1
00:00:13,400 --> 00:00:20,560
Thank you all so much for coming here to hear my speech at 8 o'clock on a Saturday night.

2
00:00:20,680 --> 00:00:26,620
I'm not sure why I got... how I managed to pull this particular time slot.

3
00:00:26,620 --> 00:00:31,340
This is a time when people would rather be breaking the law than learning about the law.

4
00:00:31,340 --> 00:00:40,260
But I'll do my best to try to keep it interesting and also maybe try to keep it short and maybe we can have something like a conversation following this.

5
00:00:40,260 --> 00:00:53,900
So, for those of you who don't know me, my name is Jennifer Granick and I am the Executive Director of the Center for Internet and Society, which is a public interest internet law program at Stanford Law School.

6
00:00:53,900 --> 00:01:03,240
And as part of our program, we have conferences, speakers, things to study the interaction of civil liberties, the public interest in computer technology.

7
00:01:03,240 --> 00:01:11,820
And I also teach a class there, which is a practical course for law students which is called the Cyber Law Clinic.

8
00:01:11,820 --> 00:01:21,680
And we take cases and provide people with pro bono legal services and students get to work on the cases and learn how to be lawyers and I get to work on issues that I think are important and interesting.

9
00:01:22,040 --> 00:01:27,920
So, I am a teacher but also a litigator in that capacity.

10
00:01:27,920 --> 00:01:36,120
I came to this job from my background as being a criminal defense attorney, which I can tell you has been an extremely useful background this week.

11
00:01:36,120 --> 00:01:40,300
And we may get a chance to talk about that a little bit while I am up here.

12
00:01:40,960 --> 00:01:52,140
Okay, so my conception for this talk was that I wanted to actually have a really large audience and I thought, how else do you have a large audience other than to survey everybody and find out what questions they are interested in and then answer those questions.

13
00:01:52,140 --> 00:02:00,460
So I took an extremely informal survey that my father would think is completely statistically inaccurate and I came up with the following questions.

14
00:02:01,460 --> 00:02:02,920
And there we have some of them.

15
00:02:02,920 --> 00:02:06,540
I came up with about ten questions that I thought that people would be interested in.

16
00:02:08,820 --> 00:02:12,200
And for those of you who responded to my survey, thank you very much.

17
00:02:12,440 --> 00:02:23,560
I swapped out one of the old questions to give us question number nine because I think that there is a lot of interesting things to say about that from a legal standpoint.

18
00:02:23,560 --> 00:02:32,200
And the thing about it, the thing about the whole issue that interested me from a legal standpoint and I will give you some idea of my sense about what the law is behind all of that.

19
00:02:32,200 --> 00:02:34,920
So these are the ten questions that I'm going to be answering.

20
00:02:35,380 --> 00:02:43,640
And I think since we have, I see some more people coming, but I think when I did a similar kind of format at Black Hat, I asked for people to keep questions until the end.

21
00:02:43,760 --> 00:02:48,700
But I think here, since it's kind of a small group, I think I can manage to take questions during.

22
00:02:48,700 --> 00:02:56,280
I just don't want to get bogged down on one question and not get to the point where, not get to the point where we get to kind of get through all of the questions.

23
00:02:56,280 --> 00:03:05,360
So if you have questions that are relevant to something I'm talking about at the time, please just raise your hand and I'll see if I want to call on you.

24
00:03:05,620 --> 00:03:12,760
I see somebody there with a trademark infringing Newsweek shirt, which I'm going to tell my husband about since he works there.

25
00:03:14,600 --> 00:03:15,940
It's a parody, yeah.

26
00:03:15,940 --> 00:03:17,920
Okay, well then you're cool, man, you're cool.

27
00:03:19,420 --> 00:03:28,040
Alright, so when you're trying to cover ten legal questions, the thing I want to make pretty clear here is that I'm going to try to give you at a very high level some legal information.

28
00:03:28,040 --> 00:03:34,880
This isn't legal advice and it's not a substitute for talking either, you know, specifically with a lawyer about your specific situation.

29
00:03:34,960 --> 00:03:43,080
But I think one of the things that's wrong with the law, and especially the law in this area, is that it's so complicated that it's hard to kind of get a sense of, like, what the deal is.

30
00:03:43,080 --> 00:03:50,600
And of course every time you ask a lawyer what the deal is, the lawyer will always answer, I mean, if they're giving you the truthful answer, the answer is always, well, it depends.

31
00:03:50,820 --> 00:03:56,540
And it depends isn't really all that helpful, I can't, but it's always the right answer.

32
00:03:56,540 --> 00:04:08,700
So I'm not going to give you an answer that's any different from it depends, I'm just going to try to give you some sense of what factors it depends upon, and then, you know, hopefully that gives you a sense of what matters in all of these issues.

33
00:04:11,840 --> 00:04:16,780
Okay, so as you know from reading my questions, the first question that people asked was about wireless.

34
00:04:16,780 --> 00:04:19,740
And why did I think that wireless would be an interesting thing to talk about?

35
00:04:19,740 --> 00:04:30,680
Well, for those of you who are readers of the internet, you know that there was very recently a case in Florida where a Florida man was arrested for using wireless networks.

36
00:04:30,740 --> 00:04:33,500
And he was charged with a crime under the Florida law.

37
00:04:33,500 --> 00:04:36,780
So people wonder, is it a crime to use open wireless networks?

38
00:04:36,780 --> 00:04:43,220
Because if so, I think probably there's a lot of people here in the audience, myself included, who have been committing some crimes.

39
00:04:45,620 --> 00:04:50,320
No one else needs to confess, I'll do the confessing for us.

40
00:04:50,320 --> 00:04:59,520
I think the important thing about wireless is that when people say, well, I'm using a wireless network, there's a couple of different things you could mean, and different laws are going to apply to these different activities.

41
00:04:59,520 --> 00:05:05,400
So depending on what you're doing, we can see which laws might apply.

42
00:05:05,700 --> 00:05:10,100
The Florida case is a relatively rare situation.

43
00:05:10,100 --> 00:05:18,860
I personally am only aware of two other instances in which people have been charged with accessing a wireless network.

44
00:05:18,860 --> 00:05:26,300
One is a case that I was involved in in California, which later morphed into a case about something else, and the wireless was no longer an issue.

45
00:05:26,300 --> 00:05:36,180
And the other was a federal prosecution of a man named Stephan Puffer in Houston, and he was acquitted following a jury trial.

46
00:05:36,180 --> 00:05:42,380
So those are the only other two instances I'm aware of in which somebody was prosecuted for wireless.

47
00:05:42,400 --> 00:05:47,400
So let's take the more easy instances first and see what laws might apply.

48
00:05:47,400 --> 00:05:50,040
First, accessing stored files through the network.

49
00:05:50,340 --> 00:06:08,400
So the law that applies to protecting stored files is the Electronic Communications Privacy Act, and I put the text of the statute up here for you, but I want to take a moment to touch on, or to really kind of talk about, the two operative concepts that are the basis for this law,

50
00:06:08,400 --> 00:06:16,620
and also for the Computer Fraud and Abuse Act, which is the anti-hacking law, and for many of these computer laws.

51
00:06:16,620 --> 00:06:20,620
And that's the issue of unauthorized access.

52
00:06:20,980 --> 00:06:29,460
So almost all of these privacy and computer crimes that we see are based on access that's unauthorized.

53
00:06:29,460 --> 00:06:30,580
So what does that mean?

54
00:06:30,580 --> 00:06:33,460
Well, access could mean a lot of things.

55
00:06:33,960 --> 00:06:45,820
I was having a conversation with my parents at dinner tonight, and we were talking about what it means to kind of get behind or go into a website, or sort of go behind the front page, or that sort of thing.

56
00:06:45,820 --> 00:06:59,860
And you can talk about access as being something kind of metaphorical, like if I visit the website, then that's sort of like the front page, like the front door, but it's not like I'm getting into the database of information that's behind it.

57
00:06:59,860 --> 00:07:08,260
Or if I ping and it sends me back a packet that says, yes, I'm here, then it's not like I really went inside or got any of the information that's inside.

58
00:07:08,480 --> 00:07:17,660
Or you can look at it in the way that computers really work, which is you send packets and it sends you packets, and when you send it packets, you're causing that machine to do something and you're accessing it.

59
00:07:17,780 --> 00:07:32,020
Well, courts have looked at it in the more broad sense, and basically the cases have read that every time you have some kind of contact with a networked computer, you're sending it electrons and packets, and so you are accessing it.

60
00:07:32,020 --> 00:07:33,540
So it has this very broad thing.

61
00:07:33,540 --> 00:07:42,560
In no case, in none of the cases that deal with the interpretation of the Computer Fraud and Abuse Act, has anyone ever been held to not have accessed the computer.

62
00:07:42,560 --> 00:07:47,440
So access is kind of, it's like any use or connection with a networked computer is access.

63
00:07:47,440 --> 00:07:50,700
Well, so okay, there's one element of the crime that we've all committed.

64
00:07:50,700 --> 00:07:52,040
What about authorization?

65
00:07:52,040 --> 00:07:57,300
Is authorization really something that helps us distinguish between legal and illegal activity?

66
00:07:58,360 --> 00:08:00,960
So authorization could mean a lot of things.

67
00:08:00,960 --> 00:08:06,940
It could mean that you have explicit permission, or it could mean that you weren't explicitly kept out.

68
00:08:06,940 --> 00:08:09,000
And how does the law see this?

69
00:08:12,490 --> 00:08:18,970
Well, a lot of technological people think that authorization is kind of about what the computer allows you to do.

70
00:08:18,970 --> 00:08:29,170
So if permissions are set in such a way that you can access a file, or if the file is stored in a public space on the web server, then you have authorization because the computer authorized you to do it.

71
00:08:29,430 --> 00:08:31,590
And that's not the way that the law looks at it.

72
00:08:31,590 --> 00:08:37,010
The law has a much more social or sociological view of what authorization means.

73
00:08:37,010 --> 00:08:43,350
And there are many ways that you can do something that goes beyond your authorization.

74
00:08:43,750 --> 00:08:52,330
There are cases that say that if you do something that's what a banner warning tells you not to do, your use is unauthorized.

75
00:08:52,330 --> 00:09:01,410
There are cases that say if you make access to a computer system contrary to the terms of a contract or terms of service, that that's unauthorized.

76
00:09:01,410 --> 00:09:09,690
Cases that say that if you are notified that what you're doing is unauthorized, and you continue to do it, that that's unauthorized.

77
00:09:09,690 --> 00:09:26,970
So we have cases like eBay versus Bidder's Edge, in which a robot spidering program that collected auction information from eBay was making unauthorized access to eBay's website because eBay told the company that ran the spidering program they didn't want them there.

78
00:09:26,970 --> 00:09:42,470
We have cases where somebody who was a former employee who had left that company and was told that as a condition of your having left this company, you're not allowed to compete with us, sort of a non-compete agreement.

79
00:09:42,470 --> 00:09:51,270
And he then went on to his old company's website and collected data there about how much, I think it was cruises, travel packages cost.

80
00:09:51,270 --> 00:10:01,830
And in that case, they said, well, you were doing that to compete with your old employer, and that was contrary to the terms of your termination contract, and so that was unauthorized.

81
00:10:01,830 --> 00:10:20,910
The case that I think reads unauthorized access the most broadly is a case where a former employee started working for a new competitor company, but before he moved to the new company, he took a copy of his old employer's customer list, and he took it with him to the new company.

82
00:10:20,910 --> 00:10:27,330
And then the old company sued the new company and said, you had your guy make unauthorized access to our computers.

83
00:10:27,390 --> 00:10:29,890
And the new employer said, hey, he was authorized.

84
00:10:29,890 --> 00:10:30,870
He had a password.

