Thank you all so much for coming here to hear my speech at 8 o'clock on a Saturday night.
I'm not sure why I got... how I managed to pull this particular time slot.
This is a time when people would rather be breaking the law than learning about the law.
But I'll do my best to try to keep it interesting and also maybe try to keep it short
and maybe we can have something like a conversation following this.
So, for those of you who don't know me, my name is Jennifer Granick
and I am the Executive Director of the Center for Internet and Society,
which is a public interest internet law program at Stanford Law School.
And as part of our program, we have conferences, speakers,
things to study the interaction of civil liberties, the public interest in computer technology.
And I also teach a class there, which is a practical course for law students
which is called the Cyber Law Clinic.
And we take cases and provide people with pro bono legal services
and students get to work on the cases and learn how to be lawyers
and I get to work on issues that I think are important and interesting.
So, I am a teacher but also a litigator in that capacity.
I came to this job from my background as being a criminal defense attorney,
which I can tell you has been an extremely useful background this week.
And we may get a chance to talk about that a little bit while I am up here.
Okay, so my conception for this talk was that I wanted to actually have a really large audience
and I thought, how else do you have a large audience other than to survey everybody
and find out what questions they are interested in and then answer those questions.
So I took an extremely informal survey that my father would think is completely statistically inaccurate
and I came up with the following questions.
And there we have some of them.
I came up with about ten questions that I thought that people would be interested in.
And for those of you who responded to my survey, thank you very much.
I swapped out one of the old questions to give us question number nine
because I think that there is a lot of interesting things to say about that from a legal standpoint.
And the thing about it, the thing about the whole issue that interested me from a legal standpoint
and I will give you some idea of my sense about what the law is behind all of that.
So these are the ten questions that I'm going to be answering.
And I think since we have, I see some more people coming,
but I think when I did a similar kind of format at Black Hat,
I asked for people to keep questions until the end.
But I think here, since it's kind of a small group, I think I can manage to take questions during.
I just don't want to get bogged down on one question and not get to the point where,
not get to the point where we get to kind of get through all of the questions.
So if you have questions that are relevant to something I'm talking about at the time,
please just raise your hand and I'll see if I want to call on you.
I see somebody there with a trademark infringing Newsweek shirt,
which I'm going to tell my husband about since he works there.
It's a parody, yeah. Okay, well then you're cool, man, you're cool.
Alright, so when you're trying to cover ten legal questions,
the thing I want to make pretty clear here is that I'm going to try to give you
at a very high level some legal information.
This isn't legal advice and it's not a substitute for talking either, you know,
specifically with a lawyer about your specific situation.
But I think one of the things that's wrong with the law, and especially the law in this area,
is that it's so complicated that it's hard to kind of get a sense of, like, what the deal is.
And of course every time you ask a lawyer what the deal is, the lawyer will always answer,
I mean, if they're giving you the truthful answer, the answer is always, well, it depends.
And it depends isn't really all that helpful, I can't, but it's always the right answer.
So I'm not going to give you an answer that's any different from it depends,
I'm just going to try to give you some sense of what factors it depends upon,
and then, you know, hopefully that gives you a sense of what matters in all of these issues.
Okay, so as you know from reading my questions, the first question that people asked was about wireless.
And why did I think that wireless would be an interesting thing to talk about?
Well, for those of you who are readers of the internet,
you know that there was very recently a case in Florida where a Florida man was arrested for using wireless networks.
And he was charged with a crime under the Florida law.
So people wonder, is it a crime to use open wireless networks?
Because if so, I think probably there's a lot of people here in the audience, myself included,
who have been committing some crimes.
No one else needs to confess, I'll do the confessing for us.
I think the important thing about wireless is that when people say,
well, I'm using a wireless network, there's a couple of different things you could mean,
and different laws are going to apply to these different activities.
So depending on what you're doing, we can see which laws might apply.
The Florida case is a relatively rare situation.
I personally am only aware of two other instances in which people have been charged with accessing a wireless network.
One is a case that I was involved in in California, which later morphed into a case about something else,
and the wireless was no longer an issue.
And the other was a federal prosecution of a man named Stephan Puffer in Houston,
and he was acquitted following a jury trial.
So those are the only other two instances I'm aware of in which somebody was prosecuted for wireless.
So let's take the more easy instances first and see what laws might apply.
First, accessing stored files through the network.
So the law that applies to protecting stored files is the Electronic Communications Privacy Act,
and I put the text of the statute up here for you,
but I want to take a moment to touch on, or to really kind of talk about,
the two operative concepts that are the basis for this law,
and also for the Computer Fraud and Abuse Act, which is the anti-hacking law,
and for many of these computer laws.
And that's the issue of unauthorized access.
So almost all of these privacy and computer crimes that we see are based on access that's unauthorized.
So what does that mean?
Well, access could mean a lot of things.
I was having a conversation with my parents at dinner tonight,
and we were talking about what it means to kind of get behind or go into a website,
or sort of go behind the front page, or that sort of thing.
And you can talk about access as being something kind of metaphorical,
like if I visit the website, then that's sort of like the front page, like the front door,
but it's not like I'm getting into the database of information that's behind it.
Or if I ping and it sends me back a packet that says, yes, I'm here,
then it's not like I really went inside or got any of the information that's inside.
Or you can look at it in the way that computers really work,
which is you send packets and it sends you packets,
and when you send it packets, you're causing that machine to do something and you're accessing it.
Well, courts have looked at it in the more broad sense,
and basically the cases have read that every time you have some kind of contact with a networked computer,
you're sending it electrons and packets, and so you are accessing it.
So it has this very broad thing.
In no case, in none of the cases that deal with the interpretation of the Computer Fraud and Abuse Act,
has anyone ever been held to not have accessed the computer.
So access is kind of, it's like any use or connection with a networked computer is access.
Well, so okay, there's one element of the crime that we've all committed.
What about authorization?
Is authorization really something that helps us distinguish between legal and illegal activity?
So authorization could mean a lot of things.
It could mean that you have explicit permission,
or it could mean that you weren't explicitly kept out.
And how does the law see this?
Well, a lot of technological people think that authorization is kind of about what the computer allows you to do.
So if permissions are set in such a way that you can access a file,
or if the file is stored in a public space on the web server,
then you have authorization because the computer authorized you to do it.
And that's not the way that the law looks at it.
The law has a much more social or sociological view of what authorization means.
And there are many ways that you can do something that goes beyond your authorization.
There are cases that say that if you do something that's what a banner warning tells you not to do,
your use is unauthorized.
There are cases that say if you make access to a computer system
contrary to the terms of a contract or terms of service, that that's unauthorized.
Cases that say that if you are notified that what you're doing is unauthorized,
and you continue to do it, that that's unauthorized.
So we have cases like eBay versus Bidder's Edge,
in which a robot spidering program that collected auction information from eBay
was making unauthorized access to eBay's website
because eBay told the company that ran the spidering program they didn't want them there.
