Heavy-handed security searches of hotel rooms at Defcon/Black Hat
secjuice.com
secjuice.com
What this hotel(s) did was unacceptable. I hope some lawsuits come out of it for the more egregious violations. No one was worried about some hackers going off the deep end, this was a heavy handed display of power over guests. I'm surprised none of the intruders had guns drawn on them. These were unidentifiable goons seemingly breaking into rooms. DEFCON is the most important security event of the year, I do hope there is a boycott after this event and all of these hotels are blacklisted by the security community.
"In a statement released to reporters, Caesars says DefCon organizers were informed before the conference of the new policy ... .. Marc Rogers, DefCon’s head of SecOps and vice president of cybersecurity strategy for identity management company Okta, said the conference is aware of the room problems and is working with Caesars on reducing conflicts for next year. “These changes represent the new reality that all hotels have to face in their work to keep guests safe,” he said at the conference’s closing ceremony Sunday. Caesars is “working closely with DefCon management to figure out the best way forward for next year.”
Some DefCon attendees are claiming on Twitter that they will refuse to attend the conference next year, if it returns to Las Vegas. Of the more than 1,650 votes in response to an informal poll started by Twitter user @notdan, a security researcher at a tech company in the San Francisco Bay Area who requested anonymity, 35 percent said they would not return to DefCon over room privacy concerns ... Moussouris emphasized a similar concern: that hotel room privacy is of paramount importance, especially for female travelers. “No matter whether DefCon moves or stays put, all hotels should have basic protocols for allowing any guest to easily authenticate a supposed hotel employee,” she wrote."
"Now we have an excuse to violate your privacy and steal your shit we're going to take it and make you accept it".
Maybe the best way to deal with this would be to make fun of and exploit security theatre.
But the whole thing seems like security theater to me. There's no way this is going to prevent anything other than people actually going to those hotels.
If hotel security forced their way into my room in any property I stay at at I'd be checking out immediately and would be doing a credit card charge back on any charges.
How do you perform a credit card charge back yourself?
If they refuse or don't reply you call your credit card company and tell them you dispute the charges; they usually immediately refund you and take it up with the hotel.
For instance - while moving from Arkansas to Virginia in 2013, I had a rifle with me in the U-Haul, and didn't want to leave it in the vehicle for it to be stolen. I just slung it barrel-down over my shoulder and carried it with all of my family's bags to the room, right past the front desk. It was a folding AK variant, which I chose for the trip because it was easy to keep accessible behind the seats' headrests, so if they were going to have an issue with a rifle that would probably be the one.
Not only is this sort of thing fairly typical in many places, in some (most?) states a hotel room is considered a domicile, and it's illegal to ban firearms as a condition of renting the room.
This is how you get your speaker system stuck on 24hrs of wpic sax guy radio.
Alternatively there is always the Tetris Brainworm or Bob Ross sessions.
A bit of Googling turned up a video on the evolution of the MLP theme from 1984-2014 [2], and contained therein was the G4 theme. But also in there or in the subsequent Googling it inspired I learned 3 other interesting things:
1. Some of the earlier themes would probably be more cutely annoying than G4 for this application,
2. Sandy Duncan and Tony Randall were voice actors in the earliest MLP stories in 1984. They were both pretty well established, critically and popularly acclaimed, actors. I would not have expected such big names in this kind of cartoon in 1984.
3. That's nothing...the 1986 movie had Randall, Danny DeVito, Rhea Perlman, Madeline Kahn, and Cloris Leachman. Either I'm totally misremembering the state of animation in 1986, or MLP was a way bigger deal then I remember.
Today's Vegas is not your parent's Vegas. It’s all professional investors now, very little mob left.
MGM Resorts Properties: Bellagio Circus Circus CityCenter (50% joint venture with Dubai World) Aria Resort & Casino Mandarin Oriental Excalibur Luxor Mandalay Bay MGM Grand The Mirage New York-New York Park MGM
Caesars Entertainment Corp: Bally's Caesars Palace Harrah's The Cromwell Flamingo Las Vegas The Linq Las Vegas Planet Hollywood Rio All Suite Hotel and Casino
I'd personally say that you shouldn't treat anyone like this.
It was great fun. But if I had been staying as a non-DEFCON guest I would be furious.
Move DEFCON to somewhere else next year in protest. Then they might learn their lesson.
That would explain "incredibly unprofessional and heavy handed about security".
Turns out it's not just the government who have an anti-tragedy agenda.
If you want to be cynical about it you could say it's bad PR for the hotel. But really, the people making these decisions are actually human beings who don't want their fellow human beings to be murdered.
