[00:00.000 --> 00:05.140]  Thank you, and thank you for all being here at this un-Christian hour.
[00:05.940 --> 00:12.620]  So, I hope you all got some of your favorite caffeinated beverage on your way up.
[00:12.800 --> 00:14.320]  So you can all stay awake.
[00:14.520 --> 00:17.200]  And I hope we have something interesting to show you.
[00:18.600 --> 00:26.680]  So, I will first roll a bit through some of the implementations we did on whistleblowing platforms in the Netherlands.
[00:26.680 --> 00:36.460]  And then Dr. Wex will introduce some of the technique behind it, and we will show some of the things we actually learned in setting up such platforms.
[00:38.740 --> 00:41.840]  So, we both work with Greenhost.
[00:42.060 --> 00:55.740]  They are a hosting provider, and they provide all kinds of services and work a lot with NGOs and other people working in dire situations if it comes to media.
[00:55.740 --> 01:01.620]  So, from that we helped set up the technical side of PubLeaks.
[01:02.700 --> 01:13.900]  PubLeaks is a Dutch intermediary platform between whistleblowers and Dutch media outlets.
[01:14.080 --> 01:15.760]  So, this is like mainstream media.
[01:15.760 --> 01:22.720]  So, these are major newspapers and primetime television news shows and et cetera.
[01:23.680 --> 01:54.640]  So, why we did that in this way is because PubLeaks does not only want to provide a safer place for online whistleblowing, but also wants to have a good link to the people who will be able to expose that what the whistleblower is trying to get out to the public.
[01:55.660 --> 02:09.640]  And what we also wanted to do is we see a demise in investigative journalism, mainly also because the revenue model for journalism is really problematic, and it's becoming more problematic over time.
[02:09.640 --> 02:33.700]  So, we hoped with this platform to revive a bit of investigative journalism because if you already have this starting point of getting some interesting documents in, then there is more of an incentive for newspapers or other media to actually support investigative journalists to investigate these leads.
[02:33.700 --> 02:41.940]  Whereas, if they start investigating their own, it's far more open-ended and harder to get the time for.
[02:45.920 --> 03:00.800]  So, what we did is Greenhost is actually managing the technical setup, whereas the PubLeaks Foundation, which is a separate foundation, is the legal entity behind PubLeaks.
[03:01.660 --> 03:20.340]  We also did this in such a way that the legal entity and the people who are actually responsible by the letter of the law do not have any access at all to any of the services that PubLeaks is running.
[03:20.340 --> 03:21.840]  So, there's a separation there.
[03:22.020 --> 03:35.280]  So, even if they raid the public offices or the private houses of those in the foundation, they will not get something that is of any use.
[03:38.380 --> 03:46.260]  So, the role of Greenhost is to provide technical support both to the journalists who try to use tools like PGP.
[03:46.440 --> 03:51.220]  And as we all know, journalists can have a bit of a problem with that.
[03:52.660 --> 03:56.980]  So, and also with the maintenance of the technical problem.
[03:57.140 --> 04:11.480]  Although we don't have, as you can understand, we don't have all the stuff that is running PubLeaks in-house, as we also don't want to be exposing anything if people would raid our offices.
[04:13.620 --> 04:28.520]  So, if a journalistic organization... So, the whole public platform is basically paid for by the newspapers and the media outlets that are connected to the platform.
[04:28.680 --> 04:34.840]  If they want to join, they have to subscribe to the public's goals, as I said earlier.
[04:34.840 --> 04:40.860]  So, that's protection of whistleblowing, more investigative journalism.
[04:42.400 --> 04:48.880]  And they need to subscribe to the Code of Bordeaux, which is a journalistic code.
[04:52.040 --> 04:57.560]  That's like the rules that journalists voluntarily abide by.
[04:57.780 --> 04:59.900]  That is internationally recognized.
[05:02.220 --> 05:05.900]  And the points that are really important here are, of course, verification.
[05:07.980 --> 05:11.940]  The checking if you can find supporting sources for the thing that's leaked.
[05:12.180 --> 05:14.900]  Because, well, you cannot directly...
[05:16.860 --> 05:20.800]  People might be leaking for all kinds of reasons and not always the good reasons.
[05:21.180 --> 05:28.020]  So, and also hearing all sides of the stories, which is also important in...
