[00:14.660 --> 00:16.120]  Good morning, HOPE.
[00:18.660 --> 00:21.740]  I don't know about the rest of you, but I was up really late last night.
[00:22.320 --> 00:24.560]  I got to bed around 7:30 this morning.
[00:24.980 --> 00:26.640]  So I got a couple of three hours sleep.
[00:28.220 --> 00:31.560]  I want to thank you for getting up so early to come into this talk because it's really important.
[00:33.780 --> 00:35.240]  I'll talk about this talk in a minute.
[00:35.340 --> 00:37.340]  I just want to make a couple of announcements first.
[00:38.960 --> 00:41.960]  In addition to the talks, you all know we do a lot of workshops here too.
[00:43.520 --> 00:50.780]  Down in the hardware hacking area of the mezzanine level and in the hackerspace village area.
[00:51.420 --> 00:57.100]  And also on the sixth floor, there's two rooms known as the Paris room and Budapest room.
[00:58.000 --> 01:01.840]  And it's been really a lot of good hands-on workshops going on there.
[01:02.500 --> 01:04.540]  This morning, there are two.
[01:05.800 --> 01:07.800]  One is called Hoonah Healing.
[01:08.260 --> 01:13.640]  It's really not about hacking, but maybe hacking your physiological being.
[01:14.680 --> 01:17.740]  Someone I know named Malcolm, she is teaching that.
[01:18.660 --> 01:22.780]  Basically, it's an internal well-being type of thing.
[01:23.120 --> 01:23.960]  It sounded really good.
[01:24.020 --> 01:25.400]  I probably need it after last night.
[01:26.020 --> 01:28.340]  That's at 10 o'clock on the sixth floor.
[01:28.540 --> 01:30.140]  And also this morning from 10 a.m. all the way to 1 p.m.
[01:31.580 --> 01:32.540]  It's sort of a floating thing.
[01:32.620 --> 01:34.900]  Come in when you want, but probably don't show up after 12.
[01:36.620 --> 01:40.280]  Is FCC amateur radio examinations.
[01:40.900 --> 01:42.100]  Like ham radio stuff.
[01:42.260 --> 01:43.760]  We have a station set up on the sixth floor.
[01:43.760 --> 01:49.840]  It's a special call sign issued to us by the Federal Communications Commission and 9H for this event.
[01:50.460 --> 02:00.720]  This past weekend, we've communicated with, I think, 15 or 20, at least 15 other countries with about, with just a few watts of power, low-speed data communications.
[02:02.000 --> 02:07.480]  Cuba, Czech Republic, Russia, Costa Rica, Argentina, a bunch more.
[02:08.100 --> 02:13.700]  Low-speed radio communications using no infrastructure between point A and point B.
[02:14.020 --> 02:14.540]  Pretty interesting.
[02:15.200 --> 02:16.180]  So show up.
[02:16.380 --> 02:20.260]  You may think you have no chance in hell of passing this thing, but you'd be surprised.
[02:20.380 --> 02:24.580]  I took an accountant to one of these tests a few years ago, a friend of mine, and he passed.
[02:24.660 --> 02:25.300]  He couldn't believe it.
[02:25.500 --> 02:27.260]  So go down there.
[02:27.400 --> 02:28.580]  Give it a shot after this talk.
[02:28.800 --> 02:30.380]  Go down there, sixth floor.
[02:30.760 --> 02:32.880]  It's $15, which is an FCC fee.
[02:33.260 --> 02:34.500]  And take the thing.
[02:34.500 --> 02:35.360]  You've got nothing to lose.
[02:35.520 --> 02:39.840]  And it's the closest thing we have to government-sponsored hacking, I think.
[02:40.620 --> 02:44.560]  Ham radio operators have been hacking the radio spectrum for over a century.
[02:44.880 --> 02:47.140]  It's really an awesome community, and you can do a lot with it.
[02:47.200 --> 02:50.440]  And when all these other communications modes fails, this works.
[02:51.060 --> 02:54.940]  So, sorry to drag on about that, but it's an important part of our community.
[02:56.600 --> 03:04.300]  This talk is about avoiding ubiquitous surveillance, becoming aware of it, and what you can do to avoid it.
[03:04.600 --> 03:14.880]  Everywhere you go, in the Hotel Pennsylvania, out in the streets, there are virtually countless forms of surveillance technology, all pointed at us.
[03:15.560 --> 03:23.080]  And, you know, one of my favorite quotes is, when everybody's out to get you, paranoia is just good thinking.
[03:23.080 --> 03:25.200]  Dr. Johnny Fever, WKRP.
[03:26.780 --> 03:33.000]  So, I always remember that when I see various forms of communications in public areas.
[03:33.220 --> 03:41.780]  So, without further ado, I want to introduce Greg Conti and Lisa Shay, both who have been with West Point for about a decade, teaching about this stuff.
[03:41.920 --> 03:42.660]  They're both academics.
[03:42.940 --> 03:44.040]  They really know their topic.
[03:44.200 --> 03:47.240]  We had Lisa on off the hook on the radio show last week, talking about...
[03:47.240 --> 03:48.280]  The week before last, was it?
[03:48.580 --> 03:49.240]  Last week, yeah.
[03:50.520 --> 03:57.500]  About 10 days ago, and she really explained a lot about what we should be aware of.
[03:57.560 --> 03:58.420]  Stuff I wasn't aware of.
[03:58.580 --> 04:00.680]  So, have a great talk.
[04:00.800 --> 04:01.000]  Thanks.
[04:07.200 --> 04:08.220]  Thanks very much, Bernie.
[04:08.500 --> 04:12.600]  And just as a side note, Greg and I are both ham radio operators, for what that's worth.
[04:15.540 --> 04:19.780]  So, as Bernie mentioned, we are both instructors at West Point.
[04:19.780 --> 04:21.620]  We are blessed with academic freedom.
[04:21.900 --> 04:23.240]  We teach at West Point.
[04:23.600 --> 04:26.620]  But these are our own personal views that we're giving you.
[04:26.780 --> 04:34.140]  They're not necessarily the views of West Point, the DOD, the Department of the Army, United States Government, or any other formal entity.
[04:35.580 --> 04:36.900]  And context matters.
[04:37.080 --> 04:42.500]  Some of these things that we're going to tell you about may not be legal to do in all places.
[04:42.500 --> 04:44.700]  So, common sense prevails.
[04:44.880 --> 04:48.160]  We're not out here to get anybody in trouble, especially ourselves.
[04:48.860 --> 04:50.320]  We're not lawyers, either.
[04:50.660 --> 04:54.180]  We're computer scientists and electrical engineers and ham radio operators.
[04:55.940 --> 05:00.100]  So, what we really want you to get out of this talk are basically three things.
[05:00.100 --> 05:03.940]  One, that network surveillance systems are out there.
[05:04.200 --> 05:05.380]  There's lots of them.
[05:05.640 --> 05:07.720]  We're under them even as we speak now.
[05:08.020 --> 05:12.400]  They can threaten our privacy and our way of life that we enjoy.
[05:13.620 --> 05:16.480]  Individuals can and should take steps to protect yourselves.
[05:16.780 --> 05:18.080]  Some of it's common sense.
[05:18.180 --> 05:19.980]  Some of it's more than common sense.
[05:19.980 --> 05:33.320]  But especially in this audience, with all of you, this community has the opportunity, the knowledge, the status, the networking, especially the social networking, to do more than just protect yourselves.
[05:33.320 --> 05:36.560]  You can deflect the trajectory of this surveilled future.
[05:41.030 --> 05:41.910]  So, Greg?
[05:46.720 --> 05:57.380]  So, as Bernie mentioned, you have to be blind, at least in our community, you'd have to be blind not to see the sensors that are popping up at virtually every facet of our lives.
[05:57.520 --> 05:59.020]  And some of them we invite into our homes.
[05:59.440 --> 06:05.140]  Some of them are invited into our societies or into our communities for us.
[06:05.220 --> 06:11.400]  If you've driven across the George Washington Bridge or any of the other, essentially, checkpoints coming onto the island, you're well aware.
[06:11.720 --> 06:20.540]  So, what we did is setting up the countermeasures by looking at, well, what are the trends that make us concerned that we need countermeasures in the first place?
