One year of Snowden, what's next?
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Kurz, Constanze
Constanze Kurz - One year of Snowden, what's next? Since June 2013, disclosed by Edward Snowden, we learn more and more facts about American and British spies’ deep appetite for information, economic spying and the methods they use to collect data. They systematically tapped international communications on a scale that only few people could imagine. But what are the consequences for societies when they now know about the NSA metadata repository capable of taking in billions of "events" daily to collected and analyze? Is there a way to defend against an agency with a monstrous secret budget?
 So welcome also from me. We're going to listen to Constanza Kurz and for those of you who don't know Constanza, she is a speaker for the Cars Communication Club. They are very instrumental in Germany for many, many things regarding data privacy. And she has been expert witness to the constitutional court that finally stopped data retention first in Germany and then later on in Europe. But she's also involved in many other legal struggles and she's going to talk a bit about this. And just one statement I'd like to give in regarding that. Many of you probably know Lawrence Lasek who said code is law, right? Maybe you heard of that. What he meant by that is actually that programming determines many things in our societies. And I think we've come to realize that laws and what governments do also influences very much what we can do with programming and how programming is actually used by the government, by secret services. And that's kind of one of the topics that evolved especially in the last year. And again Constanza has launched some actions I think so far in all of the court struggles she's been involved at, she had a 100% success rate, right? So that was, and I hope she continues with that. And in other news she's also a co-writer of very interesting books about the increasing automation that we have in our societies. The German title is Arbiter Frey which means something like out of work, like automated away, something like this. And what we can expect in the next 10 years but this is not the topic of her talk now but also something she is doing. And so I'm very happy to have her and give the keynote to Constanza. Yeah thank you Holger for the very warm words and you of course for the applause since I didn't even start it, thank you very much. Yeah it's one year of Snowden, what's next? And I guess I'm happy to be back in that building as you maybe know I've been here for quite some years because the hacker community had the really largest European Congress here for quite some years and so I'm happy to be back. And speaking in front of another tech community about the Snowden revelations. It's going to be a mixture of of course technical topics but also questions of legalese and of course political questions because after that year of revelations and the revelations will go on of course. We have to ask some questions and we should show as a wider tech community that we care and that we don't accept the way it is and that we try to change it. And I will maybe in the end of the keynote have some ideas what to do about it. Since June last year we learned more and more about American and British and other spies deep appetite for data and information and of course about economics buying and about the technology they use to collect data as well as their hacking skills because they also pay a lot of hackers as we know now. And we know that the spies systematically tap international communication on an industrial scale that's what we know. And the NSA and the GCHQ and the partner services and contractors, metadata repository is capable of storing billions of transactions and events daily. So the question is if there a way to defend against an agency like the NSA with a monstrous budget and where 8,500 NSA contractors have access to the data thinking about economics buying as we know now from the Guardian and other papers revelations. After more than one year of Snowden documents we have to conclude the democratic oversight system failed at each level of oversight. So then let's see how to fix it actually. First we need to analyze what's really going on if we want to fix it of course. And I want to talk a little bit about the surveillance industry that happens to be nowadays. There is a study of privacy international, a research study of surveillance companies that offer their products nowadays. The study is a collection of what is being sold. It's also a categorization of the technologies and also an explanation of what these technologies actually do, can do and cannot do. And those companies as you see here worldwide they are 338. They sell different kinds of technologies for surveillance like cell phone monitoring equipment, interception equipment as in hardware. Of course technologies for internet monitoring, spyware packages that allow users to take complete control over the computers and over mobile devices. They even buy cell spyware packages for law enforcement mostly or secret services that allow the user to take access to all the data and even the camera and microphones. That is the status we have today. It's really an industrial complex and not only monitoring, filtering and censorship technologies but also passive and offensive hacking tools. Privacy international really did go to the marketplaces and to the fairs which are worldwide and took a look at the marketing brochures those companies have. We should have that in mind if we think about the Snowden revelations because there's a reason for all that's buying complex and the reason is simply money. Those companies usually do not take human rights concerns into account or think about the risk of misuse meaning that their products are used to target pro-democracy activists, journalists or any political opposition in regimes or as we know from the Snowden fights now in democracies. Because since those technologies in the last decades were used in regimes only we now know that they are used in democracies as well and the technical tools to defend against it should not only be used in regimes but also in democracies. In the rare case that there are export restrictions because those companies mostly come from the Western sphere and if one of the companies can get any approval to export their surveillance products from one country then they simply do it from another. That's the way it works today. We have on a political agenda the question to ask about export regulations of those technologies not only using it in our democracies. As it is the same for the secret services like NSA and GCHQ this surveillance industry lacks effective oversight or any form of accountability too. We have a problem that comes together with those industrial surveillance complex and the secret services. But really the start of the Snowden year at least on a worldwide scale was the prison scandal, the prison program. What you see here is a picture from orbit which the NASA took and artificially you see the Facebook network plotted on that photo. And I guess since the prison program mostly used social network data and made some videos and video chats and photos the scandal really emerged because most people felt that they have to care about those prison programs because everybody or at least most of the people in the western world are targeted by those mass surveillance programs. Actually I want to talk a little bit about the Pfizer decision. I come to that later. But most important for me is that that program already started in 2007 so we have the situation that those secret services have a social and communication graph from the whole western world with the history of some years. It never happened in the history of mankind actually. They know the communication pattern of everybody who uses that services. And all the companies you see there are cooperating but they do not do this willingly at most but they are legally obliged to do so. And that's why I want to talk a little bit about the Pfizer, the foreign intelligence surveillance act because it's kind of the problem which emerged of course for those companies because this Snowden year is also really a trust crisis in not only between the state and the secret services but also in the rearm of the companies. This worldwide attention to the NSA program in the beginning it was NSA and FBI and CIA and not the British GCHQ started on June 6th last year as you maybe remember. Glenn Greenwald and even MacAskill for the Guardian and Barton Gellman and Laura Poitras for the Washington Post reported on a U.S. domestic collection of foreign internet-related data. They got from a Washington Post from this June 6th. The National Security Agency and the FBI are tapping directly into the central service of nine U.S. internet companies extracting audio, video, chats, photographs, emails, document and connection logs that enable analysts to track foreign targets. So it was really, that's why I quoted this from the law's perspective, it was really intended to target U.S. citizen, not intended to target U.S. citizen but us as in European and everybody else who's not U.S. citizen or on U.S. soil. And so the discussion on a political basis today in the U.S. Congress and the U.S. Senate is just about that domestic spying. It's not a question if that form of spying or mass surveillance will end for people outside U.S. soil or non-U.S. citizen. We should keep that in mind. President is of course the system, the internal computer system that collect this data and that is what two days later on June 8th, the U.S. Director of National Intelligence released in a fact sheet. So what I speak about here is only what is, where's no demand from the U.S. governance side or from Director of National Intelligence. There are some rare cases in that year of revelations that the U.S. government said no. Here is the reporting not correct but mostly they didn't even bother to write a demand. I want to talk a little bit about the fees that is decision because in my opinion in the public sphere it's not quite clear to everybody that this form of mass surveillance is legal in the