Notes from HOPE XVII

Hackers on Planet Earth Conference, August 14-16 2026, New Yorker Hotel, New York City

Cameras, Cops and Cell Towers, with Michael Raymond

• Surveillance cameras can be blinded at 50 feet and disabled at 5 feet away by a laser, but you need a tripod 
• ALPRs - What Do We Want? 
• warrants required
• retention limits
• no hotlists
• mapping of all locations
• bans on protest monitoring
• consequences for misuse
• Gunshot detectors (shotspotter) have microphones. I know you know what that means. That is all. 
• First responder drones can go BVR beyond visual recognition

Image credit: Still from the movie Hackers 1995

Poisoning the Well: How Decoys and Misdirection Protect Privacy When Opting Out Isn't Enough, with Rachel Vrabec of Kanary

• Kanary is a web app for personal data removal by subscription: https://www.kanary.com/pricing
• For a company who's job it is to take your money and remove your identity from online, the best they can do right now is 40% for 90 days. (They used to get 90% for 90 days.) That's not an indictment of the company but of the industry they're up against. 
• This company tested their own effectiveness on a new employee, grabbing all available personal info on day one, then performing their services of wiping that identify off the internet, then watching every day as to how it creeps back in. 
• First thing they do is make removal requests from all the data brokers, and then map all the brokers who refuse (OpenAI, Radaris, etc). Google was caching the result, making it harder to tell if it was really wiped or not. Also, most of the data brokers are directly linked to "identity, background, property check" services like Informio, PeopleFinder, AddressFinder, PropertyFinder. 
• Most of us, except California, we have no privacy rights. Apparently not everyone knows this yet, and that's a shame. Data brokers know, and they say "your address records indicate you live in a state with no privacy regulations, so we deny your request."
• If for some reason you think it's worth your time, check out BADBOOL Badass Data Brokers Opt Out List.
• How do they suggest you use decoys and misdirection? Well, first start by masking yourself when you make the first removal request, using a different email that is believable but fake, and ideally an email from your own domain that you pay for. 
• Most of our data comes from the County Tax Assessor. Seriously.
• Try putting a fake address in your LinkedIn account, and wait 6 months for it to populate.
• Try being a former FBI agent or abortion doctor, because in some states, like Arizona, those people actually have some rights to privacy. 
• Try making noisy fake profiles w fake emails and data and watch the data spread and the targeted emails start rolling in
• South Dakota and Texas allow Nomad Status where your address on your ID can be a trailer park!

How App Libraries Enable the Surveillance Apparatus, w Lena Cohen of EFF and creator of Privacy Badger

• Location data is worth $300 billion, because it's hyperlocal and event-based
• EFF reads data broker marketing material, as well as app SDK code
• There's two different kinds of GPS, coarse (1 sq mi) and precise (10 ft!)
• Advertisers write something like dark patterns for the developers of their SDKs so that location delivery is checked by default; the developers just never bother to change it 
• Developers don't have to declare if they're sending your data to a third party, only if the app itself is using, storing or sharing. (I think they're not "sharing" they're selling? And that's why it's ok? Either way Third Party Doctrine is why you kind of have no 4th Amendment rights anymore)
• Checkout Internet Safety Lab's Exodus Privacy and EFF's Appkeep

Bid Request - HOPE 16 - Location Data Brokers w B Budington and L Cohen - 2025

Image credit: This image is actually taken from last year's HOPE, where Lena Cohen gave a similar talk on Location Data Brokers. This slide is great, and I've seen it used in a few other places. 

The Deceptive Web of Scam Compounds w Laura Sang Hee Scherling

• See her articles in Tech Policy Press: https://www.techpolicy.press/author/laura-scherling/
• Most people scam-calling you are victims of human trafficking, being held in a scam compound somewhere in Southeast Asia against their will.
• If a scammer calls you, instead of getting mad, we're supposed to "reroute" them to Global Alms the advocacy group that helps trafficking victims: https://www.globalalms.com/

Remembering Hackers 31 Years Later w Emmanuel Goldstein and Renoly Santiago

This has nothing to do w the movie, but it's here where we learn that last night the livestream from the conference was shut off by youtube because of copyright infringement - for music that was literally created for the conference. So their own music that they created is being used to shut them down. It happened overnight, and although they woke up then next morning and tried unsuccessfully to get it back up, while we on the East Coast were sleeping, the Chaos Computer Club in Germany took over the feed and are now the ones streaming it. Magic does happen. (And consider this recent article by the EFF about when people use DMCA not for copyright at all but to take down people they don't like.) Last thing, and just because I thought it was funny in a kind of insider-New-Yorker kind of way, Renoly who is Phantom Phreak in the movie, and ostensibly a New Yorker, is on this day late to the talk, texting Emmanuel in real time, telling him that he took the "Yellow Line" to the 7 to Hudson Yards and is now running down 34th Street, to which Emmanuel asks out loud to the audience as he's reading it, "He's supposed to be a New Yorker, but now I'm suspicious - Who calls it the Yellow Line?" And he's right. 