[06:20.540 --> 06:35.440]  Well, just as an example, the government of India is planning on tracking its citizenry using a biometric identification system, you know, on the order of 1.2 billion people in kind of the first generation of this.
[06:37.320 --> 06:49.700]  There's research right now, and you think about parts of your lives that are currently opaque to various sensors or various people who'd like to separate you from your money or to keep your respective nations safe.
[06:49.700 --> 06:53.020]  And examples, you know, your living room.
[06:53.260 --> 07:05.040]  Very Orwellian, but TVs that watch you are currently under development, and the idea that they can tell if people are sitting in front, better targeted advertising, and all sorts of other potential uses.
[07:05.720 --> 07:07.260]  And the same thing in communities.
[07:07.460 --> 07:14.520]  And this is just an example that one group building a billion-dollar scientific ghost town to basically instrument the whole community.
[07:14.780 --> 07:21.140]  And, you know, largely these are for business gains, not for, you know, to build the surveillance society of the future.
[07:21.280 --> 07:29.040]  But if not, privacy is not built in with proper, you know, safeguards, then we risk doing just that.
[07:30.220 --> 07:31.780]  And then there's also applications.
[07:31.920 --> 07:35.240]  Well, what do people do with these myriad data streams that are in our environments?
[07:35.460 --> 07:37.200]  And I thought this is just one example.
[07:37.360 --> 07:44.260]  Well, if they can count emperor penguins from space, what else can they do with that type of technology?
[07:44.260 --> 07:45.980]  And not just a one-off instance.
[07:45.980 --> 07:50.980]  As we see technology evolve, you know, this type of activity really could occur in real time.
[07:52.880 --> 08:01.440]  And we see other applications, and often a trend from military technology being used in, say, law enforcement or commercial use.
[08:01.600 --> 08:04.000]  And this is just an example of a police drone.
[08:04.520 --> 08:11.700]  You know, on the website, a very Skynet-like photo of it flying over a metropolis.
[08:13.240 --> 08:16.980]  And, you know, there are technical challenges, and one of them being power.
[08:16.980 --> 08:23.300]  And we see research into better power for these mobile or fixed sensor systems.
[08:23.500 --> 08:30.160]  And example, just nuclear-powered drone research trying to go from days to months to time on station.
[08:30.780 --> 08:32.700]  Lots of investment behind it.
[08:32.880 --> 08:37.620]  Just one example of many, many, many examples is the Minneapolis-St.
[08:37.740 --> 08:42.220]  Paul launching a $20 million HD surveillance camera project.
[08:43.560 --> 08:50.060]  And for those that live in Manhattan, I think you're well aware of the surveillance system being put in place post 9-11.
[08:52.660 --> 08:54.240]  And also increased capability.
[08:54.440 --> 08:57.080]  Another use of, you know, you generate this data.
[08:57.080 --> 08:58.120]  What do you do with it?
[08:58.640 --> 08:59.680]  How can it be applied?
[08:59.740 --> 09:00.620]  How can it be mined?
[09:00.660 --> 09:02.720]  And that capability is getting better and better.
[09:03.460 --> 09:05.420]  To me, a great example is SoundHound.
[09:05.560 --> 09:09.420]  You hold it up, it gets a sample of a song, and it can tell you what the song was.
[09:09.420 --> 09:15.880]  And just imagine how powerful that is, and then what variants of that could be used for.
[09:17.620 --> 09:20.500]  Same thing with facial recognition capabilities.
[09:20.740 --> 09:26.180]  Or really, the idea of identifying people based on their physical appearance or other biometric attributes.
[09:26.420 --> 09:28.780]  Trying to get to the unique identity of a person.
[09:29.020 --> 09:31.940]  And again, getting much better active area for research.
[09:32.860 --> 09:37.020]  And when technology alone won't work, we're seeing hybrid solutions.
[09:37.300 --> 09:40.540]  That tap into what humans are good at, and what machines are good at.
[09:40.920 --> 09:47.720]  And this, just as an example, was Google using captcha to help humans decode street view addresses.
[09:50.000 --> 09:53.540]  Sensors are getting better and better on a daily basis.
[09:53.540 --> 09:59.860]  And just right now, and this basically terrifies me, the idea of real-time video through solid walls.
[09:59.860 --> 10:03.600]  So your homes aren't necessarily secure.
[10:03.700 --> 10:06.040]  And I know it's not the best view on the right-hand side.
[10:06.140 --> 10:08.500]  But it's there, and it's an emerging technology.
[10:10.740 --> 10:12.420]  Behind much of this are incentives.
[10:12.560 --> 10:19.720]  Incentives for governments, incentives for businesses, incentives for individuals to employ and use these sensor systems.
[10:20.780 --> 10:23.900]  And just, you know, people like their money.
[10:24.120 --> 10:28.660]  And, you know, this was just an example that a GPS being used for driver discounts.
[10:28.940 --> 10:31.840]  And you may have seen various marketing puffery on that.
[10:32.000 --> 10:35.520]  Trying to convince people to put these in their cars in return for a discount.
[10:36.640 --> 10:44.220]  And then in general, the justification typically is to improve your, you know, your online experience, your shopping experience.
[10:49.660 --> 10:55.400]  The key component of this is tying it to some record, some database that tells who you are.
[10:55.560 --> 10:56.940]  Because you have this data.
[10:56.940 --> 11:00.720]  You want to associate it with some person or group of people.
[11:00.900 --> 11:05.120]  And you see various attempts at coercive disclosure of identity.
[11:05.500 --> 11:09.620]  And I think you can look at Google Plus, you know, when it first came out, the real name policy.
[11:09.760 --> 11:10.880]  Trying to tie it to your real name.
[11:11.100 --> 11:12.180]  Being just one example.
[11:12.260 --> 11:14.940]  Not necessarily in this case, but the idea that you can twist people's arms.
[11:14.940 --> 11:25.920]  And either through billing records, cell phone numbers, or a variety of other means, be able to tie those data flows, attributes in those data flows to people.
[11:26.820 --> 11:34.120]  You know, if you've ever tried to get an anonymous easy pass, you'll find out how difficult or essentially impossible that is.
[11:35.100 --> 11:37.600]  And what this picture of a puppy is, is...
[11:37.600 --> 11:42.940]  So if you go onto Google and you're looking for vulnerability, this is the closest I could come to vulnerability.
[11:42.940 --> 11:46.840]  The soft underbelly of these systems...
[11:48.060 --> 11:49.140]  I tried.
[11:49.380 --> 11:50.140]  I mean, what is vulnerability?
[11:50.780 --> 11:53.640]  So Google Images is beautiful for things like that.
[11:55.480 --> 12:01.340]  But these systems themselves often aren't resilient to attack by third parties.
[12:01.600 --> 12:05.580]  And then they can get... and people can get in and use these systems that we're building.
[12:05.580 --> 12:08.140]  So this isn't legal use, this is illegal use.
[12:08.300 --> 12:09.860]  And there are examples of that.
[12:09.960 --> 12:15.900]  And Tom Cross gave a great talk in Black Hat DC that explains some of... some of the ways this could be done.
[12:18.540 --> 12:21.620]  And then you see a lot of concerning blue sky ideas.
[12:22.060 --> 12:27.080]  For example, the idea of using U.S. postal trucks as a fleet of sensor platforms.
[12:27.080 --> 12:27.840]  Right?
[12:28.120 --> 12:29.000]  I mean, think about that.
[12:29.200 --> 12:32.180]  Driving through your community, constant sensors in every...
[12:32.700 --> 12:36.500]  A sensor, you know, monitoring of the community via the U.S. postal system.
[12:36.680 --> 12:40.520]  So not that this is being implemented, but it sure does make one nervous.
[12:42.660 --> 12:46.400]  The end result of all of this is the potential for misuse is high.
[12:46.620 --> 12:49.540]  And we build it for arguably well-intentioned reasons.
[12:49.540 --> 12:58.420]  But the potential for misuse, either through a slippery slope of, you know, legitimate legal uses or illegal use.
[12:58.540 --> 13:03.260]  We're building this infrastructure that could certainly be used in negative ways.
[13:03.540 --> 13:04.780]  Very, very negative ways.
