CLEARING OF WORDS AT DEFCON

I'm a firm believer that if you make addendums or additions/corrections to an article, you leave the original article entirely intact, and put a clarification statement before the original article. I find this makes it much easier both to separate the changes that would normally slip into a later revision of a document sight unseen, and also lets you see, together, both the progression of thought and the original jumping-off point.

Roughly 100 people have read the article at my site by this point. I know that it was copied and posted to a number of mailing lists, and that means the number of viewers is probably a bit more. Most importantly, the article filtered to the DEFCON organizers/staff mailing list. Within about a day of my article going up on this page, I recieved various communications from a number of DEFCON Staff (I still hate the term "goon" and believe strongly it is both misleading and part of the problem) with opinions about the article. I've had the opportunity to discuss the events of July 13, 2001 with them. The conversation has also, in a few cases, expanded to the idea of DEFCON and being a Goon in general, as well as helping work through the lingering issues that I think my article raises. Some of these issues, I believe, linger in the mind of many DEFCON attendees, and are either forgotten until the next year, or groused in the sort of quiet, non-threatening way that people train themselves to do to avoid "trouble".

However, that's obviously not what I did; I typed out my thoughts and put them out on my site, and now I'd like to to tell you about what I've learned from the "Other Side", the folks who help run DEFCON every year.

(You are doing yourself a major disservice if you do not first read the original article as it appeared on this page.)

I can defuse some of the issues by clarifying what I was trying to say in my writing.

Coming to the wild, wooly, and enjoyable DEFCON this year, I idly watched some pamphlets get distributed with the same sort of hazy indifference that many attendees might show towards the usual complaints that the event they're attending is sub-par. My neutrality towards the complaints were quickly sharpened to a full awareness when I was intensely (by my standards) interrogated by armed guards working in the capacity of DEFCON staff, accompanied by a number of red-shirted goons angry about the pamphlet. Defusing the situation as best I could from my side, the guards moved on to other suspects, and I was left with the cold sweat of a person who has felt the crosshairs of an overactive investigator pass over him and move elsewhere.

I came away from this experience with a sour taste in my mouth, and I felt this was an extraordinary thing to bring into such a naturally volatile conference, especially over a pamphlet. To prove my point about the positive aspects of airing out words instead of hiding them away, I review the issues raised by the pamphlet (as best I can) and leave them sitting there, ugly and naked, much as I've heard them recounted to me in the past.

How well I achieved this goal is up to the individual reader, but I recieved feedback ranging from "thought-provoking" and "interesting" to "long-winded", "one-sided" and "fiction".

It's not fiction; it's what I saw and felt. It was definitely one-sided: the feelings of the attendees who were in the scene. I ran the article by them before putting it up on my site, because I wanted to make sure I was as accurate as possible.

That said, several of the criticisms I recieved were very valid. The article contained a number of factual errors which have been brought to my attention. Most of these errors center around the specific structure, responsibilities, and hierarchy of the DEFCON Staff. I would be doing a disservice to attempt to accurately describe the whole team, other than to say that some are paid (for repetitive jobs such as registration and inspecting badges) some are volunteers (goons), and some are in an administrative capacity and technically recieve money although not as employees (such as Jeff). Most glaringly, the DEFCON staff also includes (in a manner of speaking) the Alexis Park Security Team, which is a separate organization run by the hotel itself. These are the only individuals who were carrying a gun in a holster during DEFCON. No goon wielded a gun, and DEFCON did not hire armed guards; they merely used the services of already present armed guards. In the case of my experience, this is almost academic, because regardless of who the guard was beholden to, I was interrogated on the spot and I did feel threatened, but he was not put in place specifically by the DEFCON organizers.

Therefore, saying that this was the first year that DEFCON had armed guards was wrong. It would be much more accurate to say that this was the first year that I became aware of an armed presence moving through the convention, and once I knew to look for holsters, I saw them an awful lot. This bothered me because armed authority figures means the potential for someone to get shot, and I don't like to see people get shot.

There is some confusion, even among the DEFCON staff that contacted me, as to how much of the use of the Security staff was the doing of the Alexis Park and how much of it was the actual DEFCON staff. The use of the guards was certainly effective in terms of sniffing out suspects and generally getting "the job done". The question that lingers is whether this was a course of action that needed to be taken to get "the job done". And now we get to the meat of the issue.