> large and diverse group of counter-culture oriented people
Ironically this is the exact opposite of the mass shooter "profile".
They do allow you to have firearms in your hotel room, but request that they are kept secured in locked containers. Many firearms industry trade events take place in Las Vegas, including Shot Show. I have personally been in hotel suites during that show that had several dozens of firearms on display.
From what I understand the big change to security now at vegas hotels is an increased awareness of people who refuse maid service for days at a time, as this specifically allowed the mass shooter to prepare his room without alerting anybody.
I know this is a right dear to many Americans -- certainly not all though -- but hn is a global forum and I'm giving an outsider's perspective. Wouldn't have thought that'd merit downvotes?
nb: that was a reply to vageli, but there wasn't a reply button yet.
Britain didn't know to be on the extreme lookout for any signs of armed rebellion in the 13 Colonies; by the time they positively knew what was going on, their best hope was to try to take the militia's arms.
As such, the Founding Fathers didn't learn first-hand the value of privacy in quite the same way as they learned the value of arms-bearing.
For clarification, do you mean that after more time
- the hotel will forget about the shooting,
- shootings will become less likely, or
- secret privacy invasions that people were never meant to know about will stop being such good PR.
I think maybe closest to the first? That we should be understanding in the short term around overreaction because those businesses have suffered trauma and just need time to get back to a normal state of mind.
Of those three reasons I have the most sympathy for the second, though still not a lot. Perhaps all of them can be phrased more even-handedly, though, and maybe there are better reasons why the passage of time might matter. I'm happy to listen.
> What did they expect?
I think they expected respect, privacy and professionalism from their hotel at their conference. They wanted to feel safe, not invaded and bullied.
This kind of thing will drive more people to Airbnb -- security is worse, but trust is higher.
Just like checking shoes before boarding a plane after 1 shoe bomber...
Or are they afraid of copycats?
Honestly they should just invest in a bit more tech. How about modifying their lifts to detect large amounts of metals, or explosives? (Well, there's your next security technology goldmine). But of course hiring muscles is cheaper, never mind that maybe party goers will stop coming to Vegas if they get harassed.
Reality is that the searches of peoples stuff was a heavy handed and unclear policy that the hotels didn't make clear to the customer so that they could have an informed choice. However a Mark 1 eyeball is in this case probably the most effective choice for a security mitigation.
You can't claim surprise or lack of precedent for the second time, and it really does look like negligence to the circling lawyers if you didn't react to it.
In risk management terms, the likelihood of a repeat might not have changed, but the consequence of a repeat sure has.
Maybe such simple things as having identity verification in place for their security people?!
This kind of 'emotional' logic is dangerous and can be used to justify a police state and tyranny.
It's quite possible to ensure security without being a tyrant, and setting up processes upfront and being transparent about it. This is sinister, more associated with a police state.
As a thought experiment think of the Chinese security services doing this at an international security conference and it becomes clear why this kind of apologism doesn't work, no one would justify that.
I don't understand - have those "people" never been to a hotel? Or do they visit hotels where luggage searches are somehow normal/acceptable? What do they want? Airport-style luggage searches for people who stay at hotels?
That being said, if your things are being actually rummaged through and arbitrarily confiscated, I'm completely in disagreement with it. Especially being done by "security people" with no ID.
Ok, ok I get it, Vegas hotels probably have to deal with way more crap from guests than your average hotel, still, this is uncalled for.
Still, hotel rooms are serviced, nobody should be going through regular suitcases, it's a different thing to turn away room service for days at a time and have big boxes and crates that don't look like something ordinary
> have those "people" never been to a hotel?
I have. Hotels are not rentals. A degree of privacy is expected, surely, but it's not "free for all"
This is just the nature of public discourse. The newreading public is not going to withold forming an opinion, tweet or somesuch until they've thought through all implications. They are going to have general, simplified opinions. This is normal. It is kind of disingenuous taking this to mean "people want __insert totalitarian implications__.
Hote security want similar things. They have a more nuanced understanding, being professionals after all. They particularly don't want to be blamed after-the-fact for having overlooked (in retrospect) danger signs. The type of people with the kind of stuff that go to to defco probably alert all sorts of "common sense" danger signs.
Lisbeth Salander walks through the lobby towing a 150kg box....
Typically a mass shooter is not a criminal until he starts shooting people. Correct me if I’m wrong but what you sound like you are saying people want “pre-crime.”
I don’t want to live in a place where I might be arrested for something someone guesses I might do.
Well for one thing they likely expected that the hotel change their policies to reflect that they are going to go through guests luggage, and to clearly state that security guards are going to go through their rooms.
The outrage isn’t that hey are doing this, it’s that they are doing so without proper information and without following their own policy.
