Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/377 Thanks!
I don't think I have to explain anything,
it says it all up there.
OK, Michael, you're free.
And everyone said, Michael, I work
for the international human rights
organization ACCESS
and I'm going to be talking about
threats to civil society, but
also responses to those threats.
And I'm actually going to try to focus a
little bit more on the response.
In the past, we've done this talk
at home in 2013, for instance,
and it was very much on threats, which
are always exciting and
always changing.
But it's become more interesting
for me anyway on ways
of building a
response to those threats,
groups, organizations working together
to have infrastructure to be able
to respond
to these threats better. So I'm going to
be talking about these threats briefly,
the rapid response
to those threats and then some of the
things that we're looking forward to
in twenty fifteen.
So I probably
don't need to go too deep into
the threats that are being faced by
civil society today, but.
Civil society is always going to be at
a disadvantage when compared to
corporations or governments
in protecting themselves
from attack, and some
of that is just based on capacity.
Some of that is because they focused
they're non technical civil society
organizations or groups.
Maybe they're activists and
social, political or
otherwise, and they are not
interested, or at least initially not
interested in digital security,
but rather their activism or their
work.
What we see is more and
more and we
have been seeing this more in the news as
well, that groups
such as journalists, especially
investigative journalists, independent
media websites,
all varieties of activists and all
sorts of contexts, lawyers
and others, are getting targeted.
And what's also interesting is the
groups and organizations and
foundations that fund and support these
groups are also
a potential factor
for attack, but also potentially
as a strong ally in providing
this additional capacity for these
groups.
So the perspective that I'm going to be
speaking from, um,
wow, that's washed out, but is
through our helpline, what we call it,
which is three offices
around the world that focus on
providing this, uh, rapid
response support, as well as digital
security advice to civil society
groups.
The oldest one is based in Tunis.
It's been around since around February of
2013.
It's got most importantly, one shift
lead in two incident handlers.
Um, then we
opened an office in San Jose with a shift
lead, an incident handler, and
most recently in Manila with
a shift lead and an incident handler.
In addition to those core
staff members
who are available,
we also have various support folks
such as technologists, developers
and a trainer.
So why do why they're
part of it or a lot of it is timezone.
So what we want to be able to provide is
somebody who doesn't have to stay up
the whole night and
in a very unsustainable way, provide
digital security support to,
uh, a group or
an organization, regardless of what
times on in.
So by being in these
different time zones, we're able to pass
jobs from one office to the other
during kind of regular hours.
And hopefully that makes it more
sustainable for us as a support
organization. In addition,
it allows us to have language coverage
in these different regions, as well as
regional expertize and
relationships with regional organizations
and all of that.
So, uh, what
type of cases have we seen or
in on our helpline?
So.
The three twenty thirteen
we had around
twelve point six on
average cases per month,
up to twenty fourteen, we're now
averaging thirty seven cases.
So what that basically means is we have
more than one new case per day.
And to be clear, these are external
non tort abuse cases.
So we also run a number of
exit nodes and
we handle the abuse of those
as well.
So cases are increasing.
Our capacity is also increasing.
And most importantly, what I think speaks
to the increasing case load
is that our internal kind of workflows
and processes are improving.
So, you know, because we've dealt with
problem X before, we can now
have a template for that
and maybe we've created a walk through or
we found the appropriate resources that
are online that are effective for that.
Um, and so we're looking forward
to further
solidifying those workflows and then also
making sure that those are audited with
other organizations that do similar
things so that we're doing the best
practice that we can.
Looking at these cases from another way,
also kind of splitting it arbitrarily
between the two years
we've done cases in more than 60
countries, the
countries very pretty wildly.
It's not
as interesting data
as you would think in terms of the
rankings because there were such
a higher number of cases in twenty
fourteen.
Um, you know, you know,
you could still have a greater
number of Malaysia cases in twenty
fourteen as you had in twenty thirteen,
but it doesn't make it to the top ten,
that type of thing.
Um, so there
are a couple of different contexts that
maybe are shared between these different
countries that we definitely saw.
So presidential elections are definitely
a ripe time for the targeting of
independent media sites or activists
and protests and civil unrest
for sure. One of the interesting things
is the prominence of
the United States.
