When Security Compromises Security – The Caesars/Defcon debacle
defiant.com
defiant.com
Just look at this situation. Unless hotel security have been breaking the law, which is unlikely, staying at these hotels means they can legally search your room and possibly your things. The only thing standing in the way of this is the reaction from the organizers and attendees. So if you care about your rights you don't really have much of a choice than to react and moving, at least out of Las Vegas, shouldn't be a hard decision.
And this would be illegal in at least part of Europe since a hotel room is categorized as a temporary residence.
Source, go through the body scanners at the TSA. Worn down, can't be bothered to "echo FUUUUUUUU > /dev/null" any more.
https://www.gsblaw.com/duff-on-hospitality-law/guest-room-pr...
https://scholarship.shu.edu/cgi/viewcontent.cgi?article=1048...
From my very basic understanding of what transpired, the hotel security were trespassing by entering a rented room. I'm not altogether familiar with state law in Nevada, but that could certainly be argued in California.
Hotel Security aren't the federal government. The 4th amendment? C'mon.
FWIW; at camping festivals, I know your tent also is a temporary residence and requires a warrant for search.
As I mentioned, this sounds like a case of trespassing. If it were me, I’d be pursuing charges on that basis.
Care to clarify what do you mean by this?
Of course, most places in Europe also have much stricter laws on guns. Many places aren't quite into the whole "free speech" thing in the way Americans are. These things are pretty important to a large number of attendees.
DEFCON is probably best regarded as a regional North American hacker con that reflects the culture and history of North American hackers. You cannot transplant DEFCON and preserve its cultural history. This is an issue of some concern, as it's the people and culture that matter the most at DEFCON rather than the conference that someone who has never attended might reasonably assume. After all, it's just a conference, right?
Continental Europe already has CCC. DEFCON's roots and history tie is pretty firmly to Vegas.
Guns are an easy example. Lockpicks are another - the UK does not smile on them. I'm saying you cannot readily relocate DEFCON to a randomly selected European conference venue without fundamentally transforming it into something that is no longer the DEFCON we know and love.
To put it another way, your suggestion and incomprehension underscores that you understand DEFCON as a conference. An event where people talking at halls of other people is the main thing that matters. I'm trying to communicate that it is a convention and cultural touchstone enabled by the unique confluence of laws in Nevada and the willingness of casinos to cooperate with wealthy groups.
It's very easy to suggest that an event be moved somewhere else. Why not move Jeremy Corbyn's next rally to, I dunno, Canada? There are halls for rent there too! It's perhaps more subtle to understand that there are other things than bare physical requirements that tie an event and a place together.
Because Jeremy Corbyn is a politician whose constituency is in the UK. The just makes DEFCON sound parochial
> Lockpicks are another - the UK does not smile on them.
Yet locksmiths in the UK routinely carry them.
You seem to be trying to paint a picture of Vegas being free, and Europe being oppressive. There are plenty of things that are legal in parts of Europe that are not in the USA. What you have really succeeded in doing is painting a picture that DEFCON is so much about guns that you would not trade the guns for anything.
You're exactly right! His events are tied to a place. Perhaps DEFCON is a convention whose primary constituency is in North America in the same way that CCC is a convention whose primary constituency is in continental Europe.
> Yet locksmiths in the UK routinely carry them.
Because they're licensed for such. Random people are subject to arrest for doing the same thing. Which would mean that nearly everyone who visits the lockpick village would be subject to arrest and a goodly number of other attendees. We're talking about thousands of people, arrested for having funny-shaped little bits of metal.
What I'm saying is that you are possessed of the wonderful opportunity to come to a greater understanding of what DEFCON - and its community - are. It's perhaps possible that you may stand to benefit by perhaps seeking first to understand the thing you wish others to consider changes to.
Because this is what fear has done to the world. As much as I hate the status quo, caving in and not going when I've done nothing wrong only serves to perpetuate it.
Oh, and they made fun of how much I paid for room service, which is weird because it's overpriced to help pay their salaries... shrug
I get the why of what they're doing, but they didn't look through anything, so if I was planning something I could have had it all just in my dresser.
Defcon is moving to Paris, Bally's, and Planet Hollywood next year, but those are all Caesar owned properties, so it doesn't address anything. Although the room service may be cheaper.
$55 for a bad 18" NY style pepperoni pizza
There's an 18% gratuity and a $10 delivery fee for every order.
That's something you assume but cannot know unless you had a look at their books. Paying security out of room service seems quite odd. I don't think that the salary of security is based upon room service at all.
Apparently these security people weren't that useful security wise, but maybe it's more that they know that too.