most forms because of that Pfizer Foreign Intelligence Surveillance Act. Generally speaking, under that Pfizer, any form of electronic surveillance is permissible if there is a probable cause to believe that the target is a foreign agent or foreign power and the primary purpose of the investigation is collection of foreign intelligence information. And in Section 218 of Pfizer even that requirement that foreign intelligence gathering be the primary purpose of the investigation was eliminated. Now it only requires that it be a significant purpose and this act you maybe read about it in the newspapers also established a special secret court composed of hand selected court judges to review the applications for electronic surveillance orders. But this secret court hears only the government's evidence. And the Pfizer court is not revealing any public information concerning electronic surveillance with the exception of an annual report detailing only the number the request made. So the secret Pfizer court is also a very silent court. And this silent court and secret court have never refused a single request in its 21 year history until 2002 when the Boundless US Patriot Act became law. So that is the kind of oversight we have which completely failed. Not speaking about the political oversight but the judges. But allowing secret tribes based on secret evidence with secret outcomes and no public scrutiny to ensure any form of fairness would be a talk on its own. So I stopped talking about that legal site now. Well speaking of the companies, the cooperating companies, then if a company like Google receives a valid Pfizer court order it has of course to deliver any information requested. Of course. So from the beginning and it's even after a year one of the largest scandals and all those revelations they emerged in an interesting discussion about metadata. You see on that picture an example. This is from a Greek scandal some years ago where the whole government, the president and the ministers were tapped. And this is a press conference actually a picture from a press conference where they plotted from one of those surveillance software products so that you see what metadata will be seen at the screen. Of course if you have it on a computer you can interact of course with that. The problem is that metadata and most of that surveillance stuff is really it's abstract in a way I mean it's not really, you cannot really feel the surveillance. If you sit in a cafe and there's somebody really staring at you the whole time then you would maybe say stop doing that. Don't look at my screen don't listen to my phone calls. But if you have that metadata discussion it's not the same as surveillance in a physical word. So what's really at risk here most people don't realize. But the metadata discussion goes on until now and maybe we will have a decision about that from the US Supreme Court later that year or in the next year that is possible. I come back to that metadata later of course. Why they are interested in that metadata so much is because it's significantly easier to collect and store because of the volume of the data and it's much easier to detect any anomaly. Meaning anomalies in personal communication behavior like if they are a person starting to communicate with each other is it maybe on, it's maybe in nighttime. So you can have filters or triggers in any form to detect those anomalies and ask maybe for a special identifier like phone number or E-mail numbers. And it's of course optimal for any form of automatic filtering. So that metadata discussion is not over now. Of course in Europe metadata belongs to the data that is protected by the right privacy. Maybe not the same in the US but we will maybe see from court decision this or next year. After the first revelations about the prison program and the starting metadata discussion, General Kieser-Elektander, the then director of the NSA which is of course a general because the head of the NSA is always a military guy, confirmed in two public hearings of US Congressional Intelligence Review Committees that the NSA collect both domestic and international telephone call metadata from all major US carriers and maintains a database of all such codes for five years. So we now know but actually that is for all the revelations that I speak about here. We just know nothing really changed. The SNN initiative right now in the US Congress to change some of some of those programs but actually it's just for domestic spying. It's not for European. Let's say not for us. The next step in that scandal which is the third one from, or I believe that it's one of the largest scandal is a temporal program. What you see here are commercial undersea cable which we have today. You see a little anomaly because if you would have an undersea cable today then you maybe wouldn't choose that route from UK to New York over the ocean but that come from the telegraph lines more than 100 years ago. And as the telegraph lines were invented actually they didn't know very much about the underground of the ocean so they just took a direct route. And that is the reason that more than 85% maybe of all the connections between the European continent and the Americas goes through the British island and that's why with the temporal program the GCHQ started to be part of the scandal that is the British, one of the British spy agencies. GCHQ wasn't actually exaggerating when it invented the phrase mastering the internet which is the name of one of the programs as to be found in the snow and documents. Within those temporal program some 300 GCHQ plus 250 NSA agents have the task to analyze the data that goes through the undersea cables and this is stored up for up to three days for content and up to 30 days for metadata because the volume is of course not that high. You see we talk about a 20 petabyte that means million gigabytes in that three days. And those events it's really the stuff we do every day on mobile phones and over the internet. So it's not an event like a technical term but it's our communication and our emails and our photos and stuff. And of course it's the same as in the prison program the cooperating companies which are not only the well-known companies like British Datacom or Verizon, it's also the backbone providers because of course part of the temporal program are hardware devices on the places where the undersea cable land on British soil. As we know most of the bits we click is betawrent, YouTube and U-Porn of course and to reduce the sheer volume of the data running through the undersea cables like peer-to-peer downloads. It's discarded of course by filters and this reduces the volume about by 30% maybe. And those filters not only reducing the data volume but also a triggered by words, by email addresses of phone numbers. So the data stream is actually filtered, categorized and stored if it's of any interest. All in all GCHQ and NSA which work as, yeah, it's more like it's really close working together at least in the TEPAWR program. And they use around 40,000 of those triggers to filter and analyze the data that flows over the undersea cable. So we know that for a year now and the question for all the European countries and not only Europe but worldwide actually is what we're going to do about it. We talk about the TEPAWR program here in Europe a lot but there's also an exact duplicate of the program for the PAKnet which is an Asian Pacific undersea cable net. So it's actually a worldwide undersea cable surveillance program. For my opinion at least in Germany the public debate, it's not only Germany, it's worldwide I guess, really changed when one prominent German person and her mobile phone was tapped. And to me it's until now a scandal that only this one tapping of a mobile phone which is Chancellor Angela Merkel of course is really a scandal in the political sphere and not the mass surveillance and the offensive hacking techniques we learn from. I see you agree. And since I don't have the time to follow that chronology of that year step by step because you could really need five hours for that, I just want to have a short break and tell you just in some words what happened afterwards until maybe the end of the year because I guess you remember from reading the newspaper what happened in this year. And June 21 where GCHQ's Temporal Tapping Fiber Opticabits became known which was from the Guardian. In July we also had a attack list, a target list reported by the Guardian about cyber attacks. That was a list of quite a lot of targets worldwide. In July we also learned that the NSA is buying explicitly in Asia and Hong Kong and there are also hacking attempts against China and that the US hacked PAKNAT which is the Asian Pacific Fiber Optic and then Network as I mentioned. And not only from one year or two but from 2009 on. In July 31 we also learned about X-key score which is essential to the NSA users to aggregate nearly everything from the Internet as the Guardian wrote. In August it was just one month later and we all thought it was somehow maybe the revelation stopped. We learned about even more cyber attacks by the US mostly NSA and that were 231 offences operations even in one year. And in September the first time there was really blood on the data because we learned from an article in the Washington Post that the NSA has ties to the US drone attack and that metadata and content data explicitly were dumped into the US drone program. That means that the data triggered the CIA driven drone program and well the Reaper and Predator drone with the Hellfire rocket were sent to mobile phones to deliver the bombs. So actually that was not really reported in Europe very much but in the US it was reported from the Washington Post as I said. And I guess that is a discussion we should follow closely because I think in this year 2014 we will have more of those connections between the CIA drone program and the metadata and content data collection of the NSA. Because if you want to fire a Hellfire rocket then you need the data to know which mobile phone to target. In September we even had the first cyber war attack as defined by the NATO and that was as the GCHQ targeted and spied on Belgacom