>> So, as a speaker, it's very difficult to come to DEF CON and watch really terrific talks and not develop some sense of speaker envy, you know.  So this is a very humbling thing to do, and even though this is my 6th  year doing this, it's nothing I take lightly, and it's a great honor to be with you guys doing this, so I'd just like to thank the goons that do speaker opps for make a really great experience as a speaker.  Every year at DEF CON, something new happens and I had a new experience this year.  I want to thank the people at black hat, as well.  I decided to come to the Rio on Thursday to pick up my credentials and went home, I live here in Vegas and I very innocently took out my materials and I sat down my black hat badge on my dining room table and put my DEF CON bag next to it and I looked at it and I go this is really interesting and I did a tweet, you know, the difference between black hat and DEF CON in one picture and I this that was amusing, I didn't think it was bad amusing.  Well, between re‑ tweets and favorites and whatnot, this got reposted like 700 times on Twitter, so my phone was doing this for almost the entire Con, it was like warm ‑ ‑  that was a cool experience, a very cool experience.  So my name is Michael Schrank, I have a book, I will be doing a book signing, if you have questions, we can book up, I don't tell people I write bot nets and bots any more, I didn't tell people I do that any more because I'm ear met with blank stares or looks of horror, so now I just tell people I do business intelligence, and that seems to have a better story for people.  I've been doing DEF CON since 97, DEF CON 5 was my first one and I came out here to cover it for a computer world magazine, it was the first article that I've ever had published and I started thinking this weekend about the effect DEF CON has had on my life, if I hadn't come out here for that, I would have never been published, I would have never got a book deal, all of the things that came after the book, all the foreign travel, the speaking opportunities, the gigs I probably didn't deserve, if DEF CON hadn't made me come out to Vegas once a year for 17 years I probably never would have moved here, you know, so it's an awesome thing, a very awesome thing.
So today, what I'm going to talk about, the name of the talk is your leaking trade secrets, but what I'm really talking about is organization of privacy, and it's a little bit different than personal privacy, because individuals tend to leak identity issues whereas organizations tend to leak trade secrets.
So the message I want you to have coming out of here is information that you put online, on the web, is not always read by the intended audience and it's not always used the way it's intended to be used now, there's been a lot of awareness about personal privacy but there's been much less awareness about organizational privacy and I think that's largely because of the way the media handles it.  The media's been roll good at informing people about things but less good about informing our organizations, and I think a lost that is the types of stories they cover.  So in the case of leaked trade secrets, these kinds of stories are always treated as news stories, they're factual, but they don't really teach any lessons.  Whereas, you know, there are other reasons I think for the press covering personal privacy issues.  For example, the one thing, it creates a lot of customers for a lot of advertisers so it makes good business sense to do that kind of thing.  The other thing is it is just really good content.  One of my favorite stories about a personal leak, about a year ago, that there was a head master at a Privilege School, I believe it's in Georgia, who was let go.  And he felt he was let go for the wrong reason, he felt it was age discrimination, so he filed a suit, they settled out of court, stipulation that he never talked about 9 case about what does his daughter do she gets on Facebook, she lets her know that the case was settled and they were paying for her trip to Europe.
The other story like is if you're a soldier and you're stationed someplace where your government says you're not, you can probably removed the GEO codes off your selfie before you upload it to Instagram, I love that one, but these are great because they teach lessons.  And the lesson that this should be teaching all of us is that there is not a piece of software, there's not a piece of hardware that can protect against this kind of stuff.  It's an awareness thing, and there's really no substitute for awareness.
So one of the things I'm going to do is we're talking about trade secret, I've got examples of unintentional data leaks and this is really all about business intelligence, because if it wasn't somebody doing things with these leaks, they really wouldn't matter, right, so we're going to look at little bit about how online intelligence is different than offline intelligence.  But then finally, we're going to talk a little bit about what can be done to minimize the effects of all of this kind of stuff.
