1 ) (Feds of a feather flock together): Know that someone is a Fed? Are they wearing an "I'm the Fed Shirt? Were they on a "Meet the Fed" panel? Were they introduced as a Fed? Watch who they "hang" with at DefCon. Category: Social-Passive A) Not selected [ +0 ] B) More time, giving "fed" info, seems comfortable [ +5 ] C) More time, giving more fed info, acts friendly [ +8 ] D) More Time, talking about fed-work, acts like a peer [ +12 ] E) More Time, talking about fed-work, other feds treat target as a boss [ +30 ] 2 ) (Feds are sinners!): Why else would they want to talk to Priest? Some may pay with federal checks, or want to swap Fed stuff for a tee shirt or "shoot the breeze." Category: Social-Passive A) Not Selected [ +0 ] B) People priest is scolding/threatening to throw target out of DefCon [ -5 ] C) A Calm Priest seems interested in the conversation with non-goon target [ +5 ] D) A Calm Priest is smiling and lauging with a non-goon target. [ +8 ] E) Priest gets a check or trades "I'm The Fed" shirt with target for other swag. [ +30 ] 3 ) (Check please!): People who ask for receipts for food, room, and transportations (like taxi service) are generally looking to be reimbursed. Could be business employee or Fed. Category: Social-Passive A) Not Selected [ +0 ] B) Target steals food [ -3 ] C) Target files a receipt with other receipts [ +1 ] D) After asking for receipt, target files a receipt with other receipts [ +2 ] E) Same as above, but also writes on receipt with pen [ +3 ] 4 ) (Your place or mine?): Feds generally stay where hotels offer a rate for federal employees that is not too costly and has been negotiated with the government. Research hotels in Las Vegas: Embassy Suites, Hilton Chain, Amerisuites, Crown Plaza Category: Social-Passive A) Not Selected [ +0 ] B) Target sleeps in public unprotected [ -2 ] C) Target sleeps with 30 other people in the same room at the Alexis Park [ -1 ] D) Target stays at hotet closest to the Alexis Park with the best Government Rates [ +2 ] E) Like above and shares taxi to the Alexis Park with other good fed targets. [ +3 ] 5 ) (Where is my Exit? Are they a threat? Where's my nearest cover?): Age 18-30 males who look like they workout a lot have "ass kicking" shoes/boots with rubber soles and always have their eyes trained on the doors and the people around them-- not the person they talk to. (Paranoia can be a false positive to this.) Category: Social-Passive A) Not Selected [ +0 ] B) Target looks fit, but has demeanor of a GI on leave [ -2 ] C) Target looks fit, but is preoccupied with own appearance than exits and threats [ -1 ] D) Target has genuine interest in the exits. [ +2 ] E) Target is watching people, evaluating risks and watching exits [ +4 ] 6 ) (Bartender? Virgin Milk on the rocks.): Is the person not drinking alcohol at all-- even when you offer them a free beer? Could be part of AA/12-step, could be Fed, could be into self control, or on a diet. Category: Social-Passive A) Not Selected [ +0 ] B) Target is drunk, drinks without consideration of company (feds or non-feds) [ -3 ] C) Target is drinking heavily [ +0 ] D) Target is not drinking but accepts and drinks a beer when you offer it. [ +1 ] E) Target like above but refuses free drink or accepts but does not drink it. [ +2 ] 7 ) (Give me a job!): Tell a goon that you want to talk to a Fed about employment with the (insert TLA here.) That Fed will likely be "unspottable" but be an important link to finding other feds. Remember, "feds of a feather flock together," and you may be able to social engineer meeting more feds. Category: Social-Active A) Not Selected [ +0 ] B) No score to this-- it is an action. [ +0 ] C) No score to this-- it is an action. [ +0 ] D) No score to this-- it is an action. [ +0 ] E) No score to this-- it is an action. [ +0 ] 8 ) (Obtaining a search warrant is such a pain...): Drop keywords and fed-speak and observe reactions from your potential fed. Body language, and facial expressions give away a great deal of information-- especially when unexpected topics are discussed. Category: Social-Active A) Not Selected [ +0 ] B) No score to this-- it is an action. [ +0 ] C) No score to this-- it is an action. [ +0 ] D) No score to this-- it is an action. [ +0 ] E) No score to this-- it is an action. [ +0 ] 9 ) (How can you tell when a Lawyer lies?): Learn about characteristics exhibited by people as they tell lies and use these when you ask them direct yes or no questions in conversation. Category: Social-Active A) Not Selected [ +0 ] B) No score to this-- it is an action. [ +0 ] C) No score to