[00:13.400 --> 00:20.560]  Thank you all so much for coming here to hear my speech at 8 o'clock on a Saturday night.
[00:20.680 --> 00:26.620]  I'm not sure why I got... how I managed to pull this particular time slot.
[00:26.620 --> 00:31.340]  This is a time when people would rather be breaking the law than learning about the law.
[00:31.340 --> 00:35.760]  But I'll do my best to try to keep it interesting and also maybe try to keep it short
[00:35.760 --> 00:40.260]  and maybe we can have something like a conversation following this.
[00:40.260 --> 00:45.080]  So, for those of you who don't know me, my name is Jennifer Granick
[00:45.080 --> 00:49.540]  and I am the Executive Director of the Center for Internet and Society,
[00:49.540 --> 00:53.900]  which is a public interest internet law program at Stanford Law School.
[00:53.900 --> 00:57.940]  And as part of our program, we have conferences, speakers,
[00:57.940 --> 01:03.240]  things to study the interaction of civil liberties, the public interest in computer technology.
[01:03.240 --> 01:09.440]  And I also teach a class there, which is a practical course for law students
[01:09.440 --> 01:11.820]  which is called the Cyber Law Clinic.
[01:11.820 --> 01:15.360]  And we take cases and provide people with pro bono legal services
[01:15.360 --> 01:18.080]  and students get to work on the cases and learn how to be lawyers
[01:18.080 --> 01:21.680]  and I get to work on issues that I think are important and interesting.
[01:22.040 --> 01:27.920]  So, I am a teacher but also a litigator in that capacity.
[01:27.920 --> 01:31.880]  I came to this job from my background as being a criminal defense attorney,
[01:31.880 --> 01:36.120]  which I can tell you has been an extremely useful background this week.
[01:36.120 --> 01:40.300]  And we may get a chance to talk about that a little bit while I am up here.
[01:40.960 --> 01:45.360]  Okay, so my conception for this talk was that I wanted to actually have a really large audience
[01:45.360 --> 01:48.680]  and I thought, how else do you have a large audience other than to survey everybody
[01:48.680 --> 01:52.140]  and find out what questions they are interested in and then answer those questions.
[01:52.140 --> 01:58.160]  So I took an extremely informal survey that my father would think is completely statistically inaccurate
[01:58.160 --> 02:00.460]  and I came up with the following questions.
[02:01.460 --> 02:02.920]  And there we have some of them.
[02:02.920 --> 02:06.540]  I came up with about ten questions that I thought that people would be interested in.
[02:08.820 --> 02:12.200]  And for those of you who responded to my survey, thank you very much.
[02:12.440 --> 02:16.720]  I swapped out one of the old questions to give us question number nine
[02:16.720 --> 02:23.560]  because I think that there is a lot of interesting things to say about that from a legal standpoint.
[02:23.560 --> 02:28.320]  And the thing about it, the thing about the whole issue that interested me from a legal standpoint
[02:28.320 --> 02:32.200]  and I will give you some idea of my sense about what the law is behind all of that.
[02:32.200 --> 02:34.920]  So these are the ten questions that I'm going to be answering.
[02:35.380 --> 02:37.560]  And I think since we have, I see some more people coming,
[02:37.560 --> 02:41.260]  but I think when I did a similar kind of format at Black Hat,
[02:41.260 --> 02:43.640]  I asked for people to keep questions until the end.
[02:43.760 --> 02:48.700]  But I think here, since it's kind of a small group, I think I can manage to take questions during.
[02:48.700 --> 02:53.040]  I just don't want to get bogged down on one question and not get to the point where,
[02:53.540 --> 02:56.280]  not get to the point where we get to kind of get through all of the questions.
[02:56.280 --> 03:00.280]  So if you have questions that are relevant to something I'm talking about at the time,
[03:00.280 --> 03:05.360]  please just raise your hand and I'll see if I want to call on you.
[03:05.620 --> 03:09.740]  I see somebody there with a trademark infringing Newsweek shirt,
[03:09.740 --> 03:12.760]  which I'm going to tell my husband about since he works there.
[03:14.600 --> 03:17.920]  It's a parody, yeah. Okay, well then you're cool, man, you're cool.
[03:19.420 --> 03:23.040]  Alright, so when you're trying to cover ten legal questions,
[03:23.040 --> 03:25.560]  the thing I want to make pretty clear here is that I'm going to try to give you
[03:25.560 --> 03:28.040]  at a very high level some legal information.
[03:28.040 --> 03:31.880]  This isn't legal advice and it's not a substitute for talking either, you know,
[03:31.880 --> 03:34.880]  specifically with a lawyer about your specific situation.
[03:34.960 --> 03:39.120]  But I think one of the things that's wrong with the law, and especially the law in this area,
[03:39.120 --> 03:43.080]  is that it's so complicated that it's hard to kind of get a sense of, like, what the deal is.
[03:43.080 --> 03:46.820]  And of course every time you ask a lawyer what the deal is, the lawyer will always answer,
[03:46.820 --> 03:50.600]  I mean, if they're giving you the truthful answer, the answer is always, well, it depends.
[03:50.820 --> 03:56.540]  And it depends isn't really all that helpful, I can't, but it's always the right answer.
[03:56.540 --> 03:59.380]  So I'm not going to give you an answer that's any different from it depends,
[03:59.380 --> 04:03.800]  I'm just going to try to give you some sense of what factors it depends upon,
[04:03.800 --> 04:08.700]  and then, you know, hopefully that gives you a sense of what matters in all of these issues.
[04:11.840 --> 04:16.780]  Okay, so as you know from reading my questions, the first question that people asked was about wireless.
[04:16.780 --> 04:19.740]  And why did I think that wireless would be an interesting thing to talk about?
[04:19.740 --> 04:22.940]  Well, for those of you who are readers of the internet,
[04:22.940 --> 04:30.680]  you know that there was very recently a case in Florida where a Florida man was arrested for using wireless networks.
[04:30.740 --> 04:33.500]  And he was charged with a crime under the Florida law.
[04:33.500 --> 04:36.780]  So people wonder, is it a crime to use open wireless networks?
[04:36.780 --> 04:41.280]  Because if so, I think probably there's a lot of people here in the audience, myself included,
[04:41.280 --> 04:43.220]  who have been committing some crimes.
[04:45.620 --> 04:50.320]  No one else needs to confess, I'll do the confessing for us.
[04:50.320 --> 04:53.820]  I think the important thing about wireless is that when people say,
[04:53.820 --> 04:56.840]  well, I'm using a wireless network, there's a couple of different things you could mean,
[04:56.840 --> 04:59.520]  and different laws are going to apply to these different activities.
[04:59.520 --> 05:05.400]  So depending on what you're doing, we can see which laws might apply.
[05:05.700 --> 05:10.100]  The Florida case is a relatively rare situation.
[05:10.100 --> 05:18.860]  I personally am only aware of two other instances in which people have been charged with accessing a wireless network.
[05:18.860 --> 05:24.000]  One is a case that I was involved in in California, which later morphed into a case about something else,
[05:24.000 --> 05:26.300]  and the wireless was no longer an issue.
[05:26.300 --> 05:31.880]  And the other was a federal prosecution of a man named Stephan Puffer in Houston,
[05:31.880 --> 05:36.180]  and he was acquitted following a jury trial.
[05:36.180 --> 05:42.380]  So those are the only other two instances I'm aware of in which somebody was prosecuted for wireless.
[05:42.400 --> 05:47.400]  So let's take the more easy instances first and see what laws might apply.
[05:47.400 --> 05:50.040]  First, accessing stored files through the network.
[05:50.340 --> 05:57.320]  So the law that applies to protecting stored files is the Electronic Communications Privacy Act,
[05:57.320 --> 06:00.700]  and I put the text of the statute up here for you,
[06:00.700 --> 06:04.580]  but I want to take a moment to touch on, or to really kind of talk about,
[06:04.580 --> 06:08.400]  the two operative concepts that are the basis for this law,
[06:08.400 --> 06:14.760]  and also for the Computer Fraud and Abuse Act, which is the anti-hacking law,
[06:14.760 --> 06:16.620]  and for many of these computer laws.
[06:16.620 --> 06:20.620]  And that's the issue of unauthorized access.
[06:20.980 --> 06:29.460]  So almost all of these privacy and computer crimes that we see are based on access that's unauthorized.
[06:29.460 --> 06:30.580]  So what does that mean?
[06:30.580 --> 06:33.460]  Well, access could mean a lot of things.
[06:33.960 --> 06:37.580]  I was having a conversation with my parents at dinner tonight,
[06:37.580 --> 06:42.420]  and we were talking about what it means to kind of get behind or go into a website,
[06:42.420 --> 06:45.820]  or sort of go behind the front page, or that sort of thing.
[06:45.820 --> 06:50.740]  And you can talk about access as being something kind of metaphorical,
[06:50.740 --> 06:55.940]  like if I visit the website, then that's sort of like the front page, like the front door,
[06:55.940 --> 06:59.860]  but it's not like I'm getting into the database of information that's behind it.
[06:59.860 --> 07:03.940]  Or if I ping and it sends me back a packet that says, yes, I'm here,
[07:03.940 --> 07:08.260]  then it's not like I really went inside or got any of the information that's inside.
[07:08.480 --> 07:10.800]  Or you can look at it in the way that computers really work,
[07:10.800 --> 07:13.100]  which is you send packets and it sends you packets,
[07:13.100 --> 07:17.660]  and when you send it packets, you're causing that machine to do something and you're accessing it.
[07:17.780 --> 07:20.880]  Well, courts have looked at it in the more broad sense,
[07:20.880 --> 07:28.440]  and basically the cases have read that every time you have some kind of contact with a networked computer,
[07:28.440 --> 07:32.020]  you're sending it electrons and packets, and so you are accessing it.
[07:32.020 --> 07:33.540]  So it has this very broad thing.
[07:33.540 --> 07:39.220]  In no case, in none of the cases that deal with the interpretation of the Computer Fraud and Abuse Act,
[07:39.220 --> 07:42.560]  has anyone ever been held to not have accessed the computer.
[07:42.560 --> 07:47.440]  So access is kind of, it's like any use or connection with a networked computer is access.
[07:47.440 --> 07:50.700]  Well, so okay, there's one element of the crime that we've all committed.
[07:50.700 --> 07:52.040]  What about authorization?
[07:52.040 --> 07:57.300]  Is authorization really something that helps us distinguish between legal and illegal activity?
[07:58.360 --> 08:00.960]  So authorization could mean a lot of things.
[08:00.960 --> 08:04.240]  It could mean that you have explicit permission,
[08:04.240 --> 08:06.940]  or it could mean that you weren't explicitly kept out.
[08:06.940 --> 08:09.000]  And how does the law see this?
[08:12.490 --> 08:18.970]  Well, a lot of technological people think that authorization is kind of about what the computer allows you to do.
[08:18.970 --> 08:22.130]  So if permissions are set in such a way that you can access a file,
[08:22.130 --> 08:25.410]  or if the file is stored in a public space on the web server,
[08:25.410 --> 08:29.170]  then you have authorization because the computer authorized you to do it.
[08:29.430 --> 08:31.590]  And that's not the way that the law looks at it.
[08:31.590 --> 08:37.010]  The law has a much more social or sociological view of what authorization means.
[08:37.010 --> 08:43.350]  And there are many ways that you can do something that goes beyond your authorization.
[08:43.750 --> 08:50.550]  There are cases that say that if you do something that's what a banner warning tells you not to do,
[08:50.550 --> 08:52.330]  your use is unauthorized.
[08:52.330 --> 08:55.370]  There are cases that say if you make access to a computer system
[08:55.370 --> 09:01.410]  contrary to the terms of a contract or terms of service, that that's unauthorized.
[09:01.410 --> 09:06.770]  Cases that say that if you are notified that what you're doing is unauthorized,
[09:06.770 --> 09:09.690]  and you continue to do it, that that's unauthorized.
[09:09.690 --> 09:12.830]  So we have cases like eBay versus Bidder's Edge,
[09:12.830 --> 09:17.750]  in which a robot spidering program that collected auction information from eBay
[09:17.750 --> 09:21.210]  was making unauthorized access to eBay's website
[09:21.210 --> 09:26.970]  because eBay told the company that ran the spidering program they didn't want them there.
[09:26.970 --> 09:34.290]  We have cases where somebody who was a former employee who had left that company
[09:34.290 --> 09:38.310]  and was told that as a condition of your having left this company,
[09:38.310 --> 09:42.470]  you're not allowed to compete with us, sort of a non-compete agreement.
[09:42.470 --> 09:48.070]  And he then went on to his old company's website and collected data there about how much,
[09:48.070 --> 09:51.270]  I think it was cruises, travel packages cost.
[09:51.270 --> 09:56.450]  And in that case, they said, well, you were doing that to compete with your old employer,
[09:56.450 --> 10:01.830]  and that was contrary to the terms of your termination contract, and so that was unauthorized.
[10:01.830 --> 10:05.750]  The case that I think reads unauthorized access the most broadly
[10:05.750 --> 10:12.430]  is a case where a former employee started working for a new competitor company,
[10:12.430 --> 10:18.810]  but before he moved to the new company, he took a copy of his old employer's customer list,
[10:18.810 --> 10:20.910]  and he took it with him to the new company.
[10:20.910 --> 10:23.270]  And then the old company sued the new company and said,
[10:23.270 --> 10:27.330]  you had your guy make unauthorized access to our computers.
[10:27.390 --> 10:29.890]  And the new employer said, hey, he was authorized.
[10:29.890 --> 10:32.030]  He had a password. He was still working there.
[10:32.030 --> 10:35.370]  He was allowed to access the customer list.
[10:35.370 --> 10:39.130]  Maybe, you know, he took a trade secret or something, but it wasn't this violation.
[10:39.130 --> 10:41.490]  It wasn't unauthorized access to your computers.
[10:41.670 --> 10:46.730]  And what the court said is that, no, the court said at the moment that he knew in his mind
[10:46.730 --> 10:50.870]  that he was acting contrary to the interests of his employer,
[10:59.500 --> 11:03.600]  all right, and that he was acting contrary to the interests of his employer,
[11:03.600 --> 11:05.380]  his use was not authorized.
[11:05.380 --> 11:06.220]  Well, think about that.