So what is the trade secret?  Trade secrets are intellectual property but they're very different than patents and very different than copyrights.  The biggest difference is that you don't need to publish a trade secret, and if you did publish one, it would not be a trade secret any more, so that's obvious.  Unlike patents and copyrights, they have absolutely no expiration date and they're protected by something called the UTSA, and this came about, I believe '70s or '80s unlike patents or copyrights, there were no laws.  All but one or two states have signed off on this, but it used to be an issue because if it were a big company and you had offices across the country, you would subject to the various trade secret laws in those various states, so this simplified things quite a bit.
In order to be a trade secret, it must have some kind of economic value.  The interesting thing that I think about trade secrets is that you can use anybody's trade secret if you happen to discover it on your own.  So if you find it on a piece of paper on a sidewalk, you can use it.  If you find it in wiki leaks, you can use it.  If you discover it through reverse engineering, you can use it.  If you discover it.  So what is the value of a trade secret?  Well, basically  ‑ ‑  oh one other thing I think I forgot to mention is you have to make some effort to protect it, that's the other thing, you can't just come back retro actively and say that's a strayed secret, that doesn't work.  The reason you established trade secrets is so you can sue people and recovery losses and damages and attorneys fees and that kind of stuff.  But only if somebody misappropriates the trade secret.  If you lose it through your own stupidity, it's our own fault.
So when people think about trade secrets they automatically think about things like the recipe for Coca‑ Cola or the formula for a fragrance like Chanel number 5.  The interesting things about fragrances is you can't copyright or patent a fragrance but you can have a trade secret over the formula, so if you go in Walgreens and find a knock off, they're perfectly legal because you can't copyright or patent a fragrance, but you can trade secret the process or the recipe.
A lot of times, trade secrets are used in conjunction with patents, so you might have some patent, but the way you implement those patents is some kind of a process that's protected by trade secrets.  But today, more often, trade secrets take the form of data, and I just listed a few of these here, you know, things like your list of your employee, your list of your suppliers, customer lists, funding sources, expansion plan, marketing plans, new product planning, pricing strategy, labor issues, how quickly things move in and out of your inventory, how fast thing sell, IT infrastructure change, security information, this is all data and these are all straight secrets and in your organization, you should treat these as secrets.
And every try is going to have a different one.  There's no  ‑ ‑  I mean, depending on what you're doing you're going to have different things that you're going to call trade secrets.
For example, in the European Union, they have much more progressive privacy laws than we have here in the states, and in the EU, if somebody is collecting personal data, you have a right to go to that organization and say what is the data that you're collecting on me?  And they have to show it to you.  Well, somebody in I believe Ireland approached Facebook and says I want all my data, I want to know what you're collecting on me, Facebook used a little exemption in the law that said if through the disclosure you're going to show trade secret, you're exempt from the law and Facebook said hey, that's us, that's us.  And these are all the trade secrets that Facebook wanted to protect.  And I'm not putting these up here for you to read them, I'm just showing you there were 22 of them, a lot of them and they included things like, you know, if you delete an image, we just erase the pointer, it's still really there.  If you poke somebody, we record that.  You know, all that kind of stuff.
And they were saying if you have your data, you're essentially learning about what we do with that data, since we buy the nature of that data, so data has become a trade secret.  So we've got all of these potential trade secrets now and they're all floating around on the Internet and this has really changed the way business intelligence is collected.  For example, before 1995, and I use 1995, because for me, that's kind of when the Internet [indiscernible] a little bit, before 1995, all the web pages looked like [indiscernible] web pages and things have just matured a little bit there, so before 95, you had to do things like this guy, this is Mitch Modell, the CEO of Modell sporting goods and he was accused of the following:  He dressed up as a disguise, misrepresented himself at dick's sporting goods, told the receptionist that he was an executive for Dick's and he was waiting for a meetings with the CEO and she preceded to show him room where there was a lot of files and he started particular pictures and he was just helping himself to information.  What makes this story really weird is that the same guy was also on undercover boss on CBS where he basically did the same thing except for his own employees so he was really into this.  But this is the way intelligence was often gathered prior to the Internet.
