NOTH1NG T0 HID3: go out and fix privacy!
Solovjovs, Kirils
After the highly-successful presentation "Toll of personal privacy in 2018" at Chaos-West 35C3 where I talked about my personal experiences with trying to protect my privacy, this year I return with a completely* different talk that tries to convince the audience — you should care about privacy too! This talk revisits the theme of personal privacy in the digital world, this time centring around the "I've got nothing to hide" argument. A beam of intensive light is shed upon the motivation behind caring about one's privacy. We go in depth into what we can do to stay private and should we even try to do it at all. We talk about where we as an global society were able to fix privacy and where we have failed. New topics previously not covered are discussed, such as herd immunity and certification programs. \* 97%+
 So I'm very happy to announce for the second talk of the day Kirill Solovs-Jovs. He's a lead researcher at possible security and he's a bug bounty hunter. He's an IT policy activist and a white hat hacker from Latvia and he's talking today about nothing to hide, go out and fix your privacy. Some citizens complain about being under surveillance but they are told that if you have nothing to hide, they have nothing to fear. Still news media regularly cover cases where citizens with unusual behavior are put on suspicion lists even though they have broken no laws. Now this is a quote from a news article from European digital rights newspaper, Eddrogram number 300. Anyone here took math in college? Mathematical logic? Some? So you can tell me what this means. So basically what it says here on the screen is for every person that belongs to the group of criminals, that person also belongs to the group of people who are hiding something. That funky sign in the middle means from that statement follows that for every person that has something to hide, that person also belongs to the group of criminals. How many of you think this is correct? No one? Great. It's of course wrong but it is a really common fallacy. I hear that a lot. Now what even is privacy though? Privacy first of all is the autonomous right to choose. Who will work with my data? So maybe I'm fine with company A working with my data but I'm not okay with company B working with my data. Also how the information is processed. So maybe I am okay for Amazon to process my home address to send me a package but I do not consent to Amazon sending goons to my house to get money out of me. And of course what information is processed. Even though I'm okay with giving my address, maybe I'm not okay with giving my phone number. But it's not only that. It's also right to decide who I interact with. That includes right to be left alone. So in a sense privacy is also about consent in a lot of ways. Now to illustrate this is a bit better. To try to transfer my feeling to you I created this concept of Schrodinger's video camera. You may have heard of Schrodinger's cat. Schrodinger's video camera goes something like that. Imagine you just bought a new apartment somewhere in Paris. Great view. Nice building. And then one day you notice that a security camera has showed up outside your window on the open side. It has one of these non-transparent domes and you cannot see inside it. You cannot see if it's looking at you or not. You can't even tell if there's a camera inside or if it's completely fake. But for me it doesn't matter. The feeling I get is terrible either way. Even if someone told me that there's no camera in there, even if someone showed me that there's no camera in there, I wouldn't feel at ease. So that's why for me privacy is in many ways the feeling of privacy. Now exactly one year ago at this stage I gave a talk, a talk of personal privacy in 2018. I just want to acknowledge some reactions that I've been getting since the talk. So some of the reactions are funny. Some of them are affirmative. Others are insightful. Of course others are just plain uninformed because you do not have to actually use a phone even though it's hard but you don't have to. Even more so you don't actually have to use Facebook. But these two remaining arguments I want to talk closer about these two. So here's a short video. Some of you may have seen it. So it's a video of a lady trying to unlock the man's phone with a face ID. Now it's clear from this that it's fake. At least it's a sketch. It's clearly visible. But what I want to talk about is the reactions. And I'm outraged by the reactions. All the main topic of the video aside, all these people here assume that since he has something to hide, he did something wrong, which is unacceptable to me. So what if you really got nothing to hide? Maybe we have people in the audience here even though I doubt that have nothing to hide. I'm sure we have some people like that watching the stream, not here at the congress. So what about data hoarding? What if someone will say a government or a large corporation these days, maybe that's more likely, collects enough data about you that allows them to more easily blackmail you, that allows them to impersonate you? Even if that's not the case, think about herd immunity. That's a concept used in vaccinations. You should get vaccinated because some people medically can't and you will also protect them by providing human shield if we can so say. The same applies for privacy. There's herd immunity in privacy. So many people not hiding anything will make it really hard for the few who actually have something to hide. And it doesn't have to be anything criminal or nefarious. Many people have legitimate reasons to hide things. And by accepting that you're okay with not hiding anything, by giving up your right to privacy, you're also helping those people that actually need privacy to give up their right as well. And of course, remember that today's authority might become to tell Terian or inhumane. We see the transformation process starting in a couple of western countries right now and I don't know where it's going to lead us in the next years, but it may be the case. Imagine how much easier would it have been for Adolf to have committed his atrocities here in Germany if he had Facebook, if he had access to all the data? I hope that's not coming back, never. Now what I want to talk about now is a state of privacy. I want to take a look at what's happening around the world. And what's happening around the world, of course, is there are these protests in Hong Kong going on. So this is an article from middle of this year. And people in Hong Kong, they're really aware of tracking that their transportation cards can be used to track where they move. So they try to avoid that. We are afraid of having our data tracked is what they say. So that's good. People are getting more aware. But it's also happening in the West. Los Angeles decided, passed a law basically, that all the scooter sharing companies have to share real-time scooter location data with the government. And Uber, even though I dislike their methods and trying to disobey the law wherever possible, I think they took the right stand. All the other companies actually are ready to give the data and are giving the data to the government. Uber is the only one who questioned this and tried to fight against that. The idea behind that is a good idea. So the government wants to make sure that the communities, the geographical communities where underrepresented people live or under privileged nationalization shall say, that they also get the scooters. They don't target just the rich neighborhoods. So that's good. But do they really need real-time tracking for that? I doubt that. Now my favorite topic of CCTV, of course, this is the only slide from the last year that I included here. These are actual posters for those of you who haven't seen them from the UK, how the government is telling you that CCTV is good. So what's new? Well, this happened. Beginning of this year, so in May this year, a man was stopped by the police. All he did, he was walking by and someone warned him that there is facial recognition going on over there. So what he did, he pulled over his sweater, he pulled it over his face and walked by. Police stopped him, forced him to scan his face, found nothing wrong and fined him 90 pounds for trying to evade the facial recognition. So it's super disturbing and super creepy. But I mean, there are ways around that, right? We could use this cap, for example, and have a face of, I don't know, general secretary of a Communist Party somewhere. So then you're not trackable, not attracting attention, right? There is this law in Hong Kong that doesn't allow you to use masks anymore in the protests. And it's problematic because they track everyone through facial recognition. So that's why the mask was allegedly created. The good news is, it's a relatively recent news, in November it was ruled, it's a system, political system in Hong Kong is complicated, but Hong Kong court ruled that it's illegal to ban wearing masks. And the full hearing in the next level of court is still going to happen in January next year. But currently, the law is suspended. Currently you can actually wear masks. I mean, I don't know if police actually are okay with that, but by law you can. Now, privacy advocates, me included, have always been complaining about not being able to use public Wi-Fi without a phone number. Finally we can. We have an option to take a selfie and upload the passports. It's just terrible. Oh my God. Let's get back to facial recognition for a second. So European countries are trying to copy and paste the idea that China is doing. It's not just China, it's not just Russia. But the difference is they are asking for permission. So why are they asking for permission? Well. And now that they've got a negative answer, the question is, will they listen? Yes, they will. Because European data protection board finds a school in Sweden because of using facial recognition. I mean, thanks to whoever made it, but we have GDPR. So we do have some protection in Europe. Unfortunately, not all of us here and not all of us watching this stream are so lucky to have that kind of regulation. But it does actually work. Even though I've been hearing bad things about GDPR, yes, there are things to improve. But it does work. It does help us. Now, as you were told, I come from Latvia, and I want to share something from Latvia. This is a picture I took at a press event in Riga. So police were presenting their new vehicle, this one over here. And this vehicle, the idea is it will automatically find people for not wearing seat belts, talking on the phone, not showing turn signals. So it has a bunch of 360-degree cameras in there and doing some fancy stuff. I mean, I'm all for traffic safety, but check this out. I mean, I like that they do have a sense of humor. I guess BB was taken, so I mean, they decided to go with GC, which is okay, which is the one that police use, but still, or we'll be proud. So another slide from my previous presentation. So People's Daily China was telling how cool it is that in classrooms you can actually now use surveillance cameras to track the progress of students. Are they learning? Are they focusing? And so on. Well, what's new? What happened in 2019? Anyone knows? This happened. Brain scans. So let's take a look at this short video here. Teachers at this primary school in China know exactly when someone isn't paying attention. These headbands measure each student's level of concentration. The information is then directly sent to the teacher's computer and to parents. China has big plans to become a global leader in artificial intelligence. It has enabled a cashless economy where people make purchases with their faces. A giant network of surveillance cameras with facial recognition helps police monitor citizens. Meanwhile, some schools offer glimpses of what the future of high-tech education in the country might look like. Students have robots that analyze students' health and engagement levels. Students wear uniforms with chips that track their locations. There are even surveillance cameras that monitor how often students check their phones or yawn during classes. These gadgets have alarmed Chinese netizens. Now, that's screwed up beyond repair, if you ask me. But luckily, just happening in China, right? No. U.S., America. So there's a great article. I invited you to read it in Fall in the Guardian, published in October 2022 this year, about how they use digital surveillance for American kids or against American kids, I shall say. I will read you some of the quotes from the article. I divided this article into multiple categories so it's easier for you to understand. First of all, the reason why is anyone doing that? I mean, it's not China. It's not the national communism. You're not supposed to spy on people, at least unless you're the government in the U.S. So the reason is that lawsuits by parents of students who have committed suicide or parents of children who have been cyberbullied is a problem for the schools. So they see this as an easy solution. They track everything students do and then they are office code free. I mean, from the perspective of the school's lawyer, even if the kid does commit suicide, their assets are covered because they have this great system and they did everything they could. So it's kind of a loose, loose situation there. Now what was reaction time? So as the article says, it's not, I've sent this email two days ago. You've sent this email three minutes ago. Come to my office, let's talk. That's the speed, that's the latency, that's the reaction time of the system. In Veldt County, Colorado, a student emailed a teacher that she heard two boys were about to smoke weed in a bathroom. And school is proud of this. Within four minutes of sending the email, troops were deployed to the bathroom. Scope. So I mean, it's getting worse and worse. So I'm going to get ready for that, prepare for that. So it's not just about what they do at school. 24 hours a day, whether students are in their classrooms or their bedrooms, the monitoring is going on. Of course, I'm not talking about video cameras here, but the content monitoring. Tech companies are also working with schools to monitor students' web searches and internet usage. And in some cases, track what they are writing in their private social media accounts. Gaggle, which is the name of one of the companies providing the service in the US, also automatically sends students a scolding email every time they use a profanity. How is that for a chilling effect? Now with all that, what's the justification? Some proponents of the school monitoring say that the technology is part of educating today's students in how to be good digital citizens. What does that mean? Well, allegedly, it helps trained students for constant surveillance after they graduate. That's the actual quote from the justification of this system. And here's another quote from Bill McCullough, a Gaggle spokesperson. Take an adult in the workforce. You can't type anything you want in your work email. It's being looked at. So their idea is, you know, let's do this to our kids in schools and then prepare them for that. What are the effects? Of course, there are chilling effects. ACLU said schools don't post on a bulletin board. Here are the words we are going to be searching for. Of course, it forces students to be careful and to self-censor. They might not write about things or talk about things that are not, in fact, being monitored. The idea that everything students are searching for and everything that they're writing down is going to be monitored can really inhibit growth and self-discovery. That's a quote from Natasha Duerte, a policy analyst at the Center for Democracy and Technology. And finally, it's a military technology in the United Kingdom. School surveillance technology has been already tested for use in counter-terrorism efforts. Again, I don't want to get blown up by terrorists, but I mean, I don't like all these safety processes that we have either. I mean, even here at Congress this year, we are starting to have signs, don't leave your bags unentended. I'm not sure how I feel about that. I mean, I thought it's a safe space here. The ACLU expert that referred to previously said, it's certainly fair to ask to what extent we feel comfortable with technologies first developed for use in war, being used against our children. Now let's take a moment to talk about the company name, Gaggle. According to Merriam-Wefster dictionary, gag is a verb that means to prevent from exercising freedom of speech or expression. And the other definitions for the verb to me only emphasize the non-conceptional nature of the interaction between a student, the kids, and the school. They don't have a say in that. They're being gagged, not only technologically, but also psychologically. That's unacceptable. Okay, let's talk about something else. The end-to-end encryption, or as US Attorney General William Barr called it, warrant-proof encryption. GCHQ has suggested that touch firms communication services should be able to serpitously add intelligence agents to conversations or group chats. This is still an ongoing discussion, but this is where this is going. So I've been looking at this problem and I've been thinking, I've been trying to predict how will secure and cryptic communications look in the future? Because the