We have cases where somebody who was a former employee who had left that company
and was told that as a condition of your having left this company,
you're not allowed to compete with us, sort of a non-compete agreement.
And he then went on to his old company's website and collected data there about how much,
I think it was cruises, travel packages cost.
And in that case, they said, well, you were doing that to compete with your old employer,
and that was contrary to the terms of your termination contract, and so that was unauthorized.
The case that I think reads unauthorized access the most broadly
is a case where a former employee started working for a new competitor company,
but before he moved to the new company, he took a copy of his old employer's customer list,
and he took it with him to the new company.
And then the old company sued the new company and said,
you had your guy make unauthorized access to our computers.
And the new employer said, hey, he was authorized.
He had a password. He was still working there.
He was allowed to access the customer list.
Maybe, you know, he took a trade secret or something, but it wasn't this violation.
It wasn't unauthorized access to your computers.
And what the court said is that, no, the court said at the moment that he knew in his mind
that he was acting contrary to the interests of his employer,
all right, and that he was acting contrary to the interests of his employer,
his use was not authorized.
Well, think about that.
Every time you access some computer in a way that the computer owner might not like is unauthorized,
that's pretty broad.
Okay, so keep that in mind when we're talking about all of these things,
about what unauthorized means and whether it's really a principled way to distinguish
between something that's criminal and not criminal.
I mean, my argument is that it's not.
And if you look at the civil cases that interpret these, particularly the civil cases,
but now some criminal cases,
think about whether search engines or spidering robots or shopping bots
or those sorts of things are crimes,
because cases have held that all of those are making unauthorized access to computers.
So if you were to use wireless to access stored files on a network without permission,
that would be a violation of this particular law that I have listed up here.
What about intercepting communications that go over the network?
Well, there's a law that says that you are not allowed to intercept the contents of communications.
So when people ask me,
well, what if it's unencrypted just going over a wireless network?
Can I read it and take a look at it?
And I always say no.
And I feel even better about this after I used the wireless at Black Hat to check my email,
and the next thing I knew I was locked out of my email account
because some bozo was logged on and so I couldn't get back in.
I've had to change my email password four times at Black Hat.
I know. I know what you guys are all thinking.
But I'm a lawyer. Give me a break.
So I always tell people you shouldn't be accessing the content of communications,
but I do think that if anybody,
and it wouldn't be any of my clients who talked to me about this beforehand,
but if anybody ever does make this mistake and ends up getting prosecuted for it,
I think there might be a defense within the context of the statute.
The statute does have an exception in it,
which I think was designed to protect people who were capturing radio signals.
And that exception says that it's not unlawful to intercept communications
which are configured so as to be accessible to the general public,
readily accessible to the general public.
And I think there's an argument you could make that unencrypted communications over wireless
are readily accessible to the general public.
So hopefully none of you will ever have to mount that defense,
but if so, we'll see how that goes.
Alright, what about just using the network?
So this also gets us into question number two,
which is what are the federal and state laws regarding computer crimes?
And as I talked to you before,
the kind of triggering thing is this unauthorized access.
The Computer Fraud and Abuse Act, which is 18 U.S.C. 1030,
one of my favorite laws,
makes it a crime to access a computer without authorization
and either obtain information or cause damage.
It's a very long statute and there's more to it than that,
but you get the basic gist.
So the question is, is using wireless a crime under this statute?
And I've always thought no, just using it isn't,
because the wireless isn't necessarily a computer
and as long as you're not overusing the bandwidth
or doing anything to damage the network, there's no damage.
And in order for this to happen,
you have to either obtain information or cause damage.
So I thought that was pretty okay
until we started seeing these California and Florida cases.
So, why is it different under state law?
Well, state laws are phrased differently than the federal law
and I have here the California law.
It basically says you don't have to cause damage
and it doesn't have to be access to a computer.
If you use computer services without permission,
you may be committing a crime.
And this was the statute that they chose to arrest
the person that I was working with under.
Similarly, the Florida statute says that it's a crime
to willfully, knowingly, and without authorization
access a computer system or computer network.
And you could say that the wireless or the access hub
is part of the computer network.
So, this is kind of scary,
because you know that you're accessing the wireless
and how do they prove that it's without authorization?
Well, the way they usually prove it is not that hard.
Basically, as I said, it's kind of in the mind of the owner,
is the way that the law looks at it.
And what I have seen them do in all of my cases is
they get the person who's the owner of the computer system
to come into court and they say,
did you ever give the defendant permission
to use your computer services or computer?
And the owner says, no, I never gave them permission.
And boom, they're done, they leave, and that's it.
What are you going to say?
So, authorization's always been pretty easy,
or lack of authorization's always been pretty easy to prove.
But with wireless, how do you know, right?
Is there a question?
So, his question is, isn't it kind of implicit
if people leave it open,
that maybe you're authorizing,
that it's implicit that you're allowed?
Yeah.
They're saying, well, the box is called allow all,
and I can promise both of you
that people who have wireless in their house,
many people have never seen that box.
Many people just plug the thing in
and it just automatically allows, and that's it.
So, do those people want other people to make access,
or don't they?
Some ISPs encourage you to share your broadband connection,
and some ISPs in the contract tell you
that you're not allowed to share.
But the vendors choose to leave the burden
of actually excluding or including people,
or actually including or excluding outside users
to the people who purchase the access and the wireless router,
and most of those people aren't like us.
Most of those people are more like,
as I have my poster children of my parents,
most of those people are more like my parents,
who, at best case scenario, are going to plug the thing in
and be psyched that it works.
Worst case scenario, have to call in, you know,
some expert technical assistance to help with that.
So the question is, what do you know?
Exactly.
So the question is, what do you as the user know
about what the owner wants,
just based on the fact that access is possible?
Do you really know what's in their mind?
And as long as the courts look at what's in the owner's mind,
as opposed to what might seem reasonable to you,
you're in trouble.
In the case that I was involved in,
one of the things that made them feel like it wasn't authorized
is that my client was outside of somebody's house in his car,
and they're like, why is he lurking around outside their house?
Now, that might seem like totally normal behavior to some of us,
you know, when you need to get onto the wireless,
there's nothing wrong with lurking around outside somebody's house.
But, you know, I don't know that a judge or a jury
is necessarily going to view it the same way,
and it's kind of risky to depend upon that.
And of course, you don't know.
When the access point's open, you don't know whether you're allowed
or the person's just, you know, too lazy or ignorant
to have configured it differently.
So what I have argued with these laws
is that it shouldn't be enough that you know you use wireless
and that it's unauthorized.
I've argued that you should have to know that it's unauthorized.
Like, you in your mind know that you're not allowed
to be doing what you're doing.
Otherwise, you don't have a guilty state of mind.
You're not doing anything that is, you know,
the illicit criminal thing that's what we're trying to prevent.
And much of criminal law, in fact almost all of criminal law,
requires you to have like a guilty criminal state of mind.
And that's what we do to distinguish between, you know,
where you don't get punished and where it's okay to put you in prison.
So no court has adopted that yet.
