Welcome, welcome everybody to a very unusual DEF CON.
Lots of things are different, lots of things are staying the same,
including, as always, the open organization of Lockpickers, Lockpick Village.
We're so glad you're here.
We hope that you can learn some things, have some fun, walk out more fired up
about hacking and lockpicking than you arrived.
My particular part of this today is law school for lockpickers.
What even is that?
Well, by way of background, I'm Preston Thomas, a former board member of TOOL.
I'm a licensed attorney barred in the District of Columbia and in California,
which is, importantly, different than barred from D.C. and California.
I've done this talk before, including at DEF CON,
but 2020 has brought this topic into a new light.
Security research of all kinds, from hacking, reverse engineering,
social engineering, lockpicking, these all rely on civil liberties
of an open society with rule of law.
Hacking is, by nature, subversive. Lockpicking is no different.
So, like journalists and priests and security researchers,
our job is to comfort the afflicted and afflict the comfortable.
We can do things many people don't understand.
For certain types of people, encountering something they don't understand
makes them nervous, irrational, maybe even angry.
I should note, I've worked with TOOL for almost ten years
and been a lawyer for longer, and when people get nervous,
irrational, or angry about lockpicking topics,
it often ends up on my plate. Falls to me to explain.
I've had this particular conversation hundreds of times.
So, this talk today, it isn't for you. It's for me.
I want to recruit all of you into my crusade to push back
on the tide of bullshit about laws and lockpicking and how the two interact.
I'm tired. I want to be done talking about this,
but people won't let me. Help me. Please.
Let's do this.
To begin with, I am a lawyer.
I am not, however, your lawyer.
This is so, so not legal advice. The only advice I'm going to give you today is
don't get your legal advice from a guy at a con.
Also, my opinions are my own. They don't represent TOOL or anyone I work for.
Standard disclaimer. Law & Order was a great show because
half was the cops and half was the lawyers. For the law part,
you can just Google what the laws are in a specific jurisdiction or how to talk
to a law enforcement officer. There's great stuff on YouTube about that.
This is not that talk. This talk is more the second part,
the order part, about why lockpicking laws are the way they are.
And what it means for you as a practitioner dealing with
lots of non-practitioners. Everyone has legal theories
about lots of parts of daily life, not just lockpicking.
Most of them are workable. Some of them are nonsensical.
Some of them are absolutely bananas. And where do loopy legal theories
tend to come from? Armchair lawyers.
Armchair lawyers everywhere with their good old University of Wikipedia
law degree. And their specialty area is something I like to call
folk law. These are guys' ideas about law that everyone seems to know,
but no one really seems to know where they came from. This is,
I want my one phone call, or if you ask someone if they're a cop,
they have to tell you, or I don't have to pay income taxes
because I live in the free state of Jefferson.
Because of folk law and all the people opining about it
and spouting off about it, Googling about lockpicking laws on the Internet
is worse than Googling about that weird rash.
So let's get real. Today, let's do this
law school style. We're going to be concrete, specific,
and clear in how we use words.
Let's start off this law school for lockpickers
by building a law. Let's build a criminal statute called
the Possession of Burglary Tools, because that's almost always what we're talking about
when we're talking about the legality of lockpicks.
Criminal laws are constructed of elements. These elements are what need to be proven
beyond a reasonable doubt before someone can be legally found guilty of a crime.
In the case of a burglary tool statute, there's usually two elements.
Possession is physically having a tool or device, including lockpicks,
and intent means criminal mindset, i.e., you intend
to do something that is against the law. You can call this formula
Possession plus Intent.
Now, intent is difficult to get at. It's in your head.
It's not something the court has access to.
So, typically in a court of law, it's shown through circumstances.
In other words, part of the district attorney's job is to show circumstances
that make it beyond a reasonable doubt that a person had crime in mind
at the time they possessed lockpicks.
No circumstances, no intent, no intent, no crime.
In most states, it's as simple as that.
Mere possession of lockpicks without any circumstances indicating unlawful intent,
not a crime.
You look across, you can see that is the vast majority of states.
We colored them green just because it's nice, it's soothing,
it sends the right message across.
But what about those shadowy places you say in your best
Jonathan Taylor Thomas 1994 Simba voice?
Remember how I said intent was really hard to get at?
The court can't know it's in someone's mind.
So, who better to provide evidence about the state of someone's mind
than the person themselves?
