start	end	text
13400	20560	Thank you all so much for coming here to hear my speech at 8 o'clock on a Saturday night.
20680	26620	I'm not sure why I got... how I managed to pull this particular time slot.
26620	31340	This is a time when people would rather be breaking the law than learning about the law.
31340	35760	But I'll do my best to try to keep it interesting and also maybe try to keep it short
35760	40260	and maybe we can have something like a conversation following this.
40260	45080	So, for those of you who don't know me, my name is Jennifer Granick
45080	49540	and I am the Executive Director of the Center for Internet and Society,
49540	53900	which is a public interest internet law program at Stanford Law School.
53900	57940	And as part of our program, we have conferences, speakers,
57940	63240	things to study the interaction of civil liberties, the public interest in computer technology.
63240	69440	And I also teach a class there, which is a practical course for law students
69440	71820	which is called the Cyber Law Clinic.
71820	75360	And we take cases and provide people with pro bono legal services
75360	78080	and students get to work on the cases and learn how to be lawyers
78080	81680	and I get to work on issues that I think are important and interesting.
82040	87920	So, I am a teacher but also a litigator in that capacity.
87920	91880	I came to this job from my background as being a criminal defense attorney,
91880	96120	which I can tell you has been an extremely useful background this week.
96120	100300	And we may get a chance to talk about that a little bit while I am up here.
100960	105360	Okay, so my conception for this talk was that I wanted to actually have a really large audience
105360	108680	and I thought, how else do you have a large audience other than to survey everybody
108680	112140	and find out what questions they are interested in and then answer those questions.
112140	118160	So I took an extremely informal survey that my father would think is completely statistically inaccurate
118160	120460	and I came up with the following questions.
121460	122920	And there we have some of them.
122920	126540	I came up with about ten questions that I thought that people would be interested in.
128820	132200	And for those of you who responded to my survey, thank you very much.
132440	136720	I swapped out one of the old questions to give us question number nine
136720	143560	because I think that there is a lot of interesting things to say about that from a legal standpoint.
143560	148320	And the thing about it, the thing about the whole issue that interested me from a legal standpoint
148320	152200	and I will give you some idea of my sense about what the law is behind all of that.
152200	154920	So these are the ten questions that I'm going to be answering.
155380	157560	And I think since we have, I see some more people coming,
157560	161260	but I think when I did a similar kind of format at Black Hat,
161260	163640	I asked for people to keep questions until the end.
163760	168700	But I think here, since it's kind of a small group, I think I can manage to take questions during.
168700	173040	I just don't want to get bogged down on one question and not get to the point where,
173540	176280	not get to the point where we get to kind of get through all of the questions.
176280	180280	So if you have questions that are relevant to something I'm talking about at the time,
180280	185360	please just raise your hand and I'll see if I want to call on you.
185620	189740	I see somebody there with a trademark infringing Newsweek shirt,
189740	192760	which I'm going to tell my husband about since he works there.
194600	197920	It's a parody, yeah. Okay, well then you're cool, man, you're cool.
199420	203040	Alright, so when you're trying to cover ten legal questions,
203040	205560	the thing I want to make pretty clear here is that I'm going to try to give you
205560	208040	at a very high level some legal information.
208040	211880	This isn't legal advice and it's not a substitute for talking either, you know,
211880	214880	specifically with a lawyer about your specific situation.
214960	219120	But I think one of the things that's wrong with the law, and especially the law in this area,
219120	223080	is that it's so complicated that it's hard to kind of get a sense of, like, what the deal is.
223080	226820	And of course every time you ask a lawyer what the deal is, the lawyer will always answer,
226820	230600	I mean, if they're giving you the truthful answer, the answer is always, well, it depends.
230820	236540	And it depends isn't really all that helpful, I can't, but it's always the right answer.
236540	239380	So I'm not going to give you an answer that's any different from it depends,
239380	243800	I'm just going to try to give you some sense of what factors it depends upon,
243800	248700	and then, you know, hopefully that gives you a sense of what matters in all of these issues.
251840	256780	Okay, so as you know from reading my questions, the first question that people asked was about wireless.
256780	259740	And why did I think that wireless would be an interesting thing to talk about?
259740	262940	Well, for those of you who are readers of the internet,
262940	270680	you know that there was very recently a case in Florida where a Florida man was arrested for using wireless networks.
270740	273500	And he was charged with a crime under the Florida law.
273500	276780	So people wonder, is it a crime to use open wireless networks?
276780	281280	Because if so, I think probably there's a lot of people here in the audience, myself included,
281280	283220	who have been committing some crimes.
285620	290320	No one else needs to confess, I'll do the confessing for us.
290320	293820	I think the important thing about wireless is that when people say,
293820	296840	well, I'm using a wireless network, there's a couple of different things you could mean,
296840	299520	and different laws are going to apply to these different activities.
299520	305400	So depending on what you're doing, we can see which laws might apply.
305700	310100	The Florida case is a relatively rare situation.
310100	318860	I personally am only aware of two other instances in which people have been charged with accessing a wireless network.
318860	324000	One is a case that I was involved in in California, which later morphed into a case about something else,
324000	326300	and the wireless was no longer an issue.
326300	331880	And the other was a federal prosecution of a man named Stephan Puffer in Houston,
331880	336180	and he was acquitted following a jury trial.
336180	342380	So those are the only other two instances I'm aware of in which somebody was prosecuted for wireless.
342400	347400	So let's take the more easy instances first and see what laws might apply.
347400	350040	First, accessing stored files through the network.
350340	357320	So the law that applies to protecting stored files is the Electronic Communications Privacy Act,
357320	360700	and I put the text of the statute up here for you,
360700	364580	but I want to take a moment to touch on, or to really kind of talk about,
364580	368400	the two operative concepts that are the basis for this law,
368400	374760	and also for the Computer Fraud and Abuse Act, which is the anti-hacking law,
374760	376620	and for many of these computer laws.
376620	380620	And that's the issue of unauthorized access.
380980	389460	So almost all of these privacy and computer crimes that we see are based on access that's unauthorized.
389460	390580	So what does that mean?
390580	393460	Well, access could mean a lot of things.
393960	397580	I was having a conversation with my parents at dinner tonight,
397580	402420	and we were talking about what it means to kind of get behind or go into a website,
402420	405820	or sort of go behind the front page, or that sort of thing.
405820	410740	And you can talk about access as being something kind of metaphorical,
410740	415940	like if I visit the website, then that's sort of like the front page, like the front door,
415940	419860	but it's not like I'm getting into the database of information that's behind it.
419860	423940	Or if I ping and it sends me back a packet that says, yes, I'm here,
423940	428260	then it's not like I really went inside or got any of the information that's inside.
428480	430800	Or you can look at it in the way that computers really work,
430800	433100	which is you send packets and it sends you packets,
433100	437660	and when you send it packets, you're causing that machine to do something and you're accessing it.
437780	440880	Well, courts have looked at it in the more broad sense,
440880	448440	and basically the cases have read that every time you have some kind of contact with a networked computer,
448440	452020	you're sending it electrons and packets, and so you are accessing it.
452020	453540	So it has this very broad thing.
453540	459220	In no case, in none of the cases that deal with the interpretation of the Computer Fraud and Abuse Act,
459220	462560	has anyone ever been held to not have accessed the computer.
462560	467440	So access is kind of, it's like any use or connection with a networked computer is access.
467440	470700	Well, so okay, there's one element of the crime that we've all committed.
470700	472040	What about authorization?
472040	477300	Is authorization really something that helps us distinguish between legal and illegal activity?
478360	480960	So authorization could mean a lot of things.
480960	484240	It could mean that you have explicit permission,
484240	486940	or it could mean that you weren't explicitly kept out.
486940	489000	And how does the law see this?
492490	498970	Well, a lot of technological people think that authorization is kind of about what the computer allows you to do.
498970	502130	So if permissions are set in such a way that you can access a file,
502130	505410	or if the file is stored in a public space on the web server,
505410	509170	then you have authorization because the computer authorized you to do it.
509430	511590	And that's not the way that the law looks at it.
511590	517010	The law has a much more social or sociological view of what authorization means.
517010	523350	And there are many ways that you can do something that goes beyond your authorization.
523750	530550	There are cases that say that if you do something that's what a banner warning tells you not to do,
530550	532330	your use is unauthorized.
532330	535370	There are cases that say if you make access to a computer system
535370	541410	contrary to the terms of a contract or terms of service, that that's unauthorized.
541410	546770	Cases that say that if you are notified that what you're doing is unauthorized,
546770	549690	and you continue to do it, that that's unauthorized.
549690	552830	So we have cases like eBay versus Bidder's Edge,
552830	557750	in which a robot spidering program that collected auction information from eBay
557750	561210	was making unauthorized access to eBay's website
561210	566970	because eBay told the company that ran the spidering program they didn't want them there.
566970	574290	We have cases where somebody who was a former employee who had left that company
574290	578310	and was told that as a condition of your having left this company,
578310	582470	you're not allowed to compete with us, sort of a non-compete agreement.
582470	588070	And he then went on to his old company's website and collected data there about how much,
588070	591270	I think it was cruises, travel packages cost.
591270	596450	And in that case, they said, well, you were doing that to compete with your old employer,
596450	601830	and that was contrary to the terms of your termination contract, and so that was unauthorized.
601830	605750	The case that I think reads unauthorized access the most broadly
605750	612430	is a case where a former employee started working for a new competitor company,
612430	618810	but before he moved to the new company, he took a copy of his old employer's customer list,
618810	620910	and he took it with him to the new company.
620910	623270	And then the old company sued the new company and said,
623270	627330	you had your guy make unauthorized access to our computers.
627390	629890	And the new employer said, hey, he was authorized.
629890	632030	He had a password. He was still working there.
632030	635370	He was allowed to access the customer list.
635370	639130	Maybe, you know, he took a trade secret or something, but it wasn't this violation.
639130	641490	It wasn't unauthorized access to your computers.
