Hey, everybody. Listen up. We're a little early. We'll get started. This is "legal aspects
of active defense." I am always pleased when techies come and want to see how law intersects
with technology. And years ago I mentioned that to, Marcus Sax, who is a SANS instructor
at Verizon and all that stuff. And I said Marcus I am always amazed that like the orom
will fill up and people actually show up. And he said yeah, or the other rooms are all
full and they don't have any other place to go. So if you're here because you want to
see how they intersect, great. Wonderful. This is great. But if you're here because
all the other rooms have filled up and you couldn't go anyplace else, sorry about that.
We'll try to get bigger rooms next time. So legal aspect of computer network defense.
The agenda, the things we're going to talk about here as we go through, to figure out
what are those things that you need to do to be able to do computer network active defense.
Disclaimer aspect on things. I am here in a personal capacity. I represent no employer,
entity, Government organization. Anything. So I hope to be informative to you and give
you some information and yet still may be a little bit entertaining.
I have spoken at numerous Black Hats and DEF CONs before and typically I have the only
million dollar give away. And what that is is for any question or the best question,
best comment or even best heckle, I usually will give away a $5, a $10 or a $25 chip under
the million dollar give away. Now you have to take the chip and go out to the casino
and parlay that into a million dollars on that.
(Laughter) Now I normally, that's what I do. I'm going
to apologize. That's been canceled due to sequestration.
(Laughter) So if you're pissed at your Government for
things, let me explain something. Talk to my wife about having 20 percent pay taken
away. That's when you get pissed, when you have to deal with that on the home front.
There is a current topic out there, that is quite pressing. It is ripe for comedy, and
I've been having fun with it. It involves the United States Government. And while the
United States Government was founded on happiness, I think if you look at the Declaration of
Independence in there you will see that basically, you know, it is founded on happiness. We are
the only happy country. You look at any of the other documents out there, the Magna carta
or anything, they don't mention happiness. With that said, I have spoken to sources familiar
with the matter and they tell me that the Government has no sense of humor on this topic.
And so, therefore, we will not be making any folks about that whatsoever.
As we go along, I have an active defense scenario to talk about. A spoiler alert here. If you
don't want to know how it comes out at the end, please turn away from the screens and
look the other way. Because the way that it ends, he's the bad guy on this.
And if you're from my generation, actually, he's the bad guy.
(Applause) And I know we're not supposed to do any sponsorships
or plugs, but because I'm a Chrysler kid from Detroit, Mighigan, and I can also get fine
Corinthian leather from him on that. This is the first year that I'm going to hand
out a Robert Clark cybersecurity award. Drink.
ROBERT CLARK: What? Oh, drink. There was a different one last year at Black hat. They
said any time anybody says "cyber," you're supposed to shout out something else. I can't
stand the word "Cyber." Absolutely hate it. I'm a computer network guy from the aspects
of a decade. But if you want to have money thrown at anything, you've got to have the
word "cyber" in it. If you wanted port-a-pottys for DoD, you would say these are cyber port-a-pottys
and they would give you thousands of dollars for these things. And of course you would
say wait a second, what makes it a cyber port-a-potty? Well, there's a key pad --> don't even go there.
So I would like to give the first Robert Clark cyber security award to someone who has done
something to advance cyber security. So who should this possibly go to? You've got folks
like, you know, Leo La Port out there doing stuff, Tom Merits doing good work. Like Steve
Gibson's aspect, and I even like Patrick Gray and the risky business. All of these folks
are out there. And while I would like to kiss up to them and to get onto their shows, I
really actually want to kiss up to Steven Cobert.
(Laughter) Now, if you're wondering why? Well, you know,
he knows the technology. Now granted a couple years ago it was very archaic. Of course this
might be the securest way to communicate these days. I can't see below the table to see if
there is anybody in the middle, but you never know. But he knows the technology. I mean,
he gets customized technology that he gets to use. One of the first users of a tablet.
Into that virtualization aspects. Even invented his own Google Glasses. So from that aspect
what more could you want from somebody? He knows the technology so much he even advised
Anthony Wieder, a/k/a Carlos Danger, they should be using snapchat. So, you know, the
guy is there. He knows the web. He knows iTunes. He's got Google down, Bing, Twitter. Big coin
even talks about him and even PalTalk. If you someone can come and tell me what PalTalk
is afterwards, I'd appreciate that. He knows the people, you know, from Jobs, to Schmidt
and Gates and even knows Anonymous. As a matter of fact, he probably knows Anonymous a little
too well and too closely. If that's not enough for this award, he's
got a virtual presence. He's on the international space station and he's even in animations.
