KURT OPSAHL: All right, thank you, everybody, for coming
to the Ask The EFF Panel.
It's so great to see so many people here filling
up this room.
We are the Electronic Frontier Foundation.
(Cheers and applause.) KURT OPSAHL:
Thank you.
And so it's a pleasure to come here to DEF CON.
There's so many people who have been great supporters of us here
and so many people doing interesting things that lead to interesting issues,
trying to help make the world a better place and we really also enjoy
helping defend the people in this community.
No arrests so far.
We're going to hope for that for the rest of the weekend.
I'm Kurt Opsahl, one of the attorneys at the Electronic Frontier Foundation.
I do work on the coders' rights project, designed to try
to make sure that people understand what their legal risks are when doing
security research and talking about it.
I also work on some of our other stuff.
What I will be talking about a bit is the NSA surveillance and some
of the recent revelations and what the EFF is doing about it.
What we are going to do is go down the line here where each of us
will talk a little bit about some of the projects that we are doing
and introduce themselves.
Then after we have that sort of brief introduction we are going
to turn it over to you to bring up your questions.
There is a microphone over on this side.
So if you have questions you can just line-up in front of that microphone
and ask them.
A couple of things I want to say about the kind of questions.
We are happy to talk about a lot of the legal and policy issues,
the technology products and such, but this is not the forum to ask
for legal advice.
(Laughter.) KURT OPSAHL: We do provide legal advice to people
but that's best done in a confidential setting.
This is not only not confidential because of all you fine people here,
it's also being recorded for posterity.
It is not the right place for asking, here, I did this thing last night.
Was that legal?
(Laughter.) KURT OPSAHL: All right.
So let me just begin with just one of the things that EFF is working
on that I have been part of.
And that is about the NSA warrantless surveillance program.
It has been in the news lately and some
of you may have read about it.
And we have actually been working on these issues for quite a long time.
In 2005 the New York Times published some reports
about a warrantless surveillance program that was re-branded
by the bush administration as the terrorist surveillance program,
at least part of that.
The following year the USA today published reports
about a program to get the call detail records
from various telecommunications companies.
We have actually from based on the information that we learned
at that time a case that we brought representing
some people against the NSA and the government to try and stop
the surveillance called jewel versus NSA.
That has been going on in the courts for years now.
But we have recently had a little bit of good news there which I will get
to in a second.
I want to say the second case that was brought
about last month, and that was first Unitarian versus NSA.
So in the jewel case the government put forward
the State secret privilege.
They said hey, this has got some secrets
to it that prevent it from being litigated.
And so we can't allow this case to go forward.
They brought up a number of other defenses.
What we have said is that under the Foreign Intelligence
Surveillance Act there is a procedure set
out by Congress after the Church Commission found
a whole bunch of misuse of surveillance powers to determine
the legality, have a court rule about whether what they are doing
is or is not legal.
That's the procedure that trumps the State secret privilege.
So this case has gone up and down in the courts.
It went, we lost an initial round.
Went up to the appeals court.
Won the appeal.
Went back down to the District Court.
Last month the District Court said the case can go forward.
Go through this under the Foreign Intelligence
Surveillance Act.
So that case is ongoing.
We are going to see whether the next move
from the government is to appeal that or to move forward
in the District Court.
After some of the more recent revelations that have
confirmed a lot of the stuff that we had seen before,
but provided something special.
I assume that most people here have been paying a fair amount
of attention to some of the stuff that has come
out in the guardian.
One of the things that came out was a copy of an order that was
for Verizon to hand overall of the records.
This was the call detail record.
This is who you called, how long you spoke, and so the time
of the call.
And it was for all of them.
Not just, you know, one and foreign and not purely foreign but also
down to local calls.
On a daily basis they were to turn over to the FBI to hand
over to the NSA or more or less directly to the NSA this database,
the previous day's calls and then it would be added
into the pool for analysis of contact chains.
Basically this is kind of taking the metadata -- the government
will say it's just metadata, not a big deal.
But metadata is a big deal.
It says who you call and that can reveal a tremendous amount
about your relationship, reveal a tremendous amount
about you if you are, you know, all of a sudden you're making a lot
of calls to a doctor.
That says something about your health situation.
If you are calling certain representatives or political groups,
it may say something about your political affiliation.
There is a lot that it says about you than doesn't require them
to listen to the content of the call.
So this is very important information, very sensitive.
The new case we filed last month, first Unitarian versus NSA was
a collection of 18 different political advocacy
organizations, church groups, people who have a right of association,
a right to get together with other people who are like-minded
and try to act together.
This comes under the First Amendment, where
a lot of the other litigation about the NSA has been
under the Fourth Amendment.
Because that's exactly what the call detail record program is about,
trying to find out what the associations are and cases have
found that indeed that is a First Amendment right.
You can organize, get together with like-minded people, try
to do collective action without the government knowing
everybody you are connecting with.
That case was filed last month, just in the beginning phases.
We are moving forward on a new angle.
That's a very brief summary on some of what we are doing
on the NSA front and with that I'll turn it over to Eva.
EVA GALPERIN: Hi, my name is Eva Galperin,
a global policy analyst for the Electronic Frontier Foundation.
I understand that those are three words that can mean just about anything.
I work on EFF's international team.
There are five of us.
EFF is a relatively small organization.
We have a reasonably large number of lawyers who specialize
in litigation within the United States.
But in the meantime, the Internet is global.
So are we.
So it's up to the international team to cover the rest of the world.
So that's a little exhausting.
(Laughter.) EVA GALPERIN: In some of these places rule of law
is relatively strong.
So we can pursue our protection of the Internet through policy venues.
We can fight bad laws.
We can go to the European parliament.
We can fight secret trade treaties like TPP and acta in a policy space,
but a lot of my favorite work happens in countries or working
with people who are located in people where the rule of law
is even less strong than it is in the United States.
You really cannot pursue the goal of Internet freedom
through policy venues.
Instead you have to go through a sort of process
of helping users to protect themselves, often using technical tools.
I spend a lot of time talking to journalists,
especially independent journalists in countries where the act
of journalism is almost indistinguishable
from activism.
Having your opinion and publishing it about the news is an act of activism
in many countries.
I talk to a lot of terrified journalists and a lot of terrified activists.
Sometimes difficult to tell the difference.
I spend a lot of time advising them
about best practices for protecting their security
and privacy and talking about their rights as they travel
around and try to publish the information that they have.
So in a lot of ways I rely on you guys because the only way
to really understand best practices is to understand what the threats are
on the Internet right now and what kind of threat models people are looking
at and what both governments and individuals are capable
of doing when it comes to compromising people's privacy
and security.
I follow the hacker community very, very closely.
This is my seventh DEF CON.
Not in a row.
The first one I attended was 1998.
It was a much smaller room.
(Chuckles.) EVA GALPERIN: So one of the things I wanted to talk
about really quick was while most of the people here are going
to be talking about what they can do for you, I will talk a little bit
about what you can do for me.
The biggest project that I was working on last year was the project
in which we were finding documenting, reverse engineering and then writing
up the reports on Syrian malware, forces against President Assad were
spying on activists throughout Syria.
Even if you're using encryption, they would surreptitiously install
a root kit on your machine, therefore by passing
all of your precious encryption and all of the good advice I can possibly
give to Syrian activists.
We tracked down the malware, reverse engineering it and writing
up the reports.
We had the reports translated into Arabic.
There's no point in writing them if they can't be read
by the people who are targeted.
This was actually very successful.
And as a result, I have terrified activists coming
to me with more malware from all over the world, places
like Ethiopia and Vietnam and occasionally China.
There are a lot of reverse Chinese malware.
I need a show of hands.
Anybody here reverse malware?
Anybody?
I see some hands.
I need you all.
And over there.
I need you all to come talk to me after this talk
because I have more terrifying malware than I have reversers.
This is where I go to pick up more reversers.
(Laughter.) EVA GALPERIN: I desperately need your help.
I am here to answer questions about anything involving the rest
of the world.
Julian Assange.
EVA GALPERIN: Including Julian Assange, Edward Snowden, ACTA,
TPP, China, Iran, all kinds of terrible malware gamma PHIN
Phisher, United States selling to regimes in Turkmenistan.
That's what I do and if you have questions I'm happy
to answer them later.
MARCIA HOFFMANN: Hi, there.
My name is Marcia Hoffmann.
I was a senior staff attorney at Electronic Frontier Foundation
for a long time.
I was there for seven years.
I left just a couple months ago to start my own little private practice
focused on technology law, very specifically privacy issues,
copyright issues, hacking and security related things,
free speech.
And I remain involved with the EFF as a fellow.