government really has, they have strong incentive to try and access that kind of communication because of terrorist content, because of child abuse material. So I think as a community, we managed to convince them that backdouring the crypto part is not going to work. I mean, it would work, but it's not the worst of the ideas. So what I think is actually, this is where it's going to be going. So public clients are going to be able, like public clients, I mean, WhatsApp, Facebook, and so on, they're going to be able to add the third party to your encrypted communication channel without you knowing it's going to happen in your client software. So that's what I think is going to happen. By the way, Jim Baker, the FBI's general counsel who has been working with William Barr on that proposal, had a change of heart. This is a cool article from October. This year you can take a look at it. And the guy finally understood that what he's trying to do is not the right direction to go to. Okay, let's talk about those client apps. So let's take WhatsApp as an example. If WhatsApp were doing something shady on your phone, you could stop it by routing your phone, right? That would help because then you can install background apps that monitor the traffic, that monitor the file interactions, that take a look inside the WhatsApp. And amazing. But you cannot do that. They've had that rule for some time. And it also applies, of course, to iPhones, to jailbreaking iPhones as well. But they tend to have these waves where they reinforce the rule. So it's been there for years, but they reinforce it once and again, right? So okay, I can't route my phone. What about third-party apps? Well, nope, this is actually a bit newer. It hasn't been there for that long. But if you install a third-party WhatsApp app, you're going to get banned, right? So the only question for us, the technological nerds here, is, is it going to be legal to install our beloved secure apps? But I want you to think about the other people. I want you to think about non-technological people. What are they going to do? How are you going to communicate with them? And actually, not less importantly, how will they communicate between each other? Let's take a look at another important aspect of everyone's everyday life. Watching pornography online. The Australians want to use facial recognition to verify that the people who are watching porn online are the actual people. I mean, how short-sighted have you been to not see how this can go wrong, right? Those fake emails everyone's getting, we filmed you watching porn and we filmed your face. Those are going to turn real if this is actually enforced. But another thing, right, is of course online dating. It has launched in the US this year and it rolls out in the EU next year. And I actually have a couple of things about Facebook online dating. It actually does provide you more privacy, which is good. So when you opt into Facebook dating, it not only makes sure that your dating profile is in a way anonymized and it limits the access to your actual data, it also does something to your actual Facebook profile where it tweaks the privacy settings a bit that you are a bit more private. But there's a catch. In order to opt in for Facebook dating, you have to enable location on your phone. You have to physically confirm your location. So Facebook isn't going to give us privacy for nothing. They want something in return. So not good again. Now suicide prevention is an important topic and Facebook is doing their share and I feel quite okay about that. That they're doing that. That's good. And here is the algorithm from the official, from their official spec that's available publicly. So basically, they monitor everything. By the way, people with knowledge on the subject have told me, have informed me that even if you do not post the message, even if you do not post the comment, if you decide to write that message and then delete it before send, kidding, submit, Facebook still gets that text. And they still launch it through this process here. So they use a classifier. They use some neural nets to try to understand what's happening. And the last step, well, not the last step, the one step before the last step is it's reviewed by a human person, which is the part that I dislike about this idea. So, I mean, giving that, that taking action over here actually means popping up with this. So the user basically gets this message here. I mean, I think it'd be okay to have more false positives and not have it reviewed by a human reviewer. That would be, that would be better, even though some people are more creeped out by robots reading their stuff than people reading their stuff. I'm one of those guys actually. Still on Facebook, date reuse. So there's this article. Facebook lawyer was forced to testify in court. They do that all the time this year, but that's one of these years. It's from June 2019, one of these times this year. And what they basically said is, you have no expectation of privacy. There's no privacy interest because by sharing with 100 friends, you have published. You have shared with everybody. And then they go on to compare it to a birthday party in the article where you invite couple of your close friends, like 20 friends, and you have no expectation of privacy because any of those 20 friends could go ahead and tell your stuff to anyone else. So I'm not okay with that. Remember, privacy is also about consent, and that's not fucking consent. Okay. Let's talk about something more technical, web browsing. Specifically JavaScript. The technology that fuels the modern web from dynamic web pages to tracking. This here is an interesting message that I got when trying to search for some parts on Mouser. So it says that JavaScript is disabled, so you can either enable JavaScript or log in. I mean, if that's an admission of why the JavaScript is being used, then I don't know what it is. We also have this article here. And I'm not good with German, but it's funny. It's kind of loads, but then it doesn't. So I don't know what the point of that again. They're just screwing with people like me. I mean, I used to have to browse with JavaScript disabled to have the web not work for me. Now all I get to do is browse from Europe. That's what I get. One of the comics that I read, that is the actual comic. That part on top. Everything else is trash on my screen. And it's not just that. It's open any page on your mobile and your screen. It's full of garbage, not the actual text that you want to take a look at. So this is interesting here. If you take a look at the Washington Post a bit closer, so this is what happens when you open from Europe. You have this nice blah, blah, blah, and then you can click agree and continue. And your only other option, if you don't agree to tracking, to give up your privacy, according to GDPR, is back to all options. And if you click back to all options, what you get is you can pay to access the content. So that may be legal. Washington Post is a relatively large organization. So they probably know what they're doing here. But it's not ethical at all. Now I'd like to spend the next 10 minutes to talk about why I do all of that. Why do I try to stay private in my everyday life? I tried to convince you at the beginning. Personally for me, it's care for others. Even though I don't have that much to hide, I like to provide that shelter that has immunity for the vulnerable people that really do. But it does, so me hiding stuff, me not disclosing as much as the normal person, does tend to create some curious situations. So I have a bunch of certificates. This is not the crowd I should advertise that to. I was kind of forced to get them. Anyway, so after every time that I take an exam, I have to write them a message. Because every time I take an exam, I show them my ID, my governmental ID, my secondary ID, and they still take my photo and store it. So obviously every time after the exam, I write a polite letter to them saying, thank you for the exam, please delete my stuff. And they do. But one time, they also said we did, and then I asked why the hell are my certificates gone, why can't I verify them? And this is what I said. So sorry, we misunderstood what you meant. So we deleted your whole account and all your certifications. And the funny part, when we were trying to resolve that, multiple times they basically asked, so tell us which certifications those were, because we deleted all of them all. Like I could choose any of them. At one point they said, okay, we restored them all. I took a look at my list, took a look at their list, and one was missing. So I told them, nope, look more closely here. So another thing happened to me. I got an SMS. Anyone still get SMS here in the audience? Yeah, about half the people. So I got an SMS. It didn't come from a number. It came from a spoofed source, so it's ASCII based, crediton.lv. And what it says in Latvian is basically, hello, unfortunately, your credit request has been denied, crediton.lv. I've never ever applied to any kind of credit or credit cards in my life. So I was confused. Obviously, a normal person gets SMS, what do they do? They try to phone the fuckers. They try to understand why the hell are you spamming me, because you cannot reply to that number. So I go to the web page, which is, you know, that, and I ask them, so what's up? And they don't pick up. So I phone them. I was about to ask them, and they don't connect, because my outgoing number doesn't exist. It's set to private. I use call ID barring. So they don't connect. They don't want to talk to me. So okay, the only thing I can do is I hop on my bike. Then I ride over to their office. And everything is fine. Everything is solved. I arrive there. I show them my phone. They ask my phone number. I write my phone number on a piece of paper. They take it over backstage to some IT guys. And the IT guys come back saying, nope, it's not our system. We didn't send it. And I'm okay with that. I mean, I could easily have sent that myself, right? Or you could have done it, huh? But I mean, it's fair. Someone can spoof that. It happens. I wave goodbye and I'm out. So that's that. A week later, same number. Win a shopping cart for 50 euros if you go in your profile and renew your information. So what they do? Call them up. Doesn't connect. Look at their web page again. Take my bike. Go there about one hour before the closing time. It's not open. Apparently, the opening hours in the web page are the opening hours for the phone, which doesn't work, not for the actual office. So 10 p.m. They were there. People were there. I saw them, but they didn't open the door for me. So on my way back, I go into the patrol station. I fill the bike a bit for about one euro and I have the receipt with me. So in two days, I ride back again. They're open. I fill the bike a bit, take the receipt, go there. And I show them this again. And you know what they told me? That, yeah, we looked more closely here and we found your number. Sorry. Our bad. I told them, okay. Well, it's a bit strange. You don't verify the number. Don't you have, like, requirements by law to verify these things? And they replied, yeah, we do, but only if we approve the credit. So you can apply with a bunch of random guys' numbers and get them spammed. So I thought, okay, that's a number for you, but I have these two euros that I need you to compensate because, you know, because of you, I was there or there, you lied to me and now I had to take these trips here. And so they told me to send an email. So I got the email address. I went home. I sent them an email, attached the scans. And they replied, please provide your bank account number to transfer the money. I politely and honestly replied, I do not have a bank account number that I can provide to you at this time. So that was that. They never replied. A couple weeks later, I look at my bank account and there's the fucking money. Many people have asked me at this point, why haven't I looked deeper into that? I'm too afraid what I'm going to find out. I don't know how they got my account number. I don't have the slightest clue. Now from the privacy perspective, there's one more thing you can do. If you still use post, in the post office, you can use a post office box. That means if you give someone your address, they cannot abuse it. If I can send them to sending me stuff, they can send me stuff, but they cannot break down my door because that's not my door. That's my PO box in the post office. So I don't know the prices here in Germany. In Latvia, it's their cheap. I actually have two PO boxes this year. One box costs 12 euros per year. So it's super, super cheap. Speaking of Congress, C3Post is also quite good. It's anonymous if you want it to be, and it's right behind the stage. So go send a postcard to someone you want to send a postcard to after the talk. Let's talk briefly about mobile apps. So this is Socratic. It's a mobile app that kids use to talk about homework, right, to learn. And Apple and also Google right now have actually created a good system that allows you to control, granularly control what can apps do and what they cannot do. And in this case, they ask to ask you to contact. And the thing that Apple has done is they allow the developer to actually specify whatever text they want in here. They cannot delete or change anything, but they cannot detect. So let's say it's only about chatting. It's only for chatting about homework. Don't worry. So naturally, you press don't allow, and this happens. Sorry. We kind of need that. So I hope they come today when Apple forbids apps like that, that block your experience fully just because you haven't given them a permission that should actually be optional. Now I use this taxi app called Bolt. Then they change the branding to Bolt. And this is how it looks now. I can still use it. But if I want to press on the button which you don't see on the screen, it's super, super dim over there where all my settings were, my name, my phone number, my previous rights, I cannot access it unless I have GPS enabled. So why do I need GPS to access my history? I have no idea. But that's how they do it now. But still, at least it was functional until they deleted my account because I wrote a GDPR request to them to explain what's going on and why I can't access my data. They basically said, since you have lost your trust in a server, we will terminate your account starting next month. But I mean, I still got to use it for a while. So then I switched to this other taxi that's Yandex. It may or may not be run by Russian special services. I don't know. I was using that. I took one ride. Coincidentally, it was to the airport to go to Ukraine. Coming back from Ukraine, I enabled my phone connection. Again, this is what I got. Your next ride can happen 2023. Welcome. Speaking of Yandex, they have privacy policy, of course. All companies doing business in the EU need to have that now. And it's quite okay. So they actually have the type of data, like location. They explain how they use it and they explain how you can change your data or how you can withdraw your consent of them using the data. And it's all fine here. But if we scroll down further, we see those kinds of categories. And we see the reason is to improve app performance quality. And we see that you cannot use the Mapp without giving the data. And what does that include? A lot of disk space on Android, list of installed apps on Android, device tech, characteristics like model, manufacturer, operating system, sensor information. Anyone has a camera sensor on their phone? Geez. Okay. Back to WhatsApp. I was forced to use WhatsApp because my friends use WhatsApp and I have all the apps. I'm like that guy. But I don't want to be that guy that shares your phone book with the company because then you betray your friends. So I never do that. I always click deny. So I was using WhatsApp like that and I want to show you how I found a way to create new conversations in WhatsApp without giving access to your phone book. So here, I use my regular dialer. I dial the number I want to dial. I want to chat with in WhatsApp. I press the green button. I press the red button. I go to recent. I press on the I over there. Then I hold the message button. Then I choose WhatsApp. The call button. Then I call in WhatsApp. Then I press the red button. Then I go to calls in WhatsApp. Then I open up here and then I press the chat. And I'm in the chat. Yeah. So that's how you could create a chat in WhatsApp. And could is not because you can't do it anymore, but because they fixed it. I still don't love WhatsApp, but now they actually fixed the button for the people, for those of us who do not have the other book. So that's something. I mean, it doesn't make them perfect, but now I don't have to do that. So that's cool. I also use these things. Do you have them here in Germany? The prepaid anonymous cards. You can just buy them in the shop. Yeah? Okay. So I use these a lot since I don't have any other kind of banking cards. And if you notice, it doesn't have a name. This just says term of use one year maximum. So I decided I have to be fair. And when I buy something online, I have to write as it is. So I try to do a bunch of stuff by leaving the name on the card blank. That's just the placeholder. It's on the road. And it gives nice errors like a pork bun, a DNS register here, gives a kind of technical