Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/412 Thanks!
And so I have the pleasure
to announce the
talk about track free,
you never read alone.
And as speakers we have Maria,
as I know, who is a research
researcher at technically
I'm so sorry, technical tech
collective.
And there's Claudio Agosti, who's
also with the Technical Tech Collective.
And apparently we're going to have a
premiere tonight because they're going
to show us Tretyakov for you, which is a
software which will illustrate where
all this data is going that the websites
are collecting about us.
The zaal is yours.
Hi, thank you very much for being here
today.
Claudia and I work with tactical tech, as
you just mentioned, tactical tech as an
NGO based in Berlin.
But we work internationally and we are
super excited today because we are
launching one of our new projects, which
is called Truckle Graphy and is all about
online tracking.
So when we think about surveillance, very
often we think about governments because
a lot of it is carried out by them and
rightfully so. We do think about
governments. However, in most
cases, I think that companies,
corporations make a lot of surveillance
possible. A lot of our daily browsing
activities, like reading the news online,
is what enables governments to have
access to the states so they can monitor
us to begin with.
So, for example, when you think about
PRISM and a whole bunch of other systems
used by the NSA and other intelligence
agencies, we can see that a lot of their
monitoring is possible because
a whole bunch of companies like Google
and Facebook collected data based
on their tracking that they do on a daily
basis. And this is something we would
really like to draw your attention to
through this project.
Basically, what we understand is that
this whole world of data collection
is creating a new sort of power around
the world. And why we created Tachograph,
because we want to corroborate
what is that data geopolitics at
the moment. If you know that one
country has a larger pipe of gas
and this gas permits you to be warm
in the winter, you understand the Sanjuro
political relationship.
But what about the data?
Who is the owner of whom we talk, the
country that are depending more from
harder? This kind of answer are
the things that I was thinking inside of
us and try to
be on elsewhere is a project intended
basically for advocator
lawyer, analyst or researcher
sorpasso that to make this about this
phenomena.
We are focused on the media website
for the website, we mean websites
providing news media, because if
someone is able to understand and to
study how our population,
our region account is access
into the media and what is more more
interesting, what is,
said the researcher,
in fact, a way to perceive
and to study the Venetian itself,
the target itself.
We also see by the Facebook experiment
that based on what
you are reading, your influence, your
influence in your mood to be
more positive or negative.
And that is why
the media are the subject of this test.
That theory can be applied to every
website.
So basically, we develop
a softer script that emulates
the behavior of a user connected
to a website.
This group them perform HTP connection
using phantoms.
Yes.
Yes. These browser that ran that without
a display window.
Every time you connect to
a media website, you have many
third party content, like
if a video came from a third party
or a banner at a display
of advertising or some static picture
or some hidden tracker like it, keep the
inclusion that the just put the same
cookie and read your behavior.
The third party is what our
script to automatically detect.
Then we perform at Resprout throughout
it. For every included.
Third party is it can lead to
figure out which is the network path
needed to reach the
server included.
And then we perform IP.
So a resolution from every
hopper in the path
to a geographical location
in order to figure it out, which are in
fact involved.
At the moment, whoever collected the
30 Kountry in the complete analysis
of whether
directly on our GitHub repository
with the Middle East, because the Middle
East are changing at the time and the
required local knowledge to be Junette
so everyone can contribute to putting
is on a country.
And we have a more than 3000
media actually analyzed
and there are some special media that
arise from every country.
So let's have a look at your graphy,
as I just mentioned, we
collected data for 30 countries.
We did this essentially by running the
script and these countries based on
lists of media websites that we collected
for each one of them.
If your country is not blue in the map,
don't feel discriminated.
It just that we don't happen to have
partners in that country or we just don't
happen to have someone who could run
the script there.
So as you can see, these blue countries
are the ones that we have data for.
So if we click on Germany, for
example, since we're in Germany
on the side of the panel, you can see
that we have lists of media websites
by global media.
Essentially, we mean media websites which
cover the news internationally and which
are accessed globally.