[13:05.360 --> 13:08.840]  But we'll... and we're focused on the physical world here.
[13:09.020 --> 13:11.620]  We'll leave online surveillance for another talk.
[13:12.560 --> 13:13.300]  Okay, Lisa.
[13:16.080 --> 13:23.880]  So there was a Chinese general named Sun Tzu who lived about 2,500 years ago.
[13:24.280 --> 13:29.740]  And what we're trying to educate you about actually has ancient roots.
[13:30.320 --> 13:32.920]  Sun Tzu said many, many things.
[13:33.040 --> 13:35.220]  His book is often quoted, The Art of War.
[13:35.420 --> 13:42.200]  But one of the things that he said was, If you know your enemy and you know yourself, then in 100 battles you need not fear the outcome.
[13:42.200 --> 13:44.440]  And that's what we're trying to get at here.
[13:44.620 --> 13:47.480]  We're going to look at deconstructing a surveillance system.
[13:48.080 --> 13:53.520]  And Greg and I and some colleagues at West Point have developed a surveillance system model.
[13:53.700 --> 13:58.380]  And as I talk through the different components of the model, think about what are the vulnerabilities?
[13:59.140 --> 14:02.300]  What's the soft underbelly of each of these components?
[14:03.120 --> 14:05.000]  So let's start out with the sensors.
[14:05.120 --> 14:06.100]  It's a sensor system.
[14:06.220 --> 14:07.500]  It has sensors.
[14:07.500 --> 14:13.340]  We look at sensors as an electrical engineer in sort of two broad categories.
[14:13.720 --> 14:17.280]  Sensors can be passive, which are what's down in the bottom left corner.
[14:17.460 --> 14:20.640]  They receive energy from the environment.
[14:20.900 --> 14:25.240]  And that's fundamentally what a sensor does, is it detects energy of some sort.
[14:26.660 --> 14:29.140]  You could have an active sensor as well.
[14:29.340 --> 14:30.800]  Think of a police radar gun.
[14:31.300 --> 14:36.020]  Active sensors emit some form of energy and then measure what's returned.
[14:37.600 --> 14:43.240]  All of these sensors fundamentally measure analog quantities.
[14:43.780 --> 14:47.200]  Pressure, light, heat, something like that.
[14:47.460 --> 14:53.400]  But all of these computer systems that we work with transmit and store digital information.
[14:53.660 --> 14:57.080]  So the sensors generally convert the analog to digital.
[14:57.080 --> 15:09.820]  And then there's usually a local processing and local storage that's conducted to perhaps do feature extraction, identify those identities perhaps, or the key characteristics.
[15:10.200 --> 15:12.700]  And then often that data is stored locally.
[15:13.700 --> 15:19.900]  What we're most concerned about are these networked surveillance systems or network sensor systems.
[15:19.900 --> 15:23.740]  Because data that's stored locally, you have to go there to hack it.
[15:23.820 --> 15:26.680]  It's more difficult to compromise.
[15:27.120 --> 15:32.260]  But many systems nowadays transmit data across a network.
[15:32.500 --> 15:37.840]  And I don't have to tell this community how many vulnerabilities there are when you start doing that.
[15:38.020 --> 15:43.140]  And the data is then aggregated and stored, perhaps in the cloud, stored somewhere remotely.
[15:43.140 --> 15:46.200]  And again, that has all sorts of vulnerabilities.
[15:47.460 --> 15:50.480]  Finally, none of this would really be a concern if nobody ever looked at it.
[15:50.700 --> 15:54.500]  But we're concerned about who has access to this data.
[15:55.680 --> 15:59.000]  Who are the legitimate users and what are they using it for?
[15:59.300 --> 16:05.960]  And then, of course, as Greg mentioned, these systems can be accessed by illegal third parties.
[16:05.960 --> 16:07.940]  And that's, of course, a concern to us.
[16:08.500 --> 16:12.820]  In addition, these systems don't have to necessarily be accessed by real people.
[16:13.440 --> 16:18.880]  One sensor system can talk to another sensor system or to just another network computer system.
[16:19.460 --> 16:21.360]  Think of, you know, Greg mentioned E-ZPass.
[16:21.640 --> 16:22.960]  I love E-ZPass.
[16:22.960 --> 16:25.480]  It makes my daily commute much easier.
[16:25.660 --> 16:29.100]  I like not having to stop at every bridge toll and fork over.
[16:29.240 --> 16:30.320]  Well, now it's $1.50.
[16:31.360 --> 16:32.540]  Well, I live upstate.
[16:32.740 --> 16:33.500]  Here it's way more.
[16:34.080 --> 16:36.300]  Yeah, no, you guys pay some outrageous fee.
[16:36.300 --> 16:37.800]  But yeah, I have a cheaper commute.
[16:38.100 --> 16:41.720]  So it's nice to be able to just drive through the toll booth.
[16:41.880 --> 16:50.220]  But that E-ZPass system connects to the credit card system because every couple of months, they deduct $25 or $35 off my credit card.
[16:50.560 --> 16:52.740]  So these systems talk to other systems.
[16:52.740 --> 16:55.900]  And then you wonder about the secondary security of that other system.
[16:56.340 --> 16:59.040]  So these are all definitely areas of concern.
[17:00.360 --> 17:08.280]  So now that we've known a little bit about the system as a whole, let's look at technologically-based countermeasures.
[17:08.780 --> 17:11.940]  So first off, we started with looking at the sensor.
[17:12.200 --> 17:13.880]  Let's look at the sensor vulnerabilities.
[17:14.120 --> 17:19.260]  If you're going to counteract a system, you have to understand what the characteristics are.
[17:19.700 --> 17:26.840]  Joe Grand has done some great talks on hardware hacking, including one at DEFCON 17 on smart parking meters.
[17:26.840 --> 17:36.020]  If you know what the hardware consists of, you can figure out how to reverse engineer it and potentially avoid being subject to it.
[17:38.100 --> 17:41.620]  Ultimately, you would like to deny, degrade, or defeat these sensors.
[17:42.080 --> 17:43.400]  First, you have to know where they are.
[17:43.560 --> 17:50.480]  So this is a really clever car radar detector from a company in Japan, not sold in the U.S.
[17:50.520 --> 17:51.200]  that I can find.
[17:51.400 --> 17:53.620]  It combines a GPS with a radar detector.
[17:55.220 --> 18:01.480]  Shodan and other online services can be a great source for finding some of these network sensor systems.
[18:01.820 --> 18:09.520]  If they're visible online, you can use online tools to find them, and then you know if and when you're being surveilled.
[18:11.300 --> 18:15.120]  Sometimes, the people who put these systems into place tell you about them.
[18:15.740 --> 18:16.580]  Washington, D.C.
[18:16.660 --> 18:20.220]  and lots of other local governments tell you where their traffic cameras are.
[18:20.220 --> 18:25.540]  These are designed to help commuters so you can avoid rush hour traffic jams.
[18:26.180 --> 18:33.920]  Sometimes, community organizations band together and develop databases of where these sensors are.
[18:33.920 --> 18:42.540]  You have to understand where the sensors are, what their range is, what they're covering, and then potentially, it might be just easy to bypass them.
[18:43.720 --> 18:47.380]  Maybe with a little bit of work, maybe you have to get on your knees, do it.
[18:48.120 --> 18:53.100]  But certainly, if you can bypass a sensor, that's an easy countermeasure.
[18:53.100 --> 19:01.140]  Others, if you know the more technical data about the sensor, if you know its sampling rate or its sensitivity, you can defeat it that way.
[19:02.020 --> 19:05.500]  MythBusters has done some great episodes on this, especially episode 59.
[19:05.980 --> 19:22.560]  They looked at a number of sensor systems that were defeated in movies, and of course, the hero in the movie blows a little bit of talcum powder, and you see this networked array of lasers all around, and they can just step over and step under and crawl around them.
[19:22.840 --> 19:24.220]  If only it were that easy.
[19:25.040 --> 19:27.740]  They busted a number of things that were shown in the movies.
[19:27.940 --> 19:30.360]  Not everything in the movies is true.
[19:32.580 --> 19:34.700]  But we tested a couple of these ourselves.
[19:35.140 --> 19:45.920]  We have, in our electrical engineering program, a Fluke TI-55 thermal imager, and we were able to verify that, yes, indeed, glass does block infrared.