So in my book he deserves the first Robert Clark cybersecurity award. And if this isn't
enough to get me on his show, I really don't know what it's going to take. It's not going
to be my intellect, from that aspect of it. So now getting on to things. Disclaimer, again,
I am here in a personal capacity. All the opinions are my own.
Cyber education is a big piece. I am actually leaving the United States Army cyber command,
which is not the same agency as the United States cyber command. I work for General Hernandes.
This is my last day, actually, working for him. And tomorrow I start at the Naval Academy
out at Anapolis on their faculty to educate --
(Applause) So I'm a professor of law, this is sweet,
to teach midshipmen on the nontechnical content for cyber operations, the law and policy aspects
on life. And so they have two core classes that every midshipman must take, and we're
developing a cyber operations major. West Point also has an Army cyber center, so I'll
mention that with my Army heritage, and then the other service has something they're doing,
too. But I have no affiliation with them. So if I say something wrong, please by all
means say you heard it from an officer at Army Cyber Command. And if I say something
right, please say that this brilliant professor from the Naval Academy said. I'd appreciate
that. (Laughter)
When I go to a conference, I'm really hoping that I'm taking away only one or two golden
nuggets of information, because if I'm not then I'm really stupid and I really should
be studying a lot more. And so the one golden nugget I want to give
right up front, if you're interested in this area, the American Bar Association cyber security
task force is going to be coming out with a report that's supposed to be coming out
soon with a report on active defense. So I would say tuck this away if this is an area
you are really interested in, and go to their site down the road and see if they have that
coming out. Because they're going to talk about some beaconing and some other aspects
of it, so it might be something to tuck away in a back pocket as we're moving about, talking
about doing active defense. So law and computer network operations. If
you ask the same question to two attorneys, you will get a lot of --> you'll get four answers
and there are only two attorneys there. The thing is, I'm not your lawyer, and please
ask questions at any time. Stand up, shout. We will be glad to address them. The interaction
is really what makes this thing go. But I'd like to talk, if anyone was in Mark
Weathorford's talk on the growing irrelevancy of the US Government information sharing,
he made a point about attorneys. He didn't say which ones. And he said that they were
very risk adverse and didn't understand the technology. We'll get into Clark's law about
dealing with your lawyers and technology a little bit here. The aspect about being risk
adverse and what a lawyer's role is, and this is kind of for you, I provide advice. I give
counsel. If it's something illegal I'll say this breaks the law. If it violates a policy,
but I provide advice. The responsibility to act on that belongs to my client or the commander
or the Government. And it's their job to say got it? Okay. But you don't let your general
counsel run your company from that aspect. And that's kind of an interesting take that
I had a problem with, with Mark Weatherford's comments. And it's not --> I understand the
scenario. Yes, senior leadership's not going to do anything unless their general counsel
says yes, you can do that. That's backwards. The senior leadership is
supposed to listen to their general counsel, it's their attorney. But they make the decisions
and if they're not going to make the decisions, then they're the ones who are risk adverse.
So that's the aspect and that's kind of the role.
Because when the day is over, I'm going to go home and have a steak dinner. You guys
might be led away with handcuffs on, but I'm going to go home and have a steak dinner on
that one. Before we get started, there are a couple
cases I always like to point out. The United States versus Proctor was the courts recognizing
that computer security professionals are a special skilled group. Proctor had the right
to remain silent but he didn't have the ability. He gave a nice detailed confession, to which
the Judge elevated his sentence and said you've got special skills and the Court's going to
recognize that, though that's probably not a great thing on the computer security side.
There is an Ishing wifi case that came out. Now it's a civil case and it's one of those
patent trolling cases, In re Innovacio, from this aspect. They're suing coffeehouses and
people that are using WiFi. And it's that wonderful legitimate suit where, you know,
basically you send the coffeehouse a notice saying for $7,000 I'll go away or we're going
to sue you. And they did it to 7100 hotels, coffee shops. And they had a motion to enter
how they were going about sniffing and grabbing the communications going across the WiFi.
And how it worked was they were using --> grabbing data packets going over the unencrypted WiFi,
using things that are readily accessible to the general public, and that the sniffing
protocol they were using again was available to the general public. And the court was basically
saying it falls under the wire tap exception and so there is no problem with them doing
this. You can have, with the proper foundation, this evidence can come in.
