1
00:00:00,680 --> 00:00:01,480
Thanks.

2
00:00:01,660 --> 00:00:02,620
Thanks, Whitney.

3
00:00:02,960 --> 00:00:05,880
Thanks to the Crypto Village for fitting me on on the last minute here.

4
00:00:05,880 --> 00:00:09,220
I know this is pulled together rapidly.

5
00:00:09,220 --> 00:00:14,300
So today I'm going to talk to you about the FOIA process.

6
00:00:15,200 --> 00:00:19,780
I call this talk Fun with FOIA, just hitting up the government for sweet, sweet secrets.

7
00:00:20,680 --> 00:00:27,380
So what I intend to do here is to give an overview of the FOIA process and how you can make it work for you.

8
00:00:28,300 --> 00:00:29,680
So what's FOIA?

9
00:00:29,680 --> 00:00:38,380
So a lot of people don't necessarily know that the government does have a pathway for giving you documents that belong to all of us.

10
00:00:38,400 --> 00:00:41,540
So FOIA stands for the Freedom of Information Act.

11
00:00:42,040 --> 00:00:51,020
And so what this is designed to do is to disperse documents that are sourced from the government.

12
00:00:51,840 --> 00:00:53,820
It's true information.

13
00:00:53,820 --> 00:00:56,860
It's usually, in some cases, it's raw information.

14
00:00:56,860 --> 00:00:58,600
In other cases, it's processed information.

15
00:00:58,600 --> 00:01:00,360
It all depends on what you're asking for.

16
00:01:00,360 --> 00:01:11,280
But the beauty of the Freedom of Information Act is that it allows common people to make these requests, you know, at will for almost any topic that you're interested in.

17
00:01:12,360 --> 00:01:14,320
It's a very powerful process.

18
00:01:14,320 --> 00:01:16,480
It doesn't have to cost you any money.

19
00:01:16,480 --> 00:01:23,480
In some cases, it will cost money, but we'll get into the nuance of all of this as we go along.

20
00:01:25,440 --> 00:01:30,480
So, okay, so why would you want to interact with the government in the first place?

21
00:01:30,480 --> 00:01:43,720
I don't know why you'd want to interact with the government on any other basis, but the Freedom of Information Act is something that we should all be involved in because it boosts transparency in a way that not very many other governmental processes allow for.

22
00:01:43,720 --> 00:01:52,820
So if you're interested in a topic and you want to know more, you think maybe the government might have some information, FOIA is going to be your way to get that.

23
00:01:53,020 --> 00:01:56,480
So maybe you're doing research on a topic.

24
00:01:57,300 --> 00:02:00,240
You've got an area of interest and you want to know more about it.

25
00:02:00,240 --> 00:02:02,220
FOIA may be the way that you can do that.

26
00:02:02,300 --> 00:02:10,720
There are a lot of different complications that make FOIA challenging in some ways and liberating in others.

27
00:02:10,720 --> 00:02:19,180
Again, something we'll get into in a little while, but with this process, you want to have a topic in mind when you get started.

28
00:02:19,260 --> 00:02:24,380
So let's just jump right into how we would do this.

29
00:02:24,820 --> 00:02:34,480
So I'm going to kind of try and keep the context of everything I say around a topic that's of interest to me and probably a lot of people who are on the stream.

30
00:02:35,420 --> 00:02:55,840
Working with a colleague of mine, Emma Best, we put together a project to look through government documents that involve the history of hackers and events that have happened to the government or may have been investigated by the government around information security.

31
00:02:55,840 --> 00:02:57,920
We call this hacking history.

32
00:02:58,100 --> 00:03:09,280
And on muckrock.com, which is a site that you can use to submit Freedom of Information Act requests, we are over 1% of the requests on the site now.

33
00:03:09,280 --> 00:03:13,220
By far, we're the largest by requests.

34
00:03:13,220 --> 00:03:16,940
We're the largest program project on muckrock.

35
00:03:16,940 --> 00:03:24,160
So we've put in, I think I got an update today that we have over 850 requests in, which is quite a bit.

36
00:03:24,160 --> 00:03:27,420
Enough of my bragging.

37
00:03:27,700 --> 00:03:35,020
So with hacking history, it's a large umbrella topic that you can ask all kinds of different questions about.

38
00:03:35,020 --> 00:03:47,220
So this can range from anywhere from malicious code that the government may have to specific events the government may have been investigating or even involved in directly.

39
00:03:47,220 --> 00:03:48,940
It could involve people.

40
00:03:49,560 --> 00:03:55,320
So there are a lot of subtopics that fit into this topic that you can ask the government about.

41
00:03:56,320 --> 00:04:02,040
So to get started, we can think of something that we want to ask a question about.

42
00:04:02,040 --> 00:04:11,620
So because we're talking at DEF CON, because we're having a DEF CON weekend here, and I've got some information back, which I'll share at the end of the slideshow.

43
00:04:11,760 --> 00:04:13,640
Let's take DEF CON, for instance.

44
00:04:13,640 --> 00:04:15,920
So let's say that you want to know more about DEF CON.

45
00:04:15,920 --> 00:04:22,060
The process here is to try and target something that you think that the government may have specific information on.

46
00:04:22,060 --> 00:04:31,540
So an event like DEF CON, you would want to start by asking questions that pertain to that specific event that happens yearly.

47
00:04:31,540 --> 00:04:46,780
In a way, this is kind of like... it's a little like social engineering, but not in the more technical way that the actual good social engineers, not like myself, can do this.

48
00:04:46,880 --> 00:04:54,220
So you want to think of questions that will get the best response for the questions that you're asking.

