customers have an encrypted container.
[49:12.240 --> 49:13.060]  I don't have...
[49:13.060 --> 49:14.360]  And I don't have the key.
[49:14.740 --> 49:15.920]  So you can take...
[49:15.920 --> 49:21.800]  I can be Mr. Friendly and go, here's the encrypted container that is the target of that search warrant.
[49:23.560 --> 49:24.720]  Have fun with that.
[49:24.820 --> 49:28.860]  But also, so that way you can say, don't take our other stuff.
[49:29.640 --> 49:32.380]  I have been as helpful as I can be.
[49:34.860 --> 49:36.180]  I have a picture of a cat.
[49:36.340 --> 49:37.680]  Because I wanted to have two...
[49:37.680 --> 49:40.400]  Like, here's the nice passive approach.
[49:40.520 --> 49:42.640]  And I couldn't find a picture of the kitten being angry.
[49:43.720 --> 49:44.140]  So...
[49:47.760 --> 49:49.640]  Well, the problem is I then have to take a picture.
[49:50.560 --> 49:50.940]  Okay.
[49:51.100 --> 49:51.800]  Transitive trust.
[49:52.060 --> 49:53.260]  Think about who you trust.
[49:53.780 --> 49:54.900]  And who they trust.
[49:55.060 --> 49:55.940]  And so on.
[49:56.260 --> 49:57.120]  The idea is this.
[49:57.300 --> 50:00.140]  Sometimes the information attacker wants is in multiple places.
[50:00.140 --> 50:01.700]  So where do you go?
[50:03.140 --> 50:04.800]  Go after the soft target.
[50:05.100 --> 50:09.380]  Who has less interest in protecting the info or has weaker security.
[50:09.720 --> 50:10.640]  Same thing.
[50:11.540 --> 50:13.340]  You maybe are aggressive.
[50:14.100 --> 50:15.260]  You are WikiLeaks.
[50:15.500 --> 50:21.020]  So you have a bunch of attorneys that will jump in just to f*ck with the system.
[50:21.240 --> 50:23.200]  And f*ck with the man to defend this.
[50:23.460 --> 50:24.020]  Fine.
[50:24.180 --> 50:25.480]  I'm gonna go for someone who's some...
[50:25.480 --> 50:31.120]  If the same data is on some small cloud provider that's like, I've got a realist.
[50:31.240 --> 50:32.700]  I know a lawyer somewhere.
[50:33.740 --> 50:34.220]  Fine.
[50:34.440 --> 50:35.380]  They'll hand the data over.
[50:35.500 --> 50:36.180]  They'll give it up.
[50:36.620 --> 50:40.220]  So the hard armored target, the angry one, is gonna...
[50:40.920 --> 50:41.400]  Fine.
[50:41.540 --> 50:42.960]  If the same data is on another box.
[50:44.620 --> 50:45.100]  So...
[50:45.600 --> 50:46.380]  Example one.
[50:46.760 --> 50:48.780]  Subpoena cloud provider instead of an account holder.
[50:49.040 --> 50:51.340]  The cloud provider may just give you up.
[50:51.480 --> 50:52.580]  It's faster and easier.
[50:52.800 --> 50:54.720]  May not even alert the data holder.
[50:55.620 --> 50:56.760]  And there's an example.
[50:56.900 --> 50:57.300]  People v. Harris.
[50:57.900 --> 50:58.980]  I don't want to go into it.
[51:00.280 --> 51:03.640]  But no expectation of privacy and deleted public tweets.
[51:03.920 --> 51:05.400]  And the tweets were Twitters.
[51:05.640 --> 51:06.520]  Not the owner.
[51:06.700 --> 51:07.360]  Not the creator.
[51:08.180 --> 51:10.800]  So therefore, you have no privacy rights in that.
[51:12.060 --> 51:13.040]  Example number two.
[51:14.000 --> 51:15.480]  This is a litigation.
[51:16.200 --> 51:20.180]  Two companies get into either a merger and acquisition deal or a litigation.
[51:21.180 --> 51:25.700]  Each of them takes their data and hands it off to an e-discovery provider that may have shit security.
[51:26.420 --> 51:31.040]  I, as the attacker, don't go after the company with the big InfoSec department.
[51:31.260 --> 51:35.820]  I go after the e-discovery vendor, which may not even have good physical security.
[51:35.960 --> 51:40.380]  I walk onto the floor, grab the data.
[51:41.080 --> 51:42.760]  I've worked for an e-discovery vendor.
[51:43.000 --> 51:44.080]  We had no security.
[51:44.320 --> 51:46.320]  You could have walked in and taken drives.
[51:47.240 --> 51:50.280]  They were in an evidence bag, but I've noticed this.
[51:50.620 --> 51:52.760]  Evidence bags rip really easy.
[51:53.760 --> 51:55.220]  I can grab the data.
[51:56.320 --> 52:00.420]  All that IP walks out the door are a few people buy stock at the right time.
[52:02.580 --> 52:04.200]  However, it's going to be okay.
[52:05.240 --> 52:06.540]  Soothing picture of a kitten.
[52:08.300 --> 52:09.700]  What can you do?
[52:10.500 --> 52:14.880]  Learn how to speak to the lawyers in your organization about these problems.
[52:14.880 --> 52:16.940]  How you want to approach them.
[52:17.060 --> 52:17.960]  So that way you're being proactive.
[52:18.740 --> 52:22.480]  You're like, look, I think about the security stuff more than you do.
[52:23.160 --> 52:27.940]  And I would like to help you do your job so we both protect the organization.
