Times and Measures

Comment to the Montana Supreme Court on Metadata

2016-11-23T00:00:00+00:00

Update 2016-11-30

As I wrote in my original post below, I wrote my comment on the assumption that no other comments were going to be filed (not that I wouldn’t welcome them, but it seemed like the bar had other interests). As it happened, four other comments were filed in total:

The Board of Trustees of the State Bar of Montana commented that they are “unpersuaded that being the first in the country to adopt this rule is either necessary or wise.” They went on: “[t]he Trustees are united in the belief that the proposed rule is unnecessary, confusing, and must be rejected.”
The State Bar of Montana Technology Committee stated that “The proposed rule stems from a fear of technology and a fundamental misunderstanding of what is and is not possible.”
The (non-lawyer) IT Program Manager at the State Bar of Montana wrote a short letter encouraging the Court to “ponder whether this rule… achieves the more important function of protecting clients.” He also suggested easy tools to remove unnecessary information from documents.
Finally, the State Bar of Montana Ethics Committee refused to consider changes to their proposal (recommended by the Trustees and the Technology Committee). “The committee foresees technology’s contribution to the erosion of professionalism and standards of courtesy in a rapidly changing bar,” and went on to cite the adoption of the Uniform Bar Exam (a shared bar exam that allows people to apply to multiple bars for admission on the basis of having taken one exam) as background for the rule. As someone admitted to the Montana bar having taken the UBE, this argument does not seem responsive to the concerns that I raised (which the ethics committee had not yet seen) or that the Trustees or Technology Committee raised (which the ethics committee had seen); however, I would invite all readers please to examine this comment (and all of the comments) to see if the argument works for them.

My comment is also on the docket, if anyone wanted proof that I did in fact submit it.

Finally, thanks to the variety of lawyers and non-lawyers who submitted changes, corrections, etc. to my comment; I forgot to thank them in the original blog post, and I feel bad about that. They are awesome.

I will update this post again when I learn what the Court’s decision is.

Original Post

Lawyers are a self-regulating profession; that means that we create the rules that are used to determine whether we’re behaving in a manner consistent with the requirements of professional responsibility and legal ethics. From time to time, then, the rules need to be updated. While the American Bar Association has created its Model Rules of Professional Conduct, those rules have no legal effect (though they have a not-insignificant persuasive effect). Instead, each state has a process by which it proposes and adopts its own rules of professional conduct.

Recently, the State Bar of Montana proposed a set of changes to the Montana rules having to do with technology. Many of those changes are excellent; one, however, gave me some concern. Changes to the rules are proposed to the Montana Supreme Court, who will then often solicit comment on the changes before deciding whether to adopt them. Hence, I submitted a comment, which I have rendered below in HTML; here is the PDF version of the comment.

As of the time I wrote this, no other comments had been received on this particular proposal (Rule 4.4(c)). If you’re curious what other sorts of proposals are being made, or to see other comments, the full docket is here.

The Comment

November 22, 2016

Re: AF 09-0688 - Addition of Rule 4.4(c) to the Rules of Professional Responsibility

Honorable Justices of the Montana Supreme Court,

My name is Brendan Francis O’Connor. I am an attorney admitted to practice in the State of Montana; I am also a researcher and practitioner in the field of computer security.¹ I write to comment from a technical perspective on the proposed addition of a Rule 4.4(c) to the Montana Rules of Professional Responsibility, the text of which is as follows:

“A lawyer shall not knowingly access or use electronically stored information in a communication or document received from another lawyer, for the purpose of discovering protected work product, privileged or other confidential information unless the receiving lawyer has obtained permission to do so from the author of the communication or document. Communication or document as used in this rule excludes documents produced in discovery and information that is the subject of criminal investigation.”

First, the rule, as drafted, does not produce a workable distinction between “electronically stored information” and the content of a document—nor does one exist. It seems likely, from the phrase “electronically stored information in a communication or document” that the drafters mean any information that was not typed at a keyboard by a human being—so-called “metadata.” The issue with restricting document metadata is that there is not a meaningful difference between content and metadata—all of the data in a file is interpreted and used by standard tools in their normal course of operation.

For instance, take the case of a JPEG image.² A digital camera is simply a computer with a specialized light sensor on it.³ When the camera takes a picture, the sensor captures light during the instant that the shutter is open. Once the light has been captured in a temporary format stored in the computer’s memory, the computer adds a large amount of information to the photo to allow it to be interpreted by other computers before saving it. This information, called EXIF data,⁴ often includes the model of camera, the lens used, whether the flash was triggered, the focal length and aperture setting of the camera, and information necessary to display the image (for instance, information about how color is represented in the image, or the image rotation). The information can be very extensive; it may include the serial number of the camera, the location, altitude, and direction of the camera,⁵ and information about how the photo was edited, if the photo was edited at the time it was taken (on the camera) or later (e.g., using Adobe Photoshop).

This information does not require deep technical understanding to locate or use; indeed, every image-displaying program will need at least some of the information, and common image software, from Photoshop or iPhoto to the Flickr image-sharing website, will make great use of all of the EXIF data. For instance, Flickr’s mapping functionality⁶ automatically places images uploaded to it on a world map; this allows people to look in specific areas for photos of interest. One might search “court” near 59620 and find images of the Old Supreme Court Chamber; these would be different from searching “court” near 59101 and finding images of Billings courthouses. Similarly, many “photo album” programs automatically use the image location to categorize different parts of a trip. In this way, the location is not separate from the image; it is a significant part of understanding the image and being able to work with it efficiently, and that is why it is included in the image file. The same is true for all of the information embedded in the image, from the color of a part of the image to the lens used to capture the image. Indeed, Flickr displays nearly all this information for each image when a user clicks “Show EXIF,” and most software can display relevant metadata for a file being edited in just a few clicks.

Every type of computer file has metadata of one sort or another. Video DVDs contain region and video encoding information, stating where they are meant to be played and how the video is stored. Documents in Microsoft Word format include metadata relating to formatting (selecting the font size, for instance), metadata relating to the document’s creator and editors, and in some cases (when the feature has been expressly enabled for a particular document by its creator, for this is not the default), information about changes made to the document. MP3 files include information about the artist and album, as well as information relating to where the music was purchased. Computers store metadata for every file stored on a drive, including when the files were first saved, last changed, and last opened. Even computer hardware has metadata; when a USB device is plugged into a computer, it identifies itself to the computer to explain what it is and how to use it before any other data is transmitted. All of this information is viewable; it does not require special tools or uncommon skills to use. Metadata is inextricable from the normal use and function of any computer. In this way, metadata gives new life to “the medium is the message;” without the metadata to give context to the remainder of the message, it would be unintelligible.

Second, attorneys already have effective, built-in tools to remove unnecessary metadata from documents. When attorneys need to remove information from a paper document (for instance, in response to Rule 1.6), they can redact it. Attorneys are also able to remove metadata from a document trivially, if they feel that the metadata might reveal privileged or work product information. For instance, Microsoft Word has several built-in tools to do this, including the “Check For Issues” button prominently displayed in modern versions of Word; in addition, saving the document as a PDF before sending it removes Track Changes, Comments, and many other potential sources of privileged or work product information from a document. These tools are built-in to many document editors and operating systems, and are easy to use when necessary.