49
00:04:54,220 --> 00:05:01,200
So when you think of a topic, try and make it something specific, but you don't necessarily have to make it super, super specific when you just get started.

50
00:05:01,200 --> 00:05:09,700
You can start with something that's very broad in nature and try and target documents that you think maybe may comport with a broader sense.

51
00:05:09,700 --> 00:05:16,560
So like, if you're starting broad, start with something like indexes.

52
00:05:16,560 --> 00:05:29,260
So asking for indexes of things is a really good place to start if you're not really quite sure what you want to ask about, or whether you're not quite sure if there may be documents that exist on the topic in the first place.

53
00:05:29,260 --> 00:05:37,480
So you can ask a government, for instance, for indexes of programs that pertain to a specific topic.

54
00:05:37,600 --> 00:05:50,220
So you may be able to ask the Federal Bureau of Investigation about... for an index of maybe hacker conferences that they've been tracking for the last, you know, 10 or 15 years.

55
00:05:50,500 --> 00:05:53,720
Which brings me to another kind of sub-genre here.

56
00:05:53,720 --> 00:05:57,520
So you want to kind of think of... make sure that you time-bound everything.

57
00:05:58,180 --> 00:06:04,560
So don't just ask for like everything the government has on X if it's a really big topic.

58
00:06:04,560 --> 00:06:08,440
Try and keep it something very specific in time.

59
00:06:09,720 --> 00:06:11,260
Oh, let me go back one.

60
00:06:11,260 --> 00:06:15,920
So when you're asking these questions, yeah, time-bound it.

61
00:06:15,920 --> 00:06:19,980
Keep it between a certain time frame.

62
00:06:19,980 --> 00:06:23,940
I usually start with January 1 of a specific year.

63
00:06:23,940 --> 00:06:30,460
And then if I want to go for five years, I might go January 1 of like 1990 to 1995 or something like that.

64
00:06:30,580 --> 00:06:36,880
I like to be specific about the exact day that I wanted to start and end.

65
00:06:36,880 --> 00:06:38,540
I just think that makes it easier.

66
00:06:38,540 --> 00:06:48,180
Because really, you have to remember that on the other end of this process is another human and the other human may have different quirks about how they would provide information to you.

67
00:06:48,180 --> 00:06:54,300
So time-bounding helps with larger topics to kind of chunk it down.

68
00:06:54,580 --> 00:07:00,560
It saves a lot of time on the other side of the search.

69
00:07:00,560 --> 00:07:08,900
So when the FOIA officer gets the request, they'll be able to take that information and do a search against it.

70
00:07:08,900 --> 00:07:13,860
But there are requirements that the government tries to stay under.

71
00:07:13,860 --> 00:07:25,230
So what I mean by that is the government is not obligated to provide you everything that they have and just work on it indefinitely.

72
00:07:25,730 --> 00:07:36,430
It has to not cause... I think with the wording they use is reasonable distress.

73
00:07:37,010 --> 00:07:39,410
It's got to be a reasonable request.

74
00:07:39,410 --> 00:07:43,230
You can't ask for an entire database of something and expect that you're going to get it back.

75
00:07:43,450 --> 00:07:52,530
So try to, especially if it's a larger topic, kind of try and keep it in a self-isolated kind of like chunk of information that you expect to get back.

76
00:07:52,530 --> 00:07:57,190
This can also be helpful if you're not sure what you're going to get back in the first place.

77
00:07:57,650 --> 00:08:03,830
So if you think that there may be a lot of information there, the time-bounding really helps with that.

78
00:08:04,230 --> 00:08:14,390
So when I did my request for DEF CON, for instance, I chunked it down to like the beginning of DEF CON, which is like 9293 timeframe to 1997.

79
00:08:15,170 --> 00:08:21,850
What I ended up getting was like wildly... it was way up into the 2000s that I got some information.

80
00:08:22,350 --> 00:08:27,030
And that's just kind of one of the fun things about the FOIA process is that you never really know what you're going to get back.

81
00:08:27,030 --> 00:08:28,510
So it's kind of like a treasure hunt.

82
00:08:29,730 --> 00:08:32,690
Okay, so who can you ask questions to?

83
00:08:33,190 --> 00:08:35,990
You can ask questions to any government agency.

84
00:08:35,990 --> 00:08:40,910
Every federal government agency is required to be responsive to FOIA.

85
00:08:41,690 --> 00:08:46,890
How they are responsive to your requests is part of the nuance.

86
00:08:46,890 --> 00:08:50,410
So a lot of my requests, for instance, go to FBI.

87
00:08:50,410 --> 00:09:08,850
If you wanted to ask something about special forces, so about a specific special forces organization, you might want to send a Freedom of Information Act to the Special Operations Command, which is just a sub-genre of the Department of Defense.

88
00:09:09,050 --> 00:09:15,850
You can also duplicate that request and send it to the Department of Defense to see if they may have anything kind of broader.

89
00:09:15,850 --> 00:09:18,650
You can ask the Central Intelligence Agency.

90
00:09:18,650 --> 00:09:24,350
You can ask the Department of Housing and Urban Development.

91
00:09:24,350 --> 00:09:33,550
Any government agency that takes public funding, which is all of them, has to be responsive to FOIA in some form or fashion.

92
00:09:33,550 --> 00:09:36,350
Some of them are better than others.

93
00:09:37,810 --> 00:09:40,970
Famously, the NSA is not good with FOIA.

94
00:09:40,970 --> 00:09:45,190
They take forever to acknowledge your FOIAs.

95
00:09:45,230 --> 00:09:50,670
When they do finally acknowledge them, the searching takes a lot longer than really it should.

96
00:09:50,670 --> 00:10:03,510
I think by law, they're bound to provide full service to all requests within 10 days, but it almost never goes down that way.