error so you can work from there. But for these cards, of course, you can write any name that you want and it just works. Now if you take a look at this picture here, I took that in Vienna. It's everywhere. I don't like to waste time. So I always on longer rides, I try to work. I open my laptop, but I cannot work on a bus. They will see my passwords. I don't know what kind of resolution they have. I don't know if it's a 30 FPS camera or it's a 240 FPS camera. Who the hell knows? So you can't work there. And the private information on my screen, information of my customers, it's also at risk. So basically the only place you can still work are airplanes. Although I did see one airplane that has a camera already from the cockpit to the cabin on the door instead of the usual analog systems that they use. So luckily airlines want to save weight so they probably are not going to install cameras on all seats even though I've seen news about some low budget carriers installing cameras in the entertainment systems on every seat. And they actually have been confronted about that and they told everybody that we want to evaluate it. Basically they use different wording but they want to track people like we do online. We want to see how they interact with our product. Now speaking of airports, right? Airplanes are mostly good but they have these things. In some airports it's actually considered a privilege. I was coming here from Riga through the fast track and they referred me to secondary and the position of this thing in the Riga airport and me going there through multiple times a month actually suggested to me that they only use this for fast track travelers. It's a feature, not a bug, right? You get magnetic for an L and pad down and here you get this. But you can still opt out of course, even in the UK. UK tried to ditch that. European courts ruled that it's not allowed. Now until Brexit happens we're good including the UK. Around the world it differs. My main concern is that it's not that I'm going to be seen naked. It's the artificial intelligence, the robots taking decisions in a non-transparent way about me. I mean it's going to beep or whatever anyway. Just pat me down. I'm not even talking about transgender people because for these things, the first thing the operator has to do, they have to select the, I don't know if it's meant to be sex or gender but they have to select a pictogram of who's going in the system. Boarding passes. Boarding passes are cool except totally insecure. They can accept USA, they do have a signature part where you can sign it. But you know, they're really secure. But my problem with boarding passes is shopping, especially in Germany. They fixed something two years ago and now you cannot buy a single thing in the airport without showing the boarding pass after you go through security. So I hate that. And what I'm going to do is I'm going to spend the Congress to work on an app. I'm going to present it in March in Stomnihak in Switzerland. I'm going to have a talk called travel for hackers. I'm going to talk about how to safely travel, what can you take and what you cannot take to different countries. And I'm also going to have this app. But you have to promise to only use it for shopping, not for boarding or accessing airport lounges. Anyway, you can, using this app you'll be able to anonymize your boarding pass like point and click. And then you can go shop, right? Don't use it for bad stuff or I might get thrown in jail. I don't want that. Do we? Another thing. What is secure? I mean, airports, you have boarding passes, we have these scanners. Fingerprints are secure. Unless you use them as your password, that's dumb. But fingerprints are good. So back, I think it was 10 years ago when Latvia started to enroll into this ICIO program for biometric passports. And before that, they just told everybody we don't need your fingerprints because we had no biometric passports. That's fine. Now, that changed to we only store fingerprints in your passports. And that's an acceptable compromise. I mean, I see how that can improve travel safety as opposed to the dump limitations we have on the liquids that we can carry. But I have told you the story how I tried to carry ice through airport security in Belgium. They told me it was a liquid. We argued with them for about 30 minutes and then they won because then it became liquid. True story. I gave up. I just threw it away. Yeah. So, I mean, they have their own physics. So back to passport, right? So we only store fingerprints in passports. So okay. But then I learned somehow that, you know, they might somehow save that. I talked to some friends in the Ministry of Interior and that's what they told me. Well, that's what someone hinted me. And the thing is, what happened then is there was a rush to create a law that's called on biometric data storage. So they wanted to legalize storing a hash in the database. That's their current answer. If you ask them what do you do with a fingerprint, we store the hash on a fingerprint database. And hash is safer. Why? Because if I do stuff that annoys my government, they cannot download my fingerprint from database and put it on a dead guy somewhere. Hash is hash, right? So what I did is I used the kind of GDPR. We had the GDPR since 2001 in Latvia. A similar thing. It was basically the same. Only the fines were up to 1,000 euros. But everything else was the same. So I used that to request my data from the government to take a look at the hash. So they sent me the hash. VSQ. It's an FBI's Wavelet's Qualification Algorithm. It's an algorithm that can be used to compress black and white images. I got these two files left and right, finger. And I did manage to find the only resource on the Internet, and it was GitHub, actually, that contains an algorithm to open it up. And yeah, my fingerprint isn't there. That's not an actual fingerprint, but you got it there. So my whole damn fingerprint is there. That's the repo I used. Let's summarize. So what's the status quo right now? I want to talk about multiple aspects. First of all, user demand. As you see, I marked it with a frowny face. Users, and I'm talking about people outside this conference, do not really care about privacy. They don't need private apps. They're okay with being filmed. They're okay with being, with their fingerprints being taken. I think most people would be okay with their palm print being taken. Maybe even a blood sample if it only happens once in four years. So that's romantic. The cookie law. If someone remembers that, we have that in the EU. We've had it for a couple years now. Well, it did nothing. It basically did this, that every site had to open one more banner and inform us that, hey, cookies are being used. And we did have the DNT header in HTTP. It was a great idea. I took a look at what happened, and it basically just randomly died within some discussion group. So maybe we should revive that, because that's perfect. Inform your browser if you want to be not tracked. And the website should be mandated to not show you the banner, but to actually take care of honoring that header. A GDPR for big data? That's actually crap. Big companies have ways, both legal and technical, to get around GDPR currently. And GDPR enforcement cannot reach them. I mean, if something happens that can be proven, fines are big, and those fines are going to be paid, I hope. But GDPR still can be improved there. Now, GDPR in general, that's great. That actually allows us to stand for our rights. Go and ask them about what data are you holding on me. Go and ask them to delete the data, to change your data. They need to be on their toes and need to know that we are looking at what they're doing. But the problem is, all these things are EU only. I mean, cookie law is the other thing. GDPR is EU only, so we have to make sure that other governments around the world adopt something similar. Surveillance technology is getting worse and worse. We have different technology being advertised, both as a military tool and a tool to track your kids and wife. That's not okay. And for encryption, I use average face, neutral face here, because encryption is good, right? Anyone who knows how, say, AES works or a virtual algorithm, you can take a look at that, and it's great. It's unbreakable if you implement correctly and use right key sizes. There are two problems. It's not being implemented correctly in some places, and most importantly, as a user, you have no idea if the app is actually using encryption for that part or it's bypassing encryption entirely or using something else. So that's problematic. Would any of you notice that your favorite chatting app sends a copy of your message somewhere even though the original copy is encrypted? So what do we do? How can you fix it? Now, let's not talk about cookie load, that's not that interesting. For user demand and GDPR, the same thing. We have to inform users that there's GDPR, and first hand, we have to tell them that it's good. You can use it, and privacy is good. This is how it will help you. This is how it will help your friends. This is how it will help other people online. GDPR for big data. Most of work needs to be done if there are any lobbies in the room. If you have contacts in European Parliament, that's where you go in. We need to fix GDPR so it works better for big data. Because big data is pseudonymized and you cannot do anything with it, right? It's safe, but it's not. Now for surveillance technology and encryption, this needs to be fixed by us here. We are the only ones with the technical expertise to actually try and fix these things. Privacy and indeed human rights are a relatively recent invention. They've been among us for a hundred, maybe 200 years, which is why, at least in my eyes, it's even more deplorable to see corporations and governments alike hastily eating away at our right to privacy for their own benefit. Privacy shouldn't be a luxury that only the rich and powerful can afford. Privacy is for everyone. Privacy is a fundamental right. And like with all fundamental rights, any encroachment on them needs to be aggressively and decisively terminated. Thank you so much. Thank you, Kirils, for your great talk. Unfortunately we don't have time for questions. But yeah, I think there was a lot of content in that. And if you have any questions, contact him. All the details are here. So enjoy all the interaction and enjoy the rest of the Congress. Thanks. And perhaps you did give quite a bit of a run to copyright, just a little bit to this moment. you
 So I'm very happy to announce for the second talk of the day Kirill Solovs-Jovs.  He's a lead researcher at possible security and he's a bug bounty hunter.  He's an IT policy activist and a white hat hacker from Latvia and he's talking today about  nothing to hide, go out and fix your privacy.  Some citizens complain about being under surveillance but they are told that if you have nothing  to hide, they have nothing to fear.  Still news media regularly cover cases where citizens with unusual behavior are put on  suspicion lists even though they have broken no laws.  Now this is a quote from a news article from European digital rights newspaper, Eddrogram  number 300.  Anyone here took math in college?  Mathematical logic?  Some?  So you can tell me what this means.  So basically what it says here on the screen is for every person that belongs to the group  of criminals, that person also belongs to the group of people who are hiding something.  That funky sign in the middle means from that statement follows that for every person that  has something to hide, that person also belongs to the group of criminals.  How many of you think this is correct?  No one?  Great.  It's of course wrong but it is a really common fallacy.  I hear that a lot.  Now what even is privacy though?  Privacy first of all is the autonomous right to choose.  Who will work with my data?  So maybe I'm fine with company A working with my data but I'm not okay with company B working  with my data.  Also how the information is processed.  So maybe I am okay for Amazon to process my home address to send me a package but I do  not consent to Amazon sending goons to my house to get money out of me.  And of course what information is processed.  Even though I'm okay with giving my address, maybe I'm not okay with giving my phone number.  But it's not only that.  It's also right to decide who I interact with.  That includes right to be left alone.  So in a sense privacy is also about consent in a lot of ways.  Now to illustrate this is a bit better.  To try to transfer my feeling to you I created this concept of Schrodinger's video camera.  You may have heard of Schrodinger's cat.  Schrodinger's video camera goes something like that.  Imagine you just bought a new apartment somewhere in Paris.  Great view.  Nice building.  And then one day you notice that a security camera has showed up outside your window on  the open side.  It has one of these non-transparent domes and you cannot see inside it.  You cannot see if it's looking at you or not.  You can't even tell if there's a camera inside or if it's completely fake.  But for me it doesn't matter.  The feeling I get is terrible either way.  Even if someone told me that there's no camera in there, even if someone showed me that there's  no camera in there, I wouldn't feel at ease.  So that's why for me privacy is in many ways the feeling of privacy.  Now exactly one year ago at this stage I gave a talk, a talk of personal privacy in 2018.  I just want to acknowledge some reactions that I've been getting since the talk.  So some of the reactions are funny.  Some of them are affirmative.  Others are insightful.  Of course others are just plain uninformed because you do not have to actually use a  phone even though it's hard but you don't have to.  Even more so you don't actually have to use Facebook.  But these two remaining arguments I want to talk closer about these two.  So here's a short video.  Some of you may have seen it.  So it's a video of a lady trying to unlock the man's phone with a face ID.  Now it's clear from this that it's fake.  At least it's a sketch.  It's clearly visible.  But what I want to talk about is the reactions.  And I'm outraged by the reactions.  All the main topic of the video aside, all these people here assume that since he has  something to hide, he did something wrong, which is unacceptable to me.  So what if you really got nothing to hide?  Maybe we have people in the audience here even though I doubt that have nothing to hide.  I'm sure we have some people like that watching the stream, not here at the congress.  So what about data hoarding?  What if someone will say a government or a large corporation these days, maybe that's  more likely, collects enough data about you that allows them to more easily blackmail  you, that allows them to impersonate you?  Even if that's not the case, think about herd immunity.  That's a concept used in vaccinations.  You should get vaccinated because some people medically can't and you will also protect  them by providing human shield if we can so say.  The same applies for privacy.  There's herd immunity in privacy.  So many people not hiding anything will make it really hard for the few who actually have  something to hide.  And it doesn't have to be anything criminal or nefarious.  Many people have legitimate reasons to hide things.  And by accepting that you're okay with not hiding anything, by giving up your right to  privacy, you're also helping those people that actually need privacy to give up their  right as well.  And of course, remember that today's authority might become to tell Terian or inhumane.  We see the transformation process starting in a couple of western countries right now  and I don't know where it's going to lead us in the next years, but it may be the case.  Imagine how much easier would it have been for Adolf to have committed his atrocities  here in Germany if he had Facebook, if he had access to all the data?  I hope that's not coming back, never.  Now what I want to talk about now is a state of privacy.  I want to take a look at what's happening around the world.  And what's happening around the world, of course, is there are these protests in Hong  Kong going on.  So this is an article from middle of this year.  And people in Hong Kong, they're really aware of tracking that their transportation cards  can be used to track where they move.  So they try to avoid that.  We are afraid of having our data tracked is what they say.  So that's good.  People are getting more aware.  But it's also happening in the West.  Los Angeles decided, passed a law basically, that all the scooter sharing companies have  to share real-time scooter location data with the government.  And Uber, even though I dislike their methods and trying to disobey the law wherever possible,  I think they took the right stand.  All the other companies actually are ready to give the data and are giving the data to  the government.  Uber is the only one who questioned this and tried to fight against that.  The idea behind that is a good idea.  So the government wants to make sure that the communities, the geographical communities  where underrepresented people live or under privileged nationalization shall say, that  they also get the scooters.  They don't target just the rich neighborhoods.  So that's good.  