Going AFK: A Discussion on Standing Up and Standing Out

Good morning everyone. All right, you can hear me. All right. So, number one, thank you for being here. I really appreciate that. Taking your weekend out to come to an infosc conference is something that only a very niche group of people have the uh you know the to be able to do. So, thanks for being here. Um, all right. So, just in case you meant to go to track two, this is track one. I am Gray Fox and this is going AFK. AFK is away from keyboard in case there are people here didn't know what that meant. But essentially what we're going to be talking about is um getting a little bit safer when you're going out and

demonstrating or going to protests or anything where you want to engage what your first amendment rights are. So I'm Gray Fox. I have a very long and sorted history with the US military. [snorts] Uh what I tell people is I spent 20 years in the Air Force doing signals intelligence. What I don't like telling people is that when you join the Air Force, you have a bunch of different pads. On paper, you do something, but on in real life, you do a whole bunch of other different things. And a lot of what my military career involved was things you wouldn't expect an airman to do. So, I got opportunities to work with some fantastic people on the ground.

They never let me kick in a door cuz they're like, "No way, Gray Fox. You're too expensive." So, I had to stay about 30 yards behind everybody. But I helped as much as I could. And along the way, I learned um I learned a lot about what people around the world, what rights they have, what rights they don't have, and how they were protecting themselves when they tried to at least grasp some of the rights that they had, especially when it came to demonstrations. Some of the work I did involved uh some of the actions around the Arab Spring. Uh did a lot of Middle East stuff. I did a lot of Europe stuff. I spent some time

in Afghanistan just like everybody else did and uh you know it was not a pretty time but the people there were wonderful so I did a lot of education to try to help them as much as I could. Uh these days I'm a penetration tester or at least I like to tell myself that. I've been moved more into the vulnerability management role which is way less exciting but I think a little bit more impactful. And on the side I still have a lot of friends that can teach me things and so I try to teach them things. If any of you saw me walking around yesterday, I you know like to I like to volunteer. It's just it's what I

do. I like to give back to the community. Uh the optics mean something. So if I'm walking around looking like, "Oh, I'm always pissed." It's not that I'm pissed. It's just that, you know, I want to make sure everyone else is happy. So, you know, that involves doing some sacrifice and staying on your feet and standing in one place. But, you know, you do what you got to do, right? So, why are we here? I don't dig reading off the slides, especially since the slide is over here and I don't want to turn my back to you. So, feel free to read, but I'm going to summarize. And the summary is it is not the most safe and pleasant

time to be out expressing yourself. with the current administration and just the current geopolitical environment that we're in. Um, we have a lot to deal with as citizens or maybe even non-citizens when it comes to expressing yourself. I'm not saying that, you know, we are in a bad place. I think we're still in a great place. We can still express ourselves. But if we don't plan, if we don't do that risk analysis of what it means to really go out, get involved in a demonstration, get involved in a protest, then we're setting ourselves up for a little bit of failure. I think everyone in this room probably has a good head on their shoulders about

looking around, having situational awareness, knowing what you're getting into when you step into a public demonstration. But there are going to be bad eggs, and those bad eggs are going to ruin it for everybody. So here I'm going to try to at least give you a baseline of how we can avoid being embroiled in whatever the bad eggs are trying to do. If I had five hours with you, we might be able to cover everything, but I have less than an hour. So if I tend to go fast, I apologize for that. But I'll be around. You want to dig deeper into something, hit me up. All right. The backdrop of everything I'm going to

talk about is operational security. It's just a big word that means everything that you think about is going to have to have risk in mind. What do I have? Who wants it? How do I defend myself? If I have some gaps in my defenses or gaps in my security, how do I mitigate that? A lot of that mitigation is going to come down to, well, maybe I put stuff in my pockets and not hold on to it. Maybe I think about a different place to park my car uh on a daily basis. Whenever we're going food shopping or just even leaving our homes, we do that risk analysis. Is it raining out? Well, if it's raining

out, take your raincoat. Great. Successful risk analysis. If it's going to be wet out, then am I going to hydroplane because I'm driving too quickly? Maybe I drive a little bit more slowly. Again, risk analysis. These are things we do every single day. We may not call it operation security, but we're doing it. And everything we're going to talk about today is going to have that backdrop. So, the first question to ask if you are thinking about getting involved and making yourself known and expressing your first amendment rights is why? What is the purpose? And this is probably the most important question. If you want to make yourself heard because you feel like you care about an issue, great. Do

you need to be there or can you do this by, you know, maybe financially supporting a different organization? Or maybe you can do this by making a video if you're an influencer or if you create content. Anything that will reduce your risk, that will reduce the likelihood of you being harmed. Think about that. If you want to go out and you want to protest because well, you want to be outside, you want to do it, that's fine. It's going to take a little bit more work for you to make sure that all of your plans, everything is going to guarantee or at least on paper guarantee that you'll be a little bit safer. All of us will probably be a lot safer