which the speaker reported. Actually Belgacom is one of the main telecom carriers in Belgium and the GCHQ passively sniffing hacked some of the maintainers of the network and faked linked in pages to target those engineer and they had success and that is really a cyber war attack as defined by the NATO against another NATO country which is Belgacom. That was really interesting because that kind of attack was the first time we heard about that. We even had a location data scandal but it wasn't really reported worldwide because the NSA collection, a mass collection of US cell phone location data was only reported in English and not so much on the European country. So we have also of course not only the communication and social graph from Prism but also a geolocation program which runs geolocation profiles of course. Maybe I stop here. I mean you can read it in the newspapers and I guess as I took a look of all the papers I'm researching for that scandal for about a year now. Some of those reports in the different newspapers not only American and European but also Brazilian and Asian newspapers. I simply forget because all the small scandals in between are really forgotten when you think about the really big scandals we have here and the lack of oversight for that mafia like secret service complex. What we learned from that chronology and I took it on one slide because I wanted to have it in one place. That's what we learned over the months. These are priorities as in targets from those NSA programs. As you clearly see these are the top terrorists we have in the world. The targets are the EU institutions and also the parliament. 80 embassies worldwide, heads of foreign governments and two from those heads we know by name, Brazilian president and German Chancellor Merkel. We also have the top terrorists at the G20 meetings which were tapped. They even invented fake internet cafes to grab the passwords of the teams of the politicians meeting at the G20. Also the OPEC, the World Bank, large companies like the Brazilian Petroba. We have a list of priorities here but we have even more. We also have from the revelation the national intelligence priority framework. This is a kind of matrix from just the part you see here and you don't have to read it. I copied it. You see it in the next slide. It's a matrix of targets as in contents. What is really, what kind of topics are those secret service interested? You would maybe wait for national security issues but I copied it for Germany from that framework. What you see here are the targets in that framework. That is cyber attack counter espionage emerging strategic technologies. Clearly a top terrorist problem. International trade policy, arms export, arms control, foreign policy, objectives, economic and financial stability. What we learned from that year is that it's much more about economics buying than the political discussion and the discussion in the newspaper is about. They always argue with the question of national security but as we know from the revelations it's much more about economics buying. Actually the scantils are much more about power and access to information than about national security. If you see the ideology behind that and I quote that from the deputy attorney general, James Cole, then you have that metaphor of the haystack. He said if you're looking for a needle in the haystack you have to get the haystack first. What we learned from all those programs is that they are piling even more hay. What we also learned and I come to that in a minute is that piling on more hay doesn't really help to find the needle. But before I come back to that ideology I want to talk a little bit about the dimension of what we actually fight against now. That is part of the revelations too. It's so-called black budget. Most German countries you know about the budget, those secret services as in money or receive. When we have the 19 German secret services we know as a population what money we spent on that. That was different in the United States. The black budget revelation was really interesting to take a look at the US national intelligence budget. That is of course you see it here. Over 50 billion dollars a year and that is much more than even some of the politicians in the review committees knew. As I talked to William Binney who has been here in Berlin because we have the commission in the German Bundestag, the NSA Untersuchungsausschuss. We talked about that budget on a podium here in Berlin and he said, okay, that 50 billion dollars per year is not sufficient. And I looked at him like, what do you mean not sufficient? It's not that much or even more. He said it's even more because some of the secret service budgets are in, let's say, in military stuff. It's hiding somewhere. He said in his active time in the NSA the budget was already 80 billion dollars per year and he said that some years ago so it's maybe even more. That meaning he corrected the budget above. I was really staring at him at that moment because I thought 50 billion dollars was quite a lot. If you think about how many nurses you could pay from that or how many rockets you can send to the moon from that money. I'm running a little bit out of time. But I want to talk a little bit about the tailored access operation because most of the scandal in the public sphere talked about the mass surveillance, metadata, content data and the little and the larger scandals. But for me as a hacker it's of course interesting what they do in the tailored access operations and what kind of exploits they really have and what are the methods actually that they are using. In the Snowden papers we know now that the TAO, tailored access operations, has explored against Windows, MacOS, Linux and iOS and some more which are unnamed. Some of those exploits are really zero day exploits but most of them are known. So they spend maybe quite a lot of money to have access to those exploits. And we also learned actually that the gray and black market for computer vulnerabilities or mobile phone vulnerabilities and malware of all kinds, that gray market is paid from those secret service budgets. So we wouldn't even have that gray and black market on that large scale if they wouldn't spend that money on that. They had different methods within the TAO operation. Meaning of course back doors, that's what we expected. It was a manipulation of random number generators because that's a good way to weaken encryption. They had an intent of cooperation with NIST, NIST is a standard institute where every 10 years, new encryption standards are somewhat invented. I shouldn't say invented but NIST was really releasing a press statement and some parts they said yes we did cooperate with secret services. They even tried for that part of the data collection they had which was encrypted to get the master encryption keys with different methods and the programs they have for that called bull run for the NSA and etcher for the GCHQ. They have really $255 million a year and it's if you think about it in fact an anti-security program and it undermines of course the trust we have and the IT systems we use every day. That was really interesting to learn about the offensive strategies from those secret services. They really have a lot of hackers that they pay and it's really hard to change it on the ideological way. If you take a look at the British and the American hacker community it's quite common to work for some years for NSA contractors or even for the NSA itself. It's maybe very different from the European habits. We heard all that and I missed a lot of revelations because I don't have time to collect them all here but I want to talk a little bit about the success. So what about national security? And I copied this from the White House panel which US President Bargul Barma initiated as a commission really run by secret service veterans and even those secret service guy who clearly belong to the intelligence community wrote this in their report. The metadata of the telemedication brings only a modest contribution to the nation's security and there has been no instance in which NSA could say with confidence that the outcome of a terror investigation would have been any different without the metadata. So the stupid phrases we heard in the beginning of that scandal that all that mass surveillance explicitly metadata but also counter data would help against terrorist attack is quite nonsense and we see it in the White House report and the intelligence community itself who is sitting in that commission stated it in its own report. That was really interesting and as you maybe know it wasn't really reported at least not in German. You maybe know and I'm coming to the optimistic part of the talk now. They also targeting a tour. We know from October where the presentation the NSA presentation tour stings were published that tour is really targeting, tour is anonymizing network as you maybe know. And this July the German ID and the Zutatia Zeitung had a publication that explicitly target users, tour users are targeted. That was really interesting because they released some of the filter routes for the deep packet inspection which the NSA and the GCHQ used to have triggers for every tour user and not only tour user but also people who search for information about tour. That was really interesting because right now tour is the only affordable and reliable technology for people in for example China or Iran to communicate encrypted and anonymized with the rest of the world. One of those tour services operated by the Chaos Computer Club here in Germany. And so the data traffic to and from those so-called tour directory servers is being taken into the repositories of the NSA. And that was the reason that we fired again a criminal complaint against Angela Merkel, Anders in Germany, the head of the secret services in Germany and foreign secret services. And mostly everybody who could be maybe responsible for that because I guess at least we don't only need political help and we need technical tools to fight against those NSA must surveillance and especially targeted surveillance like that one but we also should use the laws existing and that's why we fired a criminal