[00:01.560 --> 00:02.480]  Hey, everybody.
[00:03.120 --> 00:06.500]  It's time for the MetroCard discussion, I suppose.
[00:07.660 --> 00:09.320]  Red Balacava is going to be speaking.
[00:09.520 --> 00:19.980]  He has one request, and that is if you are taping this or taking pictures or recording, if it goes on broadcast television, pixelate the voice and... pixelate the face and change the voice.
[00:20.760 --> 00:23.000]  He's coming here shortly.
[00:23.300 --> 00:25.020]  He's hiding, apparently.
[00:25.360 --> 00:30.340]  And he'll be speaking from the middle of the room.
[00:30.940 --> 00:33.740]  And here he comes.
[00:34.500 --> 00:35.980]  Everybody, be happy.
[00:55.260 --> 00:56.220]  Good morning.
[00:57.500 --> 01:00.560]  As you can tell, I'm Red Balaclava.
[01:01.420 --> 01:05.600]  So named for my face gear.
[01:07.820 --> 01:12.220]  I had heard that I was supposed to be the first speaker today.
[01:12.500 --> 01:16.820]  And when I heard that, I had also heard from Emmanuel Goldstein.
[01:17.480 --> 01:21.240]  That we had a request from the Christian Broadcasting Network.
[01:21.760 --> 01:24.880]  That we have services, since it is the Lord's Day.
[01:25.200 --> 01:28.480]  So, we're going to oblige them, brothers and sisters.
[01:29.140 --> 01:35.820]  And since this is the house of the Lord, temporarily, I'd like to ask everybody wearing a cap, take it off.
[01:37.040 --> 01:40.920]  And it's just going to be a very, very short Bible reading.
[01:43.540 --> 01:44.940]  From Revelation...
[01:48.860 --> 01:50.260]  Revelation 13.
[01:51.700 --> 01:53.600]  Let me just get everything out.
[01:58.500 --> 01:59.550]  Revelation 13.
[02:02.060 --> 02:11.400]  But no man would be allowed to buy nor sell except that he had the mark of the beast upon his forehead.
[02:12.640 --> 02:16.480]  And the mark of the beast in his right hand.
[02:26.290 --> 02:28.850]  Thank you for coming to this Bible reading.
[02:29.930 --> 02:31.690]  Now on with my talk.
[02:38.280 --> 02:42.780]  As you know, I gave a talk last time around at HOPE.
[02:44.200 --> 02:47.580]  On the MetroCard, which at the time was the blue one.
[02:48.820 --> 02:50.240]  And that went over well.
[02:50.480 --> 02:52.340]  And we knew a few things about it.
[02:52.400 --> 02:53.840]  And we had read an awful lot.
[02:54.620 --> 02:58.040]  But what we had read was mostly news items.
[02:58.540 --> 03:01.980]  Not too much in the way of internal documents.
[03:02.660 --> 03:08.040]  Even though some of you know that I would have some access to internal documents.
[03:09.740 --> 03:11.020]  Won't say how.
[03:12.400 --> 03:16.540]  Since then, we've managed to come across lots of interesting things.
[03:16.820 --> 03:18.080]  And done a few mild.
[03:19.000 --> 03:21.040]  And I stress the word mild experiments.
[03:22.660 --> 03:29.240]  Those of you who think that you're going to learn how to go home and learn how to make imitation MetroCards.
[03:29.240 --> 03:32.840]  Or learn how to put $15,000 on the MetroCard you have.
[03:33.120 --> 03:35.300]  Are really sorely mistaken.
[03:38.020 --> 03:38.700]  I know.
[03:40.240 --> 03:40.680]  Okay.
[03:41.900 --> 03:44.820]  The heart of the MetroCard is a U.S.
[03:45.000 --> 03:45.300]  patent.
[03:45.960 --> 03:52.520]  It happens to be number 5,298,726.
[03:52.520 --> 03:55.100]  Issued March 29, 1994.
[03:56.540 --> 03:58.880]  To a man named Kenneth R.
[03:59.100 --> 03:59.560]  Aubrey.
[03:59.820 --> 04:01.840]  Who probably works for Cubic.
[04:01.980 --> 04:06.240]  The title of the patent is Fair Card Read Writer.
[04:06.440 --> 04:09.380]  Which overwrites oldest or invalid data.
[04:10.380 --> 04:14.440]  It's been assigned to Cubic Automatic Revenue Collection Group.
[04:14.640 --> 04:19.140]  Which you know is the people that make MetroCard turnstiles.
[04:19.720 --> 04:21.060]  And the MetroCard proper.
[04:21.900 --> 04:24.000]  It's really an ingenious system.
[04:24.360 --> 04:27.040]  And even though patents are pretty damn obtuse.
[04:27.280 --> 04:29.080]  And this one is no exception.
[04:30.920 --> 04:32.330]  If you listen carefully.
[04:32.840 --> 04:35.400]  And it is unfortunately much longer than I want to read.
[04:35.520 --> 04:36.480]  But I'm going to read it anyway.
[04:37.240 --> 04:38.340]  If you listen carefully.
[04:38.680 --> 04:41.760]  It comes out how ingenious this thing actually is.
[04:43.660 --> 04:44.240]  Abstract.
[04:44.620 --> 04:48.700]  An access control ticket having three fields of data.
[04:48.700 --> 04:51.340]  A first field of fixed data.
[04:51.540 --> 04:53.640]  A second field of variable data.
[04:54.160 --> 04:55.920]  And a third field of variable data.
[04:56.700 --> 04:58.520]  I am not consistent.
[04:58.780 --> 04:59.380]  I have to say.
[04:59.980 --> 05:00.500]  Is read.
[05:00.800 --> 05:03.560]  And information processed by a microprocessor.
[05:04.680 --> 05:06.740]  This tells us what we had suspected.
[05:07.020 --> 05:09.900]  Those of you who were at the first hope remember Bill SF.
[05:10.540 --> 05:13.320]  The hacker who successfully...
[05:13.320 --> 05:16.100]  Yeah, I sure give Bill a hand even though he's not here.
[05:19.310 --> 05:24.790]  He's one of the hackers who successfully defeated the BART.
[05:24.930 --> 05:27.070]  The Bay Area Rapid Transit card.
[05:29.950 --> 05:31.810]  In San Francisco.
[05:32.790 --> 05:39.010]  Bill determined pretty quickly that it was three tracks on the MetroCard.
[05:39.010 --> 05:42.310]  Unlike your credit cards in your pocket.
[05:43.410 --> 05:45.070]  Which only have two tracks.
[05:45.310 --> 05:46.950]  A MetroCard actually has three.
[05:47.430 --> 05:49.270]  The only other device...
[05:49.270 --> 05:50.970]  Access device.
[05:51.150 --> 05:53.890]  The only other card in common use with three tracks.
[05:54.950 --> 05:56.010]  Airline tickets.
[05:56.870 --> 06:02.950]  This is why it's been so difficult for us to get our hands on a three track reader.
[06:03.510 --> 06:05.210]  Or a three track reader writer.
[06:05.210 --> 06:07.530]  There aren't that many out there.
[06:08.230 --> 06:10.590]  You don't find them second hand.
[06:10.890 --> 06:19.750]  I'm sure every third person in the audience has a discarded or even bought legitimately credit card reader.
[06:19.890 --> 06:24.470]  Which you've hooked up to your PC and look or your oscilloscope and looked at.
[06:24.910 --> 06:26.530]  Those are easy to come by.
[06:27.030 --> 06:27.910]  Three tracks.
[06:28.230 --> 06:29.250]  Much more difficult.
[06:29.770 --> 06:31.030]  Back to the patent.
[06:32.030 --> 06:37.110]  The microprocessor determines the validity of information on the ticket data fields.
[06:37.650 --> 06:40.410]  And which of the variable fields has older data.
[06:41.170 --> 06:46.770]  Writing only occurs on or over the variable field with the invalid or older data.
[06:48.310 --> 06:53.650]  Upon subsequent use, the ticket contains current access data just written.
[06:53.650 --> 06:58.210]  And last, previous access data as well as fixed field data.
[06:58.850 --> 07:04.350]  This added data, past use, can be used for statistical analysis or other purposes.
[07:05.070 --> 07:10.970]  More importantly, the added data field reduces read-write reliability problems.
[07:11.650 --> 07:16.230]  One improperly written variable data field does not invalidate the ticket.
[07:16.490 --> 07:19.150]  Only the last variable data entry.
[07:19.150 --> 07:26.090]  The microprocessor is programmed to override invalid data in one of the variable data fields during the next use.
[07:27.650 --> 07:31.910]  Overall, a metric card tends to be self-correcting.
[07:32.290 --> 07:35.650]  If there's a minor error, it's no problem.
[07:35.910 --> 07:43.270]  If it's an error on not the data for your last use, but earlier use, it's still no problem.
[07:43.530 --> 07:47.250]  It only needs to know perfectly a few things.
[07:47.250 --> 07:56.410]  We're sure that all a turnstile needs to know is how much money is currently on the card, what the serial number is.
[07:57.110 --> 07:59.590]  That's what we know it has to know.
[07:59.830 --> 08:10.390]  We're pretty sure turnstile also has to know off a MetroCard, its expiration date, and its start date.
[08:10.730 --> 08:13.870]  This is what the turnstile has to know.
[08:13.870 --> 08:16.070]  There are three parts of this system.
[08:16.230 --> 08:17.290]  There's the turnstile.
[08:17.870 --> 08:22.390]  There's the booth computer and or area computer.
[08:22.750 --> 08:27.630]  I lumped them together because they're at the intermediate level for different purposes.
[08:28.030 --> 08:30.890]  And then there's the transit authorities mainframe.
[08:31.610 --> 08:33.770]  Back to the pen for a second.
[08:33.970 --> 08:36.770]  I'm almost done with this boring piece of...
[08:37.530 --> 08:40.350]  It's boring, but it gave us a lot of insight.
[08:42.130 --> 08:45.870]  Since the ticket still has the fixed data field...
[08:46.650 --> 08:48.370]  That's the serial number.
[08:48.570 --> 08:50.490]  That's the expiration date.
[08:51.850 --> 08:56.750]  Still has the fixed data field and a prior use variable data field.
[08:57.430 --> 09:00.050]  That's the time you went through a turnstile.
[09:00.830 --> 09:04.310]  That's probably the place you went through a turnstile.
[09:04.990 --> 09:07.090]  That's how much was taken off.
[09:07.230 --> 09:08.510]  How much is on the card.