That's why I'm on the panel today, I'm still an EFF fellow.
And I also became an EFF member last night
for the sole selfish purpose of getting
the totally amazing rocking EFF DEF CON T-shirt.
I don't know if you've seen the new one.
Visit the booth and check it out.
It's amazing, fantastic and I love it.
I wanted to talk to you today about a case I became involved
in while I was still at EFF, but when I left I remained involved in it.
EFF is also involved in it.
We are partnering on it.
It's a case some of you may have heard about,
United States versus Auernheimer.
Show of hands, how many people heard of this?
You may know it as the Weev case or iPad hacker case.
Does that ring any bells?
So let me tell you what happened in this case.
There is this guy named Daniel Spitler.
And he notices something interesting about iPads a few years ago.
Specifically what he notices is that if a person has an iPad and wants
to go set up adapt plan on that iPad, the person goes and visits
the AT&T website using the browser on the iPad.
And when they visit the browser, they see
a pop-up window that has pre-populated in the pop-up window
the account holder's e-mail address and then the account holder
is supposed to type in the password to get into the account.
He notices that when you see this pop-up window in the browser,
in the URL there is a number.
And he recognizes that this is an ICC ID which
is a unique identifier associated with the SIM card of the iPad.
Basically what was happening, AT&T servers were recognizing that
this is this particular iPad, AT&T knows that this is, this iPad
is associated with this account holder.
They pre-populate the e-mail address.
He says oh, well, I wonder what happens
if I change that number?
What if I change one digit?
Boom, there's a different e-mail address.
And so he wrote a script that basically just iterated
through the ICC IDs in the URL and managed to harvest
about 140,000 e-mail addresses this way.
And then he, while he's in the process of doing this
he goes online and he tells some of his friends there: Oh, my God,
I just figured out that AT&T does this thing
and I wrote this script and I'm harvesting this stuff.
One of the people that he was speaking to about this
is a guy named Andrew Auernheimer who is also known as Weev.
Weev says we should see if in that list
of e-mail addresses there are any reporters and we can tell them
about this and maybe they'll write about it.
They identify several reporters, including a gawker reporter.
Weev sends them an e-mail and explains the situation, frankly
in rather provocative terms to attract attention.
Then gawker published a story about it.
As opposed spiller and Weev were then indicted on two felony counts each,
conspiracy to violate the federal Computer Fraud
and Abuse Act and identity theft.
Basically the government's argument
for the violation, the conspiracy to violate the Computer Fraud
and Abuse Act is that Spitler's script, his access
to AT&T servers amounted to unauthorized access
to protected computers.
And I think that this is a really concerning interpretation
of the law because this is information that AT&T published
on the Internet.
It was hidden, but there was no barrier in place
to protect that information.
There was no password.
There was nothing.
AT&T basically just hoped that people would never notice it was there.
And so what ended up happening was, Spitler cooperated
with the government, testified against Weev and
in November -- Weev and in November Weev was convicted
on two felony counts, sentenced to three and a half years in prison
and to pay AT&T $73,000 to compensate them for what
they needed to do to rectify the situation.
We are in the midst of appealing this case.
EFF is on it.
I'm continuing to work on it pro bono.
We are joined by Orin Kerr, a respected crime counsel.
And we are partnering to appeal this to the Third Circuit Court of Appeals.
We filed our opening brief in July, July 1st and
the government's opposition will be filed in just a couple of weeks.
And so that's kind of the deal with that case.
If you have questions about it, of course I will be happy to discuss
or any number of other things that you want
to talk about.
Thank you.
(Applause.) MITCH STOLTZ: Hi, I'm Mitch Stoltz, an attorney at EFF
in the intellectual property team.
I apologize in advance of the effect of a very old kind of malware known
as ahead cold.
Bear with me.
I'll keep this brief.
I work on cases where intellectual property
laws like copyright, patent, although I'm less of a patent expert,
and some other random laws interfere with freedom of speech, freedom
to build, freedom to tinker.
And I'll just quickly mention two things that are, you know,
probably really current issues and probably of interest to some
of the people here.
One is the Digital Millennium Copyright Act.
This was a law passed 15 years ago.
Part of it is a federal civil and criminal ban on breaking what
is commonly known as DRM, digital access controls
on copyrighted works.
For the start, we think it was a bad premise
because with a few generally not that useful exceptions it is illegal
to break DRM even if you are breaking it
for an otherwise legal purpose.
Now, there are some exceptions, but those exceptions are hard to use,
for the most part.
They protect certain people and not others.
And there is a process where the Library
of Congress can pass new exceptions every three years.
The problem with those is they are generally very narrow
and they only last three years.
What happened this year, a couple of things that were interesting.
In the last three-year cycle which was 2009 to -- beginning of 2009,
EFF asked for and got an exemption for jail breaking smart phones.
A declaration of shield against lawsuits for people who want
to install unapproved apps on a mobile phone device.
At the time there was another group, actually this was EFF
at the time who also got an exemption for unlocking, that
is for modifying a smart phone to use it on a different wireless network,
different cellular network.
What happened this year, we successfully renewed
the exemption, I'm sorry, in 2012 we successfully renewed
the exemption for jail breaking, but the Library
of Congress decided not to renew the exemption for unlocking.
This was really strange to a lot of people and the way it was reported
in the press mostly accurately was the librarian
of Congress says that unlocking your phone to switch carriers is now illegal.
Maybe not true exactly.
A couple of courts have gone one way.
A couple of courts have gone the other way.
There is no connection to protecting copyrighted works here,
which is arguably what this law was supposed to do.
But some of the major cellular networks,
cellular carriers have claimed and continue to claim that
if you unlock your phone or if you hire someone
to unlock your phone without their permission, that
they can sue you and that there may even be criminal penalties.
This is separate and apart from your contract.
Obviously you break a contract, usually you have to pay
an early termination penalty.
This is something everybody understands.
It's a bargain that you make when you sign up for mobile phone service.
This is on top of that.
The claim that because of this law that was supposed
to protect and restrict, for example, the encryption on DVDs,
because of that law you can't change carriers
without the current carrier's permission.
All really fairly ridiculous.
There's a bill going through Congress just passed
out of a House committee last week, that would fix
in a very narrow way this specific problem about phone unlocking,
but only for the next two years and without getting
at the deeper problem, which is this law is used as a club to stop
and punish lots of things that could be called
circumventing a digital access control.
Going beyond, just protection of copyrighted material, movies,
music and so on, books, to really being a yet another kind
of anti-hacking law.
It gets used as a club.
You know, we are looking for ways to hopefully get Congress
to fix this law in a more really comprehensive way.
In the meantime we continue to ask the Library of Congress for exemptions.
We respect interested in hearing people's stories
about how they, and under what circumstances do you need
to circumvent or undo or avoid digital access controls?
If you've ever been legally threatened for those things,
those are things we would be interested in hearing
about in private and confidentially.
Or if you have thoughts about that law.
The other area that I'll mention briefly is patent trolls, which has been
a really big area for us this year and for the country.
We've seen really strong statements out of the White House, a lot
of sectors of the digital technology economies
about patent trolls.
What are patent trolls?
There is not a really widely accepted definition,
but generally speaking we are talking about companies that don't build
or produce or sell things.
They simply own patents.
They simply own patents and sue over them.
The really damaging ones are in the information technology space,
in the Internet space.
For example, recently there's
a company that has been threatening bloggers
with patent infringement lawsuits because they claim to own
a patent that covers some really basic aspects of Web publishing.
Things that have really been done for over a decade.
The other one recently -- it will come to me.
There's a number of things being done, a number of things that EFF is doing.
We launched a site called trolleffects.org.
We are collecting threaten letters that people have received
from patent trolls or likely patent trolls and see if we can develop a picture
of who is doing this, what patents do they actually own.
It's hard to tell who owns what because they tend
to use shell companies and false identities when they send
the threatening letters.
If people send them to trolleffects.org we can hopefully get
a picture of who is doing what.
And it can be resource for people who get a threat letter,
to figure out how legitimate it is, whether this is a company that
is likely to sue, so on and so forth.
So we would be interested in hearing from you how patents
on software, patents on protocols, patents
on communications technologies, et cetera, have affected you.
I'll leave it at that.
DAN AUERBACH: Hi, everyone.
My name is Dan Auerbach, staff technologist at EFF.
We have a staff of four technologists.
Part of my job is to provide technical support
for the organization in terms of if someone wants to know what
is an IP address or how does network address translations work?
Those sorts of questions, I give that information
to our legal team and activism team and to journalists.
But today I want to give an overview of the other aspect of what we work on.
