Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/945 Thanks!
Good morning, everyone.
Imagine you're in a position where you
decide that, well, you want to know the
surveillance capabilities of your
government.
This is nice. Well, everyone wants
to know that.
But now imagine that if you
ask questions and they are required
to be answered, that would be even
nicer.
That's what Freedom of Information
requests are for.
And here to tell you about how this
can be applied in Italy to
determine what the Italian government has
capability wise is Ricardo
Colini.
OK.
Hi. Hi, everyone, I'm
I'm a freelance journalist in Italy,
writing mainly for Italy
and also a member of the Army's Center
for Transparency and Human Rights.
What I'm about to introduce you today,
it's a project for monitoring government
surveillance capabilities via means
of transparency towards.
Some background,
the Italian history is peculiar due to
organized crime and mafia,
there are specific transparency
and anti-corruption laws
that can help to understand
better what is going on for
this kind of project.
But so when we talk about surveillance,
Italian surveillance are well known
abroad, worldwide due to some companies
such as area and hacking team.
They are well known for exporting
surveillance technologies to
authoritarian regimes all over the world
and also accounting for
the huge hacked which suffers.
And my
question was, OK,
the surveillance technology developed in
Italy are famous abroad, but
what is going on in Italy?
What are the technologies that the
government is using to
intercept and surveil its own
citizens?
What is it? It's basically starting
from some open source intel
available online, starting from two great
websites like the Surveillance Industry
Index and Backplane Dot info,
which gathers some information on
several surveillance companies
from all over the world.
And specifically, I looked for
the Italian one, the main Italian ones.
Starting from that, I
turn to Google searching
for the value added tax numbers,
which gave me some interesting
results.
What I got were
some spreadsheets detailing the
payments, but the minister of interior
to each companies
why this happened, because due to
transparency law number 53
of 2013,
the public sector is obliged to publish
their payments from
the spreadsheets. What I got also
of the money, the
there was also the subject, the
tender identification code
of what there were paying for
using the information.
Could I turn back to Google again?
Google it.
And what I found were some
XML files.
In which it was the all
the public procurement data sets
of the public sectors, these, again,
due to anti-corruption law,
each public sector.
So the minister of interior, for example,
the minister of defense, the minister of
justice and all other public office
are obliged to publish on
this XML format
the information regarding their public
procurement data sets.
So
whatever they are interested in buying
and there is a public tender is going to
be published online.
This is the format.
And given
this data, this was my reaction.
I had all the ingredients
to start monitoring exactly
what the government was buying, how
much was paying for it, and
which were the companies involved.
So I constructed this workflow,
which is basically starting from the
public procurement data set XML files.
I can get the tender ID code
and the list of companies participating
in the tenders. It's not only the company
that won the tender, there are all the
participants, which is pretty interesting
because you can discover new companies
that you weren't aware of before.
Given this data, then the intensification
and the list of companies, thanks
to the Freedom of Information
access law recently introduced in Italy
at the beginning of 2017,
I can ask for documents regarding
invoices issued
by the several companies and
technical and economic offers
of the public tenders.
In this way, I can monitor the
expenditures and I can get information
on the software, the technologies and
the devices that these companies are
selling to the government.
So let's start with some of the results
of this monitoring the table on
the right, where the companies,
which I gather from the open source
intel websites, so.
I was able to more than double the number
of companies. There are more to
add to the United Hour, like
some peculiar one.
There's one which is called NSA Italia,
which is pretty far name for a company.
And there's also Telecom
Italia, which is
the second most large
telecommunication company in Italy,
which is well known, which is big and
which is weird to find in
a database of companies selling
surveillance technologies and devices.
But we see later why not want
to focus better on two other companies?
The first one is I forget suffragan.
It's a pretty recent new company.
It belongs to the group of electronica
and an Italian company.
And among their products,
two of them are the Wi-Fi catcher,
which is basically a Wi-Fi network
monitoring system, able to
localize and identify the nodes
and provide some traffic flow
analysis, the instead
the net. And it's basically
an integrated platform which provides
you the possibility to surveil
phone calls.
Instant messaging chats posted
remain on social media and
even voice over IP calls.
