[00:00.000 --> 00:00.160]  HOPE.
[00:01.200 --> 00:01.700]  It's HOPE.
[00:01.880 --> 00:02.800]  The home of con funk.
[00:03.560 --> 00:05.720]  So... Didn't we hand out soap one year?
[00:05.960 --> 00:06.280]  Yes.
[00:06.440 --> 00:06.800]  Yeah.
[00:07.680 --> 00:12.420]  Well, I'm not going to drag this out any longer because what they have to say is more interesting than what I have to say.
[00:12.600 --> 00:14.620]  But, Sandy Clark and Josh Marpet.
[00:14.920 --> 00:15.620]  Give them an applause.
[00:17.820 --> 00:27.540]  Oh, and by the way, I see, tried to stay out of the aisle there where the red tapes are and make sure your cell phone ringers are turned off because you don't want to miss anything they have to say.
[00:27.540 --> 00:27.980]  Thanks again.
[00:30.420 --> 00:34.460]  I can't see the... No, this is not that con.
[00:34.620 --> 00:36.100]  This is hope, but thanks.
[00:36.860 --> 00:37.720]  I know where to aim.
[00:40.320 --> 00:40.760]  Okay.
[00:44.760 --> 00:46.700]  This is going to get interesting fast.
[00:47.120 --> 00:47.320]  Okay.
[00:50.240 --> 00:52.780]  I see the Philly set crowd has followed me up here.
[00:53.140 --> 00:53.140]  Okay.
[00:53.400 --> 00:54.540]  I can do it and you can't prove it.
[00:56.360 --> 00:59.560]  My co-talk, my co-speaker is saying you can't prove it was me.
[00:59.700 --> 00:59.980]  Thanks.
[01:00.220 --> 01:02.040]  So you didn't hand out the rockets beforehand.
[01:02.940 --> 01:03.020]  Okay.
[01:03.080 --> 01:05.020]  Is there any chance I can move this up here so we can...
[01:05.020 --> 01:07.560]  You can, but if I speak with it up there, they won't be able to see me.
[01:07.800 --> 01:08.440]  Well, we'll move it.
[01:08.500 --> 01:08.840]  It's okay.
[01:09.780 --> 01:11.040]  We're flexible about that.
[01:11.500 --> 01:11.900]  All right.
[01:12.160 --> 01:12.460]  So...
[01:12.460 --> 01:13.300]  You're not on the screen.
[01:18.340 --> 01:18.980]  There you are.
[01:19.200 --> 01:19.280]  Okay.
[01:20.000 --> 01:20.280]  All right.
[01:20.400 --> 01:21.720]  So we're talking about the CSI effect.
[01:21.880 --> 01:24.460]  So how many of you have actually seen CSI the show?
[01:25.820 --> 01:27.220]  How many of you believe it's true?
[01:29.060 --> 01:29.460]  What?
[01:29.720 --> 01:30.120]  Really?
[01:30.580 --> 01:32.780]  Because like it's totally all true, man.
[01:32.920 --> 01:33.940]  Every little bit of it.
[01:34.100 --> 01:35.380]  So let's talk about that.
[01:35.900 --> 01:37.480]  So first off, who are we?
[01:37.680 --> 01:39.560]  Well, this is Sandy, otherwise known as Mouse.
[01:39.920 --> 01:42.000]  She is a graduate student.
[01:42.260 --> 01:44.780]  She is, uh, omnicompetent.
[01:44.920 --> 01:46.540]  She's done just about everything.
[01:46.760 --> 01:51.560]  And she loves finding things in little cracks and crevices that people haven't looked ever before.
[01:51.820 --> 01:52.900]  Like a mouse.
[01:54.040 --> 01:55.520]  So she rocks.
[01:56.400 --> 01:57.640]  Uh, I'm Josh Marpet.
[01:57.820 --> 01:59.240]  I do way too much crap.
[01:59.740 --> 02:03.140]  Uh, I'm known as the Infosec Therapist, the Infosec Megaphone.
[02:03.180 --> 02:04.460]  How do you feel about your network today?
[02:05.180 --> 02:07.440]  So I do all sorts of stuff.
[02:07.860 --> 02:08.740]  Yeah, yeah, yeah, yeah, yeah.
[02:08.820 --> 02:09.240]  That's exciting.
[02:09.320 --> 02:11.460]  Come to B-Sides Delaware if you like other conferences.
[02:11.460 --> 02:12.360]  You'll enjoy it too.
[02:12.820 --> 02:13.740]  Free con, we like those.
[02:14.280 --> 02:16.640]  Uh, we do all sorts of stuff.
[02:16.760 --> 02:21.340]  And between us, we all, we always call each other and giggle about weird crap we find on the Internet and various other places.
[02:21.580 --> 02:22.820]  Not that any of you do that either.
[02:24.020 --> 02:25.660]  So what's the CSI effect?
[02:26.000 --> 02:28.520]  Uh, basically we all look like that, right?
[02:28.920 --> 02:30.080]  Either that or that.
[02:30.460 --> 02:32.720]  Because this is what crime lab techs are, right?
[02:32.980 --> 02:34.420]  Isn't that what a crime lab tech looks like?
[02:34.560 --> 02:38.280]  They're either a techno mage or a sexy goth techno wizard what?
[02:38.880 --> 02:40.200]  Like that's everybody, isn't it?
[02:40.300 --> 02:41.900]  I mean, don't you have your black leather boots?
[02:42.400 --> 02:43.620]  I, Tom, I know you actually do.
[02:43.820 --> 02:44.000]  I do.
[02:44.200 --> 02:46.260]  And no comment.
[02:46.460 --> 02:46.740]  Anyway.
[02:49.260 --> 02:53.700]  So this is actually what crime lab techs look like, you know, especially the mustache on that one guy.
[02:54.820 --> 02:58.800]  I, I actually was looking for pictures of crime lab tech, saw that almost spit on the screen.
[02:58.820 --> 02:59.860]  I was like, that's perfect.
[03:00.400 --> 03:02.140]  You know, they're stuck in the 1970s.
[03:02.240 --> 03:02.840]  Yes, that's true.
[03:02.840 --> 03:03.920]  The porn stash lives.
[03:04.240 --> 03:04.280]  Okay.
[03:05.420 --> 03:06.860]  And this is really what they are.
[03:06.980 --> 03:07.440]  They're scientists.
[03:07.960 --> 03:08.820]  And that's great.
[03:08.960 --> 03:09.380]  They're technicians.
[03:09.620 --> 03:09.960]  They're engineers.
[03:10.160 --> 03:10.520]  They're scientists.
[03:10.720 --> 03:11.600]  And they do good work.
[03:11.700 --> 03:12.120]  Don't get me wrong.
[03:12.240 --> 03:14.260]  I'm not dissing real crime lab techs in the slightest.
[03:14.480 --> 03:16.000]  They do amazingly good work.
[03:16.140 --> 03:22.540]  It's amazing how far CSI or, you know, crime scene investigation has come in a few hundred years.
[03:23.060 --> 03:28.400]  Uh, but we show it in different ways.
[03:28.560 --> 03:34.000]  And I'll be honest, I used this exact illustration four years ago and it's still unbelievably funny.
[03:34.160 --> 03:34.360]  Watch.
[03:35.100 --> 03:35.980]  So I had to break it up.
[03:36.500 --> 03:37.940]  See if you can enhance that license plate.
[03:38.160 --> 03:41.880]  Can, can you see that, that video capture, which you can't see squatting, right?
[03:42.000 --> 03:45.700]  Because you know, if you enhance it, it's really, really clear.
[03:48.420 --> 03:48.820]  Okay.
[03:48.980 --> 03:50.980]  Oh, wait, zoom in on that screw.
[03:51.540 --> 03:52.780]  Are you frigging kidding?
[03:53.300 --> 03:53.880]  No, no.
[03:54.740 --> 03:56.540]  They can get the tool marks.
[03:56.540 --> 03:57.820]  We've got him.
[03:58.420 --> 03:59.400]  But, but wait.
[04:00.880 --> 04:01.760]  Oh my God.
[04:01.960 --> 04:04.660]  If you zoom in on the screw even more, there's a reflection.
[04:08.460 --> 04:12.960]  And then of course, the obligatory, yeah.
[04:15.140 --> 04:18.710]  I mean, and this is like a joke and not a joke because that's what they do.
[04:19.000 --> 04:23.880]  Who here went to see Skyfall and heard, and we did it after B-Sides Delaware one year.
[04:23.970 --> 04:25.590]  We organized, it was the opening night for Skyfall.
[04:25.670 --> 04:26.710]  We organized a trip to see it.
[04:26.910 --> 04:28.530]  Half the theater is, is geeks.