641670	646730	And what the court said is that, no, the court said at the moment that he knew in his mind
646730	650870	that he was acting contrary to the interests of his employer,
659500	663600	all right, and that he was acting contrary to the interests of his employer,
663600	665380	his use was not authorized.
665380	666220	Well, think about that.
666220	671860	Every time you access some computer in a way that the computer owner might not like is unauthorized,
671860	673260	that's pretty broad.
673260	678460	Okay, so keep that in mind when we're talking about all of these things,
678460	682700	about what unauthorized means and whether it's really a principled way to distinguish
682700	685080	between something that's criminal and not criminal.
685080	687040	I mean, my argument is that it's not.
687040	690560	And if you look at the civil cases that interpret these, particularly the civil cases,
690560	692180	but now some criminal cases,
692180	697560	think about whether search engines or spidering robots or shopping bots
697560	699700	or those sorts of things are crimes,
699700	704420	because cases have held that all of those are making unauthorized access to computers.
704840	709640	So if you were to use wireless to access stored files on a network without permission,
709640	714480	that would be a violation of this particular law that I have listed up here.
716520	720000	What about intercepting communications that go over the network?
720000	725340	Well, there's a law that says that you are not allowed to intercept the contents of communications.
725480	726920	So when people ask me,
726920	729680	well, what if it's unencrypted just going over a wireless network?
729680	732360	Can I read it and take a look at it?
732360	733480	And I always say no.
733480	738880	And I feel even better about this after I used the wireless at Black Hat to check my email,
738880	741320	and the next thing I knew I was locked out of my email account
741320	745080	because some bozo was logged on and so I couldn't get back in.
745080	748260	I've had to change my email password four times at Black Hat.
750320	752540	I know. I know what you guys are all thinking.
752540	754880	But I'm a lawyer. Give me a break.
764080	768420	So I always tell people you shouldn't be accessing the content of communications,
768420	771160	but I do think that if anybody,
771160	774000	and it wouldn't be any of my clients who talked to me about this beforehand,
774000	777440	but if anybody ever does make this mistake and ends up getting prosecuted for it,
777440	781000	I think there might be a defense within the context of the statute.
781220	783500	The statute does have an exception in it,
783500	788060	which I think was designed to protect people who were capturing radio signals.
788060	791440	And that exception says that it's not unlawful to intercept communications
791980	796620	which are configured so as to be accessible to the general public,
796620	798760	readily accessible to the general public.
798760	803760	And I think there's an argument you could make that unencrypted communications over wireless
803760	806300	are readily accessible to the general public.
806300	809640	So hopefully none of you will ever have to mount that defense,
809640	812720	but if so, we'll see how that goes.
814500	816780	Alright, what about just using the network?
816800	819140	So this also gets us into question number two,
819140	823000	which is what are the federal and state laws regarding computer crimes?
823080	824760	And as I talked to you before,
824760	828880	the kind of triggering thing is this unauthorized access.
829120	832360	The Computer Fraud and Abuse Act, which is 18 U.S.C. 1030,
832360	834740	one of my favorite laws,
834740	837420	makes it a crime to access a computer without authorization
837420	839820	and either obtain information or cause damage.
839820	842100	It's a very long statute and there's more to it than that,
842100	843640	but you get the basic gist.
843720	849260	So the question is, is using wireless a crime under this statute?
849260	852440	And I've always thought no, just using it isn't,
852440	855120	because the wireless isn't necessarily a computer
855120	857260	and as long as you're not overusing the bandwidth
857260	861180	or doing anything to damage the network, there's no damage.
861180	862560	And in order for this to happen,
862560	864700	you have to either obtain information or cause damage.
864700	866940	So I thought that was pretty okay
866940	870520	until we started seeing these California and Florida cases.
871320	873760	So, why is it different under state law?
873760	877200	Well, state laws are phrased differently than the federal law
877200	879220	and I have here the California law.
879220	881800	It basically says you don't have to cause damage
881800	884180	and it doesn't have to be access to a computer.
884200	887560	If you use computer services without permission,
887560	889260	you may be committing a crime.
889260	892780	And this was the statute that they chose to arrest
892780	895220	the person that I was working with under.
895700	898760	Similarly, the Florida statute says that it's a crime
898760	901020	to willfully, knowingly, and without authorization
901020	904560	access a computer system or computer network.
904560	907180	And you could say that the wireless or the access hub
907180	909660	is part of the computer network.
909660	911240	So, this is kind of scary,
911240	914460	because you know that you're accessing the wireless
914460	917580	and how do they prove that it's without authorization?
917580	921080	Well, the way they usually prove it is not that hard.
921080	925160	Basically, as I said, it's kind of in the mind of the owner,
925160	926880	is the way that the law looks at it.
926880	929640	And what I have seen them do in all of my cases is
929640	932040	they get the person who's the owner of the computer system
932040	934060	to come into court and they say,
934060	936100	did you ever give the defendant permission
936100	938800	to use your computer services or computer?
938800	942440	And the owner says, no, I never gave them permission.
942440	944480	And boom, they're done, they leave, and that's it.
944480	945580	What are you going to say?
945580	947820	So, authorization's always been pretty easy,
947820	950720	or lack of authorization's always been pretty easy to prove.
951020	952760	But with wireless, how do you know, right?
952760	953660	Is there a question?
967320	969480	So, his question is, isn't it kind of implicit
969480	971100	if people leave it open,
971100	973040	that maybe you're authorizing,
973040	975420	that it's implicit that you're allowed?
977200	977940	Yeah.
979940	981740	They're saying, well, the box is called allow all,
981740	983060	and I can promise both of you
983060	985200	that people who have wireless in their house,
985200	987860	many people have never seen that box.
987860	989500	Many people just plug the thing in
989500	992800	and it just automatically allows, and that's it.
992800	996860	So, do those people want other people to make access,
996860	997940	or don't they?
997940	1003260	Some ISPs encourage you to share your broadband connection,
1003260	1005920	and some ISPs in the contract tell you
1005920	1007480	that you're not allowed to share.
1007480	1010120	But the vendors choose to leave the burden
1010120	1013460	of actually excluding or including people,
1013460	1016860	or actually including or excluding outside users
1016860	1021620	to the people who purchase the access and the wireless router,
1021620	1023620	and most of those people aren't like us.
1023620	1025320	Most of those people are more like,
1025720	1028560	as I have my poster children of my parents,
1028560	1030140	most of those people are more like my parents,
1030140	1033020	who, at best case scenario, are going to plug the thing in
1033020	1034620	and be psyched that it works.
1034860	1036720	Worst case scenario, have to call in, you know,
1036720	1039900	some expert technical assistance to help with that.
1039900	1042260	So the question is, what do you know?
1042920	1043800	Exactly.
1044140	1047240	So the question is, what do you as the user know
1047240	1048760	about what the owner wants,
1048760	1051940	just based on the fact that access is possible?
1051940	1053620	Do you really know what's in their mind?
1053620	1056500	And as long as the courts look at what's in the owner's mind,
1056500	1059820	as opposed to what might seem reasonable to you,
1059820	1060760	you're in trouble.
1061040	1065780	In the case that I was involved in,
1065780	1068380	one of the things that made them feel like it wasn't authorized
1068380	1073360	is that my client was outside of somebody's house in his car,
1073360	1076240	and they're like, why is he lurking around outside their house?
1076240	1079200	Now, that might seem like totally normal behavior to some of us,
1079200	1081040	you know, when you need to get onto the wireless,
1081040	1083620	there's nothing wrong with lurking around outside somebody's house.
1083620	1085760	But, you know, I don't know that a judge or a jury
1085760	1088800	is necessarily going to view it the same way,
1088800	1090940	and it's kind of risky to depend upon that.
1090940	1092180	And of course, you don't know.
1092180	1094560	When the access point's open, you don't know whether you're allowed
1094560	1099320	or the person's just, you know, too lazy or ignorant
1099320	1101380	to have configured it differently.
1101640	1103640	So what I have argued with these laws
1103640	1107060	is that it shouldn't be enough that you know you use wireless
1107060	1108940	and that it's unauthorized.
1108940	1112100	I've argued that you should have to know that it's unauthorized.
1112100	1114400	Like, you in your mind know that you're not allowed
1114400	1115840	to be doing what you're doing.
1115840	1118220	Otherwise, you don't have a guilty state of mind.
1118220	1121440	You're not doing anything that is, you know,
1121440	1124720	the illicit criminal thing that's what we're trying to prevent.
1124860	1127840	And much of criminal law, in fact almost all of criminal law,
1127840	1130440	requires you to have like a guilty criminal state of mind.
1130440	1132980	And that's what we do to distinguish between, you know,
1132980	1135860	where you don't get punished and where it's okay to put you in prison.
1136420	1138560	So no court has adopted that yet.
1138560	1141780	But if there are any lawyers out here who ever face some of these cases,
1141780	1143500	you can call me, I wrote a brief on it,
1143500	1145940	and I think it's pretty good, I think it's a really good argument.
1146340	1149460	But can you count on it? You know, no.
1162670	1166630	So the question is, what else could you do to make the fail-open,
1166630	1171990	to make fail-open more of a legal, like more robust legally?
1171990	1176830	So that, you know, in the absence of circumstances that clearly point to the contrary,
1176830	1180950	instead of assuming that you're not authorized, we assume that you are authorized.
1181050	1183850	And I think that, I mean, that would be great, right,
1183850	1189330	if we could communicate to courts or juries or, you know, or Congress
1189330	1194350	that, or legislatures, that in the absence of some kind of security measure
1195290	1198810	or some kind of clear notice to the contrary,
1198810	1203850	if something is accessible, we can assume that it's okay to access it.
1204270	1208150	And, you know, so there's two ways that the law develops.
1208150	1210490	The law can either develop through, well, there's many ways,
1210490	1213230	but the law can mainly develop either through statute,
1213230	1216470	where you can have that be something that a legislature would pass,
1216470	1220670	or it can develop through the common law, where through the process of judges making rulings,
1220670	1224570	something becomes conventional and is sort of the way that things are done.