and a lot more comfortable just staying in our homes. Maybe we don't have that choice. So, let's get into some more of that planning. One thing to note that um if you are going to go and you're going to go by yourself, that's one thing and I have it right here. If you're going to go with a group of people, say to a demonstration, a rally, a protest, whatever. Whatever you take away from here, make sure you're spreading that knowledge. If everyone in your group is all good to go, they've all been involved in your planning, they're doing that risk analysis, then great. You have a good defensive group with you. But if it's just you and everyone else that's

going with you really doesn't have a clue, that's more exposure for you. So just keep that in mind. More people in your group needs a bigger attack surface. So very first thing that we're going to look at your site survey. You need to know where you're going. You need to know where these things are going to take place. It doesn't necessarily mean that you have to go there on site, though going in person is great. It just means that maybe you just need to look at a map and you need to see what the terrain is. This gets into a little bit more deeper planning than most people do, but it's not hard. We all know how

to use Google Maps. We all know how know how to use Open Street Maps. Whatever you want to use, just take a look at where you're going. And this was usually step one whenever we would plan an operation. What does it look like on the ground? So, first thing is your way in and your way out. So, the map I have over here, I spend a lot of time in Pittsburgh. This is Market Square in downtown Pittsburgh. I was going to try to find a place in Baltimore, but Baltimore is huge, so I didn't want to uh do a whole new slide presentation. Pittsburgh is pretty easy. Weigh in and way out. If you're looking

at a square like this, you can see that it's more or less a grid pattern. So, you have four ways in or out and then little alleyways all interspersed. So, you have a lot of options when it comes to that. You also want to look at what is electronic surveillance there. That's a big hot topic now. It wasn't for a while, [snorts] but now we see all over the news that information collection and electronic surveillance is it is pervasive. It is ubiquitous and there's not a whole lot that we can do to protect our identities unless we recognize that that threat is there. Next thing that you want to look at is what is around. If it is just a park,

then it's a park. But if it's a public area like this, you're going to have businesses. You may even have places of worship. You might have schools, banks, all kinds of places. You want to know about what places are there because if you're going to be there for something, whether it is a rally, demonstration, protest, even just to sit in, you want to know what's around because if something happens where you need to take cover, you want to know where to go. You want to know what's going to be safe, what's going to be open. Next thing to take a look at is public transportation and parking. If you're going to drive there, great. Determine

how close you want to park. If police decide to get involved and they shut the place down, do you have access to your vehicle? Do you have access to that bus stop that you came in at? These are things to consider. Also, if you want to do um you want to do anything that's going to expose you to risk, you need to be prepared for the worst case scenario. There have been many instances, maybe not in the US, unless you look at places like Minneapolis for instance, but all over the world where somebody somewhere is going to get pissed. They may have brought a firearm and now metal is flying all over the place. Protect

yourself. Do your sight survey. See where is good to be so that if shots get fired, you can get behind something. It doesn't need to be complicated. It could be a planter. It could be another building. Even something like a vehicle that's parked. Get behind something. These are things that you want to look for. And then another thing is bottlenecks. Now, you can tell from this picture that you have a bunch of ways in and out, but if something does go down and things like in my parlance when things get pear-shaped, pear-shaped means that the situation is just completely bonkers. People are going to rush places. Where are they going to rush to? Are they

going to trample you? Are they all going to get stuck? That's what we call a bottleneck. You want to look for places where people will bottleneck. You want to try to avoid that or at least you want to try to get ahead of it. And then lastly, do some research. If you know where you're going to be and you know where uh what day you're going to be there, see what's going on. See if there's any events that are adjacent to that. Look at the news. Look at the history. Have there been protests there before? How did that protest end up? Did it get violent? Was it peaceful? Where did people come into? Where did people leave

from? So, there's a lot of information that you can go through here. But all of it feeds into that risk assessment. So, let's take a look at one of my favorite things ever, and it's a photo sphere. And you can see that from Google Maps. You activate your photo sphere from your your uh street view. And I have a bunch here that I can try to pick on. Before I get into some of my findings, I'll even show you one. If I were to take a look around here from this photophere, I can do my surveillance without even being on site. So, you can see just from looking at this view, you can see where

some of the surveillance is, where some of these cameras are. You can see where cars are parked. If I'm looking for cover and concealment, I can see where the corners are. I can see that there are trees. There are some places where I might want to stand. If I'm really worried about surveillance, I can look and I can see where cameras are. I can see where some of the electronics are that are on these poles. So, photopheres are a really good resource. And when you're doing your reconnaissance, I highly urge you to take a look at this. Take a look at all the other ones, too. Get a good complete view. You can do all of this without

being in place. For all of Google's faults, photopheres are one of the coolest things. All right, I didn't have this slide in here originally, but a couple of days ago when I got into town, I wanted to take a walk around one of the neighborhoods, and just looking at the what was around like in just one alleyway, I found so many fun things. So, get back. So, my slides are functioning. Things that look really innocuous, but they're recording everything. I have no idea where this infrastructure is going. Is it closed off? Does it go to a cloud service? Is there sharing happening? I don't know what's going on with any of these, but just one city block. This is