[04:28.730 --> 04:34.730]  And we're sitting there and every time they go, it's been obfuscated and the IP address is 356.995.
[04:35.850 --> 04:38.830]  And like we're giggling and half the theater is going, what man, it could happen.
[04:39.090 --> 04:40.830]  We're like, no, whatever.
[04:42.770 --> 04:46.060]  And things like this, I mean, it's commercial grade encryption.
[04:46.270 --> 04:47.710]  So consider it cracked.
[04:48.730 --> 04:49.090]  Yes.
[04:49.210 --> 04:51.170]  Cause PGP happens in three seconds flat.
[04:51.580 --> 04:51.970]  Sure.
[04:52.200 --> 04:52.320]  Okay.
[04:52.560 --> 04:56.440]  But this is the reality.
[04:57.650 --> 04:58.440]  Here's reality.
[04:59.020 --> 05:02.650]  It takes weeks to month to get a DNA, DNA analysis done.
[05:03.710 --> 05:06.620]  Multiple people check and recheck the evidence cause we don't know.
[05:06.940 --> 05:08.320]  He might be a screw up.
[05:08.560 --> 05:09.580]  No, actually we know about him.
[05:12.230 --> 05:13.770]  He's going, yeah, yeah, he really is.
[05:14.210 --> 05:15.830]  I brought him here cause I feel bad for him.
[05:18.140 --> 05:23.710]  Only 5 to 10% of cases leave DNA evidence, leave actual skin cells or blood or whatever that you can check.
[05:24.170 --> 05:24.210]  Yeah.
[05:24.440 --> 05:25.880]  That's the actual, I mean, that's the average.
[05:26.020 --> 05:26.120]  Okay.
[05:26.120 --> 05:27.620]  Some cases you're going to have blood everywhere.
[05:27.980 --> 05:31.020]  Some cases you're not going to find squat, but the average is 5 to 10% of cases.
[05:32.060 --> 05:35.620]  CODIS, the DNA database, has only about three to four million samples of DNA.
[05:36.160 --> 05:38.620]  Now there's a lot more, hell, there's more people in New York City than that.
[05:38.700 --> 05:41.290]  Of course, most of the people in CODIS are from New York City, but...
[05:43.240 --> 05:45.600]  APHIS, the automatic fingerprint identification system.
[05:45.920 --> 05:48.260]  If you have ever been a criminal, never mind.
[05:49.120 --> 05:50.350]  You're in APHIS, okay?
[05:50.700 --> 05:52.480]  I'm in APHIS because I used to be a cop.
[05:52.670 --> 05:57.790]  So they actually had to check us to make sure that we didn't leave fingerprints at crime scenes cause wonder of wonders, it's a problem.
[05:58.170 --> 05:59.520]  Did you put your gloves on?
[05:59.600 --> 06:00.400]  Oh yeah, I forgot.
[06:01.120 --> 06:01.850]  It happens.
[06:01.960 --> 06:02.580]  What am I going to say?
[06:02.880 --> 06:08.140]  And the rape kit backlog, hundreds and hundreds and hundreds of thousands of rape kit backlogs across the country.
[06:08.350 --> 06:09.200]  They cost money.
[06:09.500 --> 06:11.400]  Some people don't take them seriously, whatever.
[06:11.580 --> 06:13.000]  I'm not going off about rape.
[06:13.120 --> 06:15.260]  I'm just saying it's an amazingly horrible statistic.
[06:16.920 --> 06:19.980]  Crime scenes and crime labs are backed up beyond belief.
[06:20.140 --> 06:23.790]  If you've ever dealt with an RCFL, a regional criminal forensics laboratory, I think I got that acronym right.
[06:24.000 --> 06:24.460]  Did I?
[06:24.620 --> 06:24.900]  Brad?
[06:25.140 --> 06:26.100]  You got it.
[06:26.160 --> 06:26.670]  Okay, thanks.
[06:28.200 --> 06:31.480]  The RCFLs are backed up normally between two to seven months.
[06:32.200 --> 06:36.730]  Sometimes you can get a priority put on a case, but then everybody puts a priority on a case, which means everybody's at the same priority.
[06:37.020 --> 06:37.560]  You're screwed.
[06:38.500 --> 06:41.920]  And that's who you go to to get forensics done if you don't have an in-house forensics team.
[06:41.920 --> 06:43.460]  And they're seven months backlogged.
[06:43.560 --> 06:44.700]  It's like, uh, we're done.
[06:45.040 --> 06:46.660]  He fled to Sweden by now.
[06:46.780 --> 06:47.060]  We're good.
[06:47.280 --> 06:47.780]  You know?
[06:47.980 --> 06:48.420]  Okay, sorry.
[06:49.120 --> 06:51.340]  But in CSI, DNA.
[06:52.080 --> 06:53.080]  One commercial break.
[06:53.160 --> 06:54.020]  The DNA's done, baby.
[06:54.120 --> 06:54.700]  We're good.
[06:55.520 --> 06:55.920]  Okay?
[06:56.170 --> 06:58.900]  One person handles the entire case from collection to arrest.
[06:59.100 --> 07:00.670]  They even carry guns and arrest the people.
[07:00.850 --> 07:01.660]  I'm an ex-cop.
[07:01.880 --> 07:03.260]  They offered me to go to crime lab.
[07:03.400 --> 07:04.980]  I said, well, what's the change?
[07:05.140 --> 07:06.160]  They're like, same pay, no gun.
[07:06.230 --> 07:07.080]  I'm like, huh, go to hell.
[07:08.460 --> 07:08.850]  Okay?
[07:09.460 --> 07:10.400]  True hacker answer.
[07:11.280 --> 07:12.440]  Yeah, true hacker answer.
[07:12.540 --> 07:12.880]  No gun?
[07:13.040 --> 07:13.480]  Screw you.
[07:14.660 --> 07:15.560]  Everybody sheds DNA.
[07:15.720 --> 07:18.660]  They find DNA, like, you know, they're like walking and going, look, DNA.
[07:18.840 --> 07:19.780]  I can see it on the wall.
[07:20.280 --> 07:20.880]  Is there blood?
[07:20.980 --> 07:22.500]  No, it's just, I have really good vision.
[07:23.320 --> 07:23.820]  Screw you.
[07:23.980 --> 07:24.440]  Give me a break.
[07:24.880 --> 07:26.720]  CODIS has you because it has everybody.
[07:27.060 --> 07:28.100]  Everybody's in a DNA sample.
[07:28.760 --> 07:29.460]  Give me a break.
[07:29.670 --> 07:31.290]  There are laws about DNA sampling.
[07:31.520 --> 07:36.720]  And by the way, if you ever go to jail and they try to DNA sample you, this is one of our hints, see if you can refuse.
[07:36.720 --> 07:37.730]  Don't be violent.
[07:37.900 --> 07:39.230]  They get bad in jail about that.
[07:39.540 --> 07:42.720]  But if you say, hey, are you DNA sampling me because of a law?
[07:42.880 --> 07:43.350]  Which law?
[07:43.580 --> 07:44.600]  They should answer you.
[07:45.340 --> 07:48.120]  Admittedly, if you're already cuffed and in jail, they'll probably go shut up and open your mouth.
[07:48.420 --> 07:51.120]  But hopefully they'll actually answer you which law it is.
[07:51.290 --> 07:52.900]  I worked in a jail down in Louisiana.
[07:53.140 --> 07:55.940]  We DNA sampled everybody that walked in the door until we found out that was illegal.
[07:56.080 --> 07:56.790]  Little detail things.
[07:58.040 --> 07:58.140]  Okay?
[07:59.540 --> 08:00.670]  APHIS has almost everybody.
[08:00.790 --> 08:04.120]  At least in APHIS they admit that people might not be in there.
[08:04.120 --> 08:05.080]  But only rarely.
[08:05.340 --> 08:09.000]  You know, you watch NCIS and they're like, well, we're checking every database.
[08:09.760 --> 08:10.160]  Really?
[08:10.350 --> 08:11.460]  Because there are state databases.
[08:11.880 --> 08:13.120]  There are county databases.
[08:13.290 --> 08:14.350]  There are local jail databases.
[08:14.520 --> 08:17.540]  There are the federal APHIS database, which is coordinated by the FBI.
[08:17.620 --> 08:20.080]  And they never screw anything up and they never lose anything, right?
[08:21.220 --> 08:21.620]  Okay?
[08:22.780 --> 08:28.380]  And, but at least in APHIS, most of the crime shells will be like, sometimes we don't have somebody.
[08:28.560 --> 08:29.260]  That's what they can do.
[08:29.460 --> 08:30.730]  Hmm, who could it be?
[08:31.600 --> 08:32.380]  That kind of scene.
[08:32.940 --> 08:34.740]  And rape kit backlogs, they don't have that problem.
