Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/677 Thanks!
The next talk I want to
ask you one
thing, did you know that had been Crypto
Wars 2.0?
Who has known?
Who has knowledge of that?
OK, I see about three, four hands.
So the most of us hackers even didn't
know about Crypto Wars 2.0.
And it seems like we kind of
lost it.
So what are we doing now?
And one step
to take would be
to stopping law enforcement hacking
and how can we do that?
And this is why Christophers on stage.
He will tell us a little bit about
exactly that topic.
Thank you very much.
All right, thank you all for coming.
This is a topic I've been researching
for, I think, three or four years
now, so I'm really excited to finally
be able to talk to my community about
this.
So let me start by saying just a little
bit about myself.
My name is Chris Soghoian.
For the last four years, I've been
employed at the American Civil Liberties
Union, a major NGO, and
the United States. And I'm a computer
scientist. I advise the lawyers
who do our surveillance cases as I
work hand in hand with the lawyers
who sue the FBI and the NSA for spying.
But. Well, thank you.
So this is actually near
the end of my job, I'll be leaving the
ACLU
at the beginning of January to spend a
year in Congress advising
politicians on technology.
And so I want to emphasize one thing
before I begin my talk, which is
not only am I not speaking on behalf of
my current employer, but I'm definitely
not speaking on behalf of any future
employer.
Government hacking is an extremely
controversial topic.
There are mixed feelings even within
the hacker community and within civil
society.
And so I recognize that my
own views are definitely not mainstream,
even within the community of
people who fight the government and fight
law enforcement surveillance.
All right. So disclaimer number two,
there's actually three disclaimers coming
here, too.
So this is a great quote from from
a famous journalist in United States.
I want to read it right quick.
The trouble with fighting for human
freedoms is that one spends most of one's
time defending scoundrels, for it
is against scoundrels that oppressive
laws are first aimed and oppression
must be stopped at the beginning if it is
to be stopped at all.
Really what he's describing here.
So what he's describing here is the fact
that many of the court cases that
define our basic privacy rights
come from cases involving drug dealers,
people smuggling, alcohol
and pedophiles. And so it
can be very
unpleasant for for people
to sort of engage in these cases.
But if you wait until
the government is using its powers
against journalists and freedom fighters,
by that point, the case law is settled.
And so if you care about
our rights, you have to roll up your
sleeves and get into some
pretty unpleasant fights.
And so that's, in fact what I've done
this year.
I volunteered in for
child porn cases, for the defense
in my personal capacity.
I took time off from work.
I didn't take any money.
And I went and volunteered in these cases
because I wanted to understand how the
FBI hacks
and these are the cases.
The unfortunate fact is, is that child
porn cases are the only cases
we really know about where the most
innovative and troubling techniques are
being used. And if you want to
help to decide what the law of hacking is
going to be, this is where the action is.
It's probably the most difficult thing
I've ever done in terms of
in terms of of forcing me to
confront my feelings about the state
and about the criminal justice system.
I understand that there are many people
in this community who would not go that
far.
And it's certainly kept me up at night
on many evenings because
I volunteered for the defense.
In several cases, I've actually
seen things that are not public.
I've seen documents that are still
sealed.
I have copies of
some software that the defense was
provided, provided to the defense.
That's still not public. And what I want
to emphasize is that everything that I'll
be describing today
is based on public information.
Although I've worked as a volunteer
expert for several defense teams, nothing
in this talk will rely on any information
learned in that context.
All right. And then disclaimer number
three, this is going to seem
very American centric and I apologize
for that. I get from the audience here,
I'm an American.
I live in the United States.
And the fact is, is that my government
is has been more open about
its use of hacking than many other
governments. And that's not necessarily
because we are a more open society.
I think it's more that the FBI has been
caught a few times.
But the end result is that we've learned
a lot more about law enforcement
hacking in the United States than many
other countries have.
And I think there are many lessons that
can be learned by what has happened
in the US, even if you're not an
American.
All right. So what's the point of this
talk? This is not a talk show.
I'm going to give you the history of law
enforcement hacking.
This is not a talk show.
I'm going to describe in real intimate
detail how the technology
of government malware works.
The purpose of this talk is really to
advance the debate around
law enforcement hacking.
When I first learned probably
five or six years ago that the FBI
had a dedicated team of hackers,
my instinct was that I didn't like it.
But beyond sort of the initial ick
factor, it took me a while to figure
out why I didn't like the idea
of the government having the ability to
control people's webcams or microphones
or break into their mobile phones or
laptops and steal information.
It took me a while to come up with
my own feelings and my own arguments.
And the unfortunate thing is that many
people in civil society in
trying to push back against
government hacking authority, have
not advanced our arguments very much.
Our arguments are very basic and
really it's been focused on protecting
the privacy of the targets.
The government has violated the privacy
of the pedophiles they're investigating,
and that's a total loser in the political
sphere.
And so the purpose
of this talk is to advance us beyond
that. Right. If the best argument we have
against government hacking is tied
to the privacy of pedophiles,
we're toast.
Even if we think that everyone in our
society deserves basic privacy
protections. This is not a winning
argument for people in Washington,
for people in Brussels and in
capitals around the world.
And so if we would like to
see laws passed, if
we would like to see restrictions on
government hacking or even a prohibition
on it, we have to come up with arguments
that politicians and the public will
embrace to win
to win the fight against government
hacking, we actually have to change the
debate. And so the purpose
of this talk is to begin the process
of reframing the debate around government
hacking away from a
privacy issue and
to want to. Focused on collateral damage
and in particular, the harm that
governments impose on innocent
third parties, the harm that governments
impose on the Internet at
large.
All right, I'm going to run through
about, I think, six different areas
where hacking causes problems.
