Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/386 Thanks!
Hello.
Great that you're all here.
It is very crowded in this room.
I didn't expect that.
I think that is a big
hooray for how politics
and technology are more and more
things you can say together in one
sentence without getting weird
looks.
So my name is Sasha.
As some of you know, I do stuff on the
Internet.
And in the next 25 minutes, I hope to
give you a bit of an overview, actually,
of the things that have happened since
the summer of 2004
13.
What has not happened since then
and what I think should happen
as it's only 20 minutes,
I will probably ha
ha,
this is where technology fails.
I will probably
miss some things or under or over
represent some things.
But never mind, we will have a
big five minutes of discussions
afterwards where you can, like,
get back on me for that.
So, um,
so let me start with a short introduction
of myself. I'm one of the co-founders of
Greenhouse that is a Dutch Internet
hosting provider based in Amsterdam.
We work a lot and I work a lot with civil
society groups and NGOs.
And as such, I have some close experience
on how people deal with surveillance both
on and offline,
not only technically, but also socially
and more importantly, also
psychologically.
In a way, I feel that most of my work is
actually trying to translate between
the tech and other fields.
The idea for this talk has been running
through my mind for a long time and I
hope and think that this might be the
right time.
The title of this talk on war
tactics is actually a reference
to a
to the to the closing keynote
that was given by Dymaxion at the first
Moisy Square at home in 2013,
just after the first Snowden revelations
came in.
And of course, just after or at
the end of oame, which had, as
some of you might know, some controversy
of its own
to lightly touch upon.
Under that, for those who do not know it,
the concept of the square footage
was first conceived after some
disagreement around AUM and sponsorship
to a point that, for instance, C.C.C.
decided officially not to be present at
AUM, at which moment a group of
people, including myself and
organizations, decided that it would be
great to have a bit more of a political
voice and accommodate for some
more focus
on that by trying to house
specific space.
For that, it must, of
course, be said that this, of course,
only works through the support of the
main AUM organization,
be it sometimes reluctant, but
most of the time actually enthusiastic.
So looking back,
I see that since then, more self
organized stuff is
happening, stuff is organized like Camp
Zero, backbone for 09 interference,
and even Moisy Square returned at some
other places.
Maybe it's not as oppositional
as it has been before, but more
as a safe place within
a safe space
for people, for like minded
tech activists.
So to get back to Dymaxion
talk that addressed
some of the most pressing issues around
the surveillance state,
the surveillance state.
And
people, hacker culture and technology,
most incomplete, not in order and out of
context, I think the main things are
you cannot be apolitical because
then you are aiding just the status quo.
Put the user and our environment in the
middle. The toughest part of the systems
and tactics are needed to
be nice and do not fight each other.
There is a thing called institutional
logic and you should know about it.
Surveyance is not a zero sum game,
but it is more economic in nature.
Well, just by pointing out this five
things, I think you can already see that
in the past two years we didn't succeed
in taking all those things really to
heart.
And so I was wondering,
did we get any further in this field?
Did our tactics actually work?
So as for being political,
I think that we've not only
seen a rising number of hacking
events, that we're addressing the
political stronger than ever before.
We can also see, for instance, that the
political track, at least in my
perception at Congress, has
been bigger every year since the past
three, the past three years.
On the other hand, we must be careful the
fact that it is the case that
does not say that things are completely
well.
Congress might be bigger every year as
well. That might feel good,
but there's not so many of us, you know,
as a reference to the
yearly Dutch household
affair gets about
two hundred thousand visitors
a year or so.
And another thing is,
I think it is important to note that
we should, as activists, be very
aware that we do not separate
separate ourselves from that large
and larger hacker community that is
already not so very large, as I just
pointed out.
So I think
it's great that our initiatives like a
square, as long as the point is to have
interaction with the whole community at
large. But we should be very
fearful to go beyond the point in
which you have a conference within a
conference or people not talking to
each other.
OK.
So a last point on this that I want
to make is that I think if
we speak of a war, a war should be fought
on many levels.
So it shouldn't only be detected,
shouldn't only be political.
It should not only be illegal, it should
actually be on all those points.
And all those points are actually maybe
not equally, but they're all needed
to actually get us a step further
in getting away from
getting away from this this
surveillance state.
So looking
at the bigger picture of the Internet,
um.