[09:11.130 --> 09:12.030]  Back to the pen.
[09:12.030 --> 09:22.210]  No human intervention, repair of access control devices for single failures, or new tickets are required.
[09:22.590 --> 09:30.770]  The location of variable use data can also be segregated from fixed data to further enhance reliability.
[09:31.890 --> 09:40.310]  We believe very strongly that of these three tracks, one track is entirely stuff that's written on new.
[09:41.010 --> 09:54.710]  In other words, you wouldn't be able really to tell two cards from the same batch, from one another, aside from the subtle things like the serial number is off slightly.
[09:56.390 --> 10:00.450]  Finally, all the things that change are in one track.
[10:00.590 --> 10:02.130]  Actually, the number three track.
[10:04.950 --> 10:06.710]  Last couple lines of the pen.
[10:07.490 --> 10:22.150]  The reduction in failures and tolerance of single non-recurring errors allows hand-held swipe type read writers to be utilized for mass transit applications?
[10:23.330 --> 10:29.430]  Access is quick, avoiding manual ticket insertion, grabbing, transport, and return.
[10:30.590 --> 10:32.570]  It's really very ingenious.
[10:33.010 --> 10:49.470]  Unlike Washington DC and other transit systems, where the machine has to grab the ticket out of your hand, perform an action on it, and then return it to you, The transit authorities system allows some tolerance in the swipe speed.
[10:49.790 --> 10:56.890]  I know everybody is laughing to themselves, remembering sometime when it took them 20 shots to get through the turnstile.
[10:57.290 --> 11:01.050]  I really hate to say this, it was probably you.
[11:02.970 --> 11:03.990]  You laugh.
[11:04.210 --> 11:07.490]  I've seen people take 20 or 30 shots at it.
[11:07.490 --> 11:11.130]  Somebody else comes along and says, please, may I?
[11:11.670 --> 11:12.630]  One swipe.
[11:13.170 --> 11:17.730]  The turnstile didn't suddenly become lenient or polite.
[11:20.270 --> 11:24.830]  Let's talk a little about what's with the MetroCard, and what's been with the MetroCard.
[11:25.510 --> 11:28.810]  The MetroCard was first introduced in 1994.
[11:31.170 --> 11:35.310]  And when it was introduced, it was in a limited number of subway stations.
[11:35.930 --> 11:40.190]  And people kept saying, I'm not going to use it until it's everywhere.
[11:40.250 --> 11:41.850]  Well, it's now everywhere.
[11:43.350 --> 11:48.730]  And people are using it more and more, especially since the introduction of transfers.
[11:50.270 --> 11:56.350]  When it first came out, of course, people said, hey, maybe I can hack a MetroCard.
[11:57.490 --> 12:03.450]  People said, I'm sure when the token first came out in 1953, maybe I can hack a token.
[12:03.610 --> 12:09.990]  Only what they were saying then instead of hack was, maybe I can get a substitute token or make a counterfeit token.
[12:11.070 --> 12:12.670]  A slug, as it's known.
[12:14.230 --> 12:20.010]  Well, if you're interested in getting free rides, slugs are probably still the way to go.
[12:20.010 --> 12:21.170]  It's a lot easier.
[12:21.370 --> 12:22.470]  It's a lot lower tech.
[12:23.550 --> 12:30.130]  And the odds of your getting caught, even on a failure, are much better if you're using a slug.
[12:31.270 --> 12:40.330]  If you're using a MetroCard and you try a counterfeit MetroCard every day and it fails and then you pay, people are creatures of habit.
[12:40.550 --> 12:43.130]  Sooner or later they'll say, hey, at 6 p.m.
[12:43.150 --> 12:46.410]  at this station, somebody uses a counterfeit MetroCard.
[12:46.550 --> 12:48.690]  It doesn't work, but they keep on trying it.
[12:49.690 --> 12:57.770]  The first successful hack of a MetroCard was pretty much a week or two into its introduction.
[12:57.770 --> 13:02.630]  That sounds shocking, but it shows the hacker mentality at work.
[13:03.870 --> 13:06.170]  I don't know the person who did it.
[13:06.290 --> 13:07.530]  I don't know his name.
[13:07.730 --> 13:11.970]  I don't know if at all he was a hacker or called himself one.
[13:11.970 --> 13:15.170]  But the hacker mentality was evident in this man.
[13:15.730 --> 13:19.550]  He ended up being arrested without a successful use.
[13:19.930 --> 13:22.010]  Well, let me rephrase that.
[13:22.250 --> 13:24.970]  It worked to get him into the station.
[13:25.550 --> 13:30.550]  Unfortunately for him, that's about as far into the station as he got.
[13:30.550 --> 13:41.230]  What this guy had tried is he looked at the MetroCard, he saw a magnetic stripe on it, and he reasoned by analogy.
[13:41.510 --> 13:47.830]  He said, gee, this looks like magnetic sound recording tape.
[13:49.550 --> 13:57.490]  From what I understand from an article in the Daily News in March of 94, he treated it as if it was magnetic recording tape.
[13:57.990 --> 14:05.590]  He passed it through, according to the article, an eight track recorder, and made a duplicate tape.
[14:06.310 --> 14:26.870]  He used his legitimate MetroCard somewhere, and then with this piece of duplicate tape, since you can't pass a piece of tape through a turnstile, he glued it to a piece of cardboard, used it in a turnstile, activated the turnstile, walked through, and was promptly arrested.
[14:26.890 --> 14:27.370]  Why?
[14:27.710 --> 14:34.270]  There was a cop leaning on a turnstile, a couple of turnstiles over, who saw a guy pass a piece of cardboard through a turnstile.
[14:38.440 --> 14:43.740]  A piece of cardboard doesn't look like a MetroCard as far as I know, and as far as that cop knew, too.
[14:44.740 --> 14:45.860]  Well, that failed.
[14:47.420 --> 14:51.760]  The next successful hack of a MetroCard was an in-house job.
[14:52.960 --> 14:55.280]  This was two or three months after that.
[14:55.420 --> 14:58.540]  That would have been April or May of 94.
[15:00.220 --> 15:10.660]  A railroad clerk, which is the official title of those people in the subway token booths, decided that there was some potential here.
[15:11.180 --> 15:16.400]  I don't know how many people actually stare into a token booth up against the glass.
[15:17.140 --> 15:19.800]  Personally, I wouldn't do that.
[15:19.960 --> 15:21.100]  It's kind of impolite.
[15:21.260 --> 15:25.700]  I mean, do you go up to people that you don't know and just, like, stare at them?
[15:27.340 --> 15:27.740]  See?
[15:28.280 --> 15:30.900]  I feel a little self-conscious, but then again, I'm normal.
[15:31.200 --> 15:33.760]  This man is probably a little self-conscious.
[15:34.560 --> 15:36.940]  It's not a polite thing to do, but people do that.
[15:37.100 --> 15:39.800]  And you might do it, too, hopefully a bit more casually.
[15:39.800 --> 15:54.380]  If you do it nowadays, what you'll see in a token booth, you'll see a small, oh, about 9 by 14 metal box with a computer screen on one side on a metal pole.
[15:55.340 --> 15:59.400]  You'll see a hole in the board, as it's called.
[15:59.400 --> 16:02.600]  That wooden surface on which the tokens and change are.
[16:02.800 --> 16:06.920]  And if you stick money in the slot, the clerk slides the tokens and the change along.
[16:06.920 --> 16:08.080]  You'll see a hole in it.
[16:08.640 --> 16:10.180]  You won't see the computer.
[16:10.480 --> 16:30.320]  The computer now, because of this man who hacked, because of this railroad clerk, the computer is now in not only an armored case, which it always was in, it's in an armored case where all the connections to and from the computer are locked as well.
[16:32.000 --> 16:37.460]  Well, the reason is that when it first started, the computer was a big bulky thing.
[16:37.720 --> 16:47.620]  About the size of your average 17 inch computer monitor, fixed keyboard on it, inside a stainless steel case, and it was on a big arm.
[16:47.740 --> 16:49.020]  And it was a big bulky thing.
[16:49.280 --> 16:54.960]  It was probably bigger than this box with the flaps up.
[16:57.600 --> 17:00.860]  But, all the connections were on the back of it.
[17:01.160 --> 17:03.420]  All the connections could be removed.
[17:04.100 --> 17:07.960]  So what this guy did was, he had the hacker mentality.
[17:08.720 --> 17:10.980]  He also had the criminal mentality.
[17:11.220 --> 17:23.960]  But he had the hacker mentality and he figured out which of those connected the booth computer to the TA's mainframe computer, and he disconnected it.
[17:24.420 --> 17:30.040]  So what he would do when a passenger came up and asked for a MetroCard is, he would make up a MetroCard.
[17:30.300 --> 17:33.080]  You hit the appropriate keys on the computer keyboard.
[17:34.340 --> 17:41.780]  In those days you would swipe the card across, much like a turnstile, on the booth computer.
[17:41.780 --> 17:46.840]  And it would encode the card, and he'd sell the card.
[17:47.420 --> 17:59.340]  Now, if the customer decided to swipe it on the external card reader to the booth, the computer supervising that external card reader was the one in the booth.
[18:00.550 --> 18:02.840]  It would show it's a perfectly valid card.
[18:04.080 --> 18:10.860]  If the passenger walks ten feet, swiped it on the freestanding card reader, same thing.
[18:11.160 --> 18:15.140]  Because the computer in the booth is the computer controlling that card reader.
[18:17.080 --> 18:21.700]  What would happen is, passenger would then go to a turnstile.
[18:22.660 --> 18:23.540]  Use it.
[18:23.960 --> 18:25.100]  It would work.
[18:26.020 --> 18:32.080]  However, this is where the system starts getting ingenious and proof of the ingenuity can be found.
[18:34.000 --> 18:55.520]  Approximately every six minutes, all this apparatus that the Transit Authority has, all this apparatus that costs a total of 900 million dollars, you heard that right, close to a billion dollars in fair car technology in your subway system, would communicate with one another.
[18:56.140 --> 18:58.640]  It would go up to the next level.
[18:59.580 --> 19:03.460]  In other words, if it was the booth computer, it would go up to the area controller.
[19:04.760 --> 19:08.360]  If it was the area controller, it would go up to the mainframe.
[19:08.360 --> 19:10.680]  And things would come back down.
[19:10.840 --> 19:11.340]  Information.
[19:12.720 --> 19:21.040]  Turnstile would say to the area controller computer, okay, I just saw this fair card.