this-- it is an action. [ +0 ] D) No score to this-- it is an action. [ +0 ] E) No score to this-- it is an action. [ +0 ] 10 ) (You were on The FBI In Color? Can I have your autograph? or The Pen is mightier than the s-word?) For people who spend a lot of time on paperwork, a choice in writing device is often important. Either passive observation or S.E. to yeild display of pens/pencils can help here. Category: Social-Active A) Not Selected [ +0 ] B) Does not have a pen, pencil, or paper. [ -1 ] C) Has a cheap-ass pencil, or pen, or both [ +0 ] D) Has a nice pen or pen and pencil set [ +2 ] E) Has a "Zebra" brand pen or matching pen and pencil set. [ +3 ] 11 ) (Foxtrot, Uniform, Charlie, Kilo): LEO have different translations for speaking letters and numbers from military groups. Category: Language A) Not Selected [ +0 ] B) Target talking on Radios with this language [ +0 ] C) Target talking about these in conversation with other radio people [ +0 ] D) Target occasionally dropping these into conversation. "A as in Abel" [ +1 ] E) Target reading part numbers, model number, strings of chars with these [ +6 ] 12 ) (Yeah. Uh-huh. Whatever. No Way Dude!): Casual ways to say yes and no are common to humans. "Affirmative" and "Negative" are not as common in speech. Category: Language A) Not Selected [ +0 ] B) Target says mockingly [ -1 ] C) Target says these into radio [ +0 ] D) Target says these seriously [ +0 ] E) Target says these seriously, without even noticing or caring [ +2 ] 13 ) (Pay attention stupid!): Priest sometimes gives away clues about feds. At DC12, during leetest link, Priest said something like: "we had a well known Fed in the audience who has been spotted before." Right around the same time, a much younger blond woman was seen speaking to a 'well known Fed' sitting near the front, in an informal familiar way. She then walks back away from the front of the room where our well known Fed was sitting. Then Priest says, "There is a daughter of a well known Fed," (our fed turns his head a bit,) "who is in the audience. She is here in the building. She is blond. Anyone? Anyone?" Nobody spotted her. Sad. Pay attention, and use the clues. (She may have gone to over 3 DefCons without being spotted BTW.) Category: Hint A) Not Selected [ +0 ] B) No score to this-- it is an action. [ +0 ] C) No score to this-- it is an action. [ +0 ] D) No score to this-- it is an action. [ +0 ] E) No score to this-- it is an action. [ +0 ] 14 ) (It's the shoes!): Many who attend DefCon will wear their work shoes while at con. (Penny loafers, hush puppies, Red Wing Shoes.) Category: Clothing A) Not Selected [ +0 ] B) Shoes are BRAND NEW (rigid, not broken-in, way oversized/undersized) [ -3 ] C) Brown or black shoes with white soxs [ +3 ] D) Target wears comfortably with dark, or patterned socks [ +15 ] E) Same as above, and Target is age 40+ [ +23 ] 15 ) (Can You Hear Me Now?): Earpiece. Why would they wear these at DefCon? Fake Feds might do this. People who want a free shirt, but aren't Feds might do this. Category: Clothing A) Not Selected [ +0 ] B) Target earpiece plugged into nothing [ -4 ] C) Target earpiece plugged into unknown [ -2 ] D) Target earpiece plugged into radio for DefCon Radio/FRS [ -1 ] E) Target earpiece plugged into police scanner [ -1 ] 16 ) (My future is so bright...): Wearing sunglasses indoors? More likely they are stoned and don't want people to see their pupils and eyes or they want a free tee shirt. Category: Clothing A) Not Selected [ +0 ] B) Dark/mirrored sunglasses worn outdoors at night by target [ -4 ] C) Dark/mirrored sunglasses worn indoors by target [ -3 ] D) Dark/mirrored sunglasses worn outdoors during day by target [ +0 ] E) "Fashion tinting" on regular glasses of target [ +0 ] 17 ) (Guns don't kill people. I do.): "Gunnysack"/shoulder-holster can be an indication when it includes a firearm. Category: Clothing A) Not Selected [ +0 ] B) Target has a handgun (useless) [ +0 ] C) Target wears a handgun in a holser in open view [ +0 ] D) Target has a concealed handgun (how did you see it?) [ +18 ] E) Target has more than one concealed handgun (how did you see it?) [ +23 ] 18 ) (It's a freakin' Kangaroo!): Fanny packs, butt packs, front packs were suggested and used as an intermediate storage of firearms in later cons, but these became false positive as people who wanted free tee-shirts wore these too. Category: Clothing A) Not Selected [ +0 ] B) Pack worn on front and obviously empty [ -1 ] C) Pack worn on back [ +0 ] D) Pack worn on front but empty [ +1 ] E) Pack worn on front [ +2 ] 19 ) (No Shirt, No Shoes, No