1224570	1228510	And so, you know, many of these cases, what you're hoping for is to develop a common law
1228510	1233910	so that courts see that, you know, we're going to assume, we're going to assume freedom.
1233910	1238210	We're going to put the burden of security, the burden of closing something on the owner,
1238210	1240650	and we're going to not put the burden on the public to assume that
1240650	1243730	unless they're explicitly invited in, they can't go anywhere.
1243950	1246230	So that's the way that it works with the law.
1246230	1250050	I mean, there may very well be technological ways we could do that as well,
1250050	1255090	which might include making it easier for people to make their preferences more explicit
1255090	1260370	and putting maybe pressure on vendors, for example, to make that process of deciding easier
1260370	1264050	so that we don't have to assume that if it's open, it's ignorance.
1264050	1269130	We can assume that if it's open, it's intentional, and that if it's closed, that too is intentional.
1273160	1275360	Okay, so the Patriot Act and computer crime.
1275360	1278640	How did the Patriot Act change investigations of computer crimes?
1279080	1284220	Well, clearly the Patriot Act expanded surveillance in many areas,
1284220	1287780	but I'm going to talk just specifically about this particular area.
1287780	1291980	And the Patriot Act changed computer crime investigation in two main ways.
1291980	1297640	First, it made it possible to get wiretaps to investigate computer crimes.
1297640	1301580	A wiretap is a very privacy-invasive investigatory tool,
1301580	1304560	and you can't get it to investigate just any crime.
1304560	1310340	You can only get it to investigate a certain enumerated list of crimes,
1310340	1314400	kind of meant to be the more serious or the more dangerous ones.
1314480	1320160	And now computer hacking is one of those more serious or dangerous crimes for which you can get a wiretap.
1320160	1325180	It also created this computer trespasser exception to the wiretap rules.
1325200	1330260	The trespasser exception gives the government additional rights to monitor somebody
1330260	1333100	who is a trespasser on the computer system.
1333100	1337380	So if it's your system, it gives you more power to bring the government in
1337380	1339840	without the government needing to get a warrant,
1339840	1344780	and it gives the government more power to work with people who are owners of victim systems
1344780	1352540	in order to do monitoring without having to go through the same kind of...
1352540	1357540	without having to show the same level of proof that they would have to show prior to the Patriot Act.
1357540	1361220	And here is basically the terms and conditions of the trespasser exception.
1361220	1361760	Yes?
1365760	1370240	So trespasser is defined... it's very interesting, I think, how they defined it in this statute.
1370240	1376840	A trespasser is somebody who has no contractual relationship or authority to be on the computer.
1376840	1379920	And I think the thing that's really interesting about that is to contrast it
1379920	1383080	with the definition in the Computer Fraud and Abuse Act,
1383080	1385700	which says that you're just unauthorized.
1385700	1390080	And it's clear that unauthorized means you've gone beyond the terms of the contract.
1390080	1393200	Here they're saying, even if you go beyond the terms of the contract,
1393200	1396980	that's not enough to be a trespasser on this computer system.
1397120	1401540	If you have any right to be there at all, like if you're a legitimate user
1401540	1404320	and you're just exceeding your authorized access,
1404320	1407560	you're not going to be falling in under the computer trespasser exception.
1407560	1411700	You're just not... it's got to be somebody who has no authority or no right to be there at all.
1411920	1416740	And the thing that just really aggravates me about that is it shows that Congress knows
1416740	1421780	that the Computer Fraud and Abuse Act covers people who are outside of the bounds of contract
1421780	1426760	and that they're making criminal something that is just a breach of contract,
1426760	1429380	which I think is wrong and drives me crazy.
1429380	1432580	And you wonder whether maybe they just don't realize what they're doing
1432580	1436540	and then you see that they excluded people with some kind of contractual authority
1436540	1440800	when they made the trespasser exception, which shows that they knew what they were doing all along
1440800	1445080	and they just disagree with me as opposed to they don't know what I know.
1445080	1447560	They know what I know and they like it the way it is.
1451510	1454550	Okay, where can you find out more information about the Patriot Act?
1454550	1456230	Here's some places.
1456390	1462710	And basically, at this point in time, there are many controversial provisions of the Patriot Act
1462710	1466370	which are due to terminate or sunset very soon.
1466490	1472730	And the House of Representatives has reauthorized those provisions and it goes to the Senate now.
1472730	1476750	So it's actually a time where there's a lot of legal work being done on the Patriot Act
1476750	1481750	and it's a good chance and a good opportunity to get involved with Patriot Act issues.
1482730	1483470	Seth?
1487060	1489180	Today? Or yesterday?
1490300	1494680	Okay, so Seth says that the Senate passed a bill that reauthorized most or all?
1499480	1503560	Okay, so he says it has different sunset terms from the House, but they reauthorized everything.
1503560	1506800	And I wasn't reading the newspapers yesterday, so I'm totally behind.
1506800	1508900	But it shows you how fast things move, right?
1508900	1510920	So is it too late for us or what?
1517320	1521640	Okay, so it's not too late. There's still a chance to win the House and Senate conference on the bill.
1522420	1523380	Yeah, it's late.
1531730	1537690	So see what happens when they bring us down here, we're having fun in Las Vegas, and they're busy working up there on stuff we don't like.
1538810	1539450	Okay.
1540350	1545530	So, one of the questions that people had asked me is, like, when can the government surveil me?
1545530	1547210	This is question number four.
1547210	1555870	And I put that on my list of questions, and then I realized it's just simply, completely impossible to do that question any kind of justice in this format.
1557770	1558210	So...
1560420	1562860	Excuse me, I'm trying to figure out how much time I have.
1562940	1563560	Okay.
1563740	1570600	But I thought I would just, you know, make some comments about privacy and about how the laws that govern surveillance work generally
1570600	1576640	to give you a framework for what kind of things should I be looking for or asking when I'm wondering about when I can be surveilled.
1576640	1583360	So there's many different theories of privacy which are sort of operant in our law.
1583420	1591140	And what we've done is sort of, we have like this mishmash of statutes which either try to protect or totally fail to protect privacy.
1591380	1598060	And I think that you can really, sort of a useful framework for looking at privacy questions and questions of surveillance
1598060	1605200	is to ask yourself, you know, these five questions when you're looking at an issue of what is, you know, is this privacy protecting?
1605200	1608520	Is privacy protecting enough or not enough?
1608520	1616860	So, you know, we're looking at what level of proof needs to be shown for a certain kind of information depending on its sensitivity
1616860	1624780	and what safeguards are in place to make sure that there isn't any kind of, you know, unauthorized or excessive use of this personal information.
1630320	1631560	Okay.
1632600	1635620	So, a lot of people ask me questions about encryption.
1635620	1639800	The very popular topic in the survey.
1640120	1644300	And, you know, people wanted to know, you know, these sorts of questions about encryption.
1644420	1646660	Mostly, you know, is using encryption a crime?
1646660	1647840	And why did this come up?
1647840	1654860	Well, again, recently there was a case out of Minnesota in which the court appeared to be holding that
1654860	1660920	the fact that the defendant had PGP on his computer was evidence of criminal intent.
1660920	1667060	Now, for those of you who aren't familiar with the case, I can tell you basically this was a child molest case.
1667060	1674060	And the victim told the investigators that the defendant had molested her and had taken pictures of it.
1674060	1678760	And the investigators got a warrant and they went to search the defendant's computer.
1678820	1682680	And when they searched the defendant's computer, they didn't find any pictures.
1682680	1689140	So, it didn't... that portion of the victim's story was not corroborated.
1689140	1693160	And in ruling on whether or not... but they let in evidence.
1693160	1699720	The trial court let in evidence and considered evidence that the defendant had had PGP on his computer
1699720	1705040	in saying that there was enough evidence for him to be convicted of the child molest.
1705040	1709840	And on appeal, the defendant said that using the encryption evidence,
1709840	1713640	admitting the encryption evidence and using it in that way was improper.
1713880	1717560	And the court of appeal said, no, it's not improper. It's fine.
1717560	1720120	Well, there's a couple ways that you can look at this.
1720120	1725320	So, first of all, did the court say that using encryption itself was a crime? No.
1725320	1729920	So, there are not cases that say purely using encryption is a crime.
1729920	1735720	In fact, there are cases that say the encryption algorithms themselves are protected by free speech principles.
1735860	1742200	Certainly, we also have a right to communicate and a right to communicate anonymously and privately.
1742200	1745440	And so, we don't have cases that say just encryption is bad.
1745440	1747740	But is it evidence of criminal intent?
1747760	1750280	Now, remember, this is one case out of Minnesota.
1750560	1755240	And I don't know how influential Minnesota will be in other states.
1755240	1759740	But what you often find in this area is that the very first case on a topic,
1759740	1765940	even if it's kind of poorly reasoned and poorly explained, like this case is, can become influential.
1765940	1769860	So, you want to be really careful about what it is that the case really says.
1769860	1776080	And one wishes that judges were more careful about what they say that the law is.
1776320	1783500	The two ways to look at this particular opinion are either the one that we're all worried about,
1783500	1788620	which is that when you have PGP on your computer, it shows that you have something to hide.
1788620	1793960	And it shows guilty knowledge and that you're trying to keep stuff from investigators.
1793960	1799880	So, it shows you have consciousness of your own guilt.
1800180	1810420	Another way to read this very same case is that the PGP evidence explains why there wasn't evidence on the defendant's computer.
1810600	1814360	So, it wasn't that it showed that he had something to hide,
1814360	1818820	but it was an explanation for why they didn't find the pictures that they expected to find.
1818820	1822160	Maybe they were encrypted or maybe he'd wiped them or something like that.
1822160	1826300	It's unclear which of these explanations the court is adopting.
1826400	1833480	One maybe makes some kind of sense and doesn't necessarily penalize somebody for having encryption.
1833480	1838160	It just says, well, in the totality of the evidence and because I find the victim so credible,
1838160	1842040	I'm not going to say she's not credible just because I didn't end up finding the pictures
1842040	1845940	because there's other things I can look to to figure out why the pictures might not be there.