DEFCON was at Bally's and Paris for two or three years two or three years ago. The theory a few of us have is the Caesar's Palace people were looking for soldering equipment (that might damage their tables) and that Caesar's doesn't care as much if there is damage to their less prestigious properties.
Black Hat is a bit more subdued. It costs a lot more to attend Black Hat. Black Hat parties are more like casual social gatherings. I believe that in Europe, country clubs are more likely to be called gentlemen's clubs. In either case, it's usually the richer people attending.
[1] https://en.wikipedia.org/wiki/North_American_fraternity_and_...
https://events.ccc.de/congress/
No page for 2018 yet, but a little reminder that there are great events in other parts of the world too.
If a woman is worried about being put into a situation where they feel they are at more risk of assault/rape they should be listened to. Its a shame that is being drown out in favor of the invasion of privacy narrative.
The problem, as I read it, is that the hotels started more intrusive checking by security guards without considering or providing for the needs of some guests to be less than fully co-operative (for good reasons).
Caesars, and the other hotels, are trying to find a balance between the security needs of the guests and the security needs of the staff. It's going to take time to work everything out.
Just a few weeks ago, the hotels reached an agreement the maids union to provide every one of them (20,000, at least) with wireless panic buttons that geolocate them down to the floor and room. Even Google doesn't have that kind of granularity.
And all of the security changes have to be worked out between the property, Metro (the regional police force), the FBI and others. It's a complicated process.
What happened to a small number of people at DEFCON is sad and wrong. But chances are it's wasn't malicious. On a busy weekend, 350,000 people visit Las Vegas. The number of people affected by what happened in the blog post is less than a rounding error. Mistakes happen. Security people are still people. Life will never be perfect when you interact with wetware.
For the record, our room bill at Caesars alone came in at over $50K
$50k is nothing to Caesars. You see bar receipts for more than that discarded on the floors of the nightclubs there.
/Written from a nearby property, overlooking Caesars
The thing is, they don't need to be going through a change. A crazy man did a crazy thing; that's no reason to upend life. The next lunatic's lunacy will very likely be different.
As an aside, I had no idea that there are hotels which conduct weapons searches (and hence presumably ban weapons). Do they offer guests a place to check their weapons?
In a logical, computerized, HN-centric world, that is correct. But we live in a world filled with people, who aren't always logical. The hotels also have to think about insurance liability, lawsuits, and a million other wetware factors.
Do they offer guests a place to check their weapons?
It is possible, but I don't know for sure. The reason I say it's possible is because there are a lot of people who fly to and through Las Vegas to go hunting, and stay in the casino resorts because they're all very close to the airport.
Earlier this year there was a news story because someone was stopped at the TSA checkpoint because they found a dead cougar in his luggage from a hunting trip.† They let him go because it was weird, but not "Vegas weird," and not illegal.
To illustrate how close the resorts are to the airport, the runways had to be shut down during the October 1 massacre because a number of people fleeing the festival grounds ended up on the tarmac.
Another reason it's very likely that weapons can be checked is because Las Vegas hosts several enormous hunting, weapons, and arms conventions throughout the year.
Also, having lived in both Nevada and Texas, IMO, the chances of some random (local) stranger having a concealed weapon on him is exponentially higher in Nevada than even Texas.
† http://www.fox5vegas.com/story/37149625/cougar-found-in-mans...
The insidious aspects of society usually aren't. That doesn't change much.
I have not seen remarks in the security community that people were afraid of being arrested out of the blue like Marcus Hutchins.
This stuff happens every year, probably multiple times.
The people worried about the FBI already avoid the US.
Had I been older, they’d probably have arrested me.
I ended up being arrested months later by local police.
Also if you're into crypto you should go to the summerschool in Croatia or the workshops at Eurocrypt!
So I might be worth it for people who haven't experienced that sort of thing. But otherwise I would recommend watching online with some friends and travelling someplace else for new experiences.
I think the differences between CCC and DEF CON are roughly:
- CCC is much more political, more about making statements about privacy, etc. There are often journalists there, and there's much more of a balance between political/cultural/privacy issues, and the tech side of hacking.
- CCC is based in the European hacker counter-culture which is quite different to the US hacker counter-culture.
- CCC is a bit more community focused, being very low-budget, accessible ticket prices, more hostels than hotels, etc.
From https://marcrogers.org/2018/08/13/open-letter-to-the-hacker-.... (linked in the article): "Yes hotel staff NEED to check rooms but if we, who can change the very building blocks of life, can’t come up with a safer way to do this then we really aren’t trying hard enough."