I think it would be good to also dove a
bit into tech that has been
happening a lot on the in the in the
field of technology that is
related to what we're here for.
Um, so I
don't think we're here yet to lift,
uh, to lift the cypherpunk
dream.
We don't have a sustainable krypto for
everyone.
Actually we're more at a point still
more at a point where we're living
to we are living
the cypherpunks nightmare and are only
trying to mitigate that a bit.
Um, on the other hand,
the last year has been very interesting.
We have some we saw some
box with open SSL,
then some box with open SSL
and there might also have
been some box with open SSL.
Well, but after being hard blat
and shell shocked, there were of course
some other security issues,
like with Web applications,
like the rootkit with CMS functionality
that at our office is known at Drupal
and with exten hypervisor.
The most interesting, however, I found
about this year was that we saw
the emergence of the bug,
the pop star bug, the bug
with the sexy name, which I think helped
a lot with a widespread pick up in the
media because Seifi,
something that's something that something
is apparently only sexy and very, very,
very small circles.
Some other things happened.
I am not an actual user, nor
am I actually very fond of WhatsApp.
But their cooperation with whisper
systems to include to include
better end to end encryption, I think is
an important step.
We need mainstream apps that are used
by large group of people or groups of
people for other reasons than
having military grade security,
because that is the way to
make stuff safer for
everyone, because then that traffic also
doesn't stand out or even installing a
certain app on your phone doesn't stand
out in a crowd or at a border crossing.
On the usability front, oh,
by the way, this is not a WhatsApp
endorsement.
Use text secure
on the usability front.
Mostly we're still
at the point where the inmates
are running the asylum, although they're
not programing for basic anymore.
But there are changes coming.
I see a movement in the direction
of having
more research towards users,
actually code developing which users or
for some sort of for some developers
like just sitting in a room with the
user. And those are great things that
really helps on the other end.
We should also not overdo it.
I think some
some
applications at this point are
at this point so much broken that it
doesn't really help in a
to do to try to do like ethnographic
research in how users
perceive that interface different in the
Middle East. We should probably first
try to fix the interface in the first
place.
As, for instance, with Skype, nobody
usually asks that question.
And I can assure you that they use
a lot of.
Still, in our discussions, I think we are
far away from looking at security
in a more holistic way as the user
interacting with its environment, doing
a task which it wants to finish.
We also forget that mass surveillance
and the NSA and the CIA and other
agencies like Jasjeet HQ
and some would say TOR, but I think
that's another discussion.
That's a joke, by the way,
are not usually the main
perceived threats to people and probably
in a lot of situations, not directly into
their threat profiles.
So I think we should watch out to say,
well, you're fucked anyway.
We can't really fix this because now
we have a secure operating systems,
but we actually still own your hardware.
And oh, no, we have open hardware, but
who is running that plant?
And it's the stuff on the Silicon Valley.
Actually, the thing that I send up send
out is the chip design.
So, I mean, and we can even go
deeper because then we have the machines
that make the chips and the machines
that make the machines that make chips.
Um, so
as another person once said,
it is basically turtles, one
turtles all the way down.
Um.
So, for instance, let's look
at, let's say, a Syrian
media activists, a
Syrian media activists, for instance,
in Aleppo, is in a situation
where a computer is a tool
to get a message out and
not necessarily an easy tool to get the
message out. But because you need all
these kind of things, you need the
Internet, which means that you need
atrocity, which
means that it also
helps if you're not shelled at the same
time and etc..
So that is a very complex situation
in which o use this much
slower, hard to use
app and you will be more secure a
thing that that anyone will buy in
at such a point.
So we really should look at
the whole picture and how we
and how we can fix it.
So a digital security tool that
is not the tool to always
do the job and it's not part
or integrated with the tactics to the job
or with the workflow of the person
doing the job.
It will not be used or it will be used in
a wrong way and be unsafe in that
sense. So
there are other bad things and security
is an end point.
Security is actually worse than ever.
Not only activists was also
intermediaries.
NGOs have been targeted,
for instance, by the Assad regime
using spearfishing
and as such, getting rockets on
their on their computers and being
less. Listen into their
Skype logs and other things.
And Skype logs also means like history
for you for months or years
or so.
And even the first ISIS attributed
malware has been reported on.
So this is for a lot of people, a
more serious problem than
than those more abstract, but still for
other people, very real threats of
surveillance by the NSA.
