WEBVTT 00:00.680 --> 00:01.480 Thanks. 00:01.660 --> 00:02.620 Thanks, Whitney. 00:02.960 --> 00:05.880 Thanks to the Crypto Village for fitting me on on the last minute here. 00:05.880 --> 00:09.220 I know this is pulled together rapidly. 00:09.220 --> 00:14.300 So today I'm going to talk to you about the FOIA process. 00:15.200 --> 00:19.780 I call this talk Fun with FOIA, just hitting up the government for sweet, sweet secrets. 00:20.680 --> 00:27.380 So what I intend to do here is to give an overview of the FOIA process and how you can make it work for you. 00:28.300 --> 00:29.680 So what's FOIA? 00:29.680 --> 00:38.380 So a lot of people don't necessarily know that the government does have a pathway for giving you documents that belong to all of us. 00:38.400 --> 00:41.540 So FOIA stands for the Freedom of Information Act. 00:42.040 --> 00:51.020 And so what this is designed to do is to disperse documents that are sourced from the government. 00:51.840 --> 00:53.820 It's true information. 00:53.820 --> 00:56.860 It's usually, in some cases, it's raw information. 00:56.860 --> 00:58.600 In other cases, it's processed information. 00:58.600 --> 01:00.360 It all depends on what you're asking for. 01:00.360 --> 01:11.280 But the beauty of the Freedom of Information Act is that it allows common people to make these requests, you know, at will for almost any topic that you're interested in. 01:12.360 --> 01:14.320 It's a very powerful process. 01:14.320 --> 01:16.480 It doesn't have to cost you any money. 01:16.480 --> 01:23.480 In some cases, it will cost money, but we'll get into the nuance of all of this as we go along. 01:25.440 --> 01:30.480 So, okay, so why would you want to interact with the government in the first place? 01:30.480 --> 01:43.720 I don't know why you'd want to interact with the government on any other basis, but the Freedom of Information Act is something that we should all be involved in because it boosts transparency in a way that not very many other governmental processes allow for. 01:43.720 --> 01:52.820 So if you're interested in a topic and you want to know more, you think maybe the government might have some information, FOIA is going to be your way to get that. 01:53.020 --> 01:56.480 So maybe you're doing research on a topic. 01:57.300 --> 02:00.240 You've got an area of interest and you want to know more about it. 02:00.240 --> 02:02.220 FOIA may be the way that you can do that. 02:02.300 --> 02:10.720 There are a lot of different complications that make FOIA challenging in some ways and liberating in others. 02:10.720 --> 02:19.180 Again, something we'll get into in a little while, but with this process, you want to have a topic in mind when you get started. 02:19.260 --> 02:24.380 So let's just jump right into how we would do this. 02:24.820 --> 02:34.480 So I'm going to kind of try and keep the context of everything I say around a topic that's of interest to me and probably a lot of people who are on the stream. 02:35.420 --> 02:55.840 Working with a colleague of mine, Emma Best, we put together a project to look through government documents that involve the history of hackers and events that have happened to the government or may have been investigated by the government around information security. 02:55.840 --> 02:57.920 We call this hacking history. 02:58.100 --> 03:09.280 And on muckrock.com, which is a site that you can use to submit Freedom of Information Act requests, we are over 1% of the requests on the site now. 03:09.280 --> 03:13.220 By far, we're the largest by requests. 03:13.220 --> 03:16.940 We're the largest program project on muckrock. 03:16.940 --> 03:24.160 So we've put in, I think I got an update today that we have over 850 requests in, which is quite a bit. 03:24.160 --> 03:27.420 Enough of my bragging. 03:27.700 --> 03:35.020 So with hacking history, it's a large umbrella topic that you can ask all kinds of different questions about. 03:35.020 --> 03:47.220 So this can range from anywhere from malicious code that the government may have to specific events the government may have been investigating or even involved in directly. 03:47.220 --> 03:48.940 It could involve people. 03:49.560 --> 03:55.320 So there are a lot of subtopics that fit into this topic that you can ask the government about. 03:56.320 --> 04:02.040 So to get started, we can think of something that we want to ask a question about. 04:02.040 --> 04:11.620 So because we're talking at DEF CON, because we're having a DEF CON weekend here, and I've got some information back, which I'll share at the end of the slideshow. 04:11.760 --> 04:13.640 Let's take DEF CON, for instance. 04:13.640 --> 04:15.920 So let's say that you want to know more about DEF CON. 04:15.920 --> 04:22.060 The process here is to try and target something that you think that the government may have specific information on. 04:22.060 --> 04:31.540 So an event like DEF CON, you would want to start by asking questions that pertain to that specific event that happens yearly. 04:31.540 --> 04:46.780 In a way, this is kind of like... it's a little like social engineering, but not in the more technical way that the actual good social engineers, not like myself, can do this. 04:46.880 --> 04:54.220 So you want to think of questions that will get the best response for the questions that you're asking. 