[00:01.370 --> 00:02.190]  Morning, everybody.
[00:02.690 --> 00:07.350]  Welcome to HOPE 16 on a Saturday morning.
[00:07.590 --> 00:09.130]  I don't know if anyone partied last night.
[00:09.350 --> 00:13.950]  I just want to quickly tell you that, you know, in case of fire, I'm a fireman.
[00:14.010 --> 00:18.350]  In case of fire, there are four exits in the back, leads straight outside.
[00:19.850 --> 00:21.030]  Restrooms are around the hall.
[00:21.870 --> 00:24.890]  So for our first talk today, I'd like to introduce Sean O'Brien.
[00:25.050 --> 00:28.310]  He's the founder of the Yale Privacy Lab and research fellow at Yale Law School.
[00:28.590 --> 00:33.610]  He's a security researcher with extensive experience uncovering surveillance and mobile applications.
[00:34.030 --> 00:41.650]  Sean has spent over a decade advocating for digital rights, open-source solutions, and decentralized technologies.
[00:42.570 --> 00:54.470]  As the driving force behind sticktock.com, which he's going to talk about today, he leads the Privacy Safe's mission to develop a free and open-source tools that empower users to protect their privacy and regain control over their digital experiences.
[00:54.770 --> 00:55.450]  Welcome, Sean.
[00:55.630 --> 01:00.130]  If you have questions before, during, or after, please use the microphones up here.
[01:01.250 --> 01:01.630]  Awesome.
[01:01.850 --> 01:02.090]  Thank you.
[01:06.520 --> 01:09.800]  I am very excited to be on the main stage at HOPE.
[01:10.060 --> 01:11.460]  I didn't think I would ever be here.
[01:11.680 --> 01:14.320]  So this is a big sort of wish fulfillment thing for me.
[01:14.460 --> 01:14.900]  So thank you.
[01:15.060 --> 01:17.180]  And thank you for being here on a Saturday morning.
[01:17.440 --> 01:18.400]  It's not easy.
[01:18.560 --> 01:19.260]  It wasn't easy for me.
[01:19.280 --> 01:19.920]  I'll tell you that.
[01:21.680 --> 01:26.280]  So I'm going to talk about this thing called StickTock that we made, which is pretty cool.
[01:26.420 --> 01:28.320]  It's an alternative front end for TikTok.
[01:28.500 --> 01:31.320]  A lot of you folks are familiar with that probably work on that stuff.
[01:31.540 --> 01:33.040]  So we're going to do that a little bit.
[01:33.040 --> 01:40.100]  But then I'm going to show you a demonstration that I think sort of proves a point about surveillance that we really need to make.
[01:41.260 --> 01:42.800]  So, que movida con TikTok no?
[01:43.280 --> 01:44.740]  What's up with TikTok, right?
[01:46.960 --> 01:48.420]  Well, I won't talk about me.
[01:48.540 --> 01:49.480]  I had a nice little intro.
[01:49.480 --> 01:53.560]  But I've been very much involved in the whole TikTok thing, okay?
[01:55.720 --> 02:04.480]  I have been on two amicus or amicus, never sure how that's pronounced, briefs to the Supreme Court with a bunch of folks, law professors around the country.
[02:06.140 --> 02:11.740]  I basically am against any information flows stopping, right?
[02:11.740 --> 02:17.480]  I do not want to see people not on TikTok, but TikTok sucks.
[02:17.820 --> 02:18.720]  It's terrible, right?
[02:19.180 --> 02:21.540]  Okay, so I just want to get that out of the way.
[02:22.620 --> 02:24.760]  But a lot of the things are terrible, right?
[02:25.240 --> 02:28.020]  Let me fix this slide because what is going on there?
[02:28.320 --> 02:29.780]  We cannot have that.
[02:32.580 --> 02:34.320]  You're going to be cut off with everything.
[02:35.360 --> 02:37.260]  Hold on, folks.
[02:38.060 --> 02:38.820]  Much better.
[02:40.000 --> 02:40.380]  All right.
[02:41.840 --> 02:44.700]  So, this isn't just something that's academic for me.
[02:44.940 --> 02:46.800]  I've been very much involved in it.
[02:46.920 --> 02:52.400]  I've been sort of put in front of crowds and pilloried for my opinion.
[02:52.680 --> 03:00.640]  As a cyber security person, you're supposed to say that TikTok is the worst thing ever and that we're all going to destroy our lives and our phones and everything else.
[03:00.960 --> 03:02.420]  But I don't believe that.
[03:03.800 --> 03:09.080]  Privacy Lab, as the MC mentioned, this is an initiative at Yale Law School.
[03:09.260 --> 03:14.340]  We do digital self-defense workshops, what we used to call key signing parties or crypto parties, right?
[03:14.580 --> 03:18.780]  So, if you want to check out the work we do there, or if you're in New Haven, please, you know, come down.
[03:18.980 --> 03:20.660]  I see Chris Garrafa in the audience.
[03:20.820 --> 03:24.840]  He's from New Haven as well and is an awesome person you can connect with there.
[03:26.240 --> 03:26.680]  Awesome.
[03:27.480 --> 03:30.080]  So, who here uses TicTok?
[03:30.180 --> 03:30.800]  Show of hands.
[03:31.900 --> 03:32.580]  All right.
[03:33.520 --> 03:34.400]  Maybe you have to.
[03:34.620 --> 03:35.280]  Maybe you like it.
[03:35.700 --> 03:36.320]  Totally cool.
[03:36.900 --> 03:47.180]  One of the interesting things about TikTok is we now know that it is one of not only the most addictive apps that's out there, but that the psychological effects are pretty serious.
[03:47.840 --> 03:57.960]  And by that, I mean, we spend an awful lot of time on TikTok if we use it, but we don't remember nearly anything we saw on TikTok, right?
[03:58.240 --> 04:07.580]  It's a combination of both that short media format and the fact that we go on apps like that to do so-called doom scrolling.
[04:08.060 --> 04:13.240]  It's a passive thing that you're kind of disengaging your mind when you're on the platform.
[04:13.240 --> 04:13.820]  Okay.
[04:16.220 --> 04:18.280]  TikTok isn't just an app though.
[04:18.560 --> 04:21.080]  I mean, we still kind of talk about it in that context, right?
[04:21.280 --> 04:24.780]  And, you know, you talk about, say, oh, it's a Gen Z app, et cetera, et cetera.
[04:25.600 --> 04:31.260]  TikTok may be the most popular app in the United States usage wise.
[04:31.820 --> 04:42.980]  Depending on the metrics you look at, it may be bigger than all of the apps, but it's certainly the largest social app for number of minutes, number of hours in usage in the United States.
[04:43.180 --> 04:48.900]  And that's across all kinds of cultural barriers, all kinds of different demographic groups.
[04:49.060 --> 04:49.240]  Okay.
[04:50.500 --> 04:52.400]  It's also a digital marketplace.
[04:52.920 --> 04:56.240]  So the TikTok shop is becoming a really, really big deal.
[04:56.420 --> 05:02.420]  And the folks who got in on the ground floor on that are making entire business models around TikTok, right?
[05:03.200 --> 05:05.260]  Certainly it's a geopolitical bargaining chip.
[05:05.260 --> 05:08.320]  That's why we're talking about it in this context today.
[05:09.640 --> 05:11.100]  It's about information control.
[05:11.300 --> 05:12.860]  It's about information flows, right?
[05:13.120 --> 05:17.840]  This is a proxy, obviously, in a geopolitical conflict between the U.S.
[05:17.960 --> 05:18.500]  and Canada.
[05:18.960 --> 05:19.080]  Okay.
[05:19.480 --> 05:19.860]  Canada.
[05:20.140 --> 05:20.260]  Jeez.
[05:20.520 --> 05:20.920]  Sorry.
[05:21.480 --> 05:24.540]  We have a Canadian here, my friend, Mikulai Birriku.
[05:25.960 --> 05:26.840]  He's in Canada.
[05:26.840 --> 05:27.980]  So we keep talking about it.
[05:28.020 --> 05:29.000]  So it's in the back of my mind.