And the goal really of this talk
is to equip you
and to equip those who will continue
this debate with
arguments that will actually work so
that if you're seated with someone
who thinks that, you know, hacking
pedophiles seems like a really good idea,
you can come up with convincing arguments
as to why, even again, in
those circumstances, it's not a good
idea. So the first problem with law
enforcement hacking is secrecy.
When when the protests in
Ferguson, Missouri, first took place
a couple of years ago in the United
States, I think many people were shocked
to see images like this
in news articles and on TV screens.
Really what we have here are
military technology is being used by law
enforcement.
For those who have been watching this
space for a while, this is not a new
phenomenon. But certainly in Ferguson,
this was the most high profile
demonstration of the militarization
of law enforcement.
Just a few months back, there
was an armed standoff
in Dallas, Texas, where the police ended
up using a bomb
disposal robot to kill
an armed target.
Of course, in recent years, law
enforcement agencies around the country,
in the United States and around the world
have acquired drones and
other sophisticated formerly military
tools and.
I think at this point, many people have
probably heard of stingrays or as they're
known in Europe, Mzee catchers,
and these two are surveillance devices
that were first designed for the military
and the intelligence community and have
trickled down to state and local law
enforcement.
So this phenomenon
has really been described quite well by
Radley Balko, a libertarian
author and journalist in the United
States.
The phenomenon really is the
militarization of police,
the fact that
sophisticated technology
designed for the military, designed for
the intelligence community eventually
trickles down to law enforcement.
And the problem with this
is that it's not just the tools that
trickle down.
It's not just the arms that trickle down.
It's not just tanks and machine guns
and armored personnel carriers and vests
and helmets. It's also surveillance
technology, military and
intelligence surveillance technology
trickles down to state and local law
enforcement. But because this the same
technology remains in use
both in the military, the intelligence
community and in law enforcement,
it also comes with a cloud of secrecy.
That is, law enforcement tries
to keep everything about their use
of these kinds of technologies secret
because they don't want to tip off the
bad guys.
And also they want to have to keep using
it in the military and the intelligence
community context.
And so what we see time and time
again, whether it's stingray's, whether
it's hacking or other innovative
surveillance technologies, is there a use
by law enforcement comes
with massive secrecy.
And so the FBI has had
a dedicated hacking team since
at least 2001.
It wasn't until the
early 2010s when F F
got a bunch of documents and put them
online. And when I was reading them, I
stumbled on this phrase,
the remote operations unit.
It wasn't until I think 12
and 13 that
I first learned the name of the FBI's
hacking unit 12 years after it was
created.
The fact is, this unit has operated
in near total secrecy.
And this secrecy doesn't just affect the
public's awareness of who is doing the
hacking, but we're seeing pervasive
secrecy entering our judicial system.
Court orders related to
government use of these technologies are
routinely redacted.
If they're ever released, they're sealed
routinely.
Defense lawyers may not know how their
clients were identified or arrested.
Judges may not know what they're being
asked to authorize and may not know where
the evidence in their own cases came
from.
We really have this this pernicious
cloud of secrecy shrouding
the criminal law enforcement landscape
because the government wants to preserve
the secrecy around these tools
separately because
of the desire to preserve the secrecy.
We also have a circumvention of
traditional legislative oversight that
has yet to be a single congressional
hearing focused on law enforcement
hacking, even though for more than 15
years law enforcement agencies
have been engaging in and hacking.
We need to have a debate around this.
But a debate hasn't happened, in part
because they don't want to highlight
their use of this technology.
All right. So, number one, the problem of
secrecy.
Number two,
mistakes will be made.
Hacking tools are designed by
humans and deployed by humans.
And humans are not perfect.
So the first kind of mistake that will
take place is that innocent users
will be hacked. And this is not
a theoretical issue.
This has happened.
So in twenty thirteen.
And one of the first bulk hacking
operations today, the FBI
went after, I think twenty three
sites on a dark Web, one of which was tor
mail.
Now, while I think sites one
through twenty two, we're focused on on
contraband activity, mainly child
pornography sites.
Formal was a service used by many
legitimate users, journalists,
activists or people who just like to
maintain some privacy online.
And
although the government got a court
order from a judge authorizing them to
hack 300 particular
terminal users the way
they deployed their malware, that
to them hacking innocent users,
essentially anyone who visited the Tor
mail homepage for a few days
while the FBI was engaging in their
hacking operation would get a
piece of malware from the government.
Now, I don't believe that the FBI
intended to do this.
I actually think they made a mistake.
But the fact is, is that they
accidentally exploited vulnerabilities
in the browsers of innocent people,
deployed malware to their computers,
then never told them about it.
Those individuals never got a letter in
the mail. No apologies.
To the extent that the malware ever
caused damage to their computers, the
government never volunteered to clean up
the mess.
And so as hacking
becomes a routine tool, we
should expect to see these mistakes
take place and we should expect to see
more and more innocent people getting
hurt. And when that happens, the
government will shrug their shoulders and
say, oh, not our problem.
In the terminal case for the first
year, they refuse to even acknowledge
that the FBI had been behind the hack.
It was all a nudge, nudge, wink, wink.
And so there's a complete lack of
accountability when the government makes
mistakes.
Second problem in the context
of mistakes being made is that
when the government agencies use
zero day vulnerabilities or use
exploit, that the target is their
vulnerabilities and they make mistakes
and they get caught.
Those zero days will be thrown
out into the wild.
This is, again, not a theoretical
phenomenon. And when it has happened time
and time again, the agencies
responsible have disappeared.
They've taken no responsibility.
They've not paid for any cleanup
or compensated the parties that have to
actually clean up the damage.
And so we have three high profile
examples of this.
When the US and Israel
deployed their Stuxnet malware
against Iran, they exploited several
zero days and the Windows operating
system. And when their Stuxnet malware
was discovered and then publicized,
criminals took advantage of those same
zero days while people on the Internet
were waiting to get the patch
or waiting to install the patch
separately.