85
00:10:30,870 --> 00:10:32,030
He was still working there.

86
00:10:32,030 --> 00:10:35,370
He was allowed to access the customer list.

87
00:10:35,370 --> 00:10:39,130
Maybe, you know, he took a trade secret or something, but it wasn't this violation.

88
00:10:39,130 --> 00:10:41,490
It wasn't unauthorized access to your computers.

89
00:10:41,670 --> 00:10:50,870
And what the court said is that, no, the court said at the moment that he knew in his mind that he was acting contrary to the interests of his employer,

90
00:10:59,500 --> 00:11:05,380
all right, and that he was acting contrary to the interests of his employer, his use was not authorized.

91
00:11:05,380 --> 00:11:06,220
Well, think about that.

92
00:11:06,220 --> 00:11:13,260
Every time you access some computer in a way that the computer owner might not like is unauthorized, that's pretty broad.

93
00:11:13,260 --> 00:11:25,080
Okay, so keep that in mind when we're talking about all of these things, about what unauthorized means and whether it's really a principled way to distinguish between something that's criminal and not criminal.

94
00:11:25,080 --> 00:11:27,040
I mean, my argument is that it's not.

95
00:11:27,040 --> 00:11:44,420
And if you look at the civil cases that interpret these, particularly the civil cases, but now some criminal cases, think about whether search engines or spidering robots or shopping bots or those sorts of things are crimes, because cases have held that all of those are making unauthorized access to computers.

96
00:11:44,840 --> 00:11:54,480
So if you were to use wireless to access stored files on a network without permission, that would be a violation of this particular law that I have listed up here.

97
00:11:56,520 --> 00:12:00,000
What about intercepting communications that go over the network?

98
00:12:00,000 --> 00:12:05,340
Well, there's a law that says that you are not allowed to intercept the contents of communications.

99
00:12:05,480 --> 00:12:09,680
So when people ask me, well, what if it's unencrypted just going over a wireless network?

100
00:12:09,680 --> 00:12:12,360
Can I read it and take a look at it?

101
00:12:12,360 --> 00:12:13,480
And I always say no.

102
00:12:13,480 --> 00:12:25,080
And I feel even better about this after I used the wireless at Black Hat to check my email, and the next thing I knew I was locked out of my email account because some bozo was logged on and so I couldn't get back in.

103
00:12:25,080 --> 00:12:28,260
I've had to change my email password four times at Black Hat.

104
00:12:30,320 --> 00:12:30,960
I know.

105
00:12:30,960 --> 00:12:32,540
I know what you guys are all thinking.

106
00:12:32,540 --> 00:12:33,920
But I'm a lawyer.

107
00:12:33,920 --> 00:12:34,880
Give me a break.

108
00:12:44,080 --> 00:12:57,440
So I always tell people you shouldn't be accessing the content of communications, but I do think that if anybody, and it wouldn't be any of my clients who talked to me about this beforehand, but if anybody ever does make this mistake and ends up getting prosecuted for it,

109
00:12:57,440 --> 00:13:01,000
I think there might be a defense within the context of the statute.

110
00:13:01,220 --> 00:13:08,060
The statute does have an exception in it, which I think was designed to protect people who were capturing radio signals.

111
00:13:08,060 --> 00:13:18,760
And that exception says that it's not unlawful to intercept communications which are configured so as to be accessible to the general public, readily accessible to the general public.

112
00:13:18,760 --> 00:13:26,300
And I think there's an argument you could make that unencrypted communications over wireless are readily accessible to the general public.

113
00:13:26,300 --> 00:13:32,720
So hopefully none of you will ever have to mount that defense, but if so, we'll see how that goes.

114
00:13:34,500 --> 00:13:36,780
Alright, what about just using the network?

115
00:13:36,800 --> 00:13:43,000
So this also gets us into question number two, which is what are the federal and state laws regarding computer crimes?

116
00:13:43,080 --> 00:13:48,880
And as I talked to you before, the kind of triggering thing is this unauthorized access.

117
00:13:49,120 --> 00:13:51,640
The Computer Fraud and Abuse Act, which is 18 U.S.C.

118
00:13:51,660 --> 00:13:59,820
1030, one of my favorite laws, makes it a crime to access a computer without authorization and either obtain information or cause damage.

119
00:13:59,820 --> 00:14:03,640
It's a very long statute and there's more to it than that, but you get the basic gist.

120
00:14:03,720 --> 00:14:09,260
So the question is, is using wireless a crime under this statute?

121
00:14:09,260 --> 00:14:21,180
And I've always thought no, just using it isn't, because the wireless isn't necessarily a computer and as long as you're not overusing the bandwidth or doing anything to damage the network, there's no damage.

122
00:14:21,180 --> 00:14:24,700
And in order for this to happen, you have to either obtain information or cause damage.

123
00:14:24,700 --> 00:14:30,520
So I thought that was pretty okay until we started seeing these California and Florida cases.

124
00:14:31,320 --> 00:14:33,760
So, why is it different under state law?

125
00:14:33,760 --> 00:14:39,220
Well, state laws are phrased differently than the federal law and I have here the California law.

126
00:14:39,220 --> 00:14:44,180
It basically says you don't have to cause damage and it doesn't have to be access to a computer.

127
00:14:44,200 --> 00:14:49,260
If you use computer services without permission, you may be committing a crime.

128
00:14:49,260 --> 00:14:55,220
And this was the statute that they chose to arrest the person that I was working with under.

129
00:14:55,700 --> 00:15:04,560
Similarly, the Florida statute says that it's a crime to willfully, knowingly, and without authorization access a computer system or computer network.

130
00:15:04,560 --> 00:15:09,660
And you could say that the wireless or the access hub is part of the computer network.

131
00:15:09,660 --> 00:15:17,580
So, this is kind of scary, because you know that you're accessing the wireless and how do they prove that it's without authorization?

132
00:15:17,580 --> 00:15:21,080
Well, the way they usually prove it is not that hard.

133
00:15:21,080 --> 00:15:26,880
Basically, as I said, it's kind of in the mind of the owner, is the way that the law looks at it.

134
00:15:26,880 --> 00:15:38,800
And what I have seen them do in all of my cases is they get the person who's the owner of the computer system to come into court and they say, did you ever give the defendant permission to use your computer services or computer?

135
00:15:38,800 --> 00:15:42,440
And the owner says, no, I never gave them permission.

136
00:15:42,440 --> 00:15:44,480
And boom, they're done, they leave, and that's it.

137
00:15:44,480 --> 00:15:45,580
What are you going to say?

138
00:15:45,580 --> 00:15:50,720
So, authorization's always been pretty easy, or lack of authorization's always been pretty easy to prove.

139
00:15:51,020 --> 00:15:52,760
But with wireless, how do you know, right?

140
00:15:52,760 --> 00:15:53,660
Is there a question?

141
00:16:07,320 --> 00:16:15,420
So, his question is, isn't it kind of implicit if people leave it open, that maybe you're authorizing, that it's implicit that you're allowed?

142
00:16:17,200 --> 00:16:17,940
Yeah.

143
00:16:19,940 --> 00:16:27,860
They're saying, well, the box is called allow all, and I can promise both of you that people who have wireless in their house, many people have never seen that box.

144
00:16:27,860 --> 00:16:32,800
Many people just plug the thing in and it just automatically allows, and that's it.

145
00:16:32,800 --> 00:16:37,940
So, do those people want other people to make access, or don't they?

146
00:16:37,940 --> 00:16:47,480
Some ISPs encourage you to share your broadband connection, and some ISPs in the contract tell you that you're not allowed to share.

147
00:16:47,480 --> 00:17:03,620
But the vendors choose to leave the burden of actually excluding or including people, or actually including or excluding outside users to the people who purchase the access and the wireless router, and most of those people aren't like us.

148
00:17:03,620 --> 00:17:14,620
Most of those people are more like, as I have my poster children of my parents, most of those people are more like my parents, who, at best case scenario, are going to plug the thing in and be psyched that it works.

149
00:17:14,860 --> 00:17:19,900
Worst case scenario, have to call in, you know, some expert technical assistance to help with that.

150
00:17:19,900 --> 00:17:22,260
So the question is, what do you know?

151
00:17:22,920 --> 00:17:23,800
Exactly.

152
00:17:24,140 --> 00:17:31,940
So the question is, what do you as the user know about what the owner wants, just based on the fact that access is possible?

153
00:17:31,940 --> 00:17:33,620
Do you really know what's in their mind?

154
00:17:33,620 --> 00:17:40,760
And as long as the courts look at what's in the owner's mind, as opposed to what might seem reasonable to you, you're in trouble.

155
00:17:41,040 --> 00:17:56,240
In the case that I was involved in, one of the things that made them feel like it wasn't authorized is that my client was outside of somebody's house in his car, and they're like, why is he lurking around outside their house?

156
00:17:56,240 --> 00:18:03,620
Now, that might seem like totally normal behavior to some of us, you know, when you need to get onto the wireless, there's nothing wrong with lurking around outside somebody's house.

157
00:18:03,620 --> 00:18:10,940
But, you know, I don't know that a judge or a jury is necessarily going to view it the same way, and it's kind of risky to depend upon that.

158
00:18:10,940 --> 00:18:12,180
And of course, you don't know.

159
00:18:12,180 --> 00:18:21,380
When the access point's open, you don't know whether you're allowed or the person's just, you know, too lazy or ignorant to have configured it differently.

160
00:18:21,640 --> 00:18:28,940
So what I have argued with these laws is that it shouldn't be enough that you know you use wireless and that it's unauthorized.

161
00:18:28,940 --> 00:18:32,100
I've argued that you should have to know that it's unauthorized.

162
00:18:32,100 --> 00:18:35,840
Like, you in your mind know that you're not allowed to be doing what you're doing.

163
00:18:35,840 --> 00:18:38,220
Otherwise, you don't have a guilty state of mind.

164
00:18:38,220 --> 00:18:44,720
You're not doing anything that is, you know, the illicit criminal thing that's what we're trying to prevent.

165
00:18:44,860 --> 00:18:50,440
And much of criminal law, in fact almost all of criminal law, requires you to have like a guilty criminal state of mind.

166
00:18:50,440 --> 00:18:55,860
And that's what we do to distinguish between, you know, where you don't get punished and where it's okay to put you in prison.

167
00:18:56,420 --> 00:18:58,560
So no court has adopted that yet.

168
00:18:58,560 --> 00:19:05,940
But if there are any lawyers out here who ever face some of these cases, you can call me, I wrote a brief on it, and I think it's pretty good, I think it's a really good argument.

169
00:19:06,340 --> 00:19:07,940
But can you count on it?

170
00:19:08,160 --> 00:19:09,460
You know, no.

171
00:19:22,670 --> 00:19:31,990
So the question is, what else could you do to make the fail-open, to make fail-open more of a legal, like more robust legally?

172
00:19:31,990 --> 00:19:40,950
So that, you know, in the absence of circumstances that clearly point to the contrary, instead of assuming that you're not authorized, we assume that you are authorized.

173
00:19:41,050 --> 00:20:00,710
And I think that, I mean, that would be great, right, if we could communicate to courts or juries or, you know, or Congress that, or legislatures, that in the absence of some kind of security measure or some kind of clear notice to the contrary, if something is accessible,

174
00:20:00,710 --> 00:20:03,850
we can assume that it's okay to access it.

175
00:20:04,270 --> 00:20:08,150
And , you know, so there's two ways that the law develops.

176
00:20:08,150 --> 00:20:20,670
The law can either develop through, well, there's many ways, but the law can mainly develop either through statute, where you can have that be something that a legislature would pass, or it can develop through the common law, where through the process of judges making rulings,

177
00:20:20,670 --> 00:20:24,570
something becomes conventional and is sort of the way that things are done.