[05:29.340 --> 05:30.380]  It's between the U.S.
[05:30.380 --> 05:30.860]  and China.
[05:31.020 --> 05:33.040]  Canada is caught in the middle, certainly.
[05:33.240 --> 05:34.980]  And that's an important point I'll make in a second.
[05:35.940 --> 05:40.520]  This slide is from basically a group, NDIA.
[05:40.940 --> 05:42.420]  It's a defense group.
[05:42.640 --> 05:46.280]  These are private contractors, beltway contractors that work with the Pentagon.
[05:46.980 --> 05:52.540]  If you check out a lot of the information out there that is... this is unclassified, right?
[05:54.300 --> 05:59.140]  This kind of stuff has been talked about for a very long time by defense contractors.
[05:59.440 --> 05:59.660]  Okay?
[06:00.320 --> 06:04.400]  This is how the defense industry sees China.
[06:04.760 --> 06:05.120]  Okay?
[06:05.380 --> 06:09.740]  This is in the context of, of course, electronics, as they say here.
[06:10.120 --> 06:12.760]  But it's an iceberg for them, right?
[06:13.140 --> 06:15.220]  They've been constantly just beating this drum.
[06:15.320 --> 06:16.500]  This is from a few years ago.
[06:16.640 --> 06:20.440]  And they say this is a strategic issue where we're only seeing the tip of the iceberg.
[06:20.440 --> 06:23.800]  And there's this huge amount of stuff that we don't see.
[06:24.280 --> 06:32.280]  And they've been gearing up for a geopolitical conflict with China for a very, very long time in the context of digital technology.
[06:32.480 --> 06:32.840]  Okay?
[06:34.100 --> 06:35.900]  So let's panic, right?
[06:36.660 --> 06:47.860]  This is a good meme from a couple days before the actual ban on TikTok was supposed to go into effect, sort of went into effect back in January.
[06:48.560 --> 06:52.140]  Now, I think this was a real cultural moment.
[06:52.400 --> 06:53.920]  Obviously, it was all over the television.
[06:53.920 --> 06:55.060]  You can get away from it.
[06:55.140 --> 06:55.920]  It was all over the Internet.
[06:55.920 --> 06:57.160]  People were talking about it.
[06:57.280 --> 06:59.720]  And there was a bit of an exodus, right?
[07:00.400 --> 07:01.560]  Not this exodus.
[07:01.960 --> 07:04.380]  This exodus is exodus privacy.
[07:05.000 --> 07:08.240]  They're a great group that I've worked with in France.
[07:08.580 --> 07:12.920]  And they do tracker analysis, basically trackers, as we call them.
[07:13.160 --> 07:16.580]  At Yale Privacy Lab, we come up with, basically, do static analysis.
[07:16.900 --> 07:19.460]  We get snippets of these sort of signatures.
[07:19.780 --> 07:24.220]  And then we send those upstream to exodus privacy.
[07:24.480 --> 07:26.180]  They put it in their tracker database.
[07:26.480 --> 07:31.020]  These SDKs that are in these Android apps are then identified by their automated tool.
[07:31.580 --> 07:37.240]  And then FDroid actually hooks into their API and scans all the apps for it as well.
[07:37.340 --> 07:39.820]  I think the Aurora store also does that now.
[07:39.980 --> 07:41.480]  So it's very good work that they do.
[07:41.640 --> 07:45.260]  But maybe we should be a little afraid of TikTok, right?
[07:45.540 --> 07:47.320]  There are these trackers in TikTok.
[07:47.560 --> 07:52.220]  There's no doubt that there's a huge privacy problem with TikTok, right?
[07:54.780 --> 07:59.680]  The ban itself is obviously some sort of geopolitical mess, right?
[07:59.780 --> 08:02.340]  We're talking about three different administrations here, technically.
[08:02.840 --> 08:07.420]  The first Trump administration, the Biden administration, and now Trump two.
[08:08.200 --> 08:11.120]  Let's hope there's not a Trump three, but who knows?
[08:12.440 --> 08:20.420]  Anyway, and this has obviously just gone back and forth, back and forth, like all of the nonsense around tariffs.
[08:20.840 --> 08:25.760]  When I talk about this issue, I call it a data tariff issue, okay?
[08:25.980 --> 08:29.720]  That's the correct context, in my opinion, to be talking about TikTok.
[08:30.140 --> 08:32.600]  These information flows are valuable.
[08:33.100 --> 08:35.460]  This data is a commodity, okay?
[08:35.760 --> 08:41.600]  And United States big tech companies want that commodity for themselves.
[08:41.640 --> 08:45.540]  And certainly the executive branch has listened, right?
[08:47.400 --> 08:48.920]  Now, the flip-flopping.
[08:49.820 --> 08:53.760]  This is what apparently happens, right, with Trump.
[08:54.260 --> 08:57.960]  Kicking it down the road, kicking it down the road, 90 days, 90 days, 90 days.
[08:58.380 --> 08:59.920]  Who knows what's going to go on?
[09:01.200 --> 09:14.400]  What we do know is that when the ban happened, ban, back in January and February, sort of, there was this big drop-off of usage, right?
[09:15.920 --> 09:25.080]  From TikTok, so this is the competitors, the people using TikTok started jumping to these other Chinese-affiliated apps, right?
[09:25.480 --> 09:27.600]  The big one being Red Note, right?
[09:28.160 --> 09:31.420]  Red Note is a worse security disaster than TikTok.
[09:31.680 --> 09:32.620]  I'm not going to go into it.
[09:33.040 --> 09:37.660]  But it was a sign, especially that Gen Z was rebelling.
[09:37.980 --> 09:47.780]  They were purposefully going to awful, from a privacy perspective, awful from a security perspective, awful from an open-source perspective, apps.
[09:48.280 --> 09:55.520]  They were going to Red Note, they were going to Lemonade, they were going to these things, just to stick it to the man, so to speak.
[09:55.680 --> 09:55.780]  Right?
[09:56.020 --> 09:59.680]  Just to make a point that they were going to use Chinese apps, no matter what.
[09:59.940 --> 10:00.160]  Right?
[10:01.940 --> 10:06.620]  But who actually benefited the What's the most from the so-called ban on TikTok?
[10:07.660 --> 10:09.600]  Well, we have some numbers now.
[10:10.000 --> 10:16.060]  So the little experiment of it being offline for a short time gave us some data, which is very interesting.
[10:16.920 --> 10:30.520]  As you can see, there's an enormous amount of money that can be made by Meta specifically, with folks jumping to Instagram specifically, if they leave TikTok and go to that platform.
[10:30.520 --> 10:39.340]  And we did see some of that happen already, especially folks who have entire businesses around TikTok, who are influencers around TikTok.
[10:39.340 --> 10:42.620]  They were saying, you know, crap, I've got to use Instagram.
[10:42.620 --> 10:48.700]  I've got to get in there because my entire business could just be banned with my entire audience or a huge portion of my audience.
[10:49.200 --> 10:54.000]  Snap is another one that benefits, and there's some other intermediaries as well in the United States.
[10:54.000 --> 11:04.980]  But this commodity, this data, already has started flowing into big tech, into U.S.-affiliated Silicon Valley firms, instead of, obviously, Chinese-affiliated firms.
[11:06.820 --> 11:08.760]  There's all kinds of research around this.
[11:08.920 --> 11:12.560]  We don't have time to go into it, basically, but you can look into the research itself.
[11:12.560 --> 11:18.320]  We don't get these kinds of experiments that often in the real world with our platforms.
[11:18.540 --> 11:28.100]  So it's a very interesting one to look at, seeing where the data flows went, seeing where the advertising revenue went, seeing where the attention went, really.
[11:28.580 --> 11:30.660]  And there's some good papers out there I recommend.
[11:30.920 --> 11:33.160]  This presentation, by the way, I'm going to give you a link at the end.
[11:33.280 --> 11:36.460]  You can just download the presentation, remix it, do whatever you want with it.
[11:37.340 --> 11:38.820]  Now, let's talk about StickTock.
