[00:31.550 --> 00:37.190]  I'm an investigative attorney, and I do a lot of security work around the world.
[00:37.350 --> 00:44.710]  My associate this morning is Matt Fidler, who is a security consultant and former military intelligence,
[00:44.710 --> 00:49.790]  and does a lot of security work, both hardware and software.
[00:50.390 --> 00:57.870]  The impetus for this discussion this morning grew out of last year, the conference in New York.
[00:57.870 --> 01:06.810]  I was part of a panel involving vulnerability of locks issues, which is what I mainly deal with.
[01:06.870 --> 01:19.600]  And as a result of that, there was a sense of security community with regard to the ethics of disclosure
[01:19.600 --> 01:24.100]  of vulnerabilities of locking systems.
[01:24.100 --> 01:30.040]  And so we decided that we'd put together a presentation and really would like,
[01:30.040 --> 01:37.560]  at the conclusion of our PowerPoint, to solicit comments from you folks as to what your thoughts are
[01:37.560 --> 01:42.620]  so these can be taken back to the hardware security community.
[01:43.700 --> 01:52.180]  Essentially, the locksmiths and their organization have determined that there should not be any disclosure
[01:52.180 --> 01:59.100]  of defects or vulnerabilities other than the security professionals and security management
[01:59.100 --> 02:04.460]  and other locksmiths. I don't particularly subscribe to that theory, nor does Matt.
[02:04.460 --> 02:07.520]  We want to go through why we do not.
[02:07.520 --> 02:12.640]  It's obviously been dealt with in the logical security community a long time ago,
[02:12.640 --> 02:15.280]  but not really in the hardware community.
[02:15.380 --> 02:19.820]  And so we'll present a PowerPoint first. Matt will do that.
[02:19.820 --> 02:25.260]  And then we want to solicit your comments and input.
[02:25.260 --> 02:30.060]  Good morning, everybody. So as Mark said, we're going to run through this pretty quick.
[02:30.060 --> 02:33.260]  Then we can hop down. We've got some swag to throw out.
[02:45.200 --> 02:48.760]  So this quote goes back over 150 years.
[02:49.460 --> 02:52.880]  A.C. Cox wrote the book Locks and Safes.
[02:53.040 --> 03:01.540]  And you can read it, but it details that the unscrupulous individuals already have this bit of information.
[03:01.540 --> 03:04.980]  They already know about the defects. They're already exploiting them.
[03:04.980 --> 03:09.660]  And it's better to provide this information to the public and make it available.
[03:10.340 --> 03:15.820]  This was a Usenet post in June 2nd of this year from a locksmith.
[03:15.820 --> 03:21.320]  And again, you can read it, but basically they're indicating that providing this type of information,
[03:21.320 --> 03:30.460]  and I think this was in response to top-level master key or Eric Michaud's multi-lock attack on a plate,
[03:30.460 --> 03:35.760]  and just indicating that this is all secret information. It should not be published.
[03:37.100 --> 03:39.140]  So clearly, there are no secrets.
[03:39.720 --> 03:43.160]  We're going to talk about the importance of full disclosure.
[03:43.160 --> 03:47.720]  We'll identify from a physical security perspective what defects are.
[03:48.200 --> 03:50.620]  Mark will go into some of the legal issues of them.
[03:55.350 --> 03:58.190]  And then we'll go into some case examples of the last year.
[04:01.030 --> 04:05.150]  So again, locksmiths are the first line in most cases.
[04:05.150 --> 04:11.060]  They have publicly come out and said that, like you said...
[04:11.060 --> 04:12.680]  That would be all of you.
[04:19.840 --> 04:21.860]  So defects, what are defects?
[04:21.860 --> 04:25.260]  They're simple bypasses, really simple tools.
[04:25.260 --> 04:28.320]  We're talking seconds of bypass.
[04:47.110 --> 04:54.130]  We're talking about the type of bypass that does not require sophisticated tools, expertise, and time.
[04:54.130 --> 04:56.570]  The type of tools that I routinely deal with.
[04:56.670 --> 05:00.630]  Versus the ballpoint pen opening the tubular lock trick.
[05:01.470 --> 05:05.290]  That's the type of bypass that we're really talking about.
[05:05.290 --> 05:13.430]  The simple, really, defects or problems that lead to the ability to circumvent a locking system.
[05:17.530 --> 05:20.410]  Okay, well, the legal issues are real simple.
[05:20.410 --> 05:21.630]  The real question is...
[05:22.510 --> 05:29.030]  What does the end user have a right to know about the security products that they're buying and using?
[05:29.030 --> 05:38.810]  And what's the liability for the locksmith or architect or hardware vendor if they don't tell you about a vulnerability?
[05:38.890 --> 05:42.610]  And you put in that system and then you suffer a loss.
[05:42.610 --> 05:43.590]  Somebody gets injured.
[05:43.590 --> 05:44.690]  Somebody gets killed.
[05:44.690 --> 05:45.750]  There's a major theft.
[05:45.750 --> 05:47.890]  There's a compromise of information.
[05:48.270 --> 05:51.830]  Who's got the liability or is there any liability?
[05:51.830 --> 06:00.950]  And especially involving federal and state statutes regarding the disclosure of protection of medical information, financial information.
[06:00.950 --> 06:03.730]  These are serious legal issues.
[06:03.730 --> 06:11.030]  The locksmiths really haven't come to grips with them and frankly don't understand a lot of the problems that can face them.
[06:11.030 --> 06:19.450]  And as an end user security administrator or person responsible for physical security, the real question is...
[06:19.450 --> 06:25.310]  How much information do you have a right to know in order to make the security assessment?
[06:26.070 --> 06:32.390]  If you rely on a security consultant to make that assessment for you, that's fine.
[06:32.390 --> 06:40.630]  But if you're charged with the responsibility and fail to have all the needed information, then you really can't make that assessment.
[06:40.630 --> 06:42.270]  And then who is liable?
[06:42.390 --> 06:44.790]  Those are really the critical issues.
[06:45.390 --> 06:54.850]  So as far as statutory liability, I'm sure most of you out there in the IT world are familiar with HIPAA, SOX, GLBA, all the regulatory compliance issues.
[06:54.850 --> 07:07.070]  HIPAA, over one quarter or almost one quarter of HIPAA statutes govern physical access control, access to facilities, file lockers, etc.
[07:07.070 --> 07:09.710]  containing protected health information.
[07:09.710 --> 07:14.870]  So clearly we're all in bed with these regulatory issues.