178
00:20:24,570 --> 00:20:33,910
And so, you know, many of these cases, what you're hoping for is to develop a common law so that courts see that, you know, we're going to assume, we're going to assume freedom.

179
00:20:33,910 --> 00:20:43,730
We're going to put the burden of security, the burden of closing something on the owner, and we're going to not put the burden on the public to assume that unless they're explicitly invited in, they can't go anywhere.

180
00:20:43,950 --> 00:20:46,230
So that's the way that it works with the law.

181
00:20:46,230 --> 00:21:03,150
I mean, there may very well be technological ways we could do that as well, which might include making it easier for people to make their preferences more explicit and putting maybe pressure on vendors, for example, to make that process of deciding easier so that we don't have to assume that if it's open,

182
00:21:03,150 --> 00:21:04,050
it's ignorance.

183
00:21:04,050 --> 00:21:09,130
We can assume that if it's open, it's intentional, and that if it's closed, that too is intentional.

184
00:21:13,160 --> 00:21:15,360
Okay, so the Patriot Act and computer crime.

185
00:21:15,360 --> 00:21:18,640
How did the Patriot Act change investigations of computer crimes?

186
00:21:19,080 --> 00:21:27,780
Well, clearly the Patriot Act expanded surveillance in many areas, but I'm going to talk just specifically about this particular area.

187
00:21:27,780 --> 00:21:31,980
And the Patriot Act changed computer crime investigation in two main ways.

188
00:21:31,980 --> 00:21:37,640
First, it made it possible to get wiretaps to investigate computer crimes.

189
00:21:37,640 --> 00:21:44,560
A wiretap is a very privacy-invasive investigatory tool, and you can't get it to investigate just any crime.

190
00:21:44,560 --> 00:21:54,400
You can only get it to investigate a certain enumerated list of crimes, kind of meant to be the more serious or the more dangerous ones.

191
00:21:54,480 --> 00:22:00,160
And now computer hacking is one of those more serious or dangerous crimes for which you can get a wiretap.

192
00:22:00,160 --> 00:22:05,180
It also created this computer trespasser exception to the wiretap rules.

193
00:22:05,200 --> 00:22:13,100
The trespasser exception gives the government additional rights to monitor somebody who is a trespasser on the computer system.

194
00:22:13,100 --> 00:22:32,540
So if it's your system, it gives you more power to bring the government in without the government needing to get a warrant, and it gives the government more power to work with people who are owners of victim systems in order to do monitoring without having to go through the same kind of...

195
00:22:32,540 --> 00:22:37,540
without having to show the same level of proof that they would have to show prior to the Patriot Act.

196
00:22:37,540 --> 00:22:41,220
And here is basically the terms and conditions of the trespasser exception.

197
00:22:41,220 --> 00:22:41,760
Yes?

198
00:22:45,760 --> 00:22:50,240
So trespasser is defined... it's very interesting, I think, how they defined it in this statute.

199
00:22:50,240 --> 00:22:56,840
A trespasser is somebody who has no contractual relationship or authority to be on the computer.

200
00:22:56,840 --> 00:23:05,700
And I think the thing that's really interesting about that is to contrast it with the definition in the Computer Fraud and Abuse Act, which says that you're just unauthorized.

201
00:23:05,700 --> 00:23:10,080
And it's clear that unauthorized means you've gone beyond the terms of the contract.

202
00:23:10,080 --> 00:23:16,980
Here they're saying, even if you go beyond the terms of the contract, that's not enough to be a trespasser on this computer system.

203
00:23:17,120 --> 00:23:27,560
If you have any right to be there at all, like if you're a legitimate user and you're just exceeding your authorized access, you're not going to be falling in under the computer trespasser exception.

204
00:23:27,560 --> 00:23:31,700
You're just not... it's got to be somebody who has no authority or no right to be there at all.

205
00:23:31,920 --> 00:23:46,760
And the thing that just really aggravates me about that is it shows that Congress knows that the Computer Fraud and Abuse Act covers people who are outside of the bounds of contract and that they're making criminal something that is just a breach of contract,

206
00:23:46,760 --> 00:23:49,380
which I think is wrong and drives me crazy.

207
00:23:49,380 --> 00:24:05,080
And you wonder whether maybe they just don't realize what they're doing and then you see that they excluded people with some kind of contractual authority when they made the trespasser exception, which shows that they knew what they were doing all along and they just disagree with me as opposed to they don't know what I know.

208
00:24:05,080 --> 00:24:07,560
They know what I know and they like it the way it is.

209
00:24:11,510 --> 00:24:14,550
Okay, where can you find out more information about the Patriot Act?

210
00:24:14,550 --> 00:24:16,230
Here's some places.

211
00:24:16,390 --> 00:24:26,370
And basically, at this point in time, there are many controversial provisions of the Patriot Act which are due to terminate or sunset very soon.

212
00:24:26,490 --> 00:24:32,730
And the House of Representatives has reauthorized those provisions and it goes to the Senate now.

213
00:24:32,730 --> 00:24:41,750
So it's actually a time where there's a lot of legal work being done on the Patriot Act and it's a good chance and a good opportunity to get involved with Patriot Act issues.

214
00:24:42,730 --> 00:24:43,470
Seth?

215
00:24:47,060 --> 00:24:47,940
Today?

216
00:24:48,300 --> 00:24:49,180
Or yesterday?

217
00:24:50,300 --> 00:24:54,680
Okay, so Seth says that the Senate passed a bill that reauthorized most or all?

218
00:24:59,480 --> 00:25:03,560
Okay, so he says it has different sunset terms from the House, but they reauthorized everything.

219
00:25:03,560 --> 00:25:06,800
And I wasn't reading the newspapers yesterday, so I'm totally behind.

220
00:25:06,800 --> 00:25:08,900
But it shows you how fast things move, right?

221
00:25:08,900 --> 00:25:10,920
So is it too late for us or what?

222
00:25:17,320 --> 00:25:18,900
Okay, so it's not too late.

223
00:25:18,900 --> 00:25:21,640
There's still a chance to win the House and Senate conference on the bill.

224
00:25:22,420 --> 00:25:23,380
Yeah, it's late.

225
00:25:31,730 --> 00:25:37,690
So see what happens when they bring us down here, we're having fun in Las Vegas, and they're busy working up there on stuff we don't like.

226
00:25:38,810 --> 00:25:39,450
Okay.

227
00:25:40,350 --> 00:25:45,530
So, one of the questions that people had asked me is, like, when can the government surveil me?

228
00:25:45,530 --> 00:25:47,210
This is question number four.

229
00:25:47,210 --> 00:25:55,870
And I put that on my list of questions, and then I realized it's just simply, completely impossible to do that question any kind of justice in this format.

230
00:25:57,770 --> 00:25:58,210
So...

231
00:26:00,420 --> 00:26:02,860
Excuse me, I'm trying to figure out how much time I have.

232
00:26:02,940 --> 00:26:03,560
Okay.

233
00:26:03,740 --> 00:26:16,640
But I thought I would just, you know, make some comments about privacy and about how the laws that govern surveillance work generally to give you a framework for what kind of things should I be looking for or asking when I'm wondering about when I can be surveilled.

234
00:26:16,640 --> 00:26:23,360
So there's many different theories of privacy which are sort of operant in our law.

235
00:26:23,420 --> 00:26:31,140
And what we've done is sort of, we have like this mishmash of statutes which either try to protect or totally fail to protect privacy.

236
00:26:31,380 --> 00:26:45,200
And I think that you can really, sort of a useful framework for looking at privacy questions and questions of surveillance is to ask yourself, you know, these five questions when you're looking at an issue of what is, you know, is this privacy protecting?

237
00:26:45,200 --> 00:26:48,520
Is privacy protecting enough or not enough?

238
00:26:48,520 --> 00:27:04,780
So, you know, we're looking at what level of proof needs to be shown for a certain kind of information depending on its sensitivity and what safeguards are in place to make sure that there isn't any kind of, you know, unauthorized or excessive use of this personal information.

239
00:27:10,320 --> 00:27:11,560
Okay.

240
00:27:12,600 --> 00:27:15,620
So, a lot of people ask me questions about encryption.

241
00:27:15,620 --> 00:27:19,800
The very popular topic in the survey.

242
00:27:20,120 --> 00:27:24,300
And, you know, people wanted to know, you know, these sorts of questions about encryption.

243
00:27:24,420 --> 00:27:26,660
Mostly, you know, is using encryption a crime?

244
00:27:26,660 --> 00:27:27,840
And why did this come up?

245
00:27:27,840 --> 00:27:40,920
Well, again, recently there was a case out of Minnesota in which the court appeared to be holding that the fact that the defendant had PGP on his computer was evidence of criminal intent.

246
00:27:40,920 --> 00:27:47,060
Now, for those of you who aren't familiar with the case, I can tell you basically this was a child molest case.

247
00:27:47,060 --> 00:27:54,060
And the victim told the investigators that the defendant had molested her and had taken pictures of it.

248
00:27:54,060 --> 00:27:58,760
And the investigators got a warrant and they went to search the defendant's computer.

249
00:27:58,820 --> 00:28:02,680
And when they searched the defendant's computer, they didn't find any pictures.

250
00:28:02,680 --> 00:28:09,140
So, it didn't... that portion of the victim's story was not corroborated.

251
00:28:09,140 --> 00:28:13,160
And in ruling on whether or not... but they let in evidence.

252
00:28:13,160 --> 00:28:25,040
The trial court let in evidence and considered evidence that the defendant had had PGP on his computer in saying that there was enough evidence for him to be convicted of the child molest.

253
00:28:25,040 --> 00:28:33,640
And on appeal, the defendant said that using the encryption evidence, admitting the encryption evidence and using it in that way was improper.

254
00:28:33,880 --> 00:28:36,260
And the court of appeal said, no, it's not improper.

255
00:28:36,260 --> 00:28:37,560
It's fine.

256
00:28:37,560 --> 00:28:40,120
Well, there's a couple ways that you can look at this.

257
00:28:40,120 --> 00:28:44,520
So, first of all, did the court say that using encryption itself was a crime?

258
00:28:44,520 --> 00:28:45,320
No.

259
00:28:45,320 --> 00:28:49,920
So, there are not cases that say purely using encryption is a crime.

260
00:28:49,920 --> 00:28:55,720
In fact, there are cases that say the encryption algorithms themselves are protected by free speech principles.

261
00:28:55,860 --> 00:29:02,200
Certainly, we also have a right to communicate and a right to communicate anonymously and privately.

262
00:29:02,200 --> 00:29:05,440
And so, we don't have cases that say just encryption is bad.

263
00:29:05,440 --> 00:29:07,740
But is it evidence of criminal intent?

264
00:29:07,760 --> 00:29:10,280
Now, remember, this is one case out of Minnesota.

265
00:29:10,560 --> 00:29:15,240
And I don't know how influential Minnesota will be in other states.

266
00:29:15,240 --> 00:29:25,940
But what you often find in this area is that the very first case on a topic, even if it's kind of poorly reasoned and poorly explained, like this case is, can become influential.

267
00:29:25,940 --> 00:29:29,860
So, you want to be really careful about what it is that the case really says.

268
00:29:29,860 --> 00:29:36,080
And one wishes that judges were more careful about what they say that the law is.

269
00:29:36,320 --> 00:29:48,620
The two ways to look at this particular opinion are either the one that we're all worried about, which is that when you have PGP on your computer, it shows that you have something to hide.

270
00:29:48,620 --> 00:29:53,960
And it shows guilty knowledge and that you're trying to keep stuff from investigators.

271
00:29:53,960 --> 00:29:59,880
So, it shows you have consciousness of your own guilt.

272
00:30:00,180 --> 00:30:10,420
Another way to read this very same case is that the PGP evidence explains why there wasn't evidence on the defendant's computer.