So before 1995, there were limited number of sources, you know, where are you going to go?  You can go look at the patent files, you looked at newspaper, maybe subscribed clipping service, it was manual, it made it a really expensive process, so it's not something that you could do over and over again.  Basically, you would take a no shot of what was happening at a certain time.  It often required physical contact, you know, maybe would go to a conference and get your competitor drunk and talk to him and not tell him who you were, you know.  Probably we've all done that.  So it required physical contact and it often required people to identify themselves or if not identify themselves, occasionally get caught.  So you're anonymity would be blown.  Now after '95  there's almost an unlimited number, I would sigh there is an unlimited number of sources because they keep coming in and out to automate data collection, we can repeat it, do it day after day, you start looking at data collected over time, and you start to analyze trends and do all kinds of cool stuff.  It can be done remotely.  And you can usually  ‑ ‑  it can usually be done anonymously, so this looks a lot like hacking, right?  You can do it remotely, automate it, you can do it anonymously, so basically, business intelligence has now become as far as I'm concerned, the other thing about business intelligence collected online is that it is immediately actionable.  And this evident in my talk last year where I talked about a bot net that wrote about $20  million worth of cars over a period of 9 months, 20  million retail, I did it totally by self.  And this data that we have basically, the inside information we had some inside information on servers that allowed the client to basically buy things at will, and we were able to act on that intelligence immediately.
So through the eyes of a hacker, anything you put online is potential business intelligence.  And that's a really important point.  Again, every industry has its own cases, I picked out a few that I think we can all relate to.  All right.  So imagine the plight of an online retailer, this is what they're thinking, I need to keep my online store up to date and I need to keep up with what's happening with competitors as far as pricing, so I need to respond to my market basically.  So a hacker looks at that and says hey, I can watch the store remotely, I can do it anonymously and I can automate the information gathering.  So if I monitor a retail site and you do it over time it's possible to leak pricing strategies, you start to figure things out, you can Figure out inventory strategies, you have items coming and going, I can't is that?  Why is this no longer offered?  Sometimes they can show supplier issues, right, if it's something you know that they always have but they don't have it now and they really should have it, they're having a supplier issue.  If they come off and they are always having a lower price than you, they are buying it from somebody different or they have a better deal than you have.
The problem is much greater when you are a retailer and selling specific item, oh, so we're not talking Sears now that has an infinite number of T shirts we're talking about a real estate website that has one house on the corner of 3rd  and main, we're talking about  ‑ ‑  SE is a huge business, in excess of a billed a year.  Emerchants tend to sell one item  at a time, you can learn what is a good thing to sell on eBay and watching what sells and for what price.  Used bookstores tend to sell single copies of things, car dealerships, any kind of seller of collectibles, and this group includes anyone selling any kind of uniquely identifiable goods.
So if you watch one of these stores over time, they basically disclose their entire service record, right?  You monitor this long enough, you pretty much have enough information where you can do their accounting.  And this is something that people don't think about.
Okay.  Let's look at  ‑ ‑  I love picking on HR because I think they're probably the biggest source of leaks within an organization.  So let's think about a HR manager, put yourself in their position.  They're thinking this year it's going to be a busy year for us, we have a lot of stuff going on, I need to post 250 job postings.  So that's what they're think, that's what their task is.  The hacker on the other hand thinks, I can watch these job postings remotely, and they can be anonymous while I'm doing it, I can even look like somebody else, I could look like an actual job seeker if I wanted to and I can automate the information gathering.  So what does this do?  Let's just look at a simple job listing here, this is natural listing, I won't tell you the company  ‑ ‑  this is an actual listing, I won't tell you the company it came from, this is a decent job listing, I will show you one that's not sos did but this one is fine, there doesn't seem to be anything wrong with it, we have a new location here, we haven't seen this before, and we have a new skill, that's something they haven't seen before.  If you look at this over time, you're watching this remotely, anonymous, doing the information gather, you can start to grasp things, you can check out when new postings come out and new skills are mentioned, you can look at when new locations are mentioned, it's like oh, yeah, here's did they've never hired a HR contact representative before, I wonder what's going on there, Portuguese?  They haven't needed that before, and an office in Puerto Rico, what's going on here?  And if you look at stuff and how the listings come and go, it starts to paint a narrative where you can start figuring out a company's strategic plans, okay?