1845940	1849020	And that's something maybe we can all live with as opposed to something that says,
1849020	1852100	oh yeah, PGP, that shows that you knew you did something wrong.
1852320	1854000	A question here? I'll go to you in a second.
1869720	1874740	So, he's saying the press on the case, and I agree with this interpretation,
1874740	1880500	it wasn't that the PGP evidence alone was enough, but in context with all the other evidence,
1880500	1887580	was part of there being sufficient proof to convict the defendant of this particular case.
1887580	1890260	And I think that that's a totally reasonable reading of the case
1890260	1894900	and I think we want to be careful when we read these cases to not give them an interpretation.
1894980	1900580	And by we, I don't necessarily mean you guys, I mean we as lawyers and I was going to say we as judges,
1900580	1903240	but we all know that's never going to happen for me.
1903600	1906680	But judges also need to be very careful when reading these cases
1906680	1910200	to make sure that they're not giving an interpretation that's not warranted
1910200	1915160	and taking something that made sense in one small context and expanding it to be a general principle.
1915160	1917480	There was a comment over here. Gentleman here.
1932770	1936950	So it's a question about employees on employer's network.
1936950	1940910	And when you're on your employer's network, this gentleman is right,
1940910	1944990	you have very little privacy and that's for a couple reasons.
1944990	1950070	First of all, many of our privacy laws, like the Fourth Amendment, don't apply to private parties.
1950070	1952070	So the Fourth Amendment doesn't apply.
1952090	1957650	And many of the privacy laws that we do have, privacy rights that we're entitled to by statute,
1957650	1968210	have exceptions in them which will apply to employers and allow employers to do a lot of monitoring and that sort of thing.
1968210	1971330	So people generally have very little privacy at work.
1971330	1975010	And employers have a lot of rights to surveil.
1975010	1976750	Now we've seen limits to that.
1976750	1984390	For example, with cases that involve videotaping and changing rooms and things like that.
1984390	1988210	But a lot of times what employers will just do is say in the employee handbook,
1988210	1992450	everything you do here on your computer is something that we'll monitor and you understand that.
1992450	1993850	And that's basically it.
1993850	1998110	So work is not a great place for privacy, generally.
1998110	1999730	I'll take this question over here.
2006000	2008620	Great question, because this brings me to my next point.
2008620	2011220	And he's like, why is it not covered by the Fifth Amendment?
2011220	2016900	So this is what I'm saying about can you be compelled to turn over your keys so that they can decrypt your stuff.
2018160	2022900	And I hate to say this, because if this ever happens to one of my clients,
2022900	2026000	I'm definitely going to argue that it's a Fifth Amendment violation.
2026020	2029360	But I think the reason you would say it's not a Fifth Amendment violation is this.
2029720	2033620	Fifth Amendment, you can't be compelled to testify against yourself.
2033620	2034700	There's a couple things there.
2034700	2037180	First of all, it has to be compelled.
2037420	2042020	So the stuff you wrote that you encrypted that you don't want to turn over,
2042020	2043480	no one compelled you to write that.
2043480	2044780	You wrote that voluntarily.
2044780	2046360	So there's no compulsion there.
2046360	2048760	The compulsion, and they could search that.
2048760	2053000	If they can get access to it without violating the Fourth Amendment,
2053000	2056480	they can get it because it's not compelled testimony.
2056780	2058040	What about the keys?
2058160	2060740	You're being compelled to turn over the keys, right?
2060740	2062460	But the Fifth Amendment has a second part,
2062460	2066980	which is that what you're compelled to do is something testimonial.
2066980	2069320	And there are a lot of cases about what's testimonial.
2069320	2074240	And for example, cases say stuff like name, rank, and serial number are not testimonial.
2074240	2077700	So if you are compelled to turn over your key,
2077700	2081640	you're not being forced to say anything that's testimonial.
2081640	2087140	All you're doing is giving them the access to the stuff you wrote which wasn't compelled.
2087140	2091640	So the best argument that you have, I think, of why you can't turn the key over is
2091640	2096820	there is something testimonial about the divulging of the key,
2096820	2098380	something that is communicative.
2098380	2101940	And what that is is that you're the person who encrypted it,
2101940	2105380	that you're the person who has access, at the very least, to the information
2105380	2107200	because you've got the key.
2107540	2112540	And I think that the downside of that argument is that what a prosecutor would do
2112540	2115160	if they really wanted the stuff is they would say,
2115160	2119380	all right, you've got a Fifth Amendment right and I'm going to overcome it by giving you immunity.
2119380	2122520	Fifth Amendment rights can be overcome by giving you immunity,
2122520	2125060	which basically says we're not going to use that against you.
2125160	2127540	But they don't have to say we're not going to use what we find against you,
2127540	2130220	and they don't have to say we're not going to use the fact that you...
2130220	2134120	What they say is we won't use the fact that you had the key against you.
2134120	2137800	So you're divulging the key to the extent that it's testimonial.
2137800	2139200	We're not using it against you.
2139200	2140880	Now you have to give us the key.
2141080	2144500	And so then I think you're in a lot of trouble with your Fifth Amendment argument.
2161810	2165190	Okay, so he says, well, you know, but let's say it's somebody with whom you have a privilege,
2165190	2166490	like your wife or something.
2176860	2182580	Okay, so you don't have privilege in information you confide to another person, period.
2182580	2186560	You tell me something, if I'm not your lawyer, they can ask me and I can be forced to tell.
2186560	2190340	The reason why you have a privilege with people like your wife or your shrink or your doctor
2190340	2194200	is because the law has picked out certain relationships that it wants to protect
2194200	2196740	because it wants to encourage the free flow of communication.
2196740	2200400	And it's got certain little enumerated categories that it falls in there.
2200400	2204300	And the reason why it does that is because it's protecting that relationship.
2204320	2208080	Now the spousal privilege, they're protecting it because they don't want to tear your marriage apart
2208080	2211240	by forcing your spouse to testify against you.
2211240	2214740	And they want to make sure that marital communications flow back and forth.
2214740	2219620	But if I write a letter to my husband and it's in my house and they have a right to come search my house,
2219620	2223720	like let's say they have a warrant and they find a letter to my husband, they can use it against me.
2223760	2230140	Just like if you rob a bank and you tell your lawyer, you tell your lawyer I robbed a bank,
2230140	2233520	that doesn't mean that they can't use that statement against you.
2233520	2236900	It just means they can't make me testify that you told me that.
2242700	2250360	Well then the question is, is decrypting a violation of privacy?
2250480	2256640	And what I would say to that is, even if the law says that the fact that you encrypted it
2256640	2259980	shows you have an expectation of privacy in the information,
2259980	2263860	expectations of privacy can be overcome with warrants.
2263860	2269940	If there is probable cause to believe that it's a crime, you may very well have an expectation of privacy,
2269940	2273980	but it is a conditional right which is overcome with a warrant
2273980	2277420	or if there's some exception to the warrant requirement.
2277420	2281420	So just the mere fact that you encrypt it isn't going to give you any kind of absolute protection
2281420	2284000	under either the Fourth Amendment or the Fifth Amendment.
2284380	2287220	I'm going to take this gentleman in the back with the glasses.
2301810	2304130	This is why I love speaking at DEF CON.
2304130	2307510	I never get questions like this at Black Hat.
2320500	2324110	So if I'm married to an android, can it be compelled to...
2327800	2329340	That's a great question.
2329340	2334780	I don't know whether the law would be willing to recognize a privilege between you and a machine
2334780	2339000	even if the machine was serving the purpose that somebody
2339000	2343250	who would otherwise fit under a privileged relationship with you would have.
2343620	2344720	And that's the question.
2344720	2350500	You would have to ask, is the law prepared to protect this person's relationship with the machine
2350500	2354380	the same way that we would protect this person's relationship with a real wife
2354380	2358460	or a real shrink or a real priest.
2359540	2368640	I mean, I'd be speculating, but I'm going to guess maybe not.
2368640	2371240	That's a great question.
2372180	2375260	Wait, can I just... I'm sorry. I'm laughing at your question, but I actually...
2375260	2378880	I'm laughing because it's a fun question, but it allows me to say something,
2378880	2382700	which is that this is the way we deal with stuff exactly in the law, right?
2382720	2385280	You've got computer technology that evolves.
2385360	2386800	I mean, because it's a beautiful question.
2386800	2390380	So you've got computer technology that evolves, and we have these old rules from way back.
2390380	2394340	And now we've kind of got to decide, like, what are we going to do with these old rules in this new world?
2394340	2396300	And so the law has trouble with this.
2396300	2398120	Like, the law just doesn't... and the question is...
2398120	2402020	What we try to do, really, is we try to go back to the reason why we had the law.
2402020	2404260	I mean, in our best moments.
2404380	2408160	We try to go back to the reason why the law existed in the first place
2408160	2411500	and try to preserve those values now into the new world.
2411500	2415820	Which is why I say we'd have to ask whether society or courts would be prepared to say
2415820	2422440	that the interrelationship between me and digital psychiatrists is deserving of the kind of protection
2422440	2425840	that the relationship between me and flesh-and-blood psychiatrists was.
2425840	2427760	And if so, we're going to say yes.
2427760	2429460	And if not, then we're going to say no.
2429460	2430880	Similar question with bloggers.
2430880	2433740	Do bloggers get the same kinds of rights as journalists?
2433740	2436500	You know, we have all of these situations where we have new technology
2436500	2440120	and we're looking to our old rights and privileges and saying, you know,
2440120	2441540	how are these going to be in the new world?
2441540	2447200	So I laughed at your question, but it is the fundamental question that I spend my whole life studying.
2447280	2451720	Which is, what are we going to do with these old laws in this new context?
2451720	2457680	So lest you think I was laughing at the question, I really just enjoyed your scenario.
2458180	2458720	Yes.
2473370	2475770	That's K-I-T-T-Y porn, right?
2475990	2477090	Yeah, I thought so.
2484870	2486750	It's very hypothetical.
2514250	2520550	I mean, yes, what I would say is the stuff that you wrote down, that you then encrypted,
2520550	2524510	the way the law would look at it is say, that's not compelled because you wrote it down voluntarily.
