Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/672 Thanks!
I was actually quite looking forward to
moderate this talk because OPSEC aside,
I have to admit I now Klaudia quite well.
And why is that?
Because we share a coworking space and
the third tenant is a drum set.
And this is important enough for the
little story I tell now.
I almost I always notice
when he does his work breaks because
first he reads Twitter for ten minutes,
then he gets triggered.
And the next thing I know is a 45
minute drum solo in
Norwegian Death Metal.
And I don't know how many
of you are familiar with Roth.
Yeah, but that's
not always pleasant.
And I noticed something changed during
the last few weeks and
I wondered what happened.
And part of the explanation for this is
this talk. And so if
you discourage cloud with this new
project, then the drum solo
is work. Start again and I would
back you. Please don't do that.
But if I come in with a big round
of applause.
Klau, you go energy security researcher
with Amnesty International and
a fellow at the Citizen Lab.
Well, hello, everybody.
So firstly, I have to say I'm a bit sick,
so my voice isn't that great.
So please bear with me.
Um, secondly, the usual disclaimer,
everything that I'm going to say today is
purely just my opinion does not
represent any of the opinions of my
employer or any of the organizations that
I work with.
Um, I'm going to
run for a little today.
And I actually it's the first time that I
give a non-technical talk, and
that kind of scares me a little.
Um, but
I hope it's going to make sense.
So this
is going to be a reflection on
the last few years of my experience.
And I'm a security researcher by
training and by profession.
And last year, years I work
specifically in working with human
rights organization and journalistic
organizations and civil society in
general, in assisting
on security issues.
And I've learned a lot of things,
especially coming from more, uh,
corporate security background.
So computer systems were
destined for for a global
cultural and economic revolution.
I think that the community, the
hacker community anticipated
a long time ago and we saw that potential
and we saw it coming early on.
And while we enjoyed that little time
of the good times of
reckless punditry online
and playing as the hackers, movie
teachers, the cowboys of the early
Internet connected age,
we also soon welcome the global
realization that we were right
all along, that technology
was going to become predominant in
society and that
information technology
was going to change everything.
And computer security in particular
was going to be critical.
And with that, we embrace the
legitimization of our culture.
And with that, also the monetization
of our skills, you know.
And now the Internet basically governs
our lives.
What's interesting is that the moral
principle of our subculture,
our counterculture, as some people say,
uh, that was traditionally subversive
and anti authoritarian of change
radically and have become increasingly
diluted with vested interests.
And the traditional distrust for the
state is only meaningfully
visible in some corners of our community,
and this one being one of them.
For the most part, at least the most
visible one, I would say the security
community, but the industry really in
particular, and I make that distinction
quite often throughout this speech,
he's enjoying the six figure salaries,
the luxury suites in Las Vegas,
the media attention
and the business class plus
traveling and all of that.
And you know what
concerns me is that with hackers,
you know, having moved through through
their professional lives and their
careers and working for many
different sides of of society
and across the entire political spectrum,
now it's becoming really difficult to to
identify shared values among ourselves
in the larger and the larger and this
larger community and.
What is what is to say is also the
Internet morphed with it, change with us
to once it was kind of
an export space
that we were wondering in solitude
and now has become a marketplace for
goods.
It has become the primary vehicle of
global communication.
It has become the place to share cats
and memes and foreign news
and also,
thankfully enough, an unprecedented
platform for Intellectual
Liberation Organization mobilization
and so on. And that's all great.
However, to quote Kevin Kelly, there is
no powerfully constructive technology
that is also not powerfully destructive
in another direction, just as there is
no great idea that cannot be creatively
perverted for great harm.
And indeed, an invention or idea is not
really tremendous unless it can be
tremendously abused.
And it should be the first law of
technological expectation.
The greater the promise of a new
technology and the greater is the
potential for harm as well.
And sure enough, we observed that same
technology and the Internet and
everything that we've built over the
decades that, you know,
we consider of technology, of liberation
and self-determination.
We discovered it being turned into a tool
for repression as well, and it was
inevitable.
There is never significant technological
imbalance between states
and their citizens, and as billions of
dollars are poured into systems of
surveillance, both passive and active,
it might not just by the United States,
but really by any government that is
wealthy enough to do so.
Credible defense is really either lag
behind the remaining accessible and
generally only available to corporations
and businesses with deep enough pockets
and a few ambitious free software
projects that we have attempting to
change things radically are often
faced with rather unsustainable funding
models, um, which
really will last long enough to grow
these projects to maturity.
And I think this is a big issue that we
need to face really small
and nation states are very aware of this
imbalance, of this technological
imbalance and use it to their own
advantage. Of course, we
have learned through it, through the use
that technology is regularly used to curb
dissent, to censor information, to
identify and monitor people, especially
those engaging in political struggles and
societal struggles.