[11:39.440 --> 11:41.650]  Okay, so sticktock.com.
[11:42.140 --> 11:45.380]  You can go out there now on your phones if you'd like, laptops, et cetera.
[11:45.880 --> 11:49.360]  This is a free and open-source alternative front-end for TikTok.
[11:50.500 --> 11:54.060]  It's got a lot of code from another project called Off-TikTok.
[11:54.880 --> 11:58.300]  If the developer of Off-TikTok is here, we would love to talk to you.
[11:58.440 --> 12:02.440]  I tried reaching out over the channels, but maybe that person doesn't want to be contacted.
[12:03.500 --> 12:03.920]  Okay.
[12:03.920 --> 12:09.940]  Anyway, StickTock is basically a tool that proves a point.
[12:10.280 --> 12:12.920]  We were trying to get a point across with a proof of concept.
[12:13.120 --> 12:21.400]  It's not a full-fleshed out NVIDIA style or Knitter style front-end that's going to give you a reasonable experience as if you were on TikTok.
[12:21.680 --> 12:27.660]  But what it will do, it will allow you to pop in a URL that someone shares with you from TikTok.
[12:27.660 --> 12:33.740]  It will download the video from TikTok to a server that's in Iceland, not the United States, not China.
[12:34.040 --> 12:34.360]  Okay.
[12:34.700 --> 12:37.180]  There are no trackers, no tracking code.
[12:37.320 --> 12:38.780]  We don't want to know anything about you.
[12:38.980 --> 12:40.240]  There's a .onion for this.
[12:40.360 --> 12:41.900]  So there's a Tor hidden service for this.
[12:42.680 --> 12:44.520]  And you can just watch that video.
[12:45.180 --> 12:49.740]  If I go out there now, which I will do, and let's see if I mess up the demo or not.
[12:50.580 --> 12:50.980]  Okay.
[12:52.280 --> 12:53.260]  I don't think so.
[12:53.360 --> 12:53.800]  Not this one.
[12:53.860 --> 12:55.720]  The second demo is a little trickier.
[12:57.780 --> 13:01.740]  So this, by the way, TikTok, it was sponsored by our project PrivacySafe.
[13:02.400 --> 13:03.920]  We're building a lot of very cool apps.
[13:04.260 --> 13:05.840]  Mikulai talked about that yesterday.
[13:06.260 --> 13:10.920]  John Kiriakou will be talking about it a little bit as part of his speech today at 4 p.m.
[13:11.640 --> 13:15.080]  So that's the project we're doing this TikTok project under.
[13:16.140 --> 13:18.940]  If you go out to sticktock.com, how does that look?
[13:19.420 --> 13:20.120]  It's okay.
[13:20.120 --> 13:21.380]  And you click watch TikTok.
[13:24.160 --> 13:28.820]  You will get the latest TikTok videos that people have popped into that URL bar.
[13:29.320 --> 13:29.420]  Okay?
[13:30.020 --> 13:30.620]  And they play.
[13:31.300 --> 13:34.660]  And you can swipe and do the TikTok thing.
[13:36.160 --> 13:36.640]  Okay.
[13:37.480 --> 13:38.480]  That's enough of that.
[13:41.600 --> 13:52.080]  Why if all of these folks who are much more powerful than our little dev team, who had a lot more time than our little dev team, a lot more resources than our little dev team, okay?
[13:52.900 --> 14:08.260]  Why, if they were so concerned about the privacy of Americans, right, did they not develop, maybe even working with the TikTok folks, the folks at ByteDance, another front end or app for TikTok that doesn't spy on people?
[14:08.480 --> 14:08.960]  Okay?
[14:10.000 --> 14:11.460]  That's the open question here.
[14:11.560 --> 14:17.900]  And that's the question I think we should be asking about these terrible intermediaries that are gobbling up our data and spying on us.
[14:17.900 --> 14:22.820]  We need to be pushing back by actually implementing stuff and getting it out there into the world, right?
[14:24.120 --> 14:26.140]  And we need to make it as portable as possible.
[14:26.320 --> 14:29.340]  There are some folks already who are running their own TikTok servers.
[14:29.760 --> 14:31.240]  There's a Docker image for this.
[14:31.500 --> 14:33.600]  It's not the easiest thing to deploy, but you can do it.
[14:34.080 --> 14:36.780]  Plugs into the TikTok API, so your mileage may vary.
[14:38.560 --> 14:41.760]  Cory Doctorow was amazing and helped us promote this, which is great.
[14:41.760 --> 14:48.180]  Obviously, you all know who he is, and he cares very much about information.
[14:48.560 --> 14:50.980]  Also, does not like TikTok, right?
[14:51.220 --> 14:52.860]  So you can have that opinion.
[14:53.060 --> 14:56.580]  It is okay to say, we don't want to ban things.
[14:56.640 --> 14:59.040]  We understand there's a problem with this platform.
[14:59.040 --> 15:08.940]  We also don't want to get into the geopolitical tit-for-tat conflict between the U.S. Empire and China, which Canada is caught in the middle of.
[15:12.040 --> 15:17.640]  I'm not going to go through all the promotion, but I just want to give shout-outs in the presentation to the folks who did actually cover us.
[15:17.640 --> 15:21.740]  We served up around 50,000 videos, I think, in the first month.
[15:21.980 --> 15:23.440]  It's a little more than that now.
[15:23.760 --> 15:29.100]  We see peaks, obviously, when the ban gets, you know, supposedly is going to happen again.
[15:30.240 --> 15:33.680]  And it is one of our most popular sites out there right now.
[15:35.280 --> 15:38.360]  But the bottom line here, obviously, is that there's strength in numbers.
[15:38.800 --> 15:42.640]  Sort of, this is my little bit of a call to action here in the middle of the presentation.
[15:43.320 --> 15:46.700]  The people in this room, and it's not like just use StickTock.
[15:46.800 --> 15:48.420]  It would be great to have help with this, by the way.
[15:48.520 --> 15:51.260]  It would be great for you all to contribute or help us.
[15:51.480 --> 15:56.260]  You'll see, for example, there are issues out there that will say things like StickTock is down.
[15:56.420 --> 16:00.820]  That tends to be the biggest issue we get because that's what people are using it for.
[16:00.940 --> 16:05.840]  And when it doesn't take their video, et cetera, you know, we get an issue with some vague sort of filing.
[16:06.460 --> 16:08.840]  It would be nice to have some triaging and some help with that.
[16:08.840 --> 16:13.560]  But we need to be building alternative front ends and embracing alternative front ends again.
[16:14.380 --> 16:19.140]  I've noticed and I've seen, and it's partially because of the lawfare around all of this, of course.
[16:19.620 --> 16:21.780]  Partially because of the threats around all of this, of course.
[16:22.200 --> 16:26.300]  I've seen a lot of the alternative front ends we did have stop working, right?
[16:26.500 --> 16:30.600]  There used to be proxy talk, which was an alternative front end for TikTok.
[16:30.980 --> 16:36.060]  When I went out to look for something to use, I went out to look for it and it was hopelessly broken.
[16:36.060 --> 16:36.780]  Okay.
[16:37.220 --> 16:42.720]  So we need to fix these things, polish these things, and get these things out there.
[16:42.920 --> 16:44.640]  I know it's not fun work.
[16:44.840 --> 16:47.400]  I know that we have many, many other things to do.
[16:47.500 --> 16:54.380]  But these platforms that people are locked into, we need to start pushing back with actual grassroots implementations.
[16:54.800 --> 16:54.920]  Okay.
[16:56.260 --> 16:58.760]  Code's out there on GitHub if you want to check it out.
[17:00.540 --> 17:01.980]  Let's talk about DeepSeek.
[17:01.980 --> 17:10.820]  So about a week after the whole kerfuffle around TikTok and the supposed ban, which I don't even think was 24 hours.
[17:11.040 --> 17:15.700]  By the way, sticktock.com, of course, did stay up during the ban, and people were using it.
[17:15.780 --> 17:18.640]  So that was a good real-world proof of concept as well.