complaint against those aggressive surveillance in Germany directly and we just hope that the General Bundesanwalt is a state federal prosecutor to do his job and ask the NSA some questions. I'm not quite sure if this will work out but we even tried. I want to talk a little bit about other ways to defend against those mass surveillance. And a quote here from a GCHQ memo from May 2012 where the GCHQ said our main concern is that references to agency practices, meaning the scale of interception and deletion, could lead to damaging public debate which might lead to legal challenges against the current regime and the scale of interception and retention required would be fairly likely to be challenged on Article 8, the right to privacy grounds and that is exactly what we did because the Article 8 is part of the European Human Rights Convention and the UK different from the US of course ratified that convention in 1951 so it's bounded to that convention. And a big brother watch, open rights group and the English pen and myself, we had a joint application to the European Court of Human Rights in Strasbourg so we try to go the legal way, though I think we should protect ourselves on a technical way to begin with, of course. Maybe in the end of July we will know a little bit more from the court because until now we have so-called Rule 41 which means that all cases prioritized but actually the court although we have that fast track, stopped the process a little bit because of the British Tribunal which is also a secret court on UK soil where groups like Privacy International try to make a case too. And so they waited for that outcome so we just know maybe in a few days where the case goes. We just right now have a catalogue of questions for the British government and also for the German government because I'm a German citizen but until now the German government decided to not really answer any of the questions. But I guess it's just a legal way and we should try that and I'm really very satisfied that a lot of people, thousands of people spent money on that case as we had in just 48 hours the 20,000 pounds we needed for that case together. And this five or six euro come from all over Germany and in just 48 hours we had that sum we needed together. I'm very proud of that and I feel that different from the opinion you read in the newspaper people actually care and they want to support. That's our fear at least. But the legal way is one thing and to put political pressure on those responsible for that. But I think as a tech community first of all we should use encryption and not only use it but implement it. That is what we should do in our normal working habits because we as a tech community should help the normal user because he will rely on us to have working encryption because the NSA, mass surveillance programs, they doesn't scale. If just 10 or 15 percent of users really switch encryption on they get blinded and that's what we actually should do. So that's actually what I demand from you, use encryption but not only use it but implement it. Be as transparent as possible when using encryption in technologies or software you build. That is I guess to rebuild the trust that is lost that is essential for that. So be as transparent as you can. We should not only cut the budgets of the professional peeping tones but also raise the standards in general for the government to look at everyday communication data, metadata, content data, purchase records, medical records and so on. Because by its very nature mass surveillance is neither necessary nor proportionate because these technologies enable the violation of human rights. It's a human rights issue, particularly the right to privacy and also the human rights of freedom of expression. So eavesdropping on that massive scale is simply not acceptable in free society so let's fight it. Thank you. I'm not quite sure Holger, are we supposed to have a question and answer? I don't know. I don't want to be that negative. I hope you have an optimistic feeling right now. There are two microphones, you can go over there or here and we have like let's say five minutes and then we... Is this thing on? Yes. It is. Thank you for these amazing insights. Thank you. I have two questions which are actually basically one. What would happen if one of these companies at some point just says no? And what would happen if all these companies, their CEOs come together and they make the agreement and they say no? Can you tell me? Do you have any insights into that? Well, that is not such a trivial question. That's a really complex question actually. The point is I have maybe to remind you that law-interception techniques are built into all commercial telecommunication networks by law and they have standards, so-called Etsy standards. So the technique to intercept is from a legal perspective necessary to be a commercial telecom carrier in all western countries, meaning that the possibility is already there. And from a legal perspective, not only the US companies but in many European countries too, they are simply obliged to hand over the data. What they could do actually is to switch on encryption to not lock any content and in that way help the users a little bit. What they actually do right now mostly in the US is of course write open letters because they see that the trust crisis is a question of economy right now in the European and Asian markets because they see that mostly the cloud companies that, well, it really drops the partners, not even, they don't have a lot of new contracts but they also have second contracts from agent and European partners demanding from the US companies that they have special privacy contracts to the normal cloud contracts and stuff. And so the pressure from the economics fear to the US administration, it's getting higher. So maybe that trust crisis will be not solved in a political realm but in an economic realm. We have a lot of small companies who say, okay, we build our technology that way that we can't hand over data like in the TOR network or other examples. But we, the huge telecom carriers and internet companies, they don't have a choice. Well, it's interesting because if you step out for a moment and you look at what's happening, it's basically, it's the nation state, an institution with an army, which is very powerful of course, but it's interesting to think what would actually be happening on the enforcement side of things if a group of these companies just agree not to participate. Well, they actually do. Point is that we as users, we tend to use the large companies. So maybe I urge you to think more decentralized. Thank you. Hi. We're here at the Python conference. Gido Van Rassen, the creator of Python, has been working in a company that makes sure we all have our data secure, our most important data secure for the last three years. This company has just acquired a new member of the board of directors, which is Condoleezza Rice, one of the main supporters of massive surveillance, which is working at the same company of the guy who created this beautiful language. What are your thoughts about it? Yes. What you're referring to is actually the so-called revolving door, right? Is that what you meant? The so-called revolving door that you have is a lot of people who switch between companies, contractors, secret services and stuff. That's what you mean? I mean Dropbox. I don't really get to. Well, sorry. Dropbox is a company where you can keep all your most important files in the cloud. Well, Gido Van Rassen is working, the creator of Python is working for that company for the last three years. This company just added a new member to the board of directors, which is Condoleezza Rice, one of the main supporters of massive surveillance, one of the people who explained that it's necessary to have some... Now I get you. Of course, I read it in the news. Maybe since at the Hope 10 in New York, Edward Snowden referred to that case. Maybe most people are aware now. I don't have really any good comment on that. I guess it's not the only case. I feel. I think it's just something we should all think about and maybe talk to Gido about it. Thank you. Okay.感覺?
 So welcome also from me.  We're going to listen to Constanza Kurz and for those of you who don't know Constanza,  she is a speaker for the Cars Communication Club.  They are very instrumental in Germany for many, many things regarding data privacy.  And she has been expert witness to the constitutional court that finally stopped data retention first  in Germany and then later on in Europe.  But she's also involved in many other legal struggles and she's going to talk a bit about  this.  And just one statement I'd like to give in regarding that.  Many of you probably know Lawrence Lasek who said code is law, right?  Maybe you heard of that.  What he meant by that is actually that programming determines many things in our societies.  And I think we've come to realize that laws and what governments do also influences very  much what we can do with programming and how programming is actually used by the government,  by secret services.  And that's kind of one of the topics that evolved especially in the last year.  And again Constanza has launched some actions I think so far in all of the court struggles  she's been involved at, she had a 100% success rate, right?  So that was, and I hope she continues with that.  And in other news she's also a co-writer of very interesting books about the increasing  automation that we have in our societies.  The German title is Arbiter Frey which means something like out of work, like automated  away, something like this.  And what we can expect in the next 10 years but this is not the topic of her talk now  but also something she is doing.  And so I'm very happy to have her and give the keynote to Constanza.  Yeah thank you Holger for the very warm words and you of course for the applause since I  didn't even start it, thank you very much.  Yeah it's one year of Snowden, what's next?  And I guess I'm happy to be back in that building as you maybe know I've been here for quite  some years because the hacker community had the really largest European Congress here  for quite some years and so I'm happy to be back.  