[11:06.220 --> 11:11.860]  Every time you access some computer in a way that the computer owner might not like is unauthorized,
[11:11.860 --> 11:13.260]  that's pretty broad.
[11:13.260 --> 11:18.460]  Okay, so keep that in mind when we're talking about all of these things,
[11:18.460 --> 11:22.700]  about what unauthorized means and whether it's really a principled way to distinguish
[11:22.700 --> 11:25.080]  between something that's criminal and not criminal.
[11:25.080 --> 11:27.040]  I mean, my argument is that it's not.
[11:27.040 --> 11:30.560]  And if you look at the civil cases that interpret these, particularly the civil cases,
[11:30.560 --> 11:32.180]  but now some criminal cases,
[11:32.180 --> 11:37.560]  think about whether search engines or spidering robots or shopping bots
[11:37.560 --> 11:39.700]  or those sorts of things are crimes,
[11:39.700 --> 11:44.420]  because cases have held that all of those are making unauthorized access to computers.
[11:44.840 --> 11:49.640]  So if you were to use wireless to access stored files on a network without permission,
[11:49.640 --> 11:54.480]  that would be a violation of this particular law that I have listed up here.
[11:56.520 --> 12:00.000]  What about intercepting communications that go over the network?
[12:00.000 --> 12:05.340]  Well, there's a law that says that you are not allowed to intercept the contents of communications.
[12:05.480 --> 12:06.920]  So when people ask me,
[12:06.920 --> 12:09.680]  well, what if it's unencrypted just going over a wireless network?
[12:09.680 --> 12:12.360]  Can I read it and take a look at it?
[12:12.360 --> 12:13.480]  And I always say no.
[12:13.480 --> 12:18.880]  And I feel even better about this after I used the wireless at Black Hat to check my email,
[12:18.880 --> 12:21.320]  and the next thing I knew I was locked out of my email account
[12:21.320 --> 12:25.080]  because some bozo was logged on and so I couldn't get back in.
[12:25.080 --> 12:28.260]  I've had to change my email password four times at Black Hat.
[12:30.320 --> 12:32.540]  I know. I know what you guys are all thinking.
[12:32.540 --> 12:34.880]  But I'm a lawyer. Give me a break.
[12:44.080 --> 12:48.420]  So I always tell people you shouldn't be accessing the content of communications,
[12:48.420 --> 12:51.160]  but I do think that if anybody,
[12:51.160 --> 12:54.000]  and it wouldn't be any of my clients who talked to me about this beforehand,
[12:54.000 --> 12:57.440]  but if anybody ever does make this mistake and ends up getting prosecuted for it,
[12:57.440 --> 13:01.000]  I think there might be a defense within the context of the statute.
[13:01.220 --> 13:03.500]  The statute does have an exception in it,
[13:03.500 --> 13:08.060]  which I think was designed to protect people who were capturing radio signals.
[13:08.060 --> 13:11.440]  And that exception says that it's not unlawful to intercept communications
[13:11.980 --> 13:16.620]  which are configured so as to be accessible to the general public,
[13:16.620 --> 13:18.760]  readily accessible to the general public.
[13:18.760 --> 13:23.760]  And I think there's an argument you could make that unencrypted communications over wireless
[13:23.760 --> 13:26.300]  are readily accessible to the general public.
[13:26.300 --> 13:29.640]  So hopefully none of you will ever have to mount that defense,
[13:29.640 --> 13:32.720]  but if so, we'll see how that goes.
[13:34.500 --> 13:36.780]  Alright, what about just using the network?
[13:36.800 --> 13:39.140]  So this also gets us into question number two,
[13:39.140 --> 13:43.000]  which is what are the federal and state laws regarding computer crimes?
[13:43.080 --> 13:44.760]  And as I talked to you before,
[13:44.760 --> 13:48.880]  the kind of triggering thing is this unauthorized access.
[13:49.120 --> 13:52.360]  The Computer Fraud and Abuse Act, which is 18 U.S.C. 1030,
[13:52.360 --> 13:54.740]  one of my favorite laws,
[13:54.740 --> 13:57.420]  makes it a crime to access a computer without authorization
[13:57.420 --> 13:59.820]  and either obtain information or cause damage.
[13:59.820 --> 14:02.100]  It's a very long statute and there's more to it than that,
[14:02.100 --> 14:03.640]  but you get the basic gist.
[14:03.720 --> 14:09.260]  So the question is, is using wireless a crime under this statute?
[14:09.260 --> 14:12.440]  And I've always thought no, just using it isn't,
[14:12.440 --> 14:15.120]  because the wireless isn't necessarily a computer
[14:15.120 --> 14:17.260]  and as long as you're not overusing the bandwidth
[14:17.260 --> 14:21.180]  or doing anything to damage the network, there's no damage.
[14:21.180 --> 14:22.560]  And in order for this to happen,
[14:22.560 --> 14:24.700]  you have to either obtain information or cause damage.
[14:24.700 --> 14:26.940]  So I thought that was pretty okay
[14:26.940 --> 14:30.520]  until we started seeing these California and Florida cases.
[14:31.320 --> 14:33.760]  So, why is it different under state law?
[14:33.760 --> 14:37.200]  Well, state laws are phrased differently than the federal law
[14:37.200 --> 14:39.220]  and I have here the California law.
[14:39.220 --> 14:41.800]  It basically says you don't have to cause damage
[14:41.800 --> 14:44.180]  and it doesn't have to be access to a computer.
[14:44.200 --> 14:47.560]  If you use computer services without permission,
[14:47.560 --> 14:49.260]  you may be committing a crime.
[14:49.260 --> 14:52.780]  And this was the statute that they chose to arrest
[14:52.780 --> 14:55.220]  the person that I was working with under.
[14:55.700 --> 14:58.760]  Similarly, the Florida statute says that it's a crime
[14:58.760 --> 15:01.020]  to willfully, knowingly, and without authorization
[15:01.020 --> 15:04.560]  access a computer system or computer network.
[15:04.560 --> 15:07.180]  And you could say that the wireless or the access hub
[15:07.180 --> 15:09.660]  is part of the computer network.
[15:09.660 --> 15:11.240]  So, this is kind of scary,
[15:11.240 --> 15:14.460]  because you know that you're accessing the wireless
[15:14.460 --> 15:17.580]  and how do they prove that it's without authorization?
[15:17.580 --> 15:21.080]  Well, the way they usually prove it is not that hard.
[15:21.080 --> 15:25.160]  Basically, as I said, it's kind of in the mind of the owner,
[15:25.160 --> 15:26.880]  is the way that the law looks at it.
[15:26.880 --> 15:29.640]  And what I have seen them do in all of my cases is
[15:29.640 --> 15:32.040]  they get the person who's the owner of the computer system
[15:32.040 --> 15:34.060]  to come into court and they say,
[15:34.060 --> 15:36.100]  did you ever give the defendant permission
[15:36.100 --> 15:38.800]  to use your computer services or computer?
[15:38.800 --> 15:42.440]  And the owner says, no, I never gave them permission.
[15:42.440 --> 15:44.480]  And boom, they're done, they leave, and that's it.
[15:44.480 --> 15:45.580]  What are you going to say?
[15:45.580 --> 15:47.820]  So, authorization's always been pretty easy,
[15:47.820 --> 15:50.720]  or lack of authorization's always been pretty easy to prove.
[15:51.020 --> 15:52.760]  But with wireless, how do you know, right?
[15:52.760 --> 15:53.660]  Is there a question?
[16:07.320 --> 16:09.480]  So, his question is, isn't it kind of implicit
[16:09.480 --> 16:11.100]  if people leave it open,
[16:11.100 --> 16:13.040]  that maybe you're authorizing,
[16:13.040 --> 16:15.420]  that it's implicit that you're allowed?
[16:17.200 --> 16:17.940]  Yeah.
[16:19.940 --> 16:21.740]  They're saying, well, the box is called allow all,
[16:21.740 --> 16:23.060]  and I can promise both of you
[16:23.060 --> 16:25.200]  that people who have wireless in their house,
[16:25.200 --> 16:27.860]  many people have never seen that box.
[16:27.860 --> 16:29.500]  Many people just plug the thing in
[16:29.500 --> 16:32.800]  and it just automatically allows, and that's it.
[16:32.800 --> 16:36.860]  So, do those people want other people to make access,
[16:36.860 --> 16:37.940]  or don't they?
[16:37.940 --> 16:43.260]  Some ISPs encourage you to share your broadband connection,
[16:43.260 --> 16:45.920]  and some ISPs in the contract tell you
[16:45.920 --> 16:47.480]  that you're not allowed to share.
[16:47.480 --> 16:50.120]  But the vendors choose to leave the burden
[16:50.120 --> 16:53.460]  of actually excluding or including people,
[16:53.460 --> 16:56.860]  or actually including or excluding outside users
[16:56.860 --> 17:01.620]  to the people who purchase the access and the wireless router,
[17:01.620 --> 17:03.620]  and most of those people aren't like us.
[17:03.620 --> 17:05.320]  Most of those people are more like,
[17:05.720 --> 17:08.560]  as I have my poster children of my parents,
[17:08.560 --> 17:10.140]  most of those people are more like my parents,
[17:10.140 --> 17:13.020]  who, at best case scenario, are going to plug the thing in
[17:13.020 --> 17:14.620]  and be psyched that it works.
[17:14.860 --> 17:16.720]  Worst case scenario, have to call in, you know,
[17:16.720 --> 17:19.900]  some expert technical assistance to help with that.
[17:19.900 --> 17:22.260]  So the question is, what do you know?
[17:22.920 --> 17:23.800]  Exactly.
[17:24.140 --> 17:27.240]  So the question is, what do you as the user know
[17:27.240 --> 17:28.760]  about what the owner wants,
[17:28.760 --> 17:31.940]  just based on the fact that access is possible?
[17:31.940 --> 17:33.620]  Do you really know what's in their mind?
[17:33.620 --> 17:36.500]  And as long as the courts look at what's in the owner's mind,
[17:36.500 --> 17:39.820]  as opposed to what might seem reasonable to you,
[17:39.820 --> 17:40.760]  you're in trouble.
[17:41.040 --> 17:45.780]  In the case that I was involved in,
[17:45.780 --> 17:48.380]  one of the things that made them feel like it wasn't authorized
[17:48.380 --> 17:53.360]  is that my client was outside of somebody's house in his car,
[17:53.360 --> 17:56.240]  and they're like, why is he lurking around outside their house?
[17:56.240 --> 17:59.200]  Now, that might seem like totally normal behavior to some of us,
[17:59.200 --> 18:01.040]  you know, when you need to get onto the wireless,
[18:01.040 --> 18:03.620]  there's nothing wrong with lurking around outside somebody's house.
[18:03.620 --> 18:05.760]  But, you know, I don't know that a judge or a jury
[18:05.760 --> 18:08.800]  is necessarily going to view it the same way,
[18:08.800 --> 18:10.940]  and it's kind of risky to depend upon that.
[18:10.940 --> 18:12.180]  And of course, you don't know.
[18:12.180 --> 18:14.560]  When the access point's open, you don't know whether you're allowed
[18:14.560 --> 18:19.320]  or the person's just, you know, too lazy or ignorant
[18:19.320 --> 18:21.380]  to have configured it differently.
[18:21.640 --> 18:23.640]  So what I have argued with these laws
[18:23.640 --> 18:27.060]  is that it shouldn't be enough that you know you use wireless
[18:27.060 --> 18:28.940]  and that it's unauthorized.
[18:28.940 --> 18:32.100]  I've argued that you should have to know that it's unauthorized.
[18:32.100 --> 18:34.400]  Like, you in your mind know that you're not allowed
[18:34.400 --> 18:35.840]  to be doing what you're doing.
[18:35.840 --> 18:38.220]  Otherwise, you don't have a guilty state of mind.
[18:38.220 --> 18:41.440]  You're not doing anything that is, you know,
[18:41.440 --> 18:44.720]  the illicit criminal thing that's what we're trying to prevent.
[18:44.860 --> 18:47.840]  And much of criminal law, in fact almost all of criminal law,
[18:47.840 --> 18:50.440]  requires you to have like a guilty criminal state of mind.
[18:50.440 --> 18:52.980]  And that's what we do to distinguish between, you know,
[18:52.980 --> 18:55.860]  where you don't get punished and where it's okay to put you in prison.
[18:56.420 --> 18:58.560]  So no court has adopted that yet.
[18:58.560 --> 19:01.780]  But if there are any lawyers out here who ever face some of these cases,
[19:01.780 --> 19:03.500]  you can call me, I wrote a brief on it,
[19:03.500 --> 19:05.940]  and I think it's pretty good, I think it's a really good argument.
[19:06.340 --> 19:09.460]  But can you count on it? You know, no.
[19:22.670 --> 19:26.630]  So the question is, what else could you do to make the fail-open,
[19:26.630 --> 19:31.990]  to make fail-open more of a legal, like more robust legally?
[19:31.990 --> 19:36.830]  So that, you know, in the absence of circumstances that clearly point to the contrary,
[19:36.830 --> 19:40.950]  instead of assuming that you're not authorized, we assume that you are authorized.
[19:41.050 --> 19:43.850]  And I think that, I mean, that would be great, right,
[19:43.850 --> 19:49.330]  if we could communicate to courts or juries or, you know, or Congress
[19:49.330 --> 19:54.350]  that, or legislatures, that in the absence of some kind of security measure
[19:55.290 --> 19:58.810]  or some kind of clear notice to the contrary,
[19:58.810 --> 20:03.850]  if something is accessible, we can assume that it's okay to access it.
[20:04.270 --> 20:08.150]  And, you know, so there's two ways that the law develops.
[20:08.150 --> 20:10.490]  The law can either develop through, well, there's many ways,
[20:10.490 --> 20:13.230]  but the law can mainly develop either through statute,
[20:13.230 --> 20:16.470]  where you can have that be something that a legislature would pass,
[20:16.470 --> 20:20.670]  or it can develop through the common law, where through the process of judges making rulings,
[20:20.670 --> 20:24.570]  something becomes conventional and is sort of the way that things are done.
[20:24.570 --> 20:28.510]  And so, you know, many of these cases, what you're hoping for is to develop a common law
[20:28.510 --> 20:33.910]  so that courts see that, you know, we're going to assume, we're going to assume freedom.