[19:47.460 --> 19:55.480]  This is a picture of a person who's standing partly behind a glass door, and you can only see the part of the person that's not behind the glass door.
[19:56.100 --> 19:58.820]  Now, granted, that's maybe not the most practical countermeasure.
[19:58.920 --> 20:02.660]  Walking around New York City carrying a pane of glass is probably not recommended.
[20:03.760 --> 20:08.100]  But for a lighter weight, more durable alternative, try acrylic or Plexiglass.
[20:08.760 --> 20:10.640]  Works just as well, much lighter.
[20:10.980 --> 20:12.620]  Doesn't break if you happen to drop it.
[20:13.220 --> 20:15.940]  However, you might want to put handles on the backside.
[20:16.220 --> 20:20.020]  Because as you're holding the Plexiglass, it will heat up, and then you can see through it again.
[20:21.800 --> 20:27.000]  Other types of electromagnetic... or other types of energy that you might want to shield against.
[20:30.560 --> 20:31.420]  Electromagnetic energy.
[20:31.860 --> 20:33.880]  There's RFID blocking wallets.
[20:33.880 --> 20:38.980]  There's this really interesting product, a Wi-Fi shielding wallpaper that Greg and I wanted to test.
[20:39.140 --> 20:40.280]  It's not yet available.
[20:40.440 --> 20:42.040]  We saw it on a website.
[20:42.040 --> 20:43.740]  It should be out, I think, this fall.
[20:44.120 --> 20:55.920]  The neat thing about it was it alleges that it will block your Wi-Fi signals from getting out of your house, so people can't snoop and use your Wi-Fi network.
[20:56.580 --> 20:59.540]  But it will allow cell phone signals into your house.
[21:00.420 --> 21:06.160]  Which, as an electrical engineer, I find pretty fascinating because the cell phone band goes up to 1.9 gigahertz.
[21:06.420 --> 21:12.000]  And Wi-Fi, 802.11 BGN, is at 2.4 gigahertz.
[21:12.180 --> 21:15.320]  So how it can have that Sharpa filter, I think, is pretty fascinating.
[21:16.060 --> 21:18.320]  Or maybe it doesn't work so well.
[21:18.320 --> 21:18.940]  We'll have to see.
[21:21.020 --> 21:26.960]  If you want to block visible light, you could do something like put on one of these laptop copy body socks.
[21:27.920 --> 21:30.780]  It will prevent people from seeing what you're doing.
[21:31.320 --> 21:35.520]  It won't help for those people that can detect what you're typing simply by listening to you.
[21:36.260 --> 21:38.580]  And it may actually attract some attention.
[21:40.840 --> 21:41.940]  But it's a technique.
[21:42.740 --> 21:56.760]  And then, ultimately, if you're not connected to a network, if you have what's called an air gap, if your computer only is connected to your printer using a cable and it's in your house, then you're protected to a much greater extent.
[21:57.580 --> 22:00.980]  Hard to surf the Internet that way, but, you know, sometimes there's trade-offs.
[22:02.360 --> 22:03.700]  Other forms of shielding.
[22:03.700 --> 22:13.120]  Some residents of Tempe, Arizona had some issues with cameras that were posted in their neighborhoods.
[22:13.780 --> 22:18.180]  And so, around Christmas time, Santa Claus gave those cameras a present.
[22:19.760 --> 22:25.240]  You may have heard in the news lately stories about graphene making invisibility cloaks.
[22:25.520 --> 22:28.020]  It's not entirely science fiction.
[22:28.360 --> 22:33.680]  There's electromagnetic properties of graphene that will allow it to deflect electromagnetic radiation.
[22:33.700 --> 22:40.240]  These are still lab test sorts of things, but it could be coming to a theater near you.
[22:40.760 --> 22:43.900]  The military, of course, is interested in these sorts of things.
[22:44.300 --> 22:47.780]  The Navy is interested in ultraviolet cloaking.
[22:47.980 --> 22:55.700]  We have a variety of systems of chaff where you can disperse material to prevent radar from...
[22:56.620 --> 22:59.380]  to prevent your visibility to radar.
[22:59.800 --> 23:02.820]  And they're looking at being able to do that in other spectra.
[23:03.740 --> 23:09.480]  Or, instead of deflecting radiation, maybe you just want to absorb that radiation.
[23:09.480 --> 23:14.660]  If the sensor doesn't detect the reflection, then it doesn't detect you.
[23:15.220 --> 23:20.520]  So, there are radar absorbing materials and potentially other types of absorbing materials.
[23:20.920 --> 23:25.420]  Or, finally, another opportunity would be to jam that sensor.
[23:25.620 --> 23:28.720]  Send back more energy than it's expecting to receive.
[23:29.580 --> 23:31.100]  We live in just a cool world.
[23:31.220 --> 23:37.860]  You can search on the Internet for a green laser pointer at webcam and get just dozens of cool pictures like this.
[23:38.360 --> 23:44.540]  Non-destructive, at least, unless you do it a lot or at close range, or the really high power laser.
[23:45.080 --> 23:48.140]  But it's, you know, it's certainly effective at blocking the image.
[23:49.320 --> 23:53.680]  Or, you could try and destroy it with much more intense radiation.
[23:54.760 --> 23:57.680]  Again, another thing that you could find searching the Internet.
[23:57.920 --> 23:59.340]  High energy, RF guns.
[23:59.880 --> 24:02.320]  These, however, you want to be careful about.
[24:03.080 --> 24:04.440]  You can kill yourself.
[24:05.420 --> 24:06.700]  These are dangerous.
[24:06.940 --> 24:11.380]  If you point these at targets, you really want to make sure that you own the target you're pointing it at.
[24:11.380 --> 24:16.440]  Because you can do some serious damage to people or equipment.
[24:17.560 --> 24:19.640]  Lower tech ways of disabling.
[24:19.940 --> 24:22.580]  Might be something as simple as putting black tape over a lens.
[24:22.840 --> 24:27.240]  Or, for disabling audio sensors, potentially a microphone plug.
[24:27.720 --> 24:31.980]  Greg has this cool picture of the microphone plug up top.
[24:31.980 --> 24:37.380]  It is something that he found, but he hasn't actually found a real source for it.
[24:37.440 --> 24:43.040]  So, if anybody knows where you can buy one of those cool low-profile plugs, please let one of us know.
[24:44.400 --> 24:46.100]  I'd like to buy a couple thousand of them.
[24:47.980 --> 24:54.680]  I mean, I can go to Mouser or Digikey and get plugs, but they're not that cool low-profile type.
[24:54.980 --> 24:57.300]  So, you know, if you see one, let us know.
[24:58.720 --> 24:59.340]  So, Greg?
[25:03.040 --> 25:06.460]  So, what we've looked at so far is largely the energy-based.
[25:07.100 --> 25:11.420]  With the, you know, the energy being emitted, how do you block it, disperse it, and so forth.
[25:11.880 --> 25:14.280]  What this section will look at is a little bit higher level.
[25:14.600 --> 25:16.640]  How do you, more at the information level.
[25:16.860 --> 25:20.580]  And how do you deny, defeat, or degrade that in the associated processing.
[25:23.000 --> 25:25.580]  One common strategy is the idea of spoofing.
[25:25.680 --> 25:29.760]  That you're generating something that looks to be one thing, but is actually something else.
[25:29.760 --> 25:33.140]  And, you know, it's just interesting that you can go back and look.
[25:33.260 --> 25:34.760]  World War II, Operation Bodyguard.
[25:34.900 --> 25:38.820]  They had mock-ups of various vehicles to use for battlefield deception.
[25:39.020 --> 25:43.700]  And then today you see, circa 2010, Russian inflatable weapons.
[25:43.840 --> 25:45.140]  But the idea is spoofing.
[25:46.760 --> 25:47.820]  Similarly, camouflage.
[25:48.120 --> 25:56.560]  Circa World War II, dazzle camouflage used to, in some cases, hide or blend, or camouflage being used to hide or blend in to the background.
[25:56.740 --> 26:00.500]  But also to defeat being able to be locked on or divert the eye.
[26:00.680 --> 26:06.520]  So when a gunner was shooting at a target, it would divert them away from the sensitive areas.