Earlier this summer, an
entity we believe to be Russia
released several of NSA's
router hacking tools under the
name of the shadow brokers.
When that happened, what happened from
NSA? Nothing.
NSA said nothing.
They did nothing.
It was the engineers at Cisco and Juniper
who had to work overnight
and try and quickly develop fixes and
roll them out. And then just
last month, an unknown
entity, probably a law enforcement
agency, got caught engaging in
a bulk hacking operation, targeting a
dark male website.
I saw a dark Web site called
Gift Box, which was a child pornography
site, and a Firefox's
zero day was released into the wild
when that operation was detected,
who had to clean up the mess?
Mozilla When
governments lose zero days, it's the
Internet that has to deal with the
consequences. And it's the companies and
developers who build the software who
have to deal with the
with the collateral damage.
And so I really think the analogy to
think of here
is a bit like an oil spill, right.
The oil companies tell
us that they will work hard to ensure
that they will not be accidents.
But there are, of course, always
accidents at oil drilling sites.
And when those accidents take place,
it's the people who live in the community
who have to deal with the consequences.
Right. It's the people who are fishing in
those waters or who live on the coast.
They're the ones who have to deal with
the mess. The CEO of the oil company,
his or her children are not eating fish
from that water.
And so I really think we should be
thinking of of the government
loss of zero days in the same way
they are forcing the costs of
their mistakes onto the Internet at
large.
All right. Problem number three, trust.
The FBI has a bit of a tricky
problem when it comes to deploying
malware
in the event that they're not able to do
like a drive by attack or
a watering hole attack where they know
where someone is going to visit a Web
page someone will log into in the
event they're looking for a particular
user, they have to get their malware
onto that user's device.
And the tool of choice, the first
choice will always be phishing because it
works so well.
But most
reasonably sophisticated targets are not
going to open up an email if the from
address says FBI dot gov.
This is an obvious thing.
No one will open an email from
law enforcement and so they
have to go undercover.
Law enforcement has to trick someone
into opening up an email and clicking
on that attachment and looking at the
PowerPoint or the PDF file.
So how do they do this?
They need to impersonate parties who are
trusted in our society.
They need to impersonate journalists,
which the FBI did in 2007
when it was trying to identify
a teenager who had called in a bomb
threat to his school, they impersonated
the Associated Press, sent a
an email to the teenager saying, hey,
we're the Associated Press, we're writing
about you. Please see the attached
word file, which is a draft of the story
we've written.
Let us know if there are any mistakes.
The kid double clicks on it.
Malware installs, he gets arrested.
But what about the press?
What about the collateral damage
caused to journalists?
If sources think that when they're
contacted by a journalist, it might
be the government going undercover
this this fall,
Citizen Lab released a really devastating
report showing how
an Israeli company, the NSA group, had
provided iOS
malware to, I think, the Bahraini
government.
This got a lot of publicity because the
word on the street is that the
vulnerability cost a million bucks.
What really sort of slipped below the
radar was the NSA group,
as part of their deployment
infrastructure, was using a bunch of
lookalike domain names, domain names that
people might click on because they look
somewhat legitimate.
And there was a Facebook domain and there
was a WhatsApp domain and a Google
domain. But there are also two domains
that look like the Red Cross.
Now, I understand why
governments might want to impersonate the
Red Cross, but I would hope that we can
all recognize that we do not want
military, intelligence, community
or law enforcement agencies to
impersonate medics
in our society. Medics and doctors play
a vital role.
And if you are worried that your doctor
is secretly an FBI agent, you
will not go to them when you need help.
You will not tell them about your drug
addiction or your suicidal thoughts,
right. That even though it might
be temporarily useful, the risk
and the harm to the trust in our society,
it could be devastating.
Another example, just
a few years ago, Flame, which is sort
of the cousin of Stuxnet, was discovered
in the wild.
We believe this was the
work of the US government.
And Flame utilized
a novel hash
collision technique to actually
allow the government to impersonate the
Microsoft Windows Update service.
Now, we've all permitted Google
and an Apple
and these other tech companies to deliver
automatic updates to our browsers and
automatic updates to our computers.
And these these update mechanisms
rely on code signing.
We only allow Google to deliver
updates to Chrome and we only allow
Microsoft to deliver updates to Windows.
What if governments can leverage that
update mechanism? What if they can
impersonate Microsoft or Google
or Apple and deliver spyware directly
to our computers?
People may turn off automatic updates,
which I think many of us don't want.
We don't want to go back to the old days
of Windows XP where people were not
getting security updates.
And in the Apple
FBI case this spring,
one of the arguments that the government
made in that case was, look,
we're being really nice to you.
We're asking you to write the software.
But if you don't want to do this, we can
come back and demand your source
code and your code signing keys and we'll
do it ourselves.
So we've seen a clear threat
from law enforcement in the US that they
believe that automatic
update mechanisms are a fair target
for law enforcement surveillance
programs.
So the trust thing, I think, should worry
many people. All right.
Problem number four,
the economics of surveillance.
So I love Chris Rock, the American
comedian and
possibly my favorite my favorite
Chris Rock standard routine is where he
talks about his views on guns.
And, of course, American views
on guns are very different from European
views on guns. And I'm not taking
a political position here about guns,
but I just want to use Chris's
routine to really drive home a point.
He says that he thinks that guns should
be legal, but bullets should cost
a million dollars each.
Right. And the idea here is let's
make it really expensive for people
to shoot others. And then it might
happen every once in a while, but they'll
only do it where it's really, really
important. And I sort of view
surveillance in the same light.
I know that governments are going to want
to hack and I know that governments are
going to want to spy.
But if we make it expensive, they'll have
to focus their resources on the people
who are really, really important, the
real threats.