[17:19.880 --> 17:22.840]  But DeepSeek was released shortly after that.
[17:23.220 --> 17:28.080]  DeepSeek also has these trackers, as I'm showing in the X's privacy window here, right?
[17:29.580 --> 17:38.040]  Very cleverly, DeepSeek was released by the team, basically the same folks who make TikTok, a lot of the ByteDance folks.
[17:38.300 --> 17:42.640]  It was released about a week after TikTok was allowed to go back up.
[17:43.040 --> 17:48.200]  Now, we can talk about all the legal stuff around this whole situation.
[17:48.200 --> 17:50.880]  Should the executive branch have the power to do this?
[17:52.380 --> 17:54.380]  Actually, they're supposed to enforce the law.
[17:54.600 --> 17:58.100]  This is the law of the land that there's not supposed to be TikTok.
[17:58.780 --> 18:02.180]  The executive branch has just unilaterally decided not to enforce the law.
[18:02.820 --> 18:05.480]  I didn't know that could be done, but hey, it is being done.
[18:06.600 --> 18:09.360]  With DeepSeek, we haven't had that kind of a ruling yet.
[18:09.620 --> 18:11.560]  We may not see that kind of a fight.
[18:12.000 --> 18:12.440]  Who knows?
[18:12.440 --> 18:16.240]  But DeepSeek, of course, is, in my opinion, a much bigger deal.
[18:17.840 --> 18:25.900]  It's a much bigger deal because the fallout from this could tank the entire U.S.
[18:25.980 --> 18:27.580]  economy and the global economy, right?
[18:28.120 --> 18:34.540]  This war I'm talking about between these two countries, the United States and China, in the digital battlefield, right?
[18:34.540 --> 18:40.920]  This war now is in this artificial intelligence, so-called AI area.
[18:41.240 --> 18:45.940]  And as we know, NVIDIA is hugely overvalued, in my opinion.
[18:46.240 --> 18:53.660]  But there's an enormous amount of the global economy wrapped up in these firms now.
[18:55.880 --> 19:05.640]  If we don't sort of de-escalate these conflicts, we could see serious, serious impacts on ordinary individuals.
[19:05.880 --> 19:08.280]  The kind of folks who are just going out there and using TikTok.
[19:08.640 --> 19:11.100]  The kind of folks who are just going out there and using ChatGPT.
[19:11.340 --> 19:13.900]  And it's not that I love ChatGPT, believe me.
[19:14.040 --> 19:16.920]  And it's not like I'm trying to save them from the threat of DeepSeek.
[19:17.060 --> 19:22.400]  But we need to always consider and talk about these things in the context that we're living in, right?
[19:25.080 --> 19:31.460]  One of the interesting things about DeepSeek, and one of the reasons that, of course, it kind of did hurt the NVIDIA stock, right?
[19:31.520 --> 19:34.600]  It went down for a while, but then, of course, it boomeranged back up.
[19:36.220 --> 19:42.420]  Was because DeepSeek is one of the models that you can run on commodity off-the-shelf hardware, right?
[19:43.800 --> 19:44.420]  Reasonably well.
[19:44.880 --> 19:45.560]  Not great.
[19:45.740 --> 19:55.080]  But there certainly were a lot of folks in free and open-source software circles who were talking about your own personal AI assistant, LLM in your pocket, all that kind of stuff.
[19:56.600 --> 20:00.240]  If you want to ask about the licensing later, we can get into all that around that.
[20:00.460 --> 20:05.280]  Obviously, these models are not trained to respect open-source licensing, right?
[20:06.420 --> 20:07.020]  Okay.
[20:08.280 --> 20:16.880]  The interesting part about DeepSeek was there was sort of this cooling period where people weren't actually analyzing it from a privacy and security standpoint.
[20:16.880 --> 20:20.500]  I was a little shocked that people didn't immediately make the comparison to TikTok.
[20:20.780 --> 20:25.800]  At least the folks I was talking to, looking at online and sort of definitely in the mainstream press.
[20:25.800 --> 20:28.420]  We didn't see the same sort of DeepSeek as a threat.
[20:28.520 --> 20:31.400]  It took a little while before people started saying that, right?
[20:31.720 --> 20:38.480]  But if you looked at the network traffic, you would see that the traffic is directed to mainland China.
[20:38.480 --> 20:47.760]  Now, in the U.S., if you use the DeepSeek app, you would see that the traffic was going through an intermediary primarily in Germany.
[20:48.580 --> 20:48.680]  Okay.
[20:49.540 --> 20:54.620]  Taobao is basically a grocery store chain that's getting into the cloud world.
[20:55.440 --> 20:58.740]  And they're running a bunch of different services in Germany.
[20:58.960 --> 21:02.820]  And then that stuff is ostensibly going to mainland China, right?
[21:04.180 --> 21:11.700]  But if you look at the traffic, there's no doubt it's either directly going to mainland China or Chinese intermediaries, right?
[21:11.860 --> 21:16.440]  So you would think that the conversation around DeepSeek would be similar to the conversation around TikTok.
[21:16.700 --> 21:19.060]  It hasn't risen to that level yet.
[21:21.120 --> 21:22.960]  Also, obviously, it has ByteDance components.
[21:23.140 --> 21:25.460]  It has fingerprints of ByteDance all over it.
[21:25.460 --> 21:31.720]  And also, there's all kinds of other stuff to say about it that they actually outline in their privacy policy.
[21:31.940 --> 21:36.500]  So it's not like ByteDance was trying to hide this or any of the folks behind any of these apps are trying to hide this.
[21:36.600 --> 21:44.600]  They have very clear privacy policies that say we use these third-party SDKs and they link to the source.
[21:44.800 --> 21:47.520]  There's all kinds of information out there if you go look for it.
[21:47.620 --> 21:48.700]  It's not exactly hidden.
[21:50.520 --> 22:06.360]  Again, the privacy issues with DeepSeek, the privacy issues with TikTok, the privacy issues with our software ecosystem and our software supply chain, especially on smartphone platforms, iOS and Android, right, are awful, right?
[22:06.580 --> 22:13.420]  The average app I look at has a dozen or so of these SDK trackers in it running in the background all the time.
[22:13.420 --> 22:25.240]  The average person does not think about when they open an app that it's talking to 12, 13, 15, 22 different servers around the world and snarfing up their information, right?
[22:26.780 --> 22:30.120]  Here's just some of the network traffic showing some of the servers.
[22:32.080 --> 22:34.200]  So I got a proof, right?
[22:34.340 --> 22:35.020]  I got to verify.
[22:36.840 --> 22:47.440]  It's just the user agent string coming from, this is actually an Android virtual machine in this case, but you can clearly see there is something that we can call browser fingerprinting, right?
[22:47.520 --> 22:51.100]  Or not really browser, but app fingerprinting going on here.
[22:51.220 --> 22:57.420]  So you can potentially uniquely identify users just using the user agent string, right?
[22:58.360 --> 23:06.260]  And here's the translation of the part of the privacy policy, the disclosure about third parties that DeepSeek has.
[23:08.080 --> 23:14.240]  Now, Yael Grauer and Micah Lee were on stage yesterday, and I think Yael is talking again today.
[23:15.160 --> 23:18.180]  This is a story that I did with her.
[23:18.440 --> 23:26.520]  We also worked with LeMond, and we released this all over the place back in 2017 with Yale Privacy Lab, okay?
[23:27.020 --> 23:33.240]  The reason I'm bringing this up is because this problem with tracking SDKs is nothing new.
[23:33.240 --> 23:36.780]  But it proves another point we need to make, right?
[23:36.900 --> 23:40.760]  We need to always keep focused on what's actually going on here from a privacy standpoint.
[23:41.020 --> 23:47.480]  Not obsessively talk about TikTok, or obsessively talk about any specific actor, country, nation state, whatever.
[23:49.360 --> 23:51.080]  It's just a huge problem.
[23:52.360 --> 23:54.820]  I've done a bunch of investigations around this sort of thing.
[23:54.960 --> 23:56.680]  If you want to go look at it, you can.