[05:28.740 --> 05:30.520]  Or at least trying to do that.
[05:30.940 --> 05:31.300]  So...
[05:31.300 --> 05:36.340]  And the other thing is, all the journalists that want to be using the platform...
[05:38.000 --> 05:42.140]  Have to receive a mandatory training, which will take a day.
[05:42.740 --> 05:43.840]  And they will be...
[05:43.840 --> 05:46.860]  They will get acquainted with...
[05:48.100 --> 05:55.540]  With the tools they are going to use for the whistle, for connecting to the public's platform.
[05:55.920 --> 05:57.800]  Which is basically Tor, PGP.
[05:58.460 --> 06:06.960]  And we also give a bit of a crash course into security online, metadata and documents, etc.
[06:06.960 --> 06:10.660]  So people don't do the...
[06:10.660 --> 06:15.580]  Are a bit more aware of the risks that are out there in this kind of situations.
[06:18.020 --> 06:25.960]  So, we also provide all these journalists with a five-year-old laptop...
[06:26.620 --> 06:30.580]  With a USB key with tails to connect to the platform.
[06:30.580 --> 06:35.600]  We help them with setting up their PGP and starting some PGP communications.
[06:36.060 --> 06:40.180]  So, what were the results?
[06:40.440 --> 06:46.300]  So, the platform was launched in September last year.
[06:46.300 --> 06:50.640]  And within the first week, we got a first major...
[06:50.640 --> 06:52.460]  We got a first leak.
[06:52.680 --> 06:56.240]  Which was about a healthcare provider, Humanitas.
[06:56.780 --> 07:07.300]  That had this interim guy that earned so much money for saving this institution...
[07:09.560 --> 07:12.760]  While failing and at the same time...
[07:12.760 --> 07:13.680]  So that...
[07:13.680 --> 07:14.920]  And at the same time we have a...
[07:14.920 --> 07:15.220]  What?
[07:15.220 --> 07:21.500]  Basically, they hired this guy and gave him about more than 100,000 euros...
[07:21.500 --> 07:22.880]  To fire a lot of people.
[07:23.260 --> 07:24.220]  To save money.
[07:26.460 --> 07:27.020]  So...
[07:27.020 --> 07:32.560]  And there's a lot of uproar recently about how people in the semi-public domain...
[07:32.560 --> 07:35.160]  Actually earn a lot more than the people in the public domain.
[07:35.900 --> 07:37.160]  And that this has to stop.
[07:37.400 --> 07:41.560]  So this was a bit of a problematic thing that got leaked.
[07:42.140 --> 07:45.020]  The first major leak happened within a month.
[07:45.900 --> 07:50.360]  That actually led to the step-down of a member of parliament.
[07:50.720 --> 07:55.120]  The situation was that this was a member of parliament for the elderly party.
[07:56.340 --> 07:57.720]  Which we have in the Netherlands.
[07:57.720 --> 08:01.200]  They have like two of the 150 seats in parliament.
[08:01.980 --> 08:06.000]  And this guy used to be editor of a magazine.
[08:06.300 --> 08:12.160]  And when he was the editor-in-chief of the magazine, he didn't pay for the pension plans of his employees.
[08:12.160 --> 08:19.220]  And as you can see, that can be kind of problematic if you are in the party of the elderly in parliament.
[08:19.520 --> 08:22.960]  Defending that people should get fair pensions and etc.
[08:23.780 --> 08:25.300]  So he had to go.
[08:25.300 --> 08:29.100]  He's trying to get into the European parliament, but it's not going so well.
[08:30.560 --> 08:33.060]  Basically the whole system works over the Tor network.
[08:33.340 --> 08:39.740]  So the Publix server itself is a Tor hidden service.
[08:39.740 --> 08:47.380]  And people can connect to Publix.nl, but Publix.nl is actually just a facade.
[08:48.100 --> 08:55.680]  It is only a Tor2Web bridge that is pushing the traffic to the Publix site.
[08:55.680 --> 09:03.500]  At this point, we do allow people to submit through the Publix site directly.
[09:04.840 --> 09:07.940]  Which means that they are using Tor2Web to do their submissions.
[09:08.240 --> 09:13.780]  And we, of course, make sure that this is over HTTPS using ephemeral keys.