So what they were doing is they were using a Riverbed Air PCAP packet capture adapter
for 700 bucks. Wire shark. So with the laptop software and the packet capture adapter, they
could get any communications, as long as they were in range. All of these things are provided
by commercial providers. And so it didn't violate the wire tap statute.
Now this is kind of interesting, meaning so back in the day --> and the way with technology
being generally available to people, it came back out of a case called Kila where DEA looked
into a house using thermal imaging. The court said no, that is not technology that's readily
available to the public. They don't have their own helicopters with their own thermal imaging
radar, so we're not going ot let you do that. God, you know, what you folks are doing now
and the technology that's available to the general public, it is a very interesting area
where we're going into in terms of what you can sit there and sniff and grab that courts
are holding not a violation of the Electronic Communication Privacy Act. And of course he
said the public's lack of awareness of this was irrelevant.
So it's an interesting civil case that's out there. It's not a criminal case that's out
there, but it was kind of interesting. The constitution, pretty damn good document
to run a country of 350 million people or so, written in 1787, and then what happened
next were computers. Well, DOJ set up the computer crime unit in 1991. There's a little
gap there on that. And a little bit before that, they did the Computer Fraud Act.
So how does this law stuff apply to we the geeks from that aspect? Now on the constitution,
there is the Article 2 powers are the President's powers, so it's kind of an interesting aspect.
There is a little known footnote in here that you've got to kind of look for that Madison
put in there. You know, he envisioned people like Jobs inventing communication devices
that were incredible. So under the Article 2 powers, the President can conduct a peer
network operations. He goes I don't know what a computer is, but I'm sure it's going to
be important in a couple years and please keep an eye on the IRS for us.
(laughter) So legal aspects of computer network defense.
We had a preconversation up front here. We were talking about some certain things. An
important lessen learned which is relevant to the area we're in right now, and this is
very true, bad legal advice put OJ in jail. It was an interesting aspect where again he
wanted to get his property back and his lawyer told him, hey, if you don't breech the peace,
don't use force, you can go get your property. Of course, the facts of the case is that he
went there with a couple buddies that had guns, breeching the peace, and he's in jail.
And so basically he kind of needs that number right there.
If you are out there, I've seen some of the attendees doing things, this is a valid number,
you may want to jot this down for the weekend on that.
So, again, I am not your lawyer. When I try to come up with a topic for DEF CON, I want
to make sure that it is relevant to what's going on. And this IP Commission report just
came out recently, and it was interesting from an aspect of again the DOJ had a chance
to put in there that they say hacking back is illegal. So don't do it. The report was
written by Dennis Blair, who was the first DNI director, and Huntsman who used to be
the ambassador to China. The report really said that hey, if I can retrieve my digital
property without damaging that person's computers, I should be able to do that. So we're talking
about self defense. There are 21 state constitutions that say
that you have a constitutional right to defend your property on that. It is recognized in
common law and goes back a long time that you have the right to defend yourself and
your property, from that aspect. And it kind of flows into this thing called trespass to
chattel. Now the Intel versus Hamadi case was that blasting of emails to Intel by Hamadi.
And one of the things that the court said was we favor in this area trespass prevention
over post-trespass recovery. That's kind of the theme of what we're going to be talking
about here. We're going to be talking about those things you do ahead of time so you don't
have to do post-trespass recovery. The active defense scenario obviously is going to be
a post-trespass recovery scenario as we go down there.
Self defense, you have to be in a place you have the right to be. A whole bunch of other
factors that go with it. But you've really got to be in that place that you have a right
to be. It is not unlimited for property. You can't usually use deadly force to defend your
property, under certain circumstances. That actually will come back into play. So you've
got to be in a place you have the right to be with all the factors that go in there.
We were also talking earlier about if we were going to do this, you know, who are the experts
we listen to. Stewart Baker, formerly of Steptoe and Johnson, actually he is with them now,
is quite the advocate that you should be able to hack back. And I was at the FC conference
in Maryland and he offered to represent anyone who did it and was prosecuted by the DOJ,
for free. Now, you can call him p and say hey, I heard from this guy --> and he might
hang up on you, but that's what I heard. Orin Kerr who is a professor at George Washington
University and who writes the book on computer crime has pointblank said I don't think there
is a digital self-help as the way things stand right now. So sorry to ruin that for you for
where we're going to go with our scenario, but if it's me and I'm going to be prosecuted,
I'm going to get Jennifer Granick or Orin Kerr to represent me. And both of them have
there is no digital self-help, you know, self-help defense here.
Jennifer was on Patrick Gray's Risky Business pod cast 272 talking about this extensively.
And, again, she said there is no digital self defense.