[23:56.680 --> 24:02.580]  Again, this investigation was one I did actually when I was running something called the Digital Security Lab at ExpressVPN.
[24:02.640 --> 24:06.500]  We did basically some analyses of different apps.
[24:06.800 --> 24:12.060]  We did, for example, an analysis of some health apps in the middle of COVID.
[24:12.740 --> 24:16.620]  The telehealth apps are also really, really bad.
[24:18.200 --> 24:25.360]  But this one specifically looked at like X-Mode and some of the well-known names in sort of the tracking ecosystem now.
[24:26.000 --> 24:26.260]  Okay?
[24:27.180 --> 24:28.980]  And there's links to that out there.
[24:29.060 --> 24:30.360]  There's all kinds of information out there.
[24:32.440 --> 24:34.660]  This breach just happened, right?
[24:35.040 --> 24:37.360]  This is a biggie that happened back in January.
[24:38.100 --> 24:40.960]  Gravy Analytics has been around for a really long time.
[24:40.960 --> 24:46.340]  It's certainly one of the intermediaries, one of the tracker SDKs that I've been looking at for a while.
[24:46.840 --> 24:50.440]  They had an enormous amount of data that leaked.
[24:52.180 --> 24:56.620]  And we're familiar, as privacy people, that this has real-world impact on people, right?
[24:57.000 --> 24:59.280]  This is from that story by Zach Whitaker.
[24:59.960 --> 25:09.060]  And this basically shows a map where the locations of individuals, right, can be found because of that Gravy Analytics breach, right?
[25:09.060 --> 25:13.880]  So just to roll back a little bit, you can be running an app, right?
[25:14.540 --> 25:16.540]  In this case, it's Tinder, right?
[25:17.160 --> 25:23.960]  And in the background, right, snippets of code can be running that are talking to servers, right?
[25:24.120 --> 25:26.160]  And sending your location data to those servers.
[25:26.380 --> 25:28.140]  Then they can be stored in a database.
[25:28.500 --> 25:35.060]  And then the intermediary, in this case Gravy Analytics, can sell that information about you, right?
[25:35.060 --> 25:38.780]  And be breached, and the information can get out there, right?
[25:38.980 --> 25:44.020]  And you as a user, you only have on your phone a little permission dialogue, right?
[25:44.220 --> 25:46.740]  To just make a few choices when you install the app.
[25:47.140 --> 25:48.340]  Ostensibly a few choices.
[25:50.080 --> 25:57.680]  Baptiste Robert, Elliot Alderson online, he basically has a huge data set that he hasn't even gone through yet.
[25:58.760 --> 26:01.140]  And this is just a small part of it.
[26:02.420 --> 26:07.400]  So I bring up this breach because we're starting to see, just like with traditional data breaches, right?
[26:07.520 --> 26:11.760]  That the scale of this privacy problem is enormous, right?
[26:11.920 --> 26:14.620]  And that the fallout is really serious.
[26:14.800 --> 26:18.720]  But like real-world data breaches of traditional systems, right?
[26:19.460 --> 26:22.860]  It's just an everyday occurrence now, or it's getting to be much more common.
[26:22.860 --> 26:27.180]  So it's not a big deal anymore, unfortunately, right?
[26:27.380 --> 26:33.040]  When the Yahoo breach happened a few years ago, however many years ago that was, six, seven years ago, right?
[26:33.100 --> 26:34.600]  Everybody was freaking out about it.
[26:34.720 --> 26:40.540]  It had a big impact on the valuation of Yahoo when they were the merger and acquisition process, et cetera, et cetera, right?
[26:41.240 --> 26:43.400]  Now breaches are just happening every other day.
[26:43.520 --> 26:52.520]  And we're going to start seeing them more and more from these tracker SDK intermediaries, including some of the trackers that are in an app like TikTok, right?
[26:53.800 --> 26:54.880]  Okay, hold on.
[26:55.660 --> 26:57.420]  So all kinds of implications here.
[26:57.820 --> 27:03.900]  Obviously, the folks who feel the most harm from this are the most vulnerable, right?
[27:04.280 --> 27:05.800]  The ones that are affected the most.
[27:06.180 --> 27:11.820]  A lot of that, you know, LGBTQ plus folks, you know, religious minorities, et cetera, et cetera.
[27:12.480 --> 27:17.260]  These groups are often the ones who are the most easily identifiable, right?
[27:17.520 --> 27:18.960]  And the most persecuted.
[27:19.180 --> 27:20.960]  So it's a serious, serious thing.
[27:22.300 --> 27:24.200]  This is an example of an Android manifest.
[27:24.460 --> 27:29.540]  We probably have folks who, for better or for worse, have had to package and build Android apps, right?
[27:29.960 --> 27:31.460]  So you might be familiar with this.
[27:31.600 --> 27:42.920]  If you want to look into this sort of thing and do the work yourself the hard way, although there's some good automated tools these days, you're basically doing a little bit of analysis on these .dex files, right?
[27:43.540 --> 27:54.920]  So, and the manifest itself, which you also kind of have to unpack, that has the information, usually the permission information, which will sort of give away that the SDKs are there in the first place.
[27:55.940 --> 27:59.460]  Now, we didn't used to have those permissions, right, at all.
[28:00.520 --> 28:07.100]  Those permissions came because not only hackers and inventors and innovators, right, were pushing for them to exist.
[28:07.520 --> 28:16.720]  But because the public had an understanding from stories, like the one I did with Yael at The Intercept, they started to have an understanding that there were problems, right?
[28:16.900 --> 28:21.140]  And they were clamoring for real privacy, which Apple pretends to give people.
[28:22.140 --> 28:22.500]  Okay.
[28:24.100 --> 28:27.680]  If anybody wants to dig into this more and contact me directly, please do.
[28:27.960 --> 28:37.240]  I look back through my files and it turns out I have some documentation I'm not sure anybody else has anymore that's not on the web anymore around Gravy Analytics.
[28:37.600 --> 28:40.160]  I haven't had time, basically, to do anything with it.
[28:40.380 --> 28:43.320]  But there's a bigger story here about them specifically, I think.
[28:45.060 --> 28:50.120]  The real question for us, right, is just how did things get this bad?
[28:50.380 --> 28:52.720]  You know, Corey was up here last year talking about insidification.
[28:52.920 --> 28:58.160]  I don't think I have to sell very hard to this crowd, that things are not good in digital land.
[28:58.160 --> 29:06.540]  But we need to remind ourselves that the intermediaries that we have the most power over in the United States are the American intermediaries, Google's, et cetera, right?
[29:07.220 --> 29:12.160]  And when we talk about this sort of thing, we usually talk about it in the context of location surveillance, right?
[29:12.380 --> 29:14.500]  The map of the Tinder users was location surveillance.
[29:14.500 --> 29:22.180]  This is an overlay of the Strava data from the Strava, sort of like fitness tracker data from a few years ago.
[29:22.300 --> 29:23.160]  That information leaked.
[29:23.260 --> 29:28.760]  You can actually overlay it on open street maps on your own hometown if you do a little bit of hacking, I guess.
[29:29.440 --> 29:37.920]  And then we went around and we were tagging different surveillance cameras and ALPRs and things of that nature around New Haven.
[29:37.920 --> 29:41.740]  And you can actually see there sometimes is a correlation or there often is a correlation.
[29:41.740 --> 29:46.240]  The biggest traffic points, of course, of individuals are going to have the most surveillance, right?
[29:48.240 --> 30:00.260]  But I'm going to show you right now, just sort of to cap off here, that we need to worry about more than just location surveillance, just like we need to shift the conversation from just talking about how bad China is, right?
[30:01.900 --> 30:05.320]  So we have tons of sensors in our devices.
[30:05.320 --> 30:13.660]  These sensors can be used in unexpected ways to also get information that can be used for surveillance on individuals, right?
[30:14.440 --> 30:24.720]  For example, one of the most traditional ways people have been identified, and John Kiriakou will tell you all about this from his time in the CIA, is gait, okay?
