 Welcome, welcome everybody to a very unusual DEF CON. Lots of things are different. Lots of things are staying the same, including, as always, the Open Organization of Lockpickers Lockpick Village. We're so glad you're here. We hope that you can learn some things, have some fun, walk out more fired up about hacking and lockpicking than you arrived. My particular part of this today is law school for lockpickers. What even is that? Well, by way of background, I'm Preston Thomas, a former board member of Tool. I'm a licensed attorney, barred in the District of Columbia and in California, which is importantly different than barred from DC and California. I've done this talk before, including at DEF CON, but 2020 has brought this topic into a new light. Security research of all kinds from hacking, reverse engineering, social engineering, lockpicking, these all rely on civil liberties of an open society with rule of law. Hacking is, by nature, subversive. Lockpicking is no different. So like journalists and priests and security researchers, our job is to comfort the afflicted and afflict the comfortable. We can do things many people don't understand. For certain types of people encountering something they don't understand makes them nervous, irrational, maybe even angry. I should know. I've worked with Tool for almost 10 years and been a lawyer for longer and when people get nervous, irrational, or angry about lockpicking topics, it often ends up on my plate, false to me to explain it. I've had this particular conversation hundreds of times. So this talk today, it isn't for you. It's for me. I want to recruit all of you into my crusade to push back on the tide of bullshit about laws and lockpicking and how the two interact. I'm tired. I wanna be done talking about this, but people won't let me. Help me, please. Let's do this. To begin with, I am a lawyer. I am not however, your lawyer. This is so, so not legal advice. The only advice I'm gonna give you today is, don't get your legal advice from a guy at a con. Also, my opinions are my own. They don't represent Tool or anyone I work for. Standard disclaimer. Law and order was a great show because half was the cops and half was the lawyers. For the law part, you can just Google what the laws are in a specific jurisdiction or how to talk to a law enforcement officer. There's great stuff on YouTube about that. This is not that talk. This talk is more the second part, the order part about why lockpicking laws are the way they are and what it means for you as a practitioner dealing with lots of non-practitioners. Everyone has legal theories about lots of parts of daily life, not just lockpicking. Most of them are workable. Some of them are nonsensical. Some of them are absolutely bananas. And where do loopy legal theories tend to come from? Armchair lawyers. Armchair lawyers everywhere with their good old University of Wikipedia law degree. And their specialty area is something I like to call folk law. These are the ideas about law that everyone seems to know but no one really seems to know where they came from. This is, I want my one phone call or if you ask someone if they're a cop, they have to tell you or I don't have to pay income taxes because I live in the free state of Jefferson. Because of folk law and all the people opining about it and spouting off about it, Googling about lockpicking laws on the internet is worse than Googling about that weird rash. So let's get real. Today, let's do this law school style. We're gonna be concrete, specific and clear in how we use words. Let's start off this law school for lockpickers by building a law. Let's build a criminal statute called the possession of burglary tools because that's almost always what we're talking about when we're talking about the legality of lockpicks. Criminal laws are constructed of elements. These elements are what need to be proven beyond a reasonable doubt before someone can be legally found guilty of a crime. In the case of a burglary tool statute there's usually two elements. Possession is physically having a tool or device including lockpicks. And intent means criminal mindset, i.e. you intend to do something that is against the law. You can call this formula possession plus intent. Now, intent is difficult to get at. It's in your head. It's not something the court has access to. So typically in a court of law it's shown through circumstances. In other words, part of the district attorney's job is to show circumstances that make it beyond a reasonable doubt that a person had crime in mind at the time they possessed lockpicks. No circumstances, no intent, no intent, no crime. In most states, it's as simple as that. Mere possession of lockpicks without any circumstances indicating unlawful intent, not a crime. You look across, you can see that is the vast majority of states. We call it in green just because it's nice, it's soothing, it sends the right message across. But what about those shadowy places you say in your best Jonathan Taylor Thomas 1994 Simba voice? Remember how I said intent was really hard to get at? The court can't know it's in someone's mind. So who better to provide evidence about the state of someone's mind than the person themselves? That is the thinking behind that minority of states that just throw up their hands and say, you tell me. I'm looking at you, Virginia, Ohio, Mississippi, Nevada. Laws change over time but they pretty much solidified down to these four as having the possession plus intent formulation. So these states, they write their burglary tools so that possession of lockpicks is prima facia, evidence of intent to commit a crime. We'll talk about prima facia here in a second. Here's an example from the code of Virginia. For those of you who like to follow along, this criminal code 18.2-94, the possession of such burglary as tools, implements or outfit by any persons other than a licensed dealer shall be prima facia, evidence of an intent to commit burglary, robbery or larceny. So let's talk about that prima facia word. It's not law school without some Latin, let's dive into it. Prima facia, Latin literally means on first face or on first impression, you can think of it. In plain English, that means if I didn't know better, I'd say something. I'd say you're up to no good. Turning that back into legal language, that's referred to as a rebuttable presumption. It's a presumption because it starts offset to true, default value true. It's rebuttable because that default value can be changed, which means the ball is in your court. Or in more colloquial terms, prima facia means explain it. And I put this GIF up there and I'm increasingly surprised how few people know what it's from. If you don't recognize this GIF, I congratulations on your high school graduation, I guess. Okay, so people will often say, but I have a presumption of innocence, but my constitution, I've got rights. And you're right, you do have rights at least for the time being. But the presumption of innocence is not one of the rights that's guaranteed in the constitution. You can read it, it's not that long. You should read it, it's worth the read. And one of the things you'll notice, there's no presumption of innocence mentioned in the constitution. It flows indirectly from the fifth, sixth and 14th amendments. A coffin versus United States is one of the first cases you study in law school. And that shows how, even though it's not actually in the text, it was discovered as a necessary implication of the rights guaranteed explicitly in the fifth, sixth and 14th amendments. More importantly though, this formulation of burglary law just won't be challenged in court because it's too much of an edge case to ever make it to trial. There's two things DAs hate. They hate crime and they hate losing cases. And because this formulation, even if it is arguably unconstitutional or might be, it'll never get tested because if it's such an edge case that you might be able to make a constitutional argument, the DA will shrug his hands and throw it out. He doesn't wanna go down that route. That's not what his job is. He's got much bigger fish to fry. So these kinds of problems where the law is a little unclear and common sense doesn't seem to quite match up with the way the law is written. That's why humans are in the loop. There's district attorneys with prosecutorial discretion. There's judges sitting over each trial. They're specifically there to handle exceptions where the law as written doesn't quite match up with the facts on the ground. So even if you might be able to have a constitutional problem with this formulation, know that it will probably never come to trial because no one's gonna care enough about a fact pattern like that to actually push it. Now, there's kind of a sense of boo-hit about these states that have possession implies intent formulation. And a lot of people think, oh, they're just wrong or they're nonsensible or they're anti-hacker, anti-lock picker. But if you look at actually what they're thinking is, it begins to make a little bit more sense and you have more sympathy for them. So I decided, let's look at some of them. First of all, I didn't know what the Nevada flag looked like. I had to look that up just for this presentation. Here's what Nevada decided is, they said in a case, 1965, it is still good law. They said, it is consistent with all the constitutional protections of accused men to throw on them the burden of proving facts, particularly within their knowledge and hidden from discovery by the government. This is an illustrative example of the kind of reasoning that motivates possession implies intent states. You don't have to agree with it, but you can see what their thinking is. If we're having trial and the goal of the trial is to find out what the truth is and whether someone is guilty and that person has the information they say is relevant to the case, they should be able to provide it if they have it. Then the least they could do is show it to the court. It kind of makes sense. It's very simple. Maybe it makes some of our civil liberties impulses a little squeamish, but it's not unreasonable, especially when you consider the one we collectively like a little bit better, which is the possession plus intent formulation, the more liberal version. So why shouldn't we imply intent? And here's an example from the District of Columbia that shows the kind of reasoning involved in arriving at the idea that possession plus intent should be the proper formulation. And what they say is, and this is great close parsing by the judge, he says, although the sledgehammer ax and hacksaw, which the appellant had quite clearly can be used criminally, they also may, and for the most