273
00:30:10,600 --> 00:30:18,820
So, it wasn't that it showed that he had something to hide, but it was an explanation for why they didn't find the pictures that they expected to find.

274
00:30:18,820 --> 00:30:22,160
Maybe they were encrypted or maybe he'd wiped them or something like that.

275
00:30:22,160 --> 00:30:26,300
It's unclear which of these explanations the court is adopting.

276
00:30:26,400 --> 00:30:33,480
One maybe makes some kind of sense and doesn't necessarily penalize somebody for having encryption.

277
00:30:33,480 --> 00:30:45,940
It just says, well, in the totality of the evidence and because I find the victim so credible, I'm not going to say she's not credible just because I didn't end up finding the pictures because there's other things I can look to to figure out why the pictures might not be there.

278
00:30:45,940 --> 00:30:52,100
And that's something maybe we can all live with as opposed to something that says, oh yeah, PGP, that shows that you knew you did something wrong.

279
00:30:52,320 --> 00:30:53,140
A question here?

280
00:30:53,140 --> 00:30:54,000
I'll go to you in a second.

281
00:31:09,720 --> 00:31:27,580
So, he's saying the press on the case, and I agree with this interpretation, it wasn't that the PGP evidence alone was enough, but in context with all the other evidence, was part of there being sufficient proof to convict the defendant of this particular case.

282
00:31:27,580 --> 00:31:34,900
And I think that that's a totally reasonable reading of the case and I think we want to be careful when we read these cases to not give them an interpretation.

283
00:31:34,980 --> 00:31:43,240
And by we, I don't necessarily mean you guys, I mean we as lawyers and I was going to say we as judges, but we all know that's never going to happen for me.

284
00:31:43,600 --> 00:31:55,160
But judges also need to be very careful when reading these cases to make sure that they're not giving an interpretation that's not warranted and taking something that made sense in one small context and expanding it to be a general principle.

285
00:31:55,160 --> 00:31:56,760
There was a comment over here.

286
00:31:56,760 --> 00:31:57,480
Gentleman here.

287
00:32:12,770 --> 00:32:16,950
So it's a question about employees on employer's network.

288
00:32:16,950 --> 00:32:24,990
And when you're on your employer's network, this gentleman is right, you have very little privacy and that's for a couple reasons.

289
00:32:24,990 --> 00:32:30,070
First of all, many of our privacy laws, like the Fourth Amendment, don't apply to private parties.

290
00:32:30,070 --> 00:32:32,070
So the Fourth Amendment doesn't apply.

291
00:32:32,090 --> 00:32:48,210
And many of the privacy laws that we do have, privacy rights that we're entitled to by statute, have exceptions in them which will apply to employers and allow employers to do a lot of monitoring and that sort of thing.

292
00:32:48,210 --> 00:32:51,330
So people generally have very little privacy at work.

293
00:32:51,330 --> 00:32:55,010
And employers have a lot of rights to surveil.

294
00:32:55,010 --> 00:32:56,750
Now we've seen limits to that.

295
00:32:56,750 --> 00:33:04,390
For example, with cases that involve videotaping and changing rooms and things like that.

296
00:33:04,390 --> 00:33:12,450
But a lot of times what employers will just do is say in the employee handbook, everything you do here on your computer is something that we'll monitor and you understand that.

297
00:33:12,450 --> 00:33:13,850
And that's basically it.

298
00:33:13,850 --> 00:33:18,110
So work is not a great place for privacy, generally.

299
00:33:18,110 --> 00:33:19,730
I'll take this question over here.

300
00:33:26,000 --> 00:33:28,620
Great question, because this brings me to my next point.

301
00:33:28,620 --> 00:33:31,220
And he's like, why is it not covered by the Fifth Amendment?

302
00:33:31,220 --> 00:33:36,900
So this is what I'm saying about can you be compelled to turn over your keys so that they can decrypt your stuff.

303
00:33:38,160 --> 00:33:46,000
And I hate to say this, because if this ever happens to one of my clients, I'm definitely going to argue that it's a Fifth Amendment violation.

304
00:33:46,020 --> 00:33:49,360
But I think the reason you would say it's not a Fifth Amendment violation is this.

305
00:33:49,720 --> 00:33:53,620
Fifth Amendment, you can't be compelled to testify against yourself.

306
00:33:53,620 --> 00:33:54,700
There's a couple things there.

307
00:33:54,700 --> 00:33:57,180
First of all, it has to be compelled.

308
00:33:57,420 --> 00:34:03,480
So the stuff you wrote that you encrypted that you don't want to turn over, no one compelled you to write that.

309
00:34:03,480 --> 00:34:04,780
You wrote that voluntarily.

310
00:34:04,780 --> 00:34:06,360
So there's no compulsion there.

311
00:34:06,360 --> 00:34:08,760
The compulsion, and they could search that.

312
00:34:08,760 --> 00:34:16,480
If they can get access to it without violating the Fourth Amendment, they can get it because it's not compelled testimony.

313
00:34:16,780 --> 00:34:18,040
What about the keys?

314
00:34:18,160 --> 00:34:20,740
You're being compelled to turn over the keys, right?

315
00:34:20,740 --> 00:34:26,980
But the Fifth Amendment has a second part, which is that what you're compelled to do is something testimonial.

316
00:34:26,980 --> 00:34:29,320
And there are a lot of cases about what's testimonial.

317
00:34:29,320 --> 00:34:34,240
And for example, cases say stuff like name, rank, and serial number are not testimonial.

318
00:34:34,240 --> 00:34:41,640
So if you are compelled to turn over your key, you're not being forced to say anything that's testimonial.

319
00:34:41,640 --> 00:34:47,140
All you're doing is giving them the access to the stuff you wrote which wasn't compelled.

320
00:34:47,140 --> 00:34:58,380
So the best argument that you have, I think, of why you can't turn the key over is there is something testimonial about the divulging of the key, something that is communicative.

321
00:34:58,380 --> 00:35:07,200
And what that is is that you're the person who encrypted it, that you're the person who has access, at the very least, to the information because you've got the key.

322
00:35:07,540 --> 00:35:19,380
And I think that the downside of that argument is that what a prosecutor would do if they really wanted the stuff is they would say, all right, you've got a Fifth Amendment right and I'm going to overcome it by giving you immunity.

323
00:35:19,380 --> 00:35:25,060
Fifth Amendment rights can be overcome by giving you immunity, which basically says we're not going to use that against you.

324
00:35:25,160 --> 00:35:30,220
But they don't have to say we're not going to use what we find against you, and they don't have to say we're not going to use the fact that you...

325
00:35:30,220 --> 00:35:34,120
What they say is we won't use the fact that you had the key against you.

326
00:35:34,120 --> 00:35:37,800
So you're divulging the key to the extent that it's testimonial.

327
00:35:37,800 --> 00:35:39,200
We're not using it against you.

328
00:35:39,200 --> 00:35:40,880
Now you have to give us the key.

329
00:35:41,080 --> 00:35:44,500
And so then I think you're in a lot of trouble with your Fifth Amendment argument.

330
00:36:01,810 --> 00:36:06,490
Okay, so he says, well, you know, but let's say it's somebody with whom you have a privilege, like your wife or something.

331
00:36:16,860 --> 00:36:22,580
Okay, so you don't have privilege in information you confide to another person, period.

332
00:36:22,580 --> 00:36:26,560
You tell me something, if I'm not your lawyer, they can ask me and I can be forced to tell.

333
00:36:26,560 --> 00:36:36,740
The reason why you have a privilege with people like your wife or your shrink or your doctor is because the law has picked out certain relationships that it wants to protect because it wants to encourage the free flow of communication.

334
00:36:36,740 --> 00:36:40,400
And it's got certain little enumerated categories that it falls in there.

335
00:36:40,400 --> 00:36:44,300
And the reason why it does that is because it's protecting that relationship.

336
00:36:44,320 --> 00:36:51,240
Now the spousal privilege, they're protecting it because they don't want to tear your marriage apart by forcing your spouse to testify against you.

337
00:36:51,240 --> 00:36:54,740
And they want to make sure that marital communications flow back and forth.

338
00:36:54,740 --> 00:37:03,720
But if I write a letter to my husband and it's in my house and they have a right to come search my house, like let's say they have a warrant and they find a letter to my husband, they can use it against me.

339
00:37:03,760 --> 00:37:13,520
Just like if you rob a bank and you tell your lawyer, you tell your lawyer I robbed a bank, that doesn't mean that they can't use that statement against you.

340
00:37:13,520 --> 00:37:16,900
It just means they can't make me testify that you told me that.

341
00:37:22,700 --> 00:37:30,360
Well then the question is, is decrypting a violation of privacy?

342
00:37:30,480 --> 00:37:43,860
And what I would say to that is, even if the law says that the fact that you encrypted it shows you have an expectation of privacy in the information, expectations of privacy can be overcome with warrants.

343
00:37:43,860 --> 00:37:57,420
If there is probable cause to believe that it's a crime, you may very well have an expectation of privacy, but it is a conditional right which is overcome with a warrant or if there's some exception to the warrant requirement.

344
00:37:57,420 --> 00:38:04,000
So just the mere fact that you encrypt it isn't going to give you any kind of absolute protection under either the Fourth Amendment or the Fifth Amendment.

345
00:38:04,380 --> 00:38:07,220
I'm going to take this gentleman in the back with the glasses.

346
00:38:21,810 --> 00:38:24,130
This is why I love speaking at DEF CON.

347
00:38:24,130 --> 00:38:27,510
I never get questions like this at Black Hat.

348
00:38:40,500 --> 00:38:44,110
So if I'm married to an android, can it be compelled to...

349
00:38:47,800 --> 00:38:49,340
That's a great question.

350
00:38:49,340 --> 00:39:03,250
I don't know whether the law would be willing to recognize a privilege between you and a machine even if the machine was serving the purpose that somebody who would otherwise fit under a privileged relationship with you would have.

351
00:39:03,620 --> 00:39:04,720
And that's the question.

352
00:39:04,720 --> 00:39:18,460
You would have to ask, is the law prepared to protect this person's relationship with the machine the same way that we would protect this person's relationship with a real wife or a real shrink or a real priest.

353
00:39:19,540 --> 00:39:28,640
I mean, I'd be speculating, but I'm going to guess maybe not.

354
00:39:28,640 --> 00:39:31,240
That's a great question.

355
00:39:32,180 --> 00:39:33,420
Wait, can I just... I'm sorry.

356
00:39:33,420 --> 00:39:35,260
I'm laughing at your question, but I actually...

357
00:39:35,260 --> 00:39:42,700
I'm laughing because it's a fun question, but it allows me to say something, which is that this is the way we deal with stuff exactly in the law, right?

358
00:39:42,720 --> 00:39:45,280
You've got computer technology that evolves.

359
00:39:45,360 --> 00:39:46,800
I mean, because it's a beautiful question.

360
00:39:46,800 --> 00:39:50,380
So you've got computer technology that evolves, and we have these old rules from way back.

361
00:39:50,380 --> 00:39:54,340
And now we've kind of got to decide, like, what are we going to do with these old rules in this new world?

362
00:39:54,340 --> 00:39:56,300
And so the law has trouble with this.

363
00:39:56,300 --> 00:39:58,120
Like, the law just doesn't... and the question is...

364
00:39:58,120 --> 00:40:02,020
What we try to do, really, is we try to go back to the reason why we had the law.

365
00:40:02,020 --> 00:40:04,260
I mean, in our best moments.

366
00:40:04,380 --> 00:40:11,500
We try to go back to the reason why the law existed in the first place and try to preserve those values now into the new world.

367
00:40:11,500 --> 00:40:25,840
Which is why I say we'd have to ask whether society or courts would be prepared to say that the interrelationship between me and digital psychiatrists is deserving of the kind of protection that the relationship between me and flesh-and-blood psychiatrists was.