[08:34.940 --> 08:36.000]  They're, boom, they're done, right?
[08:36.440 --> 08:40.310]  Actually, some of the, um, damn, what's the, what's the crime show?
[08:40.430 --> 08:40.880]  Law and Order.
[08:40.950 --> 08:43.430]  Some of the Law and Order shows have actually said, oh yeah, the backlog's bad.
[08:43.920 --> 08:47.020]  And, but then like the next episode of the same show, we got it done.
[08:47.530 --> 08:48.880]  The backlog's like a year long.
[08:49.070 --> 08:50.000]  What are you talking about, guys?
[08:50.280 --> 08:54.760]  I mean, I know that in between TV time, it, real time speeds up really fast, but that's ridiculous.
[08:55.400 --> 08:59.600]  So the point is, is that the CSI effect, this is what people believe.
[09:00.520 --> 09:03.100]  They see this over and over and over again.
[09:03.450 --> 09:06.710]  How many of you have friends that are addicted to Law and Order, CSI, NCIS?
[09:07.640 --> 09:09.160]  Name the, the bullshit crime show.
[09:09.290 --> 09:10.500]  How many of you have friends that are addicted to them?
[09:10.550 --> 09:11.600]  How many of you are addicted to them?
[09:11.880 --> 09:15.430]  Be honest, binge watching on Netflix, anybody?
[09:17.880 --> 09:20.240]  It's like a drinking game though, screw something up.
[09:22.310 --> 09:28.140]  That's like when you watch any of the, any of the purported hacker shows, and they're like, I'm going to write a VB GUI to track the IP address.
[09:28.360 --> 09:29.020]  And you're just like, oh!
[09:31.120 --> 09:31.930]  Drink, thank you.
[09:33.190 --> 09:36.050]  Okay, so, this is the problem.
[09:36.240 --> 09:38.920]  In a real courtroom, they did tests, they did studies.
[09:39.040 --> 09:39.980]  And I have them listed at the bottom.
[09:40.340 --> 09:41.500]  If you can't see them, don't worry.
[09:41.640 --> 09:42.900]  I will happily send them to you.
[09:43.550 --> 09:52.290]  Compared to non-CSI viewers, CSI viewers are more critical, but more CSI viewers expect to see scientific evidence, crime lab evidence.
[09:52.740 --> 09:55.360]  So, you're, you're caught in a, in a catch-22.
[09:55.720 --> 09:59.050]  They want you to bring evidence, but they're going to be really critical of it.
[09:59.260 --> 10:00.810]  So, what the hell do I do?
[10:01.340 --> 10:07.600]  I mean, it's so bad that this is a joke in the law, but it's like real.
[10:08.140 --> 10:11.660]  We have 10 eyewitnesses, he has motive, motive, and my client pled guilty.
[10:11.760 --> 10:12.160]  He's guilty.
[10:12.340 --> 10:13.070]  Where's the DNA?
[10:14.160 --> 10:15.520]  It's a joke, and it's not.
[10:15.660 --> 10:16.100]  It happens.
[10:16.100 --> 10:18.880]  So, the question is, what are the effects?
[10:19.140 --> 10:21.500]  Does it make juries more dubious or more gullible?
[10:21.620 --> 10:24.040]  Because in some cases, it makes them more dubious.
[10:24.190 --> 10:25.220]  We're critical of the evidence.
[10:25.400 --> 10:27.570]  In some cases, it makes the juries more gullible.
[10:27.740 --> 10:29.640]  Oh, it's a guy in a white lab coat.
[10:29.760 --> 10:31.000]  He must be like a god.
[10:31.220 --> 10:36.720]  I'm just going to listen to him and accept everything he says, and not use my critical thinking facilities, which have been blunted by Budweiser.
[10:37.320 --> 10:38.220]  And Fox News.
[10:38.400 --> 10:40.310]  And Fox News, phone news.
[10:40.760 --> 10:41.190]  Anyway.
[10:42.950 --> 10:44.290]  And our school system.
[10:49.510 --> 10:50.900]  Do police get defensive?
[10:51.280 --> 10:53.620]  Do they waste money by ordering tests?
[10:53.900 --> 10:54.840]  Look, this is budget.
[10:55.140 --> 10:55.780]  This is money.
[10:56.180 --> 10:59.580]  If you've got an open-shut case, if you've got 10 eyewitnesses, he pled guilty.
[10:59.720 --> 11:00.800]  He's like, yeah, here's how I did it.
[11:00.900 --> 11:01.640]  Here's the plans.
[11:01.720 --> 11:02.520]  Here's the diagrams.
[11:02.840 --> 11:03.600]  Here's the weapon.
[11:03.740 --> 11:05.280]  Oh, by the way, the body's over here.
[11:05.420 --> 11:06.080]  It's right there.
[11:06.180 --> 11:06.880]  It's under that leaf.
[11:07.040 --> 11:10.120]  And by the way, you're going to find it under a log twisted at a 90-degree angle.
[11:10.120 --> 11:10.680]  And they do it.
[11:10.740 --> 11:11.140]  And they find it.
[11:11.200 --> 11:11.500]  And it's there.
[11:11.640 --> 11:12.440]  And they're like, oh, wait.
[11:12.540 --> 11:13.320]  Does he have DNA evidence?
[11:13.500 --> 11:14.400]  It's like, crap.
[11:14.560 --> 11:14.780]  Okay.
[11:14.900 --> 11:16.000]  We better order a DNA test.
[11:16.430 --> 11:18.580]  So does it waste your taxpayers' money?
[11:18.820 --> 11:20.440]  Does it waste your crime lab time?
[11:20.540 --> 11:23.140]  Does it contribute to the backlog because of that?
[11:23.880 --> 11:28.020]  Does it make prosecutors, judges, and lab techs change how they view expert witnesses?
[11:28.740 --> 11:29.160]  Well, shit.
[11:29.300 --> 11:31.520]  This is going to screw you when you go in as a forensic expert.
[11:31.520 --> 11:32.520]  This is the most common one.
[11:32.660 --> 11:35.020]  When you go in as a forensic expert into a courtroom, won't it?
[11:35.180 --> 11:35.960]  It'll screw you over.
[11:36.300 --> 11:53.260]  It'll screw you when you go into a courtroom as an expert witness on some procedure for system administration, for a pen test that went wrong and you've got to defend your firm, for a pen test that went right and somebody's suing the hosting firm because you went in to do a pen test against a hosting company.
[11:53.760 --> 11:54.840]  We're a big company.
[11:54.900 --> 11:55.700]  We're co-lawing with them.
[11:55.820 --> 11:57.300]  We've got authorization to do a pen test.
[11:57.380 --> 11:57.680]  Go ahead.
[11:57.680 --> 11:59.480]  And you come up with, oh my God.
[11:59.860 --> 12:02.300]  And the hosting company says, we're suing you because none of that's real.
[12:02.400 --> 12:05.180]  And you're ruining our reputation and our goodwill and our corporate blah, blah, blah.
[12:05.740 --> 12:06.760]  And you've got to go to court.
[12:07.400 --> 12:07.720]  Okay?
[12:07.920 --> 12:11.140]  Now, you may not have DNA evidence unless you did really obscene things with the servers.
[12:11.560 --> 12:11.880]  Okay?
[12:12.860 --> 12:14.980]  And, you know, it was authorized.
[12:16.200 --> 12:17.940]  I want to see that letter of authorization.
[12:19.260 --> 12:21.040]  And I just sent you a letter of authorization.
[12:21.220 --> 12:22.960]  So I know that's not in there, dude.
[12:23.560 --> 12:24.320]  Actually, that's the truth.
[12:24.360 --> 12:25.000]  I just sent them one.
[12:26.360 --> 12:27.900]  It's a legitimate research topic.
[12:28.080 --> 12:29.480]  There's been some research done on it.
[12:29.580 --> 12:32.100]  But every piece of research I found has some bias one way or another.
[12:32.240 --> 12:33.620]  It was done by law enforcement agencies.
[12:33.860 --> 12:35.640]  It was done by crime labs themselves.
[12:35.940 --> 12:37.560]  And legitimately, they're the ones interested in it.
[12:37.660 --> 12:38.780]  But still, there is bias.
[12:38.900 --> 12:40.520]  And we found inherent bias in most of the studies.
[12:40.920 --> 12:42.680]  In real life, you've got to deal with this crap.
[12:42.720 --> 12:43.360]  So what do you do?
[12:43.560 --> 12:48.220]  So I've got a few, just a few things to tell you about.
[12:48.520 --> 12:49.940]  Has anybody heard of the Daubert test?
[12:51.280 --> 12:52.180]  Or the Daubert procedure?
[12:52.300 --> 12:53.020]  Yes, our lawyers.