2524510	2527890	And his question, I'm sorry, his question was basically, you know,
2527890	2530830	is there a difference between saying, I'm compelled to testify,
2530830	2536490	versus I'm compelled to give them something which lets testimony against me happen.
2536490	2540070	And what I would say is that, yes, there is a difference,
2540070	2543330	because the Fifth Amendment only applies to compelled testimony,
2543330	2548490	and this is where they're compelling you to get something that's...
2548490	2553350	or the testimony was not compelled, and they're compelling you to give something that's not...
2553350	2557730	Okay, so testimony, or the thing you encrypted was not compelled,
2557730	2560670	and they're just compelling you to give them something non-testimonial, which is the key.
2560670	2562510	So I don't think that that would work.
2575290	2577910	I'm not sure what your question is, but let's go for it.
2578010	2579970	Let me just get through the rest of these slides, and then we'll go.
2580050	2581210	I'm not saying you're compelled.
2581210	2586430	I'm saying, let's say I write in my journal, I killed him, and then I encrypt it.
2586870	2589790	When I wrote I killed him, I wasn't compelled to write it.
2589790	2591150	Fifth Amendment doesn't apply.
2591150	2594450	I encrypt it, and now I have to turn over my key.
2594470	2596110	The key's not testimonial.
2596110	2597970	They can compel me to turn it over.
2597970	2600730	Then they get access to my non-compelled testimony.
2600750	2602030	I'm the one who killed him.
2602230	2603050	Boom, you're done.
2604230	2605870	Okay, statute of limitations.
2605890	2608430	Now, I put this in because I thought this would be a nice, easy question,
2608430	2611730	because statute of limitations, if there's an answer, I should just put a big number up,
2611730	2615650	which will be the number five, and that'll be great because, you know,
2615650	2619010	so many of these questions are it-depends kind of complicated questions.
2619010	2621730	But even the statute of limitations isn't clear,
2621730	2624750	because while there's a five-year statute of limitations for computer crimes,
2624750	2629370	there's another statute that allows courts to suspend the running of statutes of limitations
2629370	2632450	when they're doing investigations that involve evidence in a foreign country.
2632690	2633910	Statute of limitations.
2644360	2647140	Is the content of the key testimony? No.
2647940	2649640	Okay. Logs as evidence.
2649640	2651100	So, a lot of people think...
2651640	2654380	You had a question before, so I'm going to let you ask it.
2659190	2663310	He asked me if there's a notification requirement for an extension of the statute of limitations.
2663310	2666050	I think that's an excellent question, and I don't know the answer to that.
2666050	2668730	So, I'm going to have to look that up, and I'm going to have to get back to you.
2668830	2672670	So, will you email me, my email's on the thing, and make sure that I tell you?
2672670	2673930	Because I don't know.
2674750	2676590	Okay. Logs as evidence.
2676590	2680290	So, a lot of people who are technological people feel that, you know,
2680290	2687170	we know how malleable digital data is, and we feel like there's a very high standard,
2687170	2690030	for admitting logs, computer logs, as evidence.
2690130	2692970	And I think people are always surprised at the extremely...
2692970	2695150	That was good, actually, by the way, that you stumped me.
2695150	2698290	I think that there might be a prize in that for you.
2699910	2701790	I was going to buy him a drink.
2703190	2706830	A lot of people think that you have to, you know,
2706830	2709070	that you have to show that it wasn't tampered with,
2709070	2711830	and that you have to prove that it is exactly the right thing.
2712150	2714810	Sort of, it's almost like the reverse is true.
2714810	2717510	All you have to do to get computer logs admitted as evidence
2717510	2721810	is just show that it is basically what you, as the proponent of the evidence,
2721810	2722550	purport it is.
2722550	2724210	Show that it's reliable enough.
2724210	2726810	And what they do is they bring in the person whose computer it is,
2726810	2728790	you know, who is the system administrator,
2728790	2731710	and he says, yes, we have this computer set to log,
2731710	2734590	and it logs in the regular, normal course of business.
2734590	2738150	And these are the logs, and I pulled this off of the computer
2738150	2740850	in the place where the log files are stored, and here it is.
2740850	2744450	And it looks pretty much like what it was that I pulled off the computer.
2744450	2749490	And at that point in time, the court will say, okay, I'm ready to admit it.
2749490	2751910	And you can say, yeah, but I mean, he could have edited it.
2751910	2752570	What was, you know...
2752570	2755450	In fact, I've had logs that were edited, admitted.
2755450	2759650	I've had logs where they basically cut out all of the extraneous data,
2759650	2762290	leaving behind only the data that showed that it was my client
2762290	2764590	who had been accessing their computer and said, you know,
2764590	2767210	I just, to make it shorter for you, your honor,
2767210	2769910	I just, you know, left in the important, relevant stuff,
2769910	2771730	and I didn't put any of the other stuff in there.
2771730	2773210	So, you know, here's your log.
2773210	2775290	And I was like, you know, you can't do that.
2775290	2778270	And the court was like, well, he says that this is accurate,
2778270	2780790	and so, you know, I'm willing to believe it
2780790	2782890	unless you can show me that it's not accurate.
2782970	2786910	And what usually happens then is you try to show that it's not accurate,
2786910	2789150	and the courts say, well, maybe there might be some question about it,
2789150	2790730	but I'll let the evidence in,
2790730	2793610	and then the trier of fact can decide what weight to give it.
2793610	2796850	So computer logs have been something that courts have been very forgiving about,
2797390	2799130	particularly in my experience.
2803270	2804230	Okay.
2804590	2806150	This is why I sort of wanted to rush
2806150	2808790	to make sure that we had a little bit of time to talk to this stuff.
2809830	2812970	So I think that probably everybody here is familiar with
2812970	2817070	or has heard about the lawsuit that happened earlier this week
2817070	2819830	after Mike Lynn's talk on Wednesday at Black Hat.
2819830	2822110	And I was involved in that case,
2822110	2826810	helping Mike with the aftermath of his talk.
2826850	2827790	Thank you.
2833820	2835580	You know, and while I was doing that,
2835580	2839280	particularly when we were in the six-hour settlement conference
2839280	2841300	with the nine attorneys from the other side
2841300	2843060	trying to hash out a settlement agreement,
2843060	2845780	I was thinking to myself, I can't believe I'm doing this.
2845780	2848720	I'm in Vegas, and I've been up since six in the morning,
2848720	2849720	and I'm working on this.
2849720	2852020	And I thought to myself, you know, and I'm not even getting paid.
2852020	2855500	And then I thought, but I'm really saving a lot of money by not gambling.
2855500	2858740	So actually, I'm way ahead here.
2858740	2861620	So I have Mike to thank, at least for that.
2862460	2865280	But I think that one thing we haven't done a lot of talking about,
2865280	2869240	and I know that there's been a lot of talking and rumors and all of that stuff,
2869240	2874120	and I can't talk about the facts of the case or anything like that,
2874120	2875980	and I don't want to take any questions on that,
2875980	2877760	but I do want to talk a little bit about the law
2877760	2883960	and how it was that they claimed that what he did was improper.
2884520	2889780	So basically, this was a case that involved California's Trade Secret Act.
2889780	2895000	And the Trade Secret Law prohibits the misappropriation of trade secrets.
2895080	2897520	So what's a trade secret?
2903490	2907070	All right, so this is awesome that you guys are here.
2910990	2914110	We have, first of all, this is Mike's cape.
2914110	2917970	We made him a superhero cape to go with his hat.
2918170	2923110	And we're going to use it right now to let Jennifer change into her present that we got her.
2923990	2926290	And Jennifer, she's doing such an awesome job.
2926290	2928390	She can probably share this cape with Mike.
2928390	2929950	She's just doing such an awesome job.
2930350	2931150	Yeah!
2938310	2940210	You guys look fabulous.
2941490	2942470	All right, thank you.
2942470	2943990	But I want that cape, though.
2945430	2947210	Did you guys see the Incredibles?
2947510	2948730	No capes.
2952610	2954670	Oh, that's beautiful.
2954670	2955930	I'll make sure he gets it.
2956770	2957930	Thanks, you guys.
2960250	2961390	Trade Secret Law.
2961390	2962990	It's very serious business.
2965590	2970830	So a trade secret is information that derives its value from the fact that it's not...
2970830	2972710	All right, you guys are making me laugh.
2973950	2979990	A trade secret law is information that derives its value from the fact that it's not generally known to the public.
2980090	2981730	So that's thing number one.
2981730	2984730	And so the first thing you have to ask yourself when you've got a trade secret case is,
2984730	2986350	what's the secret?
2986350	2989710	Is it the kind of thing that's protected by trade secret law?
2989710	2993390	And then the second thing you ask yourself is, what's the misappropriation?
2993390	2996550	So there's two possible claims here.
2996550	3002010	One claim is that the information that he had about what the flaw was,
3002010	3007910	was a trade secret to his employer, or rather I should say his ex-employer, ISS.
3007910	3010350	The other possibility is that the case is about...
3010910	3015290	that there's something about the Cisco code that remains a trade secret to Cisco.
3015290	3017010	So... question.
3024500	3026640	So his question is about whistleblower laws.
3026640	3030840	So let me make sure that he's a researcher, but let me get to that.
3030840	3036740	Because my second summer of law school, I worked at this whistleblower place in DC.
3036740	3038420	So I know a bit about the whistleblower laws.
3038420	3041980	But my particular whistleblower specialty is FIFRA,
3041980	3046120	which is the Federal Insecticide, Fungicide, and Redenticide Act.
3046120	3050280	And I did a white paper on the whistleblower provisions of FIFRA.
3050280	3056200	So if anybody here has any rodenticide researcher issues,
3056200	3060180	I think that I'm the person most qualified to respond to those.
3061040	3062900	You laugh, but it's true.
3063760	3067940	Okay, so then the question is, was it misappropriated?
3068060	3071800	And so, what is misappropriation?
3071800	3079820	Well, the statute says, specifically, that reverse engineering is a proper way of discovering something,
3079820	3081580	even if it's a trade secret.
