Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/207 Thanks!
So this is going to be a talk by Kurt
Dobson, who's an attorney with the
Electronic Frontier Foundation,
and yeah, that
talk is called through a prism darkly.
Give him a warm round of applause,
please.
Thank you.
Thank you very much, and thank you for
coming out here, it's great to see so
many people.
I am CropScience attorney with the
Electronic Frontier Foundation.
We are a nonprofit civil liberties
organization dedicated to defending
your rights online.
And I have been involved in litigation
against the NSA spying program
since 2006.
And yeah, we've had that.
And we've learned a lot over that time.
Some of it actually first coming out in
2005, a lot of it coming out this summer.
And so we talk a little bit about what
we know started out with the background
where that where the program originated.
Some of the code names
some of the spying laws that purported
to enable the programs.
We can talk about basically two types
of programs.
Some which are purportedly authorized
by law from the Foreign Intelligence
Surveillance Act, Amendment Act
or Pfizer
and the Patriot Act,
and then some which are not authorized
by law but are done by executive order,
which is just an order from the president
to go do it.
And there's a particular executive order
which is dealing with collecting
intelligence around the world
on people like you.
And then finally, we'll talk about
fighting back what we can do to stop
the spying.
So the background after 9-11,
President Bush unleashed the full power
of the NSA, unleashed the eye of Sauron
to look around the world and try and find
everybody all the time.
The NSA had been operating
under some constraints at that point.
Some of those constraints actually were
from the original Foreign Intelligence
Surveillance Act of 1978,
which came about after a number of
scandals encourage
Congress to rein in the NSA.
And they went ahead beyond Pfizer,
ignoring Pfizer with what was called
the president's surveillance program.
A subset of that program was later
called the terrorist surveillance
program. And that first was admitted
by the president in 2005.
The TSP was actually a tautology.
It was that portion of the larger program
that surveil terrorists.
And so it enabled them to say things
like the TSP only surveil terrorists
because by definition, any part of it
that didn't surveil a terrorist wasn't
part of the TSP.
The PSP
was done without any court warrants,
without any of the legal authorities and
niceties that generally are happening
a, you know, rule of law
type of government.
So why did they do it or how did they do
it? Well, the main inspiration came
from the fortuitous
ness of having U.S.
companies sitting on top of the wire.
This comes from one of the original PRISM
slides that came out back in June,
and it shows the paths of
communications between various regions
in the world and the amount of bandwidth.
And as you can see, the very large wide
orange lines are focused
on U.S. and Canada.
And what this means is that a lot of
communications around the world, even if
they're not going to and from the United
States, even if they are going between
two other regions, will likely pass
through the United States because that is
the cheapest path.
That is the one that is going to be the
more efficient path.
And that allows the company
who are sitting on the wire to look at
what's going past.
So they started doing this program and
they were doing it for a number of years
in super secrecy.
So secret, in fact, that the
legal department, the general counsel of
the NSA, was not allowed to see the legal
reasoning behind it.
Very few people within the U.S.
Department of Justice were allowed to see
the legal reasoning behind it.
But eventually, that broke down, and
some of the people in the DOJ started
to see the memos that
explain why they thought this was legal.
And there was actually a very interesting
incident in 2004
where the acting attorney general
got a hold of the reasoning, and there
was one aspect of it that he just
couldn't buy.
And that was.
And, you know, just this is not a, you
know, civil libertarian.
This is a law and order or, you know,
a conservative really ready to surveil
kind of guy. But it was still too much,
and it was that they had come up with a
definition of acquire
such that the process by which
previously they didn't have it and then
later they did have it was not an
acquisition.
And this allowed them to get the stuff
without acquiring it and thus not have
to worry about those laws that talked
about what you had to do to acquire
things.
So he didn't buy it, and he refused to
sign off on the president's surveillance
program.
So at that time, the White
House counsel, Alberto Gonzalez.
Want side?
Well, I'll go over his head.
He was the acting attorney general
because the actual attorney general was
in a hospital with pancreatic cancer
and pancreatitis.
And so they raced to the hospital and
this was actually done with, you know,
sirens and lights blowing through red
lights to get there first.
So what? Gonzales was trying to get the
sick attorney general to sign off at, and
Comey was trying to get there to prevent
that from happening.
Comey did get there first.
The attorney general did not sign off on
it, and they threatened to
resign if the program continued
with this particular aspect.
Eventually, the program actually stopped
going under that theory, and there was a
gap for a couple of months until they
developed a new theory
of being able to obtain the same
information, and we never found
out about it because people did not
resign.
However, about a year later,
the New York Times first revealed the
existence of the PSP,
and they focused on content collection,
collection of content of
internet, communications and telephone
calls.
And this caused a lot of fuss at the
time. This is when the president came out
and said, Well, there is a terrorist
surveillance program, but don't worry, it
only surveilled terrorism.
We're already discussing what that really
meant.
And then in 2006,
USA Today revealed the
call detail records program.
That's the records of who you call,
how long you spoke when the call was.
And they named several companies that
were participating in it, AT&T and
Verizon.
This is when actually in
that time period before the USA Today
article, but after the New York Times is
when it first filed suit
against the program in
2007,
they decided that they were going to say,
OK, we'll put it under the FISA
court. That's the Foreign Intelligence
Surveillance Court. It is a secret court.
We'll talk about that more in a moment
and then to try to bulk up some
of the legal problems they passed the
Protect America Act.
This is part of sort of the American
tradition of having these sort of vaguely
Orwellian names.