If we click on The Wall Street
Journal, for example, what we can see
now is what happens when we access
the Wall Street Journal, The Wall Street
Journal in Germany.
As you can see on the map, the green
country is Germany, the country we're
accessing the Wall Street Journal from
the blue country in this case is
the United States, which hosts the server
of the Wall Street Journal.
The purple countries are the ones which
host the network infrastructure required
to access the server and the red
countries, which in this case, as the
U.K. and the Netherlands are the
countries which are hosting the servers
of the companies which can track us when
we access the Wall Street Journal.
What's noteworthy in this case,
essentially, is that this is the way
that these companies track is because
every single website, or at least most
media websites include an embedded
image and code which belong to
third party companies.
And yeah, we can see that we have
a lot of Internet connections above.
Yes.
So the one Internet connection is
basically to the media website, the
unintended connections, which in this
case are sixty seven, are the connections
to the servers of third party companies.
That means that while we were planning to
connect to the Wall Street Journal, in
reality, we are also actually connecting
to the servers of third party companies
which can track us and which can collect
data about us in the process.
If we spoke to more
media, you get some of the legislation
agreed with others and
right.
So you can feel free to when you get
access to this map, you can feel free to
select the media websites that you
access, the media that you read either
from the globalist or if you scroll down
below, you can also click from
the national list in your country or the
regional list, which covers the regional
news. And by clicking on every single one
of these media websites, essentially you
can see which the party trackers,
which third party companies can track you
every time you access them, but not only
which companies track you, but also where
your data travels to every time you
access these websites.
Judge.
The reason why I would say to show you
this is because this is one of the very
few examples of not only the only one
where there's a media website where you
access it from Germany and no one
trusts you, or at least according to our
results, there are no Third-Party
trackers included.
And this is WikiLeaks.
So.
So, again, our results show that when you
access WikiLeaks, sure, your data does
travel to Norway because based on one
of our results, the survey of WikiLeaks
is based. But as you can see, there are
zero unintended connections, which means
that poll trackers, which I think is
quite interesting.
Beside the study, who is the third
party that is present on your navigation
is also important to understand what is
the network topology, because every time
you are connected to another server, your
connection passthrough and infrastructure
and this infrastructure, it is owned
by someone that is analyzing activity.
Your content can
create the collection of the
of your behavior or the content
you are exchanging.
If the connection is encrypted, that
stops. The third party in the middle has
no power to modify or dampen
the collective traffic.
But commonly this kind of interaction
is not encrypted and that we saw
with the Snowden revelations about the
Angry Birds.
This was was one of the example because
the Angry Birds was just a game
with some advertising embedded,
but the advertising server was running in
the US. Therefore, the infrastructure
needed to reach the server
was touching the US.
And the NSA has got to be a good idea
to monitor our traffic.
That is why the subject
matter.
Another reason why the network topology
matters is because you never really know
who has access to these cables, you never
know you never really know who has access
to the network infrastructure when you're
accessing websites and when your
connections travel through them.
So this is an example from the Snowden
leaks. This document
illustrates Rampart
program through which the NSA
collaborates with a whole bunch of third
party countries which provide them direct
access to the fiber optic cables, which
make up the backbone of the Internet.
And also these third party countries,
which include Ethiopia, Saudi
Arabia, Tunisia and so forth, they also
are hosting US equipment.
So this is just one example to illustrate
that while you might say, OK, right, OK,
so I'm accessing this website, my data
goes through, I don't know, Azerbaijan,
for example, to reach the server
while it's not a big deal.
Well, actually, it might be a big deal
because maybe, you know, agencies
which you wouldn't want to have access
your data do have access to data because,
you know, they're tapping into that
particular network infrastructure.
And besides that and passive
collection, we already saw that a lot
of attacks that exploit this kind of
communication, if you fly, is a
one kind of the implied threat on
the fly can just to change the way
download we are performing and put
the future Trojan on on
your download. But this can also be
applied to some exploit.