[19:21.280 --> 19:22.120]  Serial number.
[19:22.280 --> 19:23.980]  For argument's sake, 01.
[19:25.420 --> 19:28.040]  It had a total of three dollars on it.
[19:29.180 --> 19:32.880]  I deducted a buck fifty, it now has a buck fifty on it.
[19:32.880 --> 19:42.340]  Remember, we are talking about this fake, well, not fake, this MetroCard that was made up on a computer that was not communicating directly to the mainframe.
[19:45.540 --> 19:47.820]  This information would get to the mainframe.
[19:48.440 --> 19:53.080]  The mainframe would say, wait a minute, I just heard from the booth computer.
[19:53.200 --> 19:55.640]  The booth computer has never seen this MetroCard.
[19:55.640 --> 20:02.900]  The reason being, the guy in the booth had disconnected the wiring that went from the booth computer to the mainframe.
[20:05.100 --> 20:08.300]  The mainframe would say, I've never seen this MetroCard.
[20:08.540 --> 20:10.620]  It never had money added to it.
[20:11.020 --> 20:15.780]  Next time you see it, treat it as if it's no good.
[20:16.020 --> 20:17.200]  Don't accept it.
[20:17.500 --> 20:20.700]  And it would send that out to all the turnstiles.
[20:21.540 --> 20:23.220]  This is how it works.
[20:23.440 --> 20:40.040]  If you have a MetroCard with an illegitimate serial number, if you have a MetroCard where something like this has happened, each turnstile has a list of MetroCards whose serial numbers are invalid.
[20:40.440 --> 20:41.460]  It won't work.
[20:43.240 --> 20:49.000]  In addition, each turnstile reads the valid times on a card.
[20:49.000 --> 20:55.120]  For example, there are student MetroCards that are good only from 5am to like 9pm.
[20:56.500 --> 21:03.320]  You come down at 9.30, all it needs to do is read the valid time field off that MetroCard.
[21:04.860 --> 21:08.220]  Computer processor inside the turnstile knows what time it is.
[21:11.270 --> 21:12.770]  Treats it as if it's invalid.
[21:12.950 --> 21:16.750]  Doesn't even need on those situations to consult the mainframe.
[21:16.750 --> 21:20.130]  Back to our guy who disconnected the wires.
[21:21.250 --> 21:25.850]  So all these people would buy MetroCards for vast sums of money.
[21:26.130 --> 21:27.350]  10, 20 dollars.
[21:29.610 --> 21:30.810]  Use it once.
[21:32.190 --> 21:34.290]  And then discovered it didn't work.
[21:34.930 --> 21:38.950]  Well, this scam didn't work for too long either.
[21:38.950 --> 21:47.270]  If you have a couple hundred people complaining at the same booth with their MetroCards not working, you are going to do some investigation.
[21:48.110 --> 21:50.350]  Transit police did some investigation.
[21:50.350 --> 21:52.670]  This clerk got his ass in jail.
[21:54.410 --> 21:59.490]  So we learned something from his misfortune.
[22:00.510 --> 22:03.450]  We learned that that's not the way to hack a MetroCard.
[22:03.590 --> 22:04.710]  There has to be a better way.
[22:05.750 --> 22:08.770]  Well, it turns out there aren't better ways.
[22:11.050 --> 22:13.250]  Hacking a MetroCard can be done.
[22:17.390 --> 22:22.130]  It can be done in at least two ways that we know of.
[22:22.130 --> 22:30.470]  One of which is duplicated on magnetic recording tape of some sort.
[22:30.990 --> 22:39.350]  The other way is make up a card on the token booth computer or a facsimile thereof.
[22:40.330 --> 22:44.850]  Facsimile thereofs are tough to come by because you need a track three reader writer.
[22:44.850 --> 22:48.130]  You have to write to the one track that we know is written to.
[22:49.810 --> 22:53.610]  But even then you start having problems because what's going to happen?
[22:54.990 --> 23:01.870]  If you make up a fake serial number, it might be legitimate, but you're going to get one use out of it.
[23:02.630 --> 23:09.570]  If you make up a duplicate serial number, it'll work, but you'll still only get one use out of it.
[23:09.690 --> 23:09.950]  Why?
[23:10.630 --> 23:15.450]  Suppose it duplicates another card that somebody has in their pocket.
[23:16.790 --> 23:18.790]  You use it at 10 a.m.
[23:19.030 --> 23:19.750]  in the Bronx.
[23:21.450 --> 23:26.830]  It goes from, let's say, the $3 you put on it to $1.50.
[23:28.170 --> 23:30.730]  That information gets to the mainframe.
[23:30.730 --> 23:32.470]  The mainframe says, hey, wait a minute.
[23:33.250 --> 23:38.530]  I saw this card at 9 o'clock, or even better.
[23:38.690 --> 23:40.030]  It would say, wait a minute.
[23:40.210 --> 23:42.530]  I saw this card at 10.05 in Brooklyn.
[23:44.090 --> 23:46.830]  In Brooklyn, it had 30 bucks on it.
[23:46.950 --> 23:50.670]  And I don't have any record of it going from $1.50 to $30.
[23:51.990 --> 23:53.070]  Invalidate this card.
[23:53.290 --> 24:00.970]  Now, the fake card that you made up that duplicates another one, and the legitimate card are not going to match.
[24:01.610 --> 24:04.910]  They're both going to be turned off, so to speak.
[24:05.050 --> 24:06.490]  They'll both be declared invalid.
[24:07.990 --> 24:09.510]  You're out, but you don't care.
[24:09.650 --> 24:10.750]  You're not going to go complain.
[24:10.750 --> 24:12.110]  You got one right out of it.
[24:13.010 --> 24:15.050]  The other person is going to go complain.
[24:15.830 --> 24:23.310]  If this pops up, same station in the Bronx, because you're a creature of habit, they're going to start looking for you.
[24:24.210 --> 24:33.170]  If you're more ingenious, and you make up cards of different serial numbers, possibly the same thing will happen.
[24:33.970 --> 24:37.210]  You'll use it for one fair in the morning, one fair in the evening.
[24:37.690 --> 24:42.870]  If you use it with any regularity, they're still going to come looking for you.
[24:42.990 --> 24:50.950]  And on top of that, it's a lot of bother for $1.50 in the morning and $1.50 in the evening.
[24:51.790 --> 24:54.050]  Hackers have better things to do with their time.
[24:57.380 --> 25:00.220]  As I said earlier, you're also not going to get rich.
[25:01.980 --> 25:05.620]  You can't make up legitimate cards for $80 or $100.
[25:07.300 --> 25:23.800]  You can't sell the cards you've got, although last year, late in the year, November, there was some guy making up cards for $80, sold them to five or six unsuspecting tourists around Fulton Street in Lower Manhattan for half price.
[25:25.060 --> 25:26.980]  What problem did they have?
[25:27.260 --> 25:28.720]  It worked once.
[25:28.720 --> 25:30.100]  It didn't work again.
[25:32.780 --> 25:37.120]  His problem, since there were only five or six reports of it, he was smart.
[25:37.460 --> 25:39.080]  He got a few bucks.
[25:39.080 --> 25:40.800]  He stopped doing it, apparently.
[25:40.800 --> 25:42.820]  He never got arrested as far as I know.
[25:46.140 --> 25:47.780]  He avoided the problem.
[25:48.040 --> 25:53.900]  If he did it regularly in the same place, sooner or later he'd get arrested.
[25:55.420 --> 26:02.160]  The other problem, as I alluded to earlier, is you're not going to make a fortune doing this because you simply can't.
[26:02.300 --> 26:06.780]  The only way you can guarantee that every card you sold on the street would work?
[26:07.080 --> 26:09.860]  Make $1.50 cards.
[26:10.240 --> 26:11.640]  Who in this audience?
[26:12.080 --> 26:13.720]  Who in any audience?
[26:14.720 --> 26:16.960]  I mean, what bunch of petty criminals?
[26:17.160 --> 26:22.620]  What bunch of mafiosi would buy $1.50 Metro cards?
[26:23.840 --> 26:24.720]  Nobody.
[26:24.720 --> 26:24.860]  Nobody.
[26:26.000 --> 26:27.660]  It's not worth it.
[26:28.430 --> 26:31.900]  There's too many of them to move to make any sort of profit.
[26:32.400 --> 26:35.740]  There is no way to crack.
[26:36.140 --> 26:38.040]  And I put cracks in quotes.
[26:38.240 --> 26:43.540]  And I define crack as the criminal version of hack.
[26:44.640 --> 26:48.180]  There is no way to crack MetroCard.
[26:48.280 --> 26:50.760]  It is a sloppy system.
[26:50.760 --> 26:53.960]  It is an expensive system.
[26:54.480 --> 27:02.120]  But surprisingly, it is a good system for what it attempts to do.
[27:03.660 --> 27:05.960]  It takes fares off.
[27:06.380 --> 27:11.140]  It adjusts for people who are entitled to ride free.
[27:11.440 --> 27:14.880]  For people who are entitled to ride at half price.
[27:15.940 --> 27:27.580]  People don't know this, but every weekend for the first year and a half of its existence, it actually adjusted for people to ride off-peak for a discount.
[27:27.580 --> 27:40.400]  If you rode on weekends, once a month, the first year that it was in effect, the $1.25 fare, it only took $1.20 off.
[27:40.400 --> 27:46.320]  So we know that discounts are possible on the purchase end.
[27:46.480 --> 27:50.180]  On the end where, or shall I say better, the sales end.
[27:50.340 --> 27:54.740]  Or even better, the fare collection end.
[27:55.600 --> 27:59.700]  Discounts are possible on the fare collection end, where it hits the turnstiles.
[28:00.920 --> 28:09.700]  Supposedly, the Transit Authority, starting this January, is going to give discounts at the purchase end, in the token booth.
[28:10.780 --> 28:17.980]  If you put more than 10 rides, the current cost of which, at $1.50 a ride, is $15.
[28:18.080 --> 28:26.180]  If you put 10 rides on your card, somehow your card will end up with 11 rides on it.
[28:27.260 --> 28:31.280]  How this is going to be done, we don't quite know yet.
[28:31.280 --> 28:33.280]  We presume it's possible.
[28:33.540 --> 28:40.040]  However, every method we've come up with to do this, has a small hole in it.
[28:40.200 --> 28:42.980]  So we don't know for sure how this is going to be done.
[28:43.180 --> 28:46.420]  We're going to take the TA at their word for it, for now.
[28:49.020 --> 28:50.760]  What else about MetroCards?