Service): Style vs. age. Does the person look like they have "dressed down" from their norm? Do they have old-style casual-ware that still looks really new/unused? After the vendor area opens this quickly loses value as Fed have learned to buy and wear DefCon tee Shirts. Category: Clothing A) Not Selected [ +0 ] B) Casual style clothing with expected wear for age, and target looks relaxed [ -8 ] C) Casual style clothing, all new [ +0 ] D) Casual clothing, new style, new clothes [ +0 ] E) Casual clothes, clothing looks new-ish but style is way old (not used much) [ +2 ] 20 ) (The Truth is Out There!): Men in Black. Right. Full black work suit. White Shirt. Black tie. Category: Clothing A) Not Selected [ +0 ] B) Target wearing "Men in Black" style clothing NOT during Black and White Ball [ -20 ] C) Target wearing "Men in Black" style clothing during Black and White Ball [ -10 ] D) Not an issue [ +0 ] E) Not an issue [ +0 ] 21 ) (Pro's and Cons): Are they professionals? Did they attend BlackHat? USENIX? SANS courses/presentations? Do they have swag/shirts from any expensive security "cons" ? They could be corporate, or they could be government. Category: Clothing A) Not Selected [ +0 ] B) Shirts with military slogans. eg: "Semper Fi" [ +1 ] C) Shirts describe expensive conventions (SANS, BlackHAt, etc) [ +4 ] D) Target's clothing includes description of Fed-only gatherings [ +6 ] E) Target has swag from federal project carried while looking for Priest [ +8 ] 22 ) (Nice Golf outfit buddy): Polo shirts and khaki pants were useful indicators before, but now corporate types have been found wearing this. Category: Clothing A) Not Selected [ +0 ] B) Polo Shirt kahki pants, and under age of 20 [ -4 ] C) Polo Shirt kahki pants, and between age of 21-24 [ +2 ] D) Polo Shirt kahki pants, and between age of 25-44 [ +3 ] E) Polo Shirt kahki pants, and between age of 45-65 [ +7 ] 23 ) (I had a disagreement with a nail gun): Body Piercing Category: Grooming-Mutilation A) Not Selected [ +0 ] B) Many body piercing on face [ -15 ] C) One body piercing on face [ -3 ] D) Body piercing on ear [ +0 ] E) Body piercings in area covered by shorts and tee shirt [ +0 ] 24 ) (Ink me baby): Tattoos: Category: Grooming-Mutilation A) Not Selected [ +0 ] B) Tatoos on face and/or neck [ -5 ] C) Lots of tatoos [ -2 ] D) Tatoos in places that would be covered by shorts and tee shirt [ +0 ] E) Tatoos about military service (Tours, "group" names.) [ +1 ] 25 ) (Rogaine won't change my profession): Hairstyle. Category: Grooming-Mutilation A) Not Selected [ +0 ] B) Long hippy-hair [ -2 ] C) Well groomed? Professional? [ +1 ] D) Conservative [ +2 ] E) "Military style" haircut [ +3 ] 26 ) (I'm allergic to soap.): Feds who are not obese seem to bathe regularly and don't stink. Category: Grooming-Mutilation A) Not Selected [ +0 ] B) Target is not obese, has not been "working out", but stinks [ -5 ] C) Target is obese and stinks [ +0 ] D) Target does not stink [ +2 ] E) Target is obese and does not stink [ +3 ] 27 ) (Old age and treachery will outsmart youth and vigor?): Feds seem to primarily hire people with college degrees. Consider the age for someone to have at least a 4 year degree. Category: Demographics A) Not selected [ +0 ] B) Age under 18 [ -30 ] C) Age 18-22 [ -10 ] D) Age 23-65 [ +2 ] E) Age 65+ [ +1 ] 28 ) (Because a mind is a terrible thing to taste): Does the suspected Fed have a 4 year degree or better from a college? Military academy? (West Point, Annapolis, "Air Force Academy" (Colorado Springs).) Category: Demographics A) Not selected [ +0 ] B) Target has no four year degree or better [ -1 ] C) Target has a four year degree or better [ +1 ] D) Target worked at a military academy [ +2 ] E) Target graduated from a military academy [ +5 ] 29 ) (Fit as a fiddle): Many TLA that have people working in the field have minimum requirements for fitness, but people can do desk work, or work in forensics and not be fit. Fitness is not a very good indicator by itself. Category: Demographics A) Not Selected [ +0 ] B) Does not apply [ +0 ] C) Does not apply [ +0 ] D) Does not apply [ +0 ] E) Does not apply [ +0 ] 30 ) (Pimp 'mah' ride): Is the car they drive marked with federal stickers or decals? Does their license plate have a <G> or say "U.S. Government"? Most Feds will fly in and use a rental car. Category: Demographics A) Not Selected [ +0 ] B) Car has U.S. Government License Plates [ +25 ] C) Car has federal stickers for parking [ +25 ] D) Car has federal stickers for security gates [ +25 ] E) Any or all of the the above except the first [ +25 ] observations