So here's the deal. This is Logan. Everybody say hi, Logan. Hi, Logan. So Logan's been to how many Defqons? Two. Two. This is your second. Second. So one and a third. Yes. Logan's never spoken to Defqons, so he's a Defqon Virgin speaker. And we'll have to... Yeah, we'll be gentle. So here's the deal. You used to come to Defqon and when we gave a talk, people in the audience were downright belligerent. They were usually very drunk. Some of you may still be drunk but aren't nearly belligerent enough in my humble opinion. No offense to the goons who are trying to control this place. There you go.  All in unison. One, two, three.  There we go. Welcome to Defqon. Thank you very much. Yeah, no pressure. So you're going to stand for the whole thing or... Eventually.  Painted it right there so you know where to aim.  And the same is true now. I think more than ever, Defqon has become almost polite at times. We cue like British. We all stand politely in line with our tea and wait to get into a room.  But honestly, you know, the undertone of the whole thing is the same, right? It's all about attacking offense, owning computers, defending computers, all that kind of stuff. People that get on stage, I've said it a million times. Your ability to stand on stage here to talk like this is just a testament. Your ability to socially engineer your way past the paper submission people, right? Like, I wrote a book or I started writing a book and somebody had to pick up the pieces at the end. I wanted to do a book and I thought, I'll do wireless security.  And I wrote up a little proposal, sent it to O'Reilly and two weeks later they fed X me a contract and I signed it and I was suddenly an author. And I thought, well, I should buy some wireless cards and figure out how to secure these things. Not a joke. This is really how it happened. There wasn't a lot of digitalism involved in the entire process. So I missed the flash and everything that was just retarded. So, alright, here's the deal. Oh, that one doesn't make noise. Gaming is big. We're going to talk about computer games.  How many people have played Team Fortress? How many people have played in the Team Fortress tournament that we have? How many people knew there was a Team Fortress tournament? Yeah, handful, yeah. Lots of random questions. How many people have social security numbers? It starts with two. Anyway, so I encourage you, if you haven't played the Team Fortress tournament, even if you're not a gamer, please come by because we really put a lot of effort into it. We built a just big-ass crate. It was 1100 pounds a gear that we shipped from Maryland to come to Vegas. We wrote a custom, or I didn't, these guys, Logan and a couple other guys wrote a custom scoreboard with Flex and Python and much other stuff to score it. We got real-time video. And it's just kind of comical to watch because a lot of people playing have never played and they suck. And so you can watch the real-time video and their heads blow up into a billion little pieces and we all giggle. It's great. Anyway, when we were thinking about what we wanted to do for Defcon, we said, well, why don't we do something about gaming? You know, we're not in the game industry. That's not our native thing, but we do play a lot of video games. So by default, that makes us an expert. I know how to configure a firewall. Therefore, I'm a security expert. Ooh, sorry. So gaming is a big industry. I don't need to go into it too much. Oh, there's a few of those, by the way. They originally were every slide, but it was decided that it might have been a little excessive. So that was every other slide. So at the end, we'll vote. Was it excessive, all the unreal and quake noises that you'll hear? And I hope to sincerely, it wasn't excessive because I really enjoy it and I giggle every time I do this. Anyway, this is just a number of concurrent Steam users each night. You know, I got two million people online. It's a big business. Fortunately, it's not a big enough business for Black Hat. We were rejected. This talk was rejected because, quote, it wasn't business enough. So $47 billion industry does not, you know, apparently make a business. So we're here instead talking to Black, or Defcon, bringing our A game, right? Woo, yes. Yes. And by yes, we should preface this by saying we started setting up the Team Fortress 2 tournament yesterday morning. We started the first match at 1. And what really happened was 1.30. He was still writing code, actually, for the scoreboard and everything. Today at 1.30, he continued to write code until I said, hey, dude, we have a talk to give it an hour and a half. And he actually looked at the slides yet. So you should probably stop coding. So anyway, we've been really wrapped up with the TF2 attorney. So I apologize if this is a little rough around the edges. Monster kill. So, you know, have some levity with that. Here's the deal. Gaming, again, you know, I wasn't trying to rag on Black Hat, but seriously, people don't view gaming as a business. They don't view it as something that warrants serious discussion, right? Although, arguably, everybody in this room plays video games. You all know 100 people that play video games. It's obviously a billion-dollar, multi-billion-dollar industry. But when we talk about gaming, we talk about reviews of video games. We talk about industry analysts, you know, who's buying who and, you know, what development studios are doing what and what now. But we don't really talk about the security much, right? We don't talk about the security of game servers or anything of that nature. We talk about it when there's money to be gained or while it's involved, apparently, and then two edge cases there. Maybe potentially the same edge case. You know, how do you farm more efficiently and can you get people to do it and make money? Yes, okay, then we're going to care about cheating. But in general, cheating is just kind of marginalized and game server security is kind of marginalized.  Yes, they do. We all know, I love reading the Penny Arcade comics when they're like, you know, when you have online games and anonymity it results in, you know, complete fucktards. You know, people that just leave all etiquette at the door and that's, apparently, the gaming community. What we're trying to do here is have a start, well, there's some people that are having kind of public discussions about cheating and game server security. We're trying to help contribute to that community and also hopefully open the eyes of people that are here to, you know, what's possible, what people are doing with respect to gaming security and cheating. People play a lot of different games. What we're really going to talk about, we're kind of short on time, so I'm going to...  That one's got a three? Well, it's every other slide, so that would be how many slides? Four. Jesus Christ. Yeah, there's a schmooble, all right. You missed, you were aiming for that guy. God. I have the hard hat on though, so I can just kind of talk and cover. For the rest of this talk, what we're really going to focus on is the source dedicated server that Valve's released. Source has an interesting past. It's a platform that not only supports, you know, Valve's needs, but unlike a lot of other gaming engines, it's very customizable. It's very open and they encourage people to, you know, extend it and do things with it. There's a huge number of source servers deployed worldwide. The real reason we're talking about Source is not because it's fantastically interesting, but we all play a lot of TF2, so it's what we know. It's what we're familiar with. It's what we administer every day. Source server and most of the other gaming servers have this fantastically interesting problem, which is that you've got people on machines of all shapes and sizes with connections to networks of all shapes and sizes trying to play what boils down to a fair game, right? We're all trying to have a reasonable experience.  They want it to be fair and they want it to be enjoyable, and it turns out that's actually a really hard math problem. There's an awful lot of complexity.  They're applauding for it over next door, yeah. They think something else is going on over here. So, you know, it's a fantastically complex piece of software because you have to provide basically real-time services on a non-real-time operating system. So, and speaking of non-real-time, we run ours on Centos, which I don't know if you've noticed, it's had a little bit of an issue lately.  That guy's just a jerk, which is not something you want on a operating system, like on the main page. Imagine going to Novell and seeing it on their main page.  Let me install that. Where are the disks? Bring it on. So, you know, Linux by nature is not RTOS, you know, it's not real-time, but these game servers have to somehow make these operating systems behave appropriately. They have to deal with all the data coming to and from the clients and basically make a fair game.  Really, it's an amazing piece of software that you get for free to run a server and do your own thing.  Like, I don't know how many people, who here administer source servers? Anybody? A handful? Got some of the source admin mailing lists? Like, people, I mean, there's public mailing lists on there, people just slagging on Valve all the time. I'm like, are you serious? Like, these guys give you, you know, millions of lines of code for free to do this stuff and form your own communities two years after it was created and people, they still support the game. They're still adding new pieces. You know, most games that you buy, you're lucky if you get a patch when it's broken, right? Valve still supports the thing, it still adds functionality. So, God bless Valve. Yay, yay. I want to throw that in in case any of their lawyers get upset about this talk. I find it's always nice to stock them up first. And so, by this time, the lawyers are kind of tuning out. Like, oh, they're speaking nice about us. Hit stop.  So, I guess we're going to just have to disassemble reverse engineer this thing, and it's big.  