But do they really need real-time tracking for that?  I doubt that.  Now my favorite topic of CCTV, of course, this is the only slide from the last year  that I included here.  These are actual posters for those of you who haven't seen them from the UK, how the government  is telling you that CCTV is good.  So what's new?  Well, this happened.  Beginning of this year, so in May this year, a man was stopped by the police.  All he did, he was walking by and someone warned him that there is facial recognition  going on over there.  So what he did, he pulled over his sweater, he pulled it over his face and walked by.  Police stopped him, forced him to scan his face, found nothing wrong and fined him 90  pounds for trying to evade the facial recognition.  So it's super disturbing and super creepy.  But I mean, there are ways around that, right?  We could use this cap, for example, and have a face of, I don't know, general secretary  of a Communist Party somewhere.  So then you're not trackable, not attracting attention, right?  There is this law in Hong Kong that doesn't allow you to use masks anymore in the protests.  And it's problematic because they track everyone through facial recognition.  So that's why the mask was allegedly created.  The good news is, it's a relatively recent news, in November it was ruled, it's a system,  political system in Hong Kong is complicated, but Hong Kong court ruled that it's illegal  to ban wearing masks.  And the full hearing in the next level of court is still going to happen in January next year.  But currently, the law is suspended.  Currently you can actually wear masks.  I mean, I don't know if police actually are okay with that, but by law you can.  Now, privacy advocates, me included, have always been complaining about not being able  to use public Wi-Fi without a phone number.  Finally we can.  We have an option to take a selfie and upload the passports.  It's just terrible.  Oh my God.  Let's get back to facial recognition for a second.  So European countries are trying to copy and paste the idea that China is doing.  It's not just China, it's not just Russia.  But the difference is they are asking for permission.  So why are they asking for permission?  Well.  And now that they've got a negative answer, the question is, will they listen?  Yes, they will.  Because European data protection board finds a school in Sweden because of using facial  recognition.  I mean, thanks to whoever made it, but we have GDPR.  So we do have some protection in Europe.  Unfortunately, not all of us here and not all of us watching this stream are so lucky  to have that kind of regulation.  But it does actually work.  Even though I've been hearing bad things about GDPR, yes, there are things to improve.  But it does work.  It does help us.  Now, as you were told, I come from Latvia, and I want to share something from Latvia.  This is a picture I took at a press event in Riga.  So police were presenting their new vehicle, this one over here.  And this vehicle, the idea is it will automatically find people for not wearing seat belts, talking  on the phone, not showing turn signals.  So it has a bunch of 360-degree cameras in there and doing some fancy stuff.  I mean, I'm all for traffic safety, but check this out.  I mean, I like that they do have a sense of humor.  I guess BB was taken, so I mean, they decided to go with GC, which is okay, which is the  one that police use, but still, or we'll be proud.  So another slide from my previous presentation.  So People's Daily China was telling how cool it is that in classrooms you can actually  now use surveillance cameras to track the progress of students.  Are they learning?  Are they focusing?  And so on.  Well, what's new?  What happened in 2019?  Anyone knows?  This happened.  Brain scans.  So let's take a look at this short video here.  Teachers at this primary school in China know exactly when someone isn't paying attention.  These headbands measure each student's level of concentration.  The information is then directly sent to the teacher's computer and to parents.  China has big plans to become a global leader in artificial intelligence.  It has enabled a cashless economy where people make purchases with their faces.  A giant network of surveillance cameras with facial recognition helps police monitor citizens.  Meanwhile, some schools offer glimpses of what the future of high-tech education in  the country might look like.  Students have robots that analyze students' health and engagement levels.  Students wear uniforms with chips that track their locations.  There are even surveillance cameras that monitor how often students check their phones or  yawn during classes.  These gadgets have alarmed Chinese netizens.  Now, that's screwed up beyond repair, if you ask me.  But luckily, just happening in China, right?  No.  U.S., America.  So there's a great article.  I invited you to read it in Fall in the Guardian, published in October 2022 this year, about  how they use digital surveillance for American kids or against American kids, I shall say.  I will read you some of the quotes from the article.  I divided this article into multiple categories so it's easier for you to understand.  First of all, the reason why is anyone doing that?  I mean, it's not China.  It's not the national communism.  You're not supposed to spy on people, at least unless you're the government in the  U.S.  So the reason is that lawsuits by parents of students who have committed suicide or parents  of children who have been cyberbullied is a problem for the schools.  So they see this as an easy solution.  They track everything students do and then they are office code free.  I mean, from the perspective of the school's lawyer, even if the kid does commit suicide,  their assets are covered because they have this great system and they did everything  they could.  So it's kind of a loose, loose situation there.  Now what was reaction time?  So as the article says, it's not, I've sent this email two days ago.  You've sent this email three minutes ago.  Come to my office, let's talk.  That's the speed, that's the latency, that's the reaction time of the system.  In Veldt County, Colorado, a student emailed a teacher that she heard two boys were about  to smoke weed in a bathroom.  And school is proud of this.  Within four minutes of sending the email, troops were deployed to the bathroom.  Scope.  So I mean, it's getting worse and worse.  So I'm going to get ready for that, prepare for that.  So it's not just about what they do at school.  24 hours a day, whether students are in their classrooms or their bedrooms, the monitoring  is going on.  Of course, I'm not talking about video cameras here, but the content monitoring.  Tech companies are also working with schools to monitor students' web searches and internet  usage.  And in some cases, track what they are writing in their private social media accounts.  Gaggle, which is the name of one of the companies providing the service in the US, also automatically  sends students a scolding email every time they use a profanity.  How is that for a chilling effect?  Now with all that, what's the justification?  Some proponents of the school monitoring say that the technology is part of educating today's  students in how to be good digital citizens.  What does that mean?  Well, allegedly, it helps trained students for constant surveillance after they graduate.  That's the actual quote from the justification of this system.  And here's another quote from Bill McCullough, a Gaggle spokesperson.  Take an adult in the workforce.  You can't type anything you want in your work email.  It's being looked at.  So their idea is, you know, let's do this to our kids in schools and then prepare them  for that.  What are the effects?  Of course, there are chilling effects.  ACLU said schools don't post on a bulletin board.  Here are the words we are going to be searching for.  Of course, it forces students to be careful and to self-censor.  They might not write about things or talk about things that are not, in fact, being monitored.  The idea that everything students are searching for and everything that they're writing down  is going to be monitored can really inhibit growth and self-discovery.  That's a quote from Natasha Duerte, a policy analyst at the Center for Democracy and Technology.  And finally, it's a military technology in the United Kingdom.  School surveillance technology has been already tested for use in counter-terrorism efforts.  Again, I don't want to get blown up by terrorists, but I mean, I don't like all these safety  processes that we have either.  I mean, even here at Congress this year, we are starting to have signs, don't leave your  bags unentended.  I'm not sure how I feel about that.  I mean, I thought it's a safe space here.  The ACLU expert that referred to previously said, it's certainly fair to ask to what extent  we feel comfortable with technologies first developed for use in war, being used against  our children.  Now let's take a moment to talk about the company name, Gaggle.  According to Merriam-Wefster dictionary, gag is a verb that means to prevent from exercising  freedom of speech or expression.  And the other definitions for the verb to me only emphasize the non-conceptional nature  of the interaction between a student, the kids, and the school.  They don't have a say in that.  They're being gagged, not only technologically, but also psychologically.  That's unacceptable.  Okay, let's talk about something else.  The end-to-end encryption, or as US Attorney General William Barr called it, warrant-proof  encryption.  GCHQ has suggested that touch firms communication services should be able to serpitously add  intelligence agents to conversations or group chats.  This is still an ongoing discussion, but this is where this is going.  So I've been looking at this problem and I've been thinking, I've been trying to predict  how will secure and cryptic communications look in the future?  Because the government really has, they have strong incentive to try and access that kind  of communication because of terrorist content, because of child abuse material.  So I think as a community, we managed to convince them that backdouring the crypto part is not  going to work.  I mean, it would work, but it's not the worst of the ideas.  So what I think is actually, this is where it's going to be going.  So public clients are going to be able, like public clients, I mean, WhatsApp, Facebook,  and so on, they're going to be able to add the third party to your encrypted communication  channel without you knowing it's going to happen in your client software.  So that's what I think is going to happen.  By the way, Jim Baker, the FBI's general counsel who has been working with William  Barr on that proposal, had a change of heart.  This is a cool article from October.  This year you can take a look at it.  And the guy finally understood that what he's trying to do is not the right direction to  go to.  Okay, let's talk about those client apps.  So let's take WhatsApp as an example.  If WhatsApp were doing something shady on your phone, you could stop it by routing your  phone, right?  That would help because then you can install background apps that monitor the traffic,  that monitor the file interactions, that take a look inside the WhatsApp.  And amazing.  But you cannot do that.  They've had that rule for some time.  And it also applies, of course, to iPhones, to jailbreaking iPhones as well.  But they tend to have these waves where they reinforce the rule.  So it's been there for years, but they reinforce it once and again, right?  So okay, I can't route my phone.  What about third-party apps?  Well, nope, this is actually a bit newer.  It hasn't been there for that long.  But if you install a third-party WhatsApp app, you're going to get banned, right?  So the only question for us, the technological nerds here, is, is it going to be legal to  install our beloved secure apps?  But I want you to think about the other people.  I want you to think about non-technological people.  What are they going to do?  How are you going to communicate with them?  And actually, not less importantly, how will they communicate between each other?  Let's take a look at another important aspect of everyone's everyday life.  Watching pornography online.  The Australians want to use facial recognition to verify that the people who are watching  porn online are the actual people.  I mean, how short-sighted have you been to not see how this can go wrong, right?  Those fake emails everyone's getting, we filmed you watching porn and we filmed your face.  Those are going to turn real if this is actually enforced.  But another thing, right, is of course online dating.  It has launched in the US this year and it rolls out in the EU next year.  And I actually have a couple of things about Facebook online dating.  It actually does provide you more privacy, which is good.  So when you opt into Facebook dating, it not only makes sure that your dating profile is  in a way anonymized and it limits the access to your actual data, it also does something  to your actual Facebook profile where it tweaks the privacy settings a bit that you are a  bit more private.  But there's a catch.  In order to opt in for Facebook dating, you have to enable location on your phone.  You have to physically confirm your location.  So Facebook isn't going to give us privacy for nothing.  They want something in return.  So not good again.  Now suicide prevention is an important topic and Facebook is doing their share and I feel  quite okay about that.  That they're doing that.  That's good.  And here is the algorithm from the official, from their official spec that's available  publicly.  So basically, they monitor everything.  By the way, people with knowledge on the subject have told me, have informed me that  even if you do not post the message, even if you do not post the comment, if you decide  to write that message and then delete it before send, kidding, submit, Facebook still gets  that text.  And they still launch it through this process here.  So they use a classifier.  They use some neural nets to try to understand what's happening.  And the last step, well, not the last step, the one step before the last step is it's  reviewed by a human person, which is the part that I dislike about this idea.  So, I mean, giving that, that taking action over here actually means popping up with this.  So the user basically gets this message here.  I mean, I think it'd be okay to have more false positives and not have it reviewed by a human  reviewer.  That would be, that would be better, even though some people are more creeped out by  robots reading their stuff than people reading their stuff.  I'm one of those guys actually.  Still on Facebook, date reuse.  So there's this article.  Facebook lawyer was forced to testify in court.  They do that all the time this year, but that's one of these years.  It's from June 2019, one of these times this year.  And what they basically said is, you have no expectation of privacy.  There's no privacy interest because by sharing with 100 friends, you have published.  You have shared with everybody.  And then they go on to compare it to a birthday party in the article where you invite couple  of your close friends, like 20 friends, and you have no expectation of privacy because  any of those 20 friends could go ahead and tell your stuff to anyone else.  So I'm not okay with that.  Remember, privacy is also about consent, and that's not fucking consent.  Okay.  Let's talk about something more technical, web browsing.  Specifically JavaScript.  The technology that fuels the modern web from dynamic web pages to tracking.  This here is an interesting message that I got when trying to search for some parts  on Mouser.  So it says that JavaScript is disabled, so you can either enable JavaScript or log in.  I mean, if that's an admission of why the JavaScript is being used, then I don't know  what it is.  We also have this article here.  And I'm not good with German, but it's funny.  It's kind of loads, but then it doesn't.  So I don't know what the point of that again.  They're just screwing with people like me.  I mean, I used to have to browse with JavaScript disabled to have the web not work for me.  Now all I get to do is browse from Europe.  That's what I get.  One of the comics that I read, that is the actual comic.  That part on top.  Everything else is trash on my screen.  And it's not just that.  It's open any page on your mobile and your screen.  It's full of garbage, not the actual text that you want to take a look at.  So this is interesting here.  If you take a look at the Washington Post a bit closer, so this is what happens when  you open from Europe.  You have this nice blah, blah, blah, and then you can click agree and continue.  And your only other option, if you don't agree to tracking, to give up your privacy, according  to GDPR, is back to all options.  And if you click back to all options, what you get is you can pay to access the content.  So that may be legal.  Washington Post is a relatively large organization.  So they probably know what they're doing here.  But it's not ethical at all.  Now I'd like to spend the next 10 minutes to talk about why I do all of that.  Why do I try to stay private in my everyday life?  I tried to convince you at the beginning.  Personally for me, it's care for others.  