[12:53.200 --> 12:53.680]  Very good.
[12:53.680 --> 12:55.080]  Any other lawyers in the room?
[12:56.500 --> 12:57.280]  Okay, one.
[12:57.340 --> 12:58.040]  Not that we'll admit it.
[12:58.080 --> 12:59.080]  Not that we'll admit it.
[12:59.340 --> 13:00.420]  I passed the bar.
[13:00.640 --> 13:01.260]  Please don't hurt me.
[13:01.860 --> 13:05.140]  The Daubert test is, hey, does the judge think you're qualified?
[13:05.680 --> 13:06.940]  Literally, that's all it is.
[13:07.020 --> 13:07.780]  Am I vaguely right?
[13:10.810 --> 13:11.810]  I'm para-quoting.
[13:11.910 --> 13:12.190]  Thank you.
[13:12.470 --> 13:15.910]  The Daubert test is, can you prove that you're an expert?
[13:16.490 --> 13:21.530]  Can you prove beyond a shadow of a doubt, that's, don't take that literally, that you're an expert?
[13:21.530 --> 13:24.230]  You know, hey, let's say it's a forensic case.
[13:24.390 --> 13:26.190]  I've done this SANS course.
[13:26.330 --> 13:27.570]  I'm certified as this.
[13:27.830 --> 13:29.990]  I've done these five other court cases.
[13:30.110 --> 13:31.330]  I've been accepted as an expert.
[13:31.490 --> 13:32.550]  And it's really fuzzy.
[13:32.710 --> 13:35.850]  It really is the opinion of everybody in the courtroom say, you're an expert.
[13:35.990 --> 13:37.930]  You have to prove it to them and show them.
[13:38.070 --> 13:38.890]  So what does that mean?
[13:39.230 --> 13:42.030]  It means you've got to have a CV or a resume, curriculum vitae.
[13:42.030 --> 13:44.290]  You've got to have your certifications to go to court.
[13:44.490 --> 13:45.710]  I know, I know, certs.
[13:46.130 --> 13:47.730]  But you really kind of have to.
[13:47.930 --> 13:49.810]  Do you have relevant industry experience?
[13:49.950 --> 13:51.670]  And are you a confident sumbitch?
[13:52.610 --> 13:58.430]  If you walk into the courtroom and go, I did this once or twice, Daubert test, fail.
[13:58.870 --> 14:02.310]  If you walk in and go, yes, I've done it six times in various courts.
[14:02.750 --> 14:09.970]  My testimony has been accepted as an expert witness in Indiana, Illinois, New Jersey, New York, and Florida, as well as Lithuania.
[14:09.970 --> 14:10.550]  Lithuania.
[14:10.690 --> 14:12.270]  Lithuania, it's a long story.
[14:12.450 --> 14:12.890]  Okay, whatever.
[14:13.550 --> 14:16.190]  You're going to have a much better chance of being accepted as an expert witness.
[14:16.470 --> 14:17.030]  Does that make sense?
[14:17.350 --> 14:18.330]  But don't lie.
[14:18.650 --> 14:20.970]  If you've never been to court before, don't mention it.
[14:21.150 --> 14:23.570]  Just don't say, I've never been to court before.
[14:23.870 --> 14:26.430]  Do something like my work.
[14:26.590 --> 14:28.210]  I've spoken at various conferences.
[14:28.610 --> 14:29.890]  Talk about your industry experience.
[14:30.030 --> 14:30.890]  Does that make sense to everybody?
[14:31.230 --> 14:31.410]  All right.
[14:31.650 --> 14:33.930]  You need to prove to them that you're an expert.
[14:34.070 --> 14:34.910]  That's the Daubert test.
[14:35.150 --> 14:37.310]  That's how you get accepted as an expert witness in court.
[14:37.570 --> 14:38.110]  All right.
[14:38.110 --> 14:47.270]  And if you go to court as a defense, a defendant, you can still be asked as to the qualifications and everything else.
[14:47.450 --> 14:49.250]  Make sure you know what the hell your qualifications are.
[14:49.410 --> 14:57.010]  If you're going in because you busted a server and it was outside the scope and it was the same subnet, same naming scheme, I thought it was fine.
[14:59.710 --> 15:00.890]  Okay, well, prove it.
[15:01.170 --> 15:02.250]  What do you mean not prove it?
[15:02.350 --> 15:03.770]  Well, why did you think it was fine?
[15:03.950 --> 15:16.150]  Well, in my relevant experience, if it's in the same subnet, here's our letter of authorization for that subnet, here's the name of the server, here's the naming scheme they were using on their servers, it appears to be ins... that comes across pretty well as,
[15:16.270 --> 15:17.130]  dude, I thought it was cool.
[15:18.490 --> 15:18.930]  Right?
[15:19.770 --> 15:21.270]  You come across still as an expert.
[15:21.530 --> 15:24.510]  Same thing happens if you're a defendant or if you're an expert witness.
[15:24.810 --> 15:25.610]  Does that make sense to everybody?
[15:25.750 --> 15:26.330]  It's important.
[15:26.910 --> 15:28.010]  So don't lie.
[15:28.990 --> 15:32.030]  Credibility, if you lose credibility once, you've lost it forever.
[15:33.090 --> 15:33.690]  It's done.
[15:34.130 --> 15:34.710]  Got it.
[15:35.390 --> 15:35.770]  I'll be done.
[15:35.950 --> 15:36.010]  Easy.
[15:36.730 --> 15:39.110]  Be ready to explain why your tests don't explain the answers.
[15:39.330 --> 15:40.550]  Who here has done forensics?
[15:40.690 --> 15:41.790]  Live response forensics.
[15:42.790 --> 15:43.750]  Okay, a few people.
[15:43.930 --> 15:46.250]  In live response forensics, we make changes, right?
[15:46.830 --> 15:48.210]  Can you explain those changes?
[15:50.530 --> 15:51.470]  You have to.
[15:51.770 --> 15:56.140]  Otherwise, you can do it like that.
[15:56.540 --> 15:57.380]  It's science.
[15:58.460 --> 16:03.820]  You better be able to explain the changes you've made in live response forensics because otherwise the judge is going to be, you made changes.
[16:04.200 --> 16:05.340]  You ruined the evidence.
[16:05.480 --> 16:05.580]  Bye.
[16:05.940 --> 16:21.420]  If you can explain the changes, if you can understand what's going on, if you can show how your collection caused these changes, your modification or your imaging, your file carving, your whatever, your memory dump for decompilation of the memory or decryption,
[16:21.500 --> 16:24.380]  pulling the encryption keys, these are the changes that it made.
[16:24.460 --> 16:27.960]  And you can explain them credibly, logically, reasonably, understandably.
[16:28.200 --> 16:36.420]  And remember that what we understand might not be what grandpa, grandma, man on the street, Joe Q public, John Q public, whatever can understand.
[16:36.960 --> 16:37.080]  Okay?
[16:37.880 --> 16:42.560]  What I mean is quite literally, find family members and check your explanations on them.
[16:42.740 --> 16:49.240]  Find people that are not geeks, find people that are not in our world and try your explanations out on them.
[16:49.680 --> 16:55.040]  A great one would be most lawyers because they're about as technical as a flock of geese, most of them.
[16:56.000 --> 16:56.440]  Okay?
[16:56.800 --> 17:00.140]  If your lawyer can understand your explanation, you're probably doing okay.
[17:01.440 --> 17:02.060]  All right.
[17:02.260 --> 17:03.380]  Yeah, that was... sorry lawyers.
[17:03.600 --> 17:04.160]  I'm sorry.
[17:05.300 --> 17:08.260]  But the other important thing is you're going to be in cross-examination.
[17:08.840 --> 17:10.300]  So listen to the lawyer.
[17:10.540 --> 17:18.860]  When they tell you don't answer that question, answer it this way, you can discuss it with them privately, but you can't answer it the way they say don't answer it.
[17:18.860 --> 17:20.060]  Trust me, there's a trap there.
[17:20.420 --> 17:20.860]  Okay?
[17:21.100 --> 17:22.120]  And I should have put Ackbar.
[17:22.260 --> 17:24.100]  It's a trap because it is.
[17:24.980 --> 17:29.300]  If you answer a question wrong, you can get seriously screwed in court.
[17:29.540 --> 17:30.320]  Alex, am I right?
[17:34.140 --> 17:35.320]  And what if you're the defendant?
[17:36.060 --> 17:37.480]  Yeah, you won't get hired again.
[17:37.740 --> 17:39.620]  You'll have these problems called making rent.
[17:39.780 --> 17:40.440]  It's a detail thing.
[17:41.120 --> 17:43.200]  So what do you do?
[17:43.480 --> 17:44.340]  You're confident.
