WEBVTT

00:13.400 --> 00:20.560
Thank you all so much for coming here to hear my speech at 8 o'clock on a Saturday night.

00:20.680 --> 00:26.620
I'm not sure why I got... how I managed to pull this particular time slot.

00:26.620 --> 00:31.340
This is a time when people would rather be breaking the law than learning about the law.

00:31.340 --> 00:40.260
But I'll do my best to try to keep it interesting and also maybe try to keep it short and maybe we can have something like a conversation following this.

00:40.260 --> 00:53.900
So, for those of you who don't know me, my name is Jennifer Granick and I am the Executive Director of the Center for Internet and Society, which is a public interest internet law program at Stanford Law School.

00:53.900 --> 01:03.240
And as part of our program, we have conferences, speakers, things to study the interaction of civil liberties, the public interest in computer technology.

01:03.240 --> 01:11.820
And I also teach a class there, which is a practical course for law students which is called the Cyber Law Clinic.

01:11.820 --> 01:21.680
And we take cases and provide people with pro bono legal services and students get to work on the cases and learn how to be lawyers and I get to work on issues that I think are important and interesting.

01:22.040 --> 01:27.920
So, I am a teacher but also a litigator in that capacity.

01:27.920 --> 01:36.120
I came to this job from my background as being a criminal defense attorney, which I can tell you has been an extremely useful background this week.

01:36.120 --> 01:40.300
And we may get a chance to talk about that a little bit while I am up here.

01:40.960 --> 01:52.140
Okay, so my conception for this talk was that I wanted to actually have a really large audience and I thought, how else do you have a large audience other than to survey everybody and find out what questions they are interested in and then answer those questions.

01:52.140 --> 02:00.460
So I took an extremely informal survey that my father would think is completely statistically inaccurate and I came up with the following questions.

02:01.460 --> 02:02.920
And there we have some of them.

02:02.920 --> 02:06.540
I came up with about ten questions that I thought that people would be interested in.

02:08.820 --> 02:12.200
And for those of you who responded to my survey, thank you very much.

02:12.440 --> 02:23.560
I swapped out one of the old questions to give us question number nine because I think that there is a lot of interesting things to say about that from a legal standpoint.

02:23.560 --> 02:32.200
And the thing about it, the thing about the whole issue that interested me from a legal standpoint and I will give you some idea of my sense about what the law is behind all of that.

02:32.200 --> 02:34.920
So these are the ten questions that I'm going to be answering.

02:35.380 --> 02:43.640
And I think since we have, I see some more people coming, but I think when I did a similar kind of format at Black Hat, I asked for people to keep questions until the end.

02:43.760 --> 02:48.700
But I think here, since it's kind of a small group, I think I can manage to take questions during.

02:48.700 --> 02:56.280
I just don't want to get bogged down on one question and not get to the point where, not get to the point where we get to kind of get through all of the questions.

02:56.280 --> 03:05.360
So if you have questions that are relevant to something I'm talking about at the time, please just raise your hand and I'll see if I want to call on you.

03:05.620 --> 03:12.760
I see somebody there with a trademark infringing Newsweek shirt, which I'm going to tell my husband about since he works there.

03:14.600 --> 03:15.940
It's a parody, yeah.

03:15.940 --> 03:17.920
Okay, well then you're cool, man, you're cool.

03:19.420 --> 03:28.040
Alright, so when you're trying to cover ten legal questions, the thing I want to make pretty clear here is that I'm going to try to give you at a very high level some legal information.

03:28.040 --> 03:34.880
This isn't legal advice and it's not a substitute for talking either, you know, specifically with a lawyer about your specific situation.

03:34.960 --> 03:43.080
But I think one of the things that's wrong with the law, and especially the law in this area, is that it's so complicated that it's hard to kind of get a sense of, like, what the deal is.

03:43.080 --> 03:50.600
And of course every time you ask a lawyer what the deal is, the lawyer will always answer, I mean, if they're giving you the truthful answer, the answer is always, well, it depends.

03:50.820 --> 03:56.540
And it depends isn't really all that helpful, I can't, but it's always the right answer.

03:56.540 --> 04:08.700
So I'm not going to give you an answer that's any different from it depends, I'm just going to try to give you some sense of what factors it depends upon, and then, you know, hopefully that gives you a sense of what matters in all of these issues.

04:11.840 --> 04:16.780
Okay, so as you know from reading my questions, the first question that people asked was about wireless.

04:16.780 --> 04:19.740
And why did I think that wireless would be an interesting thing to talk about?

04:19.740 --> 04:30.680
Well, for those of you who are readers of the internet, you know that there was very recently a case in Florida where a Florida man was arrested for using wireless networks.

04:30.740 --> 04:33.500
And he was charged with a crime under the Florida law.

04:33.500 --> 04:36.780
So people wonder, is it a crime to use open wireless networks?

04:36.780 --> 04:43.220
Because if so, I think probably there's a lot of people here in the audience, myself included, who have been committing some crimes.

04:45.620 --> 04:50.320
No one else needs to confess, I'll do the confessing for us.

04:50.320 --> 04:59.520
I think the important thing about wireless is that when people say, well, I'm using a wireless network, there's a couple of different things you could mean, and different laws are going to apply to these different activities.

04:59.520 --> 05:05.400
So depending on what you're doing, we can see which laws might apply.

05:05.700 --> 05:10.100
The Florida case is a relatively rare situation.

05:10.100 --> 05:18.860
I personally am only aware of two other instances in which people have been charged with accessing a wireless network.

05:18.860 --> 05:26.300
One is a case that I was involved in in California, which later morphed into a case about something else, and the wireless was no longer an issue.

05:26.300 --> 05:36.180
And the other was a federal prosecution of a man named Stephan Puffer in Houston, and he was acquitted following a jury trial.

05:36.180 --> 05:42.380
So those are the only other two instances I'm aware of in which somebody was prosecuted for wireless.

05:42.400 --> 05:47.400
So let's take the more easy instances first and see what laws might apply.

05:47.400 --> 05:50.040
First, accessing stored files through the network.

05:50.340 --> 06:08.400
So the law that applies to protecting stored files is the Electronic Communications Privacy Act, and I put the text of the statute up here for you, but I want to take a moment to touch on, or to really kind of talk about, the two operative concepts that are the basis for this law,

06:08.400 --> 06:16.620
and also for the Computer Fraud and Abuse Act, which is the anti-hacking law, and for many of these computer laws.

06:16.620 --> 06:20.620
And that's the issue of unauthorized access.

06:20.980 --> 06:29.460
So almost all of these privacy and computer crimes that we see are based on access that's unauthorized.

06:29.460 --> 06:30.580
So what does that mean?

06:30.580 --> 06:33.460
Well, access could mean a lot of things.

06:33.960 --> 06:45.820
I was having a conversation with my parents at dinner tonight, and we were talking about what it means to kind of get behind or go into a website, or sort of go behind the front page, or that sort of thing.

06:45.820 --> 06:59.860
And you can talk about access as being something kind of metaphorical, like if I visit the website, then that's sort of like the front page, like the front door, but it's not like I'm getting into the database of information that's behind it.

06:59.860 --> 07:08.260
Or if I ping and it sends me back a packet that says, yes, I'm here, then it's not like I really went inside or got any of the information that's inside.

07:08.480 --> 07:17.660
Or you can look at it in the way that computers really work, which is you send packets and it sends you packets, and when you send it packets, you're causing that machine to do something and you're accessing it.

07:17.780 --> 07:32.020
Well, courts have looked at it in the more broad sense, and basically the cases have read that every time you have some kind of contact with a networked computer, you're sending it electrons and packets, and so you are accessing it.

07:32.020 --> 07:33.540
So it has this very broad thing.

07:33.540 --> 07:42.560
In no case, in none of the cases that deal with the interpretation of the Computer Fraud and Abuse Act, has anyone ever been held to not have accessed the computer.

07:42.560 --> 07:47.440
So access is kind of, it's like any use or connection with a networked computer is access.

07:47.440 --> 07:50.700
Well, so okay, there's one element of the crime that we've all committed.

07:50.700 --> 07:52.040
What about authorization?

07:52.040 --> 07:57.300
Is authorization really something that helps us distinguish between legal and illegal activity?

07:58.360 --> 08:00.960
So authorization could mean a lot of things.

08:00.960 --> 08:06.940
It could mean that you have explicit permission, or it could mean that you weren't explicitly kept out.

08:06.940 --> 08:09.000
And how does the law see this?

08:12.490 --> 08:18.970
Well, a lot of technological people think that authorization is kind of about what the computer allows you to do.

08:18.970 --> 08:29.170
So if permissions are set in such a way that you can access a file, or if the file is stored in a public space on the web server, then you have authorization because the computer authorized you to do it.

08:29.430 --> 08:31.590
And that's not the way that the law looks at it.

08:31.590 --> 08:37.010
The law has a much more social or sociological view of what authorization means.

08:37.010 --> 08:43.350
And there are many ways that you can do something that goes beyond your authorization.

08:43.750 --> 08:52.330
There are cases that say that if you do something that's what a banner warning tells you not to do, your use is unauthorized.

08:52.330 --> 09:01.410
There are cases that say if you make access to a computer system contrary to the terms of a contract or terms of service, that that's unauthorized.

09:01.410 --> 09:09.690
Cases that say that if you are notified that what you're doing is unauthorized, and you continue to do it, that that's unauthorized.

09:09.690 --> 09:26.970
So we have cases like eBay versus Bidder's Edge, in which a robot spidering program that collected auction information from eBay was making unauthorized access to eBay's website because eBay told the company that ran the spidering program they didn't want them there.

09:26.970 --> 09:42.470
We have cases where somebody who was a former employee who had left that company and was told that as a condition of your having left this company, you're not allowed to compete with us, sort of a non-compete agreement.

09:42.470 --> 09:51.270
And he then went on to his old company's website and collected data there about how much, I think it was cruises, travel packages cost.

09:51.270 --> 10:01.830
And in that case, they said, well, you were doing that to compete with your old employer, and that was contrary to the terms of your termination contract, and so that was unauthorized.

10:01.830 --> 10:20.910
The case that I think reads unauthorized access the most broadly is a case where a former employee started working for a new competitor company, but before he moved to the new company, he took a copy of his old employer's customer list, and he took it with him to the new company.

10:20.910 --> 10:27.330
And then the old company sued the new company and said, you had your guy make unauthorized access to our computers.

10:27.390 --> 10:29.890
And the new employer said, hey, he was authorized.

10:29.890 --> 10:30.870
He had a password.

10:30.870 --> 10:32.030
He was still working there.