Even though I don't have that much to hide, I like to provide that shelter that has immunity  for the vulnerable people that really do.  But it does, so me hiding stuff, me not disclosing as much as the normal person, does tend to  create some curious situations.  So I have a bunch of certificates.  This is not the crowd I should advertise that to.  I was kind of forced to get them.  Anyway, so after every time that I take an exam, I have to write them a message.  Because every time I take an exam, I show them my ID, my governmental ID, my secondary  ID, and they still take my photo and store it.  So obviously every time after the exam, I write a polite letter to them saying, thank  you for the exam, please delete my stuff.  And they do.  But one time, they also said we did, and then I asked why the hell are my certificates  gone, why can't I verify them?  And this is what I said.  So sorry, we misunderstood what you meant.  So we deleted your whole account and all your certifications.  And the funny part, when we were trying to resolve that, multiple times they basically  asked, so tell us which certifications those were, because we deleted all of them all.  Like I could choose any of them.  At one point they said, okay, we restored them all.  I took a look at my list, took a look at their list, and one was missing.  So I told them, nope, look more closely here.  So another thing happened to me.  I got an SMS.  Anyone still get SMS here in the audience?  Yeah, about half the people.  So I got an SMS.  It didn't come from a number.  It came from a spoofed source, so it's ASCII based, crediton.lv.  And what it says in Latvian is basically, hello, unfortunately, your credit request  has been denied, crediton.lv.  I've never ever applied to any kind of credit or credit cards in my life.  So I was confused.  Obviously, a normal person gets SMS, what do they do?  They try to phone the fuckers.  They try to understand why the hell are you spamming me, because you cannot reply to that  number.  So I go to the web page, which is, you know, that, and I ask them, so what's up?  And they don't pick up.  So I phone them.  I was about to ask them, and they don't connect, because my outgoing number doesn't exist.  It's set to private.  I use call ID barring.  So they don't connect.  They don't want to talk to me.  So okay, the only thing I can do is I hop on my bike.  Then I ride over to their office.  And everything is fine.  Everything is solved.  I arrive there.  I show them my phone.  They ask my phone number.  I write my phone number on a piece of paper.  They take it over backstage to some IT guys.  And the IT guys come back saying, nope, it's not our system.  We didn't send it.  And I'm okay with that.  I mean, I could easily have sent that myself, right?  Or you could have done it, huh?  But I mean, it's fair.  Someone can spoof that.  It happens.  I wave goodbye and I'm out.  So that's that.  A week later, same number.  Win a shopping cart for 50 euros if you go in your profile and renew your information.  So what they do?  Call them up.  Doesn't connect.  Look at their web page again.  Take my bike.  Go there about one hour before the closing time.  It's not open.  Apparently, the opening hours in the web page are the opening hours for the phone, which  doesn't work, not for the actual office.  So 10 p.m.  They were there.  People were there.  I saw them, but they didn't open the door for me.  So on my way back, I go into the patrol station.  I fill the bike a bit for about one euro and I have the receipt with me.  So in two days, I ride back again.  They're open.  I fill the bike a bit, take the receipt, go there.  And I show them this again.  And you know what they told me?  That, yeah, we looked more closely here and we found your number.  Sorry.  Our bad.  I told them, okay.  Well, it's a bit strange.  You don't verify the number.  Don't you have, like, requirements by law to verify these things?  And they replied, yeah, we do, but only if we approve the credit.  So you can apply with a bunch of random guys' numbers and get them spammed.  So I thought, okay, that's a number for you, but I have these two euros that I need you  to compensate because, you know, because of you, I was there or there, you lied to me  and now I had to take these trips here.  And so they told me to send an email.  So I got the email address.  I went home.  I sent them an email, attached the scans.  And they replied, please provide your bank account number to transfer the money.  I politely and honestly replied, I do not have a bank account number that I can provide to  you at this time.  So that was that.  They never replied.  A couple weeks later, I look at my bank account and there's the fucking money.  Many people have asked me at this point, why haven't I looked deeper into that?  I'm too afraid what I'm going to find out.  I don't know how they got my account number.  I don't have the slightest clue.  Now from the privacy perspective, there's one more thing you can do.  If you still use post, in the post office, you can use a post office box.  That means if you give someone your address, they cannot abuse it.  If I can send them to sending me stuff, they can send me stuff, but they cannot break down  my door because that's not my door.  That's my PO box in the post office.  So I don't know the prices here in Germany.  In Latvia, it's their cheap.  I actually have two PO boxes this year.  One box costs 12 euros per year.  So it's super, super cheap.  Speaking of Congress, C3Post is also quite good.  It's anonymous if you want it to be, and it's right behind the stage.  So go send a postcard to someone you want to send a postcard to after the talk.  Let's talk briefly about mobile apps.  So this is Socratic.  It's a mobile app that kids use to talk about homework, right, to learn.  And Apple and also Google right now have actually created a good system that allows you to control,  granularly control what can apps do and what they cannot do.  And in this case, they ask to ask you to contact.  And the thing that Apple has done is they allow the developer to actually specify whatever  text they want in here.  They cannot delete or change anything, but they cannot detect.  So let's say it's only about chatting.  It's only for chatting about homework.  Don't worry.  So naturally, you press don't allow, and this happens.  Sorry.  We kind of need that.  So I hope they come today when Apple forbids apps like that, that block your experience  fully just because you haven't given them a permission that should actually be optional.  Now I use this taxi app called Bolt.  Then they change the branding to Bolt.  And this is how it looks now.  I can still use it.  But if I want to press on the button which you don't see on the screen, it's super, super  dim over there where all my settings were, my name, my phone number, my previous rights,  I cannot access it unless I have GPS enabled.  So why do I need GPS to access my history?  I have no idea.  But that's how they do it now.  But still, at least it was functional until they deleted my account because I wrote a  GDPR request to them to explain what's going on and why I can't access my data.  They basically said, since you have lost your trust in a server, we will terminate your  account starting next month.  But I mean, I still got to use it for a while.  So then I switched to this other taxi that's Yandex.  It may or may not be run by Russian special services.  I don't know.  I was using that.  I took one ride.  Coincidentally, it was to the airport to go to Ukraine.  Coming back from Ukraine, I enabled my phone connection.  Again, this is what I got.  Your next ride can happen 2023.  Welcome.  Speaking of Yandex, they have privacy policy, of course.  All companies doing business in the EU need to have that now.  And it's quite okay.  So they actually have the type of data, like location.  They explain how they use it and they explain how you can change your data or how you can  withdraw your consent of them using the data.  And it's all fine here.  But if we scroll down further, we see those kinds of categories.  And we see the reason is to improve app performance quality.  And we see that you cannot use the Mapp without giving the data.  And what does that include?  A lot of disk space on Android, list of installed apps on Android, device tech, characteristics  like model, manufacturer, operating system, sensor information.  Anyone has a camera sensor on their phone?  Geez.  Okay.  Back to WhatsApp.  I was forced to use WhatsApp because my friends use WhatsApp and I have all the apps.  I'm like that guy.  But I don't want to be that guy that shares your phone book with the company because then  you betray your friends.  So I never do that.  I always click deny.  So I was using WhatsApp like that and I want to show you how I found a way to create new  conversations in WhatsApp without giving access to your phone book.  So here, I use my regular dialer.  I dial the number I want to dial.  I want to chat with in WhatsApp.  I press the green button.  I press the red button.  I go to recent.  I press on the I over there.  Then I hold the message button.  Then I choose WhatsApp.  The call button.  Then I call in WhatsApp.  Then I press the red button.  Then I go to calls in WhatsApp.  Then I open up here and then I press the chat.  And I'm in the chat.  Yeah.  So that's how you could create a chat in WhatsApp.  And could is not because you can't do it anymore, but because they fixed it.  I still don't love WhatsApp, but now they actually fixed the button for the people, for those  of us who do not have the other book.  So that's something.  I mean, it doesn't make them perfect, but now I don't have to do that.  So that's cool.  I also use these things.  Do you have them here in Germany?  The prepaid anonymous cards.  You can just buy them in the shop.  Yeah?  Okay.  So I use these a lot since I don't have any other kind of banking cards.  And if you notice, it doesn't have a name.  This just says term of use one year maximum.  So I decided I have to be fair.  And when I buy something online, I have to write as it is.  So I try to do a bunch of stuff by leaving the name on the card blank.  That's just the placeholder.  It's on the road.  And it gives nice errors like a pork bun, a DNS register here, gives a kind of technical  error so you can work from there.  But for these cards, of course, you can write any name that you want and it just works.  Now if you take a look at this picture here, I took that in Vienna.  It's everywhere.  I don't like to waste time.  So I always on longer rides, I try to work.  I open my laptop, but I cannot work on a bus.  They will see my passwords.  I don't know what kind of resolution they have.  I don't know if it's a 30 FPS camera or it's a 240 FPS camera.  Who the hell knows?  So you can't work there.  And the private information on my screen, information of my customers, it's also at  risk.  So basically the only place you can still work are airplanes.  Although I did see one airplane that has a camera already from the cockpit to the cabin  on the door instead of the usual analog systems that they use.  So luckily airlines want to save weight so they probably are not going to install cameras  on all seats even though I've seen news about some low budget carriers installing cameras  in the entertainment systems on every seat.  And they actually have been confronted about that and they told everybody that we want  to evaluate it.  Basically they use different wording but they want to track people like we do online.  We want to see how they interact with our product.  Now speaking of airports, right?  Airplanes are mostly good but they have these things.  In some airports it's actually considered a privilege.  I was coming here from Riga through the fast track and they referred me to secondary and  the position of this thing in the Riga airport and me going there through multiple times  a month actually suggested to me that they only use this for fast track travelers.  It's a feature, not a bug, right?  You get magnetic for an L and pad down and here you get this.  But you can still opt out of course, even in the UK.  UK tried to ditch that.  European courts ruled that it's not allowed.  Now until Brexit happens we're good including the UK.  Around the world it differs.  My main concern is that it's not that I'm going to be seen naked.  It's the artificial intelligence, the robots taking decisions in a non-transparent way about  me.  I mean it's going to beep or whatever anyway.  Just pat me down.  I'm not even talking about transgender people because for these things, the first thing  the operator has to do, they have to select the, I don't know if it's meant to be sex  or gender but they have to select a pictogram of who's going in the system.  Boarding passes.  Boarding passes are cool except totally insecure.  They can accept USA, they do have a signature part where you can sign it.  But you know, they're really secure.  But my problem with boarding passes is shopping, especially in Germany.  They fixed something two years ago and now you cannot buy a single thing in the airport  without showing the boarding pass after you go through security.  So I hate that.  And what I'm going to do is I'm going to spend the Congress to work on an app.  I'm going to present it in March in Stomnihak in Switzerland.  I'm going to have a talk called travel for hackers.  I'm going to talk about how to safely travel, what can you take and what you cannot take  to different countries.  And I'm also going to have this app.  But you have to promise to only use it for shopping, not for boarding or accessing airport  lounges.  Anyway, you can, using this app you'll be able to anonymize your boarding pass like  point and click.  And then you can go shop, right?  Don't use it for bad stuff or I might get thrown in jail.  I don't want that.  Do we?  Another thing.  What is secure?  I mean, airports, you have boarding passes, we have these scanners.  Fingerprints are secure.  Unless you use them as your password, that's dumb.  But fingerprints are good.  So back, I think it was 10 years ago when Latvia started to enroll into this ICIO program  for biometric passports.  And before that, they just told everybody we don't need your fingerprints because we  had no biometric passports.  That's fine.  Now, that changed to we only store fingerprints in your passports.  And that's an acceptable compromise.  I mean, I see how that can improve travel safety as opposed to the dump limitations we  have on the liquids that we can carry.  But I have told you the story how I tried to carry ice through airport security in Belgium.  They told me it was a liquid.  We argued with them for about 30 minutes and then they won because then it became liquid.  True story.  I gave up.  I just threw it away.  Yeah.  So, I mean, they have their own physics.  So back to passport, right?  So we only store fingerprints in passports.  So okay.  But then I learned somehow that, you know, they might somehow save that.  I talked to some friends in the Ministry of Interior and that's what they told me.  Well, that's what someone hinted me.  And the thing is, what happened then is there was a rush to create a law that's called on  biometric data storage.  So they wanted to legalize storing a hash in the database.  That's their current answer.  If you ask them what do you do with a fingerprint, we store the hash on a fingerprint database.  And hash is safer.  Why?  Because if I do stuff that annoys my government, they cannot download my fingerprint from database  and put it on a dead guy somewhere.  Hash is hash, right?  So what I did is I used the kind of GDPR.  We had the GDPR since 2001 in Latvia.  A similar thing.  It was basically the same.  Only the fines were up to 1,000 euros.  But everything else was the same.  So I used that to request my data from the government to take a look at the hash.  So they sent me the hash.  VSQ.  It's an FBI's Wavelet's Qualification Algorithm.  It's an algorithm that can be used to compress black and white images.  I got these two files left and right, finger.  And I did manage to find the only resource on the Internet, and it was GitHub, actually,  that contains an algorithm to open it up.  And yeah, my fingerprint isn't there.  That's not an actual fingerprint, but you got it there.  So my whole damn fingerprint is there.  That's the repo I used.  Let's summarize.  So what's the status quo right now?  I want to talk about multiple aspects.  First of all, user demand.  As you see, I marked it with a frowny face.  Users, and I'm talking about people outside this conference, do not really care about  privacy.  They don't need private apps.  They're okay with being filmed.  They're okay with being, with their fingerprints being taken.  I think most people would be okay with their palm print being taken.  Maybe even a blood sample if it only happens once in four years.  So that's romantic.  The cookie law.  If someone remembers that, we have that in the EU.  We've had it for a couple years now.  Well, it did nothing.  It basically did this, that every site had to open one more banner and inform us that,  hey, cookies are being used.  And we did have the DNT header in HTTP.  It was a great idea.  I took a look at what happened, and it basically just randomly died within some discussion  group.  