3081760	3085860	And reverse engineering is specifically allowed under California law.
3085860	3089880	And I have quoted here for you what the California law is about reverse engineering.
3089880	3093100	And you can see, reverse engineering or independent derivation alone
3093100	3095200	shall not be considered improper means.
3095200	3096780	So that's an important thing, number one.
3096780	3099680	But the other important thing about this statute is it does say
3099680	3103920	that it's improper if you breach a duty to maintain secrecy.
3103920	3106200	Okay, so we've got these two functional things here.
3106200	3108920	One, is there a duty to maintain secrecy?
3108920	3113340	And two, or was it independently derived?
3114300	3119820	So, the issue in the case is basically, you know, what did he disclose
3119820	3125360	and was it in violation of some duty to keep it secret or was it independently derived?
3125380	3129440	So, a violation of a nondisclosure agreement, for example,
3129560	3134060	a nondisclosure agreement with an employer, might be a trade secret violation.
3134060	3137200	But that, if you read the complaint, wasn't part of the case.
3137200	3142140	There wasn't a claim that he had disclosed something that was a secret
3142140	3144860	and was proprietary to his employer.
3144860	3147900	What the claim was, really, if you looked at the complaint,
3147900	3156080	was that the machine code that he had disassembled from the Cisco binary
3156080	3162400	was a trade secret as to Cisco and that he revealed that information to the public
3162400	3165960	when he showed his slides at the presentation.
3165960	3170020	And so, the question there, clearly, the statute clearly says,
3170020	3173120	although, of course, they don't cite the statute in their papers very much,
3173120	3175780	the statute clearly says reverse engineering is okay.
3175940	3179040	Reverse engineering alone isn't improper.
3179040	3181980	And they said, well, it's not reverse engineering alone,
3181980	3184800	it's reverse engineering in violation of our EULA.
3184800	3187920	Because when you get the Cisco, you know, when you get the Cisco router,
3187920	3192000	our EULA says, and for those of you who don't know, it's the end user license agreement
3192000	3197560	or terms of service for use of the machine, our EULA says no reverse engineering.
3197680	3200520	So, now, EULAs have a lot of issues.
3200520	3204460	And I think I've decided that next year for me is going to be EULA year
3204460	3207080	and I'm going to be worrying a lot about EULAs.
3207160	3212880	And one of the ways that people have always attacked EULAs has been on the issue of formation.
3212880	3216540	Is it really a contract if you just slap some warning on your product
3216540	3220480	and I never click I agree or, you know, have any kind of, you know,
3220480	3223460	intention to enter into a contract with you.
3223460	3229580	But I don't believe personally that attacking EULAs solely on the grounds that it's not really a contract
3229580	3234420	because we never had this offer and acceptance meeting of the minds that's required for contracts to happen
3234420	3237920	is a very fruitful process.
3237920	3242820	I think that it's a dead end in the long run because we'll end up with things where they'll make you agree
3242820	3245880	and most people will agree to something like no reverse engineering
3245880	3251860	and those few people who do care to reverse engineer just simply won't be able to buy the product.
3251940	3254820	But we can talk more about that in question and answer.
3254820	3259540	I think the question that was really raised by the lawsuit in this case
3259540	3265940	and the thing that made me super interested in it was the question of whether the violation of a promise in the EULA
3265940	3273080	i.e. a promise not to reverse engineer is a violation of the trade secret law.
3273080	3278720	Something beyond simply having reverse engineered and independently derived it
3278720	3286420	the violation of some kind of promise that makes something that ordinarily might just be a contract breach a crime.
3286420	3289460	Or at the very least something that imposes civil liability.
3289460	3295360	And as you may have guessed from my comment before about the website terms of service
3295360	3297500	and employment contracts and that sort of thing
3297500	3301780	it really makes me mad when suddenly breaches of contracts are crimes.
3301780	3305060	It's just not something that used to be true in the law at all.
3305060	3309800	In fact, breaches of contracts are things for which you can't even get punitive damages usually
3309800	3315100	because the law likes to see people breach contracts when it's economically efficient.
3315100	3319040	So if I have a contract with you, but I can make more money with somebody else
3319040	3321020	I'm allowed to breach the contract with you.
3321020	3322900	I pay you what you expected to get
3322900	3328800	and I get to reap the profit of the fact that I got to enter into a contract with somebody else
3328800	3330600	and the law is happy.
3330600	3334400	There's no moral opprobrium that attaches to breaches of contracts.
3334400	3338620	So it really bothers me to see these kinds of things made criminal.
3338720	3342180	And I think that one of the things sort of in the bigger picture that the case raised
3342180	3346300	is this question of is there a limit to the enforceability of EULAs
3346300	3350620	and can EULAs be the grounds for these sorts of other kinds of offenses.
3350620	3352520	I have a question from this gentleman here.
3358640	3361980	So the question is if the information is discoverable by reverse engineering
3361980	3364440	is it a trade secret and the answer to that is no.
3364520	3368260	Because first you did not obtain it by improper means.
3368440	3371640	You discovered it. No longer a secret.
3371680	3373160	So it's no longer a trade secret.
3373160	3375660	So the answer is basically no.
3375660	3377260	There's a question from this gentleman in the green.
3386490	3389530	We don't have a decision in Blizzard yet, right?
3389590	3400030	Okay, so I will answer your question.
3400030	3406110	So Blizzard versus BnetD is a case that involves a manufacturer of one of these multiplayer games
3406110	3409150	and some people who reverse engineered that game and built their own server
3409150	3411590	on which people could play the games compatibly.
3411650	3415190	And the case is now on appeal, which is why I said there wasn't a decision,
3415190	3418990	but this gentleman is right that there was a decision from the trial court below.
3418990	3424130	And what the trial court below said was that if you have a user agreement
3424130	3428310	that says no reverse engineering, then those terms are enforceable.
3428310	3430170	There's another case that says the same thing.
3430170	3431970	It's Bowers versus Baystate.
3431970	3436150	And that case also says terms in EULAs are enforceable.
3436150	3440430	And the EULA picture is this, to kind of give you the big picture of where we're at.
3442150	3445090	So contracts require offer and acceptance.
3445090	3447050	This really was one of my favorite classes in law school
3447050	3448950	because it's so beautiful if you think about it.
3448950	3452550	There's an offer, there's acceptance, there's mutual consideration,
3452550	3454010	there's this meeting of the minds.
3454010	3455410	It's very romantic.
3455410	3460830	But those things are required, right?
3460830	3464670	So a lot of cases that involve things like click wrap or browse wrap,
3464670	3468190	we have cases that say if there's not actually an offer and acceptance,
3468190	3469270	then it's not a contract.
3469270	3471330	So if it's just something that says legal at the bottom
3471330	3474370	and you don't have to click on it or agree or anything,
3474370	3477910	then it's not a contract and you're not bound by those terms.
3478110	3481250	And there's other situations where you don't have notice or something like that,
3481250	3484490	or maybe you do have notice and you continue to use the site.
3484490	3486890	So the question is, is there agreement to the terms?
3486890	3489470	And those are things I would call formation issues.
3489470	3491050	Was there a meeting of the minds?
3491050	3494930	Did the person know what the terms were and manifest their assent,
3494930	3498270	either through clicking OK or for using it or something like that?
3498270	3499770	So formation issues.
3499870	3502950	If there's formation, there's offer and there's acceptance,
3502950	3507210	either through actual clicking OK or through notice and continued use,
3507210	3509970	then you're into the question of whether the terms are enforceable.
3509970	3513810	And my fear is if you have every term be enforceable no matter what,
3513810	3518430	you can have EULAs that say, no talking nasty about this product.
3518450	3522510	And maybe 95% of the people in the world don't want to talk nasty about the product.
3522510	3524090	They just want to buy it and use it.
3524090	3526150	And so most of us will just agree.
3526150	3528930	And those people who do want to talk nasty about the product,
3528930	3531350	the company doesn't need to sell to them.
3531430	3535050	And so they'll never be able to buy it.
3535050	3536210	They won't sell it to them.
3536210	3538330	And they won't buy it and they won't have access to the product,
3538330	3541630	so they won't be able to test it or benchmark it or anything.
3541630	3543970	And all the rest of us will be happily using the product
3543970	3547170	and no one will be allowed to tell us that the product stinks.
3547530	3551390	So, you know, when I say that I think next year will be EULA year,
3551390	3553130	the thing that I'm really concerned about is,
3553130	3556130	are there limitations to the terms that will be enforceable in EULAs
3556130	3559890	when you have a situation where the term is contrary to public policy?
3560130	3561850	Individually it might not be a big deal,
3561850	3564930	but in aggregate it deprives the public of the right to know something
3564930	3567990	or the right to do something that has great public benefit.
3567990	3569550	A question right here.
3601840	3605660	Okay, so his question is, you know, how far does the contract extend?
3605660	3608380	So if I buy it with, you know, if I buy somebody's product,
3608380	3611080	maybe I agree to the EULA, but when I sell it to somebody else
3611080	3613860	and the software is already installed and everything,
3613860	3615900	you know, those people, the second, you know,
3615900	3618560	the second purchaser hasn't agreed to the contract,
3618560	3621780	so maybe the second purchaser isn't bound by it at all.
3621780	3624380	And I think that, you know, in some ways that's a good argument.
3624380	3628040	I actually, I'm not 100% sure of that question,
3628040	3630940	but I think that, you know, you could make me agree to terms of contract
3630940	3634740	simply by selling something to me without my also having notice.
3635040	3636900	So I think that that may be sort of a break.
3636900	3639700	And, you know, if I were going to buy your machine
3639700	3642880	with your ancient copy of Microsoft Windows on it
3642880	3645280	and continue to use it without reinstalling or anything,
3645280	3648900	maybe I wouldn't be bound by that, by those terms.
3648900	3651860	But if I, let's say then I decided that I was going to criticize
3652680	3655720	Microsoft's product or something, and they wrote to me and they said,
3655720	3658980	hey, we hear you're criticizing us, and that's contrary to our EULA,
3658980	3663300	you can't either stop criticizing us or stop using our product,
3663300	3664580	then I'm on notice.