So what you've got to do as we're talking about building that case of reasonableness,
what are those things you're going to do that are necessary and reasonable. So when we're
building that case of reasonableness, you've got to think what are the things you're doing
to secure and defend. And it's that aspect of technology, your open source and situational
awareness, intelligence, your policies, your training, information control, active defense
things you may need to do, which might be deception, recovery operations. You know,
the stopping the pain aspects on life. And what is the one thing that was missing
from all those slides that is extremely important to DOJ? Previous and ongoing coordination
with law enforcement agencies. And why is this important? Because if you're planning
on doing this, in reality, why are you preparing for this? Because you're trying to convince
DOJ not to prosecute you or any other type of law enforcement agency or prosecutorial
office to prosecute you. What are the things I did ahead of time that were reasonable that
I had to take the next step. Or worse case scenario, you're going to have to try to convince
a Judge or jury that you have a self defense claim.
So the reality and the practicality of this is simply DOJ is always and has always been
taking a hard look at this and a hard stance on this. Until the law is amended, they feel
that this is a crime. Now, don't blame DOJ. You don't beat the monkey
if the organ grinder is not present. Go see Congress, because Congress is the ones that
is responsible to amend the law for that aspect of it.
So the requirements for self defense, or a necessity defense, require that there are
no other lawful means available. Meaning you've gone to CNLEA. All your remedies have been
exhausted, meaning no law enforcement, the civil lawsuits have been filed on that. And
I go back to this prosecuting computer crimes manual that DOJ has had out for a long time.
Again, doing so may be illegal regardless of your motive.
The other aspect for you all that I've had conversations with some techies on, it's the
aspect of resource intensive. So if you've got this honeypot with a bunch of fake documents
in there and they say no, the big problem with this is my clients can't manage their
real stuff and now you want them to have a bunch of fake stuff on there? I don't have
time managing the real stuff. So this is very resource intensive from my perspective. So
I don't think it's a mom and pop shop thing that they're going to be doing.
I did government contract litigation and we had a lot of mom and pop third-party suppliers.
I can't see they're the ones doing this. It has got to be somebody that's got a lot of
resources to dive into this. So building that case of reasonableness, the
things I think you need to do so you can actually get to that active defense scenario.
There's the technology you've go to have in place. And you guys, I'm talking to the experts
that know all of that. So you're talking about your different, you know, your firewalls,
your intrusion systems, realtime network awareness, SL proxy things, your logging, your monitoring
on that. And you've got some honeypots flowing from that aspect. So you're doing all this.
And of course legally you can do this, because to do this you've got to comply with the law,
which would be the wire tap statute. So you're either getting consent of your users through
log-ins or banners from that aspect on life, or you're doing it in the service providers
aspect, with the exception to the wire tap statute that says hey, it's my property. I
can defend it. It's necessary to the defense of the property. And these are the cases that
came out of the Blue Box cases, where they had to find out --> you know, after taking
the whistle out of the Captain Crunch box. It's back in the way where they recorded the
beginning part of the conversations, half of it and all of it. And when the cases got
to the court, the Judge said okay, you recorded the front part of it, that was tailored. You
identified what the phone number was. Those are going to go forward. And when they recorded
more of the conversation, like half of it, where the prosecutor could submit why they
needed to record half of it, those cases went forward. And if they couldn't, they were thrown
out. And pretty much when they recorded the whole thing, the Judge said you didn't tailor
this at all, we're throwing this out. So now how do you tailor computer network
defense? How do you tailor your intrusion detection systems? It's not like I can record
the first part of a three-way handshake. And kind of, in my opinion, it means like I'm
going to run my snort sensors out there and I'm going to grab everything. You know, see
how much my storage space is going to have, whether this is overwritten in 4 hours or
whether it stays on there for 30 days. And when I get my alerts I can go back and grab
the information and take a look at it to review my computer security. So from that aspect
that seems reasonable. It's tailored. And there hasn't been an argument or a debate
on that aspect of it from the technology speaking aspect.
When I talk to techies, I always ask one thing. Why aren't the crown jewels, air gapped off
and why aren't they encrypted in data at rest? Again, being the lawyer and the stupid one
in the room, I'm thinking okay, it has got to be expensive, it's got to take time, it's
got to slow things down. And I've actually had techies come back and go no, not so much.
So if I'm wrong at that, please tell me on that aspect of it. But I'm always curious
at why the crown jewels of a company aren't separated off, air gapped, and aren't things
in place to protect them? Again, steps that are reasonable to defend the information that
you want to do. I did mention beacons before. I will note
that DOJ has a --> again, it's one of the absurdities of law, the way it's written. If you're not
an electronic service provider, you can't do beacons. It's a strange thing on that.