DEFCON is obviously an entirely different experience for the Goons and the Security/Hired Staff than it is for the attendees. There's a strong hint of that in the promotional materials and in the attitudes of the staff if you talk with them, but it's not explicitly written down anywhere: The near misses of violence or medical emergencies they contend with, the harassment many recieve, the strange and taxing situations they will find themselves in, in a moment's notice. I had the number of 5,200 attendees for DEFCON 9 mentioned to me; if this is the case, then it's hundreds of people per Goon on duty, and that can be a tinderbox and an endless cascade of difficult momentary decisions to be made. And what it tends to end up with is a misunderstanding as to why the Goons are taking an action, and towards what purpose.

An example: I was one of several dozen witnesses who watched a young male attendee get ordered out of one of the pools because he was swimming naked in it as part of the Defcon Scavenger Hunt. He was thrown a towel, made to climb out of the pool, and talked to for a number of minutes. To myself (and a number of others, I would like to think) this scene made no sense; he didn't seem intoxicated or under the influence of drugs (he was doing an excellent butterfly stroke) and he "wasn't hurtin' nobody". And yet here he was being hauled out like he'd just broken a neighbor's window with his baseball. It made no sense to me.

It has now been explained to me that the Alexis Park has a strict policy and demand under the laws of Nevada against public nudity. Apparently this is enough of an issue that they have to step in quickly in any case where public nudity occurs on hotel grounds. This has been indicated to me as a strict state law issue, on the same level as the fire laws (rules governing the occupancy limits of a room). The ability of the fire marshalls in Las Vegas to shut down an entire convention/meeting has been made clear to me by other people than just DEFCON, so I can personally vouch for it. Laws are funny things.

How are we supposed to know about all these unusual legal situations?

Well, yes, we could go to the laws of Nevada and look all of them up. But then again, that would also rule out underage drinking, violation of copyright laws, and felony computer intrusion, all of which also occurred. So that's not very helpful to know what's a no-no and will cause the staff, security, or goons to get involved.

The staff knows what the real big problems are, and why they're the big problems. They go out of their way on the website to give you reading lists, file mirrors, FTP sites, and links to caravans and gun shoots, but there's surprisingly little on what the actual current structure of staff is, what the hotel has very strict policies against, and what all of the staff's responsibilities/priorities are. This is just the thing to add to the website.

It is my belief that many, many misunderstandings, hard feelings, rumors, speculation, lies and the usual poison could be avoided if DEFCON sat down and wrote the following:

An Accounting, as best as they could, about all the major events that were encountered during the cons just past, what actions were taken, what the opinion of the DEFCON staff was, and what the resolution ultimately was for the conflict.

A clearer disclosure of the role of Alexis Park Security in the entire running of DEFCON, and when they are generally called upon to intervene in the convention.

And, as mentioned above, a more explicit listing of some of the more quirky aspects of the Alexis Park and Las Vegas rules and how people might find themselves in conflict with them without knowing it. Framed as a way of saying the staff is NOT insane and NOT micromanaging the convention, it will help put together a clearer face on the people doing all the hard work of keeping the convention running smoothly.

The second part of the article ensnares me into a number of growing conflicts and stale debates I don't honestly want to be a direct part of.

Regarding my statements about HOPE versus DEFCON, to be honest, I will continue to attend both, and both sides dragging each other into a war of words and claims helps neither of them. It's also not my war, and I couldn't fight it if I wanted to. May the best man win, and I hope it's both of you.

The money made or not made at DEFCON is not my direct concern; I certainly like to buy t-shirts and swag at these events, and as I've always been a speaker at DEFCON, I've never actually paid the admission fee, so its debatable expensiveness is me talking theories and not facts. (It's obviously up in the air whether I will be able to speak next year). If massive money is made, lost, stolen or earned, I myself got my money's worth.

But Jeff should be aware of the amount of questions about the money part of DEFCON. They've always hovered around it like a stink as long as I've paid attention, and will continue to. He tends to answer these criticisms with one or two line responses that have the theme of "This con takes a lot of money to put on, and you get your money's worth." This is his battle, not mine, and he knows how and whether to respond to it.

Black Hat is another issue altogether. I've never attended Black Hat, I know I can't afford it, I doubt I could convince my employer I need to go there, and I don't think speeches about BBS History will be welcomed with open arms to a security symposium. It's another distant issue as regards me.