what I found for cameras. Are they edge computing with facial recognition? I don't know. But all of this goes into my risk calculus. if I feel like I want to protect my identity, if I'm going in public, not even do a demonstration, but just going in public. This is what I'm up against. This is what all of us are up against. So, just be mindful of what's out there and what's recording. So, next phase is going to be your route plan. You know where you're going. You took a look around. You see where you can get in and where you can get out. So, how are you going to get there? It could be as simple as driving a car

and parking there or taking a bus and getting out of the bus stop, taxi, Uber, whichever. Or if you want, you can pick a place that's far away, maybe four blocks, five blocks, something that might give you a little bit of a standoff, and then you can just walk there. So if things do get pear-shaped and the place gets cordoned off, now you can walk away from it, and you'll still have access to your vehicle if you parked. If you pick a bus stop that's a few blocks away, same thing. Transportation hopefully will still be running. You will still have access to that bus stop. And that's really what the route planning comes down to. Doesn't need to

be complicated, but I would definitely pick more than one. You have a backup. Maybe you come in one and you want to leave in the other. Is it overkill? Possibly. But these are just things to take a look at, things to think about while you're trying to reduce your risk. Getting in and getting out is probably some of the most important stuff. So, this is why I spend so much time on it. So, you want to talk about overkill for those of you that are going in a group. And again, I didn't originally have this slide in here, but I was asked about it. Someone said to me, "Hey, listen. When you're going out to a protest and you're

with a group, what if you get separated? What do you do? What would you guys do if you're on the ground and you're doing special operations stuff? I'm like, "Okay, sit down. You're going to be bored." So, I talked about rally points. A rally point, it's not complicated. You plan a place where everyone's going to meet up if you lose contact. Important things about it. Number one, it could be the same place where all of you arrive. All of you get off the bus at the same place. Great. Our rally point is this bus stop. If we get separated, come back here. Don't make it somewhere that is important. So, let's say that you're doing a

demonstration or a rally or let's say that for some reason there's a counter demonstrator that doesn't like you and so they want to follow you. If your rally point is somewhere sensitive like where you live or where you work, you've just compromised that space. You've put a lot of other people in danger. So, be mindful about where your rally points are. Don't make it somewhere sensitive. Make it somewhere temporary. Another thing, two is better than one. If you're going to pick rally points, multiple rally points, go in succession. Everyone go to rally point one. Stay there for 20 minutes. If you don't see anybody, go to rally point two. Stay for 20 minutes. If you don't see anybody, go

to rally point three. Again, is it overkill? Possibly. But you're not waiting around forever for people that may not show up because you can't wait around forever. You still need to get out of there. So, you don't need to. It doesn't need to be 20 minutes, could be five, could be 15, could be a half hour, could be an hour. It's all up to what your group wants to do. What kind of risk tolerance do you have? How long do you want to stay in place? Another big thing that I like is if I'm picking a time period where I'm going to stay in a rally point and then I have to move on, I'm going to carry some chalk

with me and maybe I'll put something innocuous on the wall or on the ground saying that I was here. anyone else that shows up in your group, they'll recognize that call sign. You all can come up with your own and then you mark it. And so if I show up after that designated wait time, that dwell time, and you already gone, I'll at least know that you were there. Okay, they were there. That means I have to go to rally point two now. I don't have to wait around. There's no guesswork involved. Does that make sense? >> All right. And then lastly, again, don't wait forever. There was a fly in here. Guess he wants to learn about this

stuff, too. Fair enough. Phase three is grow is going dark. You might watch a lot of YouTube videos or some other kind of, you know, influence and contact vehicle that's going to tell you about this is how you're supposed to protest safely. All they're going to talk about is electronic surveillance. They don't really get into the boots on the ground stuff, but I'm going to treat it a little bit here. When you're going dark, basically what that means is anti-serveillance. Um, in my role as, you know, I guess you could call it in, so in the concept of asymmetric warfare, you have the underdog and you have the top dog. In my role as top dog,

electronic surveillance was how we would get at the adversary. We would use all means possible. It could be front-end collection like cameras, could be cellular collection, phones, cell phones, things like that. Could be internet, could be social media. You could post on your Facebook page about all kinds of things that'll make my job a lot easier. Anti-serveillance is being mindful of that. Save up some cash. If you use a credit card or some other point of sales system, that's electronic. It leaves a digital trail. If you don't want to be seen as being somewhere that might put you at risk, save up some cash. My recommendation is no [snorts] less than 50 and no more