97
00:10:03,510 --> 00:10:08,350
So be prepared for disappointment and long timelines, especially depending on who you ask.

98
00:10:09,950 --> 00:10:16,370
But your FOIA requests are not just limited to federal agencies and federal entities.

99
00:10:16,370 --> 00:10:20,650
You can also, in a lot of cases, you can ask your local entities the same questions.

100
00:10:21,750 --> 00:10:23,470
Especially if they're of local interest.

101
00:10:23,470 --> 00:10:30,430
So if you wanted to ask your local police department questions, you're almost assured to be able to do that.

102
00:10:30,430 --> 00:10:38,870
So it's not quite the same as the federal mandate, but local jurisdictions also, municipalities have to follow.

103
00:10:38,870 --> 00:10:46,050
They usually have their own form of the Freedom of Information Act that mirrors what the feds use.

104
00:10:46,330 --> 00:10:52,870
So any question that you might ask to the police or to the FBI, you can probably ask your local folks as well.

105
00:10:53,630 --> 00:10:56,630
Okay, so here's the fun part, the ask.

106
00:10:56,630 --> 00:11:01,210
So when you go to do your asking, we already touched on a little bit of this.

107
00:11:02,450 --> 00:11:09,750
Have a topic in mind, that's one big thing, but also have specific questions that you want to ask in mind.

108
00:11:09,830 --> 00:11:21,870
So if you're unclear when you put your request in, again, remember there's a human on the other end of this process, and there's a good chance that they're not going to know what you're asking for if you're not super clear about it.

109
00:11:21,870 --> 00:11:39,690
So if you tell them that you want something that's very vague and up for interpretation, or it's muddy and difficult to divine what it is that you're asking for exactly, the FOIA officer is bound to just kick it back to you and say, like, I don't know what you're talking about.

110
00:11:39,790 --> 00:11:41,310
Be more specific.

111
00:11:41,770 --> 00:11:46,790
So don't give up if you get a rejection when you send in your first few.

112
00:11:47,050 --> 00:11:51,330
Just try to hone in on exactly what it is that you want to know about.

113
00:11:51,870 --> 00:12:11,130
I know I had a ton of rejections when I first started asking before I started to figure out, like, oh, I guess you can't, you know, you can't just ask CIA about aliens because they've been asked this question probably a million times, and they probably don't really have anything good in the first place.

114
00:12:11,310 --> 00:12:16,830
So, or something that's releasable, which is another thing that we'll get into shortly.

115
00:12:17,390 --> 00:12:21,010
So when you do this asking, try to be as specific as possible.

116
00:12:22,350 --> 00:12:26,850
Even when you're not quite sure what to expect back.

117
00:12:26,850 --> 00:12:32,230
So when you start a research project, you may start with fewer details.

118
00:12:32,230 --> 00:12:38,470
So let's say that you put in a request for an index because you have nothing on the topic that you're interested in.

119
00:12:38,530 --> 00:12:42,890
And the index is going to come back and it's going to have some information that will kind of give you threads to pull.

120
00:12:42,890 --> 00:12:52,010
And so when you start to pull those threads, you'll be able to figure out what kinds of questions to ask next that will be more specific to your area of interest.

121
00:12:53,470 --> 00:12:57,430
So when you format your question, again, make sure it's time bound.

122
00:12:57,510 --> 00:13:03,170
Even if you're asking for something that you know that the government has for a specific time frame.

123
00:13:03,170 --> 00:13:05,930
I like to put like buffer space on either side.

124
00:13:05,930 --> 00:13:11,290
So give it maybe a year before and after the event, if you're asking about an event.

125
00:13:11,330 --> 00:13:17,370
And just see if they've been collecting information prior to or after the event was supposed to have taken place.

126
00:13:18,330 --> 00:13:25,810
Good things to ask about events, programs, individual specific, all of those things are great places to start.

127
00:13:25,810 --> 00:13:32,190
So if you have like a specific hacking event, for instance, that you want to ask about.

128
00:13:32,510 --> 00:13:38,010
Let's just say like there's a Citibank hack from 1995.

129
00:13:39,150 --> 00:13:43,390
If you know exactly when that happened, time bound it for that year.

130
00:13:43,450 --> 00:13:47,750
Maybe give yourself some six months on either side.

131
00:13:48,930 --> 00:13:57,290
If you know that there's a specific individual you want to ask about, there are a few more things that you have to keep in mind when you actually go to do the question asking.

132
00:13:58,550 --> 00:14:01,450
And those are more that we'll get into in just a second.

133
00:14:02,450 --> 00:14:09,150
But make sure that you just like if you want to know about let's say you want to know something about Kevin Mitnick.

134
00:14:09,150 --> 00:14:10,670
There's a lot more here.

135
00:14:10,670 --> 00:14:20,550
But if you want to know something about Kevin Mitnick, you ask the FBI, you know, give me all the information that you have, any documentation related to Kevin Mitnick between the years of X and X.

136
00:14:21,850 --> 00:14:28,010
And make sure that you include things like audio visual, handwritten notes.

137
00:14:28,010 --> 00:14:32,650
It also really helps to get familiar with very specific government documentation.

138
00:14:32,650 --> 00:14:42,710
One of my favorites to ask for is FBI FD 302 documents because 302s are what the FBI uses to take handwritten notes.

139
00:14:42,770 --> 00:14:46,690
So FBI agents are not required.

140
00:14:46,690 --> 00:14:57,730
They're actually, I don't know if they're disqualified by mandate to not be able to actually record conversations that they have with as interviews with people.

141
00:14:57,730 --> 00:15:00,430
So with sources and just like bystanders.