We have a bunch of tech projects.
Kind of a theme of our tech projects is encrypting the Web.
So this is kind of a mission that we have at EFF
to try to encourage the adoption of https and the use of https
as much as possible.
We have been encouraged with recent news based on the leaks,
the NSA leaks that encryption does seem to work.
The NSA doesn't have some sort of magic ability to decrypt things.
Which is great news.
It means that we really need to deprecate http.
We need http to become like Telenet, to what SHH is now.
(Applause.) DAN AUERBACH: So towards that end we have
a project that we launched in 2010 which
is called Https Everywhere, a browse extension
for Chrome and Firefox.
This is the most visible project.
The way this works, there's a giant list
of rules and your browser understands that some websites offer
an https connection but don't do it by default.
So Https Everywhere encrypts those connections.
It recognizes this is, by default Wikipedia was over http,
but with our add-on it would encrypt that traffic.
That was kind of our first foray into this area.
But then we started noticing, well, https is great, but PKI,
public key infrastructure, the certificate authority system is really,
seems really problematic.
So what we did next was this project called the observatory,
where we did a scan on port 443 of the entire IPV4 Internet and collected
all the security certificates.
And with that, we made a map of the existing certificate authorities
and the relationships between them.
Some certificate authorities are root and they are trusted in your browser.
Others are intermediate.
Some certificates can be cached by the browser even though
they are not implicitly trusted.
It's a messy world of how certificates are handled.
For people who kind of follow this issue, it
is well-known that PKI is pretty broken.
That we need to fix it.
But the observatory was kind of a tool that we tried to use
to study this problem.
We also have something called the decentralized observatory which
for users on Firefox you can opt into sending us
the certificates that you see as you browse around the Web.
And so this is a way for us to detect attacks.
So, for example, if your browser thinks that it
is seeing a valid certificate for Google.com, but we notice, whoa,
this is very different than a lot of the other certificates we're seeing.
We will be able to warn the user about that.
And we also will be able to kind of get some more information
about how certificates vary from region
to region and how Web servers generally deploy their SSL certificates.
That's kind of some of our projects in the vein of encrypting the Web,
but we also have other stuff we work on, too.
Another area that we've been kind of investigating lately is the issue
of nonconsensual tracking on the Web.
So ten years ago when you visited a site like the New York Times,
your browser loaded resources mostly just from the New York Times.
Now if you inspect, when you load the New York Times
and you open a debugger to see all the resources you're loading,
it's from maybe dozens or hundreds of different companies, many
of which are kind of invisible third-party trackers,
which are amassing browsing histories of users.
We think this is really bad.
People don't know about it and it's happening more
and more.
There is an effort called do not track which was supposed
to help mitigate this problem, but unfortunately
the W3C tracking protection working group which I'm on,
has stalled quite a bit.
And so users are left with a few different options.
They can install an ad blocker which I'm sure many
of the savvier people in this room have already done.
But advertising does form a significant portion of revenue
on the Web and we don't think that you should have to block all ads in order
to stop tracking.
So what we did is we are building a tool which is actually
an experimental Chrome tension which you can download now called
the EFF tracker blocking laboratory.
So we thought we would add to the ecosystem of blockers by,
instead of having a list based blocker -- most blockers
today, if you use ad block plus or ghost tree, there's
a manual list created in a central crawl.
What we are doing is a heuristic based blocker.
From within the blousier as you browse around,
we notice this domain seems like it's tracking you and we block it
based on that.
This is very experimental but it's a direction we are going to try
to add to the ecosystem so that we can hopefully eventually land a feature
like this in browsers, so we can fight back more
against the nonconsensual tracking.
Finally we have a project to promote open wireless access.
We are trying to make it easier for people
to provide open wireless guest access with a deprioritized, it would start
with the second wireless LAN that is deprioritized so your bandwidth
is not affected.
We are trying to figure out how to build security properties
into that open wireless solution.
It is actually the case that WPA2 doesn't provide
much security, especially at a conference like this.
It is essentially an open network
because everyone has the password.
We are looking at ways to get WPA2 kind of security
for open networks.
That's an overview of our tech projects.
If you have questions about any of those I'm the guy to ask.
Thank you.
(Applause.) MARC JAYCOX: Hi, everyone.
I'm Marc Jaycox, a legislative assistant for EFF,
working for the legal and activism teams.
That involves working with, dealing with Congress and legislation
and also blogging, helping run coalitions, things like that.
I'm going to give probably a quick overview of my year
with what we have been doing and what we have been working on.
And so the year kind of started off with CISPA,
Cyber Intelligence Sharing and Protection Act.
Before the leaks, this was a law that granted broad legal immunity
for companies to by pass the privacy laws and to share
a lot more information.
So we started off the year with that.
Congress year after year has consistently pushed
cyber security, really online security, network security bills,
all cyber talk has taken over Washington, D.C.
They often at least the language they offer is not very technical.
The terms are always pretty bad.
So we started off this year with the House debating this issue
and kind of arguing for these massive exemptions.
And we over the course of a few months we had
a very large campaign to combat this bill.
It was one of many bills that comes back
every year.
And so this was in the House.
We created a CISPA is bad bill; a zombie bill that comes back.
Last year we defeated it.
This year in the House it had passed
but we ran a pretty successful campaign
with numbers we hadn't seen since the SOBA campaign.
We had over 100,000 signatures against this bill.
Very show out of Congress men coming
out against this bill.
It was such a good showing that we were able
to do such a good job with the help of the community that
the Senate saw the bill, looked at a lot of our critiques and agreed
with the massive privacy invasion that the bill had.
They agreed it wasn't the right way to deal with online security
or network security when it comes in the federal government
and private companies.
So the year kind of started out with that.
Fortunately, they have kind of stopped pushing that,
these types of bills.
So far we'll see with the recent leaks.
And it session segued, we moved on and segued
into Computer Fraud and Abuse Act.
And for the past, from probably January
until June EFF along withstand forward and CDT
and demand progress has been pushing for CFAA reform especially
in light of Aaron.
It was a really big issue and really important to us
and the community.
So we have this coalition of broad left to right coalition
and we spent many months putting the pressure on Congress,
creating a campaign from a wide and diverse set of individuals
to change the Computer Fraud and Abuse Act, to decrease
the penalties in it, to clarify the law so it can't be abused
and it's harder to be abused by the Department of Justice
and by companies.
To make sure that it's actually used for its original intents.
Right now CFAA on the civil side tends
to be used against trade secrets instead of hacking and that shouldn't
be the case.
After many months, about a few weeks ago, four weeks ago,
three or four weeks ago, Senators Lofgren, Sensenbrenner,
Wyden introduced Aaron's Law, a law that decreases some
of the penalties, doesn't allow the government top bootstrap multiple
penalties to jump up the prison time and clarifies
and incorporates the two better judicial decisions
out there in the Ninth and Fourth Circuits.
This is one of the major campaigns going
on and we actually have a phone booth that we brought that
is in the contest area that is a direct line
to Congress so you can call up the Congressional switchboard,
ask for your rep and give them your mind and speak to them about it.
(Applause.) MARC JAYCOX: If anything, with the bills every year
and how DC has been for a while but it's starting to get right in our faces,
that it's time for the community to really push back and time
for the community to engage with them and tell them what's up.
And so that is one of our bigger campaigns.
We have a pretty cool '80s phone booth that we have.
And so I encourage you to go to the area and check it out.
We have another thing that is part of CFAA reform
is the security researchers letter and letter to Congress
from the community, from DEF CON also.
The letter demands Congress to take up CFAA reform which increasingly
looks like a possibility and that they are going to do it and move it.
And it's a letter from the community and
from security researchers pretty much pushing for Aaron's Law
and pushing for CFAA reform.
That's kind of what has been going on with CFAA reform and you know,
it does look like they are listening and the campaigns have been pretty
fantastic so far and the response from the community has been fantastic
so far.
It looks like they will pick it up.
They are going to discuss it.
There will be hearings and we'll see where it goes.
It's something that EFF will push on for and demand progress
and pushing for it in Congress.
Coming off of that, what happened next, that was probably until June, mid June.
What happened next was the NSA spying leaks.
And focused around that we just have had -- there
are over ten bills to fix this.
We had overnight campaigns launched, especially with the most recent,
the first time since the leaks that Congress has had
to speak out on this is the Amash Amendment,
which I don't know how many people know about it, but it was
a amendment that would defund and curtail one part of the spying,
the use of the Patriot Act and culling that information that Kurt
was talking about.
And so since the leaks, pretty much what I have been doing
is focusing on the legislation.