So, we've got debuggers running, and I'm trying to just get a high-level view of the code, and what's doing what? He's like, dude, you know if you go into Steam, you can just download the source code. That's why I had the debugger open. Shit. Yeah, just because I can't doesn't mean that I should. Absolutely. We wasted a fair bit of time, because they had like anti-debugging stuff in there, subverting that, moving it away. It was ridiculous. Anyway, what's interesting is all the code base that they exposed are like the game rules, object interaction, that kind of thing. So, you basically build your own video game out of the source engine, which is really interesting. We release the source code for the stuff that we would actually care about. So, there's stuff that happens where you're doing something with an object in the game, and in a nutshell, what happens is that data about what you've done to manipulate it, as an example, will get serialized and sent across the network to the server, or the server will take and serialize something and send it to the clients, vectors of who's moving where, and all this kind of stuff, but it's all just a bit stream, right? So, what happens is in the source code you have the network, and then you just call this magical function, and that magical function only exists in object code. That source code doesn't exist, and we discovered that after digging through many, many lines of source code, so then we went back to where we started, and by that point, we had to get ready for the TF2 tournament, and didn't make as much progress as we wanted to, because, basically, we're idiots. Head nodding. He doesn't want to use the mic. He's like, yep, we're dicks. Anyway, head shot. That one's not really important. Pong, I love this thing. Pong, why was Pong successful? Because everyone could grasp the concept, and in eight words in the front, avoid missing the ball for high score and insert coin. That was the entire premise, right? Not complicated. Even drunk people in a bar could put a quarter in and play. Even drunk people in a bar can play TF2. Why? There's two colors, right? If you're on the blue team, you kill the red team. It doesn't matter. That game's fun because people blow up, right?  Start calling them names and whatever. There's also some fantastic work that they did on the art direction, and if you want to grab this talk later, just for that URL alone at the bottom, it's like a two-hour long discussion on the palette choices and all the weird rendering stuff they had to do to get the feeling for the kind of 50s style cartoony bits of TF2 that they wanted to get. They put a lot of effort in the game. I have a lot of respect for them. I sound like an Apple fanboy, except I'm a Valve fanboy right now. This is not important. There's a lot more... Impressive. Thank you. A lot more slides. The server has remote administration, like SSH except non-encrypted. Basically, it's just remote console commands. You send a password and the command that you want and it changes it. This is everything from changing levels to low-level rate manipulation to enabling cheats and doing all kinds of other stuff. It's just wide open. There's also rate limiting that you can do because they know it's unencrypted. They know it's difficult to control. They try to rate limit how often you can connect. They have this nasty history of having bugs that if you try to connect to the Archon console too many times, it just crashes the server anyway. It's a cute DOS. I think it's one of their favorites, apparently. The one thing about Archon access is it's damn near equivalent to shell access. You can save files wherever you have access to save files in the file system. If you get really cute, you can execute code even. Your Archon password is like any other password or really bad thing, but it's amazing there are places you go online where you read about game servers and people are having permissions problem. You know what the answer is? Running is root! I'm a big fan of running is root. Real men run is root. Chuck Norris ran is root. I'm a big fan of that, but when it comes to millions of lines of random gaming code, maybe a jail is prudent thing. Just a hunch. Anyway, they have plugins too. This is actually kind of neat. If you want to interact with the engine directly, you can write plugins that hook all these public APIs that they have. The problem is some of the APIs are pretty complex. People have written abstraction layers to allow lay people to write reasonable plugins to do total gameplay modifications or just administrative functions or something like that. Real popular one that we use and we're using on the server in the TF2 room is MetaMod with SourceMod. And again, this is layers of abstraction on top of APIs. Again, we didn't do a lot of research into this, but one can assume when you start abstracting things like that there's a long history in the security community of shit going wrong. Security issues with MetaMod and SourceMod and people enabling things that they shouldn't and things being opened that they shouldn't and things of that nature. It's a big extensible system is the lesson of the story and what it results in is why we're all here. The female ones are better than male ones in my humble opinion. Always. It's cheating. That's pretty much the big focus that we're going to talk about today is actually trying to control cheating. There's ways to cheat that are idiotically simple and there's ways to cheat that are fantastically interesting and would make for actually probably a good black hat talk. Someone should submit something. Haha. Yeah, oh, hey, I'm sorry. I did make an assumption there, sir. No, it's a good DEF CON talk. You're correct. Damn it. Wow, that was bad. I missed that by like a foot. You can just replace sound files on the computer to have different effects. You would think, what difference does a sound file make? Well, there's a class in Team Fortress 2. How many people have actually played TF2? I'm sorry, raise your hands.  In general, for those that haven't, there's nine classes in TF2 and they all have different capabilities. One of them's the spy.    So what you can do is they make little subtle noises when they un-cloak. And so here's the spy un-cloaking. Is that playing? No. There we go. And so listen very carefully. Hear that whoosh? That was un-cloaking.  Right?  You know, that's not a fanciful sound. You just get stabbed in the back. Thank you. Here we go. So this is with a slightly different sound to give the player a little bit of an advantage. You'll hear the whoosh. Here it comes. There we go. And then here's the new sound. Scatman. Scatman. Scatman. Scatman. Scatman. So that one is, and it's funny because I gave this talk at Nonicon, not this talk, but kind of a variant of it that was focused more on administration. And I had made this demo on my main gaming rig, but I left that sound in. That sound down forever. And some dude called me on it on some server the other day. He's like, G-Dead, you have really good hearing. I'm like, yes, that's exactly it. Shit. I'm that guy. Other things you can do. There are certain materials that will show through walls. I've made some maps just to play around. You can make maps through the editor. And my kids actually made a map on the map, and you can see the decals all the way through the entire level, regardless if there's a wall in front of you. And they loved it. There's decals everywhere. You have no idea how far away they are because they're at a wall that's 100 feet away. It's just bouncing into things because all you see is these decals that go through. Certain materials will show through walls and things of that nature.  This guy's on the blue team.  This is just fantastic bounce of information. This guy knows where everybody is on the other team. So he dies, sees all his own team members through walls, runs across these people all over the place. This is an obvious kind of cheat. It's just carnage.  You notice their heads are a different color? Because you can actually look and get to this, their bots that you can have that will focus on certain colors that are on the screen and when the bot sees that pink color it just aimed there for you. So, yeah, it turns out it's really useful. Combinating! Whoa, that was loud! Shit, that's funny. That's getting funnier, that's the part I love. So, how do you stop this? I mean, seriously, it's child's play but it completely changes the nature of the game, right? Like, when you're playing on a server, I've been on servers where I've had either a bad day or some guy was really cheating and it's not fun. Like, honest to God, and when games stop being fun, people stop playing them, people stop buying them and game companies lose money, right? There are lots of games who started out kind of fun but for whatever reason people just didn't get into it or there was a lot of cheating in Unreal Tournament. Yes, yeah, UT. Yeah, my favorite thing about UT how many people play in Unreal Tournament?  Okay, how many people have seen the Penny Arcade comic where, like, dude doesn't realize that they're bots and is talking with them and, like, talking smack to them and whatever? I first got Unreal Tournament. I did that.  I'm, like, really? I've been here for an hour. And then I read that Penny Arcade and I'm, like, Jesus, apparently this is like an endemic problem, you know? Anyway, so how do you control this? So the server can implement this thing called SVPure so there's all these variables that get set with the server that control how the server acts in this one, SVPure, basically is a way that Valve tries to control these client-side cheats, these really simple, highly effective cheating mechanism. By default, it's SVPure is zero. You turn it to one and it scans for some sounds, some models and things, you know, basically the stuff that I showed you would be caught with SV1. Some custom contents allow people to use sprays like little things, images that they can put on walls and stuff to say, like, their clan was here or whatever. And custom materials, certain things can be whitelisted on the server side. So this is a real flexible way to control that. SV2 is basically, I'm going to scan what you possibly could change, and if you did change it, then I'm not going to allow you to join the server. There's a couple of problems with this. One, it increases load time, right? It's basically an antivirus scan. It's chugging along. And it's already, I mean, seriously, it takes a while to load TF2. Like, no screwing around, a lot of these source-based games take a long time to load. I've got an SSD at home that I use basically just for loading TF2. It's fast. And I get really pissed off when I get back in a regular spindle because it takes so long to load the game. The other problem is it uses CRC32. Which arguably, we know how to subvert, right? Like, we've handled MD5 pretty well. I think we can do CRC32 in our sleep. Like, there's probably an option on the Microsoft calculator to subvert CRC32. So it's not a real security mechanism. But again, it stops the ankle biters.  