And my concern is that the costs
have gotten a little bit too cheap.
This is one of my favorite quotes
from a judicial opinion, from a court
decision in the United States.
This is a famous American judge, Judge
Posner, talking about the economic.
A surveillance, and he says that
technological progress poses
a threat to privacy by enabling
an extent of surveillance that in earlier
times would have been prohibitively
expensive. And what he's talking about
here is the economic cost of
surveillance. When the government has
to send a team of five agents to follow
your car, they only have so
many agents.
There's only so many people they can
simultaneously surveil.
But when a GPS tracking device in your
in your car or in your phone can
enable that same degree of surveillance,
a single officer from his or her desk
can spy on hundreds or thousands
of people.
Suddenly, the government can spy on
more people than it could before because
technology makes surveillance easier
and cheaper.
So the most high profile
FBI hacking operation to date,
the playpen operation, the one that I
described at the beginning where I
volunteered a few of these cases,
we now know that in that case, the
government hacked the FBI, hacked more
than eight thousand computers around the
world by the thousands in the US
and the rest abroad.
So let's do a little bit of like back of
the napkin math here.
Let's say that.
So we don't know for sure that the
vulnerability of the FBI used was a zero
day. But let's assume that it's Firefox's
zero day and the average price
seems to be about one hundred
thousand dollars. That seems like a fair
thing for this conversation.
One hundred thousand dollars for a zero
day in Firefox, divided by eight
thousand targets equals twelve
and a half dollars.
Per target.
So
my concern with with the economics
of hacking is that if the government
hacks enough people, hacking
not only becomes
an attractive way of surveilling, it
becomes the cheapest way of spying on
people. Write two or three officers
can conduct one of these operations and
hack thousands, tens
of thousands or hundreds of thousands of
targets. And as long as the operation
happens in a relatively short period of
time, they'll be able to get
that many people before the software
industry finds out and rolls out a patch
and deploys the patch.
And so my concern is that
when they hack enough people,
surveillance becomes so cheap, it becomes
cheaper than hacking, becomes
cheaper than even a single hour of
law enforcement overtime.
That this will become the tool of first
resort hacking will be the first
tool in the toolkit that they reach for
before they go undercover, before they
try and convince someone the
old fashioned way.
My concern is that hacking is making
spying far too cheap.
All right. So that's the economics of
surveillance. Problem number five,
cross-border hacking.
So it's not just the FBI that
is engaging in law enforcement hacking.
As Joseph Cox revealed in one of his
stories a few months ago, the
Australian police have engaged in
hacking of Tor users, which led to them
hacking some people in the United States.
Companies like Hacking Team have
have sold surveillance technology to
governments around the world.
And so this technology has been used not
just for domestic surveillance by
governments, but for cross-border
surveillance.
And the most high profile case involves
the Ethiopian government hacking
into American journalists
of Ethiopian heritage living in the
Washington, D.C. area.
EFF is currently engaged
in a lawsuit against the Ethiopian
government. But it's it's an uphill
struggle.
This is not just a phenomenon of
your government hacking you.
We are now about to enter a world
where plenty of governments will hack
across borders.
So so you might ask what's what's
the problem with this? Maybe this is just
where it's going.
Cross-border law enforcement hacking
raises a couple of really thorny issues.
So when this when
this incident happened, I
think a year ago, this was in UC
Davis, just north of San Francisco,
a very, very iconic photograph
of a police officer, tear gassing
or massing nonviolent
protesters.
This photograph, of course, went viral,
captured the world's attention.
This officer ended up losing his job.
And the controversy around it
ended up actually costing the president
of the university her job, too.
So there were consequences associated
with this event, in part because the
people that lived in that community were
disgusted by what happened.
And the students at this university were
outraged. And that led to
political pressure and political
accountability.
Now, think about what happens when
a government other than your own engages
in an activity in your country that you
don't like. So a classic, I think example
here is the US government's campaign
of drone assassination in Pakistan
and Afghanistan.
Now, the average person on the street in
Pakistan is not happy about the
fact that the American government is
dropping bombs in their towns.
But people in Pakistan don't
vote in Iowa and California
and New York. There's nothing that they
can do about it through the normal
powers of the political process.
You cannot vote foreign police
out of office.
And so, you know, while I'm
not completely comfortable with what the
FBI is doing, I at least have
a vehicle as an American voter
to register my displeasure,
but to petition my government to change
the rules.
But there's nothing that I, as an
American, can do to stop the Australian
government, to stop the French government
or the Italian government from using
these kinds of tools in my country.
And I think we're we're going to find out
that the cross-border hacking is going to
be the most problematic and
the most legally difficult form of
law enforcement hacking.
All right. And then the last problem area
associated with law enforcement hacking
is what I call the digital security
divide.
And really what that boils down to is
that we are not all equally
vulnerable to surveillance.
Some of us use devices that are more
secure than others.
Some of us use Web browsers that are more
secure than others.
And some of us have up to date software.
Some of us don't think about
the average iPhone user.
They have a 600 euro device in their
pocket that gets automatic
software updates supported for
three or four years.
After they buy the device, they
have automatic disk encryption
default, end to end encryption of text
messages when communicating with other
people who have iPhones.
This is a device that out of the box is
pretty damn secure.
Now, think about the situation with
Android phones.
With the exception of the Nexus series
and now the pixel series of Android
phones, most Android phones rarely
receive security updates.
And if they do receive them, it's often
very late.
Android phones still
do not use end to end encryption
by default for text messaging
or voice or video communications.
And many
Android phones still do not use this
encryption by default.
Even though Google has required it of
newer phones, there's still a carve out
for slower, older chipsets.
And so the end result is that many
people who have Android phones are more
vulnerable to law enforcement hacking.