142
00:15:00,570 --> 00:15:03,490
So the way that they do this is they take handwritten notes.

143
00:15:03,490 --> 00:15:09,650
So all those handwritten notes go into the FBI database and you can ask for those those handwritten notes.

144
00:15:09,990 --> 00:15:12,730
So asking for FD 302 is always great.

145
00:15:12,730 --> 00:15:17,030
There's always all kinds of like funny extemporaneous information in there.

146
00:15:18,010 --> 00:15:19,410
Keywords are great.

147
00:15:19,410 --> 00:15:25,150
Specific records like an FD 302, even if you don't know they exist, ask for them anyway.

148
00:15:25,710 --> 00:15:27,290
Indexes we already covered.

149
00:15:28,190 --> 00:15:32,890
Basically, you can ask for anything that qualifies as a public document.

150
00:15:32,890 --> 00:15:38,230
So anything that's recorded by the government technically becomes a public document.

151
00:15:38,250 --> 00:15:41,430
But just because you ask for them doesn't mean that they have to give them to you.

152
00:15:41,430 --> 00:15:44,950
So there will be some exemptions that we'll have to deal with in this process.

153
00:15:44,950 --> 00:15:49,990
So when you get responses, this is going to take some time.

154
00:15:49,990 --> 00:15:54,270
So give yourself plenty of... make sure that you're very patient with this process.

155
00:15:54,270 --> 00:16:02,190
I've still got FOIAs waiting for responsive documents that I've been waiting for for the last couple years.

156
00:16:02,350 --> 00:16:09,690
I put one in for a well known hacker that probably people on the stream know of named Trick.

157
00:16:09,690 --> 00:16:18,630
I've got one into the Defense Intelligence Agency for Trick and I am not expecting that one to be done until December of 2021.

158
00:16:18,750 --> 00:16:26,710
So be patient, especially if you're asking for something that's been classified or is currently classified.

159
00:16:27,030 --> 00:16:29,030
Just have patience with the process.

160
00:16:29,030 --> 00:16:33,210
A lot of times they'll declassify it if it's relevant and it's older.

161
00:16:33,970 --> 00:16:36,590
But that's kind of just the luck of the draw.

162
00:16:37,730 --> 00:16:39,370
So do's and don'ts.

163
00:16:39,370 --> 00:16:41,490
Okay, so things that you should do.

164
00:16:41,490 --> 00:16:44,170
Ask specific questions.

165
00:16:44,170 --> 00:16:45,610
Time bound your requests.

166
00:16:45,730 --> 00:16:46,530
FOIA for the dead.

167
00:16:46,530 --> 00:16:49,450
So here's an interesting thing about people.

168
00:16:50,010 --> 00:17:04,610
So when I just gave that example about doing a Freedom of Information Act request on Kevin Mitnick, you wouldn't get anything back in all likelihood because he's still a US person and he's still alive.

169
00:17:04,610 --> 00:17:13,950
So when you do a request like this, you have to make sure that you are following their rules for asking for information.

170
00:17:14,150 --> 00:17:19,590
If the person is dead, you can ask these questions and just provide an obituary.

171
00:17:19,590 --> 00:17:21,750
In most cases, that will be enough.

172
00:17:22,290 --> 00:17:26,090
The obituary has to be from a publication that's well known.

173
00:17:27,110 --> 00:17:32,870
You can't just send them like a local newspaper probably won't cut it or like a blog post or something.

174
00:17:32,870 --> 00:17:34,850
Trust me, I've tried this and it doesn't work.

175
00:17:35,230 --> 00:17:40,150
So don't be disappointed if you send them something and they just flat out reject it.

176
00:17:40,150 --> 00:17:43,330
I've had that happen before, even if I think that it's good enough.

177
00:17:44,310 --> 00:17:54,210
There are also exemptions, though, for the US person's policy, which is what prohibits the government from sharing information about living US persons.

178
00:17:54,250 --> 00:17:58,450
One of those is an exemption for public figures.

179
00:17:58,650 --> 00:18:02,770
So I don't know that Kevin Mitnick would qualify as being a public figure.

180
00:18:04,430 --> 00:18:11,970
But if you were to ask for something within the last 10 or 15 years on Mitnick, probably they're not going to share it.

181
00:18:12,130 --> 00:18:18,270
Unless, you know, unless he dies tonight, which I hope that didn't happen, but just sibling.

182
00:18:19,050 --> 00:18:22,190
Yeah, and remember that there's a person on the other end of this.

183
00:18:22,430 --> 00:18:25,770
So don't be a huge jerk to them.

184
00:18:27,470 --> 00:18:31,270
Most of them are earnestly trying to be helpful to you.

185
00:18:31,270 --> 00:18:38,990
So try to be polite, especially if you get something back, like be very thankful, grateful to them for being helpful to you.

186
00:18:39,070 --> 00:18:44,010
You don't have to kiss their ass or anything, but like just be aware that they have been trying to help you.

187
00:18:47,380 --> 00:18:49,220
Oh, I forgot that I made these highlighted.

188
00:18:49,220 --> 00:18:50,260
Okay, so don't.

189
00:18:50,260 --> 00:18:52,480
Okay, so really don't be a jerk.

190
00:18:52,480 --> 00:18:57,860
The person on the other side can just decide to slow the process.

191
00:18:57,860 --> 00:18:59,260
Like there's really no punishment.

192
00:18:59,260 --> 00:19:04,840
So if you've been a total asshole to them from the get go, they can just slow roll it.

193
00:19:05,300 --> 00:19:07,620
And that's not going to be helpful to you.

194
00:19:07,800 --> 00:19:14,500
At the same time, though, don't back down just because you've been denied doesn't mean that you can't appeal.