I've been in a lot of HR meetings and I've never heard anybody say are we leaking our strategic plans by listing these job I've never heard anybody say that.
Let's look at another one.  I love this example.  I'm going to advertise a vacancy we have for an IT help desk professional, that sounds like a you nice thing to do, a hacker comes along and says can I read between the lines to learn how to compromise your network?  Let's take a look.  This is a recreation of an actual ad, and this was an actual ad from a law firm that I used to deal with, and I saw this published than I got on the phone, talked to one of my friends who was a partner and said you need to take this ad down now!  And so you look at it and it looks fine, you know, it's a law firm, and the company overview, looked at the description, they have an immediate opening for an IT help professional, with remote access tools like PC anywhere and phone dial, this was a few years ago.  Talks about the responsibilities, so yeah, I mean, it looks like a nice little opportunity for somebody.  And you're like whoa, what is this?  They are announcing they have secret, they're a law firm.  Do they have to announce they're a law firm?  No, no.  The IT people you hire for law firms are essentially the same IT people you would hire for any kind of manufacture plant or whatever you.  It's like oh, they have secrets, we know they have secret because their a law firm, we know what kind of secret these have, they do acquisitions.  So if you deal in stocks at all, this might be interesting information, right?  I wonder who's secrets they have, oh, they've got their client list.  So we though they've got secrets, we know what kind of secrets they have, we know who's secrets they are.  Okay.  Let's look a little bit further here.
Never say you have an immediate opening for an IT position like this, because that means there's nobody there now.
[ Laughter ]
>> No one is watching the store.  What kind of social engineering could happen with nobody watching the store, you know?  Oh, they're telling us how to break into their network, they're using PC anywhere and phone dial‑ in system, so you guys remember how that works back in the day, you just started at the bottom of a block of numbers and starting dialing until you get something that sounds like a fax machine and then there's nobody watching the store, get your things ready, because we can automate attacks, right?  The other thing is that they're liking the fact they have problems with remote access.  Okay, so social engineering‑ wise, I mean, yeah.  And the other thing is this was the only IT ad they had advertised and this guy's got way too many responsibilities.  Helping attorneys, you know, working remotely, responsible for network security, software install, license management, policy development, problem has to see do some training along the way, right, this guy is overwhelmed so what can possibly go wrong?  What kind of social engineering things can you think of?  What I would do is call them up and ask them, they will tell me if this job has been filled, oh, yeah, we filled that, great.  You wait for the great to get settled a little bit, you pose as one of these attorneys emote, you're having problems dialing in, it's 2:00  in the afternoon, you've got a surprise hearing at 2:15, want to settle things out of court, you need a paper from the home office so bad, this guy's new, he's going to do everything possible to help you out.  You're in.  So be careful what you put in ad, especially IT ads.
All right.
>> [Off mic].