So why would I ever have brought all these thorny, sticky issues up? Mostly to prove a point, I suppose; that if the flyer's questions, no matter how crudely expressed, were in some way supressed or censored, then the natual response by the kind of person who attends DEFCON would be to consider the issues raised by the pamphlet. And the issue is: Is DEFCON Exploiting Hackers and hacking culture's natural openness for personal monetary gain? Is DEFCON part of the problem instead of the solution?

But ultimately, I'm not going to answer that question. The Goons certainly don't think this is the case. Jeff doesn't seem to think this is the case. And the attendees.... well, someone should ask them.

So to end what has been an overly long rebuttal/clarification that has extended past the original length of the article it is discussing, I hope I've made it clearer why I wrote my article in the first place and that my feelings were genuine and true, if not granted all the perspective of the DEFCON staff. One member of the DEFCON staff wanted me to tell you to feel free to ask the goons at DEFCON why they're doing something or not doing something, to seek them out and ask them for information or clarification if they don't understand why a choice was made or an action was taken. I can't voice for how this will work out in a real life situation.

And speaking of real life, that's what this whole thing was about. Theoretical vs. Practical. Concepts of freedom or keeping the peace vs. percieved threats and angry words spoken in the heat of fear or indignity. To drag out one of the other famous statements about freedom, also from Justice Oliver Wendell Holmes: "The right to swing your fist ends at the tip of my nose." When words become actions, that's when defense is unquestionably justified. When words are just words, that's when the principles of free speech come into play. When there's question on any side as to what is speech and what is action... that's where the mud comes in, the names are called, and the misunderstandings can explode into accusations, interrogations, protests, and retaliation.

I don't pretend to have all the answers, or to know what the right thing is. I have my principles about feeling secure with one's possessions and well-being and I have an awful bad feeling when I see a fight over words. I used words to get attention to the situation, and that has now happened. I hope that my efforts, in some small part, help everyone, staff and attendee, understand where the other side is coming from.

- Jason Scott
July 20, 2001

FEAR OF WORDS AT DEFCON

The gun knocked against my friend's head as he turned to me. "What is your name? Where are you from? Tell me who the person was who did this. You know who they are."

You might think I was quoting some cheap detective novel, or maybe describing my visit to some oppressive country and what went wrong, but I'm not.

I'm talking about my first day at DEFCON 9.

DEFCON, if you've not heard of it, is billed as the largest convention of hackers and computer people on earth. They gather once a year in Las Vegas, Nevada, in what until now has been a series of hotels, each one burnt out by the surrounding vandalism and mischief of the legions of miscreants that accompany the experience. In the last few years, it has stayed at the Alexis Park Hotel, an off-strip "resort" hotel that has no on-premises gambling, and which therefore can allow people aged less than 21 to rent hotel rooms and walk around without too much trouble.

"Cons" of this sort have been going on for roughly 10-11 years, and meetings of hackers in public spaces went on for decades before that. I avoided the conventions before 1998 because I had nothing but fear about such a stable, easy-to-see target; so many self-professed hackers in one place, in a world where people have been brutally mistreated by police for merely congregating in shopping malls? This wasn't a place I'd feel safe at.

But DEFCON proved itself to be a different sort of animal; with thousands of people in one place, I figured there was safety in numbers. People might not like the "mainstream" appeal of DEFCON, but at the time it was what finally convinced me to attend. One rent-a-cop harassing 20 people in a hotel room is one thing; trying to mistreat thousands of people at once would be another.

And I was right.... sort of.

DEFCON is now so large that it was able to sign a multi-year contract with the Alexis Park, ensuring a semi-permanent location. Thanks to the efforts of the Cult of the Dead Cow and their release of the Back Orifice suite of tools at two DEFCONs, worldwide press has focused on the event as an easy lap-up of stories for the next couple of weeks. This means a lot of attention, a lot of press, and a lot of focus on the general debauchery that takes place at the hotel. Each year, a new group of people come trying to outdo the legends of the previous year. And each year someone generally does in fact reach a new low or high in various ways: I won't waste space recounting the many destructive and inspiring events that have taken place.

But this year, things were a little different.

DEFCON hired armed guards.

Lots of them.

And they put them everywhere.