So in the US, there
are many international organizations that
are based there that do work elsewhere
in the world. And so a lot of that work
is actually helping these organizations,
such as advocacy
organizations or other
do that work in a safe and effective way.
That's not putting their local partners
at risk.
And so that also speaks to kind of the
lack of depth that we've started
categorizing things.
Still, we haven't differentiated
those cases within the actual target
countries.
Twenty fourteen you have hacking
groups, the targeting of LGBTI
communities and as well as independent
media and journalists.
I'm going to take a brief look at Vietnam
just because it's a the number
one, uh, country that we worked in
for this year.
And it's represents
a case that
or it represents a lot of issues that are
faced in a lot of places and it gets
them all.
So what's
interesting about Vietnam is you actually
do have access to Facebook and you do
have access to popular
platforms that are censored in Iran
or China or other places.
But what that means is then you have
provision hacking groups and other folks
taking advantage of those platforms to
try to target folks.
So we get a lot of account recovery
or compromised accounts.
You get a lot of abuse
of abuse mechanisms on these
platforms.
So the classic examples of that is
real name policy.
So this is something that's especially
prevalent with Facebook.
And for a time it
was a significant threat because
if enough people,
uh, reported your profile,
then Facebook would ask you for
an identity card or information,
and this would be likely an individual
that's, you know, working under a
pseudonym. And they would be
thinking that they're authenticating
themselves to Facebook when in fact,
they might be authenticating themselves
to their entire network, um,
which means they provide their
information to Facebook.
Then Facebook publishes that new updated
information to their profile, basically
outing them. So that's obviously
something that you want to prevent.
In addition, Vietnam is interesting
because, uh, there's a lot of
infrastructure
or potential infrastructure attacks
on the website side.
Websites get, uh,
of independent media and civil society
groups get targeted.
And so there's a lot of needs regarding
updated and heartening details
for. And there's a lot of existing
organizations that we can connect
groups with, so such as deflect
cloud flares, project Galileo
or Google as Project Shield,
that I'll provide free protection to
civil society.
And then, of course, there's a host of
other secure communications and anonymity
concerns there more
generally in
the countries and communities
that we've worked in.
There's there's obviously a wide
spectrum of need, but maybe some of the
ones that are most interesting or most
familiar to you guys are
secure email, GPG
encrypted email is still very tough for
a lot of folks.
And so
mail pile is also obviously something
that we're anticipating greatly.
But we can't put all of our faith
in one tool,
secure file sharing and collaboration.
There isn't really one cross from
one cross platform
solution for that, unfortunately,
but there are some very interesting ones.
So like BitTorrent
sync, for instance, friend,
for example, on mobile is very
interesting, but it's not Phos
website security.
There's a lot of targeting
of websites because there's a lot of
poor practices out there and people
have a lot of difficulty if you're a
non technical organization
in keeping those websites up to date,
let alone kind of hard and or secure.
And so one of the big needs for
a lot of organizations is
what's termed secure hosting.
So basically a hosting provider that will
proactively make sure that things are
up to date and
protect against threats that
are coming out.
And unfortunately, that costs
a fair bit of money for and so
are out of reach for a lot of these civil
society organizations.
And then I already talked about real name
policy a little bit.
So what are some of the ways
that people are that
that organizations are trying to
support this work and try
to improve this work?
So
one piece of this is improving
the workflows that we have for
responding to these attacks.
So a number of organizations
such as Digital Defenders Partnership
Circle, if
Internews and others
as well as ourselves put a thing called
Digital First Aid Kit, which is basically
the first step towards trying to
audit these workflows and how we respond
to these situations.
But it's not just for the existing
community in order to build some
type of general foundation
of response, let's say, to targeted
malware or whatnot.
It's also to make it easier to build
additional rapid response
groups and communities
around the world, because what's
most helpful is it's not one organization
doing this, but it's a number of
organizations that international and
regional and local and community levels
doing this work
in terms of improving
these processes as well.
There's been the recent listing of
civil society certa to try to improve
this coordination between the civil
society community.
And you can check it out.
It's not accredited yet as a cert.
We're also hoping to
go through this same process.
And a lot of this is to help audit our
workflows and help make
sure that all the things that we do are
our best practice and
are easily shareable
publicly so that other groups can also
build these types of infrastructure
and support mechanisms for civil society.