10:32.030 --> 10:35.370
He was allowed to access the customer list.

10:35.370 --> 10:39.130
Maybe, you know, he took a trade secret or something, but it wasn't this violation.

10:39.130 --> 10:41.490
It wasn't unauthorized access to your computers.

10:41.670 --> 10:50.870
And what the court said is that, no, the court said at the moment that he knew in his mind that he was acting contrary to the interests of his employer,

10:59.500 --> 11:05.380
all right, and that he was acting contrary to the interests of his employer, his use was not authorized.

11:05.380 --> 11:06.220
Well, think about that.

11:06.220 --> 11:13.260
Every time you access some computer in a way that the computer owner might not like is unauthorized, that's pretty broad.

11:13.260 --> 11:25.080
Okay, so keep that in mind when we're talking about all of these things, about what unauthorized means and whether it's really a principled way to distinguish between something that's criminal and not criminal.

11:25.080 --> 11:27.040
I mean, my argument is that it's not.

11:27.040 --> 11:44.420
And if you look at the civil cases that interpret these, particularly the civil cases, but now some criminal cases, think about whether search engines or spidering robots or shopping bots or those sorts of things are crimes, because cases have held that all of those are making unauthorized access to computers.

11:44.840 --> 11:54.480
So if you were to use wireless to access stored files on a network without permission, that would be a violation of this particular law that I have listed up here.

11:56.520 --> 12:00.000
What about intercepting communications that go over the network?

12:00.000 --> 12:05.340
Well, there's a law that says that you are not allowed to intercept the contents of communications.

12:05.480 --> 12:09.680
So when people ask me, well, what if it's unencrypted just going over a wireless network?

12:09.680 --> 12:12.360
Can I read it and take a look at it?

12:12.360 --> 12:13.480
And I always say no.

12:13.480 --> 12:25.080
And I feel even better about this after I used the wireless at Black Hat to check my email, and the next thing I knew I was locked out of my email account because some bozo was logged on and so I couldn't get back in.

12:25.080 --> 12:28.260
I've had to change my email password four times at Black Hat.

12:30.320 --> 12:30.960
I know.

12:30.960 --> 12:32.540
I know what you guys are all thinking.

12:32.540 --> 12:33.920
But I'm a lawyer.

12:33.920 --> 12:34.880
Give me a break.

12:44.080 --> 12:57.440
So I always tell people you shouldn't be accessing the content of communications, but I do think that if anybody, and it wouldn't be any of my clients who talked to me about this beforehand, but if anybody ever does make this mistake and ends up getting prosecuted for it,

12:57.440 --> 13:01.000
I think there might be a defense within the context of the statute.

13:01.220 --> 13:08.060
The statute does have an exception in it, which I think was designed to protect people who were capturing radio signals.

13:08.060 --> 13:18.760
And that exception says that it's not unlawful to intercept communications which are configured so as to be accessible to the general public, readily accessible to the general public.

13:18.760 --> 13:26.300
And I think there's an argument you could make that unencrypted communications over wireless are readily accessible to the general public.

13:26.300 --> 13:32.720
So hopefully none of you will ever have to mount that defense, but if so, we'll see how that goes.

13:34.500 --> 13:36.780
Alright, what about just using the network?

13:36.800 --> 13:43.000
So this also gets us into question number two, which is what are the federal and state laws regarding computer crimes?

13:43.080 --> 13:48.880
And as I talked to you before, the kind of triggering thing is this unauthorized access.

13:49.120 --> 13:51.640
The Computer Fraud and Abuse Act, which is 18 U.S.C.

13:51.660 --> 13:59.820
1030, one of my favorite laws, makes it a crime to access a computer without authorization and either obtain information or cause damage.

13:59.820 --> 14:03.640
It's a very long statute and there's more to it than that, but you get the basic gist.

14:03.720 --> 14:09.260
So the question is, is using wireless a crime under this statute?

14:09.260 --> 14:21.180
And I've always thought no, just using it isn't, because the wireless isn't necessarily a computer and as long as you're not overusing the bandwidth or doing anything to damage the network, there's no damage.

14:21.180 --> 14:24.700
And in order for this to happen, you have to either obtain information or cause damage.

14:24.700 --> 14:30.520
So I thought that was pretty okay until we started seeing these California and Florida cases.

14:31.320 --> 14:33.760
So, why is it different under state law?

14:33.760 --> 14:39.220
Well, state laws are phrased differently than the federal law and I have here the California law.

14:39.220 --> 14:44.180
It basically says you don't have to cause damage and it doesn't have to be access to a computer.

14:44.200 --> 14:49.260
If you use computer services without permission, you may be committing a crime.

14:49.260 --> 14:55.220
And this was the statute that they chose to arrest the person that I was working with under.

14:55.700 --> 15:04.560
Similarly, the Florida statute says that it's a crime to willfully, knowingly, and without authorization access a computer system or computer network.

15:04.560 --> 15:09.660
And you could say that the wireless or the access hub is part of the computer network.

15:09.660 --> 15:17.580
So, this is kind of scary, because you know that you're accessing the wireless and how do they prove that it's without authorization?

15:17.580 --> 15:21.080
Well, the way they usually prove it is not that hard.

15:21.080 --> 15:26.880
Basically, as I said, it's kind of in the mind of the owner, is the way that the law looks at it.

15:26.880 --> 15:38.800
And what I have seen them do in all of my cases is they get the person who's the owner of the computer system to come into court and they say, did you ever give the defendant permission to use your computer services or computer?

15:38.800 --> 15:42.440
And the owner says, no, I never gave them permission.

15:42.440 --> 15:44.480
And boom, they're done, they leave, and that's it.

15:44.480 --> 15:45.580
What are you going to say?

15:45.580 --> 15:50.720
So, authorization's always been pretty easy, or lack of authorization's always been pretty easy to prove.

15:51.020 --> 15:52.760
But with wireless, how do you know, right?

15:52.760 --> 15:53.660
Is there a question?

16:07.320 --> 16:15.420
So, his question is, isn't it kind of implicit if people leave it open, that maybe you're authorizing, that it's implicit that you're allowed?

16:17.200 --> 16:17.940
Yeah.

16:19.940 --> 16:27.860
They're saying, well, the box is called allow all, and I can promise both of you that people who have wireless in their house, many people have never seen that box.

16:27.860 --> 16:32.800
Many people just plug the thing in and it just automatically allows, and that's it.

16:32.800 --> 16:37.940
So, do those people want other people to make access, or don't they?

16:37.940 --> 16:47.480
Some ISPs encourage you to share your broadband connection, and some ISPs in the contract tell you that you're not allowed to share.

16:47.480 --> 17:03.620
But the vendors choose to leave the burden of actually excluding or including people, or actually including or excluding outside users to the people who purchase the access and the wireless router, and most of those people aren't like us.

17:03.620 --> 17:14.620
Most of those people are more like, as I have my poster children of my parents, most of those people are more like my parents, who, at best case scenario, are going to plug the thing in and be psyched that it works.

17:14.860 --> 17:19.900
Worst case scenario, have to call in, you know, some expert technical assistance to help with that.

17:19.900 --> 17:22.260
So the question is, what do you know?

17:22.920 --> 17:23.800
Exactly.

17:24.140 --> 17:31.940
So the question is, what do you as the user know about what the owner wants, just based on the fact that access is possible?

17:31.940 --> 17:33.620
Do you really know what's in their mind?

17:33.620 --> 17:40.760
And as long as the courts look at what's in the owner's mind, as opposed to what might seem reasonable to you, you're in trouble.

17:41.040 --> 17:56.240
In the case that I was involved in, one of the things that made them feel like it wasn't authorized is that my client was outside of somebody's house in his car, and they're like, why is he lurking around outside their house?

17:56.240 --> 18:03.620
Now, that might seem like totally normal behavior to some of us, you know, when you need to get onto the wireless, there's nothing wrong with lurking around outside somebody's house.

18:03.620 --> 18:10.940
But, you know, I don't know that a judge or a jury is necessarily going to view it the same way, and it's kind of risky to depend upon that.

18:10.940 --> 18:12.180
And of course, you don't know.

18:12.180 --> 18:21.380
When the access point's open, you don't know whether you're allowed or the person's just, you know, too lazy or ignorant to have configured it differently.

18:21.640 --> 18:28.940
So what I have argued with these laws is that it shouldn't be enough that you know you use wireless and that it's unauthorized.

18:28.940 --> 18:32.100
I've argued that you should have to know that it's unauthorized.

18:32.100 --> 18:35.840
Like, you in your mind know that you're not allowed to be doing what you're doing.

18:35.840 --> 18:38.220
Otherwise, you don't have a guilty state of mind.

18:38.220 --> 18:44.720
You're not doing anything that is, you know, the illicit criminal thing that's what we're trying to prevent.

18:44.860 --> 18:50.440
And much of criminal law, in fact almost all of criminal law, requires you to have like a guilty criminal state of mind.

18:50.440 --> 18:55.860
And that's what we do to distinguish between, you know, where you don't get punished and where it's okay to put you in prison.

18:56.420 --> 18:58.560
So no court has adopted that yet.

18:58.560 --> 19:05.940
But if there are any lawyers out here who ever face some of these cases, you can call me, I wrote a brief on it, and I think it's pretty good, I think it's a really good argument.

19:06.340 --> 19:07.940
But can you count on it?

19:08.160 --> 19:09.460
You know, no.

19:22.670 --> 19:31.990
So the question is, what else could you do to make the fail-open, to make fail-open more of a legal, like more robust legally?

19:31.990 --> 19:40.950
So that, you know, in the absence of circumstances that clearly point to the contrary, instead of assuming that you're not authorized, we assume that you are authorized.

19:41.050 --> 20:00.710
And I think that, I mean, that would be great, right, if we could communicate to courts or juries or, you know, or Congress that, or legislatures, that in the absence of some kind of security measure or some kind of clear notice to the contrary, if something is accessible,

20:00.710 --> 20:03.850
we can assume that it's okay to access it.

20:04.270 --> 20:08.150
And , you know, so there's two ways that the law develops.

20:08.150 --> 20:20.670
The law can either develop through, well, there's many ways, but the law can mainly develop either through statute, where you can have that be something that a legislature would pass, or it can develop through the common law, where through the process of judges making rulings,

20:20.670 --> 20:24.570
something becomes conventional and is sort of the way that things are done.

20:24.570 --> 20:33.910
And so, you know, many of these cases, what you're hoping for is to develop a common law so that courts see that, you know, we're going to assume, we're going to assume freedom.