And that was a one year
extension.
And then finally, in 2008,
they passed FISA and
that added some additional authority,
most prominently Section 702, which will
which we'll talk about.
So as you go on a couple of code names
to sort of keep in mind the original
program, the president's surveillance
program was known as stellar wind,
and you can think of it as having four
parts and a metal grid here.
So like on one hand, you have either
telephony or internet, and
then they divide it into content and
metadata.
And then within the grid could see some
of the databases and applications
that that information goes into.
Now, this does not mean that that's the
only thing inside these databases.
So Marina, you know, takes in information
from other sources as well.
But this is where those things go into
a couple of other code names to point out
there's one which is evil.
All of this is for
geolocation.
One ETF is one and
foreign.
So in order to help
justify their program, they try and focus
on one and foreign or at least
one and foreign, they use evil all up to
do that. I like evil all because
it has some neat characteristics.
It's a palindrome.
It is also an anagram for I love
evil.
So I think there are some people there,
but I have a
sense of humor and then
fuzzier. This is the location database
of where you are, and
the Fasher seems to be a reference to.
Well, it seems to many words
of fascism think to be really fair,
so boundless.
Indeed, Boundless Informant was one
of the programs or one of the databases
that was revealed.
This is a color map showing
a heat map showing where the SIG
addresses are.
Getting information for Segui addresses
is a collection point.
There are 504
SIG addresses which are
being reflected here.
And this adds up to
billions of pieces of information,
and this is actually only showing it for
a very short period of time.
Now you might, you know, as you might
imagine, some places like Iran
is is in red, Pakistan in red.
But as you can see, there is a
lot of countries which are
considered to be U.S.
allies that are
getting more than just a little bit.
You can see Germany there in Orange, so.
So too, with the United States the same
color as China.
So here are some spying laws.
There's the Wiretap Act that
was one of the first laws
that we have in the United States
to regulate when the government can
listen in on your phone calls that passed
in the 60s and
it was largely for law enforcement
in the 70s, there was the Foreign
Intelligence Surveillance Act that was
born from some of the scandals that were
discovered in the early 70s.
In the 80s came the Electronic
Communications Privacy Act that was
trying to modernize communication
law to deal with email communications.
The USA Patriot Act passed
in the wake of 9-11 in particular
that had a Section 215,
which turned out to be very important to
their spying program.
When that was passing,
that was referred to as
the library records provision, people
were thinking that this was a provision
that might allow them to get records of
what you checked out of libraries.
Little did we know that it actually was
far, far worse.
The Protect America Act This was a
temporary measure.
The final FISA Amendment Act brought
another section, Section 702, which we'll
talk about, which is the rules
about spying on non-Americans
and then also executive order
twelve triple three.
That was an executive order actually
signed a long time ago by President
Reagan. It's been updated a few times
since, but it provides the framework
for spying outside
of the legal frameworks passed
by Congress.
So where we first found out about this
came from finding out
about a splitter that was
in room 641 eh
of AT&T San Francisco facility
whistleblower Mark Klein came
to EFF with some documents showing
how the splitter was hooked
up, where one
copy of the LightStream would
go to the NSA and the other copy would go
to its destination and even provided
a photo of the room.
You can see the room is the door
has no handles.
It was controlled access.
You had to be approved by the NSA to get
access to the room, even to
the point when there was a leak
and it was actually causing some damage
to the rest of the facility.
They couldn't get someone to go in there
and fix the leak until they had gotten
clearance, and it took several, several
days to do so.
This graphic explains
how it works and sort of simple
form. You have all the nice people at the
top of their communications
go to the AT&T facilities.
The splitter takes, the light beam makes
two equal copies, one of which
goes to 641, eh?
And the rest goes on.
So how much are they able to get by
sitting on the wires and putting in the
splitters? Well, the NSA says, you
know, it's not that much.
It's only about 1.6 percent of
the world's internet traffic.
But it's worth pointing out that that
that actually turns out to be a lot of
information.
Well, first of all, only about 12 percent
of the traffic is web.
Another three percent communications.
Almost everything is video
streaming, and about
two thirds of those communications
is spam. So you can sort of bet that the
NSA actually has some of the best spam
filter technology in the world.
And even if we take them at
their word and say it's only 1.6 percent,
that's still 30 petabytes
a day that they're ingesting.
And that is just of the internet traffic
flow. And as we know, they're also
getting phone calls, call
records and location.
So where do you put all of that data?
Well, that turned out to be a problem.
And so they built this new facility out
in Utah. This is just
broke ground.
The summer they finished up in September.
It is a about a 10000
square meter server space.
Various estimates have been given about
the size of it could be up to 12
exabytes.
Uses a lot of power.
And so Brewster Kale, you guys familiar
with the Internet Archive,
the wayback machine.
Anyone?
All right. It's good service.
They store a lot of data.
And Brewster knows a lot about storing
massive amounts of data.
And he estimated just for the U.S.
phone calls, it would take
a four hour, 464 square meters
to store and process that.
That's a lot less than the total
facility. So what is the rest of it?
Well, it's all of your calls.
It's all of the internet data.
And what do you do with all that data?
Well, so Ryzen and licked by our two New
York Times reporters explained.
What they do is comb through it in
a large data mining operation.
John Yoo, who is one of the legal
architects working for the Bush
administration, described it, plucking
out the emails and phone calls that have
a high likelihood of being terrorist
communications.
So this is what they're trying to do.
And how do they do it?
Well, one of the ways they
they they do it is
by playing a little bit of a word game on
what they're doing
holding without collecting.