[26:06.520 --> 26:10.820]  And then there's an example of dazzle camouflage, circa 1917.
[26:11.680 --> 26:15.800]  And interestingly, dazzle camouflage, circa 2012.
[26:16.320 --> 26:22.700]  And it's makeup and makeup, you know, techniques for defeating several things.
[26:22.840 --> 26:25.520]  One is facial detection.
[26:25.520 --> 26:33.920]  So the computer algorithm can't necessarily detect that a face is there, effectively making you invisible to the algorithm.
[26:34.160 --> 26:40.300]  Or defeating the algorithm's ability to form facial recognition.
[26:40.500 --> 26:51.200]  And there's a great talk on the right-hand side, the dazzle camouflage, facial recognition facts and fiction, and other, from DEFCON 18.
[26:53.200 --> 26:58.000]  Also, the idea of degrading information quality and inserting spurious activity.
[26:58.100 --> 27:11.560]  If you're a fan of The Prisoner, you may recall it's your funeral episode where people would deliberately insert noise, you know, try and fool people into thinking they were going to take some action, which they never did.
[27:11.940 --> 27:17.480]  Eventually lowering the threshold to the point the powers that be, the surveillers thought they were harmless.
[27:18.220 --> 27:19.980]  And then they could strike.
[27:21.300 --> 27:23.900]  And also just overcoming the processing altogether.
[27:24.320 --> 27:29.000]  Particularly powerful if you're looking at human-based processing.
[27:29.920 --> 27:38.100]  And just, I'm not advocating this, but one example out of the New York Times just earlier this year, was the idea if you want to crash the justice system, just go to trial.
[27:43.180 --> 27:50.140]  Beyond the high-level information degradation type activities, it's very useful to think of just collection, retention, storage, and lifespan.
[27:51.020 --> 27:54.860]  Of course, there's encryption for data at rest or data in transit.
[27:55.100 --> 28:01.860]  But there's other activities or other means to lower the sensor's ability to collect data.
[28:02.120 --> 28:07.040]  For example, you may have seen privacy glasses, that type of thing that only you can see what's on the screen.
[28:08.160 --> 28:13.900]  And let me just say it's a great time to be alive when there are industrial shredders that you can put a Volkswagen bug into.
[28:15.120 --> 28:17.220]  Shredders should all be an important part of our lives.
[28:17.420 --> 28:18.500]  Maybe not that big.
[28:20.500 --> 28:27.360]  But there's also the idea of de Gaussers and the idea that basically we need to have plans to destroy our data.
[28:27.620 --> 28:35.580]  Sometimes that's built into companies because they're worried about discovery of data and being able to get pulled out into a court of law, which may be an incentive.
[28:35.880 --> 28:41.520]  But in general, the idea that we need to have plans for destroying our data personally and in the people we deal with.
[28:43.020 --> 28:45.540]  And avoiding generating data in the first place.
[28:46.560 --> 28:47.820]  Sometimes we have a choice.
[28:48.780 --> 28:49.820]  Sometimes we don't.
[28:50.380 --> 28:55.520]  We need to use common sense and make sure that when we have a choice, we're not disclosing something that we shouldn't.
[28:55.580 --> 28:57.360]  And I always opt for less rather than more.
[28:57.840 --> 29:05.300]  However, becoming a Leo Luddite and attempting to live in the 21st century can be a very difficult thing.
[29:05.580 --> 29:08.940]  I like living in the 21st century and don't want to live in a cabin in Montana.
[29:09.680 --> 29:12.760]  But I think there are times in our lives where we have a choice.
[29:14.160 --> 29:17.360]  Or our companies have a choice and potentially our governments have a choice.
[29:19.200 --> 29:23.260]  Sensors themselves are part of sensor systems, often with command and control.
[29:25.420 --> 29:29.280]  There are opportunities, good and bad, for sensors to be controlled.
[29:29.500 --> 29:33.140]  This is an example of the ability to turn off cameras.
[29:33.580 --> 29:34.560]  It was a patent.
[29:34.920 --> 29:37.920]  The ability to turn off cameras by sending a certain signal to the camera.
[29:38.120 --> 29:43.760]  Personally, I find that concerning that certain entities can turn off my camera against my will.
[29:43.760 --> 29:47.860]  But nonetheless, there are perhaps mechanisms for controlling the sensors.
[29:49.400 --> 29:59.080]  But, and there are also, I mean, using the online example, we have the ability to control, using privacy settings, how much information we share to the public and to various groups.
[30:00.620 --> 30:07.780]  However, and oftentimes that you've seen that it wasn't, you know, Facebook, there's a constant series of articles out there.
[30:08.780 --> 30:11.720]  Privacy settings, shall we say, weren't all that intuitive.
[30:11.720 --> 30:16.500]  And were set with defaults that weren't all that protective of privacy.
[30:17.160 --> 30:20.420]  But beyond that, beware the illusion of control.
[30:20.640 --> 30:26.100]  So you can set your privacy settings all day for who you share information with on your social networking site.
[30:26.240 --> 30:36.480]  But you should not forget that all that data, every conceivable piece of interaction data, likely resides forever on the servers of the company that you're dealing with.
[30:36.480 --> 30:41.060]  So, but beware the illusion of control, the placebo.
[30:43.060 --> 30:44.440]  Also, denial of service.
[30:44.600 --> 30:52.700]  And I think denial of service is particularly interesting when you look at the human and the communications channel aspects of various systems.
[30:53.060 --> 30:54.700]  And I thought this was a great example.
[30:55.180 --> 31:03.320]  If the lights, if I could see you, I would say, with a show of hands, who's received robocalls that they haven't, into their lives that they haven't?
[31:03.320 --> 31:04.440]  Okay, I can see hands.
[31:04.660 --> 31:05.420]  I can see hands, yes.
[31:06.180 --> 31:10.180]  So one enterprise and company decided to build a reverse robocaller.
[31:10.900 --> 31:16.800]  So let's say a given government leader decided to call you and invite you to vote for him or her in their campaign.
[31:17.020 --> 31:26.460]  This company would allow you to dial that person back repeatedly, expressing your personal interest in not being on their list anymore.
[31:28.020 --> 31:32.040]  Now, I went back later and the company is now not offering the service.
[31:32.280 --> 31:35.000]  So I'm not sure exactly what happened, but I thought it was a great hack.
[31:37.580 --> 31:41.260]  And then beyond, and at least I'll get into this larger context in a minute.
[31:41.460 --> 31:46.820]  But, so we've talked about the sensors themselves, the energy flowing, the information.
[31:46.900 --> 31:54.180]  But we also need to understand the actors, because really they're the people building, sharing, allowing these things to take place.
[31:54.180 --> 31:55.940]  So with that, I'll turn it over to Lisa.
[31:59.710 --> 32:05.990]  So the model that I talked about a little bit ago is a technologically focused model.
[32:06.150 --> 32:14.630]  And that's important, because that's where we as technologists love to tinker and we have the expertise to exploit.
[32:14.970 --> 32:23.490]  But even more important is the ability to understand how that model fits into the real world.
[32:23.490 --> 32:29.370]  Because technological solutions aren't always the most permanent.
[32:29.690 --> 32:37.750]  If you can get a system removed entirely, then that's better than having to defeat it on an individual sensor-by-sensor basis.
[32:37.990 --> 32:42.110]  So let's look at the world that these sensor systems reside in.
[32:42.450 --> 32:45.310]  First off, these sensors have targets.
[32:45.310 --> 32:47.850]  And often that's us.
[32:48.090 --> 32:55.010]  And as users and as citizens, we should be concerned and understand what these systems are.
[32:55.150 --> 32:59.390]  And then think about how we want to interact with them.
[32:59.530 --> 33:01.610]  Or perhaps not interact with them at all.
[33:02.250 --> 33:05.970]  All of these systems are in place for a purpose.
[33:06.230 --> 33:07.510]  Who uses the data?
[33:07.810 --> 33:09.690]  Who has legal access?
[33:09.850 --> 33:10.850]  Who has illegal access?
[33:10.850 --> 33:13.250]  What are they using the data for?
[33:13.490 --> 33:23.090]  And can we strike a compromise with them that they can get some or most of the benefit of that system without unduly affecting our privacy?