[28:51.000 --> 28:51.300]  Okay.
[28:53.300 --> 28:54.600]  Back to the Bible.
[28:55.580 --> 28:59.120]  And that little reading that we had this morning.
[29:00.680 --> 29:05.820]  One of the interesting things about MetroCard, well, let's take this from another approach.
[29:07.760 --> 29:31.700]  The man that runs the organization known as Voters Telecommunications Watch, who I believe is speaking in half an hour, a man by the name of Shabir Safdar, said to me after my talk at HOPE in 94, hey, I don't like MetroCards because what's going to happen is the Transit Authority is going to trace people with these.
[29:33.020 --> 29:35.680]  I looked at him, and I said, you're crazy.
[29:36.240 --> 29:41.360]  You can go to any booth in the subway system and buy a MetroCard.
[29:41.720 --> 29:50.580]  You could be out with your girlfriend riding around in your car, someplace that you're never on in the subway, like the Bronx, like Brooklyn, whatever.
[29:51.560 --> 29:55.000]  For my argument's sake, I'll say Brooklyn, because I'm almost never there.
[29:55.160 --> 29:56.660]  I'm riding around in Brooklyn.
[29:56.860 --> 29:58.000]  I'm never there on the subway.
[29:59.600 --> 30:03.660]  I buy a MetroCard from there, and I use it to go from Manhattan to the Bronx.
[30:04.100 --> 30:06.440]  How's the TA going to trace it back to me?
[30:07.520 --> 30:09.140]  It's a cash transaction.
[30:09.140 --> 30:09.940]  It's anonymous.
[30:11.260 --> 30:13.540]  He said, mark my words, they're going to do it.
[30:14.680 --> 30:17.600]  Well, they're not quite there yet, but they're getting warmer.
[30:19.500 --> 30:23.620]  They can't trace you to a specific MetroCard in most cases.
[30:23.880 --> 30:26.440]  In a moment, we'll talk about those cases where they can.
[30:27.620 --> 30:44.460]  However, if for some reason they stop you and you have a MetroCard in your pocket, or you're a suspect in a murder, a rape, a robbery, hacking, whitehouse.gov, whatever, you have a MetroCard.
[30:46.240 --> 31:01.900]  What they can do without a warrant, they really should have one, but it would be easy to do this without a warrant, they could take it to any token booth and say, hey, pass this through the machine, add money to it.
[31:02.000 --> 31:11.840]  But before you do that, when the screen comes up with all the information, tell me the last use date, tell me the last use time.
[31:12.640 --> 31:18.980]  Well, the last use time comes up on the screen for the railroad clerk in the booth in clear.
[31:19.380 --> 31:25.660]  It comes out 0800 hours or 1600 hours, month, date, year.
[31:27.140 --> 31:29.880]  It's not so easy with last use place.
[31:29.880 --> 31:32.740]  It comes out as either bus or subway.
[31:33.200 --> 31:34.460]  Then parentheses.
[31:35.420 --> 31:37.200]  And then there's four digits.
[31:38.120 --> 31:40.080]  And it's some sort of code.
[31:41.280 --> 31:44.480]  We have yet to crack the code for the buses.
[31:45.640 --> 31:50.140]  We have the code for buses going northbound and buses going southbound.
[31:50.400 --> 31:52.700]  They're not the same on the same bus line.
[31:53.780 --> 31:58.820]  We do have a partial crack of the code for subways.
[31:59.300 --> 32:27.060]  We know that if you are riding the N or the R train and you get on sometime between... somewhere, rather, between 59th and Lexington and Whitehall Street, your card will say something between last use place, subway, 15XX, where XX is 00, and 1530.
[32:27.740 --> 32:35.880]  And an interesting thing is, how many token booths do you think there are between Whitehall Street and 59th and Lexington?
[32:37.180 --> 32:39.320]  Oh yeah, lots of smart people here.
[32:39.320 --> 32:40.400]  You're right, 30.
[32:43.120 --> 32:43.680]  So...
[32:44.320 --> 32:45.600]  It gets more interesting.
[32:47.100 --> 32:52.880]  At the beginning of this year, a letter was attached to all employee pay tricks.
[32:53.140 --> 33:03.260]  Every employee in the Transit Authority got this letter from one Lawrence Reuter, who those of you who are in New York might know, is the president of the Transit Authority.
[33:04.020 --> 33:09.500]  And it said, don't hand out your MetroCard to your relatives.
[33:11.200 --> 33:14.020]  Actually, it didn't say that, but that was the gist of it.
[33:14.620 --> 33:23.660]  What had happened is that, people who worked fixed positions in the Transit Authority, by fixed I mean not moving them around.
[33:24.440 --> 33:26.980]  Let's say they were in a token booth for eight hours.
[33:27.160 --> 33:31.300]  Let's say they were in a bus depot taking bus engines apart.
[33:31.300 --> 33:33.740]  Let's say they were motorman on a train.
[33:34.060 --> 33:39.240]  And this was, let's say, the one in the nine between the Bronx and South Ferry.
[33:40.440 --> 33:41.600]  They're on the job.
[33:42.180 --> 33:43.420]  TA knows you're on the job.
[33:43.420 --> 33:44.400]  You sign in.
[33:45.100 --> 33:59.580]  And while they're on the job, their MetroCard is going from the Bronx to Queens, back to Manhattan, into Brooklyn, maybe over the bridge on a bus to Staten Island, back on Staten Island Rapid Transit, whatever.
[34:01.260 --> 34:06.860]  You're supposed to keep your employee MetroCard, which doubles as a photo ID, on you at all times.
[34:07.400 --> 34:19.100]  You're not supposed to let somebody use it, because one of the few perks, and I hesitate to call it a perk, of riding, of working for the Transit Authority, is free transportation.
[34:19.680 --> 34:24.440]  The reason I hesitate to call it a perk is, how many times a day can you ride this subway?
[34:24.620 --> 34:25.140]  I mean, really.
[34:27.780 --> 34:28.960]  They lent it out.
[34:30.840 --> 34:36.360]  They're now out of a job, and criminal charges were preferred against the people they had lent it to.
[34:37.220 --> 34:39.340]  How did the TA discover this?
[34:41.280 --> 34:42.990]  Well, they went to the mainframe.
[34:42.990 --> 34:44.810]  Remember the patent?
[34:45.090 --> 34:48.390]  That boring thing I read, right after the exciting Bible reading?
[34:52.710 --> 34:57.230]  Everything other than last use, is stored on the mainframe.
[34:58.210 --> 35:07.990]  If you have access to the mainframe, you can read, not only last use date and place, you can read every use date and place.
[35:08.850 --> 35:15.210]  Back to our private eye, back to our FBI agent, back to our cop that stopped you, with the MetroCard in your pocket.
[35:16.850 --> 35:26.170]  If he gets a warrant, or if he pressures the TA, or if the TA wants to cooperate, he can get a list of where that card has been and when.
[35:28.530 --> 35:46.690]  If at 4.20 in the morning, your boss, who has been driving you crazy, who you said, if you give me more code to write, I'll kill you, winds up dead at a station where nobody really rides.
[35:47.810 --> 36:05.570]  Railroad clerk in the booth that night doesn't remember anybody coming in, but son of a gun, your MetroCard shows a use place and date, maybe 15, 20 rides ago, 4.30 in the morning, a station a half a block from where your boss's body was found.
[36:06.950 --> 36:08.230]  Who are you going to call?
[36:09.250 --> 36:10.790]  I suggest a good lawyer.
[36:12.110 --> 36:17.190]  And the thing is, now that sounds like a legitimate use.
[36:17.190 --> 36:19.290]  And now that may be a legitimate use.
[36:19.430 --> 36:21.070]  But remember my friend Shabir?
[36:22.230 --> 36:27.690]  What happens when they start saying things like, hey, you were at a 2600 meeting.
[36:28.210 --> 36:31.190]  They've already started that, so that's not a good example.
[36:33.530 --> 36:42.730]  Whatever they start saying, if they start looking at your MetroCard, they can put you, quote, in the vicinity of.
[36:43.990 --> 36:52.870]  That's why someone I know has started at 2600 meetings here in New York, free MetroCard exchange.
[36:52.870 --> 36:59.490]  If you come up with a MetroCard with no money on it, they'll give you a different MetroCard with no money on it.
[37:01.870 --> 37:11.810]  This is not yet a police state where that would be necessary, but it's better to start now and not need it, than to start late when it's needed.
[37:12.890 --> 37:20.250]  I was going to say what else they do with cards along this path.
[37:21.970 --> 37:32.910]  As some of you may know, if you are a monthly Metro North or Long Island Railroad commuter, you can get a monthly Metro North or Long Island Railroad pass.
[37:33.830 --> 37:35.270]  These are color coded.
[37:35.430 --> 37:37.430]  You flash them to the conductor on the train.
[37:37.930 --> 37:39.270]  You pay by check.
[37:39.770 --> 37:41.510]  I don't know if they actually take check.
[37:41.710 --> 37:42.450]  You pay by check.
[37:42.630 --> 37:43.670]  You pay by credit card.
[37:44.810 --> 37:46.570]  And it's not transferable.
[37:46.810 --> 37:48.870]  So, in other words, they know who you are.
[37:49.010 --> 37:50.630]  You can't give it to someone else.
[37:51.330 --> 37:55.830]  Okay, no real problem there because they still actually don't know when you've used it.
[37:57.030 --> 38:03.070]  However, for an additional fee, you can get one which is also a MetroCard.
[38:05.750 --> 38:11.470]  You can use that, you can pass it through the turnstiles, and they know who you are.
[38:12.310 --> 38:14.630]  Because it's a Long Island Railroad ticket as well.
[38:16.050 --> 38:22.010]  The Transit Authority supposedly wants to start selling MetroCards by mail.
[38:22.590 --> 38:25.450]  Actually, they are going to start selling MetroCards by mail.
[38:25.450 --> 38:29.370]  You have to supply a credit card number.
[38:29.790 --> 38:31.510]  They mail it back to you.
[38:33.370 --> 38:36.430]  Does anyone see a problem here besides me?
[38:38.210 --> 38:38.890]  Good.
[38:42.340 --> 38:44.480]  That's going to be it for MetroCards.
[38:44.760 --> 38:47.320]  And I'm going to take questions in a couple of minutes.
[38:47.460 --> 38:58.460]  However, I am going to change the subject somewhat because I promised a couple of reporters that I would and I didn't tell them on what topic.
[38:58.760 --> 39:02.580]  But it is still the Transit Authority and technology.