That is to say, they were able to say to
a number of congressional committees and
other statements that they weren't
collecting all of this information,
and then they later had to sort of
explain what that meant,
said the director of national
intelligence.
He said, think of it like a huge library.
To me, collection would mean taking
the books off the shelf.
Now, I don't think that's how most people
would think of a collection, like if you
went into a library and said,
You know, Well, what? I want a nice
collection. It is.
You can sort of imagine that Clapper
would have to say, No, it's not.
I haven't read all these books yet.
When asked about how
many Americans data were in
there, the director of national
intelligence, McConnell said, We
can't know, we can't know
until we look at what's in there.
And so sort of if we don't look at
it, it doesn't matter.
Instead, they are sort of focus on
what they are targeting.
And so these are so this is a slide that
is giving some of the numbers about
the selectors for targeting.
And you look at these numbers in the, you
know, they're fairly substantial numbers
15000, 19000,
but not supremely huge numbers.
And that is because what they're talking
about is targeting, but
when they are targeting something,
they're hitting a lot more than their
target.
And so they try to minimize the amount
of the scariness
of it by talking about the selectors.
But when one selector can mean
a lot of information.
So let's talk about
Pfizer seven oh, two, Pfizer.
This is the section of the law that
passed in 2008 that
is set up to design, designed for
getting the content of communications
outside of the U.S.
and they have two sources you should use
both upstream
and that's sitting on the wire, the fiber
optic splitters we talked about earlier
and then PRISM, which was revealed
this summer. And that is collection from
the service providers
and PRISM involve collection
both through 702 orders
and also through through other means
that were gathered in there.
We will talk about those in a bit.
And it had some targeting
and minimization rules.
So one is that the statute
said, you know, you have to be targeting
foreigners.
And so they interpret this to mean as
a 51 percent chance or more
that something is foreign.
And so if it's slightly
better than a coin flip,
then you assume it's for him and
unless it's proven otherwise.
So if it's unknown, if they can't figure
it out one way or the other, then it's
foreign.
And then if if they can't
tell exactly what it is because it's
encrypted, well, they'll just keep it
around forever until they do.
And to get these orders, they go to
the FISA court.
Now the FISA court, I
have not seen it, but someone who
has was helpful enough to make this
drawing of its entrance.
This is the secure door.
You can see the hand reader there.
He passed the code.
The court meets inside a Faraday cage.
It is a highly protected
it right now.
It is in the the court
in Washington, D.C., for
a long time, actually for the first, like
20 years or so.
It was inside the Department of Justice,
so in the same building as
the attorneys who are going to
get orders from it.
Then they finally sort of saw it.
Well, that seems to be maybe
a little bit too much to see, like we're
working too closely together.
So we'll move it to to a new building.
He was established under the FISA Act
and in its original idea,
it was about spying on spies.
So, you know, other foreign intelligence
agents may be diplomats,
sort of the traditional notions of
foreign intelligence, but its
role was massively expanded,
especially after nine eleven,
and it is now being used
to far more.
And it goes in there and is basically a
rubber stamp court.
They go in there, they provide the
application.
They have a phenomenal approval
rate.
It is an ex parte court.
What that means is only one side gets
to argue. They only get to see
what the government has to say without
any counter argument, and they tend
to just believe what it says.
Now, after some of the revelations
this summer, the FISA court felt that it
was necessary to sort of explain itself.
And in doing so, they said, basically,
the court does not have the capacity to
investigate issues of noncompliance.
They don't know what it's doing.
They're basically unable to provide
oversight. Nevertheless, the government
often points to this court as saying,
This is where we get the oversight.
Now there's a couple of definitions
within the Foreign Intelligence
Surveillance Act that that are important.
One is the United States person.
So this is what it is interested in
protecting. It's not that interested in
protecting you. It's interested in
protecting U.S.
citizens or permanent residents
groups with substantial numbers of U.S.
persons or U.S.
corporations.
And then what is trying to get at is
foreign intelligence information.
Now that includes the things that you
would sort of expect it to include,
you know, national security terrorists.
But it has another provision here things
that relate to the conduct of the foreign
affairs of the United States.
Now, as you might imagine, that is an
extraordinarily broad
definition.
Almost anything could relate
to the conduct of the foreign affairs of
the United States.
And if you ever if you listen closely to
when the government is trying
to explain what they're looking
for and what they're doing, they will be
using examples such as
going after terrorists,
including national security.
But of course, also including
the foreign affairs, the United States.
So we talked before about how had to be
51 percent or more for it.
So how do they figure that out?
Well, the hair we saw the XKeyscore
dashboard and it has a
handy pull down menu
where it has a pre-selected reasons
why someone might be 51 percent or more
foreign. And all they have to do
is select one of these.
And then that is a pre-approved good
reason. And then they move on.
So you just go there, select the one you
want. Move on.
It's very hard to make a mistake because
all of the answers are correct.
And I'm.
There is the targeting procedures.
So here's an example of what
they mean sort of by targeting something,
this is an example about Sweden,
and what they targeted was
everybody in Sweden
who went to this particular
URL. So you put in the URL
and one field, you put in the country
code and the other push the go button
and now you have a targeted
collection.
One of the searches that was revealed
in that document sort of shows how
broadly this can be.
It was looking for communications that
had the word Ericsson, which
I believe they were referring to the
Swedish manufacturer and not just the
last name and the word
radio or radar.
And you can sort of imagine how many
communications say to
or from somebody named.