So there's obviously some limitations of what you can do when you're just searching and replacing these skins and these sounds and that kind of thing. If you want to automatically control your player, you want to automatically aim, shoot that kind of thing, you have to actually look under the hood of the source server. And that's what we're going to go into next is some lower-level cheats of how people manipulate the source engine. Dominating! So that one wasn't even funny, right? I mean, it was just, no. Was it the same as last time? Wait till you get to his slides. They're all the same. No, I changed them for you. No problem. This was his quote. I think all my slides, when they flip, say perfect, return, return, return, that's because they are. It was sarcasm. It was sarcasm, yes. He used 8-point font, by the way. I had to change that. Anyway, so one thing that Valve uses is a Valve anti-cheat. It's called VAC. A lot of you that play Valve games are familiar with this. What this thing really is, is, again, it's a relatively, it's a more sophisticated anti-virus program, if you will, except it's not looking for malware. It's looking for changes to the source engine. It unfortunately isn't that good. It's not a behavioral analysis. It's not the holy grail of anti-cheat. It's looking for basically blacklisted bad stuff. You know, someone wrote a cheat. Someone found out the cheat, sent the information to Valve. Valve figured out how it worked.  It's pretty simple. It's effective at stopping stuff that's in wide deployment, but it's not effective in stopping people who are willing to take a cheat, change it a little bit. You know, it's just like modern day networks, right? Right? We've got anti-virus. It's great for commodity viruses, but you change that one little bit and you can go own an entire enterprise. Right? That's how it works. I mean, I'm dealing with enterprises all the time right now who have massive problems because someone recompiled a binary and a little change or repacked it or whatever, and magically it flies through all the security protocols and pops everything. Whoopsie! You know, same problem where I had Mortal Kombat reference. No one plays Mortal Kombat anymore. No one. God, that was like my high school. Anyway, so here's what... Here's where we're going to turn it over to Logan and he's going to talk about other things. I still have a microphone. Great. So I started looking at the Dark Storm source that... Actually, first I started going down the line of writing my own sheet, and then I found the Dark Storm source, fortunately, because these things are really, really complicated. Not only do you have to know how to do common hacker techniques, such as DLL injection and, you know, process injection and all that stuff, but you have to know DirectX and vector math and it's impressive what these guys can do. And Dark Storm is just one example of basically a cheating tool kit that is out there, right? There's lots of people out there that have cheating tool kits. Some of them are publicly available, like Dark Storm. Others are available only to, you know, friends of friends and that kind of thing, like the carding industry or whatever, you know, if you know someone, you can get in, you get to cheat, because the cost of failure here for all these guys is the same. If their cheats are found out, they become worthless, right? And you can't cheat anymore and they're not cool. And so Dark Storm is a good example of one that's pretty extensible and we got some examples from it, but again, we didn't write most of this. This is just stuff we took from Dark Storm. We're using it as an example of this is how it works, this is how people get passed back and inject themselves into these programs. Perfect. Told you. Alright, so the first step in loading a cheat that is going to inject into the process is naturally injecting it. We do this through standard injection techniques. We do this with the SSID allocate space in the address, virtual address space, and then create your remote thread and kick off every function you want to hook inside of there. It does a couple things. Well, there are a couple different ways you can hide from VAC. And this particular cheat employs one of them, removing the PE header, that's it. But while I was looking around and analyzing some of these other cheats, you can do a lot of different things. The link list one, I think, is an interesting one. You should tell them about that one. It's a standard virus technique to remove yourself from the link list that describes all the modules that are loaded in a particular process. And VAC will go through and they'll look at that and that's how they'll get their list of modules to analyze and take a signature of. They also use the PE header as a way to start their signatures, too. So effectively, removing your PE header hides you from VAC and it is almost impossible for VAC to start scanning your memory space. Perfect. Oh, I changed them, really. Right. Like I said before, this is pretty much the only hiding technique that DarkStorm employs. Pretty standard. It grabs the image header and just nulls out the bits that say, I'm a PE. The first thing we need to do is undo some flags that say that we can't call certain functions because these functions ValveConsider is protected and they know that they could be used in order to cheat. So we go down the line of this PVAR struct and just flip bits and that's basically what's happening right here in this loop. And this is the first... It got funny again. It's like Family Guy, right? Like it starts out... Okay, y'all got it. I don't even need to explain it. Alright, so the first function that we hook is called CreateMove. It's pretty well named because it is just your move with the character. Every tick of the game this function is called and there can be 30, 40 ticks a second that happens. So every time a tick happens, we call this function and we start down our line of what do we want to do to cheat? Aimbot. I'm sure most of you know what an aimbot is. Unfortunately, there's no video of an aimbot because Valve released a patch and removed a particular function that was used by this aimbot to aim. So it would have taken a conservative amount of work to emulate that function and get it working again. It didn't have the time. Because of the TF2 30. Yeah, we have to have an excuse, right?  It's something else going on. Rampage. Alright, so here's a basic premise of how it works, though. You grab your list of entities, entity being anything on the board, anything that is moving or stationary. And you just go through an if statement and say, is it a player? Is it not me? Is it solid? Are they on the other team? Yes, then grab where I am, grab where they are and give me a vector. Aim my vector, aim my position in that direction and if I'm aiming at the right portion of their body, fire. Fire to choose from, but I don't know anybody that chooses anyone but the head, seriously. The speed hack. So this one is actually pretty deductible on a lot of servers. People have written a lot of plugins to perform the security that VAC doesn't. Which is kind of strange. We were talking about Source Mod and Meta Mod before. There's like a serious plugin that's written by a guy named Kagan which defeats a lot of these cheats. So while I was going around on just getting experience cheating, I don't cheat normally, as evidenced and you'll see in a second in the videos. I was worried that some of these servers would have been employing this mod and I was going to be caught but apparently they weren't. So the speed hack, real quick, it just sets a CVAR which is a console variable inside of SRCDS which says what is my host timescale speed and you can set it between 1 and 25. You don't want to go above 7 because you can't move. It's too fast. It's just insanely fast. 7 is about right. So if you're playing with this 7 is what you want to do. Humiliation. No pressure. No pressure at all. Rapid fire. So there's a couple of characters in the game that have pistols and basically you can flip a bit and your pistol turns into a chain gun and that's exactly what happens right here. It just comes in, sets the bit to fire and you go to town, just mowing people down. This works really well with the constant criticals. Cheat because when you have a chain gun it hurts people. An ESP. So ESP is it's just what you think it is. You're getting information about targets from a distance. You're finding out stuff about their class, their hit points, what weapon they're holding and you can see it through walls. So there's a good example. Real quick how it works. You're basically taking the model that's drawn on the screen for source or SRCDS and you're appending these values to it and you'll see in the next picture what happens. Double kill. If you can see that pretty well but that's basically based on the weapon he's holding, that's a scout on the other side of the wall and I know he's at full life so that's what ESP does for you. And I think we got a video. Can I annotate this video for you? This is my favorite. If I say no, will you not? No, it's not an optional problem. I need to stand up for this because this one makes me laugh. I almost fell out of my chair when I first watched this video. Logan doesn't cheat a lot.  He's still there because he doesn't want to get shot again. Well, Logan has ESP so he knows where everybody is but yet he's still looking where there's no one there because he's so worried he's going to get shot in the head. First he's going to get dominated by Boogie Girl. Boogie Girl just nominates him. I'm old Greg by the way. Now he's going to round the corner and he's got ESP so he knows where everybody is. Boogie Girl was on the roof and now Boogie Girl jacks him in the head. Same person. Now he's really scared. He doesn't want to be embarrassed again because he knows this is going to show up at DEF CON so he's a sniper and he rounds the corner and he looks up there and there's no one there. There's no ESP information but he's still looking up there. He's really worried that maybe she's got a cheat that disables the ESP Yeah. He does have a redeeming shot up here in a minute. I have a couple. I mean you were able to pull the trigger successfully I'll give you credit. Thanks. I don't know if there's a way to fast forward this or not. This gets kind of boring but in general you get the idea. This is a good part. The scout was coming behind the wall so I'm coming the whole time and he actually managed to hit him in the head. Thank you. So obviously this is a lot of information. You can't see through the walls you can't see exactly the characters but you actually still get the character information through the walls. It's a fantastically useful cheat so you can control at least know where everybody is. That's probably good. Hold on. Just a second. One more. There you go. Good job. Okay. 10. Killing spree. Alright. Constant criticals. So this is pretty useful but at the same time it's kind of a kind of a bane because the way that it happens there's not just a magic bit that says every shot you're going to make is going to be a critical. We actually have to try and compute our probability for a critical and on every tick of the game we try and see if our next shot's going to be a critical