>> Do you ever go fishing, take a hook out after a fishes mouth that's kind of the response, it's like what?  Really?  Yeah.  Oh, I see.  Okay.  They did take the ad down.  Okay.  Sometimes  ‑ ‑  so basically what we talked about so far is walking websites and building a database over time, changes and whatnot.  Sometimes databases are left in plain sight, and that was what hand here.  This  ‑ ‑  if you Foley elections at all, this was one to watch, because it was so bizarre, it was the senatorial election of 2006 in the state of Minnesota, it was an extraordinarily close election.  It was decided by a few votes after a long period in the court systems.  There was a lot of shenanigans going to ban back and forth, a lost accusations of hacking, a lost servers going down, a lot of things happening but probably the strangest part about this election was the cast of characteristics involved we started out from Frank, probably known from his days in Saturday night live where he was a writer and a cast member for I think 10 years a long time.  Norm Coleman has a really interesting political background, he started off  ‑ ‑  well, his first elected office he was elected mayor of St.  Paul Minnesota, he changed party affiliations and we reelected.  He ran for governor where he was defeated by Jesse Ventura, he was the incumbents in this race and he became the incumbent because his opponent died in a plane crash before the election.  And then there was a third‑ party candidate who did pretty well, he got a half million votes, Dean Barkley and he was most well‑ known for being the political advisor for this guy Jesse Ventura, so it was a very likely election, I believe Ventura was actually the governor during this period.  Of what happened is after the election, after the Norm Coleman had the most votes not enough to keep the recount from happening, after the recount, Al Franken was ahead by three notes, since month later they decided whether or not they were going to count all of the absentee ballots and Al ended up winning by 312 votes.  But like I said, there were all kinds of charges of misappropriation of trade secrets, and in such a close election, any little dirt you have on your opponent or anything is gold.
Well, along the way, somebody came up with a database of Norm Coleman's political correcter, their names, what they did for a living, Social Security numbers, their credit card numbers, and the first thing is we've been hacked, somebody took our database, no, they didn't, they actually put it  ‑ ‑ 
[ Laughter ] 
>> [Off mic].
>> They compressed it and put it in a directory that was unprotected on their website.  If you want to hear the story behind this, Richards how a lot of stuff on YouTube about this but basically they just left it there and there's a lot of this going on.  I don't know if you  ‑ ‑  there's a tons of this, one of the things that I do in addition to business intelligence, I do a lot of work with data journalists, primarily in the UK and the Netherlands and I love working with an investigative journalist because they've got a hacker's mind, they think like hackers.  You give them a tool, they run with it, they take all of their background and experience and do all kinds of wonderful things.  I have been doing all kinds of stuff like this.  They were finding like stockbroker's list of clients and how much their funds were and where they had their stuff distributed and they were basically just doing Google hacking is although were doing, just looking for files.
So one other back story to this one that I think is kind of interesting, so I somehow came across this database, and it was just an Excel spread sheet, first thing I did was I imported it into an actual database, where I could do queries on it and I was doing queries on it for a couple of days trying to find out interesting combinations of data, and I had done this before, I mean, I had worked with a lot of European newspapers and stuff, on doing this kind of stuff, mostly from freedom of information act kind of stuff and in had enough information I thought that probably would have been good for probably 3 to 5 stories so I contacted the major news newspaper Minnesota, told them what I had done and the kind of stories they could generate from this and the response I got was we have our own IT department, we really don't need what you have.
All right.  Cool.  Okay.  VNF can be a major source of leaks, and especially when it comes to marketing.  You know, some of you are probably aware of this, but I've got a couple of examples I think that are pretty cool.  So you're a marketing person, you go I need to register so domain names for new products we have.  Well, the hacker comes along and says I have been watching these registrations remotely, I can do it anonymously and I can automate the process.  Or if I have $750, I can just buy this information, a little bit cheaper, and it's true.  You can see that Apple has registered about 4500 domain names and for not a lot of money, you can go and see what they are all.  Do you think Samsung does this?  I'm sure they've got a copy of it, you know.  The thing that I found interesting for this is this particular screen shot I took during an organizational privacy talk in Dublin Ireland for the security forum, so this snapshot was done in March, they had 4,000  ‑ ‑  4544 domains on March  17th.  I did this again earlier on just like last week and they had almost another thousand domains they had checked out.  Do you think there's any intelligence you can gather from those thousand domains?  I'll bet there is.  I'll bet Samsung has that list.
>> [Off mic].
>> They could be doing that, they could be diversions, but there's probably intelligence you could gather from that, as well.  The question was, you know, maybe they're not real domain names but yeah, I think you can probably read between the lines there, too.