20:33.910 --> 20:43.730
We're going to put the burden of security, the burden of closing something on the owner, and we're going to not put the burden on the public to assume that unless they're explicitly invited in, they can't go anywhere.

20:43.950 --> 20:46.230
So that's the way that it works with the law.

20:46.230 --> 21:03.150
I mean, there may very well be technological ways we could do that as well, which might include making it easier for people to make their preferences more explicit and putting maybe pressure on vendors, for example, to make that process of deciding easier so that we don't have to assume that if it's open,

21:03.150 --> 21:04.050
it's ignorance.

21:04.050 --> 21:09.130
We can assume that if it's open, it's intentional, and that if it's closed, that too is intentional.

21:13.160 --> 21:15.360
Okay, so the Patriot Act and computer crime.

21:15.360 --> 21:18.640
How did the Patriot Act change investigations of computer crimes?

21:19.080 --> 21:27.780
Well, clearly the Patriot Act expanded surveillance in many areas, but I'm going to talk just specifically about this particular area.

21:27.780 --> 21:31.980
And the Patriot Act changed computer crime investigation in two main ways.

21:31.980 --> 21:37.640
First, it made it possible to get wiretaps to investigate computer crimes.

21:37.640 --> 21:44.560
A wiretap is a very privacy-invasive investigatory tool, and you can't get it to investigate just any crime.

21:44.560 --> 21:54.400
You can only get it to investigate a certain enumerated list of crimes, kind of meant to be the more serious or the more dangerous ones.

21:54.480 --> 22:00.160
And now computer hacking is one of those more serious or dangerous crimes for which you can get a wiretap.

22:00.160 --> 22:05.180
It also created this computer trespasser exception to the wiretap rules.

22:05.200 --> 22:13.100
The trespasser exception gives the government additional rights to monitor somebody who is a trespasser on the computer system.

22:13.100 --> 22:32.540
So if it's your system, it gives you more power to bring the government in without the government needing to get a warrant, and it gives the government more power to work with people who are owners of victim systems in order to do monitoring without having to go through the same kind of...

22:32.540 --> 22:37.540
without having to show the same level of proof that they would have to show prior to the Patriot Act.

22:37.540 --> 22:41.220
And here is basically the terms and conditions of the trespasser exception.

22:41.220 --> 22:41.760
Yes?

22:45.760 --> 22:50.240
So trespasser is defined... it's very interesting, I think, how they defined it in this statute.

22:50.240 --> 22:56.840
A trespasser is somebody who has no contractual relationship or authority to be on the computer.

22:56.840 --> 23:05.700
And I think the thing that's really interesting about that is to contrast it with the definition in the Computer Fraud and Abuse Act, which says that you're just unauthorized.

23:05.700 --> 23:10.080
And it's clear that unauthorized means you've gone beyond the terms of the contract.

23:10.080 --> 23:16.980
Here they're saying, even if you go beyond the terms of the contract, that's not enough to be a trespasser on this computer system.

23:17.120 --> 23:27.560
If you have any right to be there at all, like if you're a legitimate user and you're just exceeding your authorized access, you're not going to be falling in under the computer trespasser exception.

23:27.560 --> 23:31.700
You're just not... it's got to be somebody who has no authority or no right to be there at all.

23:31.920 --> 23:46.760
And the thing that just really aggravates me about that is it shows that Congress knows that the Computer Fraud and Abuse Act covers people who are outside of the bounds of contract and that they're making criminal something that is just a breach of contract,

23:46.760 --> 23:49.380
which I think is wrong and drives me crazy.

23:49.380 --> 24:05.080
And you wonder whether maybe they just don't realize what they're doing and then you see that they excluded people with some kind of contractual authority when they made the trespasser exception, which shows that they knew what they were doing all along and they just disagree with me as opposed to they don't know what I know.

24:05.080 --> 24:07.560
They know what I know and they like it the way it is.

24:11.510 --> 24:14.550
Okay, where can you find out more information about the Patriot Act?

24:14.550 --> 24:16.230
Here's some places.

24:16.390 --> 24:26.370
And basically, at this point in time, there are many controversial provisions of the Patriot Act which are due to terminate or sunset very soon.

24:26.490 --> 24:32.730
And the House of Representatives has reauthorized those provisions and it goes to the Senate now.

24:32.730 --> 24:41.750
So it's actually a time where there's a lot of legal work being done on the Patriot Act and it's a good chance and a good opportunity to get involved with Patriot Act issues.

24:42.730 --> 24:43.470
Seth?

24:47.060 --> 24:47.940
Today?

24:48.300 --> 24:49.180
Or yesterday?

24:50.300 --> 24:54.680
Okay, so Seth says that the Senate passed a bill that reauthorized most or all?

24:59.480 --> 25:03.560
Okay, so he says it has different sunset terms from the House, but they reauthorized everything.

25:03.560 --> 25:06.800
And I wasn't reading the newspapers yesterday, so I'm totally behind.

25:06.800 --> 25:08.900
But it shows you how fast things move, right?

25:08.900 --> 25:10.920
So is it too late for us or what?

25:17.320 --> 25:18.900
Okay, so it's not too late.

25:18.900 --> 25:21.640
There's still a chance to win the House and Senate conference on the bill.

25:22.420 --> 25:23.380
Yeah, it's late.

25:31.730 --> 25:37.690
So see what happens when they bring us down here, we're having fun in Las Vegas, and they're busy working up there on stuff we don't like.

25:38.810 --> 25:39.450
Okay.

25:40.350 --> 25:45.530
So, one of the questions that people had asked me is, like, when can the government surveil me?

25:45.530 --> 25:47.210
This is question number four.

25:47.210 --> 25:55.870
And I put that on my list of questions, and then I realized it's just simply, completely impossible to do that question any kind of justice in this format.

25:57.770 --> 25:58.210
So...

26:00.420 --> 26:02.860
Excuse me, I'm trying to figure out how much time I have.

26:02.940 --> 26:03.560
Okay.

26:03.740 --> 26:16.640
But I thought I would just, you know, make some comments about privacy and about how the laws that govern surveillance work generally to give you a framework for what kind of things should I be looking for or asking when I'm wondering about when I can be surveilled.

26:16.640 --> 26:23.360
So there's many different theories of privacy which are sort of operant in our law.

26:23.420 --> 26:31.140
And what we've done is sort of, we have like this mishmash of statutes which either try to protect or totally fail to protect privacy.

26:31.380 --> 26:45.200
And I think that you can really, sort of a useful framework for looking at privacy questions and questions of surveillance is to ask yourself, you know, these five questions when you're looking at an issue of what is, you know, is this privacy protecting?

26:45.200 --> 26:48.520
Is privacy protecting enough or not enough?

26:48.520 --> 27:04.780
So, you know, we're looking at what level of proof needs to be shown for a certain kind of information depending on its sensitivity and what safeguards are in place to make sure that there isn't any kind of, you know, unauthorized or excessive use of this personal information.

27:10.320 --> 27:11.560
Okay.

27:12.600 --> 27:15.620
So, a lot of people ask me questions about encryption.

27:15.620 --> 27:19.800
The very popular topic in the survey.

27:20.120 --> 27:24.300
And, you know, people wanted to know, you know, these sorts of questions about encryption.

27:24.420 --> 27:26.660
Mostly, you know, is using encryption a crime?

27:26.660 --> 27:27.840
And why did this come up?

27:27.840 --> 27:40.920
Well, again, recently there was a case out of Minnesota in which the court appeared to be holding that the fact that the defendant had PGP on his computer was evidence of criminal intent.

27:40.920 --> 27:47.060
Now, for those of you who aren't familiar with the case, I can tell you basically this was a child molest case.

27:47.060 --> 27:54.060
And the victim told the investigators that the defendant had molested her and had taken pictures of it.

27:54.060 --> 27:58.760
And the investigators got a warrant and they went to search the defendant's computer.

27:58.820 --> 28:02.680
And when they searched the defendant's computer, they didn't find any pictures.

28:02.680 --> 28:09.140
So, it didn't... that portion of the victim's story was not corroborated.

28:09.140 --> 28:13.160
And in ruling on whether or not... but they let in evidence.

28:13.160 --> 28:25.040
The trial court let in evidence and considered evidence that the defendant had had PGP on his computer in saying that there was enough evidence for him to be convicted of the child molest.

28:25.040 --> 28:33.640
And on appeal, the defendant said that using the encryption evidence, admitting the encryption evidence and using it in that way was improper.

28:33.880 --> 28:36.260
And the court of appeal said, no, it's not improper.

28:36.260 --> 28:37.560
It's fine.

28:37.560 --> 28:40.120
Well, there's a couple ways that you can look at this.

28:40.120 --> 28:44.520
So, first of all, did the court say that using encryption itself was a crime?

28:44.520 --> 28:45.320
No.

28:45.320 --> 28:49.920
So, there are not cases that say purely using encryption is a crime.

28:49.920 --> 28:55.720
In fact, there are cases that say the encryption algorithms themselves are protected by free speech principles.

28:55.860 --> 29:02.200
Certainly, we also have a right to communicate and a right to communicate anonymously and privately.

29:02.200 --> 29:05.440
And so, we don't have cases that say just encryption is bad.

29:05.440 --> 29:07.740
But is it evidence of criminal intent?

29:07.760 --> 29:10.280
Now, remember, this is one case out of Minnesota.

29:10.560 --> 29:15.240
And I don't know how influential Minnesota will be in other states.

29:15.240 --> 29:25.940
But what you often find in this area is that the very first case on a topic, even if it's kind of poorly reasoned and poorly explained, like this case is, can become influential.

29:25.940 --> 29:29.860
So, you want to be really careful about what it is that the case really says.

29:29.860 --> 29:36.080
And one wishes that judges were more careful about what they say that the law is.

29:36.320 --> 29:48.620
The two ways to look at this particular opinion are either the one that we're all worried about, which is that when you have PGP on your computer, it shows that you have something to hide.

29:48.620 --> 29:53.960
And it shows guilty knowledge and that you're trying to keep stuff from investigators.

29:53.960 --> 29:59.880
So, it shows you have consciousness of your own guilt.

30:00.180 --> 30:10.420
Another way to read this very same case is that the PGP evidence explains why there wasn't evidence on the defendant's computer.

30:10.600 --> 30:18.820
So, it wasn't that it showed that he had something to hide, but it was an explanation for why they didn't find the pictures that they expected to find.

30:18.820 --> 30:22.160
Maybe they were encrypted or maybe he'd wiped them or something like that.

30:22.160 --> 30:26.300
It's unclear which of these explanations the court is adopting.

30:26.400 --> 30:33.480
One maybe makes some kind of sense and doesn't necessarily penalize somebody for having encryption.