But if there are any lawyers out here who ever face some of these cases,
you can call me, I wrote a brief on it,
and I think it's pretty good, I think it's a really good argument.
But can you count on it? You know, no.
So the question is, what else could you do to make the fail-open,
to make fail-open more of a legal, like more robust legally?
So that, you know, in the absence of circumstances that clearly point to the contrary,
instead of assuming that you're not authorized, we assume that you are authorized.
And I think that, I mean, that would be great, right,
if we could communicate to courts or juries or, you know, or Congress
that, or legislatures, that in the absence of some kind of security measure
or some kind of clear notice to the contrary,
if something is accessible, we can assume that it's okay to access it.
And, you know, so there's two ways that the law develops.
The law can either develop through, well, there's many ways,
but the law can mainly develop either through statute,
where you can have that be something that a legislature would pass,
or it can develop through the common law, where through the process of judges making rulings,
something becomes conventional and is sort of the way that things are done.
And so, you know, many of these cases, what you're hoping for is to develop a common law
so that courts see that, you know, we're going to assume, we're going to assume freedom.
We're going to put the burden of security, the burden of closing something on the owner,
and we're going to not put the burden on the public to assume that
unless they're explicitly invited in, they can't go anywhere.
So that's the way that it works with the law.
I mean, there may very well be technological ways we could do that as well,
which might include making it easier for people to make their preferences more explicit
and putting maybe pressure on vendors, for example, to make that process of deciding easier
so that we don't have to assume that if it's open, it's ignorance.
We can assume that if it's open, it's intentional, and that if it's closed, that too is intentional.
Okay, so the Patriot Act and computer crime.
How did the Patriot Act change investigations of computer crimes?
Well, clearly the Patriot Act expanded surveillance in many areas,
but I'm going to talk just specifically about this particular area.
And the Patriot Act changed computer crime investigation in two main ways.
First, it made it possible to get wiretaps to investigate computer crimes.
A wiretap is a very privacy-invasive investigatory tool,
and you can't get it to investigate just any crime.
You can only get it to investigate a certain enumerated list of crimes,
kind of meant to be the more serious or the more dangerous ones.
And now computer hacking is one of those more serious or dangerous crimes for which you can get a wiretap.
It also created this computer trespasser exception to the wiretap rules.
The trespasser exception gives the government additional rights to monitor somebody
who is a trespasser on the computer system.
So if it's your system, it gives you more power to bring the government in
without the government needing to get a warrant,
and it gives the government more power to work with people who are owners of victim systems
in order to do monitoring without having to go through the same kind of...
without having to show the same level of proof that they would have to show prior to the Patriot Act.
And here is basically the terms and conditions of the trespasser exception.
Yes?
So trespasser is defined... it's very interesting, I think, how they defined it in this statute.
A trespasser is somebody who has no contractual relationship or authority to be on the computer.
And I think the thing that's really interesting about that is to contrast it
with the definition in the Computer Fraud and Abuse Act,
which says that you're just unauthorized.
And it's clear that unauthorized means you've gone beyond the terms of the contract.
Here they're saying, even if you go beyond the terms of the contract,
that's not enough to be a trespasser on this computer system.
If you have any right to be there at all, like if you're a legitimate user
and you're just exceeding your authorized access,
you're not going to be falling in under the computer trespasser exception.
You're just not... it's got to be somebody who has no authority or no right to be there at all.
And the thing that just really aggravates me about that is it shows that Congress knows
that the Computer Fraud and Abuse Act covers people who are outside of the bounds of contract
and that they're making criminal something that is just a breach of contract,
which I think is wrong and drives me crazy.
And you wonder whether maybe they just don't realize what they're doing
and then you see that they excluded people with some kind of contractual authority
when they made the trespasser exception, which shows that they knew what they were doing all along
and they just disagree with me as opposed to they don't know what I know.
They know what I know and they like it the way it is.
Okay, where can you find out more information about the Patriot Act?
Here's some places.
And basically, at this point in time, there are many controversial provisions of the Patriot Act
which are due to terminate or sunset very soon.
And the House of Representatives has reauthorized those provisions and it goes to the Senate now.
So it's actually a time where there's a lot of legal work being done on the Patriot Act
and it's a good chance and a good opportunity to get involved with Patriot Act issues.
Seth?
Today? Or yesterday?
Okay, so Seth says that the Senate passed a bill that reauthorized most or all?
Okay, so he says it has different sunset terms from the House, but they reauthorized everything.
And I wasn't reading the newspapers yesterday, so I'm totally behind.
But it shows you how fast things move, right?
So is it too late for us or what?
Okay, so it's not too late. There's still a chance to win the House and Senate conference on the bill.
Yeah, it's late.
So see what happens when they bring us down here, we're having fun in Las Vegas, and they're busy working up there on stuff we don't like.
Okay.
So, one of the questions that people had asked me is, like, when can the government surveil me?
This is question number four.
And I put that on my list of questions, and then I realized it's just simply, completely impossible to do that question any kind of justice in this format.
So...
Excuse me, I'm trying to figure out how much time I have.
Okay.
But I thought I would just, you know, make some comments about privacy and about how the laws that govern surveillance work generally
to give you a framework for what kind of things should I be looking for or asking when I'm wondering about when I can be surveilled.
So there's many different theories of privacy which are sort of operant in our law.
And what we've done is sort of, we have like this mishmash of statutes which either try to protect or totally fail to protect privacy.
And I think that you can really, sort of a useful framework for looking at privacy questions and questions of surveillance
is to ask yourself, you know, these five questions when you're looking at an issue of what is, you know, is this privacy protecting?
Is privacy protecting enough or not enough?
So, you know, we're looking at what level of proof needs to be shown for a certain kind of information depending on its sensitivity
and what safeguards are in place to make sure that there isn't any kind of, you know, unauthorized or excessive use of this personal information.
Okay.
So, a lot of people ask me questions about encryption.
The very popular topic in the survey.
And, you know, people wanted to know, you know, these sorts of questions about encryption.
Mostly, you know, is using encryption a crime?
And why did this come up?
Well, again, recently there was a case out of Minnesota in which the court appeared to be holding that
the fact that the defendant had PGP on his computer was evidence of criminal intent.
Now, for those of you who aren't familiar with the case, I can tell you basically this was a child molest case.
And the victim told the investigators that the defendant had molested her and had taken pictures of it.
And the investigators got a warrant and they went to search the defendant's computer.
And when they searched the defendant's computer, they didn't find any pictures.
So, it didn't... that portion of the victim's story was not corroborated.
And in ruling on whether or not... but they let in evidence.
The trial court let in evidence and considered evidence that the defendant had had PGP on his computer
in saying that there was enough evidence for him to be convicted of the child molest.
And on appeal, the defendant said that using the encryption evidence,
admitting the encryption evidence and using it in that way was improper.
And the court of appeal said, no, it's not improper. It's fine.
Well, there's a couple ways that you can look at this.
So, first of all, did the court say that using encryption itself was a crime? No.
So, there are not cases that say purely using encryption is a crime.
In fact, there are cases that say the encryption algorithms themselves are protected by free speech principles.
Certainly, we also have a right to communicate and a right to communicate anonymously and privately.
And so, we don't have cases that say just encryption is bad.
But is it evidence of criminal intent?
Now, remember, this is one case out of Minnesota.
And I don't know how influential Minnesota will be in other states.
But what you often find in this area is that the very first case on a topic,
even if it's kind of poorly reasoned and poorly explained, like this case is, can become influential.
So, you want to be really careful about what it is that the case really says.
And one wishes that judges were more careful about what they say that the law is.
The two ways to look at this particular opinion are either the one that we're all worried about,
which is that when you have PGP on your computer, it shows that you have something to hide.
And it shows guilty knowledge and that you're trying to keep stuff from investigators.
So, it shows you have consciousness of your own guilt.
Another way to read this very same case is that the PGP evidence explains why there wasn't evidence on the defendant's computer.
So, it wasn't that it showed that he had something to hide,
but it was an explanation for why they didn't find the pictures that they expected to find.
Maybe they were encrypted or maybe he'd wiped them or something like that.
It's unclear which of these explanations the court is adopting.
One maybe makes some kind of sense and doesn't necessarily penalize somebody for having encryption.
It just says, well, in the totality of the evidence and because I find the victim so credible,
I'm not going to say she's not credible just because I didn't end up finding the pictures
because there's other things I can look to to figure out why the pictures might not be there.
And that's something maybe we can all live with as opposed to something that says,
oh yeah, PGP, that shows that you knew you did something wrong.
A question here? I'll go to you in a second.
So, he's saying the press on the case, and I agree with this interpretation,
it wasn't that the PGP evidence alone was enough, but in context with all the other evidence,
was part of there being sufficient proof to convict the defendant of this particular case.
And I think that that's a totally reasonable reading of the case
and I think we want to be careful when we read these cases to not give them an interpretation.
And by we, I don't necessarily mean you guys, I mean we as lawyers and I was going to say we as judges,
but we all know that's never going to happen for me.
But judges also need to be very careful when reading these cases
to make sure that they're not giving an interpretation that's not warranted
and taking something that made sense in one small context and expanding it to be a general principle.
There was a comment over here. Gentleman here.
So it's a question about employees on employer's network.
And when you're on your employer's network, this gentleman is right,
you have very little privacy and that's for a couple reasons.
First of all, many of our privacy laws, like the Fourth Amendment, don't apply to private parties.
So the Fourth Amendment doesn't apply.
And many of the privacy laws that we do have, privacy rights that we're entitled to by statute,
have exceptions in them which will apply to employers and allow employers to do a lot of monitoring and that sort of thing.
So people generally have very little privacy at work.
And employers have a lot of rights to surveil.
Now we've seen limits to that.
For example, with cases that involve videotaping and changing rooms and things like that.
But a lot of times what employers will just do is say in the employee handbook,
everything you do here on your computer is something that we'll monitor and you understand that.
And that's basically it.
So work is not a great place for privacy, generally.
I'll take this question over here.
Great question, because this brings me to my next point.
And he's like, why is it not covered by the Fifth Amendment?
So this is what I'm saying about can you be compelled to turn over your keys so that they can decrypt your stuff.
And I hate to say this, because if this ever happens to one of my clients,
I'm definitely going to argue that it's a Fifth Amendment violation.
But I think the reason you would say it's not a Fifth Amendment violation is this.
Fifth Amendment, you can't be compelled to testify against yourself.
There's a couple things there.
First of all, it has to be compelled.
So the stuff you wrote that you encrypted that you don't want to turn over,
no one compelled you to write that.
You wrote that voluntarily.
So there's no compulsion there.
The compulsion, and they could search that.
If they can get access to it without violating the Fourth Amendment,
they can get it because it's not compelled testimony.
What about the keys?
You're being compelled to turn over the keys, right?
But the Fifth Amendment has a second part,
which is that what you're compelled to do is something testimonial.
And there are a lot of cases about what's testimonial.
And for example, cases say stuff like name, rank, and serial number are not testimonial.
So if you are compelled to turn over your key,
you're not being forced to say anything that's testimonial.
All you're doing is giving them the access to the stuff you wrote which wasn't compelled.
So the best argument that you have, I think, of why you can't turn the key over is
there is something testimonial about the divulging of the key,
something that is communicative.
And what that is is that you're the person who encrypted it,
that you're the person who has access, at the very least, to the information
because you've got the key.
And I think that the downside of that argument is that what a prosecutor would do
if they really wanted the stuff is they would say,
all right, you've got a Fifth Amendment right and I'm going to overcome it by giving you immunity.
Fifth Amendment rights can be overcome by giving you immunity,
which basically says we're not going to use that against you.
But they don't have to say we're not going to use what we find against you,
and they don't have to say we're not going to use the fact that you...
What they say is we won't use the fact that you had the key against you.
So you're divulging the key to the extent that it's testimonial.
We're not using it against you.
Now you have to give us the key.
And so then I think you're in a lot of trouble with your Fifth Amendment argument.
Okay, so he says, well, you know, but let's say it's somebody with whom you have a privilege,
like your wife or something.
Okay, so you don't have privilege in information you confide to another person, period.
You tell me something, if I'm not your lawyer, they can ask me and I can be forced to tell.
The reason why you have a privilege with people like your wife or your shrink or your doctor
is because the law has picked out certain relationships that it wants to protect
because it wants to encourage the free flow of communication.
And it's got certain little enumerated categories that it falls in there.
And the reason why it does that is because it's protecting that relationship.
Now the spousal privilege, they're protecting it because they don't want to tear your marriage apart
by forcing your spouse to testify against you.
And they want to make sure that marital communications flow back and forth.
But if I write a letter to my husband and it's in my house and they have a right to come search my house,
like let's say they have a warrant and they find a letter to my husband, they can use it against me.
Just like if you rob a bank and you tell your lawyer, you tell your lawyer I robbed a bank,
that doesn't mean that they can't use that statement against you.
It just means they can't make me testify that you told me that.
Well then the question is, is decrypting a violation of privacy?
And what I would say to that is, even if the law says that the fact that you encrypted it
shows you have an expectation of privacy in the information,
expectations of privacy can be overcome with warrants.
If there is probable cause to believe that it's a crime, you may very well have an expectation of privacy,
but it is a conditional right which is overcome with a warrant
or if there's some exception to the warrant requirement.
So just the mere fact that you encrypt it isn't going to give you any kind of absolute protection
under either the Fourth Amendment or the Fifth Amendment.
I'm going to take this gentleman in the back with the glasses.
This is why I love speaking at DEF CON.
I never get questions like this at Black Hat.
So if I'm married to an android, can it be compelled to...
That's a great question.
I don't know whether the law would be willing to recognize a privilege between you and a machine
even if the machine was serving the purpose that somebody
who would otherwise fit under a privileged relationship with you would have.