And we saw some examples of it
that are very well known.
We saw the relentless attacks against
journalists in Ethiopia.
We saw the crushing of protest movements
and in Bahrain did hunting
and hunting of dissidents in Iran and
an atrocity that then became of Syria.
And all of this complemented with
electronic surveillance and censorship.
And it is not an eye anymore to see that
people are getting arrested for a tweet
that just happens more and more every
day. And anybody who negates this reality
is just either misguided or
misguided.
And all of these cases that we observe,
then we learn over the years remind me
not only that that oppressive technology
can be used to silence people, but
that we also take granted access
to to simple defensive technology
or technology in general, when in
countries like Morocco, Egypt, the
Emirates and many others, even simply
access to to encryption or the use
of encryption is normally forbidden by
default.
And that in other parts of the world,
even basic communication platforms are
regularly blocked. And at times even
entire access to Internet connections are
shut down for the entire nation.
And we should be outraged and alone
against that. I don't think we are
enough.
So security can no longer be a privilege
or a commodity in the hands of those few
who can afford it,
those who face imprisonment and violence
in the pursuit of justice and democracy
cannot succeed if they don't communicate
securely as well as the remain safe
online. And I think that's a lesson
that we have learned already.
Security has to become a right.
It has to be exercised and protected.
It is a precondition.
It is a precondition for privacy, which
is the key enabler for freedom of
expression, which is a requirement for
for a healthy democracy.
And while the security industry is
becoming increasingly dependent, but not
financially and politically on
on the national security and defense
sector, I think we find
ourselves in a renewed need for
a structured, structured social
and political engagement from the hacker
community.
And geeks like us
often do not get along very well with
ethics and politics after, say,
until eventually the grown of maturity, I
think to recognize the implications
and the social responsibility
we have as as technologists.
And some of this some of us get there
sooner or some of them get there later.
Some some of us just never will.
But having social consciousness is
often, I think, even cause
of ridicule among techies, and
that's unbearable.
You can experience exclusion when you
become outspoken on matters that the
larger security community deems stranger
to the competencies, and you start seeing
others becoming patronizing and
condescending to you.
Fortunately, not here, not at Congress,
but I'm sure many of you experienced the
same just as I did elsewhere
in other parts, and that you shouldn't
let that intimidate you.
We need to recognize the privilege we
have as educated professionals and
technicians, the advantage
we have with our understanding of the
many facets of technology
and realize that we can not abdicate that
responsibility of upholding human
rights in the modern connected society,
especially if we keep acting as
gatekeepers
and be creating or contributing to free
software or helping someone in need
or, you know, pushing Internet
corporations and being more respectful
to users privacy,
dedicating your time and abilities to the
benefit of society as completely a
political choice.
And you should embrace that with
consciousness and pride.
The fact is that there is there is a very
prominent human rights culture and
narrative in the crypto community
and but there is very little of that in
the security community and especially in
the industry. And I don't
know why, but that definitely needs to
change.
It is time to start asking ourselves,
what is that we working for and what is
the we working towards in our
wanting our lives?
I think we need to start to think
and formalize the idea of security
activism.
Parallel to privacy activism and human
rights activism, all of these forms of
engagement in society that we already
practice.
And we do have the means and hopefully
also the will to do that, but we also
face a lot of challenges in this
and we need to rethink the strategies and
and reconsider the tactics that we
employ.
And I thought a lot about this.
And in traditional activism,
there is there is a predominant concept,
which is the concept of bearing witness.
You know, it is this is a practice of
observing and documenting a wrongdoing
and without interfering directly
with the assumption that exposing it to
the world might be sufficient enough
to prevent it in the future from
happening again as a result of the public
outcry and the public attention, and is
viewed as a powerful tactic and quite
often also the only available or
meaningful tactic.
This wasn't always the case in activist
movements. The shift of tactics are
generally witnessed in reaction to the
growth, the legitimization, the
structural easing of the of these
movements themselves, which have to
conform to the norms of society and of
acceptable behavior.
And similarly, as we know, security
researchers and technologies and privacy
activists conform to.
We also bear witness in some way.
We observe, we document we reported
abuses of technology in a way that I
believe is a powerful claim
that economic tension that exists between
offense and defense.
Being a journalist, electronic
communication intercepted or computer
compromised?
Or the censorship of website or the
blocking of messaging systems that we
see, you know, pretty much every week,
the exposure of technology that is being
used to empower such repressions
increments the cost of their development
and the repression. That is a meaningful
tactic, as are the tactic defeated,
circumvented and consequently
unnecessarily reengineer, redeployed.
This process costs money and time.