[20:33.910 --> 20:38.210]  We're going to put the burden of security, the burden of closing something on the owner,
[20:38.210 --> 20:40.650]  and we're going to not put the burden on the public to assume that
[20:40.650 --> 20:43.730]  unless they're explicitly invited in, they can't go anywhere.
[20:43.950 --> 20:46.230]  So that's the way that it works with the law.
[20:46.230 --> 20:50.050]  I mean, there may very well be technological ways we could do that as well,
[20:50.050 --> 20:55.090]  which might include making it easier for people to make their preferences more explicit
[20:55.090 --> 21:00.370]  and putting maybe pressure on vendors, for example, to make that process of deciding easier
[21:00.370 --> 21:04.050]  so that we don't have to assume that if it's open, it's ignorance.
[21:04.050 --> 21:09.130]  We can assume that if it's open, it's intentional, and that if it's closed, that too is intentional.
[21:13.160 --> 21:15.360]  Okay, so the Patriot Act and computer crime.
[21:15.360 --> 21:18.640]  How did the Patriot Act change investigations of computer crimes?
[21:19.080 --> 21:24.220]  Well, clearly the Patriot Act expanded surveillance in many areas,
[21:24.220 --> 21:27.780]  but I'm going to talk just specifically about this particular area.
[21:27.780 --> 21:31.980]  And the Patriot Act changed computer crime investigation in two main ways.
[21:31.980 --> 21:37.640]  First, it made it possible to get wiretaps to investigate computer crimes.
[21:37.640 --> 21:41.580]  A wiretap is a very privacy-invasive investigatory tool,
[21:41.580 --> 21:44.560]  and you can't get it to investigate just any crime.
[21:44.560 --> 21:50.340]  You can only get it to investigate a certain enumerated list of crimes,
[21:50.340 --> 21:54.400]  kind of meant to be the more serious or the more dangerous ones.
[21:54.480 --> 22:00.160]  And now computer hacking is one of those more serious or dangerous crimes for which you can get a wiretap.
[22:00.160 --> 22:05.180]  It also created this computer trespasser exception to the wiretap rules.
[22:05.200 --> 22:10.260]  The trespasser exception gives the government additional rights to monitor somebody
[22:10.260 --> 22:13.100]  who is a trespasser on the computer system.
[22:13.100 --> 22:17.380]  So if it's your system, it gives you more power to bring the government in
[22:17.380 --> 22:19.840]  without the government needing to get a warrant,
[22:19.840 --> 22:24.780]  and it gives the government more power to work with people who are owners of victim systems
[22:24.780 --> 22:32.540]  in order to do monitoring without having to go through the same kind of...
[22:32.540 --> 22:37.540]  without having to show the same level of proof that they would have to show prior to the Patriot Act.
[22:37.540 --> 22:41.220]  And here is basically the terms and conditions of the trespasser exception.
[22:41.220 --> 22:41.760]  Yes?
[22:45.760 --> 22:50.240]  So trespasser is defined... it's very interesting, I think, how they defined it in this statute.
[22:50.240 --> 22:56.840]  A trespasser is somebody who has no contractual relationship or authority to be on the computer.
[22:56.840 --> 22:59.920]  And I think the thing that's really interesting about that is to contrast it
[22:59.920 --> 23:03.080]  with the definition in the Computer Fraud and Abuse Act,
[23:03.080 --> 23:05.700]  which says that you're just unauthorized.
[23:05.700 --> 23:10.080]  And it's clear that unauthorized means you've gone beyond the terms of the contract.
[23:10.080 --> 23:13.200]  Here they're saying, even if you go beyond the terms of the contract,
[23:13.200 --> 23:16.980]  that's not enough to be a trespasser on this computer system.
[23:17.120 --> 23:21.540]  If you have any right to be there at all, like if you're a legitimate user
[23:21.540 --> 23:24.320]  and you're just exceeding your authorized access,
[23:24.320 --> 23:27.560]  you're not going to be falling in under the computer trespasser exception.
[23:27.560 --> 23:31.700]  You're just not... it's got to be somebody who has no authority or no right to be there at all.
[23:31.920 --> 23:36.740]  And the thing that just really aggravates me about that is it shows that Congress knows
[23:36.740 --> 23:41.780]  that the Computer Fraud and Abuse Act covers people who are outside of the bounds of contract
[23:41.780 --> 23:46.760]  and that they're making criminal something that is just a breach of contract,
[23:46.760 --> 23:49.380]  which I think is wrong and drives me crazy.
[23:49.380 --> 23:52.580]  And you wonder whether maybe they just don't realize what they're doing
[23:52.580 --> 23:56.540]  and then you see that they excluded people with some kind of contractual authority
[23:56.540 --> 24:00.800]  when they made the trespasser exception, which shows that they knew what they were doing all along
[24:00.800 --> 24:05.080]  and they just disagree with me as opposed to they don't know what I know.
[24:05.080 --> 24:07.560]  They know what I know and they like it the way it is.
[24:11.510 --> 24:14.550]  Okay, where can you find out more information about the Patriot Act?
[24:14.550 --> 24:16.230]  Here's some places.
[24:16.390 --> 24:22.710]  And basically, at this point in time, there are many controversial provisions of the Patriot Act
[24:22.710 --> 24:26.370]  which are due to terminate or sunset very soon.
[24:26.490 --> 24:32.730]  And the House of Representatives has reauthorized those provisions and it goes to the Senate now.
[24:32.730 --> 24:36.750]  So it's actually a time where there's a lot of legal work being done on the Patriot Act
[24:36.750 --> 24:41.750]  and it's a good chance and a good opportunity to get involved with Patriot Act issues.
[24:42.730 --> 24:43.470]  Seth?
[24:47.060 --> 24:49.180]  Today? Or yesterday?
[24:50.300 --> 24:54.680]  Okay, so Seth says that the Senate passed a bill that reauthorized most or all?
[24:59.480 --> 25:03.560]  Okay, so he says it has different sunset terms from the House, but they reauthorized everything.
[25:03.560 --> 25:06.800]  And I wasn't reading the newspapers yesterday, so I'm totally behind.
[25:06.800 --> 25:08.900]  But it shows you how fast things move, right?
[25:08.900 --> 25:10.920]  So is it too late for us or what?
[25:17.320 --> 25:21.640]  Okay, so it's not too late. There's still a chance to win the House and Senate conference on the bill.
[25:22.420 --> 25:23.380]  Yeah, it's late.
[25:31.730 --> 25:37.690]  So see what happens when they bring us down here, we're having fun in Las Vegas, and they're busy working up there on stuff we don't like.
[25:38.810 --> 25:39.450]  Okay.
[25:40.350 --> 25:45.530]  So, one of the questions that people had asked me is, like, when can the government surveil me?
[25:45.530 --> 25:47.210]  This is question number four.
[25:47.210 --> 25:55.870]  And I put that on my list of questions, and then I realized it's just simply, completely impossible to do that question any kind of justice in this format.
[25:57.770 --> 25:58.210]  So...
[26:00.420 --> 26:02.860]  Excuse me, I'm trying to figure out how much time I have.
[26:02.940 --> 26:03.560]  Okay.
[26:03.740 --> 26:10.600]  But I thought I would just, you know, make some comments about privacy and about how the laws that govern surveillance work generally
[26:10.600 --> 26:16.640]  to give you a framework for what kind of things should I be looking for or asking when I'm wondering about when I can be surveilled.
[26:16.640 --> 26:23.360]  So there's many different theories of privacy which are sort of operant in our law.
[26:23.420 --> 26:31.140]  And what we've done is sort of, we have like this mishmash of statutes which either try to protect or totally fail to protect privacy.
[26:31.380 --> 26:38.060]  And I think that you can really, sort of a useful framework for looking at privacy questions and questions of surveillance
[26:38.060 --> 26:45.200]  is to ask yourself, you know, these five questions when you're looking at an issue of what is, you know, is this privacy protecting?
[26:45.200 --> 26:48.520]  Is privacy protecting enough or not enough?
[26:48.520 --> 26:56.860]  So, you know, we're looking at what level of proof needs to be shown for a certain kind of information depending on its sensitivity
[26:56.860 --> 27:04.780]  and what safeguards are in place to make sure that there isn't any kind of, you know, unauthorized or excessive use of this personal information.
[27:10.320 --> 27:11.560]  Okay.
[27:12.600 --> 27:15.620]  So, a lot of people ask me questions about encryption.
[27:15.620 --> 27:19.800]  The very popular topic in the survey.
[27:20.120 --> 27:24.300]  And, you know, people wanted to know, you know, these sorts of questions about encryption.
[27:24.420 --> 27:26.660]  Mostly, you know, is using encryption a crime?
[27:26.660 --> 27:27.840]  And why did this come up?
[27:27.840 --> 27:34.860]  Well, again, recently there was a case out of Minnesota in which the court appeared to be holding that
[27:34.860 --> 27:40.920]  the fact that the defendant had PGP on his computer was evidence of criminal intent.
[27:40.920 --> 27:47.060]  Now, for those of you who aren't familiar with the case, I can tell you basically this was a child molest case.
[27:47.060 --> 27:54.060]  And the victim told the investigators that the defendant had molested her and had taken pictures of it.
[27:54.060 --> 27:58.760]  And the investigators got a warrant and they went to search the defendant's computer.
[27:58.820 --> 28:02.680]  And when they searched the defendant's computer, they didn't find any pictures.
[28:02.680 --> 28:09.140]  So, it didn't... that portion of the victim's story was not corroborated.
[28:09.140 --> 28:13.160]  And in ruling on whether or not... but they let in evidence.
[28:13.160 --> 28:19.720]  The trial court let in evidence and considered evidence that the defendant had had PGP on his computer
[28:19.720 --> 28:25.040]  in saying that there was enough evidence for him to be convicted of the child molest.
[28:25.040 --> 28:29.840]  And on appeal, the defendant said that using the encryption evidence,
[28:29.840 --> 28:33.640]  admitting the encryption evidence and using it in that way was improper.
[28:33.880 --> 28:37.560]  And the court of appeal said, no, it's not improper. It's fine.
[28:37.560 --> 28:40.120]  Well, there's a couple ways that you can look at this.
[28:40.120 --> 28:45.320]  So, first of all, did the court say that using encryption itself was a crime? No.
[28:45.320 --> 28:49.920]  So, there are not cases that say purely using encryption is a crime.
[28:49.920 --> 28:55.720]  In fact, there are cases that say the encryption algorithms themselves are protected by free speech principles.
[28:55.860 --> 29:02.200]  Certainly, we also have a right to communicate and a right to communicate anonymously and privately.
[29:02.200 --> 29:05.440]  And so, we don't have cases that say just encryption is bad.
[29:05.440 --> 29:07.740]  But is it evidence of criminal intent?
[29:07.760 --> 29:10.280]  Now, remember, this is one case out of Minnesota.
[29:10.560 --> 29:15.240]  And I don't know how influential Minnesota will be in other states.
[29:15.240 --> 29:19.740]  But what you often find in this area is that the very first case on a topic,
[29:19.740 --> 29:25.940]  even if it's kind of poorly reasoned and poorly explained, like this case is, can become influential.
[29:25.940 --> 29:29.860]  So, you want to be really careful about what it is that the case really says.
[29:29.860 --> 29:36.080]  And one wishes that judges were more careful about what they say that the law is.
[29:36.320 --> 29:43.500]  The two ways to look at this particular opinion are either the one that we're all worried about,
[29:43.500 --> 29:48.620]  which is that when you have PGP on your computer, it shows that you have something to hide.
[29:48.620 --> 29:53.960]  And it shows guilty knowledge and that you're trying to keep stuff from investigators.
[29:53.960 --> 29:59.880]  So, it shows you have consciousness of your own guilt.
[30:00.180 --> 30:10.420]  Another way to read this very same case is that the PGP evidence explains why there wasn't evidence on the defendant's computer.
[30:10.600 --> 30:14.360]  So, it wasn't that it showed that he had something to hide,
[30:14.360 --> 30:18.820]  but it was an explanation for why they didn't find the pictures that they expected to find.
[30:18.820 --> 30:22.160]  Maybe they were encrypted or maybe he'd wiped them or something like that.
[30:22.160 --> 30:26.300]  It's unclear which of these explanations the court is adopting.
[30:26.400 --> 30:33.480]  One maybe makes some kind of sense and doesn't necessarily penalize somebody for having encryption.
[30:33.480 --> 30:38.160]  It just says, well, in the totality of the evidence and because I find the victim so credible,
[30:38.160 --> 30:42.040]  I'm not going to say she's not credible just because I didn't end up finding the pictures
[30:42.040 --> 30:45.940]  because there's other things I can look to to figure out why the pictures might not be there.
[30:45.940 --> 30:49.020]  And that's something maybe we can all live with as opposed to something that says,
[30:49.020 --> 30:52.100]  oh yeah, PGP, that shows that you knew you did something wrong.
[30:52.320 --> 30:54.000]  A question here? I'll go to you in a second.
[31:09.720 --> 31:14.740]  So, he's saying the press on the case, and I agree with this interpretation,
[31:14.740 --> 31:20.500]  it wasn't that the PGP evidence alone was enough, but in context with all the other evidence,
[31:20.500 --> 31:27.580]  was part of there being sufficient proof to convict the defendant of this particular case.
[31:27.580 --> 31:30.260]  And I think that that's a totally reasonable reading of the case
[31:30.260 --> 31:34.900]  and I think we want to be careful when we read these cases to not give them an interpretation.
[31:34.980 --> 31:40.580]  And by we, I don't necessarily mean you guys, I mean we as lawyers and I was going to say we as judges,
[31:40.580 --> 31:43.240]  but we all know that's never going to happen for me.
[31:43.600 --> 31:46.680]  But judges also need to be very careful when reading these cases
[31:46.680 --> 31:50.200]  to make sure that they're not giving an interpretation that's not warranted
[31:50.200 --> 31:55.160]  and taking something that made sense in one small context and expanding it to be a general principle.
[31:55.160 --> 31:57.480]  There was a comment over here. Gentleman here.
[32:12.770 --> 32:16.950]  So it's a question about employees on employer's network.
[32:16.950 --> 32:20.910]  And when you're on your employer's network, this gentleman is right,
[32:20.910 --> 32:24.990]  you have very little privacy and that's for a couple reasons.