3664580	3668120	And what a lot of the cases say is that notice plus continued use
3668720	3671380	will bind me to the terms of the contract.
3671380	3675340	So, you know, it hasn't always been a great defense.
3675340	3677540	Well, I don't know about the terms or I've never agreed
3677540	3680480	because they managed to get you when they do the,
3680480	3682320	we're going to get to see the food again.
3691810	3692530	Right.
3693450	3695790	So this gentleman's point is, well, at that point, you know,
3695790	3698430	you didn't break the contract, so you could just stop using it
3698430	3702550	and continue to be free to say or do whatever you want at that point,
3702550	3704450	and I think that that probably would be right.
3704730	3705330	Yes.
3712230	3716490	So his question is, what if I spent a lot of money on it
3716490	3719030	and either they tell me to stop using it or, you know,
3719030	3721990	then I learn that the terms of service are something that I don't like.
3721990	3725810	And there was a class action suit in California on this issue
3725810	3727490	because of shrink wrap.
3727490	3730810	So people buy software, they take it home, they open the box,
3730810	3732850	they see these restrictive license terms,
3732850	3734150	they don't want the software anymore.
3734150	3736070	So they take it back to Best Buy, and Best Buy's like,
3736070	3737910	we don't take your open software.
3737990	3740290	So then they try to return it to the vendor, and the vendor said,
3740290	3743370	we don't take your open, you know, we're not taking that back either.
3743850	3745050	And so what do you do?
3745050	3747210	So there was a class action suit in California,
3747210	3749650	which said basically, you know, if you're going to do this,
3749650	3750990	if you're going to have your terms of service
3750990	3752230	on the inside of the box,
3752230	3753570	or if you're going to have your terms of service
3754050	3756170	pop up only when you install,
3756170	3757930	you've got to let people take it back
3757930	3759130	and get their money back.
3759130	3762750	So practically, that never happens,
3762750	3764810	but legally it's supposed to happen.
3765090	3766850	All right, some other questions?
3766850	3768010	I can take a few more questions
3768010	3770110	because the people who are coming after us are late.
3770110	3771370	So let's go for like three more minutes
3771370	3773050	if anybody has other questions about this.
3773050	3774390	Let me just do my last slide.
3774390	3775570	So when to talk to a lawyer.
3775570	3777430	So as you can see, this is really complicated.
3777430	3779310	And so, you know, you sort of
3779310	3781270	almost always need to talk to a lawyer,
3781270	3784230	unfortunately, which is too bad for you guys,
3784230	3785670	but great for lawyers.
3786930	3787570	You know,
3787570	3789350	the law is really complicated,
3789350	3791410	and if you feel like, I definitely know,
3791410	3792950	I'm doing something that I thought was kind of
3792950	3795510	maybe risky, but now I definitely know
3795510	3797390	that it's either illegal or illegal,
3797390	3799130	then you definitely need to talk to a lawyer
3799130	3801650	because if you think that the answers are really clear,
3801650	3803670	then you're not getting it at all.
3803670	3805530	If you think that the answer is,
3805530	3808290	it depends, and I kind of know what it depends upon,
3808290	3809750	but maybe it depends on more things too,
3809750	3812030	and I might need to get a little more advice on this,
3812030	3813350	then you're in good shape.
3813370	3816650	So that's the sort of finale of my talk.
3816650	3817790	And I'll take a couple more questions
3817790	3818890	if there are some.
3818890	3820290	I'll take one here.
3827900	3829620	Is reading the machine code
3829620	3830820	reverse engineering?
3831520	3833080	I think here
3833080	3834500	it was,
3834500	3837080	I think here we agreed it was reverse engineering
3837080	3839300	because he decompiled it from the binary.
3839380	3841240	But if you've got machine code,
3841240	3843560	reading it is, I mean, reverse engineering,
3843560	3845000	the courts have looked at reverse engineering
3845000	3846740	as being a lot of things.
3846740	3848060	Testing, you know,
3848620	3850740	trying to watch processes
3850740	3853100	and replicate,
3853740	3854520	decompiling.
3854520	3856680	So a lot of things are reverse engineering,
3856680	3858880	but I mean, either it's legal
3858880	3860620	because you're reading something that's already written
3860620	3862480	or you're reverse engineering.
3890080	3891660	So what he's saying,
3891660	3892420	what his comment is
3892420	3893580	that he doesn't think machine code
3894800	3896180	is either secret
3896800	3898700	or is reverse engineering.
3898700	3901280	And I think there's a good argument for that.
3915140	3916700	The beer is not here yet,
3916700	3917840	so you have to,
3917840	3919760	so I'm going to, which is a tragedy,
3919760	3921800	so I'm going to take a few more questions
3921800	3922840	if people have other questions.
3922840	3924180	This gentleman in the back.
3930090	3931370	But for those of you,
3931370	3933230	I'm going to try to take questions still,
3933230	3934790	so you guys have to be kind of quiet
3934790	3936310	because I can't hear what he's saying.
3943580	3944520	So the question is,
3944520	3946200	do I think Cisco got what they wanted
3946200	3947380	out of the case?
3948480	3950860	I'm, you know, I'm not a
3950860	3952760	researcher, so I may be a little more
3952760	3954740	compassionate to most of the players
3955120	3956760	in this than other people are.
3956760	3958380	I think Cisco definitely didn't get
3958380	3959800	what they wanted out of this case.
3959800	3962560	I mean, I can tell you what their point,
3962560	3964580	what they thought they were doing
3964580	3966800	was. And in the settlement agreement
3966800	3968440	that we entered into to
3968440	3970120	settle the civil case,
3970700	3972840	Cisco and ISS insisted
3973760	3974740	that the settlement
3974740	3976600	agreement say that Cisco
3976600	3979100	and ISS were working together on a
3979100	3980720	presentation that would have revealed
3980720	3982660	the problem without revealing stuff
3982660	3985340	that they felt was trade secret information.
3985340	3986960	Now, I have no information
3986960	3988800	personally whether or not that was true, because I came into
3988800	3990560	the whole thing, you know, after that.
3990560	3992580	But I think that what Cisco,
3992580	3994540	if you asked them, and I'm not them,
3994540	3996520	but to try to be fair to them, I think what they would
3996520	3998580	have said is that they really had
3998580	4001060	certain things that they definitely didn't want,
4001060	4003200	which was the code and the pointers,
4003200	4004660	and that they ended up getting
4004660	4006660	exactly, totally not what they
4006660	4008620	wanted in all of this, because all of
4008620	4011060	that came out, and they look bad,
4011060	4012880	and they had to pay lawyers,
4012880	4014480	and they had to pay to have the
4014480	4016720	materials taken out of the presentation stuff,
4016720	4018320	and they had to pay to get rid of the CDs
4018320	4020560	and make new CDs. So they have
4020560	4022460	had a really bad week, in addition
4022460	4024020	to the rest of us
4024540	4026020	having a really bad week, too.
4026380	4028600	I know it was tough, but I got a cape out
4028600	4030560	of it, so...
4050260	4051160	So the question
4051160	4052840	is, our click wrap
4052840	4054760	and shrink wrap aren't really meeting
4054760	4056980	of the minds, because it's kind of a take it or leave
4056980	4059180	it thing. Can you modify the terms
4059180	4060440	ahead of time and then click
4060940	4061820	accept?
4067720	4068160	And...
4068160	4069760	Is he calling me?
4070820	4072400	So the question is, can I modify
4072400	4074160	the terms? And the answer is no, because then you don't
4074160	4076160	have a meeting of minds on the other end.
4077140	4078140	So I'm told that
4078140	4080080	I should answer this phone call, which I'm going
4080080	4081560	to do, since we're on
4082400	4083120	overtime.
4088420	4089280	A call-in
4089280	4091160	question. Okay, I'll take a call-in
4091160	4093360	question. Let's see
4093360	4095120	if I can do it through the...
4095120	4097500	Let's see if you can do it through the microphone.
4097500	4098060	Ready?
4101430	4102070	No,
4102070	4102870	it doesn't play.
4103210	4111790	Okay, it was a personal
4111790	4113390	question, which I don't answer.
4115790	4117910	Does anybody have an appropriate
4118510	4119850	professional, non-personal
4119850	4120770	question?
4143610	4144630	So, the
4144630	4146770	question was about the encryption issue
4146770	4148970	and the forced disclosure.
4148970	4150650	And I'm not a...
4150650	4152790	I'm not familiar with these cases that you're referring
4152790	4154690	to where journalists have been forced to turn
4154690	4156750	over encryption keys.
4156750	4158750	The difference there might be that we're not
4158750	4160170	talking about something that is
4160890	4162570	incriminating. I mean, that might be one
4162570	4164810	difference. Then you also have another difference,
4164810	4166630	which is you've got this journalist thing, which brings in
4166630	4168730	all this free press type of issues as
4168730	4170690	well. But I think the fundamental thing is
4170690	4173050	that the Fifth Amendment applies
4173050	4174670	very... I mean, the arguments for the Fifth
4174670	4176630	Amendment application to compulsory key
4176630	4178730	turning over, I think, are weak.
4178730	4180450	Though I hate to say it.
4181430	4184780	All right.
4184780	4186300	Do you want me to keep going?
4188000	4188640	All right.
4189140	4190100	Other questions?
4193730	4195070	All right. So, there's no
4195070	4196970	other questions, so I'm not going to keep going, but as
4196970	4198670	you can see, we have the next thing that's happening.
4198670	4199690	Do you want to say something?
4200230	4200870	Okay.
4202670	4203270	I could tell...
4205570	4207170	All right. So, you guys...
4207170	4209090	Let's see. Do you guys want to hear a story?
4209850	4210570	All right.
4212710	4213190	Okay.
4213190	4215090	I'm going to tell you guys
4215290	4217270	a story about the first time
4217270	4219030	I tried to help somebody who got arrested
4219030	4220050	at DEF CON.