368
00:40:25,840 --> 00:40:27,760
And if so, we're going to say yes.

369
00:40:27,760 --> 00:40:29,460
And if not, then we're going to say no.

370
00:40:29,460 --> 00:40:30,880
Similar question with bloggers.

371
00:40:30,880 --> 00:40:33,740
Do bloggers get the same kinds of rights as journalists?

372
00:40:33,740 --> 00:40:41,540
You know, we have all of these situations where we have new technology and we're looking to our old rights and privileges and saying, you know, how are these going to be in the new world?

373
00:40:41,540 --> 00:40:47,200
So I laughed at your question, but it is the fundamental question that I spend my whole life studying.

374
00:40:47,280 --> 00:40:51,720
Which is, what are we going to do with these old laws in this new context?

375
00:40:51,720 --> 00:40:57,680
So lest you think I was laughing at the question, I really just enjoyed your scenario.

376
00:40:58,180 --> 00:40:58,720
Yes.

377
00:41:13,370 --> 00:41:15,770
That's K-I-T-T-Y porn, right?

378
00:41:15,990 --> 00:41:17,090
Yeah, I thought so.

379
00:41:24,870 --> 00:41:26,750
It's very hypothetical.

380
00:41:54,250 --> 00:42:04,510
I mean, yes, what I would say is the stuff that you wrote down, that you then encrypted, the way the law would look at it is say, that's not compelled because you wrote it down voluntarily.

381
00:42:04,510 --> 00:42:16,490
And his question, I'm sorry, his question was basically, you know, is there a difference between saying, I'm compelled to testify, versus I'm compelled to give them something which lets testimony against me happen.

382
00:42:16,490 --> 00:42:28,490
And what I would say is that, yes, there is a difference, because the Fifth Amendment only applies to compelled testimony, and this is where they're compelling you to get something that's...

383
00:42:28,490 --> 00:42:33,350
or the testimony was not compelled, and they're compelling you to give something that's not...

384
00:42:33,350 --> 00:42:40,670
Okay, so testimony, or the thing you encrypted was not compelled, and they're just compelling you to give them something non-testimonial, which is the key.

385
00:42:40,670 --> 00:42:42,510
So I don't think that that would work.

386
00:42:55,290 --> 00:42:57,910
I'm not sure what your question is, but let's go for it.

387
00:42:58,010 --> 00:42:59,970
Let me just get through the rest of these slides, and then we'll go.

388
00:43:00,050 --> 00:43:01,210
I'm not saying you're compelled.

389
00:43:01,210 --> 00:43:06,430
I'm saying, let's say I write in my journal, I killed him, and then I encrypt it.

390
00:43:06,870 --> 00:43:09,790
When I wrote I killed him, I wasn't compelled to write it.

391
00:43:09,790 --> 00:43:11,150
Fifth Amendment doesn't apply.

392
00:43:11,150 --> 00:43:14,450
I encrypt it, and now I have to turn over my key.

393
00:43:14,470 --> 00:43:16,110
The key's not testimonial.

394
00:43:16,110 --> 00:43:17,970
They can compel me to turn it over.

395
00:43:17,970 --> 00:43:20,730
Then they get access to my non-compelled testimony.

396
00:43:20,750 --> 00:43:22,030
I'm the one who killed him.

397
00:43:22,230 --> 00:43:23,050
Boom, you're done.

398
00:43:24,230 --> 00:43:25,870
Okay, statute of limitations.

399
00:43:25,890 --> 00:43:39,010
Now, I put this in because I thought this would be a nice, easy question, because statute of limitations, if there's an answer, I should just put a big number up, which will be the number five, and that'll be great because, you know, so many of these questions are it-depends kind of complicated questions.

400
00:43:39,010 --> 00:43:52,450
But even the statute of limitations isn't clear, because while there's a five-year statute of limitations for computer crimes, there's another statute that allows courts to suspend the running of statutes of limitations when they're doing investigations that involve evidence in a foreign country.

401
00:43:52,690 --> 00:43:53,910
Statute of limitations.

402
00:44:04,360 --> 00:44:06,560
Is the content of the key testimony?

403
00:44:06,560 --> 00:44:07,140
No.

404
00:44:07,940 --> 00:44:08,580
Okay.

405
00:44:08,580 --> 00:44:09,640
Logs as evidence.

406
00:44:09,640 --> 00:44:11,100
So, a lot of people think...

407
00:44:11,640 --> 00:44:14,380
You had a question before, so I'm going to let you ask it.

408
00:44:19,190 --> 00:44:23,310
He asked me if there's a notification requirement for an extension of the statute of limitations.

409
00:44:23,310 --> 00:44:26,050
I think that's an excellent question, and I don't know the answer to that.

410
00:44:26,050 --> 00:44:28,730
So, I'm going to have to look that up, and I'm going to have to get back to you.

411
00:44:28,830 --> 00:44:32,670
So, will you email me, my email's on the thing, and make sure that I tell you?

412
00:44:32,670 --> 00:44:33,930
Because I don't know.

413
00:44:34,750 --> 00:44:35,310
Okay.

414
00:44:35,550 --> 00:44:36,590
Logs as evidence.

415
00:44:36,590 --> 00:44:50,030
So, a lot of people who are technological people feel that, you know, we know how malleable digital data is, and we feel like there's a very high standard, for admitting logs, computer logs, as evidence.

416
00:44:50,130 --> 00:44:52,970
And I think people are always surprised at the extremely...

417
00:44:52,970 --> 00:44:55,150
That was good, actually, by the way, that you stumped me.

418
00:44:55,150 --> 00:44:58,290
I think that there might be a prize in that for you.

419
00:44:59,910 --> 00:45:01,790
I was going to buy him a drink.

420
00:45:03,190 --> 00:45:11,830
A lot of people think that you have to, you know, that you have to show that it wasn't tampered with, and that you have to prove that it is exactly the right thing.

421
00:45:12,150 --> 00:45:14,810
Sort of, it's almost like the reverse is true.

422
00:45:14,810 --> 00:45:22,550
All you have to do to get computer logs admitted as evidence is just show that it is basically what you, as the proponent of the evidence, purport it is.

423
00:45:22,550 --> 00:45:24,210
Show that it's reliable enough.

424
00:45:24,210 --> 00:45:34,590
And what they do is they bring in the person whose computer it is, you know, who is the system administrator, and he says, yes, we have this computer set to log, and it logs in the regular, normal course of business.

425
00:45:34,590 --> 00:45:40,850
And these are the logs, and I pulled this off of the computer in the place where the log files are stored, and here it is.

426
00:45:40,850 --> 00:45:44,450
And it looks pretty much like what it was that I pulled off the computer.

427
00:45:44,450 --> 00:45:49,490
And at that point in time, the court will say, okay, I'm ready to admit it.

428
00:45:49,490 --> 00:45:51,910
And you can say, yeah, but I mean, he could have edited it.

429
00:45:51,910 --> 00:45:52,570
What was, you know...

430
00:45:52,570 --> 00:45:55,450
In fact, I've had logs that were edited, admitted.

431
00:45:55,450 --> 00:46:08,010
I've had logs where they basically cut out all of the extraneous data, leaving behind only the data that showed that it was my client who had been accessing their computer and said, you know, I just, to make it shorter for you, your honor, I just, you know,

432
00:46:08,010 --> 00:46:11,730
left in the important, relevant stuff, and I didn't put any of the other stuff in there.

433
00:46:11,730 --> 00:46:13,210
So, you know, here's your log.

434
00:46:13,210 --> 00:46:15,290
And I was like, you know, you can't do that.

435
00:46:15,290 --> 00:46:22,890
And the court was like, well, he says that this is accurate, and so, you know, I'm willing to believe it unless you can show me that it's not accurate.

436
00:46:22,970 --> 00:46:33,610
And what usually happens then is you try to show that it's not accurate, and the courts say, well, maybe there might be some question about it, but I'll let the evidence in, and then the trier of fact can decide what weight to give it.

437
00:46:33,610 --> 00:46:39,130
So computer logs have been something that courts have been very forgiving about, particularly in my experience.

438
00:46:43,270 --> 00:46:44,230
Okay.

439
00:46:44,590 --> 00:46:48,790
This is why I sort of wanted to rush to make sure that we had a little bit of time to talk to this stuff.

440
00:46:49,830 --> 00:46:59,830
So I think that probably everybody here is familiar with or has heard about the lawsuit that happened earlier this week after Mike Lynn's talk on Wednesday at Black Hat.

441
00:46:59,830 --> 00:47:06,810
And I was involved in that case, helping Mike with the aftermath of his talk.

442
00:47:06,850 --> 00:47:07,790
Thank you.

443
00:47:13,820 --> 00:47:25,780
You know, and while I was doing that, particularly when we were in the six-hour settlement conference with the nine attorneys from the other side trying to hash out a settlement agreement, I was thinking to myself, I can't believe I'm doing this.

444
00:47:25,780 --> 00:47:29,720
I'm in Vegas, and I've been up since six in the morning, and I'm working on this.

445
00:47:29,720 --> 00:47:32,020
And I thought to myself, you know, and I'm not even getting paid.

446
00:47:32,020 --> 00:47:35,500
And then I thought, but I'm really saving a lot of money by not gambling.

447
00:47:35,500 --> 00:47:38,740
So actually, I'm way ahead here.

448
00:47:38,740 --> 00:47:41,620
So I have Mike to thank, at least for that.

449
00:47:42,460 --> 00:47:55,980
But I think that one thing we haven't done a lot of talking about, and I know that there's been a lot of talking and rumors and all of that stuff, and I can't talk about the facts of the case or anything like that, and I don't want to take any questions on that,

450
00:47:55,980 --> 00:48:03,960
but I do want to talk a little bit about the law and how it was that they claimed that what he did was improper.

451
00:48:04,520 --> 00:48:09,780
So basically, this was a case that involved California's Trade Secret Act.

452
00:48:09,780 --> 00:48:15,000
And the Trade Secret Law prohibits the misappropriation of trade secrets.

453
00:48:15,080 --> 00:48:17,520
So what's a trade secret?

454
00:48:23,490 --> 00:48:27,070
All right, so this is awesome that you guys are here.

455
00:48:30,990 --> 00:48:34,110
We have, first of all, this is Mike's cape.

456
00:48:34,110 --> 00:48:37,970
We made him a superhero cape to go with his hat.

457
00:48:38,170 --> 00:48:43,110
And we're going to use it right now to let Jennifer change into her present that we got her.

458
00:48:43,990 --> 00:48:46,290
And Jennifer, she's doing such an awesome job.

459
00:48:46,290 --> 00:48:48,390
She can probably share this cape with Mike.

460
00:48:48,390 --> 00:48:49,950
She's just doing such an awesome job.

461
00:48:50,350 --> 00:48:51,150
Yeah!

462
00:48:58,310 --> 00:49:00,210
You guys look fabulous.

463
00:49:01,490 --> 00:49:02,470
All right, thank you.

464
00:49:02,470 --> 00:49:03,990
But I want that cape, though.

465
00:49:05,430 --> 00:49:07,210
Did you guys see the Incredibles?

466
00:49:07,510 --> 00:49:08,730
No capes.

467
00:49:12,610 --> 00:49:14,670
Oh, that's beautiful.

468
00:49:14,670 --> 00:49:15,930
I'll make sure he gets it.

469
00:49:16,770 --> 00:49:17,930
Thanks, you guys.

470
00:49:20,250 --> 00:49:21,390
Trade Secret Law.

471
00:49:21,390 --> 00:49:22,990
It's very serious business.

472
00:49:25,590 --> 00:49:30,830
So a trade secret is information that derives its value from the fact that it's not...