So here's another example, this was an example from a data journalism class I taught through the center for investigative journalism in London.  Keep in mind, this is a group of primarily journalist from the UK, they were not Americans, and I asked them, you know, knowing what you know, can you tell me when Sarah Palin gave first real thoughts, first documented thoughts about running for president?  So they were all busy and again, investigative journalists, they're like hackers, and they started looking at DNS records, I didn't tell them to go to DNS records, they just went there and they found this listing by Jay Griffith who after a quick Google search you can find out was her political advisor and he took out the domains Palin for president, Palin 2012, right, that gives you a little bit of an idea of what they were planning, Sarah Palin 2012 a and they were all registered on August  24th  of 2007, that was pretty much a year before she was interviewed and before this ever became  ‑ ‑  before she was ever even a candidate for vice president.  So there were some talk in the past.  So DNS records are like a snapshot of the past like little time capsules.
Employees leak trade secrets all the time, and they'll do it on a personal level, just like that by the number of employees that you have, that's the kind of problems that organizations have.  So if you're a HR director, again, we're taking on HR, they will say the company is only as great as their employees and to succeed I need to train, hire and retain the very best ones, I need to invest some money in them and because of that, trade  ‑ ‑  your list of employees is really a trade secret.  So what does a hacker think?  Oh, I hacker thinks linked in and Twitter is what they think.  Because you can go on to linked in and within a matter of minutes I could probably tell you every  ‑ ‑  for example every new business development person in your company.  And if I triangulate that information with their endorsements, and what they're doing on Twitter, I could tell you who your client list is.  Okay.  That's not information you want to have out.
Sometimes you know, you can't keep people from using media but you can keep them from doing really stupid things.  This is a case where this was actually pretty common, people leaking the code names of top secret NSA projects on their LinkedIn profile.  You know, yeah, this is my experience, I worked on this project.  You know, it's a lot easier to find out things about projects if you know what they're called, right?  And I actually, this is not just snapshot in, this is still going on, you can't keep  ‑ ‑  excuse me, you can't keep people from doing stupid things but you can monitor and keep an eye on things, so what I recommend people doing is use corporate social media accounts for any kind of marketing kind of things that you've got going, in fact, social media accounts are now actually being considered as intellectual property, just the account itself.  There was a case about a year ago where there was a salesperson who was Twitter account very effectively, their followers were their customer base and the name of the Twitter account was something like bob@ABC company, well, Bob@ABC company jumped ship took a job with XYZ company, what does he do, he renames his Twitter handle Bob@XYZ company, takes all of his contacts with him, his former employer sues him and they won and they determined no, that is not yours this belongs to your company.  So to avoid anything like that, use official accounts that you have control over, if you're going to go use social media for marketing.
Now, a lot of leaks you really can't avoid, a lost them are done transparency for regulatory purpose, it's worth watching these things, court record, people pulling building permits, there is a lot of information you can glean by looking all the things like, you know, licensing and you know, FCC filing, that kind of stuff, SEC filings, but you have to make sure your competition [indiscernible] degree that these are problems for yourself it's more about learning about your competitors and what I ask everybody to do is think about what happens if your website is monitored and if all the changes end up in a database some place, would that change what you put on your website?  I think it probably would.
I strongly suggest, especially if you're doing new product stuff, you are picking out new domains for new products, use a proxy, don't do what Apple appears to be doing.  Don't host your own website on your own network.  There was a case if you're in Las  Vegas within the last year, where I believe it was a group associated with anonymous got into the Sans corporation, Sans if you don't live here in Vegas, they own the Venetian and in addition to breaking into their website, they discovered that their website was on their corporate record so that gave them access to HR records which they published and strangely enough, it also gave them access to the network where all the slot machines were.