than 200. No less than 50 because you cannot buy anything less than $50 these days. So if you want to be able to buy lunch and not use a credit card, carry around 50 bucks. $200 is my maximum because if I get knocked down and mugged, I'm out 200 and that's it. But you can carry as much as you want. It depends on your risk analysis. Next thing is your social media information. If you're going to go dark, that means you can't post, "Hey guys, I'm going to go to this rally. It's going to be great." Awesome. Now I know about that. That means law enforcement knows about that, too. So, be mindful of it. Turn the tables on social media. See

from the adversary perspective. Next thing is disinformation. This is a special case. Not a lot of people feel comfortable doing this. But if I were going to be in a place at a time and I didn't want anyone to know that, I may say I'm going to be in a different place at a different time. And if I have a habit of not lying on social media like any of us do, then I might believe that. So I've just thrown the trail off of myself. Next thing is you want a time period. I would say two weeks out is a good is a good time to start doing any of these blackout procedures. Two weeks is good because as

an investigator, if I if I geofence an area and I get a 100 people I have to investigate, I'm not going to go more than two weeks out. That's too much work. Everybody is taxed with resources. So, that's just my point of view. Could be one week, could be a whole month. It's up to you. It's up to your threat model. And then make sure you're communicating all of this to your group. If one person does it, everybody has to do it because if one person lets something leak, then your whole operation is done. Everybody is compromised. So, make sure you're sharing this plan. All right? Don't bring your phones. Here's why. So, doing a very basic threat model of

your phone, and this doesn't even have to do with going to a demonstration. This has to do with everyday life. You are running the risk in the physical realm of lost theft, somebody swiping it, and then you're out your phone. And if your phone doesn't have a good strong PIN or if you left it unlocked, I as your thief will have access to everything. So there's your physical risk. That's one reason not to carry it in a place where if things get really chaotic, somebody might swipe it out of your pocket or you might drop it. From the electronic point of view, you have technical collection. Techno collection is like those stingrays everybody talks about. Does anyone not know what a

stingray device is? All right. Looks like everybody does. That's the world we live in, right? Then you have signals intelligence. Signals intelligence is if I were to collect stuff with a Stingray, what do I do with that? How do I analyze it? Well, I analyze it by technical information from your device. That tells me what apps you're using. It tells me who was next to you. It tells me who was next to you an hour after or an hour beforehand. This is signals intelligence. This is how I build out a network. And now you're looking at a whole bunch of location stuff too. And this is a lot of how modern agencies will operate. Most

of the applications that we have are very leaky and very chatty with our location. location data is that's probably rule number one of conducting any kind of surveillance is I want a location. Your phone is going to leak your location. It's as simple as that. Some of the the vectors where my location would be leaked would be app telemetry if we are not careful about the applications we have on our devices. Uh advertising technology everyone knows that surveillance capitalism is all about location. And then lastly, geof fencing, which I mentioned before. Another question. Who here does not know what geo fencing is? All right, looks like we all do. Um, geofencing would be my first strategy.

If there were a demonstration and someone did something dumb, law enforcement wanted to investigate who was there, a geoence would be my first strategy. If your phone is on and it's with you, I'm going to get you in that geoence and you've become a suspect. So, keep that in mind. Now, another big thing is, well, let's use Meshtastic. Meshtastic is new. It's cool. Everyone's using it. It's encrypted, bro. Maybe. Here's the thing that I don't dig about Meshtastic. When you're going into a situation where you need to pay attention, number one, you're typing. I like radios. A two-way radio. Yeah, it's not encrypted. I can listen in on it, but all I need to do is

this. Hey, I'm here. as opposed to this. Where am I looking when I'm doing that? Not around. Exactly. Meshtastic is cool, but it's not a very tactical kind of cool. Right. Next thing is, is your GPS on your meshtastic? If it is, then great. Anybody that has the uh the longfast channel open, which is the default channel, is going to see your GPS, too, which means it's public data. Your location is being leaked. even if you don't have your phone on you. Next thing is alerting. This thing is going to make a lot of noise. It's probably going to distract me. Next thing is everyone else is going to have one. Anyone here that has any knowledge

of RF theory knows that if you saturate a space with RF, things are going to get dropped. Your meshtastic messages might not make it to you in time. That means I'm getting latency. Latency means I'm not getting stuff on time. That means that I can't react quickly. A radio on the other hand, hey, how's it going? I got that instantly, provided the channel is clear. If everybody has a radio and everyone chooses the same channel, that's a completely different scenario. But again, I have less than an hour. Your messages are showing. If I'm shoulder surfing, I'll see your messages. While you're looking down at your messages, someone else is going to be looking down at your messages. Be

mindful of that, too. Next thing is unless you're using one of the standalone devices like that T deck that I have pictured, then the app is going to be on your phone. Oh no, you have your phone. So I know that was a brief brush on technical stuff and I think that might be at the center of everyone's attention. Get hold of me after. We can have days long discussions about it. Phase four, backup and emergencies. This is overlooked by many people. If you have an emergency contact, write it down on paper. Put it in your pocket. Why? Because you're probably not going to have your phone on you. Please don't have your phone on you. Um, if you