Now, if Android phones cost 600 euros
and iPhones cost six euros, then I'd
say let the market decide.
But the fact is, is the android dominates
the middle and low end of the market,
which means that the most vulnerable in
our society, minorities
and the poor, are more likely to be using
devices that are easier for law
enforcement agencies to hack.
So that might mean that to have
a middle class banker,
the government needs a zero day in loss
and to hack a poor immigrant.
The government can use a two year old
exploit they purchased for five thousand
dollars online.
My concern is that law enforcement
hacking because of the inequality
of software security, will actually
further perpetuate the existing
inequalities in our society.
All right. So for those six
reasons I described, there are serious
collateral harms associated with law
enforcement hacking,
even if you think.
There are justified reasons for the state
to hack, you should at least now see
that it's not necessarily a clean
technique with no harm caused to third
parties. So the purpose of the Titlist
talk is stopping law enforcement hacking.
How do we stop this practice or at
least restrict this practice?
So option one, of course, is to legislate
to pass laws to regulate this.
As I said before, the FBI in
my country has been hacking for more than
15 years.
There's never been a law passed to
regulate this. There's never been a
congressional hearing.
And it's only really in the last couple
of years that the courts have started to
struggle to to deal with this phenomenon.
We need legislation,
but that's a really tough and it's
particularly tough when
in this current climate.
So in the US, there's been no
laws at all.
In the UK, they just recently passed
the most sweeping piece of surveillance
legislation in decades that clearly
authorizes hacking in the
U.K. They call it
electronic interference.
But I think part of the reason why that
legislation sailed through
so easily and why the government got all
the hacking powers they wanted is we
haven't done a good job of articulating
the problems with hacking.
And so that means that civil society,
if we're going to get laws passed
to regulate or restrict hacking, we have
to do a better job about
how we talk about it.
So we cannot change the law
until we change the debate.
And as long as this is a debate around
the government violating people's privacy
through hacking, we lose.
We have to talk about damage
to the Internet trust.
We have to talk about the government
losing zero days.
We have to talk about the government
hacking innocent people.
We have to talk about the
government hacking. Poor user is more
than rich users.
That's the only way that we
create political support for
hacking legislation that will benefit
the Internet and that will restrict these
tools. Otherwise, any hacking legislation
will give law enforcement everything they
want.
All right. So the legislative landscape
may be a little bit depressing.
What are some other ways that we can
restrict or prevent law enforcement
hacking?
Well, this is a technical conference and
this is a community of nerds.
Let's talk about how tech can
restrict government malware
so we can do a better job of increasing
the security of the platforms that we all
use. If if
we make our devices more hardened, if we
make our software more secure, then it
will be more difficult for governments to
hack. They will have to spend more money.
And when they do lose a zero day, it will
really hurt them.
So one of the big problems in this space
is that the privacy software we use
is often such a soft target,
it's so in many ways
the privacy software is often more
vulnerable than regular off the shelf
software. And I really think there's no
better example than Firefox.
I think this photograph really sort of
sums it up.
So the Firefox is otherwise known as the
red panda, and this panda is
barely hanging on this branch with just a
single push.
It would fall down. And really, that's
about the security posture of the
Firefox browser.
Firefox is not hardened,
which means that although
there are techniques, there are well
known techniques that Mozilla could
employ that would make it harder for the
Firefox browser to be hacked.
They have not employed those techniques.
So this is a chart
that much the famous American hacker put
together with his cyber independent
testing lab.
And this chart compares Chrome,
Safari and Firefox based
on the exploit mitigation techniques
they've deployed, things like ACEL
are he protections that guards
what you can clearly see here, and this
is from a few months ago, but you can see
the Firefox was lagging behind the other
two browsers.
Many of these are simple
compile time options that can be enabled
with a few changes in
the build process and then make it
significantly harder for an
adversary to hack Firefox users.
And I should be clear, this is not just
about the hundreds of millions, millions
of Firefox users.
This is about people using the Tor
browser, which is a variant
on Firefox.
So one of the key techniques
that Firefox has been missing and in
many ways is still missing until now
is the security sandbox.
And the impact of the security sandbox
is that it makes it harder for an
attacker to use a single
vulnerability to take control of your
computer.
I apologize for my really shitty
Photoshop skills.
This is not my area of expertize.
In many ways, the Chrome browser,
although it is clearly the most privacy
invading browser, is also
the most secure browser.
And Google has spent a huge sum
of money to to really
armor their browser and make
it more difficult for governments
to exploit. And really we can see
the fruits of that and Google's
bug bounty program, where they pay
researchers for four for
successful compromises of their other
products.
This is from the chromium blog,
the Google Chrome team's blog in 2012,
talking about a chain of vulnerabilities
that that a researcher named Pinkie Pie
delivered and got a prize for.
So how does one get full remote code
execution and chrome in the case
of pinkie pies?
It took a chain of six different bugs
in order to successfully break out of
chrome sandbox.
In the same same month,
what's clear is that Sergei's certainly
earned his sixty thousand dollar podium
award, he chained together a whopping
14 bugs quirks and
missed hardening opportunities.
And so what we see here is that
in the case of the Chrome browser,
researchers cannot in many cases
take over the browser with one
vulnerability. They need six
or 10 or a dozen.
Now, to be clear, that is
possible for researchers to find six or
10 or a dozen bugs or
vulnerabilities. But that's certainly
more difficult.
And if we force governments to
to up their game, it'll
make exploitation more expensive.
And it'll mean that when they do get
caught, they'll be
maybe more reluctant to engage in those
operations in the future.
And so, as I said before, the
Tor browser currently
uses a variant is a
form of the Firefox browser.
And so the the lack of a sandbox
in Firefox directly affects
the Tor browser and those users
who depend on TOR for their safety and
security.
So one method, as I said, is to is
to sort of harden the software that we
all use.