30:33.480 --> 30:45.940
It just says, well, in the totality of the evidence and because I find the victim so credible, I'm not going to say she's not credible just because I didn't end up finding the pictures because there's other things I can look to to figure out why the pictures might not be there.

30:45.940 --> 30:52.100
And that's something maybe we can all live with as opposed to something that says, oh yeah, PGP, that shows that you knew you did something wrong.

30:52.320 --> 30:53.140
A question here?

30:53.140 --> 30:54.000
I'll go to you in a second.

31:09.720 --> 31:27.580
So, he's saying the press on the case, and I agree with this interpretation, it wasn't that the PGP evidence alone was enough, but in context with all the other evidence, was part of there being sufficient proof to convict the defendant of this particular case.

31:27.580 --> 31:34.900
And I think that that's a totally reasonable reading of the case and I think we want to be careful when we read these cases to not give them an interpretation.

31:34.980 --> 31:43.240
And by we, I don't necessarily mean you guys, I mean we as lawyers and I was going to say we as judges, but we all know that's never going to happen for me.

31:43.600 --> 31:55.160
But judges also need to be very careful when reading these cases to make sure that they're not giving an interpretation that's not warranted and taking something that made sense in one small context and expanding it to be a general principle.

31:55.160 --> 31:56.760
There was a comment over here.

31:56.760 --> 31:57.480
Gentleman here.

32:12.770 --> 32:16.950
So it's a question about employees on employer's network.

32:16.950 --> 32:24.990
And when you're on your employer's network, this gentleman is right, you have very little privacy and that's for a couple reasons.

32:24.990 --> 32:30.070
First of all, many of our privacy laws, like the Fourth Amendment, don't apply to private parties.

32:30.070 --> 32:32.070
So the Fourth Amendment doesn't apply.

32:32.090 --> 32:48.210
And many of the privacy laws that we do have, privacy rights that we're entitled to by statute, have exceptions in them which will apply to employers and allow employers to do a lot of monitoring and that sort of thing.

32:48.210 --> 32:51.330
So people generally have very little privacy at work.

32:51.330 --> 32:55.010
And employers have a lot of rights to surveil.

32:55.010 --> 32:56.750
Now we've seen limits to that.

32:56.750 --> 33:04.390
For example, with cases that involve videotaping and changing rooms and things like that.

33:04.390 --> 33:12.450
But a lot of times what employers will just do is say in the employee handbook, everything you do here on your computer is something that we'll monitor and you understand that.

33:12.450 --> 33:13.850
And that's basically it.

33:13.850 --> 33:18.110
So work is not a great place for privacy, generally.

33:18.110 --> 33:19.730
I'll take this question over here.

33:26.000 --> 33:28.620
Great question, because this brings me to my next point.

33:28.620 --> 33:31.220
And he's like, why is it not covered by the Fifth Amendment?

33:31.220 --> 33:36.900
So this is what I'm saying about can you be compelled to turn over your keys so that they can decrypt your stuff.

33:38.160 --> 33:46.000
And I hate to say this, because if this ever happens to one of my clients, I'm definitely going to argue that it's a Fifth Amendment violation.

33:46.020 --> 33:49.360
But I think the reason you would say it's not a Fifth Amendment violation is this.

33:49.720 --> 33:53.620
Fifth Amendment, you can't be compelled to testify against yourself.

33:53.620 --> 33:54.700
There's a couple things there.

33:54.700 --> 33:57.180
First of all, it has to be compelled.

33:57.420 --> 34:03.480
So the stuff you wrote that you encrypted that you don't want to turn over, no one compelled you to write that.

34:03.480 --> 34:04.780
You wrote that voluntarily.

34:04.780 --> 34:06.360
So there's no compulsion there.

34:06.360 --> 34:08.760
The compulsion, and they could search that.

34:08.760 --> 34:16.480
If they can get access to it without violating the Fourth Amendment, they can get it because it's not compelled testimony.

34:16.780 --> 34:18.040
What about the keys?

34:18.160 --> 34:20.740
You're being compelled to turn over the keys, right?

34:20.740 --> 34:26.980
But the Fifth Amendment has a second part, which is that what you're compelled to do is something testimonial.

34:26.980 --> 34:29.320
And there are a lot of cases about what's testimonial.

34:29.320 --> 34:34.240
And for example, cases say stuff like name, rank, and serial number are not testimonial.

34:34.240 --> 34:41.640
So if you are compelled to turn over your key, you're not being forced to say anything that's testimonial.

34:41.640 --> 34:47.140
All you're doing is giving them the access to the stuff you wrote which wasn't compelled.

34:47.140 --> 34:58.380
So the best argument that you have, I think, of why you can't turn the key over is there is something testimonial about the divulging of the key, something that is communicative.

34:58.380 --> 35:07.200
And what that is is that you're the person who encrypted it, that you're the person who has access, at the very least, to the information because you've got the key.

35:07.540 --> 35:19.380
And I think that the downside of that argument is that what a prosecutor would do if they really wanted the stuff is they would say, all right, you've got a Fifth Amendment right and I'm going to overcome it by giving you immunity.

35:19.380 --> 35:25.060
Fifth Amendment rights can be overcome by giving you immunity, which basically says we're not going to use that against you.

35:25.160 --> 35:30.220
But they don't have to say we're not going to use what we find against you, and they don't have to say we're not going to use the fact that you...

35:30.220 --> 35:34.120
What they say is we won't use the fact that you had the key against you.

35:34.120 --> 35:37.800
So you're divulging the key to the extent that it's testimonial.

35:37.800 --> 35:39.200
We're not using it against you.

35:39.200 --> 35:40.880
Now you have to give us the key.

35:41.080 --> 35:44.500
And so then I think you're in a lot of trouble with your Fifth Amendment argument.

36:01.810 --> 36:06.490
Okay, so he says, well, you know, but let's say it's somebody with whom you have a privilege, like your wife or something.

36:16.860 --> 36:22.580
Okay, so you don't have privilege in information you confide to another person, period.

36:22.580 --> 36:26.560
You tell me something, if I'm not your lawyer, they can ask me and I can be forced to tell.

36:26.560 --> 36:36.740
The reason why you have a privilege with people like your wife or your shrink or your doctor is because the law has picked out certain relationships that it wants to protect because it wants to encourage the free flow of communication.

36:36.740 --> 36:40.400
And it's got certain little enumerated categories that it falls in there.

36:40.400 --> 36:44.300
And the reason why it does that is because it's protecting that relationship.

36:44.320 --> 36:51.240
Now the spousal privilege, they're protecting it because they don't want to tear your marriage apart by forcing your spouse to testify against you.

36:51.240 --> 36:54.740
And they want to make sure that marital communications flow back and forth.

36:54.740 --> 37:03.720
But if I write a letter to my husband and it's in my house and they have a right to come search my house, like let's say they have a warrant and they find a letter to my husband, they can use it against me.

37:03.760 --> 37:13.520
Just like if you rob a bank and you tell your lawyer, you tell your lawyer I robbed a bank, that doesn't mean that they can't use that statement against you.

37:13.520 --> 37:16.900
It just means they can't make me testify that you told me that.

37:22.700 --> 37:30.360
Well then the question is, is decrypting a violation of privacy?

37:30.480 --> 37:43.860
And what I would say to that is, even if the law says that the fact that you encrypted it shows you have an expectation of privacy in the information, expectations of privacy can be overcome with warrants.

37:43.860 --> 37:57.420
If there is probable cause to believe that it's a crime, you may very well have an expectation of privacy, but it is a conditional right which is overcome with a warrant or if there's some exception to the warrant requirement.

37:57.420 --> 38:04.000
So just the mere fact that you encrypt it isn't going to give you any kind of absolute protection under either the Fourth Amendment or the Fifth Amendment.

38:04.380 --> 38:07.220
I'm going to take this gentleman in the back with the glasses.

38:21.810 --> 38:24.130
This is why I love speaking at DEF CON.

38:24.130 --> 38:27.510
I never get questions like this at Black Hat.

38:40.500 --> 38:44.110
So if I'm married to an android, can it be compelled to...

38:47.800 --> 38:49.340
That's a great question.

38:49.340 --> 39:03.250
I don't know whether the law would be willing to recognize a privilege between you and a machine even if the machine was serving the purpose that somebody who would otherwise fit under a privileged relationship with you would have.

39:03.620 --> 39:04.720
And that's the question.

39:04.720 --> 39:18.460
You would have to ask, is the law prepared to protect this person's relationship with the machine the same way that we would protect this person's relationship with a real wife or a real shrink or a real priest.

39:19.540 --> 39:28.640
I mean, I'd be speculating, but I'm going to guess maybe not.

39:28.640 --> 39:31.240
That's a great question.

39:32.180 --> 39:33.420
Wait, can I just... I'm sorry.

39:33.420 --> 39:35.260
I'm laughing at your question, but I actually...

39:35.260 --> 39:42.700
I'm laughing because it's a fun question, but it allows me to say something, which is that this is the way we deal with stuff exactly in the law, right?

39:42.720 --> 39:45.280
You've got computer technology that evolves.

39:45.360 --> 39:46.800
I mean, because it's a beautiful question.

39:46.800 --> 39:50.380
So you've got computer technology that evolves, and we have these old rules from way back.

39:50.380 --> 39:54.340
And now we've kind of got to decide, like, what are we going to do with these old rules in this new world?

39:54.340 --> 39:56.300
And so the law has trouble with this.

39:56.300 --> 39:58.120
Like, the law just doesn't... and the question is...

39:58.120 --> 40:02.020
What we try to do, really, is we try to go back to the reason why we had the law.

40:02.020 --> 40:04.260
I mean, in our best moments.

40:04.380 --> 40:11.500
We try to go back to the reason why the law existed in the first place and try to preserve those values now into the new world.

40:11.500 --> 40:25.840
Which is why I say we'd have to ask whether society or courts would be prepared to say that the interrelationship between me and digital psychiatrists is deserving of the kind of protection that the relationship between me and flesh-and-blood psychiatrists was.

40:25.840 --> 40:27.760
And if so, we're going to say yes.

40:27.760 --> 40:29.460
And if not, then we're going to say no.

40:29.460 --> 40:30.880
Similar question with bloggers.

40:30.880 --> 40:33.740
Do bloggers get the same kinds of rights as journalists?

40:33.740 --> 40:41.540
You know, we have all of these situations where we have new technology and we're looking to our old rights and privileges and saying, you know, how are these going to be in the new world?

40:41.540 --> 40:47.200
So I laughed at your question, but it is the fundamental question that I spend my whole life studying.