develop an emergency contact, someone that is going to have copies of your keys in case you're separated from your vehicle or you lose your keys when you're on site, that's a good idea. But also make sure that's not somebody in your group. Because if everybody gets separated or let's say there's a mass arrest, because I've seen these happen before, your emergency contact is right next to you in a prison cell. That's not a very good emergency contact. So, just be mindful of that. All about risk assessment, right? All right. Phase five, packing the basics. These are examples of bags, and I even own a couple of them that to me would look innocuous. They're not overtly military. They're

not very colorful. I can't really pick them out in a picture and then do it a reverse image search. You know, they're just regular bags. I think those are good things to have. Also, don't spend a whole bunch of money on them cuz somebody somewhere is going to spill a Pepsi on it and then it's ruined. But the stuff that you want to put in it, this list is all the basic things. Can anyone see anything in here that is not something that you may carry in your regular school bag or work bag or an emergency bag in your car? Maybe you might not have some chalk, but we went over the chalk thing. But yeah,

these are just basics, but this is your baseline. If you have all of these on you, then you're pretty much set for any situation, not just high-risk situations where you're demonstrating. Let's talk about masks. Um, the possibility of you getting gassed here in the States is relatively low. People might disagree because they've seen it on the news, but the fact that it made it on the news means that it's newsworthy. Law enforcement does not want to deploy gas just as much as you don't want to breathe it in. Here are my recommendations for if you want to have one just in case. And from left to right, it goes from what is reliable to what I would call the Amazon, I don't

know, gamblers special because you have no idea if it's really going to work or not. But you have some pricing over here. You're going to get what you pay for. Even if you got the cheapest piece of crap one, if you got the right kind of filters that will filter out oilbased particullet, it's still going to work. Just make sure you test it out before you bring it with you. The way to test it out, I'm going [clears throat] to put the mic down. Put it on.

That's how you test it. All right. What not to bring? Um, any idea why I wouldn't want to wear contact lenses in a demonstration situation? We just talked about gas. They will fuse to your eyes. Trust me, you don't want to be in that situation. You don't want to be a first aid giver or an EMT in that situation because you feel for these people. They may not they may not see anything again. It's pretty terrible. Um, we talked about the cash. Why not fire starters beyond just a lighter? Cops don't like fire. It's as simple as that. If for some reason there is a search and seizure policy or you get detained with an on

the spot search and they find like a big old torch on you, that's what we call a clue. So, just be mindful of that. You don't want to look like someone that is going to cause trouble. Story time. That's why I have that asterisk over here. I went to a Second Amendment rally in Richmond, Virginia, and everybody was dressed like that because everybody was meant to be dressed like that. You blended in by looking like that. But if you did that here in Baltimore, that's different. So, just be mindful of that. You may be making a point, but you're making yourself a target. So, remember to do that risk analysis. Well, how do I know

what not to bring? Learn from the past. Go to go look at the news. What did demonstrations look like in the past? What do they look like? What are they saying? What are they doing? What is their posture? What does the signage look like? All of these things will play into your risk analysis. If you want to stand out, great. See how other people stood out. If you don't want to stand out, but you want to make your voice heard, you can do that, too. Look at the demographics. Look at the spacing. Look at what the signs are saying. Where are people standing? What are they not doing? All of these can play into your risk analysis.

And another thing is if you want to look at branding, accessories, demographic, this will tell you exactly what kind of people are coming out and demonstrating. Are they the poorest people? Are they the most wealthy people? Are they college students? Are they industrial workers? This is how you figure that out. This is how you know exactly what you're getting into. And now things things like fashion. So this is what we call in the Middle East, they call it a shamac. You might call it a head wrap here, whatever. It looks really cool and fashionable on this person. But this is the connotation that these things have. So be very careful about your accessories because something

that you wear or something that you're carrying might trigger somebody and that trigger will make you a target. So just be mindful of that. This is why the research is so important. All right. How I would find you in a demonstration. You can probably already tell from some of these pictures what would make you stand out. Um symbolism. Things you have on your shirts. things you have on your bags, your pants, tattoos, anything that's exposed. If you have unique tattoos, maybe think about that. Wear a jacket, wear long sleeves. If you if you want to wear a hat to protect your face, that's great. Um, maybe it's an identity thing. Maybe it's because it's sunny or it's rainy, but, you know,

be mindful of that. If you have a unique hairstyle, anything that you can't necessarily change, but you can cover up, it's something to consider. Um, speaking of hats, [snorts] I get it. You want to let your flag fly. Totally cool. Just be prepared to if things go pear-shaped, like I keep saying, take it off, put it in your bag, because if I have a way of finding you and you were near something bad and I'm law enforcement, that is how I would find you. Reverse image search from all of the data collected in that area, from all that technical surveillance that we saw. Make sense? All right, let's keep on going. Let's say that you