Another method that we could employ
to make hacking
more difficult is to actually target
the specific methods that we know that
governments are employing.
So in the case of Tor users
and governments.
Governments are not trying to steal
Bitcoin from users.
Governments are not trying to install,
you know, ransomware on
your computer if your Tor user and
you are likely to get hacked by law
enforcement. The one thing they want more
than anything else is your IP address,
your IP and then your Mac.
So they need to gain the
ability to to execute code on your
computer. They want to learn your IP
address and then they want to send it
back to an FBI or
GC HQ computer.
And so if we want to make
law enforcement hacking more difficult,
why not focus on
the way that they hack?
Why not focus on or rather the
information they're seeking to extract?
And that's, in fact, what some folks
are doing right now.
Just a couple of months ago, the Tor
project announced that they had deployed
a new experimental
technique using something called
Unix domain sockets.
But essentially the Tor browser,
if you're using this experimental build,
cannot talk to the Internet.
All communications go through the Tor
browser. And so there's no way
for malware on
on that computer to call home.
We just saw the first experimental build
from that project, I think released maybe
a week or two weeks ago.
And so that is a direct,
direct effort to take on the exploitation
techniques that law enforcement agencies
are using.
There's also projects like cubes
and sub graph these
these these projects that are sort of
trying to build penetration resistant
operating systems or a more secure
operating system.
And the idea here is
that we will get hacked and how do we
survive a hack.
And in both cases, with both cubes
and sub Grof, although it
might be possible for law enforcement
to hack your browser, that necessarily
won't lead to the discovery of your real
IP address, because
the the browser is either contained in
a container or virtual machine that
cannot see a real IP address.
And then this brings me to my final
technical point.
The Linux community has not
been great in embracing
security techniques.
There is a
free people over there who really care.
So there's there was a devastating
article written last summer, a year ago
in The Washington Post about the toxic
relationship between Linux kernel
developers and developers
and the security project.
So I've been using Linux since I was,
I think, 11, 10 or 11 years
old. I remember as a child
debating with friends and family members
about which operating system was better.
And I always sort of felt superior
as a Linux user.
It's embarrassing that so
many of the exploit mitigation
technologies like Asla were
designed first in the Linux community,
but are still not deployed by default in
the Linux community.
Windows has taken the best of our ideas
and deployed it to their users.
Apple has followed and
the fact is there are
we don't need to wait for next generation
R&D to make exploitation
harder.
The security projects and others have
pioneered some really amazing
technologies.
But then there's this toxic, toxic
relationship between the security
community and the kernel community,
which means that basic
protections that other operating systems
have already deployed are still missing
from mainstream Linux distributions
and from the Linux kernel
mainline project itself.
Now, things are getting better
after that Washington Post story
came out. And it's really it's a long
fun read, but it's not every day
that a five thousand word story about the
Linux kernel appears on the front page of
The Washington Post. And so I strongly
recommend that you read
Craig Timberg story.
Everyone in that story comes away looking
like shit.
There's egos as far as the eye can see,
so things are getting slightly better.
There's a kernel hardening project now
that's trying to strip off individual
features from G.R. security and get them
up. Streambed But our
community needs to do a much better
job of getting
these these mainstream security
technologies upstream.
And it shouldn't be this easy
for governments to hack
the users who depend on technologies
and.
You know, non-technical users can only
be expected to do so much and we
have created these tools for them,
and then many of them still
get hacked successfully by governments,
even though the users are doing the right
thing. We've delivered software
that lets you shoot yourself in the foot
a bit too easily or that self-destruct
too easily.
And we know how to build
hardened software because many of the
people in this room have, you know,
custom builds of software or custom
patches installed.
We need to make the default software that
we're delivering more secure.
We know how to do this, but
people need to get over their egos and
their hate of each other.
In many cases, it really seems like
these communities have hated each other
for so long.
They've forgotten why they originally
started hating each other.
And I'm hoping that, you
know, in two or three years
that Ubuntu will have some of these
protections and the Debian will have some
of these protections turned on by
default.
All right. So to sort of wrap this up.
Even though the title of this talk is
stopping law enforcement hacking,
we're not actually going to have to stop
all law enforcement hacking
because it's too useful and government's
like tools that work.
But we can make it more expensive.
We can make it much, much more expensive.
And as I think I've outlined and
explained, law enforcement hacking
is not just cheap.
It may become the cheapest form of
surveillance when deployed at scale.
And if we don't do something about the
cost, I think we're going to see
hacking not just be an obscure
tool used for special cases against
special targets, but becoming the
first tool because it works so well.
Thank you very much.
So now it's time for questions and
answers.
Does anybody know if you have a question?
Yes, I'm free.
I see one.
I don't I'm very content
with what you say, but I'm kind of
confused.
Also, you say
that it's about law enforcement.
And I would argue that Australia
hacking in the US is not law enforcement,
it's espionage.
And drone bombings are not law
enforcement.
It's warfare.
So please help me with that
misunderstanding or tell me what
do I get wrong or where's the distinction
between law enforcement and
other activities of the government?
When the Australian police hacked
to our users, that wasn't an espionage
case. That was a case designed
to identify people who would then be
arrested and put in jail.
That's law enforcement.
Yes. The Pakistan, for example.
That's definitely either the military or
or the spies.
But the reason I brought up that example
is simply to show that when a foreign
government does something in your country
and you don't like it, you have a lot
less ability to get things changed.
You cannot call up your elected official
and tell them to stop doing it.
Thank you.
The question from the Internet,
the Internet wants to know, does
the government ever remove the
malware from a PC?
In the for example, in the case of
Tahl mail, if they found out,
oops, not the person we
are looking for.
My understanding, at least in the
three or four bulk hacking
operations that have come become public
so far, that none and none of those
cases was the malware permanently
installed in your computer.