40:47.280 --> 40:51.720
Which is, what are we going to do with these old laws in this new context?

40:51.720 --> 40:57.680
So lest you think I was laughing at the question, I really just enjoyed your scenario.

40:58.180 --> 40:58.720
Yes.

41:13.370 --> 41:15.770
That's K-I-T-T-Y porn, right?

41:15.990 --> 41:17.090
Yeah, I thought so.

41:24.870 --> 41:26.750
It's very hypothetical.

41:54.250 --> 42:04.510
I mean, yes, what I would say is the stuff that you wrote down, that you then encrypted, the way the law would look at it is say, that's not compelled because you wrote it down voluntarily.

42:04.510 --> 42:16.490
And his question, I'm sorry, his question was basically, you know, is there a difference between saying, I'm compelled to testify, versus I'm compelled to give them something which lets testimony against me happen.

42:16.490 --> 42:28.490
And what I would say is that, yes, there is a difference, because the Fifth Amendment only applies to compelled testimony, and this is where they're compelling you to get something that's...

42:28.490 --> 42:33.350
or the testimony was not compelled, and they're compelling you to give something that's not...

42:33.350 --> 42:40.670
Okay, so testimony, or the thing you encrypted was not compelled, and they're just compelling you to give them something non-testimonial, which is the key.

42:40.670 --> 42:42.510
So I don't think that that would work.

42:55.290 --> 42:57.910
I'm not sure what your question is, but let's go for it.

42:58.010 --> 42:59.970
Let me just get through the rest of these slides, and then we'll go.

43:00.050 --> 43:01.210
I'm not saying you're compelled.

43:01.210 --> 43:06.430
I'm saying, let's say I write in my journal, I killed him, and then I encrypt it.

43:06.870 --> 43:09.790
When I wrote I killed him, I wasn't compelled to write it.

43:09.790 --> 43:11.150
Fifth Amendment doesn't apply.

43:11.150 --> 43:14.450
I encrypt it, and now I have to turn over my key.

43:14.470 --> 43:16.110
The key's not testimonial.

43:16.110 --> 43:17.970
They can compel me to turn it over.

43:17.970 --> 43:20.730
Then they get access to my non-compelled testimony.

43:20.750 --> 43:22.030
I'm the one who killed him.

43:22.230 --> 43:23.050
Boom, you're done.

43:24.230 --> 43:25.870
Okay, statute of limitations.

43:25.890 --> 43:39.010
Now, I put this in because I thought this would be a nice, easy question, because statute of limitations, if there's an answer, I should just put a big number up, which will be the number five, and that'll be great because, you know, so many of these questions are it-depends kind of complicated questions.

43:39.010 --> 43:52.450
But even the statute of limitations isn't clear, because while there's a five-year statute of limitations for computer crimes, there's another statute that allows courts to suspend the running of statutes of limitations when they're doing investigations that involve evidence in a foreign country.

43:52.690 --> 43:53.910
Statute of limitations.

44:04.360 --> 44:06.560
Is the content of the key testimony?

44:06.560 --> 44:07.140
No.

44:07.940 --> 44:08.580
Okay.

44:08.580 --> 44:09.640
Logs as evidence.

44:09.640 --> 44:11.100
So, a lot of people think...

44:11.640 --> 44:14.380
You had a question before, so I'm going to let you ask it.

44:19.190 --> 44:23.310
He asked me if there's a notification requirement for an extension of the statute of limitations.

44:23.310 --> 44:26.050
I think that's an excellent question, and I don't know the answer to that.

44:26.050 --> 44:28.730
So, I'm going to have to look that up, and I'm going to have to get back to you.

44:28.830 --> 44:32.670
So, will you email me, my email's on the thing, and make sure that I tell you?

44:32.670 --> 44:33.930
Because I don't know.

44:34.750 --> 44:35.310
Okay.

44:35.550 --> 44:36.590
Logs as evidence.

44:36.590 --> 44:50.030
So, a lot of people who are technological people feel that, you know, we know how malleable digital data is, and we feel like there's a very high standard, for admitting logs, computer logs, as evidence.

44:50.130 --> 44:52.970
And I think people are always surprised at the extremely...

44:52.970 --> 44:55.150
That was good, actually, by the way, that you stumped me.

44:55.150 --> 44:58.290
I think that there might be a prize in that for you.

44:59.910 --> 45:01.790
I was going to buy him a drink.

45:03.190 --> 45:11.830
A lot of people think that you have to, you know, that you have to show that it wasn't tampered with, and that you have to prove that it is exactly the right thing.

45:12.150 --> 45:14.810
Sort of, it's almost like the reverse is true.

45:14.810 --> 45:22.550
All you have to do to get computer logs admitted as evidence is just show that it is basically what you, as the proponent of the evidence, purport it is.

45:22.550 --> 45:24.210
Show that it's reliable enough.

45:24.210 --> 45:34.590
And what they do is they bring in the person whose computer it is, you know, who is the system administrator, and he says, yes, we have this computer set to log, and it logs in the regular, normal course of business.

45:34.590 --> 45:40.850
And these are the logs, and I pulled this off of the computer in the place where the log files are stored, and here it is.

45:40.850 --> 45:44.450
And it looks pretty much like what it was that I pulled off the computer.

45:44.450 --> 45:49.490
And at that point in time, the court will say, okay, I'm ready to admit it.

45:49.490 --> 45:51.910
And you can say, yeah, but I mean, he could have edited it.

45:51.910 --> 45:52.570
What was, you know...

45:52.570 --> 45:55.450
In fact, I've had logs that were edited, admitted.

45:55.450 --> 46:08.010
I've had logs where they basically cut out all of the extraneous data, leaving behind only the data that showed that it was my client who had been accessing their computer and said, you know, I just, to make it shorter for you, your honor, I just, you know,

46:08.010 --> 46:11.730
left in the important, relevant stuff, and I didn't put any of the other stuff in there.

46:11.730 --> 46:13.210
So, you know, here's your log.

46:13.210 --> 46:15.290
And I was like, you know, you can't do that.

46:15.290 --> 46:22.890
And the court was like, well, he says that this is accurate, and so, you know, I'm willing to believe it unless you can show me that it's not accurate.

46:22.970 --> 46:33.610
And what usually happens then is you try to show that it's not accurate, and the courts say, well, maybe there might be some question about it, but I'll let the evidence in, and then the trier of fact can decide what weight to give it.

46:33.610 --> 46:39.130
So computer logs have been something that courts have been very forgiving about, particularly in my experience.

46:43.270 --> 46:44.230
Okay.

46:44.590 --> 46:48.790
This is why I sort of wanted to rush to make sure that we had a little bit of time to talk to this stuff.

46:49.830 --> 46:59.830
So I think that probably everybody here is familiar with or has heard about the lawsuit that happened earlier this week after Mike Lynn's talk on Wednesday at Black Hat.

46:59.830 --> 47:06.810
And I was involved in that case, helping Mike with the aftermath of his talk.

47:06.850 --> 47:07.790
Thank you.

47:13.820 --> 47:25.780
You know, and while I was doing that, particularly when we were in the six-hour settlement conference with the nine attorneys from the other side trying to hash out a settlement agreement, I was thinking to myself, I can't believe I'm doing this.

47:25.780 --> 47:29.720
I'm in Vegas, and I've been up since six in the morning, and I'm working on this.

47:29.720 --> 47:32.020
And I thought to myself, you know, and I'm not even getting paid.

47:32.020 --> 47:35.500
And then I thought, but I'm really saving a lot of money by not gambling.

47:35.500 --> 47:38.740
So actually, I'm way ahead here.

47:38.740 --> 47:41.620
So I have Mike to thank, at least for that.

47:42.460 --> 47:55.980
But I think that one thing we haven't done a lot of talking about, and I know that there's been a lot of talking and rumors and all of that stuff, and I can't talk about the facts of the case or anything like that, and I don't want to take any questions on that,

47:55.980 --> 48:03.960
but I do want to talk a little bit about the law and how it was that they claimed that what he did was improper.

48:04.520 --> 48:09.780
So basically, this was a case that involved California's Trade Secret Act.

48:09.780 --> 48:15.000
And the Trade Secret Law prohibits the misappropriation of trade secrets.

48:15.080 --> 48:17.520
So what's a trade secret?

48:23.490 --> 48:27.070
All right, so this is awesome that you guys are here.

48:30.990 --> 48:34.110
We have, first of all, this is Mike's cape.

48:34.110 --> 48:37.970
We made him a superhero cape to go with his hat.

48:38.170 --> 48:43.110
And we're going to use it right now to let Jennifer change into her present that we got her.

48:43.990 --> 48:46.290
And Jennifer, she's doing such an awesome job.

48:46.290 --> 48:48.390
She can probably share this cape with Mike.

48:48.390 --> 48:49.950
She's just doing such an awesome job.

48:50.350 --> 48:51.150
Yeah!

48:58.310 --> 49:00.210
You guys look fabulous.

49:01.490 --> 49:02.470
All right, thank you.

49:02.470 --> 49:03.990
But I want that cape, though.

49:05.430 --> 49:07.210
Did you guys see the Incredibles?

49:07.510 --> 49:08.730
No capes.

49:12.610 --> 49:14.670
Oh, that's beautiful.

49:14.670 --> 49:15.930
I'll make sure he gets it.

49:16.770 --> 49:17.930
Thanks, you guys.

49:20.250 --> 49:21.390
Trade Secret Law.

49:21.390 --> 49:22.990
It's very serious business.

49:25.590 --> 49:30.830
So a trade secret is information that derives its value from the fact that it's not...

49:30.830 --> 49:32.710
All right, you guys are making me laugh.

49:33.950 --> 49:39.990
A trade secret law is information that derives its value from the fact that it's not generally known to the public.

49:40.090 --> 49:41.730
So that's thing number one.

49:41.730 --> 49:46.350
And so the first thing you have to ask yourself when you've got a trade secret case is, what's the secret?

49:46.350 --> 49:49.710
Is it the kind of thing that's protected by trade secret law?

49:49.710 --> 49:53.390
And then the second thing you ask yourself is, what's the misappropriation?

49:53.390 --> 49:56.550
So there's two possible claims here.

49:56.550 --> 50:07.910
One claim is that the information that he had about what the flaw was, was a trade secret to his employer, or rather I should say his ex-employer, ISS.

50:07.910 --> 50:10.350
The other possibility is that the case is about...

50:10.910 --> 50:15.290
that there's something about the Cisco code that remains a trade secret to Cisco.

50:15.290 --> 50:17.010
So... question.

50:24.500 --> 50:26.640
So his question is about whistleblower laws.