[33:24.570 --> 33:26.630]  All of these systems have enablers.
[33:26.810 --> 33:34.650]  And by that we mean corporations, companies, individuals that design, build, market these systems.
[33:34.650 --> 33:48.610]  They have a financial incentive in these systems, but can they also be persuaded to build in security, build in privacy, so that their system is still profitable to them, but not as onerous to us.
[33:49.510 --> 34:04.030]  And then all of these systems that are in place are in place by some organization, some collection of people, be it a company or a government or whether it's a local municipality or a national government.
[34:05.130 --> 34:10.170]  And those owners have a vested interest in getting some benefit from these systems.
[34:10.390 --> 34:19.730]  But again, perhaps there can be a compromise struck that they still retain some, most, or all of the benefit without being detrimental to our way of life.
[34:20.650 --> 34:23.350]  And then finally, are any of these systems regulated?
[34:23.710 --> 34:24.830]  Should they be regulated?
[34:24.990 --> 34:25.930]  Can they be regulated?
[34:25.930 --> 34:39.010]  Who might best regulate them so that we can continue the way of life that we enjoy without suffering the harm that the second order effects from some of these systems?
[34:39.810 --> 34:52.070]  So, although we, as technologists, always tend to turn first towards a technological solution, it's often most effective to look at this broader context.
[34:52.070 --> 34:58.690]  So, influencing the policy and policy makers can be a very powerful way of counteracting systems.
[34:59.550 --> 35:05.010]  And in many countries in the world, including this one, we can do that through the ballot box.
[35:05.010 --> 35:15.530]  And I encourage all of you to use your right to vote in a way that, you know, to exercise your right to vote.
[35:15.530 --> 35:21.870]  We also, as technologists, have a unique ability to educate.
[35:22.130 --> 35:28.770]  Educate our friends, educate our neighbors and our communities about these systems, but then also educate the decision makers.
[35:29.210 --> 35:38.750]  And if we want to influence policy and we want to have laws that protect privacy, the policy makers need to understand the issues.
[35:38.750 --> 35:42.630]  Perhaps one of the best ways to educate is through the mass media.
[35:43.210 --> 35:52.110]  And so, Stephen Cass gave an excellent talk on how to talk to the mainstream media so that our voices become heard more broadly.
[35:53.690 --> 35:55.390]  And we can learn from history.
[35:56.310 --> 36:03.230]  Although my students sometimes think that the only important inventions occurred in the last five years, that's not always the case.
[36:03.430 --> 36:04.930]  Look to history and learn from it.
[36:06.370 --> 36:09.190]  Mass media can be influenced.
[36:09.730 --> 36:11.970]  This was a really cool billboard that we found.
[36:12.210 --> 36:16.530]  You can educate people in somewhat unobtrusive ways.
[36:16.930 --> 36:21.790]  And again, if it's just one or two people speaking out, nobody hears you.
[36:21.990 --> 36:29.610]  But if you rally support and get thousands, tens of thousands, hundreds of thousands on your side, you can make an impact.
[36:29.610 --> 36:38.050]  We all remember what happened in January when Wikipedia and major online companies boycotted the Internet.
[36:38.410 --> 36:44.330]  Yeah, and I'd add that when your parents or grandparents are asking you about what SOPA is, we've succeeded.
[36:48.670 --> 36:56.790]  And even on a local scale, the state of Pennsylvania ran an ad for tax amnesty that had these Orwellian implications.
[36:56.790 --> 36:58.870]  And it was just way over the top.
[37:00.490 --> 37:04.230]  When ads say things like, listen, Tom, we can make this easy.
[37:04.390 --> 37:10.210]  And a satellite video is zooming in on a picture of a house in presumably in Pennsylvania.
[37:10.750 --> 37:12.970]  I'd hate to be the person to actually own that house.
[37:13.110 --> 37:14.090]  Boy, would I feel paranoid.
[37:15.910 --> 37:19.730]  So this was an ad that was just kind of egregious.
[37:20.210 --> 37:22.690]  And the local community protested.
[37:23.310 --> 37:28.610]  Recently, we went back to the site where we saw that video, and it wasn't there anymore.
[37:29.990 --> 37:33.270]  So sometimes you can affect change.
[37:34.450 --> 37:45.810]  They even took that URL and some enterprising entrepreneur repurposed it for his or her own benefit.
[37:47.770 --> 37:50.510]  But it's important to communicate these issues effectively.
[37:50.950 --> 37:59.830]  When you speak to a fellow technologist, you might speak differently than you do to the mass media or than you do to decision makers.
[37:59.830 --> 38:03.010]  And so you have to communicate these issues effectively.
[38:03.790 --> 38:10.930]  Daniel Solove had a very powerful example of talking about privacy and just how sticky a concept that is.
[38:11.230 --> 38:15.310]  One of those things that we know when we see it, but how do we actually define it and talk about it?
[38:15.910 --> 38:18.030]  Art can be a powerful way to communicate.
[38:19.370 --> 38:23.110]  And again, sometimes that works.
[38:23.110 --> 38:34.270]  Science fiction is well known for communicating and raising issues of technological problems long before they actually are instantiated.
[38:35.250 --> 38:40.580]  You can often be effective if you highlight cost-benefit analyses.
[38:40.580 --> 38:51.100]  The TSA has drawn lots of attention for ways that it's surveilled us, and sometimes in very harmful ways.
[38:51.380 --> 39:02.680]  And as you draw attention to health risks or costs, the effectiveness, the users and the owners of these systems are continually doing a cost-benefit analysis.
[39:02.680 --> 39:08.740]  If the cost is too high compared to the benefit, they can be persuaded to change their methods.
[39:12.240 --> 39:19.700]  So when TSA breaks someone's $10,000 insulin pump, that's a serious problem.
[39:19.700 --> 39:27.120]  Yes, there's a legitimate security interest, but not when it comes at the cost of actually harming the citizens.
[39:28.740 --> 39:31.420]  So you can affect change.
[39:32.700 --> 39:35.060]  Transparency, we believe, is always a good thing.
[39:35.440 --> 39:39.700]  Disclosure of where these sensors are and what they're doing is important.
[39:40.760 --> 39:42.220]  Sometimes it can be embarrassing.
[39:42.920 --> 39:47.460]  Not everybody who uses sensor systems uses them for beneficial purposes.
[39:47.460 --> 39:51.080]  But transparency does help keep people honest.
[39:51.960 --> 39:57.720]  And as researchers, we advocate conducting and sharing admissible research.
[39:57.980 --> 40:00.600]  Admissible meaning invisible in a legal context.
[40:00.600 --> 40:07.060]  If research is done well, it can be introduced in some of those court cases that Greg alluded to earlier.
[40:07.660 --> 40:14.180]  We can influence laws and policymakers through the court system if we do our research well.
[40:17.380 --> 40:22.080]  And you can take these issues to Congress.
[40:22.260 --> 40:28.420]  Maybe not you personally, but people, organizations can be called to testify in front of Congress.
[40:28.800 --> 40:40.720]  And although we give Congress sometimes a hard time for some of the laws or the things they do or don't do, here's an example of a Congressional panel doing TSA oversight.
[40:41.600 --> 40:50.200]  And when in a Congressional report it says, the work of our two committees has documented a recurring pattern of mismanagement and waste at the TSA.
[40:50.740 --> 41:00.360]  Add to this an unending string of video clips, photographs, and news reports about inappropriate, clumsy, and even logical searches and screenings by TSA agents.
[41:00.580 --> 41:05.260]  I mean, that's some pretty damning commentary about another branch of government.
[41:05.620 --> 41:07.600]  So sometimes Congress does get it.
[41:08.280 --> 41:10.500]  And we do have multiple branches of government.
[41:10.860 --> 41:15.200]  You can work through the legislative arena, possibly through the judicial arena.
[41:15.440 --> 41:19.960]  We've, I think, probably all heard about the recent Brown case on GPS.
[41:21.580 --> 41:29.420]  And even the White House has taken notice with their Privacy Bill of Rights that's just been drawn up.
[41:31.460 --> 41:34.700]  So is anyone here a citizen of Sealand?
[41:36.400 --> 41:39.260]  This would be a place I can't see, but if there are.