and if it is if we're pressing the button then we fire. So this can result in some lag time so sometimes you'll press the button and nothing will happen and sometimes you'll press the button and two crit rockets will come out. So it's interesting and there's a video to go along with it also. So for those that don't know a critical it's basically the same shot as another kind of shot it just does more damage like 50% more damage and in TF2 they also are lit up and they're a different color. So it becomes kind of abundantly obvious because normally you get one about every 5 to 10 and you start shooting like 20 in a row it's really obvious. So what you'll see Logan here doing in a minute is shooting in different directions in different places just so not everyone sees the fact that he's just unloading critical rockets over and over and over. I was pretty worried that my own team was going to turn me in for cheating even though it was helping them out but they didn't so that was a good thing. It's like a critical you hit the button and nothing happens. Don't make me come up here. Wow! I'm going to go with no video. Impressive. I would just keep moving. Alright so then there's a then you can do a thing called a wall hack. So this will basically draw the materials on the models in the game but it sets a certain value these values down here sorry these values right here when I set material flag is called and it sets the Z-index to something different than the wall so whenever a character is displayed on the screen you see it instead of the wall. You can you can see that pretty well there there's the demo man he's sitting right there obviously behind the wall but I can see him and I know exactly where you know what direction he's facing and what he's doing there that's part of ESP dominating and no scope so I don't know if you guys noticed when I was in the video back there but normally when you're a sniper you have a scope and your scope looks like that the one on the right that is the one on the left is what happens when you execute this code and remove the materials for all four corners of the scope it's a huge advantage as a sniper being able to run around zoom in and see 100% of the world you want me to tackle this or you got it yeah that's actually the end of the dark storm so alright a couple of things real quick one SRCDS will log just like anything else and what's interesting about the longing is that there's a lot of third party products that will pick up the logs and display like how well you're doing, how much you kick ass whatever and you go to webpages, hlstats, hlstats, x or some of the more well known versions of that anyone can write code to do that and there's lots of third party logging and log analysis utilities that are out there including the ones that we wrote which turned out were ripe for sequel ejection and DOS attacks because what are you out there Peter O'Toole there's a guy who was he at Shmucon at Shmucon he had a character in his name that killed our parser outright and Logan fixed it and then inadvertently commented that code out and then brought that code to Defcon and same dude showed up and crashed our parser again just kind of a cute trick to have it happen twice with the same guy you know it's basically you know this is standard stuff right it takes data it's going to parse it with a language, Perl, Python, whatever it's going to shove it in a database so it's ripe for issues like sequel and injection every once in a while I'll see somebody running around on the server with you know Robert Semicolon drop tables as his name oh it's little Bobby Tables just the greatest thing ever and like three people get it and everyone else like who's the dick with the name and meanwhile like I don't know how many it's amazing the grasp of extended ASCII characters that gamers have like I can't type in a backwards RF but sure should apparently like ASCII like you know 212 is that thing at some entire clan has that as their clan tag screw off I know how to do it that was another problem we had extended ASCII yeah barfed along on that stuff I think even today we still just basically drop it right yeah we just ignore it so if you have a fancy clan tag that doesn't have regular ASCII fuck off um meant that in the nicest possible way five minutes yes I think she might have thrown me out for other reasons real quick there has to be code releases because we're here at DEF CON so unfortunately we didn't have a lot of the security relevant code that we wanted to have to release here partially because we did get so wrapped up with this but one thing we wanted to do is turn back to community all the scoreboard and parsing stuff that we have for the real time stats tracking for the streaming video and all the other stuff so and team sign ups and the whole deal so if anyone runs land parties or anything there's actually a lot of code here that'd be very useful for you so that'll be available on the no moose website here shortly we have version one up there right now but version two will be released after DEF CON's and slogan I think it's still running said code it's done okay you sure I'm taking your editors away and we'll see what happens so and at some point you can go to our website look at the hokey video setup we had for Shmoocon which involved two transcodings and I shit you not an audio loopback cable for those that don't know that's a really short headphone cable that goes from audio out to audio in that's how we're capturing the audio yes yes that's exactly yeah it's idiotic so there was another release I was hoping to have which was a wire shark protocol to sector which was going to dig around and figure out all the innards of the source protocol stuff put in a bunch of work doing that and unfortunately what I've got so far written is basically I can see the first two 32 bit counters that are little endian what and I can find the strings that are all in there in TLV format so it parses all that stuff out but it doesn't get all the vectors of who's moving where yet still trying to figure out all the serialized stuff I hope to have that done actually this year it's still a project I'm working on but it wasn't done by this point and if anybody's interested in helping out feel free to let me know one last yes one last thing Shmoocon 2010 woo how many people here have been to Shmoocon? hot diggity for those that don't know Shmoocon's a security conference that the Shmoocon group puts on in Washington DC every year it's been the same place for the last five years there have been no more we've had people come up and tell us like at Shmoocon 4 that they've been to all 6 apparently it was so good there was a couple extras it's a lot of fun we try to be honest members of the community give back as much as we can through Shmoocon so it's anyway you can ask other people that have been if you haven't been it's a good time we really enjoy it and we really enjoy having people show up we have dates now February 5th through 7th 2010 again at the Warburn Park Marriott DC CFP will be open by the end of the month and you can follow Shmoocon on Twitter or go to Shmoocon.org for more info as it's released but you can expect the CFP will largely be like the CFP that we had before and most other hacker cons have as well which is have a cool project submit a rational write up you might get in so anyway that's lots of humiliation this is kind of a scattershot gun of a talk but we appreciate y'all showing up there's a lot of information here I mean there was just source code that we just you know washed over whatever you know feel free to download this presentation feel free to download some of these cheats from the places that we reference have fun with them get yourself an extra steam account though when you do because you might get your ass banned but it's it's really interesting because as Logan pointed out you know this isn't just a cheating thing if you can write a cheat for that gets past back you can write malware that gets past antivirus right it's the same techniques we're doing the same tricks to get past back as we are to get past McAfee and Symantec and whatever else and so it's kind of you're killing two birds with one stone right you get your rocks off blowing people up like playing a video game and you're learning how to write malware so it's like a double whammy who wouldn't do this is like an introductory course to malware giggle giggle quack all right I think that's it if you guys have questions you can catch us later on at the TF2 tourney where Logan will still be writing code I appreciate you guys showing up oh run run


Hello, I am Sushant Sinha, the founder of Indian Kanun. It is a website which provides a search engine for Indian law, Indiankanun.org. Today I'll be talking about right to privacy versus right to know the challenges and the way forward. So let us start with when this problem started. This was started in 2008 with just 50,000 Supreme Court judgment and 1,000 central laws. What I did was I aggregated all the laws and the court judgments into a common platform. The courts were publishing their judgments. I took them out through a crawler and made them searchable on a common platform. The search engine as it is, it provided order results by a messenger of relevance which was more relevant to the legal audience. All the documents were joined together. So if you are reading a court judgment and it cites a different court judgment, you can click it and read it. So it improved the document discovery as well. So what Alok was pertaining earlier was earlier all these documents were inside paywalls or inside court websites which are very their own silos. And you can't really go and read them, search them, do anything much with that. What Indian Kanun was that all that process. By 2011, we had almost half a million users per month. So as with the website the court judgments came on the website. They were searchable on the Google as well. They also landed the legal judgments were publicly even earlier as per the law but were inaccessible to general people. Landing on Indian Kanun also made the availability on Google improve and as such was searchable on Google as well. Over time the website ranking on the search engines improved and when you search someone's name you would find an Indian Kanun court judgment related to them on Indian Kanun that. So as what happens is I started getting a lot of emails that some court judgments need to be removed from individuals Initially most of these court judgments were related to matrimonial cases. And some were requests, some threats, some talked about my long term karma. Here are two examples I will give you which will kind of present this in a more nuanced way. So here are two requests the first request is pertaining to a person who had an involvement with a girl and apparently didn't work out and court cases were lodged against him and later his family was in a problem as he was not they were not able to get a marriage for a sister done. The second thing is also kind of interesting because this person had a court judgment which talked about his psychological disorder and then the companies, some companies actually set them on record that we are not going to have with that issue. So if you think about the two I mean these cases are much more nuanced than saying that something should be available to everyone. To deal with the requests some policy changes were done on Indian Karun. In the beginning what we received was mostly complaints regarding people ability to remarry up because the decisions regarding their past marriages were all available on Indian Karun. So as a policy response it started blocking matrimonial cases from generic search engine. We were not removing any court judgment but only blocking from the Google Yahoo using the robots.txt and that is started doing in 2012. The second kind of request that is started seeing was mostly related to job loss that I am not able to get hired because there is a court judgment related to me which doesn't talk favorably about me. Also the second was since a lot of people are actually business man in India one problem that they were facing was there was a check bounce case against me and no one is ready to do a business with me now. For Indian Karun no policy changes were done to accommodate these two kind of requests. Of course when you say that you will not comply with the request they file cases. So things move on to the courts. First case was in fact filed in 2009 when I was not there even in India. I was not in India even. And the court disposed of saying that we can't do much with inter-country request. So we are not going to take anything. Andhra Haikot dropped that request totally. Many court cases were filed for name removal. Some asked for complete removal of court judgment. Some asked for name anonymization and some were flatly denied. Like the Gujarat Haikot I'll come to that. The primary argument in these court cases were that people were facing hardship in their life due to recording of what happened in the past in these court judgments. And as Jyothi talked about also the Gujarat Haikot judgment it was an interesting case. So someone filed a court judgment citing a very specific Haikot rule saying that non-reportable judgments cannot be taken by a third party without an explicit approval by the court. It was a kind of a very interesting because it challenged the court based on its own rules. Surprisingly I didn't have any representation from my side so it was an exparte case. The Gujarat Haikot dismissed the request totally and said that there is nothing that requires to show that we can do anything about it. Our principle based approach was filed in Delhi Haikot it was based on right to be forgotten and it was removal of a particular name in a court judgment. It was based on the principle was based on previous decision of the EU court. But the EU courts did that with the privacy law and here we don't have a privacy law so this is more of a problem to grant such request on a principle like this. So of course the question that comes to your mind is let's suppose Supreme Court gave a court judgment on oh you guys have a right to privacy. So why is it not a violation of privacy to report everyone details in such detailed manner? It is also important to note that Supreme Court the judgment was important in that sense but Supreme Court has held the right to privacy as a fundamental right for last 4 decades starting from Menaka Gandhi versus Union of India in 1978. Supreme Court has repeatedly upheld individual right to individual autonomy over personal choices and the fact that they can control dissemination of information over their personal information. But as with all right the right is not a absolute and is set to one set of restrictions. So what are these restrictions to the right to privacy? The R Raj Gopal case which was a 1994 case Supreme Court laid out the contours to this right to privacy while dealing with the biography of a convicted criminal. So an author was trying to write a book on a convicted criminal R Raj Gopal and R Raj Gopal challenged that on the basis of right to privacy and Supreme Court gave a detailed court judgment detailing what the right to privacy is. It held that the right to privacy ceases to exist in matters of public record including court records. So if you write a book based on public record that is based on court judgments no one can do much about it. The second part to the right to privacy is that people also have a right to know on what facts and argument court into a decision. You know that you need that because appellate court decisions are also precedents in future cases. So if you want to argue your case you have to produce a decision saying at least you did the same thing in this case. The facts and circumstances are similar so grant me a same relief. And lastly, court or public repository of facts I think I will come to later which is something that inhibits this right to privacy. Let us come to the right to know. Supreme Court has placed the right to know as part of freedom of speech in a court judgment on SP Gupta versus Union of India. It says the people and I quote, the people of this country have a right to know every public tact, everything that is done in a public way by their public functionaries. They are entitled to know the particulars of every public transaction in all its bearing. The right to know which is derived from the concept of freedom of speech though not absolute is a factor which should make one value. And secrecy is claimed for transactions which can at any rate have no repercussions for public security. So as you can see the SP Gupta case Supreme Court laid out a pretty broad framework for right to know that every public functionary and of course courts are also public functionaries you have a right to know how they do things how do they arrive to decisions court judgments being an integral part of it you cannot do much about that. So people have a fundamental right to know about public right to information act is a enabling statute to give that right to a meaningful one specially with respect to the public authorities. Here are some instances I will talk about where right to know in court judgments has held do things. A person was arrested by Kerala police after one man googled his details and read a court judgment on Indian Kanwan about him. So apparently this guy was trying to fraud this person and he googled and he found this court judgment detailing what he has done in past he alerted the police and he was arrested. So individual identity of people are important it is not that they are not recently a journalist figured out about Lokniti foundation and how they were abusing PIS to form further government agenda in Supreme Court. So even when the petitioners are groups it is also important to them many times. And of course the use of precedent is one thing you can see that this is actually happened much earlier when Mohammed Azil Hussain who took AMU to Allahabad High Court when he was illegally suspended by them. He self represented himself in the court used Indian Kanwan and then succeeded. So precedent value is available to every citizen when someone something illegal happens to you you can get your own right and go to court you can self represent yourself. So the availability of court judgments are also important. Now after establishing people's right to privacy and right to know let us see how they cross each other. So once a personal dispute or commercial dispute reaches the court it becomes a matter of public record. And are people entitled to know all such dispute or entire details of such dispute just for the sake of transparency of the courts? To me what it appears to me is that this blanket exceptions to such public record is too broad. We need to balance citizens right with people's right to know and court should also respect people privacy to some extent. Now let's talk about the different challenges to modifying court order. The court judgments are repository of facts. They actually record acquittals conviction in particular offenses. They also contain detail about whether if an income tax authority levied you with certain things and let levied you with fines and whether you contested and won that case or not. There are many times when you are actually through the government through the state government through the union government for denying of your own rights and these are important repository of facts. One thing you would also notice is that many other things actually court does things like partition decree, succession decree are important. I mean this thing actually I realized after my father wanted to sell his ancestral home and the person who was taking a loan to buy that home actually had to show the partition decree that happened in that ancestral home and there was a will preceding it and whether that will was provided by the court or not. So these documents are not just document for things but also for the when we are talking about 40 years back these documents are also important for as a matter of for your further for justifying your property rights but justifying a lot of things. Even personal matters like divorce decree adoption deed, maintenance amount all this goes in court and these are actually enforceable. So one thing I want to make clear is when one of the things that people hate me for is that I just don't change judgments and that is primary the reason that we cannot just go and remove people's name from it because it has lot of importance in it. The second set of challenges 4 documents are remembered by party names. When you say SP Gupta versus union of India you know which case you are talking about. When you talk about like Kedarnath versus state of Bihar you know which case you are talking about. When you talk about Kesavananda, Bharti versus union of India you know which case. Remember if all the names are changed by something like ABC versus XYZ. Oh in that ABC dash some 1, 2, 3 who will understand which court judgment you are talking about. So that is an important way in common law systems where actually court judgments are themselves a law in law. And many cases have rich history behind it. For example if you would have heard the court judgment in which Kedarnath versus state of Bihar which challenge the sedition law. Whether sedition law is constitutional or not and it appeals a sedition law in a very narrow way but if you go back and read about Kedarnath there is a lot of rich history behind the behind that case. And similarly one of the most important judgments that has come out from Supreme Court is the basic structure doctrine which is the Kesavananda Bharti versus union of India. If you go and read about the mutt which Kesavananda Bharti was actually operating and why this eminent domain was questioned then it's an important history that everyone needs to know which case today becomes a matter of historical importance tomorrow you never know. And any mangling of the names impact historians and even ordinary citizens to understand how these cases came to court. So let's talk about removal of sensitive information since court records are public records we let us do some proactive removal. Let us not do a this is something I will advocate is what the courts need to do. The proactive removal is important because data once released is almost very difficult to erase from the Internet there is also a need to develop a principle of harm to exclude victim names. This currently applies only to such a protection is only applied to rate victims and that too only in the trial court judgment. So if there is an appeal happens in the high court or Supreme Court and somehow this name comes into their court judgment they are not protected and the identity is no longer protected. So this should be expanded to cover victims of molestation, sexual harassment and in all court documents not just the trial court. One thing that a lot of people talk about is let's abbreviate the name let's talk about partial name anonymization in certain civil cases like divorce, child custody, child adoption while I think those are fine approaches but as I said it will impact court documents as repository effect once you have removed the names no one knows what case you are talking about you cannot use that judgment to say see this is how I adopted my kid and let's suppose someone challenges the adoption or something like that. Once you remove names like that it will also impact how people have to cite a certain judgment. One more thing I would like to mention is there are many things that I have heard is about minors being harassed in schools because their name appeared in court judgment and this is kind of sensitive because people were studying in class 10 in 11, 12 since their name appeared in a court judgment related to some let's suppose divorce of their parents and this the children are not that matured they go and harass the younger kids and they are I mean they are under more pressure and not that psychologically developed to deal with these pressures. So one thing that we need to adopt is that there is no need to publish names of minors in any court document. You should always mention natsanon, daughter of whatever the names of the parents are but at least the minors should be completely avoided. There is also an issue with regulating with court judgment writing and I propose that we need to regulate these court judgments. The way these court judgments are written. One thing we need is the court should put its case finding conviction and acquittal at the top of judgment. So this is because many times people say I was acquitted court acquitted me but who will read the judgment. But if court records records its own findings at the top then at least people don't have to face that problem. There is also a problem with the judges of copying verbatim facts from the pleadings into the court judgment. Which is I think a mistake because then you are copying a lot of allegations of one another which people make in cases just because you don't like the other party. So only facts which are relevant to the judge to arrive at a decision should be placed in public domain. Also people should stop assuming that going to court means that its decision will be private. Once you go to the court based on what the laws are it will be published and it will be publicly available. So don't think that oh this is my private decision this is my judgment why are you putting it without my permission it is a court decision it's not your decision. Now let me come to this redaction after publication. So right to be forgotten I think it's a bad principle as it fits a private party with a private party. It says like Google has to determine whether the content is actually valid or it is important or not and how is a private party going to decide on what principles. In fact Google doesn't do any manual review of URLs to be blocked whether it actually confirms to the European Union finding they don't do that. I have myself made many people have claimed that a particular Indian Kanun link shouldn't be displayed and they actually delisted from the European Union websites and I have complained many times and there is no review there is no manual review by Google and it makes sense to them why would Google invest time and money to examine content whether something is relevant or not. EU court has said remove it they just remove it and it's the significant harm to the people's right to know which Jyoti talked a lot about more about what can happen with this reputation management and people trying to remove URLs and so the right to be forgotten should not be based on this private party people approaching Google, people approaching Indian Kanun. It should be by a law. The law needs to draw bright lines and quotes in their administrative capacity need to decide these issues rather than leaving it to each individual publisher. It should be based on the principle of harm that is demonstrable or to correct an error that cause certain facts to be lived in judgment that's all. So I don't think the redaction should do more than that which comes to the last slide which is privacy in public data sets. So I think still the court judgments are still the tip of the iceberg because it is the first public data set that is available in a electronic format. Now more data sets are coming up one of this is this first information reports which are the FIRs. These are also public data sets as per the Supreme Court order. So what is a FIR? FIR is people lodge complaints against known or unknown persons with full details about the crime in police station. So I mean some of these things may be true some may be concocted. Basically these are completely unverified allegations at least in court judgment there is a judicial mind applied to come to what is correct what is not correct FIRs there is no judicial mind. It is one person claim against the other or unknown people. It is in fact being published in Delhi and many other cities on a daily basis. So I mean another data set is that almost entire as Gupta case showed almost entire functioning of government is public. So things like that in future when tenders project land details, land use, land conversion all of this becomes public in a searchable digitizable format. I wonder what happens when a search engine is built on top of that and people can search it very effectively. Thank you. Thank you Sushant. Jyoti if you could just join us. We will have a round of questions. You can direct your questions whatever questions you had to Jyoti as well. I think we can have both the speakers take the questions. So since a lot of the topics covered were common you can just mention whether you want Jyoti to specifically answer or Sushant or if you'd like the speakers to offer their views you can go ahead and answer. So if you can have any questions, yeah ma'am. Jyoti you had the question or sorry he had the question. So this is Sushant. Could you just also introduce yourself please. I'm Venkateshan and I have a question regarding the dividing line and cases the way I see it. I mean I may not know all the details but at least in certain cases it seems fairly clear cut right? If it is a personal civil case, it's not a case brought by the state, it's not in public interest right? Then why should we not anonymize the names? I noted the fact that you mentioned that citing it becomes difficult X, Y, Z, 1, 2, 3. But I don't think that that many sort of individual personal battles like court cases that are necessarily cited that much A. And B even if they are, yes in those cases I think anonymity should trump the inconvenience or the awkwardness of the way in which these things get cited. So I mean two parts. One is that of course what I think is that there should be a lot defining what needs to go in a court judgment what needs to, the parties which parties need to anonymize not anonymized. But court documents as you know is also a repository of facts. So until unless you are ready to, no no I mean someone goes to a court gets a divorce decree it's a matter of public record. So until unless you are ready to completely forego that, that is something you mean the court or the courts have to decide. I mean but you could also think of it for example you are probably thinking it's a divorce or these personal ones. What if it's a private party involved in corruption cases and then what if these private parties also are managing public projects and then people bring it. No but you know different businesses can also lay charges on each other. It's not so again like Shishan said we should look at whether it is the individual bringing the claim forward, the groups bringing the claim forward or whether it's a corporation bringing the claim forward. I get your point that you know there is a need for anonymity but in many cases anyway the searching function is really really hard. Like as a non-lawyer you really can't like look for legal documents and then these names or these references become a really easy marker for you to be able to find information. That aside you know in some cases the fact that this action has taken place should be there. I mean there should be a very high threshold of when we remove records that are part of the public or at least there needs to be a very very strong legitimate justification as to why the need for protection of anonymity in that certain context. So maybe and we do have laws like that where Shishan will probably tell you more about it. So I mean there is a specific law in IPC which talks about not disclosing your marriage in your second marriage and it's a crime. Not disclosing your first marriage. That is different right? No no no. So I am saying if you do not disclose your first marriage while dealing with the second marriage it's a crime. Perfect. We have no that doesn't necessarily mean that we should display the full details of the first marriage. No that is something I mean I don't have So we should be conflating those things right? We are talking about publicly displaying personal battles. We were businesses, corporations, corruptions everything. Just personal battles. Yeah but why should we find out the names of the people? I mean let's suppose I want to find out whether it was the first marriage or whether my first... No if you should disclose you have right to that as you pointed out that is necessary to do. But it should be