And speaking in front of another tech community about the Snowden revelations.  It's going to be a mixture of of course technical topics but also questions of legalese and  of course political questions because after that year of revelations and the revelations  will go on of course.  We have to ask some questions and we should show as a wider tech community that we care  and that we don't accept the way it is and that we try to change it.  And I will maybe in the end of the keynote have some ideas what to do about it.  Since June last year we learned more and more about American and British and other spies  deep appetite for data and information and of course about economics buying and about  the technology they use to collect data as well as their hacking skills because they  also pay a lot of hackers as we know now.  And we know that the spies systematically tap international communication on an industrial  scale that's what we know.  And the NSA and the GCHQ and the partner services and contractors, metadata repository is capable  of storing billions of transactions and events daily.  So the question is if there a way to defend against an agency like the NSA with a monstrous  budget and where 8,500 NSA contractors have access to the data thinking about economics  buying as we know now from the Guardian and other papers revelations.  After more than one year of Snowden documents we have to conclude the democratic oversight  system failed at each level of oversight.  So then let's see how to fix it actually.  First we need to analyze what's really going on if we want to fix it of course.  And I want to talk a little bit about the surveillance industry that happens to be nowadays.  There is a study of privacy international, a research study of surveillance companies  that offer their products nowadays.  The study is a collection of what is being sold.  It's also a categorization of the technologies and also an explanation of what these technologies  actually do, can do and cannot do.  And those companies as you see here worldwide they are 338.  They sell different kinds of technologies for surveillance like cell phone monitoring equipment,  interception equipment as in hardware.  Of course technologies for internet monitoring, spyware packages that allow users to take  complete control over the computers and over mobile devices.  They even buy cell spyware packages for law enforcement mostly or secret services that  allow the user to take access to all the data and even the camera and microphones.  That is the status we have today.  It's really an industrial complex and not only monitoring, filtering and censorship technologies  but also passive and offensive hacking tools.  Privacy international really did go to the marketplaces and to the fairs which are worldwide  and took a look at the marketing brochures those companies have.  We should have that in mind if we think about the Snowden revelations because there's a  reason for all that's buying complex and the reason is simply money.  Those companies usually do not take human rights concerns into account or think about  the risk of misuse meaning that their products are used to target pro-democracy activists,  journalists or any political opposition in regimes or as we know from the Snowden fights  now in democracies.  Because since those technologies in the last decades were used in regimes only we now know  that they are used in democracies as well and the technical tools to defend against  it should not only be used in regimes but also in democracies.  In the rare case that there are export restrictions because those companies mostly come from the  Western sphere and if one of the companies can get any approval to export their surveillance  products from one country then they simply do it from another.  That's the way it works today.  We have on a political agenda the question to ask about export regulations of those technologies  not only using it in our democracies.  As it is the same for the secret services like NSA and GCHQ this surveillance industry  lacks effective oversight or any form of accountability too.  We have a problem that comes together with those industrial surveillance complex and  the secret services.  But really the start of the Snowden year at least on a worldwide scale was the prison  scandal, the prison program.  What you see here is a picture from orbit which the NASA took and artificially you see  the Facebook network plotted on that photo.  And I guess since the prison program mostly used social network data and made some videos  and video chats and photos the scandal really emerged because most people felt that they  have to care about those prison programs because everybody or at least most of the people in  the western world are targeted by those mass surveillance programs.  Actually I want to talk a little bit about the Pfizer decision.  I come to that later.  But most important for me is that that program already started in 2007 so we have the situation  that those secret services have a social and communication graph from the whole western  world with the history of some years.  It never happened in the history of mankind actually.  They know the communication pattern of everybody who uses that services.  And all the companies you see there are cooperating but they do not do this willingly at most  but they are legally obliged to do so.  And that's why I want to talk a little bit about the Pfizer, the foreign intelligence  surveillance act because it's kind of the problem which emerged of course for those  companies because this Snowden year is also really a trust crisis in not only between  the state and the secret services but also in the rearm of the companies.  This worldwide attention to the NSA program in the beginning it was NSA and FBI and CIA  and not the British GCHQ started on June 6th last year as you maybe remember.  Glenn Greenwald and even MacAskill for the Guardian and Barton Gellman and Laura Poitras  for the Washington Post reported on a U.S. domestic collection of foreign internet-related  data.  They got from a Washington Post from this June 6th.  The National Security Agency and the FBI are tapping directly into the central service  of nine U.S. internet companies extracting audio, video, chats, photographs, emails, document  and connection logs that enable analysts to track foreign targets.  So it was really, that's why I quoted this from the law's perspective, it was really  intended to target U.S. citizen, not intended to target U.S. citizen but us as in European  and everybody else who's not U.S. citizen or on U.S. soil.  And so the discussion on a political basis today in the U.S. Congress and the U.S. Senate  is just about that domestic spying.  It's not a question if that form of spying or mass surveillance will end for people outside  U.S. soil or non-U.S. citizen.  We should keep that in mind.  President is of course the system, the internal computer system that collect this data and  that is what two days later on June 8th, the U.S. Director of National Intelligence released  in a fact sheet.  So what I speak about here is only what is, where's no demand from the U.S. governance  side or from Director of National Intelligence.  There are some rare cases in that year of revelations that the U.S. government said no.  Here is the reporting not correct but mostly they didn't even bother to write a demand.  I want to talk a little bit about the fees that is decision because in my opinion in  the public sphere it's not quite clear to everybody that this form of mass surveillance  is legal in the most forms because of that Pfizer Foreign Intelligence Surveillance Act.  Generally speaking, under that Pfizer, any form of electronic surveillance is permissible  if there is a probable cause to believe that the target is a foreign agent or foreign power  and the primary purpose of the investigation is collection of foreign intelligence information.  And in Section 218 of Pfizer even that requirement that foreign intelligence gathering be the  primary purpose of the investigation was eliminated.  Now it only requires that it be a significant purpose and this act you maybe read about  it in the newspapers also established a special secret court composed of hand selected court  judges to review the applications for electronic surveillance orders.  But this secret court hears only the government's evidence.  And the Pfizer court is not revealing any public information concerning electronic surveillance  with the exception of an annual report detailing only the number the request made.  So the secret Pfizer court is also a very silent court.  And this silent court and secret court have never refused a single request in its 21 year  history until 2002 when the Boundless US Patriot Act became law.  So that is the kind of oversight we have which completely failed.  Not speaking about the political oversight but the judges.  But allowing secret tribes based on secret evidence with secret outcomes and no public  scrutiny to ensure any form of fairness would be a talk on its own.  So I stopped talking about that legal site now.  Well speaking of the companies, the cooperating companies, then if a company like Google receives  a valid Pfizer court order it has of course to deliver any information requested.  Of course.  So from the beginning and it's even after a year one of the largest scandals and all  those revelations they emerged in an interesting discussion about metadata.  You see on that picture an example.  This is from a Greek scandal some years ago where the whole government, the president  and the ministers were tapped.  And this is a press conference actually a picture from a press conference where they  plotted from one of those surveillance software products so that you see what metadata will  be seen at the screen.  Of course if you have it on a computer you can interact of course with that.  The problem is that metadata and most of that surveillance stuff is really it's abstract  in a way I mean it's not really, you cannot really feel the surveillance.  If you sit in a cafe and there's somebody really staring at you the whole time then  you would maybe say stop doing that.  