Yn y prydysgwch, mae'n gweithio'n gweithio'n gweithio. Yn y prydysgwch, mae'n gweithio'n gweithio'n gweithio'n gweithio, mae'n gweithio'n gweithio'n gweithio. A blynyddiad y blynyddiad yng Nghymru. Yn y prydysgwch, mae'n gweithio'n gweithio'n gweithio'n gweithio, All right. Fortunately, my wife is not working for me here. Well what do I call it a bug? In slides for Google on the iPad it requires you to have an internet connection in order to present. Which is probably one of the worst features I've ever heard of. Because it should just be able to download it, it should be fine. OK, so when I just got to put into it that problem, so there your password is wrong. Is this a computer? All right, well how about this? Is this big enough for everybody or is this going to be an issue here? Just don't read ahead on me here. Is that going to be OK? OK, well if this pops on, we'll go ahead and try to present if it does connect to the internet. So if you're here for CSS grants I believe is what's published, I'm sorry. You can take a nap, you can relax, watch some YouTube, you're not going to offend me. I'm on 5%, but I unplugged in, so that's actually 5% increase now, so yes. The joys of having one US to UK adapter is that all of your devices are like barely powered at any time. So yeah, I apologize if this isn't the talk you're here for. You're not going to offend me if you want to leave. But we're going to be talking about organizational security. A lot of people like to know who is this guy and why am I up here. My name is Chris Taitzel. You can find me on Twitter at Techner Taitzel. Feel free to huckle me via Twitter. I'm totally fine with it. I make mistakes. I'll say something wrong and I'll definitely say something stupid, so go ahead and quote me on that. I'm on Drupal.org. Eight years, two months-ish under CellarGore. I'm the founder and CEO of Cellar of Media. I also have a company called Locker, which does encryption and key management. We'll hop into that stuff later. More and more now I'm an information architect and security specialist.  I got into Drupal because I bought a theme off of monster themes. It sucked. So I just ended up rebuilding the entire theme layer myself and then hopped on Omega and kind of rode the Omega Wave in the Omega 3X days. My claim to fame is that I'm technically a third generation tech nerd. My grandpa started at IBM in the 50s.  He started at IBM in the 80s.  So I am proof that genetics are something you should never mix with. So let's just jump into it. The top five security myths are there are only five. There is one single most important vector to secure in your site. We hear this one so often. It's like oh I got a great firewall. Awesome. Cudos. You've got one layer of many that you need to build. So a lot of folks like to focus on one layer, focus on one thing and saying I do this really well. I'm going to be protected. No. Completely wrong. We hear this one a lot. My website host will take care of this for me again. Very wrong. Just because your host is compliant with regulation X, with requirement X, you still have to be using that host in a regulated fashion. So coming up here, GDPR, a host can be GDPR compliant and your site could not be. So don't rely on your site and your host to actually be taking care of your site security for you. Likewise, don't just think that if I have a really secure CMS, I'm going to be totally fine no matter where it is. Again, wrong. Drupal actually does a really good job, especially Drupal 8 now that we got rid of the PHP templating layer. By getting rid of PHP in the templating layer, we are now preventing more and more mistakes from occurring. But just because you're hardening your CMS, you can still put it on insecure software, you can still run it in insecure environments. And as we're going to talk about later, you will still run into places where you will be moving that data around and moving the site into insecure locations. I can automate my approach to security. I apologize. We are all technologists. We are end goals to automate everything and basically just sit back and let the machines do the work for us. Security is not one of those things because at the end of the day, there's always a human at the end of the keyboard. There's always a human at the other side of what you're building. And if there's a human at the other side, there will be... I just caught Wi-Fi. Awesome. Because there's a human at the other end, there's always going to be the necessity to plan for human interaction. So we won't be able to automate this whole thing. And then last, but this is the one we hear the most, is I am too small to be a target. That's the BBC Coke. These guys are the ones that they're going after. They're not going after my little site. And that's actually wrong. They're actually going after your site more than they're going after the larger ones because the larger ones are harder to get to. One of the things you need to learn about hackers, if you don't already know, is that they're lazy. They're like us. They procrastinate in their lazy. So what are they going to do is they're going to go around and they're going to knock on every single door until one of them opens up accidentally. And then they'll put the foot in the door. And then they're going to go around and knock on more doors until another one opens up and they'll put the foot in that door.  A lot of small sites don't realize, they will now because of GDPR and other regulations, that they do carry a lot of sensitive data in them. I've had more stories of just horrible, horrible data. I'll give you an example. I'm trying to protect my clients here, but we're in a safe spot. I had a client come to me and I built them a Drupal 6 site. And I said, hey, my form is going wrong. Can you help me out? So what's the form for? Oh, it's to buy tickets. Oh, I didn't really give you an e-commerce solution. And I pulled it up and they used web form to create a credit card checkout form that was saving the data to the database where they would then print it into an Excel spreadsheet to then hand to the office clerk who would then call in. I see a lot of groans in this and everything like, but this is what we deal with, right? So the small sites, they don't know what they're doing wrong. And so they are actually targets because of that. The other thing is that a lot of small sites run up. Sorry, did I throw you into convulsions here with that? Sorry. The other thing is that a lot of these small sites run on shared hosts. Shared hosts have resources that are valuable, crypto mining, all the way to DDoS attacks. If they can take over even your little shred of processing power, that's worth something. So they're going to continue to use that. And then as you can see here, there are myths that will go on for days. And we could write a whole book and just sit here and talk all day about myths that people come up with about security. So what do we do? What we do is we say, okay, we're going to take a defense in depth approach to security. Again, we're not going to do one layer, we're not going to do one thing. We're going to do a whole bunch of them. And the idea here is that rather than building a really, really tall wall, let's just build a lot of really hardware, hard hurdles to jump. And more hurdles that you put in place, the more likely somebody is that they're going to trip over one of them and fail. Or you're going to catch them after they hop over one or two of them. And so you can see here at the very external, it starts with policies, procedures and awareness. We're going to go into that. Today's talk is going to be a bit more organisational and a little bit less tech heavy, but if you guys want to ask tech questions, I'd be more than happy to answer. Physical, network, computer, application, device, there are multiple, multiple, multiple layers that we have to protect here. We can't just say, I got a firewall, I'm fine. Or I'm encrypting all my traffic via SSL, I'm fine. Wrong. We have to look at it in multiple ways. So what are we looking for? OWASP is a really good bar to set for yourself. And these are the top 10 from OWASP. These are actually under revision right now. A couple of these will be changing due to the more adoption of APIs and the microservice architecture, create some new, interesting vulnerabilities that aren't represented necessarily here. There's some debate about, obviously some conflict about what exactly we do as, as is always in the tech community, we like to argue amongst ourselves. And so they're currently being revised and they're going to be revised again. There are some proposed ones, but these are what's there. So looking at it, injection, so SQL injection, Drupal Geddon, how many people remember and went through Drupal Geddon? Wow, not too many people. That is awesome. This was kind of like the scariest thing that's ever happened is we all woke up one morning and realized that every single Drupal site in the entire world was vulnerable to a single attack. And with a SQL injection attack like that, somebody can get in, put an admin user on. Unfortunately, this was the time in Drupal 7 where we had the PHP filter. You can enable the PHP filter and take over God knows what on the entire website. So these are good, but these are baselines. So we had SQL injection, weak authentication and session management. Drupal actually does a fairly good job of authentication and session management, but there are ways to bolster that, which we'll talk about later. Cross-site scripting is fairly obvious. Insecure direct object references, security misconfiguration. This is kind of the catch-all of like, hey, you're just not updating things. Over in the US, we ran into this with Equifax. They decided not to update Apache Struts, and basically everybody's confidential information is now available on the web. Going on, we've got sensitive data exposure.  And how do you protect the customer's data? How do you make sure that the data that you have... So GDPR is more, and I hope you guys know about this, but GDPR is more about the right to know what's being collected on you, the right to being forgotten, but then also what do you do with that information when you are collecting it? So sensitive data exposure in Drupal specifically. There are convenient libraries for this, and I know because our teams built them, that with encrypts now in Drupal 7 and Drupal 8, there really isn't a reason why you shouldn't be able to implement quick, easy encryption in Drupal for any field, form, whatever you want. It's there and it's available. Cross-site request forgery, using components with known vulnerabilities. And keep things up to date, and the unvalidated redirects in forwards. So these are the top ten that OWASP sets out and says, hey, these are the things that we're seeing most attacked. This doesn't account for, you know, crypto mining in the JavaScript. This doesn't account for credit card payments and how we're processing credit card payments and using tokenization instead of passing the credentials to the server. So there are more of these to be updated, but these are good ones to look at. When looking at all of those, you can kind of boil it down to three. It's the CIA triad. It has absolutely nothing to do with our US agency, the CIA, so don't be afraid. They're probably listening in on this, but that's completely different. But when it boils down to it, security all comes down to confidentiality, integrity and availability. Confidentiality we all understand, right? Encrypt the data, keep it private. The integrity of it. So the integrity of the systems, SQL injection, making sure that everything's up to date. But availability is the one that a lot of people don't pay as much attention to and are actually more prone to now, and we're actually seeing more and more of the attacks coming through in this availability. This is your DDoS attack. These are your attacks that are just trying to take down the site in general. Now, you may ask, like, why would a DDoS attack or anything like that be, why is it that bad? I mean, if the site goes down, it's not like anything's lost, right? Correct. You didn't lose the specific data, but you're also losing function. You're losing commerce. You're losing your presence on the web. So though it may not be a data integrity issue, availability is a huge business liability that we all need to look out for. So, with that, DDoS is the growing threat attack. It is where, because of our environment of having connected devices, we saw this a couple of years back with the IoT, that you're able to now take all these internet-connected devices from thermostats to fridges to microwaves or whatever and turn them into a giant botnet to take down sites. This can be because you don't agree with what the site said. This can be because you want to expose other vulnerabilities within it or you can just want to take the mouth line for the fun of it. But we're seeing this as a growing trend. So the question is, how do you protect yourself against a DDoS attack? And the idea with a specific DDoS attack is that they are trying to basically run an arm trace against you and see how much do you have versus how much do they have and can they overload all your resources until your site just falls on its face. Now, the way that you can prevent that or try to stay ahead of it is to spread your attack surface as wide as possible. So this is why having a CDN, we say, is really good for the marketing team because it makes all those images fast and the videos low and everyone's really happy about it. But from a security perspective, you're actually in a much better position because you're able to spread that attack surface out to the localized regions. So when you're coming out of Russia, it's going to hit that Russian pop and take the Russian pop down. So maybe the Russian version of the site isn't going to be shown, but for the 90% of the world that is visiting it, it'll still be up and running and everything's valid in there. So it's a way to kind of spread that attack surface and, again, think about it in layers and hurdles instead of big walls. If you all of a sudden see pops starting to go down, you have a chance to react to it before it ripples itself out to where your main customers are rather than, oh crap, the whole thing's down, now what do we do? So the second stat here is actually pretty amazing. 500 and 79 gigabit per second traffic. Like that is massive. And because of our connected world and because of our connected devices, this is now possible. Does anybody remember the Dyn attack? A couple of years back. It was basically, thank you, US government. A US government created weaponized code that somebody got a hold of and decided for shits and giggles that they would release it on the web and see what it does. And it ended up taking down the DNS backbone for like three quarters of the US internet. That backbone is made to withstand this much traffic and it still goes down. That's the type of attacks that we're going against and by spreading ourselves out, by giving ourselves a wider footprint with the CDN and just based on general cloud availability and being able to scale out, we're going to be able to hopefully run that arms race faster than and shut it off before the attacker does. So we're going to go through some practical steps in just your website environment. Again, if you guys want to ask more technical questions, that's totally fine. I'm aiming this more in kind of a general business sense of why we want to protect our website environment. We actually see this a lot. We see it more often than we should. Luckily, because of the way that cloud services are running, we're seeing it less and less. But this is still an issue where your entire business, everything you don't want them to have access to, sits on the exact same environment that your marketing site does.  Again, what hackers do is they try to get their foot in an easy door and once they do, they use that as a point to pivot about the entire organization. This has seen it, for instance, the Ashley Madison attack that occurred a few years back. They didn't use any authentication past the firewall. Basically, once you got in that same password was access to everything. They got in through a simple front end vector and then they were able to ripple themselves through absolutely everything in the entire organization. If you ask me, I'm kind of glad they did. But they were able to expose all the nastiness that was going on inside because they put everything into one giant bulk container. This is the reason why I propose and push people to go forward to manage hosts, get away from trying to host everything yourself, because when you do, you're going to try to make it as easy as you can on yourself and you're going to try to put them all into the same environment. This should go without saying now, but HTTPS does matter. SSL does matter. Google is actually warning the nasty security certificates in Valid. They're now extending that to if the page has a password entry on it and it's not using SSL, it will throw the same warning as if it had a bad SSL certificate. In other words, customers will start seeing really, really nasty. This is horrible. You shouldn't use this website even if you're using a Valid or if you're using an invalid cert or if you're using no cert at all. In addition to that, Google has now announced that they're going to stop, they're going to be putting the insecure in the browser bar for all domains that are not running SSL. That's going to start phasing into all of their products. So now, even if you may just have a simple marketing site and nothing fancy on there or whatever, you're going to be branded as insecure. With Let's Encrypt and all the other options out there, there really is no reason that you should not be using SSL now. It also unlocks a lot of potential and features, so if you want to start using geolocation, notifications, anything with the smartphones and the device orientation, those are all requiring that you use SSL now, so you have to. Again, a lot of the argument about SSL in the past is that it's performance heavy. It's going to cause my site to slow down. From a server perspective, negligible now. That's not the issue. It does cause a couple of extra round trips to occur, and this is why having a CDN again not only does it make you secure from a DDoS attack and spreading everything out, if you can get that handshake to occur sooner in the chain, then you don't have to negotiate and do as many round trips so you can actually speed up that SSL process by using a CDN. Once we've established that you have your marketing site and everything away from your main and your core resources, once we've established that you are using SSL, let's talk about the fact of why are we still using passwords. I don't know how many of you have a multi-million-dollar budget to protect your passwords. I don't, and these guys do. So why are we trying to do their job better than they can? They provide us simple integrations, so federated logins, social logins such as Twitter, Facebook, and Google. 99% of your users will have those. So if they have that ability to use something that is more secure, let them. A lot of those now have two-factor authentication, or, hey, we noticed that somebody in North Korea is trying to log in to your Google account, probably isn't you, can we make sure that it is? I don't know if you guys have it, but we don't have the resources to run that type of validation on every single request that comes to our site. So using a social or enterprise login system, if you're in a larger enterprise or in your EDU, you already have that backbone available to all your other systems. Expose it to your Drupal site and allow Drupal to use that instead of trying to use your own passwords, because amazingly enough, every year when they publish the top 10 passwords, ABC123, QWERTY, password 123, people try to get crazy and password with a zero instead of an O. All that type of crazy stuff, it doesn't really mean anything. The other thing is that the more unique passwords that you put in place, and one of the things that they're surprisingly good in the US, that they're starting to do is they're pulling back on the level of complexity that are required in passwords, and saying entropy is now more required. So in other words, rather than saying, hey, you have to have three digits, two symbols, but the symbols can only be these three, and you have to use your first cats, your first initial, and all this weird stuff into your password, and say, create a password that's longer than 20 characters. If it's longer than 20 characters, it can be all lowercase, and you're still going to have a higher entropy than trying to take a 10-digit password and mix it up with letters and symbols. The other thing that you also run into is two-factor authentication, fatigue, or password fatigue. Yes, you can have a really, really strong password, but your really, really strong password to every other really, really, really strong password that they have to do, and your two-factor authentication is in addition to all the other two-factor authentication that somebody has to go through, and once you put that much burden on the user, they're lazy. They're going to try to find a way to get around it. So what do they do? You can have two-factor authentication. They're going to write that on the post-it note and stick it on their monitor. They're still going to write the password on their monitor, or on the sticky note and put it on their monitor, and they make them only remember one thing and one thing only. It gives you a better sense of knowing that they're going to be provably using secure passwords. And again, these guys' budget for passwords is much larger than all of ours, so let's let them do their thing. When it comes to key management, this is kind of my big project, because this is all of what my product manages. How many people knew about OneLogin or the OneLogin breach? A couple of folks. So OneLogin is this enterprise identity management single sign-on across all of your apps. We're just going to hold all your passwords for you. I'll read the quote here, and then I'll explain. A review has shown that a threat actor obtained access to a set of AWS keys and used them to access the AWS API from an intermediate host with another smaller service provider in the US. The actor created several instances in our infrastructure to do reconnaissance. One of the things that we're finding and we're trying to swap as fast as we find it is over-provisioned AWS keys, and just in general over-provisioned cloud keys. These cloud providers are giving you a lot of really cool capabilities and a lot of cool technologies to use. But if you use the one key to rule them all, the one key that accesses your entire cloud and you go and put that into Drupal, where's Drupal going to save it? One of two places, the database or your code. Both of those are bad. If I get your database, I now have an AWS key that has access to everything in your AWS environment. So that's exactly what happened here. There was a small marketing site that was on a provider that they're trying to distance themselves from it, right? But they gave basically the master key to somebody likely in this, and I've seen it happen before, hey, I want to use the S3 module to store images in S3 so that we can then, you know, store them in S3 and use CloudFront and all that fun stuff. Great. Well, here's a key. Go use it. Well, that key is the master key. They got that. They're able to get into their cloud, into the BPC, actually spin up their own instances inside there. And because they have that API key, they're able to access all the encryption, they're able to access all the databases, they're able to have carp launch to everything inside, and so basically one login came back out and said, oh, by the way, everything you gave us has been compromised. It doesn't matter. You're going to have to re-roll all of your credentials, which at the core of the company is what they do. So not only is this just like bad practice, it creates a giant liability for your company, and that your company and all of their infrastructure can be compromised from one single key that one person thought would be easier to use for the S3 bucket. So make sure you know what you're putting into your website. Make sure you know what tokens are being stored, what passwords are being stored, where they're being stored, and how. In Drupal specifically, in Drupal 7 and Drupal 8, we created the key module. The key module is plug-able. You can use it to store your keys wherever you want. But it kind of acts as a centralized spot where all of your credentials can be and you can monitor what keys are being used, where are they being used, by who, and then you have a place where you can easily roll them in the event that something like this occurs and you need to go back and redo everything. So now that we've kind of talked through practical security in your website, one of the things that doesn't get discussed as much, but that definitely needs to, is just creating a security mindset. How do we create our teams to be secure? Big, big, big caveat, not a lawyer. Feel free to sue me for as much as you've paid to get this information, which is nothing. And so, yeah. Big disclaimer, everything I'm saying here, take it with a grain of salt when it comes legally, but professionally, I hope I have some credibility with you guys. First off and foremost, document absolutely everything. Most companies should and will have expected best practices. We expect you to have encryption turned on, trial encryption on your laptops. We expect employees to be able to in the event of losing a laptop, what happens. All of those procedures are there. Document project specific security. Now this is something that a lot of people don't do, but thanks to GDPR we'll start doing because part of the idea behind GDPR is security by design. The idea that you can provably show at the beginning of the project or somewhere throughout we decided that we're going to put security as a forefront in what we're doing. So in order to do that, we need to look at what data is in the system inherently, what data is being collected by the system, and then show that we're doing this all by design. That we actually took security as a concept at the beginning rather than bolting it on at the end, which always ends up occurring. These data audits are really fun. If you come into a new site we've done these with automated scans and stuff and it's like, oh look, you've got 20,000 credit cards in here. Awesome. Now we're going to go out to delete them and why are we collecting them and where are we collecting them. And then it's just really good to be able to show your client like here's all the data in your system. Did you know that this is here? Did you know you're collecting this and do you really want to? But this is one that I've heard of recently that a lot of people are documenting and when shit hits the fan what do you do? If you were to go to your CMO or whoever is in charge of the brand of your company and say, hey, BBC just called you it's two o'clock in the morning and they're asking about that hack that just got reported on Twitter. What are you going to say?  So you need to look at every layer here and start documenting. What's PR going to say? When the breach occurs PR is going to do this. Legally, okay, we're going to grab the lawyers we're going to get them in the room as fast as possible and figure out who's liable for what and how do we mitigate that. We're going to get DevOps in. How did it occur? How do we prevent it from happening again? And then if necessary to criminal authorities, who are we going to contact? How do we contact them? Who's going to be the one managing those contacts and those investigations that will have to occur afterwards? If you have this binder just sitting there waiting hopefully never to be used when it does happen you can just pull it out and everyone has a sheet that they're running by and everyone is in lockstep it's going to help your brand and the event that you're actually having pulled this binder out your brand is going through some damage it's going to protect your customers because you're going to have a quick response plan of here's what we're going to do here's what we're going to shut off here's what we're going to turn on and it just kind of creates a sense of calmness. So in the event that you do have a breach liability again I'm not a lawyer Do you have liability insurance? Most companies do. Does that liability insurance cover cybersecurity? Most of them don't. So make sure that you actually ask your insurance broker hey am I covered in the event of a cybersecurity breach am I covered in the event of a data breach and if not get protection for that because one of the former FBI directors is famously quoted as saying there's two types of businesses in the world those that have been hacked and those that will be hacked and they're pretty much turning into those that have been hacked and those that will be hacked again most people need to operate under the assumption that you will be hacked at some point so having this insurance and having this cover you in the event of that especially if you're an agency like I run an agency if one of our clients is breached and they put that back and pin that back on us then we have insurance to cover it because I don't know if many agencies can do this but if you're at risk of the liabilities for a data breach hands up how many small agencies are in the room or folks that run deaf shops or are part of deaf shops how many of you guys can write a 100,000 pound check tomorrow and be in the business right so that's the thing is like if you have a data breach you have to realize that you're going to potentially have to be writing a giant check let your insurance company write it this is the big one we hear all the time my clients aren't requesting us to do this no they're not requesting it but they're requiring it they expect you to know what you're doing so you need to be able to build that into your contract build that into your practices so that you can show your clients yes this is something we are doing even though you haven't asked us to yes it's going to add a little bit more to the budget but you're going to be really happy when that day comes when all of your competitors are hacked and you're not and along those lines make sure you have good contracts make sure you have it laid out with who is it liable for what in the event of that customer who brought me their website that I had built them that then collected all the credit card forms or all the credit card information I right away said look just for all clarity here liability wise I did not create this I'm not touching this I'm not downloading and I'm not accessing any of this credit card information because I don't ever want to see any of this information to be liable for it make sure that you have in your contract who's liable for what and how and when because you may be really cheery cheery with your clients and your customers now so maybe you might not be and that's normal but when the data breach occurs nobody's going to be friends and everyone's going to be pointing fingers and you want to be able to look at a contract and say no according to our contract that we both signed a year ago you're the one liable for this not me yeah what's that? backup your backup of your backup I can't say enough I have saved more sites by being like oh there's a backup that happened an hour ago awesome back we go and I've lost sites or had to recreate sites where it's like oh that didn't happen early on and it bit me once or twice I'll never do it again this shouldn't have to be something I say in this room but just use it don't ask you'd be surprised at how many tech conferences I go to and I get like should we use it? yes don't FTP into your servers it's bad enough so the three Bs of a breach breathe backup and build breathe this is the first one that I don't think enough people take to heart when you're hacked it's stressful how many people have gone through a hack oh quite a bit of people was it a fun time? you know let's do it again stop and I've had to do this with our team it's stop take a breath collect yourself because you're going to make knee jerk reactions that are going to cause yourself more issues and more damage down the road if you're just trying to put out fires fast so take a step back breathe control contain the situation and then back it up that way you can go have a post more to later and say what the hell happened and why otherwise if you're just in there fixing oh I fixed it well you don't know how it happens you don't know how to prevent it from happening again and then again build build fast build whatever you need to do to get the site back up to remediate the issue or to fix the whole but this all comes back to employee education so how do you actually educate your employees or educate your team on having that security mindset I like to partner up and have buddy programming junior devs with senior devs code reviews it's very important that the best way us developers learn is from others and from Google and Stack Overglow and so because of that we're constantly seeking advice from others and seeking out how to how to work with the technology that we have the best place to do that is those that have already been there so partner up your junior devs with your senior devs take your post mortem seriously don't just be like well that's done now we're off to the next one actually look at it what went wrong what procedures went wrong did I freak out and run around the room yeah probably shouldn't have done that okay let's go let's figure out what the procedure is next give time for the developers to recap and review code before releasing again don't just cowboy code let's push it out and pray that nothing goes wrong review it have other people review it this goes back to the buddy system and then this is an interesting one but reward failure when a breach occurs it sucks but reward finding that breach right if you can find a bug in your own code or a breach or a hole in your own code before it actually gets exploited that's not something that's like oh why did you code that wrong you should have never done that my favorite example of this is does everyone remember when s3 Amazon s3 went down in the US and like internet just started burning to the ground it was all because of one dev fact fingered a single command line that they were supposed to do some routine clean up in s3 and it ended up just like deleting all of the buckets right Amazon came out in their post mortem and said the failure was not the employees it was ours in giving him the ability to make that mistake and I thought that was really powerful to be able to say yeah they failed but it's our failure and letting them fail and rewarding that failure and rewarding that being open with that that possibility principle of least privilege don't let employees access things they shouldn't this shouldn't be something that I have to talk about but again it's something that I hear over and over again I heard of a company recently that every employee on the first day got rude access to the servers don't do that that's bad you trust your employees awesome I don't so people need to earn that and people always make mistakes so make sure that all of your permissions or all of your actions are based on capabilities not on permission because if it's based on just permission alone in saying like I can delete that then if somebody is impersonating me then they can delete X but if I should never even have the ability to delete that in the first place if it's capability based then it's like I shouldn't be able to do that so if you start moving towards capabilities and away from this like ambient authority of just once you have the password you can do everything that starts to secure more and more pieces of your infrastructure but remote workers this is again shouldn't have to be said but GDPR follows you everywhere so all of your remote workers are covered by GDPR protect your devs and you protect your clients and your business so it starts with the devs encrypted data protects your employees so if you encrypt your data and then send it to your employees they can't decrypt it they're not able to be an attack vector for it so that's why we promote encryption of data within Drupal because you send it to a remote worker there's laptop gets stolen great good luck decrypting it you have the key to decrypt that production data secure team communications keybase.io if you haven't already used it go grab it it's like Slack but encrypted and it's awesome so you need to share that password with somebody on your team and you're not using a password manager which is the next one down you should be using a password manager but if you're not you can send it over keybase it's encrypted between you two it also has like a really cool encrypted file share so similar to the Dropbox but too encrypted and it forces it out amongst your team that they use that and then try to push it onto your clients yes it's possible I have like a happy moment in my heart every time a client's like hey can I keep any of my passwords yes you're not emailing me your password anymore this is good and then there's other customers who send me their password via email and then we have to go and do everything all over again UB Keys or other two factor authentication devices are awesome, they're cheap, they're easy plug them in, yep right there you just plug them in and use them and because two factor is something you know and something you are that UB key is a physical device that you have to have with you and then last but not least sales and marketing I don't think we have many sales and marketing in the room here because this is more of a technical conference but use services and vendors that are vetted payment systems, it's really annoying and hard for developers but I built this really cool tool and then you went and installed this like really weird widget in the sidebar and then it just broke the whole site and caused a massive data breach sales and marketing need to kind of clear what they're putting into the site most of the website responsibilities now are coming underneath marketing as agencies you're probably finding yourselves working more with the marketing departments and you are at the IT departments these tend to be less technical people and they talk to them about what the security requirements are and why it's important not to put credit cards in the database when in doubt just don't post it this goes back to the in general just if you don't have if you don't need to collect the data or you don't need to post the data don't and then the last thing is just like if you are around security or you're trying to market security to your customers don't use FUD fear, uncertainty and doubt it's just kind of it'll work but is it really how you want to sell your service you're going to get hacked you're going to be liable for all this damage give them a sense of empowerment by using this or by us doing this extra service or by us using this extra product you're going to be empowered to be safer you're going to be empowered to do more and that I'm going to find and I've found through marketing our own product empowerment works just as well and at the end of the day you can sleep at night knowing that you're not using fear to market all of your products so with that I don't think we have much time if any for questions very quick one the most secure way of sending the username and password again, IT based everything so if it is it's like signal or any of those others that are two-way encrypted it requires you to both have it basically is public-private key encryption between two people but in a very easy to use chat-like form so every time you click on somebody's username it opens up a secure channel negotiates that secure channel and then you can start passing information keybase.io quick to tell us what locker is oh sorry I don't like promoting myself too hard on these so locker we have a plug-in that plugs into the key module also into WordPress yes I know I do WordPress as well basically the idea is that Drupal has two things available to it the database and the file system both of which are passed around more than candy in the dev team and both of which are very insecure methods of storing your secrets so we take those encrypted and store them in our they have more acronyms and letters next to it regulated vault basically of secrets and it allows your website not to store any of the secrets on the site but still have the faxes to them as if they were right there so if you are on pantheon or using pantheon your site actually will already know who you are and then the other fun thing about it is that you are in prod environments and so by doing that if you set a key in production it will never be pulled in dev and likewise dev to production so when you migrate your database back you are not actually having to reset because I don't know about you guys but I have never toggled that mistakenly and charged credit cards and things that I shouldn't have but if you were to do that it would prevent you from doing that or sending the test email to everyone so the tricky question is that's us giving you all secrets no, you are giving me an encrypted blob which I am storing on your behalf and giving you back because what happens is is before it even leaves Drupal it's encrypted again and sent to me not me but stored in the cloud so I always joke that we could actually publish our database publicly and it wouldn't mean anything because you would have to have the alternate key to do it so totally secure actually helps me regulation and if you want to talk to me about its implications in GDPR and the right to be forgotten we are actually coming up with some really cool stuff that will actually nuke customer data into the past in all of your database backups and all that too how do you customers usually react to the media security in terms of in terms of budget in terms of budget so you have to


Hi, welcome everyone. Thank you for joining us for this great press conference we have today. The press conference is sponsored by the Richard Roth law firm. And Richard Roth is the lead counsel for the attorneys and journalists that have sued the CIA and for violating their Fourth Amendment protections. I'm just going to give a quick overview on the process and what the order of speakers will be for the press conference. And then I'm going to give some contact information in case any journalists would like to speak to any of the plaintiffs or to Richard or anybody else afterwards. As I said earlier, the first Richard Roth can raise your hand, or no, people can recognize you. Richard Roth is the lead counsel and he'll be the first speaker giving an overview and what the news, which is kind of a historic event. After Richard speaks, we're going to turn it over to Stephen Rody, who is a constitutional law expert and a retired civil rights attorney who doesn't need a lot of introduction for the work he's done in all the years past. After Stephen, we're going to have Deb Herbeck. And Deb is another plaintiff and she is a media attorney based out of New York City who has decided to sue the CIA. After that, we'll turn it over to Nathan Fuller. And Nathan is the director of the Assange Defense Campaign here in the United States. Then we'll open it up for some Q&A for any reporters or journalists who have any questions. If you want to reach me after the press event, feel free to email me, Trevor, t-r-e-v-o-r-f-g at protonmail.com. And with that, I'm going to turn it over to Mr. Roth. Thank you, Trevor. We are actually very excited that on Tuesday of this week, December 19th, 2023, Judge Cotel rendered a decision on the CIA's motion to dismiss the entire complaint brought by individuals who went to the Ecuadorian embassy to rewind the tape. In about August of 2022, we commenced the lawsuit. That is, the individuals, American individuals who went to the Ecuadorian embassy to visit Julian Assange, commenced a certain of them, commenced the lawsuit, alleging that there was a wrongful search and seizure. They actually, everything they brought with them to the embassy, their phone, their Apple iPads, their laptops, their computers, were handed over to the embassy, which they thought was for safe keeping. Little did they know, as the complaint alleges, was there an agreement between the CIA and another entity, MC Global, wherein the CIA actually imaged everything on the computers and the phones and brought it back down to Langley. So we brought a lawsuit against the CIA and Mike Pompeo back in August of 2022, saying you can't do that. There's a Fourth Amendment right. You can't just image a computer and think about it. Imaging lawyers' computers that have sensitive information, imaging doctors' computers that have medical information about the patient who was Julian Assange. So you just can't do that. So we brought a lawsuit in August of 2022. The first thing the CIA did was it actually made a motion to dismiss, which we expected. We expect this to be a long, hard fight. And after a lot of papers back and forth, a decision and oral argument, a decision was rendered this week on Tuesday wherein the judge said, you know what? You're right. The CIA can't do that. They denied the motion to dismiss by the CIA, which essentially was our complaint that they couldn't image computers and laptops and phones. The court granted part of the motion. They let Pompeo out. They also let out other allegations. But the meat of this case remains in it, which is, quite frankly, a very, very big win against the Central Intelligence Agency and the federal government. And the court in its decision actually said that it recited our complaint where we were and we alleged in April 2017 Pompeo pledged that his office would embark in a long-term campaign to destroy WikiLeaks. So we are very thrilled by the result. Quite frankly, we're happy that the court rejected the CIA's efforts to essentially silence these plaintiffs who merely speak to expose the CIA's attempts to carry out Pompeo's vendetta against Asanj and WikiLeaks. With that said, so what happens next? So now that the motion was denied, we have discovery. We will get documents. As all of you on the phone most likely know, there's a lawsuit in Spain that's pending wherein they have a lot of documents, which we're going to get, which essentially discloses the relation between UC Global and the CIA and what Pompeo asked for and what they took. So we're going to sort of, in pair with the Spanish proceeding, we're going to get documents. We're going to get agreements between the CIA and UC Global. We're going to get emails. We're going to get all kinds of information. Then we're going to start taking depositions. We're going to take Mike Pompeo's deposition. We're going to take depositions of operatives who are actually in the Ecuadorian embassy. So it's a long road. We expect it to be difficult. None of this is easy. But we are very thrilled that the federal court judge, who's been sitting since 1994, 30 years, he was appointed by Bill Clinton, saw our case and said, no, there's something there. So with that said, I'll turn it over, Stephen, but we are very happy, in fact, thrilled that this case will proceed against the CIA. Thank you. I don't think the importance of this case can be overemphasized. This is the intersection of a case involving freedom of speech and government surveillance. It's the intersection of the First Amendment and the Fourth Amendment. It is rare for civil litigants to be able to get past the pleading stage in a case and to move into the discovery that Richard Roth has described. It's rare because the government, as much as they are fighting to extradite and prosecute Julian Assange, fight to keep secrets. They fight to conceal information from the American people and people across the world in this case. So it is significant that a case survives a motion to dismiss. This was the first shot by the CIA to throw the entire case out. Certain claims were trimmed down. Under a legal theory, Mike Pompeo was removed as a personal defendant, but he is still subject to deposition to sworn testimony. And as this case proceeds, I think the fact that this lawsuit will provide the bright disinfectant of sunlight into what the CIA conspired to do. We've been able this lawsuit carves out the peace of these lawyers and others visiting Julian Assange in the Ecuadorian Embassy for the simple act of seeing him, supporting him, talking and listening to him. And for that, it's alleged that their Fourth Amendment rights were violated by the intrusive imaging of their various devices. It should worry any American. It should worry anyone across the world who visits a foreign embassy that the CIA will, in this case, take those kinds of actions. I think it's a critical case. It's rare for cases against the government generally, or the CIA in particular, to reach the discovery phase. And I think it's going to be a case to watch carefully as the discovery emerges and as the case eventually proceeds to trial. Thank you, Stephen. I'm Deborah Herback. I'm an attorney, a media lawyer, and I'm one of the plaintiffs in this case. I think that this case is really important because it shows that the government has been so determined to keep Julian Assange behind bars that it's willing to trample on the constitutional rights of American lawyers and journalists. This should really shock the conscience of anyone who cares about democracy or the First Amendment. And it's particularly noteworthy that a federal court judge had the courage to recognize the illegality of the government's activities in its persecution of Julian Assange while the media itself has been paying very little attention. The lack of support from the media for WikiLeaks and for Julian Assange proves how successful the government has been in chilling journalists from calling out this assault on press freedom. As a media lawyer, I am outraged by the weaponizing of the Espionage Act to silence the routine activities of investigative journalists. The criminalization of WikiLeaks and Julian Assange sets a very dangerous precedent for any journalist or publication anywhere in the world who dares to report on or publish information that the US government deems harmful to its interests. Each of the 18 charges and the indictment against Assange relates to WikiLeaks' publication in 2010 and 2011 of evidence of war crimes committed by the US government leaked by Chelsea Manning. Countless other journalists from mainstream publications reported on the very same leaks. Isn't that the press' job? Yet it's only Julian Assange who has been holed up in maximum security prison for almost five years and through a combination of silence and collusion by the press, the government is succeeding in criminalizing investigative journalism. Why isn't WikiLeaks entitled to the same press freedoms enjoyed by the mainstream media publications and every other news outlet because it's an online only publication? Has that supposed differentiation stood the test of time? Do we really think that online journalists are not worthy of First Amendment protections? If we don't act our window into government activities is going to be closed shut. It's time for mainstream media to put pressure on the Department of Justice to drop the charges and drop the extradition proceeding against Julian Assange and we very much hope that this case, which we've had an astounding victory in so far, will help shine a light on the outrageous injustice that's being perpetrated. Thank you very much, Deb. Okay, Nathan, why don't we talk a little bit about what the Assange Defense Campaign has brewing in light of this campaign, but also the potential extradition of Julian to the United States? All right, thanks, Trevor, and thanks everybody for being here. I'm Nathan Fuller at assangedefense.org for the US based campaign for Julian Assange's freedom. I'm really excited about this development as an effort to hold the CAA accountable. I can also see it as kind of microcosmic of what WikiLeaks does in efforts to hold governments accountable. That's what this is all about. So this is just yet another step in this long story and it's a really exciting one because the CAA gets away with a lot. It's as Stephen has made clear, it's not often that they're brought to court, let alone past the pleading stage. So just kudos to all of you in this case, but yeah, I wanna put this in the bigger context of the Assange Campaign. We've got a lot of news in the Assange case just in these last few days. In addition to this court case, we also have heard that in the UK, Julian's appeal will be heard February 20th and 21st in London. That is the last stage in the UK domestic level. That's so this is potentially the last barrier to extradition. We could see an Assange extradition within the next few months, it's possible. So this is really urgent and it's really urgent that people are paying more attention to this. I'm hoping that people paying attention to this case and efforts to hold the CAA accountable will then learn a little bit more about the rest of this case. Longer efforts to hold the government accountable, including the 2010 publication of war logs and State Department cables that were incredibly newsworthy and the only one going to jail for the crimes exposed there is the person who exposed them. So yeah, we have had some other exciting developments here in the United States. Of course, around the world's politicians in Australia, Europe, South America have been sounding the alarms over the Assange case for years now, but finally US politicians are getting on board. We've had two letters go through Congress writing to the Department of Justice calling on Attorney General Merrick Garland to drop these charges specifically because they are a threat to the First Amendment and the right to publish anywhere, everywhere. So the first letter had a whole bunch of Democrats. The second letter was bipartisan. We also now have a resolution introduced by Paul Gosar going through Congress that has picked up about eight cosponsors already, Republicans and Democrats alike. So more and more people are seeing on both sides of the aisle how important this case is and why it matters to them and their future, even if they thought it was just some far away legal case in London, this really matters for their future. So yeah, please check out asangedefense.org continually. We'll post updates on the CIA case, but also on the UK appeal efforts and other developments here in the US. Thanks everybody. Nathan, this is Trevor. I have just a quick question. What can people do? What can the public do to most make a difference? Yeah, so now is the time when we're seeing that Congress members, representatives are responding to constituent pressure. Write in, call in to your representative and say, hey, look, so many others are putting their neck out there. Others are putting their names on these resolutions. So it's H-934, call your representative, ask them to sign on to this, ask them to call for the DOJ to drop these charges. This could happen, we could have resolution in the UK court, but I wanna remind people, it's the US that has the power to drop this at any time. Merrick Garland could just drop the charges at any time. So we finally have a whole lot of representatives calling, but we need more. So please contact your representative in your home state and get them to join the cause. Hi, can I ask a question? This is Cara from Newsmax and the Gateway Pundit. One of the things I've wanted to know, I don't know if anyone has in contact with Julian Assange, is he doing well mentally? Like I've been wondering that for a while. Like is he still, from what I understand, he's like, I mean, he's been in jail for a while now. I don't know if he's suffering mentally, but how is he doing? How is the state of mind? Yeah, I don't know if anyone else here is more capable to talk about this, but unfortunately, we don't get to hear from Julian. He's, yeah, we don't know, you know, specific updates about his mental health situation. Of course, that was a big factor in his extradition hearing from 2020 to 2021. And that was the initial barrier for extraditing him. So we know that he has endured a whole lot of psychological abuse, including torturous conditions at various times throughout this persecution. So it's safe to say he's not doing well. I don't have specific updates on anything more recent, but he's been through a brutal ordeal, and that takes a serious toll. Does anyone know his like his conditions in the jail is meaning like, is he in solitary confinement, or is he mixed in with other people? Like, is he, what is his situation? The last, we haven't heard reports on that for quite a while. He was, at one point, was in a kind of, administrative type of solitary confinement when he was thrown into the medical ward in prison in London, but we think that he was taken out of that medical ward. So no, we don't have more specific updates on his condition currently in prison. But he's going to be extraditing him here for sure? No, so February 20th and 21st is an appeal hearing in the UK. He is appealing the decision to extradite him. So, and after that, if he loses that, he will appeal at the European Court of Human Rights. It's unclear if that court would hear the case, but there's at least one potential avenue still left before extradition. So they're trying to, so I understand, because I'm very interested in this. They're trying to try him here in the United States. I've got some questions about the CAA case. You know. Would you say, Joe? Yeah, I think Joe said it would be good to keep questions on topic to the CAA lawsuit if possible. It would be best to do so if, but... And you should wait till you're called on as well. Wait till you're called on. But Cara, I'll catch up with you afterwards also to give you the information you're looking for. Thank you. Yeah, of course. So Q&A. Do any other journalists, is that Lee? You have a question. You're muted, Lee. Lee, you're on mute. On your computer, Lee, it says you're muted. If you can't fix it, you can always put it in the chat, put the question in the chat, if that's easier. Forgive me, sorry about that. I gotta find the screen. I want to address the issue of Jewish mental health. And I don't know anything firsthand, but here's what I know. I've had strokes, that's why it was like this. And Julian Assange has had strokes. I was out in Belmarsh when Julian was taking from the university covering the story.  And when I think about Julian Assange suffering strokes, being in that place, that would make anyone nuts. It's frightening. I mean, a stroke, if you're in a hospital, is frightening. But to be in that condition, I think is torture that I think a lot of people may not think about, but hits home to me. And so that's what I want to say, that what's being done to Assange, I think is a form of torture. Thanks, Lee. Where could we read, I don't know how to raise my hand. So I would like to ask to be called on like the other gentlemen, so nicely pointed out, but I don't know how to raise my hand. So I just have a question, if that's okay. Yeah, go ahead. Is there a press release available regarding the CIA lawsuit? We did put one out. We put out a statement, and I'll email it to you. Okay. It's a very simple one page, or the decision is 27 pages long. The judge took a lot of time and carefully reviewed each of the, there were a lot of reasons why the CIA wanted this case dismissed and the judge went through every single one of them. So we have a one page press release. If you want, we can also send you the decision. Great, thank you. Can I ask a question about the lawsuit? Yes. So I would like to understand whether this lawsuit will be, do you think you will be able to get some information about the metadata because according to the Spanish lawyers, the United States has refused to cooperate with the metadata about the emails from the United States to UC Global, especially from the Sheldon Edelson Resort. So do you think the judge will be able to order UC Global or the CIA? I don't know the mechanism here to provide an answer to the international regulatory as a result of these lawsuits? Yeah, that's a really good question. My understanding is that the government, the US government has been essentially ignoring the Spanish courts. And the answer is yes, we will be seeking all of the information that relates to both UC Global and the CIA. And as much as the CIA can play games for lack of a better word with the Spanish courts, it can't with the federal court judge. This federal court judge will not put up with any, they won't be ignoring subpoenas, they won't be, they can't refuse to respond. They're gonna try their best to narrow the scope of everything because as you can imagine, there's probably a tremendous amount of data. But no, we plan on vigorously going after all of that information. We wanna get the relationship between the parties. We wanna get the communications. We wanna know what they've taken. There's a lot. Oh, and the federal court judge is gonna deem all of that to be not only relevant but necessary. So yes, I think we'll be much more, by denying the motion and letting us proceed in New York, I think we are in a much better position against the CIA because they can't just ignore a federal court judge. This is amazing. I'm one of the journalists most heavily targeted among the media partners. However, I'm a European citizen. I'm an Italian citizen. Do I have any hope to get anything like this even if I'm not a US citizen? Well, are you saying do you have a hope of getting the information or being a plaintiff? Getting the information. So the answer is, we will see. The CIA is going to clearly want to have a confidentiality agreement between everything that's produced, claiming there's all kinds of secrets. And we're gonna have to, it will probably be a fight with the CIA and federal court, but our goal is to, which sort of, Nathan, it's funny, this sort of is in line with WikiLeaks entire model. Our goal is for transparency. Our goal is to get that information to the CIA and to allow people like you and anyone else to see it. It's not, we are doing it through a different avenue, but it's the same result. We will arguably argue that this stuff should be produced and it should not be sealed in any way. Wow, last question. How many months or years do you think this process will require? Another very good question. So look, because we're in federal court, it will go a little quicker. However, we have a conference in the middle of January with counsel for the CIA to determine dates. My assumption is that we should be well into discovery by the fall of 2024, I would say. What's gonna happen is we take our discovery, the CIA will make another motion to dismiss. It's called the summary judgment motion. So I think you're gonna get a lot of developments this year. The trial, if we get that far, will most likely be next year. But certainly we're going to, we're gonna be, not only are we gonna seek this information, but we want it now. And so I would expect by the summer or fall, we're gonna know, you're gonna know a lot more about this case. Can I ask one last question? So this week, The Guardian Australia published one of my documents, which I got through the FY litigation in the US against the State Department. And this document reveals that the US diplomacy monitored the Assange supporters in Australia. There basically, there is not a description in this. It was a confidential now for a US diplomatic cables. And it was declassified through my FY litigation. There are no details about this monitoring. It's not clear whether they spy or whether they just look at the public protest. If we got more information, would it be a prostitutionally? I mean, if they spy, for example, on US protesters, on US supporters of Julian, would it be, could they apply for, could they file a lawsuit like you did, like Deborah did for her visit in the embassy? So the answer is no, the only defense they have is they're gonna claim that there's a lot of documents that we are not entitled to as civil litigants, but they are not gonna, I'm not worried about them filing a lawsuit or any way going after the plaintiffs here or anyone else. And in particular, with regard to that one wire cable that you mentioned, the more information we have on it, the better because we can ask very targeted document requests. We can ask for all documents that refer relate to that particular cable and they're either, they will most likely object, nothing is easy when you're with the federal government, but it will be a fight and we would want that information. But their only defense right now really is to continue to try to ward off this lawsuit and minimize the production. And then they're gonna make another motion after discovery. Okay, thank you. You're welcome. If I could, if I may add- Richard, let me in. Yes, go on. I just wanna add because I think it needs to be highlighted. In the press statement you have and in the 27 page opinion, the judge emphasized the allegations of how the CIA and Mike Pompeo tipped their hand by saying that they were going to launch a long-term campaign and other specific allegations that you have in front of you. That allows discovery to look into that kind of internal planning. We have other information that the CIA considered various plots to assassinate Julian Assange. So the CIA will fight tooth and nail to narrow discovery, but the scope of discovery is defined by the allegations in the complaint. And the judge has already seen the relevance of the allegations that Mike Pompeo announced, a campaign against Julian Assange. I think that's gonna be very significant. I think it's going to allow Mr. Roth significant targeted but relevant discovery. And I think in that fashion we are gonna learn a lot more than we know today about what goes on behind the scenes and this decade's long effort to target not only Julian Assange but his supporters. I'm assuming that you or no one on your team has security clearance. Of course there's a chance and you're probably worried that they might use or are you worried they might use the state secrets privilege to withhold what they would call classified. Meteor which very well might be protecting their own backsides actually. And if you get over that hurdle, if you get over that hurdle, what are the chances of a trial? And I'm assuming you're not interested in settling. You think they might try to do that? Well, so let me hit one at a time. We do not have clearance. They are going to argue state secrets. Our argument is that these cannot be state secrets. Without a search warrant, you don't have the ability to go through information. And like Steven just said, our complaint, relevancy is determined by the four corners of the complaint. Our complaint starts with a Pompeo speech and goes forward all the way to all the invasiveness that the government was involved in. So our argument is that it is all relevant for purposes of our case. It doesn't, they're not giving us any confidential information, state secrets about what the CIA is doing, what they're doing other than wrongfully targeting these individuals who should never have been targeted. So I think the judge are gonna give us a lot of latitude in that regard. And oh, as far as settlement goes. So yeah, we don't have any, we have no desire to settle this. We believe that what the CIA did as Deb, so just brilliantly pointed out, was just outrageous. And so we want, it's important for the people in this country to understand that the government has limitations. They can't stomp on you. And that's the purpose of this lawsuit to not let them stomp on my client. It's just like they're doing on Julian. And so we don't expect to settle this case. We do expect to, part of the, one of the reasons for this lawsuit is to bring to light what the federal government is doing behind closed doors. Deborah, can I ask you if you've reached out to anybody in mainstream media to cover this story and what kind of responses did you get from them? Because they're clearly not doing it. Well, you know, I've been, everyone was notified about this press conference, Trevor, maybe you can speak more specifically to who's been reached out to or in how. But generally just as a viewer of the press, I'm just horrified that this isn't stored, not necessarily our case, but that what's been going on with Julian and how he's been treated as a journalist for basically doing his job and exposing what the government is doing in our name by way of war crimes. The press doesn't seem to care. And we're supposedly the liberal press is supposedly so concerned about Trump coming in and stamping all over the constitution. Well, so am I, but why are we, why are we letting this happen right now before there's any authoritarian government, you know, making it happen? We're just saying, hands up, sure. Trump all over our rights, we don't care. And I think it's because the media is concerned about national security media, national security journalists have relationships with government agencies that they rely on for sourcing. They also don't want to annoy the government in a way that would end up with them being persecuted in the same way that Julian Assange has been. So they've been, you know, understandably scared, but it's time to step up but we're not gonna have a free press. Does anybody know if the Central Intelligence Agency as an organization has ever stood trial anywhere at any court in, oh, Stefania, at the end.  Yes, sorry. We are the only country in which the 26 Americans, most of them, 25 of them were CIA agents responsible for the extraordinary rendition of a buomar. They received a final sentence. So they cannot, and there is still a European arrest warrant. So the moment they travel to Europe, they get arrested if they travel under their own identity. And indeed, one of them was traveling to India because her mother was seriously ill and she was arrested in Portugal due to this arrest warrant by the Italian prosecutors. So they were put on trial in absentia because in Italy it is possible to put people on trial in absentia and they receive a final sentence. And the head of the CIA in Italy also had these properties seized by the out prosecutors. He had a wonderful villa in Piedmont and it was seized by out prosecutors. However, none of them went to prison even if they received a final sentence because we now know, thanks to the WikiLeaks cables that they put pressure on all our politicians both conservative and progressive and our prosecutors and our, sorry, and our politicians refused to forward the arrest warrant to the US. So six justice ministers refused to forward the arrest warrant for the, even if they had received a final sentence. However, they were put on trial. They were sentenced. But those are individuals, not the CIA. In this case, Pompeo was off the hook now, isn't he? Oh, you're right. Yeah, I'm not aware. I would defer to Steve. I don't know if he's aware of any case where the CIA was a civil defendant. I'm not aware of any. The greatest success has been under the Freedom of Information Act. There have been successful cases brought to secure documents and sometimes remove the redaction on documents. So to that extent, there's been a trial, but it is very rare. I would have to search back through the history of the CIA to see a full public trial in the United States where the CIA was a defendant. And where there accused of a constitutional breach here, not at the FOIA. That's exactly right. They worked. I mean, their conduct will be put on trial, which is very different than the Freedom of Information Act request. If you ask for information, they don't give it, they can be sued. But here, Jody, your point, we are putting their conduct on trial. If in fact we can, we will get the agreements with the UC Global, that the documents that show that they were monitoring, the fact that they were bringing this information back to Langley, their conduct will be on trial here. So I don't think it's ever happened. And we look forward to getting that far. If I may, Rebecca had a question on the chat. The question was, could you explain how the Fourth Amendment protection? How'd she let her hand it? Yeah, yeah. Yes. Go ahead, Rebecca. Go ahead. Yes, hi. So I just, this is just a technical thing, but I wanted to understand how Fourth Amendment protections covered you if you were in a foreign embassy, and does that apply also to a foreign country? Or is this because it was an intelligence, a US intelligence spying on a US citizen? So the simple answer is the Fourth Amendment protects US citizens anywhere in the world. If it's an American, if it's the FBI or the CIA or a local law enforcement US agency, they can't go in to take information from a US citizen without a search warrant. They have to go to a judge, they have to show probable cause, and then they can go in. So the answer is because they're US citizens, it's not just in an embassy. And because the CIA is the actor, they cannot, they just can't do what they did. And then the other part of my question was, did any of the plaintiffs experience anything as a result of that illegal search, the allegation of illegal search? Did they personally experience intrusion or hacking as a result of it or no? The answer to, I'm sorry, if I can just jump in.  The answer to this is that we know that there, we know through the Spanish discovery in the Spanish criminal investigation of UC Global and the material that's been uncovered there that shows the connection between the CIA and UC Global that as a matter of practice, the cell phones and other devices and materials that were left with security guards when visitors were visiting Julian Assange were systematically opened, the contents downloaded, photographs taken of the inside and outside, SIM card information taken, possible tracking devices installed. Until we get the discovery, we won't know- The extent of it. To the extent to which we've been followed since, but we have every reason to, we have no reason to think that we weren't treated the same as everybody else that visited the embassy. And our information does come to the Spanish proceeding. This is not a goose chase. We know from statements, affidavits, et cetera, that they went in and took information. Think about it. Deborah Beck's a perfect example. Let's assume she has 30 clients on her laptop with communications for the CIA not only to violate the Fourth Amendment, but to have that attorney client protected information and their possession, it's like Deb said, it's horrifying. Yeah, got it. I have a question. Go ahead, Lee. You've been waiting patiently. Thank you. No, thank you. First off, Attorney Roth, congratulations on the major victory and congratulations to the entire team. I was wondering if you found anything out about the role of Sheldon Adelson, the Republican financier, or you intend to pursue that? Do you want me to speak to that? It's fine, Deb. You could start now, Phil, and go ahead. Okay, yeah. I mean, what we do know from the Spanish investigation is that the CIA actually recruited the Spanish security team that was guarding the embassy at the Venetian Hotel in Las Vegas in January of 2017, and that it was Sheldon Adelson's security team who made the approach and who are believed to be some of the handlers. So he was very deeply involved. In fact, we also have information that suggests that the payment to UC Global for their services in order to avoid exposing the US government directly was made by Sheldon Adelson to UC Global purportedly to be protecting him on his private yachts, which is extremely, why would they pay a Spanish security company to do that? So Sheldon Adelson's similarly to what happened in Macau, which some of you may have followed, we think it's exactly the same MO that's going on here. Thank you. Kara, I know you have a question. You're saying too- Yeah, it was more of just a suggestion. I know like it's hard to get stuff like this. Can you hear me? Sorry. Can you adjust to your, so we can see you? I don't know if it's the greatest, but yeah, hi. I was gonna make the suggestion that, I've been about how I've been for a long time trying to get a lot of stuff out into the mainstream media about the prisoners from January 6th. I know this isn't related, but the way I went about doing it to crack it into the mainstream is like really going through the alternate media podcasters that have tremendous followings. And then the mainstream media is almost forced to pick it up because there's a crossover audience. So if you go on those like podcasters that really believe in this and that have no like, like say someone like Tim Castor, all of these podcasters that don't have overseeing people like a corporation that's telling them what to say and what to do, it'll sort of force like a Fox News and I guess a CNN to pick it up if they see that people are talking about it. That's just a suggestion I wanted to make. And I also think that someone like Tucker Carlson now is pretty free in what he could say and do and he would be really interested. And as I've heard him speak at times, I believe about Julian Assange in a favorable way. So that was just a suggestion I thought I would make. Going through the alternate podcasters, they're more powerful now, like someone like Tucker or somebody, you know, they're more powerful than Fox News. People listen, more people pay attention more to what they have to say. Richard's going to be on with Jimmy Dore next week. Great. He's already done some, but you're right.  Every single national security correspondent or reporter in the United States was sent about four emails on this. So there is almost a blacklisting still of WikiLeaks and of Assange in the U.S. Very scary. Part of the national security establishment.  I think that answers that. All right, are there any other questions? If I could make one final comment about the intersection of the First Amendment and the Fourth Amendment. Mike Pompeo and lawyers at the DOJ claim that Julian Assange had no First Amendment rights. He can't be invoking the First Amendment. Of course they've had the audacity to try to enforce the infamous espionage act of 1917 against a foreign journalist in a foreign country. But what I find beautiful about this lawsuit, as Richard has explained, as far as the CIA is concerned and the conspiracies that are alleged here, the Fourth Amendment does apply to American citizens in a foreign country. So there is some symmetry to the fact that it is this lawsuit that will be demanding transparency of the kind that the CIA has previously denied and will finally allow these plaintiffs and in their stead, the American people to expose the CIA to this kind of legitimate rule of law and the kind of civil discovery that we depend on. And I think that's what makes this ruling and the case itself so important. Thank you very much. Okay, if anybody watching wants to interview or speak with any of the panelists, please again, my email is Trevor, t-r-e-v-o-r-f-g at protonmail.com. And with that, let's free Assange. Thanks everybody for joining us. Thank you. Thank you.


The World's Honored Watch is Laun Jean. Laun Jean watches have won ten World's Fair Grand Prizes, twenty-eight gold medals and more honors for accuracy than any other timepiece. Laun Jean, the world's most honored watch, is made and guaranteed by the Laun Jean Wittemaw Watch Company. It's time for the Laun Jean Chronoscope, a television journal of the important issues of the hour, brought to you every Monday, Wednesday and Friday. A presentation of the Laun Jean Wittemaw Watch Company, maker of Laun Jean, the world's most honored watch, and Wittemaw, distinguished companion to the world-honored Laun Jean. Good evening. This is Frank Knight. May I introduce our co-editors for this edition of the Laun Jean Chronoscope. Mr. Henry Stieger, editor of Argosy Magazine and Mr. William Bradford Huey, editor of the American Mercury. Our distinguished guest for this evening is the Honorable Huey D. Scott Jr., United States representative from Pennsylvania. The opinions expressed are necessarily those of the speakers. Mr. Scott, our audience, of course, knows you as a man who's devoting a great deal of time to promoting the candidacy of General Eisenhower. Now, obviously, you think you're going to have an active candidate, so we won't ask you those old questions about whether or not you think he's going to run. But we would be interested in your interpretation of what you think will be General Eisenhower's positions. Now, sir, do you believe that General Eisenhower expects to wage an active campaign and express his opinions on all the vital issues? I would certainly expect that, yes. I have heard him say on occasion that when not in uniform, he would never have any hesitation in expressing himself vigorously on the issues of the day. And I've heard him use the expression, the American people will be in no doubt as to where I stand on any important matter. You think that he's too good an American to expect to be given the nomination while the people are still in doubt as to where he stands? I think he would feel that the American people are entitled to know from not only his past speeches, but from his future comments exactly where he stands on matters of grave import to them. And I think that long before the time the people will have to act, they will be fully aware of his views stated without equivocation. Now, there are many good Americans who are bitterly opposed to the candidacy of General Eisenhower. Now, for instance, let's take their points that they make against him. Number one, they say that he has no stomach for controversy. What's your opinion on that, sir? Well, I think that's about as ridiculous as any statement I've ever heard because to know General Eisenhower is to know that he has never hesitated to lay down the law to express his opinions as he sees them. I know of some of the things he's had to say to foreign governments. I know of one celebrated difference of opinion with Churchill, for example. And now there's nothing wrong with that man. What about the speaking of intestinal fortitude? How about such ordinary everyday things as we've even heard talk about his weak stomach, literally speaking. Well, I was there one day when some gentlemen had just spread that unworthy sort of smear. And they said to me, the only thing that has bothered me the whole time I've been in Europe has been the fact that this morning I have a cold in the head. And that day in the afternoon he played 18 holes of golf. It's his custom to work eight hours to play golf afterwards if time permits and often to work after that. Certainly he's a strong and virile and healthy man. Well, now let's take the one about his having restrained general pattern. His having generally approved the cooperate with Russia policy in 1945 and 46. His having supported the Morgenthau plan. Now, do you believe that General Eisenhower favored the cooperate with Russia plan in 1945 and 6? Well, on the contrary, I would be inclined very strongly to believe what you will find for yourself in the Forrestal Diaries. Page 76, ladies and gentlemen, in page 264 and 265 where it shows that, where Forrestal reports that Eisenhower very definitely came to grips with Churchill that he complained against the fixing of that line that he wanted to proceed as far as our military potential will permit. And then another thing occurs in another place in the Forrestal Diaries. He expressed grave mistrust of giving any concession away to the Russians at the forthcoming Yalta conference and said to Churchill, I hope you will not make major concessions to the Russians because they can't be trusted. How about specifically the A-bomb, Mr. Scott? There was some talk, you know, about sharing that with Russia at the time in 1945. What was his thought there? I could not answer my own knowledge because I'm not familiar with the controversy, but I do know that his general distrust of communism, his hatred of communism and his distrust of Russia would never have allowed General Eisenhower to concede for a moment that the A-bomb ought to be shared with Russia. And I've heard of his views in the Korean War where he is reluctant to use it as a military weapon unless and until there is no other alternative. Now, you mentioned Yalta a moment ago, sir. Now, number one, it's your opinion that General Eisenhower was consulted before the Yalta conference. It's my opinion that he was consulted generally on military and diplomatic matters and that he did express himself as far as told reports that he did as being very mistrustful of the Russians and hopeful that no concession would be there. In short, it would be your opinion that he would have been opposed to the concessions made by President Roosevelt to Russia at Yalta. Oh, I would very definitely feel that. And I know from very recent conversations how much he hates and fears communism and how anxious he is that the American people, and especially the young people, will become aware of the dreadful and the awful menace which communism is. It's your belief that he understands the nature of the communist conspiracy throughout the world and that he was... No other man does, Mr. Huey. No other man does, in my opinion. I think he is the foremost fighter for the American way of life and the democratic way for the way of the collective security of the free people. Well, returning to the scene here in the United States, it's often been said that his being favored by the Truman administration on so many occasions might be the kiss of death. How do you feel about that? Well, I've seen a letter which the general wrote to someone on a first name basis not so long ago in which he said, I have never been responsible for nor assumed responsibility for the policies of any administration, any administration during the 40 years in which I'd been in the Army. Most Americans... I think that's the answer to that. Surely I know that he's free to combat the things with which he disagrees and that would include a lot of trumanism and he's a highly honorable man of great integrity and he certainly wouldn't go along with this shabby corruption that we are suffering today. What about our Asiatic policy, specifically Mr. Atchison? Do you think you'd have any enthusiasm for Mr. Atchison? I don't know his personal opinion, but I don't see how he could go along with the Asiatic policy and I know many of the strongest critics of the Asiatic policy who have talked to the general and then expressed themselves as entirely satisfied with Eisenhower's views on the Asiatic policy. Now, most people who are any... He wouldn't favor any truckling toward communism or any appeasement. Now, most Americans who are anti-administration, they won a battle in 1952. They think that they lost the truman in 1948 because they didn't have a scrapping candidate. Now, is it your conviction, sir, that if they nominate General Eisenhower, they will get a real scrapping candidate and not another Me Too candidate? Listen, I'd like to say to you, Mr. Huey, and to the people in this television audience, that if they knew General Eisenhower as I know him and as many other people who know him better than I do are aware of, there is no question of the fact that there is much that goes on in our government, in domestic and foreign affairs, which he will feel free to criticize, which he will criticize, and if the people want to fight, by golly, we'll give them to him because there's an awful lot that I hate about this administration and I think that the general's views are those of a good, modern, minded, middle-of-the-road republic. And I would expect him to do the same thing. You know, there was a lot of talk about Eisenhower and MacArthur being at odds. Could you clear that up? I'd like to know how they feel about each other. Well, I don't... I can't obviously say how one man feels about another. That's in his mind. I don't know, but I do know this, that so far as I have any information, they both hold each other in high regard. And if each of them thinks as much of the other as I think of both of them, well, there can be no cause for this faked controversy which a few people would like to throw out. General McLaugh is a great man. And Ike Eisenhower is a great man. And among great men, I find a mutual respect for that capacity. Well, if Eisenhower is such a fighting man, isn't he going to come out pretty soon and state his candidacy, and how soon are we going to find out about it? I think that is a question which you're only going to get answered by General McLaugh himself. But I would expect that long before the convention, he will be in civilian life again, out of uniform, and free to answer these questions for himself. How about in March, Mr. Scott? I wouldn't be a bit surprised yet. We've got the New Hampshire primary on March 11. It could happen in February. It could happen in March. It will depend upon the completion of his job. I think that most of our audience who would like, would be interested in your answer to this question. Suppose General Eisenhower does campaign for the Republican nomination, and suppose for some reason he loses it. Do you think that he would then support the Republican ticket in the campaign of 1952? I have said that I'm entirely convinced that he's a Republican. Therefore, I apply that standard. I am sure that no matter how we may differ now, that after the convention, all of us will be united to get rid of this vile shabbiness that has come to be known as Trumanism, and I would expect that any other Republican, which would include General Eisenhower in civilian life, would feel the same way. Now, do you think that General Eisenhower will get quotes the liberal support in America? Do you yourself consider yourself a liberal, as it's now used in American politics? Well, I don't think that either, like Eisenhower and myself, would want to use the word liberal unless we knew what it meant. I have a quotation from him in which he said, the definition of a liberal has become a man in Washington who wants to play the almighty with our money. No, he's not that kind of a liberal. I think he'd be very careful with the pocketbook and the first strings of the government. If you mean a progressive, a modern-minded middle-of-the-road, mid-century American who shares the apprehensions of other apprehensive Americans, yes. I hope I'm that kind of a progressive myself. Thank you, sir, very much for coming up. The editorial board for this edition of the Laun Jean Chronoscope was Mr. Henry Steger and Mr. William Bradford Huey. Our distinguished guest was the Honorable Hugh D. Scott Jr., United States Representative from Pennsylvania. Four thousand leading jewelers of the United States will answer your question, what is the finest watch you sell? With the answer, my finest is Laun Jean. Now, isn't that a compelling consideration when planning the purchase of a watch as a Christmas gift? As a matter of fact, throughout the world in such places as Athens, storied seat of learning, Macca, religious center of the Muslim world, in Bangkok, capital city of Thailand, the ancient Siam, or in La Paz, the sky-high capital of Bolivia, as in all capitals of all the free nations, no other name on a Christmas watch means so much as Laun Jean. The world's most honored watch. The only watch in history to win ten World's Fair Grand Prizes, twenty-eight gold medal awards, and highest honors for accuracy from the great government observatories. There's a style and type of Laun Jean watch for every need and purpose. Faultlessly finished, styled with ageless good taste, made with the skill of eighty-five years of fine watchmaking experience to give good time for a long, long time. And you know that you may buy and proudly give a Laun Jean watch this Christmas for as little as seventy-one fifty. Laun Jean, the world's most honored watch, premier product of the Laun Jean Wittner Watch Company, since eighteen-sixty-six, maker of watches of the highest character. This is Frank Knight again inviting you to join us every Monday, Wednesday, and Friday evening at this same time for the Laun Jean Chronoscope, a television journal of the important issues of the hour, broadcast on behalf of Laun Jean, the world's most honored watch, and Wittner Distinguished Companion to the world-honored Laun Jean. Sold and serviced from coast to coast by more than four thousand leading jewelers who proudly display this emblem, Agency for Laun Jean Wittner Watchers. This is the CBS Television Network.