[ Laughter ]
>> So there is no reason to host your own website on your network.  In fact, I don't think you should host your own website anywhere, you should have an agency do that for you.  There's no reason to do it.  And the most important thing to do, I think, is to get everybody's buy‑ in, the organizational privacy  ‑ ‑  that organizational privacy is important to everybody in the organization.  You know, any one leak basically pulls everybody down, so you need to get everybody's buy‑ in and again, this is a training issue is what it really is.  You need enforceable policy.  How many times have you seen security policies that aren't enforceable?  You know, there's as good as not having did they're worn not having policies because they give you a good feeling.  And when I say enforceable, they should be enforceable through tools, there should be tools enforcing those, you shouldn't need people to do it, you know.  You should be doing your own business intelligence on your own system.
Audit everything that you publish.  Anything that goes out in your website should be audited through some group hopefully that group isn't marketing, because they're empty going to get it, okay?  Because the real important thing here is that security and privacy are not IT functions, they're everybody's responsibility.  IT can't protect you from the nonsense that you showed you here.
Don't disclose a lot of organizational information on every job posting.  It's not even important and in most cases it may you don't even needed to put the name of your company, there's no reason to have job listings on your own corporate website.  There isn't.  I encourage people to use cookies to track their competitors when they're coming to their website and it's good to do cookies and you start to associate cookies of known gateways of your competitors, so that way if you have their cookies, if they're using a laptop or mobile device, if they go somewhere else or go home and go to your website, sometimes people will go to your corporate website and look at different things at home than they might at the job.  So you can really screw with people, too, when you do this.  And I suggested this to a number of clients I've never had one do it but if you're tracking your competitors and you've got their cookies, you can show them whatever you want, you can show them different prices, you can turn it into a recruiting website to recruit from your competitors.  I would love to see somebody do that sometime.
Okay.  To the that's my talk, thanks for coming.  If you have questions, we've got a little bit of time now.  We've 5 minutes, otherwise, rhyme doing a book signing at the no starch booth.  Thank you all for coming.  I appreciate it.
[Applause]
>> [Off mic].
>> I don't know.
>> [Off mic].
>> We're ready for questions here at the mic or are we going to jump right to the desk?
>> [Off mic].
>> Sure.  Your comment about the hacking with the  ‑ ‑ 
>> I'm sorry, what?
>> The casino in Las  Vegas, your comment, your comment and presentation about the casino being hacked.
>> There's a lot of noise.
>> Come on up.
>> I understand that  ‑ ‑  you said that you published donor lists.
>> Not in every case, only certain donors that's my understanding.
>> [Off mic].
>> Okay.  Okay.
>> [Off mic]. oh, yeah.
>> [Off mic].  Well, a lot of it is  ‑ ‑  it was also a political thing.
>> Yeah.
>> [Off mic].
>> Okay.
>> [Off mic].
>> Great advice.
>> Thank you.
>> [Off mic].
>> No, but that's a great identify and this is something that I'm going to publish.  Like I they'd, there's a lot of awareness about this.
>> [Off mic].
>> Most of the things don't really [indiscernible] I mean  ‑ ‑ 
>> [Off mic].
>> She was saying in 2007 about running in 2012.  Oh, I see.
>> Right.
[Voices overlapping]
>> Oh, thank you.
>> [Off mic]. Washington D.C.VIP.
>> Okay. 
>> I'm going a book signing at noon.  Is this still on?  I was asked where the book signing was going to be.
>> I have most idea what I'm supposed to do.  Sort of.
>> Is this on?  Okay. probably, no.  Sometimes I think I do thing better drunk.  I'm not typically good at [indiscernible] I'm good at [indiscernible].  So yeah, I'm not good at single pin picking, I was submitted for DEF CON was for a lock pick game, I've been doing a lot of that recently.  After I leave here, I'm going to go by me some new toys in the vendor room.
We've got about 6 minutes before we talk again.  How many people here understand the basis of how tour functions?  Mostly.  Okay.  I'm going to do a real quick rehash, I'm going to try to limit it to 10 minutes, I have 45 minutes and in want to get to the main dirt.
>> Okay, hi, Scout with speaker opps and it's my pleasure to introduce Adrian.
[Applause]

"This text is being provided in a rough draft format.   Communication Access Realtime Translation (CART) is provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings."