Trash Piracy: an Opsec Case Study

Transcript

[music] [music] GM mies. Today I'm here to talk about trash piracy and lessons in real life OPSEC. So before we get started, I have a quick disclaimer. This is a fictional story about my friend Trashbeard. It's not about me. It's set in the United States of America, and I do not advocate for any illegal or immoral behavior. Now, we all know that a good pirate is kind to the ocean, and we also know that all pollution flows into the ocean. But pirates produce trash just like the rest

of us. Throwing trash overboard is simply not an option due to the pirates code. So, what is a pirate to do? Trashbeard came ashore in the US with a few large bags of household trash. He had no money as plundering had gone poorly that season and most of his actions were considered illegal dumping if he were to dispose of his trash anywhere. He looked around at his options. One of his options was to take his trash to the dumpster behind a business like Walmart or 7-Eleven. But behind most of those businesses, the dumpsters were locked. There were also cameras and employees who would likely rat him out if they saw him. He considered taking his trash to the

public trash cans in parks or in pedestrian areas, but he noted that they were too small and there were also cameras and signs watching him. He considered taking his trash to the landfill, but as I mentioned, his coffers were empty and he couldn't afford to do this. He considered taking his trash out into nature and just dumping it somewhere, but that is pure scallywag behavior and against the pirates code, so he wouldn't allow it. He considered taking his trash in front of somebody's house and just using their bins, but he realized that any family who saw him doing this would instantly be able to identify his trash as not theirs and would be highly motivated to escalate the situation. And finally, he noticed that apartment dumpsters were

shared amongst many residents. People might not notice him coming and going, and they were already full of household trash, making his blend in perfectly. And of course, this is what he chose. Now, what can we learn from this? The first thing is to pay attention to our adversaries priorities and incentives. We can note that security at stores is highly motivated to catch you because they might lose their job if they see you and say nothing. Similarly, single family homes may feel very violated if you're on their property and would likely escalate to stop that bad feeling. Apartment residents, on the other hand, wouldn't bat an eye at some strange person being there, as there's a lot of people they don't know. They

mostly want a quiet and tidy place to live. We can also rely on the fact that most people are lazy. So, if we don't give them a big reason, they aren't likely to do much against us. Security posture is also important to pay attention to here. The cameras, signs, and locks on dumpsters all represent effort. They show that whoever is against us is likely to take further steps against us, and they serve as a warning. Much like the Jolly Roger, they say, "Don't mess with me." We can pay attention to anonymity sets. The dumpsters at apartment complexes are for household trash already, which allows ours to blend in perfectly. However, if Trash Beard were to take his trash to a

commercial dumpster, his trash would stand out quite a bit because it looks different than household garbage. So, it's important to make sure that we're matching like to like. We can pay attention to externalities. It's important to minimize our connections. We should avoid perhaps visiting our friends apartment complexes or making repeat visits to the same apartment complex. And we have to avoid creating a mess as an overflowing dumpster would prompt enforcement action swiftly. Metadata hygiene is important here as well. Trashbeard needed to rid his trash of any serious personal identifying information. No junk mail with his name or address on it. No receipts with his credit card number on it. But our trash is still a unique

fingerprint to us. So one has to decide how much is enough sanitization. Trashbeard took advantage of information decay as residents quickly forget your face and the trash goes out removing all evidence. Similarly, he took advantage of information silos. Stores and cities with cameras are watching you and building a profile against you. Residents, however, are very unlikely to communicate with each other or share their information with law enforcement. Note that you can be tracked. In today's day and age, cameras are cheap and ubiquitous, and AI makes data analysis extremely easy. So, it's a matter of choosing your battles. Finally, let's

discuss moral convictions. It's obvious that Trash Beard would have had a much easier time simply throwing his trash overboard where no one was watching. But his morals do not allow him to do this. So I ask you, what decisions are you making because of your morals? How are you making your life more difficult for yourself? And why? Thank you. What questions have you Thank you, Eric. Thank you. Wow, I love the theme of this talk. Um, any questions for Eric? If you have a question, just raise your hand and a box will be thrown at you. So try and catch it if you can.

Okay. Of course, if you have any other questions that you maybe want to have a longer chat with Eric about afterwards, feel free to approach him. >> No. >> No. No. Throw the clip. Throw the clip. >> Okay. There's a question here. >> Recommend Oh, there's a mic here. Sorry, guys. Good morning. Do you recommend burning trash? >> No. that creates pollution and it's against the pirates code. >> From which which pirates code? >> Uh the code of don't be a jerk and be nice to the ocean. [laughter] >> I don't think pirates care about that.

But okay. >> Yes. Yeah. If if you're only concerned about getting caught, burning it is clearly a good option. >> This is the international code of pirates, right? It's >> very real. Okay thanks. [music]