[39:04.500 --> 39:06.020]  Quick show of hands.
[39:06.260 --> 39:07.920]  How many people from New York City?
[39:08.780 --> 39:09.380]  Okay.
[39:09.860 --> 39:22.640]  How many people remember that horrible occurrence in late March when a railroad clerk, those are the guys once again in the token booths, this railroad clerk in Long Island City at the Vernon Jackson Station got killed?
[39:23.680 --> 39:24.440]  Okay.
[39:26.180 --> 39:31.100]  It's possible that this man was killed partially through high technology.
[39:32.200 --> 39:35.860]  This is entirely speculation on my part.
[39:36.320 --> 39:40.240]  Not reserve of accusing the Transit Authority of anything.
[39:40.480 --> 39:44.620]  If I thought they deserved accusation, I would be the first to do so.
[39:45.800 --> 39:50.700]  But, this is speculation on my part, but it's not highly unlikely.
[39:53.500 --> 39:58.920]  Through the grapevine, the way that this clerk got killed.
[39:59.540 --> 40:10.680]  Railroad clerks are supposed to go out officially about an hour and a half before their tour ends and do what's known as pull the wheels.
[40:11.420 --> 40:15.120]  The wheels are in-house talk for the turnstiles.
[40:15.120 --> 40:22.140]  If you pull the wheels, you're opening up the turnstiles and getting the tokens out of them.
[40:24.160 --> 40:26.600]  Apparently, this clerk went out to pull the wheels.
[40:26.740 --> 40:27.660]  He was the night clerk.
[40:27.840 --> 40:29.800]  He went out like 4.30 in the morning.
[40:31.540 --> 40:38.920]  According to the grapevine, somebody attempted either to rob him or to grab the bucket of tokens.
[40:39.280 --> 40:40.820]  And there was a scuffle.
[40:43.180 --> 40:47.920]  It's unclear whether the scuffle continued from the turnstiles.
[40:48.080 --> 40:50.740]  And at the station that this happened, that's not a big distance.
[40:50.960 --> 40:54.600]  It's about as far as me to this photographer in front of me.
[40:54.660 --> 40:59.420]  In other words, if I fell down now, the top of my head would hit the feet of this person.
[41:00.320 --> 41:02.200]  That's six feet, five inches.
[41:05.470 --> 41:14.910]  In the old days, like six months ago or longer, the door of the booth was just a nice, simple, regular door.
[41:15.770 --> 41:17.110]  It's somewhat armored.
[41:17.450 --> 41:18.610]  Not tremendously.
[41:18.610 --> 41:22.010]  If you have an anti-tank weapon, getting into a booth is no problem.
[41:22.410 --> 41:26.350]  I won't say how low in weaponry you have to go to get in.
[41:28.250 --> 41:30.690]  But the door was a nice, normal door.
[41:30.690 --> 41:39.790]  If you pulled it shut, there was a little latch, like you see on a dozen doors and a dead bolt.
[41:40.590 --> 41:46.450]  And the door would be locked and somebody could grab that door and shake that door all they wanted and not get in.
[41:48.750 --> 41:57.010]  The transit authority went over from a simple door like that with a medical lock to a nice, high-tech door.
[41:57.290 --> 42:03.310]  I don't know what other hotels have this, but it's the same sort of lock that you find in the Mirage in Las Vegas.
[42:03.710 --> 42:09.750]  It looks like a relatively normal key, but there are no markings on it.
[42:09.750 --> 42:12.930]  There are no cuts of varying height and width.
[42:14.550 --> 42:16.190]  They all look identical.
[42:16.470 --> 42:18.390]  It's an electronic lock of some sort.
[42:18.830 --> 42:37.930]  And the flaw with this is, and I don't know if this was a permanent flaw or just in some doors and they corrected it everywhere, or it's something that could recur because down in the subways you have diesel work trains going by once, twice, three times a night.
[42:37.930 --> 42:41.230]  If they're working near you, you've got diesel fumes coming out all night.
[42:42.270 --> 42:47.330]  You've got more steel dust than you can imagine coming off those rails.
[42:47.870 --> 42:52.030]  Don't get paranoid that you're going to die of steel dust exposure.
[42:53.450 --> 42:59.490]  If you're there traveling as a passenger, you're there for an hour a day, two hours a day at the most.
[42:59.770 --> 43:05.990]  You go home, you blow your nose, you take a shower, you probably, you almost definitely have no problems.
[43:05.990 --> 43:09.490]  But it accumulates on any sort of machinery.
[43:11.790 --> 43:16.690]  It is possible that there was a problem with that door.
[43:16.990 --> 43:21.910]  There have been problems with plenty of other doors to booths in the Transit Authority.
[43:21.910 --> 43:24.150]  And the problem is this.
[43:25.350 --> 43:33.230]  Unlike the nice, simple low-tech door, you close it, you hold the handle with your other hand, you lock it, it's locked.
[43:34.990 --> 43:45.730]  You close the high-tech door, and if the lock doesn't actuate, you don't have anything to toggle inside to lock it.
[43:47.170 --> 43:50.490]  To get it to lock, you have to open it again and close it again.
[43:50.650 --> 43:53.430]  And if it doesn't work, you have to open it again and close it again.
[43:53.610 --> 43:56.350]  And if it doesn't work, you've got to open it again and close it again.
[43:59.310 --> 43:59.710]  Okay.
[44:00.550 --> 44:01.550]  Suppose you're small.
[44:01.870 --> 44:06.990]  And suppose some big guy tries to take your tokens from you at the turnstiles.
[44:07.510 --> 44:08.350]  You get away.
[44:08.530 --> 44:09.730]  You run back to the booth.
[44:09.870 --> 44:11.250]  You have the high-tech lock on.
[44:11.370 --> 44:12.250]  You close the door.
[44:12.430 --> 44:16.370]  If it doesn't lock, you're not about to open it again.
[44:17.370 --> 44:19.070]  You're holding on for dear life.
[44:20.150 --> 44:26.710]  If the guy is enough bigger than you, he'll force that door open in 10 minutes if he really wants to get in.
[44:28.410 --> 44:33.510]  A clerk by the name of Robert LeBright was found shot to death inside his booth.
[44:34.130 --> 44:37.110]  He may have been shot outside his booth and got in.
[44:38.890 --> 44:41.110]  He may have had the door wide open.
[44:42.010 --> 44:55.710]  It's also possible he may have scuffled with his attacker, ran back into the booth, and the booth door didn't lock, and it got opened by the perpetrator who then shot him.
[44:56.750 --> 45:01.290]  I'm not accusing the TA because, frankly, I don't know.
[45:02.650 --> 45:08.030]  I also have to say it's possible that this was a temporary problem that was fixed.
[45:09.710 --> 45:11.370]  I'm not going to accuse the TA.
[45:11.510 --> 45:24.090]  I'm just throwing this out because it's transit authority related, and it shows the dangers of going over to a higher technology without thinking it through.
[45:28.100 --> 45:28.660]  Okay.
[45:30.100 --> 45:31.520]  Questions from the audience.
[45:32.980 --> 45:33.540]  Okay.
[45:33.680 --> 45:35.580]  I've been asked to take questions up at the front.
[45:36.620 --> 45:37.180]  Okay.
[45:42.450 --> 45:44.170]  We'll go from left to right.
[45:44.690 --> 45:45.570]  First person.
[45:45.750 --> 45:45.890]  Hi.
[45:46.190 --> 45:46.510]  Hi.
[45:46.710 --> 45:47.230]  Question.
[45:47.470 --> 45:54.190]  You mentioned the six minutes of every six minutes the turnstile computer is talking to the mainframe computer.
[45:54.190 --> 45:58.010]  Every six minutes we know it talks to the next level up.
[45:58.230 --> 45:58.790]  Okay.
[45:59.010 --> 45:59.210]  Can you...
[45:59.210 --> 45:59.330]  Okay.
[45:59.530 --> 46:02.730]  We don't know if it's directly to the mainframe.
[46:03.010 --> 46:07.410]  We strongly suggest it doesn't upload to the mainframe directly.
[46:07.710 --> 46:13.090]  We strongly suspect that it downloads from the mainframe directly to the turnstile.
[46:13.090 --> 46:14.490]  How about on the buses?
[46:14.790 --> 46:15.190]  How does that work?
[46:15.190 --> 46:15.830]  Oh, buses.
[46:16.030 --> 46:16.130]  Yeah.
[46:16.210 --> 46:17.110]  That's a good question.
[46:17.410 --> 46:18.890]  How do buses work?
[46:19.050 --> 46:22.170]  And no, they don't have very long invisible cables.
[46:24.110 --> 46:33.810]  A couple years ago the transit authority went and got themselves a number of frequencies on the spectrum that they didn't have previously.
[46:33.810 --> 46:36.370]  And they assigned it to buses.
[46:37.390 --> 46:41.410]  We couldn't figure out why because every bus had a radio...
[46:41.410 --> 46:43.710]  Well, not every bus had an individual radio frequency.
[46:43.790 --> 46:46.590]  But they had enough frequencies for buses.
[46:47.550 --> 46:50.610]  And since then we've...
[46:50.610 --> 46:52.770]  Actually I know someone who has listened.
[46:53.070 --> 46:54.790]  It's definitely a data stream.
[46:54.910 --> 46:57.470]  It comes off the bus about once every ten minutes.
[46:58.770 --> 47:02.510]  And there are occasional other data streams floating around.
[47:02.510 --> 47:03.330]  We don't know where.
[47:03.470 --> 47:09.130]  We presume it's out of J Street, TA Headquarters, for the buses.
[47:10.470 --> 47:11.590]  So, yeah.
[47:11.770 --> 47:12.610]  That's how it's done.
[47:12.750 --> 47:13.990]  It's done over the radio.
[47:14.530 --> 47:18.470]  And it's done somewhere between six and ten minutes.
[47:19.030 --> 47:19.770]  Thank you.
[47:20.050 --> 47:20.650]  Next person.
[47:21.230 --> 47:23.710]  Is there any way to remotely access the mainframe?
[47:24.930 --> 47:26.810]  We don't think so.
[47:26.810 --> 47:32.490]  So, there's three states that a token booth computer can be in.
[47:33.750 --> 47:35.750]  One is for railroad clerks.
[47:35.810 --> 47:39.510]  All you can really do there is sell MetroCards.
[47:39.690 --> 47:41.390]  One is for supervisors.
[47:41.710 --> 47:44.150]  A supervisor can sell MetroCards.