So maybe we should revive that, because that's perfect.  Inform your browser if you want to be not tracked.  And the website should be mandated to not show you the banner, but to actually take  care of honoring that header.  A GDPR for big data?  That's actually crap.  Big companies have ways, both legal and technical, to get around GDPR currently.  And GDPR enforcement cannot reach them.  I mean, if something happens that can be proven, fines are big, and those fines are going to  be paid, I hope.  But GDPR still can be improved there.  Now, GDPR in general, that's great.  That actually allows us to stand for our rights.  Go and ask them about what data are you holding on me.  Go and ask them to delete the data, to change your data.  They need to be on their toes and need to know that we are looking at what they're doing.  But the problem is, all these things are EU only.  I mean, cookie law is the other thing.  GDPR is EU only, so we have to make sure that other governments around the world adopt something  similar.  Surveillance technology is getting worse and worse.  We have different technology being advertised, both as a military tool and a tool to track  your kids and wife.  That's not okay.  And for encryption, I use average face, neutral face here, because encryption is good, right?  Anyone who knows how, say, AES works or a virtual algorithm, you can take a look at that, and  it's great.  It's unbreakable if you implement correctly and use right key sizes.  There are two problems.  It's not being implemented correctly in some places, and most importantly, as a user, you  have no idea if the app is actually using encryption for that part or it's bypassing  encryption entirely or using something else.  So that's problematic.  Would any of you notice that your favorite chatting app sends a copy of your message  somewhere even though the original copy is encrypted?  So what do we do?  How can you fix it?  Now, let's not talk about cookie load, that's not that interesting.  For user demand and GDPR, the same thing.  We have to inform users that there's GDPR, and first hand, we have to tell them that  it's good.  You can use it, and privacy is good.  This is how it will help you.  This is how it will help your friends.  This is how it will help other people online.  GDPR for big data.  Most of work needs to be done if there are any lobbies in the room.  If you have contacts in European Parliament, that's where you go in.  We need to fix GDPR so it works better for big data.  Because big data is pseudonymized and you cannot do anything with it, right?  It's safe, but it's not.  Now for surveillance technology and encryption, this needs to be fixed by us here.  We are the only ones with the technical expertise to actually try and fix these things.  Privacy and indeed human rights are a relatively recent invention.  They've been among us for a hundred, maybe 200 years, which is why, at least in my eyes,  it's even more deplorable to see corporations and governments alike hastily eating away  at our right to privacy for their own benefit.  Privacy shouldn't be a luxury that only the rich and powerful can afford.  Privacy is for everyone.  Privacy is a fundamental right.  And like with all fundamental rights, any encroachment on them needs to be aggressively  and decisively terminated.  Thank you so much.  Thank you, Kirils, for your great talk.  Unfortunately we don't have time for questions.  But yeah, I think there was a lot of content in that.  And if you have any questions, contact him.  All the details are here.  So enjoy all the interaction and enjoy the rest of the Congress.  Thanks.  And perhaps you did give quite a bit of a run to copyright, just a little bit to this  moment.  you
36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_0_107.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_108_1307.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1308_1379.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1380_1499.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1500_1547.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1548_1595.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1596_1751.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1752_1799.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_1800_7799.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_7800_7847.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_7848_8087.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_8088_8171.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_8172_9503.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_9504_9551.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_9552_9659.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_9660_12131.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_12132_12599.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_12600_16403.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_16404_16715.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_16716_18611.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_18612_18779.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_18780_19619.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_19620_21611.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_21612_21731.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_21732_21911.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_21912_22199.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_22200_22295.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_22296_23279.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_23280_24239.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_24240_30971.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_30972_33551.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_33552_36155.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_36156_42731.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_42732_43079.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_43080_43259.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_43260_44255.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_44256_52391.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_52392_53747.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_53748_63671.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_63672_64919.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_64920_66563.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_66564_68303.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_68304_70283.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_70284_72179.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_72180_75551.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_75552_75611.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_75612_77291.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_77292_78383.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_78384_78971.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_78972_79151.png 36c3-chaoswest-78-eng-NOTH1NG_T0_HID3_go_out_and_fix_privacy_hd_79152_79739.png
So I'm very happy to announce for the second talk of the day Kirill Solovs-Jovs. He's a lead researcher at possible security and he's a bug bounty hunter. He's an IT policy activist and a white hat hacker from Latvia and he's talking today about nothing to hide, go out and fix your privacy. Some citizens complain about being under surveillance but they are told that if you have nothing to hide, they have nothing to fear. Still news media regularly cover cases where citizens with unusual behavior are put on suspicion lists even though they have broken no laws. Now this is a quote from a news article from European digital rights newspaper, Eddrogram number 300. Anyone here took math in college? Mathematical logic? Some? So you can tell me what this means. So basically what it says here on the screen is for every person that belongs to the group of criminals, that person also belongs to the group of people who are hiding something. That funky sign in the middle means from that statement follows that for every person that has something to hide, that person also belongs to the group of criminals. How many of you think this is correct? No one? Great. It's of course wrong but it is a really common fallacy. I hear that a lot. Now what even is privacy though? Privacy first of all is the autonomous right to choose. Who will work with my data? So maybe I'm fine with company A working with my data but I'm not okay with company B working with my data. Also how the information is processed. So maybe I am okay for Amazon to process my home address to send me a package but I do not consent to Amazon sending goons to my house to get money out of me. And of course what information is processed. Even though I'm okay with giving my address, maybe I'm not okay with giving my phone number. But it's not only that. It's also right to decide who I interact with. That includes right to be left alone. So in a sense privacy is also about consent in a lot of ways. Now to illustrate this is a bit better. To try to transfer my feeling to you I created this concept of Schrodinger's video camera. You may have heard of Schrodinger's cat. Schrodinger's video camera goes something like that. Imagine you just bought a new apartment somewhere in Paris. Great view. Nice building. And then one day you notice that a security camera has showed up outside your window on the open side. It has one of these non-transparent domes and you cannot see inside it. You cannot see if it's looking at you or not. You can't even tell if there's a camera inside or if it's completely fake. But for me it doesn't matter. The feeling I get is terrible either way. Even if someone told me that there's no camera in there, even if someone showed me that there's no camera in there, I wouldn't feel at ease. So that's why for me privacy is in many ways the feeling of privacy. Now exactly one year ago at this stage I gave a talk, a talk of personal privacy in 2018. I just want to acknowledge some reactions that I've been getting since the talk. So some of the reactions are funny. Some of them are affirmative. Others are insightful. Of course others are just plain uninformed because you do not have to actually use a phone even though it's hard but you don't have to. Even more so you don't actually have to use Facebook. But these two remaining arguments I want to talk closer about these two. So here's a short video. Some of you may have seen it. So it's a video of a lady trying to unlock the man's phone with a face ID. Now it's clear from this that it's fake. At least it's a sketch. It's clearly visible. But what I want to talk about is the reactions. And I'm outraged by the reactions. All the main topic of the video aside, all these people here assume that since he has something to hide, he did something wrong, which is unacceptable to me. So what if you really got nothing to hide? Maybe we have people in the audience here even though I doubt that have nothing to hide. I'm sure we have some people like that watching the stream, not here at the congress. So what about data hoarding? What if someone will say a government or a large corporation these days, maybe that's more likely, collects enough data about you that allows them to more easily blackmail you, that allows them to impersonate you? Even if that's not the case, think about herd immunity. That's a concept used in vaccinations. You should get vaccinated because some people medically can't and you will also protect them by providing human shield if we can so say. The same applies for privacy. There's herd immunity in privacy. So many people not hiding anything will make it really hard for the few who actually have something to hide. And it doesn't have to be anything criminal or nefarious. Many people have legitimate reasons to hide things. And by accepting that you're okay with not hiding anything, by giving up your right to privacy, you're also helping those people that actually need privacy to give up their right as well. And of course, remember that today's authority might become to tell Terian or inhumane. We see the transformation process starting in a couple of western countries right now and I don't know where it's going to lead us in the next years, but it may be the case. Imagine how much easier would it have been for Adolf to have committed his atrocities here in Germany if he had Facebook, if he had access to all the data? I hope that's not coming back, never. Now what I want to talk about now is a state of privacy. I want to take a look at what's happening around the world. And what's happening around the world, of course, is there are these protests in Hong Kong going on. So this is an article from middle of this year. And people in Hong Kong, they're really aware of tracking that their transportation cards can be used to track where they move. So they try to avoid that. We are afraid of having our data tracked is what they say. So that's good. People are getting more aware. But it's also happening in the West. Los Angeles decided, passed a law basically, that all the scooter sharing companies have to share real-time scooter location data with the government. And Uber, even though I dislike their methods and trying to disobey the law wherever possible, I think they took the right stand. All the other companies actually are ready to give the data and are giving the data to the government. Uber is the only one who questioned this and tried to fight against that. The idea behind that is a good idea. So the government wants to make sure that the communities, the geographical communities where underrepresented people live or under privileged nationalization shall say, that they also get the scooters. They don't target just the rich neighborhoods. So that's good. But do they really need real-time tracking for that? I doubt that. Now my favorite topic of CCTV, of course, this is the only slide from the last year that I included here. These are actual posters for those of you who haven't seen them from the UK, how the government is telling you that CCTV is good. So what's new? Well, this happened. Beginning of this year, so in May this year, a man was stopped by the police. All he did, he was walking by and someone warned him that there is facial recognition going on over there. So what he did, he pulled over his sweater, he pulled it over his face and walked by. Police stopped him, forced him to scan his face, found nothing wrong and fined him 90 pounds for trying to evade the facial recognition. So it's super disturbing and super creepy. But I mean, there are ways around that, right? We could use this cap, for example, and have a face of, I don't know, general secretary of a Communist Party somewhere. So then you're not trackable, not attracting attention, right? There is this law in Hong Kong that doesn't allow you to use masks anymore in the protests. And it's problematic because they track everyone through facial recognition. So that's why the mask was allegedly created. The good news is, it's a relatively recent news, in November it was ruled, it's a system, political system in Hong Kong is complicated, but Hong Kong court ruled that it's illegal to ban wearing masks. And the full hearing in the next level of court is still going to happen in January next year. But currently, the law is suspended. Currently you can actually wear masks. I mean, I don't know if police actually are okay with that, but by law you can. Now, privacy advocates, me included, have always been complaining about not being able to use public Wi-Fi without a phone number. Finally we can. We have an option to take a selfie and upload the passports. It's just terrible. Oh my God. Let's get back to facial recognition for a second. So European countries are trying to copy and paste the idea that China is doing. It's not just China, it's not just Russia. But the difference is they are asking for permission. So why are they asking for permission? Well. And now that they've got a negative answer, the question is, will they listen? Yes, they will. Because European data protection board finds a school in Sweden because of using facial recognition. I mean, thanks to whoever made it, but we have GDPR. So we do have some protection in Europe. Unfortunately, not all of us here and not all of us watching this stream are so lucky to have that kind of regulation. But it does actually work. Even though I've been hearing bad things about GDPR, yes, there are things to improve. But it does work. It does help us. Now, as you were told, I come from Latvia, and I want to share something from Latvia. This is a picture I took at a press event in Riga. So police were presenting their new vehicle, this one over here. And this vehicle, the idea is it will automatically find people for not wearing seat belts, talking on the phone, not showing turn signals. So it has a bunch of 360-degree cameras in there and doing some fancy stuff. I mean, I'm all for traffic safety, but check this out. I mean, I like that they do have a sense of humor. I guess BB was taken, so I mean, they decided to go with GC, which is okay, which is the one that police use, but still, or we'll be proud. So another slide from my previous presentation. So People's Daily China was telling how cool it is that in classrooms you can actually now use surveillance cameras to track the progress of students. Are they learning? Are they focusing? And so on. Well, what's new? What happened in 2019? Anyone knows? This