Finally, this rule may have the unintended effect of dissuading Montana attorneys from using technology to manage their legal practices. Modern legal practice management tools automate the discovery and use of document metadata. For instance, the MetaJure platform⁷ uses document metadata, both that which is stored inside the document and that which is found outside the document (such as information about an email to which a document was attached) to locate, organize, and make documents available throughout a firm. This use of metadata helps firms comply with their obligations to their clients and to opposing counsel, by minimizing the number of documents that are lost in the virtual shuffle.

The proposed rule would require that attorneys go to significant lengths to avoid any inadvertent contact with document metadata, lest normal tools for photo viewing, document editing, or the like (all of which must use and display metadata as part of their normal course of operation, as described above) reveal confidential information that was transmitted to them. While it is certainly possible that this use might be found not to be “for the purpose of discovering… confidential information,” the rule will create a chilling effect that dissuades attorneys from using technology to its fullest extent lest they be found to have violated the rule. This is particularly egregious because Rule 4.4(b), which deals with information inadvertently sent to an attorney, does not require this level of care with paper documents; as amended by this Court on September 22, 2016, the rule only requires notification of the sender if an attorney knows that a document was inadvertently sent. To say that electronic documents are somehow both different from paper documents, and more dangerous, significantly harms the cause of efficiency in moving to an electronic practice, which in turn will hurt both clients and the efficient administration of justice.

I recognize and applaud the hard work of the State Bar of Montana on issues relating to technology. I am very much in favor of the change to the Preamble to the Montana Rules of Professional Conduct, adopted by this Court’s order on September 22, 2016: “Competence implies an obligation to keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology.” I think that it is excellent that the Bar and the Court wish to ensure that the Rules take into account the changing nature of technology; when they do so, it would be my request that they first ask if their goals are best met by curtailing a particular use of technology, or by, as in the Preamble, reaffirming an attorney’s existing obligations regardless of the medium. In many cases, I would submit that the answer most in keeping with the tenor and traditions of the legal profession would be the latter.

I humbly request that this Court reject the proposed Rule 4.4(c) in its entirety.

Sincerely yours,

Brendan Francis O’Connor

I hold the degrees of Bachelor of Science in Computer Science and Master of Science in Engineering in Computer Science from The Johns Hopkins University. While I was in law school, I pursued, was awarded, and successfully completed two research contracts, awarded by the United States Defense Advanced Projects Research Agency (DARPA) in the field of computer security (DARPA Cyber Fast Track). I have presented technical research at computer security conferences in the United States, Canada, Norway, and the Netherlands; I have also presented at a variety of legal venues in the United States and Europe on both legal and technical issues, including two CLE presentations for the State Bar of Montana. I have served as Vice-Chair of the American Bar Association’s Information Security Committee (ST-ISC) since August 2014; however, this comment does not necessarily represent the views of the ABA or of the Committee. ↩
JPEG stands for the Joint Photographic Experts Group, a standards body that created the JPEG image standard (as well as several revisions and extensions). The JPEG format is commonly used for photos. Files in JPEG format often have the filetype “.jpeg” or “.jpg.” ↩
Indeed, camera manufacturers speak openly about the importance of the signal processing and other functions of the computers they attach to the light sensor. See, e.g., http://www.learn.usa.canon.com/resources/articles/2012/digic_processors.shtml. ↩
Exchangeable Image File format data (EXIF data) is used with a variety of image formats, including JPEG. ↩
Position sensors are more common in higher-end cameras; however, smartphones have made the sensor package that captures location and direction so easily obtainable that these features are becoming more common in consumer cameras. In addition, many modern smartphones will capture location information and add it to their images by default. ↩
https://www.flickr.com/map ↩
http://metajure.com/ ↩

What is Imperative

2016-11-10T00:00:00+00:00

I’m currently in Amsterdam, speaking at O’Reilly Security, so I watched the election happen very late at night. (Yes, I voted, in advance, by mail (as does everyone in Washington state).)

I read a lot of science fiction. A lot of what I read isn’t very positive about the future; even excellent writing with incredible implications, such as Pattern Recognition by William Gibson, or Halting State by Charles Stross, tends toward the dark (if not pitch black). There are some exceptions, though, and after the election, I decided to reread Rapture of the Nerds, by Cory Doctorow and Charles Stross. Near the beginning of the book, this line appears:

There’s always someone who unaccountably carries the let’s-lick-the-frozen-fence-post gene. There’s always a fucking geek who’ll do it because it’s a historical goddamned technical fucking imperative.

I think this needs to be the response of the collective geek community to the challenges with which we are now presented. Let me explain:

I am a geek. I have been since I was very young. The geeks I know face down impossible tasks the same way they meet any challenge: they build their tools, change the parameters of the problem when necessary, and make things better. They do so even when their approach looks insane at first (like licking the frozen fence post). Groups like Telecomix CMB do this for communications during national blackouts (with dial-up modems and ham radios); other groups like WikiHouse are making CNC-routable open source emergency housing. This approach (“we’re looking for a few good nerds”) works. Heck, Let’s Encrypt figured out how to end the extraordinary expense (and abysmal security) of the CA system, implemented their solution, and now have millions of live hosts protected by their efforts in a very short timeframe.

So: find a problem. Talk with the people who have it (actually talk to them! People skip this bit, and it hurts the utility of their solution, as Scout Brody pointed out at O’Reilly Security NYC (and I believe that video of her talk will be online soon)). Design a solution, and get it into the hands of the people who need it. Then find the issues in your solution, iterate, and keep going. Build technology designed to meet the needs of people who need need help, to protect them, keep them safe, and to meet the trust that users will place in your solution. (If you do security, we especially need you; we need your help to design technology to protect users and privacy from the first principles, not just as an add-on!) Build things to make the world better.

As a community, we now face down several years of living in (or merely with) a country that may cause significant international turmoil. What we have the ability to do is find areas in which we can build the technology to enable the change we need. We have the opportunity to make our tech be the shining beacon to everyone that our government may not be. We must, in other words, be the geeks we wish to see in the world–because the alternatives suck.

It truly is a historical goddamned technical fucking imperative. I hope you’ll join me.

PhD-ish On the Internet

2016-03-21T00:00:00+00:00

TL;DR: I think it’d be possible to set up a small community on the Internet that works like a lab full of PhD students. This would enable us to have shared community on long research projects (even when not working on projects together), sounding boards, peer review, and collective mentorship, which are all good things one can find in a PhD setting. I’m wondering who else might be interested in such a program.

The RFC

This is a request for comments. If you think this proposal is crazy, do let me know. I don’t claim this proposal is fully fleshed out just yet, but it’s something I wanted to ask the Internet about.

The problem statement

I do research. I do research on my own; my day job doesn’t have a research program / 20% time program, and in any case, my research tends to be outside the field of interest of a small consultancy. This means I don’t have to confirm my work to what’s currently fashionable in security research, but it comes with a problem: doing work outside of work is, well, haaaaaaard.