So end point security
is still a big problem, but on the other
hand, numerous efforts are building more
capacity towards better usable products.
A lot of times there might be an
overemphasis on general-purpose
computing. I think there's a lot
a lot on let everything work
on everything mentality.
Still, that I think is is
really nice with general purpose
computing. But on the other hand, it is
great if we have
tools that can actually do a very
small task and don't have the high tech
surface of a CPU.
And don't get me wrong, you don't have
one CPU on your laptop, you
have a CPU, you have a chip
that does your network.
You have a chip that assures your your
your keyboard. You have all kinds of
chips that are random purpose computing
chips that you can write nice
more firmware for.
So, um,
sometimes less is more.
And I think sometimes we should more live
up to to that and see if we can separate
things more.
Talking about separation.
We also saw a movement to more to factor
to factor all the things right.
It's very important.
Google has started with popularizing
Two-Factor authentication
and also opened up some middleware
to make sure that
other people are to make sure that there
becomes a new standard for Two-Factor,
authentication that is actually usable
outside of the enterprise, but also for
normal people.
And I think this is really important.
It is also important.
Like it or not, the Google did it because
because Google did it.
It is a broad solution used
by a lot of people that can get
some traction and that actually can
change something.
OK,
Two-Factor, so what you should do is
implement that in all your SchÃ¤fer
apps anyway, so
to factor all the things on the other
end.
So enormous amount of material
is actually not on the user's computer,
but is actually on websites, are
our private keys for SSL certificates
are keys for
DNA, DNS, SEC or,
uh, or other stuff.
And those keys should
actually also be stored on Two-Factor
devices. At the same time,
we don't have a Two-Factor device yet
that we can actually open up.
We need that black box that we of which
we know the content we need at Two-Factor
device for operators that actually
does what it does and not the
stuff that is created by
government contractors
at that to Two-Factor devices that are
put into
providers and other spaces.
There are luckily some projects on
the way. Most notably, people
are working on using the
Novotna board for that
at that that's
Rendi Bush and others and
they're currently housed at
Cryptic DOT.
So if you want to
fund something before the end of the
year, go to their website.
It's cool stuff.
So
we we talked about turtles,
turtles, turtles, turtles, which brings
me to the next point, and
that is we can't fix it
because security is not and has
never been in any way is zero
sum game.
I, of course, do not have to tell you
that absolute security does
not exist. What exists in the
economy is an economy of security
where our costs play a significant role
on all sides of the equation.
So let's, uh, let's shortly revisit
economics and politics.
So there is this thing called
institutional logic, that means as soon
as you start an institution,
it will at some point start to
fight for itself
separately of the reason
for which it first came into place.
It would change their mission.
It would change their structure.
It would do everything to
not get less power, but get more power.
Sometimes that works into our advantage.
For instance, the European Court of Human
Rights was a very good example where
this kind of institutionalization
actually led to a lot of changes,
good changes in European law
sometimes. And a lot of times it is not
to our advantage because it means that
institutions that were a long time
ago actually started
with a totally different idea
than that, or very
much smaller and with a very
specific task now become bigger and
bigger and bigger and bigger and at some
point become more and more and more
self-serving.
So and that
is also the case with
some parts, and that's also
the case with some parts of government,
of course, and especially with things
like security agencies
who will always want to have
more budget and more power and more
control.
Um.
So what we should do is make
sure that we support the right
institutions because sometimes we're just
not big enough to
win the fight on our own, sometimes we
have to find
the enemy of our enemy and befriend them
for a while, of course, because
it's always important to know when to
stop them.
So we should bend the rules
or if we can actually rewrite
them, we should also
do the following. We should change the
narrative.
Because the narrative is now like cyber
security is all about
like nation states and warfare
and and cyber war, and
I don't know what kind of crap which
is real, but
in a way, it's it's not so relisten
that it is cyber real, because
usually people people talk about cyber.
They mean I don't know what I'm talking
about, but,
um.
So we should change this
narrative because there's a lot of money
that is lost at this point and that
money is lost with companies
and and and other institutions.
But there's a lot of money lost by
companies who got hacked, cannot
release films. I don't know stuff
happens, apparently, but, um,
which I think could only be an economic
game for some movies.
But, um,
in the end,
it means that what we should do is try to
emphasize that narrative, the narrative
that we need to secure people, we need to
security and point we need to security
and point, because that is where we
actually lose the most.