[52:29.620 --> 52:31.040]  Educate them about security.
[52:31.340 --> 52:32.520]  Don't talk down to them.
[52:33.120 --> 52:34.320]  Be their peers.
[52:35.800 --> 52:38.840]  To convince them that this doesn't need to be outsourced.
[52:38.840 --> 52:40.260]  We want someone to be able to...
[52:40.260 --> 52:42.480]  We're going to hire an outside vendor to search all our stuff.
[52:42.680 --> 52:43.160]  F*ck that.
[52:43.260 --> 52:43.880]  I can do that.
[52:45.340 --> 52:49.740]  I can do that cheaper and better and more securely than your outside vendor can.
[52:49.820 --> 52:51.040]  Because I know where all the stuff is.
[52:51.260 --> 52:53.680]  I will happily handle that for you.
[52:55.880 --> 52:56.280]  Crap.
[52:57.940 --> 52:58.860]  What tool do you use?
[52:58.980 --> 52:59.260]  Crap.
[52:59.660 --> 53:00.060]  Worked.
[53:01.060 --> 53:02.280]  What can you do continued?
[53:02.940 --> 53:03.940]  E-discovery audits.
[53:03.940 --> 53:08.300]  This is we go through and figure out who has access to what and where the systems are.
[53:08.520 --> 53:09.660]  Does that sound familiar?
[53:10.700 --> 53:12.380]  I did e-discovery vendor...
[53:12.380 --> 53:16.680]  I did e-discovery audits and was like, this could be tacked onto a regular security audit.
[53:17.300 --> 53:20.180]  In fact, it should be because it's the same damn thing.
[53:20.360 --> 53:23.520]  But because I'm an attorney, I get to bill some multiple.
[53:24.420 --> 53:28.260]  Because I said it's an e-discovery audit, not a regular security audit.
[53:29.400 --> 53:32.840]  The ability to back up everything is the ability to preserve everything.
[53:32.840 --> 53:38.520]  You don't need to necessarily buy a special e-discovery package, which are usually crappy.
[53:38.840 --> 53:40.760]  You can just say, I need to grab stuff.
[53:40.920 --> 53:41.800]  I can grab stuff.
[53:42.420 --> 53:43.700]  Help vet the vendors.
[53:43.960 --> 53:45.740]  Figure out if they can protect your shit.
[53:46.240 --> 53:47.180]  Any questions?
[53:47.840 --> 53:48.800]  Art, get a card.
[53:48.960 --> 53:50.440]  We have two minutes, so I'll have to be quick.
[53:56.250 --> 54:00.270]  So, you talked about GREP and the discovery process.
[54:00.550 --> 54:04.750]  A friend of mine works for the Department of Justice Antitrust Division.
[54:04.750 --> 54:11.470]  And in addition to looking for all the text documents, he has thousands and thousands of hours of wiretaps to look through.
[54:11.710 --> 54:15.090]  So, he has a lot of opinions on electronic discovery.
[54:15.650 --> 54:23.470]  So, what do you think is possible and what would you like to see for electronic discovery tools so we can stop burning these bags of money?
[54:25.210 --> 54:26.150]  Am I billing?
[54:26.430 --> 54:27.210]  Then it's not a...
[54:27.210 --> 54:28.450]  Burning money isn't bad.
[54:29.230 --> 54:30.790]  Anything that just lets you search.
[54:31.050 --> 54:32.410]  Think of it as just data.
[54:32.690 --> 54:38.090]  And we think about how to search data all the time in ways that the e-discovery vendors don't.
[54:39.470 --> 54:40.850]  What if you miss something?
[54:43.090 --> 54:44.550]  I f*ck up every day.
[54:45.550 --> 54:47.150]  No, I'm going to be serious.
[54:47.430 --> 54:50.990]  You're not going to get killed for f*cking up occasionally, as long as you made a best effort.
[54:53.110 --> 54:53.810]  One minute.
[54:53.970 --> 54:54.870]  I'll take one more question.
[54:56.390 --> 55:05.230]  What about documents that need to have longer lifespans, like research notes or product documentation or...
[55:05.230 --> 55:07.670]  Then you hold on to it as long as you need to.
[55:07.970 --> 55:12.590]  You have to be able to give it over when you've got it, and you have to know that you've got it.
[55:13.150 --> 55:18.250]  It's more that if you're following a data retention thing, don't you have to destroy it?
[55:21.510 --> 55:23.830]  Well, I don't think I'm understanding the question.
[55:24.070 --> 55:27.830]  If you have a data retention policy that says, if it's older than 90 days, we destroy it.
[55:27.990 --> 55:28.290]  Okay.
[55:28.410 --> 55:37.850]  And you have this document, like notes on a program that you're probably going to need to refer to a year down the line when you're updating it.
[55:39.830 --> 55:40.750]  How do you...
[55:40.750 --> 55:42.450]  You can write granular...
[55:42.450 --> 55:44.070]  You can write granular...
[55:45.490 --> 55:45.890]  Policies.
[55:46.030 --> 55:46.430]  Policies.
[55:46.550 --> 55:48.290]  Where it's like, this we hold for a long time.
[55:48.550 --> 55:48.890]  Okay.
[55:48.910 --> 55:49.770]  This we don't.
[55:50.070 --> 55:50.350]  Okay.
[55:50.450 --> 55:50.710]  Thank you.
[55:51.130 --> 55:51.430]  Thanks.
[55:52.330 --> 55:52.890]  Thank you.
[55:52.990 --> 55:53.410]  Next talk.