195
00:19:14,500 --> 00:19:26,960
So this kind of another kind of like subroutine in this process is that when you ask a question and you get rejected, that doesn't necessarily need to be all she wrote.

196
00:19:27,500 --> 00:19:28,860
You can do appeals.

197
00:19:28,860 --> 00:19:37,380
So if you get a rejection, you can say, you know, I don't know that you did a thorough enough search of your records.

198
00:19:37,380 --> 00:19:39,700
I'm pretty sure the FBI might have files on this.

199
00:19:39,700 --> 00:19:47,740
So I would like to appeal this this finding and and then that goes on to another authority to kind of like double check the work.

200
00:19:48,280 --> 00:19:57,160
More often than not, they will just do what they call an affirmed on appeal, which means that they'll just say, nope, we got it right the first time, even if they didn't.

201
00:19:57,340 --> 00:20:04,880
And so then it's it's kind of game over at that point, unless you get a lawyer and then you can take them to court to fight them.

202
00:20:04,880 --> 00:20:13,620
That's like a whole other ball of wax, though, that's not really primed for this specific beginner's tutorial on FOIA.

203
00:20:14,120 --> 00:20:16,360
Don't ask for sources and methods.

204
00:20:16,420 --> 00:20:26,940
So if you go to CIA or FBI or NSA and you say like, give me all the documentation you have on like all the exploits you have.

205
00:20:26,940 --> 00:20:31,900
They're not going to they're not going to just give up the goods because you asked them nicely.

206
00:20:32,000 --> 00:20:35,200
They would classify that as sources and methods.

207
00:20:35,200 --> 00:20:45,760
So that information is highly, highly protected because it provides the information that provides the government with a future pathway to to procure new information.

208
00:20:46,040 --> 00:20:56,880
So yeah, so don't like don't ask CIA about their purchasing programs or like specific things that they do to handle assets or anything like that.

209
00:20:56,940 --> 00:20:58,280
They're not going to talk about it.

210
00:20:58,280 --> 00:20:59,460
Don't waste your time.

211
00:20:59,460 --> 00:21:00,580
Don't waste their time.

212
00:21:00,580 --> 00:21:04,840
Like you're just going to aggravate them and you'll be aggravated as well.

213
00:21:06,680 --> 00:21:08,860
Don't ask about living US persons.

214
00:21:08,860 --> 00:21:10,700
This is kind of a general rule.

215
00:21:10,920 --> 00:21:12,840
Again, just kind of a waste of time.

216
00:21:12,840 --> 00:21:16,700
There's, there's not going to be and most people don't really have there.

217
00:21:16,700 --> 00:21:20,640
I think there's this notion that people just have like government files all over the place.

218
00:21:20,640 --> 00:21:22,580
Probably not.

219
00:21:22,900 --> 00:21:33,900
So, so don't count on like doing a FOIA request for your neighbor and expecting to get this like big file of information back that you can use against them in your next disagreement.

220
00:21:33,900 --> 00:21:37,220
It just doesn't, it just doesn't work like that.

221
00:21:37,780 --> 00:21:41,660
You can, though, do a FOIA request on yourself.

222
00:21:41,920 --> 00:21:46,000
So that is another kind of like loophole to the whole US persons exemption.

223
00:21:46,000 --> 00:21:55,820
So if you wanted to do a freedom, freedom of information as a tongue twister, if you wanted to do a FOIA request on yourself, you can do this.

224
00:21:55,960 --> 00:21:58,760
All you have to do is submit a privacy waiver.

225
00:21:59,020 --> 00:22:10,120
So what that does is it's, it's basically a form that you fill out and you send into the agency and you say, like, I'm, I'm forfeiting my, my right to privacy on this basis.

226
00:22:10,120 --> 00:22:14,980
What they do is they'll send you the information that's pertinent to that request.

227
00:22:15,160 --> 00:22:24,320
So if you are, if you've had run-ins with the FBI in the past, or if they've interviewed you or something and you want to get that information later on, totally do it.

228
00:22:24,320 --> 00:22:27,280
They're not going to make it public and put it on a website or something.

229
00:22:27,280 --> 00:22:34,740
I would, I would suggest not doing it through a site like MuckRock because MuckRock will just publish it if you want it to remain private.

230
00:22:36,140 --> 00:22:46,140
But if you do it through, directly through the FBI's online portal, if you put the request in that way, then they'll just send the information directly to you and not make it public in any other way.

231
00:22:46,320 --> 00:22:50,900
So definitely encourage you to do this if, if you have interest in your own information.

232
00:22:53,160 --> 00:22:54,640
Okay, exemptions.

233
00:22:54,640 --> 00:23:00,980
So like I said before, just because you ask the government for something does not necessarily mean that they're going to just give it to you.

234
00:23:00,980 --> 00:23:08,500
And ways that they will deny giving you information that you ask for is through, they'll usually do this with exemptions.

235
00:23:08,500 --> 00:23:16,680
So you tend to see exemptions more when it comes to specific national security organizations.

236
00:23:17,380 --> 00:23:24,000
So some of the common ones that we see all the time are B-1, and I'm just kind of paraphrasing what this means.

237
00:23:24,000 --> 00:23:29,660
If you see a B-1, this may come in the form of a redaction or just a full out, like, we're not going to give you anything.

238
00:23:31,260 --> 00:23:33,520
Usually it will come attached to a document.

239
00:23:33,520 --> 00:23:39,300
So when you see, when you get a document back, there will be like a big blurb that will just be, it'll have a big white box over it.

240
00:23:39,340 --> 00:23:43,760
And then they'll have the exemption listed in the, in the margin.