Go and have a look on their Twitter
account. It's interesting, there are some
interesting pictures
in that a company is KPM
This one basically sells
jammers, drones, jammers also.
But look into the tender's.
There was a tender regarding IMSA,
Sketchers and
CPM. Electronica is said
to be the official reseller of the
cell phone company, which is
an English company selling
in Sketchers.
So this is one of the results that we can
get with this approach.
We can discover also official
sellers of companies that are
based abroad and somehow are selling
devices that the government, the Italian
government is interested in.
Still remaining on the topic
of Sketchers, this is the
XML data that you get
regarding the 10 or so on top of
the subject, the providing a mnemonic
system, then there are the list of
participants. There are some
well known names, and there's also
Telecom Italia.
So Telecom Italia, our telecommunication
company, mentioned company
participated in Tender in 2015
for an e-mail to get your system.
They didn't win the company that won
at the time was it alarms
the the first one on top.
Regarding him, Sketchers, still, you
can get some information from the
technical specification that the
government is requesting for these
companies. So, yeah,
they're asking for the downgrade.
So pasturing from 3G to 2G,
from 4G of terrorists or to
weaken the security of the
communications.
And they're provided also a scheme
of what it would like their
names to capture, to provide to to
the authorities. So you see to basically
to try and provide some location
targeting, following around
the specific target collecting, as
you see at the center, the
emcee and Imane numbers.
This is regarding him, Sketchers, so
let's try to build the real the proper
toolbox of what
they are interested in.
What about Internet surveillance and
interception?
What I found there was
a project which belongs
to the National Imperative Plan,
which is
a plan to to foster the
development of companies in south of
Italy, which is using European
money and Italian public money
to fund these kind of projects.
This project, which was
held by the company R6, which is another
well-known surveillance company
in Italy from Italy,
was basically to provide some
Internet probes to
provide lawful interception of data
traffic interception regarding a specific
user or even
intercepting traffic from
or to or towards specific site.
What was weird is
that the tag of
this project highlighted
in yellow, it's for cultural
activities. So they basically said
this project regards to the culture
sphere.
But there are it's not
it's an Internet problem for
interception.
There's a cost of this project was
a little bit more than 100000 euros.
It was approved in 2006
and it received one hundred
thirty three thousand euros of public
funding.
And the last payment was due on
January 2015.
I filed a request for information request
to receive and obtain all the
documents regarding this project.
This was funded with public money.
But the answer I got was no,
you know, due to
intellectual property issues
for the company and to
the secrecy of the technology itself.
For a national security standpoint.
Which is a.
Next, let's think about
the social media and
the all the positive we do
online.
The Ministry of Interior has bought
a system for social media intelligence,
the project, the codenamed Project,
its crime, which is.
What does this system do?
It's basically
its aim is to
provide immediate monitoring
system to gather all
audio files available online from
social media.
So Facebook, Google, YouTube and
everything is basically doing that.
We are crawling, scraping these these
web pages, transcribe
the audio file and get identify
the speakers and store
a database of voice fingerprints.
Which are pretty concerning the
Digital Protection Authority, the Talent
Protection Authority has opened an
investigation into this and it has
requested more documents and information
to the minister of interior because
this specific system
would have to be implemented to fight
terrorism.
But the.
The power of these instruments regarding
the disability, Krall's creep and also
how are these voice fingerprints
stored in the database?
What are the safeguards?
What is going to happen?
This is not clear.
Luckily, I fallowfield information
request access, which was granted
partially what happened, the
ilma with company, the one on top, on the
right one, the tender,
but they refused to provide their
technical offers due to intellectual
property issues.
But they received some other, for
example, from ISIS, which she
said are well known companies.
And this is an excerpt from
the witnesses of technical
offers. And you see on the left
side all the public
channels, including Da,
Yahoo, Google, Reddit and
basically how they would
like to stream so.
No, who was there then to pass through,
because you also have a knowledge,
understanding of what the meaning and the
system also translates to get soldiers
from several languages.
All these documents that we obtained will
be published probably
the beginning of the 2018 there in
Italian, so we have to understand how
to properly translate them or made
them available to all the community.