This is not a new result. Outside work, life exists, and can be of great interest. Life includes theatre, music, or even just wandering around. (Note: if your life includes none of these things, I suggest you try at least one of them.) It’s a perfectly valid thing to do only relaxing/entertaining things outside of work.

I like creating new things, however. Sometimes they’re small-but-fun things, like when I made an ice cube sphere cutter for my brother. Sometimes they’re large, crazed things that scare people; that project took, all told, nearly two and a half years (September 2011 - March 2014). Sometimes they’re in between, like my spending more hours than I’d like to admit on creating an HTML5/CSS3 CV that has interactive elements without JavaScript.

Keeping motivation up, however, is an issue. Also an issue: having very few people off whom I can bounce ideas, or with whom I can commiserate (for instance, swearing at JavaScript) or simply work in agreeable community.

How does academia do this?

We have an existing model for groups of people working together on independent projects: PhD programs. (Note to those of you with PhDs: I’m going to summarize, here, so I don’t pretend this description is universal. Feel free to leave correcting comments, however.) Unlike college or professional graduate programs (such as MDs, JDs, and the like), PhD programs involve few classes. Instead, a new student joins a research lab with other students in approximately the same specialty, where the student will work for several (3-7) years on several (1-5) long research projects. These projects will culminate in one long paper, the dissertation, which represents a significant contribution to the state of world knowledge on a given topic. Different disciplines do this in different ways; computer science seems to favor several smaller (say, yearlong) projects, whereas lab disciplines (like biology or Biomedical Engineering) seem to favor fewer, longer projects.

So while the students work “together” in the sense of being in approximately the same space and time, they’re working on independent research. There’s a shared community. There’s also shared mentorship; the lab leader (often called a Principal Investigator, nearly always a tenured faculty member) can provide direction, mentorship, advice, or whatever else is necessary to any or all of the students. (In a real lab, the PI is also responsible for winning the grants that fund the research; I’m going to set that aside because it’s not relevant to this discussion.)

Can we do this?

While a great friend of mine has spoken movingly on why everyone in security should consider doing PhD work, I’m not sure that’s for me right now. It’s certainly not for everyone; after all, we have jobs, careers, goals we don’t want to set aside for years. There are reasons we don’t all get PhDs.

That said, the shared community, the lightweight obligation to keep making progress (to talk about at weekly or monthly lab meetings), and the sounding board? I could definitely use that. Interacting with a group of people who are also driven by the same weird impulses I am would be great.

The proposal

I suggest that it is possible to create a PhD-like lab on the Internet. While we wouldn’t be physically in the same space, Slack provides a great “water cooler” / “random muttering” space that can be selectively ignored when one needs complete focus, or clicked over to when it’s a good moment for a break. For lab meetings, Hangouts or other video chat would suffice; it’s nice to be able to see your colleagues, even for a few minutes a week, and it helps to build that shared community (as well as the lightweight obligation to keep working I mentioned earlier).

This group could help members to keep progressing, but also provide motivation and feedback and peer review when it becomes time to explain results (whether in a whitepaper, a prestigious journal, or a conference with or without proceedings). For mentorship, rather than a single PI, a roving cast of characters who wish to at least keep a finger near research could help out; there are PhDs and other academics among us all the time, of course, and I think a few of them might be willing to give of their time.

Speaking of time: a real PhD lab is your job. It’s more than full time, and it’s your life until you’re done, one way or another. This wouldn’t be such a commitment, but certainly one would be spending a good chunk of time on their work each week. (What that would look like for each person would depend primarily on their goals.)

The call to action

There are lots more questions to be answered. Some of them include:

Does a person “graduate” from this program? When, and who decides?
Should it be allowed to grow without bounds, or should we keep it small–and if it’s going to be small, how should we let in new people? Applications? Rap battles? Something else?
Should it be security-focused, CS-focused, or broader? (Obviously we couldn’t support a wet lab environment–as my sister is fond of pointing out, keeping an engineering environment sterile for a long term is hard, and not yet doable in a garage–but it wouldn’t have to be only people who want to submit DEF CON talks.
Would it be sustainable?

For now, however, while I welcome suggestions on any of these (or other) fronts, I’m mostly curious: who else would be interested in such a group, if it existed? You’d only commit to continuing to do your own research, and it’s not like we’re collecting tuition to hang over your head (no sunk cost fallacies here). If you think this could be worthwhile, though, leave a comment below, or email me: bfo @ ussjoin dot com.

For my part, I think I’ve got some Raspberries Pi that need weeding….

How the United States Holds Its Elections

2015-06-16T00:00:00+00:00

Note: The following is deliberately tongue-in-cheek. Please do not leave comments to explain to me how elections “actually” work. I know how they work.

I have a coworker who is not from the United States who was dismayed at the announcement of a particular candidate for the President of the United States. This was my response to him:

Here is how we elect the leader of the self-declared Free World:

God personally calls a candidate. Actually, God personally calls at least ten potential candidates, if you assume that no one would lie. And who would lie about being directly chosen by God?
Those candidates God chose, along with many who others will argue God did not choose, establish “independent” corporations that can take unlimited donations, known as SuperPACs. Because corporations have more rights than people, in the US, these PACs can spend unlimited amounts of money and can hide their donors, whereas when mere people donate to a campaign, their names are required to be disclosed and their contributions are limited.
The candidates go to places they believe will win them votes to declare their candidacy. For most candidates this is Iowa or New Hampshire, because due to skeletons buried deep within their ground, these locations have magical power. Or deep-fried Oreos. Whatever. Other candidates will declare at one of their chain of buildings, or somewhere in their home state. Doesn’t really matter. The press will nonetheless say they have the “momentum” until the next candidate declares.
Candidates say things. Many of those things are disproven by facts, but candidates do not believe in facts. Others of those things are statements of intention that they will not actually intend. These statements become increasingly insane. Anyone who says anything coherent and statesmanlike at this stage will be disqualified, regardless of their party or intelligence. See Jon Huntsman in 2012 (whether or not one supported him, he did say a few nice things).
In January of the election year (you thought we were in the same year as the election before? Hah! Elections in the US take at least one Congressional term to process, sometimes two), Iowa and New Hampshire will have primaries. Iowa will ignore the American tradition of secret ballots and verifiable results and have caucuses. No one knows what those are. Someone will win.
The media will anoint the person who won the frontrunner. Nice of them. They will anoint a frontrunner approximately 200 times through the next year, however, so don’t worry if you don’t like this particular one.
More primaries ensue. At this point, candidates will start to drop out of the race, which has now cost more per candidate than the GDP of any but the wealthiest 50 countries.
Eventually, we will be down to two candidates, one for each party. (What’s that you say? There are other parties? That’s some of that Freedom-Hating stuff, we don’t do that in the US.) Those parties will hold a nominating convention. No one will care.
The candidates will have a series of debates. These will be unholy unions of soundbites and sweat dripping. The media will focus on which candidate sweated less. No one will care.
The candidates will fly around the country making increasingly frantic statements. No one will care.
(Hypothesis—though this would explain a few things.) Somewhere around September, the four or five wealthiest people in the country will get together and decide who gets to be President.
In October, the so-called “October Surprise” (which comes without fail) will kneecap one candidate just as they were about to win.
On the first Tuesday after a Monday in November (so somewhere Nov 2-8), the US will go to the polls. Only four states will matter, due to the “Electoral College” which ensures that the US’ “one person, one vote” principle never applies to Presidential elections.
The losing candidate will file lawsuits in 20 states. This usually won’t work, but after 2000, when it did, it’s worth a shot.
Sometime November-December, a candidate will be declared the President-Elect. Most media sources will say he (or, theoretically, she) will destroy the country.
January 20, the new President takes the stage and promises to defend the Constitution. Given that the preceding 15 steps didn’t do much for the Constitution, one will wonder.