[32:24.990 --> 32:30.070]  First of all, many of our privacy laws, like the Fourth Amendment, don't apply to private parties.
[32:30.070 --> 32:32.070]  So the Fourth Amendment doesn't apply.
[32:32.090 --> 32:37.650]  And many of the privacy laws that we do have, privacy rights that we're entitled to by statute,
[32:37.650 --> 32:48.210]  have exceptions in them which will apply to employers and allow employers to do a lot of monitoring and that sort of thing.
[32:48.210 --> 32:51.330]  So people generally have very little privacy at work.
[32:51.330 --> 32:55.010]  And employers have a lot of rights to surveil.
[32:55.010 --> 32:56.750]  Now we've seen limits to that.
[32:56.750 --> 33:04.390]  For example, with cases that involve videotaping and changing rooms and things like that.
[33:04.390 --> 33:08.210]  But a lot of times what employers will just do is say in the employee handbook,
[33:08.210 --> 33:12.450]  everything you do here on your computer is something that we'll monitor and you understand that.
[33:12.450 --> 33:13.850]  And that's basically it.
[33:13.850 --> 33:18.110]  So work is not a great place for privacy, generally.
[33:18.110 --> 33:19.730]  I'll take this question over here.
[33:26.000 --> 33:28.620]  Great question, because this brings me to my next point.
[33:28.620 --> 33:31.220]  And he's like, why is it not covered by the Fifth Amendment?
[33:31.220 --> 33:36.900]  So this is what I'm saying about can you be compelled to turn over your keys so that they can decrypt your stuff.
[33:38.160 --> 33:42.900]  And I hate to say this, because if this ever happens to one of my clients,
[33:42.900 --> 33:46.000]  I'm definitely going to argue that it's a Fifth Amendment violation.
[33:46.020 --> 33:49.360]  But I think the reason you would say it's not a Fifth Amendment violation is this.
[33:49.720 --> 33:53.620]  Fifth Amendment, you can't be compelled to testify against yourself.
[33:53.620 --> 33:54.700]  There's a couple things there.
[33:54.700 --> 33:57.180]  First of all, it has to be compelled.
[33:57.420 --> 34:02.020]  So the stuff you wrote that you encrypted that you don't want to turn over,
[34:02.020 --> 34:03.480]  no one compelled you to write that.
[34:03.480 --> 34:04.780]  You wrote that voluntarily.
[34:04.780 --> 34:06.360]  So there's no compulsion there.
[34:06.360 --> 34:08.760]  The compulsion, and they could search that.
[34:08.760 --> 34:13.000]  If they can get access to it without violating the Fourth Amendment,
[34:13.000 --> 34:16.480]  they can get it because it's not compelled testimony.
[34:16.780 --> 34:18.040]  What about the keys?
[34:18.160 --> 34:20.740]  You're being compelled to turn over the keys, right?
[34:20.740 --> 34:22.460]  But the Fifth Amendment has a second part,
[34:22.460 --> 34:26.980]  which is that what you're compelled to do is something testimonial.
[34:26.980 --> 34:29.320]  And there are a lot of cases about what's testimonial.
[34:29.320 --> 34:34.240]  And for example, cases say stuff like name, rank, and serial number are not testimonial.
[34:34.240 --> 34:37.700]  So if you are compelled to turn over your key,
[34:37.700 --> 34:41.640]  you're not being forced to say anything that's testimonial.
[34:41.640 --> 34:47.140]  All you're doing is giving them the access to the stuff you wrote which wasn't compelled.
[34:47.140 --> 34:51.640]  So the best argument that you have, I think, of why you can't turn the key over is
[34:51.640 --> 34:56.820]  there is something testimonial about the divulging of the key,
[34:56.820 --> 34:58.380]  something that is communicative.
[34:58.380 --> 35:01.940]  And what that is is that you're the person who encrypted it,
[35:01.940 --> 35:05.380]  that you're the person who has access, at the very least, to the information
[35:05.380 --> 35:07.200]  because you've got the key.
[35:07.540 --> 35:12.540]  And I think that the downside of that argument is that what a prosecutor would do
[35:12.540 --> 35:15.160]  if they really wanted the stuff is they would say,
[35:15.160 --> 35:19.380]  all right, you've got a Fifth Amendment right and I'm going to overcome it by giving you immunity.
[35:19.380 --> 35:22.520]  Fifth Amendment rights can be overcome by giving you immunity,
[35:22.520 --> 35:25.060]  which basically says we're not going to use that against you.
[35:25.160 --> 35:27.540]  But they don't have to say we're not going to use what we find against you,
[35:27.540 --> 35:30.220]  and they don't have to say we're not going to use the fact that you...
[35:30.220 --> 35:34.120]  What they say is we won't use the fact that you had the key against you.
[35:34.120 --> 35:37.800]  So you're divulging the key to the extent that it's testimonial.
[35:37.800 --> 35:39.200]  We're not using it against you.
[35:39.200 --> 35:40.880]  Now you have to give us the key.
[35:41.080 --> 35:44.500]  And so then I think you're in a lot of trouble with your Fifth Amendment argument.
[36:01.810 --> 36:05.190]  Okay, so he says, well, you know, but let's say it's somebody with whom you have a privilege,
[36:05.190 --> 36:06.490]  like your wife or something.
[36:16.860 --> 36:22.580]  Okay, so you don't have privilege in information you confide to another person, period.
[36:22.580 --> 36:26.560]  You tell me something, if I'm not your lawyer, they can ask me and I can be forced to tell.
[36:26.560 --> 36:30.340]  The reason why you have a privilege with people like your wife or your shrink or your doctor
[36:30.340 --> 36:34.200]  is because the law has picked out certain relationships that it wants to protect
[36:34.200 --> 36:36.740]  because it wants to encourage the free flow of communication.
[36:36.740 --> 36:40.400]  And it's got certain little enumerated categories that it falls in there.
[36:40.400 --> 36:44.300]  And the reason why it does that is because it's protecting that relationship.
[36:44.320 --> 36:48.080]  Now the spousal privilege, they're protecting it because they don't want to tear your marriage apart
[36:48.080 --> 36:51.240]  by forcing your spouse to testify against you.
[36:51.240 --> 36:54.740]  And they want to make sure that marital communications flow back and forth.
[36:54.740 --> 36:59.620]  But if I write a letter to my husband and it's in my house and they have a right to come search my house,
[36:59.620 --> 37:03.720]  like let's say they have a warrant and they find a letter to my husband, they can use it against me.
[37:03.760 --> 37:10.140]  Just like if you rob a bank and you tell your lawyer, you tell your lawyer I robbed a bank,
[37:10.140 --> 37:13.520]  that doesn't mean that they can't use that statement against you.
[37:13.520 --> 37:16.900]  It just means they can't make me testify that you told me that.
[37:22.700 --> 37:30.360]  Well then the question is, is decrypting a violation of privacy?
[37:30.480 --> 37:36.640]  And what I would say to that is, even if the law says that the fact that you encrypted it
[37:36.640 --> 37:39.980]  shows you have an expectation of privacy in the information,
[37:39.980 --> 37:43.860]  expectations of privacy can be overcome with warrants.
[37:43.860 --> 37:49.940]  If there is probable cause to believe that it's a crime, you may very well have an expectation of privacy,
[37:49.940 --> 37:53.980]  but it is a conditional right which is overcome with a warrant
[37:53.980 --> 37:57.420]  or if there's some exception to the warrant requirement.
[37:57.420 --> 38:01.420]  So just the mere fact that you encrypt it isn't going to give you any kind of absolute protection
[38:01.420 --> 38:04.000]  under either the Fourth Amendment or the Fifth Amendment.
[38:04.380 --> 38:07.220]  I'm going to take this gentleman in the back with the glasses.
[38:21.810 --> 38:24.130]  This is why I love speaking at DEF CON.
[38:24.130 --> 38:27.510]  I never get questions like this at Black Hat.
[38:40.500 --> 38:44.110]  So if I'm married to an android, can it be compelled to...
[38:47.800 --> 38:49.340]  That's a great question.
[38:49.340 --> 38:54.780]  I don't know whether the law would be willing to recognize a privilege between you and a machine
[38:54.780 --> 38:59.000]  even if the machine was serving the purpose that somebody
[38:59.000 --> 39:03.250]  who would otherwise fit under a privileged relationship with you would have.
[39:03.620 --> 39:04.720]  And that's the question.
[39:04.720 --> 39:10.500]  You would have to ask, is the law prepared to protect this person's relationship with the machine
[39:10.500 --> 39:14.380]  the same way that we would protect this person's relationship with a real wife
[39:14.380 --> 39:18.460]  or a real shrink or a real priest.
[39:19.540 --> 39:28.640]  I mean, I'd be speculating, but I'm going to guess maybe not.
[39:28.640 --> 39:31.240]  That's a great question.
[39:32.180 --> 39:35.260]  Wait, can I just... I'm sorry. I'm laughing at your question, but I actually...
[39:35.260 --> 39:38.880]  I'm laughing because it's a fun question, but it allows me to say something,
[39:38.880 --> 39:42.700]  which is that this is the way we deal with stuff exactly in the law, right?
[39:42.720 --> 39:45.280]  You've got computer technology that evolves.
[39:45.360 --> 39:46.800]  I mean, because it's a beautiful question.
[39:46.800 --> 39:50.380]  So you've got computer technology that evolves, and we have these old rules from way back.
[39:50.380 --> 39:54.340]  And now we've kind of got to decide, like, what are we going to do with these old rules in this new world?
[39:54.340 --> 39:56.300]  And so the law has trouble with this.
[39:56.300 --> 39:58.120]  Like, the law just doesn't... and the question is...
[39:58.120 --> 40:02.020]  What we try to do, really, is we try to go back to the reason why we had the law.
[40:02.020 --> 40:04.260]  I mean, in our best moments.
[40:04.380 --> 40:08.160]  We try to go back to the reason why the law existed in the first place
[40:08.160 --> 40:11.500]  and try to preserve those values now into the new world.
[40:11.500 --> 40:15.820]  Which is why I say we'd have to ask whether society or courts would be prepared to say
[40:15.820 --> 40:22.440]  that the interrelationship between me and digital psychiatrists is deserving of the kind of protection
[40:22.440 --> 40:25.840]  that the relationship between me and flesh-and-blood psychiatrists was.
[40:25.840 --> 40:27.760]  And if so, we're going to say yes.
[40:27.760 --> 40:29.460]  And if not, then we're going to say no.
[40:29.460 --> 40:30.880]  Similar question with bloggers.
[40:30.880 --> 40:33.740]  Do bloggers get the same kinds of rights as journalists?
[40:33.740 --> 40:36.500]  You know, we have all of these situations where we have new technology
[40:36.500 --> 40:40.120]  and we're looking to our old rights and privileges and saying, you know,
[40:40.120 --> 40:41.540]  how are these going to be in the new world?
[40:41.540 --> 40:47.200]  So I laughed at your question, but it is the fundamental question that I spend my whole life studying.
[40:47.280 --> 40:51.720]  Which is, what are we going to do with these old laws in this new context?
[40:51.720 --> 40:57.680]  So lest you think I was laughing at the question, I really just enjoyed your scenario.
[40:58.180 --> 40:58.720]  Yes.
[41:13.370 --> 41:15.770]  That's K-I-T-T-Y porn, right?
[41:15.990 --> 41:17.090]  Yeah, I thought so.
[41:24.870 --> 41:26.750]  It's very hypothetical.
[41:54.250 --> 42:00.550]  I mean, yes, what I would say is the stuff that you wrote down, that you then encrypted,
[42:00.550 --> 42:04.510]  the way the law would look at it is say, that's not compelled because you wrote it down voluntarily.
[42:04.510 --> 42:07.890]  And his question, I'm sorry, his question was basically, you know,
[42:07.890 --> 42:10.830]  is there a difference between saying, I'm compelled to testify,
[42:10.830 --> 42:16.490]  versus I'm compelled to give them something which lets testimony against me happen.
[42:16.490 --> 42:20.070]  And what I would say is that, yes, there is a difference,
[42:20.070 --> 42:23.330]  because the Fifth Amendment only applies to compelled testimony,
[42:23.330 --> 42:28.490]  and this is where they're compelling you to get something that's...
[42:28.490 --> 42:33.350]  or the testimony was not compelled, and they're compelling you to give something that's not...
[42:33.350 --> 42:37.730]  Okay, so testimony, or the thing you encrypted was not compelled,
[42:37.730 --> 42:40.670]  and they're just compelling you to give them something non-testimonial, which is the key.
[42:40.670 --> 42:42.510]  So I don't think that that would work.
[42:55.290 --> 42:57.910]  I'm not sure what your question is, but let's go for it.
[42:58.010 --> 42:59.970]  Let me just get through the rest of these slides, and then we'll go.
[43:00.050 --> 43:01.210]  I'm not saying you're compelled.
[43:01.210 --> 43:06.430]  I'm saying, let's say I write in my journal, I killed him, and then I encrypt it.
[43:06.870 --> 43:09.790]  When I wrote I killed him, I wasn't compelled to write it.
[43:09.790 --> 43:11.150]  Fifth Amendment doesn't apply.
[43:11.150 --> 43:14.450]  I encrypt it, and now I have to turn over my key.
[43:14.470 --> 43:16.110]  The key's not testimonial.
[43:16.110 --> 43:17.970]  They can compel me to turn it over.
[43:17.970 --> 43:20.730]  Then they get access to my non-compelled testimony.
[43:20.750 --> 43:22.030]  I'm the one who killed him.
[43:22.230 --> 43:23.050]  Boom, you're done.
[43:24.230 --> 43:25.870]  Okay, statute of limitations.
[43:25.890 --> 43:28.430]  Now, I put this in because I thought this would be a nice, easy question,
[43:28.430 --> 43:31.730]  because statute of limitations, if there's an answer, I should just put a big number up,
[43:31.730 --> 43:35.650]  which will be the number five, and that'll be great because, you know,
[43:35.650 --> 43:39.010]  so many of these questions are it-depends kind of complicated questions.
[43:39.010 --> 43:41.730]  But even the statute of limitations isn't clear,
[43:41.730 --> 43:44.750]  because while there's a five-year statute of limitations for computer crimes,
[43:44.750 --> 43:49.370]  there's another statute that allows courts to suspend the running of statutes of limitations
[43:49.370 --> 43:52.450]  when they're doing investigations that involve evidence in a foreign country.