displayed, should be necessarily... How would somebody find that data if it isn't displayed? So say I get married and this person has come into my life and they've already been married before and they don't reveal to me that they've been married. What is the avenue for me to gather that data through using my own resources if these if the record of his first divorce is not there in the... Can we just move on to others as well because we can continue the discussion because there's a BOF after this. So we'll just move on. Can we just... Hi my name is Lakshmi. You mentioned about how blockchain is complex. I think it's... Hi please. Hi. You spoke about how blockchain is complex. I think it's the other way around. It's far more easier to understand and reason about than the policy and the laws and the legal framework etc. So let's say you want to build a blockchain solution which could be solution to many of these privacy problems. Just like WhatsApp says there's nothing we can do about fighting fake news because sent to end and tripped it. So it kind of solves many of these problems in this crazy hands thing. It's a public fact of public record. It's nothing I can do about it. It's just over and I can't help you. So if you were to even build a solution of that, I think how could you interpret many of these existing things in intervening courts and then changing policies, changing laws and then the super court powers that exist in the system. So first of all... Two, which is also a question to you which is would you consider a kind of a blockchain solution wherein you can say that there's nothing I can do because it's a fact of the court and it will... I can't intervene in the system because it will modify and the system exists like this. So that's a really great premise for the question but actually I would beg to differ from your opinion that if WhatsApp's problems had been fixed by the fact that it was using end-to-end encryption technology, all of the legal notices government orders and the media flag that it has been getting for the lynchings and fake news would not be happening and there will be efforts to over-regulate that platform because we have a very censorious attitude towards speech in this country. But having said that I'm no expert on blockchain, what I found really interesting while prepping for this conference was that we are introducing rights and we're introducing rights in order to certain... a focus and a vision that we have about empowering citizens but at the same parallel to this legislative framework of empowering individuals, there are technologies that are doing the exact same thing and what I found really odd was that the implications of the rights being developed to empower citizens and their implications on the technologies that are being developed to empower citizens are not necessarily speaking to each other but I see no way for me to be able to answer your question till I see more integrated thinking and coming together of people from both those sectors to actually think through these issues because that is exactly what is happening. A lot of decision making is happening in silos where government officials are like, oh my God, lynching is happening, let's regulate them. Are we bringing everybody in the same room and being like, if we do introduce this, what would be the repercussion? One point to add, we don't want to be in a situation where tomorrow the government says we're not going to allow any end-to-end secure encrypted messaging service because lynching is happening. I mean that's the worst possible outcome of any discussion. So I think the point which if I understood Jyothi correctly was to say, keep in mind that these two cannot happen on parallel tracks. They will have to today at this moment think of how this developing this technology is being developed without understanding that parallel conversation is happening about this right to be forgotten that may suddenly crash into this and we may end up with the worst possible solution. I think that's sort of just the point that I want. Broadly, government has far more powers than technology. It can just shut down an entire city. No internet today in Rajasthan. Government is way more powerful. Bitcoin is a distributed manager for currency management if they shut down Bitcoin. You can't do any transaction to Bitcoin. So I mean don't underestimate the power of government. As I said, you can just say drop encryption totally from all devices. So I mean you want a more nuanced and people meeting up rather than extreme steps. Hello, can you hear me? So I do understand that the right to know or the right to your public information should be available and people should be able to mine it. But don't you think there should be some legislature you know some kind of laws against how that data can be used right because for example yesterday there was a talk on getting the electricity bills of people using that to segment people and then use it for propagation and that propagation might be really harmful and may even result in riots. I love that example personally. That was an eye-opening example for me. You're right. We need really strong protection. We need very strong boundaries for who is collecting our data, what purpose they're collecting it for, how they're going to continue using it, for how long are they going to keep it. But this is exactly what the Sri Krishna committee has been working on for the past and Alok would be actually somebody who would be the best person to speak on this. I invite you to give us some views. I strictly can't but let me just sort of point out by saying I think the committee report will be discussing this point. They're going to submit it today in the evening as I mentioned earlier and this is one of the things that whatever bill they're going to recommend is probably going to address this point. There are probably going to be more discussions about it. The evolving framework. I will not say today that we'll have one law and the law will address all questions possible. It is going to have to evolve because people are going to respond to the law. The law will have to respond to people and vice versa. So I would say that let's wait for that report when it comes out today. The principles I think is what is going to be important. More than what the exact law. You're absolutely right. We need a law for this but more than the law the principles on how this law is going to be made important. What are the institutions we're going to create to enforce this law equally important. I think we miss out that institutions part in a lot of our discussions. So I think this discussion it's unfortunate that this thing is happening one day before that report came out but yeah that's a very valid point and maybe the a lot of the answers will come out in that report. There was one... A larger question. I'll be both a radical archivist of sorts who is opening up information and chatting down information for privacy. So the larger question right now is transparency is required so is privacy. But as you mentioned both of your talks we need a theory of harm to say when should transparency be up or when should privacy be weighed up. What are larger societal needs versus what are individual's privacy requirements. What tops what. So the question is most of these discussions have been academic and only because it's affecting individuals right now with the government's mandatory data collections requirements with the digital India program that people are very agitated. Now the important question is how do we ensure that these debates are discussed more often and how do we evolve the theory even in the academic circles both from a technical point of view and as well as the legal point of view. In terms of technical points the concept of redactions for example that is not there in the current publications. I mean we should have more talks more debates around this. We are having one today certainly more health. But I mean the academic should do I mean I think this is a new upcoming area where academic should invest time and effort into delianating this and have been in touch with some of them talking about what needs to be done and what doesn't need to be done. And some of this what you have seen today some of the proposals of what needs to go to the court judgment and what should not be done is actually coming from that. I'm going to be a bit controversial and actually say that we owe Nandan Nilakani and their India stack developers a whole lot of thank you for opening up our eyes to the creative wonderful ways that our data can be used and weaponized against us. So and I'm also very glad that these conversations are not weren't happening even 5 or 10 years back for a selfish for one selfish reason and for not so selfish selfish reason being I wouldn't be a part of it. Unselfish reason that I don't think as a country we were ready to take on these questions. I think the fact that Adhar happened the fact that we are contemplating and negotiating with ourselves what our digital identity should be what is the government imposing this identity and then you know linking databases and that identity to all manner of services. But I think a lot of what this has done is it's opened up our own eyes of how we want to be seen like you know do we want to give up our data do we not give up our data is is this app collecting our data is our location button on we had a birds of feather session on AI and you know it was really interesting we started that session by asking people what are the measures they actually take to protect the privacy online and I was so amazed to hear about the variety of answers. So I'm glad that this conversation is happening now I agree with you that we need to move a little from the academic discussions and bring more practical approaches but I think more than that we need to open these conversations from the same silos of the same 10 people sitting and talking about it. I hope they are bored of hearing each other and invite us in. One last point I want to make is that important part about law meeting the technology is also that many times the tech people do very interesting exciting stuff but then catch up with the law and the law has its own way of punishing. So when a prime example is someone like Aaron Squads who actually was doing phenomenal work he has a deep understanding of society politics things like that but the way the law soon within him and he had to do a suicide is just shocking and something that the tech people need to understand about the law there should be more meeting of the mind of law and technology. So just very quickly lunch has begun so if you would like to go ahead and start beginning lunch you are most welcome but we will continue this discussion because I see that a lot of quite a few questions so we