Don't look at my screen don't listen to my phone calls.  But if you have that metadata discussion it's not the same as surveillance in a physical  word.  So what's really at risk here most people don't realize.  But the metadata discussion goes on until now and maybe we will have a decision about  that from the US Supreme Court later that year or in the next year that is possible.  I come back to that metadata later of course.  Why they are interested in that metadata so much is because it's significantly easier  to collect and store because of the volume of the data and it's much easier to detect  any anomaly.  Meaning anomalies in personal communication behavior like if they are a person starting  to communicate with each other is it maybe on, it's maybe in nighttime.  So you can have filters or triggers in any form to detect those anomalies and ask maybe  for a special identifier like phone number or E-mail numbers.  And it's of course optimal for any form of automatic filtering.  So that metadata discussion is not over now.  Of course in Europe metadata belongs to the data that is protected by the right privacy.  Maybe not the same in the US but we will maybe see from court decision this or next year.  After the first revelations about the prison program and the starting metadata discussion,  General Kieser-Elektander, the then director of the NSA which is of course a general because  the head of the NSA is always a military guy, confirmed in two public hearings of US Congressional  Intelligence Review Committees that the NSA collect both domestic and international telephone  call metadata from all major US carriers and maintains a database of all such codes for  five years.  So we now know but actually that is for all the revelations that I speak about here.  We just know nothing really changed.  The SNN initiative right now in the US Congress to change some of some of those programs but  actually it's just for domestic spying.  It's not for European.  Let's say not for us.  The next step in that scandal which is the third one from, or I believe that it's one  of the largest scandal is a temporal program.  What you see here are commercial undersea cable which we have today.  You see a little anomaly because if you would have an undersea cable today then you maybe  wouldn't choose that route from UK to New York over the ocean but that come from the  telegraph lines more than 100 years ago.  And as the telegraph lines were invented actually they didn't know very much about the underground  of the ocean so they just took a direct route.  And that is the reason that more than 85% maybe of all the connections between the European  continent and the Americas goes through the British island and that's why with the temporal  program the GCHQ started to be part of the scandal that is the British, one of the British  spy agencies.  GCHQ wasn't actually exaggerating when it invented the phrase mastering the internet  which is the name of one of the programs as to be found in the snow and documents.  Within those temporal program some 300 GCHQ plus 250 NSA agents have the task to analyze  the data that goes through the undersea cables and this is stored up for up to three days  for content and up to 30 days for metadata because the volume is of course not that high.  You see we talk about a 20 petabyte that means million gigabytes in that three days.  And those events it's really the stuff we do every day on mobile phones and over the  internet.  So it's not an event like a technical term but it's our communication and our emails  and our photos and stuff.  And of course it's the same as in the prison program the cooperating companies which are  not only the well-known companies like British Datacom or Verizon, it's also the backbone  providers because of course part of the temporal program are hardware devices on the places  where the undersea cable land on British soil.  As we know most of the bits we click is betawrent, YouTube and U-Porn of course and to reduce  the sheer volume of the data running through the undersea cables like peer-to-peer downloads.  It's discarded of course by filters and this reduces the volume about by 30% maybe.  And those filters not only reducing the data volume but also a triggered by words, by email  addresses of phone numbers.  So the data stream is actually filtered, categorized and stored if it's of any interest.  All in all GCHQ and NSA which work as, yeah, it's more like it's really close working together  at least in the TEPAWR program.  And they use around 40,000 of those triggers to filter and analyze the data that flows  over the undersea cable.  So we know that for a year now and the question for all the European countries and not only  Europe but worldwide actually is what we're going to do about it.  We talk about the TEPAWR program here in Europe a lot but there's also an exact duplicate  of the program for the PAKnet which is an Asian Pacific undersea cable net.  So it's actually a worldwide undersea cable surveillance program.  For my opinion at least in Germany the public debate, it's not only Germany, it's worldwide  I guess, really changed when one prominent German person and her mobile phone was tapped.  And to me it's until now a scandal that only this one tapping of a mobile phone which is  Chancellor Angela Merkel of course is really a scandal in the political sphere and not  the mass surveillance and the offensive hacking techniques we learn from.  I see you agree.  And since I don't have the time to follow that chronology of that year step by step  because you could really need five hours for that, I just want to have a short break and  tell you just in some words what happened afterwards until maybe the end of the year  because I guess you remember from reading the newspaper what happened in this year.  And June 21 where GCHQ's Temporal Tapping Fiber Opticabits became known which was from  the Guardian.  In July we also had a attack list, a target list reported by the Guardian about cyber  attacks.  That was a list of quite a lot of targets worldwide.  In July we also learned that the NSA is buying explicitly in Asia and Hong Kong and there  are also hacking attempts against China and that the US hacked PAKNAT which is the Asian  Pacific Fiber Optic and then Network as I mentioned.  And not only from one year or two but from 2009 on.  In July 31 we also learned about X-key score which is essential to the NSA users to aggregate  nearly everything from the Internet as the Guardian wrote.  In August it was just one month later and we all thought it was somehow maybe the revelation  stopped.  We learned about even more cyber attacks by the US mostly NSA and that were 231 offences  operations even in one year.  And in September the first time there was really blood on the data because we learned  from an article in the Washington Post that the NSA has ties to the US drone attack and  that metadata and content data explicitly were dumped into the US drone program.  That means that the data triggered the CIA driven drone program and well the Reaper and  Predator drone with the Hellfire rocket were sent to mobile phones to deliver the bombs.  So actually that was not really reported in Europe very much but in the US it was reported  from the Washington Post as I said.  And I guess that is a discussion we should follow closely because I think in this year  2014 we will have more of those connections between the CIA drone program and the metadata  and content data collection of the NSA.  Because if you want to fire a Hellfire rocket then you need the data to know which mobile  phone to target.  In September we even had the first cyber war attack as defined by the NATO and that was  as the GCHQ targeted and spied on Belgacom which the speaker reported.  Actually Belgacom is one of the main telecom carriers in Belgium and the GCHQ passively  sniffing hacked some of the maintainers of the network and faked linked in pages to target  those engineer and they had success and that is really a cyber war attack as defined by  the NATO against another NATO country which is Belgacom.  That was really interesting because that kind of attack was the first time we heard about  that.  We even had a location data scandal but it wasn't really reported worldwide because  the NSA collection, a mass collection of US cell phone location data was only reported  in English and not so much on the European country.  So we have also of course not only the communication and social graph from Prism but also a geolocation  program which runs geolocation profiles of course.  Maybe I stop here.  I mean you can read it in the newspapers and I guess as I took a look of all the papers  I'm researching for that scandal for about a year now.  Some of those reports in the different newspapers not only American and European but also Brazilian  and Asian newspapers.  I simply forget because all the small scandals in between are really forgotten when you think  about the really big scandals we have here and the lack of oversight for that mafia like  secret service complex.  What we learned from that chronology and I took it on one slide because I wanted to  have it in one place.  That's what we learned over the months.  These are priorities as in targets from those NSA programs.  As you clearly see these are the top terrorists we have in the world.  The targets are the EU institutions and also the parliament.  80 embassies worldwide, heads of foreign governments and two from those heads we know  by name, Brazilian president and German Chancellor Merkel.  We also have the top terrorists at the G20 meetings which were tapped.  They even invented fake internet cafes to grab the passwords of the teams of the politicians  meeting at the G20.  Also the OPEC, the World Bank, large companies like the Brazilian Petroba.  We have a list of priorities here but we have even more.  We also have from the revelation the national intelligence priority framework.  This is a kind of matrix from just the part you see here and you don't have to read it.  I copied it.  You see it in the next slide.  It's a matrix of targets as in contents.  What is really, what kind of topics are those secret service interested?  