473
00:49:30,830 --> 00:49:32,710
All right, you guys are making me laugh.

474
00:49:33,950 --> 00:49:39,990
A trade secret law is information that derives its value from the fact that it's not generally known to the public.

475
00:49:40,090 --> 00:49:41,730
So that's thing number one.

476
00:49:41,730 --> 00:49:46,350
And so the first thing you have to ask yourself when you've got a trade secret case is, what's the secret?

477
00:49:46,350 --> 00:49:49,710
Is it the kind of thing that's protected by trade secret law?

478
00:49:49,710 --> 00:49:53,390
And then the second thing you ask yourself is, what's the misappropriation?

479
00:49:53,390 --> 00:49:56,550
So there's two possible claims here.

480
00:49:56,550 --> 00:50:07,910
One claim is that the information that he had about what the flaw was, was a trade secret to his employer, or rather I should say his ex-employer, ISS.

481
00:50:07,910 --> 00:50:10,350
The other possibility is that the case is about...

482
00:50:10,910 --> 00:50:15,290
that there's something about the Cisco code that remains a trade secret to Cisco.

483
00:50:15,290 --> 00:50:17,010
So... question.

484
00:50:24,500 --> 00:50:26,640
So his question is about whistleblower laws.

485
00:50:26,640 --> 00:50:30,840
So let me make sure that he's a researcher, but let me get to that.

486
00:50:30,840 --> 00:50:36,740
Because my second summer of law school, I worked at this whistleblower place in DC.

487
00:50:36,740 --> 00:50:38,420
So I know a bit about the whistleblower laws.

488
00:50:38,420 --> 00:50:46,120
But my particular whistleblower specialty is FIFRA, which is the Federal Insecticide, Fungicide, and Redenticide Act.

489
00:50:46,120 --> 00:50:50,280
And I did a white paper on the whistleblower provisions of FIFRA.

490
00:50:50,280 --> 00:51:00,180
So if anybody here has any rodenticide researcher issues, I think that I'm the person most qualified to respond to those.

491
00:51:01,040 --> 00:51:02,900
You laugh, but it's true.

492
00:51:03,760 --> 00:51:07,940
Okay, so then the question is, was it misappropriated?

493
00:51:08,060 --> 00:51:11,800
And so, what is misappropriation?

494
00:51:11,800 --> 00:51:21,580
Well, the statute says, specifically, that reverse engineering is a proper way of discovering something, even if it's a trade secret.

495
00:51:21,760 --> 00:51:25,860
And reverse engineering is specifically allowed under California law.

496
00:51:25,860 --> 00:51:29,880
And I have quoted here for you what the California law is about reverse engineering.

497
00:51:29,880 --> 00:51:35,200
And you can see, reverse engineering or independent derivation alone shall not be considered improper means.

498
00:51:35,200 --> 00:51:36,780
So that's an important thing, number one.

499
00:51:36,780 --> 00:51:43,920
But the other important thing about this statute is it does say that it's improper if you breach a duty to maintain secrecy.

500
00:51:43,920 --> 00:51:46,200
Okay, so we've got these two functional things here.

501
00:51:46,200 --> 00:51:48,920
One, is there a duty to maintain secrecy?

502
00:51:48,920 --> 00:51:53,340
And two, or was it independently derived?

503
00:51:54,300 --> 00:52:05,360
So, the issue in the case is basically, you know, what did he disclose and was it in violation of some duty to keep it secret or was it independently derived?

504
00:52:05,380 --> 00:52:14,060
So, a violation of a nondisclosure agreement, for example, a nondisclosure agreement with an employer, might be a trade secret violation.

505
00:52:14,060 --> 00:52:17,200
But that, if you read the complaint, wasn't part of the case.

506
00:52:17,200 --> 00:52:24,860
There wasn't a claim that he had disclosed something that was a secret and was proprietary to his employer.

507
00:52:24,860 --> 00:52:45,960
What the claim was, really, if you looked at the complaint, was that the machine code that he had disassembled from the Cisco binary was a trade secret as to Cisco and that he revealed that information to the public when he showed his slides at the presentation.

508
00:52:45,960 --> 00:52:55,780
And so, the question there, clearly, the statute clearly says, although, of course, they don't cite the statute in their papers very much, the statute clearly says reverse engineering is okay.

509
00:52:55,940 --> 00:52:59,040
Reverse engineering alone isn't improper.

510
00:52:59,040 --> 00:53:04,800
And they said, well, it's not reverse engineering alone, it's reverse engineering in violation of our EULA.

511
00:53:04,800 --> 00:53:17,560
Because when you get the Cisco, you know, when you get the Cisco router, our EULA says, and for those of you who don't know, it's the end user license agreement or terms of service for use of the machine, our EULA says no reverse engineering.

512
00:53:17,680 --> 00:53:20,520
So, now, EULAs have a lot of issues.

513
00:53:20,520 --> 00:53:27,080
And I think I've decided that next year for me is going to be EULA year and I'm going to be worrying a lot about EULAs.

514
00:53:27,160 --> 00:53:32,880
And one of the ways that people have always attacked EULAs has been on the issue of formation.

515
00:53:32,880 --> 00:53:43,460
Is it really a contract if you just slap some warning on your product and I never click I agree or, you know, have any kind of, you know, intention to enter into a contract with you.

516
00:53:43,460 --> 00:53:57,920
But I don't believe personally that attacking EULAs solely on the grounds that it's not really a contract because we never had this offer and acceptance meeting of the minds that's required for contracts to happen is a very fruitful process.

517
00:53:57,920 --> 00:54:11,860
I think that it's a dead end in the long run because we'll end up with things where they'll make you agree and most people will agree to something like no reverse engineering and those few people who do care to reverse engineer just simply won't be able to buy the product.

518
00:54:11,940 --> 00:54:14,820
But we can talk more about that in question and answer.

519
00:54:14,820 --> 00:54:26,460
I think the question that was really raised by the lawsuit in this case and the thing that made me super interested in it was the question of whether the violation of a promise in the EULA i.e.

520
00:54:26,600 --> 00:54:33,080
a promise not to reverse engineer is a violation of the trade secret law.

521
00:54:33,080 --> 00:54:46,420
Something beyond simply having reverse engineered and independently derived it the violation of some kind of promise that makes something that ordinarily might just be a contract breach a crime.

522
00:54:46,420 --> 00:54:49,460
Or at the very least something that imposes civil liability.

523
00:54:49,460 --> 00:55:01,780
And as you may have guessed from my comment before about the website terms of service and employment contracts and that sort of thing it really makes me mad when suddenly breaches of contracts are crimes.

524
00:55:01,780 --> 00:55:05,060
It's just not something that used to be true in the law at all.

525
00:55:05,060 --> 00:55:15,100
In fact, breaches of contracts are things for which you can't even get punitive damages usually because the law likes to see people breach contracts when it's economically efficient.

526
00:55:15,100 --> 00:55:21,020
So if I have a contract with you, but I can make more money with somebody else I'm allowed to breach the contract with you.

527
00:55:21,020 --> 00:55:30,600
I pay you what you expected to get and I get to reap the profit of the fact that I got to enter into a contract with somebody else and the law is happy.

528
00:55:30,600 --> 00:55:34,400
There's no moral opprobrium that attaches to breaches of contracts.

529
00:55:34,400 --> 00:55:38,620
So it really bothers me to see these kinds of things made criminal.

530
00:55:38,720 --> 00:55:50,620
And I think that one of the things sort of in the bigger picture that the case raised is this question of is there a limit to the enforceability of EULAs and can EULAs be the grounds for these sorts of other kinds of offenses.

531
00:55:50,620 --> 00:55:52,520
I have a question from this gentleman here.

532
00:55:58,640 --> 00:56:04,440
So the question is if the information is discoverable by reverse engineering is it a trade secret and the answer to that is no.

533
00:56:04,520 --> 00:56:08,260
Because first you did not obtain it by improper means.

534
00:56:08,440 --> 00:56:09,600
You discovered it.

535
00:56:10,020 --> 00:56:11,640
No longer a secret.

536
00:56:11,680 --> 00:56:13,160
So it's no longer a trade secret.

537
00:56:13,160 --> 00:56:15,660
So the answer is basically no.

538
00:56:15,660 --> 00:56:17,260
There's a question from this gentleman in the green.

539
00:56:26,490 --> 00:56:29,530
We don't have a decision in Blizzard yet, right?

540
00:56:29,590 --> 00:56:32,990
Okay,

541
00:56:38,010 --> 00:56:40,030
so I will answer your question.

542
00:56:40,030 --> 00:56:51,590
So Blizzard versus BnetD is a case that involves a manufacturer of one of these multiplayer games and some people who reverse engineered that game and built their own server on which people could play the games compatibly.

543
00:56:51,650 --> 00:56:58,990
And the case is now on appeal, which is why I said there wasn't a decision, but this gentleman is right that there was a decision from the trial court below.

544
00:56:58,990 --> 00:57:08,310
And what the trial court below said was that if you have a user agreement that says no reverse engineering, then those terms are enforceable.

545
00:57:08,310 --> 00:57:10,170
There's another case that says the same thing.

546
00:57:10,170 --> 00:57:11,970
It's Bowers versus Baystate.

547
00:57:11,970 --> 00:57:16,150
And that case also says terms in EULAs are enforceable.

548
00:57:16,150 --> 00:57:20,430
And the EULA picture is this, to kind of give you the big picture of where we're at.

549
00:57:22,150 --> 00:57:25,090
So contracts require offer and acceptance.

550
00:57:25,090 --> 00:57:28,950
This really was one of my favorite classes in law school because it's so beautiful if you think about it.

551
00:57:28,950 --> 00:57:34,010
There's an offer, there's acceptance, there's mutual consideration, there's this meeting of the minds.

552
00:57:34,010 --> 00:57:35,410
It's very romantic.

553
00:57:35,410 --> 00:57:40,830
But those things are required, right?

554
00:57:40,830 --> 00:57:49,270
So a lot of cases that involve things like click wrap or browse wrap, we have cases that say if there's not actually an offer and acceptance, then it's not a contract.

555
00:57:49,270 --> 00:57:57,910
So if it's just something that says legal at the bottom and you don't have to click on it or agree or anything, then it's not a contract and you're not bound by those terms.

556
00:57:58,110 --> 00:58:04,490
And there's other situations where you don't have notice or something like that, or maybe you do have notice and you continue to use the site.

557
00:58:04,490 --> 00:58:06,890
So the question is, is there agreement to the terms?

558
00:58:06,890 --> 00:58:09,470
And those are things I would call formation issues.

559
00:58:09,470 --> 00:58:11,050
Was there a meeting of the minds?

560
00:58:11,050 --> 00:58:18,270
Did the person know what the terms were and manifest their assent, either through clicking OK or for using it or something like that?

561
00:58:18,270 --> 00:58:19,770
So formation issues.

562
00:58:19,870 --> 00:58:29,970
If there's formation, there's offer and there's acceptance, either through actual clicking OK or through notice and continued use, then you're into the question of whether the terms are enforceable.

563
00:58:29,970 --> 00:58:38,430
And my fear is if you have every term be enforceable no matter what, you can have EULAs that say, no talking nasty about this product.

564
00:58:38,450 --> 00:58:42,510
And maybe 95% of the people in the world don't want to talk nasty about the product.

565
00:58:42,510 --> 00:58:44,090
They just want to buy it and use it.

566
00:58:44,090 --> 00:58:46,150
And so most of us will just agree.

567
00:58:46,150 --> 00:58:51,350
And those people who do want to talk nasty about the product, the company doesn't need to sell to them.

568
00:58:51,430 --> 00:58:55,050
And so they'll never be able to buy it.

569
00:58:55,050 --> 00:58:56,210
They won't sell it to them.