Again, that's something I'm hoping that the ABA task force report will talk about as we
go down the road. Pen testing and red teaming. One of the things
you need to be kind of concerned about actually is the Landem Act. It's a national system
for trademark registration to protect your trademarks from either consumer confusion
or dilution. And that means if you're using that mark and it reduces people's perception
of it, you can have a problem. Why would this come into this field? So you have --> you go
to your lawyer and you go hey, we want to do spear fishing. Okay. And Beyonce's concert
is coming up, so we want to send that out to our employees that for $45 if you click
here, you can get $45 tickets front row to Beyonce. Is that a problem? The lawyer doesn't
know much about technology. He's busy with other things, so he says go ahead. So they
ahead and they sent that out. The next thing you know they forward it to two friends and
they forward it to two friends and they forward it to two friends and it goes outside your
network and now everyone's sitting there going wow, we can get Beyonce tickets for $45.
And Beyonce's attorney comes knocking at your door going who the hell are you and what the
hell you doing? So that's the aspect. If you don't plan for these things and make them
so they can't get released into the wild, you can have a problem here.
Now, I am not a Landem Act attorney. And before you blast me to the evaluation boards and
everything, you need to understand one thing. You're going to go hire the law firm of Dewey,
Cheatem and Howe. And they're going to give you their legal advice for what you need to
do, and there are a whole bunch of people in this law firm. And one of the branches
you're going to have to go see is the Landem Act branch to talk to them about this and
how to go about doing that. So that's one situation in your law firm that you're going
to have to deal with. Intelligence and situational awareness. You've
got to know what's going on out there. So you've got your open source intelligence,
where you're going to have your bulletins from the OSERT. You're going to hire a commercial
company to give you added intelligence on that. Because we know the Government doesn't
get anything first. And so you're going to get that private information there. You're
going to do active business intelligence, which you're going to do that competitive
intelligence. And you've got to be careful not to step on the side of economic espionage.
Economic espionage. So that's set up to protect trade secrets and information. Again, in the
time of this high technology information age. So a couple things. It's getting that information
without authority. You know, you kind of kwow when you got it without authority, and then
the trade secrets. Now. Good old dog and Christian here kind
of wrote an article dealing with looking at these aspects of economic espionage. And they
say hey, it's a very broad topic. And you've got to kind of be aware of it. You can get
into trouble when you're doing this aspects of getting open source intelligence. Some
lawful means of going out and grabbing information can in fact become misappropriation. And so
you've got to be careful because that combination of all that public information could get you
into trouble. Again, this is kind of dogging Christian's take on this.
Now, there is a case out there that kind of said look, possession of open source information
or readily ascertainable information is clearly not espionage. So you've got some case law
on your side there. But Bill Bradford kind of went down this path
and was talking about the different aspects of economic espionage when he was looking
at firms routinely getting this stuff. And that practice of getting open source publicly
available information for that. So what are you talking about? The desired information
you're looking at. You know, research plans, R&D, things of nature, strategies out there,
publicly available information. You're looking at, you know, common ways to
do this. Data mining, patent. I like the psychological modeling of rival executives. I think that's
kind of neat. That's like my wife wants me to have that done, too. So there's that.
Areas that kind of raised some questions that he looked at when you're talking about ethical
questions was interesting. Because he was like appropriating documents that are misplaced
by rivals, which gets into okay, if I've got an iPhone left behind, if you go to your lawyer
and say hey, I found this. Oh, abandoned property. Hey, it's abandoned. There are no rights to
that property anymore. Let's rip it apart. Okay. Well, there might be that theory.
He talks about overhearing rivals, executives. You know, I'm a fan of if you come talk to
me about this one, I'm like hey, that is misplaced trust. I mean, that's the third party doctrine
where if you're going to say something, broadcasting it out. You know, again, these are areas where
it could raise ethical questions, not quite blank illegal.
Hiring employees away from rivals, you've got a Computer Fraud And Abuse Act thing that
really comes into play on that one you've got to be careful on.
And I love the dumpster diving aspect on life. Because actually there are some court cases
out there that once you put your trash out by the curb, anybody can go diving into it
as much as they want. Those areas that are clearly illegal, yeah,
the kind of stuff that you all are really good at on that, and so you've got to be careful
on those things. Again, I'm not an economic espionage lawyer,
so you're going to go to your law firm of Dewey, Cheatem and Howe. You're going to go
up to the economic espionage branch and say: Here is what I'm planning on doing on this.