The purpose of having such a massive armed security force at DEFCON is obvious; you can't have 4,500 people in one place, especially with the years of examples from when these people last met, without wanting some ability to control the crowds. You try and make the best preparation you can for any contingency, and there comes a time when a volunteer force of friends and associates brought together by word of mouth just doesn't seem adequate against an army of free-thinking hacker types. So you make a tough choice; you bring in "the professionals".

DEFCON has its own force of volunteer guards, organizers and general administrators of the peace. They call them "Goons". The term Goon means, among other things, a thug, and was probably once an ironic term used to describe helpful volunteers as some sort of scary force. This is similar to calling your loose camaraderie of friends a "Secret Ninja Army". You're neither secret, ninjas, or an army; you're just a group of people proud to know each other. Unfortunately, the "Goon" term just serves to alienate these volunteers from the other people at DEFCON. When I use the term "Goon" here, I use it because they use it, not because I think that's what they actually are.

There's some lingering questions as to what these professionals can and can't do. In the case of DEFCON, they had the full run of the place, deciding who could or couldn't enter the convention area, breaking up any "unwanted" activities, and generally making themselves known as a position of authority.

But the professionals are, technically, under the control of the people who hired them. And they take their cues from their bosses. If the bosses say something is unimportant, they will ignore it. If the bosses say that something is vital, then it becomes top priority.

On July 13th, a set of pamphlets started showing up in the bar and lobby area of the Alexis Park. Entitled "REJECT HACKER EXPLOITATION - FIGHT BACK", this single sided one-eighth-page paper gave a list of suggestions and thoughts on DEFCON and what it has become. It espoused several general themes: DEFCON has become the very corporation it supposedly was created to fight, you should turn DEFCON into a scene of Chaos, and you should refuse to follow the artificially-imposed rules DEFCON has placed on its attendees.

But don't take my word for it. Read the Pamphlet Yourself.

The pamphlet is juvenille. It's simplistic. It's badly thought out. But it's JUST A PAMPHLET! It's WORDS ON A PAGE.

So because someone distributed a pamphlet with the phrase "Fuck up a Goon", the armed security force started hunting people out, interrogating on the spot, looking for "the perpetrators", and generally turning the entire convention into the scene of a witchhunt.

So it was that I found myself in the bar area of DEFCON being interrogated by an armed guard. When he sauntered over to our table and pointed at the pamphlets scattered about, he turned and his holstered gun smacked against my friend's head. This brought my strict and firmest attention. I've seen what guns can do to people.

"Are these your pamphlets?" he demanded. No sir, we said. "Did you see who put these pamphlets here?" Some guys, we said. "Can you describe them?" No, we couldn't.

I knew exactly who had dropped those pamphlets here. But even though we weren't the closest people in the world, there was no way I was sending an armed man against him. This is the sort of choice a person has to make in this situation. It's not a "snitch-rat" sort of thing; it's a "decency" sort of thing.

He walked away, into a back room that I saw was full of other guards like himself. My friends and I discussed how unpleasant we felt, and how much overreaction was happening.

Then they came out again.

Now it was a couple goons and several armed guards surrounding us. The "manager" guard (no obvious gun, wearing a suit, part of the entourage nonetheless) walked around out of our sight while the questions came again.

The look on the goon's face was pinched, angry. The guards asked the questions again, and further ones besides. "Where are you all staying? What are your names? Are you staying at this hotel? You must tell us WHO THESE PEOPLE ARE."

I glanced nervously down at my knapsack. I'd taken some copies of the pamphlet for a souvenier; were they going to search through my belongings? Could I stop them if I wanted to? Would they try to physically restrain me if I refused or decided to walk away?

I SHOULD NOT HAVE HAD TO CONSIDER THESE THOUGHTS.

This entire situation was a classic out-of-control escalation. Faced with nameless person or persons who mentioned violence against them in a pamphlet, the goons decided to use any means at their disposal to ferret out the responsible parties. Guards brought in to quell potential violence or serve as a hardened private police force in the event of a riot or major threat to life and limb were now trying to find who had printed some words on a paper.

I stood up and immediately introduced myself, engaging them in a conversation and revealing that I was just another speaker at the con, someone who was harmless and completely on their side. This calmed the situation immediately, and I heard the goon say "They're cool." The manager guard behind me nodded and turned back to his cell phone, moving the entire entourage out into the lobby.