The legislation deals with a variety of things from fixing section 215 so that
this kind of bulk spying can't happen
and doesn't happen; to fixing the -- the spying is over seen
by the secret surveillance court called the FISA court.
That's my preferred term.
Some of the bills, you know, half of these ten bills deal with exposing
the legal opinions and legal rationales that the government proposes
to the secret corporate and remain top-secret.
We don't -- this is secret law that none of us get to see.
It's interpretations of the Fourth Amendment,
interpretations of the statute that we haven't seen.
So these bills push for the transparency
around those opinions and pure structural reform of the court,
making sure the court right now is composed of people selected
by the Chief Justice of the Supreme Court.
He nominates them and confirms them.
We have a couple of bills that push for, we are not pushing for,
but the Senators have a couple of structural reform bills that were
released this week and we will be blogging about shortly,
once I get out of here.
That's part of the NSA spying.
Then there's the Amash Amendment that was going
to curtail part of section 215's program.
It's a blunt instrument.
An amendment to the defense budget bill.
The House has the right, they have the power of the purse.
And so we found out -- this was an amendment that, you know,
we had known about for a week or so.
It was unclear.
The House, the way the House works, the leadership decides which
amendment gets thrown to the floor.
We didn't know this was going to come to the floor.
We found out about 7:00 o'clock the night
before and overnight we had a pretty ...
(Lost audio.) MARC JAYCOX: Impressed a whole bunch of people.
Overnight we pretty much created an activism campaign.
Form a lot of support.
The community reacted brilliantly.
We got the best vote that we've gotten since the reauthorization of these laws.
And it's a tremendous, a clear signal
from Congress that we are, in my opinion it's a clear signal
from Congress that they are very dubious
of how section 215 is being used and they want to change it.
That's kind of been my first, or the first six months of this year.
It has been really fun, intense.
That's kind of what I have been focusing on.
(Applause.) KURT OPSAHL: All right.
Now it's time to get your questions asked
and answered.
So anybody who has questions about anything we just discussed
or other aspects of EFF's work?
Please come to the microphone here and we
will do our best to answer your questions.
AUDIENCE: The FISA court seems to my mind to be a secret court,
a tool of a police state.
I mean, it seems like it probably has a thin justification.
What is the justification and why can't that court be abolished in total?
KURT OPSAHL: The question is what is the justification
for the foreign intelligence surveillance court?
It was created by the Foreign Intelligence Surveillance
Act which, oddly enough, was an attempt at reform.
Previously there were no courts that were being involved and so
they created the foreign intelligence surveillance
court in order to have judges be involved.
So in that sense it was an attempt to bring some aspects
of the judiciary into it.
What has happened is, as a secret court, it
is doing secret reinterpretations of the law.
These have gone into some very strange directions.
I'll just give one sort of example of where this has gone
in some very weird directions.
So the law that allows the government or, you know,
the government says it allows to get your phone records
is section 215 of the Patriot Act.
And Section 215 says amongst other things that it can get business records
that are relevant to an authorized investigation.
And under that secret interpretation of the law, all of the records
of all of the people for all of the time are relevant
to an authorized investigation.
(Chuckles.) MARC JAYCOX: We haven't seen what that interpretation is,
but I'm really curious to see it.
It's going to be an amazing piece of BS, right?
How can you make it so that everything is -- I mean,
relevant becomes essentially a meaningless word.
There's no difference in that statute
with the world relevant and without the word relevant.
And Sensenbrenner, actually the author of that part
of the Patriot Act agrees that is not what it was meant to say.
That's the problem with the secret FISA court.
AUDIENCE: Wouldn't that require 310 minimum search warrants,
the cats case, that can't be legal.
The Fourth Amendment says you need a search warrant.
310 million.
AUDIENCE: (Speaker away from microphone.) It is true,
illegal and unconstitutional are not the same thing, but we think
the amendment is both illegal and unconstitutional.
(Applause.) AUDIENCE: You talked about EFF's add-on
for blocking tracking cookies.
How does your approach compare to Firefox's approach
of blocking third-party cookies by default and then having
the cookie clearinghouse to create white lists and black lists
based on privacy policies?
Sure.
So ours is not a third-party cookie blocking in general.
How it works is, it's more like an ad blocker.
First of all it's not just blocking cookies, it black holes resources similar
to the way many ad blockers work today.
So if you look apartment kind of the spectrum there's blocking based
on very general metrics, like block all third-party cookies.
Then there's, here is a list of particular resources you
should block.
We are trying to find somewhere in the middle.
We think both of those approaches are valuable
and users should install an ad blocker and disable third-party
cookies in their browser.
But in addition we wanted to add to that by having
in middle area where it is sort of functioning like an ad blocker
except as you browse around it is dynamically updating the list
of resources that should be black holed.
So I hope that answers the question.
AUDIENCE: Yes, thank you.
AUDIENCE: Hi.
I also wanted to ask about the markets firms,
like private sector marketing firms and nonconsensual tracking piece of it.
You hear stories about people browsing
for baby stuff and getting catalog for maternity things two weeks later
or marketing that looks where your mouse goes, and so on.
My question is: How bad are the capabilities
of these private sector markets firms in the first place and secondarily are
they subscribed to by governments in order to turn that metadata
into uniquely identifiable data?
Those are great questions and the short answer is,
we don't really know.
We don't know too much about whether the government has
gone to these firms to request data
because those requests are secret.
Some companies are starting to publish transparency reports.
These are generally the larger tech companies that have
first party presence like Google and Facebook and Microsoft
and Twitter.
But not the invisible third-party ad companies that you've never heard of.
So we don't really know what data is being requested of them.
As far as what abilities they have, also it's hard to know.
I think there's a lot of data that gets passed
around in the background.
Right now it's the wild west.
There's just no rules about what you can do or can't do
with user data.
So it is probably safe to assume that
a browsing history associated with a pseudonym
is in the hands much many companies.
If you -- corresponding to you if you're browsing around the Web.
That's kind of a half answer.
That's the closest we get to really knowing.
I want to add on to that, one of the aspects of this
is data broker companies, commercial companies that collect
information from a variety of sources and repackage that
and make it available for commercial sale.
I think that you should basically rest assured that
the government has purchased subscriptions to these services.
I can say that there has been some FOIA work done
by the EPIC that confirms that, confirmed that several years ago.
AUDIENCE: Thank you.
AUDIENCE: Kind of a two part question
about Computer Assistance for Law Enforcement Act?
Yeah, I wrote an article earlier this year, foolishly, which
the title inferred that the FBI was planning
on surveilling our realtime online communications.
That was before the NSA revelations.
So the two-part question is: One, is CALEA receiving enough, I guess,
awareness from the public?
Is that still a threat?
And I know that the FBI made some statements
several times.
One of their previous legal counsels in a course earlier this year
to expand CALEA to allow for online surveillance as well
as extending the privileges to local law enforcement.
And then the second part of the question is,
concerning jurisdiction, if for instance
a local law enforcement agency had permission to do surveillance online,
how exactly do you think that would work?
Obviously it's difficult for them to identify where the person
is when they are doing online surveillance.
I see that kind of as the equivalent of someone
from Las Vegas police department coming to my home and
in a different state and performing a search.
So I'll just answer as to if CALEA is still a threat.
And then Kurt and Marcia and Eva can tackle the other part.
Perfect.
So the answer is yes, definitely.
But what we've seen is the government become very reticent
and nervous about discussing CALEA or discussing
even -- I'll jump back to the online security bills,
the cyber security bills.
They have been nervous because it's completely outlandish
for them to push such bills when we sometime
don't know what is going on with the surveillance.
We sometime don't know what is going on with how they uses
the FISA, Foreign Intelligence Secuirty Act Court
and things like that.
It is very much a threat and it's something that we
as a community, we as EFF have to keep our toes on.
The second we fall asleep or the second we miss something,
they may try to slip it in or try to continue to push it.
For now I don't think -- for now, at least for short-term, next month
or two, I don't think it is a threat.
Definitely medium to long-term it is something that
they have been very vocal about and something to watch for.
And I really hope that we don't have to go through another Crypto war.
I want to add in terms of like extending those abilities
down to local law enforcement, the first time that was discussed
with their legal counsel in front of the subcommittee and Congress,
the two examples they brought up were the importation of drugs
and like child pornography which are not national security issues.
MARCIA HOFFMANN: To be clear for everybody here, CALEA does not
at this time include the ability to wiretap the Internet.
And there has actually been a lot of questions
about whether or not this includes Skype, which
is a Voiceover IP service and it is used by hundreds of millions
of people all over the world.
Until fairly recently, until a couple of years ago Skype was
a European-based company.
