Let me start off by saying I bought a badge, a Gold one at that. SXSW got $695 of my company’s money for me to attend. I’m not saying you shouldn’t pay for a badge and try to sneak into SXSW. I’m all for supporting people that make things happen. With that said, here’s my own personal experience/social experiment/security analysis with SXSW and my badge:
I bought my SXSW badge on-site at the Austin Convention Center. The process was painless, and except for the increased price for not getting it early, it was just as good. I bought a Gold badge so that I could attend both Interactive and Film events. My badge was printed on site, complete with a hologram and a black and white photo of myself. It’s tied to the purchaser and says so in big capital letters.
When I compared it to my friends’ badges, it was missing one thing, an RFID. Between the four of us we had 1 platinum speaker badge, 1 normal platinum badge, 1 gold speaker badge, and my normal gold badge. Mine was the only one without an RFID. I’m still not sure as to the purpose of the RFID as I never once saw a reader. An article on a previous SXSW indicates badges for attendees would “use an RFID-enabled badge, also encrypted with a unique ID number”. They indicated that this would not be personally identifying information, but the fact that each badge was using a unique ID number means that each one is identifiable. This is just pure speculation, but it’s possible that SXSW could have been using the RFIDs with readers scattered throughout the convention center to track panel attendance. Again, I never saw an RFID reader and I was never scanned by anyone so I’m not sure of its purpose. In fact I hardly ever had to show my badge.
One of the first talks we attended was Brian Bushwood’s “Social Engineering: Scam Your Way Into Anything or From Anybody”. He touched on many different social engineering tactics and sparked my idea of seeing how far I could get without showing my badge. The results? Surprisingly far.
In the 5 days that I attended panels, I kept my Gold badge tucked away in my coat pocket or backpack. I was able to walk around the Convention Center freely, use the wireless internet access, buy food, hang out on couches, etc. without any hassle, or even a second look. I was very recognizable and stood out with my bright red hair, so it wasn’t like I was fading into the sea of people. I often passed by 2-3 SXSW volunteers (sometimes only a foot away) who were standing guard at multiple entrances without any comments.
When it came to attending talks and panels, it was just as easy. I made it to 12 different talks without showing my badge at all. I was finally asked to present it for my 13th and final talk on the last day of SXSWi, I think primarily because I was with a couple of friends who also weren’t wearing their badges at the time.
How did I do it? Surprisingly easily. Over the couple of days I utilized several techniques to make it past the SXSW volunteers without getting stopped:
* Wear a coat. The first few days were cold and rainy and I always had a coat on. Most people will assume your badge is under your coat. When the weather warmed up to 80 degrees, this wasn’t so much an option.
* Bury your head in your iPhone/schedule/something, look like you’re deep in thought. Most people will want to be polite and won’t interrupt you and you can walk right past.
* Stick with a large group of people, preferably in the middle of them.
* Avoid eye contact. Don’t engage people that should be checking your badge. You want to get by and have them focus on the next person, literally forgetting about you in seconds.
* Walk around like you belong there. Granted this was easy for me to do since I had paid for a badge, but anyone with some confidence could do the same. This is probably the most important thing and actually something Brian Bushwood echoed.
So how many times did I have to show my badge during the week of SXSWi? Only 5 times: Picking up my shwag bag, free drinks/food at the Web Awards Pre-party, seeing the premiere of Objectified, my 13th and final panel, and the official closing party. Four out of those five instances I just flashed a badge that had stickers slipped in, covering up the holograms and most of my name and photo. All of the technical and physical anti-counterfeiting measures that SXSW implemented in their badges were basically rendered useless by the flaws in the social realm.
As I said before, do not use this information for evil. You should pay for a badge for SXSW, as it is an event that is definitely worth the price. If you do it early it’s quite affordable. I also imagine that this will be more difficult in the future as I informed SXSW employees of my experience in addition to making this post.
UPDATE: My friend John Adams says that badge checking during the Music portion of SXSW has been much stricter than Interactive.