241
00:23:43,760 --> 00:23:47,600
So B-1, yeah, it's really, really classified.

242
00:23:47,600 --> 00:23:50,140
It's, it's National Security Act stuff.

243
00:23:50,140 --> 00:23:52,140
So like, no, no, we're not kidding.

244
00:23:52,140 --> 00:23:52,860
It really is.

245
00:23:52,860 --> 00:23:55,460
This is actually really, actually classified.

246
00:23:56,100 --> 00:23:58,560
So they'll exempt it for that reason.

247
00:23:58,640 --> 00:24:01,800
B-3, this is CIA's NOPE rule.

248
00:24:02,120 --> 00:24:07,120
It's specific, it's, it's protected by a very specific statute in law.

249
00:24:07,360 --> 00:24:14,620
I can't think of any examples of this right off the top of my head, but this is something that's generally used by, by CIA.

250
00:24:15,540 --> 00:24:19,460
B-4 is a, is a one that protects trade secrets.

251
00:24:19,520 --> 00:24:25,080
So you'll see this oftentimes in the form of like a propent proprietary information.

252
00:24:25,300 --> 00:24:30,880
That kind of stuff is, is really just to, there to, to protect intellectual property.

253
00:24:31,380 --> 00:24:36,400
B-5, B-5 is one that I really, really hate.

254
00:24:36,400 --> 00:24:42,000
B-5, when I see a B-5, what it says to me is like, fuck you in particular.

255
00:24:42,260 --> 00:24:47,180
What we call it in the, in the FOIA community is the withhold it because you want to exemption.

256
00:24:48,120 --> 00:24:52,680
There's, there's not really, this is kind of a catch all that, that agencies will use.

257
00:24:52,680 --> 00:24:57,500
I've even gotten B-5s from like the Department of Education.

258
00:24:57,500 --> 00:25:00,300
So it's not because the information is classified.

259
00:25:00,300 --> 00:25:02,860
They've just decided not to share it with you.

260
00:25:04,100 --> 00:25:07,760
These ones, I think, though, you, you have much more luck fighting in court.

261
00:25:07,760 --> 00:25:14,860
If you got something that's completely B-5ed out, you can, you can hire a lawyer if you want to and see the information.

262
00:25:15,700 --> 00:25:23,820
They really do need to, agencies, in my opinion, should be providing you with a better exemption than just, we're just, don't feel like sharing it with you.

263
00:25:23,820 --> 00:25:25,520
So, you know, shoo.

264
00:25:26,780 --> 00:25:37,000
It does also protect interagency and intra-agency memos, though, which like still, it doesn't, to me, it doesn't matter whether it's being shared between two agencies or not.

265
00:25:37,000 --> 00:25:39,080
Like if it's releasable, it's releasable.

266
00:25:39,760 --> 00:25:42,880
B-6 is one that protects personal information.

267
00:25:42,920 --> 00:25:54,200
So let's say that you, you've requested information about a very old CIA operation, for instance, and you get a bunch of B-6 back in the, in the responsive documentation.

268
00:25:54,200 --> 00:26:03,640
It could be that you're getting like, like CIA cables back and inside the cables may have some specific personal information there that relates to people who may still be alive.

269
00:26:04,320 --> 00:26:07,280
So if you see B-6, just don't, don't be shocked.

270
00:26:07,640 --> 00:26:10,280
And then B-7 is just the law enforcement exemption.

271
00:26:10,280 --> 00:26:12,760
It kind of protects local law enforcement.

272
00:26:12,960 --> 00:26:17,100
There are some others that you may see in particular for, for CIA.

273
00:26:17,100 --> 00:26:28,160
They use X-series exemptions, which is, it just goes into very specific detail, which is actually, the fact that they're withholding it is, is, is what it is.

274
00:26:28,160 --> 00:26:34,080
But the fact that they give you very specific, specific exemptions that are specific to CIA is actually kind of helpful.

275
00:26:34,080 --> 00:26:44,160
So you might get an X-series exemption for like a human source and they'll, they'll give you one that separates a human source out from like a technical source, etc, etc.

276
00:26:44,160 --> 00:26:49,140
So very, very helpful when you go to, to actually look at the documentation.

277
00:26:49,600 --> 00:26:53,540
Okay, so now, now we get to the really fun part, which is my, my war stories.

278
00:26:53,880 --> 00:26:57,880
So here's one that people have really taken interest in.

279
00:26:57,880 --> 00:27:03,200
I put a FOIA request in for Snoop Dogg to the Secret Service.

280
00:27:03,500 --> 00:27:12,000
This is Snoop, this is a snippet from Snoop Dogg's Secret Service dossier is kind of a, to put it in generic terms.

281
00:27:12,380 --> 00:27:15,040
So very specific information in here.

282
00:27:15,280 --> 00:27:21,020
What we can gather just from looking at this is kind of the reason for why Secret Service took interest in the first place.

283
00:27:21,620 --> 00:27:23,700
So there was a music video.

284
00:27:23,700 --> 00:27:29,340
I, this is actually why I did the FOIA because I knew that, that Snoop Dogg had made a video where he was pointing a gun at the president.

285
00:27:29,340 --> 00:27:33,160
And this, of course, gets like, this gets bootlickers dander up.

286
00:27:33,160 --> 00:27:36,040
So they really hate this when you threaten the president.

287
00:27:36,740 --> 00:27:42,520
So they, they, you know, pull together an entire, an entire file on Snoop Dogg.

288
00:27:42,520 --> 00:27:46,480
And it's just, it's just, it's, you'll see what I mean.

289
00:27:46,980 --> 00:27:56,380
So, so here we can see some very specific information about about Calvin Broadus, his real name.