570
00:58:56,210 --> 00:59:01,630
And they won't buy it and they won't have access to the product, so they won't be able to test it or benchmark it or anything.

571
00:59:01,630 --> 00:59:07,170
And all the rest of us will be happily using the product and no one will be allowed to tell us that the product stinks.

572
00:59:07,530 --> 00:59:19,890
So, you know, when I say that I think next year will be EULA year, the thing that I'm really concerned about is, are there limitations to the terms that will be enforceable in EULAs when you have a situation where the term is contrary to public policy?

573
00:59:20,130 --> 00:59:27,990
Individually it might not be a big deal, but in aggregate it deprives the public of the right to know something or the right to do something that has great public benefit.

574
00:59:27,990 --> 00:59:29,550
A question right here.

575
01:00:01,840 --> 01:00:05,660
Okay, so his question is, you know, how far does the contract extend?

576
01:00:05,660 --> 01:00:18,560
So if I buy it with, you know, if I buy somebody's product, maybe I agree to the EULA, but when I sell it to somebody else and the software is already installed and everything, you know, those people, the second, you know, the second purchaser hasn't agreed to the contract,

577
01:00:18,560 --> 01:00:21,780
so maybe the second purchaser isn't bound by it at all.

578
01:00:21,780 --> 01:00:24,380
And I think that, you know, in some ways that's a good argument.

579
01:00:24,380 --> 01:00:34,740
I actually, I'm not 100% sure of that question, but I think that, you know, you could make me agree to terms of contract simply by selling something to me without my also having notice.

580
01:00:35,040 --> 01:00:36,900
So I think that that may be sort of a break.

581
01:00:36,900 --> 01:00:48,900
And, you know, if I were going to buy your machine with your ancient copy of Microsoft Windows on it and continue to use it without reinstalling or anything, maybe I wouldn't be bound by that, by those terms.

582
01:00:48,900 --> 01:01:03,300
But if I, let's say then I decided that I was going to criticize Microsoft's product or something, and they wrote to me and they said, hey, we hear you're criticizing us, and that's contrary to our EULA, you can't either stop criticizing us or stop using our product,

583
01:01:03,300 --> 01:01:04,580
then I'm on notice.

584
01:01:04,580 --> 01:01:11,380
And what a lot of the cases say is that notice plus continued use will bind me to the terms of the contract.

585
01:01:11,380 --> 01:01:15,340
So, you know, it hasn't always been a great defense.

586
01:01:15,340 --> 01:01:22,320
Well, I don't know about the terms or I've never agreed because they managed to get you when they do the, we're going to get to see the food again.

587
01:01:31,810 --> 01:01:32,530
Right.

588
01:01:33,450 --> 01:01:44,450
So this gentleman's point is, well, at that point, you know, you didn't break the contract, so you could just stop using it and continue to be free to say or do whatever you want at that point, and I think that that probably would be right.

589
01:01:44,730 --> 01:01:45,330
Yes.

590
01:01:52,230 --> 01:02:01,990
So his question is, what if I spent a lot of money on it and either they tell me to stop using it or, you know, then I learn that the terms of service are something that I don't like.

591
01:02:01,990 --> 01:02:07,490
And there was a class action suit in California on this issue because of shrink wrap.

592
01:02:07,490 --> 01:02:14,150
So people buy software, they take it home, they open the box, they see these restrictive license terms, they don't want the software anymore.

593
01:02:14,150 --> 01:02:17,910
So they take it back to Best Buy, and Best Buy's like, we don't take your open software.

594
01:02:17,990 --> 01:02:23,370
So then they try to return it to the vendor, and the vendor said, we don't take your open, you know, we're not taking that back either.

595
01:02:23,850 --> 01:02:25,050
And so what do you do?

596
01:02:25,050 --> 01:02:36,170
So there was a class action suit in California, which said basically, you know, if you're going to do this, if you're going to have your terms of service on the inside of the box, or if you're going to have your terms of service pop up only when you install,

597
01:02:36,170 --> 01:02:39,130
you've got to let people take it back and get their money back.

598
01:02:39,130 --> 01:02:44,810
So practically, that never happens, but legally it's supposed to happen.

599
01:02:45,090 --> 01:02:46,850
All right, some other questions?

600
01:02:46,850 --> 01:02:50,110
I can take a few more questions because the people who are coming after us are late.

601
01:02:50,110 --> 01:02:53,050
So let's go for like three more minutes if anybody has other questions about this.

602
01:02:53,050 --> 01:02:54,390
Let me just do my last slide.

603
01:02:54,390 --> 01:02:55,570
So when to talk to a lawyer.

604
01:02:55,570 --> 01:02:57,430
So as you can see, this is really complicated.

605
01:02:57,430 --> 01:03:05,670
And so, you know, you sort of almost always need to talk to a lawyer, unfortunately, which is too bad for you guys, but great for lawyers.

606
01:03:06,930 --> 01:03:21,650
You know, the law is really complicated, and if you feel like, I definitely know, I'm doing something that I thought was kind of maybe risky, but now I definitely know that it's either illegal or illegal, then you definitely need to talk to a lawyer because if you think that the answers are really clear,

607
01:03:21,650 --> 01:03:23,670
then you're not getting it at all.

608
01:03:23,670 --> 01:03:33,350
If you think that the answer is, it depends, and I kind of know what it depends upon, but maybe it depends on more things too, and I might need to get a little more advice on this, then you're in good shape.

609
01:03:33,370 --> 01:03:36,650
So that's the sort of finale of my talk.

610
01:03:36,650 --> 01:03:38,890
And I'll take a couple more questions if there are some.

611
01:03:38,890 --> 01:03:40,290
I'll take one here.

612
01:03:47,900 --> 01:03:50,820
Is reading the machine code reverse engineering?

613
01:03:51,520 --> 01:03:59,300
I think here it was, I think here we agreed it was reverse engineering because he decompiled it from the binary.

614
01:03:59,380 --> 01:04:06,740
But if you've got machine code, reading it is, I mean, reverse engineering, the courts have looked at reverse engineering as being a lot of things.

615
01:04:06,740 --> 01:04:14,520
Testing, you know, trying to watch processes and replicate, decompiling.

616
01:04:14,520 --> 01:04:22,480
So a lot of things are reverse engineering, but I mean, either it's legal because you're reading something that's already written or you're reverse engineering.

617
01:04:50,080 --> 01:04:58,700
So what he's saying, what his comment is that he doesn't think machine code is either secret or is reverse engineering.

618
01:04:58,700 --> 01:05:01,280
And I think there's a good argument for that.

619
01:05:15,140 --> 01:05:22,840
The beer is not here yet, so you have to, so I'm going to, which is a tragedy, so I'm going to take a few more questions if people have other questions.

620
01:05:22,840 --> 01:05:24,180
This gentleman in the back.

621
01:05:30,090 --> 01:05:36,310
But for those of you, I'm going to try to take questions still, so you guys have to be kind of quiet because I can't hear what he's saying.

622
01:05:43,580 --> 01:05:47,380
So the question is, do I think Cisco got what they wanted out of the case?

623
01:05:48,480 --> 01:05:56,580
I'm, you know, I'm not a researcher , so I may be a little more compassionate to most of the players in this than other people are.

624
01:05:56,580 --> 01:05:59,740
I think Cisco definitely didn't get what they wanted out of this case.

625
01:05:59,740 --> 01:06:05,240
I mean, I can tell you what their point, what they thought they were doing was.

626
01:06:05,240 --> 01:06:25,120
And in the settlement agreement that we entered into to settle the civil case, Cisco and ISS insisted that the settlement agreement say that Cisco and ISS were working together on a presentation that would have revealed the problem without revealing stuff that they felt was trade secret information.

627
01:06:25,120 --> 01:06:30,420
Now , I have no information personally whether or not that was true, because I came into the whole thing, you know, after that.

628
01:06:30,420 --> 01:06:45,660
But I think that what Cisco, if you asked them, and I'm not them, but to try to be fair to them, I think what they would have said is that they really had certain things that they definitely didn't want, which was the code and the pointers, and that they ended up getting exactly,

629
01:06:45,660 --> 01:06:59,560
totally not what they wanted in all of this, because all of that came out, and they look bad, and they had to pay lawyers, and they had to pay to have the materials taken out of the presentation stuff, and they had to pay to get rid of the CDs and make new CDs.

630
01:06:59,560 --> 01:07:06,020
So they have had a really bad week, in addition to the rest of us having a really bad week, too.

631
01:07:06,380 --> 01:07:10,560
I know it was tough, but I got a cape out of it, so...

632
01:07:30,260 --> 01:07:37,700
So the question is, our click wrap and shrink wrap aren't really meeting of the minds, because it's kind of a take it or leave it thing.

633
01:07:37,700 --> 01:07:41,820
Can you modify the terms ahead of time and then click accept?

634
01:07:47,720 --> 01:07:48,160
And...

635
01:07:48,160 --> 01:07:49,760
Is he calling me?

636
01:07:50,820 --> 01:07:52,920
So the question is, can I modify the terms?

637
01:07:52,920 --> 01:07:56,160
And the answer is no, because then you don't have a meeting of minds on the other end.

638
01:07:57,140 --> 01:08:03,120
So I'm told that I should answer this phone call, which I'm going to do, since we're on overtime.

639
01:08:08,420 --> 01:08:10,040
A call-in question.

640
01:08:10,040 --> 01:08:11,920
Okay, I'll take a call-in question.

641
01:08:12,420 --> 01:08:15,120
Let's see if I can do it through the...

642
01:08:15,120 --> 01:08:17,500
Let's see if you can do it through the microphone.

643
01:08:17,500 --> 01:08:18,060
Ready?

644
01:08:21,430 --> 01:08:22,870
No, it doesn't play.

645
01:08:23,210 --> 01:08:23,730
Okay

646
01:08:29,990 --> 01:08:33,390
, it was a personal question, which I don't answer.

647
01:08:35,790 --> 01:08:40,770
Does anybody have an appropriate professional, non-personal question?

648
01:09:03,610 --> 01:09:08,970
So, the question was about the encryption issue and the forced disclosure.

649
01:09:08,970 --> 01:09:10,650
And I'm not a...

650
01:09:10,650 --> 01:09:16,750
I'm not familiar with these cases that you're referring to where journalists have been forced to turn over encryption keys.

651
01:09:16,750 --> 01:09:21,670
The difference there might be that we're not talking about something that is incriminating.

652
01:09:21,670 --> 01:09:23,510
I mean, that might be one difference.

653
01:09:23,510 --> 01:09:29,250
Then you also have another difference, which is you've got this journalist thing, which brings in all this free press type of issues as well.

654
01:09:29,250 --> 01:09:38,730
But I think the fundamental thing is that the Fifth Amendment applies very... I mean, the arguments for the Fifth Amendment application to compulsory key turning over, I think, are weak.

655
01:09:38,730 --> 01:09:40,450
Though I hate to say it.

656
01:09:41,430 --> 01:09:44,780
All right.

657
01:09:44,780 --> 01:09:46,300
Do you want me to keep going?

658
01:09:48,000 --> 01:09:48,640
All right.

659
01:09:49,140 --> 01:09:50,100
Other questions?

660
01:09:53,730 --> 01:09:54,230
All right.

661
01:09:54,230 --> 01:09:58,670
So, there's no other questions, so I'm not going to keep going, but as you can see, we have the next thing that's happening.

662
01:09:58,670 --> 01:09:59,690
Do you want to say something?

663
01:10:00,230 --> 01:10:00,870
Okay.

664
01:10:02,670 --> 01:10:03,270
I could tell...

665
01:10:05,570 --> 01:10:06,150
All right.

666
01:10:06,150 --> 01:10:07,170
So, you guys...

667
01:10:07,170 --> 01:10:07,690
Let's see.