50:26.640 --> 50:30.840
So let me make sure that he's a researcher, but let me get to that.

50:30.840 --> 50:36.740
Because my second summer of law school, I worked at this whistleblower place in DC.

50:36.740 --> 50:38.420
So I know a bit about the whistleblower laws.

50:38.420 --> 50:46.120
But my particular whistleblower specialty is FIFRA, which is the Federal Insecticide, Fungicide, and Redenticide Act.

50:46.120 --> 50:50.280
And I did a white paper on the whistleblower provisions of FIFRA.

50:50.280 --> 51:00.180
So if anybody here has any rodenticide researcher issues, I think that I'm the person most qualified to respond to those.

51:01.040 --> 51:02.900
You laugh, but it's true.

51:03.760 --> 51:07.940
Okay, so then the question is, was it misappropriated?

51:08.060 --> 51:11.800
And so, what is misappropriation?

51:11.800 --> 51:21.580
Well, the statute says, specifically, that reverse engineering is a proper way of discovering something, even if it's a trade secret.

51:21.760 --> 51:25.860
And reverse engineering is specifically allowed under California law.

51:25.860 --> 51:29.880
And I have quoted here for you what the California law is about reverse engineering.

51:29.880 --> 51:35.200
And you can see, reverse engineering or independent derivation alone shall not be considered improper means.

51:35.200 --> 51:36.780
So that's an important thing, number one.

51:36.780 --> 51:43.920
But the other important thing about this statute is it does say that it's improper if you breach a duty to maintain secrecy.

51:43.920 --> 51:46.200
Okay, so we've got these two functional things here.

51:46.200 --> 51:48.920
One, is there a duty to maintain secrecy?

51:48.920 --> 51:53.340
And two, or was it independently derived?

51:54.300 --> 52:05.360
So, the issue in the case is basically, you know, what did he disclose and was it in violation of some duty to keep it secret or was it independently derived?

52:05.380 --> 52:14.060
So, a violation of a nondisclosure agreement, for example, a nondisclosure agreement with an employer, might be a trade secret violation.

52:14.060 --> 52:17.200
But that, if you read the complaint, wasn't part of the case.

52:17.200 --> 52:24.860
There wasn't a claim that he had disclosed something that was a secret and was proprietary to his employer.

52:24.860 --> 52:45.960
What the claim was, really, if you looked at the complaint, was that the machine code that he had disassembled from the Cisco binary was a trade secret as to Cisco and that he revealed that information to the public when he showed his slides at the presentation.

52:45.960 --> 52:55.780
And so, the question there, clearly, the statute clearly says, although, of course, they don't cite the statute in their papers very much, the statute clearly says reverse engineering is okay.

52:55.940 --> 52:59.040
Reverse engineering alone isn't improper.

52:59.040 --> 53:04.800
And they said, well, it's not reverse engineering alone, it's reverse engineering in violation of our EULA.

53:04.800 --> 53:17.560
Because when you get the Cisco, you know, when you get the Cisco router, our EULA says, and for those of you who don't know, it's the end user license agreement or terms of service for use of the machine, our EULA says no reverse engineering.

53:17.680 --> 53:20.520
So, now, EULAs have a lot of issues.

53:20.520 --> 53:27.080
And I think I've decided that next year for me is going to be EULA year and I'm going to be worrying a lot about EULAs.

53:27.160 --> 53:32.880
And one of the ways that people have always attacked EULAs has been on the issue of formation.

53:32.880 --> 53:43.460
Is it really a contract if you just slap some warning on your product and I never click I agree or, you know, have any kind of, you know, intention to enter into a contract with you.

53:43.460 --> 53:57.920
But I don't believe personally that attacking EULAs solely on the grounds that it's not really a contract because we never had this offer and acceptance meeting of the minds that's required for contracts to happen is a very fruitful process.

53:57.920 --> 54:11.860
I think that it's a dead end in the long run because we'll end up with things where they'll make you agree and most people will agree to something like no reverse engineering and those few people who do care to reverse engineer just simply won't be able to buy the product.

54:11.940 --> 54:14.820
But we can talk more about that in question and answer.

54:14.820 --> 54:26.460
I think the question that was really raised by the lawsuit in this case and the thing that made me super interested in it was the question of whether the violation of a promise in the EULA i.e.

54:26.600 --> 54:33.080
a promise not to reverse engineer is a violation of the trade secret law.

54:33.080 --> 54:46.420
Something beyond simply having reverse engineered and independently derived it the violation of some kind of promise that makes something that ordinarily might just be a contract breach a crime.

54:46.420 --> 54:49.460
Or at the very least something that imposes civil liability.

54:49.460 --> 55:01.780
And as you may have guessed from my comment before about the website terms of service and employment contracts and that sort of thing it really makes me mad when suddenly breaches of contracts are crimes.

55:01.780 --> 55:05.060
It's just not something that used to be true in the law at all.

55:05.060 --> 55:15.100
In fact, breaches of contracts are things for which you can't even get punitive damages usually because the law likes to see people breach contracts when it's economically efficient.

55:15.100 --> 55:21.020
So if I have a contract with you, but I can make more money with somebody else I'm allowed to breach the contract with you.

55:21.020 --> 55:30.600
I pay you what you expected to get and I get to reap the profit of the fact that I got to enter into a contract with somebody else and the law is happy.

55:30.600 --> 55:34.400
There's no moral opprobrium that attaches to breaches of contracts.

55:34.400 --> 55:38.620
So it really bothers me to see these kinds of things made criminal.

55:38.720 --> 55:50.620
And I think that one of the things sort of in the bigger picture that the case raised is this question of is there a limit to the enforceability of EULAs and can EULAs be the grounds for these sorts of other kinds of offenses.

55:50.620 --> 55:52.520
I have a question from this gentleman here.

55:58.640 --> 56:04.440
So the question is if the information is discoverable by reverse engineering is it a trade secret and the answer to that is no.

56:04.520 --> 56:08.260
Because first you did not obtain it by improper means.

56:08.440 --> 56:09.600
You discovered it.

56:10.020 --> 56:11.640
No longer a secret.

56:11.680 --> 56:13.160
So it's no longer a trade secret.

56:13.160 --> 56:15.660
So the answer is basically no.

56:15.660 --> 56:17.260
There's a question from this gentleman in the green.

56:26.490 --> 56:29.530
We don't have a decision in Blizzard yet, right?

56:29.590 --> 56:32.990
Okay,

56:38.010 --> 56:40.030
so I will answer your question.

56:40.030 --> 56:51.590
So Blizzard versus BnetD is a case that involves a manufacturer of one of these multiplayer games and some people who reverse engineered that game and built their own server on which people could play the games compatibly.

56:51.650 --> 56:58.990
And the case is now on appeal, which is why I said there wasn't a decision, but this gentleman is right that there was a decision from the trial court below.

56:58.990 --> 57:08.310
And what the trial court below said was that if you have a user agreement that says no reverse engineering, then those terms are enforceable.

57:08.310 --> 57:10.170
There's another case that says the same thing.

57:10.170 --> 57:11.970
It's Bowers versus Baystate.

57:11.970 --> 57:16.150
And that case also says terms in EULAs are enforceable.

57:16.150 --> 57:20.430
And the EULA picture is this, to kind of give you the big picture of where we're at.

57:22.150 --> 57:25.090
So contracts require offer and acceptance.

57:25.090 --> 57:28.950
This really was one of my favorite classes in law school because it's so beautiful if you think about it.

57:28.950 --> 57:34.010
There's an offer, there's acceptance, there's mutual consideration, there's this meeting of the minds.

57:34.010 --> 57:35.410
It's very romantic.

57:35.410 --> 57:40.830
But those things are required, right?

57:40.830 --> 57:49.270
So a lot of cases that involve things like click wrap or browse wrap, we have cases that say if there's not actually an offer and acceptance, then it's not a contract.

57:49.270 --> 57:57.910
So if it's just something that says legal at the bottom and you don't have to click on it or agree or anything, then it's not a contract and you're not bound by those terms.

57:58.110 --> 58:04.490
And there's other situations where you don't have notice or something like that, or maybe you do have notice and you continue to use the site.

58:04.490 --> 58:06.890
So the question is, is there agreement to the terms?

58:06.890 --> 58:09.470
And those are things I would call formation issues.

58:09.470 --> 58:11.050
Was there a meeting of the minds?

58:11.050 --> 58:18.270
Did the person know what the terms were and manifest their assent, either through clicking OK or for using it or something like that?

58:18.270 --> 58:19.770
So formation issues.

58:19.870 --> 58:29.970
If there's formation, there's offer and there's acceptance, either through actual clicking OK or through notice and continued use, then you're into the question of whether the terms are enforceable.

58:29.970 --> 58:38.430
And my fear is if you have every term be enforceable no matter what, you can have EULAs that say, no talking nasty about this product.

58:38.450 --> 58:42.510
And maybe 95% of the people in the world don't want to talk nasty about the product.

58:42.510 --> 58:44.090
They just want to buy it and use it.

58:44.090 --> 58:46.150
And so most of us will just agree.

58:46.150 --> 58:51.350
And those people who do want to talk nasty about the product, the company doesn't need to sell to them.

58:51.430 --> 58:55.050
And so they'll never be able to buy it.

58:55.050 --> 58:56.210
They won't sell it to them.

58:56.210 --> 59:01.630
And they won't buy it and they won't have access to the product, so they won't be able to test it or benchmark it or anything.

59:01.630 --> 59:07.170
And all the rest of us will be happily using the product and no one will be allowed to tell us that the product stinks.

59:07.530 --> 59:19.890
So, you know, when I say that I think next year will be EULA year, the thing that I'm really concerned about is, are there limitations to the terms that will be enforceable in EULAs when you have a situation where the term is contrary to public policy?

59:20.130 --> 59:27.990
Individually it might not be a big deal, but in aggregate it deprives the public of the right to know something or the right to do something that has great public benefit.

59:27.990 --> 59:29.550
A question right here.

01:00:01.840 --> 01:00:05.660
Okay, so his question is, you know, how far does the contract extend?

01:00:05.660 --> 01:00:18.560
So if I buy it with, you know, if I buy somebody's product, maybe I agree to the EULA, but when I sell it to somebody else and the software is already installed and everything, you know, those people, the second, you know, the second purchaser hasn't agreed to the contract,

01:00:18.560 --> 01:00:21.780
so maybe the second purchaser isn't bound by it at all.

01:00:21.780 --> 01:00:24.380
And I think that, you know, in some ways that's a good argument.