Value of Cloud Security (Rather than Forced Localization)

2015-02-11T00:00:00+00:00

I’m pleased to finally announce that work I did with James Arlen and Lee Brotherston at Leviathan Security Group is seeing the light of day. We wrote three whitepapers on the “Value of Cloud Security”—more specifically, on the security challenges faced by so-called data localization laws (that require that all data about a country’s citizens be kept within the country). While it’s easy to oppose these laws on the basis that many of them come from known-censorious regimes (e.g., Russia), we found that the security implications of forced localization laws are disastrous.

The papers are here, and I invite everyone to read them. We’ve also made some media splashes, with CloudWedge, IT World Canada, and ZDNet (twice) writing about them so far (and I’ll add new links as I find new articles).

Article in the ABA SciTech Lawyer

2014-04-14T00:00:00+00:00

I was fortunate enough to have an article published last month in the journal of the Science and Technology Section of the American Bar Association, called The SciTech Lawyer; it was titled Whoops! How Your “Convenience” Broadcasts Your Secrets, and dealt with the implications of pervasive WiFi sniffing (e.g., via CreepyDOL, though certainly not exclusively) on attorney-client privilege and client confidentiality across practice areas. Thanks to the ABA Science and Technology Section for letting me write, and further for letting me host the article here.

The article is here.

CreepyDOL

2013-08-09T00:00:00+00:00

Update on December 4, 2013: Want to watch the videos?

Black Hat USA 2013: https://www.youtube.com/watch?v=zojjHWSTdy8
DEF CON 21: https://www.youtube.com/watch?v=ubjuWqUE9wQ

CreepyDOL (Creepy Distributed Object Locator) is the name of the sensor networking project I’ve been working on since January, with the initial thoughts coming from a post-DEF CON 20 musing on the airplane. I presented it at Black Hat USA and DEF CON 21. I could summarize, but frankly Ars Technica did a really good job of hitting the high notes with their summary, and Forbes did one of the best early pieces. The project also got coverage on Gizmodo, Gizmag, Dark Reading, The New York Times, CNN, and so on. I even got on Bloomberg TV. All in all, a pretty wide reach for a security talk.

I cited some prior good work having to do with large-scale data collection and academic sensor network research in my slides, but I missed a really neat presentation from 44Con in 2012, where a project called Snoopy did some very related work. Both Snoopy and CreepyDOL start from the problem of “beacon frames are leaking too much data,” but then they take it a fascinating direction: rather than doing the very simple work through the NOM Filters that I describe in my talks, they do some really deep analytics, and sometimes go into a fully active wireless attack mode, complete with deauth, MitM, SSLStrip, etc. Their sensor system is quite different, too—more-powerful endpoints, connected in a star topology, compared to my distributed network (using Reticle) of really simple endpoints—and I encourage everyone to go check out their work. I hate (and not just due to my academic background) to miss citing to prior work, so I’m sorry I didn’t know about the project in time to put it in my slides. My apologies to the authors, and seriously—go check out their work. It’s great.

(As a side note, “I looked and I couldn’t find anything, then way later discovered someone else had solved some of the same problems I did” is pretty much the exact reason I started Hark, a project to create a hacker archive that gives us the discoverability of academic work, while making sure to encourage more than just formal papers. I’d really love to be able to get it running, but we need your help: check out the Kickstarter to learn more, and support the effort!)

Since a huge number of people have asked: I will be selling completed F-BOMBs (the hardware I use for CreepyDOL, now in version 2) in a few weeks, for those who would like to purchase them. They’re a great base platform for a lot of different areas of work: they’re more powerful than usual sensors, while also being much cheaper. (Of course, many sensor motes are ultra-low-power, which these are not; everything is a tradeoff.) If you’d like to get announcements when preorders for the F-BOMB are being taken, as well as a few other milestone announcements from CreepyDOL, sign up for the CreepyDOL Announce List.

In addition, I will be releasing everything related to CreepyDOL—source code, some binaries, disk images, VMs, parts lists, sketches—all at once, as soon as I can; I’m aiming for the end of August, but that date may slip. (There’s some code cleanup that I need to do; while some projects enjoy having large amounts of profanity in the code base, I’m going to work on removing mine. :-) ) Rest assured, that code is coming.

Have more questions about CreepyDOL? Drop me a line: brendan -at- maliceafterthought -dot- com.

Thank you to all the people I’ve ceaselessly annoyed and/or ignored for the last several months while getting this all ready (especially Kathryn Sweet), to the Black Hat and DEF CON CFP committees, and to everyone who showed up to my talks at either conference. And, not least, to the kind and gentle Goons, who insisted that I take the ritual shot of Jack Daniels before I began my DEF CON talk.

Below, my slides from Black Hat, my slides from DEF CON, and the YouTube copy of the video demo I showed at each (there’s no sound).

Amicus Brief for Andrew Auernheimer, AKA Weev

2013-07-05T00:00:00+00:00

TL:DR

A whole bunch of insanely famous security researchers, plus myself, wrote an amicus brief for Weev. Go read it at https://github.com/ussjoin/weevamicus/releases.

News Coverage

Update, July 29, 2013: Two good articles on the amicus brief and the effect that Weev’s conviction has as we approach the DEF CON and Black Hat USA season: Security researchers file appeal for Weev following AT&T/iPad “hack” and Fear of prosecution hampers security research, the latter of which focuses particularly on the damaging effects to all consumers from harassing independent security researchers.

Huh?

I’m a hacker; I’m also a law student. I’ve spent some time trying to convince those in column A that they need to also spend some time in column B; we need more people who can do both. I haven’t been able to spend a huge amount of time doing both at once—but that changed over the last few months.

Back at ShmooCon 2013, Meredith Patterson, Dan Hirsch, Sergey Bratus, and I were discussing Weev—for those of you who haven’t followed, he got sent to prison for 41 months for adding 1. This is one of those really, really bad ideas: the interpretation of the Computer Fraud and Abuse Act that the government used to convict him was that even public information, publicly served, could be restricted if someone said so, after the fact. A lot of security researchers have publicly destroyed their work, representing months or years of their time, rather than try to do their work after this conviction. It’s terrifying, and for good reason: if Weev, then all of us, too.

So what did we do?