Well, let's move on recently here in
Germany, I read an article on the Berlin
train station, they're going to test the
facial recognition system.
Well, Italy wants
to do the same or actually
maybe a little bit more.
What they did is, uh, at the beginning
of this year,
they've bought the system of face
recognition system for a project called
Saray, which is basically
a face recognition system.
This is the architecture, uh, a picture
taken from their, uh,
technical specs requires.
So you have these basically on the right
DFI. Yes, it's the
database of, uh, let's say the
mug shots, the all the image that they
already have of criminals.
They would like to have this server
application with several engines using
several face recognition
algorithms to find
the specific person
containing the image.
The system is split into two different
parts.
There's an enterprise version which
has to deal with 10 million
images and which is basically a static
version. So you you have I mean, you have
an image you would like to know if the
person on that image is present
in your database.
The other one is a real time one
which needs to
work together with 10
CCTV cameras that they put in
the standard as well to be
deployed according
to their necessities around Italy.
Uh, the system
will spot the the
person in real time comparing to
a watch list of 10000 images,
which are almost
concerning numbers, both on
for the 10 million images and the ten
thousands.
Um.
We we filed a Freedom
of Information request also for those
technical offers, and we
had some issues because
they only provided the technical
affairs of the company
that won the tender but
obscure. They redacted some
some passages. So it's not completely
clear what the engineers.
But again, also for the system,
the Italian Data Protection Authority
opened an investigation asking for more
information to go to the minister of
interior.
But let's move on what we can request
with our freedom of information law in
Italy.
We wanted to request invoices.
So this is an example of the of
invoices that I request for, the company
area that you see in the camera redacted.
So they wanted to remove some specific
detail regarding investigations,
but they basically provided us
with documents. So this is
this is good. This is leverage because we
have a precedent. They provided us some
invoices I'm keeping
asking new invoices.
So they're coming.
We are collecting them.
We would like to understand how much they
spend on these technologies.
So far, we've been talking about the
Ministry of Interior, the this
project can be applied to the Ministry of
Defense and the Ministry of Justice
with the Ministry of Interior, though
there are some caveats because the
transparency laws differ,
are not so powerful as in other cases.
But still we can get some information.
This is a.
The PDF documents detailing the
expenditures of the arm of the defense
regarding some some communication
intelligence that the empowerment of
women in communication intelligence
systems, a pretty interesting
one is the one I like to do, which is
a legal system developed by the company
expert system.
And this legal system, it's
it's used to select the intercept
the traffic and to
provide a sort of speech to text
translation, so to transcribe it.
And here you can see more details.
Yeah, we would like to think about this
as some sort of weaker
version of this code.
But yeah, because basically you have some
research criteria, criteria's parameters
you can search to connect and provide
a comprehensive understanding of
the target of your target.
So.
What was my initial question, what are
the to what's inside
the toolbox of Italian government?
Looks like the Italian government
has acquired everything that
it needs, everything that other bigger
nations use.
Such as physical recognition, social
media, intelligence and Internet
interception and signatures.
But what's next?
We would like to keep following
this Freedom of Information request to
get all the invoices and technical
economic offers.
We would like to expand the database of
companies because there are some
missing companies, for example, hacking
team.
There was no information
regarding that, but we are trying to find
companies connecting to them
and this would be really helpful because.
If we find the companies that are
participating in the tenders,
we know more companies that are trying to
sell these kind of technologies and we
can somehow linked them
to our team or other more important
companies. And I have pointed an
interesting point is to push
the government on the expenditures.
So how much is it spending?
Not only on our privacy
concerning point of view, but also on the
expenditures point of view, how much does
it cost to surveil your
citizens?
And this in this way, we can
somehow understand it.
What is missing so far is
to analyze the legal framework
that lets the government
use such technologies.
So far it's quite blurred.
There's no for the recognition
there was not even a mention of terrorism
threat. It was like, yeah, we want to buy
this recognition system and use it in
public events, which is concerning,
which is not even like the social media
intelligence system only for
terrorism related issues.