Ericsson might have the word radio
in them, but rather than
miss any, they're getting all of them.
And this is what they mean by targeting
things.
Once they obtain the information, they
process it.
The slide is showing sort of how it goes.
You can see some of the databases we
mentioned earlier Marina Main Way
Nucleon.
So it goes through these various
processes and then ends up in the
database where it can be retrieved later.
Now our turn to Section 215
of the Patriot Act.
They said this was originally thought of
as a library provision.
It was to allow them to produce tangible
things,
and it had what was thought to
be a restriction on how broadly
could be used. These things had to be
relevant to an authorized
investigation.
It was imagined to be similar to a
grand jury subpoena, which is sort of
the typical process by which
a prosecutor could get records from,
you know, from the phone company.
You know, they get one record about one
person at a time.
Then we saw the Verizon order
and the Verizon order show what they
meant by relevant was
everything, all the calls
of all the people, all
of the time,
all the information about them
dumped on a daily basis, with the order
being constantly reviewed,
renewed every 90 days.
So that sounds like a lot of information,
but a it's just metadata.
So in the defense of the program,
President Obama said, Well, we're not
listening to your calls.
We're just sifting through so-called
metadata like how he adds sort of the so
called in there to sort of make it
somewhat dismissive in it.
They keep on saying we don't listen
in to the calls did not include the
content.
But let's let's examine some of these
explanations.
Let's say one of them was
we're not getting the identity of the
people involved.
Well, that that's nice.
But it's possible that the NSA has access
to phonebook technology and
they can cross-reference things.
They also said no location
information under this program.
More recently, it was revealed then that
well under a different program.
Well, that's a that's another story
they said, well, it's only a few hundred
selectors.
But then once they have each selector,
they take it three hops.
And so that's everybody.
You call everybody.
They call everybody.
They call.
And so on until one
one selector can be
hundreds of thousands, if not millions of
people, depending on how frequently they
call people, how many different people
they call over the years and years
of data that they are collecting.
So they had some legal basis for this,
the FISA court.
Originally, they approved it by basically
saying, Yep, looks like it meets
the statute. Go ahead.
And then, you know, the program got
revealed. There's a lot of public
controversy, and only then
did they issue an opinion that that
purported to have some, some legal
analysis.
The the first opinion came out sort of
discussing some of the legal issues.
They said, Yeah, you know, relevance
doesn't actually mean anything.
So it was OK.
And then some people pointed out, Well,
gee, you know, you didn't look at
Supreme Court case that had talked about
us V. Jones, which is Supreme Court case
that talked about how you couldn't
you needed a warrant to go after people
and surveil them with GPS.
So then they issued another opinion and
trying to deal with that.
This is after the fact justifications
which they felt were necessary because of
the public controversy, not a true
analysis that began looking at it
skeptically from the beginning
when it came to an open court.
Things were a little bit different.
We've now had two court rulings
that have looked at it in open court.
One good, one bad.
So the first opinion found that it was
likely unconstitutional.
And then earlier this week, there was
another opinion that unfortunately went
the other way.
These are going to go up on appeal,
and we hope that the right decision
will eventually be reached.
So let's take a moment to talk about why
it matters, so they're saying like it
doesn't really matter, it's just
metadata. It's information about
your calls, not the content itself,
but actually metadata matters a lot.
And so we have some examples here of
how well, if you just
know when the call is
who you're talking to, what time,
how long you spoke.
You can get a great deal of information
about the meaning of the communication.
In fact, it may be easier to figure
out what you're talking about than
listening to the content.
If you listen to the actual words
people are speaking, they may
be, you know, mumbling there might be
some static on the line.
You have to sort of parse it.
It's kind of a pain.
But with metadata.
You have some hard facts, and
you can make inferences that can often
tell you a lot more about the
meaning of the communication than
actually parsing the communications
themselves.
So the final authority
under this three part system is executive
order twelve triple three.
So this is it's
an authority in some sense, but
it is not a limit
on spying. And unlike the Foreign
Intelligence Surveillance Act,
where it is trying to put some
limitations and say there has to be the
limitation and targeting so on.
It is not a substantive limit.
It suggests you use the least intrusive
collection techniques feasible.
If you know something extremely
intrusive is the least intrusive, well,
then so be it.
And it's OK, so long as
it's in accordance with procedures
so they can come up with procedures.
And once those procedures that are in
place, then they have satisfied the
requirements of twelve triple three.
And then also helpfully, at the end of
twelve triple three, they mentioned that
if they if there's any violation of it,
there's no substantive right.
You can't sue to say that
this was unlawful because they violated
executive order twelve triple three.
So under that authority, they do a couple
of things. There's some bulk operations.
So we found out about some of the phone
call operation, 70 million calls
and France 60 million in Spain,
apparently with the assistance
of the French and Spanish intelligence
service. They're using this to get
financial records through Swift.
Swift is the cooperative owned
by several several thousand financial
institutions, so this is getting
information about your credit card
transactions and what you're spending and
where.
But that wasn't enough, so they also
needed to get some of the information
from the internet providers.
So we recently learned about the muscular
program.
And this was going into the data
links between tech company data
centers.
If you guys have been to several of the
talks here, you've probably seen this
graphic quite a bit.
It's a pretty good one.
They point out where the SSL
is added. Remove, add the little taunting
smiley face.
This smiley face, I think, has come
back to bite them.
It has been interpreted as a bit of a
taunt by the companies, and
the companies have responded
by encrypting the links between their
data center, increasing the adoption
of HTTPS by default
by using strict transport security,
adding forward secrecy.