And that's the question.
You would have to ask, is the law prepared to protect this person's relationship with the machine
the same way that we would protect this person's relationship with a real wife
or a real shrink or a real priest.
I mean, I'd be speculating, but I'm going to guess maybe not.
That's a great question.
Wait, can I just... I'm sorry. I'm laughing at your question, but I actually...
I'm laughing because it's a fun question, but it allows me to say something,
which is that this is the way we deal with stuff exactly in the law, right?
You've got computer technology that evolves.
I mean, because it's a beautiful question.
So you've got computer technology that evolves, and we have these old rules from way back.
And now we've kind of got to decide, like, what are we going to do with these old rules in this new world?
And so the law has trouble with this.
Like, the law just doesn't... and the question is...
What we try to do, really, is we try to go back to the reason why we had the law.
I mean, in our best moments.
We try to go back to the reason why the law existed in the first place
and try to preserve those values now into the new world.
Which is why I say we'd have to ask whether society or courts would be prepared to say
that the interrelationship between me and digital psychiatrists is deserving of the kind of protection
that the relationship between me and flesh-and-blood psychiatrists was.
And if so, we're going to say yes.
And if not, then we're going to say no.
Similar question with bloggers.
Do bloggers get the same kinds of rights as journalists?
You know, we have all of these situations where we have new technology
and we're looking to our old rights and privileges and saying, you know,
how are these going to be in the new world?
So I laughed at your question, but it is the fundamental question that I spend my whole life studying.
Which is, what are we going to do with these old laws in this new context?
So lest you think I was laughing at the question, I really just enjoyed your scenario.
Yes.
That's K-I-T-T-Y porn, right?
Yeah, I thought so.
It's very hypothetical.
I mean, yes, what I would say is the stuff that you wrote down, that you then encrypted,
the way the law would look at it is say, that's not compelled because you wrote it down voluntarily.
And his question, I'm sorry, his question was basically, you know,
is there a difference between saying, I'm compelled to testify,
versus I'm compelled to give them something which lets testimony against me happen.
And what I would say is that, yes, there is a difference,
because the Fifth Amendment only applies to compelled testimony,
and this is where they're compelling you to get something that's...
or the testimony was not compelled, and they're compelling you to give something that's not...
Okay, so testimony, or the thing you encrypted was not compelled,
and they're just compelling you to give them something non-testimonial, which is the key.
So I don't think that that would work.
I'm not sure what your question is, but let's go for it.
Let me just get through the rest of these slides, and then we'll go.
I'm not saying you're compelled.
I'm saying, let's say I write in my journal, I killed him, and then I encrypt it.
When I wrote I killed him, I wasn't compelled to write it.
Fifth Amendment doesn't apply.
I encrypt it, and now I have to turn over my key.
The key's not testimonial.
They can compel me to turn it over.
Then they get access to my non-compelled testimony.
I'm the one who killed him.
Boom, you're done.
Okay, statute of limitations.
Now, I put this in because I thought this would be a nice, easy question,
because statute of limitations, if there's an answer, I should just put a big number up,
which will be the number five, and that'll be great because, you know,
so many of these questions are it-depends kind of complicated questions.
But even the statute of limitations isn't clear,
because while there's a five-year statute of limitations for computer crimes,
there's another statute that allows courts to suspend the running of statutes of limitations
when they're doing investigations that involve evidence in a foreign country.
Statute of limitations.
Is the content of the key testimony? No.
Okay. Logs as evidence.
So, a lot of people think...
You had a question before, so I'm going to let you ask it.
He asked me if there's a notification requirement for an extension of the statute of limitations.
I think that's an excellent question, and I don't know the answer to that.
So, I'm going to have to look that up, and I'm going to have to get back to you.
So, will you email me, my email's on the thing, and make sure that I tell you?
Because I don't know.
Okay. Logs as evidence.
So, a lot of people who are technological people feel that, you know,
we know how malleable digital data is, and we feel like there's a very high standard,
for admitting logs, computer logs, as evidence.
And I think people are always surprised at the extremely...
That was good, actually, by the way, that you stumped me.
I think that there might be a prize in that for you.
I was going to buy him a drink.
A lot of people think that you have to, you know,
that you have to show that it wasn't tampered with,
and that you have to prove that it is exactly the right thing.
Sort of, it's almost like the reverse is true.
All you have to do to get computer logs admitted as evidence
is just show that it is basically what you, as the proponent of the evidence,
purport it is.
Show that it's reliable enough.
And what they do is they bring in the person whose computer it is,
you know, who is the system administrator,
and he says, yes, we have this computer set to log,
and it logs in the regular, normal course of business.
And these are the logs, and I pulled this off of the computer
in the place where the log files are stored, and here it is.
And it looks pretty much like what it was that I pulled off the computer.
And at that point in time, the court will say, okay, I'm ready to admit it.
And you can say, yeah, but I mean, he could have edited it.
What was, you know...
In fact, I've had logs that were edited, admitted.
I've had logs where they basically cut out all of the extraneous data,
leaving behind only the data that showed that it was my client
who had been accessing their computer and said, you know,
I just, to make it shorter for you, your honor,
I just, you know, left in the important, relevant stuff,
and I didn't put any of the other stuff in there.
So, you know, here's your log.
And I was like, you know, you can't do that.
And the court was like, well, he says that this is accurate,
and so, you know, I'm willing to believe it
unless you can show me that it's not accurate.
And what usually happens then is you try to show that it's not accurate,
and the courts say, well, maybe there might be some question about it,
but I'll let the evidence in,
and then the trier of fact can decide what weight to give it.
So computer logs have been something that courts have been very forgiving about,
particularly in my experience.
Okay.
This is why I sort of wanted to rush
to make sure that we had a little bit of time to talk to this stuff.
So I think that probably everybody here is familiar with
or has heard about the lawsuit that happened earlier this week
after Mike Lynn's talk on Wednesday at Black Hat.
And I was involved in that case,
helping Mike with the aftermath of his talk.
Thank you.
You know, and while I was doing that,
particularly when we were in the six-hour settlement conference
with the nine attorneys from the other side
trying to hash out a settlement agreement,
I was thinking to myself, I can't believe I'm doing this.
I'm in Vegas, and I've been up since six in the morning,
and I'm working on this.
And I thought to myself, you know, and I'm not even getting paid.
And then I thought, but I'm really saving a lot of money by not gambling.
So actually, I'm way ahead here.
So I have Mike to thank, at least for that.
But I think that one thing we haven't done a lot of talking about,
and I know that there's been a lot of talking and rumors and all of that stuff,
and I can't talk about the facts of the case or anything like that,
and I don't want to take any questions on that,
but I do want to talk a little bit about the law
and how it was that they claimed that what he did was improper.
So basically, this was a case that involved California's Trade Secret Act.
And the Trade Secret Law prohibits the misappropriation of trade secrets.
So what's a trade secret?
All right, so this is awesome that you guys are here.
We have, first of all, this is Mike's cape.