For example, if you're downloading a
Macromedia Flash content and
your browser is going to go to some
flesher exploit
the person in the middle congestions are
to substitute the content you are
receiving in order to exploit the
computer.
Um.
That was a similar attacks performed
by starting from the same kind of
privilege to the point of view.
So one of the reasons why we developed
Tachograph is because we want to think
about the geopolitics of data.
What does it mean today when through
the Internet, your data literally travels
to various servers all over the world?
Now, if we look at a small comparison
between what happens in the so-called
global west and the so-called global
south, one example here is where
you were accessing three national
media websites in Italy.
And what we can see here is that Italy
owns the servers of these media websites.
Of course, the red countries, as you can
see here, are the ones which are hosting
the servers, the tracking companies.
But what's important to note here is that
there are no blogs in the sense that
they own their own
servers of their own media websites, on
the other hand.
However, if we look at a country
in the global south, like Nigeria, for
example, what we can see here is that
Nigeria does not host the servers of
its national media websites.
Instead, they are hosted in the USA
and the network infrastructure required
to access them is based in South Africa.
And the Blue Dogs essentially show like
how the weather data
has to travel to every time they want to
do something as simple as their national
news online.
Now, I think one of the reasons why this
is particularly interesting is because
how can they do? And all the Nigers in
the world kind of protect their citizens
data and practice when they don't even
own their own infrastructure.
How can they how can they make sure that
their citizens data is actually, in
practice protected when they do not own
then the kind of control what happens to
it? I'm not implying that we should have
some type of autonomous system like China
or so forth, but I do think that's
something we should think about
carefully. It maybe it raises debates
about.
Another aspect to this other
study is that when you see someone,
that investor on a foreign
infrastructure, for example, the
format of the telephony
monopoly standard Telecom Italia as a
portfolio of investment in Brazil,
in this case, it has been has gone to
South America to create the network
infrastructure.
This means that in a certain case
of the test performed,
the connection to that is traveling
from your Brazilian carrier
to reassure us, but through some
Italian infrastructure.
This does not mean that the
connection actually go down the ocean
in Rome and then come back to Washington.
It just because on the field
in Brazil is present some Italian
infrastructure and the IP addresses
are associated to an Italian company.
Therefore, the system recognizes
the ownership and and
the person and entity owning the
infrastructure.
Now, again, another example,
given the political tension
in Ukraine with regards to Russia
throughout 2014 and the revolution
in February, we decided to read the
script in Ukraine.
As you can see in the map, a lot
of connections go to Russia.
This is because essentially by accessing
two of the main media websites
in Ukraine, Pravda and Vesti, we can
see that one of the main companies which
tracks users is Yandex.
And Yandex is sort of like the Google
equivalent in Russia.
Now, this raises a whole bunch of
a whole bunch of questions.
But essentially what I think is quite
interesting is regardless of whether
Ukrainians are, you know, pro-Russian or
not, it really comes down to do
they really want to have a lot of their
data ending in Russia or do they really
want Russia to have access to them?
And do they really want a company like
Yandex, which likely works
hand in hand with Russian intelligence
agencies to have access to the type of
news they read and or other activities?
And more or less a lot of things they
do online.
When you click on our country's colorada,
you can see why is Colorado and
which are the party
running in there or their connection
passing through?
And with I close here,
OK, but the goal here when
we start to collectively talk was not to
generate, uh, just a
major and interesting things that
we have created an API that is permitted
to every researcher to collect this data
and make an ISIS is an example
of the, uh.
Percentage exposure that is
facing every country tested
for these explosive.
I mean, is enough that the one connection
between the very many that are performing
there when you are accessing that website
is passing through a country
to put to a sign
you a presence of the counter,
because if is running some program that
analyzes the traffic of the foreigner in
order to
analyze their behavior.
Need to be taken into account
in this matter.
We see, for example, in Russia
on one test that ran on a certain
carrier that the answer to the autonomous
system with this number,
because every
Internet access provider has different
contracts with other international
carrier, there are four different
international carriers, bring different
routes.