And exposure can effectively and
effectively become
a way to curb that their indiscriminate
adoption and become
basically an act of oversight in some
way by showing that there is
competent people watching out and that
abuses won't go unnoticed.
And hacking team and Finfish Johannesson
and all of these cases are a great
example of that.
There are cases where operations of
companies producing spyware or other
technologies of sorts there are sold to
governments around the world where more
effectively understood and studied
and scrutinized as a result of the
public attention derived from a bunch of
geeks like us and the researchers
tracking and repeatedly exposing the
abuses perpetrated through the use of
such technology.
And then we have kids as well, where
a future arrives and hacks the companies
and leaked all the emails and documents
and quite frankly, are players or
Howard, there is one fundamental flaw in
the bearing witness we practice.
It is a strategy that requires
accountability in order to be effective.
It implies that a perpetrator
of this wrongdoing is identifiable
and preferable, and it requires
you basically to to just name and shame
people and organizations and states and
institutions.
And none of these properties are often
available to us in a digital world.
Right.
The Internet provides abusers plausible
deniability and an accountability quite
often.
So it makes it close to impossible to
identify the abusers in the first place
in any meaningful way.
I mean, recently we're seeing seeing a
shift of that, but let alone
name and shame them effectively
and in our society, bombarded with
information and increasingly exposed
through the media to the risks and the
breaches that happen almost daily.
The few stories we are able to tell on
repression of dissent
and citizens become, uh,
are becoming repetitive and boring,
after all, in the front of the majesty of
the myriad of attacks and,
you know, entire countries being shut
down off the Internet, apparently, and
in the hundreds of millions of online
accounts compromised every other week,
even in front of the mathematics
by the infrastructure of the five eyes
and so on, what is in the eyes
of the public and activists from the
Middle East or some other part of the
world that is unknown to most and
compromise with the trappy tradition that
has been bought off the Internet for
twenty five bucks?
You know, that is not an interesting
story.
So we need to stop and take a deep breath
and look at the world around us
and see if we're missing the big picture.
So a little bit of puppies to lift your
spirits and for me to drink some water.
Wonderful.
So firstly, we need to stop thinking that
the most interesting or flamboyant
research is the most important one.
Thank you.
And when companies like NSA
or Hacking Team or Finfish, the most
well-known examples are found involving
in violation of human rights of sorts,
makes it for a hell of a media story.
You know, and sometimes in research
that I worked on an equal authority in
London, front pages of major
international newspapers, I find that
a bit ridiculous, to be honest.
But it's great in some way.
But the truth is, is that despite
how legally and politically important
these cases are and it's great to expose
them and bring them to the public
attention, as we have done in the last
years, those cases are also exceptions
and they're not particularly
representative, in fact, to what is the
reality of the use of technology as a
tool for repression by most states.
And for one dissident found
targeted with sophisticated commercial
spyware produced by a European company
or American company or whatever,
there are hundreds more are infected with
free to download a poorly written
Trojan's, which, you know, would make
any security researcher yound
got bored immediately, but I deserve
equal attention in some way.
And what I've learned over the years and
working in this field is that fighting is
a legitimate hacking and intrusion
of journalists and dissidents is a never
ending cat and mouse game for us.
But it's also about our technically
boring one.
However, once you grow out of the boredom
at the sight of yet another dark helmet
or black shades, right.
Or a four years old Microsoft
Office exploit.
Then you start understanding the true
value of this work, which is that it's
less technical and it's more human.
And it is not about the next hack of the
next unusual device or vehicle,
as it is not about ourselves or profiles
or of our careers,
and too often we observe a toxic
celebrity culture in the hacker
and the security communities.
Emphasized also, obviously, by the
aggrandizing bias of the media
that too often looks for the story
of the renegade hacker
and too often we indulge into into
that.
And often at the expense of the
victims of oppressive technologies who
really struggle and and most remain
unheard and unknown
to to to most people.
So we need to grow some humility and
start containing our egos.
I think.
The challenges are.
Many.
And I spent the last four years, as I
said, kind of offering my my my expertize
and my modest skills
to the human rights community.
And while I have to say that is greatly
satisfying in a way that I didn't find as
much satisfying previous corporate work,
it is also a mastodon struggle,
really.
You know, securing a global civil society
is a road filled with obstacles and
complication.
And while on the one hand, it can provide
really interesting, unprecedented
challenges for our Problem-Solving
minds as hackers, resources
also comes with the toll of knowing that
lives are at stake and really that
it's not just some intellectual property
or some profit or some couple of boxes
blinking boxes and a shelf being at
stake.
So how do you secure a distributed,
dissimilar and diverse network of people
who face different risks, different
adversaries, and operate in different
places with different technologies and
different services?
It's a topological nightmare.