04:54.220 --> 05:01.200 So when you think of a topic, try and make it something specific, but you don't necessarily have to make it super, super specific when you just get started. 05:01.200 --> 05:09.700 You can start with something that's very broad in nature and try and target documents that you think maybe may comport with a broader sense. 05:09.700 --> 05:16.560 So like, if you're starting broad, start with something like indexes. 05:16.560 --> 05:29.260 So asking for indexes of things is a really good place to start if you're not really quite sure what you want to ask about, or whether you're not quite sure if there may be documents that exist on the topic in the first place. 05:29.260 --> 05:37.480 So you can ask a government, for instance, for indexes of programs that pertain to a specific topic. 05:37.600 --> 05:50.220 So you may be able to ask the Federal Bureau of Investigation about... for an index of maybe hacker conferences that they've been tracking for the last, you know, 10 or 15 years. 05:50.500 --> 05:53.720 Which brings me to another kind of sub-genre here. 05:53.720 --> 05:57.520 So you want to kind of think of... make sure that you time-bound everything. 05:58.180 --> 06:04.560 So don't just ask for like everything the government has on X if it's a really big topic. 06:04.560 --> 06:08.440 Try and keep it something very specific in time. 06:09.720 --> 06:11.260 Oh, let me go back one. 06:11.260 --> 06:15.920 So when you're asking these questions, yeah, time-bound it. 06:15.920 --> 06:19.980 Keep it between a certain time frame. 06:19.980 --> 06:23.940 I usually start with January 1 of a specific year. 06:23.940 --> 06:30.460 And then if I want to go for five years, I might go January 1 of like 1990 to 1995 or something like that. 06:30.580 --> 06:36.880 I like to be specific about the exact day that I wanted to start and end. 06:36.880 --> 06:38.540 I just think that makes it easier. 06:38.540 --> 06:48.180 Because really, you have to remember that on the other end of this process is another human and the other human may have different quirks about how they would provide information to you. 06:48.180 --> 06:54.300 So time-bounding helps with larger topics to kind of chunk it down. 06:54.580 --> 07:00.560 It saves a lot of time on the other side of the search. 07:00.560 --> 07:08.900 So when the FOIA officer gets the request, they'll be able to take that information and do a search against it. 07:08.900 --> 07:13.860 But there are requirements that the government tries to stay under. 07:13.860 --> 07:25.230 So what I mean by that is the government is not obligated to provide you everything that they have and just work on it indefinitely. 07:25.730 --> 07:36.430 It has to not cause... I think with the wording they use is reasonable distress. 07:37.010 --> 07:39.410 It's got to be a reasonable request. 07:39.410 --> 07:43.230 You can't ask for an entire database of something and expect that you're going to get it back. 07:43.450 --> 07:52.530 So try to, especially if it's a larger topic, kind of try and keep it in a self-isolated kind of like chunk of information that you expect to get back. 07:52.530 --> 07:57.190 This can also be helpful if you're not sure what you're going to get back in the first place. 07:57.650 --> 08:03.830 So if you think that there may be a lot of information there, the time-bounding really helps with that. 08:04.230 --> 08:14.390 So when I did my request for DEF CON, for instance, I chunked it down to like the beginning of DEF CON, which is like 9293 timeframe to 1997. 08:15.170 --> 08:21.850 What I ended up getting was like wildly... it was way up into the 2000s that I got some information. 08:22.350 --> 08:27.030 And that's just kind of one of the fun things about the FOIA process is that you never really know what you're going to get back. 08:27.030 --> 08:28.510 So it's kind of like a treasure hunt. 08:29.730 --> 08:32.690 Okay, so who can you ask questions to? 08:33.190 --> 08:35.990 You can ask questions to any government agency. 08:35.990 --> 08:40.910 Every federal government agency is required to be responsive to FOIA. 08:41.690 --> 08:46.890 How they are responsive to your requests is part of the nuance. 08:46.890 --> 08:50.410 So a lot of my requests, for instance, go to FBI. 08:50.410 --> 09:08.850 If you wanted to ask something about special forces, so about a specific special forces organization, you might want to send a Freedom of Information Act to the Special Operations Command, which is just a sub-genre of the Department of Defense. 09:09.050 --> 09:15.850 You can also duplicate that request and send it to the Department of Defense to see if they may have anything kind of broader. 09:15.850 --> 09:18.650 You can ask the Central Intelligence Agency. 09:18.650 --> 09:24.350 You can ask the Department of Housing and Urban Development. 09:24.350 --> 09:33.550 Any government agency that takes public funding, which is all of them, has to be responsive to FOIA in some form or fashion. 09:33.550 --> 09:36.350 Some of them are better than others. 09:37.810 --> 09:40.970 Famously, the NSA is not good with FOIA. 09:40.970 --> 09:45.190 They take forever to acknowledge your FOIAs. 