[43:52.690 --> 43:53.910]  Statute of limitations.
[44:04.360 --> 44:07.140]  Is the content of the key testimony? No.
[44:07.940 --> 44:09.640]  Okay. Logs as evidence.
[44:09.640 --> 44:11.100]  So, a lot of people think...
[44:11.640 --> 44:14.380]  You had a question before, so I'm going to let you ask it.
[44:19.190 --> 44:23.310]  He asked me if there's a notification requirement for an extension of the statute of limitations.
[44:23.310 --> 44:26.050]  I think that's an excellent question, and I don't know the answer to that.
[44:26.050 --> 44:28.730]  So, I'm going to have to look that up, and I'm going to have to get back to you.
[44:28.830 --> 44:32.670]  So, will you email me, my email's on the thing, and make sure that I tell you?
[44:32.670 --> 44:33.930]  Because I don't know.
[44:34.750 --> 44:36.590]  Okay. Logs as evidence.
[44:36.590 --> 44:40.290]  So, a lot of people who are technological people feel that, you know,
[44:40.290 --> 44:47.170]  we know how malleable digital data is, and we feel like there's a very high standard,
[44:47.170 --> 44:50.030]  for admitting logs, computer logs, as evidence.
[44:50.130 --> 44:52.970]  And I think people are always surprised at the extremely...
[44:52.970 --> 44:55.150]  That was good, actually, by the way, that you stumped me.
[44:55.150 --> 44:58.290]  I think that there might be a prize in that for you.
[44:59.910 --> 45:01.790]  I was going to buy him a drink.
[45:03.190 --> 45:06.830]  A lot of people think that you have to, you know,
[45:06.830 --> 45:09.070]  that you have to show that it wasn't tampered with,
[45:09.070 --> 45:11.830]  and that you have to prove that it is exactly the right thing.
[45:12.150 --> 45:14.810]  Sort of, it's almost like the reverse is true.
[45:14.810 --> 45:17.510]  All you have to do to get computer logs admitted as evidence
[45:17.510 --> 45:21.810]  is just show that it is basically what you, as the proponent of the evidence,
[45:21.810 --> 45:22.550]  purport it is.
[45:22.550 --> 45:24.210]  Show that it's reliable enough.
[45:24.210 --> 45:26.810]  And what they do is they bring in the person whose computer it is,
[45:26.810 --> 45:28.790]  you know, who is the system administrator,
[45:28.790 --> 45:31.710]  and he says, yes, we have this computer set to log,
[45:31.710 --> 45:34.590]  and it logs in the regular, normal course of business.
[45:34.590 --> 45:38.150]  And these are the logs, and I pulled this off of the computer
[45:38.150 --> 45:40.850]  in the place where the log files are stored, and here it is.
[45:40.850 --> 45:44.450]  And it looks pretty much like what it was that I pulled off the computer.
[45:44.450 --> 45:49.490]  And at that point in time, the court will say, okay, I'm ready to admit it.
[45:49.490 --> 45:51.910]  And you can say, yeah, but I mean, he could have edited it.
[45:51.910 --> 45:52.570]  What was, you know...
[45:52.570 --> 45:55.450]  In fact, I've had logs that were edited, admitted.
[45:55.450 --> 45:59.650]  I've had logs where they basically cut out all of the extraneous data,
[45:59.650 --> 46:02.290]  leaving behind only the data that showed that it was my client
[46:02.290 --> 46:04.590]  who had been accessing their computer and said, you know,
[46:04.590 --> 46:07.210]  I just, to make it shorter for you, your honor,
[46:07.210 --> 46:09.910]  I just, you know, left in the important, relevant stuff,
[46:09.910 --> 46:11.730]  and I didn't put any of the other stuff in there.
[46:11.730 --> 46:13.210]  So, you know, here's your log.
[46:13.210 --> 46:15.290]  And I was like, you know, you can't do that.
[46:15.290 --> 46:18.270]  And the court was like, well, he says that this is accurate,
[46:18.270 --> 46:20.790]  and so, you know, I'm willing to believe it
[46:20.790 --> 46:22.890]  unless you can show me that it's not accurate.
[46:22.970 --> 46:26.910]  And what usually happens then is you try to show that it's not accurate,
[46:26.910 --> 46:29.150]  and the courts say, well, maybe there might be some question about it,
[46:29.150 --> 46:30.730]  but I'll let the evidence in,
[46:30.730 --> 46:33.610]  and then the trier of fact can decide what weight to give it.
[46:33.610 --> 46:36.850]  So computer logs have been something that courts have been very forgiving about,
[46:37.390 --> 46:39.130]  particularly in my experience.
[46:43.270 --> 46:44.230]  Okay.
[46:44.590 --> 46:46.150]  This is why I sort of wanted to rush
[46:46.150 --> 46:48.790]  to make sure that we had a little bit of time to talk to this stuff.
[46:49.830 --> 46:52.970]  So I think that probably everybody here is familiar with
[46:52.970 --> 46:57.070]  or has heard about the lawsuit that happened earlier this week
[46:57.070 --> 46:59.830]  after Mike Lynn's talk on Wednesday at Black Hat.
[46:59.830 --> 47:02.110]  And I was involved in that case,
[47:02.110 --> 47:06.810]  helping Mike with the aftermath of his talk.
[47:06.850 --> 47:07.790]  Thank you.
[47:13.820 --> 47:15.580]  You know, and while I was doing that,
[47:15.580 --> 47:19.280]  particularly when we were in the six-hour settlement conference
[47:19.280 --> 47:21.300]  with the nine attorneys from the other side
[47:21.300 --> 47:23.060]  trying to hash out a settlement agreement,
[47:23.060 --> 47:25.780]  I was thinking to myself, I can't believe I'm doing this.
[47:25.780 --> 47:28.720]  I'm in Vegas, and I've been up since six in the morning,
[47:28.720 --> 47:29.720]  and I'm working on this.
[47:29.720 --> 47:32.020]  And I thought to myself, you know, and I'm not even getting paid.
[47:32.020 --> 47:35.500]  And then I thought, but I'm really saving a lot of money by not gambling.
[47:35.500 --> 47:38.740]  So actually, I'm way ahead here.
[47:38.740 --> 47:41.620]  So I have Mike to thank, at least for that.
[47:42.460 --> 47:45.280]  But I think that one thing we haven't done a lot of talking about,
[47:45.280 --> 47:49.240]  and I know that there's been a lot of talking and rumors and all of that stuff,
[47:49.240 --> 47:54.120]  and I can't talk about the facts of the case or anything like that,
[47:54.120 --> 47:55.980]  and I don't want to take any questions on that,
[47:55.980 --> 47:57.760]  but I do want to talk a little bit about the law
[47:57.760 --> 48:03.960]  and how it was that they claimed that what he did was improper.
[48:04.520 --> 48:09.780]  So basically, this was a case that involved California's Trade Secret Act.
[48:09.780 --> 48:15.000]  And the Trade Secret Law prohibits the misappropriation of trade secrets.
[48:15.080 --> 48:17.520]  So what's a trade secret?
[48:23.490 --> 48:27.070]  All right, so this is awesome that you guys are here.
[48:30.990 --> 48:34.110]  We have, first of all, this is Mike's cape.
[48:34.110 --> 48:37.970]  We made him a superhero cape to go with his hat.
[48:38.170 --> 48:43.110]  And we're going to use it right now to let Jennifer change into her present that we got her.
[48:43.990 --> 48:46.290]  And Jennifer, she's doing such an awesome job.
[48:46.290 --> 48:48.390]  She can probably share this cape with Mike.
[48:48.390 --> 48:49.950]  She's just doing such an awesome job.
[48:50.350 --> 48:51.150]  Yeah!
[48:58.310 --> 49:00.210]  You guys look fabulous.
[49:01.490 --> 49:02.470]  All right, thank you.
[49:02.470 --> 49:03.990]  But I want that cape, though.
[49:05.430 --> 49:07.210]  Did you guys see the Incredibles?
[49:07.510 --> 49:08.730]  No capes.
[49:12.610 --> 49:14.670]  Oh, that's beautiful.
[49:14.670 --> 49:15.930]  I'll make sure he gets it.
[49:16.770 --> 49:17.930]  Thanks, you guys.
[49:20.250 --> 49:21.390]  Trade Secret Law.
[49:21.390 --> 49:22.990]  It's very serious business.
[49:25.590 --> 49:30.830]  So a trade secret is information that derives its value from the fact that it's not...
[49:30.830 --> 49:32.710]  All right, you guys are making me laugh.
[49:33.950 --> 49:39.990]  A trade secret law is information that derives its value from the fact that it's not generally known to the public.
[49:40.090 --> 49:41.730]  So that's thing number one.
[49:41.730 --> 49:44.730]  And so the first thing you have to ask yourself when you've got a trade secret case is,
[49:44.730 --> 49:46.350]  what's the secret?
[49:46.350 --> 49:49.710]  Is it the kind of thing that's protected by trade secret law?
[49:49.710 --> 49:53.390]  And then the second thing you ask yourself is, what's the misappropriation?
[49:53.390 --> 49:56.550]  So there's two possible claims here.
[49:56.550 --> 50:02.010]  One claim is that the information that he had about what the flaw was,
[50:02.010 --> 50:07.910]  was a trade secret to his employer, or rather I should say his ex-employer, ISS.
[50:07.910 --> 50:10.350]  The other possibility is that the case is about...
[50:10.910 --> 50:15.290]  that there's something about the Cisco code that remains a trade secret to Cisco.
[50:15.290 --> 50:17.010]  So... question.
[50:24.500 --> 50:26.640]  So his question is about whistleblower laws.
[50:26.640 --> 50:30.840]  So let me make sure that he's a researcher, but let me get to that.
[50:30.840 --> 50:36.740]  Because my second summer of law school, I worked at this whistleblower place in DC.
[50:36.740 --> 50:38.420]  So I know a bit about the whistleblower laws.
[50:38.420 --> 50:41.980]  But my particular whistleblower specialty is FIFRA,
[50:41.980 --> 50:46.120]  which is the Federal Insecticide, Fungicide, and Redenticide Act.
[50:46.120 --> 50:50.280]  And I did a white paper on the whistleblower provisions of FIFRA.
[50:50.280 --> 50:56.200]  So if anybody here has any rodenticide researcher issues,
[50:56.200 --> 51:00.180]  I think that I'm the person most qualified to respond to those.
[51:01.040 --> 51:02.900]  You laugh, but it's true.
[51:03.760 --> 51:07.940]  Okay, so then the question is, was it misappropriated?
[51:08.060 --> 51:11.800]  And so, what is misappropriation?
[51:11.800 --> 51:19.820]  Well, the statute says, specifically, that reverse engineering is a proper way of discovering something,
[51:19.820 --> 51:21.580]  even if it's a trade secret.
[51:21.760 --> 51:25.860]  And reverse engineering is specifically allowed under California law.
[51:25.860 --> 51:29.880]  And I have quoted here for you what the California law is about reverse engineering.
[51:29.880 --> 51:33.100]  And you can see, reverse engineering or independent derivation alone
[51:33.100 --> 51:35.200]  shall not be considered improper means.
[51:35.200 --> 51:36.780]  So that's an important thing, number one.
[51:36.780 --> 51:39.680]  But the other important thing about this statute is it does say
[51:39.680 --> 51:43.920]  that it's improper if you breach a duty to maintain secrecy.
[51:43.920 --> 51:46.200]  Okay, so we've got these two functional things here.
[51:46.200 --> 51:48.920]  One, is there a duty to maintain secrecy?
[51:48.920 --> 51:53.340]  And two, or was it independently derived?
[51:54.300 --> 51:59.820]  So, the issue in the case is basically, you know, what did he disclose
[51:59.820 --> 52:05.360]  and was it in violation of some duty to keep it secret or was it independently derived?
[52:05.380 --> 52:09.440]  So, a violation of a nondisclosure agreement, for example,
[52:09.560 --> 52:14.060]  a nondisclosure agreement with an employer, might be a trade secret violation.
[52:14.060 --> 52:17.200]  But that, if you read the complaint, wasn't part of the case.
[52:17.200 --> 52:22.140]  There wasn't a claim that he had disclosed something that was a secret
[52:22.140 --> 52:24.860]  and was proprietary to his employer.
[52:24.860 --> 52:27.900]  What the claim was, really, if you looked at the complaint,
[52:27.900 --> 52:36.080]  was that the machine code that he had disassembled from the Cisco binary
[52:36.080 --> 52:42.400]  was a trade secret as to Cisco and that he revealed that information to the public
[52:42.400 --> 52:45.960]  when he showed his slides at the presentation.
[52:45.960 --> 52:50.020]  And so, the question there, clearly, the statute clearly says,
[52:50.020 --> 52:53.120]  although, of course, they don't cite the statute in their papers very much,
[52:53.120 --> 52:55.780]  the statute clearly says reverse engineering is okay.
[52:55.940 --> 52:59.040]  Reverse engineering alone isn't improper.
[52:59.040 --> 53:01.980]  And they said, well, it's not reverse engineering alone,
[53:01.980 --> 53:04.800]  it's reverse engineering in violation of our EULA.
[53:04.800 --> 53:07.920]  Because when you get the Cisco, you know, when you get the Cisco router,
[53:07.920 --> 53:12.000]  our EULA says, and for those of you who don't know, it's the end user license agreement
[53:12.000 --> 53:17.560]  or terms of service for use of the machine, our EULA says no reverse engineering.
[53:17.680 --> 53:20.520]  So, now, EULAs have a lot of issues.
[53:20.520 --> 53:24.460]  And I think I've decided that next year for me is going to be EULA year
[53:24.460 --> 53:27.080]  and I'm going to be worrying a lot about EULAs.
[53:27.160 --> 53:32.880]  And one of the ways that people have always attacked EULAs has been on the issue of formation.
[53:32.880 --> 53:36.540]  Is it really a contract if you just slap some warning on your product
[53:36.540 --> 53:40.480]  and I never click I agree or, you know, have any kind of, you know,
[53:40.480 --> 53:43.460]  intention to enter into a contract with you.
[53:43.460 --> 53:49.580]  But I don't believe personally that attacking EULAs solely on the grounds that it's not really a contract
[53:49.580 --> 53:54.420]  because we never had this offer and acceptance meeting of the minds that's required for contracts to happen
[53:54.420 --> 53:57.920]  is a very fruitful process.