We formed a group to write what’s called an amicus brief. Amicus is short for amicus curiae, or friend of the court; the plural is amici curiae. An amicus brief, then, is a kind of letter to the court, asking them to take into account the perspective of some group that isn’t party to the litigation—which in the case of a criminal case, means someone who isn’t the defendant or the government. In this case, the perspective is that of the independent security researchers who are affected, and the court in question is the Third Circuit Court of Appeals, since that’s where Weev’s appeal is sitting now.

I was chosen to do the primary drafting on the brief, since I’m a law student and was willing. A friend of mine, Alex Muentz, who’s a Real Lawyer who practices in Pennsylvania, was willing to sign the brief and submit it to the Third Circuit (because he’s awesome). A whole lot of work later, I had an initial draft, which the amici tore apart; over the next two months, then, we built something pretty good. It was a heck of a team effort: every single member of the group contributed at least a thought to the brief that we didn’t have before, and several contributed a lot of great material and ideas. All the work was done for free, even by the Real Lawyers (of which there are two, Alex and Peyton, in the amicus group).

In the end, we were fortunate enough to receive consent to file from both parties—both Tor Ekeland, who’s Weev’s attorney, and the US Attorney assigned to the appeal. This was great; courts usually let amici file, but not always, so it removed one last speedbump.

The Amici

So who are these mysterious amici? It’s a pretty epic list: we kick the Magnificent Seven’s butts.

Meredith Patterson - she of LangSec fame, among many other areas of fame
Brendan O’Connor - your humble scrivener
Professor Sergey Bratus - Patron Saint of the Gospel of the Weird Machines
Professor Gabriella Coleman - Hacker historian and scholar writ large
Peyton Engel - Hacker, pen tester, Real Lawyer, and generally neat guy
Professor Matthew Green - Cryptographer, great professor, gets interviewed a lot about all his research
Dan Hirsch - Another LangSec researcher, analyst, and cool dude
Dan Kaminsky - Do I really need to introduce Dan Kaminsky?
Professor Samuel Liles - a professor doing research on “cyber warfare”
Shane MacDougall - 2x Defcon Black Badge winner, social engineer extraordinaire
Brian Martin - The man behind the legend behind the squirrel
C. “Space Rogue” Thomas - Founding member of The L0pht
Peiter “Mudge” Zatko - Another founder of The L0pht, but also a now-former DARPA Program Manager, responsible for Cyber Fast Track

To make sure the court knew how cool these people were, we made an Appendix. Ordinarily, the appendix on these sorts of briefs is reserved for documents from the record, affidavits, etc. Instead, we attached the CVs of everyone in the group—a staggering 61 pages worth, in the end.

What happens now?

Well, the brief’s done (it will be submitted on July 8, 2013); we can hope the court reads it. The attorney on behalf of the United States will be able to write his brief, after which Weev’s attorneys will have one more shot. The amici will be done, however; we don’t write response briefs (unless the court specifically asks us; in general, if a Court of Appeals says to write more, you do that).

So now we wait, and hope. If you’d like to donate to Weev’s ongoing legal battles, you can do so at the CFAA Defense Fund, which is set up by Weev’s attorneys. We did our work pro bono so they don’t have to.

Thanks

Thanks, of course, to all of the amici—especially those who signed on at the beginning, when the draft was nonexistent or terrible. Thanks also to all those who proofread the drafts, often over and over—including my parents (both Real Lawyers), my brother (also a Real Lawyer, who graduated in May), and my girlfriend, Kathryn Sweet, who in addition to reading several drafts of the brief and fixing my grammar, also had to deal with me while I wrote it—for about three months.

Contact

If you’d like to talk to me about this, leave a comment below, or email me: blog -at- ussjoin -dot- com.

Postscript: Why Defend Weev?

I want to draw out my earlier concept a bit: if Weev, then everyone. Why? After all, Weev is a notorious troll. He’s ranted at some length about his dislike for Aaron Swartz, and in general, people dislike him. What could be wrong with letting him rot in prison, and waiting for someone we like more to be thrown in prison next? We’ll get the next one.

We can’t do that: mighty Casey will strike out, immediately; he got three strikes, but we only get one. In the United States, we have a system of precedent: higher courts rule, and their rulings control lower courts. Higher courts can overrule themselves, and sometimes do; for instance, in 2003, the United States Supreme Court ruled in Lawrence v. Texas, which overturned its previous decision in Bowers v. Hardwick that gays were evil. (I am paraphrasing.) Obviously, more recently, they’ve taken larger steps for the GLBT community. So that happens.

But it doesn’t happen much; it takes a long time for a court to recognize that it did the wrong thing. So in the interim, people live their entire lifetimes under the wrong rule of law—whether that’s in slavery, whether that’s working until people die from exhaustion, or any other area in which they might not be doing too well. And that assumes the right rule of law ever comes out: in Buck v. Bell, the Supreme Court allowed the forced sterilization of “mental defectives,” and they’ve never overturned that. (There are a few specific reasons that Buck still stands today, actually—but it’s true that it’s generally considered a constitutional right to have children, these days. If you’re curious why they haven’t overturned Buck, ping me.)

So what does this have to do with Weev? Well, it’s like this: Weev has appealed to the Third Circuit Court of Appeals, which has precedential weight: what they say becomes the law, until they change their minds (or the Supreme Court changes them for them). We can’t afford, as a community, to spend twenty, thirty, fifty, or a hundred years in a situation where corporations can retroactively punish users of the web for looking at their publicly-offered websites. Not only will that immediately destroy the security research community, but it will, ultimately, destroy the Internet as it stands. (Imagine you dislike someone. If they read your blog, even once, you can later call the FBI and state that they accessed your website without permission, and push for a felony conviction. Sound far-fetched? That’s essentially what the EFF concluded, too. It’s terrifying, and the EFF was talking about Terms of Service violations—and in Weev’s case, there wasn’t even a TOS at issue.)

The moment to stand and fight this is, therefore, now; “They claimed it was for the sake of their grandparents and grandchildren, but it was of course for the sake of their grandparent’s grandchildren, and their grandchildren’s grandparents.” (Young Zaphod Plays it Safe, by Douglas Adams.) And don’t think that living outside the Third Circuit (Delaware, New Jersey, Pennsylvania) makes you safe: Weev was actually in Arkansas when he allegedly committed his “crimes.” Since Internet traffic goes everywhere, there’s always a way to make venue lie in a particular area.

As I said back in April: Miranda was a rapist, Washington was a murderer, and Gideon was a thief. We don’t have to like someone to agree that they need their rights protected—because if we don’t defend them, we will all lose our rights. That’s the way criminal law works. So we defend Weev, because in doing so, we defend us all. Not a bad idea.

Testimony on Montana Senate Bill 150, 'An Act Limiting the Use of Unmanned Aerial Vehicles'

2013-01-22T00:00:00+00:00

At the invitation of Senator Driscoll, I submitted this testimony to the Judiciary Committee of the Montana State Senate in their 63rd session, on January 22, 2013, regarding Senate Bill 150, “An Act Limiting the Use of Unmanned Aerial Vehicles.” A PDF version of this testimony is available at http://blog.ussjoin.com/static/posts/SB150Testimony.pdf.