Therefore, it was not even potentially coming under CALEA
because it was out of CALEA's jurisdiction.
But when Skype was purchased by Microsoft,
suddenly there were questions about whether or not Skype would be
required to include sort of back door wiretapping capabilities
in order to comply with law enforcement requests.
In order to clarify this, EFF was part of a coalition of individuals
and NGOs that wrote a letter to Microsoft requesting
a transparency report on Skype, saying: Hey,
if you could just clarify whether or not you are tapping
hundreds of millions of users' Voiceover IP phone
communications, we would really appreciate that.
So in a very gratifying moment Microsoft
did us one better.
A few months later they came out with a transparency report
for all of their products, including Skype.
If you take a look at Microsoft's transparency report
for Skype it says we have never given up any phone calls, any content data,
anything to the governments in response to a request,
to any government.
Then the Snowden revelations came around and we started looking
at the Prism slides which included Skype as a source of content.
And a lot of the other Snowden revelations have
seriously implied or out right stated at one point or another
the NSA has had the ability to tap Skype communications.
So I think that Microsoft and Skype have a great deal
of explaining to do.
It's unclear the extent to which the NSA is capability
of eavesdropping on Skype communications.
One of the things that does appear to be clear,
they are probably not doing it under the auspices of CALEA.
They have a different legal justification for doing this.
But it could very well be happening and we are very interest interested
in learning just what the extent of that eavesdropping is.
And whether or not Microsoft or Skype were really capable
of telling us that it was going on.
I want to briefly address the jurisdictional questions.
CALEA is mostly about requiring service providers
to have tap-ability, like the ability for law enforcement to be able
to get telecommunications that went over them.
But where are they getting the authority to do
the wiretap comes from other sources.
You have like the wiretap, some kind of information would be attained
through a warrant that is obtained through the Wiretap Act.
If they are going through foreign intelligence
surveillance court there are processes there.
I guess the jurisdictional question was sort
of about their desire to sort of extend these realtime surveillance
powers down to local law enforcement.
Well, local law enforcement has
wiretap powers.
If they go to court and get an appropriate court order,
local law enforcement can do tapping.
AUDIENCE: Okay.
MARCIA HOFFMANN: Just not on the Internet.
Is not under CALEA.
Also.
And thank you for Weev and bringing that up.
AUDIENCE: So my question is, we all get to go home at the end
of this and go back to our families.
But the guy who started this whole conversation is locked
in an airport terminal.
He's out now.
AUDIENCE: Okay, I haven't seen a newspaper
in Vegas since I got here.
How can we help him?
He is stuck in Russia where the food is notoriously bad.
Borscht?
In terms of the news, the Russians granted him
one-year asylum.
He is no longer in the airport.
(Applause.) We just applauded the Russians.
Don't be fooled.
The Putin government is not a wonderful government.
They are authoritarian and done terrible things.
Especially with the Internet.
This is part of a global power play
between the United States and Russia.
It just sort of happened, how it happened to play out here.
One of the things that is very important about this,
what we are trying to do especially with some of the work that we are doing
with filing a new lawsuit, pushing forward with that, going
to Congress, trying to get better legislation
is take advantage of what Snowden has put out there.
He put this information out there.
Not for himself but for all of you so people could find
out what was going on and what we can do with it.
So we have all this information.
Study it.
Figure it out.
Figure out what is going on and see what we can do
to stop illegal and unconstitutional surveillance.
(Applause.) AUDIENCE: So on the topic of Snowden and Weev
and others, what are the federal definitions
of whistle blowers.
How does the government get around that in order
to prosecute someone in a civil or criminal case.
What protections do we have?
(Some applause.) So whistle blower law is primarily,
the whistle blower laws are designed to protect people who go
to the government to whistle blow.
(Laughter.) : So what the government's position on this
is actually, yeah, you should have gone
to your supervisor at the NSA and told them all about it and
they will take it up the appropriate channels.
(Chuckles.) And some people have tried
to do this and have not gotten responses.
There actually may be a lot of people who are part
of the system who have gone through the existing whistle blowers,
talked to the inspectors general, talked to appropriate people.
Of course, we never found out about it
because the people upstream just ended the inquiry.
So unfortunately, the protections for whistle blowers who are whistle
blowing to the press and to the public are not very robust
in the laws because a lot of the times the government
is not that keen on things coming out that way.
There are a number of good organizations that focus
on whistle blowers, whistleblowers.org and
the government accountability project focus on people who are interested
in blowing the whistle.
If you know someone who has information and wants to blow
the whistle on it, those are really good resources
for them.
AUDIENCE: Then on the topic of CFAA and Booz Allen and other very
interesting curious government contractors.
So when you would end up like breaking into something that
is owned publicly and that's clearly in violation of intended access,
does that mean that the people that would be working
for the government to build stuff like that are actually
committing felonies?
Are they at risk to get prosecuted by that if, for example, they blow
the whistle on something?
If you install a root killing device and intended to go to China
but are jail breaking a device to add different firm ware -- Let me
see if I can try this.
I'm not sure about your question but see if I can rephrase it or see
if I can understand it.
Talking about somebody working for the government and in the course
of their work for the government they get access to a device
or exceed authorized access?
AUDIENCE: Yes.
: So if they are doing so lawfully, that is to say pursuant
to a warrant that authorizes the access, that's one story.
And if they are doing it unlawfully which is to say because it
is exceeding what they are allowed to do under the constitution, it
is a different story.
It would be illegal.
In some circumstances you can prosecute government officials who
exceed their authority.
But the law is actually fairly friendly to law enforcement officials who
over step bounds and it is sort of, it comes
down to whether you are exceeding a clearly established
constitutional right.
If it's the first time the courts are dealing
with a question there's a bit of a pass.
There's a question of whether it was intentional misuse.
It is fairly rare for a government official who exceeds
their authority in air manner that the government wanted them to do
to get prosecuted.
If someone exceeds their authority in a way that
the government didn't want them to do, they are at risk of being prosecuted.
AUDIENCE: I'm thinking of government contractors,
people who are not government officials but still deal with stuff that
the government purchases.
I think there are less protections.
But if they are doing it pursuant to lawfully authorized warrant,
then that should provide protection.
There's a lot of things in the law where it says good faith
compliance with a lawfully authorized warrant can
be protected.
If someone is not acting in good faith, if they are doing something
they know is illegal, it may be something that
they can go forward.
It's unlikely that Booz Allen find itself indicted or prosecuted for that.
I will say that the CFAA has an exception
for any lawfully authorized investigative protective or intelligence activity
of a law enforcement agency of the United States or
of any intelligence agency of the United States.
So particularly to the extent that a private contractor
is doing work on behalf of the government in that vein, I think,
you know, the statute pretty clearly wouldn't apply
to them.
AUDIENCE: Okay.
Thank you very much.
AUDIENCE: First I want to say thanks.
I appreciate everything the EFF is doing to protect our rights,
that we supposedly already have.
(Applause.) AUDIENCE: I want to continue in the vein
of whistle blowers.
How can grassroots or legislative reform help to protect leakers
and whistle blowers.
If you study history you see that governments are always prone
to abuse and to becoming oppressive
at various points.
We need leakers and whistle blowers like Snowden.
How can we as an Internet savvy community solve
that bigger problem of protecting, like with the pentagon papers.
You know, restoring some of those protections to leakers
and whistle blowers.
On the legislative stuff?
In general there are a couple of things out there.
I mean, there's an attempt to get a federal reporter shield law.
Now, this gets at the problem in a little bit of a different direction,
which is to say it protects journalists from having
to disclose who their sources were.
So that if somebody goes in confidence to a journalist and says,
you know, here is the evidence of wrongdoing.
The government says okay, who gave that to you?
If they were a federal shield law they would say I'm protected
by the shield law.
I don't have to disclose who my source is.
A lot of states have shield laws.
Some of them are very protective.
Some of them are modestly protective.
There is no federal shield law.
Then also there's the First Amendment
and its protections for freedom of speech and freedom of the press
and how that has shaken out in the courts is that
on the whole there are protections for having reporters having to give
up their sources but they can be overcome
by a sufficient showing of need by the government.
The government has tried to get this information
from other sources and failed.
And so the only thing to do would be to use impact litigation in a court
and try to show a court that the First Amendment does apply and
to give greater protections because, you know, there's a quote from one
of the founders of this country, and I'm going to badly paraphrase,
but a popular government without access
to popular information is but a prelude to a farce or tragedy
or maybe both.
What it is meant by that, if you are going to have
a democracy where people are voting about the representatives and
the representatives are voting on the laws, but we don't know what
is really going on or don't have access
to full information, it is a farce.