got there. What is it going to look like? All of it. It's all going to be there. We already demonstrated that. It's a fact of life. Be prepared for it. If you have your mask and your sunglasses and your hat, you'll be you will be prepared for it. Be ready to see cops or some other kind of security service. Don't let them put you off. They are there and they are probably as trepidacious as you are about things going wrong. So, it's going to be a presence. You're also going to have people that maybe don't like your messaging. They are probably going to be more dangerous than any law enforcement because they don't have any

edict to stand by. They're probably not going to care about rule of law. They just don't like you because you don't stand for what they stand for. So, be mindful of them. Next thing is barricades, tape, and fencing. Yes, it's going to be there. There are places where you may not be able to stand. Your demonstration permit was for this area, but not for that area. Pay attention to those. I would also say avoid them because if you have a trampling situation from a bottleneck, those bottlenecks will probably be those barriers. If you're standing by one and something across the square goes really, really wrong, people are going to come towards you and it's going to be a sandwich situation and not

a good sandwich. All right? Not all the messaging is going to be the same. You may be going to a rally about something. The person next to you might want to rally about something else. Take every opportunity you want. Um, in the back there's always going to be that legalized pot guy and that's fantastic. Good for them. They've been at it for a while and they're making progress. Yes, the system at work. Confirm your routes. When you get on site, look around. Make sure everything that you saw is still there. Some of those routes that you had picked out may be blocked. There may be construction. There may be police vehicles around. There may be

counterprotesters blocking it. Do your risk analysis. It's all about thinking on the ground, right? And then expect some chaos. Um, usually demonstrations will be peaceful and you'll be okay. Having that expectation of chaos means that you're going to be looking over your shoulder. You're going to have good situational awareness, but don't let it consume you. Don't look paranoid. If I'm on site and I'm looking for anyone that's going to make trouble, I'm gonna look for that person that's doing this because that to me looks like someone that is trying to find an opportunity for something or is maybe trying to avoid me or somebody else. Go there and do what you got to do. Definitely keep

aware, but chaos is going to be around you. There's no real good way to inoculate yourself against it, but don't let it consume you. Don't look like that person that's going to make you a target. I know it's difficult to explain, but again, less than an hour. Definitely hit me up after. I'll give you some examples of people that I would not want to mimic. All right? And again, I'm going to stress this. Your communication plan means something. You can have your phone. Uh don't don't take me saying don't bring your phone as, you know, the lay of like the lay of the land and the bottom line. You can have your phone. That's fine. It just

depends on your threat model and your risk analysis. Your phone is going to be very chatty. It's going to give away your location. It's going to give away everything else. Whether it's Bluetooth or Wi-Fi, I will be able to identify you. But I highly recommend for your own safety. And just because the environment that we're living in now, both socially and politically, really reconsider that phone. If you have two-way radios, that's the way that I would go. So, face covered because that's where we live now. Have your radio on. Make sure your group has their radios on. Do your radio checks, but be mindful of that phone. All right. Why would you want to leave a

demonstration or a protest? Go ahead. Scream out answers. Hair-shaped. I love it. Here's the thing. If someone tells you to and they're the ones with the guns, you do it. That's a big one. And I could probably just end the slide right here, but that's not who I am. I like to go deep. Another thing is somebody in your group has to leave. If one leaves, everybody leaves. That's that's the way that I usually run my stuff. If oh, I got to go to the bathroom. I'll be right back. That's one thing. But if somebody says, "Hey, listen. I can't be here anymore. This is too much for me. You know, it's messing with my head."

You can all go and it's going to be okay. You probably did what you had to do. But if somebody's got to take off and everyone else wants to stay, that's okay, too. Make sure they stick to the plan. Make sure they get back safely. When you get somewhere in a group and then you start leaving one by one, that's when people, you know, go a little bit nuts when plans start collapsing. So, just make sure that you take that into account. Um, people start throwing things. uh this will happen. There's [snorts] a lot of glass, um a lot of aluminum cans, whatever. People have things in their hands. I remember one time that I this wasn't a

demonstration. This was like a a concert and everybody around me had those paper cups that had Coke in them, Sprite, whatever. And somebody said something maybe 10 yards that way that everybody around them didn't like. I wasn't a part of it. I didn't hear what was going on. But all I saw was everybody to my right doing this and there was coke everywhere. Got all over me. Got all over that bag that I told you not to, you know. So yeah, it's anything can be made a projectile. People see movies and they're like, "Oh yeah, grenades. Grenades are awesome." Yeah, your uh your disposable drink container is a grenade. And you know, getting all of

that dried sugar and everything off of your clothing and your bag and maybe having to wipe down that convertible car where the top was open. That's not fun. So, people start fires. Remember what I talked about lighters and torches and things? Fires are bad. As law enforcement, if I were in that position and I saw a fire where a fire wasn't supposed to be, that is going to be my cue to get all my buddies to make everybody leave because fire department has to come in and put that out and make sure nobody is on fire. So, be very mindful of fire. If you see one and is not supposed to be there, turn and go.