part, are used for legitimate purposes. Since the mere fact of possession of such influence has no relevance to guilt, it may not be made the occasion of casting on the defendant the obligation of exculpation. In other words, unless what you're carrying are literally drugs or something else that's similarly illegal just for existing, then the cops have to introduce additional facts to overcome the statistical likelihood that you intend to use them for a legal purpose. Most people carrying axes, sledge hammers, hacks, hammers, et cetera, are using for legal purposes. So why in this case would we infer that they're using it for anything other than legal purpose? When you walk through it like that, it's kind of tortured logic. You have to suddenly appreciate people who say, hey, you know what? It's probably what it looks like unless you tell us otherwise. I have a lot after doing the research for this. I have a lot more sympathy for the jurisdictions that decide to throw up their hands and say, you tell us. I know some of you in the back are saying, hey, aren't there different types of intent under the law? Yes, but that's not relevant here. Any intent will do for this particular formulation. Now, this kind of close parsing and close analysis of the way laws are written and what's the meaning behind them leads to some really funny outcomes including my favorite lockpicking case. It turns out I have a favorite lockpicking case. We are once again back in the District of Columbia. This is a DC appeals court still relatively recently from 2014. Inray JW means it was a minor involved. So some kid under 18 got nicked by the cops, funny circumstances. Here's what happened. JW was arrested red-handed, trying to steal a Vespa with a pair of bolt cutters. He was charged with possession of implements of a crime, which is the usual statute that applies to lockpicking. Both elements are satisfied, no question. He's sitting there middle of the night by the Vespa, bolt cutters in hand, definition of caught red-handed. Absolutely possession, absolutely intent. However, there's an inartful drafting the statute because the statute specified, doesn't usually specify, but in this case it does, it specified tools for picking locks. A meticulous appeals court judge observed that picking a lock is generally understood to require skill rather than brute force and to turn the lock without damage to the lock. He literally went and looked up the definition of picking a lock in the dictionary and came back with that and entered it in the record. As a result of reading the statute across from the definitions, it was the judge concluded not physically possible to pick a lock with bolt cutters, nor is it legally possible to convict J.W. under the statute as written because try as you might, those big old bolt cutters will not fit into the lock and turn it in a non-damaging fashion. Conclusion, no possession of tools designed for picking locks and J.W. goes free and anyone who complains about that gets to go back and write the statute a little bit more carefully. I think that is a great example of a judge carefully parsing the statute, holding the state to what they said they wanted and then telling them if you want something different, you have to be a little bit more careful. Another thing I like about this is this means that we have it on record that all those savages and reprobates at conferences who destroy the locks and tie the lock picks into pretzels are not legally speaking picking locks. So here's the part that I think a lot of people show up for. The A number one, absolute main area of shouting and nonsense regarding locks and lock picking is speculation on breaking the link between possession and intent. So let's talk about it. This is in those states where possession implies intent, the minority of states. Well, what can we do to protect ourselves? There's a thought that these are the places where lock picks are illegal and we have to be on our guard and we have to have an answer ready. So what do we do about it? And something that often comes up is how card, have some kind of self-made card or a more professional card, poof, problem solved. This is that fantasy of holding it up to the officer and say, don't worry officer, I have a permit for this. That couldn't be further from the truth. There is no such thing as a get out of jail free card because they're absolutely allowed to have that conversation with you. And by the time you're having that conversation, it is not in your interest to try to avoid that conversation. Instead, I want you to think of if you're having a conversation about lock picks with a cop, you now is in your interest to engage in and expand in and own that conversation rather than trying to flash some kind of card and avoid it. The tool membership card, which is forthcoming contains a few carefully crafted paragraphs to help you achieve a productive tone in that conversation. Essentially, as it acts as a conversation starter, it's a way to help you have the conversation effectively rather than avoid the conversation. It explains that tool is an organization that exists, that recreational lock port. Lock port is a thing that exists that the holder of the card is a member of tool and it gives a gloss on the general state of overall laws. It doesn't overplay its hand. It basically digs down the idea that what