We recently did a survey, our crypto
web report, that shown there
on the slide.
You can. The green checkmarks are for the
companies who are doing
some of these things.
Have the column on the
on the left is for encrypting
data center links. There's a lot more
check marks there than even when we
started the survey, though there are
some notable exceptions on
there.
You'll notice that all of the
telecom providers, well,
they have a lot of
red marks and unknowns.
I don't think that they're going to be
pushing too hard for additional
encryption.
We learned about the Co-travellers
Traveler program.
This is the program by which they
obtain a location information from a wide
variety of sources
and they automate guilt
by association.
So if people are traveling together,
hanging out together and they don't
like one of them, then they now don't
like the other one.
And they look at the speed and trajectory
of two people's cell phone patterns
and then say, Oh, they're traveling
together. So given
where we all are, the cell towers around
here is now that a lot of new travelers
to their database. So sorry about that.
You're you're now part of this program.
They also are looking for disposable cell
phones, which is for one of the things
that many people are trying to do in
order to protect themselves from
surveillance. Maybe if they're a
journalist, they want to talk to a source
starting using disposable cell phones.
Well, they're trying to make that more
difficult. They're looking for phones
which are being switched on.
You make a call, you switch it off, and
they're looking for situations in which
you've been using a phone for a while and
then you stop using it.
And then a new phone connect.
So if you are going to be switching to a
new cell phone,
don't do it at the same time.
Leave the old one on for a while.
If you're trying to avoid being tracked
on a phone, leave the phone somewhere
instead of turning it off and on again.
And then they have the targeted
operations.
So in addition to the bulk collection,
they use some of the information obtained
in the bulk collection to go after
specific people.
We know about going after
the Chancellor Merkel's cell phone.
Since before she was the chancellor
using American diplomatic buildings,
they have spied on at least 35 world
leaders.
And they've also has been revealed that
this is not just for
counterterrorism, not just for
international espionage against
adversary states, but
economic spying on allies.
And this comes back to the definition of
foreign intelligence information, which
includes anything having to do with
foreign affairs, the United States.
So economic spying falls
within that system.
They're doing man in the middle there,
the great slide that came out from
Brazilian TV Flying Pig,
which was a program that was organizing
some SSL certificates in order
to basically get around SSL.
They own the router, then
do the attack.
One thing that came out from the flying
pig I, they compare that with PRISM.
It suggests someone in the code named
apartment is a fan of Pink Floyd
album covers.
We've also learned a bit more in the last
couple of days about the
tailored access operations.
The Dow of NSA.
This is where they are doing particular
targeted operations.
We've known about some of them against
the Mexican president's email OPEC.
Others.
One of the ways in which they're
targeting is using the Google pref
cookie. The advantage being that almost
everybody who uses a browser
at some point in time is going to
encounter some Google ads
get a Google pref cookie.
It is theoretically anonymized, but
it is unique enough to have it become
a point of target.
And then once they have a target, they
use the quantum insert,
this is a diagram actually this this is
one of the ones that just came out
yesterday showing how the quantum
insert method works
when your communication is going to
a website.
They get in the middle, they are
sitting on the wire, so they're able to
operate faster than
the, in this case, Yahoo server.
Get the tainted communication
back to you and direct you to
the Fox acid server.
The Fox acid server is then
programed to serve up the appropriate
malware.
The actually the codename for the program
that serves the malware is called the
ferret cannon.
So the Ferron Can shoots the malware,
which which is appropriate for the
circumstances.
What they are trying to do is make sure
that they don't burn too many things.
So if they think that you're a
sophisticated user, which they may think
for many of the people in this audience,
they're not going to put a sophisticated
attack on there.
In case you find it, and then it becomes
known to the world, depending on
the value of the target, they may use
something which is a zero day, or they
may use something which is not that
important.
And then bull run.
This is sabotage inserting
vulnerabilities, trying to make
the crypto systems upon which we all
rely
become, well, worthless,
putting the pseudo and pseudo random.
So we have learned some pretty
compelling evidence that
dual E.C.
has been horribly compromised.
Not only that that RSA was
paid $10 million to
continue to have it be part of the
standard.
And then apparently in 2010,
using the sabotage program,
they were able to break through vast
amounts of data.
We still don't know exactly what that is,
but it is
well, it's allowing them to look at
things which seem to be encrypted
on on the wires.
They've also been very interested in
going after tours.
The good news here is that
Tor, the fundamental security
appears to be intact.
They are going after the Firefox bugs
that are with the Tor browser
bundle using Firefox.
We actually have an example of
this technique that was was revealed
in the NSA slides being used
on Freedom Post, which was using
a JavaScript bug to
identify people who went to dot
onion routers that were being hosted on
Freedom Host.
When they were doing this, it was rather
not discriminatory.
Any buddy who went to freedom host,
whether as one of the targeted sites
which were serving child
porn, or if it was somebody who was
using it for an opposition site
and activism site.
All of them got this bug and
they were used to track them back.
And I think this this is a little bit
dangerous. We we made actually, this was
the graphic at the bottom is a
modification that we made of.
The NSA graphic to show why
this matters is that it's very hard
to tell the difference between a
terrorist with the Tor client installed
and an activist with the Tor class.
But it's important not to treat them the
same and to realize that
activists used and depend on Tor.
We've also heard from the government that
there hasn't been any views.
We heard that for a while and then an
audit came out finding that
there were two thousand seven hundred
seventy six incidences in
one year of unauthorized collection,
and this was just in the D.C.
and Fort Meade area, which was
one of or two of several
NSA areas.