Do not ask questions. Gunshots. This is going to go without saying. If you hear gunshots, go. Leave. Remember when I said in my sight survey, you need to find somewhere where you can get cover and concealment. If you feel safer ducking down and making yourself small so that those gunshots don't find you, fine, do that. But now everything has changed and your personal safety is paramount. Gunshots are really, really bad. Worse than fire, I would argue. Um, people screaming in supplies and alarm. Yes, this is definitely a thing. If you're in a peaceful demonstration and then everyone off to the side starts screaming and you don't know why, give yourself some distance. Find out what it

was later, but just listen to the people. If people are surprised and they are alarmed, it's probably something bad. These are all things that we should be mindful of. If you want to stay and you want to look at that train wreck, good on you. If that's part of your risk assessment, fine. I do not condone that. Give yourself distance. find out about it later. It'll probably be in the news. All right, we all have gut feelings. That's probably something that your eyes or your ears or your nose is telling you, but you may not be able to translate into whatever language you speak. It doesn't mean that it's not a thing. If you get a feeling that something is off

and you want to leave, listen to that gut. Get out. This has saved more people that I know more than any other situational awareness or intelligence. You just get that feeling something is off. I need to get out of here. And remember, if one person in your group needs to leave because they get that feeling, trust them. Listen to them. Your personal safety is at risk. Listen. Everyone with me so far? Right. Here's how you get out if things go pear-shaped. Very first thing that you want to consider is if everyone says, "Hey, it's over. We're leaving." You're leaving. You're walking away peacefully. If you start running, people will think that you're running in surprise and

alarm. And then everyone else is going to run in surprise and alarm. You will have caused that trampling situation. So, if it's a peaceful thing and it's over, leave peacefully. But if it's not, then there are some other things that you need to like really be mindful of. Number one, your sight survey. When you were on the ground, you saw the ways you could get in and out. Remember where they are. Make your way to them. [snorts] If you get separated and you came up with rally points, make sure everyone knows where they are. If you didn't, that's fine. That's up to whatever your plan was. Just make sure that if you're in the group, do your

best to stay together. One of the biggest things that I see people whenever I watch any footage of protests that have gone pear-shaped or have, you know, gone south in some other way is people will start running and they'll run thinking the distance is going to save them from things like gunshots, fire. Um, it's not going to. You can run as fast as you want. You might still get hurt. Don't be afraid to listen to your sight survey when you saw what was around that square. businesses, restaurants banks churches mosques whatever. If your life is at stake, don't be afraid to go inside and duck in. Don't be afraid to get that cover and concealment. [snorts] This is going

to be all about getting away from that crowd, making yourself as small as possible. Um, in that panic state, we tend to get tunnel vision. People tend to have a herd mentality and they all just want to give distance. They want to follow everybody else. Try to maintain that presence of mind to find cover that's around you. Avoid where the crowd is going because maybe they're not going in the right direction. Cool down just a little bit in this doorway. And then when you get that opportunity and things are a little bit safer, then you go. But we all tend to forget that kind of thing. We all tend to have that herd mentality and that's okay. That's human

nature. But these are things to think about. And I would argue the more that you think about it now, the more you'll think about it when you're on site. Still with me? All right. If you need to get to your rally points, remember to be safe, but get there as soon as safely possible. And that means you don't have to book. Avoid those bottlenecks. Avoid those crowds. Remember to duck in if you have to. All right. Anyone in here ever been arrested? You don't have to raise your hand. So, here's a couple things to remember. [snorts] If you are detained, that's one thing. If you're arrested, that's a different thing. If you are not read your rights,

you are detained. At least that's here in the States. In other places, that might be different. Know what the local laws are. Don't say anything. If you feel as if you are in danger or maybe you're being accused of something you didn't do, don't say anything except for the words, "I want a lawyer." and the words I do not consent to this search if they try to search you. A thing about devices, if you brought your phone with you, then that is going to become evidence more than likely. Fourth amendment of the United States will protect that kind of search and seizure. They cannot get a password. They cannot get a PIN. That's what the Fourth

Amendment does. The Fourth Amendment does not do biometrics. So, if you have Face ID or thumbrint, law enforcement will they'll take advantage of that. If they feel as if they want to get information from your device, they'll just take it and they'll see that maybe it has Face ID, they'll just point it at your face and now it's unlocked. So, be mindful of that, too. I would disable biometrics and go with a PIN. Four-digit PIN is okay. working in mobile forensics, six-digit pins are actually much better protection, but that's a whole different song. Look for me next year. All right. When you get a chance to make your call, get out that piece of paper with the

emergency contact and make that call because you do have that. You did your check. You do have that emergency contact on you, right? Um, one of the last things, some of you may get nabbed, some of you may not. If you got away but your friends didn't, don't stick around because then that means that you'll be going to jail or some kind of detention with them. It's better that you just book. Don't go back. You can recover after. The important thing is that even though someone is sitting on the ground with flexi cuffs on, at least they're not injured. So there is some modeicum of comfort that you could take from that. But trust in the system. Don't go