You would maybe wait for national security issues but I copied it for Germany from that  framework.  What you see here are the targets in that framework.  That is cyber attack counter espionage emerging strategic technologies.  Clearly a top terrorist problem.  International trade policy, arms export, arms control, foreign policy, objectives, economic  and financial stability.  What we learned from that year is that it's much more about economics buying than the  political discussion and the discussion in the newspaper is about.  They always argue with the question of national security but as we know from the revelations  it's much more about economics buying.  Actually the scantils are much more about power and access to information than about  national security.  If you see the ideology behind that and I quote that from the deputy attorney general,  James Cole, then you have that metaphor of the haystack.  He said if you're looking for a needle in the haystack you have to get the haystack  first.  What we learned from all those programs is that they are piling even more hay.  What we also learned and I come to that in a minute is that piling on more hay doesn't  really help to find the needle.  But before I come back to that ideology I want to talk a little bit about the dimension  of what we actually fight against now.  That is part of the revelations too.  It's so-called black budget.  Most German countries you know about the budget, those secret services as in money or receive.  When we have the 19 German secret services we know as a population what money we spent  on that.  That was different in the United States.  The black budget revelation was really interesting to take a look at the US national intelligence  budget.  That is of course you see it here.  Over 50 billion dollars a year and that is much more than even some of the politicians  in the review committees knew.  As I talked to William Binney who has been here in Berlin because we have the commission  in the German Bundestag, the NSA Untersuchungsausschuss.  We talked about that budget on a podium here in Berlin and he said, okay, that 50 billion  dollars per year is not sufficient.  And I looked at him like, what do you mean not sufficient?  It's not that much or even more.  He said it's even more because some of the secret service budgets are in, let's say,  in military stuff.  It's hiding somewhere.  He said in his active time in the NSA the budget was already 80 billion dollars per  year and he said that some years ago so it's maybe even more.  That meaning he corrected the budget above.  I was really staring at him at that moment because I thought 50 billion dollars was quite  a lot.  If you think about how many nurses you could pay from that or how many rockets you can send  to the moon from that money.  I'm running a little bit out of time.  But I want to talk a little bit about the tailored access operation because most of  the scandal in the public sphere talked about the mass surveillance, metadata, content data  and the little and the larger scandals.  But for me as a hacker it's of course interesting what they do in the tailored access operations  and what kind of exploits they really have and what are the methods actually that they  are using.  In the Snowden papers we know now that the TAO, tailored access operations, has explored  against Windows, MacOS, Linux and iOS and some more which are unnamed.  Some of those exploits are really zero day exploits but most of them are known.  So they spend maybe quite a lot of money to have access to those exploits.  And we also learned actually that the gray and black market for computer vulnerabilities  or mobile phone vulnerabilities and malware of all kinds, that gray market is paid from  those secret service budgets.  So we wouldn't even have that gray and black market on that large scale if they wouldn't  spend that money on that.  They had different methods within the TAO operation.  Meaning of course back doors, that's what we expected.  It was a manipulation of random number generators because that's a good way to weaken encryption.  They had an intent of cooperation with NIST, NIST is a standard institute where every 10  years, new encryption standards are somewhat invented.  I shouldn't say invented but NIST was really releasing a press statement and some parts  they said yes we did cooperate with secret services.  They even tried for that part of the data collection they had which was encrypted to  get the master encryption keys with different methods and the programs they have for that  called bull run for the NSA and etcher for the GCHQ.  They have really $255 million a year and it's if you think about it in fact an anti-security  program and it undermines of course the trust we have and the IT systems we use every day.  That was really interesting to learn about the offensive strategies from those secret  services.  They really have a lot of hackers that they pay and it's really hard to change it on the  ideological way.  If you take a look at the British and the American hacker community it's quite common  to work for some years for NSA contractors or even for the NSA itself.  It's maybe very different from the European habits.  We heard all that and I missed a lot of revelations because I don't have time to collect them all  here but I want to talk a little bit about the success.  So what about national security?  And I copied this from the White House panel which US President Bargul Barma initiated  as a commission really run by secret service veterans and even those secret service guy  who clearly belong to the intelligence community wrote this in their report.  The metadata of the telemedication brings only a modest contribution to the nation's  security and there has been no instance in which NSA could say with confidence that the  outcome of a terror investigation would have been any different without the metadata.  So the stupid phrases we heard in the beginning of that scandal that all that mass surveillance  explicitly metadata but also counter data would help against terrorist attack is quite  nonsense and we see it in the White House report and the intelligence community itself  who is sitting in that commission stated it in its own report.  That was really interesting and as you maybe know it wasn't really reported at least not  in German.  You maybe know and I'm coming to the optimistic part of the talk now.  They also targeting a tour.  We know from October where the presentation the NSA presentation tour stings were published  that tour is really targeting, tour is anonymizing network as you maybe know.  And this July the German ID and the Zutatia Zeitung had a publication that explicitly  target users, tour users are targeted.  That was really interesting because they released some of the filter routes for the deep packet  inspection which the NSA and the GCHQ used to have triggers for every tour user and not  only tour user but also people who search for information about tour.  That was really interesting because right now tour is the only affordable and reliable  technology for people in for example China or Iran to communicate encrypted and anonymized  with the rest of the world.  One of those tour services operated by the Chaos Computer Club here in Germany.  And so the data traffic to and from those so-called tour directory servers is being  taken into the repositories of the NSA.  And that was the reason that we fired again a criminal complaint against Angela Merkel,  Anders in Germany, the head of the secret services in Germany and foreign secret services.  And mostly everybody who could be maybe responsible for that because I guess at least we don't  only need political help and we need technical tools to fight against those NSA must surveillance  and especially targeted surveillance like that one but we also should use the laws existing  and that's why we fired a criminal complaint against those aggressive surveillance in Germany  directly and we just hope that the General Bundesanwalt is a state federal prosecutor  to do his job and ask the NSA some questions.  I'm not quite sure if this will work out but we even tried.  I want to talk a little bit about other ways to defend against those mass surveillance.  And a quote here from a GCHQ memo from May 2012 where the GCHQ said our main concern  is that references to agency practices, meaning the scale of interception and deletion, could  lead to damaging public debate which might lead to legal challenges against the current  regime and the scale of interception and retention required would be fairly likely to be challenged  on Article 8, the right to privacy grounds and that is exactly what we did because the  Article 8 is part of the European Human Rights Convention and the UK different from the US  of course ratified that convention in 1951 so it's bounded to that convention.  And a big brother watch, open rights group and the English pen and myself, we had a joint  application to the European Court of Human Rights in Strasbourg so we try to go the legal  way, though I think we should protect ourselves on a technical way to begin with, of course.  Maybe in the end of July we will know a little bit more from the court because until now  we have so-called Rule 41 which means that all cases prioritized but actually the court  although we have that fast track, stopped the process a little bit because of the British  Tribunal which is also a secret court on UK soil where groups like Privacy International  try to make a case too.  And so they waited for that outcome so we just know maybe in a few days where the case  goes.  We just right now have a catalogue of questions for the British government and also for the  German government because I'm a German citizen but until now the German government decided  to not really answer any of the questions.  But I guess it's just a legal way and we should try that and I'm really very satisfied  that a lot of people, thousands of people spent money on that case as we had in just  48 hours the 20,000 pounds we needed for that case together.  And this five or six euro come from all over Germany and in just 48 hours we had that sum  we needed together.  