And while we the security community at
large, I don't mean just we in this room
secure corporations and organizations
with proper modeling, you know, by
firming and tightening the technology
that is being adopted and by watching
closely for anomalies in that model.
What we the handful of technologies that
are working in the human rights field
often can do is only recommend a
stock software or another, hoping that
it's not going to fail the person that
we are helping, quote unquote.
So I've recently traveled to a West
African country to meet some
local journalists and activists.
And that's perennial in my checklist
of things to preach around.
I suggest this one to encrypt this phone
as it normally would.
And littering tonight as we meet for
dinner.
And he comes in the place and
he starts waving his phone at me
and and these plates show that his
handwrote phone had failed to the
encryption process, despite
having followed all of the appropriate
and necessary steps that corrupted all of
the data on it.
And the person looked at me and said, I'm
never going to decrypt anything ever
again.
So sometimes the technology we advocate
is inadequate, sometimes it is
inaccessible or just too expensive,
sometimes it just simply fails.
And we can expect the world to fix itself
just by making some tools available,
despite how vital they are.
So that brings me to the second
reflection, which which is that we need
to become more engaged.
So we need to become an integral part of
this social struggles and movements that
are very much needed in this world right
now. And so my suggestion to
you is to to find our cause and
assist others.
And, you know, being a
local environmental organization,
campaigning against fracking or a citizen
journalist group exposing corruption
locally or globally, human rights
organizations fighting injustice or even
just assisting in the policymaking field,
your help might make a significant
impact, much more there where our
expertize is so much lacking.
And Congress, the space we have
so much to given that and rather than
lamenting a lack of technical content,
as I often read and hear, we
should welcome with open arms all of the
different voices that enable us for at
least that one time of year.
To hear about what else goes on in the
outer corners, corners of society.
It is that one opportunity
to learn more about ethics and politics
on which very little we actually know
of and actually very little we learn in
our in our education, technical
education.
And perhaps today or tomorrow, you will
learn or hear about some cause or some
projects that you might decide to
contribute to and that it's already a
success.
And then we have Twitter, our Twitter
filter bubble, and the rest of the year
think about exploits and malware analysis
and programing and all of this stuff.
I think that it's important to recognize
what we can do, more we can organize.
The problem is that civil society, which
is what I deeply care, suffers a
fundamental lack of visibility, but also
understanding of the threats it faces
in the digital sphere
because of a lack of internal expertize
and the financial inability to access
technology and solutions that
are instead available to the corporate
world. Certainly isn't making things any
easier. And the fact of the matter is
that regular users are no longer
consumers of security.
Let alone dissidents or journalists.
We need to approach this problem
differently. I recognize that civil
society isn't going to secure itself.
Hackers are in such high demand
and all sorts of highly remunerated, I
have to say, in the private sector.
I guess you guys know
that I believe that civil society in
the nonprofit sector in general have very
little chances to build an adequate
internal expertize.
It's just an impossible struggle,
and not many would abandon their career
to follow this path and those that could
or they would want to probably, probably
even can't.
So what if we reverse
this and what if we create a place for
technicians to gather, organize
and work collectively on a volunteer
basis or provide at least some assistance
to civil society?
And that's where I'm getting at.
So we need to flip this game
and this is one attempt of doing Social
Security Without Borders is a project
that I have the pleasure to announce
here.
And it is an open collective of hackers
and security professionals who volunteer
with assisting journalists, human rights
defenders and nonprofit organizations
with security issues.
We already gathered a number of people
being penetration tester, malware
analysts, engineers, researchers, and
I invite all of you to join in some
way.
We want to create a structure.
Able to assist voluntarily with
penetration tests, incident response,
malware analysis, as well, as well as
able to build tools right newsletters
and make all of those missing components
that will make civil society a lot
stronger.
And it's still very much an experiment
that will grow, obviously, and change and
adapt as people participate.
But the idea is to
reverse this problem and make sure that
if we aggregate enough number of people
that can dedicate even one hour a week
will have enough manpower
to actually solve a lot of issues that
are remaining unsolved.
Right now.
So it is still an experiment, but I do
believe, however, that if we come
together and through a coordinated effort
of solidarity and volunteering,
we can make those changes in
society that are very much needed
and this time not not for fortune and
fame, but for that greater
good that we all deep down aspire to.
And with that, I thank you all and
you can go on the website right now to
find some more details and find out ways
to to reach out and get in contact with
us. Thank you.
Thank you very much for the talk about
equal firepower.
We have plenty of time for questions.
So if there are questions, you can line
up on that mic and on that mic.
And in the meantime, do we
have questions from the Internet signal
end? OK.
OK, so if that's that, I'm
sure the cloud can be approached
at the stage.
And I wish you good time
so far.
Thank you.