Summary

SB 150 protects the fundamental Constitutional rights of Montanans by preventing government agencies from using drones to surveil citizens, and by preventing drone-mounted weapons of any type from being used against Montanans.
Current UAV technology allows every face to be seen and identified across more than 19 square miles, simultaneously, from an aircraft at 20,000 feet. This technology can be used to track every movement of every person even in Montana’s largest cities.
Law enforcement officials in other states have already deployed Taser-equipped UAVs; hobbyists have demonstrated that firearms can be mounted to drones as well, which would allow the “remote kill” functionality currently used in other countries to be used in Montana as well.
SB 150 does not burden Montana’s businesses in any way, allowing them to continue to grow the economy of the State of Montana with this new area of technology while also protecting Montana’s citizens from governmental overreach.

My Background

My name is Brendan O’Connor. I am a fifth-generation Montanan; my mother grew up on her family’s cattle ranch, halfway between Culbertson and Bainville; my great-great-grandfather was a homesteader, and I grew up in Billings. I am also a small-business owner; my company, Malice Afterthought,¹ is a Montana corporation which performs computer security research on behalf of businesses and the government. In 2012 alone, I presented on computer security issues at conferences in Washington, D.C., New York City, Las Vegas, and Dublin, Ireland. In the same year, my company won two separate research contracts from DARPA,² the long-range research group of the Department of Defense (whose work created both the Internet and, relevant to this testimony, the RQ-1 unmanned aerial vehicle, commonly known as the Predator drone³). I hold a security clearance from the Department of Defense, and I spent the first half of 2011 teaching at the military’s cyberwarfare school. I hold both a Bachelor’s and a Master’s degree in Computer Science, with a research focus on computer security, from Johns Hopkins.⁴ I am telling you these things because I want you to know that the issues surrounding unmanned aerial vehicles, especially as they impact the rights and freedoms of my fellow Montanans, are deeply important to me, and they have been of both personal and professional interest to me for years. You are welcome to consult my full resume, which is available on my website.⁵

This law, which Senator Driscoll is presenting to you today, was written while I was working for The Rutherford Institute,⁶ an organization which is dedicated to the protection of civil liberties and human rights. The organization is often considered to be a leading conservative civil liberties group; indeed, in Montana, it partnered with my father, Bill O’Connor, successfully to protect the right of a student to thank God for her accomplishments as she graduated from high school in Butte, Montana.⁷ I want you to know this because the issue of drones over Montana is not a partisan issue: I firmly believe that both Democrats and Republicans want the freedoms of the US and Montana Constitutions to continue to ring true for future generations.

Current Drone Capabilities

The abilities of current military UAVs⁸ are relatively well-documented, if not generally directly experienced by the American public. Modern military UAVs view and record every action taken by every person in a full city simultaneously,⁹ whether or not they are targets of interest at the time the recordings are taken, using technologies such as “Gorgon Stare” (capable of surveilling more than 19 square miles of land at a time, and identifying every face in that area simultaneously); analysts can then use “instant replay” technology (designed by the same people responsible for reality television camera operations) to access recordings from any time in the past, of and from any location in the field. UAVs that store video in these same systems range from tiny, hand-thrown drones with wingspans of just a few feet that can be carried in a backpack,¹⁰ to the massive Avenger that stores its bombs and missiles inside its 16,000 pound hull.¹¹

Of course, these are military drones, flying combat missions to protect our troops. Let us instead look at the UAVs flying over the United States. The Department of Homeland Security flies Predator drones (capable of carrying the same “Gorgon Stare” whole-city camera system as mentioned previously) from Corpus Christi, Texas,¹² and wants to purchase an additional 22 drones as soon as possible. Many of these are intended to fly over Montana and other border states.¹³ For reference, only 61 of the current Predator model, the MQ-1C “Grey Eagle,” have been produced for the whole world since 2004,¹⁴ which means that the Department of Homeland Security wants to have the capacity to fight almost half as many full wars as the Department of Defense does, UAV-wise. There is no difference in the technology being deployed between the military and DHS versions; only the intent stated currently, at the outset, differs in any way.

This military technology is not confined to the Border Patrol; the Electronic Frontier Foundation compiled a list of the more than 700 authorizations to non-military entities (including universities, local police forces, and even sheriffs of rural counties) granted since 2004 (see Figure 1), and so now police forces can watch—and indeed, will be watching—every activity taking place over the area of an entire city, day or night, whether or not any wrongdoing takes place, and storing that data for future use. This technology is being employed so broadly that, as the EFF noted, Otter Tail, Minnesota is planning to fly the same planes that were designed for combat zones. Indeed, so many people are now needed to remotely control these UAVs that American aviation schools are now creating UAV “pilot” schools, and encouraging young people to “get a huge advantage” by studying this expanding field now.¹⁵ While the FAA has not released information regarding any requests from Montana-based agencies to use drones, the EFF estimate that the FAA has yet to release information about fully half of the current licensees; current Montana law means that agencies are under no requirement to disclose these requests to the Legislature or any other body within the state. In addition, Montana is currently surrounded by drone bases (see Figure 2) whose UAVs will, just as with Air Force-owned drones (as noted below), “just happen” to overfly Montana. It is therefore a matter of certainty that Montanans are being captured by this technology every day, by an ever-increasing number of local, state, and federal agencies.

Figure 1: A map of UAV permits issued by the FAA to state and local agencies in the United States. Data courtesy of the Electronic Frontier Foundation. http://tinyurl.com/cjb2ema

Figure 2: A map of UAV permits issued by the FAA to state and local agencies in the United States. Data courtesy of the Electronic Frontier Foundation.

In addition to these civilian uses of drones, the Department of Defense operates 64 flight bases for UAVs in the United States.¹⁶ Since these planes do, of course, have to traverse American airspace while flying to combat zones, their sensors will see the same range of legal human activity as any other drone in American airspace–and despite the “posse comitatus” rules prohibiting use of the military against American civilians without Congressional approval, the Air Force recently sent out a mandatory instruction instructing UAV teams to keep that footage for “up to” 90 days while it is examined for evidence of any possible wrongdoing.¹⁷ Even assuming that it is not kept longer, it is an unprecedented step in the history of the use of military force against American citizens to allow them to keep a continuous log of all civilian activities for 90 days; since police can keep such footage permanently, however, one can imagine a Truman Show-style montage of every moment of one’s life, captured for one’s “convenience” from overhead. In addition to this “accidental” collection of footage, reporters have witnessed the Air Force intentionally instructing their unmanned drones to keep constant surveillance on private citizens’ vehicles inside the United States, without a warrant, simply because they had nothing else to be doing.¹⁸