[07:14.870 --> 07:20.050]  SB 1386, the loss of information, defamation assets.
[07:21.410 --> 07:28.870]  It's incumbent on us to understand the physical hardware that protects these assets.
[07:30.770 --> 07:33.290]  So we'll get into the ethical debate.
[07:33.290 --> 07:37.630]  Again, the question we want to throw out there, we'd like to get your feedback.
[07:37.630 --> 07:39.570]  Come on up, ask questions.
[07:40.390 --> 07:43.950]  But again, if the manufacturer is notified, what should they do?
[07:43.950 --> 07:44.850]  Should they admit it?
[07:44.850 --> 07:46.810]  Should it be publicized?
[07:46.810 --> 07:48.870]  We'll talk about some case examples.
[07:48.870 --> 07:52.310]  We recognize some other vendors and how they use it.
[07:52.310 --> 07:53.630]  Full disclosure.
[07:53.990 --> 07:58.410]  And ultimately, what is the vendor's level of negligence?
[07:58.410 --> 08:00.350]  And one other comment.
[08:00.350 --> 08:12.070]  If you find a security defect or a vulnerability that allows a lock or system to be bypassed, do you take it to the manufacturer without making it public?
[08:12.210 --> 08:14.190]  Or do you make it public?
[08:14.190 --> 08:22.950]  And that's really an interesting question because if you take it to the manufacturer and they have a large embedded base of security products, do they make it public?
[08:22.950 --> 08:25.330]  The responsible manufacturers will.
[08:25.330 --> 08:26.650]  A lot of them will not.
[08:26.650 --> 08:28.830]  So where does that leave the end user?
[08:44.100 --> 08:45.140]  Anywhere.
[08:45.140 --> 08:47.180]  In a closed group.
[08:47.280 --> 08:49.060]  In a closed group, yeah.
[08:49.760 --> 08:56.700]  So the second point, the reality is you disclose a defect but there isn't one really there.
[09:01.430 --> 09:04.030]  Someone else may or may not find it.
[09:05.250 --> 09:07.690]  So, again, we want to pose this question.
[09:07.910 --> 09:16.450]  There's been a lot of public disclosures on non-physical vulnerabilities that haven't come to fruition.
[09:16.450 --> 09:21.730]  They were one-time bypasses that someone was able to do in a controlled environment.
[09:25.030 --> 09:39.910]  Well, the other issue is, and a lot of the locksmiths have propounded, okay, if there's a known vulnerability in a lock or a piece of hardware, okay, you can tell the public, yes, there's a vulnerability, but you can't tell them what it is.
[09:39.910 --> 09:41.350]  What does that do for you?
[09:41.350 --> 09:42.950]  In our view, nothing.
[09:43.150 --> 09:48.210]  Because the minute you disclose there's a hardware defect, somebody's going to find it.
[09:48.210 --> 09:50.330]  And if they find it, they're going to publish it.
[09:50.330 --> 09:52.810]  A lot of locksmiths haven't heard of the Internet yet.
[09:52.810 --> 09:56.210]  And so they still believe that there are secrets out there.
[09:56.210 --> 09:59.290]  And as we keep trying to tell them, there are no secrets anymore.
[10:00.970 --> 10:06.230]  So some considerations for thought, again, between the questions and the evidence here.
[10:06.410 --> 10:08.290]  Need to know at full disclosure.
[10:08.910 --> 10:23.610]  The level of expertise that we spoke about, you know, some in seconds, but little or no training.
[10:49.540 --> 10:59.900]  So as far as UL ratings and other industry standard hardware ratings, point of danger feedback should be everywhere.
[10:59.900 --> 11:01.460]  And what is enough to be secured?
[11:01.460 --> 11:04.020]  What's too much or too little?
[11:04.500 --> 11:06.440]  And what's a security defect?
[11:06.440 --> 11:12.940]  A manufacturing defect versus an exposed vulnerability.
[11:12.940 --> 11:19.640]  Because there's a continuum of vulnerability versus a real significant design defect.
[11:49.740 --> 11:52.940]  Let me even take it farther.
[11:53.860 --> 11:57.320]  The real question is, who has a need to know?
[11:57.320 --> 12:01.060]  And let's talk about one of the security releases we did last year.
[12:01.060 --> 12:05.500]  I found a vulnerability in gun lock, gun trigger locks.
[12:05.720 --> 12:11.400]  A really serious vulnerability to the point that literally I shot a video in Toronto with an 11-year-old kid
[12:11.400 --> 12:15.400]  removing three of the most popular gun locks off a rifle in seconds.
[12:15.500 --> 12:19.120]  Should that vulnerability be disclosed to the public?
[12:19.120 --> 12:21.040]  Or how should they be warned?
[12:21.040 --> 12:26.080]  Because at some point, some kid's going to get hurt or killed by removing one of these gun locks
[12:26.080 --> 12:30.060]  that their parents mistakenly believe provides security on that weapon.
[12:30.060 --> 12:33.600]  It's a perfect example where there can be tragic results.
[12:33.600 --> 12:35.400]  Do you disclose it? Do you not disclose it?
[12:35.400 --> 12:38.700]  When I talked to one of the leading manufacturers in the industry,
[12:38.700 --> 12:42.380]  who I did some work for a long time ago, they didn't want to disclose.
[12:42.380 --> 12:44.780]  They didn't think it was a big problem, and they weren't talking about it.
[12:44.780 --> 12:48.140]  And they haven't to this day, and they continue to manufacture the locks.
[12:48.220 --> 12:52.940]  And these are major manufacturers that are putting this material out there.
[12:52.960 --> 12:56.700]  Every hardware store and sporting goods store in the country sells them.
[12:56.700 --> 13:00.340]  Should that be exposed in the national media?
[13:05.270 --> 13:07.270]  Okay, and we'll talk about that in a minute.
[13:07.330 --> 13:13.450]  Because, well, you say yes until you're the parent of a kid that reads a report on the Internet
[13:13.930 --> 13:17.890]  and then goes and pulls a gun lock off a weapon and shoots one of his classmates,
[13:17.890 --> 13:21.170]  and then you're going to be coming to me saying, what the hell did you publish it for?
[13:21.650 --> 13:24.990]  Because my kid wouldn't have known about it if you didn't publish it.
[13:24.990 --> 13:26.310]  That's the problem.
[13:32.050 --> 13:34.590]  I agree. We'll talk about it in just a minute.
[13:38.930 --> 13:40.250]  Right, well, that's the attitude.
[13:40.370 --> 13:44.050]  Actually, we took the attitude that we didn't publish it directly.
[13:44.110 --> 13:49.250]  We charged a $3 fee for the report so that you'd have to have a credit card to buy it,
[13:49.250 --> 13:53.550]  which would eliminate virtually every kid from buying the report.
[13:53.550 --> 13:55.910]  And that's how we control distribution.
[13:55.910 --> 13:59.190]  All right, we're going to get some swag out.
[13:59.850 --> 14:01.070]  Oh, yeah, that's important.
[14:01.070 --> 14:04.350]  Let's, uh, and R.C. and, uh, ask Bob.
[14:08.890 --> 14:11.250]  Yeah, that's it.
[14:12.650 --> 14:14.950]  All right, R.C., now you can answer.
[14:16.330 --> 14:20.910]  In the hardware, locked and hardware environment.
[14:20.910 --> 14:21.990]  Okay, there you go.
[14:21.990 --> 14:24.910]  Here's a copy of Make Magazine for you.
[14:25.770 --> 14:28.850]  So you're all familiar with the controversy.
[14:28.850 --> 14:33.230]  When we were in the New York Times two years ago on top-level master key,
[14:33.230 --> 14:36.830]  as I've referred to it in my disk set, in my book,
[14:36.830 --> 14:39.210]  extrapolation of the top-level master key.
[14:39.210 --> 14:42.230]  Very, very serious security vulnerability.
[14:42.610 --> 14:47.670]  Basically, anybody in an organization that has access to one key to one door
[14:47.670 --> 14:52.830]  that is on the top-level master key system can compromise that system
[14:52.830 --> 14:56.790]  unless they have the proper locks installed, they've been coded properly,
[14:56.790 --> 15:01.510]  and they have the proper restricted type of blank with sidebar coding.
[15:01.510 --> 15:03.830]  It's a serious, serious problem.
[15:03.830 --> 15:07.590]  Yeah, so the, uh, the second quote I got from Bob,
[15:07.590 --> 15:17.570]  about locksmiths being huge up in Arkansas,
[15:21.430 --> 15:24.170]  and that we compromise national security.
[15:24.250 --> 15:26.790]  Now, then, of course, they turned around and said,
[15:26.790 --> 15:31.470]  yes, but every locksmith has known about this for 50 years, so it's no secret.
[15:31.470 --> 15:35.070]  So, of course, there would be a slight inconsistency in that position,
[15:35.070 --> 15:38.970]  but it shouldn't have been disclosed notwithstanding everybody knew about it.
[15:39.390 --> 15:41.250]  Everybody except the consumer.
[15:41.250 --> 16:02.240]  So, the tubular lock bypass, and then shortly after Hope published information on Weinstadt News,
[16:02.240 --> 16:06.660]  got some, a little bit of, you know, attention.
[16:06.800 --> 16:12.680]  It wasn't until an individual took that bypass technique and applied it to a kryptonite lock,
[16:12.680 --> 16:20.840]  that bike users are, you know, a little bit more crazy than motor users.
[16:20.840 --> 16:25.800]  Right, well, I can tell you the first two days that we posted that on our website,
[16:25.800 --> 16:27.860]  we had 100,000 hits.
[16:27.860 --> 16:35.720]  And I had thousands of emails from security administrators from colleges, governments, hospitals, schools,
[16:35.720 --> 16:38.960]  wanting to know what to do about their laptop locks,
[16:38.960 --> 16:44.940]  which escalated into the bike lock issue and into gun locks that use tubular locks.
[16:44.940 --> 16:47.600]  The problem isn't with the tubular lock.
[16:47.600 --> 16:51.940]  The problem is with inexpensive tubular locks that aren't designed properly.
[16:51.940 --> 17:01.190]  Now, as a result of that, and I can talk about kryptonite, they really did the right thing.
[17:01.520 --> 17:14.580]  They woke up one morning to all the flood of media, and it was sort of, it was a big surprise for them.
[17:14.580 --> 17:20.460]  And so, they spent a couple days looking at the issue, and then they finally made a corporate decision.
[17:20.460 --> 17:26.640]  They were going to replace every lock, which I believe was the very responsible thing to do.
[17:26.640 --> 17:28.760]  Frankly, there wasn't anything else they could do.
[17:31.560 --> 17:39.340]  They, the management of kryptonite, which is a subcompany of Schlage Lock,
[17:39.340 --> 17:42.420]  they made the decision to bite the bullet.
[17:42.420 --> 17:49.060]  They admitted the problem, and they offered a free replacement no matter when you bought your lock.
[17:49.060 --> 17:54.040]  They, to date, have replaced, to my understanding, about 350,000 of them,
[17:54.040 --> 17:58.040]  at a cost of about $10 million or more to Schlage.
[17:58.200 --> 18:01.840]  That is the responsible way to do it, and they've redesigned their lock,
[18:01.840 --> 18:04.700]  and so now it is a very secure piece of hardware.
[18:04.700 --> 18:08.980]  In fact, it has a security rating in Europe from the rating agency.
[18:09.100 --> 18:11.140]  They're not going to be easily broken.
[18:11.140 --> 18:27.080]  Now, that would never have occurred if, actually, we hadn't released our initial report,
[18:27.080 --> 18:34.500]  and then one of the bikers picked up on it and described the vulnerability for kryptonite locks,
[18:34.500 --> 18:39.100]  which have been and are the leader worldwide in the industry.
[18:39.100 --> 18:41.100]  And so it's a prime example.
[18:41.280 --> 18:44.680]  You know, the bottom line is don't kill the messenger for the message.
[18:44.680 --> 18:50.140]  If you have a security defect or vulnerability in your hardware, fix it or don't sell it.
[18:50.160 --> 18:51.820]  That's really the bottom line.
[18:51.820 --> 18:57.120]  Now, obviously, a lot of lock manufacturers don't subscribe to that theory, but they should,
[18:57.120 --> 18:59.560]  and the consumer really dictates that.
[18:59.560 --> 19:02.540]  Right. So, again, kryptonite clearly did it right.
[19:02.560 --> 19:08.500]  Other vendors, and we're not going to name names, but, again, engineers could not duplicate.
[19:08.500 --> 19:10.500]  They couldn't take a big advantage.
[19:10.500 --> 19:13.720]  For our people, we flexed Krypultra to bypass the lock.
[19:13.720 --> 19:14.380]  It's amazing.
[19:14.380 --> 19:18.520]  But I can also tell you that they are, because I'm in contact with a lot of them,
[19:18.520 --> 19:21.560]  they are implementing design changes that frustrate the problem.
[19:21.560 --> 19:24.220]  It's actually a very difficult problem to solve.
[19:24.220 --> 19:26.520]  It's not quite so easy as everybody thinks.
[19:26.520 --> 19:31.880]  But all of the vendors that I'm dealing with, they are taking a responsible approach now,
[19:31.880 --> 19:33.700]  and they are solving the problem.
[19:34.440 --> 19:37.240]  Okay, so bump keys or 999 keys.
[19:37.240 --> 19:43.320]  This is where a key is cut to its highest position on all the fittings.
[19:43.420 --> 19:48.660]  The inertia effect against all the pins.
[19:48.660 --> 20:01.990]  The key is inserted blind, and turn the key and open it.
[20:01.990 --> 20:05.890]  Yeah, actually, it's Mr. Newton from England, from 300 years ago,
[20:05.890 --> 20:08.630]  that helped us out on that with his third law of motion.
[20:09.030 --> 20:14.350]  He just didn't quite foresee it at that time, but that's exactly what it is.
[20:14.350 --> 20:17.010]  For every action, there's an equal and opposite reaction.
[20:17.070 --> 20:22.930]  And basically, when you wrap on the pins in a specific way, you create a few milliseconds of gap,
[20:22.930 --> 20:24.490]  and you can open the lock.
[20:24.490 --> 20:30.910]  I did some television interviews back at home demonstrating this,
[20:30.910 --> 20:33.870]  because it is a very big security vulnerability.
[20:33.870 --> 20:39.670]  Barry Wells has done a lot of work with it in Europe, and there's been a lot of publicity.
[20:39.670 --> 20:42.350]  Not so much in America yet, but it is a problem.
[20:42.350 --> 20:45.450]  It's a problem for every standard, conventional pin number lock.
[20:45.450 --> 20:48.130]  Not for most of the high security locks.
[20:48.130 --> 20:50.590]  But again, if the public doesn't know about it,
[20:50.590 --> 20:55.070]  then literally somebody can walk up to your residence door, your business door,
[20:55.070 --> 21:00.310]  and in two seconds open it with no damage and no real evidence of injury.
[21:16.600 --> 21:19.020]  Yeah, let me just address that for two minutes.
[21:19.020 --> 21:24.300]  About seven or eight years ago, I got a phone call from a locksmith in Hawaii.
[21:24.500 --> 21:28.640]  L-Safe, which is the largest in-room safe manufacturer in the world,
[21:28.640 --> 21:35.080]  they're owned by the Asa Abloy Group, has over a million safes in luxury hotel rooms,
[21:35.080 --> 21:40.240]  and virtually all of them are insecure than they were at that time,
[21:40.240 --> 21:42.860]  although they rated them as a high security safe.
[21:43.140 --> 21:45.800]  I looked at it, documented the defect,
[21:45.800 --> 21:50.220]  and frankly had a 16-year-old kid that was working for me in the office for the summer
[21:50.760 --> 21:56.600]  open it with a screwdriver and a paper clip in about one minute.
[21:56.920 --> 21:59.340]  And this was brought to the attention of L-Safe.
[21:59.340 --> 22:01.720]  They really didn't fix it. They didn't acknowledge it.
[22:01.720 --> 22:04.080]  They didn't acknowledge that I even existed
[22:05.020 --> 22:08.820]  because of the massive lawsuits that would have flowed from it.
[22:08.820 --> 22:12.080]  This is a perfect example. Hotel guests have no clue.
[22:12.080 --> 22:15.000]  I've done a lot of work in the hotel liability area.
[22:15.000 --> 22:20.080]  A lot of hotel locks are not secure. They should not be relied on.
[22:20.080 --> 22:23.340]  And the hotels, they're concerned, but they're not concerned
[22:23.340 --> 22:27.480]  because they have statutory exemption from liability and they have insurance.
[22:27.600 --> 22:32.280]  And so it's a problem. And again, as a consumer, you ought to be aware of the problem.
[22:34.120 --> 22:37.800]  So again, as Mark mentioned, we continue to do locks.
[22:37.800 --> 22:41.220]  That extends across the whole host of applications.
[22:41.220 --> 22:48.440]  Safes, Harley-Davidson brake locks, J.I.R. keys are compromised with that.
[22:48.700 --> 22:49.700]  It's huge.
[22:49.700 --> 22:54.160]  TSA luggage locks. Everybody's using them to lock their luggage when they fly.
[22:54.160 --> 22:55.700]  They're very insecure.
[22:55.880 --> 23:00.580]  We put out a security alert and demonstrated how you can take a piece of plastic from a credit card
[23:00.580 --> 23:06.300]  and open the most popular ones just by sticking a little piece of square plastic in the keyway.
[23:06.300 --> 23:07.520]  This is not security.
[23:07.520 --> 23:13.420]  And the real problem in that area is not theft from your luggage because it's easy to rip open luggage.
[23:13.420 --> 23:17.920]  The real issue, in my view, and I did a magazine article over in Europe on it,
[23:17.920 --> 23:23.360]  is that contraband can be put into your luggage after you think it's locked.
[23:23.360 --> 23:27.520]  And if it's not caught in security, then it can be a real serious problem.
[23:27.520 --> 23:50.750]  And again, Mark, talk about the gun.
[23:50.810 --> 23:55.550]  Well, multi-lock is a telescoping pin, very high security lock.
[23:55.550 --> 23:56.890]  They're made in Israel.
[23:56.890 --> 23:59.090]  I've been to their factory many times.
[23:59.090 --> 24:02.230]  They're also part of the Assa Abloy group out of Finland.
[24:03.170 --> 24:08.890]  Eric Michaud actually thought he came up with a compromise.
[24:09.710 --> 24:14.370]  When you are talking about bypass of locks, especially high security,
[24:14.370 --> 24:16.450]  one of the criteria is repeatability,
[24:17.310 --> 24:22.090]  which I don't believe can be shown in this particular bypass.
[24:22.510 --> 24:24.710]  Opening one lock doesn't mean anything.
[24:24.710 --> 24:29.390]  Opening all of them or 99% of them reliably within a time frame means a lot.
[24:29.390 --> 24:31.950]  That has not been demonstrated with multi-lock.
[24:31.950 --> 24:33.550]  And frankly, I don't think it will.
[24:33.550 --> 24:36.750]  I've done quite a bit of analysis on their locking system.
[24:36.750 --> 24:38.170]  It's a very secure device.
[24:38.170 --> 24:40.150]  But it was published.
[24:40.170 --> 24:42.650]  And the flip side of this argument is,
[24:42.650 --> 24:47.050]  it shouldn't have been published until it was truly documented.
[24:47.050 --> 24:49.510]  Theoretical in the laboratory is one thing,
[24:49.510 --> 24:52.470]  but you don't cause a manufacturer problem
[24:52.470 --> 24:58.630]  or you don't cause the public a security concern unless you can document it.
[24:58.630 --> 25:01.770]  And so that really is the flip side of this argument.
[25:01.770 --> 25:04.190]  All right.
[25:04.190 --> 25:08.410]  So, you know, we're really looking to empower you with your experience,
[25:08.410 --> 25:14.070]  your vulnerability exposures, to go out there, to look at hardware,
[25:14.070 --> 25:27.060]  and get all the information out there.
[25:27.060 --> 25:28.800]  There's a lot of material on the net.
[25:28.800 --> 25:31.540]  There's some on our website that's publicly available.
[25:31.640 --> 25:33.200]  A lot of it's restricted.
[25:33.380 --> 25:36.180]  But there's a lot of material out there.
[25:36.180 --> 25:38.440]  You really have to understand these systems.
[25:38.440 --> 25:41.620]  And again, it all comes down to what is your need to know,
[25:41.620 --> 25:43.880]  which is where I think we ought to begin this discussion.
[25:43.960 --> 25:48.200]  What is your need to know from manufacturers about vulnerabilities?
[25:49.480 --> 25:52.040]  So if you want to come up, I'll bring a mic down.
[25:53.620 --> 25:55.880]  And I think we ought to start off,
[25:55.880 --> 25:58.420]  what do you all think about the gun lock issue?
[25:58.420 --> 26:01.080]  And should we have disclosed it?
[26:01.960 --> 26:04.640]  I thought that's almost unanimous.
[26:04.640 --> 26:07.540]  Anyone for a free copy of LSS Plus?
[26:08.280 --> 26:09.520]  Come on up!
[26:10.680 --> 26:11.960]  I'm about to ask you a question.
[26:11.960 --> 26:13.740]  Actually, Matt, maybe they ought to come up afterwards,
[26:13.740 --> 26:16.980]  because otherwise it's going to take time into the presentation.
[26:18.620 --> 26:21.240]  Maybe they ought to come up to get CDs afterwards.
[26:21.240 --> 26:22.100]  Yeah, we'll do CDs afterwards.
[26:22.100 --> 26:25.760]  Why don't we do this at 10 to 11 so that we don't take time into this?
[26:26.200 --> 26:30.240]  Can you comment on electronic access control systems at all?
[26:31.120 --> 26:31.920]  Vulnerabilities?
[26:32.220 --> 26:36.660]  Can you comment on the vulnerabilities of electronic access control systems?
[26:36.660 --> 26:45.820]  Actually, I just did a survey study of all of the access control technologies for one of the government agencies.
[26:46.260 --> 26:50.660]  Some of them are secure. Some of them are marginally secure.
[26:50.660 --> 26:54.020]  There's been a lot in the media about how things can be compromised.
[26:56.060 --> 27:05.900]  Yeah, the real question is, if there's a security vulnerability on the electronic side, should it be published?
[27:06.460 --> 27:07.920]  What's your attitude?
[27:10.540 --> 27:12.880]  Okay, so should it be published?
[27:17.250 --> 27:18.870]  That's exactly correct.
[27:18.870 --> 27:21.070]  But the question is, should it be published?
[27:23.370 --> 27:25.950]  Yeah, you didn't have to use the microphone.
[27:25.950 --> 27:31.710]  I believe it should be, but manufacturers should be given some disclosure period so that they can react to it.
[27:31.710 --> 27:36.950]  Yeah, that is the responsible way to do it, unless national security is involved.
[27:37.190 --> 27:44.830]  Yeah, I mean, most manufacturers, us included, are working on preventing these things from coming out with new technologies.
[27:44.870 --> 27:48.890]  And it would be unfair for it to be disclosed before we had a solution to the problem.
[27:48.890 --> 27:51.430]  No, no, I agree with that. Okay, next question.
[27:54.130 --> 27:57.570]  Hello, my concern is...
[27:57.570 --> 27:58.710]  You have to speak up.
[27:58.890 --> 28:08.350]  My concern is with the HID card systems that I installed, just about every server room I had a chance to work in.
[28:08.570 --> 28:15.010]  And to date, I have not seen any published reports, any vulnerabilities on the system.
[28:15.010 --> 28:20.890]  I'm sure they exist, but what I'm basically concerned about is electronic systems.
[28:20.890 --> 28:25.870]  Well, obviously, Matt, maybe you should address that, but the old systems obviously were compromised.
[28:25.870 --> 28:29.630]  The newer ones are a little bit more difficult. Matt?
[28:29.630 --> 28:35.910]  So HID has their traditional proximity-based cards have been compromised.
[28:35.910 --> 28:39.230]  There is public information out there to duplicate a card.
[28:39.550 --> 28:45.350]  The new HID I-class cards defeat that capability.
[28:45.350 --> 28:49.490]  But there is publicly available information on the HID cards.
[28:50.350 --> 28:51.230]  Next.
[28:53.130 --> 28:59.430]  What do you think about a peer-review system like they do in scientific journals for lock security?
[28:59.430 --> 29:00.090]  Say that again?
[29:00.090 --> 29:06.250]  So in scientific journals, what they do is they sort of publish them and let everyone verify before it's considered good.
[29:06.250 --> 29:08.310]  Do you think that might apply well to lock?
[29:08.310 --> 29:11.090]  I think that happens on the internet about locks.
[29:11.090 --> 29:16.510]  It's just that it can really cause a manufacturer problem if you publish that there's a vulnerability.
[29:16.510 --> 29:22.430]  Well, I mean, do you think we could sort of engineer a place where you could publish a possible vulnerability and people wouldn't lose their head?
[29:22.430 --> 29:25.370]  I don't think... see, I think that would be all right.
[29:25.670 --> 29:32.570]  My theory and Matt's theory in all this is the more people that are looking at locks, the better.
[29:32.570 --> 29:36.130]  Because all it can do is improve the end product.
[29:36.270 --> 29:39.370]  There's a lot of sports lock-picking clubs in Europe.
[29:39.530 --> 29:44.570]  I go to some of them and routinely visit with them, speak and learn.
[29:44.570 --> 29:48.290]  They're just starting in America, and Matt can address that more.
[29:48.390 --> 29:55.490]  But I think it's a good thing because there are engineers, lawyers, doctors, teachers, kids, housewives.
[29:55.730 --> 29:58.510]  To pick a lock is an intellectual challenge.
[29:58.510 --> 30:00.050]  It's not just mechanical.
[30:00.130 --> 30:01.750]  To me, it's much better than chess.
[30:01.750 --> 30:03.650]  I've been doing it since I was 15.
[30:03.770 --> 30:05.190]  And it's intriguing.
[30:05.190 --> 30:07.510]  In fact, I'm doing a new book on the subject.
[30:07.590 --> 30:10.770]  And it is really intriguing.
[30:10.770 --> 30:18.190]  And so the more people that are looking at locks and finding potential exploits, in my view, the better.
[30:18.190 --> 30:20.970]  And the responsible manufacturers will agree with me.
[30:20.970 --> 30:26.770]  They want the input because at the end of the day, they want to make the best locks possible.
[30:26.770 --> 30:28.130]  End of story.
[30:28.490 --> 30:29.270]  Next.
[30:30.050 --> 30:36.690]  Briefly, lockpicking101.com is the definitive source for information.
[30:36.690 --> 30:41.570]  They've started some lock sports organizations.
[30:41.630 --> 30:46.330]  There's one in Europe that very well runs its tool, tool.nl.
[30:46.330 --> 30:48.730]  I think the URL was in the presentation.
[30:49.410 --> 30:51.910]  But lock sports are picking up.
[30:51.910 --> 30:54.350]  Clearly, we have the lockpicking competition here.
[30:54.770 --> 30:55.930]  It's a blast.
[30:55.930 --> 30:57.010]  It's a lot of fun.
[30:57.990 --> 31:03.070]  So I'm curious to get the thoughts on going back to the tubular gun lock issue.
[31:03.070 --> 31:11.810]  If you remove as far layers as you want to go, that also includes, say, store locks to gun stores.
[31:13.210 --> 31:17.810]  Given the number of lawsuits that have come against gun manufacturers for what has happened,
[31:17.810 --> 31:23.090]  do you believe there will be a change before there's a lot of lawsuits against gun lock manufacturers for the same thing?
[31:23.090 --> 31:23.850]  No.
[31:23.850 --> 31:26.890]  You know, it depends if they're negligent.
[31:26.890 --> 31:30.350]  If it was purely a negligent design, yes.
[31:30.350 --> 31:40.990]  The real problem in lockpicking and decoding and impressioning is one of expertise and skill level and time and tools required.
[31:41.150 --> 31:50.790]  If a 10-year-old kid can open a gun lock by wrapping it on the floor or sticking an ice pick into it,
[31:50.790 --> 31:55.430]  which is what I demonstrated, and pop it off the weapon in two seconds,
[31:55.430 --> 31:59.830]  I think they're going to get sued if somebody gets hurt or killed.
[32:00.930 --> 32:05.070]  It's a defective manufacturer and they all copied each other's defects.
[32:05.250 --> 32:08.530]  If it's more esoteric than that, no.
[32:09.090 --> 32:16.670]  Well, the reason why I mention that is a lot of the lawsuits that have been against manufacturers of guns have just been because of guns.
[32:16.670 --> 32:17.750]  Yeah, that's right.
[32:17.770 --> 32:27.010]  And so, going along those lines, if we do end up with something like a mandatory gun lock law, which could happen,
[32:28.150 --> 32:35.790]  given the fact that the locks actually work and you're still able to use a weapon, do you see that going down the bad path?
[32:35.790 --> 32:42.390]  Yeah, I mean, if the gun locks work, and I'm dealing with some manufacturers in Europe on this issue,
[32:42.390 --> 32:48.930]  if they work and then there's a defect and you're able to fire the weapon, it puts them a lot closer to liability.
[32:49.930 --> 32:54.250]  I'm not sure I... gun locks are a really complicated problem.
[32:54.990 --> 32:55.990]  Next.
[32:57.610 --> 33:04.750]  In the American patent system, we're dealing with software now, and it's stifling innovation left and right.
[33:04.750 --> 33:14.570]  I was wondering about your opinion on whether or not the American patent system is stifling or helping innovation in the creation of locks, and better locks.
[33:15.010 --> 33:21.730]  Yeah, I think it's helping. I mean, look, if you're inventive and create something that is unique and provides security,
[33:21.730 --> 33:24.990]  and some of them do, some of them don't, the patent doesn't guarantee security.
[33:25.150 --> 33:31.970]  I think our system rewards you for that, but it gives you a monopoly on that product for 20 years.
[33:33.310 --> 33:37.710]  Every major design defect in locks is described as patentless improvement.
[33:38.130 --> 33:46.250]  And so I've done a lot of research in the U.S. and in the patent offices to find out vulnerabilities from when I write books.
[33:46.410 --> 33:49.450]  And so, you know, it's a positive thing.
[33:49.450 --> 33:53.990]  So harder designs actually do make it into multiple vendors of locks.
[33:54.170 --> 34:03.310]  Yeah. Oh, sure. Yeah, look, there's nothing new in locks. Everybody copies everything and modifies it for patents. Yes, sir.
[34:03.310 --> 34:12.230]  Hi, you mentioned the full disclosure of 7 cases of national security.
[34:12.290 --> 34:17.750]  If you found out that some government organization was using a certain brand of lock, do you know about the users?
[34:17.750 --> 34:20.330]  You know, this audio system is not really good.
[34:21.010 --> 34:27.110]  If you found out that some government organization, you know, like some base was using a certain brand of lock
[34:27.110 --> 34:31.430]  and you knew there was a streaming vulnerability and you brought it to, you know,
[34:31.430 --> 34:40.290]  either the attention of security forces or someone in charge of security on the base or organization,
[34:40.290 --> 34:44.790]  and they didn't do anything about it, I mean, how do you normally handle that?
[34:46.150 --> 34:55.390]  Well, that's a real judgment call. I've brought vulnerabilities to GSA's attention and did not publish them upon their request.
[34:55.510 --> 35:00.510]  Even though their first comment was, if it's not covert, we don't care.
[35:00.510 --> 35:03.490]  If you have to drill a hole in the lock, we don't care.
[35:03.490 --> 35:07.270]  I said, okay, we're going to publish it. No, you're not. Why not?
[35:07.270 --> 35:09.810]  Well, because it's a security problem.
[35:09.810 --> 35:16.050]  Well, but these locks are used in the banking industry and everybody ought to know about it.