You know, what do you think? And you've got to take them through step by step those things
that you're going to do. Ironically enough there was a case that came
out just a while ago, the Lenikov case. A lot of times when you read facts or opinions
on a case, they kind of tell you where they're going as you go through them. So Serge was
a computer programmer for Goldman Sachs. He was responsible for one of their high end
important aspects. And it did market developments. It was proprietary information and he was
one of 25 programmers in the highest paid at $400,000. And this was where the facts
get fun, and he's going to be hired at a competitor for a million bucks.
So we can kind of see where things are going, especially when the court says on his last
day of employment, and then it gets better, just before his going away party going, he
decided to give himself a little gift, which was 500,000 lines of code. He sent that off
to Germany and then downloaded it later from Germany. And of course he deleted everything
that he did. And of course he's surprised when he has a "who farted" look when they
come around and arrest him. You're kidding? And he ends up getting convicted of economic
espionage for stealing the source code. Well, he appeals this on the --> at the appellate
level. The appellate court held that this was not a violation of the Economic Espionage
Act. So before you think about going and doing that, it's been modified and amended to take
that into consideration, so don't go do that. The next area of reasonableness and things
you need to do prior to going and hacking someone's computer, your information insurance
policies and training. The big aspect on this is having them in place. You have got your
banners and user agreements. Being consistent with then and enforcing them when something
goes wrong. So especially with the insider threat aspect, if you're going to do a civil
suit for computer fraud and abuse, were employees being disciplined for violating these different
procedures? So you want to make sure that you're enforcing these policies and you're
actually on top of them. Information control. It's the stuff you all
know about. It's the access lists, encryption, digital rights management. Again, another
step for reasonableness. So if I have got to be in front of a Judge, I can say here
are all the things I did before I had to actually go and retrieve my property.
The deception piece is a very interesting aspect. When you get a bunch of lawyers sitting
around just talking this stuff around, somebody invariably will bring something up like, hey,
did anybody ever think about the SEC? And you're like what the hell does the SEC have
to do with a deception plan aspect? The companies have responsibilities to actually do reporting.
And thanks to good old Reid Hastings and Netflix, you know, the SEC said we can come out and
we can investigate anything that we want that we think is a possible violation of the SEC
laws. Now I'm not an SEC attorney and I don't want to be an SEC attorney. So you're going
to go over to Dewey, Cheatem and Howe and go over to the SEC branch to start getting
their advice. Now, the disclosure piece on this becomes
a very interesting aspect when you're in this area. So you want to do a deception plan,
so you're going to have things out there internal to your network that is not going to be out
there, that are wrong, that are erroneous, that are deception. So it's no intent. You're
not going to make this public. Then they're stolen and they're leaked to the media.
Is this a disclosure that you've made? I know, they're stolen. They are leaked to the media,
you know, is this an SEC violation or not? I really don't know. Tell me how it works
out when you're in front of SEC attorneys. Because When you're talking about deception
plans or deception examples, what are you going to be putting out there?
Requests for proposals. Now, those could be your requests for proposals that you're putting
out to your suppliers. Or they could be requests for proposals that you have received as you're
doing your bid preparations. So you're putting false information out there, on there, to
be grabbed by your competitors so they don't know what you're doing.
Blueprints and designs. All right. Minor defects. We went back and we said self defense of property,
you can't harm somebody when you're going to defend your property. So it's a minor defect
or a major defect. Are you going to cause harm? If it's a product that has engineering
aspects of it, if it's computer code and somebody looks at it and downloads it and melts their
server, are you liable? If it's a car and the brakes don't work, are you liable? So
these are all things that you need to talk to your folks about when you're planning on
doing this. Business plans and financial records. Again,
you're sitting around. I'm not a mergers and acquisitions guy, but somebody comes up and
goes whoa! Wait! Mergers and acquisitions. You've got information about other people's
real companies in here, and if that's stolen and leaked to the media that could harm them.
What if they come knocking on your door saying this was your document. It's not true. I've
suffered a harm. I want some money from you. Now, your lawyers are going to say --> again,
being risk adverse --> I don't want to invite litigation in from this aspect. So you're
going to have to be very specific as you go through this, talking to your attorneys. You
know, how you're going to protect this from happening.
Joke. Because I need a thinking break. Okay. So NSA is going to store a whole bunch --> yes,
it's controversial. So all of the aspects of terabytes, petabytes, zettabytes, yottabytes.