No, they don't. They have thousands of security cameras set up, and I'd be shocked if they didn't have technologies like facial recognition built in. They have the ability to do a background check on every guest who checks in. They also have people working the front desk who likely get training to see if you're a "bad guy" or not.
So with all that, please explain why this additional search, which is a massive violation of privacy (and apparently the Constitution) is necessary?
Rationale: You can always choose another hotel with policies you like better, but you can't choose another government. Constitution only applies to governments for that reason.
To that end I've written to our venue and we'll be putting out a statement regarding exactly under what circumstances the hotel may enter your room, and what to do if you don't want to consent.
This isn't an easy thing for events in the US to deal with, and while we're based in the UK we get a lot of US citizens attending. The rules are different here, hence the decision to find out the rules and put them up so everyone's clear. In that respect, I think Marc Rogers was right to make a comment as it's clear a ball was dropped somewhere, and it came under his bailiwick. I don't believe for a second that he should resign, especially when I'm certain he'll double down on making sure things are better next time.
I was utterly horrified with Katie Moussouris' situation and absolutely will not stand for something like that happening in London. There'll be something up on the blog and mailing list once we hear back from the ILEC.
[1] - https://44con.com/
Sad how govermenmt regulation swoops down on valid business interests.
A hotel can call the police any time if they suspect an issue with a guest.
I doubt those terms are legal enforceable if they exist. Even apartment building owners in the US can't enter arbitrarily, especially if you're not present.
Those laws don’t really exist for hotels in the USA as far as I know. Hotels are categorized as temporary dwellings and are regulated much differently.
The quote's not from a definitive source but there is language like that all over the internet. Merely attending a conference does not a criminal make, so I think the hotel has a thin defense here.
[0]: https://consumer.findlaw.com/travel-rules-and-rights/hotel-q...
(I was stating my opinion, you are the one claiming I am factually wrong and not providing any proof, further a quick google search proves I was correct in my statement too based on reputable legal sites)
The original article was concerning Nevada I believe. Here is a link for Nevada. http://www.loving.lawyer/blog/2016/8/23/think-twice-before-k...
Again. This varies quite a bit by state.
Again, shady as hell ethically what they did and how they did it, but still very legal.
>The hotel employee ID card I was finally shown had the photo rubbed off. It was only shown after I had been screamed at & the door pounded on, which was after I had politely asked to verify their IDs by calling downstairs.
Was the ID badge even legit? Unless the latching lock was in place on the door, these people representing themselves as hotel security personnel should have been able to open the door with their own master keys, correct? Whey should they scream and beat at the door after being politely asked a perfectly reasonable question/request?
Consider that these were not legit security personnel, and that the hotel may have been working with some undisclosed entity to target select DEFCON attendees.
Edit: Seeing how the 4th amendment prevents the government from accessing a hotel room, why on earth wouldn't a state actor parter with a private entity to gain access?
At least say you're sorry and don't make your 20-year long business partner lose his job over your fuckup?
Guns everywhere. Tables full of guns. Gun parts. Suppressors. There were more guns than laptops.
How things have changed ...
[1] 303, OC/23.org, TX CuervoCon friends
[2] 1998/1999/2000, I think ?
Multiple rooms I presume.
Security never entered my room, nor did they want to. Why? Because I did the simplest thing. I didn't keep the DND sign on the door so I had normal maid service. I like fresh towels and made beds.
If you leave your DND up, security will come to your room once a day and take a quick visual inspection. Yes, we all know this is mostly 'theater'. If you're there alone and are uncomfortable with people in your room when you're alone, then stand outside the room during the inspection.
Some people aren't happy unless there's drama. I see many people at DEFCON who imagine they're 007 and a host of three letter agencies are interested in them. Good for them! (I suspect Marc Rogers, the DEFCON security person who resigned, simply didn't want to deal with drama anymore when there are real battles to fight.)
For the rest of us, it's a nice convention where we can talk to real engineers and security researchers about problems that affect us.
Good for you. I'm glad you got a chance to talk to real engineers and security researchers about problems that affect you. I hope you feel more secure as a result.
There are a number of other attendees who would also like to discuss the security problems that affect them, such as the notion that putting up a DnD sign on your hotel door is an implicit expectation that random men will corner you in your room. If these visitors aren't who they say they are, the only way out is through them. It being a convention of professional hackers, the fact that the only thing between you and an intruder is an electronic lock does not bestow much confidence in one's security.
Is it ok with you if we discuss this for a bit? Hopefully it doesn't get in the way of the important engineering and security research weighing on your mind.