09:45.230 --> 09:50.670 When they do finally acknowledge them, the searching takes a lot longer than really it should. 09:50.670 --> 10:03.510 I think by law, they're bound to provide full service to all requests within 10 days, but it almost never goes down that way. 10:03.510 --> 10:08.350 So be prepared for disappointment and long timelines, especially depending on who you ask. 10:09.950 --> 10:16.370 But your FOIA requests are not just limited to federal agencies and federal entities. 10:16.370 --> 10:20.650 You can also, in a lot of cases, you can ask your local entities the same questions. 10:21.750 --> 10:23.470 Especially if they're of local interest. 10:23.470 --> 10:30.430 So if you wanted to ask your local police department questions, you're almost assured to be able to do that. 10:30.430 --> 10:38.870 So it's not quite the same as the federal mandate, but local jurisdictions also, municipalities have to follow. 10:38.870 --> 10:46.050 They usually have their own form of the Freedom of Information Act that mirrors what the feds use. 10:46.330 --> 10:52.870 So any question that you might ask to the police or to the FBI, you can probably ask your local folks as well. 10:53.630 --> 10:56.630 Okay, so here's the fun part, the ask. 10:56.630 --> 11:01.210 So when you go to do your asking, we already touched on a little bit of this. 11:02.450 --> 11:09.750 Have a topic in mind, that's one big thing, but also have specific questions that you want to ask in mind. 11:09.830 --> 11:21.870 So if you're unclear when you put your request in, again, remember there's a human on the other end of this process, and there's a good chance that they're not going to know what you're asking for if you're not super clear about it. 11:21.870 --> 11:39.690 So if you tell them that you want something that's very vague and up for interpretation, or it's muddy and difficult to divine what it is that you're asking for exactly, the FOIA officer is bound to just kick it back to you and say, like, I don't know what you're talking about. 11:39.790 --> 11:41.310 Be more specific. 11:41.770 --> 11:46.790 So don't give up if you get a rejection when you send in your first few. 11:47.050 --> 11:51.330 Just try to hone in on exactly what it is that you want to know about. 11:51.870 --> 12:11.130 I know I had a ton of rejections when I first started asking before I started to figure out, like, oh, I guess you can't, you know, you can't just ask CIA about aliens because they've been asked this question probably a million times, and they probably don't really have anything good in the first place. 12:11.310 --> 12:16.830 So, or something that's releasable, which is another thing that we'll get into shortly. 12:17.390 --> 12:21.010 So when you do this asking, try to be as specific as possible. 12:22.350 --> 12:26.850 Even when you're not quite sure what to expect back. 12:26.850 --> 12:32.230 So when you start a research project, you may start with fewer details. 12:32.230 --> 12:38.470 So let's say that you put in a request for an index because you have nothing on the topic that you're interested in. 12:38.530 --> 12:42.890 And the index is going to come back and it's going to have some information that will kind of give you threads to pull. 12:42.890 --> 12:52.010 And so when you start to pull those threads, you'll be able to figure out what kinds of questions to ask next that will be more specific to your area of interest. 12:53.470 --> 12:57.430 So when you format your question, again, make sure it's time bound. 12:57.510 --> 13:03.170 Even if you're asking for something that you know that the government has for a specific time frame. 13:03.170 --> 13:05.930 I like to put like buffer space on either side. 13:05.930 --> 13:11.290 So give it maybe a year before and after the event, if you're asking about an event. 13:11.330 --> 13:17.370 And just see if they've been collecting information prior to or after the event was supposed to have taken place. 13:18.330 --> 13:25.810 Good things to ask about events, programs, individual specific, all of those things are great places to start. 13:25.810 --> 13:32.190 So if you have like a specific hacking event, for instance, that you want to ask about. 13:32.510 --> 13:38.010 Let's just say like there's a Citibank hack from 1995. 13:39.150 --> 13:43.390 If you know exactly when that happened, time bound it for that year. 13:43.450 --> 13:47.750 Maybe give yourself some six months on either side. 13:48.930 --> 13:57.290 If you know that there's a specific individual you want to ask about, there are a few more things that you have to keep in mind when you actually go to do the question asking. 13:58.550 --> 14:01.450 And those are more that we'll get into in just a second. 14:02.450 --> 14:09.150 But make sure that you just like if you want to know about let's say you want to know something about Kevin Mitnick. 14:09.150 --> 14:10.670 There's a lot more here. 14:10.670 --> 14:20.550 But if you want to know something about Kevin Mitnick, you ask the FBI, you know, give me all the information that you have, any documentation related to Kevin Mitnick between the years of X and X. 14:21.850 --> 14:28.010 And make sure that you include things like audio visual, handwritten notes. 14:28.010 --> 14:32.650 It also really helps to get familiar with very specific government documentation. 