So it ran it collected some information
and sent it home.
There are
scenarios where law enforcement
have asked courts for permission to
install more permanent or persistent
malware on computers that would collect
video footage or webcam
information for a period of like 30 or 60
days. And in that case, the software
would stay on the computer until it was
removed.
But again, we know very little
about how these technologies are deployed
in the US.
Law enforcement has had malware
for 15 years and we know of maybe
10 or less cases where it's been used.
I don't think this team is sitting
around twiddling their thumbs with
nothing to do. I think they are very busy
that most of the operations they engage
in remain sealed or
hidden from the public. And so we don't
know enough about how these tools are
used.
Number two, please.
Do you believe them, the United States,
that there's a public perception
that government hacking might be
good and civilian
or black hat hacking might be bad, and
that might contribute to why we're not
able to legislate against it effectively?
I mean, I certainly think that
the average person probably doesn't know
that law enforcement hacking is taking
place at all. Most Americans are busy
trying to put food on the table or get
their kids through school.
But I think to the extent that you have a
conversation with the average person,
yeah, I think no one
is going to be sympathetic with criminals
hacking. And like many
forms of violence, you know,
it's not OK for me to tell
someone, but the government
is supposed to have a monopoly on
violence
and maybe they should have a monopoly on
hacking. If that's a thing that has to
happen, then we need to have a debate
about it. But as I've tried to explain
this talk, just like
law enforcement use of so-called less
less lethal weapons like
like Tasers, just like they can have
collateral harms, they can accidentally
kill people sometimes.
So, too, can law enforcement hacking
lead to unintended consequences.
Number four, I wonder,
in many cases, terrorism is used
as a reason for espionage, especially
in France and Europe.
Now, I wonder if fighting
the dirty war on terrorism is a good
strategy to fight this idea of
law enforcement hacking.
So the question is whether we should use
the terrorism rhetoric or that we should
allow the other side to use the terrorism
rhetoric.
He's still fighting the idea of law
enforcement fighting.
The reason why people don't want
to use law enforcement, often terrorism,
I mean, I
think the average person doesn't want
doesn't want terrorist attacks take
place.
The average person also doesn't want
pedophiles to be able to do horrific
things to children.
I think if we allow the debate to be
framed as the government going
after bad people, then we lose the
debate. The conversation really needs to
shift to even if the
government has good intentions, what is
the the secondary effects of
their techniques? And if they're looking
for a terrorist in an apartment building
and they burn down the building, that's a
problem.
If there are lots of innocent people
living in that building in addition to
what they do to the target, we
it's it's very tempting
to engage on the specifics
of how the government is using it,
whether to discuss the pedophiles
or the terrorists or the drug dealers.
And if we get sucked in there, it's a
trap and we lose.
We have to stay back and focus
on the harms to the Internet and the harm
to innocent people.
Another question from the Internet, if
there's one.
Would it be feasible to initiate a
class action lawsuit against the FBI or
other agencies, and would we find
enough sufficient evidence or enough
people for such an initiative?
I'm not a lawyer and so
I don't know.
But it's hard enough to sue the
government when you can prove what
they're doing. It's even harder when you
cannot prove. And as I've described,
in many cases, it's really difficult just
to prove which agency was doing the
hacking even when they get caught.
Number three, please.
I've been talking to someone in
the police and
he was saying that, you know,
we already decided
that the police can quietly go into
people's homes sometimes and search
everything they want to.
So I would we just make
legislation that says they can do the
same to computers and other devices.
But I wasn't thinking, well, maybe
there is a little bit more to perhaps
your phone, for example,
than there would be in your home and it
would be searched.
How would you view that?
And how would you convince him that it
might be the other might
be some other way?
Yes, I think you bring up to sort of
really interesting questions there.
The first is that there
was a public debate, at least in my
country, about whether or not the police
when and why the police should have the
ability to search people's houses.
That debate took place at the founding of
our of our country because we were we
were concerned or my forefathers
were concerned that the British had
abused their authority to conduct general
warrant searches of entire neighborhoods.
So we've had a debate about that.
And as a result of that, we got laws
passed and there a specific legal
framework that the side that governs
when the police can kick down your front
door and search your living room.
We haven't had that debate around law
enforcement hacking.
Instead, the existing search
tools, the existing search authorities
are used for a very different kind
of search. And when you think about, you
know, why we need a debate
and why we actually need specific hacking
rules, if the government fucks
up a normal law enforcement search,
maybe they search the wrong house, maybe
they shoot your dog or
ransack your living room.
But the harm is limited to a relatively
small area. Maybe they got the building
above you instead of the building instead
of your apartment.
But in law enforcement hacking cases,
when they make a mistake, they could
be searching an entire neighborhood.
They could release a tool onto the
Internet that criminals could then use to
hack innocent people.
And so modern
bulk surveillance technologies, the
the worst case scenario for when things
get are when they make mistakes
are so much worse than a traditional
physical search of a home that we do
need to have a conversation about this.
We do need to ensure that those we elect
to office are politically accountable for
enabling this kind of technology.
And then we need to keep it under close
watch, because when it when they make
mistakes and even when they don't make
mistakes, they can still harm
innocent users on the Internet.
Number two, please.
Don't you think that it's still
pretty unlikely if you use Linux
to be hacked by the government because
it's way less affordable for them,
because they're way less Linux users,
because so they're a
smaller target.
So the question is, do I think Linux
users are safer because you're a small
enough minority, know
there are enough Linux users,
that it's that it's cost effective
for the companies who sell the tools
to governments will sell a Windows
version of Linux version and
an iMac version.
And we've seen the FBI deploying
all three flavors of malware
and in hacking cases today.
So this idea that
you're somehow safer because you
use Linux, I think is a myth.