4221850	4223010	This was back in
4224790	4225590	1999 when...
4225590	4227650	Okay. I'm not sure. I don't remember what year it is.
4228990	4229390	But...
4230370	4231330	I don't know.
4231330	4232870	This isn't my laptop.
4233170	4234570	So, I'm just going to...
4235050	4237590	Okay. So...
4238270	4239250	Actually, this is a really
4239250	4240630	long story. I'll tell you
4241490	4242790	a story. Yeah. Okay. I'll tell
4242790	4244190	the story. So,
4244770	4246670	it was the year that DEF CON was
4246670	4249370	at that Plaza Hotel that was downtown.
4249730	4250870	And I was...
4250870	4251890	What year was that?
4254590	4255390	97?
4256610	4257410	96?
4258290	4258950	No.
4259030	4261130	No. It was 98, I think.
4261190	4262770	And maybe it was 98. Anyway,
4262770	4264550	that's a great place, by the way. They have penny
4264550	4266670	slots, which are super cool because when you're just
4266670	4268670	like totally down and out and you still need
4268670	4270670	to gamble, you can go to the penny slots.
4270730	4272470	And I was about to leave. Like, I
4272470	4274470	just had my foot on the little shuttle
4274470	4276710	van step. And I remember this very clearly. Sort of
4276710	4278550	looking down and seeing my foot on the step
4278550	4280550	when suddenly a crowd of people come
4280550	4282710	running out of the hotel. And they're like,
4282710	4284690	wait, wait. Don't let the lawyer get on
4284690	4286630	that van. Phony's
4286630	4288490	been arrested. And I
4288490	4290470	remember looking at my foot and thinking,
4290470	4292930	I'm going to miss my plane. So,
4292930	4294530	I get dragged off the little shuttle
4294530	4296650	van and I'm told that this guy
4296650	4298630	by the name of Phony, and I don't know, do any of you
4298630	4300490	guys here know Phony? Who knows Phony?
4300490	4302550	Yeah, there you go. Well, you probably know the end of this
4302550	4304550	story. So, they told me that this guy
4304550	4306670	named Phony had been arrested. That, you
4306670	4308570	know, it's the last day of DEF CON and he was
4308570	4310550	about to leave and some cop came
4310550	4312710	onto the floor of the show, took him away
4312710	4314570	in handcuffs, hustled him off into
4314570	4316590	some van and we don't know where he went. So, now, what
4316590	4317490	are we going to do?
4318450	4319850	So, I said, well,
4320790	4322630	let's go try to find where he
4322630	4324390	is and see what he was charged with
4324390	4326390	and we'll see what we can do. So,
4326390	4328450	they say, okay, great. And everybody's got, like,
4328450	4330690	radio headsets on. So, I hear them say,
4330690	4332390	we've procured the lawyer. Bring around the
4332390	4333210	vans.
4334750	4336570	So, then two big black
4336570	4338350	vans roll up and
4338350	4340350	the door slides open and there's
4340550	4342350	a bunch of hackers in there, all in black,
4342350	4344130	all with the headsets. And
4344130	4346490	Emmanuel Goldstein's in there and he's got a giant
4346490	4348390	video camera and they hustle
4348390	4350290	me into the van and we're all, like,
4350290	4351970	off. And I say, okay,
4352410	4353950	we need to find where
4353950	4356050	the jail is. So, somebody's
4356050	4357830	got the GPS thing and it's, like,
4357830	4360290	98 or whatever, so this is pretty early.
4360290	4361970	And they've got the map and they're, like, finding
4361970	4363850	where the jail is and they're calling back to the hotel
4363850	4366030	and stuff and it's, like, okay, we've procured the location of the
4366030	4368050	jail. So, we get there and we, like, get to the
4368050	4369930	jail and we're, like, stop in front of the jail
4370490	4371990	and the doors to both the vans
4371990	4374070	slide open and everybody's ready to jump out and, like,
4374070	4376070	converge on the jail. And I'm, like, no, no, no,
4376070	4378030	no, no, no. This is
4378030	4379750	totally not going to work, okay?
4379750	4381590	And they're, like, one person
4381590	4383690	can come to the jail with me, but you can't
4383690	4385610	all come in. So, they're, like,
4385610	4387690	take a little vote and everything and everybody's okay
4387690	4389550	and Emmanuel's, like, filming everybody because
4389550	4391610	he's got this documentary he's doing about
4391610	4393610	how hackers help each other and aren't criminals
4393610	4395710	and stuff like that, which is totally true and great.
4395710	4397490	Although, you know, it's a little nerve-wracking
4397490	4399330	to have this big camera in your face.
4399330	4401690	So, I say, okay, so they pick who's going to come in
4401690	4404010	with me and I say, okay,
4404010	4406150	now there's one other thing I need to know.
4406310	4408090	What's Phony's real name?
4412460	4413420	And, no,
4413420	4414420	they're just, like,
4414420	4416300	can I say what Phony's real name is
4416300	4417760	or should I make up a name?
4418660	4420680	Okay, so, they're, like,
4420680	4422260	they're, like,
4424500	4427020	they're, like, it's Jeff.
4427460	4428460	Okay, Jeff
4428460	4430400	what? No one
4430400	4432600	knows. So, lots
4432600	4434440	of frantic phone calls back to the hotel
4434440	4436400	to try to find out what Phony's
4436400	4438520	real name is and, um, after
4438520	4440440	about ten minutes, we finally find
4440440	4442460	somebody who knows his name and tells me.
4442460	4444780	And I'm, like, okay. And I go into the jail.
4445020	4446500	So, I get to the jail
4447060	4448680	and we go up to the, you know,
4448680	4450440	the booking guy and he's, like,
4450440	4452460	you know, what's up? And I say, hi, I'm a lawyer. My client
4452460	4454720	just got arrested. I'm wondering if he's here
4454720	4456400	and, you know, what's going on?
4456400	4458360	And the guy takes a, you know, sort of says, well,
4458360	4460320	I don't know if he's here. What's his name?
4460320	4462400	I give him the name and he types it into his
4462400	4464440	computer and he said, well, he's not on my computer yet
4464440	4466460	but if he just got arrested, you know,
4466460	4468740	it takes a couple of hours to go through booking,
4468740	4470540	he might be here and I just don't have him
4470540	4472480	in the computer yet. I can go check
4472480	4474480	in the holding cell and see if he's there. What does he
4474480	4476580	look like? So, I don't actually know
4476580	4478360	what he looks like. So, I'm, like, what does he look like?
4478360	4480840	I don't know. So, the guy who I'm with runs out to the
4480840	4482560	van and he comes back with somebody's
4482560	4484560	digital camera that's got the picture of Phony
4484560	4486320	and he shows the picture and he's got
4486320	4488860	green hair and a blue pentagram
4488860	4491020	dyed into the back of his head.
4493200	4494820	So, I show it to the sheriff
4494820	4497220	and I go, you can't miss him.
4500100	4501280	So, the sheriff's like,
4501280	4503440	we do not have that guy here.
4503440	4504980	I would definitely know he's
4504980	4507160	not here. So, I'm like, okay, he's not here
4507160	4509180	and he says, well, maybe there's another jail across town
4509180	4510980	maybe he's over there. So, we all pile
4510980	4512920	back into the van and we've got the whole, you know,
4512920	4514920	GPS thing with where the new jail is
4514920	4516500	and stuff and we're hustling off there
4516500	4519000	and on the way, suddenly, we get a call
4519000	4520820	over the radio and the call is like,
4520820	4523640	abort, abort the mission, return to base.
4523960	4526260	So, we're like, huh, that's weird, okay.
4526260	4527740	So, you know, I think we've been to like two
4527740	4529900	jails by this time and we're like, okay, we'll return to base.
4529900	4531680	So, we return back to
4531680	4533680	the hotel and we're like, you know, we
4533680	4535620	don't know what happened. So, everybody's like, what's
4535620	4537720	going on? I don't know. And sort of like, we walk into the hotel
4537720	4539900	and we sort of go our own separate ways
4539900	4541700	and I'm like, you know, wondering
4541700	4543520	how I'm going to get home now because
4543520	4545480	I've missed my flight by quite a bit.
4545680	4547540	And Pete Shipley
4547540	4549920	comes up to me and he says, can I talk to you?
4549920	4551580	And I'm like, okay. And we go over
4551580	4553460	and he takes me aside and he's like, I'm really
4553460	4556000	sorry, but it was all a
4556000	4558840	hoax. That was Phony's
4559080	4560880	cousin. And his cousin's
4560880	4561760	a cop here in town
4561760	4566080	and he thought it would be really cool
4566080	4566260	if
4566260	4567900	he thought it would be totally cool if
4567900	4570020	instead of just leaving the con, he was
4570020	4572320	dragged off in handcuffs.
4572320	4575220	And he called me from the
4575220	4575800	airport and I was like,
4575800	4578020	that's so weird, that's Phony's number, how's
4578020	4579580	he calling me? And I said,
4579580	4581200	what are you doing? And he's like, yeah, dude,
4581200	4582440	wasn't that cool?
4584100	4585620	And Pete's like,
4585620	4587500	we dragged Granica off of her
4587500	4589240	airplane for you.
4589240	4591620	And now she can't fly home.
4592180	4593780	So Phony, who's a
4593780	4595500	gentleman, paid for me to fly back
4595500	4597540	to San Francisco first class, which I
4597540	4599620	really appreciated. And then later
4599620	4601460	in honor of my efforts, put me
4601840	4603560	in a movie where I got to
4603560	4605740	co-star with Mark Pauline as a
4605740	4607480	evil naval officer in a
4607480	4609400	movie that he was doing. So he and I ended up
4609400	4611460	being on very good terms. But that was the
4611460	4613420	very first time that I helped somebody who had been arrested
4613420	4615600	at DEFCON and you wonder why I come back
4615600	4617260	to take this abuse again
4617260	4619120	year after year. But I just
4619860	4621720	want to thank you guys
4621720	4622180	for...
4630780	4633240	I just want to thank you guys for making my life
4633240	4635480	so fun and have a good rest of your evening.