Things. There's only one thing this
was not abuse.
So somebody mistyped
a country code.
Instead of putting in to indicate Egypt,
they put in 202, which is the area
code for Washington, D.C.
And they got all of the communications
in Washington.
And this was deemed to be no big
deal because it pertained to metadata.
So there were no defects to report.
So when you hear the government say
things about, there isn't that much
abuse.
Remember that they might be doing things.
We're saying, Well, this wasn't the
category of things that rise in the level
of abuse, but you might not agree with
what their standards are.
It also reveals something rather amazing
about the program that you could actually
have something by making a typo
between 20 and 202.
There's no further check you put into
or to hit the return key
and off you go without it saying, you
know, are you really sure that you want
to do this?
This is putting tremendous power
in the hands of analysts
without much oversight.
And then another form of abuse that came
about they it was cute because they had
even a name for it.
Love it.
Where there were at least 10 incidents
where people were using their NSA super
powers to look after their ex-lovers
and spouses and see what they were up to.
And you might say, well, you know, 10
incidents, it's offensive,
but not not that many.
But keep in mind that these are
tendencies of self-reported ten
times people came and told
them that they had misused their
powers.
This is not 10 incidents that they have
found. After thoroughly scoring what
everybody was doing and then finding what
was being done.
One of the things they're also using for
is discrediting radicalizes,
so they look at what they call
radicalizes and then look at things like
their visits to porn sites, look at their
online promiscuity, try
and find things that will make their
voice less
valuable.
And what they deem are radicalizes are
people who speak to extremist
communities.
And so it's not so much that they are
doing anything illegal themselves.
But there might be inspire somebody
else to take some views that the NSA
doesn't like and using
this to undercut their message.
So what are we doing about it?
Well, one thing that we're doing is
working on legislation and activism.
If worked with the Stop Watching US
coalition and we got over half
a million petition signatures delivered
to the US Congress, it's myself
and our activism director Rainey Reitman
delivering those signatures in the US
Capitol.
We have been interpreting what
the meaning of both, what the programs
are and what the laws are
for the public so they can understand
the bills.
We've been looking at US law, so
there are two bills currently
that have prominence in the US Congress
trying to address it.
One is a fake fix from
Senator Feinstein and Representative
Rogers. It is designed to actually
do nothing about the surveillance.
Sort of the answer to it being illegal
is to pass laws to make it more
illegal.
And the other from Senator Leahy and
Sensenbrenner, which is actually trying
to rein in the NSA.
Those bills are going forward, so watch
watch for them and hopefully through
the Leahy and Sensenbrenner bill, we can
get some improvements and get some
U.S. laws that will rein in the NSA.
But there's more than just the U.S.
laws. We're also pushing forward a 13
principles for
international spying.
This is basically principles to be
adopted by various countries
legal systems on when
it is appropriate to
conduct surveillance, making sure that
it is only when it is necessary
and only used in a manner that is
proportionate.
So please go check out necessary and
proportionate dot net to read the
principles.
If you agree with them, you can sign
over 300 organizations have signed on
to it. And these principles have
become the basis for a U.N.
resolution.
There are also some legal processes that
have been going forward.
The Privacy International has submitted
a claim to the European
Convention on Human Rights
and the Organization of American States
has been holding hearing.
But in addition to
legal wolf.
Sorry about that.
There will, in addition
to the legal and policy
efforts, there are things that we can do
with technology fighting their their
technology with better technology.
Now one of them here is https everywhere.
This is an EFT project
as a browser add on that you can use
to make sure that any site that can be
HBC is a tbese.
But there's a lot of work that still
needs to be done, and hopefully some of
the people in this room can work on these
projects. I think, most importantly,
is to make these technologies easy
to use.
So there are technologies that provide
and end encryption for phones, for
instant messaging and text,
but they're not very easy to use
and to make them so basically that
anybody can use these technologies.
In fact, that everybody is using
these technologies and then try and make
sure that we're adding additional
encryption to data, rest
to data in transit
looking well. And we found actually, if
you went to Jake's talk this morning,
we did a lot of work to secure
things like our disk drives,
our flash memory, our hardware.
We need to shore up our crypto
tools against sabotage.
Take a close look at all of the standards
that have been promulgated by NEST..
It looks like that process has been
compromised and we need independent
Open-Source tools that people can
trust.
So and there is a lot that you can do.
You can start and I think a lot of you
are already doing this by paying
attention. There's a lot going on in a
lot of information, but absorb that
information. Look at it.
Share that information.
You all probably know somebody who knows
a little bit about this and should
probably know more.
Also vote.
Make sure that your representatives know
that this is very important to you,
and they can put pressure on
the US government to try and rein
in the spying.
And this is actually we've already seen
some of this. Some of the governments,
including Germany, have been putting
pressure on the U.S.
to stop spying as much
and
well, hopefully that
the economic pressure is really what's
going to do it.
Diplomatic pressure is nice and I think
needs to be done.
But also what we're seeing is a lot
of economic pressure coming from other
countries where it's affecting U.S.
businesses. And that's something that
Congress does listen to.
Another thing that's very important to
you is use all of these tools.
We want it so that these encryption
tools, safety tools and itemization tools
are used by everybody,
not just by people
who the NSA is trying to target,
but that we are all using encryption
all of the time. Now, some forms of
encryption are becoming quite
commonplace, like transport
layer security, but end to end encryption
is rare. So start using it, start using
it more frequently and get your friends
to use it.