And something more, we would like to
involve activists from other
countries, because we think that
this framework could be
could be applied, could be exported to
other countries.
And to do that specifically,
there's going to be a workshop right
after the start at 2pm at the
Rights and Freedoms Assembly.
I was going to work. There is a.
Uh, Horizon 2020 funded
project, which is called deju with
the whistle blower, which is
providing a platform
for accountability mechanism
to understand what the situation of the
nations in Europe.
But then the workshop is, if anyone
is interested, we can discuss where other
nations and
from this coming
to the workshop, we can see how
the public procurement datasets are
available, how which laws provides
in the country's ability
the possibility to apply this
same framework to understand how
your country is acquiring
such technologies and techniques.
So I invite you
to, if you're interested, to come to the
workshop leader.
Yeah, that was it.
Thank you very much, Ricardo.
We have four microphones here
in the hall that you can line up behind
for questions, and we also have plenty
of time for questions.
Are there questions from the Internet?
No questions in that case, microphone
number one, please.
Hi, sir.
When you were starting out your
investigation, you said you looked at Bug
Planet and the other website for Italian
companies providing surveillance
equipment of
other laws in Italy, specifying
that the surveillance technologies have
to come from domestic suppliers or why
was there a door chose to focus solely
on specifically Italian companies.
Not sure on the laws regarding
the domestic supplies for
at least I don't think that for
the Ministry of Interior
there are any constraints, such kind of
constraints.
What I wanted to know was like
I basically started from that because
they were like the there were no
companies.
And then I found that in
my hands, so basically my hands and
I was like, OK, let's start digging
deeper. So it's yeah, I
don't want to focus only on Italian
companies, see if any foreign
companies pop ups in the tenders.
I will surely follow the trail
for sure. So, yeah, there was no specific
reason why I didn't.
OK, one question from the Internet
via a little signal, please.
Yes.
Are these tools
under secrecy?
Under secrecy.
Well.
When I requested information
to the police, if these technologies
were being used, how
how many times, how often the stuff,
they didn't reply, they
didn't say anything.
So I hope that
the data protection authority can
understand better what is going on.
And, of course, I will try to
to see if there's been any event,
if it's already been used.
So, yeah, not probably under secrecy,
but kind of microphone
number two, please.
Hello. Did you ask the ministry
what is relation between the culture
and IP surveillance?
I requested that in the Freedom
of Information request, I mean, to
I did that to the Ministry of Economic
Development because it was the
one on holding that
the kind of project.
But they didn't reply in that.
So microphone number
four, please.
Dowrick are
tendering in Italy, if I'm
right, is something limited to
offers higher than 80 or 100000
euros.
So do you do you know do you have
the feeling that there is some.
Obfuscation by going
below the tender line in order to not
go into the public for into
those databases, i.e., I
didn't specifically check on that, but
that's certainly a point.
I mean, from this study.
Clearly, there is something missing.
For example, the Russians
are not appearing.
They're not there.
But this also because probably I
need to dig deeper into the Ministry of
Justice because it's.
They are buying this
technology, so,
yeah, not sure if they're doing that
on purpose, like lowering the
amount of the defenders, but definitely
there is something missing. So this is
not comprehensive. It's still an ongoing
effort to search more.
Another question from the Internet.
This is a three part question are
there any big newspapers in Italy
interested in your research results
and are the Italians conscious
of the surveillance?
And is there a public debate about
it?
Well.
It depends the
defense recognition system
got some attention, uh,
since I'm a freelance journalist running
from Italy, I basically wrote some
articles on that.
But, uh,
the media
not so they didn't take on this, uh,
on this kind of research yet.
I hope they I hope they will, because
I need help for sure.
If anyone wants to dig deeper to find
something else, we will provide the data
and it's going to be public available
online. So, yeah, the
public debate on privacy,
it's quite tough because we recently
introduced a new data retention
law which strikes the
the time of retention up to
six years, which is
a lot and which doesn't make completely
sense regarding to what are
the principles at the European level.
So,
yeah, Italian people
are concerned about this, but probably
not enough.
Do we have any more questions?
It does not look like it.
So a very warm and
pleasant workshop.
Thank you, Ricardo.