[17:44.640 --> 17:45.220]  You're an expert.
[17:45.220 --> 17:46.420]  You do... You're credible.
[17:46.880 --> 17:48.980]  And in the lab... Two more minutes.
[17:49.400 --> 17:50.760]  Document, document, document.
[17:51.120 --> 17:54.240]  If you don't document, you didn't do it.
[17:54.960 --> 17:56.500]  I don't care if you're pen testing.
[17:56.660 --> 17:58.060]  I don't care if you're doing forensics.
[17:58.180 --> 18:02.200]  I don't care if you're doing network, you know, oil pen adjustment.
[18:02.360 --> 18:03.080]  Whatever the hell you're doing.
[18:03.140 --> 18:03.600]  I don't care.
[18:04.560 --> 18:05.600]  Document the hell out of it.
[18:05.640 --> 18:06.620]  Otherwise, you didn't do it.
[18:06.700 --> 18:09.240]  And this also goes to being a professional in our industry.
[18:09.460 --> 18:10.940]  Do you get paid to be a pen tester?
[18:11.700 --> 18:12.020]  No.
[18:12.640 --> 18:14.080]  You get paid to be a You're a report writer.
[18:14.520 --> 18:16.340]  Your work product is what you write.
[18:17.000 --> 18:20.220]  So document the hell out of everything you do, okay?
[18:20.340 --> 18:22.340]  Did you collect every possible data point?
[18:22.560 --> 18:29.920]  Can you explain why you collected that data point and how you collected that data point and what changes collecting that data point made?
[18:30.140 --> 18:32.820]  Because if you can't write it, don't fight it.
[18:33.720 --> 18:34.700]  It's that simple.
[18:34.800 --> 18:36.000]  Seriously, okay?
[18:36.440 --> 18:38.020]  Did you document enough?
[18:38.700 --> 18:39.080]  No.
[18:39.320 --> 18:39.980]  Do it again.
[18:40.280 --> 18:41.140]  You didn't.
[18:41.200 --> 18:41.440]  No, no.
[18:41.560 --> 18:41.960]  Trust me.
[18:42.140 --> 18:42.920]  You didn't.
[18:42.920 --> 18:43.920]  Do it again.
[18:44.700 --> 18:45.420]  Document it again.
[18:45.780 --> 18:46.180]  All right?
[18:46.780 --> 18:53.320]  So now, I'm going to switch over to my colleague, who's going to talk about how this affects you and I in the world.
[18:55.640 --> 18:58.880]  So just a minor point about the documentation.
[18:59.020 --> 19:07.760]  I just published one of my first law review paper, and every time I thought I had written enough, they sent it back to me to put more words in.
[19:10.080 --> 19:11.960]  I'm going to take things in a different direction now.
[19:12.120 --> 19:13.780]  We're going from the courtroom to Capitol Hill.
[19:14.320 --> 19:22.360]  When I first started writing this talk, that wasn't my intention, but so much information has come in the news recently that the talk took a completely different direction.
[19:23.680 --> 19:30.460]  I want to talk to you about privacy surveillance, digital rights, but I'm not talking about the NSA or any other three-letter agency surveillance.
[19:30.460 --> 19:39.940]  I want to talk to you about everything else, and how the technology, new tech, and new uses for existing tech, is changing so quickly that the legal system can't keep up.
[19:40.160 --> 19:56.420]  And I want to give you a couple of examples where I think this is the case, and I hope to encourage the hackers in the audience to combine with the lawyers and the policy makers in the audience, and collaborate so that the CSI effect doesn't frame the debate that we're going to have on the legislation we need.
[19:58.200 --> 20:06.440]  So, as I do that, I need to talk to you a little bit about what privacy means in the U.S., and essentially, it's the right to be left alone.
[20:08.120 --> 20:18.320]  And that's sort of evolved into this privacy of person, unless you're a female, and property and possessions.
[20:18.320 --> 20:34.320]  And along with that, this sort of idea of privacy of information, and that's mostly governed by the Fourth Amendment, which is the one that requires for wiretap or surveillance a warrant sanctioned by a judge with probable cause.
[20:34.740 --> 20:53.840]  But when we talk about any of your communications, the discussion is always framed in something known as the third-party doctrine, which essentially says that if you knowingly give away information to a third-party, you are no longer protected by the Fourth Amendment.
[20:54.320 --> 20:57.900]  So the key word in my entire presentation here is going to be knowingly.
[20:58.580 --> 21:00.480]  And the italics, by the way, on these are mine.
[21:02.140 --> 21:21.440]  If you walk around this city, or any other major city, if you drive a car, if you shop online, if you stream videos, if you use any form of communication media like Twitter or something, if you carry a health monitor, if you have a cell phone, you are disclosing a metric shitload of information about yourself everywhere you're going.
[21:21.640 --> 21:23.480]  But are you doing it knowingly?
[21:23.480 --> 21:38.340]  You see, when the laws were first written and up until very recently when they've been interpreted, the ways or mechanisms by which privacy could be violated and the forms those violations could take were well understood.
[21:39.300 --> 21:42.280]  And they were costly.
[21:42.520 --> 21:43.500]  They were hard to do.
[21:43.620 --> 21:45.640]  They were human-intensive and they did not scale.
[21:45.960 --> 21:47.880]  And that is no longer the case.
[21:48.680 --> 21:51.640]  And we're not the only ones thinking about this.
[21:51.640 --> 22:01.940]  In 2012, Justice Sotomayor said, it may be necessary to reconsider the premise that an individual has no reasonable expectation of privacy and information voluntarily disclosed to third parties.
[22:02.360 --> 22:10.740]  This approach is ill-suited to the digital age in which people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.
[22:11.140 --> 22:13.240]  And that's only going to get worse.
[22:13.380 --> 22:15.200]  So let me give you a couple of examples.
[22:16.660 --> 22:18.260]  I'm starting with Facebook.
[22:18.660 --> 22:25.080]  And everybody knows that Facebook collects an awful lot of data on us, right?
[22:26.880 --> 22:34.140]  But this is a perfect example of how the technology is changing and the law hasn't kept up.
[22:34.300 --> 22:35.280]  And here's why.
[22:36.080 --> 22:42.240]  Facebook just announced that they had run a massive scale experiment on their customers.
[22:44.260 --> 22:50.520]  This ugly page is part of an 18-page document full of very tiny points.
[22:50.520 --> 22:52.120]  I just embiggened two of the paragraphs.
[22:52.860 --> 22:56.600]  That I have to go through as a scientist if I want to run that same experiment.
[22:57.260 --> 23:01.840]  I have to prove and give detailed proof of how I went about it.
[23:01.840 --> 23:09.000]  That every single volunteer, and they must be volunteers specifically for that experiment, not volunteers for experiments in general.
[23:10.140 --> 23:15.900]  How I informed them of what they were going to be tested of and they gave me informed consent.
[23:16.760 --> 23:23.600]  Now Facebook's experiment had 700,000 people involved in it and their informed consent is the EULA.
[23:27.420 --> 23:30.720]  Here's another example and this one really scares me.
[23:30.960 --> 23:39.080]  The New York Times reported two weeks ago that the Pittsburgh Health Plan is doing market analytics.
[23:39.420 --> 23:45.940]  They are buying information from data brokers in order to decide who are their most expensive customers.
[23:46.220 --> 23:50.800]  In other words, the ones who are most likely to use urgent care and who are their wealthiest customers.
[23:52.200 --> 24:01.700]  The data broker, the vice president for client strategy, his marketing brochure for the brokerage they purchased, said this.
[24:02.740 --> 24:06.100]  Here are other techniques for influencing well-insured patients.
[24:06.380 --> 24:10.640]  Hospitals can send birthday messages to all high-valued men and women, he wrote.
[24:10.840 --> 24:18.480]  Or notify profitable individuals 18 and above about special round-the-clock healthcare call-in lines staffed by nurses.
[24:18.480 --> 24:24.120]  And encourage those revenue-generating patients to schedule medical tests or appointments.
[24:24.760 --> 24:36.300]  Now I'm a bit concerned about my health plan buying access to my shopping habits in order to determine whether or not I deserve access to a nurse after hours.
[24:37.660 --> 24:41.020]  There's no legislation to deal with this sort of thing.
[24:42.220 --> 24:44.080]  Here's another very pertinent example.
[24:44.860 --> 24:47.020]  Renew is a marketing company.
[24:47.980 --> 24:51.640]  They set up a bunch of Wi-Fi enabled trash cans.
[24:52.800 --> 24:54.980]  And this was a year ago last June.
[24:55.240 --> 25:00.760]  These Wi-Fi enabled trash cans collect the MAC addresses of anybody, any device that's walking by.
[25:00.760 --> 25:08.880]  So in one week, twelve trash cans, just twelve, collected four million devices.