[47:44.150 --> 47:48.810]  And also look at old information.
[47:49.530 --> 47:53.050]  Either bookkeeping stuff for individual clerks.
[47:53.310 --> 47:54.350]  Back for a few days.
[47:54.690 --> 47:58.590]  He can sign on a clerk who forgot his MetroCard.
[47:58.690 --> 48:02.590]  Because that's how you get access to the computer in the booth.
[48:02.970 --> 48:07.850]  In other words, it's just like a number of security devices for computers.
[48:07.850 --> 48:13.470]  You have to not only dip a card in, but you have to know your pin and a couple other things.
[48:14.190 --> 48:17.990]  And the third is for turnstile maintainers.
[48:18.370 --> 48:22.190]  And that's just diagnostics on that machine alone.
[48:22.710 --> 48:31.790]  As far as we know, and we strongly suspect because it makes no sense if they didn't do this, there's no way to access the mainframe from the token booth computer.
[48:31.790 --> 48:37.390]  We also strongly suspect that there's no way to get the mainframe through the Internet.
[48:38.130 --> 48:40.270]  That would be excessively stupid.
[48:40.590 --> 48:42.210]  There might be dial-ups.
[48:42.690 --> 48:51.950]  But we think that they've gone to such expense to put in fixed lines and protected lines.
[48:51.950 --> 48:56.270]  It's a fiber optic system interconnecting booths.
[48:56.970 --> 49:05.470]  Well, not booth to turnstile, but booths within an area to the area computer and the area computer to the mainframe.
[49:05.670 --> 49:12.890]  We don't think that they would not splurge and connect that to wherever external they want to.
[49:13.230 --> 49:15.770]  If they have any place external.
[49:16.050 --> 49:19.230]  So we don't think there's any practical way to get to it.
[49:19.550 --> 49:20.430]  Next person.
[49:21.350 --> 49:26.870]  When the EPIC passes are swiped at the booths, does it write anything to the EPIC pass?
[49:27.070 --> 49:27.530]  Ah!
[49:27.870 --> 49:30.830]  A man who knows some of the terminology.
[49:31.130 --> 49:31.570]  EPIC.
[49:32.910 --> 49:35.430]  Employee Picture Identification Card.
[49:35.690 --> 49:39.030]  That's the MetroCard for Employees.
[49:39.630 --> 49:40.690]  Yes, it does.
[49:40.890 --> 49:45.290]  We know it's last use place and last use time.
[49:45.610 --> 49:47.070]  We don't know what else.
[49:47.190 --> 49:48.490]  We don't think anything else.
[49:49.030 --> 49:54.670]  So could you copy an EPIC pass as long as it's not during the hours that person is supposed to be working?
[49:55.130 --> 49:56.370]  And then would it check?
[49:56.730 --> 50:03.590]  I mean, because it wouldn't check where you get off and compare that you used, for instance, the EPIC pass in the same terminal without getting out of the subway.
[50:04.570 --> 50:06.930]  A man with the hacker mentality.
[50:07.410 --> 50:10.450]  Yes, that would work as far as we know.
[50:13.310 --> 50:18.630]  You could copy an employee pass when the guy goes home and goes to bed.
[50:19.290 --> 50:23.990]  You can go and work at your messenger job and pocket all those tokens that they give you.
[50:24.170 --> 50:25.590]  Not you personally, but whoever.
[50:27.830 --> 50:29.590]  Yes, that could be done.
[50:29.850 --> 50:35.550]  Now everybody is thinking, okay, red balaclava, why don't we copy your pass?
[50:35.790 --> 50:43.470]  Well, once again, this gets into the difference between the definition of hack and the definition of crack.
[50:44.170 --> 50:46.530]  A hacker wants knowledge.
[50:47.050 --> 50:51.850]  A criminal wants... a cracker wants to criminally exploit it.
[50:52.190 --> 50:53.670]  I am a hacker.
[50:53.930 --> 50:55.110]  That's with an H.
[50:56.330 --> 50:56.810]  Okay.
[50:57.070 --> 50:58.170]  Any other questions?
[50:59.130 --> 51:00.190]  Next person.
[51:01.330 --> 51:04.650]  I'd like to suggest an additional wrinkle in the logging problem.
[51:04.910 --> 51:08.150]  Don't they take time-lapse video of the turnstile area?
[51:08.410 --> 51:08.750]  Okay.
[51:09.350 --> 51:13.450]  At very few stations, they do take time-lapse video of the turnstile area.
[51:14.190 --> 51:15.890]  Less than you probably suspect.
[51:16.430 --> 51:18.950]  But they could match it up if they had it, correct?
[51:19.270 --> 51:19.590]  Yeah.
[51:19.770 --> 51:28.850]  And if something suspicious happens, the TA has, in the last three or four years, shown an amazing propensity for ingenious thinking.
[51:29.130 --> 51:32.470]  I say that because I've been with them, God forbid, 20 years.
[51:33.690 --> 51:37.910]  When I started, it was a totally Dickensian organization, okay?
[51:38.010 --> 51:41.550]  You would think that they'd have modern data processing and stuff.
[51:41.550 --> 51:42.210]  Oh, no.
[51:42.650 --> 51:43.490]  Paperwork everywhere.
[51:43.710 --> 51:45.030]  Paper, paper, and more paper.
[51:46.410 --> 51:54.710]  In the last few years, when they've suspected some sort of problem, when normal people would've said, well, why don't you put a camera there and tape it?
[51:54.930 --> 51:57.050]  They've actually put a camera there and taped it.
[51:57.750 --> 51:59.250]  Shows ingenuity on their part.
[51:59.250 --> 52:02.590]  Is there a follow-up or shall I go to the next person?
[52:03.430 --> 52:04.290]  Next person.
[52:05.450 --> 52:07.110]  It's 8.45 a.m.
[52:07.690 --> 52:09.090]  You're at Grand Central Station.
[52:09.690 --> 52:13.250]  The phone lines from the area computer or the booth computer go down.
[52:13.470 --> 52:15.150]  What happens to the collected data?
[52:15.950 --> 52:17.910]  Oh, that's a good question.
[52:17.910 --> 52:21.190]  If the phone lines go down, what happens to the collected data?
[52:22.710 --> 52:26.990]  The reason it's a good question is because it reminds me of something I wanted to say and didn't.
[52:27.990 --> 52:41.050]  If communications is lost, either communications from the turnstile or communications from the booth computer, there's really no problem.
[52:41.490 --> 52:49.090]  If communication is lost from the turnstile, the turnstile will continue to accept 3,000 entries.
[52:49.370 --> 52:50.630]  Let me define entry.
[52:51.230 --> 52:53.570]  An entry is any of the following.
[52:53.970 --> 52:55.350]  The use of a token.
[52:55.970 --> 52:57.790]  The use of a MetroCard.
[52:58.510 --> 53:06.050]  Or if it's the agent-operated turnstile, the one where the clerk in the booth buzzes you in, it's the use of the agent-operated turnstile.
[53:06.050 --> 53:21.390]  So you could have, if communications are lost, 3,000 people with MetroCards go in, or you could have 3,000 people with tokens go in, or you could have the clerk buzz that turnstile 3,000 times, or any combination thereof.
[53:21.610 --> 53:28.410]  If communication is lost from the token booth computer, the token booth computer is down.
[53:29.010 --> 53:31.010]  Nothing can be done with it.
[53:31.570 --> 53:35.950]  That's why every booth has a supply of pre-encoded cards.
[53:36.370 --> 53:41.910]  The clerk would then say, if you wanted to add money to your card, I'm sorry, I can't add money.
[53:42.030 --> 53:43.850]  I can sell you a MetroCard.
[53:44.190 --> 53:51.010]  And if that happens, I've had people complain, well, hey, why should I have to walk around with two MetroCards?
[53:52.050 --> 53:52.990]  Give me a break.
[53:53.170 --> 53:56.590]  You only got to walk around with them until you're at a booth that's working.
[53:56.770 --> 54:02.550]  Then you can combine the two onto one MetroCard and throw out or turn back the one that has zero.
[54:03.410 --> 54:05.190]  So that's not really a problem.
[54:05.830 --> 54:06.890]  Is there a follow-up?
[54:07.450 --> 54:08.030]  That's it.
[54:08.030 --> 54:08.390]  Okay.
[54:09.530 --> 54:21.670]  I'm just curious, but if the MTA wanted to send somebody in a ski mask to the hackers' conference to discourage people from hacking and cracking the MetroCard, would he have said anything different than you have?
[54:22.330 --> 54:22.770]  Okay.
[54:22.950 --> 54:26.830]  The last thing I heard with the applause was if they wanted to...
[54:26.830 --> 54:33.150]  If they wanted to send someone here in a ski mask to discourage hacking and cracking, would that person have said anything different than you have today?
[54:33.990 --> 54:36.310]  Yeah, they probably would have been a little more impressive.
[54:36.310 --> 54:38.870]  They probably would have worn the uniform shirt.
[54:40.350 --> 54:42.290]  I'm not going to discourage anybody.
[54:42.290 --> 54:48.170]  If you think any part of this was bull, feel free to disprove me.
[54:48.370 --> 54:55.370]  Because that way in three years or four years or whenever we hold the next hope, it will make a much more interesting panel.
[54:56.050 --> 55:05.150]  I'm willing to sit here if somebody wants to demonstrate that anything I've said is incorrect with the three track reader or anything else.
[55:05.750 --> 55:07.370]  I have no problems with that.
[55:07.630 --> 55:08.850]  Don't let this discourage you.
[55:08.950 --> 55:23.690]  If you think anything I've said is incorrect, if you think I'm actually misstating any of this, please, a true hacker would take this man's advice and do it for yourself.
[55:33.980 --> 55:35.700]  Okay, let's go back to the left.
[55:36.120 --> 55:38.180]  I'm just curious about serial numbers.
[55:38.380 --> 55:46.140]  Is there any difference in the beginning of the serial numbers with the transit authority, federal workers, or with normal cards?
[55:46.440 --> 55:49.860]  We're talking about serial numbers on the...
[55:50.380 --> 55:51.760]  Oh, that's a good question.
[55:51.980 --> 55:54.240]  Serial numbers on the MetroCard.
[55:55.360 --> 56:00.100]  For those of you who have seen a MetroCard, you know that...
[56:00.860 --> 56:02.000]  Somebody stole mine.
[56:02.100 --> 56:02.740]  No, only kidding.