I'm very proud of that and I feel that different from the opinion you read in the newspaper  people actually care and they want to support.  That's our fear at least.  But the legal way is one thing and to put political pressure on those responsible for  that.  But I think as a tech community first of all we should use encryption and not only use  it but implement it.  That is what we should do in our normal working habits because we as a tech community should  help the normal user because he will rely on us to have working encryption because the  NSA, mass surveillance programs, they doesn't scale.  If just 10 or 15 percent of users really switch encryption on they get blinded and that's  what we actually should do.  So that's actually what I demand from you, use encryption but not only use it but implement  it.  Be as transparent as possible when using encryption in technologies or software you  build.  That is I guess to rebuild the trust that is lost that is essential for that.  So be as transparent as you can.  We should not only cut the budgets of the professional peeping tones but also raise the standards  in general for the government to look at everyday communication data, metadata, content data,  purchase records, medical records and so on.  Because by its very nature mass surveillance is neither necessary nor proportionate because  these technologies enable the violation of human rights.  It's a human rights issue, particularly the right to privacy and also the human rights  of freedom of expression.  So eavesdropping on that massive scale is simply not acceptable in free society so let's  fight it.  Thank you.  I'm not quite sure Holger, are we supposed to have a question and answer?  I don't know.  I don't want to be that negative.  I hope you have an optimistic feeling right now.  There are two microphones, you can go over there or here and we have like let's say five  minutes and then we...  Is this thing on?  Yes.  It is.  Thank you for these amazing insights.  Thank you.  I have two questions which are actually basically one.  What would happen if one of these companies at some point just says no?  And what would happen if all these companies, their CEOs come together and they make the  agreement and they say no?  Can you tell me?  Do you have any insights into that?  Well, that is not such a trivial question.  That's a really complex question actually.  The point is I have maybe to remind you that law-interception techniques are built into  all commercial telecommunication networks by law and they have standards, so-called  Etsy standards.  So the technique to intercept is from a legal perspective necessary to be a commercial  telecom carrier in all western countries, meaning that the possibility is already there.  And from a legal perspective, not only the US companies but in many European countries  too, they are simply obliged to hand over the data.  What they could do actually is to switch on encryption to not lock any content and in  that way help the users a little bit.  What they actually do right now mostly in the US is of course write open letters because  they see that the trust crisis is a question of economy right now in the European and Asian  markets because they see that mostly the cloud companies that, well, it really drops the  partners, not even, they don't have a lot of new contracts but they also have second  contracts from agent and European partners demanding from the US companies that they  have special privacy contracts to the normal cloud contracts and stuff.  And so the pressure from the economics fear to the US administration, it's getting higher.  So maybe that trust crisis will be not solved in a political realm but in an economic realm.  We have a lot of small companies who say, okay, we build our technology that way that  we can't hand over data like in the TOR network or other examples.  But we, the huge telecom carriers and internet companies, they don't have a choice.  Well, it's interesting because if you step out for a moment and you look at what's happening,  it's basically, it's the nation state, an institution with an army, which is very powerful  of course, but it's interesting to think what would actually be happening on the enforcement  side of things if a group of these companies just agree not to participate.  Well, they actually do.  Point is that we as users, we tend to use the large companies.  So maybe I urge you to think more decentralized.  Thank you.  Hi.  We're here at the Python conference.  Gido Van Rassen, the creator of Python, has been working in a company that makes sure  we all have our data secure, our most important data secure for the last three years.  This company has just acquired a new member of the board of directors, which is Condoleezza  Rice, one of the main supporters of massive surveillance, which is working at the same  company of the guy who created this beautiful language.  What are your thoughts about it?  Yes.  What you're referring to is actually the so-called revolving door, right?  Is that what you meant?  The so-called revolving door that you have is a lot of people who switch between companies,  contractors, secret services and stuff.  That's what you mean?  I mean Dropbox.  I don't really get to.  Well, sorry.  Dropbox is a company where you can keep all your most important files in the cloud.  Well, Gido Van Rassen is working, the creator of Python is working for that company for  the last three years.  This company just added a new member to the board of directors, which is Condoleezza Rice,  one of the main supporters of massive surveillance, one of the people who explained that it's  necessary to have some...  Now I get you.  Of course, I read it in the news.  Maybe since at the Hope 10 in New York, Edward Snowden referred to that case.  Maybe most people are aware now.  I don't have really any good comment on that.  I guess it's not the only case.  I feel.  I think it's just something we should all think about and maybe talk to Gido about it.  Thank you.  Okay. 感覺?
Constanze_Kurz_-_One_year_of_Snowden__what_s_next__0_4187.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__4188_4811.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__4812_7511.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__7512_8483.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__8484_9743.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__9744_11471.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__11472_11675.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__11676_13571.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__13572_15155.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__15156_17063.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__17064_18443.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__18444_20543.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__20544_21875.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__21876_22703.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__22704_23567.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__23568_27443.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__27444_28175.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__28176_28751.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__28752_29183.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__29184_30347.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__30348_30443.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__30444_31295.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__31296_32747.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__32748_33503.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__33504_33683.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__33684_33959.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__33960_34103.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__34104_34907.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__34908_35819.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__35820_38375.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__38376_42059.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__42060_44315.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__44316_46655.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__46656_46751.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__46752_46919.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__46920_47951.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__47952_49019.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__49020_49487.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__49488_50687.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__50688_50975.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__50976_51395.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__51396_52427.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__52428_52583.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__52584_53963.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__53964_55751.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__55752_59579.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__59580_60167.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__60168_61259.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__61260_61391.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__61392_62951.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__62952_63815.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__63816_65243.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__65244_67691.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__67692_69143.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__69144_69623.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__69624_70463.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__70464_72263.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__72264_74123.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__74124_74279.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__74280_74927.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__74928_75419.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__75420_75935.png Constanze_Kurz_-_One_year_of_Snowden__what_s_next__75936_86986.png