[41:40.000 --> 41:45.340]  And not whether we're advocating these more extreme measures, but to be comprehensive in our analysis.
[41:45.340 --> 41:51.180]  I mean, certainly people have used over the, over centuries, the idea of nonviolent civil disobedience.
[41:51.620 --> 41:53.300]  Some people have started their own countries.
[41:53.760 --> 41:54.800]  Certainly hacktivism.
[41:54.900 --> 41:56.420]  People have started their own political parties.
[41:57.100 --> 42:01.760]  And there's been, in other ways, populism informed folks that they weren't, they were displeased.
[42:01.900 --> 42:03.700]  So there are other more extreme measures.
[42:03.860 --> 42:05.140]  Of course, we're not advocating them.
[42:05.620 --> 42:06.180]  All right.
[42:06.840 --> 42:11.540]  For, for less extreme measures, you know, you can do things like support your privacy champions of choice.
[42:11.540 --> 42:16.600]  Things like the, the Electronic Frontier Foundation, which has many speakers here at this conference.
[42:16.960 --> 42:28.120]  Or you could join a professional society, such as the, the IEEE or the ACM, that also help communicate to the media and to advocate to, to our legislative bodies.
[42:29.260 --> 42:32.560]  But, as always, common sense should prevail.
[42:33.560 --> 42:39.300]  A lot, a little bit of common sense can go a long way towards counteracting some of these measures.
[42:39.560 --> 42:43.540]  But also, common sense just in your, in your daily lives.
[42:43.740 --> 42:47.340]  And, and common sense in how you go about employing some of these countermeasures.
[42:48.420 --> 42:49.520]  So, Greg.
[42:49.520 --> 42:49.620]  Okay.
[42:57.010 --> 42:59.410]  So, some parting thoughts to, to wrap this up.
[43:01.450 --> 43:04.550]  This is, I was looking for a picture, a nice picture of an Ent moot.
[43:05.690 --> 43:09.390]  But I, best I could find was a good picture of, of an Ent.
[43:09.570 --> 43:13.670]  But the idea is, when you're dealing with governments, you have to expect lumbering bureaucracy.
[43:14.330 --> 43:22.450]  And, and find ways either to hack the system by finding the appropriate people that will help you, or understand the processes so you can use them most effectively.
[43:22.450 --> 43:26.510]  But don't be surprised if you run into bureaucracy, if you're trying to influence folks.
[43:27.730 --> 43:36.510]  And also, as, as much as we'd like to be smart alex, myself included, about using countermeasures, beware counter countermeasures.
[43:37.510 --> 43:44.190]  And, and this is a picture of someone who was videotaping police as they shot up a car in Miami.
[43:44.190 --> 43:47.450]  Um, and I don't know the details of, you know, how that panned out.
[43:47.550 --> 43:55.380]  But I do know that there's a video on YouTube of the individual, uh, at gunpoint, uh, where the police officer is expressing displeasure about being videotaped.
[43:56.270 --> 43:57.770]  Um, it's very compelling.
[43:58.050 --> 43:59.610]  And when you, we'll release the slides.
[43:59.650 --> 44:02.390]  If you get a chance to see this, uh, I highly recommend it.
[44:03.850 --> 44:05.590]  And don't be put off by naysayers.
[44:06.230 --> 44:14.390]  So I don't, those of you familiar with how academia works, you submit a paper to a conference, you get, uh, reviews back from various people, and they give you a grade.
[44:14.390 --> 44:16.530]  And if the grade's high enough, you get in.
[44:16.670 --> 44:28.070]  Um, so Lisa and I were writing a paper on, on a subject very close to this, where I may have mentioned something about, um, uh, total information awareness being a bad thing.
[44:29.070 --> 44:32.890]  And, and I, uh, I, I think I touched a nerve of one of the reviewers.
[44:33.770 --> 44:41.250]  And the, uh, basically, before making baseless assessments and implications, and was one of the quotes, and it sounds more like a political manifesto.
[44:41.850 --> 44:43.170]  So I may have gone a little too far.
[44:43.350 --> 44:46.090]  Uh, but nonetheless, we weren't put off by this, right?
[44:46.190 --> 44:51.890]  We, okay, we took the feedback, I touched a nerve, and it got into an even better conference about a month later.
[44:52.050 --> 44:56.890]  So you just can't be put off by naysayers, as you found with, with privacy and security.
[44:56.890 --> 44:58.950]  Uh, we'll, we'll, yes.
[45:00.570 --> 45:01.370]  Oh, ten minutes.
[45:01.450 --> 45:01.570]  Roger.
[45:01.750 --> 45:01.990]  Thank you.
[45:02.490 --> 45:02.850]  Okay.
[45:05.350 --> 45:07.210]  Okay, we're, we're one up, so we should be good.
[45:07.370 --> 45:07.930]  Okay, thanks.
[45:09.650 --> 45:10.290]  Sorry about that.
[45:10.850 --> 45:18.230]  But as you, as you're trying to do these things, you find that you can take, you can teach people about privacy and the importance of privacy at only a given rate.
[45:19.270 --> 45:22.690]  And, you know, there's only so far you can take people down the rabbit hole at first blush.
[45:22.690 --> 45:25.990]  So, just beware, don't be put off by naysayers.
[45:27.870 --> 45:33.250]  Has, I don't know if anyone's seen this flyer, it hit slash dot a while back, but it's a beautiful thing.
[45:33.790 --> 45:40.590]  Um, it, it was a flyer talking about communities against terrorism, potential indicators of terrorist activities related to Internet cafes.
[45:41.430 --> 45:48.470]  And the suspicious activities, which I frankly would propose would be great countermeasures and things we should be doing just to protect our own privacy.
[45:48.770 --> 46:01.370]  Um, included overly concerned about privacy, always paying in cash, uh, using anonymizers to shield IP address, using encryption, and finally downloading information about electronics.
[46:05.270 --> 46:09.850]  So, actually I was going to hand out these flyers today, but I thought I'd be going perhaps a little too far.
[46:10.050 --> 46:12.850]  And the idea is, we need to inform folks.
[46:13.010 --> 46:22.630]  They're well, often well intentioned, overworked, and, and I, and I, to be fair, I pulled out these because they're, but there are others in there that arguably are a good thing.
[46:22.630 --> 46:28.670]  But, eh, we need to inform folks so that we'll get better, uh, better results from our leaders.
[46:31.330 --> 46:33.370]  Also, seek actionable changes.
[46:33.790 --> 46:36.130]  Don't, you know, try and cure cancer overnight.
[46:36.470 --> 46:38.270]  I think, you know, what can be done?
[46:38.370 --> 46:41.810]  What can you go to a decision maker with that they actually can have the power to do?
[46:41.990 --> 46:47.030]  It maybe still accomplishes the end state with maybe less issues regarding privacy.
[46:47.030 --> 46:56.230]  And if you, on the left, if you've seen the initial, uh, scan, TSA scanners, uh, they're very invasive, showing essentially naked people causing an uproar.
[46:56.610 --> 47:10.070]  An incremental positive change, perhaps, is the idea of you have this more cartoonish person that doesn't, uh, that still accomplishes the objective without naked pictures of yourself being stored in a government database somewhere.
[47:11.390 --> 47:14.950]  And as you employ countermeasures, beware the risk of uniqueness.
[47:15.170 --> 47:19.550]  Make yourself more unique because you're employing the countermeasure in some way.
[47:19.690 --> 47:23.510]  And the EFF did a really neat project called PanopticLik.
[47:23.510 --> 47:25.430]  And what you did is you visited with a browser.
[47:25.430 --> 47:35.490]  And based on the information your browser passed to the server through normal interactions, they were able to uniquely identify millions and millions of browsers.
[47:36.110 --> 47:40.350]  And there's a really wonderful talk on DEFCON, DEFCON that came out after this.
[47:40.510 --> 47:47.670]  But just the idea here is beware as you employ countermeasures that you aren't making yourself more unique and more, uh, perhaps a target.
[47:48.370 --> 47:58.430]  So in conclusion, I, I, I really believe as I look and you see everywhere, once you're tuned into this, everywhere you look, you'll see more and more sensors in our lives.