[30:25.380 --> 30:38.680]  Now you can analyze video and now you can use generative AI and computer vision tools to analyze someone's gait and try to say, okay, within a certain reasonable percentage, this is Sean O'Brien walking down the street in New Haven, okay?
[30:39.260 --> 30:44.120]  And that can be done also with accelerometers in our phones, right?
[30:44.140 --> 30:46.180]  We have all kinds of other stuff that can do this.
[30:46.680 --> 30:55.800]  I think we're going to see a world where people get a traffic ticket or don't pay for their insurance or spend too much time at the bar, right?
[30:55.800 --> 31:07.300]  And they're going to get into their car, and you may agree with this or you may not, depending on your perspective on public safety, but I think it's coming, and the car is just not going to start, right?
[31:07.560 --> 31:21.100]  I think that they're going to basically be identified by their smartphone, they're going to be communication to their car computers, and we're going to have people have lack of mobility, we're going to get robo-taxis shoved down our throat, and the excuse is going to be,
[31:21.260 --> 31:26.200]  well, Sean, it's just too dangerous to have you on the road, you've gotten too many speeding tickets, right?
[31:26.660 --> 31:28.800]  That world is coming, and it's coming fast.
[31:29.320 --> 31:35.540]  We've seen accelerating forces push these trends much faster than we ever thought they would happen.
[31:35.760 --> 31:39.640]  COVID was one, this AI boom is another, okay?
[31:41.220 --> 31:48.420]  I'm going to show you an example of real-world tracking that a lot of folks aren't talking about, and it's a really fun one, so.
[31:50.380 --> 31:56.400]  This is a SDK tracker called Fids Up, and I will play the video.
[31:58.540 --> 31:59.060]  Here.
[32:13.100 --> 32:14.460]  We start from the beginning.
[32:14.460 --> 32:16.880]  Here is Léa, in full shopping session.
[32:17.540 --> 32:20.940]  Like 33 millions of people in France, she has her smartphone with her.
[32:21.280 --> 32:24.080]  She enters into a store, and she receives a message.
[32:24.480 --> 32:26.360]  Today is a special day in this store.
[32:27.080 --> 32:31.380]  In this area, she receives a cible promotion that is attracted to a very nice robe.
[32:32.520 --> 32:35.020]  The offer is exclusive, and the robe she likes a lot.
[32:35.680 --> 32:36.540]  She is seduced.
[32:38.920 --> 32:43.240]  She has all its advantages on her smartphone in the good place and at the good moment.
[32:45.120 --> 32:46.160]  In addition...
[32:46.160 --> 32:48.640]  Okay, now this phone is not connected to the Internet.
[32:49.120 --> 32:49.580]  Right?
[32:51.840 --> 32:54.580]  How did this phone just show those advertisements?
[32:56.320 --> 32:58.320]  The microphone is open on this phone.
[32:58.800 --> 33:02.760]  That video has near ultrasonic sound in it.
[33:03.120 --> 33:06.260]  And it's sending those advertisements to this phone and causing actions.
[33:06.940 --> 33:13.860]  Now, that's a demonstration video that the tracker vendor essentially was showing off.
[33:14.000 --> 33:21.920]  Hey, we're going to have folks in Paris going around shopping, and their phone is just going to show them coupons and promos as they walk through the store.
[33:23.960 --> 33:27.100]  This is not the most common technology, of course.
[33:27.520 --> 33:29.580]  It's used in very specific contexts.
[33:29.860 --> 33:33.980]  It's often used in apps, for example, that would be like a schedule app, right?
[33:34.100 --> 33:34.700]  At a conference.
[33:34.920 --> 33:35.780]  Not this one, thankfully.
[33:36.980 --> 33:39.780]  It might be used in like a sports app.
[33:39.900 --> 33:42.160]  It might be used in a concert app, right?
[33:42.240 --> 33:46.180]  Where you're checking in at different points to send them to social media because you're at Bonnaroo or whatever.
[33:46.360 --> 33:48.160]  I'm not sure if Bonnaroo uses it, but the point is.
[33:49.160 --> 33:54.360]  Places where people will not think twice to open up the microphone permissions, right?
[33:54.500 --> 33:56.380]  Because they're shooting video anyway, primarily.
[33:57.480 --> 33:57.600]  Okay.
[34:02.310 --> 34:04.290]  Now, it's been around for a long time.
[34:04.630 --> 34:06.090]  A lot of folks have worked on this.
[34:06.330 --> 34:07.690]  This is from a few years ago.
[34:08.030 --> 34:10.230]  This Pyrogue is a very interesting device, by the way.
[34:10.350 --> 34:10.930]  You should check that out.
[34:11.090 --> 34:19.010]  But the folks at Pilfer Shush, they actually have an app in FDroid that will try to block these trackers.
[34:19.630 --> 34:21.830]  It'll check the microphone permissions for you.
[34:21.970 --> 34:31.430]  And it'll also, if you want it to, although I don't recommend it, it will actively send out noise in the ultrasonic range to try to block the sound.
[34:31.650 --> 34:33.170]  It's not really kind to pets.
[34:33.470 --> 34:35.350]  So I wouldn't recommend that you do that.
[34:36.090 --> 34:37.670]  This is the actual sound.
[34:37.670 --> 34:38.790]  And you can see, right?
[34:39.190 --> 34:49.350]  Close to 20,000 kilohertz here, you'll see the clear markers here of a machine generating this sound, right?
[34:49.870 --> 34:50.850]  Those are bits.
[34:51.070 --> 34:53.090]  Those are zeros and ones, essentially.
[34:53.530 --> 34:57.130]  Usually, it's something called frequency shift keying for the ham radio folks out here.
[34:57.390 --> 35:03.710]  This is more or less, they're very familiar with it through encrypted communications, radio communications.
[35:06.070 --> 35:07.390]  Again, it's an SDK.
[35:08.750 --> 35:17.250]  Did anybody talk about France as a geopolitical problem, about Europe as a geopolitical problem, right?
[35:17.430 --> 35:20.350]  Because these apps were distributed in our software supply chain.
[35:20.350 --> 35:23.930]  I'm aware of about 13 different trackers of that kind.
[35:24.550 --> 35:27.930]  FIDZUP themselves, they had a GDPR problem, let's say.
[35:28.910 --> 35:35.170]  The CEO, there's a very funny interview where he sort of, you know, boo-hoos about the whole situation afterwards.
[35:35.630 --> 35:42.750]  And I'd like to think, but I'm not sure, that the Yale Privacy Lab sort of calling attention to it had something to do with the whole situation, but who knows?
[35:45.190 --> 35:48.250]  This is the sequence of the advertisements, okay, on the phone.
[35:49.390 --> 35:50.710]  This is ChatGPT.
[35:51.830 --> 35:53.970]  This took me about a minute to do.
[35:54.470 --> 36:05.550]  Using their prompt system, which is not very efficient, I was able to remix that audio, okay, with just a few prompts, which are easy to reproduce, okay?
[36:05.770 --> 36:07.270]  It gave me a WAV file.
[36:07.750 --> 36:11.970]  And now this is the new form of the advertisements, if you play that audio.
[36:13.350 --> 36:15.390]  You see where I'm going with this, okay?
[36:16.090 --> 36:28.110]  These surveillance technologies that are now exotic and obscure are going to become business opportunities, especially for what used to be called unicorn-style startups, where you come up with a quick proof of concept.
[36:28.270 --> 36:33.570]  You say, hey, I can get information out of the phone that nobody else can get, and here's how I do it, okay?
[36:34.130 --> 36:42.830]  And I think we're going to have generative AI tools get very, very good at coming up unique ways of remixing surveillance tools, okay?
[36:45.990 --> 36:49.110]  And I want to leave the rest for questions, but first, I just want to give a shout-out.
[36:49.210 --> 36:53.130]  If you want to check out this kind of stuff, we have bits on tape.
[36:54.070 --> 36:59.330]  This is now going to be a podcast, too, but we talk about StickTock a lot on here.
[36:59.470 --> 37:01.070]  We talk about the other apps we've been developing.
[37:01.350 --> 37:02.590]  We have an amazing team.