[25:09.880 --> 25:18.080]  And they allowed the company marketers to track the... to map the footfall of the owners within a four-minute walk of storefronts.
[25:18.440 --> 25:21.080]  And this isn't the only information that they're aggregating.
[25:21.560 --> 25:24.980]  Suppose they're also tracking gait or time from place to place.
[25:26.140 --> 25:30.800]  That gives them the possibility of knowing the gender.
[25:31.100 --> 25:34.980]  Suppose they're tracking somebody going into a big and tall store.
[25:35.180 --> 25:36.780]  Is that person possibly obese?
[25:37.920 --> 25:40.540]  There's all sorts of other information that can be correlated.
[25:40.960 --> 25:55.860]  And according to EFF, a report that they just put out recently, every Android phone for the past three years not only leaks the MAC address, but all the Wi-Fi history up to the 15, a limit of 15.
[25:57.440 --> 26:04.360]  They said, when we looked at these network lists, we realized, in fact, that they were dangerously precise location histories.
[26:05.980 --> 26:14.860]  How can you knowingly give your consent if you don't know what's being collected, where it's being collected, who's doing the collecting, and how it's going to be used?
[26:17.690 --> 26:22.210]  And here's another example of data collection.
[26:23.170 --> 26:27.820]  People not only collect data on us, but they also provide data to us.
[26:28.780 --> 26:30.690]  Who decides what we get to know?
[26:31.850 --> 26:36.540]  And the example I put up here is Google recently bought Nest.
[26:36.960 --> 26:41.000]  And there was a company called Vidant that was their major competitor.
[26:41.300 --> 26:45.920]  And right after they purchased Nest, all the links to Vidant disappeared from Google's web searches.
[26:46.820 --> 26:55.240]  Google made the claim that this was because of some links that, quote, sat outside their quality guidelines.
[26:56.960 --> 27:04.840]  But investigations of other companies who have had the same problem with Google, they were able to get their links reinstated really quickly.
[27:04.900 --> 27:07.880]  And it took over four months before Vidant got their links up.
[27:07.880 --> 27:09.660]  Because you can never find Viagra on Google.
[27:09.880 --> 27:10.190]  Right.
[27:11.930 --> 27:13.080]  So here's another one.
[27:13.080 --> 27:15.360]  Are you familiar with the No IP stuff?
[27:15.860 --> 27:24.860]  So Microsoft's superhero evil hacks or finding team convinced a judge to just let them take over a chunk of the Internet that was owned by No IP.
[27:25.260 --> 27:27.980]  No IP has 14 million customers, including me.
[27:28.210 --> 27:31.690]  I bought a Wi-Fi router to extend my network into my backyard.
[27:31.960 --> 27:36.240]  And if I want to upgrade the firmware, the website is hosted by No IP.
[27:38.020 --> 27:44.080]  So the issue here is not that some of No IP's customers were doing evil things.
[27:44.080 --> 27:45.120]  They claim to terrorism.
[27:46.360 --> 27:52.710]  But why the hell one private entity just got handed control of another private entity's business assets?
[27:53.080 --> 27:58.500]  This is like me saying, dear judge, here's a picture of somebody using a U-Haul for a crime.
[27:58.660 --> 28:00.020]  Give me all of U-Haul's trucks.
[28:01.000 --> 28:02.360]  But you're not Microsoft.
[28:02.620 --> 28:03.450]  Microsoft is the government.
[28:03.620 --> 28:04.280]  I mean...
[28:05.740 --> 28:06.720]  Another example.
[28:07.060 --> 28:09.040]  PayPal doesn't really like crowdfunding.
[28:09.300 --> 28:15.760]  And so they just decided that this Swiss company whose job...
[28:15.760 --> 28:18.300]  They provide an encrypted email service.
[28:18.520 --> 28:22.120]  They just closed them all down and said, we don't know if encryption is legal.
[28:22.930 --> 28:26.560]  It's not PayPal's job to decide whether it's legal or not.
[28:26.560 --> 28:27.880]  They don't get to decide that.
[28:29.820 --> 28:32.020]  And what about a corporation's conscience?
[28:32.890 --> 28:48.210]  Given the new ruling from the Hobby Lobby, what if a corporation decides against their conscience to let you get information on climate change or evolution or, God forbid, women's health?
[28:52.710 --> 29:00.720]  A recent study on the UK's porn filters discovered that they blocked, on average, one in five out of every websites.
[29:05.900 --> 29:06.640]  Sounds right.
[29:07.000 --> 29:08.780]  So here's another thought.
[29:09.120 --> 29:10.400]  Who has the liability?
[29:10.690 --> 29:14.950]  This is another point where I don't think the legal system is addressing this well.
[29:16.620 --> 29:17.950]  The example I've chosen here...
[29:18.940 --> 29:29.820]  A company is suing Google right now because they went out of business a few months after Google Places changed their listing and showed that they were closed on weekends.
[29:30.120 --> 29:32.400]  And they'd done 75% of their business on weekends.
[29:32.600 --> 29:38.840]  And the only reason they found out that it had been changed was that a customer had called and said, why did you suddenly decide to close?
[29:40.710 --> 29:41.800]  Who has the liability?
[29:43.120 --> 29:44.480]  Here's another example.
[29:44.840 --> 29:45.820]  If you follow...
[29:46.320 --> 29:55.820]  If you purchase a company's product and you follow their instructions, and those instructions do something bad for you, who has the liability?
[29:56.450 --> 29:57.100]  In this...
[29:57.100 --> 30:10.420]  The example is Avant just bought a hundred, maybe a couple thousand of factory-wiped cell phones off of eBay and found that they could get back pretty much all the data.
[30:11.240 --> 30:15.300]  The email addresses, the text messages, the naked selfies, everything.
[30:16.670 --> 30:20.480]  But the people selling them had followed the instructions on how to clear their data.
[30:21.620 --> 30:23.660]  And the last is an interesting picture.
[30:23.760 --> 30:31.270]  This is a paper that was just published about two, maybe three weeks ago in a machine learning conference.
[30:32.840 --> 30:37.920]  And neural networks are machine learning algorithms, and they're pretty much the state of the art right now.
[30:39.540 --> 30:42.660]  And I know the picture's kind of fuzzy, but it's fuzzy in their paper too.
[30:44.340 --> 30:56.210]  What they discovered is that machine learning algorithms, the absolute best of the best algorithms right now, can't... do not see things the way the humans see.
[30:56.920 --> 31:06.540]  So, the pictures that are in the left column, and the pictures that are in the right column, even if you look at the high resolutions of them, humans can't tell the difference.
[31:07.000 --> 31:10.780]  But there are tiny perturbations in them, and machines get them wrong.
[31:11.540 --> 31:22.380]  So, what effect does... do things that are not understood in new technology, what effect is that going to have on the laws we have, and how the laws are interpreted?
[31:24.020 --> 31:25.360]  And what about new tech?
[31:26.380 --> 31:28.280]  There are drones all over the place.
[31:28.560 --> 31:29.360]  Drones with cameras.
[31:29.560 --> 31:30.240]  Mine has two.
[31:33.540 --> 31:35.260]  And... doesn't everybody have a drone?
[31:36.660 --> 31:40.100]  And the drones are being set up, and they're being bought by cities.
[31:40.100 --> 31:50.140]  They're mostly being bought with using Department of Homeland Security money, but they're being put up without the public knowing.
[31:50.360 --> 31:57.000]  For example, this test... well, they're advertising how they managed to stop a burglary.
[31:57.300 --> 31:58.360]  They didn't stop it.
[31:58.780 --> 32:00.420]  None of this stuff actually stops crime.
[32:00.560 --> 32:01.950]  It just lets you figure out who did it.
[32:04.260 --> 32:13.720]  But... they had set this up for nine days in Compton, California, without any of the public knowing, without even the city officials of Compton knowing.
[32:14.320 --> 32:22.900]  So, yeah, they may have caught one person doing a burglary, but how many other hundreds of thousands of millions of people did they get that weren't committing a crime?
[32:24.450 --> 32:25.720]  But think of the children.
[32:26.360 --> 32:27.960]  Well, we'll get to that in just a second.
[32:28.760 --> 32:29.860]  And here's this one.
[32:29.860 --> 32:36.140]  The city of Seattle, also with Department of Homeland Security money, has set up access points all over the place.
[32:36.480 --> 32:46.980]  And when people try and get any information answered, any questions answered about what's being done with these devices, they're being stonewalled.
[32:47.600 --> 32:49.620]  And here's the reasoning.
[32:49.620 --> 33:07.000]  Seattle Police Detective Monty Moss, one of the leaders of the Mesh Network Project, which is a $2.7 million effort paid for by DHS, wrote in an email that the department, quote, is not comfortable answering policy questions when we do not yet have a policy in place,
[33:07.380 --> 33:07.960]  close quote.