We made him a superhero cape to go with his hat.
And we're going to use it right now to let Jennifer change into her present that we got her.
And Jennifer, she's doing such an awesome job.
She can probably share this cape with Mike.
She's just doing such an awesome job.
Yeah!
You guys look fabulous.
All right, thank you.
But I want that cape, though.
Did you guys see the Incredibles?
No capes.
Oh, that's beautiful.
I'll make sure he gets it.
Thanks, you guys.
Trade Secret Law.
It's very serious business.
So a trade secret is information that derives its value from the fact that it's not...
All right, you guys are making me laugh.
A trade secret law is information that derives its value from the fact that it's not generally known to the public.
So that's thing number one.
And so the first thing you have to ask yourself when you've got a trade secret case is,
what's the secret?
Is it the kind of thing that's protected by trade secret law?
And then the second thing you ask yourself is, what's the misappropriation?
So there's two possible claims here.
One claim is that the information that he had about what the flaw was,
was a trade secret to his employer, or rather I should say his ex-employer, ISS.
The other possibility is that the case is about...
that there's something about the Cisco code that remains a trade secret to Cisco.
So... question.
So his question is about whistleblower laws.
So let me make sure that he's a researcher, but let me get to that.
Because my second summer of law school, I worked at this whistleblower place in DC.
So I know a bit about the whistleblower laws.
But my particular whistleblower specialty is FIFRA,
which is the Federal Insecticide, Fungicide, and Redenticide Act.
And I did a white paper on the whistleblower provisions of FIFRA.
So if anybody here has any rodenticide researcher issues,
I think that I'm the person most qualified to respond to those.
You laugh, but it's true.
Okay, so then the question is, was it misappropriated?
And so, what is misappropriation?
Well, the statute says, specifically, that reverse engineering is a proper way of discovering something,
even if it's a trade secret.
And reverse engineering is specifically allowed under California law.
And I have quoted here for you what the California law is about reverse engineering.
And you can see, reverse engineering or independent derivation alone
shall not be considered improper means.
So that's an important thing, number one.
But the other important thing about this statute is it does say
that it's improper if you breach a duty to maintain secrecy.
Okay, so we've got these two functional things here.
One, is there a duty to maintain secrecy?
And two, or was it independently derived?
So, the issue in the case is basically, you know, what did he disclose
and was it in violation of some duty to keep it secret or was it independently derived?
So, a violation of a nondisclosure agreement, for example,
a nondisclosure agreement with an employer, might be a trade secret violation.
But that, if you read the complaint, wasn't part of the case.
There wasn't a claim that he had disclosed something that was a secret
and was proprietary to his employer.
What the claim was, really, if you looked at the complaint,
was that the machine code that he had disassembled from the Cisco binary
was a trade secret as to Cisco and that he revealed that information to the public
when he showed his slides at the presentation.
And so, the question there, clearly, the statute clearly says,
although, of course, they don't cite the statute in their papers very much,
the statute clearly says reverse engineering is okay.
Reverse engineering alone isn't improper.
And they said, well, it's not reverse engineering alone,
it's reverse engineering in violation of our EULA.
Because when you get the Cisco, you know, when you get the Cisco router,
our EULA says, and for those of you who don't know, it's the end user license agreement
or terms of service for use of the machine, our EULA says no reverse engineering.
So, now, EULAs have a lot of issues.
And I think I've decided that next year for me is going to be EULA year
and I'm going to be worrying a lot about EULAs.
And one of the ways that people have always attacked EULAs has been on the issue of formation.
Is it really a contract if you just slap some warning on your product
and I never click I agree or, you know, have any kind of, you know,
intention to enter into a contract with you.
But I don't believe personally that attacking EULAs solely on the grounds that it's not really a contract
because we never had this offer and acceptance meeting of the minds that's required for contracts to happen
is a very fruitful process.
I think that it's a dead end in the long run because we'll end up with things where they'll make you agree
and most people will agree to something like no reverse engineering
and those few people who do care to reverse engineer just simply won't be able to buy the product.
But we can talk more about that in question and answer.
I think the question that was really raised by the lawsuit in this case
and the thing that made me super interested in it was the question of whether the violation of a promise in the EULA
i.e. a promise not to reverse engineer is a violation of the trade secret law.
Something beyond simply having reverse engineered and independently derived it
the violation of some kind of promise that makes something that ordinarily might just be a contract breach a crime.
Or at the very least something that imposes civil liability.
And as you may have guessed from my comment before about the website terms of service
and employment contracts and that sort of thing
it really makes me mad when suddenly breaches of contracts are crimes.
It's just not something that used to be true in the law at all.
In fact, breaches of contracts are things for which you can't even get punitive damages usually
because the law likes to see people breach contracts when it's economically efficient.
So if I have a contract with you, but I can make more money with somebody else
I'm allowed to breach the contract with you.
I pay you what you expected to get
and I get to reap the profit of the fact that I got to enter into a contract with somebody else
and the law is happy.
There's no moral opprobrium that attaches to breaches of contracts.
So it really bothers me to see these kinds of things made criminal.
And I think that one of the things sort of in the bigger picture that the case raised
is this question of is there a limit to the enforceability of EULAs
and can EULAs be the grounds for these sorts of other kinds of offenses.
I have a question from this gentleman here.
So the question is if the information is discoverable by reverse engineering
is it a trade secret and the answer to that is no.
Because first you did not obtain it by improper means.
You discovered it. No longer a secret.
So it's no longer a trade secret.
So the answer is basically no.
There's a question from this gentleman in the green.
We don't have a decision in Blizzard yet, right?
Okay, so I will answer your question.
So Blizzard versus BnetD is a case that involves a manufacturer of one of these multiplayer games
and some people who reverse engineered that game and built their own server
on which people could play the games compatibly.
And the case is now on appeal, which is why I said there wasn't a decision,
but this gentleman is right that there was a decision from the trial court below.
And what the trial court below said was that if you have a user agreement
that says no reverse engineering, then those terms are enforceable.
There's another case that says the same thing.
It's Bowers versus Baystate.
And that case also says terms in EULAs are enforceable.
And the EULA picture is this, to kind of give you the big picture of where we're at.
So contracts require offer and acceptance.
This really was one of my favorite classes in law school
because it's so beautiful if you think about it.
There's an offer, there's acceptance, there's mutual consideration,
there's this meeting of the minds.
It's very romantic.
But those things are required, right?
So a lot of cases that involve things like click wrap or browse wrap,
we have cases that say if there's not actually an offer and acceptance,
then it's not a contract.
So if it's just something that says legal at the bottom
and you don't have to click on it or agree or anything,
then it's not a contract and you're not bound by those terms.
And there's other situations where you don't have notice or something like that,
or maybe you do have notice and you continue to use the site.
So the question is, is there agreement to the terms?
And those are things I would call formation issues.
Was there a meeting of the minds?
Did the person know what the terms were and manifest their assent,
either through clicking OK or for using it or something like that?
So formation issues.
