Halvar Flake, a German computer security researcher and mainstay of the BlackHat security conferences held in Las Vegas, Washington D.C., and elsewhere each year, was denied entry to the United States this weekend to teach at BlackHat Las Vegas next week. After a nine-hour flight to the U.S. and a four-and-a-half-hour interrogation with U.S. Customs agents, Flake was put on a plane back to Europe because he was signed up to teach at BlackHat as a private citizen rather than as a representative of his German company, Sabre Security.
Flake, who specializes in reverse engineering systems to uncover security vulnerabilities (he's the author of BinDiff, a tool used by security pros) has been presenting security findings and training security professionals at BlackHat for the last seven years. Many of the people who attend his training sessions are federal employees tasked with protecting government computer systems. These include people from the Department of Defense and Department of Homeland Security. His training session this year on Analyzing Software for Security Vulnerabilities, which cost $2,000-$2,400 to attend, was sold out according to the Black Hat web site.
Flake never had a problem entering the U.S. before. He'd simply tell U.S. authorities he was coming to teach at a conference and he was allowed entry under the visa-waiver program -- a program in place since 1988, which allows nationals from 27 countries to enter the U.S. without a visa for tourism or business purposes if they're staying for 90 or fewer days. This time, however, he made the mistake of printing out training materials for his BlackHat class and carrying them in his suitcase. When U.S. customs agents searched his suitcase and found the materials, they pulled him aside for extended interrogation. After four and half hours, officials decided that Flake was an employee of Black Hat, rather than a foreign researcher coming to present at a conference, and therefore needed a work visa to enter the country. Had Flake entered as a representative of his company, Sabre, rather than as an individual, he likely would have had no problem. As he writes on his blog, Flake thought he could simply fly back to Germany and reapply to enter the U.S. as a representative of Sabre, but that's not possible. Because he's now on a list as someone who was rejected under the visa-waiver program, he'll have to apply for a visa to enter the U.S. from now on -- which he won't be able to do in time for the BlackHat conference next week.