This is where people
their identity gets stolen.
This is where trade
secrets are stolen.
This is where people
own banks and other stuff that
is actually the core of our
of the current infrastructure.
And I'm not necessarily I mean,
you can think about
society as we are,
as it is as you want.
But in any way, I think it would be
good to look at where
we can look at where we can
actually change this economic narrative
in a way or this narrative about
surveillance or and security
in that security equals
that it is that security
or that security equals freedom
and security equals this kind of
like my ability to
have privacy on my equipment
and my ability to
not get hacked as a business
and also the ability
for people to communicate in a secure
manner.
So I think that is a very important
narrative. And it's also a narrative that
already has friends because like security
firms and and
antivirus software companies are
already making a lot of money.
So it is easy for people to see
that this narrative actually works.
So go to your local politician and tell
them that this is the way in which they
shoot and or
in which they should add to the cyber
debate.
Another thing is why not engage
with venture capitalists?
Those are the people that make that
finance, that crappy applications that
are insecure and and
hit all the time and make us think
like, oh, shit, why?
Why are you using that?
Why why are my friends, my non
tech friends using this?
Why? Why please kill me.
But so maybe we should
engage with those people because that's
a small group
to look at. And they might
see that, uh,
if they change a bit of their strategies,
that we might have better effects
on this. OK, so another
thing is
adopted journalist.
Or a parliamentarian or
a judge or, uh, or
Technologist's, if you were any of the
other categories.
Let's not say that we
were here with all techies in the room.
I think we're a mixed audience.
So but do it because that
really, really, really helps
in letting people understand and letting
and also helps in getting
people. Shavar, especially with
journalists, um,
the internal debate.
I apparently only have five
minutes left, which was your question
time. But I have a few things that I want
to say to Repp stuff up.
I will be available afterwards for
questions and questions after Noisey
square upstairs
and debate as well.
Um, so internally
you might be open.
Listen.
Also, don't think that white hats exist,
they don't there's not no
not such a thing as
a white act because
a white hat is I mean,
should someone be a self-proclaimed
white hat, then there are enough people
who can say that white people person is
not a white hat, because I think there
are a lot of people that think they are
white hat that are hacking people's
computer computers for government
that are working for the government.
Right. So they're white.
So everybody is shades of gray.
There might be black hat hats or
have hackers, but that's another
discussion. I think so.
And so in the end, I think
we should.
I think we should also note that freedom
of expression is not a free card to be
an asshole just because you can.
So please don't.
Do not save others.
Help others to save themselves
as much as they can, because otherwise
you will never built
societies where people have agency
and you will you will
be needed more and more.
And you're not scalable.
You're only with a few of you and so am
I. So
another thing is and the last thing I
think is
you can't save others or try
to help save others if you don't
save yourself first.
So please have a cup of tea
at the tea,
a quarter to a tea place
at the top floor.
Any time you need a bit of a
self care and and also
take care of each other, because this
especially if you're a tech activist,
it can be quite a
it can be quite a hard time every now
and then because you are at the point
where you realize that this is a very
long, long, long,
long war and we can only win
battles every now and then.
So.
Then how you can help Ecodesign with
users? They're here, they're everywhere,
they're users, they're friendly.
Most of the time they want to use
your stuff. So educate
users. It never if
you're talking to them anyway.
Right.
Team up with a journalist.
I think I made a point.
That's all. Help to improve laws,
push for more secure standards.
I don't have to tell you which the
standards are.
I don't have to tell them why they're all
problematic. But still, we have to push
for them.
So challenge your management.
I know that not all of us is
working on their own projects.
Some people have a day to day job.
You are important for your organization.
So if you can do something within your
organization to actually
help push for any of the other things or
just make the world a slightly better
place, maybe just Hosta Torex
out or something else,
that is a great step
and you can do it.
Also, don't trust me for having good
ideas. I don't have any
ideas or copied from others.
So please have your own great
ideas and share them with everyone and
including me, please.
So that was it.
That was actually it.
The last flight I wanted to show you
was talking
you square. It was.
I can only show it shortly, I think,
because it said I didn't see it, but it's
getting on the bottom so I will
remove it from the slides I upload.
But it was Tahrir Square
and that was just
to remind you that
revolutions in the end do not take
place on in silent
circles.
They take place on moisy
squares.
Thank you. Thank you very much.