Emerging Drone Capabilities

UAVs are, at the moment, restricted by their size from some activities; it is hard to imagine a plane with a 30-foot wingspan peering into a home window. Science has, however, come to the UAV’s rescue, and it has done so at an extremely attractive price point. For less than $1000, any person can own a powerful multicopter—a helicopter-type device with many separate propellers that allow it to hover in place for minutes or hours while capturing video, audio, and even thermal images. These devices can shoot incredible footage, and can be assembled using just basic tools from kits; some examples of their video quality and agility are demonstrated by the 2009 Mikrokopter project¹⁹ and the 2012 QuadShot project.²⁰ Even toy manufacturers have gotten into the act; the Parrot AR.Drone 2.0, a $299 device sold on Amazon.com,²¹ captures HD video in fantastic quality while streaming live to an iPhone, iPad, or Android device.²² Even the previous version, which streamed only standard-definition video, is impressive enough; we took one outside at The Rutherford Institute to watch it in action, and were amazed by the capabilities of a device—controllable by children!—that contains technology reserved just a few years ago for the military. ²³

Meanwhile, science rushes onward, successfully mounting remote-control electronics on biological flying insects²⁴ and creating fully-artificial robots that look like natural hummingbirds in both size and appearance.²⁵ High-school students can now take parts from cheap robotics kits and use them to control the muscles on (real) cockroaches to steer them around a room.²⁶ Harvard University has even developed a bee-styled UAV that assembles like a pop-up book and has a body smaller than a penny. ²⁷ With these new technologies, it will soon be essentially impossible to tell the difference between a normal insect or animal and police surveillance without detailed inspection—and with pinhole cameras weighing nearly nothing, each of these devices can be used to capture every detail of someone’s daily life. Indeed, one protective parent now uses a home-built UAV to walk his child to the bus each morning!²⁸

What This Law Would Do

SB 150 has two major purposes: one which creates a rule of criminal evidence, and one which creates a rule for the use of UAVs by government agencies in Montana (whether state or local).

Exclusionary Rule

The bill would create a blanket rule of evidence in criminal trials: UAV-collected evidence is inadmissible for any purpose. This means that courts and juries in Montana would not be able to hear drone evidence to determine the question of guilt or innocence; it also means that courts could not use drone evidence to determine the admissibility of other testimony into evidence.

The rule explicitly includes all UAV-collected evidence, regardless of its type (for instance, whether collected by listening to cellular phone calls, or by video recordings) or of who collected it. The latter is very important: since the federal government is not restricted by any state action in this area (due to the Supremacy Clause²⁹), the state is unable to prevent the federal government from sending drones (owned by the military, the Department of Homeland Security, or any other organization) to surveil Montanans. What Montana can do, however, is restrict such evidence from being immediately turned over to and used by the state or local governments against their citizens. In a similar vein, this bill does not attempt to restrict private actors from using UAVs; for instance, a farmer might use a UAV to inspect his fields, or a real estate agent might use one to take pictures of a house for sale. If these drones happen to collect information outside their original mission, that information cannot be used as evidence; this prevents any effort to “get around” the law by simply contracting such work to a private entity.

Why A Warrant “Exception” Is Unacceptable

Clearly, UAVs can collect a large amount of data on law-abiding citizens without their knowledge or consent; in general, in the United States, we use warrants to restrict the police use of such surveillance technologies to situations where it can be shown that there is probable cause to believe that a crime has occurred. Why not use warrants to restrain UAVs?

Unfortunately, UAVs are different from normal surveillance technology, precisely due to their flight characteristics. As noted above, even the Air Force cannot control what their drones see en-route to an assigned mission; the same cameras that record a citizen’s every waking action also keep the plane from, for instance, flying into a flock of geese. Requiring a warrant before recording citizens is simply unworkable; compliance with such a law would be impossible, and the requirement would therefore be meaningless.

In addition, the fact that unmanned aerial vehicles are, definitionally, unmanned, means that agencies can deploy near-limitless numbers of them to record, in essence, every waking (or sleeping) moment of every Montanan—regardless of whether any suspicion exists for any crime. This repository of all information will inexorably lead to abuse, whether it comes from people with access to the database (legal or otherwise) blackmailing citizens, or from agencies using facial recognition software to take down the names and personal information of anyone daring to show up to a political protest—or gun show. Requiring agencies to commit personnel to tasks limits the potential for abuse.

Even if the law did require a warrant to use a drone for surveillance, this is simply a minor procedural hurdle; regardless of merit, judges essentially never deny warrant requests, and magistrate judges charged with consideration of warrants often consider themselves to be an “extension of law enforcement.”³⁰ Worse, even when warrants are not issued, the Supreme Court has ruled that as long as the police act in “good faith,” the lack of a warrant is irrelevant.³¹ Since as noted, drones cannot avoid collecting this data, “good faith” will prove to be universal. Warrants do not, therefore, stand as any realistic safeguard against the abuse of UAVs; thus the addition of a warrant requirement for police use to this bill will destroy every safeguard the bill attempts to create, and destroy the Constitutional rights of the citizens of Montana.

“Nothing to Hide”

A common refrain heard by opponents of surveillance is that if one has nothing to hide, one has nothing to fear from additional scrutiny. This is simply untrue; in addition to blackmail and extortion as noted above, citizens have a right not to have the most intimate moments of their lives surveilled by the government. Supreme Court Justice Brandeis remarked that the right of privacy was “the most comprehensive of rights, and the right most valued by a free people.”³² It is this right that was described most eloquently by Orwell in “1984,” with the constant surveillance undertaken by “Big Brother” through the network of cameras in every citizen’s home and throughout his or her life. That was not technologically possible when Orwell wrote his book; unmanned aerial systems, by not requiring any human being to expend any effort whatsoever to record the innocent activities of a human, make Orwell’s vision a reality. It is imperative that the right of privacy be preserved not just in name, but in fact, by preventing the ceaseless recording of every private moment by flying robots—whether that private moment be a tender caress between husband and wife, a rancher tending his herd in the wee hours of the morning, or a hunter tracking an animal through the snow.

Anti-Personnel Capabilities

The bill also prohibits all governmental entities from using UAVs with anti-personnel devices, such as firearms, Taser-type electrical discharge weapons, or chemical agents such as “tear gas.” Why is this important? While the military has, of course, armed drones for use outside our borders, this work has not been confined there; indeed, the Department of Homeland Security purchased a Taser-equipped drone for the Montgomery County (Texas) Sheriff’s Office in 2011.³³ While that drone cost taxpayers $500,000 to purchase, these drones can be cheaply made; indeed, a hobbyist demonstrated that a handgun could be mounted to a drone costing less than $1,000 in total, with terrifying results caught on video.³⁴ Studies have shown that UAV operators are more likely to use deadly force in situations where it is not necessary, since they are not personally present at the scene and cannot see such nuances as unlikeliness to harm;³⁵ it is thus imperative that we protect the citizens of Montana from the accidental and unnecessary violence that is sure to result from these weapons being deployed as what could be seen as mere “crowd control” by a detached and impersonal user.