[53:57.920 --> 54:02.820]  I think that it's a dead end in the long run because we'll end up with things where they'll make you agree
[54:02.820 --> 54:05.880]  and most people will agree to something like no reverse engineering
[54:05.880 --> 54:11.860]  and those few people who do care to reverse engineer just simply won't be able to buy the product.
[54:11.940 --> 54:14.820]  But we can talk more about that in question and answer.
[54:14.820 --> 54:19.540]  I think the question that was really raised by the lawsuit in this case
[54:19.540 --> 54:25.940]  and the thing that made me super interested in it was the question of whether the violation of a promise in the EULA
[54:25.940 --> 54:33.080]  i.e. a promise not to reverse engineer is a violation of the trade secret law.
[54:33.080 --> 54:38.720]  Something beyond simply having reverse engineered and independently derived it
[54:38.720 --> 54:46.420]  the violation of some kind of promise that makes something that ordinarily might just be a contract breach a crime.
[54:46.420 --> 54:49.460]  Or at the very least something that imposes civil liability.
[54:49.460 --> 54:55.360]  And as you may have guessed from my comment before about the website terms of service
[54:55.360 --> 54:57.500]  and employment contracts and that sort of thing
[54:57.500 --> 55:01.780]  it really makes me mad when suddenly breaches of contracts are crimes.
[55:01.780 --> 55:05.060]  It's just not something that used to be true in the law at all.
[55:05.060 --> 55:09.800]  In fact, breaches of contracts are things for which you can't even get punitive damages usually
[55:09.800 --> 55:15.100]  because the law likes to see people breach contracts when it's economically efficient.
[55:15.100 --> 55:19.040]  So if I have a contract with you, but I can make more money with somebody else
[55:19.040 --> 55:21.020]  I'm allowed to breach the contract with you.
[55:21.020 --> 55:22.900]  I pay you what you expected to get
[55:22.900 --> 55:28.800]  and I get to reap the profit of the fact that I got to enter into a contract with somebody else
[55:28.800 --> 55:30.600]  and the law is happy.
[55:30.600 --> 55:34.400]  There's no moral opprobrium that attaches to breaches of contracts.
[55:34.400 --> 55:38.620]  So it really bothers me to see these kinds of things made criminal.
[55:38.720 --> 55:42.180]  And I think that one of the things sort of in the bigger picture that the case raised
[55:42.180 --> 55:46.300]  is this question of is there a limit to the enforceability of EULAs
[55:46.300 --> 55:50.620]  and can EULAs be the grounds for these sorts of other kinds of offenses.
[55:50.620 --> 55:52.520]  I have a question from this gentleman here.
[55:58.640 --> 56:01.980]  So the question is if the information is discoverable by reverse engineering
[56:01.980 --> 56:04.440]  is it a trade secret and the answer to that is no.
[56:04.520 --> 56:08.260]  Because first you did not obtain it by improper means.
[56:08.440 --> 56:11.640]  You discovered it. No longer a secret.
[56:11.680 --> 56:13.160]  So it's no longer a trade secret.
[56:13.160 --> 56:15.660]  So the answer is basically no.
[56:15.660 --> 56:17.260]  There's a question from this gentleman in the green.
[56:26.490 --> 56:29.530]  We don't have a decision in Blizzard yet, right?
[56:29.590 --> 56:40.030]  Okay, so I will answer your question.
[56:40.030 --> 56:46.110]  So Blizzard versus BnetD is a case that involves a manufacturer of one of these multiplayer games
[56:46.110 --> 56:49.150]  and some people who reverse engineered that game and built their own server
[56:49.150 --> 56:51.590]  on which people could play the games compatibly.
[56:51.650 --> 56:55.190]  And the case is now on appeal, which is why I said there wasn't a decision,
[56:55.190 --> 56:58.990]  but this gentleman is right that there was a decision from the trial court below.
[56:58.990 --> 57:04.130]  And what the trial court below said was that if you have a user agreement
[57:04.130 --> 57:08.310]  that says no reverse engineering, then those terms are enforceable.
[57:08.310 --> 57:10.170]  There's another case that says the same thing.
[57:10.170 --> 57:11.970]  It's Bowers versus Baystate.
[57:11.970 --> 57:16.150]  And that case also says terms in EULAs are enforceable.
[57:16.150 --> 57:20.430]  And the EULA picture is this, to kind of give you the big picture of where we're at.
[57:22.150 --> 57:25.090]  So contracts require offer and acceptance.
[57:25.090 --> 57:27.050]  This really was one of my favorite classes in law school
[57:27.050 --> 57:28.950]  because it's so beautiful if you think about it.
[57:28.950 --> 57:32.550]  There's an offer, there's acceptance, there's mutual consideration,
[57:32.550 --> 57:34.010]  there's this meeting of the minds.
[57:34.010 --> 57:35.410]  It's very romantic.
[57:35.410 --> 57:40.830]  But those things are required, right?
[57:40.830 --> 57:44.670]  So a lot of cases that involve things like click wrap or browse wrap,
[57:44.670 --> 57:48.190]  we have cases that say if there's not actually an offer and acceptance,
[57:48.190 --> 57:49.270]  then it's not a contract.
[57:49.270 --> 57:51.330]  So if it's just something that says legal at the bottom
[57:51.330 --> 57:54.370]  and you don't have to click on it or agree or anything,
[57:54.370 --> 57:57.910]  then it's not a contract and you're not bound by those terms.
[57:58.110 --> 58:01.250]  And there's other situations where you don't have notice or something like that,
[58:01.250 --> 58:04.490]  or maybe you do have notice and you continue to use the site.
[58:04.490 --> 58:06.890]  So the question is, is there agreement to the terms?
[58:06.890 --> 58:09.470]  And those are things I would call formation issues.
[58:09.470 --> 58:11.050]  Was there a meeting of the minds?
[58:11.050 --> 58:14.930]  Did the person know what the terms were and manifest their assent,
[58:14.930 --> 58:18.270]  either through clicking OK or for using it or something like that?
[58:18.270 --> 58:19.770]  So formation issues.
[58:19.870 --> 58:22.950]  If there's formation, there's offer and there's acceptance,
[58:22.950 --> 58:27.210]  either through actual clicking OK or through notice and continued use,
[58:27.210 --> 58:29.970]  then you're into the question of whether the terms are enforceable.
[58:29.970 --> 58:33.810]  And my fear is if you have every term be enforceable no matter what,
[58:33.810 --> 58:38.430]  you can have EULAs that say, no talking nasty about this product.
[58:38.450 --> 58:42.510]  And maybe 95% of the people in the world don't want to talk nasty about the product.
[58:42.510 --> 58:44.090]  They just want to buy it and use it.
[58:44.090 --> 58:46.150]  And so most of us will just agree.
[58:46.150 --> 58:48.930]  And those people who do want to talk nasty about the product,
[58:48.930 --> 58:51.350]  the company doesn't need to sell to them.
[58:51.430 --> 58:55.050]  And so they'll never be able to buy it.
[58:55.050 --> 58:56.210]  They won't sell it to them.
[58:56.210 --> 58:58.330]  And they won't buy it and they won't have access to the product,
[58:58.330 --> 59:01.630]  so they won't be able to test it or benchmark it or anything.
[59:01.630 --> 59:03.970]  And all the rest of us will be happily using the product
[59:03.970 --> 59:07.170]  and no one will be allowed to tell us that the product stinks.
[59:07.530 --> 59:11.390]  So, you know, when I say that I think next year will be EULA year,
[59:11.390 --> 59:13.130]  the thing that I'm really concerned about is,
[59:13.130 --> 59:16.130]  are there limitations to the terms that will be enforceable in EULAs
[59:16.130 --> 59:19.890]  when you have a situation where the term is contrary to public policy?
[59:20.130 --> 59:21.850]  Individually it might not be a big deal,
[59:21.850 --> 59:24.930]  but in aggregate it deprives the public of the right to know something
[59:24.930 --> 59:27.990]  or the right to do something that has great public benefit.
[59:27.990 --> 59:29.550]  A question right here.
[01:00:01.840 --> 01:00:05.660]  Okay, so his question is, you know, how far does the contract extend?
[01:00:05.660 --> 01:00:08.380]  So if I buy it with, you know, if I buy somebody's product,
[01:00:08.380 --> 01:00:11.080]  maybe I agree to the EULA, but when I sell it to somebody else
[01:00:11.080 --> 01:00:13.860]  and the software is already installed and everything,
[01:00:13.860 --> 01:00:15.900]  you know, those people, the second, you know,
[01:00:15.900 --> 01:00:18.560]  the second purchaser hasn't agreed to the contract,
[01:00:18.560 --> 01:00:21.780]  so maybe the second purchaser isn't bound by it at all.
[01:00:21.780 --> 01:00:24.380]  And I think that, you know, in some ways that's a good argument.
[01:00:24.380 --> 01:00:28.040]  I actually, I'm not 100% sure of that question,
[01:00:28.040 --> 01:00:30.940]  but I think that, you know, you could make me agree to terms of contract
[01:00:30.940 --> 01:00:34.740]  simply by selling something to me without my also having notice.
[01:00:35.040 --> 01:00:36.900]  So I think that that may be sort of a break.
[01:00:36.900 --> 01:00:39.700]  And, you know, if I were going to buy your machine
[01:00:39.700 --> 01:00:42.880]  with your ancient copy of Microsoft Windows on it
[01:00:42.880 --> 01:00:45.280]  and continue to use it without reinstalling or anything,
[01:00:45.280 --> 01:00:48.900]  maybe I wouldn't be bound by that, by those terms.
[01:00:48.900 --> 01:00:51.860]  But if I, let's say then I decided that I was going to criticize
[01:00:52.680 --> 01:00:55.720]  Microsoft's product or something, and they wrote to me and they said,
[01:00:55.720 --> 01:00:58.980]  hey, we hear you're criticizing us, and that's contrary to our EULA,
[01:00:58.980 --> 01:01:03.300]  you can't either stop criticizing us or stop using our product,
[01:01:03.300 --> 01:01:04.580]  then I'm on notice.
[01:01:04.580 --> 01:01:08.120]  And what a lot of the cases say is that notice plus continued use
[01:01:08.720 --> 01:01:11.380]  will bind me to the terms of the contract.
[01:01:11.380 --> 01:01:15.340]  So, you know, it hasn't always been a great defense.
[01:01:15.340 --> 01:01:17.540]  Well, I don't know about the terms or I've never agreed
[01:01:17.540 --> 01:01:20.480]  because they managed to get you when they do the,
[01:01:20.480 --> 01:01:22.320]  we're going to get to see the food again.
[01:01:31.810 --> 01:01:32.530]  Right.
[01:01:33.450 --> 01:01:35.790]  So this gentleman's point is, well, at that point, you know,
[01:01:35.790 --> 01:01:38.430]  you didn't break the contract, so you could just stop using it
[01:01:38.430 --> 01:01:42.550]  and continue to be free to say or do whatever you want at that point,
[01:01:42.550 --> 01:01:44.450]  and I think that that probably would be right.
[01:01:44.730 --> 01:01:45.330]  Yes.
[01:01:52.230 --> 01:01:56.490]  So his question is, what if I spent a lot of money on it
[01:01:56.490 --> 01:01:59.030]  and either they tell me to stop using it or, you know,
[01:01:59.030 --> 01:02:01.990]  then I learn that the terms of service are something that I don't like.
[01:02:01.990 --> 01:02:05.810]  And there was a class action suit in California on this issue
[01:02:05.810 --> 01:02:07.490]  because of shrink wrap.
[01:02:07.490 --> 01:02:10.810]  So people buy software, they take it home, they open the box,
[01:02:10.810 --> 01:02:12.850]  they see these restrictive license terms,
[01:02:12.850 --> 01:02:14.150]  they don't want the software anymore.
[01:02:14.150 --> 01:02:16.070]  So they take it back to Best Buy, and Best Buy's like,
[01:02:16.070 --> 01:02:17.910]  we don't take your open software.
[01:02:17.990 --> 01:02:20.290]  So then they try to return it to the vendor, and the vendor said,
[01:02:20.290 --> 01:02:23.370]  we don't take your open, you know, we're not taking that back either.
[01:02:23.850 --> 01:02:25.050]  And so what do you do?
[01:02:25.050 --> 01:02:27.210]  So there was a class action suit in California,
[01:02:27.210 --> 01:02:29.650]  which said basically, you know, if you're going to do this,
[01:02:29.650 --> 01:02:30.990]  if you're going to have your terms of service
[01:02:30.990 --> 01:02:32.230]  on the inside of the box,
[01:02:32.230 --> 01:02:33.570]  or if you're going to have your terms of service
[01:02:34.050 --> 01:02:36.170]  pop up only when you install,
[01:02:36.170 --> 01:02:37.930]  you've got to let people take it back
[01:02:37.930 --> 01:02:39.130]  and get their money back.
[01:02:39.130 --> 01:02:42.750]  So practically, that never happens,
[01:02:42.750 --> 01:02:44.810]  but legally it's supposed to happen.
[01:02:45.090 --> 01:02:46.850]  All right, some other questions?
[01:02:46.850 --> 01:02:48.010]  I can take a few more questions
[01:02:48.010 --> 01:02:50.110]  because the people who are coming after us are late.
[01:02:50.110 --> 01:02:51.370]  So let's go for like three more minutes
[01:02:51.370 --> 01:02:53.050]  if anybody has other questions about this.
[01:02:53.050 --> 01:02:54.390]  Let me just do my last slide.
[01:02:54.390 --> 01:02:55.570]  So when to talk to a lawyer.
[01:02:55.570 --> 01:02:57.430]  So as you can see, this is really complicated.
[01:02:57.430 --> 01:02:59.310]  And so, you know, you sort of
[01:02:59.310 --> 01:03:01.270]  almost always need to talk to a lawyer,
[01:03:01.270 --> 01:03:04.230]  unfortunately, which is too bad for you guys,
[01:03:04.230 --> 01:03:05.670]  but great for lawyers.
[01:03:06.930 --> 01:03:07.570]  You know,
[01:03:07.570 --> 01:03:09.350]  the law is really complicated,
[01:03:09.350 --> 01:03:11.410]  and if you feel like, I definitely know,
[01:03:11.410 --> 01:03:12.950]  I'm doing something that I thought was kind of
[01:03:12.950 --> 01:03:15.510]  maybe risky, but now I definitely know
[01:03:15.510 --> 01:03:17.390]  that it's either illegal or illegal,
[01:03:17.390 --> 01:03:19.130]  then you definitely need to talk to a lawyer
[01:03:19.130 --> 01:03:21.650]  because if you think that the answers are really clear,
[01:03:21.650 --> 01:03:23.670]  then you're not getting it at all.
[01:03:23.670 --> 01:03:25.530]  If you think that the answer is,
[01:03:25.530 --> 01:03:28.290]  it depends, and I kind of know what it depends upon,
[01:03:28.290 --> 01:03:29.750]  but maybe it depends on more things too,
[01:03:29.750 --> 01:03:32.030]  and I might need to get a little more advice on this,
[01:03:32.030 --> 01:03:33.350]  then you're in good shape.
[01:03:33.370 --> 01:03:36.650]  So that's the sort of finale of my talk.
[01:03:36.650 --> 01:03:37.790]  And I'll take a couple more questions
[01:03:37.790 --> 01:03:38.890]  if there are some.
[01:03:38.890 --> 01:03:40.290]  I'll take one here.
[01:03:47.900 --> 01:03:49.620]  Is reading the machine code
[01:03:49.620 --> 01:03:50.820]  reverse engineering?
[01:03:51.520 --> 01:03:53.080]  I think here
[01:03:53.080 --> 01:03:54.500]  it was,
[01:03:54.500 --> 01:03:57.080]  I think here we agreed it was reverse engineering
[01:03:57.080 --> 01:03:59.300]  because he decompiled it from the binary.
[01:03:59.380 --> 01:04:01.240]  But if you've got machine code,
[01:04:01.240 --> 01:04:03.560]  reading it is, I mean, reverse engineering,
[01:04:03.560 --> 01:04:05.000]  the courts have looked at reverse engineering
[01:04:05.000 --> 01:04:06.740]  as being a lot of things.
[01:04:06.740 --> 01:04:08.060]  Testing, you know,
[01:04:08.620 --> 01:04:10.740]  trying to watch processes
[01:04:10.740 --> 01:04:13.100]  and replicate,
[01:04:13.740 --> 01:04:14.520]  decompiling.
[01:04:14.520 --> 01:04:16.680]  So a lot of things are reverse engineering,
[01:04:16.680 --> 01:04:18.880]  but I mean, either it's legal
[01:04:18.880 --> 01:04:20.620]  because you're reading something that's already written
[01:04:20.620 --> 01:04:22.480]  or you're reverse engineering.
[01:04:50.080 --> 01:04:51.660]  So what he's saying,
[01:04:51.660 --> 01:04:52.420]  what his comment is
[01:04:52.420 --> 01:04:53.580]  that he doesn't think machine code
[01:04:54.800 --> 01:04:56.180]  is either secret
[01:04:56.800 --> 01:04:58.700]  or is reverse engineering.
[01:04:58.700 --> 01:05:01.280]  And I think there's a good argument for that.
[01:05:15.140 --> 01:05:16.700]  The beer is not here yet,
[01:05:16.700 --> 01:05:17.840]  so you have to,
[01:05:17.840 --> 01:05:19.760]  so I'm going to, which is a tragedy,
[01:05:19.760 --> 01:05:21.800]  so I'm going to take a few more questions
[01:05:21.800 --> 01:05:22.840]  if people have other questions.
[01:05:22.840 --> 01:05:24.180]  This gentleman in the back.
[01:05:30.090 --> 01:05:31.370]  But for those of you,
[01:05:31.370 --> 01:05:33.230]  I'm going to try to take questions still,
[01:05:33.230 --> 01:05:34.790]  so you guys have to be kind of quiet
[01:05:34.790 --> 01:05:36.310]  because I can't hear what he's saying.
[01:05:43.580 --> 01:05:44.520]  So the question is,
[01:05:44.520 --> 01:05:46.200]  do I think Cisco got what they wanted
[01:05:46.200 --> 01:05:47.380]  out of the case?
[01:05:48.480 --> 01:05:50.860]  I'm, you know, I'm not a
[01:05:50.860 --> 01:05:52.760]  researcher, so I may be a little more
[01:05:52.760 --> 01:05:54.740]  compassionate to most of the players
[01:05:55.120 --> 01:05:56.760]  in this than other people are.
[01:05:56.760 --> 01:05:58.380]  I think Cisco definitely didn't get
[01:05:58.380 --> 01:05:59.800]  what they wanted out of this case.
[01:05:59.800 --> 01:06:02.560]  I mean, I can tell you what their point,
[01:06:02.560 --> 01:06:04.580]  what they thought they were doing
[01:06:04.580 --> 01:06:06.800]  was. And in the settlement agreement
[01:06:06.800 --> 01:06:08.440]  that we entered into to
[01:06:08.440 --> 01:06:10.120]  settle the civil case,
[01:06:10.700 --> 01:06:12.840]  Cisco and ISS insisted
[01:06:13.760 --> 01:06:14.740]  that the settlement
[01:06:14.740 --> 01:06:16.600]  agreement say that Cisco
[01:06:16.600 --> 01:06:19.100]  and ISS were working together on a
[01:06:19.100 --> 01:06:20.720]  presentation that would have revealed
[01:06:20.720 --> 01:06:22.660]  the problem without revealing stuff
[01:06:22.660 --> 01:06:25.340]  that they felt was trade secret information.
[01:06:25.340 --> 01:06:26.960]  Now, I have no information
[01:06:26.960 --> 01:06:28.800]  personally whether or not that was true, because I came into
[01:06:28.800 --> 01:06:30.560]  the whole thing, you know, after that.
[01:06:30.560 --> 01:06:32.580]  But I think that what Cisco,
[01:06:32.580 --> 01:06:34.540]  if you asked them, and I'm not them,
[01:06:34.540 --> 01:06:36.520]  but to try to be fair to them, I think what they would
[01:06:36.520 --> 01:06:38.580]  have said is that they really had
[01:06:38.580 --> 01:06:41.060]  certain things that they definitely didn't want,
[01:06:41.060 --> 01:06:43.200]  which was the code and the pointers,
[01:06:43.200 --> 01:06:44.660]  and that they ended up getting
[01:06:44.660 --> 01:06:46.660]  exactly, totally not what they
[01:06:46.660 --> 01:06:48.620]  wanted in all of this, because all of
[01:06:48.620 --> 01:06:51.060]  that came out, and they look bad,
[01:06:51.060 --> 01:06:52.880]  and they had to pay lawyers,
[01:06:52.880 --> 01:06:54.480]  and they had to pay to have the
[01:06:54.480 --> 01:06:56.720]  materials taken out of the presentation stuff,
[01:06:56.720 --> 01:06:58.320]  and they had to pay to get rid of the CDs
[01:06:58.320 --> 01:07:00.560]  and make new CDs. So they have
[01:07:00.560 --> 01:07:02.460]  had a really bad week, in addition
[01:07:02.460 --> 01:07:04.020]  to the rest of us
[01:07:04.540 --> 01:07:06.020]  having a really bad week, too.
[01:07:06.380 --> 01:07:08.600]  I know it was tough, but I got a cape out
[01:07:08.600 --> 01:07:10.560]  of it, so...
[01:07:30.260 --> 01:07:31.160]  So the question
[01:07:31.160 --> 01:07:32.840]  is, our click wrap
[01:07:32.840 --> 01:07:34.760]  and shrink wrap aren't really meeting
[01:07:34.760 --> 01:07:36.980]  of the minds, because it's kind of a take it or leave
[01:07:36.980 --> 01:07:39.180]  it thing. Can you modify the terms
[01:07:39.180 --> 01:07:40.440]  ahead of time and then click
[01:07:40.940 --> 01:07:41.820]  accept?
[01:07:47.720 --> 01:07:48.160]  And...
[01:07:48.160 --> 01:07:49.760]  Is he calling me?
[01:07:50.820 --> 01:07:52.400]  So the question is, can I modify
[01:07:52.400 --> 01:07:54.160]  the terms? And the answer is no, because then you don't
[01:07:54.160 --> 01:07:56.160]  have a meeting of minds on the other end.
[01:07:57.140 --> 01:07:58.140]  So I'm told that
[01:07:58.140 --> 01:08:00.080]  I should answer this phone call, which I'm going
[01:08:00.080 --> 01:08:01.560]  to do, since we're on
[01:08:02.400 --> 01:08:03.120]  overtime.
[01:08:08.420 --> 01:08:09.280]  A call-in
[01:08:09.280 --> 01:08:11.160]  question. Okay, I'll take a call-in
[01:08:11.160 --> 01:08:13.360]  question. Let's see
[01:08:13.360 --> 01:08:15.120]  if I can do it through the...
[01:08:15.120 --> 01:08:17.500]  Let's see if you can do it through the microphone.
[01:08:17.500 --> 01:08:18.060]  Ready?
[01:08:21.430 --> 01:08:22.070]  No,
[01:08:22.070 --> 01:08:22.870]  it doesn't play.
[01:08:23.210 --> 01:08:31.790]  Okay, it was a personal
[01:08:31.790 --> 01:08:33.390]  question, which I don't answer.
[01:08:35.790 --> 01:08:37.910]  Does anybody have an appropriate
[01:08:38.510 --> 01:08:39.850]  professional, non-personal
[01:08:39.850 --> 01:08:40.770]  question?
[01:09:03.610 --> 01:09:04.630]  So, the
[01:09:04.630 --> 01:09:06.770]  question was about the encryption issue
[01:09:06.770 --> 01:09:08.970]  and the forced disclosure.
[01:09:08.970 --> 01:09:10.650]  And I'm not a...
[01:09:10.650 --> 01:09:12.790]  I'm not familiar with these cases that you're referring
[01:09:12.790 --> 01:09:14.690]  to where journalists have been forced to turn
[01:09:14.690 --> 01:09:16.750]  over encryption keys.
[01:09:16.750 --> 01:09:18.750]  The difference there might be that we're not
[01:09:18.750 --> 01:09:20.170]  talking about something that is
[01:09:20.890 --> 01:09:22.570]  incriminating. I mean, that might be one
[01:09:22.570 --> 01:09:24.810]  difference. Then you also have another difference,
[01:09:24.810 --> 01:09:26.630]  which is you've got this journalist thing, which brings in
[01:09:26.630 --> 01:09:28.730]  all this free press type of issues as
[01:09:28.730 --> 01:09:30.690]  well. But I think the fundamental thing is
[01:09:30.690 --> 01:09:33.050]  that the Fifth Amendment applies
[01:09:33.050 --> 01:09:34.670]  very... I mean, the arguments for the Fifth
[01:09:34.670 --> 01:09:36.630]  Amendment application to compulsory key
[01:09:36.630 --> 01:09:38.730]  turning over, I think, are weak.
[01:09:38.730 --> 01:09:40.450]  Though I hate to say it.
[01:09:41.430 --> 01:09:44.780]  All right.
[01:09:44.780 --> 01:09:46.300]  Do you want me to keep going?
[01:09:48.000 --> 01:09:48.640]  All right.
[01:09:49.140 --> 01:09:50.100]  Other questions?
[01:09:53.730 --> 01:09:55.070]  All right. So, there's no
[01:09:55.070 --> 01:09:56.970]  other questions, so I'm not going to keep going, but as
[01:09:56.970 --> 01:09:58.670]  you can see, we have the next thing that's happening.
[01:09:58.670 --> 01:09:59.690]  Do you want to say something?
[01:10:00.230 --> 01:10:00.870]  Okay.
[01:10:02.670 --> 01:10:03.270]  I could tell...
[01:10:05.570 --> 01:10:07.170]  All right. So, you guys...
[01:10:07.170 --> 01:10:09.090]  Let's see. Do you guys want to hear a story?
[01:10:09.850 --> 01:10:10.570]  All right.
[01:10:12.710 --> 01:10:13.190]  Okay.
[01:10:13.190 --> 01:10:15.090]  I'm going to tell you guys
[01:10:15.290 --> 01:10:17.270]  a story about the first time
[01:10:17.270 --> 01:10:19.030]  I tried to help somebody who got arrested
[01:10:19.030 --> 01:10:20.050]  at DEF CON.
[01:10:21.850 --> 01:10:23.010]  This was back in
[01:10:24.790 --> 01:10:25.590]  1999 when...
[01:10:25.590 --> 01:10:27.650]  Okay. I'm not sure. I don't remember what year it is.
[01:10:28.990 --> 01:10:29.390]  But...
[01:10:30.370 --> 01:10:31.330]  I don't know.
[01:10:31.330 --> 01:10:32.870]  This isn't my laptop.
[01:10:33.170 --> 01:10:34.570]  So, I'm just going to...
[01:10:35.050 --> 01:10:37.590]  Okay. So...
[01:10:38.270 --> 01:10:39.250]  Actually, this is a really
[01:10:39.250 --> 01:10:40.630]  long story. I'll tell you
[01:10:41.490 --> 01:10:42.790]  a story. Yeah. Okay. I'll tell
[01:10:42.790 --> 01:10:44.190]  the story. So,
[01:10:44.770 --> 01:10:46.670]  it was the year that DEF CON was
[01:10:46.670 --> 01:10:49.370]  at that Plaza Hotel that was downtown.
[01:10:49.730 --> 01:10:50.870]  And I was...
[01:10:50.870 --> 01:10:51.890]  What year was that?
[01:10:54.590 --> 01:10:55.390]  97?
[01:10:56.610 --> 01:10:57.410]  96?
[01:10:58.290 --> 01:10:58.950]  No.
[01:10:59.030 --> 01:11:01.130]  No. It was 98, I think.
[01:11:01.190 --> 01:11:02.770]  And maybe it was 98. Anyway,
[01:11:02.770 --> 01:11:04.550]  that's a great place, by the way. They have penny
[01:11:04.550 --> 01:11:06.670]  slots, which are super cool because when you're just
[01:11:06.670 --> 01:11:08.670]  like totally down and out and you still need
[01:11:08.670 --> 01:11:10.670]  to gamble, you can go to the penny slots.