That is the thinking behind that minority of states that just throw up their hands
and say, you tell me.
I'm looking at you, Virginia, Ohio, Mississippi, Nevada.
Laws change over time,
but they pretty much solidify down to these four
as having the possession plus intent formulation.
So, these states, they write their burglary tools
so that possession of lockpicks is prima facie
evidence of intent to commit a crime.
We'll talk about prima facie here in a second.
Here's an example from the Code of Virginia.
For those of you who like to follow along,
this is Criminal Code 18.2-94.
The possession of such burglary as tools, implements, or outfit by any person
other than a licensed dealer shall be prima facie evidence
of an intent to commit burglary, robbery, or larceny.
So, let's talk about that prima facie word.
It's not law school without some Latin. Let's dive into it.
Prima facie, Latin, literally means
on first face, or on first impression, you can figure.
In plain English, that means
if I didn't know better,
I'd say something.
I'd say you're up to no good.
Turning that back into legal language,
that's referred to as a rebuttable presumption. It's a presumption
because it starts off set to true. Default value, true.
It's rebuttable because that default value can be changed.
Which means the ball
is in your court. Or, in more colloquial terms,
prima facie means splainer.
And I put this gif up there and I'm increasingly surprised
how few people know what it's from. If you don't recognize this gif,
congratulations on your
high school graduation, I guess.
Okay, so people will often say,
but I have a presumption of innocence,
but my Constitution, I've got rights.
And you're right, you do have rights, at least for the time being.
But the presumption of innocence
is not one of the rights that's guaranteed in the Constitution.
You can read it, it's not that long. You should read it, it's worth the read.
And one of the things you'll notice, there's no
presumption of innocence mentioned in the Constitution.
It flows indirectly from the 5th, 6th, and 14th Amendments.
Coffin v. United States is one of the first cases you study
in law school. And that shows how, even though
it's not actually in the text, it was discovered
as a necessary implication of the rights guaranteed
explicitly in the 5th, 6th, and 14th Amendments.
More importantly, though, this formulation of burglary law
just won't be challenged in court because
it's too much of an edge case to ever make it to trial.
There's two things DAs hate. They hate crime and they
hate losing cases. And because
this formulation, even if it
is arguably unconstitutional or might be,
it'll never get tested because if it's such
an edge case that you might be able to make a constitutional argument,
the DA will shrug his hands and throw it out.
He doesn't want to go down that route. That's not what his job is.
He's got much bigger fish to fry.
So, these kinds of problems
where the law is a little
unclear and common sense doesn't seem to quite
match up with the way the law is written, that's why humans are in the loop.
There's district attorneys with prosecutorial discretion,
there's judges sitting over each trial,
they're specifically there to handle exceptions
where the law as written doesn't quite match up
with the facts on the ground. So,
even if you might be able to have a constitutional problem with this
formulation, know that it will probably never come to trial
because no one's going to care enough about a fact pattern like that
to actually push it.
Now, there's kind of a sense
of boo-hit about
these states that have possession
implies intent formulation.
And a lot of people think, oh, they're
just wrong or they're nonsensical or they're anti-hacker,
anti-lockpicker. But, if you look at actually
what they're thinking is, it begins to make a little bit more sense
and you have more sympathy for them. So, I decided
let's look at some of them. First of all,
I didn't know what the Nevada flag looked like. I had to look that up
just for this presentation. Here's what Nevada
decided.
They said in a case, 1965,
they said it is consistent
with all the constitutional protections of accused men
to throw on them the burden of proving facts
particularly within their knowledge and hidden
from discovery by the government.
This is an illustrative example of the kind of reasoning
that motivates possession implies intent state.
You don't have to agree with it, but you can see what their thinking is.
If we're having trial
and the goal of the trial is to find out what the truth is
and whether someone is guilty and that person has information
they say is relevant to the case, they should be able to provide it.
If they have it, then the least they can do is show it to the court.
It kind of makes sense.
It's very simple. Maybe it makes some of our
civil liberties impulses a little squeamish,
but it's not unreasonable. Especially when you consider
the one we collectively like a little bit better
which is the possession plus intent formulation
the more liberal version.
So why shouldn't we imply intent?
And here's an example from the District
of Columbia that shows the kind of reasoning involved
in arriving at the idea that possession plus intent should be
the proper formulation. And what they say is
and this is great
close parsing by the judge
although the sledgehammer, axe and hacksaw
which the appellant had quite clearly can be used criminally
they also may and for the most part are
used for legitimate purposes.
Since the mere fact of possession of such implements
has no relevance to guilt, it may not be made
the occasion of casting on the defendant the obligation
of exculpation. In other words,
unless what you're carrying are literally drugs or something else
that's similarly illegal just for existing
then the cops have to introduce additional facts to overcome
the statistical likelihood that you intend to use them
for a legal purpose.
Most people carrying axes, sledgehammers
hacks, hammers, etc.
are using for legal purposes. So why
in this case would we infer that they're using it for
anything other than legal purpose? When you walk through it
like that, it's kind of tortured logic. You have to
suddenly appreciate the people who say, hey, you know what
it's probably what it looks like unless you tell us
otherwise. I have a lot, after doing the research for this, I have a lot
more sympathy for the jurisdictions that decide to throw
up their hands and say, you tell us.
I know some of you in the back are saying, hey, aren't there
different types of intent under the law? Yes,
but that's not relevant here. Any intent will do
for this particular formulation.
Now, this kind of close parsing and close analysis
of the way laws are written and what's the meaning behind
them leads to some really funny
outcomes, including my favorite lockpicking case. It turns out
I have a favorite lockpicking case. We are once again back
in the District of Columbia. This is a D.C. appeals court, still
relatively recently, from 2014. In re
J.W. means there was a minor involved. So some kid
under 18 got nicked by the cops. Funny
circumstances. Here's what happened. J.W.
was arrested red-handed trying to steal a
Vespa with a pair of bolt cutters. He was charged
with possession of implements of a crime, which is the usual statute
that applies to lockpicking. Both elements are satisfied,
no question. He's sitting there, middle of the night,
by the Vespa, bolt cutters in hand,
definition of caught red-handed. Absolutely possession,
absolutely intent. However,
there's an inartful drafting of the statute because the statute
specified, doesn't usually specify, but in this case it does,
it specified tools for picking locks.
A meticulous appeals court
judge observed that picking a lock is
generally understood to require skill rather than brute force
and to turn the lock without damage
to the lock. He literally went and looked up the definition of
picking a lock in the dictionary and came back
with that and entered it in the record. As a result
of reading the statute across from the
definitions, it was, the judge
concluded, not physically possible to pick
a lock with bolt cutters, nor is it legally
possible to convict J.W. under the statute as
written, because try as you might,
those big old bolt cutters will not fit into the lock and
turn it in a non-damaging fashion.
Conclusion, no
possession of tools designed for picking locks
and J.W. goes free and anyone
who complains about that gets to go back and write the statute a little bit more
carefully. I think that is a great example
of a judge carefully parsing the statute, holding the state
to what they said they wanted, and then telling them if you want
something different, you have to be a little bit more careful.
Another thing I like about this is this means that we have it
on record that all those savages and reprobates
at conferences who destroy the locks
and tie the lock picks into pretzels are not
legally speaking, picking locks.
So,
here's the part that I think a lot of people show up for.
The A number one absolute main area of
shouting and nonsense regarding locks and lock picking
is speculation on breaking the link between
possession and intent. So, let's talk about it.
This is in those states where possession
implies intent. Those minority of states.
Well, what can we do to protect ourselves?
There's a thought that these are the places where lock
picks are illegal and we have to be on our guard and we have to have
an answer ready. So, what do we do
about it? And something that often comes up is
have a card. Have some kind of self-made
card or a more professional card. Poof.
Problem solved. This is that fantasy of holding it up
to the officer and saying, don't worry, officer. I have a permit for this.
That couldn't
be further from the truth. There is no such thing as a
get-out-of-jail-free card because
they're absolutely allowed to have that conversation
with you. And by the time you're having that conversation, it is
not in your interest to try to avoid that conversation.
Instead, I want you to think of
if you're having a conversation about lock
picks with a cop, you now
is in your interest to engage
in and expand in and own that conversation rather
than trying to flash some kind of card and
avoid it. The tool membership card, which is
forthcoming, contains a few carefully
crafted paragraphs to help you achieve a productive tone
in that conversation. Essentially,
as it acts as a conversation starter. It's a way
to help you have the conversation effectively rather
than avoid the conversation.
It explains that
tool is an organization that exists, that recreational
locksport is a thing that exists, that the holder of the
card is a member of tool, and it gives a gloss
on the general state of overall laws.
It doesn't overplay its hand. It basically
digs down to the idea that what we
teach and what we do at tool is legal
everywhere in the United States by definition because
locksporters and researchers have a legitimate use for their
picks. And they follow the two rules, the two rules
which are quite famously in tool. Don't pick a lock that you
don't own. Don't pick a lock upon which you rely. If you're following
those rules, then you don't fall afoul of either
formulation of the state law, no matter where you are.
So that helps
set the right tone. If you're a conscientious locksport
practitioner, you know, don't hide them.
Don't lie about why you have them. Essentially, don't act guilty
if you aren't guilty. People sometimes come
to me and say, Preston, that's all well and good, but
what if I'm doing this or that or the other thing? What about
this circumstance? And what I always tell them is
if what you're doing is a crime, then you are literally
doing what the crime of possession of burglary
tools says, and you have no basis to complain.
If, on the other hand, you are not
and you're practicing good locksport ethics and you're following
tools' rules, then you can be
safe in knowing that what you are doing is legal
in every state in the union and you have a card to
help explain that concept to anyone who's asking.
Now, we are very serious about
keeping our members and our friends on the right side of the law.
Nonetheless, and I want to emphasize, this is not
legal advice. This is just wisdom that any person in the society
should know. Let me give you a rule of thumb.
Call it the one crime at a time rule. If you
choose to break the law, don't break the law while you're
breaking the law. Don't accidentally turn a legitimate hobby into
an indictable offense by carrying lockpicks along on a time
when you shouldn't have them.
In the words of legal philosopher William Smith
in the matter of Earth vs. Giant Bug, 1997,
don't start nothing won't be nothing.
I have heard from many police
officers in many different jurisdictions.
I've asked them. I have been on public transit sitting there
picking on my practice locks and
I said, hey guys, I'm sitting here picking locks.
I'm pretty sure that's acceptable. Do you have any problem with it?
And they say, planning on picking locks on the train? Are you planning
on picking locks on the airplane? They don't care.
They have actual crimes to worry about. If you're sitting there as a
law-abiding citizen doing something that's not bothering anybody,
it's not worth their time.
So don't be nervous about it
and don't worry about
ignorance of the law becoming a problem for you
because you're willing to have that conversation.
Another area that people oftentimes ask about
is federal law, particularly
TSA.
DEFCON is one of the most common sources of that question
because people say, well, I just bought lockpicks
but now I can't take them on an airplane.
Well,
it's not a factor.
It is literally
not a factor
because TSA has a set of things that they're looking for
and a set of things that are not on their list.
Because a lockpicking tool is a non-sharp tool
less than 7 inches, it's carry-on approved.
It's simply not disallowed, which means it's allowed.
And don't say this to TSA if you're having that conversation
but the locks on the cockpit doors are not even pin tumbler locks
so all the more reason for it not to be on their list.
After years and years
of asking them, we've got a Twitter conversation
from a bunch of different people here
they finally, their agents
finally added lockpicks
explicitly to their
can I bring my self-service site on the website.
So if this is a concern for you
and you'd like a little extra backup
then feel free, go on the website, take a screenshot
print it out, throw it in your lockpick kit.
I've done it, I know a lot of friends of mine in tool have done it
we carried around our lockpick kit for years and years
until it got ratty and torn up, then we threw it away and we never used it.
Once again, because TSA agents
just don't care. But remember
like anything that you want to carry on a plane
the TSA agent gets the last call. So be polite
be friendly, be patient with them
whether you're doing an opt-out or bringing something unusual
through carry-on, just make sure you have enough time to have the discussion
without being rushed or being flustered. Yes, I like
opting out, there's good ethical reasons to it
even though sometimes it's a pain in the butt. If I'm in a hurry, I don't want to
miss my flight, yeah, I'll go through the scanner
carrying lockpicks is likewise
if I'm really in a hurry, I'll just check them
but for the most part, I like carrying them on A, because I know where they are
because they're valuable and make sure they don't get broken
but also to make sure that I'm practicing what I preach and telling people
yes, it's not a problem and on the rare occasion I have those conversations
then I can make it that much easier for the next person coming behind me
that's bringing lockpicks. One of the best
pieces of advice I get when I got in law school
when you're having conversations like this is
always try to seem like the most reasonable person in the room
seem like the most reasonable person in the room
if you seem like you're prepared for the conversation, if it's not a surprise
for you, then that
really helps them be that much more calm about it
As a last resort
many airports will give you the option to mail something home rather than
trashing it. Another great option if you've got time to take
advantage of it.
Here's what I do when I'm taking my lockpicks
through an airport. This is my bin on the inside
of security at San Francisco
note the gigantic bag of lockpicks
including the fuzzy handcuffs right on top just in case anyone wants to
get curious. That's all totally legal
as are the Bogotas in my wallet which is there on the right
no one ever notices that
Ironically, the illegal thing in the picture
is that little bottle of crack and rum
I totally did not know that you're not allowed to bring little bottles
through security or under the airplane. You're not allowed to provide your own booze
So yes, there is something illegal going on in that picture. No, it's not the
lockpicks. Yes, it is the booze. A note on having fun with
TSA. I like putting the handcuffs on top
because if they're going to open up the bag
I like to put a smile on their face. It gives them the problem
of do they dig around the handcuffs? Are they allowed
to pick the handcuffs up? This is a dildo
versus your dildo territory. So
as long as they're going to have the conversation, there's no reason
we can't make it a little bit fun. And before you ask
yes, handcuffs are also legal
are also permitted in carry-on. Lots of good reasons for that including
security officers and police officers that always travel
with handcuffs. A few years ago
a lady Gaga brought her own fuzzy handcuffs
and there was a bit of a hullabaloo about it. But
they were of course allowed on. So
fun lockpick tricks. Just
carry fuzzy handcuffs as well. It helps
set the conversation on the right mode. A comment that I
got from Max who works with
TOOL. He said always remember that
you can help the conversation along by
giving some framing. So if you see
your bag of lockpicks go through the x-ray
and the person's eyes kind of light up and they shunt it off to the
side for further inspection, wave at the guy
as you're walking over. So that's the
conversation just right. I see you've got my bag of lockpicking
equipment there. I do this, that, or the other thing.
I do locksport as a hobby. Inside you will find
the following things. You can help them get
in the right frame and there's kind of an art to
helping them arrive at their own conclusions rather than dictating to them
in a way that might make them suspicious.
Don't avoid the conversation. Welcome the chance to practice
the conversation. It's almost always no big deal
because again, it's a non-sharp tool less than 7 inches.
We will pass
handcuffs and we will go to the rest of the world
and people often ask me now
that I've talked about the United States, what about the rest of the world?
And the answer is the rest of the world does not differ materially
from the United States for the most part.
Everywhere around the world you'll find
countries and individual jurisdictions with both formulations.
The most common formulation is possession plus intent
but there are some places that have possession implies intent.
So Commonwealth, UK, Australia, New Zealand,
Canada, they're all legal. Some of them
are possession plus intent. Some of them are possession implies intent
but none of them make it strictly illegal.
Netherlands, as we know, Tool having started in the Netherlands
perfectly legal and there's quite a robust culture there.
Israel, a little bit more tightened down.
They're definitely in the possession implies intent camp
and I'm given to understand that in China
they are fairly illegal but like many things in China
it depends on who your patron is. So yes, when Tool
goes to China we do take lockpicks with us.
We teach lockpicking there and we get it all cleared
through the proper authorities and we haven't had a problem yet.
Now there's one last thing that needs to be said
before I round this out which is 2020
is in some ways different than other years.
In some ways no different than it ever was. We're just
learning more about it now. The Black Lives Matter movement
has really drawn a lot more attention
to the interaction between young
black people, people of color, and law enforcement
and it wouldn't be right to finish this talk
without mentioning that all the advice I gave
works great if you are a
white reasonably well-educated male
lawyer. Does it work as well if
you're not some of those things? And the only answer I can tell you is
all the principles remain the same but it is
absolutely hard mode. It's no surprise
that you might have to speak
better, understand better, make yourself heard better
to get the same results and there's nothing
that I can say to make that okay in this talk or to really
give a lot of insight from a perspective other than mine
but I do want to acknowledge that the law
is the same and many of the same principles apply
but it's hard mode. So
that is the laws of lockpicking. I understand as we end
this I'll have a chance to take questions. So for anyone who has questions
about lockpicking in the U.S., around the world, who has stories they
want to tell, who has hypotheticals that they want to get insight
on, I would be happy to share them. Mostly
thank you for showing up for this conversation. Happy lockpicking.
Look forward to seeing you around.