[09:14.800 --> 09:25.740]  And we make sure that we have a lot of cover traffic actually generated from newspaper sites in the Netherlands to the Publix.nl website.
[09:25.760 --> 09:30.200]  So it's harder to spot if someone is actually visiting this site or not.
[09:31.580 --> 09:37.040]  But what we wanted to do is make sure that people wouldn't give up.
[09:37.260 --> 09:44.340]  So we do advise people to actually use Tor to connect to the platform and download the Tor browser bundle.
[09:45.660 --> 09:53.880]  But we also do allow people to submit through Publix.nl over HTTPS.
[09:56.500 --> 10:06.280]  And we call this... we tell people that this is a bit of the difference between submitting it confidentially or anonymous.
[10:07.000 --> 10:11.540]  So by making that distinction, we try to say...
[10:11.540 --> 10:18.280]  I mean, with a lot of situations, it's not the nation state you are facing, right?
[10:18.380 --> 10:23.120]  You're facing the company you work for, which might be a medium-sized company.
[10:23.120 --> 10:33.000]  So if you're submitting it not from your company network, but from somewhere else, then you are probably quite safe in getting this information out.
[10:34.640 --> 10:46.000]  And the other thing that might be happening if we would push people to only submit over using the Tor browser bundle could be that people just gave up and not leak at all.
[10:46.200 --> 10:52.800]  Or gave up and send a plain text email or do other things just to get the message out.
[10:55.960 --> 11:00.680]  So, and then the receiver, as I said, connects to the Tor... has to connect to the Tor network.
[11:00.680 --> 11:04.800]  He or she has also received training to do that.
[11:05.680 --> 11:11.740]  All the leaks are actually only encrypted to the media you want to send it to using their PGP keys.
[11:12.120 --> 11:23.680]  So it's only stored temporarily in memory on the public server, then encrypted to the users.
[11:24.720 --> 11:32.360]  And then it is actually the unencrypted content is directly removed.
[11:32.620 --> 11:36.600]  And the receiver can only receive the PGP encrypted files.
[11:37.120 --> 11:39.100]  There's actually a side note there.
[11:39.300 --> 11:54.020]  Is that before it actually gets encrypted to PGP, when you try to upload a document, the global leaks software where Publix is based on, starts an encrypted RAM disk, which is AIS encrypted.
[11:54.540 --> 12:03.380]  And when the entire leak is completely uploaded, it will then encrypt via the PGP key of the recipient media.
[12:04.440 --> 12:09.800]  So it doesn't touch the disk in plain text at all.
[12:10.520 --> 12:10.720]  Okay.
[12:11.500 --> 12:19.860]  So, and now Jure will continue in telling something about a smaller project that we did, which is WildLeaks.
[12:20.860 --> 12:25.160]  So WildLeaks is a platform which launched a couple of months ago.
[12:25.160 --> 12:30.800]  So we first talked about PubLeaks, which has like 42 or 43 media partners.
[12:31.480 --> 12:47.140]  While WildLeaks is a much smaller instance, and isn't so much about the media, but about exposing wildlife wrongdoing, like strawberry, illegal lodging, and illegal fishing all around the world.
[12:47.140 --> 12:59.460]  And this group works with partners on the ground to stop the people from either killing or trying to stop illegal smuggling of ivory, for example.
[13:00.200 --> 13:04.460]  So this thing is also... so this project is also based on GlobalLeaks.
[13:05.660 --> 13:07.080]  It's one group only.
[13:07.240 --> 13:09.280]  It's done by people from the Elephant League.
[13:10.220 --> 13:13.500]  And it more or less exposes wrongdoing.
[13:13.500 --> 13:23.720]  So I think one thing that is pretty interesting is that... so one of the people behind this is Andrea Kosta.
[13:24.060 --> 13:25.720]  I should move this a bit.
[13:29.320 --> 13:37.840]  Who actually exposed one of the Al-Shabaab groups in Somalia generated funds by smuggling ivory.
[13:37.840 --> 13:43.660]  So this is actually interesting because you would think that this is a kind of activist project.
[13:43.940 --> 13:51.720]  And then they exposed that terrorists are using ivory to generate funds for the terrorist activities.