And so we can see that in Russia,
one percent of the connection back to
Russia, it is 85
percent attached.
USC, 77 to
seventy seven percent.
That's a great writer, Extra.
And in this way, we can take a look
at which are the country that are most
present in our navigation,
because we are we are
seeing Nigeria,
Italy, Philippines, Germany,
Austria, etc..
For example, we have in
Testor in Italy, different
autonomous system means different
provider involved and also different
exposure of, uh, of the user, in
this case, Europe.
The idea to Europe without
our specific meaning, our present
that USA, as always, either.
And that was
when we started collecting
all the tracker representa on
a reciter, we figured out how to
to to declare a Rostami
the website.
But this is impossible because we
discovered that the amount of Trócaire
injected by the website that changed
it during the time and maybe also in the
same day, they are changing at the
moment.
We are just analyzing every homepage
that
we see in this heat map
on the X certain
amount of media and
on the Epsilon Vitez stranded
in the trees.
Yes, I'm a goat.
And so if someone can help us to develop
a better visualization is welcome.
But I'm also aware of their
overall squarer.
You can see how many tracker represent
that when the test has been performed.
These are heat mapper was intended to see
if some media
dependently on the source
of the user provide a different
tracker and varsities.
Yes.
So when we access media websites,
we're not only vulnerable because our
data travels to various servers all over
the world, which we cannot control, but
also because a whole bunch of third party
companies, which we haven't
given our consent to and which we don't
know trackers track us in the process.
We have collected some figures which
illustrates which are the primary
companies which track us in every case.
So we can see, for example, that in
Germany, based on the media
websites that we run the script on in
most cases and 80 percent of the cases,
Google is the company which
tracks us. And if we scroll down,
we can also see that Google actually is
the dominant company in almost all
of the countries that we run the test
on, actually over 30
countries that we have analyzed in twenty
eight of them. Google is the main company
which tracks users in almost
90 percent of all cases, except
for two exceptions.
The one is South Africa, where
effective measure is in the first place.
And the second example is Russia, where
Yandex does the most tracking, which is
sort of like the Google equivalent in
Russia, as mentioned earlier, but still
is a very small difference with Google.
So what we can say is that Google is the
main company. And then again, this raises
questions as to whether Google should
have this type of monopoly and so forth.
But then again, it's not a simple
question, of course, because a
lot of media web, a lot of media
organizations use Google Analytics.
And that's why that's one of the reasons
why Google ends up tracking you.
And then the question is, you know, what
alternatives are there to Google
Analytics and whether we should work with
media organizations to help them find
alternatives so that all data doesn't end
up with Google in the end.
And we can bring some type of end to this
Google Germany.
So when you
read the script identified hundreds, if
not thousands of companies, of course, we
don't in these last four months, we don't
have time to analyze and go through every
single one of them. So we decided, for
starters, to look at the so-called
globally prevailing tracking companies.
By that we mean the companies which track
you the most based on the media websites
that we analyzed.
So basically the companies like Google,
which presents the highest percentages
as illustrated in visualization
previously, by looking at the websites,
we can see that their main business model
is based on advertising and profiling.
Profiling and web analytics kind of feeds
into advertising.
And, you know, a lot of people have said
to us, especially over the last month
when we've been working on this, is that,
you know, I don't care if Google or
Facebook or any company is tracking me
for the sake of advertising.
I mean, an end of the day, you know,
they improve my Web experience, they
provide me service and so forth.
What's the big deal?
That's a lot of arguments we've been
getting over the last month.
It's kind of hard supposedly to tackle
that, but we think it's a bit more
political than that.
And here's why.
So last night, Jake
and Laura Poitras gave a fantastic
talk about reconstructing the artists.
I'm guessing most of you attended, right?
Yeah, cool.
OK, so following their talk,
how many of you accessed Der Spiegel
Slash International to read,
you know, the latest revelations about
attacks on crypto SSL and
targeted killings in Afghanistan?