14:32.650 --> 14:42.710 One of my favorites to ask for is FBI FD 302 documents because 302s are what the FBI uses to take handwritten notes. 14:42.770 --> 14:46.690 So FBI agents are not required. 14:46.690 --> 14:57.730 They're actually, I don't know if they're disqualified by mandate to not be able to actually record conversations that they have with as interviews with people. 14:57.730 --> 15:00.430 So with sources and just like bystanders. 15:00.570 --> 15:03.490 So the way that they do this is they take handwritten notes. 15:03.490 --> 15:09.650 So all those handwritten notes go into the FBI database and you can ask for those those handwritten notes. 15:09.990 --> 15:12.730 So asking for FD 302 is always great. 15:12.730 --> 15:17.030 There's always all kinds of like funny extemporaneous information in there. 15:18.010 --> 15:19.410 Keywords are great. 15:19.410 --> 15:25.150 Specific records like an FD 302, even if you don't know they exist, ask for them anyway. 15:25.710 --> 15:27.290 Indexes we already covered. 15:28.190 --> 15:32.890 Basically, you can ask for anything that qualifies as a public document. 15:32.890 --> 15:38.230 So anything that's recorded by the government technically becomes a public document. 15:38.250 --> 15:41.430 But just because you ask for them doesn't mean that they have to give them to you. 15:41.430 --> 15:44.950 So there will be some exemptions that we'll have to deal with in this process. 15:44.950 --> 15:49.990 So when you get responses, this is going to take some time. 15:49.990 --> 15:54.270 So give yourself plenty of... make sure that you're very patient with this process. 15:54.270 --> 16:02.190 I've still got FOIAs waiting for responsive documents that I've been waiting for for the last couple years. 16:02.350 --> 16:09.690 I put one in for a well known hacker that probably people on the stream know of named Trick. 16:09.690 --> 16:18.630 I've got one into the Defense Intelligence Agency for Trick and I am not expecting that one to be done until December of 2021. 16:18.750 --> 16:26.710 So be patient, especially if you're asking for something that's been classified or is currently classified. 16:27.030 --> 16:29.030 Just have patience with the process. 16:29.030 --> 16:33.210 A lot of times they'll declassify it if it's relevant and it's older. 16:33.970 --> 16:36.590 But that's kind of just the luck of the draw. 16:37.730 --> 16:39.370 So do's and don'ts. 16:39.370 --> 16:41.490 Okay, so things that you should do. 16:41.490 --> 16:44.170 Ask specific questions. 16:44.170 --> 16:45.610 Time bound your requests. 16:45.730 --> 16:46.530 FOIA for the dead. 16:46.530 --> 16:49.450 So here's an interesting thing about people. 16:50.010 --> 17:04.610 So when I just gave that example about doing a Freedom of Information Act request on Kevin Mitnick, you wouldn't get anything back in all likelihood because he's still a US person and he's still alive. 17:04.610 --> 17:13.950 So when you do a request like this, you have to make sure that you are following their rules for asking for information. 17:14.150 --> 17:19.590 If the person is dead, you can ask these questions and just provide an obituary. 17:19.590 --> 17:21.750 In most cases, that will be enough. 17:22.290 --> 17:26.090 The obituary has to be from a publication that's well known. 17:27.110 --> 17:32.870 You can't just send them like a local newspaper probably won't cut it or like a blog post or something. 17:32.870 --> 17:34.850 Trust me, I've tried this and it doesn't work. 17:35.230 --> 17:40.150 So don't be disappointed if you send them something and they just flat out reject it. 17:40.150 --> 17:43.330 I've had that happen before, even if I think that it's good enough. 17:44.310 --> 17:54.210 There are also exemptions, though, for the US person's policy, which is what prohibits the government from sharing information about living US persons. 17:54.250 --> 17:58.450 One of those is an exemption for public figures. 17:58.650 --> 18:02.770 So I don't know that Kevin Mitnick would qualify as being a public figure. 18:04.430 --> 18:11.970 But if you were to ask for something within the last 10 or 15 years on Mitnick, probably they're not going to share it. 18:12.130 --> 18:18.270 Unless, you know, unless he dies tonight, which I hope that didn't happen, but just sibling. 18:19.050 --> 18:22.190 Yeah, and remember that there's a person on the other end of this. 18:22.430 --> 18:25.770 So don't be a huge jerk to them. 18:27.470 --> 18:31.270 Most of them are earnestly trying to be helpful to you. 18:31.270 --> 18:38.990 So try to be polite, especially if you get something back, like be very thankful, grateful to them for being helpful to you. 18:39.070 --> 18:44.010 You don't have to kiss their ass or anything, but like just be aware that they have been trying to help you. 18:47.380 --> 18:49.220 Oh, I forgot that I made these highlighted. 18:49.220 --> 18:50.260 Okay, so don't. 18:50.260 --> 18:52.480 Okay, so really don't be a jerk. 18:52.480 --> 18:57.860 The person on the other side can just decide to slow the process. 18:57.860 --> 18:59.260 Like there's really no punishment. 18:59.260 --> 19:04.840 So if you've been a total asshole to them from the get go, they can just slow roll it. 19:05.300 --> 19:07.620 And that's not going to be helpful to you. 19:07.800 --> 19:14.500 At the same time, though, don't back down just because you've been denied doesn't mean that you can't appeal. 19:14.500 --> 19:26.960 So this kind of another kind of like subroutine in this process is that when you ask a question and you get rejected, that doesn't necessarily need to be all she wrote. 19:27.500 --> 19:28.860 You can do appeals. 19:28.860 --> 19:37.380 So if you get a rejection, you can say, you know, I don't know that you did a thorough enough search of your records. 19:37.380 --> 19:39.700 I'm pretty sure the FBI might have files on this. 19:39.700 --> 19:47.740 So I would like to appeal this this finding and and then that goes on to another authority to kind of like double check the work. 19:48.280 --> 19:57.160 More often than not, they will just do what they call an affirmed on appeal, which means that they'll just say, nope, we got it right the first time, even if they didn't. 19:57.340 --> 20:04.880 And so then it's it's kind of game over at that point, unless you get a lawyer and then you can take them to court to fight them. 20:04.880 --> 20:13.620 That's like a whole other ball of wax, though, that's not really primed for this specific beginner's tutorial on FOIA. 20:14.120 --> 20:16.360 Don't ask for sources and methods. 20:16.420 --> 20:26.940 So if you go to CIA or FBI or NSA and you say like, give me all the documentation you have on like all the exploits you have. 20:26.940 --> 20:31.900 They're not going to they're not going to just give up the goods because you asked them nicely. 20:32.000 --> 20:35.200 They would classify that as sources and methods. 20:35.200 --> 20:45.760 So that information is highly, highly protected because it provides the information that provides the government with a future pathway to to procure new information. 20:46.040 --> 20:56.880 So yeah, so don't like don't ask CIA about their purchasing programs or like specific things that they do to handle assets or anything like that. 20:56.940 --> 20:58.280 They're not going to talk about it. 20:58.280 --> 20:59.460 Don't waste your time. 20:59.460 --> 21:00.580 Don't waste their time. 21:00.580 --> 21:04.840 Like you're just going to aggravate them and you'll be aggravated as well. 21:06.680 --> 21:08.860 Don't ask about living US persons. 21:08.860 --> 21:10.700 This is kind of a general rule. 21:10.920 --> 21:12.840 Again, just kind of a waste of time. 21:12.840 --> 21:16.700 There's, there's not going to be and most people don't really have there. 21:16.700 --> 21:20.640 I think there's this notion that people just have like government files all over the place. 21:20.640 --> 21:22.580 Probably not. 21:22.900 --> 21:33.900 So, so don't count on like doing a FOIA request for your neighbor and expecting to get this like big file of information back that you can use against them in your next disagreement. 21:33.900 --> 21:37.220 It just doesn't, it just doesn't work like that. 21:37.780 --> 21:41.660 You can, though, do a FOIA request on yourself. 21:41.920 --> 21:46.000 So that is another kind of like loophole to the whole US persons exemption. 21:46.000 --> 21:55.820 So if you wanted to do a freedom, freedom of information as a tongue twister, if you wanted to do a FOIA request on yourself, you can do this. 21:55.960 --> 21:58.760 All you have to do is submit a privacy waiver. 21:59.020 --> 22:10.120 So what that does is it's, it's basically a form that you fill out and you send into the agency and you say, like, I'm, I'm forfeiting my, my right to privacy on this basis. 22:10.120 --> 22:14.980 What they do is they'll send you the information that's pertinent to that request. 22:15.160 --> 22:24.320 So if you are, if you've had run-ins with the FBI in the past, or if they've interviewed you or something and you want to get that information later on, totally do it. 22:24.320 --> 22:27.280 They're not going to make it public and put it on a website or something. 22:27.280 --> 22:34.740 I would, I would suggest not doing it through a site like MuckRock because MuckRock will just publish it if you want it to remain private. 22:36.140 --> 22:46.140 But if you do it through, directly through the FBI's online portal, if you put the request in that way, then they'll just send the information directly to you and not make it public in any other way. 22:46.320 --> 22:50.900 So definitely encourage you to do this if, if you have interest in your own information. 22:53.160 --> 22:54.640 Okay, exemptions. 22:54.640 --> 23:00.980 So like I said before, just because you ask the government for something does not necessarily mean that they're going to just give it to you. 23:00.980 --> 23:08.500 And ways that they will deny giving you information that you ask for is through, they'll usually do this with exemptions. 23:08.500 --> 23:16.680 So you tend to see exemptions more when it comes to specific national security organizations. 23:17.380 --> 23:24.000 So some of the common ones that we see all the time are B-1, and I'm just kind of paraphrasing what this means. 23:24.000 --> 23:29.660 If you see a B-1, this may come in the form of a redaction or just a full out, like, we're not going to give you anything. 23:31.260 --> 23:33.520 Usually it will come attached to a document. 23:33.520 --> 23:39.300 So when you see, when you get a document back, there will be like a big blurb that will just be, it'll have a big white box over it. 23:39.340 --> 23:43.760 And then they'll have the exemption listed in the, in the margin. 23:43.760 --> 23:47.600 So B-1, yeah, it's really, really classified. 23:47.600 --> 23:50.140 It's, it's National Security Act stuff. 23:50.140 --> 23:52.140 So like, no, no, we're not kidding. 23:52.140 --> 23:52.860 It really is. 23:52.860 --> 23:55.460 This is actually really, actually classified. 23:56.100 --> 23:58.560 So they'll exempt it for that reason. 23:58.640 --> 24:01.800 B-3, this is CIA's NOPE rule. 24:02.120 --> 24:07.120 It's specific, it's, it's protected by a very specific statute in law. 24:07.360 --> 24:14.620 I can't think of any examples of this right off the top of my head, but this is something that's generally used by, by CIA. 24:15.540 --> 24:19.460 B-4 is a, is a one that protects trade secrets. 24:19.520 --> 24:25.080 So you'll see this oftentimes in the form of like a propent proprietary information. 24:25.300 --> 24:30.880 That kind of stuff is, is really just to, there to, to protect intellectual property. 24:31.380 --> 24:36.400 B-5, B-5 is one that I really, really hate. 24:36.400 --> 24:42.000 B-5, when I see a B-5, what it says to me is like, fuck you in particular. 24:42.260 --> 24:47.180 What we call it in the, in the FOIA community is the withhold it because you want to exemption. 24:48.120 --> 24:52.680 There's, there's not really, this is kind of a catch all that, that agencies will use. 24:52.680 --> 24:57.500 I've even gotten B-5s from like the Department of Education. 24:57.500 --> 25:00.300 So it's not because the information is classified. 25:00.300 --> 25:02.860 They've just decided not to share it with you. 25:04.100 --> 25:07.760 These ones, I think, though, you, you have much more luck fighting in court. 25:07.760 --> 25:14.860 If you got something that's completely B-5ed out, you can, you can hire a lawyer if you want to and see the information. 25:15.700 --> 25:23.820 They really do need to, agencies, in my opinion, should be providing you with a better exemption than just, we're just, don't feel like sharing it with you. 25:23.820 --> 25:25.520 So, you know, shoo. 25:26.780 --> 25:37.000 It does also protect interagency and intra-agency memos, though, which like still, it doesn't, to me, it doesn't matter whether it's being shared between two agencies or not. 25:37.000 --> 25:39.080 Like if it's releasable, it's releasable. 25:39.760 --> 25:42.880 B-6 is one that protects personal information. 25:42.920 --> 25:54.200 So let's say that you, you've requested information about a very old CIA operation, for instance, and you get a bunch of B-6 back in the, in the responsive documentation. 25:54.200 --> 26:03.640 It could be that you're getting like, like CIA cables back and inside the cables may have some specific personal information there that relates to people who may still be alive. 26:04.320 --> 26:07.280 So if you see B-6, just don't, don't be shocked. 26:07.640 --> 26:10.280 And then B-7 is just the law enforcement exemption. 26:10.280 --> 26:12.760 It kind of protects local law enforcement. 26:12.960 --> 26:17.100 There are some others that you may see in particular for, for CIA. 26:17.100 --> 26:28.160 They use X-series exemptions, which is, it just goes into very specific detail, which is actually, the fact that they're withholding it is, is, is what it is. 26:28.160 --> 26:34.080 But the fact that they give you very specific, specific exemptions that are specific to CIA is actually kind of helpful. 26:34.080 --> 26:44.160 So you might get an X-series exemption for like a human source and they'll, they'll give you one that separates a human source out from like a technical source, etc, etc. 26:44.160 --> 26:49.140 So very, very helpful when you go to, to actually look at the documentation. 26:49.600 --> 26:53.540 Okay, so now, now we get to the really fun part, which is my, my war stories. 26:53.880 --> 26:57.880 So here's one that people have really taken interest in. 26:57.880 --> 27:03.200 I put a FOIA request in for Snoop Dogg to the Secret Service. 27:03.500 --> 27:12.000 This is Snoop, this is a snippet from Snoop Dogg's Secret Service dossier is kind of a, to put it in generic terms. 27:12.380 --> 27:15.040 So very specific information in here. 27:15.280 --> 27:21.020 What we can gather just from looking at this is kind of the reason for why Secret Service took interest in the first place. 27:21.620 --> 27:23.700 So there was a music video. 27:23.700 --> 27:29.340 I, this is actually why I did the FOIA because I knew that, that Snoop Dogg had made a video where he was pointing a gun at the president. 27:29.340 --> 27:33.160 And this, of course, gets like, this gets bootlickers dander up. 27:33.160 --> 27:36.040 So they really hate this when you threaten the president. 27:36.740 --> 27:42.520 So they, they, you know, pull together an entire, an entire file on Snoop Dogg. 27:42.520 --> 27:46.480 And it's just, it's just, it's, you'll see what I mean. 27:46.980 --> 27:56.380 So, so here we can see some very specific information about about Calvin Broadus, his real name. 27:57.100 --> 27:59.840 There's, there's some B6 information in here. 27:59.840 --> 28:03.740 So that's kind of what you're seeing in the, in the, with these exemptions here. 28:04.140 --> 28:08.140 Email address being exempted. 28:08.140 --> 28:14.120 The person who received it, the report number oddly is exempted under B6. 28:14.120 --> 28:16.820 I'm not really exactly sure why, but these are, these are names. 28:16.820 --> 28:18.520 These are specific email addresses. 28:18.840 --> 28:20.940 This is kind of another weird one down here. 28:20.940 --> 28:28.440 This is kind of an odd B6, but here are all of Snoop Dogg's his, his like aliases. 28:29.300 --> 28:38.320 Notably, they didn't include Snoop Lion because nobody really wants to remember Snoop Lion, but unless it's redacted under B6. 28:39.040 --> 28:46.200 So, so, so this is, this is kind of a good place to get an idea of why you would get a B6 in the first place. 28:48.300 --> 28:53.580 And, and so also recently I got some information back on DEF CON in particular. 28:53.980 --> 28:59.280 So if you, if you do a request for something like DEF CON, you're going to get a lot of information back. 28:59.280 --> 29:04.340 And this is kind of what the top of one of the documents might look like in a header from FBI. 29:04.840 --> 29:15.040 So like routine precedence, it'll give you a date, which is very helpful in terms of kind of grouping what information you got when and maybe how to categorize it. 29:15.040 --> 29:20.000 So when you come back to do research later, you can like put it in different folders and all of that. 29:20.580 --> 29:23.060 They will also do B6 redactions. 29:23.060 --> 29:24.880 So you're seeing that happen here. 29:24.880 --> 29:37.520 These are, these are specific FBI agent names and different handler, information custodians, information handlers, and then you'll have something that will kind of give you a general idea of what you're looking at. 29:38.080 --> 29:40.540 The title of this one was computer crimes. 29:40.540 --> 29:41.320 I'm not sure. 29:41.320 --> 29:44.080 It looks like it went to the Los Angeles field office. 29:45.600 --> 29:47.380 And there's, there's two in here. 29:47.380 --> 29:49.420 So to Miami and Los Angeles. 29:51.260 --> 29:55.820 And I think this is, I think this is Washington Metropolitan field office, I think. 29:56.040 --> 29:58.740 So that's going to be the Washington FBI field office. 29:59.680 --> 30:04.480 And then a couple just specific things that are kind of fun from this one that I got was here. 30:04.480 --> 30:12.600 Here's what the FBI wrote for their release of BackOrifice in 2000, which happened at DEF CON. 30:14.600 --> 30:19.980 So this one came out at the, at the 2000 instance of DEF CON. 30:19.980 --> 30:25.340 And what we see here is just kind of the way that FBI was characterizing the release of this tool. 30:25.340 --> 30:36.360 So a previous instance of BackOrifice had been released and FBI had kind of looked into it, but I don't, I don't know that FBI really knew what to do with the information that it was out there. 30:36.440 --> 30:46.620 But definitely when BackOrifice 2000 came out, it was like, okay, now we have to be serious about this because we can't, we can't just, we can't just act like we don't know anything about this one. 30:46.620 --> 30:48.960 So they actually did start looking into it. 30:48.960 --> 31:00.580 And there are also files floating around out there about the Cult of the Dead Cow anyway, so there's a ton of stuff the FBI had already compiled on CDC prior to, even prior to this. 31:01.480 --> 31:07.100 And then this is kind of an interesting one that came out about DEF CON in 2010. 31:07.700 --> 31:16.880 So they, the FBI opened an entire program called Slam & Jam, and this is an investigation into a stolen laptop that came from General Dynamics. 31:16.880 --> 31:23.400 Really crappy name, but it kind of gives you a rundown of some of the information that they collected and where. 31:23.700 --> 31:27.700 Another kind of note here about this one is the header here, secret. 31:27.700 --> 31:29.400 That's a previous classification. 31:29.400 --> 31:35.920 They exit out like this when it becomes declassified, so it's not still secret, just in case someone had a question about that. 31:37.280 --> 31:47.680 So they do, FBI is very, very good about classify, about classifying information or like formatting it in a way that's very easy to read. 31:47.700 --> 31:52.240 Not every agency is good about this, but FBI is very good about it in particular. 31:52.240 --> 32:01.220 So Slam & Jam, and here's, here's like an excerpt that came from this, this investigation. 32:02.540 --> 32:09.860 They, the FBI specifically talked to DEF CON security to try and get some information about who might have stolen this machine. 32:10.980 --> 32:21.320 One of the, my favorite part is this, this one here about the DEF CON employees Googling the computer model and discovered it was a ruggedized laptop and that it may be GPS tracked. 32:21.320 --> 32:36.860 And then this was kind of like my favorite part of my favorite part, which was the DEF CON organizers at the time said that a drunk DEF CON employee tested the ruggedness of the computer by repeatedly dropping on the ground. 32:36.860 --> 32:44.320 So being very, very careful with, with, with computers with potential government information on them. 32:46.080 --> 32:50.360 So just a lot of really interesting stuff that you can get out of this process. 32:50.360 --> 32:57.420 I really do encourage everyone who has interest to, to, to participate in this. 32:57.420 --> 33:01.320 It's, it's a, it's something that we are really lucky to have in the United States. 33:01.320 --> 33:04.520 And it's, it's, my opinion is very underutilized. 33:05.220 --> 33:12.700 FOIA is, is probably better in the United States than it is in almost any other Western country, UK included. 33:12.700 --> 33:19.220 I even know people who do FOIA work in the UK and they get exemptions like way more than we get exemptions. 33:19.220 --> 33:25.360 So we have this tool, use it, advocate for it to be stronger. 33:25.720 --> 33:30.580 Here's a little bit of background on the project, the Hacking History Project, in case you're interested. 33:30.980 --> 33:39.640 So it's just at mockrock.com, which is a 501c3, it's a nonprofit organization that kind of helps with government transparency. 33:40.380 --> 33:43.140 So you can, you can jot that down real quick. 33:43.160 --> 33:48.100 I don't know if we can, we can probably drop it in the chat at some point, if there's chat available. 33:48.520 --> 33:49.720 And that's all I have. 33:49.720 --> 33:52.400 So if there are any questions, I'm happy to take questions. 33:52.400 --> 33:58.120 But here's my information in case you're interested and want to see stuff in the future or if you want to engage later on. 33:59.100 --> 34:00.920 So that's, that's all I got. 34:02.000 --> 34:03.280 Awesome. 34:03.280 --> 34:05.680 Thank you so much, Emily. 34:06.340 --> 34:08.820 So let me double check the Discord. 34:08.820 --> 34:13.740 We didn't have any questions come in via Discord, but I had a question for you. 34:14.620 --> 34:21.600 I'm embarrassed to admit this, but I have never actually submitted a FOIA request before. 34:21.600 --> 34:28.740 Are there any things that like you gave a lot of really great tips and tricks for your first time? 34:29.040 --> 34:35.320 What's like the number one big error that someone makes when they make their first FOIA request? 34:35.820 --> 34:39.740 So , so I know that a lot of the ones that I did early on were just way too broad. 34:39.740 --> 34:45.620 And it becomes kind of like, I don't want to, I don't want to use, make it mundane and say like, it's an art to do FOIA. 34:45.620 --> 34:46.480 It's not really an art. 34:46.480 --> 34:48.580 It's just something that you get used to over time. 34:48.580 --> 34:54.340 So when you, when you do a request, try to make it as easy to understand for the person who's reading it. 34:54.340 --> 35:04.480 Like if you can't understand, if you were to like take your, your brain out of your head, so to speak, and imagine what it would read like if you weren't writing it yourself. 35:05.000 --> 35:09.260 So I used to get them back all the time for just lack of clarity. 35:09.800 --> 35:18.360 So if you, if you want to get responsive documentation, try and make it readable and, and perfectly understandable. 35:18.360 --> 35:22.600 So it doesn't matter like how dummy the person is reading it. 35:22.600 --> 35:26.060 If they can understand it, then they will try and help you. 35:26.880 --> 35:32.420 Another kind of tip that I didn't bring up is that there's this, there's this thing I call the sweet spot. 35:32.420 --> 35:38.900 So there's a sweet spot in classification that's like 30 years back. 35:38.960 --> 35:49.340 So knowing when, when information stops being classified or when it needs to be re-evaluated for classification re-up is really helpful to FOIA investigators. 35:49.340 --> 35:57.620 So if you're asking about something that happened in like the 80s or the 90s, now is actually the perfect time to be asking government agencies about that. 35:57.620 --> 36:03.100 Because it's probably if, especially if it's been classified as top secret, they're going to have to re-justify that. 36:03.100 --> 36:07.040 And they're, they're not often going to like jump at the opportunity to do that. 36:07.040 --> 36:14.140 So information that hasn't maybe been made public before is kind of up for grabs in that 30 year span of time. 36:14.220 --> 36:24.840 So definitely if there's something that you know of that happened in the 90s or something that you want to investigate in that timeframe, do it, do it now so that you can, you can get your request in and maybe get something back. 36:24.840 --> 36:25.900 That's awesome. 36:25.900 --> 36:32.320 That's actually a really interesting tip because I'm sure the 90s were really, really interesting, especially for hacking. 36:32.320 --> 36:39.340 And so I think maybe the greatest thing to come out of the 2020s will be more information about what was going on in the 90s. 36:39.340 --> 36:40.100 Right. 36:40.100 --> 36:47.620 Emily, thank you so very much for your time and jumping on for a last minute presentation. 36:47.620 --> 36:51.900 It's just an absolute pleasure to have you on our brand new stream. 36:52.080 --> 36:59.960 I look forward to hopefully seeing you in person at DEF CON next year, or at some other event, but thank you so much for your time.