Hello.
And so this is kind of zoomed in a bit.
But
one of the interesting aspects of
the helpline work that we do and the
response that we have is actually only
50 percent or 50 one percent
of our cases are reactive in
the sense that someone is urgently
contacting us and they need X,
Y or Z done.
About half of our cases are instead
people picking us, most likely
organizations or individuals that we
already have a relationship with, from
working with them in the past that are
asking for proactive help
to secure communications
in some variety or implement or trying
out some tool or have a training
on a particular practice.
And so what this does is actually put
rapid response organizations
in a difficult position because
they're nominally focused on
this reactive type of support,
but in building these relationships with
these different organ. Associations or
groups, you're you
become involved in these more long
term fiscal
capacity building.
And so
some of the ways
of helping that is by bridging the gap
between the rapid responders
and the training community.
So the training community
are the folks that do this type of
capacity building for organizations
and individuals.
But as of now, there isn't a great
interaction between the two communities.
And and so, for instance,
a lot of the materials that are created
for training are targeting
end users rather than targeting
folks,
training other people.
So a rapid responder doesn't necessarily
have a lot of
materials in which that they can learn
how to best communicate secure
communications issues to
a given community.
But that's
getting filled at least at some level.
There's the level up project, which is
currently being managed by inertness, and
there's also the safe type project, also
currently being management and use that
are very exciting.
Level up is focused on trainers and safe
on auditors of
the security of organizations.
So these are ways of filling in these
gaps between rapid response
and the training of end users and
trying to fill in. Like what about
organizational level?
What about getting more trainers
that can kind of work in that spectrum?
On the other side, trainers often fall
into the an issue
where they're funded to
go to a certain place and do a training
for a week or five days or three days
with a number of different organizations
on a set number of topics.
And that's all that they're funded to do.
And maybe they're not even an
organization, but a number of
consultants.
And so one
way of helping support that
initial interaction with digital security
tools and practices is to have
these rapid response responder
groups supporting the trainers when
they're going to these places and coming
out of those trainings so that those
organizations can continue to
engage on those topics.
If they have issues with their, you know,
Thunderbird in an email installation or
something like that, they'll have folks
that have the capacity to respond
in a meaningful manner and all that type
of stuff.
So those are kind of my pitches for ways
of tying those two
threads together.
On the other side, you also have rapid
responders and developers.
So a lot of trainers and rapid responders
receive very interesting user
feedback on these tools
because they're working in high risk
environments with targeted communities.
And it's the type of information
that a developer hopefully would find
valuable.
However, they don't really have the
capacity or time to be going
to a developer and
trying to formulate
their feedback in a bug report
or multiple bug reports, et cetera.
And so there's not a lot of capacity
currently to kind of connect that loop.
And so one project that's an exception to
that is open. ATP's security is a
practice project, which is actually just
one person.
So obviously more
capacity there.
It would be awesome
for the developers to train side.
One of the things that we're looking
forward to trying to do in 2015
is interact more with the developers
of some of the secure communication
tools that are relied
on by these communities and trying
to, instead of the developers, having
to provide support for these communities,
which, you know, is great of them
when they're able to do it, but also have
rapid responders and trainers supporting
them when they're interacting.
Some are generally.
I hope I kind of spelled out
in a general overview the rapid
response community and
going into twenty fifteen
kind of the continued standardization
and auditing of the existing workflows
that we have.
And and part of that is also
trying to get it more publicly available
so that more groups,
you know, at a lower level can
be built around these
this documentation and these workflows
continue to focus on specific
communities that are being
targeted, improving these different
interactions between rapid responders
and training groups, as well as
these these loops with
developers.
So thank you.
Michael, here it is.
Wow.
We'll be taking questions, please,
if you as this thing is streamed,
will you please walk up to the mikes?
Number one, number two, number three
and number four
and talk into the mike.
So we got it on the street.
The young man, number three
is the first.
Number one will be the second.
OK.
Hello and thank you for the talk.
My question would be,
are yourself as an organization
being targeted at times and
to have any luck,
are you careful about that?
To have any operational security
regarding that?
Sure, yeah. That's a really good
question. So we
certainly try to take a lot of
precautions and the infrastructure that
we build and the practice that we have.