Before leaving, the guard took all the copies of the pamphlet lying around, gathering them up into a pile and taking the stack with him. Ostensibly they destroyed them all.

The goon was wild-eyed with anger and fear. "I don't want to have one of us stabbed with a screwdriver because of this." He went away as well.

Yes, that's right. Someone would actually attempt murder on someone because they read on a little piece of paper that the person should be "fucked up". This is poor, panicked thinking, the thinking of a person who has no sense of context, who sees a single sentence aimed at his archetype, and goes temporarily insane.

I specifically heard the guards use the phrase "This is like shouting 'fire' in a crowded theatre." How learned they are to discuss a quote from a 1919 supreme court case! But as better covered in other forums, this phrase is often misquoted, and in fact may have been entirely unnecessary in the original case it was part of.

At least the circumstances of the two cases were similar in that a pamphlet was involved (the 1919 supreme court case was over an anti-war pamphlet, and this was over an anti-DEFCON pamphlet). Of course, the original individuals were convincted of conspiracy to violate the Espionage Act during wartime. It was said their words represented a "Clear and Present Danger" to the country.

So was a pamphlet with a list of destructive things to do at DEFCON a "Clear and Present Danger" that could represent a violation of federal law by inciting subordination among the nation's military? Well, no. It was a somewhat crude anti-DEFCON pamphlet printed on cheap paper that got scattered over a hotel lobby in during DEFCON.

You see, this entire situation is especially henious to me because of the site I run here. With 30,000+ files of all types, if I actually believed that people would be incited to do horrible things because of my files, I'd cry myself to sleep each night. That's not why I put these files up; I put them up because they represent real and honest history. People typed these files for a reason; maybe by putting them all together, we can learn more about people. Trying to hide, destroy, remove the words we don't like, it just buries away the honesty and the truth those files contain, directly or indirectly.

Maybe some people shove the First Amendment too far away into the theoretical; they think it applies to a particularly racy movie or whether you can get Hustler at the 7-11. They forget it enters all our lives, all the time.

So they tried to bury what the pamphlet had to say.....

...let's take a little look at DEFCON as the pamphlet requests, shall we?

There's 4500 attendees, of which we can assume maybe 4,000 pay the admission price. That's 4,000 x $50: $200,000. The speakers are unpaid, and must cover hotel rooms, air travel, and whatever materials are required to put on their show. (The Cult of the Dead Cow, for example, generally covers the cost of renting their own lights, sound board, and props. This can run into the thousands of dollars.) The Goons, the staff of DEFCON, is unpaid.

And then there's BlackHat. Held in three different cities, the costs of attending are eye-opening: Over one thousand dollars! Scroll to the bottom of that link to see the sponsors. Microsoft. PriceWaterhouseCoopers. This is not exactly the kind of free flow of information you might expect. That's what DEFCON is for, they say. But is it?

Jeff Moss (Dark Tangent) is a talented organizer; this is not something to take lightly. Pulling off something like DEFCON requires a lot of experience and many "best guesses" as to what will be needed. As time has gone on, he has no doubt picked up skills as an organizer that few other people in his line of work might have; this is why not everyone can run one of these conventions successfully, year after year.

But if you look at the whole situation, you start to realize how truly controlled, how buy-sell, how media-oriented and look-at-me the whole situation has become. You might read words from the DEFCON site that it's all about free flow of information, but it's not. Consider this:

The opening paragraph of the DEFCON information booklet went out of its way to indicate that it was bigger than H2K, the hacker convention held on and off in New York City by 2600 Magazine. It indicated it was bigger than H2K was right now, and they would be 10,000 square feet bigger next year. Why do this? Why attempt to indicate another convention wasn't worth going to? Why especially do this when the other convention isn't being held in the same city, is being held by folks who have been involved in the hacker community for nearly 20 years, and make this your opening welcome to your information booklet?

Maybe the money has become so big, any competition that looks like it might come over the horizon and draw away dollars has to be addressed directly? Is this a case where the most important thing about the entire process of discussing your convention is to position it as the only choice, the assumed leader in conventions? How long will it be before the Other Conventions Page on the DEFCON site is no longer updated, or updated with the information too late to actually attend?

These are ugly thoughts. But they rise from an ugly experience. An experience I hope to never have again.

- July 18, 2001