01:00:24.380 --> 01:00:34.740
I actually, I'm not 100% sure of that question, but I think that, you know, you could make me agree to terms of contract simply by selling something to me without my also having notice.

01:00:35.040 --> 01:00:36.900
So I think that that may be sort of a break.

01:00:36.900 --> 01:00:48.900
And, you know, if I were going to buy your machine with your ancient copy of Microsoft Windows on it and continue to use it without reinstalling or anything, maybe I wouldn't be bound by that, by those terms.

01:00:48.900 --> 01:01:03.300
But if I, let's say then I decided that I was going to criticize Microsoft's product or something, and they wrote to me and they said, hey, we hear you're criticizing us, and that's contrary to our EULA, you can't either stop criticizing us or stop using our product,

01:01:03.300 --> 01:01:04.580
then I'm on notice.

01:01:04.580 --> 01:01:11.380
And what a lot of the cases say is that notice plus continued use will bind me to the terms of the contract.

01:01:11.380 --> 01:01:15.340
So, you know, it hasn't always been a great defense.

01:01:15.340 --> 01:01:22.320
Well, I don't know about the terms or I've never agreed because they managed to get you when they do the, we're going to get to see the food again.

01:01:31.810 --> 01:01:32.530
Right.

01:01:33.450 --> 01:01:44.450
So this gentleman's point is, well, at that point, you know, you didn't break the contract, so you could just stop using it and continue to be free to say or do whatever you want at that point, and I think that that probably would be right.

01:01:44.730 --> 01:01:45.330
Yes.

01:01:52.230 --> 01:02:01.990
So his question is, what if I spent a lot of money on it and either they tell me to stop using it or, you know, then I learn that the terms of service are something that I don't like.

01:02:01.990 --> 01:02:07.490
And there was a class action suit in California on this issue because of shrink wrap.

01:02:07.490 --> 01:02:14.150
So people buy software, they take it home, they open the box, they see these restrictive license terms, they don't want the software anymore.

01:02:14.150 --> 01:02:17.910
So they take it back to Best Buy, and Best Buy's like, we don't take your open software.

01:02:17.990 --> 01:02:23.370
So then they try to return it to the vendor, and the vendor said, we don't take your open, you know, we're not taking that back either.

01:02:23.850 --> 01:02:25.050
And so what do you do?

01:02:25.050 --> 01:02:36.170
So there was a class action suit in California, which said basically, you know, if you're going to do this, if you're going to have your terms of service on the inside of the box, or if you're going to have your terms of service pop up only when you install,

01:02:36.170 --> 01:02:39.130
you've got to let people take it back and get their money back.

01:02:39.130 --> 01:02:44.810
So practically, that never happens, but legally it's supposed to happen.

01:02:45.090 --> 01:02:46.850
All right, some other questions?

01:02:46.850 --> 01:02:50.110
I can take a few more questions because the people who are coming after us are late.

01:02:50.110 --> 01:02:53.050
So let's go for like three more minutes if anybody has other questions about this.

01:02:53.050 --> 01:02:54.390
Let me just do my last slide.

01:02:54.390 --> 01:02:55.570
So when to talk to a lawyer.

01:02:55.570 --> 01:02:57.430
So as you can see, this is really complicated.

01:02:57.430 --> 01:03:05.670
And so, you know, you sort of almost always need to talk to a lawyer, unfortunately, which is too bad for you guys, but great for lawyers.

01:03:06.930 --> 01:03:21.650
You know, the law is really complicated, and if you feel like, I definitely know, I'm doing something that I thought was kind of maybe risky, but now I definitely know that it's either illegal or illegal, then you definitely need to talk to a lawyer because if you think that the answers are really clear,

01:03:21.650 --> 01:03:23.670
then you're not getting it at all.

01:03:23.670 --> 01:03:33.350
If you think that the answer is, it depends, and I kind of know what it depends upon, but maybe it depends on more things too, and I might need to get a little more advice on this, then you're in good shape.

01:03:33.370 --> 01:03:36.650
So that's the sort of finale of my talk.

01:03:36.650 --> 01:03:38.890
And I'll take a couple more questions if there are some.

01:03:38.890 --> 01:03:40.290
I'll take one here.

01:03:47.900 --> 01:03:50.820
Is reading the machine code reverse engineering?

01:03:51.520 --> 01:03:59.300
I think here it was, I think here we agreed it was reverse engineering because he decompiled it from the binary.

01:03:59.380 --> 01:04:06.740
But if you've got machine code, reading it is, I mean, reverse engineering, the courts have looked at reverse engineering as being a lot of things.

01:04:06.740 --> 01:04:14.520
Testing, you know, trying to watch processes and replicate, decompiling.

01:04:14.520 --> 01:04:22.480
So a lot of things are reverse engineering, but I mean, either it's legal because you're reading something that's already written or you're reverse engineering.

01:04:50.080 --> 01:04:58.700
So what he's saying, what his comment is that he doesn't think machine code is either secret or is reverse engineering.

01:04:58.700 --> 01:05:01.280
And I think there's a good argument for that.

01:05:15.140 --> 01:05:22.840
The beer is not here yet, so you have to, so I'm going to, which is a tragedy, so I'm going to take a few more questions if people have other questions.

01:05:22.840 --> 01:05:24.180
This gentleman in the back.

01:05:30.090 --> 01:05:36.310
But for those of you, I'm going to try to take questions still, so you guys have to be kind of quiet because I can't hear what he's saying.

01:05:43.580 --> 01:05:47.380
So the question is, do I think Cisco got what they wanted out of the case?

01:05:48.480 --> 01:05:56.580
I'm, you know, I'm not a researcher , so I may be a little more compassionate to most of the players in this than other people are.

01:05:56.580 --> 01:05:59.740
I think Cisco definitely didn't get what they wanted out of this case.

01:05:59.740 --> 01:06:05.240
I mean, I can tell you what their point, what they thought they were doing was.

01:06:05.240 --> 01:06:25.120
And in the settlement agreement that we entered into to settle the civil case, Cisco and ISS insisted that the settlement agreement say that Cisco and ISS were working together on a presentation that would have revealed the problem without revealing stuff that they felt was trade secret information.

01:06:25.120 --> 01:06:30.420
Now , I have no information personally whether or not that was true, because I came into the whole thing, you know, after that.

01:06:30.420 --> 01:06:45.660
But I think that what Cisco, if you asked them, and I'm not them, but to try to be fair to them, I think what they would have said is that they really had certain things that they definitely didn't want, which was the code and the pointers, and that they ended up getting exactly,

01:06:45.660 --> 01:06:59.560
totally not what they wanted in all of this, because all of that came out, and they look bad, and they had to pay lawyers, and they had to pay to have the materials taken out of the presentation stuff, and they had to pay to get rid of the CDs and make new CDs.

01:06:59.560 --> 01:07:06.020
So they have had a really bad week, in addition to the rest of us having a really bad week, too.

01:07:06.380 --> 01:07:10.560
I know it was tough, but I got a cape out of it, so...

01:07:30.260 --> 01:07:37.700
So the question is, our click wrap and shrink wrap aren't really meeting of the minds, because it's kind of a take it or leave it thing.

01:07:37.700 --> 01:07:41.820
Can you modify the terms ahead of time and then click accept?

01:07:47.720 --> 01:07:48.160
And...

01:07:48.160 --> 01:07:49.760
Is he calling me?

01:07:50.820 --> 01:07:52.920
So the question is, can I modify the terms?

01:07:52.920 --> 01:07:56.160
And the answer is no, because then you don't have a meeting of minds on the other end.

01:07:57.140 --> 01:08:03.120
So I'm told that I should answer this phone call, which I'm going to do, since we're on overtime.

01:08:08.420 --> 01:08:10.040
A call-in question.

01:08:10.040 --> 01:08:11.920
Okay, I'll take a call-in question.

01:08:12.420 --> 01:08:15.120
Let's see if I can do it through the...

01:08:15.120 --> 01:08:17.500
Let's see if you can do it through the microphone.

01:08:17.500 --> 01:08:18.060
Ready?

01:08:21.430 --> 01:08:22.870
No, it doesn't play.

01:08:23.210 --> 01:08:23.730
Okay

01:08:29.990 --> 01:08:33.390
, it was a personal question, which I don't answer.

01:08:35.790 --> 01:08:40.770
Does anybody have an appropriate professional, non-personal question?

01:09:03.610 --> 01:09:08.970
So, the question was about the encryption issue and the forced disclosure.

01:09:08.970 --> 01:09:10.650
And I'm not a...

01:09:10.650 --> 01:09:16.750
I'm not familiar with these cases that you're referring to where journalists have been forced to turn over encryption keys.

01:09:16.750 --> 01:09:21.670
The difference there might be that we're not talking about something that is incriminating.

01:09:21.670 --> 01:09:23.510
I mean, that might be one difference.

01:09:23.510 --> 01:09:29.250
Then you also have another difference, which is you've got this journalist thing, which brings in all this free press type of issues as well.

01:09:29.250 --> 01:09:38.730
But I think the fundamental thing is that the Fifth Amendment applies very... I mean, the arguments for the Fifth Amendment application to compulsory key turning over, I think, are weak.

01:09:38.730 --> 01:09:40.450
Though I hate to say it.

01:09:41.430 --> 01:09:44.780
All right.

01:09:44.780 --> 01:09:46.300
Do you want me to keep going?

01:09:48.000 --> 01:09:48.640
All right.

01:09:49.140 --> 01:09:50.100
Other questions?

01:09:53.730 --> 01:09:54.230
All right.

01:09:54.230 --> 01:09:58.670
So, there's no other questions, so I'm not going to keep going, but as you can see, we have the next thing that's happening.

01:09:58.670 --> 01:09:59.690
Do you want to say something?

01:10:00.230 --> 01:10:00.870
Okay.

01:10:02.670 --> 01:10:03.270
I could tell...

01:10:05.570 --> 01:10:06.150
All right.

01:10:06.150 --> 01:10:07.170
So, you guys...

01:10:07.170 --> 01:10:07.690
Let's see.

01:10:07.690 --> 01:10:09.090
Do you guys want to hear a story?

01:10:09.850 --> 01:10:10.570
All right.

01:10:12.710 --> 01:10:13.190
Okay.

01:10:13.190 --> 01:10:20.050
I'm going to tell you guys a story about the first time I tried to help somebody who got arrested at DEF CON.

01:10:21.850 --> 01:10:25.590
This was back in 1999 when...

01:10:25.590 --> 01:10:25.850
Okay.

01:10:25.850 --> 01:10:26.290
I'm not sure.

01:10:26.290 --> 01:10:27.650
I don't remember what year it is.