we teach and what we do at tool is legal everywhere in the United States by definition because locksporters and researchers have a legitimate use for their picks and they follow the two rules, the two rules which are quite famously in tool don't pick a lock that you don't own, don't pick a lock upon which you rely. If you're following those rules, then you don't follow foul of either formulation of the state law no matter where you are. So that set helps set the right tone if you're a conscientious locksport practitioner, you know, don't hide them, don't lie about why you have them. Essentially don't act guilty if you aren't guilty. People sometimes come to me and say, Preston that's all well and good, but what if I'm doing this or that or the other thing? What about this circumstance? And what I always tell them is if what you're doing is a crime, then you are literally doing what the crime of possession of burglary tool says, you have no basis to complain. If on the other hand you are not and you're practicing good locksport ethics and you're following tools rules, then you can be safe in knowing that what you are doing is legal in every state in the union and you have a card to help explain that concept to anyone who's asking. Now, we are very serious about keeping our members and our friends on the right side of the law. Nonetheless, and I wanna emphasize this is not legal advice. This is just wisdom that any person in the society should know. Let me give you a rule of thumb. Call it the one crime at a time rule. If you choose to break the law, don't break the law while you're breaking the law. Don't accidentally turn a legitimate hobby into an indictable offense by carrying lockpicks along on a time when you shouldn't have them. In the words of legal philosopher William Smith in the matter of earth versus giant bug, 1997. Don't start nothing, won't be nothing. I have heard from many police officers and many different jurisdictions. I've asked them, I have been on public transit sitting there picking on my practice locks and I said, hey guys, I'm sitting here picking locks. I'm pretty sure that's acceptable. Do you have any problem with it? And they say, plan on picking locks on the train. Are you planning on picking locks on the airplane? They don't care. They have actual crimes to worry about if you're sitting there as a law abiding citizen doing something that's not bothering anybody, it's not worth their time. So don't be nervous about it and don't worry about ignorance of the law becoming a problem for you because you're willing to have that conversation. Another area that people oftentimes ask about is federal law, particularly TSA. DEFCON is one of the most common sources of that question because people say, well, I just bought lock picks but now I can't take them on an airplane. Well, it's not a factor because it is literally, I've lost a T somewhere, I've got to fix that. But it is literally not a factor because TSA has a set of things that they're looking for and a set of things that are not on their list. Because a lock picking tool is a non-sharp tool less than seven inches, it's carry on approved. It's simply not disallowed, which means it's allowed. And don't say this to TSA if you're having that conversation but the locks in the cockpit doors are not even pin tumbler locks. So all the more reason for it not to be on their list. After years and years of asking them, we've got a Twitter conversations from a bunch of different people here. They finally, their agents finally added lock picks explicitly to their, can I bring my self-service site on the website? So if this is a concern for you and you would like a little extra backup, then feel free to go on the website, take a screenshot, print it out, throw it in your lock pick kit. I've done it, I know a lot of friends of mine and tool have done it. We carried around our lock pick kit for years and years and years until it got ratty and torn up, then we threw it away and we never used it. Once again, because TSA agents just don't care. But remember, like anything that you wanna carry on the plane, the TSA agent gets the last call. So be polite, be friendly, be patient with them. Whether you're doing an opt out or bringing something unusual through carry on, just make sure you have enough time to have the discussion without being rushed or being flustered. Yes, I like opting out. There's good ethical reasons to it, even though sometimes it's the pain in the butt. If I'm in a hurry, I don't wanna miss my flight. Yeah, I'll go through the scanner. Carrying lock picks is likewise. If I'm really in a hurry, I'll just check them. But for the most part, I like carrying them on A because I know where they are because they're valuable. Make sure they don't get broken. But also to make sure that I'm practicing what I preach and telling people, yes, it's not a problem. And on the rare occasion to have those conversations, then I can make it that much easier for the next person coming behind me that's bringing lock picks. One of the best pieces of dice I get when I got in law school, when you're having conversations like this, is always try to seem like the most reasonable person in the room, seem like the most reasonable person in the room. If you seem like you're prepared for the conversation, if it's not a surprise for you, then that really