[47:58.430 --> 48:04.210]  We'll see more and more information flows, aggregating this data, more and more use.
[48:04.950 --> 48:09.230]  At a minimum, we should be aware of this and sensitive to this.
[48:09.410 --> 48:11.990]  And we should, can and we should protect ourselves.
[48:12.350 --> 48:28.050]  But in particular, the community, this community like we have here in the audience today, you've got special powers, special skills that are, that are, and special insights that allow you to, to understand what's going on and help inform and shape the debate that's ongoing now,
[48:28.150 --> 48:29.770]  either through technology or in policy.
[48:30.010 --> 48:35.690]  And we can deflect the, uh, trajectory of this surveilled future, because we're gonna have to live with it otherwise.
[48:36.990 --> 48:40.870]  So for more information, we'll have this, uh, on the slide deck we share for the HOPE website.
[48:41.790 --> 48:48.510]  We, Lisa and I, and some colleagues have done some, uh, work in this space, uh, including some on, uh, automated law enforcement.
[48:48.970 --> 48:55.450]  Because if you think about the surveillance future, a natural extension of that is, Oh, well how can we enforce the laws better that way?
[48:56.030 --> 49:00.490]  So everyone will be driving 55 on the, uh, on the beltway around DC.
[49:02.970 --> 49:05.650]  So with that, uh, are there any questions?
[49:08.390 --> 49:08.990]  Is that the mic on?
[49:09.230 --> 49:10.670]  Is that the mic on?
[49:10.810 --> 49:10.970]  Yep.
[49:11.330 --> 49:11.590]  Okay.
[49:12.190 --> 49:12.590]  Yes.
[49:13.110 --> 49:15.390]  Oh, let me, let me ask that there is a microphone here.
[49:15.590 --> 49:16.850]  That's the preferred method.
[49:17.190 --> 49:19.850]  Um, otherwise I, we have to remember to repeat your questions.
[49:22.390 --> 49:23.730]  Put up the last slide, please.
[49:24.090 --> 49:24.990]  Oh, so, oh, okay.
[49:26.350 --> 49:26.830]  Oh, there you go.
[49:26.910 --> 49:27.630]  The other up there.
[49:27.790 --> 49:28.550]  The other last slide.
[49:29.990 --> 49:31.590]  Uh, do you have, can I?
[49:32.010 --> 49:32.830]  Yes, go ahead, please.
[49:33.230 --> 49:39.210]  Uh, do you have any thoughts on the proliferation of volumetric cameras, such as the Microsoft Kinect, uh, and the PrimeSense?
[49:40.470 --> 49:40.830]  Uh...
[49:40.830 --> 49:44.130]  I mean, it, it all comes down to sensors are getting better, right?
[49:44.310 --> 49:48.370]  And we're inviting them into our homes, and we're collecting data with them.
[49:48.370 --> 49:50.990]  And then it comes down to the controls of the data.
[49:51.110 --> 49:51.970]  Is the data being retained?
[49:52.150 --> 49:52.930]  Is it being shared?
[49:53.250 --> 50:04.710]  And is it, even if it's not being shared immediately with the company that you're not aware of, is it being, is, does it reside such that a court order or other entity could come in and gain access to it?
[50:04.870 --> 50:06.290]  Or is that system secure?
[50:06.530 --> 50:13.690]  So, I mean, I think in general, and that's, you know, that's just one of many sensors we're inviting to our lives, and those are the questions you ask.
[50:13.690 --> 50:15.570]  Where's the data being shared immediately?
[50:15.830 --> 50:17.050]  Is the system secure?
[50:17.310 --> 50:22.730]  And could it be, does it reside in my system such that a third party could get it perhaps through a court order?
[50:22.930 --> 50:25.310]  So, it's the networked nature of it that's most concerning?
[50:25.590 --> 50:29.990]  Yeah, I mean, if it's networked, I mean, uh, it's even more of an issue, right?
[50:30.330 --> 50:30.610]  Thank you.
[50:31.010 --> 50:31.130]  Sure.
[50:32.690 --> 50:33.130]  Yes?
[50:33.130 --> 50:33.750]  How you doing?
[50:33.990 --> 50:34.670]  I have a question.
[50:34.870 --> 50:45.630]  I'm from Philadelphia, and in Philly, we have a volunteer, I have a camera program, where if you have a private webcam that's pointing out in the street, you let the police know, and then they basically register you.
[50:45.830 --> 50:51.610]  Have you looked into legalities behind that, or have you seen any other examples of that in other cities?
[50:52.010 --> 51:04.610]  So, what you're saying is you've got, in Philadelphia, you have people that identify cameras, and then make sure that there's, like, surveillance cameras watching the public spaces, and that those are, like, in some sort of central registry?
[51:04.930 --> 51:15.710]  Yeah, like, if you have a webcam, and you just want to keep an eye on your property, and it happens to be pointing outside, you can tell your local precinct, hey, I have a web camera, it's at this address, and then they note that, so if there's a crime,
[51:15.870 --> 51:17.330]  then they can basically go to you.
[51:17.490 --> 51:17.750]  Ah.
[51:17.930 --> 51:20.070]  And as a private citizen, you can hand it over.
[51:20.330 --> 51:23.470]  Have you seen any other examples of that, or is Philly just unique in everything else?
[51:26.170 --> 51:31.690]  I haven't heard that, and I mean, I want, I mean, and this is part of the discussion we have to think about.
[51:31.770 --> 51:34.610]  I mean, you've got private citizens with censors, you have governments with censors.
[51:36.030 --> 51:38.650]  Having a central registry of that, on one hand, is good.
[51:38.730 --> 51:45.390]  I mean, I think, generally, transparency is good, but it also makes me nervous for a way I can't really figure out right now.
[51:45.730 --> 51:46.330]  Thank you very much.
[51:46.430 --> 51:46.590]  Sure.
[51:46.750 --> 51:47.030]  Thank you.
[51:48.250 --> 51:48.390]  Cool.
[51:49.190 --> 51:50.150]  Lisa, you're welcome.
[51:51.890 --> 51:52.490]  Yeah.
[51:53.030 --> 52:03.830]  Yesterday, during Steven Rambam's presentation, we were shown some slides of people with ski masks on, where you could see their eyes and maybe their skin right below their eyes.
[52:04.090 --> 52:13.550]  And according to Mr. Rambam, facial recognition only needs about 5% of someone's face.
[52:13.550 --> 52:19.050]  Yet, in your slides, you had something different, where maybe the face was being disguised.
[52:19.250 --> 52:26.550]  So, could you talk about what actually can disguise facial recognition, avoid facial recognition, and what cannot?
[52:26.870 --> 52:28.510]  Yeah, well, I mean, it depends.
[52:28.750 --> 52:31.630]  It all depends on the capability of the software and the sensors, right?
[52:31.770 --> 52:36.570]  Can they get enough of a sample that's unique enough to perform the identification that they wish?
[52:38.530 --> 52:42.570]  What I was drawing from for that slide was based on the DEFCON talk that I referenced.
[52:43.810 --> 52:56.930]  So, I mean, and in that talk, they, you know, talk about, and he demonstrated that in certain common algorithms that that facial, that makeup, those hair designs, would prevent facial detection in the first place or frustrate facial recognition.
[52:58.210 --> 53:02.690]  However, absolutely, I mean, I've listened to Steven's talks, and they're wonderful.
[53:04.490 --> 53:07.530]  I mean, if your eyes are there, you know, you're certainly at risk.
[53:07.630 --> 53:09.970]  But it just depends down on what technology are you up against, right?
[53:10.050 --> 53:11.830]  And what type of database does it have behind it?
[53:12.430 --> 53:13.050]  So, okay.
[53:13.190 --> 53:14.470]  So, we're really down to two minutes.
[53:15.070 --> 53:18.350]  I think we'll go ahead and wrap up at this time.
[53:18.870 --> 53:20.330]  And Lisa and I will be out in the hallway.
[53:20.330 --> 53:20.990]  We'll be around.
[53:20.990 --> 53:22.390]  So, we love talking about this.
[53:22.470 --> 53:23.970]  And thank you for your time and your attention.
[53:23.970 --> 53:24.490]  Thank you very much.
[53:24.690 --> 53:24.990]  Thank you very much.