[33:08.300 --> 33:11.760]  But they're using the devices and they're collecting the information.
[33:13.260 --> 33:16.100]  That free Wi-Fi is free because you're the product.
[33:17.670 --> 33:19.820]  So consider the implications of this.
[33:20.120 --> 33:31.360]  The enormous volume of data that's being collected is magnified by the simple fact that the third-party doctrine essentially gives whoever collects data on you ownership of the data.
[33:31.720 --> 33:44.500]  That means that not only can they collect it, they can sell it to anybody they want, they can buy data from anybody who's also selling it, they can aggregate that data, they can run all sorts of analysis on that data, and they can store that data forever.
[33:45.740 --> 33:52.800]  Data is so trivially easily to collect that anyone can do it, and everybody is.
[33:53.100 --> 33:57.220]  And the reason why is because we like these devices.
[33:57.540 --> 33:59.190]  We like the services they provide.
[33:59.280 --> 34:02.100]  We like the apps that people have written for us.
[34:02.210 --> 34:04.580]  So this problem is just only going to get worse.
[34:05.450 --> 34:08.060]  Now I strayed very far from the CSI effect.
[34:08.060 --> 34:09.800]  So let me bring us back to it now.
[34:11.600 --> 34:14.100]  Anybody around in 1995?
[34:15.020 --> 34:19.200]  This was Time Magazine in the great cyber porn panic.
[34:21.820 --> 34:26.040]  And that was almost 10 years ago today.
[34:26.500 --> 34:28.040]  This is last week's.
[34:28.800 --> 34:29.460]  Look familiar?
[34:31.440 --> 34:32.340]  Kid grew up.
[34:35.630 --> 34:42.770]  One week or so after this came out, Congress voted in the Communications Decency Act.
[34:43.970 --> 34:49.050]  This was the law that said you can't put anything on the Internet that children aren't allowed to see.
[34:49.290 --> 34:50.590]  Because think of the children.
[34:53.810 --> 34:59.750]  This law was declared so unconstitutional that the Supreme Court struck it down 9-0.
[35:00.350 --> 35:00.830]  Okay?
[35:01.610 --> 35:05.990]  We have a very different Supreme Court now than we had 10 years ago.
[35:07.430 --> 35:12.110]  Given the current, the Hobby Lobby and other rulings.
[35:12.150 --> 35:16.710]  They have shown that they have a tendency to side with the corporation over the rights of the individual.
[35:18.150 --> 35:23.650]  I would rather, I think it's wiser that we deal with this before it becomes a law that needs to be struck down.
[35:23.650 --> 35:24.770]  Then let it get that far.
[35:28.450 --> 35:45.370]  And the reason this is so timely right now, and this is why I ended up talking about this, is that just last week, the Senate Intelligence Committee approved a new bill called CISA.
[35:45.370 --> 35:48.130]  And some of the things that CISA states is this.
[35:48.410 --> 36:05.110]  It authorizes individuals, anybody, and companies to monitor their own computer networks, and those of their consenting customers, which is nice, but what is consent is arguable, for cyber threats and to implement countermeasures to block those threats.
[36:05.510 --> 36:14.790]  It also puts in place liability protections for individuals and companies that appropriately monitor their networks and share cyber information.
[36:16.270 --> 36:18.150]  Here's the reasoning behind this.
[36:18.290 --> 36:21.410]  This is Senator Dianne Feinstein, who is chair of the committee.
[36:22.590 --> 36:32.450]  Every week we hear about the theft of personal information from retailers and trade secrets from innovative businesses, as well as ongoing efforts by foreign nations to hack government networks.
[36:33.050 --> 36:37.210]  This bill is an important step toward curbing those dangerous cyber attacks.
[36:37.210 --> 36:43.690]  Because cyber crime, because terrorists, because there are monsters out there in the world today.
[36:44.590 --> 36:49.550]  Let me give you a real-world example of why this is a horrific idea.
[36:50.590 --> 36:58.430]  Last October, Brian Krebs published information of a massive identity theft operation.
[36:58.930 --> 37:07.170]  This identity theft operation was traced back to this person in Vietnam, who ran an identity theft warehouse, essentially.
[37:09.090 --> 37:13.430]  He had access to approximately 200 million U.S. citizen records.
[37:14.370 --> 37:16.310]  And he got them quasi-legally.
[37:16.590 --> 37:26.770]  And by quasi, I mean that he signed up for a service, for a data brokerage that any of us can sign up for, and he did it by posing as a private investigator.
[37:27.650 --> 37:30.110]  Now, the service is a company called Court Ventures.
[37:30.110 --> 37:39.830]  And it described itself as a firm that, quote, aggregates, repackages, and distributes public record data obtained from over 1,400 state and county sources.
[37:40.690 --> 37:44.910]  But what you don't know is that Court Ventures is owned by Experian.
[37:45.050 --> 37:51.390]  So not only did he have access to the public aggregated data, but the private financial data as well.
[37:54.670 --> 37:56.610]  Now, fast forward a couple of months.
[37:57.290 --> 38:00.910]  Target has another really bad data breach, right?
[38:01.390 --> 38:03.250]  Millions and millions of their customers are affected.
[38:03.270 --> 38:05.950]  It was on all of their cash registers.
[38:07.050 --> 38:08.390]  A backdoor in...
[38:09.470 --> 38:21.050]  So the first thing that they did when they gave their mea culpa, oh, please forgive us and still stop at Target, was they went out and bought tens of thousands, hundreds of thousands of Experian licenses.
[38:21.650 --> 38:30.110]  And then they wrote on their page, use these licenses to go to Experian to have them protect your safety.
[38:30.450 --> 38:40.090]  They're encouraging their customers as a means to protect them from identity theft to give all of their data to a company that was selling it to identity theft people.
[38:42.310 --> 38:52.490]  And CISA, this new bill that they're going to be voting on soon, wants to absolve Experian and everybody else from liability if something bad happens.
[38:59.430 --> 39:07.510]  So the CSI effect is this justification for things.
[39:07.630 --> 39:09.850]  Are you aware that the UK just passed this horrible...
[39:09.850 --> 39:10.270]  Oh, thank you.
[39:13.010 --> 39:15.790]  This horrible, horrible surveillance bill this week.
[39:16.010 --> 39:18.670]  They rushed it through at night without debate.
[39:20.850 --> 39:23.850]  This is David Cameron's reasoning for this.
[39:24.030 --> 39:31.710]  I am simply not prepared to be a prime minister who has to address the public after a terrorist incident and to explain that I could have done more to prevent it.
[39:32.190 --> 39:43.050]  In other words, legislation resulting in the removal of restrictions that protect the privacy of individuals should never be rushed through because a politician is afraid for their political legacy.
[39:47.950 --> 39:54.390]  The laws we have, the laws we get, are going to depend on people's perception.
[39:55.350 --> 40:00.550]  And that perception is what needs to be protected and what are we protecting it from.
[40:00.550 --> 40:05.510]  And right now, because of the CSI effect, they think they're protecting it from evil hacksaws.
[40:08.510 --> 40:11.130]  But they don't understand what they're going to lose.
[40:11.390 --> 40:13.710]  They don't understand how the systems actually work.
[40:14.250 --> 40:21.790]  That in spite of the marketing brochures and the specifications, almost always the system does something else as well.
[40:21.790 --> 40:24.730]  They don't understand where the protections fail.
[40:29.170 --> 40:30.690]  This is why they need us.
[40:31.650 --> 40:35.890]  So, my whole push on this talk is to get you involved.
[40:36.110 --> 40:48.570]  Because hacksaws, and I'm going to speak a bit frankly here, my fellow and dear hacksaws, we tend to come off kind of like petulant teenagers when we do this discussion.
[40:48.970 --> 40:50.870]  Why do I have to have a curfew?
[40:51.030 --> 40:52.110]  I don't want rules.
[40:52.810 --> 40:54.990]  We don't speak law very well.
[40:56.330 --> 41:03.690]  We need to be collaborating with those people who do understand the law, who hack the legal system the way that we hack the technical side of things.
[41:05.230 --> 41:19.870]  We need them to translate the problems that we see, the things that we understand, into something that our politicians will understand and that our public will understand.
[41:20.210 --> 41:21.510]  We need collaboration.
[41:22.150 --> 41:27.030]  So, I want to end my part with this.
[41:28.010 --> 41:32.690]  When I prepared this talk, I went back and I reread the Declaration of Independence.
[41:32.990 --> 41:37.070]  And I reread the original Constitution and the first ten amendments.
[41:37.410 --> 41:38.390]  You must be a terrorist.