helps them be that much more calm about it. As a last resort, many airports will give the option to mail something home rather than trashing it. Another great option if you've got time to take advantage of it. Here's what I do when I'm taking my lock picks through an airport. This is my bin on the inside of security at San Francisco. Note the gigantic bag of lock picks, including the fuzzy handcuffs right on top, just in case anyone wants to get curious. That's all totally legal. As are the bogataz in my wallet, which is there on the right. No one ever notices that. Ironically, the illegal thing in the picture is that little bottle of crack and rum there. I totally did not know that you were not allowed to bring little bottles through security or under the airplane. You're not allowed to provide your own booze. So yes, there is something illegal going on that picture. No, it's not the lock picks. Yes, it is the booze. A note on having fun with TSA. I like putting the handcuffs on top because if they're gonna open up the bag, I like to put a smile on their face. It gives them the problem of, do they dig around the handcuffs? Are they allowed to pick the handcuffs up? This is, you know, a dildo versus your dildo territory. So as long as they're gonna have the conversation, there's no reason we can't make it a little bit fun. And before you ask, yes, handcuffs are also legal, are also permitted in carry-on. Lots of good reasons for that, including security officers and police officers that always traveled with handcuffs. A few years ago, Lady Gaga brought her own fuzzy handcuffs and there was a bit of a hubbubble about it, but they were, of course, allowed on. So fun lock pick tricks, just carry fuzzy handcuffs as well. It helps set the conversation on the right mode. A comment that I got from Max, who works with Tool, he said, always remember that you can help the conversation along by giving some framing. So if you see your bag of lock picks go through the X-ray and the person's eyes kind of light up and they shunted off to the side for further inspection with the guy as you're walking over. So it's the conversation just right. I see you've got my bag of lock picking equipment there. I do this, that or the other thing. I do lock sport as a hobby. Inside you will find the following things. You can help them get in the right frame and there's kind of an art to helping them arrive at their own conclusions rather than dictating to them and which in a way that might make them suspicious. So don't avoid the conversation. Welcome the chance to practice the conversation. It's almost always no big deal because again, it's a non-sharp tool less than seven inches. And we'll pass handcuffs and we will go to the rest of the world and people will often ask me now that I've talked about the United States. What about the rest of the world? And the answer is the rest of the world does not differ materially from the United States for the most part. Everywhere around the world you'll find countries and individual jurisdictions with both formulations. The most common formulation is possession plus intent but there are some places that have possession implies intent. So Commonwealth, UK, Australia, New Zealand, Canada they're all legal. Some of them are possession plus intent. Some of them are possession implies intent but none of them make it strictly illegal. Netherlands, as we know, tool having started in Netherlands, perfectly legal and there's quite a robust culture there. Israel, a little bit more tightened down. They're definitely in the possession implies intent camp. And I'm given to understand that in China they're fairly illegal but like many things in China it depends on who your patron is. So yes, when tool goes to China we do take lock picks with us. We teach lock picking there and we get it all cleared through the proper authorities and we haven't had a problem yet. Now there's one last thing that needs to be said before I round this out which is 2020 is in some ways different than other years. In some ways, no different than it ever was. We're just learning more about it now. The Black Lives Matter movement has really drawn a lot more attention to the interaction between young black people, people of color and law enforcement. And it wouldn't be right to finish this talk without mentioning that all the advice I gave works great if you are a white, reasonably well-educated male lawyer does it work as well if you're not some of those things. And the only answer I can tell you is all the principles remain the same but it is absolutely hard mode. It's no surprise that you might have to speak better, understand better, make yourself heard better to get the same results. And there's nothing that I can say to make that okay in this talk or to really give a lot of insight from a perspective other than mine but I do want to acknowledge that the law is the same and many of the same principles apply but it's hard mode. So that is the laws of lock picking. I understand as we end this I'll have a chance to take questions. So for anyone who has questions about lock picking in the US around the world who has stories they want to tell who has hypotheticals that they want to get insight on I would be happy to share them mostly. Thank you for showing up for this conversation. Happy lock picking, look forward to seeing you around.