And then finally build the tools,
build the tools that are going to make a
future that you would want to live in.
We have a choice now of moving forward
to a future which is going to be like a
dystopian Philip K.
Dick novel.
Or we can have a bright future, a
future that has privacy for future,
that has security, and you can build the
tools to get to the future that
you want.
So thank you.
OK, thank you very much
for
this very interesting talk.
So we have still a lot of time for
questions. We're going to start with the
internet. People in the room can line
up behind one of the microphones and ask
your question.
Do we have a question from the I.R.S.
or Twitter?
Speaking at auction in
June, John Parabola pledged that the ESF
would do more to fight for the
rights of more Americans.
The question coming from the IOC
now is what, if anything,
that he is following through on
this promise.
So I'm sorry the question was fighting
for the rights of non-Americans.
Yes.
Yes, indeed, so we have been working on
it, and I think probably most prominently
is the necessary and proportionate
project, putting forth the
13 principles and
organizing the three organizations
to sign on to the principles,
promulgating them to various
countries around the world
and now also to the United Nations
to get countries to adopt these
principles.
Also, we are trying to
stop the programs through the court
system and if
the if the programs stop,
then this will affect both ends of the
calls.
And so we're hopeful that
by finding that these things are
unconstitutional, that this can put
a significant reign on the program.
OK. Microphone three, please.
Yes. Hello, thanks for the great
lecture. I loved it.
One comment when I read to the name
of the cell phone tracking program
Fuschia some
little history. When Benito Mussolini
started his fascist
work in Italy in the 1920s
and 1930s, the name of their groups
was fuschia dipartimento.
You can read it in Wikipedia.
So perhaps they've chosen this name
by accident? Perhaps not.
I don't know.
But OK.
Two short questions.
Is there any evidence that
they used their knowledge
of every body of everything
to to choose the
politicians or managers they would like
to have? Because when there is an
upcoming politician who is perhaps
against surveillance or against America,
against anything, they could just link
bat news to the media, for example, which
party watches in the night in his room?
First question, second question.
The Genie program.
They spend six hundred million dollars in
2012 to insert the backdoors in
hardware.
Is there any evidence that they backdoor
the bios of the firmware default?
In this case, you don't need to care
about any encryption because you get all
the key
keystrokes from the bios.
OK, very good questions on the first
question. I have not seen evidence
that the current program
has been used to undermine
people, except for the six people
who were not identified
but mentioned in a
basic of the radicalism that
we were talking before.
But the slides did not identify who those
radicalized heroes were.
On the question of have they undermined
it? There is an unfortunate history.
If we look back at
J. Edgar Hoover, who is the director of
the American Federal Bureau of
Investigation for decades,
he actually did
get information about some of the
more embarrassing materials about
people he needed to work with
and is alleged to have used that
information to obtain,
you know, favorable budgets for the FBI
and things that he was won.
So there is a unfortunate
and dangerous history of that happening,
but we haven't seen direct evidence
that it has happened right now.
And on your second question about
worrying about
going on attacks on bias,
I don't know if you saw Jake talk from
earlier today, but it was revealing
a lot of stuff about their
misuse of bias and attacks
on hardware.
So I would suggest you take a look at
that talk and the slides that
were revealed in today's Der Spiegel.
Thank you.
So, Kristen, from the internet again,
one question coming from AOC
wasn't how could an individual
detect or
help to detect censorship if and if,
if of any form, for instance,
on broadband connection?
So how can you detect censorship?
Well, it's an interesting question, so
I guess if I'm interpreting this question
correctly, it's how would you know
if you are going across
a broadband that what you are
obtaining is what you
expected to obtain?
And we can see from the quantum insert
that they can modify what you are
receiving when you go out into
the web and give you back
something which is different from what
was originally planned to be given to
you. And I guess the way to do that
is from checking things through
alternative channels.
If what you're receiving is something
different from what somebody else is
receiving, then that may suggest that
one of these things has been modified.
So it's
a way of detecting it.
It's my understanding that for
most of this one, they are injecting
packets and giving things which are
different from what you're intending.
It's designed to be sneaky.
It's designed to not be detectable.
And if you're changing
what is being transmitted, then that is
somewhat detectable.
Though there's another form of censorship
that is going on, it is very unfortunate,
which is the self-censorship of
intimidation that happens when you know
that your communications may be monitored
and then you may not go and get the
information that you need.
And this is why it's very important to
use tools. Tools like the Tor browser
use encryption technologies so
that you can go and get the information
you need with more confidence.
OK.
Number four, please.
Yes, I was interested
about the programs that you have like, it
just gives everywhere and stuff so
that maybe one day we'll have
encryption by default.
But I was also thinking maybe, maybe one
day, wouldn't it be possible to
just spam the NSA by by having
daemon servers running on my computer?
That's sending hours, emails with the
buzzwords in there and encrypting
nonsense and sending you oversaw the NSA
will save it because it's encrypted.
Are you working on such a program?
Because I think in the beginning, the
people who are using it will be exposed.
And so it would be good to have an
organization who was running this
at one point of a time so that many users
join at the same time.
But not no one is really exposed to
the NSA as an individual.
So I've seen a number of proposals along
these lines trying to basically
overload the the channels with
the type of information you might expect
that they are looking for.
And one thing I know if you saw the size
of the Utah facility, they have a
tremendous capability
of storing data.
They have a tremendous capability of
processing data.
So take an incredible
attack to have any sort of meaningful
denial of service.