We are not able to have a functioning democracy
without a good amount of information and transparency.
I just wanted to add one quick thing, which is that one
of the reasons why EFF is made up of activists, technologists
and lawyers is that sometimes the answer is not litigation.
Or legislation.
Sometimes the answer is technology.
And one of the strongest protections that we can offer to whistle blowers
is strong encryption.
(Applause.) If I could add a most basic level, something
all of us can do is get in touch with our elected representatives
and tell them that this is something we consider important.
This is an area where unfortunately for those of us who care
about technology, phone calls are better than e-mail
and personal visits to a member's office are better still,
but they listen.
And on some level that one constituent took the time to come
in and tell them how important this issue is to them.
They see that as representative of thousands of constituents.
AUDIENCE: Hi.
Regarding technology patent trolls, a much less important issue than
a lot of the civil liberties discussions, but can you discuss
the current situation with the trolls owning the idea
of podcasting and podcast protocols and where that stands legally
right now?
I am not the staff patent expert.
We have two of them, but this was
a person who created a pre-Internet audio
distribution company.
The idea was it had something to do
with sending -- AUDIENCE: Audio programs.
Recording programs on cassette tape to subscribers
in sort of a, an early version of Netflix mailing DVDs and this was
in the mid '90s before there was podcasting.
My understanding is that there may be some examples.
In patent law this is known as prior art.
This is evidence that something was invented
before the patent owner claims to have invented it.
In other words, their invention was not in fact new.
My understanding is there may be some prior art
for podcasting for the ideas that this gentleman
is claiming.
And if that's so, we may be able to get the patent office
to nullify that patent, which would probably end
the lawsuits and the threats.
That's what we are pursuing.
AUDIENCE: Good luck with that.
Do you have a list of prior arts ...
(Speaker away from microphone.) Well,
there's trolling FX, which is on the particular thing,
the podcasting patent.
There is a method we are trying to gather information
about prior art that's out there.
I don't remember, but basically if you look through our blog posts
and see the ones about this, it will give you how you can submit prior
art that you're aware of.
Basically things from the early to mid '90s would be particularly useful.
It was like the patent was issued slightly
before the Internet archive started gathering things,
which has made it a little bit more difficult to look back
at some of the history.
We still have found some so far and are gathering more.
The other site that we maintain on that subject,
and I think it might be obvious, is called defendinnovation.org.
AUDIENCE: I have two questions.
One is if you guys might be able to talk
about a recent court ruling talking about local law enforcement not being
required to have a warrant to track cell phone location.
That's just recently come up.
Maybe the reasoning behind that.
And then the second part, the second question I've got
is anything on drones.
You guys published any list?
I hadn't heard anything about it and I was kind of surprised.
All right.
So let me hit the first of those questions
about cell phone tracking.
And so yeah, unfortunately there was
a recent case that warrants were not necessary.
It was an appellate court decision, two
out of three said you need a warrant.
One dissented.
It has actually been a mixed bag out there in the courts.
We've gotten some courts that have agreed that a warrant is necessary
to do cell phone tracking.
Actually, if you look at the recent Supreme Court case
from last year, U.S.
versus Jones talking about a GPS tracker being used
to track someone.
They said a warrant was required for that.
I think if that case is properly extended to the cell phones,
it should come to a similar conclusion that
a warrant is required.
Unfortunately there was that decision.
We are continuing to work on this and try to find cases that are going
to be good opportunities to show that
the Fourth Amendment applies to cell phone information.
An I add?
Please.
Because I have been here and I have been crazy busy
and this case just came out earlier this week, I haven't read
the opinion yet.
What I understand from the reporting is that the rationale that
the court adopted was based on the third-party doctrine.
And this is something that you guys all ought to know about.
And really have on your radars.
So the deal is, the Fourth Amendment
as a general matter, right, protects you
against unreasonable government searches and seizures.
So the government is supposed to have a warrant
to search something in which you have
a reasonable expectation of privacy unless some exception
applies, okay?
That's the general rule.
So back in the '70s the Supreme Court decided
a couple of cases.
One involving bank records and one involving
the numbers that a telephone company collects when
you dial a call.
And in those cases the Supreme Court basically said you
don't have a reasonable expectation of privacy
in information that you convey to a third-party like that.
Like a company, right?
Your bank records, your financial information that you
convey to a bank, they create records from, and
the numbers you dial that you convey to a phone company,
you don't have any reasonable expectation of privacy in a situation
like that, and the reason is you know that you're giving it up.
You are voluntarily giving this information over to them.
How can you have a reasonable expectation
of privacy in that?
That has developed into this concept that we call
the third-party doctrine, which broadly seems
to suggest that you don't have any reasonable expectation of privacy
in anything that you give to a third-party.
In this day and age where we store so much information with companies
like Google, Facebook, Microsoft, et cetera, et cetera, et cetera,
that's a very dangerous precedent.
And that is something that we need to make go away.
It just doesn't translate to the world we live in now.
And in the case that Kurt spoke about, the Supreme Court Justice Sotomayor
called this out and said this is something that we've got to look at.
So I think you are going to see a lot of cases in the future dealing with this.
I think the fifth circuit, from what I've read, has really gone
the wrong way because they said they are cell phone records and
they are stored with your company.
That's very problematic.
I think you're going to hear a lot about this in the coming years.
Yeah.
So speaking of reasonable expectations of privacy,
and the next question was about drones.
So recently the FBI responded to, I believe it was Senator Leahy
explaining what the standard is for drones.
They took the position that you did not have a reasonable expectation
of privacy against drones.
That is to say it was not reasonable to expect that you would be private
from a drone circling over your house and taking pictures
of what you're doing in your backyard.
They based on some cases that were involved
like man playing surveillance that had been done in the course
of the drug war.
And this is a sort of illustrative of how things have been going
in terms of government surveillance.
They are looking for cases in which there have been statements
about what reasonable expectation of privacy is.
That have stemmed from some particular circumstances.
And then seeing how far they can be applied.
So they find a court that says at some point
a plane flew somewhere and looked
down and there was not a reasonable expectation
of privacy on that.
That also means there could be a drone 24/7 hanging over your house.
Once they establish that there is not a reasonable expectation
of privacy they can take it to the Nth degree and it doesn't matter.
It really does matter.
It is entirely possible that a police officer would follow you
around where you go, A, and make handwritten Notes
about where you are going and what you are doing.
This does not mean that it is a good society.
A society that, a future that we would want to live
in where everybody's movements are tracked all of the time.
(Applause.) And so this is made the third-party doctrine,
the reasonable expectation of privacy is outdated and becoming misused
to take things which, beware occasional things where there
was a natural limit of resource-based limit
to how much the government can do, when things become cheaper
they can do it all the time.
We are very much working on trying to stop that.
To wrap up on drones so the people on this panel right now are not our
drones experts, but one of them actually is here.
Our colleague Parker Higgins, who is going to be in the contest area,
working the CFAA phone booth.
If you have questions about drones, he knows a lot about them.
AUDIENCE: At the same time that
the NSA penopticon was discussed it also seemed to be apparent that
the government was going to top tier providers and asking them
to give up their encryption keys.
I don't think the subject has gotten to this extent yesterday,
but what does that do to the concept of non-repudiation and contract law
or even chain of evidence, digital evidence where our digital I had
identities are now no longer solely our own.
Or to put it another way, if the whole ...
if the ...
Let me help.
The question is raising the possibility that
as you may be communicating in what you believe to be
an encrypted channel, that nevertheless someone might be
forced to give up the key such that your
communications could be decrypted and you wouldn't have the level
of security that you are -- AUDIENCE: The phrase I'm looking
for is back door key escrow.
That's my digital entity, my uniqueness and non-repudiation
suddenly evaporates and becomes negligible
as a point of law.
Hmm.
Well, I have not thought of it in terms of the digital identity
because usually what we have been hearing about is more
on the encrypting communications channel not as an encryption method,
not as a digital signature method.
But nevertheless it is quite troubling that we have
a number of systems that are designed to be able
to encrypt communications using a public key infrastructure
and certificates.
These systems have a lot of problems.
I think what Dan was talking about earlier, some of our attempts
to try to at least investigate and understand those problems.
I guess we can put it this way.
The more that is known and revealed
about government access to encryption keys, the more likely it
is that a good lawyer in a contract dispute
or anything involving chain of digital evidence will be able
to convince a jury that the contract was forged or that
the evidence was manufactured.
So that's, that risking increase.
AUDIENCE: Thank you.
Just quickly to add one last point to that, I think that it's
a really good question.
I understand you as saying providers having to give
over their private encryption keys to law enforcement.