So, for instance, on
the back end for ticketing,
we use for Cross Tracker, which can
be incorporated GPG,
so that all the emails that it sends out
to folks are encrypted.
We have an encrypted SCHLUTER mailing
list where we coordinate
stuff.
Um, we try
to in order to access,
uh, the request
tracker.
In the first instance,
um, you need to
connect to a VPN where
you're authenticated, you know, via
a certificate.
Then you go to a website that's
not publicly available, that's only
available through the VPN where you're
authenticated via a certificate,
then you authenticate with your the
account name and password.
So I think that's three factors.
So we definitely try to implement
practices to protect this type
of information and make sure
that the trust that people put in us,
you know, is well placed.
OK, thank you,
number one, please.
OK, so, um, the question
is about the party's need for secure
file sharing.
So, uh, what about
unclad?
Because I use my organization.
It's not a frontline situation, but
I know the security audits
are badly needed.
But have you considered it?
And did you find it unusable
because that was the prerequisite?
Sorry, what was the tool on Gload
Unplugged? I've not I've not played
around with the project.
OK, I'll check it out.
I mean, that's one of the great examples
of what we need to do is have
some type or more capacity
to be testing out new tools.
And then once they reach a certain
level of we want to be using them,
then have them be security audited by the
community and then finally incorporate
them into the workflows.
Cool. Thanks. Thanks.
OK, do it sequentially.
Number two, please.
OK, Michael, thanks a lot for
your nice talk. I mean, thanks a lot for
all the work.
I mean maybe I'm not so what.
Informed about it but I was wondering how
do you get your funding. And the other
question was, um,
I mean most of the search around they
are private sector search or
governmental search. I was wondering, do
you find it easy to work with them?
Are there obstacles that go
on the top of your list that you would
like to see removed?
Are you sure?
So on the first ask, so
we actually have a Web page on our
website. So websites access.
Now, Doug and I have a funding page.
I think it's slash about slash funding
and it has our funding policy as well as
where we get all of our money from, like
specifically for each project,
um, for the helpline or
for access in general.
It's like two thirds foundation and
one third corporate government and
individual donation.
But you can see it like further broken
down. Um, but yeah, that policy
ends up, uh, meaning
in practice that like we don't accept
money from the US government, for
instance, and some other
entities.
And that just comes out of our history.
We originally were providing
this type of digital security
support to the Green Movement
in Iran in 2009, 2010,
and then we expanded.
And so obviously in the Middle East,
it's, uh, and a lot of communities
getting US government funding is a
nonstarter
for the second one for certain.
I'm actually a terrible person to
ask that question. Rafael, who's sitting
in the front would be much better
at answering how it is interacting
with private certs.
I don't know if you want to like.
OK, Michael, I think your computer
is on 10 percent or something like that,
at least that's what it says.
OK, so I
work in Luxembourg National Surf there.
So that's basically
I'm helping also.
I'm trying to help civil society to have
to improve our security.
So it's it's not
really a problem of the
most complex part to deal with other the
to get the trust on.
It's also sort of the same problem you
will have all the time in such
situations. So it's not
really more complicated with a cell than
any other organization as soon
as you have to trust your phone.
Yeah.
OK, number
three, please.
Yeah, I was in the,
um, um, uh,
uh, yesterday in room number one,
Krypto Tales from the Trenches where
the journalist talked a little bit about
the whole issue, about using
crypto tools for communication.
And they seem to be running into a lot of
the same issues that you guys are
encountering when you do the work with
the people out on the front.
Are you connected to each other in a way,
because I like the approach that you're
closing the link to the developers.
And I think it would be very smart that
you all sort of joined forces
now in the next time to come, because it
seems to be a rather big issue to come
up, uh, for many people.
Yeah, I fully support that and I
definitely want that to happen.
It's just a little bit slow.
Um, but it definitely is happening.
Yeah, OK, there's
somebody at number one, please.
And was that a sign or.
Yeah, OK.
Talking to the microphone, it's not
working. It's working OK now.
Thank you.
Well, first of all, thank you for a great
book. I think it's a tremendous
help for many people.
And I would like to ask a
question about this United
States on rank two or
something. And you said it was mainly
because they are working abroad.
But do you also have,
you know, questions about,
um, being being
targeted by Western
governments? And do you
deal with that as well?