Which is completely irrelevant. He could have done the same thing with a single suitcase containing one rifle and a bunch of magazines. The whole 20+ (I don't know the exact figure) guns thing was not in any way necessary for what he did. Do people think he was some kind of eight armed octopus firing umpteen guns at the same time?
Even after 9/11, I didn’t have goons busting into my N.Y. hotel rooms just in case I had lockpicks in my luggage.
If these people are a security threat, call the real cops. The only time I’ve seen this sort of behavior is in circumstances when rent-a-cops are given police/peace officer status.
Most big hotels provide a vault or will hold luggage locked in a secure area as well. They won't open it for insurance/liability purposes and do not require access to the contents. A person could trivially store contraband in the hotel's direct custody and not throw a red flag by keeping the cleaning lady out.
This is just security bozos throwing their weight around.
It's not just the memory, but a direct consquence of our insurance and civil litigation norms.
To have privacy in their hotel rooms; to not have their lock picks stolen by hotel staff; to have some way of distinguishing these "security" guards from random strangers trying to take advantage of the situation; to tell the staff "not now" and have them listen; etc.
None of that is unreasonable. I would have canceled the remainder of my reservation if a hotel treated me like that, and I would not bother going to conferences held at those properties.
You can more or less do this at CCC, too. The Hamburg convention centre was quite central, and the Leipzig one has a regular all-night tram service to the central train station (or did last year, anyway).
I'm sure there are some large well-located convention centres in the US that could be used.
As I was reading this my wife was actually just looking at a craftshow event announced as a FB event where the first sentence literally said the location and someone commented "Where is this show being held".
https://twitter.com/beauwoods/status/1028387331927986176/pho...
This is as useless as sharing a Facebook status update saying you don't consent to your data being used.
https://www.reddit.com/r/Defcon/comments/96u2u3/next_year_is...
It is disgusting. They just mopped the room next door, where people are vomiting everywhere, and then they drag that mop around my room. I'll have to disinfect it again, as I do every time the maid has been in. This is such a pain. (wiping every switch/knob/handle with Lysol or similar)
Then there is theft and breakage. So now I have to lug my stuff around instead of leaving it in the room.
Then there is me. Maybe I like to do things in private that might be embarrassing. Maybe I want to sleep during the day.
For all these reasons, maid service should be opt-in. I should have to leave the room unlocked; there should be no maid key. Entry without my permission should require a boltcutter, prybar, breaching round, battering ram, or saw. (and yes, guests who needlessly cause this should be charged for the damage) For the time during which I am paying for the room, it should be mine alone.
Can someone please tell us why the hotel might choose to do this to some guests? (Be fair in your statement, please. I'm just looking for the 'other side of the coin' out of curiosity.)
https://en.wikipedia.org/wiki/List_of_Las_Vegas_Strip_hotels
Generally speaking police do require a warrant to search hotels in the states but it is an area with nuance.
Hotel security are not police. They are more like landlords. So the 4th Amendment does not apply to them (which every security professional on Twitter is currently experiencing collective amnesia about, apparently).
However, like landlords, state/local jurisdictions usually set rules on hotel tenant rights. I'm not sure what those rules are in Nevada, but I would bet that they are much more lenient there than elsewhere due to regulatory capture, since gambling is such a lucrative industry.
Just because you think your ideas are nobel, righteous or inherently good, it still does not allow you to use any means possible in order to push them.
What's next? Stage a murder and frame someone you think is evil?
Edit: we already have the counter-example where the search didn't happen and saw the result. Lets agree that there shouldn't be any unknown contraband / dangerous items in the hotel for everyone's sake.
The Vegas shooter bough all his armaments in suitcases. Suitcases in hotels are suspicious now?
I'll skip maid service for a the duration of my trip if it's a week or less, and let them in once a week if longer. I don't have new towels and bed sheets daily at home why would I need them changed daily in a hotel?
> One search like this could have prevented the Vegas shooting, and its worth it.
And one search of any mass shooters house would have likely stopped them as well. Should we encourage them as well. I mean WON'T SOMEBODY THINK OF THE CHILDREN?
> There is a line we shouldn't cross as far as privacy / safety, but if you're staying in a hotel, you're on their property
Then let me verify the security staff, and don't have them steal my shit. If I have "objectional material" you ask me to leave or ditch the stuff, you don't take it.
> in a shared public space -- same as on an airplane or mass transit.
No it's really not.
> Lets agree that there shouldn't be any unknown contraband / dangerous items in the hotel for everyone's sake.
Let's not. Knives are dangerous, vodka is dangerous, hell water is dangerous, lets ban that to.