[41:39.270 --> 41:49.630]  I was struck very strongly by the impression that the former document is a statement decrying the abuse of power.
[41:50.050 --> 41:56.510]  And that the latter document is intended to curb those abuses.
[41:58.030 --> 41:59.910]  We have to make trade-offs.
[42:00.230 --> 42:04.370]  There are actually three players in this system and all of them have...
[42:05.370 --> 42:10.570]  not only should have the right, there's a real reason why they all have a voice.
[42:11.870 --> 42:15.530]  The first is, of course, us.
[42:15.750 --> 42:20.330]  Privacy, individualism, personal rights.
[42:20.690 --> 42:24.950]  The second player in the system is, of course, the society as a whole.
[42:25.290 --> 42:26.550]  Protection, security.
[42:26.910 --> 42:32.070]  And then the third system is our businesses because many of the devices...
[42:32.070 --> 42:38.030]  all of the devices that we use, all of the new apps that we're downloading, all of the services.
[42:38.310 --> 42:39.470]  We really like them.
[42:40.430 --> 42:47.270]  But their business model is made on collecting this data and doing something with this data that they collect.
[42:47.450 --> 42:50.590]  So they are going to have to be compromises.
[42:54.570 --> 43:08.070]  But as George Washington said when he presented the Constitution to the original first Congress, he said, it is at all times difficult to draw with precision the line between those rights which must be surrendered and those which may be preserved.
[43:09.650 --> 43:12.470]  Right now, the CSI is being used as a distraction.
[43:13.010 --> 43:14.850]  It's being used as a justification.
[43:15.890 --> 43:29.930]  We need a voice at the table so that it doesn't frame the entire conversation, so that what laws we end up with we have because of the informed consent of those of us who will be governed by them.
[43:30.950 --> 43:32.170]  Thank you for listening.
[43:32.410 --> 43:33.250]  And we'll take questions.
[43:42.360 --> 43:43.180]  Any questions?
[43:43.700 --> 43:46.820]  We did a tactical and a strategic overview of the CSI effect.
[43:47.400 --> 43:49.160]  And we hope you learned something.
[43:49.360 --> 43:50.000]  Anybody learn anything?
[43:50.440 --> 43:50.800]  Yes.
[43:51.300 --> 43:51.800]  Good.
[43:52.080 --> 43:52.560]  Good, good, good.
[43:52.780 --> 43:53.640]  I have a question.
[43:54.520 --> 43:55.140]  Go ahead.
[43:55.440 --> 43:57.380]  I have a good friend who is an appellate lawyer.
[43:57.380 --> 43:59.560]  And we talk about digital law a lot.
[43:59.680 --> 44:00.920]  But we're not actually involved.
[44:01.100 --> 44:01.960]  How do we get involved?
[44:02.480 --> 44:07.960]  One big suggestion is that, first of all, support the organizations that are already doing tech policy.
[44:08.380 --> 44:12.820]  That's CDT, EFF, EPIC, ACLU.
[44:13.680 --> 44:14.780]  Get involved with them.
[44:14.900 --> 44:17.860]  But the second one is that every one of us has local politicians.
[44:18.980 --> 44:23.400]  And there are local state offices and local federal offices.
[44:23.680 --> 44:24.960]  Get involved and volunteer.
[44:24.960 --> 44:28.460]  Be the tech interpreter for these people because they need volunteers anyway.
[44:29.320 --> 44:36.980]  And that's a good way to make sure that the only voices that the politicians hear are not the ones who benefit from the removal of the restrictions.
[44:38.060 --> 44:40.280]  And for God's sakes, just go to the damn voting booth.
[44:40.420 --> 44:41.200]  It's not that damn hard.
[44:42.200 --> 44:42.620]  Thank you.
[44:42.620 --> 44:44.040]  You either have your say or you don't.
[44:44.160 --> 44:45.180]  But it's your choice.
[44:47.440 --> 44:48.860]  One clap for voting?
[44:49.020 --> 44:49.140]  Wow.
[44:50.660 --> 45:01.800]  On that same vein, I mean, there's been a few situations lately, particularly in the U.S., where you've got a judge that didn't understand that people could have two cell phones, you know, for legitimate reasons.
[45:02.140 --> 45:07.000]  You know, and if you're a witness or a defendant or anything of the above in a case like that, it's a problem.
[45:07.000 --> 45:13.920]  You know, the judge has got a flip phone from the 1990s and that's about as a jitterbug phone and that's about as hard as he can get.
[45:14.360 --> 45:14.420]  Yeah.
[45:14.780 --> 45:16.400]  I mean, it's a pain in the ass.
[45:16.540 --> 45:17.220]  Yeah, I'm not going to lie.
[45:17.360 --> 45:22.260]  Did anybody read the New York Times article on how our laws are being decided by people who don't use the tech?
[45:22.260 --> 45:22.700]  Yeah.
[45:22.940 --> 45:24.760]  That's exactly the point I'm making.
[45:26.100 --> 45:26.740]  Go ahead.
[45:26.820 --> 45:27.000]  I'm sorry.
[45:27.180 --> 45:35.240]  I've tried inserting myself into that process, as you say, to be, you know, the one that translates geek to, you know, something that they can understand.
[45:35.960 --> 45:43.060]  Well, my problem I've run across is oftentimes there's no such budget for any sort of those meetings or anything like that.
[45:43.220 --> 45:51.860]  The other problem is a lot of the politicians and people higher up really don't like being reminded that they're dumb as toast.
[45:52.380 --> 45:54.720]  So they don't, you know, they love their ignorance.
[45:55.080 --> 45:58.260]  They don't want to be told differently by somebody half their age.
[45:58.380 --> 45:58.960]  You're absolutely right.
[45:59.080 --> 45:59.700]  They don't want to be told.
[45:59.760 --> 46:02.560]  But sometimes they have to listen because you can explain the benefit.
[46:02.840 --> 46:02.860]  Right.
[46:02.860 --> 46:10.760]  This is where things like business logic and opportunity cost and terms like that, that I know a lot of you cringe when I say these things, you have to understand them.
[46:10.920 --> 46:12.300]  Because you have to put it in terms they get.
[46:12.640 --> 46:16.820]  Yes, but tasering them and taping them into a chair is usually more effective, but we can't do that, unfortunately.
[46:16.920 --> 46:17.760]  So, Render...
[46:19.560 --> 46:21.840]  Render, if you social engineer anything, you know what's going on.
[46:21.840 --> 46:25.840]  You know that you have to put things in the term where it, how it benefits them.
[46:26.140 --> 46:28.060]  The big... and agreed.
[46:28.420 --> 46:31.660]  The few times I have been able to get access, that does work.
[46:31.860 --> 46:39.200]  But the biggest problem I have is when you're trying to go through channels that you get impeded by PAs and other people.
[46:39.780 --> 46:41.960]  And you don't get to the right years.
[46:42.600 --> 46:45.140]  If you can make the PA, the personal assistant, I assume you're saying?
[46:45.640 --> 46:51.540]  If you can make the assistant, if you can make the gatekeeper understand why this is to benefit them, that's the only way you're going to get to them.
[46:51.620 --> 46:53.340]  And I know you're not going to have a 100% response rate.
[46:53.620 --> 46:54.660]  You know that as well as I do.
[46:54.760 --> 46:55.360]  You know that Betta and I do.
[46:55.920 --> 46:59.440]  You're often not talking to the politicians, you're talking to their staffers.
[46:59.440 --> 47:01.260]  But it's the staffers that they listen to.
[47:01.900 --> 47:01.940]  Yeah.
[47:02.180 --> 47:03.440]  And they're rational people.
[47:03.440 --> 47:08.540]  If you don't come off sounding shrill, they will listen to you.
[47:09.080 --> 47:18.640]  One of the ways that I'm getting access to politicians is one of the startups I have, I'm a part of, is we're actually doing a funding routine using technology for political campaigns.
[47:19.020 --> 47:22.860]  I'm getting access to politicians simply because I handle their money flow.
[47:23.800 --> 47:24.920]  Nice, nice, nice.
[47:24.920 --> 47:28.480]  And we're using that to subtly inject, hey, tech is good.
[47:28.720 --> 47:29.260]  Good too.
[47:29.580 --> 47:30.860]  So, all right.
[47:30.980 --> 47:31.660]  Any more questions?
[47:32.560 --> 47:32.880]  Comments?
[47:32.980 --> 47:33.380]  Good jokes?
[47:33.840 --> 47:34.640]  And no, not me.
[47:35.380 --> 47:35.980]  All right then.
[47:36.140 --> 47:36.940]  Thank you very much.
[47:37.060 --> 47:37.080]  All right.
[47:37.120 --> 47:37.660]  Thank you ladies and gentlemen.