[35:16.050 --> 35:20.090]  No, they really shouldn't know about it, and if you publish it, we'll classify it.
[35:20.270 --> 35:22.390]  Now, that was the government's response.
[35:22.390 --> 35:25.570]  I wasn't afraid of their response because I don't think they could sustain that,
[35:25.570 --> 35:34.370]  but I didn't publish it because it was a responsible thing to do about five years ago.
[35:37.030 --> 35:40.890]  Regarding the situation where you disclosed to the manufacturer first,
[35:40.890 --> 35:44.770]  before the public giving them a chance to do like what Kryptonite did,
[35:45.310 --> 35:49.210]  what kind of turnaround time is reasonable for a manufacturer to be able to...
[35:49.210 --> 35:53.790]  Oh, I think Kryptonite was pretty reasonable. They did it in, like, two months.
[35:53.850 --> 35:54.330]  Really?
[35:54.330 --> 36:01.910]  Yeah. They had a huge problem, and they acknowledged it, and they fixed it.
[36:01.910 --> 36:05.390]  I mean, they did what they were supposed to do, and it cost them $10 million to do it.
[36:05.430 --> 36:08.690]  And with no questions asked, you know, they didn't depreciate the...
[36:08.690 --> 36:12.650]  If you had had that lock for 10 years, they still gave you a new one.
[36:12.670 --> 36:16.390]  They didn't depreciate the value like your insurance company would do on your homeowners
[36:16.390 --> 36:20.490]  and say, well, that lock's only... you know, you paid $100 for it, but it's only worth $25,
[36:20.490 --> 36:23.670]  so now we're going to give you a coupon for $25 to go buy a new one,
[36:23.670 --> 36:25.850]  which would have been a marketing bonanza for them.
[36:25.850 --> 36:27.670]  They didn't do that. They just replaced it.
[36:27.670 --> 36:31.350]  They said, hey, you know, send us your lock or send us proof, we'll send you more.
[36:34.150 --> 36:40.710]  I don't know if they... I don't know if they probably not. I don't know.
[36:40.710 --> 36:45.130]  But they do have a better lock now. It's a tough lock.
[36:46.230 --> 36:52.490]  I understand your argument about defective, you know, being something that maybe a 10-year-old could open
[36:52.490 --> 36:57.830]  versus a skilled person, but, you know, I don't have any 10-year-olds running around my corporation,
[36:57.830 --> 37:03.230]  and if I go to buy a lock to lock the data center door, you know, I want to be...
[37:03.230 --> 37:08.430]  I think as a consumer, I'm surprised that the Consumer Product Safety Commission or somebody else
[37:09.130 --> 37:16.870]  wouldn't go after manufacturers because, you know, we've had Firestone for the Ford tires on the SUVs.
[37:16.870 --> 37:20.290]  People got killed.
[37:20.290 --> 37:27.310]  You know, I mean, if I lock my house and a skilled burglar comes in and murders me, you know, I'm killed.
[37:27.650 --> 37:32.610]  Vioxx, the anti-arthritis drug, it was, you know, clearly uncovered that they knew there was a problem
[37:32.610 --> 37:36.430]  and swept it under the rug, and they're being punished for that fact.
[37:36.950 --> 37:38.730]  Will this happen in the lock industry?
[37:38.730 --> 37:41.850]  I don't think so. It's a different set of problems.
[37:41.850 --> 37:48.610]  And frankly, the problem is, in all those cases you've named, you're not dealing with criminal actions.
[37:48.610 --> 37:56.930]  Here you're dealing with somebody that's violating the law, and you really can't control that other than criminal statutes.
[37:56.930 --> 38:03.390]  That's the sanction. And so the real question, again, that nobody's really addressed yet is,
[38:03.390 --> 38:08.190]  what's your... how much information do you think you ought to be entitled to from the lock manufacturer,
[38:08.190 --> 38:10.090]  and who ought to be entitled to it?
[38:10.090 --> 38:14.930]  But isn't the lock's sole purpose to prevent criminal action in some ways?
[38:14.930 --> 38:22.790]  Yeah, that's true, but... yeah, I agree, but it's a little more complicated.
[38:26.410 --> 38:30.330]  That's right. Now, they're trying to sue the gun manufacturer.
[38:32.610 --> 38:36.590]  Right. Well, yeah, okay, but that's not going to go anywhere.
[38:36.990 --> 38:38.990]  Next question, because we're running out of time.
[38:40.470 --> 38:48.830]  Instead of waiting for a lock manufacturer to invest marketing dollars and then pissing them off by releasing a security breach,
[38:48.830 --> 38:56.270]  do you think the manufacturers would consider almost like a hardware open-source review of their design before going to market?
[38:56.450 --> 38:59.470]  Why not? No.
[38:59.470 --> 39:00.910]  But isn't it better than...
[39:00.910 --> 39:07.270]  Well, first of all, until they receive a patent, they're not going to publish anything. That's the way things work.
[39:07.270 --> 39:12.890]  And, I mean, part of the security of locks is you not knowing how they work.
[39:12.970 --> 39:15.910]  But didn't you just prove security by obscurity doesn't work?
[39:15.910 --> 39:19.210]  Yeah, well, actually, I prefer to call it security by ignorance.
[39:19.750 --> 39:26.210]  And that's really what it is, because, look, if you're a security manager, IT professional,
[39:26.210 --> 39:31.110]  you're charged with a physical security responsibility as well as logical security.
[39:31.110 --> 39:41.450]  You can't make the risk assessment in your organization unless you know what the bypass techniques are and are shown what those are.
[39:41.550 --> 39:47.970]  If they'll tell you that, I don't have a problem with their policy. I don't think we ought to be telling criminals how to bypass locks.
[39:47.970 --> 39:55.590]  If you have a need to know because you have a protection responsibility, I think you have a right to know everything about that lock.
[39:55.590 --> 40:06.390]  Now, unlike software and Bill Gates and everybody who doesn't give you the code, if you're smart, you can take a lock and it'll tell you everything about itself.
[40:06.470 --> 40:10.070]  So if you're smart enough to figure it out, the information is there anyway.
[40:10.110 --> 40:13.430]  But I think you have a right to know that information.
[40:13.850 --> 40:17.950]  How can you differentiate between a consumer and a possible criminal?
[40:17.950 --> 40:26.150]  Well, that's a real good question because if the consumer relies on his locksmith or their locksmith as their security professional,
[40:26.150 --> 40:31.990]  then no problem. Let the security professional say, look, yeah, there's a vulnerability. You don't need to know what it is.