[56:02.740 --> 56:22.480]  You know that on the back, aside from the little graphics and instructions on how to use this, and the advice to refill and continue to use the card until the expiration date, and the phone numbers for customer service, you also have the expiration date.
[56:22.480 --> 56:23.820]  It says EXP.
[56:23.920 --> 56:26.700]  On this one it says 052798.
[56:27.880 --> 56:33.400]  You have a batch number on that same line, which is six digits.
[56:34.140 --> 56:36.960]  Batch numbers just go consecutively.
[56:37.200 --> 56:39.820]  I don't know what the first batch they made up was.
[56:40.500 --> 56:47.920]  But if you got a MetroCard a year ago, I would have to say the batch number is less than 515095.
[56:48.480 --> 56:51.860]  And underneath that, there's a ten digit serial number.
[56:52.160 --> 56:58.300]  This serial number happens to be 0040714259.
[57:01.660 --> 57:08.740]  I don't know if there's a difference in serial numbers between types of cards.
[57:10.940 --> 57:20.260]  That's a very interesting idea in seeing if serial, if there's some sort of code that matches serial numbers with batch numbers or with type of card.
[57:20.680 --> 57:22.980]  That is an avenue I did not consider.
[57:24.120 --> 57:25.080]  Next person.
[57:25.780 --> 57:26.260]  Hello.
[57:27.000 --> 57:36.900]  Yeah, yesterday when I left the conference, I went into the subway and I swiped the card, and this is, there's nothing wrong with it because I've been using it for weeks, and it wouldn't work.
[57:36.900 --> 57:43.100]  After like 20 tries, I went up to the booth and I swiped it through the little thing I have there, and it came up fine.
[57:43.420 --> 57:47.220]  And the token booth clerk wound up giving me another card.
[57:48.580 --> 57:50.240]  What happened is what you want to know?
[57:51.280 --> 57:51.760]  What?
[57:52.040 --> 57:53.340]  You want to know what happened?
[57:53.540 --> 57:53.720]  Yeah.
[57:54.120 --> 57:54.320]  Okay.
[57:55.440 --> 57:57.840]  That's a simple mechanical problem.
[57:58.000 --> 58:02.580]  There was probably dirt, dust, steel dust in the turnstall you were at.
[58:03.240 --> 58:06.260]  I tried it at like three different turnstiles before going back.
[58:06.280 --> 58:06.560]  Okay.
[58:07.000 --> 58:27.960]  The other possibility is that there was a minor error on your card which prevented it from being read, but did not prevent enough information from being gotten off your card so that the clerk in the booth could use the token booth computer in the booth to determine the proper value on the card and give you a substitute.
[58:28.800 --> 58:29.380]  Okay.
[58:29.660 --> 58:29.980]  Okay.
[58:29.980 --> 58:30.960]  Next person.
[58:33.040 --> 58:37.560]  One thing you mentioned was that this system handles single bit errors.
[58:38.100 --> 58:46.420]  That's a very interesting statement given modern error correction codes, powerful computers, that sort of thing.
[58:46.640 --> 58:52.780]  And the other thing to always keep in mind is that the guys who designed these systems are somewhat fairly ignorant.
[58:54.780 --> 58:58.100]  So single bit compute... there's a few things we do not...
[58:58.100 --> 58:58.900]  Well, let me interrupt you.
[58:59.000 --> 59:02.540]  I don't think I used the word single bit unless I read it off the pen.
[59:02.740 --> 59:03.180]  I'll check.
[59:03.640 --> 59:04.440]  Continue, please.
[59:04.860 --> 59:14.460]  It's... if you've got a three track system, it's fairly easy to see a simple single bit error detection method where just all three tracks are duped.
[59:14.560 --> 59:17.680]  And that's their idea of error correction codes.
[59:17.940 --> 59:21.160]  Of course, a guy like Mudge would probably die laughing, but...
[59:23.740 --> 59:28.460]  It's... it leads one to a whole line of exploration.
[59:28.860 --> 59:35.700]  One is to try and destroy an entire track on a card and see if it still reads and then re-corrects itself.
[59:36.360 --> 59:43.420]  That's a... you know, right then and there, that all of a sudden tells you a lot about how the data's are formatted and what the approaches they took.
[59:44.000 --> 59:46.160]  Okay, that's another good question.
[59:46.340 --> 59:48.800]  Mostly because it reminds me of something I wanted to say.
[59:49.820 --> 59:54.240]  First, as an aside, the patent doesn't say anything about single bit.
[59:54.380 --> 59:55.560]  It says single error.
[59:55.880 --> 59:57.660]  It may or may not be single bit.
[59:58.340 --> 01:00:03.360]  Secondly, what happens if you start screwing around with the magnetic stripe?
[01:00:03.360 --> 01:00:04.660]  I've done that.
[01:00:04.780 --> 01:00:06.540]  I've screwed around with the magnetic stripe.
[01:00:06.720 --> 01:00:08.340]  You get all sorts of interesting things.
[01:00:09.020 --> 01:00:14.500]  If you scratch it, but not too much, it will sometimes read it perfectly.
[01:00:15.000 --> 01:00:21.700]  Sometimes it will read a different serial number on the card, but the card will still be usable.
[01:00:22.180 --> 01:00:24.300]  Let me throw a caveat in.
[01:00:24.480 --> 01:00:31.540]  I'm not a rich person, so I only put very small amounts on the card, but I was able to transfer these amounts to a different card.
[01:00:33.420 --> 01:00:38.000]  Sometimes, as I said, it would read a different serial number, a different type of card.
[01:00:38.500 --> 01:00:48.080]  I have yet to find a method of punching holes or scratching the magnetic stripe where it would change the amount of money on the card.
[01:00:50.040 --> 01:00:58.540]  And I have done less destruction of the magnetic stripe on cards that had money on it than on cards that were blank.
[01:00:58.760 --> 01:01:05.980]  So I don't know about how much destruction you have to do to do that to a card with money.
[01:01:08.560 --> 01:01:09.380]  Follow up?
[01:01:09.560 --> 01:01:12.160]  Well, what I was thinking is that if there's a...
[01:01:12.160 --> 01:01:28.340]  If they've done something fairly stupid like this three-track, just duping all three tracks to look for single errors, then what that means is you can use like two-track writers to just write two tracks, and you can override their system.
[01:01:28.340 --> 01:01:29.040]  And now...
[01:01:29.040 --> 01:01:32.400]  I mean, if that's their error correction system, you own them.
[01:01:33.000 --> 01:01:33.600]  Yeah.
[01:01:33.780 --> 01:01:34.260]  Yeah.
[01:01:34.500 --> 01:01:35.500]  It might be.
[01:01:36.080 --> 01:01:36.680]  But...
[01:01:36.680 --> 01:01:38.260]  You know, you have to find that one out.
[01:01:38.560 --> 01:01:38.800]  Yeah.
[01:01:39.160 --> 01:01:55.440]  We think that it's being written to all three tracks because cards that are heavily used have markings along all three tracks, and they are not identical.
[01:01:57.760 --> 01:01:59.460]  That's not necessarily indicative.
[01:01:59.720 --> 01:02:06.620]  I can immediately think of ways where that would happen, and yet your speculation that all three tracks are identical would be true.
[01:02:07.380 --> 01:02:08.020]  You're right.
[01:02:08.140 --> 01:02:13.660]  That is another avenue that we had not given a lot of thought to that should certainly be explored.
[01:02:13.860 --> 01:02:17.500]  I mean, all of a sudden that means we can use our off-the-shelf technology...
[01:02:17.500 --> 01:02:18.240]  Not necessarily.
[01:02:18.700 --> 01:02:19.460]  Not necessarily.
[01:02:19.460 --> 01:02:19.780]  Not necessarily.
[01:02:20.160 --> 01:02:20.360]  Yeah.
[01:02:20.940 --> 01:02:21.420]  Possibly.
[01:02:21.560 --> 01:02:22.040]  Possibly.
[01:02:22.860 --> 01:02:23.800]  Next person.
[01:02:25.000 --> 01:02:28.220]  I have an observation and two questions for you.
[01:02:28.380 --> 01:02:31.120]  It's regarding not the New York subway, but the Boston subway.
[01:02:31.420 --> 01:02:34.620]  And first of all, the Boston subway is not a debit card.
[01:02:34.840 --> 01:02:39.200]  You pay once and $27, it's a monthly thing.
[01:02:39.420 --> 01:02:44.600]  However, they've had a catastrophic security failure is that old passes still work.
[01:02:45.640 --> 01:02:47.740]  They work fairly randomly.
[01:02:48.500 --> 01:02:51.180]  The turnstiles that they work in change on a day-to-day basis.
[01:02:51.980 --> 01:02:58.420]  However, this June 1995 card has worked since June of 1995.
[01:03:05.190 --> 01:03:12.570]  Do you have any ideas on how such a problem could have manifested itself and why they haven't noticed?
[01:03:13.490 --> 01:03:16.930]  There are lots of ideas on why that can be so.
[01:03:17.710 --> 01:03:22.730]  My first question is, has that card been tampered with or is it...
[01:03:22.730 --> 01:03:25.470]  Be honest, we won't think any less of you either way.
[01:03:25.910 --> 01:03:27.830]  The card has not been tampered with.
[01:03:27.990 --> 01:03:29.490]  It's not the individual card.
[01:03:29.870 --> 01:03:31.670]  It's almost any card.
[01:03:31.830 --> 01:03:32.370]  As a matter of fact...
[01:03:32.370 --> 01:03:33.550]  From that date?
[01:03:33.770 --> 01:03:34.610]  From June 1995?
[01:03:34.850 --> 01:03:34.970]  No.
[01:03:35.150 --> 01:03:37.610]  Almost any expired pass at all.
[01:03:38.630 --> 01:03:39.470]  As a matter of fact...
[01:03:39.470 --> 01:03:41.990]  Will work at some time in the future.
[01:03:42.370 --> 01:03:42.850]  Yes.
[01:03:43.250 --> 01:03:48.110]  However, the period that it works in is not consistent.
[01:03:49.510 --> 01:03:51.430]  There seems to be no order to it whatsoever.
[01:03:51.590 --> 01:03:51.670]  Okay.
[01:03:51.770 --> 01:03:54.010]  I'll tell you exactly what my first thought is.
[01:03:54.110 --> 01:03:56.970]  My first thought is they were too cute for their own good.
[01:03:56.970 --> 01:04:02.370]  In other words, they have some sort of system in which they said, Okay.
[01:04:02.750 --> 01:04:06.490]  On January 1st, 2001.