If there's formation, there's offer and there's acceptance,
either through actual clicking OK or through notice and continued use,
then you're into the question of whether the terms are enforceable.
And my fear is if you have every term be enforceable no matter what,
you can have EULAs that say, no talking nasty about this product.
And maybe 95% of the people in the world don't want to talk nasty about the product.
They just want to buy it and use it.
And so most of us will just agree.
And those people who do want to talk nasty about the product,
the company doesn't need to sell to them.
And so they'll never be able to buy it.
They won't sell it to them.
And they won't buy it and they won't have access to the product,
so they won't be able to test it or benchmark it or anything.
And all the rest of us will be happily using the product
and no one will be allowed to tell us that the product stinks.
So, you know, when I say that I think next year will be EULA year,
the thing that I'm really concerned about is,
are there limitations to the terms that will be enforceable in EULAs
when you have a situation where the term is contrary to public policy?
Individually it might not be a big deal,
but in aggregate it deprives the public of the right to know something
or the right to do something that has great public benefit.
A question right here.
Okay, so his question is, you know, how far does the contract extend?
So if I buy it with, you know, if I buy somebody's product,
maybe I agree to the EULA, but when I sell it to somebody else
and the software is already installed and everything,
you know, those people, the second, you know,
the second purchaser hasn't agreed to the contract,
so maybe the second purchaser isn't bound by it at all.
And I think that, you know, in some ways that's a good argument.
I actually, I'm not 100% sure of that question,
but I think that, you know, you could make me agree to terms of contract
simply by selling something to me without my also having notice.
So I think that that may be sort of a break.
And, you know, if I were going to buy your machine
with your ancient copy of Microsoft Windows on it
and continue to use it without reinstalling or anything,
maybe I wouldn't be bound by that, by those terms.
But if I, let's say then I decided that I was going to criticize
Microsoft's product or something, and they wrote to me and they said,
hey, we hear you're criticizing us, and that's contrary to our EULA,
you can't either stop criticizing us or stop using our product,
then I'm on notice.
And what a lot of the cases say is that notice plus continued use
will bind me to the terms of the contract.
So, you know, it hasn't always been a great defense.
Well, I don't know about the terms or I've never agreed
because they managed to get you when they do the,
we're going to get to see the food again.
Right.
So this gentleman's point is, well, at that point, you know,
you didn't break the contract, so you could just stop using it
and continue to be free to say or do whatever you want at that point,
and I think that that probably would be right.
Yes.
So his question is, what if I spent a lot of money on it
and either they tell me to stop using it or, you know,
then I learn that the terms of service are something that I don't like.
And there was a class action suit in California on this issue
because of shrink wrap.
So people buy software, they take it home, they open the box,
they see these restrictive license terms,
they don't want the software anymore.
So they take it back to Best Buy, and Best Buy's like,
we don't take your open software.
So then they try to return it to the vendor, and the vendor said,
we don't take your open, you know, we're not taking that back either.
And so what do you do?
So there was a class action suit in California,
which said basically, you know, if you're going to do this,
if you're going to have your terms of service
on the inside of the box,
or if you're going to have your terms of service
pop up only when you install,
you've got to let people take it back
and get their money back.
So practically, that never happens,
but legally it's supposed to happen.
All right, some other questions?
I can take a few more questions
because the people who are coming after us are late.
So let's go for like three more minutes
if anybody has other questions about this.
Let me just do my last slide.
So when to talk to a lawyer.
So as you can see, this is really complicated.
And so, you know, you sort of
almost always need to talk to a lawyer,
unfortunately, which is too bad for you guys,
but great for lawyers.
You know,
the law is really complicated,
and if you feel like, I definitely know,
I'm doing something that I thought was kind of
maybe risky, but now I definitely know
that it's either illegal or illegal,
then you definitely need to talk to a lawyer
because if you think that the answers are really clear,
then you're not getting it at all.
If you think that the answer is,
it depends, and I kind of know what it depends upon,
but maybe it depends on more things too,
and I might need to get a little more advice on this,
then you're in good shape.
So that's the sort of finale of my talk.
And I'll take a couple more questions
if there are some.
I'll take one here.
Is reading the machine code
reverse engineering?
I think here
it was,
I think here we agreed it was reverse engineering
because he decompiled it from the binary.
But if you've got machine code,
reading it is, I mean, reverse engineering,
the courts have looked at reverse engineering
as being a lot of things.
Testing, you know,
trying to watch processes
and replicate,
decompiling.
So a lot of things are reverse engineering,
but I mean, either it's legal
because you're reading something that's already written
or you're reverse engineering.
So what he's saying,
what his comment is
that he doesn't think machine code
is either secret
or is reverse engineering.
And I think there's a good argument for that.
The beer is not here yet,
so you have to,
so I'm going to, which is a tragedy,
so I'm going to take a few more questions
if people have other questions.
This gentleman in the back.
But for those of you,
I'm going to try to take questions still,
so you guys have to be kind of quiet
because I can't hear what he's saying.
So the question is,
do I think Cisco got what they wanted
out of the case?
I'm, you know, I'm not a
researcher, so I may be a little more
compassionate to most of the players
in this than other people are.
I think Cisco definitely didn't get
what they wanted out of this case.
I mean, I can tell you what their point,
what they thought they were doing
was. And in the settlement agreement
that we entered into to
settle the civil case,
Cisco and ISS insisted
that the settlement
agreement say that Cisco
and ISS were working together on a
presentation that would have revealed
the problem without revealing stuff
that they felt was trade secret information.
Now, I have no information
personally whether or not that was true, because I came into
the whole thing, you know, after that.
But I think that what Cisco,
if you asked them, and I'm not them,
but to try to be fair to them, I think what they would
have said is that they really had
certain things that they definitely didn't want,
which was the code and the pointers,
and that they ended up getting
exactly, totally not what they
wanted in all of this, because all of
that came out, and they look bad,
and they had to pay lawyers,
and they had to pay to have the
materials taken out of the presentation stuff,
and they had to pay to get rid of the CDs
and make new CDs. So they have
had a really bad week, in addition
to the rest of us
having a really bad week, too.
I know it was tough, but I got a cape out
of it, so...
So the question
is, our click wrap
and shrink wrap aren't really meeting
of the minds, because it's kind of a take it or leave
it thing. Can you modify the terms
ahead of time and then click
accept?
And...
Is he calling me?
So the question is, can I modify
the terms? And the answer is no, because then you don't
have a meeting of minds on the other end.
So I'm told that
I should answer this phone call, which I'm going
to do, since we're on
overtime.
A call-in
question. Okay, I'll take a call-in
question. Let's see
if I can do it through the...
Let's see if you can do it through the microphone.
Ready?
No,
it doesn't play.
Okay, it was a personal
question, which I don't answer.
Does anybody have an appropriate
professional, non-personal
question?
So, the
question was about the encryption issue
and the forced disclosure.
And I'm not a...
I'm not familiar with these cases that you're referring
to where journalists have been forced to turn
over encryption keys.