[01:11:10.730 --> 01:11:12.470]  And I was about to leave. Like, I
[01:11:12.470 --> 01:11:14.470]  just had my foot on the little shuttle
[01:11:14.470 --> 01:11:16.710]  van step. And I remember this very clearly. Sort of
[01:11:16.710 --> 01:11:18.550]  looking down and seeing my foot on the step
[01:11:18.550 --> 01:11:20.550]  when suddenly a crowd of people come
[01:11:20.550 --> 01:11:22.710]  running out of the hotel. And they're like,
[01:11:22.710 --> 01:11:24.690]  wait, wait. Don't let the lawyer get on
[01:11:24.690 --> 01:11:26.630]  that van. Phony's
[01:11:26.630 --> 01:11:28.490]  been arrested. And I
[01:11:28.490 --> 01:11:30.470]  remember looking at my foot and thinking,
[01:11:30.470 --> 01:11:32.930]  I'm going to miss my plane. So,
[01:11:32.930 --> 01:11:34.530]  I get dragged off the little shuttle
[01:11:34.530 --> 01:11:36.650]  van and I'm told that this guy
[01:11:36.650 --> 01:11:38.630]  by the name of Phony, and I don't know, do any of you
[01:11:38.630 --> 01:11:40.490]  guys here know Phony? Who knows Phony?
[01:11:40.490 --> 01:11:42.550]  Yeah, there you go. Well, you probably know the end of this
[01:11:42.550 --> 01:11:44.550]  story. So, they told me that this guy
[01:11:44.550 --> 01:11:46.670]  named Phony had been arrested. That, you
[01:11:46.670 --> 01:11:48.570]  know, it's the last day of DEF CON and he was
[01:11:48.570 --> 01:11:50.550]  about to leave and some cop came
[01:11:50.550 --> 01:11:52.710]  onto the floor of the show, took him away
[01:11:52.710 --> 01:11:54.570]  in handcuffs, hustled him off into
[01:11:54.570 --> 01:11:56.590]  some van and we don't know where he went. So, now, what
[01:11:56.590 --> 01:11:57.490]  are we going to do?
[01:11:58.450 --> 01:11:59.850]  So, I said, well,
[01:12:00.790 --> 01:12:02.630]  let's go try to find where he
[01:12:02.630 --> 01:12:04.390]  is and see what he was charged with
[01:12:04.390 --> 01:12:06.390]  and we'll see what we can do. So,
[01:12:06.390 --> 01:12:08.450]  they say, okay, great. And everybody's got, like,
[01:12:08.450 --> 01:12:10.690]  radio headsets on. So, I hear them say,
[01:12:10.690 --> 01:12:12.390]  we've procured the lawyer. Bring around the
[01:12:12.390 --> 01:12:13.210]  vans.
[01:12:14.750 --> 01:12:16.570]  So, then two big black
[01:12:16.570 --> 01:12:18.350]  vans roll up and
[01:12:18.350 --> 01:12:20.350]  the door slides open and there's
[01:12:20.550 --> 01:12:22.350]  a bunch of hackers in there, all in black,
[01:12:22.350 --> 01:12:24.130]  all with the headsets. And
[01:12:24.130 --> 01:12:26.490]  Emmanuel Goldstein's in there and he's got a giant
[01:12:26.490 --> 01:12:28.390]  video camera and they hustle
[01:12:28.390 --> 01:12:30.290]  me into the van and we're all, like,
[01:12:30.290 --> 01:12:31.970]  off. And I say, okay,
[01:12:32.410 --> 01:12:33.950]  we need to find where
[01:12:33.950 --> 01:12:36.050]  the jail is. So, somebody's
[01:12:36.050 --> 01:12:37.830]  got the GPS thing and it's, like,
[01:12:37.830 --> 01:12:40.290]  98 or whatever, so this is pretty early.
[01:12:40.290 --> 01:12:41.970]  And they've got the map and they're, like, finding
[01:12:41.970 --> 01:12:43.850]  where the jail is and they're calling back to the hotel
[01:12:43.850 --> 01:12:46.030]  and stuff and it's, like, okay, we've procured the location of the
[01:12:46.030 --> 01:12:48.050]  jail. So, we get there and we, like, get to the
[01:12:48.050 --> 01:12:49.930]  jail and we're, like, stop in front of the jail
[01:12:50.490 --> 01:12:51.990]  and the doors to both the vans
[01:12:51.990 --> 01:12:54.070]  slide open and everybody's ready to jump out and, like,
[01:12:54.070 --> 01:12:56.070]  converge on the jail. And I'm, like, no, no, no,
[01:12:56.070 --> 01:12:58.030]  no, no, no. This is
[01:12:58.030 --> 01:12:59.750]  totally not going to work, okay?
[01:12:59.750 --> 01:13:01.590]  And they're, like, one person
[01:13:01.590 --> 01:13:03.690]  can come to the jail with me, but you can't
[01:13:03.690 --> 01:13:05.610]  all come in. So, they're, like,
[01:13:05.610 --> 01:13:07.690]  take a little vote and everything and everybody's okay
[01:13:07.690 --> 01:13:09.550]  and Emmanuel's, like, filming everybody because
[01:13:09.550 --> 01:13:11.610]  he's got this documentary he's doing about
[01:13:11.610 --> 01:13:13.610]  how hackers help each other and aren't criminals
[01:13:13.610 --> 01:13:15.710]  and stuff like that, which is totally true and great.
[01:13:15.710 --> 01:13:17.490]  Although, you know, it's a little nerve-wracking
[01:13:17.490 --> 01:13:19.330]  to have this big camera in your face.
[01:13:19.330 --> 01:13:21.690]  So, I say, okay, so they pick who's going to come in
[01:13:21.690 --> 01:13:24.010]  with me and I say, okay,
[01:13:24.010 --> 01:13:26.150]  now there's one other thing I need to know.
[01:13:26.310 --> 01:13:28.090]  What's Phony's real name?
[01:13:32.460 --> 01:13:33.420]  And, no,
[01:13:33.420 --> 01:13:34.420]  they're just, like,
[01:13:34.420 --> 01:13:36.300]  can I say what Phony's real name is
[01:13:36.300 --> 01:13:37.760]  or should I make up a name?
[01:13:38.660 --> 01:13:40.680]  Okay, so, they're, like,
[01:13:40.680 --> 01:13:42.260]  they're, like,
[01:13:44.500 --> 01:13:47.020]  they're, like, it's Jeff.
[01:13:47.460 --> 01:13:48.460]  Okay, Jeff
[01:13:48.460 --> 01:13:50.400]  what? No one
[01:13:50.400 --> 01:13:52.600]  knows. So, lots
[01:13:52.600 --> 01:13:54.440]  of frantic phone calls back to the hotel
[01:13:54.440 --> 01:13:56.400]  to try to find out what Phony's
[01:13:56.400 --> 01:13:58.520]  real name is and, um, after
[01:13:58.520 --> 01:14:00.440]  about ten minutes, we finally find
[01:14:00.440 --> 01:14:02.460]  somebody who knows his name and tells me.
[01:14:02.460 --> 01:14:04.780]  And I'm, like, okay. And I go into the jail.
[01:14:05.020 --> 01:14:06.500]  So, I get to the jail
[01:14:07.060 --> 01:14:08.680]  and we go up to the, you know,
[01:14:08.680 --> 01:14:10.440]  the booking guy and he's, like,
[01:14:10.440 --> 01:14:12.460]  you know, what's up? And I say, hi, I'm a lawyer. My client
[01:14:12.460 --> 01:14:14.720]  just got arrested. I'm wondering if he's here
[01:14:14.720 --> 01:14:16.400]  and, you know, what's going on?
[01:14:16.400 --> 01:14:18.360]  And the guy takes a, you know, sort of says, well,
[01:14:18.360 --> 01:14:20.320]  I don't know if he's here. What's his name?
[01:14:20.320 --> 01:14:22.400]  I give him the name and he types it into his
[01:14:22.400 --> 01:14:24.440]  computer and he said, well, he's not on my computer yet
[01:14:24.440 --> 01:14:26.460]  but if he just got arrested, you know,
[01:14:26.460 --> 01:14:28.740]  it takes a couple of hours to go through booking,
[01:14:28.740 --> 01:14:30.540]  he might be here and I just don't have him
[01:14:30.540 --> 01:14:32.480]  in the computer yet. I can go check
[01:14:32.480 --> 01:14:34.480]  in the holding cell and see if he's there. What does he
[01:14:34.480 --> 01:14:36.580]  look like? So, I don't actually know
[01:14:36.580 --> 01:14:38.360]  what he looks like. So, I'm, like, what does he look like?
[01:14:38.360 --> 01:14:40.840]  I don't know. So, the guy who I'm with runs out to the
[01:14:40.840 --> 01:14:42.560]  van and he comes back with somebody's
[01:14:42.560 --> 01:14:44.560]  digital camera that's got the picture of Phony
[01:14:44.560 --> 01:14:46.320]  and he shows the picture and he's got
[01:14:46.320 --> 01:14:48.860]  green hair and a blue pentagram
[01:14:48.860 --> 01:14:51.020]  dyed into the back of his head.
[01:14:53.200 --> 01:14:54.820]  So, I show it to the sheriff
[01:14:54.820 --> 01:14:57.220]  and I go, you can't miss him.
[01:15:00.100 --> 01:15:01.280]  So, the sheriff's like,
[01:15:01.280 --> 01:15:03.440]  we do not have that guy here.
[01:15:03.440 --> 01:15:04.980]  I would definitely know he's
[01:15:04.980 --> 01:15:07.160]  not here. So, I'm like, okay, he's not here
[01:15:07.160 --> 01:15:09.180]  and he says, well, maybe there's another jail across town
[01:15:09.180 --> 01:15:10.980]  maybe he's over there. So, we all pile
[01:15:10.980 --> 01:15:12.920]  back into the van and we've got the whole, you know,
[01:15:12.920 --> 01:15:14.920]  GPS thing with where the new jail is
[01:15:14.920 --> 01:15:16.500]  and stuff and we're hustling off there
[01:15:16.500 --> 01:15:19.000]  and on the way, suddenly, we get a call
[01:15:19.000 --> 01:15:20.820]  over the radio and the call is like,
[01:15:20.820 --> 01:15:23.640]  abort, abort the mission, return to base.
[01:15:23.960 --> 01:15:26.260]  So, we're like, huh, that's weird, okay.
[01:15:26.260 --> 01:15:27.740]  So, you know, I think we've been to like two
[01:15:27.740 --> 01:15:29.900]  jails by this time and we're like, okay, we'll return to base.
[01:15:29.900 --> 01:15:31.680]  So, we return back to
[01:15:31.680 --> 01:15:33.680]  the hotel and we're like, you know, we
[01:15:33.680 --> 01:15:35.620]  don't know what happened. So, everybody's like, what's
[01:15:35.620 --> 01:15:37.720]  going on? I don't know. And sort of like, we walk into the hotel
[01:15:37.720 --> 01:15:39.900]  and we sort of go our own separate ways
[01:15:39.900 --> 01:15:41.700]  and I'm like, you know, wondering
[01:15:41.700 --> 01:15:43.520]  how I'm going to get home now because
[01:15:43.520 --> 01:15:45.480]  I've missed my flight by quite a bit.
[01:15:45.680 --> 01:15:47.540]  And Pete Shipley
[01:15:47.540 --> 01:15:49.920]  comes up to me and he says, can I talk to you?
[01:15:49.920 --> 01:15:51.580]  And I'm like, okay. And we go over
[01:15:51.580 --> 01:15:53.460]  and he takes me aside and he's like, I'm really
[01:15:53.460 --> 01:15:56.000]  sorry, but it was all a
[01:15:56.000 --> 01:15:58.840]  hoax. That was Phony's
[01:15:59.080 --> 01:16:00.880]  cousin. And his cousin's
[01:16:00.880 --> 01:16:01.760]  a cop here in town
[01:16:01.760 --> 01:16:06.080]  and he thought it would be really cool
[01:16:06.080 --> 01:16:06.260]  if
[01:16:06.260 --> 01:16:07.900]  he thought it would be totally cool if
[01:16:07.900 --> 01:16:10.020]  instead of just leaving the con, he was
[01:16:10.020 --> 01:16:12.320]  dragged off in handcuffs.
[01:16:12.320 --> 01:16:15.220]  And he called me from the
[01:16:15.220 --> 01:16:15.800]  airport and I was like,
[01:16:15.800 --> 01:16:18.020]  that's so weird, that's Phony's number, how's
[01:16:18.020 --> 01:16:19.580]  he calling me? And I said,
[01:16:19.580 --> 01:16:21.200]  what are you doing? And he's like, yeah, dude,
[01:16:21.200 --> 01:16:22.440]  wasn't that cool?
[01:16:24.100 --> 01:16:25.620]  And Pete's like,
[01:16:25.620 --> 01:16:27.500]  we dragged Granica off of her
[01:16:27.500 --> 01:16:29.240]  airplane for you.
[01:16:29.240 --> 01:16:31.620]  And now she can't fly home.
[01:16:32.180 --> 01:16:33.780]  So Phony, who's a
[01:16:33.780 --> 01:16:35.500]  gentleman, paid for me to fly back
[01:16:35.500 --> 01:16:37.540]  to San Francisco first class, which I
[01:16:37.540 --> 01:16:39.620]  really appreciated. And then later
[01:16:39.620 --> 01:16:41.460]  in honor of my efforts, put me
[01:16:41.840 --> 01:16:43.560]  in a movie where I got to
[01:16:43.560 --> 01:16:45.740]  co-star with Mark Pauline as a
[01:16:45.740 --> 01:16:47.480]  evil naval officer in a
[01:16:47.480 --> 01:16:49.400]  movie that he was doing. So he and I ended up
[01:16:49.400 --> 01:16:51.460]  being on very good terms. But that was the
[01:16:51.460 --> 01:16:53.420]  very first time that I helped somebody who had been arrested
[01:16:53.420 --> 01:16:55.600]  at DEFCON and you wonder why I come back
[01:16:55.600 --> 01:16:57.260]  to take this abuse again
[01:16:57.260 --> 01:16:59.120]  year after year. But I just
[01:16:59.860 --> 01:17:01.720]  want to thank you guys
[01:17:01.720 --> 01:17:02.180]  for...
[01:17:10.780 --> 01:17:13.240]  I just want to thank you guys for making my life
[01:17:13.240 --> 01:17:15.480]  so fun and have a good rest of your evening.