[01:04:06.910 --> 01:04:08.890]  One, one, zero, one.
[01:04:09.270 --> 01:04:13.330]  We will make every card where the first digit is three.
[01:04:13.970 --> 01:04:18.350]  And whatever digit is whatever work for that month.
[01:04:18.590 --> 01:04:21.150]  Make sure we only sell cards like that.
[01:04:21.630 --> 01:04:26.190]  Neglecting to remember that sometime in the future this recurs.
[01:04:26.190 --> 01:04:28.630]  Well, they may not have done it with years, but whatever.
[01:04:30.050 --> 01:04:33.550]  That would take care of it simply.
[01:04:33.770 --> 01:04:37.910]  It may throw in turnstile numbers and time of day.
[01:04:38.230 --> 01:04:45.350]  It may be a simple addition algorithm that at first glance when explaining it, it seems like it only happens once.
[01:04:45.830 --> 01:04:49.210]  But then they forget that it recurs every so often.
[01:04:49.750 --> 01:04:51.370]  That's the first thing I think.
[01:04:51.370 --> 01:04:57.530]  It may be a more complex, too simple for their own good thing along those lines.
[01:04:58.750 --> 01:05:02.630]  Or they're totally screwed is possible.
[01:05:04.130 --> 01:05:12.710]  Or it may be an error within the turnstiles in that their turnstiles are not as good as they should be.
[01:05:12.710 --> 01:05:14.570]  Partially short out.
[01:05:14.990 --> 01:05:17.610]  Have extraneous signals going through the circuitry.
[01:05:18.170 --> 01:05:18.590]  Anything.
[01:05:18.930 --> 01:05:21.170]  This is such a wide open problem.
[01:05:21.490 --> 01:05:21.870]  It probably...
[01:05:22.870 --> 01:05:25.690]  There's a wide number of causes for this.
[01:05:26.550 --> 01:05:27.190]  Possibly.
[01:05:27.390 --> 01:05:28.610]  Without more information.
[01:05:29.150 --> 01:05:32.630]  I've given you barely more information than you started with, frankly.
[01:05:33.610 --> 01:05:34.090]  Is that it?
[01:05:35.030 --> 01:05:35.770]  One further.
[01:05:36.550 --> 01:05:41.270]  The funniest thing is that some of the cards actually work better than the legitimate cards.
[01:05:41.570 --> 01:05:43.810]  In other words, the legitimate cards will fail.
[01:05:44.010 --> 01:05:44.850]  This will work.
[01:05:45.690 --> 01:05:46.110]  That...
[01:05:47.030 --> 01:05:47.650]  That's it.
[01:05:48.190 --> 01:05:48.610]  Okay.
[01:05:48.770 --> 01:05:49.890]  The man in the disguise.
[01:05:50.290 --> 01:05:50.430]  Yeah.
[01:05:51.050 --> 01:05:52.310]  Sorry for being so nervous.
[01:05:52.450 --> 01:05:54.450]  I just have a couple of questions about this.
[01:05:54.450 --> 01:06:04.750]  First of all, the thousands of buses during rush hour with probably a couple of million people using the MetroCard on the buses and subways.
[01:06:04.930 --> 01:06:10.730]  Some of these buses are all going through tunnels, areas that there's no possible radio communication permitted.
[01:06:11.170 --> 01:06:17.650]  And also realize every bus, as you said, has to be a confirmation saying that the serial number is okay.
[01:06:17.970 --> 01:06:36.570]  So perhaps either that there is some other system going on or that maybe it's possible to just essentially send a radio broadcast or whatever microwave frequency saying that every card is okay and overloading, telling each bus whether it gets the wrong MetroCard or the right MetroCard.
[01:06:36.870 --> 01:06:37.390]  Okay.
[01:06:37.690 --> 01:06:37.830]  Okay.
[01:06:38.030 --> 01:06:40.830]  There's a lot of questions and ideas in there.
[01:06:40.910 --> 01:06:42.290]  So let me handle a couple of them.
[01:06:44.010 --> 01:06:45.870]  And I'm running out of time.
[01:06:46.150 --> 01:06:46.790]  I'm over.
[01:06:47.050 --> 01:06:49.970]  So I'll take a quick question from the last guy after this only.
[01:06:52.130 --> 01:06:57.990]  No, you can't really defeat this by telling the buses that every card is okay.
[01:06:59.550 --> 01:07:00.910]  What works...
[01:07:00.910 --> 01:07:01.490]  The reason...
[01:07:01.490 --> 01:07:06.410]  The way that it works is it just gives a list of what cards are bad.
[01:07:06.610 --> 01:07:09.910]  Because that's much smaller than what cards are okay.
[01:07:10.250 --> 01:07:14.750]  And there appears to be no general thing in saying every card is okay.
[01:07:15.610 --> 01:07:22.150]  It makes no sense because immediately you're going to get cards in manufacture even which are no good.
[01:07:22.630 --> 01:07:25.950]  So you'd have to make that known to the turnstiles or to the bus fare boxes.
[01:07:27.850 --> 01:07:30.530]  How does the count send it back?
[01:07:31.090 --> 01:07:31.590]  Okay.
[01:07:31.790 --> 01:07:31.910]  Okay.
[01:07:32.030 --> 01:07:32.170]  Yeah.
[01:07:32.270 --> 01:07:32.970]  I'm going to get to that.
[01:07:34.610 --> 01:07:35.570]  Of a radio.
[01:07:35.830 --> 01:07:36.090]  Yeah.
[01:07:36.630 --> 01:07:39.370]  You say that buses go through tunnels and whatever.
[01:07:39.630 --> 01:07:42.190]  They may wait for a confirmation signal.
[01:07:42.430 --> 01:07:45.870]  They may send the same information several times.
[01:07:45.870 --> 01:07:51.070]  In other words, they may send it at noon, at 12.10, at 12.20.
[01:07:51.310 --> 01:07:57.150]  And then at 12.10 they send the new 12.10 information as well.
[01:07:57.450 --> 01:07:59.930]  Which gets repeated at 12.20 and 12.30.
[01:08:00.250 --> 01:08:03.310]  At 12.20 they may send the new 12.20 information.
[01:08:03.310 --> 01:08:04.550]  What about...
[01:08:04.550 --> 01:08:06.570]  Is there enough bandwidth for all that type of information?
[01:08:06.630 --> 01:08:07.430]  Is there enough...
[01:08:07.430 --> 01:08:09.890]  Bandwidth for all that type of information going over the...
[01:08:09.890 --> 01:08:10.330]  Baggage?
[01:08:10.810 --> 01:08:11.410]  Bandwidth.
[01:08:11.850 --> 01:08:12.450]  Banquets?
[01:08:13.070 --> 01:08:13.350]  BAM.
[01:08:13.430 --> 01:08:14.170]  Oh, bandwidth.
[01:08:14.470 --> 01:08:15.070]  Thank you.
[01:08:15.570 --> 01:08:15.990]  Sorry.
[01:08:17.370 --> 01:08:17.970]  Bandwidth.
[01:08:21.150 --> 01:08:29.690]  If the information is simple, like card numbers that are no good, you could probably compress it pretty well.
[01:08:31.510 --> 01:08:33.690]  And that's really all you need to know.
[01:08:34.570 --> 01:08:38.950]  Processing of how many people got off this, how many people got off that.
[01:08:39.270 --> 01:08:42.230]  That can wait until the bus gets back to the depot.
[01:08:43.670 --> 01:08:48.290]  As far as transfers, we're pretty sure transfers are on the card.
[01:08:48.530 --> 01:08:51.110]  So you don't have to worry about communicating that to buses.
[01:08:52.170 --> 01:08:52.610]  Okay.
[01:08:52.830 --> 01:08:53.530]  Anything else?
[01:08:53.750 --> 01:08:54.590]  It has to be quick.
[01:08:54.790 --> 01:08:56.610]  Yeah, but where does it start all?
[01:08:56.610 --> 01:08:58.110]  That's a lot of people getting on.
[01:08:58.530 --> 01:08:59.170]  You know, getting on.
[01:08:59.350 --> 01:08:59.910]  Where would it put...
[01:08:59.910 --> 01:09:00.710]  They have a hard drive?
[01:09:00.890 --> 01:09:05.770]  Yeah, but if a card works getting on and off the bus, you don't have to report that fact.
[01:09:05.930 --> 01:09:09.110]  You only have to really report problems in the two directions.
[01:09:09.490 --> 01:09:12.450]  That's a great advantage of this sort of system.
[01:09:12.650 --> 01:09:13.110]  Okay?
[01:09:13.410 --> 01:09:14.710]  That's all I'm going to take.
[01:09:14.810 --> 01:09:16.210]  If you want, we can talk later.
[01:09:17.290 --> 01:09:18.150]  Last person.
[01:09:18.230 --> 01:09:18.810]  Last question.
[01:09:19.390 --> 01:09:22.710]  I just had some information for the curious in the crowd.
[01:09:22.890 --> 01:09:26.590]  At our company, we just did a tremendous amount of research into credit cards.
[01:09:36.530 --> 01:09:42.810]  We did come across readily available commercial three-track reader writers in the $500 range.
[01:09:44.570 --> 01:09:46.610]  And then I just wanted to ask a question.
[01:09:46.890 --> 01:10:02.670]  The MetroCard serial number that you just read to us, I hope that is not a card that you have used, because certainly somebody in the audience who works for the TA will go and try to figure out where it was used and what cameras are on those turnstiles.
[01:10:02.930 --> 01:10:11.950]  The card serial number that I read is one of the cards that's in the New York City 2600 meeting, free MetroCard exchange.
[01:10:14.990 --> 01:10:18.350]  I have no idea where that card has been.
[01:10:19.230 --> 01:10:25.810]  Certainly as an employee, I have not used that card because one of the few perks, employees ride free.
[01:10:28.810 --> 01:10:29.910]  That's about it.
[01:10:30.030 --> 01:10:32.550]  I'd like to thank absolutely everyone for coming.
[01:10:34.570 --> 01:10:36.870]  I'd like to thank everyone for...
[01:10:38.650 --> 01:10:44.490]  I'd like to also thank everyone for the respect that they gave our Bible reading at the start.
[01:10:45.030 --> 01:10:49.850]  I know it's not a substitute for church, but I'm sure you feel holier for it.
[01:10:56.830 --> 01:11:04.070]  All right folks, if you stick around, we have another panel on dangerous legislation coming right up next.
[01:11:04.590 --> 01:11:08.050]  So hang out for a little bit, we'll get that set up for you right away.