The Art and Science of Metawar w Winn Schwartan

• He coined 'Cyber Pearl Harbor' way back decades ago and everyone thought he was crazy
• Now he wrote a book probably called the Art of Metawar
• The end game of TMI Too Much Information looks like religious epiphany, magic over science, and some other ones I missed, but that sounds right to me
• MIST from Cambridge Misinformation Susceptibility Test
• Researchers encourage the public to test themselves: https://yourmist.streamlit.app
• What's funny, or unsettling, to me is that they ask you "Please categorize the following news headlines as either 'Fake News' or 'Real News'"; but these days there are totally legitamate news outlets releasing crazy articles that are so biased you can't even call them real, yet the title is a real title of a real article on a real news site; it's just complete bullshit. So how am I supposed to answer these questions?
• Here's some examples:
• The Government Is Knowingly Spreading Disease Through the Airwaves and Food Supply [easy]
• Ebola Virus 'Caused by US Nuclear Weapons Testing', New Study Says [easy]
• The Government Is Manipulating the Public's Perception of Genetic Engineering in Order to Make People More Accepting of Such Techniques [only because it says 'government' not 'industry']
• The Corporate Media Is Controlled by the Military-Industrial Complex: The Major Oil Companies Own the Media and Control Their Agenda [I mean...]
• Left-Wing Extremism Causes 'More Damage' to World Than Terrorism, Says UN Report [I would almost guarantee this as a legit Fox News headline]
• I'm just thinking how maybe part of the overall problem is that we can have companies called Fox News that actually do NOT make news. If you go to a video news report from Fox News and scroll all the way to the bottom of the description, you'll see it say something like "this is not news it's entertainment". So if we allow non-news companies to produce non-news but call it news, then isn't that a problem. 

Modern OSINT Tradecraft: Attribution, Analysis and OPSEC w Lee Tungkasiri, high school student who runs Trace Labs and interns w the Navy as an engineer 

• False positives are huge in OSINT, where you've got accurate evidence but wrong attribution (wrong guy!) ... sometimes accounts are abandoned and then picked up by a scammer
• INT as in intelligence: usernames, posts, photos, network identifiers, ... 
• Geolocation of a photo - what side of the road are they driving on, what language are the signs, designs of street furniture or poles, historical street view can narrow down when a pic was taken, "suncalc" and "mooncalc" and Bellingcat's "shadowfinder"; then again, in reverse, if you know the time of the photo but not the location
• On Attribution - are 2 accounts w the same name actually the same person; more matches aren't more certainty, because someone else could just be copying the others
• Sockpuppets and Decoys - some accounts are created to confuse you; if several accounts link w the same small group of others or post all at the same time
• Networks - IPv6 can leak network data even router location
• Anakrisis is his OSINT tool, you tell it what data you have and it tells you what tools to choose from his curated database [link]

Non-Human Identity - The Gaping Hole That AI Agents Are Making Worse w Michael Morgensterm

• This is one of the most interesting talks because I had no idea this was happening
• Abandoned AI Agents are on the Internet. Their security isn't great so they're wide open to hackers and they already have tons of credentials given to them by their company, AND they get completely forgotten by the companies who created them, retaining all their credentials. 60% have no kill switch.
• They're an ungoverned attack surface and there's more NHIs than people (100:1); somewhere around August 2025, some hackers used an agent as a skeleton key to salesloft, then to salesforce. 
• Very interesting - the randomness inherent in how LLMs work makes them really hard to identify as individual agents (see the OSINT talk above for why this would be confusing)
• Shai Hulud 2 Attack! Uses someone's GitHub account to publish malicious code that can then get downloaded by others (because this coder gave it all his credentials and forgot about it, and now it does whatever the hell it wants, OR if a bad person gets hold of it they can make it do whatever they want)
• Every NHI should be administratively tied to a person (called a sponsor)
• I don't know what an MPC is but he does not like it. 
• See OWASPs 2025 List of Risks and Threats 

Against the Edgelord International w Johannes Grenzfurthner of the Monochrom Art Group [link] 

• Like the Yes Men they do really funny shit that is like the antidote to advertising in a consumer economy; "violate the terms of use until they become visible"
• Influencers are professional dissidents (oxymoron), 'they don't want you to know this'
• Entry Points - someone who takes your humiliation seriously, fitness videos, dating advice; someone who taught you squats (trust) now can tell you about Feminism or the Bronze Age, you name it
• He does a good job in general of classifying The Con that is the modern day internet; 'your confusion is because the truth was hidden from you', 'the lack of evidence is because look how good they hid it', ...
• [On How to Be an Asshole] first say the unsayable, like some racist shit --> joke about it --> defend the joke, hey man it's just a joke --> use the joke, hey he's got a serious point though you know; like "I'm just asking questions! What's wrong w that?" type shit
• [Slide 71 was really good but it went by too fast]

The Watchers You FED - Feds, Extractors, Data Brokers w Tony Spencer

• He also wrote a book, and that's the title^
• Third Party Doctrine - once you hand your data to a third party, you lose your 4th Ammendment rights to search and seizure, and it can simply be purchased by someone with no legal process required
• Palantir built Immigration OS in 2024 for $287 million, from SSN, DOB, address, and tons of other data; gives an accuracy score of where you are right now, and 3 of 4 American adults are in it (so probably you!)
• One ALPR Flock surveillance camera was queried 7 million times
• The word "protest" returned 8 million results from Flock's database. 
• Graffiti, black clothing, ordering zines (what?), having Signal on your phone (you), are all tagged with "terrorist" in the Antifa Executive Order
• Nice thing - NYC has pensions in Palantir, so they asked for an audit