happened. Brain scans. So let's take a look at this short video here. Teachers at this primary school in China know exactly when someone isn't paying attention. These headbands measure each student's level of concentration. The information is then directly sent to the teacher's computer and to parents. China has big plans to become a global leader in artificial intelligence. It has enabled a cashless economy where people make purchases with their faces. A giant network of surveillance cameras with facial recognition helps police monitor citizens. Meanwhile, some schools offer glimpses of what the future of high-tech education in the country might look like. Students have robots that analyze students' health and engagement levels. Students wear uniforms with chips that track their locations. There are even surveillance cameras that monitor how often students check their phones or yawn during classes. These gadgets have alarmed Chinese netizens. Now, that's screwed up beyond repair, if you ask me. But luckily, just happening in China, right? No. U.S., America. So there's a great article. I invited you to read it in Fall in the Guardian, published in October 2022 this year, about how they use digital surveillance for American kids or against American kids, I shall say. I will read you some of the quotes from the article. I divided this article into multiple categories so it's easier for you to understand. First of all, the reason why is anyone doing that? I mean, it's not China. It's not the national communism. You're not supposed to spy on people, at least unless you're the government in the U.S. So the reason is that lawsuits by parents of students who have committed suicide or parents of children who have been cyberbullied is a problem for the schools. So they see this as an easy solution. They track everything students do and then they are office code free. I mean, from the perspective of the school's lawyer, even if the kid does commit suicide, their assets are covered because they have this great system and they did everything they could. So it's kind of a loose, loose situation there. Now what was reaction time? So as the article says, it's not, I've sent this email two days ago. You've sent this email three minutes ago. Come to my office, let's talk. That's the speed, that's the latency, that's the reaction time of the system. In Veldt County, Colorado, a student emailed a teacher that she heard two boys were about to smoke weed in a bathroom. And school is proud of this. Within four minutes of sending the email, troops were deployed to the bathroom. Scope. So I mean, it's getting worse and worse. So I'm going to get ready for that, prepare for that. So it's not just about what they do at school. 24 hours a day, whether students are in their classrooms or their bedrooms, the monitoring is going on. Of course, I'm not talking about video cameras here, but the content monitoring. Tech companies are also working with schools to monitor students' web searches and internet usage. And in some cases, track what they are writing in their private social media accounts. Gaggle, which is the name of one of the companies providing the service in the US, also automatically sends students a scolding email every time they use a profanity. How is that for a chilling effect? Now with all that, what's the justification? Some proponents of the school monitoring say that the technology is part of educating today's students in how to be good digital citizens. What does that mean? Well, allegedly, it helps trained students for constant surveillance after they graduate. That's the actual quote from the justification of this system. And here's another quote from Bill McCullough, a Gaggle spokesperson. Take an adult in the workforce. You can't type anything you want in your work email. It's being looked at. So their idea is, you know, let's do this to our kids in schools and then prepare them for that. What are the effects? Of course, there are chilling effects. ACLU said schools don't post on a bulletin board. Here are the words we are going to be searching for. Of course, it forces students to be careful and to self-censor. They might not write about things or talk about things that are not, in fact, being monitored. The idea that everything students are searching for and everything that they're writing down is going to be monitored can really inhibit growth and self-discovery. That's a quote from Natasha Duerte, a policy analyst at the Center for Democracy and Technology. And finally, it's a military technology in the United Kingdom. School surveillance technology has been already tested for use in counter-terrorism efforts. Again, I don't want to get blown up by terrorists, but I mean, I don't like all these safety processes that we have either. I mean, even here at Congress this year, we are starting to have signs, don't leave your bags unentended. I'm not sure how I feel about that. I mean, I thought it's a safe space here. The ACLU expert that referred to previously said, it's certainly fair to ask to what extent we feel comfortable with technologies first developed for use in war, being used against our children. Now let's take a moment to talk about the company name, Gaggle. According to Merriam-Wefster dictionary, gag is a verb that means to prevent from exercising freedom of speech or expression. And the other definitions for the verb to me only emphasize the non-conceptional nature of the interaction between a student, the kids, and the school. They don't have a say in that. They're being gagged, not only technologically, but also psychologically. That's unacceptable. Okay, let's talk about something else. The end-to-end encryption, or as US Attorney General William Barr called it, warrant-proof encryption. GCHQ has suggested that touch firms communication services should be able to serpitously add intelligence agents to conversations or group chats. This is still an ongoing discussion, but this is where this is going. So I've been looking at this problem and I've been thinking, I've been trying to predict how will secure and cryptic communications look in the future? Because the government really has, they have strong incentive to try and access that kind of communication because of terrorist content, because of child abuse material. So I think as a community, we managed to convince them that backdouring the crypto part is not going to work. I mean, it would work, but it's not the worst of the ideas. So what I think is actually, this is where it's going to be going. So public clients are going to be able, like public clients, I mean, WhatsApp, Facebook, and so on, they're going to be able to add the third party to your encrypted communication channel without you knowing it's going to happen in your client software. So that's what I think is going to happen. By the way, Jim Baker, the FBI's general counsel who has been working with William Barr on that proposal, had a change of heart. This is a cool article from October. This year you can take a look at it. And the guy finally understood that what he's trying to do is not the right direction to go to. Okay, let's talk about those client apps. So let's take WhatsApp as an example. If WhatsApp were doing something shady on your phone, you could stop it by routing your phone, right? That would help because then you can install background apps that monitor the traffic, that monitor the file interactions, that take a look inside the WhatsApp. And amazing. But you cannot do that. They've had that rule for some time. And it also applies, of course, to iPhones, to jailbreaking iPhones as well. But they tend to have these waves where they reinforce the rule. So it's been there for years, but they reinforce it once and again, right? So okay, I can't route my phone. What about third-party apps? Well, nope, this is actually a bit newer. It hasn't been there for that long. But if you install a third-party WhatsApp app, you're going to get banned, right? So the only question for us, the technological nerds here, is, is it going to be legal to install our beloved secure apps? But I want you to think about the other people. I want you to think about non-technological people. What are they going to do? How are you going to communicate with them? And actually, not less importantly, how will they communicate between each other? Let's take a look at another important aspect of everyone's everyday life. Watching pornography online. The Australians want to use facial recognition to verify that the people who are watching porn online are the actual people. I mean, how short-sighted have you been to not see how this can go wrong, right? Those fake emails everyone's getting, we filmed you watching porn and we filmed your face. Those are going to turn real if this is actually enforced. But another thing, right, is of course online dating. It has launched in the US this year and it rolls out in the EU next year. And I actually have a couple of things about Facebook online dating. It actually does provide you more privacy, which is good. So when you opt into Facebook dating, it not only makes sure that your dating profile is in a way anonymized and it limits the access to your actual data, it also does something to your actual Facebook profile where it tweaks the privacy settings a bit that you are a bit more private. But there's a catch. In order to opt in for Facebook dating, you have to enable location on your phone. You have to physically confirm your location. So Facebook isn't going to give us privacy for nothing. They want something in return. So not good again. Now suicide prevention is an important topic and Facebook is doing their share and I feel quite okay about that. That they're doing that. That's good. And here is the algorithm from the official, from their official spec that's available publicly. So basically, they monitor everything. By the way, people with knowledge on the subject have told me, have informed me that even if you do not post the message, even if you do not post the comment, if you decide to write that message and then delete it before send, kidding, submit, Facebook still gets that text. And they still launch it through this process here. So they use a classifier. They use some neural nets to try to understand what's happening. And the last step, well, not the last step, the one step before the last step is it's reviewed by a human person, which is the part that I dislike about this idea. So, I mean, giving that, that taking action over here actually means popping up with this. So the user basically gets this message here. I mean, I think it'd be okay to have more false positives and not have it reviewed by a human reviewer. That would be, that would be better, even though some people are more creeped out by robots reading their stuff than people reading their stuff. I'm one of those guys actually. Still on Facebook, date reuse. So there's this article. Facebook lawyer was forced to testify in court. They do that all the time this year, but that's one of these years. It's from June 2019, one of these times this year. And what they basically said is, you have no expectation of privacy. There's no privacy interest because by sharing with 100 friends, you have published. You have shared with everybody. And then they go on to compare it to a birthday party in the article where you invite couple of your close friends, like 20 friends, and you have no expectation of privacy because any of those 20 friends could go ahead and tell your stuff to anyone else. So I'm not okay with that. Remember, privacy is also about consent, and that's not fucking consent. Okay. Let's talk about something more technical, web browsing. Specifically JavaScript. The technology that fuels the modern web from dynamic web pages to tracking. This here is an interesting message that I got when trying to search for some parts on Mouser. So it says that JavaScript is disabled, so you can either enable JavaScript or log in. I mean, if that's an admission of why the JavaScript is being used, then I don't know what it is. We also have this article here. And I'm not good with German, but it's funny. It's kind of loads, but then it doesn't. So I don't know what the point of that again. They're just screwing with people like me. I mean, I used to have to browse with JavaScript disabled to have the web not work for me. Now all I get to do is browse from Europe. That's what I get. One of the comics that I read, that is the actual comic. That part on top. Everything else is trash on my screen. And it's not just that. It's open any page on your mobile and your screen. It's full of garbage, not the actual text that you want to take a look at. So this is interesting here. If you take a look at the Washington Post a bit closer, so this is what happens when you open from Europe. You have this nice blah, blah, blah, and then you can click agree and continue. And your only other option, if you don't agree to tracking, to give up your privacy, according to GDPR, is back to all options. And if you click back to all options, what you get is you can pay to access the content. So that may be legal. Washington Post is a relatively large organization. So they probably know what they're doing here. But it's not ethical at all. Now I'd like to spend the next 10 minutes to talk about why I do all of that. Why do I try to stay private in my everyday life? I tried to convince you at the beginning. Personally for me, it's care for others. Even though I don't have that much to hide, I like to provide that shelter that has immunity for the vulnerable people that really do. But it does, so me hiding stuff, me not disclosing as much as the normal person, does tend to create some curious situations. So I have a bunch of certificates. This is not the crowd I should advertise that to. I was kind of forced to get them. Anyway, so after every time that I take an exam, I have to write them a message. Because every time I take an exam, I show them my ID, my governmental ID, my secondary ID, and they still take my photo and store it. So obviously every time after the exam, I write a polite letter to them saying, thank you for the exam, please delete my stuff. And they do. But one time, they also said we did, and then I asked why the hell are my certificates gone, why can't I verify them? And this is what I said. So sorry, we misunderstood what you meant. So we deleted your whole account and all your certifications. And the funny part, when we were trying to resolve that, multiple times they basically asked, so tell us which certifications those were, because we deleted all of them all. Like I could choose any of them. At one point they said, okay, we restored them all. I took a look at my list, took a look at their list, and one was missing. So I told them, nope, look more closely here. So another thing happened to me. I got an SMS. Anyone still get SMS here in the audience? Yeah, about half the people. So I got an SMS. It didn't come from a number. It came from a spoofed source, so it's ASCII based, crediton.lv. And what it says in Latvian is basically, hello, unfortunately, your credit request has been denied, crediton.lv. I've never ever applied to any kind of credit or credit cards in my life. So I was confused. Obviously, a normal person gets SMS, what do they do? They try to phone the fuckers. They try to understand why the hell are you spamming me, because you cannot reply to that number. So I go to the web page, which is, you know, that, and I ask them, so what's up? And they don't pick up. So I phone them. I was about to ask them, and they don't connect, because my outgoing number doesn't exist. It's set to private. I use call ID barring. So they don't connect. They don't want to talk to me. So okay, the only thing I can do is I hop on my bike. Then I ride over to their office. And everything is fine. Everything is solved. I arrive there. I show them my phone. They ask my phone number. I write my phone number on a piece of paper. They take it over backstage to some IT guys. And the IT guys come back saying, nope, it's not our system. We didn't send it. And I'm okay with that. I mean, I could easily have sent that myself, right? Or you could have done it, huh? But I mean, it's fair. Someone can spoof that. It happens. I wave goodbye and I'm out. So that's that. A week later, same number. Win a shopping cart for 50 euros if you go in your profile and renew your information. So what they do? Call them up. Doesn't connect. Look at their web page again. Take my bike. Go there about one hour before the closing time. It's not open. Apparently, the opening hours in the web page are the opening hours for the phone, which doesn't work, not for the actual office. So 10 p.m. They were there. People were there. I saw them, but they didn't open the door for me. So on my way back, I go into the patrol station. I fill the bike a bit for about one euro and I have the receipt with me. So in two days, I ride back again. They're open. I fill the bike a bit, take the receipt, go there. And I show them this again. And you know what they told me? That, yeah, we looked more closely here and we found your number. Sorry. Our bad. I told them, okay. Well, it's a bit strange. You don't verify the number. Don't you have, like, requirements by law to verify these things? And they replied, yeah, we do, but only if we approve the credit. So you can apply with a bunch of random guys' numbers and get them