01:10:28.990 --> 01:10:29.390
But...

01:10:30.370 --> 01:10:31.330
I don't know.

01:10:31.330 --> 01:10:32.870
This isn't my laptop.

01:10:33.170 --> 01:10:34.570
So, I'm just going to...

01:10:35.050 --> 01:10:35.850
Okay.

01:10:37.190 --> 01:10:37.590
So...

01:10:38.270 --> 01:10:40.070
Actually, this is a really long story.

01:10:40.070 --> 01:10:42.090
I'll tell you a story.

01:10:42.090 --> 01:10:42.330
Yeah.

01:10:42.330 --> 01:10:42.570
Okay.

01:10:42.570 --> 01:10:43.250
I'll tell the story.

01:10:43.250 --> 01:10:49.370
So, it was the year that DEF CON was at that Plaza Hotel that was downtown.

01:10:49.730 --> 01:10:50.870
And I was...

01:10:50.870 --> 01:10:51.890
What year was that?

01:10:54.590 --> 01:10:55.390
97?

01:10:56.610 --> 01:10:57.410
96?

01:10:58.290 --> 01:10:58.950
No.

01:10:59.030 --> 01:10:59.470
No.

01:10:59.470 --> 01:11:01.130
It was 98, I think.

01:11:01.190 --> 01:11:02.290
And maybe it was 98.

01:11:02.290 --> 01:11:04.030
Anyway, that's a great place, by the way.

01:11:04.030 --> 01:11:10.670
They have penny slots, which are super cool because when you're just like totally down and out and you still need to gamble, you can go to the penny slots.

01:11:10.730 --> 01:11:12.230
And I was about to leave.

01:11:12.230 --> 01:11:15.170
Like, I just had my foot on the little shuttle van step.

01:11:15.170 --> 01:11:16.390
And I remember this very clearly.

01:11:16.390 --> 01:11:22.250
Sort of looking down and seeing my foot on the step when suddenly a crowd of people come running out of the hotel.

01:11:22.250 --> 01:11:23.450
And they're like, wait, wait.

01:11:23.450 --> 01:11:25.690
Don't let the lawyer get on that van.

01:11:26.190 --> 01:11:27.730
Phony's been arrested.

01:11:27.870 --> 01:11:32.230
And I remember looking at my foot and thinking, I'm going to miss my plane.

01:11:32.270 --> 01:11:39.830
So, I get dragged off the little shuttle van and I'm told that this guy by the name of Phony, and I don't know, do any of you guys here know Phony?

01:11:39.910 --> 01:11:40.490
Who knows Phony?

01:11:40.490 --> 01:11:41.270
Yeah, there you go.

01:11:41.270 --> 01:11:43.170
Well, you probably know the end of this story.

01:11:43.310 --> 01:11:46.190
So, they told me that this guy named Phony had been arrested.

01:11:46.470 --> 01:11:56.150
That, you know, it's the last day of DEF CON and he was about to leave and some cop came onto the floor of the show, took him away in handcuffs, hustled him off into some van and we don't know where he went.

01:11:56.150 --> 01:11:57.490
So, now, what are we going to do?

01:11:58.450 --> 01:12:05.970
So, I said, well, let's go try to find where he is and see what he was charged with and we'll see what we can do.

01:12:05.970 --> 01:12:07.470
So, they say, okay, great.

01:12:07.470 --> 01:12:09.670
And everybody's got, like, radio headsets on.

01:12:09.670 --> 01:12:11.870
So, I hear them say, we've procured the lawyer.

01:12:11.870 --> 01:12:13.210
Bring around the vans.

01:12:14.750 --> 01:12:23.830
So, then two big black vans roll up and the door slides open and there's a bunch of hackers in there, all in black, all with the headsets.

01:12:24.010 --> 01:12:30.750
And Emmanuel Goldstein's in there and he's got a giant video camera and they hustle me into the van and we're all, like, off.

01:12:30.750 --> 01:12:35.150
And I say, okay, we need to find where the jail is.

01:12:35.210 --> 01:12:40.290
So, somebody's got the GPS thing and it's, like, 98 or whatever, so this is pretty early.

01:12:40.290 --> 01:12:46.530
And they've got the map and they're, like, finding where the jail is and they're calling back to the hotel and stuff and it's, like, okay, we've procured the location of the jail.

01:12:46.530 --> 01:12:55.130
So, we get there and we, like, get to the jail and we're, like, stop in front of the jail and the doors to both the vans slide open and everybody's ready to jump out and, like, converge on the jail.

01:12:55.130 --> 01:12:56.590
And I'm, like, no, no, no, no, no, no.

01:12:56.590 --> 01:12:59.750
This is totally not going to work, okay?

01:12:59.750 --> 01:13:04.810
And they're , like, one person can come to the jail with me, but you can't all come in.

01:13:04.950 --> 01:13:15.710
So, they're, like, take a little vote and everything and everybody's okay and Emmanuel's, like, filming everybody because he's got this documentary he's doing about how hackers help each other and aren't criminals and stuff like that, which is totally true and great.

01:13:15.710 --> 01:13:19.330
Although, you know, it's a little nerve-wracking to have this big camera in your face.

01:13:19.330 --> 01:13:26.150
So, I say, okay, so they pick who's going to come in with me and I say, okay, now there's one other thing I need to know.

01:13:26.310 --> 01:13:28.090
What's Phony's real name?

01:13:32.460 --> 01:13:37.760
And, no, they're just, like, can I say what Phony's real name is or should I make up a name?

01:13:38.660 --> 01:13:47.020
Okay, so, they're, like, they're, like, they're, like, it's Jeff.

01:13:47.460 --> 01:13:49.260
Okay, Jeff what?

01:13:49.800 --> 01:13:51.120
No one knows.

01:13:51.380 --> 01:14:02.460
So, lots of frantic phone calls back to the hotel to try to find out what Phony's real name is and, um, after about ten minutes, we finally find somebody who knows his name and tells me.

01:14:02.460 --> 01:14:03.340
And I'm, like, okay.

01:14:03.420 --> 01:14:04.780
And I go into the jail.

01:14:05.020 --> 01:14:11.040
So, I get to the jail and we go up to the, you know, the booking guy and he's, like, you know, what's up?

01:14:11.040 --> 01:14:12.060
And I say, hi, I'm a lawyer.

01:14:12.060 --> 01:14:13.460
My client just got arrested.

01:14:13.460 --> 01:14:16.400
I'm wondering if he's here and, you know, what's going on?

01:14:16.400 --> 01:14:19.800
And the guy takes a, you know, sort of says, well, I don't know if he's here.

01:14:19.800 --> 01:14:20.320
What's his name?

01:14:20.320 --> 01:14:31.700
I give him the name and he types it into his computer and he said, well, he's not on my computer yet but if he just got arrested, you know, it takes a couple of hours to go through booking, he might be here and I just don't have him in the computer yet.

01:14:31.700 --> 01:14:34.140
I can go check in the holding cell and see if he's there.

01:14:34.140 --> 01:14:35.280
What does he look like?

01:14:35.280 --> 01:14:37.160
So, I don't actually know what he looks like.

01:14:37.160 --> 01:14:38.360
So, I'm, like, what does he look like?

01:14:38.360 --> 01:14:38.800
I don't know.

01:14:38.800 --> 01:14:51.020
So, the guy who I'm with runs out to the van and he comes back with somebody's digital camera that's got the picture of Phony and he shows the picture and he's got green hair and a blue pentagram dyed into the back of his head.

01:14:53.200 --> 01:14:57.220
So, I show it to the sheriff and I go, you can't miss him.

01:15:00.100 --> 01:15:03.440
So, the sheriff's like, we do not have that guy here.

01:15:03.440 --> 01:15:05.760
I would definitely know he's not here.

01:15:05.920 --> 01:15:10.360
So, I'm like, okay, he's not here and he says, well, maybe there's another jail across town maybe he's over there.

01:15:10.360 --> 01:15:23.640
So, we all pile back into the van and we've got the whole, you know, GPS thing with where the new jail is and stuff and we're hustling off there and on the way, suddenly, we get a call over the radio and the call is like, abort, abort the mission, return to base.

01:15:23.960 --> 01:15:26.260
So, we're like, huh, that's weird, okay.

01:15:26.260 --> 01:15:29.900
So, you know, I think we've been to like two jails by this time and we're like, okay, we'll return to base.

01:15:29.900 --> 01:15:34.560
So, we return back to the hotel and we're like, you know, we don't know what happened.

01:15:34.580 --> 01:15:36.040
So, everybody's like, what's going on?

01:15:36.040 --> 01:15:36.460
I don't know.

01:15:36.460 --> 01:15:45.480
And sort of like, we walk into the hotel and we sort of go our own separate ways and I'm like, you know, wondering how I'm going to get home now because I've missed my flight by quite a bit.

01:15:45.680 --> 01:15:49.920
And Pete Shipley comes up to me and he says, can I talk to you?

01:15:49.920 --> 01:15:50.900
And I'm like, okay.

01:15:50.900 --> 01:15:56.440
And we go over and he takes me aside and he's like, I'm really sorry, but it was all a hoax .

01:15:56.840 --> 01:15:58.840
That was Phony's cousin.

01:15:59.080 --> 01:16:11.260
And his cousin's a cop here in town and he thought it would be really cool if he thought it would be totally cool if instead of just leaving the con, he was dragged off in handcuffs.

01:16:11.540 --> 01:16:18.660
And he called me from the airport and I was like, that's so weird, that's Phony's number, how's he calling me?

01:16:18.660 --> 01:16:20.280
And I said, what are you doing?

01:16:20.280 --> 01:16:22.440
And he's like, yeah, dude, wasn't that cool?

01:16:24.100 --> 01:16:29.240
And Pete's like, we dragged Granica off of her airplane for you.

01:16:29.240 --> 01:16:31.620
And now she can't fly home.

01:16:32.180 --> 01:16:38.540
So Phony, who's a gentleman , paid for me to fly back to San Francisco first class, which I really appreciated.

01:16:38.540 --> 01:16:48.480
And then later in honor of my efforts, put me in a movie where I got to co -star with Mark Pauline as a evil naval officer in a movie that he was doing.

01:16:48.480 --> 01:16:50.760
So he and I ended up being on very good terms.

01:16:50.760 --> 01:16:58.380
But that was the very first time that I helped somebody who had been arrested at DEFCON and you wonder why I come back to take this abuse again year after year.

01:16:58.380 --> 01:17:02.180
But I just want to thank you guys for...

01:17:10.780 --> 01:17:15.480
I just want to thank you guys for making my life so fun and have a good rest of your evening.