[40:31.990 --> 40:37.130]  I mean, my mother, she puts new locks on their house. She doesn't need to know how to pick them or open them.
[40:37.130 --> 40:42.870]  She just needs to know, is it secure and how long would it take a competent burglar to open it?
[40:42.870 --> 40:47.890]  Well, first of all, burglars don't open locks by picking them. They use a crowbar or a brick.
[40:47.970 --> 40:50.590]  Ninety-nine percent of the burglaries are done that way.
[40:50.590 --> 40:57.450]  We're talking about more sophisticated burglaries and information theft and compromise of data and that type of thing.
[40:57.770 --> 41:05.190]  Just a quick question about, you were saying that 50 years they knew how to circumvent the tumbler lock.
[41:05.190 --> 41:10.030]  And I'm wondering if the information space in lock picking is a lot tighter than information security
[41:10.030 --> 41:12.990]  because 50 years the public hasn't heard about this.
[41:12.990 --> 41:16.710]  Honestly, they really haven't. It's really quite amazing.
[41:16.710 --> 41:22.290]  This has been around for a long, long time, especially on plum keying and on master keying.
[41:23.150 --> 41:26.870]  A lot of folks know about it. The locksmithing community was aware of it.
[41:26.870 --> 41:30.830]  The problem was they weren't telling their end-user customers.
[41:30.830 --> 41:35.970]  A lot of them didn't understand it. So the end-user customer had no way to assess their risk.
[41:35.970 --> 41:41.250]  So the second part of the question I had is, for the kryptonite locks, I don't know a lot about locks, but I know about bytes.
[41:41.250 --> 41:47.890]  And I haven't seen, before this vulnerability was published, anyone whose kryptonite lock ever was really knocked open.
[41:49.410 --> 41:52.250]  I'm sure there are, but I'm wondering if you have any statistics.
[41:52.410 --> 41:58.110]  Actually, what we published, a variance of that was published about 10 years before in the UK.
[41:58.110 --> 41:59.690]  Nobody paid any attention to it.
[42:00.550 --> 42:06.310]  If you understand lock-picking theory and impressioning theory, then it's a real simple deal.
[42:10.710 --> 42:13.830]  Going to travel locks for a second.
[42:13.830 --> 42:24.910]  About 10 years ago, actually maybe 12 or 13, we had an attempt by the government to put something into place called Keyestro in cryptography.
[42:25.970 --> 42:32.650]  Would you consider the quote-unquote TSA safe locks to be a form of physical Keyestro?
[42:33.730 --> 42:37.330]  No. First of all, they're $10 cheap locks.
[42:37.330 --> 42:39.990]  And the problem is the public doesn't understand that.
[42:39.990 --> 42:41.890]  They think they're buying security.
[42:41.890 --> 42:43.790]  And it's a matter of convenience.
[42:43.790 --> 42:45.130]  Look, you have two choices.
[42:45.130 --> 42:49.970]  If you want to lock your luggage to prevent pilfering, allegedly,
[42:49.970 --> 42:53.790]  then you put a lock that TSA can get into, because otherwise they're going to cut the lock,
[42:53.790 --> 42:56.710]  because they have a legitimate interest in seeing what's in your luggage.
[42:56.710 --> 42:57.230]  End of story.
[42:57.230 --> 42:59.310]  I mean, that's why TSA locks were developed.
[42:59.510 --> 43:06.170]  A trade organization got all the lock manufacturers together, established criteria for five different kinds of locks
[43:06.170 --> 43:11.990]  that all have master keys or a bypass key that TSA can get into.
[43:12.050 --> 43:13.370]  And that's their sole purpose.
[43:13.370 --> 43:17.150]  But isn't that a... that's not a form of Keyestro?
[43:17.150 --> 43:21.290]  It's not a form of giving them, here's the pattern for the key to get into the lock?
[43:21.290 --> 43:22.950]  In that regard, yeah.
[43:22.950 --> 43:27.290]  But I don't think anybody's going to disagree that TSA doesn't have the right to check your luggage.
[43:27.290 --> 43:28.430]  No, I'm not disagreeing with that.
[43:28.430 --> 43:29.310]  I'm just saying that this is...
[43:29.970 --> 43:30.310]  Yeah, maybe.
[43:30.310 --> 43:32.330]  I mean, it's a loose parallel.
[43:33.110 --> 43:34.790]  I don't think it's exact.
[43:35.370 --> 43:36.090]  Okay.
[43:36.090 --> 43:36.430]  Yeah.
[43:36.430 --> 43:37.190]  All right.
[43:39.070 --> 43:40.230]  Yeah, actually, I would just...
[43:41.250 --> 43:45.290]  I travel a lot, and I would recommend, instead of using a lock, use a penetration tag.
[43:45.290 --> 43:47.350]  Use, like, the little wire tags or something like that.
[43:47.350 --> 43:49.530]  Because at least that way you know if somebody broke into the bag.
[43:49.810 --> 43:51.110]  You tagged it.
[43:51.110 --> 43:53.210]  You know when you pull it...
[44:01.510 --> 44:05.030]  Well, it's not TSA that I'm worried about sticking something back in there.
[44:05.030 --> 44:05.690]  They'll steal it.
[44:05.690 --> 44:06.950]  They won't put it back in.
[44:08.450 --> 44:10.350]  Well, that's been documented.
[44:10.350 --> 44:11.490]  There's been lots of arrests.
[44:11.490 --> 44:16.650]  The problem is your hotel porter in London putting something into your locked luggage that you don't know is there,
[44:16.650 --> 44:22.330]  either narcotics or explosives or whatever, and you think you're okay because it was locked.
[44:22.330 --> 44:24.050]  That's where I think the problem is.
[44:24.290 --> 44:26.130]  We've got time for one more quick question.
[44:26.130 --> 44:26.570]  Yeah.
[44:32.250 --> 44:36.750]  I'd love to do something with it.
[44:36.750 --> 44:38.650]  I had some media interest, but nobody...
[44:38.650 --> 44:39.470]  It's America.
[44:39.470 --> 44:40.590]  Nobody does anything.
[44:40.590 --> 44:42.570]  I think it's a great idea, though.
[44:43.370 --> 44:44.630]  Are we out of time, Matt?
[44:44.630 --> 44:45.590]  Yeah, we're out of time.
[44:45.870 --> 44:47.190]  Thank you very much.
[44:49.970 --> 44:50.650]  Pleasure.