So I don't know --> so I was wondering, what's a zettabyte? Well, I dated a Zeta at Michigan,
so talk to me afterwards about that. A petabyte. Do you realize if you Google the
site of peta, like this is the cleanist image you can actually put on a conference like
this. So I guess that's a petabyte. And obviously the yottabyte is easy. You have that yottabyte,
you have that yottabyte. And if that's not enough, then you'll have a stream all over.
So I don't have a sponsor. So, active defense.
Actually, I did have a sponsor, but I don't want to get into trouble. Ask me afterwards.
Active defense. Recovery operations. The Kobayaski Maru. I do like the new Star Trek. I like
the old one, but I like the new one, too. There is a certain aspect of a no win situation
when you're dealing with this. So I had colleagues ask are you going to actually talk about Clark's
law that nobody has ever heard of? And I'm like yeah, I am.
Clark's law. Get your attorneys involved early and often. Explain the technology to them
at a third grade level so they can understand it. Because they're going to have to turn
to a Judge, jury, or seniors leaders and explain it at a first grade level.
So it is very important --> no. You're all smart, so you're going to hire good lawyers
that have been very well trained to be analytical, to be able to ask the right questions on this
aspect. And that's what lawyers should be trained to do. Be analytical and ask the right
questions. So when you're explaining the technology to
them, you're walking them through that at that third grade level and they should be
able to ask the questions and really understand it.
There's another aspect of Clark's law. Because my active defense scenario, I am not a PowerPoint
ranger so I have some very simplistic graphics to go through our active defense scenario.
So we have our intruder. He's going through the innocent third-party, over to the victim.
He's going to ex-fill some information over to an open FTP server. He has his other boxes,
his other hop-in point, and he's going to download the information from there. So that's
kind of our scenario for our active defense scenario aspect on life.
So what can I do? You know, the aspect on logging. Yeah, we can can log until the cows
come home. You can log that third-party coming in. You're going to kind of look, see has
this third-party touched me before? What have I got from my records? So logging is a piece
of cake from that aspect. The FTP server. Do you log the exfiltration
of data going out? I'm getting ahead of myself because I'm going to knock off the exigent
circumstances right now. I always get the argument, but they went to my R&D shop and
got all of the documents and took out a terabyte of stuff, I have got to go after it and get
it. All right. Fine. Then your lawyer needs to ask a question, you saw them do that. When
they exfilled the documents, what were the documents? Most of the time we're finding
out that they encrypted them so you have no clue what was taken. Now you do have --> part
of an argument to say yeah, but I know it came from my R&D section, as opposed to just
HR, which is probably nothing but Social Security numbers and personal information. Who cares
about that? This is the company over here. So the circumstances of having to go after
it, it's kind of a challenge on that. But you see on your logs that they went to your
FTP server out there, and you can get that from your logs.
Now, can you see the intruder on the FTP server? It's an open FTP server. Now this is the part
when Marsha Hoffman from EFF was talking at Black Hat, and she said the Computer Fraud
And Abuse Act is kind of vague when it starts getting into the aspect of without authority
or in excess of your authority. Yes, the Computer Fraud and Abuse Act is vague. But I hate to
go to the definition that I use for my children, you know what the right choice is. Are you
in a place that you have a right to be? And it kind of comes down to that. If you're in
that gray area, you going to want to make sure you're in a place you have a right to
be. So that FTP server, when you get in there,
if it's open and you can log on there, go ahead. Hop on there. See where your files
are from that aspect. I'm not aware of logs of somebody else logging into the FTP server
is usually something you can see. So usually you're going to have to elevate your privileges
to see those logs from the FTP server to get to the intruder. Now, if that's the case then
you've probably exceeded your authorities and that access that you had, and that's probably
count one of the Computer Fraud and Abuse Act, be that as it may.
We're going to cruise along here because I want to talk about deleting data. So can you
delete the data on an FTP server? If I'm in an open FTP, you can log in, I can log in,
you can log in, anybody can get on. I think that, if we're all in agreement, I'm in a
place I have a right to be. Would that be correct? Okay.