So what we've really been focusing on is
trying to do the first thing we're
talking about is get https by
default all over the place all of the
time. One thing is the project like
https everywhere, turning something which
is optional itbs
and making it by default through the add
on. And the other is putting the pressure
on companies to make it
the default.
And as you go, check out the Encrypt
the web report that I mentioned earlier,
and you can see a lot of check marks in
there by default.
And actually a number of those were
changed within the last couple of
months where change in reaction to
what's going on. So I think sort of the
better use of resources is try and get
as much encryption all the time, all
over the place.
Microphone two, OK.
Yeah, I got two questions.
The one thing is about economic
pressure.
So just to clarify
what you're saying is that
in reality, one should, for example,
exclude Windows products from
all international
acquisitions and with an information
critical system, as it should do anyway,
but so
that they will not be able to sell it
as an example for economic pressure.
And the second one, how about
legal pressure,
criminal legal pressure for individuals
to clearly work outside
the scope of the law,
for example? And what it should we?
Shouldn't we all perhaps file criminal
a criminal accusations in our
national legislations and see if those
anti-terror laws work in our favor
for once
and as an activists proposal?
So let me let me address these.
Yeah, absolutely. So the first
one economic pressure and I think
actually this is this is the most
effective.
It's something that we know that
the U.S. government does listen to.
It is concerned about the economics of
the U.S. companies.
And one of the things that actually was
extraordinary is we
had a number of U.S.
companies, eight internet companies.
They they signed a
statement asking the government to stop
the spying. And I think in part because
it was affecting their interests.
And the sabotage program that the NSA
has been doing is sabotaging
these companies ability to sell things
around the world because they trade.
We have these products, they are secure.
And then it turns out, in fact, they're
not secure their backdoor.
They have these problems.
And that would be a reason why someone
might not want to use these things.
That will have, I think, a potent effect
going after people criminally.
I mean, this is this has been tried.
There have been complaints that have been
raised against members of
the Bush administration, stemming from
both some of the earlier allegations
or earlier revelations about
spying and also about some things having
to do with like the Iraq War and so on.
This hasn't had a substantial effect
on on policy so far.
Thank you. OK, thank you.
One more question from the internet,
please.
What do you actually think about think
of efforts like canoe net to solve
the fundamental problem of unencrypted by
default internet traffic.
So the question is, what do I think
about?
Sorry, say that again.
What do you think about efforts
like new to solve the fundamental
problem of an unencrypted by
default internet traffic?
So I'm not familiar with gang unit.
I do think that on the whole, we
want to have it be the
standard that all internet traffic should
be encrypted, right?
The internet was built in a time
when it didn't seem that encryption was
a, you know, necessary feature.
It was an additional feature, but it
should become a default feature and
we should try to change the standards
to include encryption as a basic
feature of communications.
OK, then one last question from
microphone three, please.
All right.
So you mentioned a bunch of very nice
examples where legal terms are
reinterpreted in ways that
don't make very much sense.
Like, for example, you said they acquire
data without using the word of
acquisition and stuff.
Yes.
So my question is why do
they even come up with these pseudo legal
escapes that every reasonable person
would think are illegal?
Is it just that they have an excuse once
things become public, which they weren't
supposed to anyway? So why did they
prepare for the excuse?
So so what does all of this legal
framework for?
So, for example, my expectation would
be that the NSA or
the agencies in general just do the stuff
they want to do.
And of course, then the next question is
if there is more stuff outside that
framework that's not pseudo legally
allowed and still done well.
So it's a good question.
And so why play
the word games?
There's a couple of reasons to play play
the word games. One is internal and the
other is external.
I'll look at two of them that we talked
about. One was acquisition
without acquiring and the other
was sort of collection without
collecting.
I'll start with the collection without
collecting. This was used externally
so that when they testified before
Congress, they could say things like,
We're not collecting this, we're not
collecting that went in their heads.
They were secretly meaning by collecting,
you know, this crazy definition.
And then the senator or representative
who was asking the question was thinking
that they were meaning collection in the
ordinary sense.
And so really, they weren't doing this,
this thing that they were in fact doing.
And so that later when it came about,
they could not be brought up, you know,
saying they lied to Congress.
And so they were, you know, there was one
incident with the director of National
Intelligence Clapper, where he kind
of got into a bad way where
one of the senators asked him a very
direct question
about getting the information
on phone calls.
And he said he denied it.
And then it turned out that that was
happening. But by and large, they using
these word games in order to
be responsive, but without giving
the information that is really being
sought.
But then you have the acquisition without
acquiring how this was done in secret.
This was part of a secret memo that
was only reviewed by a very small
group of people.
And the reason I think for for that
is because, believe it or not, there
are still some good people out there,
even within the government, people who
need to see an explanation
as to why this is legal,
even if they are not morally opposed
to to the surveillance.
They do believe in the rule of law, and
those people need to have this sort of
explanation.
And they tried to do this in two ways
by coming up with the well,
B.S. explanation and then keeping it
secret. Well, don't worry your pretty
little head about it. We have this secret
explanation. That's all good.
And then one thing that that is useful
about that is that
hopefully some of these people,
the ones that are good who do care about
the rule of law, are now starting to see
alternate views about what these
these are alternate views about
the legal analysis.
They might be saying that, hey, what
we were doing was wrong.
What we were doing was beyond the law.
And then remember that the oath that
they took was an oath to the Constitution
was an oath that respects.
Free expression and respect privacy.
OK, thank you very much for your talk.
Thank you, everybody.