[13:52.360 --> 13:53.660]  So that's interesting.
[13:54.140 --> 14:03.080]  And then in three months' time, there were about 24 tips ranging from importing illegal wildlife products into the U.S.
[14:03.080 --> 14:08.940]  to illegal allotting in Mexico, Malava, and Siberia.
[14:09.460 --> 14:17.700]  So when they get this tip, it isn't so much about trying to get this into the media than it is about...
[14:17.700 --> 14:26.460]  It's more about trying to stop the big groups from smuggling and exposing things kind of wrongdoing.
[14:29.060 --> 14:31.340]  I think you are the next slide.
[14:34.720 --> 14:42.680]  So when looking at implementing whistleblower platforms, you just saw two very different cases.
[14:42.680 --> 14:49.160]  Both in who the suppliers are of the information, who the receivers are, and what the aim of the platform is.
[14:49.160 --> 14:56.480]  And we think it's very important with every platform you want to set up to make a proper risk assessment.
[15:00.400 --> 15:04.960]  And look at all the risks and also inform whistleblowers about the risks.
[15:04.960 --> 15:14.960]  So if you look at the whistleblower, the risks are not only the risk of technological exposure, but it is also about social exposure.
[15:15.140 --> 15:17.460]  Because you're not leaking this in a vacuum.
[15:17.680 --> 15:24.340]  And there's a very big chance that, I mean, you're leaking something from your business.
[15:24.340 --> 15:27.900]  How many people had access to this information?
[15:29.100 --> 15:33.640]  Do you have a grudge with your boss already?
[15:34.000 --> 15:34.940]  Might they suspect you?
[15:35.160 --> 15:45.660]  So there's all these things that you have to take into account if you are a whistleblower that does not only have to do with technology.
[15:47.120 --> 15:50.640]  So, and to the receivers, this is the same thing.
[15:51.160 --> 16:00.140]  Especially if looking at the wildlife platform, you're working with people who are investigating things that lead to terrorism.
[16:00.780 --> 16:14.940]  If you look at journalists, as we see in this free society, journalists are more and more targeted if it comes to exposing people through whistleblowers.
[16:15.800 --> 16:19.080]  And then, of course, there's also the risks to the platform.
[16:19.400 --> 16:21.040]  So, what are the risks?
[16:21.480 --> 16:36.740]  I mean, looking at the two cases that we just discussed, the risks for wild leaks are completely different in terms of the risk to the platform as the risks are for the public's case.
[16:37.620 --> 16:49.760]  For instance, in the wild leaks case, the chances are a lot smaller that the Dutch police will kick in our front door and ask some questions to us.
[16:49.920 --> 16:58.540]  Whereas in the public's case, those chances are still hopefully not too big, but are at least larger and we have to take those more into account.
[17:00.700 --> 17:12.480]  So, the other thing I jotted down here was the ease of use versus theoretical security, but I think I already mentioned that in talking about how people could submit.
[17:12.480 --> 17:34.940]  I think there's always a risk of over-engineering security where people would just place a rock between the door if they need to get through 20 times a day and there's this impossible lock that they have to open every time.
[17:34.940 --> 17:44.360]  So, there is always a trade-off between theoretical security and practical security that has to do with the effort people have to put into it.
[17:44.540 --> 17:56.540]  And that relates to the risk that they actually think they are in, which usually has nothing to do with the risk they are actually in.
[18:00.110 --> 18:09.570]  So, the takeaway so far after implementing these platforms and some others is things to look at is how can you separate the responsibilities.
[18:09.850 --> 18:18.210]  Make sure that there's not a single person who has access to everything and who is also clearly known by the outside world.
[18:19.770 --> 18:37.230]  So, in the public's case, we did that by having all this kind of separate organizations and still have a very strong relation with the press because in most of the Western countries press get some extra protection in law.
[18:39.090 --> 18:41.570]  Use jurisdiction to your advantage.
[18:42.130 --> 18:50.810]  So, if you are building a leaking platform for Ukraine, maybe you shouldn't host it in Ukraine, but somewhere else.
[18:51.790 --> 18:56.890]  If you are building one for the U.S., maybe you should not host it in the U.S.
[18:59.030 --> 19:01.110]  Do not work in a vacuum.
[19:01.390 --> 19:02.130]  Create a platform.