Yeah, that's a great question.
And certainly, um, so communities
that are targeted by
us, um,
so there's like journalists,
as I mentioned, more generally, um,
lawyers dealing with
topics, um, that the U.S.
government doesn't enjoy
activists. I think
it's not dissimilar from the
types of communities that would be
targeted and in the
U.K. or similar.
OK, there's two more
questions here.
And this is Germany.
We're trying to keep the timetables, so
we'll take a maximum of three.
Go ahead, Fabio.
On Global Links, I want to ask
you if it does happen
for the kind of job that you're doing,
especially on the preemptive activities
that relate to the training and the
training activity to work
with the, let's say, project
based initiative, what I mean
with global links, but probably also
other software, you
end up supporting a group
typically in a vulnerable society
where it's not your main job
to do the digital security training, but
you end up often working with people that
require to have the digital security
skills.
And OK, we end
up doing the training when it's needed,
but it's not our job.
And what you say about
the past training critical
points is exactly what we experience
in several projects.
So my meaning is, does it happen
that when there are projects that
involve civil society that need
to be planted, that are already a set of
partner, you can get engaged
for the training, training
and support for everything that's related
to digital security.
That's a core component
of a project.
But maybe who is leading it
doesn't have specifically that kind of
preparation and especially that kind of
organized stuff to do training
and training especially.
Yeah.
So I if I
get what your question is, we would
be more than happy to support,
uh, like an organization such as yours
when you're doing those types of
activities.
If you want to coordinate beforehand,
that's even better.
I don't know if any organization
has a full
map of what they want to be doing
for the next five years.
So we're more than happy to provide
that support as issues
come up.
So, you know, if it's
initially localization and support on
secure communications to talk about
global leaks or the like,
we're happy to do it as it comes up,
but happy to talk more later, if I
understand your question.
OK, thank you.
Last question. Hang on, folks.
When you're leaving, please, can you keep
it quiet for the last two minutes?
Go ahead.
Do you have a model
for letting people volunteer to provide
instant handling sports to sort of like
the the sand storm center
where folks can be on call to provide
detailed triage investigation,
that sort of thing?
That's a good question. So if you're,
uh, volunteering for
a project like a
secure communications tool
or anonymity tool or some other project,
we're more than happy to interact with
you in with that project.
For instance, if you end up getting some
type of emergency response that you
don't have the capacity for, we don't
currently accept volunteers for
this type of work just because it's
usually rather sensitive.
And it requires, um,
it would require us to implement more, I
guess, user control, um,
in the back end to be able to
incorporate that at this stage
at least.
Um, did you want me
to ask something before
I've seen you, but thank
you for your question.
I just checked your website and I
would be curious to know if you have been
to South Korea concerning the
ITU planetary session
and you had this campaign,
you and I would be very,
uh. How do you appreciate if you could
tell us more about what a successful,
uh, did you achieved something
during this meeting?
Sure. So in addition to
the technical work that we do, we also
have a policy and advocacy teams so that
the ITU Internet governance stuff
is more on the policy team.
So I can't talk to that in particular.
But I'd be more than happy to connect you
with the policy folks that did go to
South Korea and did work on that.
OK, really, last question.
How do you raise your how do you raise
your profile and reach groups?
How do they come across you?
And of the,
um, proactive,
um, cases in which
civil society actors sought out your
help? What percentage of those had
previously sought help or support?
So for the first one,
it's through, I guess, word of mouth
currently that folks hear
about us and get connected
and there is a benefit because there's
an implicit reference or referral
in that. And so that helps us
in the vetting process by, you
know, already having one trusted partner
know this organization or individual.
But it is an internal discussion about
how much more public we want to make it
or have contact form
on the website or things like that.
But that's kind of an ongoing discussion
for the preventative.
Um, that's a really good question.
I would say the majority
of preventative cases are probably
folks that we've already interacted with
who might have initially
heard about work that we've
done from other folks or
we've done reactive,
rapid response for them.
But as you kind of see in
some of the stats, we're still kind of
working on analyzing our statistics.
So, like, I didn't try to look at that,
but I'd be happy to look at that more and
be able to share it later.
OK, let's have a final hand
from Michael. And thank you very much for
that, John.