spammed. So I thought, okay, that's a number for you, but I have these two euros that I need you to compensate because, you know, because of you, I was there or there, you lied to me and now I had to take these trips here. And so they told me to send an email. So I got the email address. I went home. I sent them an email, attached the scans. And they replied, please provide your bank account number to transfer the money. I politely and honestly replied, I do not have a bank account number that I can provide to you at this time. So that was that. They never replied. A couple weeks later, I look at my bank account and there's the fucking money. Many people have asked me at this point, why haven't I looked deeper into that? I'm too afraid what I'm going to find out. I don't know how they got my account number. I don't have the slightest clue. Now from the privacy perspective, there's one more thing you can do. If you still use post, in the post office, you can use a post office box. That means if you give someone your address, they cannot abuse it. If I can send them to sending me stuff, they can send me stuff, but they cannot break down my door because that's not my door. That's my PO box in the post office. So I don't know the prices here in Germany. In Latvia, it's their cheap. I actually have two PO boxes this year. One box costs 12 euros per year. So it's super, super cheap. Speaking of Congress, C3Post is also quite good. It's anonymous if you want it to be, and it's right behind the stage. So go send a postcard to someone you want to send a postcard to after the talk. Let's talk briefly about mobile apps. So this is Socratic. It's a mobile app that kids use to talk about homework, right, to learn. And Apple and also Google right now have actually created a good system that allows you to control, granularly control what can apps do and what they cannot do. And in this case, they ask to ask you to contact. And the thing that Apple has done is they allow the developer to actually specify whatever text they want in here. They cannot delete or change anything, but they cannot detect. So let's say it's only about chatting. It's only for chatting about homework. Don't worry. So naturally, you press don't allow, and this happens. Sorry. We kind of need that. So I hope they come today when Apple forbids apps like that, that block your experience fully just because you haven't given them a permission that should actually be optional. Now I use this taxi app called Bolt. Then they change the branding to Bolt. And this is how it looks now. I can still use it. But if I want to press on the button which you don't see on the screen, it's super, super dim over there where all my settings were, my name, my phone number, my previous rights, I cannot access it unless I have GPS enabled. So why do I need GPS to access my history? I have no idea. But that's how they do it now. But still, at least it was functional until they deleted my account because I wrote a GDPR request to them to explain what's going on and why I can't access my data. They basically said, since you have lost your trust in a server, we will terminate your account starting next month. But I mean, I still got to use it for a while. So then I switched to this other taxi that's Yandex. It may or may not be run by Russian special services. I don't know. I was using that. I took one ride. Coincidentally, it was to the airport to go to Ukraine. Coming back from Ukraine, I enabled my phone connection. Again, this is what I got. Your next ride can happen 2023. Welcome. Speaking of Yandex, they have privacy policy, of course. All companies doing business in the EU need to have that now. And it's quite okay. So they actually have the type of data, like location. They explain how they use it and they explain how you can change your data or how you can withdraw your consent of them using the data. And it's all fine here. But if we scroll down further, we see those kinds of categories. And we see the reason is to improve app performance quality. And we see that you cannot use the Mapp without giving the data. And what does that include? A lot of disk space on Android, list of installed apps on Android, device tech, characteristics like model, manufacturer, operating system, sensor information. Anyone has a camera sensor on their phone? Geez. Okay. Back to WhatsApp. I was forced to use WhatsApp because my friends use WhatsApp and I have all the apps. I'm like that guy. But I don't want to be that guy that shares your phone book with the company because then you betray your friends. So I never do that. I always click deny. So I was using WhatsApp like that and I want to show you how I found a way to create new conversations in WhatsApp without giving access to your phone book. So here, I use my regular dialer. I dial the number I want to dial. I want to chat with in WhatsApp. I press the green button. I press the red button. I go to recent. I press on the I over there. Then I hold the message button. Then I choose WhatsApp. The call button. Then I call in WhatsApp. Then I press the red button. Then I go to calls in WhatsApp. Then I open up here and then I press the chat. And I'm in the chat. Yeah. So that's how you could create a chat in WhatsApp. And could is not because you can't do it anymore, but because they fixed it. I still don't love WhatsApp, but now they actually fixed the button for the people, for those of us who do not have the other book. So that's something. I mean, it doesn't make them perfect, but now I don't have to do that. So that's cool. I also use these things. Do you have them here in Germany? The prepaid anonymous cards. You can just buy them in the shop. Yeah? Okay. So I use these a lot since I don't have any other kind of banking cards. And if you notice, it doesn't have a name. This just says term of use one year maximum. So I decided I have to be fair. And when I buy something online, I have to write as it is. So I try to do a bunch of stuff by leaving the name on the card blank. That's just the placeholder. It's on the road. And it gives nice errors like a pork bun, a DNS register here, gives a kind of technical error so you can work from there. But for these cards, of course, you can write any name that you want and it just works. Now if you take a look at this picture here, I took that in Vienna. It's everywhere. I don't like to waste time. So I always on longer rides, I try to work. I open my laptop, but I cannot work on a bus. They will see my passwords. I don't know what kind of resolution they have. I don't know if it's a 30 FPS camera or it's a 240 FPS camera. Who the hell knows? So you can't work there. And the private information on my screen, information of my customers, it's also at risk. So basically the only place you can still work are airplanes. Although I did see one airplane that has a camera already from the cockpit to the cabin on the door instead of the usual analog systems that they use. So luckily airlines want to save weight so they probably are not going to install cameras on all seats even though I've seen news about some low budget carriers installing cameras in the entertainment systems on every seat. And they actually have been confronted about that and they told everybody that we want to evaluate it. Basically they use different wording but they want to track people like we do online. We want to see how they interact with our product. Now speaking of airports, right? Airplanes are mostly good but they have these things. In some airports it's actually considered a privilege. I was coming here from Riga through the fast track and they referred me to secondary and the position of this thing in the Riga airport and me going there through multiple times a month actually suggested to me that they only use this for fast track travelers. It's a feature, not a bug, right? You get magnetic for an L and pad down and here you get this. But you can still opt out of course, even in the UK. UK tried to ditch that. European courts ruled that it's not allowed. Now until Brexit happens we're good including the UK. Around the world it differs. My main concern is that it's not that I'm going to be seen naked. It's the artificial intelligence, the robots taking decisions in a non-transparent way about me. I mean it's going to beep or whatever anyway. Just pat me down. I'm not even talking about transgender people because for these things, the first thing the operator has to do, they have to select the, I don't know if it's meant to be sex or gender but they have to select a pictogram of who's going in the system. Boarding passes. Boarding passes are cool except totally insecure. They can accept USA, they do have a signature part where you can sign it. But you know, they're really secure. But my problem with boarding passes is shopping, especially in Germany. They fixed something two years ago and now you cannot buy a single thing in the airport without showing the boarding pass after you go through security. So I hate that. And what I'm going to do is I'm going to spend the Congress to work on an app. I'm going to present it in March in Stomnihak in Switzerland. I'm going to have a talk called travel for hackers. I'm going to talk about how to safely travel, what can you take and what you cannot take to different countries. And I'm also going to have this app. But you have to promise to only use it for shopping, not for boarding or accessing airport lounges. Anyway, you can, using this app you'll be able to anonymize your boarding pass like point and click. And then you can go shop, right? Don't use it for bad stuff or I might get thrown in jail. I don't want that. Do we? Another thing. What is secure? I mean, airports, you have boarding passes, we have these scanners. Fingerprints are secure. Unless you use them as your password, that's dumb. But fingerprints are good. So back, I think it was 10 years ago when Latvia started to enroll into this ICIO program for biometric passports. And before that, they just told everybody we don't need your fingerprints because we had no biometric passports. That's fine. Now, that changed to we only store fingerprints in your passports. And that's an acceptable compromise. I mean, I see how that can improve travel safety as opposed to the dump limitations we have on the liquids that we can carry. But I have told you the story how I tried to carry ice through airport security in Belgium. They told me it was a liquid. We argued with them for about 30 minutes and then they won because then it became liquid. True story. I gave up. I just threw it away. Yeah. So, I mean, they have their own physics. So back to passport, right? So we only store fingerprints in passports. So okay. But then I learned somehow that, you know, they might somehow save that. I talked to some friends in the Ministry of Interior and that's what they told me. Well, that's what someone hinted me. And the thing is, what happened then is there was a rush to create a law that's called on biometric data storage. So they wanted to legalize storing a hash in the database. That's their current answer. If you ask them what do you do with a fingerprint, we store the hash on a fingerprint database. And hash is safer. Why? Because if I do stuff that annoys my government, they cannot download my fingerprint from database and put it on a dead guy somewhere. Hash is hash, right? So what I did is I used the kind of GDPR. We had the GDPR since 2001 in Latvia. A similar thing. It was basically the same. Only the fines were up to 1,000 euros. But everything else was the same. So I used that to request my data from the government to take a look at the hash. So they sent me the hash. VSQ. It's an FBI's Wavelet's Qualification Algorithm. It's an algorithm that can be used to compress black and white images. I got these two files left and right, finger. And I did manage to find the only resource on the Internet, and it was GitHub, actually, that contains an algorithm to open it up. And yeah, my fingerprint isn't there. That's not an actual fingerprint, but you got it there. So my whole damn fingerprint is there. That's the repo I used. Let's summarize. So what's the status quo right now? I want to talk about multiple aspects. First of all, user demand. As you see, I marked it with a frowny face. Users, and I'm talking about people outside this conference, do not really care about privacy. They don't need private apps. They're okay with being filmed. They're okay with being, with their fingerprints being taken. I think most people would be okay with their palm print being taken. Maybe even a blood sample if it only happens once in four years. So that's romantic. The cookie law. If someone remembers that, we have that in the EU. We've had it for a couple years now. Well, it did nothing. It basically did this, that every site had to open one more banner and inform us that, hey, cookies are being used. And we did have the DNT header in HTTP. It was a great idea. I took a look at what happened, and it basically just randomly died within some discussion group. So maybe we should revive that, because that's perfect. Inform your browser if you want to be not tracked. And the website should be mandated to not show you the banner, but to actually take care of honoring that header. A GDPR for big data? That's actually crap. Big companies have ways, both legal and technical, to get around GDPR currently. And GDPR enforcement cannot reach them. I mean, if something happens that can be proven, fines are big, and those fines are going to be paid, I hope. But GDPR still can be improved there. Now, GDPR in general, that's great. That actually allows us to stand for our rights. Go and ask them about what data are you holding on me. Go and ask them to delete the data, to change your data. They need to be on their toes and need to know that we are looking at what they're doing. But the problem is, all these things are EU only. I mean, cookie law is the other thing. GDPR is EU only, so we have to make sure that other governments around the world adopt something similar. Surveillance technology is getting worse and worse. We have different technology being advertised, both as a military tool and a tool to track your kids and wife. That's not okay. And for encryption, I use average face, neutral face here, because encryption is good, right? Anyone who knows how, say, AES works or a virtual algorithm, you can take a look at that, and it's great. It's unbreakable if you implement correctly and use right key sizes. There are two problems. It's not being implemented correctly in some places, and most importantly, as a user, you have no idea if the app is actually using encryption for that part or it's bypassing encryption entirely or using something else. So that's problematic. Would any of you notice that your favorite chatting app sends a copy of your message somewhere even though the original copy is encrypted? So what do we do? How can you fix it? Now, let's not talk about cookie load, that's not that interesting. For user demand and GDPR, the same thing. We have to inform users that there's GDPR, and first hand, we have to tell them that it's good. You can use it, and privacy is good. This is how it will help you. This is how it will help your friends. This is how it will help other people online. GDPR for big data. Most of work needs to be done if there are any lobbies in the room. If you have contacts in European Parliament, that's where you go in. We need to fix GDPR so it works better for big data. Because big data is pseudonymized and you cannot do anything with it, right? It's safe, but it's not. Now for surveillance technology and encryption, this needs to be fixed by us here. We are the only ones with the technical expertise to actually try and fix these things. Privacy and indeed human rights are a relatively recent invention. They've been among us for a hundred, maybe 200 years, which is why, at least in my eyes, it's even more deplorable to see corporations and governments alike hastily eating away at our right to privacy for their own benefit. Privacy shouldn't be a luxury that only the rich and powerful can afford. Privacy is for everyone. Privacy is a fundamental right. And like with all fundamental rights, any encroachment on them needs to be aggressively and decisively terminated. Thank you so much. Thank you, Kirils, for your great talk. Unfortunately we don't have time for questions. But yeah, I think there was a lot of content in that. And if you have any questions, contact him. All the details are here. So enjoy all the interaction and enjoy the rest of the Congress. Thanks. And perhaps you did give quite a bit of a run to copyright, just a little bit to this moment. you
gave a talk, a talk of personal privacy in 2018. what if you really got nothing to hide? Maybe we have people in the audience here even though I privacy. There's herd immunity in privacy. So can. We have an option to take a selfie and 2022 this year, about how they use digital services should be able to serpitously add trying to do is not the right direction to go to. why I do all of that. Why do I try to stay private in my everyday life? I tried to convince you at this time. So that was that. They never this conference, do not really care about governments around the world adopt something is good. This is how it will help you. This is European Parliament, that's where you go in. We are the only ones with the technical expertise to