[37:03.890 --> 37:07.310]  The PrivacySafe brand, we're doing a bunch of end-to-end encrypted apps.
[37:07.470 --> 37:08.610]  Mikulai talked about those yesterday.
[37:08.890 --> 37:09.450]  Check them out.
[37:09.450 --> 37:11.950]  And then the company is Ivy Cyber.
[37:12.890 --> 37:18.650]  You can go out, you can do workshops with John Kiriakou, some anti-surveillance workshops and surveillance detection workshops.
[37:19.190 --> 37:20.930]  I'll be doing the digital part of that.
[37:21.070 --> 37:25.910]  John will be doing sort of talking about the physical, tangible surveillance part of that.
[37:26.090 --> 37:29.690]  And then we're also, we have a tablet over here that's a Linux tablet.
[37:29.870 --> 37:30.870]  We're doing all kinds of cool stuff.
[37:31.170 --> 37:42.690]  So StickTock's a small part of a much larger project that has an anti-surveillance ethos that's trying to look at the world, and I think we're being somewhat successful, you know, through a wider lens, right?
[37:42.870 --> 37:44.250]  Not the narrow cybersecurity.
[37:44.770 --> 37:45.790]  I'm an American.
[37:46.210 --> 37:47.830]  Those people are Chinese, right?
[37:48.030 --> 37:50.090]  We don't think about people as the other.
[37:50.570 --> 37:51.510]  People are people.
[37:51.990 --> 37:53.490]  I'm a citizen of the world.
[37:53.610 --> 38:03.650]  And it's very, very important to me, and it should be important for hackers, I think it is, that we calm down about all this stuff and we don't participate in these cyber wars.
[38:03.950 --> 38:05.130]  Thank you very much, guys.
[38:19.850 --> 38:20.750]  Excellent talk.
[38:20.890 --> 38:21.210]  Thank you.
[38:22.610 --> 38:23.210]  I...
[38:23.210 --> 38:32.310]  You had mentioned during the talk kind of some other applications that were very similar, like Knitter or Bibliogram rib.
[38:33.570 --> 38:46.470]  What are your thoughts with StickTock on being able to keep up with any changes that would break the functionality that ultimately led to the demise of Bibliogram?
[38:47.390 --> 38:49.570]  You have identified the problem.
[38:51.250 --> 38:51.730]  Okay.
[38:52.090 --> 38:57.950]  So, all of these alternative front ends rely in some way on plugging into these APIs, right?
[38:58.050 --> 38:59.090]  Because these are closed systems.
[38:59.930 --> 39:02.430]  And we do our best to keep up on it.
[39:02.610 --> 39:06.570]  But you'll see, we, you know, we sort of keep up on it.
[39:07.030 --> 39:08.170]  We really need help.
[39:08.370 --> 39:18.370]  And I think we need to get some folks around this who are probably actively working with developers who have much more experience in this area than I think our team does.
[39:18.590 --> 39:19.990]  We care about cryptography.
[39:20.090 --> 39:22.530]  We care about communication tools.
[39:22.590 --> 39:26.590]  We're not really into the whole web scraping, web API plugin game.
[39:27.050 --> 39:31.930]  And I'm sure there's other folks here who are much, much more experienced with that who can help us out.
[39:32.170 --> 39:37.270]  The other piece of it I'll say is, this could get shut off at any moment and may.
[39:39.770 --> 39:49.270]  And I'm not going to get into the other pieces of it, but there may be some diplomatic ways to approach the ByteDance folks.
[39:50.410 --> 39:55.490]  You know, and I think diplomacy here would be very wise because TikTok's not going away.
[39:56.230 --> 39:59.690]  And it's probably going to grow substantially, I think.
[39:59.970 --> 40:00.430]  Thank you.
[40:02.670 --> 40:06.510]  Hey, so I was curious, you were really focused on like the privacy.
[40:06.990 --> 40:10.710]  I mean, sorry, like the data flows as the reason for why the U.S. wanted to shut down TikTok.
[40:10.710 --> 40:20.170]  But there's also, or at least I think that for TikTok, as well as especially with DeepSeek, there could be a desire to essentially control the narrative that's given to people, right?
[40:20.270 --> 40:24.170]  Where it's like, if you control the AI that's talking to everyone, you can control what they think almost, right?
[40:25.990 --> 40:28.550]  There always is the propaganda angle, certainly.
[40:29.030 --> 40:30.990]  And I think that's a big part of it.
[40:31.150 --> 40:43.070]  One of the reasons, and I glanced over it a little quickly, that I showed the defense slide there, is the mindset that the Chinese are the enemy is very deeply ingrained in the people running this country.
[40:44.030 --> 40:46.850]  And we need to be very careful not to fall into that mindset.
[40:46.850 --> 40:48.550]  So I 100% agree with you.
[40:53.880 --> 40:57.800]  Professor O'Brien, thank you for your wonderful speech today.
[40:57.800 --> 41:00.320]  I have two questions.
[41:00.920 --> 41:04.780]  So first of all, I think all of us agree with you.
[41:05.060 --> 41:07.700]  The privacy is a very big deal.
[41:08.100 --> 41:27.940]  If we connect the privacy with new technology, innovation and social trade like blockchain, Web3, DeFi, all the organization.
[41:28.460 --> 41:42.580]  So my question is, do you think this new technological innovation and the social trade will help to protect our privacy or it will make it worse?
[41:43.160 --> 41:43.860]  And why?
[41:46.000 --> 41:46.400]  Sure.
[41:46.520 --> 41:47.680]  So there's a lot to unpack there.
[41:47.680 --> 41:52.680]  But the first thing is what we're calling privacy is a very strange thing these days.
[41:54.200 --> 42:01.800]  In my view, what's going on is more and more of our life is being surveilled by intermediaries.
[42:01.880 --> 42:08.060]  And we now use digital intermediation for nearly everything we do all the time.
[42:08.220 --> 42:13.900]  So the scope creep of surveillance has gotten out of control.
[42:14.440 --> 42:19.640]  And therefore, the scope creep of what we call privacy is rather large.
[42:20.040 --> 42:25.500]  So when people ask me about privacy, what they're actually asking me about, generally speaking, is everything.
[42:26.140 --> 42:26.660]  Okay?
[42:26.920 --> 42:29.860]  And it makes it hard to know what we really mean.
[42:30.900 --> 42:33.680]  Obviously, I think that things are getting worse.
[42:34.740 --> 42:37.480]  There are a lot of options out there.
[42:37.660 --> 42:38.340]  There is hope.
[42:38.560 --> 42:39.780]  You know, I don't want to be a nihilist.
[42:39.780 --> 42:44.500]  When I do workshops, folks come out of the workshops sometimes and they're like, well, why should I even try?
[42:44.840 --> 42:44.940]  Right?
[42:45.200 --> 42:47.900]  Well, you don't have to tell a targeted person why they should try.
[42:48.320 --> 42:48.680]  Okay?
[42:49.300 --> 42:52.540]  It's a luxury to be able to say, why should I care about privacy?
[42:52.760 --> 42:53.120]  Okay?
[42:53.260 --> 42:54.800]  So that's how I remind myself.
[42:56.440 --> 43:00.660]  And will Web3, blockchain, crypto, etc.
[43:02.500 --> 43:05.520]  do much in the world of privacy for good or ill?
[43:07.600 --> 43:09.900]  I'm not sure what Web3 is or isn't.
[43:10.220 --> 43:10.340]  Okay?
[43:11.440 --> 43:14.660]  And I've actually worked quite a bit on crypto projects.
[43:15.060 --> 43:19.860]  I'm actually pretty bullish on the potential for blockchain for certain contexts.
[43:19.860 --> 43:23.020]  It's almost never used in those contexts.
[43:23.560 --> 43:23.660]  Okay?
[43:23.940 --> 43:33.460]  I think if you're interested in some folks who care about this, the Monero community, which is currently basically under attack, is working on some really good stuff.
[43:33.680 --> 43:36.580]  And we're actually working directly with Cake Wallet.
[43:37.540 --> 43:44.920]  And they are building a very good crypto wallet that has really awesome features, not just for Monero, but for a lot of other currencies these days.