668
01:10:07,690 --> 01:10:09,090
Do you guys want to hear a story?

669
01:10:09,850 --> 01:10:10,570
All right.

670
01:10:12,710 --> 01:10:13,190
Okay.

671
01:10:13,190 --> 01:10:20,050
I'm going to tell you guys a story about the first time I tried to help somebody who got arrested at DEF CON.

672
01:10:21,850 --> 01:10:25,590
This was back in 1999 when...

673
01:10:25,590 --> 01:10:25,850
Okay.

674
01:10:25,850 --> 01:10:26,290
I'm not sure.

675
01:10:26,290 --> 01:10:27,650
I don't remember what year it is.

676
01:10:28,990 --> 01:10:29,390
But...

677
01:10:30,370 --> 01:10:31,330
I don't know.

678
01:10:31,330 --> 01:10:32,870
This isn't my laptop.

679
01:10:33,170 --> 01:10:34,570
So, I'm just going to...

680
01:10:35,050 --> 01:10:35,850
Okay.

681
01:10:37,190 --> 01:10:37,590
So...

682
01:10:38,270 --> 01:10:40,070
Actually, this is a really long story.

683
01:10:40,070 --> 01:10:42,090
I'll tell you a story.

684
01:10:42,090 --> 01:10:42,330
Yeah.

685
01:10:42,330 --> 01:10:42,570
Okay.

686
01:10:42,570 --> 01:10:43,250
I'll tell the story.

687
01:10:43,250 --> 01:10:49,370
So, it was the year that DEF CON was at that Plaza Hotel that was downtown.

688
01:10:49,730 --> 01:10:50,870
And I was...

689
01:10:50,870 --> 01:10:51,890
What year was that?

690
01:10:54,590 --> 01:10:55,390
97?

691
01:10:56,610 --> 01:10:57,410
96?

692
01:10:58,290 --> 01:10:58,950
No.

693
01:10:59,030 --> 01:10:59,470
No.

694
01:10:59,470 --> 01:11:01,130
It was 98, I think.

695
01:11:01,190 --> 01:11:02,290
And maybe it was 98.

696
01:11:02,290 --> 01:11:04,030
Anyway, that's a great place, by the way.

697
01:11:04,030 --> 01:11:10,670
They have penny slots, which are super cool because when you're just like totally down and out and you still need to gamble, you can go to the penny slots.

698
01:11:10,730 --> 01:11:12,230
And I was about to leave.

699
01:11:12,230 --> 01:11:15,170
Like, I just had my foot on the little shuttle van step.

700
01:11:15,170 --> 01:11:16,390
And I remember this very clearly.

701
01:11:16,390 --> 01:11:22,250
Sort of looking down and seeing my foot on the step when suddenly a crowd of people come running out of the hotel.

702
01:11:22,250 --> 01:11:23,450
And they're like, wait, wait.

703
01:11:23,450 --> 01:11:25,690
Don't let the lawyer get on that van.

704
01:11:26,190 --> 01:11:27,730
Phony's been arrested.

705
01:11:27,870 --> 01:11:32,230
And I remember looking at my foot and thinking, I'm going to miss my plane.

706
01:11:32,270 --> 01:11:39,830
So, I get dragged off the little shuttle van and I'm told that this guy by the name of Phony, and I don't know, do any of you guys here know Phony?

707
01:11:39,910 --> 01:11:40,490
Who knows Phony?

708
01:11:40,490 --> 01:11:41,270
Yeah, there you go.

709
01:11:41,270 --> 01:11:43,170
Well, you probably know the end of this story.

710
01:11:43,310 --> 01:11:46,190
So, they told me that this guy named Phony had been arrested.

711
01:11:46,470 --> 01:11:56,150
That, you know, it's the last day of DEF CON and he was about to leave and some cop came onto the floor of the show, took him away in handcuffs, hustled him off into some van and we don't know where he went.

712
01:11:56,150 --> 01:11:57,490
So, now, what are we going to do?

713
01:11:58,450 --> 01:12:05,970
So, I said, well, let's go try to find where he is and see what he was charged with and we'll see what we can do.

714
01:12:05,970 --> 01:12:07,470
So, they say, okay, great.

715
01:12:07,470 --> 01:12:09,670
And everybody's got, like, radio headsets on.

716
01:12:09,670 --> 01:12:11,870
So, I hear them say, we've procured the lawyer.

717
01:12:11,870 --> 01:12:13,210
Bring around the vans.

718
01:12:14,750 --> 01:12:23,830
So, then two big black vans roll up and the door slides open and there's a bunch of hackers in there, all in black, all with the headsets.

719
01:12:24,010 --> 01:12:30,750
And Emmanuel Goldstein's in there and he's got a giant video camera and they hustle me into the van and we're all, like, off.

720
01:12:30,750 --> 01:12:35,150
And I say, okay, we need to find where the jail is.

721
01:12:35,210 --> 01:12:40,290
So, somebody's got the GPS thing and it's, like, 98 or whatever, so this is pretty early.

722
01:12:40,290 --> 01:12:46,530
And they've got the map and they're, like, finding where the jail is and they're calling back to the hotel and stuff and it's, like, okay, we've procured the location of the jail.

723
01:12:46,530 --> 01:12:55,130
So, we get there and we, like, get to the jail and we're, like, stop in front of the jail and the doors to both the vans slide open and everybody's ready to jump out and, like, converge on the jail.

724
01:12:55,130 --> 01:12:56,590
And I'm, like, no, no, no, no, no, no.

725
01:12:56,590 --> 01:12:59,750
This is totally not going to work, okay?

726
01:12:59,750 --> 01:13:04,810
And they're , like, one person can come to the jail with me, but you can't all come in.

727
01:13:04,950 --> 01:13:15,710
So, they're, like, take a little vote and everything and everybody's okay and Emmanuel's, like, filming everybody because he's got this documentary he's doing about how hackers help each other and aren't criminals and stuff like that, which is totally true and great.

728
01:13:15,710 --> 01:13:19,330
Although, you know, it's a little nerve-wracking to have this big camera in your face.

729
01:13:19,330 --> 01:13:26,150
So, I say, okay, so they pick who's going to come in with me and I say, okay, now there's one other thing I need to know.

730
01:13:26,310 --> 01:13:28,090
What's Phony's real name?

731
01:13:32,460 --> 01:13:37,760
And, no, they're just, like, can I say what Phony's real name is or should I make up a name?

732
01:13:38,660 --> 01:13:47,020
Okay, so, they're, like, they're, like, they're, like, it's Jeff.

733
01:13:47,460 --> 01:13:49,260
Okay, Jeff what?

734
01:13:49,800 --> 01:13:51,120
No one knows.

735
01:13:51,380 --> 01:14:02,460
So, lots of frantic phone calls back to the hotel to try to find out what Phony's real name is and, um, after about ten minutes, we finally find somebody who knows his name and tells me.

736
01:14:02,460 --> 01:14:03,340
And I'm, like, okay.

737
01:14:03,420 --> 01:14:04,780
And I go into the jail.

738
01:14:05,020 --> 01:14:11,040
So, I get to the jail and we go up to the, you know, the booking guy and he's, like, you know, what's up?

739
01:14:11,040 --> 01:14:12,060
And I say, hi, I'm a lawyer.

740
01:14:12,060 --> 01:14:13,460
My client just got arrested.

741
01:14:13,460 --> 01:14:16,400
I'm wondering if he's here and, you know, what's going on?

742
01:14:16,400 --> 01:14:19,800
And the guy takes a, you know, sort of says, well, I don't know if he's here.

743
01:14:19,800 --> 01:14:20,320
What's his name?

744
01:14:20,320 --> 01:14:31,700
I give him the name and he types it into his computer and he said, well, he's not on my computer yet but if he just got arrested, you know, it takes a couple of hours to go through booking, he might be here and I just don't have him in the computer yet.

745
01:14:31,700 --> 01:14:34,140
I can go check in the holding cell and see if he's there.

746
01:14:34,140 --> 01:14:35,280
What does he look like?

747
01:14:35,280 --> 01:14:37,160
So, I don't actually know what he looks like.

748
01:14:37,160 --> 01:14:38,360
So, I'm, like, what does he look like?

749
01:14:38,360 --> 01:14:38,800
I don't know.

750
01:14:38,800 --> 01:14:51,020
So, the guy who I'm with runs out to the van and he comes back with somebody's digital camera that's got the picture of Phony and he shows the picture and he's got green hair and a blue pentagram dyed into the back of his head.

751
01:14:53,200 --> 01:14:57,220
So, I show it to the sheriff and I go, you can't miss him.

752
01:15:00,100 --> 01:15:03,440
So, the sheriff's like, we do not have that guy here.

753
01:15:03,440 --> 01:15:05,760
I would definitely know he's not here.

754
01:15:05,920 --> 01:15:10,360
So, I'm like, okay, he's not here and he says, well, maybe there's another jail across town maybe he's over there.

755
01:15:10,360 --> 01:15:23,640
So, we all pile back into the van and we've got the whole, you know, GPS thing with where the new jail is and stuff and we're hustling off there and on the way, suddenly, we get a call over the radio and the call is like, abort, abort the mission, return to base.

756
01:15:23,960 --> 01:15:26,260
So, we're like, huh, that's weird, okay.

757
01:15:26,260 --> 01:15:29,900
So, you know, I think we've been to like two jails by this time and we're like, okay, we'll return to base.

758
01:15:29,900 --> 01:15:34,560
So, we return back to the hotel and we're like, you know, we don't know what happened.

759
01:15:34,580 --> 01:15:36,040
So, everybody's like, what's going on?

760
01:15:36,040 --> 01:15:36,460
I don't know.

761
01:15:36,460 --> 01:15:45,480
And sort of like, we walk into the hotel and we sort of go our own separate ways and I'm like, you know, wondering how I'm going to get home now because I've missed my flight by quite a bit.

762
01:15:45,680 --> 01:15:49,920
And Pete Shipley comes up to me and he says, can I talk to you?

763
01:15:49,920 --> 01:15:50,900
And I'm like, okay.

764
01:15:50,900 --> 01:15:56,440
And we go over and he takes me aside and he's like, I'm really sorry, but it was all a hoax .

765
01:15:56,840 --> 01:15:58,840
That was Phony's cousin.

766
01:15:59,080 --> 01:16:11,260
And his cousin's a cop here in town and he thought it would be really cool if he thought it would be totally cool if instead of just leaving the con, he was dragged off in handcuffs.

767
01:16:11,540 --> 01:16:18,660
And he called me from the airport and I was like, that's so weird, that's Phony's number, how's he calling me?

768
01:16:18,660 --> 01:16:20,280
And I said, what are you doing?

769
01:16:20,280 --> 01:16:22,440
And he's like, yeah, dude, wasn't that cool?

770
01:16:24,100 --> 01:16:29,240
And Pete's like, we dragged Granica off of her airplane for you.

771
01:16:29,240 --> 01:16:31,620
And now she can't fly home.

772
01:16:32,180 --> 01:16:38,540
So Phony, who's a gentleman , paid for me to fly back to San Francisco first class, which I really appreciated.

773
01:16:38,540 --> 01:16:48,480
And then later in honor of my efforts, put me in a movie where I got to co -star with Mark Pauline as a evil naval officer in a movie that he was doing.

774
01:16:48,480 --> 01:16:50,760
So he and I ended up being on very good terms.

775
01:16:50,760 --> 01:16:58,380
But that was the very first time that I helped somebody who had been arrested at DEFCON and you wonder why I come back to take this abuse again year after year.

776
01:16:58,380 --> 01:17:02,180
But I just want to thank you guys for...

777
01:17:10,780 --> 01:17:15,480
I just want to thank you guys for making my life so fun and have a good rest of your evening.