back. law enforcement, they are trained to be as aggressive as possible, as soon as possible in these situations because just like you, they're afraid for their lives. And the harder that they come in and the more aggressive that they are in the beginning means the faster they take command of a situation. If you wait around to see what happens, they're going to have all kinds of adrenaline and cortisol running through their systems and they will see you as a possible threat. So, you can get arrested, too. So, I know you want to stick with your group, but you have to make that separation. You got to think about yourself. They're going to be okay. Give it a couple days, but you

need to get out of there. And I know that that's hard, but that's that's how we need to do things, right? Um, if you got out, I have some texts up here, but really the message is if you've gone dark, stay dark. As soon as you get out of a protest, people got arrested, bad things happened. Immediately, everyone wants to jump on social media. Hey, look where I was. Look what I did. Look at all this cool stuff. If I'm an investigator investigating a demonstration that went wrong, that's exactly what I'm going to look for. And if I know that you were there, that makes you a suspect. So, wait it out. Stay dark. The best thing

for you to do, especially if you're in a group, is everybody get together and just sit with each other, share what you experienced. That's going to be good for your psyche. If you bottle it up inside and you don't talk to anybody about it, you're going to stew. Especially if things went wrong, someone got injured or somebody got detained. But if you all got out, you went in as a group, you left as a group, all of you now have that shared experience. It is good therapy to talk about it, but talk about it with each other. Don't start blasting on social media because then people like me are going to see that and that's

going to be an operation security danger for you. We good? We're almost done. All right. I have nothing for you. If you're going to be the one that's throwing Coca-Cola at my nice expensive bag or you're the one that brought a torch or you're the one that's going to start firing shots because you don't like someone else's messaging, I can't help you. You're probably going to get what you deserve, but just don't be that bad egg. That means you've lost a moral high ground, and all the justification you had for going out and expressing your First Amendment rights are now null and void. That's probably one of the biggest messages here. Do what you have to do,

but do it within the law. That's how you maintain your safety. Okay, questions? Yes sir.

Yeah,

a little bit. It has a little bit. So, for those that didn't hear, is applying an AI application to social media to deanonymize people a new danger? It is not a new danger. It's definitely something that's always been there, but now we've democratized the tools that allow us to do that. So now it's not just a matter of a federal agency being able to an deanonymize you. Now it's any counterprotester that has enough GPU. So my biggest threat whenever I'm going and doing anything in public is not from law enforcement. I'm I'm obeying the law. The biggest threat to me is someone that doesn't like my messaging or doesn't like me because the way I dress

or the way I look and now they want to target me. they might want to dox me. AI is accelerating that kind of threat. Um, for blackout period, I would say that two weeks is probably still good. If you want to blackout 3 weeks or four weeks, you can do that, too. It all depends on your threat model. But the reality is, if somebody gets you and they get a picture of your face, it doesn't matter what your blackout period is. If you have a history on social media, they're going to find you. Not a great answer, but does it answer your question? Anyone else?

That's a great point. That's a great point. If for some reason I have prescription narcotics, but I don't have the prescription on me, but the narcotics are on me, same thing as having a torch or having a gun, it's going to be something that is going to be probable cause, and now I'm detained. So, just definitely be mindful of that. And that's a great point. Thank you. Anybody else? All right. Oh, yes.

So, when you do your site survey, if you look around, whether you know it's in person from a vehicle or you do it from one of those photo spheres, take a look at where all of the surveillance is. If you're in an urban area or even like a suburban area that's part of a smart city, you're going to have Ring cameras everywhere, too. So, it's going to be sort of your risk analysis of like when is too soon to start covering my face where I don't look suspicious. One of the good things that came out of the co era was that now we've normalized having masks on. If you're going to be going if you're if you have an ingress or egress

operation in or out of any high-risk area, then I would say put on your protective coverings, whether it's like personal protection from actual threats or it's to counter identify yourself or protect your identity somehow. I would do that right at the outset. As soon as you're going to leave somewhere where you don't have any surveillance, that's when you put stuff on because if you have any doubt, if there's any surveillance, then for me, that's no doubt. There is going to be surveillance. Um, if that's uncomfortable for you, that's going to be completely up to you. Don't let privacy and security get in the way of your health. If wearing a mask is detrimental to your breathing or if you

need special considerations, that's one thing. But I'm always going to air on the side of caution. If you know, as soon as I leave whatever I consider a safe zone to go to that situation, that event, I'm going to protect up. I'm going to cover my face, wear my hat, put on tin foil hat stuff, like anti-IR glasses, whatever. Whatever you can find off of Amazon that looks cool. Make sure you test it out first. But that's that's what I would do. Does that answer your question? All right. Anybody else? All right. Thank you so much for bearing with me. [applause]