290
00:27:57,100 --> 00:27:59,840
There's, there's some B6 information in here.

291
00:27:59,840 --> 00:28:03,740
So that's kind of what you're seeing in the, in the, with these exemptions here.

292
00:28:04,140 --> 00:28:08,140
Email address being exempted.

293
00:28:08,140 --> 00:28:14,120
The person who received it, the report number oddly is exempted under B6.

294
00:28:14,120 --> 00:28:16,820
I'm not really exactly sure why, but these are, these are names.

295
00:28:16,820 --> 00:28:18,520
These are specific email addresses.

296
00:28:18,840 --> 00:28:20,940
This is kind of another weird one down here.

297
00:28:20,940 --> 00:28:28,440
This is kind of an odd B6, but here are all of Snoop Dogg's his, his like aliases.

298
00:28:29,300 --> 00:28:38,320
Notably, they didn't include Snoop Lion because nobody really wants to remember Snoop Lion, but unless it's redacted under B6.

299
00:28:39,040 --> 00:28:46,200
So, so, so this is, this is kind of a good place to get an idea of why you would get a B6 in the first place.

300
00:28:48,300 --> 00:28:53,580
And, and so also recently I got some information back on DEF CON in particular.

301
00:28:53,980 --> 00:28:59,280
So if you, if you do a request for something like DEF CON, you're going to get a lot of information back.

302
00:28:59,280 --> 00:29:04,340
And this is kind of what the top of one of the documents might look like in a header from FBI.

303
00:29:04,840 --> 00:29:15,040
So like routine precedence, it'll give you a date, which is very helpful in terms of kind of grouping what information you got when and maybe how to categorize it.

304
00:29:15,040 --> 00:29:20,000
So when you come back to do research later, you can like put it in different folders and all of that.

305
00:29:20,580 --> 00:29:23,060
They will also do B6 redactions.

306
00:29:23,060 --> 00:29:24,880
So you're seeing that happen here.

307
00:29:24,880 --> 00:29:37,520
These are, these are specific FBI agent names and different handler, information custodians, information handlers, and then you'll have something that will kind of give you a general idea of what you're looking at.

308
00:29:38,080 --> 00:29:40,540
The title of this one was computer crimes.

309
00:29:40,540 --> 00:29:41,320
I'm not sure.

310
00:29:41,320 --> 00:29:44,080
It looks like it went to the Los Angeles field office.

311
00:29:45,600 --> 00:29:47,380
And there's, there's two in here.

312
00:29:47,380 --> 00:29:49,420
So to Miami and Los Angeles.

313
00:29:51,260 --> 00:29:55,820
And I think this is, I think this is Washington Metropolitan field office, I think.

314
00:29:56,040 --> 00:29:58,740
So that's going to be the Washington FBI field office.

315
00:29:59,680 --> 00:30:04,480
And then a couple just specific things that are kind of fun from this one that I got was here.

316
00:30:04,480 --> 00:30:12,600
Here's what the FBI wrote for their release of BackOrifice in 2000, which happened at DEF CON.

317
00:30:14,600 --> 00:30:19,980
So this one came out at the, at the 2000 instance of DEF CON.

318
00:30:19,980 --> 00:30:25,340
And what we see here is just kind of the way that FBI was characterizing the release of this tool.

319
00:30:25,340 --> 00:30:36,360
So a previous instance of BackOrifice had been released and FBI had kind of looked into it, but I don't, I don't know that FBI really knew what to do with the information that it was out there.

320
00:30:36,440 --> 00:30:46,620
But definitely when BackOrifice 2000 came out, it was like, okay, now we have to be serious about this because we can't, we can't just, we can't just act like we don't know anything about this one.

321
00:30:46,620 --> 00:30:48,960
So they actually did start looking into it.

322
00:30:48,960 --> 00:31:00,580
And there are also files floating around out there about the Cult of the Dead Cow anyway, so there's a ton of stuff the FBI had already compiled on CDC prior to, even prior to this.

323
00:31:01,480 --> 00:31:07,100
And then this is kind of an interesting one that came out about DEF CON in 2010.

324
00:31:07,700 --> 00:31:16,880
So they, the FBI opened an entire program called Slam & Jam, and this is an investigation into a stolen laptop that came from General Dynamics.

325
00:31:16,880 --> 00:31:23,400
Really crappy name, but it kind of gives you a rundown of some of the information that they collected and where.

326
00:31:23,700 --> 00:31:27,700
Another kind of note here about this one is the header here, secret.

327
00:31:27,700 --> 00:31:29,400
That's a previous classification.

328
00:31:29,400 --> 00:31:35,920
They exit out like this when it becomes declassified, so it's not still secret, just in case someone had a question about that.

329
00:31:37,280 --> 00:31:47,680
So they do, FBI is very, very good about classify, about classifying information or like formatting it in a way that's very easy to read.

330
00:31:47,700 --> 00:31:52,240
Not every agency is good about this, but FBI is very good about it in particular.

331
00:31:52,240 --> 00:32:01,220
So Slam & Jam, and here's, here's like an excerpt that came from this, this investigation.

332
00:32:02,540 --> 00:32:09,860
They, the FBI specifically talked to DEF CON security to try and get some information about who might have stolen this machine.

333
00:32:10,980 --> 00:32:21,320
One of the, my favorite part is this, this one here about the DEF CON employees Googling the computer model and discovered it was a ruggedized laptop and that it may be GPS tracked.

334
00:32:21,320 --> 00:32:36,860
And then this was kind of like my favorite part of my favorite part, which was the DEF CON organizers at the time said that a drunk DEF CON employee tested the ruggedness of the computer by repeatedly dropping on the ground.