I think that this, there's kind of a hole right now in terms
of statutes about this.
So law tends to focus on user data.
But there's a big question mark about well, yeah,
you can get user data if you have these keys
and are companies forced to hand over the keys under various warrant
or subpoena circumstances?
I think there's just a lot of unclarity about that right now.
It's something that is really alarming.
I want to adjust one sort of general point on this.
You know, companies may be required
to provide some technical assistance to the government when
they want to wiretap.
But there's also a notion that they shouldn't be required
to break their services.
And I think if your service is involved providing encrypted
communications and you are not actually providing it, that breaks
the service and that may be an available argument.
AUDIENCE: Thank you.
AUDIENCE: Hi.
So since this Snowden revelation, I have been trying to think about,
there's three different contexts for data retention.
There's the NSA program we just learned
about and the data retention that my service
provider is doing of my metadata of their own volition and this
is in the United States.
There is internationally how the data retention works.
My understanding is that in Europe it's more regulated than it
is here.
I ask you if you wouldn't mind characterizing
the difference between the three contexts,
how long my data is retained and how much it is exposed
to access by the government with an eye to what you think
the right answers are.
So I can talk a little bit.
If you want to add ...
To Europe, I understand, is kind of a mixed bag.
There is greater protection in terms of user data and how it is handled.
On the other hand, there are also mandatory data retention
laws which we do not have in the United States.
It's a double edged sword.
But beyond those mandatory data retention
laws, I think as I said earlier it's the wild west and the private sector.
It's up to the company how long they want to retain your data.
They can have private policies right now which disclose that.
If they break those privacy policies they open themselves
up to FTC complaints or possible other lawsuits, class action lawsuits,
this sort of thick thing.
Basically there's no information.
In terms of -- there's no limit to what data they can retain.
On that front, I think the right answer is a lot of transparency
from companies and also ensuring that we don't pass
a mandatory data retention law.
If a VPN doesn't want to keep data, they shouldn't have to.
So I think that's the way that we should be going
for the private sector.
With respect to government data, I don't know if someone else wants
to take that, but I also think that there's no clear rules about it.
I think there's one more important point to make
about the private sector in the United States, especially
in Silicon Valley where you have a lot of startups and people are sitting
on a lot of user data.
There is a tendency among engineers to want to save everything.
Because you never know when it's going to be useful.
(Laughter.) Yeah.
In fact, your company might go completely
under and that might be the only thing that you can sell.
So there's a very strong push to retain as much data as possible
for as long as possible.
Saving data is cheap, backups are cheap,
the consequences of not having the data when you need it are dire.
And deletion is computationally expensive.
So usually when sort of Silicon Valley companies have
a choice between storing everything indefinitely
and finding some way to regularly delete it, they will choose
to just store it all indefinitely because it's easier.
It is not a conspiracy against user data.
It is not a conspiracy to make things more convenient
for the government.
If you've ever walked into an engineer's office and saw piles
of paper and notice they never throw anything away,
it's sort of an out growth of that.
And in some ways that is potentially very,
very worrying because even if you don't have mandatory data
retention in this manner, sometimes you wind
up having de facto data retention.
So to address the government storing end of it,
the question is are they supposed to have it in the first place?
And the problem with some of these sort
of mass storage things that have been confirmed recently with reports
about the NSA getting just gigantic piles -- five years, that's what
they say they are doing.
Actually if your information is encrypted it's until it's decrypted.
They will keep it around forever.
Or at least until they figure out how to decrypt it.
So the problem is really, that they get it in the first place.
They should only be able to get the information when
they meet legal standards and then only keep it so long as it is needed
for that valid purpose.
If that helps answer the question.
AUDIENCE: With regard to the development of the U.S.
cyber warfare, the architecture -- I don't know
if that's a correct word, but it seems like our government has been
penetrated multiple times by groups like LOLSIC,
while statement we developed advanced cyber weapons
like Stuxnet and regularly are tapping into other countries.
Could you speculate on that?
Yes, yes.
(Laughter.) EVA GALPERIN: Sure, I can speculate on that.
We actually don't have to speculate
because the White House released this thing called
the Presidential Policy Directive.
It is a document that the president creates that instructs
the divisions and the cabinet agencies about what
the policy is for the administration.
And so the document actually is part of the Snowden leaks.
What came out was that it was
a classified Presidential policy directive.
The Presidential Policy Directive Number 20.
What it did was it kind of confirmed what a lot of academics,
people in the security research, people who were watching where
the government is going with this online warfare
and virus making, malware making and what it did is, it revealed that
they have pretty much rootinized the processes and are beginning
to study and look into and create working groups
for how the government is going to deal with this and what
the government is going to do.
Before this document we saw very vague outlines, right?
Like the U.S.
government will follow the laws of war.
The U.S.
government will, we will follow the U.N.
conventions.
And international law.
What this document revealed was that a, it got into much greater detail
on what the government is doing, how they will act in defense
if they support any sort of exfiltration of data or if they suppose
they are under any type of attack.
And the document provided a pretty good foundation for how
they justify Stuxnet.
We know now within the past couple of weeks that one of the generals
is being investigated over leaking the fact that Stuxnet was a U.S.
Israeli project.
And so what we are seeing right now and what we are paying a lot
of attention to and fighting against is the increased militarization
of the Internet.
It was something that was always in the background,
something that we were always hesitant in watching and thought what
was happening.
What we are seeing now is yes, it's happening.
The government is creating these things
and there's hardly anything to be regulating it or figuring out how
to stop it and what to do about it.
Because we don't know what they are doing.
So I think what is going to happen and especially part
of the transparency efforts we're fighting for is to talk
with the government and issue these policy papers and what we think,
you know, should happen in this area and what we think really
shouldn't happen with the increasing militarization
of the Internet.
With Stuxnet -- Flame is another good example -- now when
you use an online virus it is different.
You are no longer -- you can try as hard as you may to target
a foreign nation state or something you want to exfiltrate from a government,
but it's hopping the Internet, right?
It's hopping the Internet into the public sphere
and causing citizens and causing individuals not associated
with the government and who aren't supposed to be your targets.
And it's something that is very dangerous that is happening.
I just wanted to interrupt for a second rudely and talk
a little bit about the rhetoric of cyber warfare.
One of the very interesting things that came out of the Presidential directive
was the sort of declaration that cyber space had
been sort of declared to be a theater of war.
And I think that one of the biggest problems when it comes
to talking about this stuff with the U.S.
government is that there is an entire culture
of people who say cyber.
(Laughter.) EVA GALPERIN: Which is generally
a good sign that you are talking to someone who has very little
in common with the Electronic Frontier Foundation.
The biggest problem with the term cyber warfare
is that packets are not bullets.
As a general rule they do not kill people.
Once you start using the rhetoric of warfare and guns and bullets
and cyber bombs and cyber shields and cyber tanks or whatever it
is they are using.
Cyber Pearl Harbor.
EVA GALPERIN: I would real lie like to know what this cyber Pearl
Harbor is that we have been promised for so many years.
Once you use this rhetoric it leads you to all kind
of erroneous conclusions about what kind
of protections we need and what the U.S.
can do and what the U.S.
is justified in doing in protecting sort of the American Internet as much
as there is an American Internet.
So I'm generally very wary of the term cyber warfare
and anything that begins with cyber and
the entire war rhetoric because I think it really frames
the problem in a highly misleading way.
I'll just add, it's also seriously blurring
the distinction between a civilian and military when it comes
to the Internet.
EVA GALPERIN: A lot of the things that we have been reading
about, sort of proposed protections for the U.S., for U.S.
cyber space have to do with protecting U.S.
companies' trade secrets.
And honestly, as far as I can tell, that's not a valid military objective.
You know who protects companies' trade secrets?
Companies who have hopefully many people employed
to protect their own security.
This should not be something that American tax dollars pay
for and should not be something that the U.S.
military does.
(Applause.) AUDIENCE: My question is regarding the EFF's thoughts
about the Web filtering happening in the U.K.
originally slated as being for pornography blocking
but since has been revealed to spread to other subject matter the.
And what if any actions are being taken in regards to that?
(Sighing.) Oh, British Internet, we can't take you anywhere.
What is particularly interesting about the U.K.
pornography filters is, to begin with, these are not mandatory filters
in any way.
But what is happening is that every household in the U.K.
will have porn filtering turned on by default by the major ISP
in the U.K.
And if you want porn, you have to make an affirmative decision
to contact your ISP and ask for porn.
(Chuckles.) EVA GALPERIN: And they really don't see what
the possible chilling effect of such a thing might be.
Really the chilling effect shouldn't matter because children ...