will continue to take questions but if you want to go ahead and start lunch the lunch has officially begun. We can take a few more questions I'll just take one there. Hi Jyoti and Sushant it was a very nice talk and kind of an eye-opener for me like these things are available in public domain today. Thanks. So like the fact that site Indian Kanun which shows all the legislatures is available today is a very good thing. So yeah so basically my question was a reverse of what we are discussing here like right to be forgotten I am trying to ask a question from the other side what if somebody something has happened to me something has been reported around that I am only talking about public legislations right now nothing private legislation or something. So if somebody some person has done something and that is not coming up in in his Google search then I should have an issue with that. So it's a reverse question. So I think I am able to convey the question Yes this is exactly the way to having that with Halok. Yes people right to know we need a statutory protection around that too. The only one that we see right now is right to information act perhaps we need broader To be fair I have argued for a while now that the right to information itself needs to be a fundamental right sorry I have said the right to know and the right to information see right now it has been interpreted to be part of your freedom of speech and expression I have said that the right to information and the right to know should be a fundamental right of course subject to privacy and some other considerations so that is something that needs to be proactively put out there and but that's a very valid point but again there are issues about how do people find out what do people have a right to know what do they have a right to know publicly available information and who do we put the obligation on I would say the obligation should be on the government not just on other private entities so the obligation should not as Sushant pointed out there is a right to information act everybody talks about really section 8 of the right to information act which are the exceptions to me the most important provision in which one which everybody forgets in the right to information act is section 4 which says that the government has a duty to proactively put out information which it fails to do to me that should be the most important part of the act and we should think of ways of making that more robust and that is really which something we need to work on and just to add to sorry yeah please go ahead so basically right to forgotten is something like you are having a legislation on top of the existing legislation to nullify something so basically if you have both the legislation in public domain then is that sufficient to say that right to forgotten has been exercised allow Jyoti to sort of answer that and also add I mean I think it's basically very similar to what like the ledger technologies are there something has happened then something corrective action is also publicized on the same portal or whatever and this is this concern is coming out actually in GDPR where you know that if you let's take blockchain for example if you start implementing a right to be forgotten request on blockchain it is going to be part of that transaction history in some way or the other which defeats the purpose of the right so again it will depend very much on how that right has been interpreted what are the parameters and boundaries that have been constructed around it just to add to the point about RTI you would be very interested and if you follow the RTI debates you would be very interested to know that a bill so the Shri Krishna committee is coming up with a set of recommendations now usually these recommendations are principles as Alok pointed out but part of working through the idea of coming up with these principles or codifying those principles or kind of a template for how those principles would apply would be a bill which is usually annexed as a sample or as something that needs to be considered and mulled over as part of these recommendations and one of these versions of these bills which we don't know is the final version or not has been leaked and the caravan has been reporting about it and it is absolutely shocking to see that there are provisions there that are seeking to water down the existing RTI act so not only is the government not fulfilling its obligations of providing data publicly but whatever provisions we have there is somewhere within our government machinery some kind of coordinated action or thinking about watering down these existing provisions I think as citizens we need to our heckles need to be like up and we need to be really aware and checking out what is going on with our right to information so I would urge you to follow these discussions really closely Dvij at the back sir Hi firstly thanks for your great presentations they were really informative learned a lot more about than what I knew about this and my question is to both of you and a little bit of a comment actually I was wondering if it makes sense to actually conceptually frame the right to be forgotten in two different ways right one is a general right to deletion which you've seen evolve in privacy principles that you know anybody who holds information over you as long as it's your information you should have a right to access it control and delete it the other evolved and this is where the right to be forgotten framing I guess kind of came up in recent history is about the ease with which this information is accessible or searchable and indexable which is why in Europe the context is the right to be de-indexed but in your presentation you gave a lot of different other examples like the right to be forgotten against a specific newspaper which is definitely not the context in which it evolved in Europe right so if you see it only from that second context in the context of the right to be de-indexed or the right to not be so easily searchable raise the cost of search does it make sense to then start talking about and obviously the technologies that you're using for searching are platforms right so you have facebook twitter google whatever search engines so do we need to start talking about how we regulate the ways in which these entities enforce the right to be forgotten to place the responsibility upon them because right now it's done in an absolutely ad hoc manner no actually it's not done in an ad hoc manner so google so there are a couple of issues with your statement which I want to just step in and correct facebook and twitter are not search engines google yahoo are these are hosts and the kind of obligations so like they're both platforms they're both letting you access information you know but they are different types of information you're interacting and engaging with that information in a different way depending on the platform you're accessing that information from so the obligations and liabilities for these platforms have been constructed around the role they play in allowing you access to that information now the search engine becomes a really important factor in accessing information because that's your first point right you want to look for anything you type there and that is why if my reputation connected to the search URL you know it's very significant for me because anybody who types my name will see that whereas you know on these other platforms like twitter and facebook there are certain other order of mechanisms that can create or you can tweak to create more personalized controlled over your data which a search engine doesn't afford you so fundamentally these platforms are very different and we should be very clear about how we talk about it your question being that how if you think about just raising the costs of search and a lot of this thinking is actually happening in EU so you see the distinctions even in the Canadian judgment which I find very interesting I mean in one extreme end of the judgment they're talking about using geo identifying techniques and I found that was a tricky bit but apart from that I think it gives a really elegant or if somewhat a movement towards an elegant solution where it's saying that you don't remove the data but you rank it further down you know based on the request so it's not escaping the public domain but the effort required for you to access that increases and I think more and more as judges and courts begin to think about these challenges and issues it's only a 4 year old right you know and to be fair Google did do a very robust consultation they invited academics so they do the procedure of everything is algorithmically done I don't think they are manually looking at these requests and as with any kind of decision making it's opaque and it requires some sort of you know oversight they're not looking at the content whether it fits the irrelevant and those criteria for delisting they're not looking they're only verifying the identity if the person has requested they're delisting it so I'm sorry to interrupt you but I mean let me I think this debate on private versus private is a very bad debate we shouldn't be having it because the most common thing I hear is take money and remove my court judgment and this can happen with any platform in what is my right by why should I not take my money it is good I will be much more richer I should just collect money so this is this kind of extortion shouldn't happen first of all and this whether once you give up like you gave a right to Google to delist and started delisting almost entire content is delisted I wonder how you work with that kind of thing so I mean I personally disagree with this private versus private if you want to do frame a law on what should go into public record what shouldn't go into public records there should be a law for redaction that should only court should in its judicial capacity should exercise that private people should not exercise that and that's actually what my question was is that with content moderation at scale at scales and if you've received if Google received this request last year that's in a massive scale for even like algorithmic you know deliberation of that would have its own problems as far as I know actually from three years ago I had a conversation with someone at Google who told me that they have like 500 people who look manually at these requests maybe it's possibly changed I don't know but at some point it was a manual deliberation so which brings me to my actual question sorry I won't continue after lunch because same people will be there but I agree with what Shahan said basically we are giving too much power to these platforms to make public deliberations which I think is something we need to take into consideration okay thank you everyone