335
00:32:36,860 --> 00:32:44,320
So being very, very careful with, with, with computers with potential government information on them.

336
00:32:46,080 --> 00:32:50,360
So just a lot of really interesting stuff that you can get out of this process.

337
00:32:50,360 --> 00:32:57,420
I really do encourage everyone who has interest to, to, to participate in this.

338
00:32:57,420 --> 00:33:01,320
It's, it's a, it's something that we are really lucky to have in the United States.

339
00:33:01,320 --> 00:33:04,520
And it's, it's, my opinion is very underutilized.

340
00:33:05,220 --> 00:33:12,700
FOIA is, is probably better in the United States than it is in almost any other Western country, UK included.

341
00:33:12,700 --> 00:33:19,220
I even know people who do FOIA work in the UK and they get exemptions like way more than we get exemptions.

342
00:33:19,220 --> 00:33:25,360
So we have this tool, use it, advocate for it to be stronger.

343
00:33:25,720 --> 00:33:30,580
Here's a little bit of background on the project, the Hacking History Project, in case you're interested.

344
00:33:30,980 --> 00:33:39,640
So it's just at mockrock.com, which is a 501c3, it's a nonprofit organization that kind of helps with government transparency.

345
00:33:40,380 --> 00:33:43,140
So you can, you can jot that down real quick.

346
00:33:43,160 --> 00:33:48,100
I don't know if we can, we can probably drop it in the chat at some point, if there's chat available.

347
00:33:48,520 --> 00:33:49,720
And that's all I have.

348
00:33:49,720 --> 00:33:52,400
So if there are any questions, I'm happy to take questions.

349
00:33:52,400 --> 00:33:58,120
But here's my information in case you're interested and want to see stuff in the future or if you want to engage later on.

350
00:33:59,100 --> 00:34:00,920
So that's, that's all I got.

351
00:34:02,000 --> 00:34:03,280
Awesome.

352
00:34:03,280 --> 00:34:05,680
Thank you so much, Emily.

353
00:34:06,340 --> 00:34:08,820
So let me double check the Discord.

354
00:34:08,820 --> 00:34:13,740
We didn't have any questions come in via Discord, but I had a question for you.

355
00:34:14,620 --> 00:34:21,600
I'm embarrassed to admit this, but I have never actually submitted a FOIA request before.

356
00:34:21,600 --> 00:34:28,740
Are there any things that like you gave a lot of really great tips and tricks for your first time?

357
00:34:29,040 --> 00:34:35,320
What's like the number one big error that someone makes when they make their first FOIA request?

358
00:34:35,820 --> 00:34:39,740
So , so I know that a lot of the ones that I did early on were just way too broad.

359
00:34:39,740 --> 00:34:45,620
And it becomes kind of like, I don't want to, I don't want to use, make it mundane and say like, it's an art to do FOIA.

360
00:34:45,620 --> 00:34:46,480
It's not really an art.

361
00:34:46,480 --> 00:34:48,580
It's just something that you get used to over time.

362
00:34:48,580 --> 00:34:54,340
So when you, when you do a request, try to make it as easy to understand for the person who's reading it.

363
00:34:54,340 --> 00:35:04,480
Like if you can't understand, if you were to like take your, your brain out of your head, so to speak, and imagine what it would read like if you weren't writing it yourself.

364
00:35:05,000 --> 00:35:09,260
So I used to get them back all the time for just lack of clarity.

365
00:35:09,800 --> 00:35:18,360
So if you, if you want to get responsive documentation, try and make it readable and, and perfectly understandable.

366
00:35:18,360 --> 00:35:22,600
So it doesn't matter like how dummy the person is reading it.

367
00:35:22,600 --> 00:35:26,060
If they can understand it, then they will try and help you.

368
00:35:26,880 --> 00:35:32,420
Another kind of tip that I didn't bring up is that there's this, there's this thing I call the sweet spot.

369
00:35:32,420 --> 00:35:38,900
So there's a sweet spot in classification that's like 30 years back.

370
00:35:38,960 --> 00:35:49,340
So knowing when, when information stops being classified or when it needs to be re-evaluated for classification re-up is really helpful to FOIA investigators.

371
00:35:49,340 --> 00:35:57,620
So if you're asking about something that happened in like the 80s or the 90s, now is actually the perfect time to be asking government agencies about that.

372
00:35:57,620 --> 00:36:03,100
Because it's probably if, especially if it's been classified as top secret, they're going to have to re-justify that.

373
00:36:03,100 --> 00:36:07,040
And they're, they're not often going to like jump at the opportunity to do that.

374
00:36:07,040 --> 00:36:14,140
So information that hasn't maybe been made public before is kind of up for grabs in that 30 year span of time.

375
00:36:14,220 --> 00:36:24,840
So definitely if there's something that you know of that happened in the 90s or something that you want to investigate in that timeframe, do it, do it now so that you can, you can get your request in and maybe get something back.

376
00:36:24,840 --> 00:36:25,900
That's awesome.

377
00:36:25,900 --> 00:36:32,320
That's actually a really interesting tip because I'm sure the 90s were really, really interesting, especially for hacking.

378
00:36:32,320 --> 00:36:39,340
And so I think maybe the greatest thing to come out of the 2020s will be more information about what was going on in the 90s.

379
00:36:39,340 --> 00:36:40,100
Right.

380
00:36:40,100 --> 00:36:47,620
Emily, thank you so very much for your time and jumping on for a last minute presentation.

381
00:36:47,620 --> 00:36:51,900
It's just an absolute pleasure to have you on our brand new stream.

382
00:36:52,080 --> 00:36:59,960
I look forward to hopefully seeing you in person at DEF CON next year, or at some other event, but thank you so much for your time.