But that can lower the hand who, as you
said, Tara.
Because we're actually OK, so who
who access this while using Tor
without.
OK, so who's with Tor?
Who accesses with Tor?
OK, so who accessed the latest
revelations on the Spiegel without
using Tor?
Oh, wow.
OK, so great.
Well, not great, but actually, I'm going
to shows for most of you.
So after the talk,
we thought, oh, what's happening now?
That everyone's Axis and Spiegel.
So we decided to run the script last
night to figure out.
So, as you can see, shall we run the
script based on just the Spiegelhalter?
But also there was a Spiegel
article where we've run the script to
collect the results for the specific page
of the revelations, as
you can see there, with regards to
trucking companies, more companies,
tractors. Last night when we access the
specific page, the revelations, then
when we just access dashboard in general.
And as we can also see, some of these
companies include Google, Twitter and
Facebook and FOIA.
These companies have kind of been
compromised by the NSA through a prism.
PRISM has been collecting data in bulk by
these companies, as we know.
We also know that the NSA has hacked into
the data centers of Google through the
muscular program and so on and so forth.
So what we can see basically is that last
night when we all accessed Der Spiegel
to gain access, this
very important information these
companies were tracking on us, and these
companies also work handstands with those
who probably don't want us to get access
to that information.
So maybe that's just something we should
think about, and especially
if we're ever going to argue again that,
you know, they just do advertising.
So how do these
trackers even handle the data anyway?
What do they do with our data?
It's kind of hard to answer because the
real answer is we don't know.
And that itself is the actual problem.
When we say that they track us in the
track, our data is actually what we mean
is that they track our IP address,
they track our browsing history, our
search history, the scrolling movements
of our mouse when we access the Web page.
So last night, for example, when we were
reading Jagan Lauras
Erens fantastic article,
they could literally like track the
movements of our mouse if we copy paste
something and so forth.
But in addition to that, these companies
create a whole wide range of data from a
whole bunch of other sources.
And that's why we thought it might be
interesting to look at their privacy
policies, not because they necessarily do
what they say they do in the privacy
policies, but because unfortunately,
that's kind of like our best shots
if we want to know what to do with our
data and also by looking at their privacy
policies when compared to what they
actually do. So, for example, if they say
in their privacy policy that they do not
use, I don't know,
whatever cookies or whatever tracking
technologies, and then we figure out that
they do. And that's where we can
actually, you know, raise a discussion
with them.
So what we have done is that we looked at
the privacy policies of some of the
globally prevailing tracking companies
in order to collect the following
fields of data as including the slide,
like what types of data they collect and
so forth.
And this data, we have put it in
a V on a repository on GitHub,
which means you can all access it, you
can all contribute to it.
Please do contribute to it.
There are a lot of companies and we
cannot do all of it ourselves.
And also it would be fantastic if we
could get some lawyers to help us do it
and do more research on that.
Well, we want to obtain that with that is
a nobody read the terms of service.
Nobody reads the privacy policy because
they are in fact that longer complex,
maybe the language barrier.
Maybe you are touching a company
with a hidden Third-Party tracker,
but you are not aware that exist.
Like to be blogging for Firefox to
show these things.
In this way, we can convert
the privacy policy and terms of services
in a machine readable format.
And then the app or um,
or other businesses can use
this data in order to provide an easier
realization for the user that
there can be more aware.
So by looking at the privacy policies and
I repeat, I think personally that
I mean, on the one hand, it's great that
they have privacy policies.
On the other hand, I'm not sure how
useful they are because it's not clear if
they actually do do what
they claim they do.
But like Amazon is kind of like the
best information we can get right now
from their privacy policies that what was
interesting to see is that most of them
are based in the US, which kind of again,
you know, in the past
has been we saw that Muslim based in the
US, which again is interesting, kind of
like shows again, the US, Germany,
when it comes to everything, even when it
comes to infrastructure and collecting
data and so forth.