(Some laughter and applause.) EVA GALPERIN:
Needless to say this is a terrible idea.
EFF frequently comes out against porn filtering.
We think it's fine if you decide to put it on your computer,
on your network.
But having this sort of tyranny of defaults in which you have
to make a rather public disclosure to someone else that you want porn
is highly, highly problematic and poses a potential chilling effect not
to mention that it looks like the fillers are blocking things other
than just porn.
And that this really gives the power to sensor the Internet to these ISPs
and to the people building the black lists.
We think that black lists in general are a terrible idea.
They don't work and they block all the wrong stuff.
AUDIENCE: So I'm actually from the U.K.
(Laughter.) EVA GALPERIN: Would you like porn?
AUDIENCE: So I'm really looking forward to moving back
into my parents' new house and finding one of two situations,
either the porn filter is off and I'm hung out to dry.
Sorry, the porn filter is on and I'm hung out to dry or
the porn filter is often and I know something
about my dad that I didn't need to know.
EVA GALPERIN: Or something about your mom that you didn't need
to know.
AUDIENCE: My bad.
She doesn't know anything about computers.
Back to data retention, you said that with a lot
of these startup companies, you know, data can be, if a company goes
under the only thing they have left.
I was actually, to add to that I would say that data
is the only commodity they have in the first place.
The best way to make sure it doesn't get
in the wrong hands is just not to give it to them.
My real question was about Prism.
So being from Europe, you guys actually have nothing
to worry about as American citizens
because the president doesn't actually target you guys, if what the NSA says
is to be believed.
EVA GALPERIN: If they believe that you have
a 51 percent chance of being foreign, then you are a legitimate target.
AUDIENCE: So as a foreigner -- EVA GALPERIN:
More than 51 percent?
AUDIENCE: This is really strange
because there are more than a billion people
around the world using Facebook.
The United States has -- I hate to use this word because it's kind
of inappropriate, but they have kind of declared war on the world
by having all of this data stored in private companies
within your borders and yet you have access to all of it.
So what can we -- well, firstly, as the European government, do
they have a leg to stand on at all?
And is there anything we can do to support them?
EVA GALPERIN: Let me talk about Prism real quick.
A lot of the time when American NGOs and civil liberties organizations talk
about Prism, it's very focused on outrage
over the NSA spying on Americans.
And the reason why this outrage is so focused is because spying
on Americans is very clearly outside of what
the NSA was originally entitled to do.
It is outside of its purpose.
And so it is very, very clearly illegal.
Now, what about the rest of the world?
A lot of these NGOs will simply leave the rest
of the world out to dry.
They'll say the NSA exists to spy on the rest of the world and we can't get
all upset when it goes around spying on non-U.S.
persons.
On this particular point I disagree.
Just because you are a non-U.S.
person doesn't mean that you suddenly don't have rights.
And not just -- it is not like the Bill of Rights and the U.S.
Constitution and U.S.
law are the only law on earth.
And in fact, it seems very likely that the NSA's wiretapping has, or
the NSA's sort of drag net surveillance does infringe
on the privacy rights of hundreds of millions of Internet users
all over the world.
The problem is that it's very unlikely that we are
going to get any kind of legal recourse for it.
There's simply nowhere for us to go to appeal having our basic human
rights violated as non-U.S.
persons.
What we can do is use strong encryption and also there
has been a great deal of talk within governmental bodies
all over the world looking into the state of NSA surveillance.
There was a bill proposed, I think a bill actually made it
to the floor earlier this week in Mexico.
There have been a number of proposals in the EU.
People are really riled up about this.
It's possible we will see some legislation
in other parts of the world, especially because one
of the key parts of the NSA revelations that we've seen
about NSA spying is that we are not just running
around spying on non-U.S.
persons who are a threat to the U.S.
We are also spying on our allies.
Needless to say this makes our allies including the five Is, including the U.K.,
somewhat outraged.
The question line is back ...
AUDIENCE: (Speaker away from microphone.) Sir?
AUDIENCE: Am I good to go?
Please.
We are going to keep some order here
and sometimes we may return to a follow up question
but people waiting should get a turn.
AUDIENCE: In terms of the privacy movement I have
a two-part question.
I think in information security we are very aware of all the implications,
however you say it, of what can happen with all this data.
But how do you get someone who just goes on Facebook and looks
at pictures of cats all day to understand what this means
and what is the next step for the privacy movement?
Like project mesh net or something.
What should we be working on in the meantime?
EVA GALPERIN: All right.
I guess before we get to the legal aspects of this,
which Kurt will address shortly, I think that it's a misnomer.
It is a misunderstanding to say that people these days either
don't understand the privacy that they are giving up or don't care
about the privacy that they are giving up when
they use social networks like Facebook.
I can say this because I talk to people all over the world
all the time about their concerns about this very issue.
If you want to see somebody who has a deep
and intrinsic understanding of every single one
of Facebook's privacy protections and how they work, look
at a teenager whose parents have just friended them on Facebook.
They know how that stuff works backwards and forwards and
they keep up with every last update
because they are very interested in making sure that
they maintain their privacy from people who, well,
really shouldn't know what they are doing out on a Saturday night.
And I think that this is also true for other people who have things
to lose by losing their privacy.
People are very aware.
They are smarter than we give them credit for.
Really, the task that we have as privacy trainers is just
to give them the right tools to use in order to protect themselves
and also to help them understand their threat model.
Help them understand what information it is that they are trying to protect
and who they are trying to protect it from.
If you give users that information they can usually make smart decisions
about what to do with their privacy.
I want to add on, how do we make them care,
considering the NSA thing, spying, right?
How do we make them care, because in other countries
they protested, but we didn't put fort an effort as much.
I'll address this.
We only have a few minutes remaining in the session.
Actually, I think we have to cut off the question line.
One of the things that I think has helped resonate this issue when I talked
to people about it is talking about privacy in terms of control
of your information.
To get away from, whether it's something that you have
to hide in particular, but don't you want
to have it so your information only goes to the people that you want it to go to?
And not to the ones that you don't?
You have a sense of autonomy and control
on where your information goes and what the spying is doing
is taking away that autonomy and giving control away
to somebody else.
I found that has been helpful.
AUDIENCE: I would.
I would also add that I think people, just to reiterate what Eva said,
but add on that, at least I don't know how much people
trust polls, but there has been a slough of polls
in the past few weeks that have been released that by Pew, Gallup
and Washington post and others, that shows a clear change
in people's attitudes, the larger American public's attitudes
towards privacy and the NSA spying in particular.
I think the job is to continue to hammer home what we have been
saying and talking about.
You know, talking about the lawsuits and what exactly
is metadata and things like that because at least
from these recent polls we are seeing -- I think we are seeing
for the first time since maybe 9/11 where
the larger public shift towards privacy and shift towards government
surveillance regime is changing.
AUDIENCE: There is an active ongoing petition
on the White House.gov website to pardon Edward Snowden.
Last time I checked it had 132,000 signatures.
Is that just an empty gesture?
Is that a valuable tool?
Or does that come up with a free Internal Revenue Service
audit for all the signatories?
(Laughter.) AUDIENCE: -- of the petition?
I wanted to know about what if anything the government has to do
to respond to that petition.
I just want to take a chance to talk
about the White House petitioning system because it
is something that I don't think a lot of people know about.
But the we the people site -- KURT OPSAHL: We
have one minute remaining.
MARC JAYCOX: The White House petition site
is a massive campaign tool for the Barack Obama campaign.
You give them your information and they harvest your data.
That's my quick ten seconds.
Be careful when you sign those; it's a campaign tool
for the president's election.
KURT OPSAHL: We will talk to you afterwards, but we have to move.
Sir?
AUDIENCE: Question and a comment.
So Congressman Rick Holt of New Jersey has introduced
legislation to roll back the surveillance state which asks
for repealing the Patriot Act, refiling FISA Amendments Act,
not having requirement to have back doors
in telecommunications equipment and then one more item.
What do you see as the prospects for that bill?
MARC JAYCOX: Representative Holt's bill is one
of the strongest bills presented in Congress thus far.
The only kind of Nuance with the bill is that it completely --
the government has some sort of need for a grand jury subpoena
to get some sort of information.
Representative Holt's bill doesn't have that in it.
There should be a process by which that happens, but it's
the strongest bill thus far and it is another indication that Congress
will tackle this issue and knock on wood it
will -- One quick comment because it's relevant.
He is standing for election in the democratic primary
on August 15 -- KURT OPSAHL: We are actually out of time.
But thank you all for coming.
It's wonderful to see you here.
(Applause.) KURT OPSAHL: Thank you.
It's great to be here.