The difference there might be that we're not
talking about something that is
incriminating. I mean, that might be one
difference. Then you also have another difference,
which is you've got this journalist thing, which brings in
all this free press type of issues as
well. But I think the fundamental thing is
that the Fifth Amendment applies
very... I mean, the arguments for the Fifth
Amendment application to compulsory key
turning over, I think, are weak.
Though I hate to say it.
All right.
Do you want me to keep going?
All right.
Other questions?
All right. So, there's no
other questions, so I'm not going to keep going, but as
you can see, we have the next thing that's happening.
Do you want to say something?
Okay.
I could tell...
All right. So, you guys...
Let's see. Do you guys want to hear a story?
All right.
Okay.
I'm going to tell you guys
a story about the first time
I tried to help somebody who got arrested
at DEF CON.
This was back in
1999 when...
Okay. I'm not sure. I don't remember what year it is.
But...
I don't know.
This isn't my laptop.
So, I'm just going to...
Okay. So...
Actually, this is a really
long story. I'll tell you
a story. Yeah. Okay. I'll tell
the story. So,
it was the year that DEF CON was
at that Plaza Hotel that was downtown.
And I was...
What year was that?
97?
96?
No.
No. It was 98, I think.
And maybe it was 98. Anyway,
that's a great place, by the way. They have penny
slots, which are super cool because when you're just
like totally down and out and you still need
to gamble, you can go to the penny slots.
And I was about to leave. Like, I
just had my foot on the little shuttle
van step. And I remember this very clearly. Sort of
looking down and seeing my foot on the step
when suddenly a crowd of people come
running out of the hotel. And they're like,
wait, wait. Don't let the lawyer get on
that van. Phony's
been arrested. And I
remember looking at my foot and thinking,
I'm going to miss my plane. So,
I get dragged off the little shuttle
van and I'm told that this guy
by the name of Phony, and I don't know, do any of you
guys here know Phony? Who knows Phony?
Yeah, there you go. Well, you probably know the end of this
story. So, they told me that this guy
named Phony had been arrested. That, you
know, it's the last day of DEF CON and he was
about to leave and some cop came
onto the floor of the show, took him away
in handcuffs, hustled him off into
some van and we don't know where he went. So, now, what
are we going to do?
So, I said, well,
let's go try to find where he
is and see what he was charged with
and we'll see what we can do. So,
they say, okay, great. And everybody's got, like,
radio headsets on. So, I hear them say,
we've procured the lawyer. Bring around the
vans.
So, then two big black
vans roll up and
the door slides open and there's
a bunch of hackers in there, all in black,
all with the headsets. And
Emmanuel Goldstein's in there and he's got a giant
video camera and they hustle
me into the van and we're all, like,
off. And I say, okay,
we need to find where
the jail is. So, somebody's
got the GPS thing and it's, like,
98 or whatever, so this is pretty early.
And they've got the map and they're, like, finding
where the jail is and they're calling back to the hotel
and stuff and it's, like, okay, we've procured the location of the
jail. So, we get there and we, like, get to the
jail and we're, like, stop in front of the jail
and the doors to both the vans
slide open and everybody's ready to jump out and, like,
converge on the jail. And I'm, like, no, no, no,
no, no, no. This is
totally not going to work, okay?
And they're, like, one person
can come to the jail with me, but you can't
all come in. So, they're, like,
take a little vote and everything and everybody's okay
and Emmanuel's, like, filming everybody because
he's got this documentary he's doing about
how hackers help each other and aren't criminals
and stuff like that, which is totally true and great.
Although, you know, it's a little nerve-wracking
to have this big camera in your face.
So, I say, okay, so they pick who's going to come in
with me and I say, okay,
now there's one other thing I need to know.
What's Phony's real name?
And, no,
they're just, like,
can I say what Phony's real name is
or should I make up a name?
Okay, so, they're, like,
they're, like,
they're, like, it's Jeff.
Okay, Jeff
what? No one
knows. So, lots
of frantic phone calls back to the hotel
to try to find out what Phony's
real name is and, um, after
about ten minutes, we finally find
somebody who knows his name and tells me.
And I'm, like, okay. And I go into the jail.
So, I get to the jail
and we go up to the, you know,
the booking guy and he's, like,
you know, what's up? And I say, hi, I'm a lawyer. My client
just got arrested. I'm wondering if he's here
and, you know, what's going on?
And the guy takes a, you know, sort of says, well,
I don't know if he's here. What's his name?
I give him the name and he types it into his
computer and he said, well, he's not on my computer yet
but if he just got arrested, you know,
it takes a couple of hours to go through booking,
he might be here and I just don't have him
in the computer yet. I can go check
in the holding cell and see if he's there. What does he
look like? So, I don't actually know
what he looks like. So, I'm, like, what does he look like?
I don't know. So, the guy who I'm with runs out to the
van and he comes back with somebody's
digital camera that's got the picture of Phony
and he shows the picture and he's got
green hair and a blue pentagram
dyed into the back of his head.
So, I show it to the sheriff
and I go, you can't miss him.
So, the sheriff's like,
we do not have that guy here.
I would definitely know he's
not here. So, I'm like, okay, he's not here
and he says, well, maybe there's another jail across town
maybe he's over there. So, we all pile
back into the van and we've got the whole, you know,
GPS thing with where the new jail is
and stuff and we're hustling off there
and on the way, suddenly, we get a call
over the radio and the call is like,
abort, abort the mission, return to base.
So, we're like, huh, that's weird, okay.
So, you know, I think we've been to like two
jails by this time and we're like, okay, we'll return to base.
So, we return back to
the hotel and we're like, you know, we
don't know what happened. So, everybody's like, what's
going on? I don't know. And sort of like, we walk into the hotel
and we sort of go our own separate ways
and I'm like, you know, wondering
how I'm going to get home now because
I've missed my flight by quite a bit.
And Pete Shipley
comes up to me and he says, can I talk to you?
And I'm like, okay. And we go over
and he takes me aside and he's like, I'm really
sorry, but it was all a
hoax. That was Phony's
cousin. And his cousin's
a cop here in town
and he thought it would be really cool
if
he thought it would be totally cool if
instead of just leaving the con, he was
dragged off in handcuffs.
And he called me from the
airport and I was like,
that's so weird, that's Phony's number, how's
he calling me? And I said,
what are you doing? And he's like, yeah, dude,
wasn't that cool?
And Pete's like,
we dragged Granica off of her
airplane for you.
And now she can't fly home.
So Phony, who's a
gentleman, paid for me to fly back
to San Francisco first class, which I
really appreciated. And then later
in honor of my efforts, put me
in a movie where I got to
co-star with Mark Pauline as a
evil naval officer in a
movie that he was doing. So he and I ended up
being on very good terms. But that was the
very first time that I helped somebody who had been arrested
at DEFCON and you wonder why I come back
to take this abuse again
year after year. But I just
want to thank you guys
for...
I just want to thank you guys for making my life
so fun and have a good rest of your evening.