If you if you want to compile
your own version of your browser with
custom compiler options to make yourself
a little bit more unique.
Yes. In that case, maybe you
can achieve protection by using a custom
built, but not just by using a Debian
or Ubuntu ISO image.
Thank you.
The question from the Internet, please.
The question is, what is your
opinion regarding law enforcement agency
hacking on the accountability of evidence
acquired by Hacking and Dabby, the impact
of usability as proof in court?
So there is an entire question
or the entire debate to have around how
reliable malware evidence, malware
derived evidence is.
And that's something that's being litigated
in the United States.
The FBI in the
playpen operation did not use tools
to transmit the information it collected
back to the FBI server.
And one of the arguments the defense
lawyers made was that it could have been
tampered with as it was sent
back to the government servers.
You know, there are
forensic standards used
and established by
the industry and by the government for
searching laptops and extracting data
from them. There are no forensic
standards for malware.
And because the government wishes to
preserve the secrecy around their tools,
they are very reluctant to even disclose
the shell code that they're using, let
alone the exploits that first break into
a computer. So it's very hard for
the defense in a case to really
understand what took place and what
mistakes may have may have
taken place while the search was going
on.
Number four, please.
Speaking of framing the debate,
I think there's one point that wasn't
really made and it's
the collateral damage that is done by
just zero days.
If you have a zero day, it
doesn't even matter if it goes out to
somewhere somebody else.
In the meantime, while you're using that,
they could have developed
the same capabilities and use it against
targets. So in
the end, police forces are
actively putting
the public and the public,
I mean, other government agency,
the army hospitals,
power stations and so on, in jeopardy
to be attacked with the same with the
same me in the measures that
the police already knows of.
So it's totally irresponsible for
any law enforcement agency
to use any zero days at all.
That's that's my that's my point.
I think it's an important point for
framing the debate.
So I'm definitely aware of that argument.
And it's certainly an argument we made
and the Apple FBI case and
our ACLU brief,
I don't think it's a winning political
argument.
If there was only one zero
day in the Firefox browser, then
yes, if law enforcement discovered
it and didn't tell Mozilla, it's possible
that another entity, a foreign government
or a criminal gang, could discover that
same vulnerability. And by not telling
Mozilla, we're all left vulnerable
to those foreign governments using the
same tool, that argument makes sense when
there's one zero day to be found
in Firefox. But let's be honest,
the Firefox browser is a target rich
environment when it comes to
vulnerabilities. It is not
a particularly secure piece of software.
It's very complex with very old software.
They're still paying off their technical
debt.
And I'm not going
to say zero days in Firefox are a dime
a dozen, but there are certainly enough
of them that I don't think it's
as convincing to say that governments are
leaving us vulnerable.
I get the rhetorical strategy,
but I think the argument of governments
losing zero days, I then them being
instantly used by criminals is a much
more convincing argument.
And we now have enough examples of
that taking place that I think it makes
sense to focus there, because
everyone, even the least technical
person, understands that the government
makes mistakes.
Thank you.
Number three, please.
I think your point about changing the
debate is as important as often missed
in especially in this community.
I think that we focus on technical
solutions to social problems very often,
and we kind of miss this part.
So thank you for this very much.
But I do have a question.
I think part of this debate is language
also. And so the question is,
do you think that perhaps we should find
a better word for maliciously
using, you know, exploits to break
into things than hacking?
And this is an honest question, right?
Because I think that with
this with this word use it being
used in two different meanings.
We miss a lot of opportunities to explain
the difference between a hacker who is
opposed to to
law enforcement using and abusing
exploits or the militarization
of exploits.
And the people,
the people on the other side of this of
this discussion, I think that makes it
this discussion muddied and harder
to actually engage in
and to actually change the debate, as
you suggest. Thank you.
Yeah, I think that's a fantastic point
that you bring up. The power of language
is is extremely important and
often overlooked.
In the US, for example, the FBI
came up with their own special term for
malware, which is called a network and
investigative technique.
And every time defense lawyers
use the term malware in court
or in briefs, the government freaks out.
They say, no, no, no, malware is
something that criminals use when we do
it. It's called a network investigative
technique.
So from my position, if
a gun is held by a police officer, it's
a gun. And when it's used by a bank
robber, it's still a gun.
The person who's holding it doesn't
change the physical object.
But the Department of Justice
has contorted themselves into a strange
shape to insist that their
malware is not really malware because a
judge who didn't really understand what
she was authorizing gave them a piece of
paper.
I think that for them, one of the benefit
or a few benefits of redefining
the term malware.
The first is that many judges who
are being given applications for a
hacking warrant may not really
understand what they're being asked to
authorize when it uses this clinical
made up term.
You know, until two years ago,
a Google search for network, an
investigative technique would reveal
nothing. And so a judge encountering
one of these applications for the first
time would have no way of knowing
really what they were being asked to
authorize. And still to this day, you
don't see a zero day
or shortcode or exploit
and. Anywhere in the warrant application,
and so they really use this this
sort of clinical language to make it seem
like what they're doing is really not a
big deal, doesn't have any risks.
They don't talk about what
happens if they make a mistake.
And so I think that's really useful
when it comes to convincing judges or at
least making sure that judges don't know
what they're being asked to authorize.
And then I think that
also impacts the political debate when
there is one, our community needs to
do a better job of
using language
in our in our favor.
And we, unfortunately, often let the
government define the terms and then we
use their terms, whether it's, you
know, the increased adoption
of sort of intelligence community terms
into our surveillance debate, like things
like implants, operators,
I think we use the terms because we think
they're cool.
But then we miss the opportunity to
take the power that comes from defining
them in favorable terms for our side.
So we all need to do a better job
with that. But thank you for bringing
that up.
So thank you very much and I have to
close this talk now, give a warm
applause.
Thank you.