[43:46.460 --> 43:53.260]  So, all that to be said, blockchain is, generally speaking, most chains are out there in their public.
[43:53.580 --> 43:55.460]  It's creating more information out there.
[43:55.600 --> 44:01.540]  More information for generative AI to snarf up and remix and know more about us as individuals.
[44:01.820 --> 44:01.880]  Right?
[44:02.240 --> 44:11.120]  So, just the very fact that it's more technology, that publishing more stuff, means that by definition, people are going to have less privacy.
[44:11.120 --> 44:17.500]  That's not the fault of the folks trying to build this stuff, generally speaking, unless they're purposefully building surveillance chains.
[44:19.760 --> 44:26.340]  NFTs, all this stuff, you know, they can be used in some really interesting security contexts, authentication, et cetera, et cetera.
[44:26.620 --> 44:27.660]  They're generally not.
[44:27.980 --> 44:28.100]  Right?
[44:28.440 --> 44:31.900]  And we could see that happen if we're interested in it.
[44:32.020 --> 44:35.460]  But at the moment, it doesn't seem like there aren't too many folks who are interested.
[44:38.040 --> 44:40.540]  Thanks for answering my first question.
[44:40.820 --> 44:41.920]  It inspired me a lot.
[44:42.560 --> 44:45.040]  So, here's my second question.
[44:46.100 --> 44:50.460]  I really like the term you used, data therapy.
[44:50.700 --> 45:00.640]  I think therapy is very important and a serious regulation movement by President Donald Trump.
[45:00.640 --> 45:05.700]  So, according to this term, can you please give us a guess?
[45:06.380 --> 45:13.120]  How American government will regulate the data flow on blockchain?
[45:13.960 --> 45:18.040]  Especially when we talk about the inflation flow cross-border.
[45:18.380 --> 45:18.720]  Sure.
[45:19.400 --> 45:19.860]  Thank you.
[45:20.420 --> 45:21.660]  That's a great question.
[45:21.840 --> 45:22.200]  Thank you.
[45:22.980 --> 45:28.300]  So, just like I don't want to be in one camp or the other in this geopolitical conflict, right?
[45:28.400 --> 45:36.360]  I think we need to center ourselves and remind ourselves that the previous administration, as well, was trying to ban TikTok, right?
[45:37.340 --> 45:46.740]  And the previous administrations before the Trump 2 we're in now, were also very awful to crypto projects.
[45:46.880 --> 45:49.120]  Specifically, crypto projects that cared about privacy.
[45:49.280 --> 45:52.200]  Tornado Cash, Samurai Wallet, et cetera, et cetera.
[45:52.200 --> 45:53.360]  Okay.
[45:54.040 --> 46:04.580]  Now, those projects are, some of them, the people are, you know, they're having less problems than they were.
[46:05.020 --> 46:09.060]  But, our president is a grifter.
[46:09.420 --> 46:16.780]  And the reason he cares about crypto is because he's getting personal wealth from it, has personal connections, you know?
[46:16.960 --> 46:20.260]  For example, I've gone to a lot of crypto conferences.
[46:20.260 --> 46:27.240]  I was actually one of the folks who was invited to one of the expensive dinners that they were going to announce the Melania coin at.
[46:27.720 --> 46:27.820]  Okay?
[46:28.260 --> 46:30.000]  Pump and dump scheme, right?
[46:31.020 --> 46:32.840]  That kind of stuff is going on a lot in crypto.
[46:33.400 --> 46:37.540]  Because of that, crypto is a dirty word even more than it was before.
[46:38.220 --> 46:44.120]  And crypto projects who are trying to do privacy are now having a really, really hard time getting their message out there.
[46:44.120 --> 46:44.820]  Okay?
[46:45.200 --> 46:50.660]  Because everybody is saying, screw crypto, it's a bunch of mean coins, it's fart coin and peppy and all this stuff.
[46:50.940 --> 46:51.040]  Right?
[46:51.280 --> 46:54.920]  And that has caused a real problem for folks who want to use the technology in serious ways.
[46:57.140 --> 46:57.700]  So...
[46:57.700 --> 47:00.600]  You had mentioned some of the alternatives like Red Note.
[47:01.400 --> 47:18.060]  One thing that I saw during that time period was a lot of people were getting exposure to narratives that ran counter to, you know, rampant Sinophobia and, you know, the just nationalist propaganda that we've been force-fed, you know, since day one.
[47:18.060 --> 47:30.920]  Um, what are your thoughts on, um, how much that kind of, um, exposure and backlash goes into the, the postponing and the, you know, this, this date of tariff war?
[47:31.420 --> 47:45.560]  Um, do you think that, uh, you know, Gen Alpha, Gen Z is getting exposure to these things and becoming, you know, based in CPC-pilled or, and that's the big fear the government is trying to negotiate?
[47:45.560 --> 47:51.220]  And then also, what are your thoughts on, uh, Loops or more federated alternatives?
[47:52.220 --> 47:53.360]  So Loops is great.
[47:53.700 --> 47:57.400]  Um, Privacy Safe, we actually donated to Loops, uh, Loops.
[47:57.580 --> 48:02.360]  I don't remember what tier we are as a sponsor, but we donated to their, uh, crowdfunding.
[48:02.760 --> 48:03.940]  Um, they're great.
[48:04.060 --> 48:05.380]  We actually want to see StickTock.
[48:05.580 --> 48:12.720]  And I think there's some ways we might be able to use some stuff from CID or some other projects to do some migration from TikTok to Loops.
[48:12.840 --> 48:13.700]  I think that would be awesome.
[48:13.700 --> 48:16.000]  If anybody's interested, we need the help, please.
[48:16.360 --> 48:18.840]  Um, so that's the first thing I'll say there.
[48:19.020 --> 48:22.240]  And the second thing I'll say is, you're right, this is about information flows.
[48:22.700 --> 48:25.600]  Um, when I was younger, it was really important for me to go on the Internet.
[48:26.080 --> 48:31.540]  The Internet was much more free than it was now, at least the web, um, and read stuff from all over the place.
[48:31.680 --> 48:40.400]  So I do think that there's going to be a generation who at least is getting exposed to a lot of stuff in these apps, a lot of information in Red Note that they wouldn't get exposed to.
[48:40.400 --> 48:41.940]  In that way, it is positive.
[48:42.160 --> 48:43.900]  And maybe the administration fears that.
[48:44.320 --> 48:45.220]  I'm not sure.
[48:45.220 --> 48:46.960]  I'm not sure how much of that is conscious.
[48:47.300 --> 48:47.640]  I don't know.
[48:50.350 --> 48:50.790]  Hello.
[48:51.010 --> 48:59.590]  I know we have, uh, only a moment for a couple of phrases, but you mentioned the Monero project being under attack and you mentioned a bunch of pump and dump schemes.
[48:59.590 --> 49:09.050]  So I'm curious if there are any promising or, uh, plausible legal approaches to, um, kind of redirecting the crypto space.
[49:10.650 --> 49:11.050]  Yeah.
[49:11.170 --> 49:13.290]  I mean, I don't want to overstate the Monero situation.
[49:13.290 --> 49:14.650]  I think they're handling it really well.
[49:14.790 --> 49:17.750]  Um, and actually when people say it's a 51% attack, it's not.
[49:17.850 --> 49:23.830]  It was maybe 35% of the mark of the network and just some blocks that were junk and so on and so forth.
[49:23.830 --> 49:28.910]  So I think we should embrace existing projects there as much as possible and help them rather than create new ones.
[49:29.610 --> 49:31.210]  I'm not sure what's going to happen there.
[49:31.330 --> 49:34.150]  It's very hard to say, but I do think blockchain is here to stay.
[49:34.290 --> 49:39.590]  And it's certainly becoming a stronger part of the financial system, especially with the new regulatory structures that have gone through this year.
[49:40.550 --> 49:40.670]  Thanks.
[49:41.010 --> 49:41.030]  Thanks.
[49:41.030 --> 49:41.090]  Thanks.