What SB 150 Will Not Do

It is also important to realize what SB 150 will not do. For one, it does not attempt to restrict the “airspace” of the State of Montana, as it has been repeatedly ruled by the courts that it is unconstitutional for a state to do so.³⁶ In addition, it does not restrict private entities, such as Montana’s small businesses, from flying UAVs for private purposes (including real estate, farming and ranching, safety inspections, or a host of other positive purposes). There is no need to burden Montana businessmen and women with additional regulation, nor cut off any new business opportunities in which Montanans could take a leading role; without the criminal power of the state causing ubiquitous surveillance (and the chilling effects upon behavior it causes, as noted previously), natural business forces will allow Montana corporations to experiment with finding new ways to use UAVs for the betterment of all. Finally, it does not restrict citizens from using drone-collected data (such as the “accidentally”-collected footage discussed previously) in civil lawsuits; this means that, for instance, if a citizen is injured in an accident captured by a UAV, the data collected can be used to aid that citizen.

SB 150 thus represents an effective balance between the rights of the people to be free from unwarranted governmental interference, and the hopes and dreams of Montana’s business community.

Conclusion

SB 150 defends the fundamental rights enshrined in the Montana and United States Constitutions from creeping technological overreach, on behalf of the citizens of the State of Montana. It is vitally important that this Legislature act to pass this bill, as it stands.

I am happy to answer any questions from any legislator about my testimony, about drone technology, or about the emerging capabilities of surveillance. Please feel welcome to contact me, either via email at , or via phone at 406-545-0430. Thank you very much for your time and attention.

http://www.maliceafterthought.com ↩
The Defense Advanced Research Projects Agency; http://www.darpa.mil/. ↩
http://en.wikipedia.org/wiki/General_Atomics_MQ-1_Predator ↩
http://cs.jhu.edu/ ↩
http://ussjoin.com/resume.pdf ↩
https://www.rutherford.org/ ↩
“Court: Butte Graduation Speech Ban Unconstitutional,” The Billings Gazette, http://tinyurl.com/a4rx6lf ↩
Unmanned Aerial Vehicle. Throughout this document, I will use the terms UAV and drone interchangeably. ↩
“With Air Force’s Gorgon Drone ‘we can see everything,’” The Washington Post, http://tinyurl.com/2c638fy ↩
“Raven RQ-11B Technical Specifications,” http://tinyurl.com/alf2rv9 ↩
“The Air Force Just Bought Its Biggest And Fastest Armed Drone Ever,” Business Insider, http://tinyurl.com/bh7n6or ↩
“DHS starts Predator UAV flights in Texas,” Federal Computer Week, http://tinyurl.com/2dpfmgp ↩
“DHS May Wait 14 Years To Complete Its UAV Fleet,” National Defense, http://tinyurl.com/2fve7z3 ↩
“MQ-1C Undergoing Development, Deployment,” Defense News, http://tinyurl.com/adr4ec3 ↩
“UAV Pilot License and Ratings,” Aviation Schools Online, http://tinyurl.com/bkn84qn ↩
“Revealed: 64 Drone Bases on American Soil,” Wired, http://tinyurl.com/7ojeeez ↩
“Oops! Air Force Drones Can Now (Accidentally) Spy on You,” Wired, http://tinyurl.com/blgtv9h ↩
“The Drone Zone”, New York Times, http://tinyurl.com/9wzm3m9 ↩
Video of the Mikrokopter is available at http://youtu.be/-3U-n8lRJtA. ↩
Video of the QuadShot is available at http://youtu.be/P6NDt1PCIDg?hd=1&t=2m30s. ↩
http://tinyurl.com/bbycpad ↩
Video captured by the drone is available at http://youtu.be/wpKRvHKW2U8?hd=1&t=34s. ↩
http://youtu.be/lCMjpsLVu7U ↩
http://youtu.be/PAeV96bTRiI ↩
http://youtu.be/7k_BzTu92Nc ↩
http://youtu.be/04T5Zq6KPyY ↩
http://youtu.be/VxSs1kGZQqc?hd=1&t=3m50s ↩
“Helicopter parent: Techy dad builds drone to hover over kid,” Christian Science Monitor, http://tinyurl.com/ceg2f5t ↩
“This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.” Constitution of the United States of America, Article VI. ↩
“Making Leon Worse,” Yale Law Journal, http://tinyurl.com/adz6x6u ↩
United States v. Leon, 468 U.S. 897 (1984). ↩
Olmstead v. U.S., 277 U.S. 438 (1928). ↩
“Taser Drone Launched in Texas,” Military.com, http://tinyurl.com/befpehj ↩
“Man Arms DIY Drone With Paintball Handgun and Shoots Human Cardboard Cutouts,” BoingBoing, http://tinyurl.com/c8kn7pu. ↩
” Air Force Drone Operators Report High Levels of Stress”, New York Times, http://tinyurl.com/au6zqur. ↩
See, for example, City of Burbank v. Lockheed Air Terminal Inc., 411 U.S. 624 (1973); Virginians for Dulles v. Volpe, 541 F.2d 442 (4th Cir., 1976); National Helicopter Corp. of America v. City of New York, 137 F.3d 81 (2nd Cir., 1998); U.S. v. City of New Haven, 496 F.2d 452 (2nd Cir., 1974); San Diego Unified Port Dist. v. Gianturco, 651 F.2d 1306 (9th Cir., 1981). ↩

Reasonable

2012-09-12T00:00:00+00:00

It’s a known problem in all fields of geekery; you get in to something, you get a device here, a tool there, and all of a sudden, you have a completely insane set of stuff doing all manner of weirdness.

So, too, have been my adventures in software-defined radios. I picked up a FunCube Dongle Pro last year, and now….

Well, I decided that I should be able to play with a few different bands, not just ham radio but also unlicensed bands. The sudden appearance in March/April 2012 of the RTLSDR meant I had an even better, even cheaper SDR than the FunCube, so it deserved a better antenna than the 3”-high one it ships with.

I also picked up a Kisbee, courtesy of Dragorn, and had a near-endless amount of fun this summer listening to the local SCADA traffic. So I thought a better antenna might serve it well– but obviously, the two couldn’t share– that would be horrible! So the Kisbee picked up a 14dBi Omni Antenna, and the RTLSDR is attached to a truly massive, insanely broadband Diamond D-3000N Discone Antenna (yes, 67” high from tip to tails).

Also, relics of Defcon 18 two years ago, I had a couple Alfa Outdoor WiFi Rigs with integrated 12dBi patch antennas that, like the Kisbee, are USB-powered.

So, combined with one of my Raspberry Pis, I tossed the lot up, with the sensitive bits in a hugely overkill outdoor-proof box that was supposed to hold high-end fiber optic equipment (also a product of DC18, and Unix Surplus). The Alfas and Kisbee are connected to the RPI; the Discone/RTLSDR is not, because I haven’t gotten GnuRadio to compile on the RPI, and I’m not sure it would have the horsepower even if I did. So the Discone runs a signal back into my main computer. The RPI and accessories are powered using Power Over Ethernet– which is perfectly ordinary, but I hadn’t used it for a project before. (Technically I’m using the knockoff DWL-P200 rather than a true 802.3af rig, but it meets my needs perfectly.) The RPI’s data/power cable, along with the signal from the discone, run down a floor and into the window of my office.

The antennas are on 10-foot masts, on my deck, which is ~30 feet off the ground. So I get decent signal. Not too bad, for a motley collection of parts!

A few pictures will make the nerds in the audience drool, so here you go.