There are files on there. They are available. I can open them up and look at them. You can
open them up and look at them. I can download them, I can upload them. Again, is that kind
of the way it's set up? Can I delete files that are uploaded by somebody
else on there? Yes or no. Is the answer --> if the answer is both, then say both. To my world,
it's typically no. Now this is probably one of the stupidest, silliest things. My files
have been stolen. Uploaded there by somebody else. It's my property that was taken. I'm
in a place I have a right to be. Can I delete those files? Logic says hell yeah, they're
my files. Yes. But if I don't have that authority to delete files on that server, arguably,
I don't have that authority. What am I going to do? Go talk to your attorney and don't
tell me. From that aspect, you know, it's an argument
of whether I can delete that information or not. Can I go to the intruder and delete that
information that I've seen him take off of there, a closed, protected computer? I have
no authority to be on that box. So from that aspect, like I said, if you're going to do
this, go talk to your attorneys from that part and see how it works.
What if that's an innocent third party over there? And what if you go to your and say
we went to the FTP server, our documents went out, and they're being stored by that party
box, can I get the logs from that? On an innocent third-party box. Can I go touch that box?
And this innocent third-party, they don't even know it's there. How do they know it's
not there? Because they've got terabytes of data there. There's a bunch of movies on there,
a bunch of stuff on there. There's no way they know what's on their system. Let's just
go in there, take our stuff off and away we go. Well, again, the best way to do it is
contact the third party and get consent. Any time you get consent --> hear, talk to any
law enforcement officer. Consent? Yeah, great, let's go. Any time you get consent, that's
the way to go for it when you're talking about that.
Can you go back and trace them back? No. Say you've got an innocent third-party, and they
let you into their logs, and you get back over to that intruder there, again we're still
in that same situation where we're stuck. You know, have you gone to law enforcement?
Is law enforcement involved? Can they get there fast enough from that aspect? If it
is a protected box, typically I cannot go there and get that information.
Deleting the data --> I want to move to if it's a closed FTP server. If this is a closed
FTP server and you see what the log-in information is from your logs, can you go hop on it? Yes
or no. I hear some nos. So when we listen to NSA and EFF up here, they talk about Smith
versus Maryland. That's that case where when I give my phone record to the phone company,
I've exposed it to a third party, I've got no expectation of privacy in that. If I give
you my log-in information, what's the difference? Here's the aspect. So you've got the log-on
information. It was exposed to you. I now know it. Why can't I use it? All right. So
you borrow --> you loan to your neighbor your baseball mit, some property. And you want
to get it back. And you go to their house and they have got a cipher lock on their door.
Now they gave you that code because your kid had to take care of their cat. So you had
the authority to go over to take care of the cat and use it. Do you have the authority
to go over to your neighbor's house to get your baseball mitt back by using that cipher
code at that particular time? No. Typically you don't. You're in your post trespass recovery
phase from this aspect of it. It's the OJ Simpson, don't breach the peace. Don't do
anything. I mean, that's the aspects of it. So when you go talk to your lawyers about
this aspect, you're going to say here's the information I've got. Anybody can log into
it using this information. Why can't I log into it and using this information and go
do it? Again, these are all these gray areas, this
is the great part on providing the advice, because then you get to make the decision
and if it's wrong you're led away in hand cuffs, and I'm having a steak dinner. And
I won't have you as a client anymore. But, at least I had my steak dinner.
So clearly when we're talking about these areas, they're very fact specific. And so
it's kind of difficult to try to get to the questions on it. If a fact changes, it changes
what you can and cannot do. So you need to get involved with your attorneys as you're
walking through this. And, you know, obviously doing this requires good computer network
exploitation in terms of your attribution and your log-ins that you've got for this.
You know, there is an aspect that I always get to as far as stopping the pain when you're
dealing with a denial of service tack. The part that I would say you really want to look
at for this is DOJ has done the Coroflood botnet takedown, and those documents are all
publicly available. And the steps that they go through to be able to do this kind of gives
you a blueprint for how to legally do it. And of course they are doing it with the courts
involved from that aspect. So if you're curious about doing that part of it, the DOJ documents
that are publicly available out there are a good starting point to take a look at that.
As I mentioned before, the IP Commission report talks about a lot of different areas that
you may want to do this. And the American Bar Association is going to be coming out
with their report down the road. Here is the big thing, and Jeff Moss talks
about this down the road. If you're going to do stuff like this, you need to get a good
team of lawyers. Jeff is actually a fan. I've been at talks where he is like we need more
lawyers who do this to advance this. Not that anybody really likes lawyers. Be that as it
may, you're really going to need a good team of lawyers to do this. Or if you're really
going to do this, you just need one really good lawyer on that.
So with that said, I will be going to a Q and A session, I've got three minutes for
questions right now, from what I understand. So if there's any questions, I'll be hanging
out up here. Thank you for coming. I hope you got a golden
nugget out of this. If not, I hope there was a joke that you laughed at.
Thank you. (Applause)