But more importantly, we can see that
only three of them support supporting on
track, one of which is Twitter, thanks to
us. And the other one is that basically
eleven out of twenty five that we looked
at do not only
in about twenty five disclose how long
they retain data for, but still even the
ones that do disclose how they're taking
data for that. Again, it's kind of
negotiable because while they might say,
for example, that they retain data for
730 days, that retention data
retention period might potentially be
renewed, we do not know who they share
data with, who they sell data to,
how long they retain data for and so
forth. And it's this endless, like
chain of third party actors who
eventually gain access to our data.
And it's such a big mess.
So the point is that we do not know what
happens at the end of the day.
And that itself is a problem.
And we think that just by looking at I
suppose we might get some type of
insight.
OK, and that is the
API that is designed and
we have a database that is collecting all
veterans, all the data, all the NSA
solution and they remnants of the NSA
and all the media visited and a
third party that was injected, the
privacy policy converter, the immaculate,
readable format.
And we were maximizing the
resolution of a autonomous system
of this kind of a solution with the
disconnected dots mean there are JS
on the list that the permissable
conversion between the domain name of
the third party and the name of their
company and all this data are
integrated in our database in the future
will be extended with the new data.
The goal of this API is permitted to
develop a research like a researcher
to extract that data and use it for the
analysis, etc..
The whole goal of photography is
a creator globally because
we want to cover every country
observatory because
during the time want to Mitrovic
change the qualification about it
with Rakhim Business and VEI and
exposure of the user in the network,
you can find a link of their
documentation and our Privacy
Policy Convergence Initiative.
At the moment, only 26
compañero has been converted because
is are quite human intensive
operation. But you know, this
will crowd the.
This can be easier.
So how can we block and circumvent online
tracking? There's no easy solution, but
for starters, we could all start with
these. For example, the EFF
has a privacy badge, which is pretty
awesome.
That is one example of how we can block
some Third-Party trackers in this table
with other tools which we can
use like no script to block
the party scripts or script.
No, if you're using Chrome, which may be
best to switch to Firefox, but anyway,
um, or for example,
go through disconnects if you want to
visualize third party trackers and also
block them. So this is just an example of
some of the tools which can be used, you
know, to block some online tracking.
Of course, it is important to emphasize
that, you know, the use of Tor on top of
all of this is always great, you know, to
to hide your IP address and so forth,
which is something that I always try use
to identify you.
Um, OK.
This is also better expand on
my schedule for the website.
You can find that here at the end.
The Villinger.
Um.
Imagine a little website that are
expensive to support for the defense.
Uh, we just, uh, point out that
someone can defensor it's
itself, uh, blocking the third
party like Adblock or someone out a split
entity or multiple browser in order to do
not. Falletta across the website
association. Correlation, anyway,
is, um, we're
going to finish. And, uh, the
best way to contribute in Tachograph
is contribute to the Middle East
because it's is important to have a
complete Middle East about to be made
accessible in every nation and eventually
also some kind of politically sensitive
content. Because if something is
important, can be added to the test
and run with a state when the Middle
East is reading that Python script
that, uh, around, uh, fundamental.
Yes. And JavaScript and, uh, sorry.
And out and then send out automatically
results to our server
is an open source on GitHub.
And, uh, we have to request that you can
be part of it.
And in addition to helping us review
media around the world, for example, if
your country is missing from the map and
you'd like to see what tracking is going
on there, you can help with Metellus.
And in addition to writing, the script
would be wonderful if you could, like,
meet us and we could all like brainstorm
of other ways with which we can deal with
this issue and improve the project and so
forth. It's still a project
in progress. So any ideas are welcome.
And I'm not sure if we have time for
questions.
I don't think so.
I'm so sorry.
I'm sure there are many of them.
I should by myself
in the teeth and now will be drinking
tea. And, uh, way to your eventual
question.
Thank you so much for this very, very
interesting talk.
Sorry, also, you can access
the budget at Feig.
Feel free to access it and play with a
map. Thank you.