[19:02.370 --> 19:04.510]  So, work with your users.
[19:04.730 --> 19:05.890]  Work with the whole use case.
[19:06.050 --> 19:06.950]  The thing you want to do.
[19:07.130 --> 19:07.850]  Think it all through.
[19:08.910 --> 19:13.350]  Don't start out with the idea that it is the technology that is going to solve it.
[19:13.370 --> 19:17.410]  The technology is only part of the solution.
[19:17.410 --> 19:26.910]  The users and the receivers and everybody is part of the solution of making online whistleblowing more secure.
[19:28.210 --> 19:34.150]  Part of that is also make clear what your use cases are and for what your platform can be used and for what not.
[19:35.650 --> 19:48.930]  Leaking about a three-letter government agency is a different piece of cake than leaking about something that has less of an omnipotent power.
[19:50.270 --> 19:52.110]  And co-design with your users.
[19:52.230 --> 19:57.750]  Make sure that they are involved in the process, especially the users that you can actually reach out to.
[19:57.750 --> 20:01.990]  I mean, it's hard to reach out to the whistleblowers before they know that there are whistleblowers.
[20:02.170 --> 20:09.330]  But you can reach out to people receiving the information and other people around.
[20:09.330 --> 20:22.950]  You can work with user testing and try to make something that actually works for the platform that you are trying to create.
[20:24.670 --> 20:29.870]  Next up is Jero, who would tell a bit more about the GlobalLeaks platform itself.
[20:32.070 --> 20:39.110]  So, there was yesterday a wonderful presentation about the SecureDrop software and formerly the DeadDrop software.
[20:39.810 --> 20:48.130]  And before there was SecureDrop, there was something called GlobalLeaks, which was released as the first time in September 2011.
[20:48.910 --> 20:54.150]  And from that moment on, they worked on and off about it.
[20:54.270 --> 21:01.070]  And now they have about around 30 plus websites using the GlobalLeaks software.
[21:01.430 --> 21:02.970]  Mostly in Europe, actually.
[21:03.230 --> 21:05.330]  Not so much in the U.S.
[21:06.050 --> 21:10.630]  Ranging from PubLeaks, WorldLeaks to MafiaLeaks.
[21:11.590 --> 21:19.690]  Where MafiaLeaks is a kind of website where you could upload information about Eastern European Mafia.
[21:19.870 --> 21:23.510]  But they mostly get information about Mafia from all kinds of weird places.
[21:25.770 --> 21:28.710]  So, it is really hard for them to work with it from what they understand.
[21:29.670 --> 21:31.850]  So, they have been around for a long time.
[21:32.650 --> 21:35.490]  They have been undergoing four audits.
[21:35.490 --> 21:40.390]  There has been an audit published a couple of months ago by the least authority people.
[21:41.070 --> 21:43.450]  For example, like Zuku works there.
[21:43.670 --> 21:44.710]  Who works on Tahoe Labs.
[21:46.290 --> 21:48.390]  Actually, it says 18 plus running instances.
[21:48.630 --> 21:49.830]  I think it's 18 and not 30.
[21:50.130 --> 21:50.470]  I'm sorry.
[21:51.390 --> 21:52.390]  Which is run by...
[21:52.390 --> 22:03.710]  So, the GlobalLeaks software is mostly written by a bunch of Italians who are working for the Hammers Foundation of Digital Human Rights and Security.
[22:04.610 --> 22:05.510]  Based in Italy.
[22:06.110 --> 22:09.170]  And they have a bunch of software they have been working on.
[22:09.330 --> 22:10.550]  So, for example, GlobalLeaks.
[22:11.170 --> 22:15.510]  And also, Thought Web, which was a former project from Aaron Swartz.
[22:15.750 --> 22:16.630]  They have took over.
[22:16.830 --> 22:20.910]  There's a bunch of projects that friends of them have been working on.
[22:21.010 --> 22:25.090]  Like, for example, Android clients to upload information.
[22:25.090 --> 22:26.950]  They work together with the Guardian project.
[22:27.770 --> 22:35.990]  For example, like, there have been plans to integrate the GlobalLeaks uploads in apps like InformaCam.
[22:36.770 --> 22:38.290]  And that kind of stuff.
[22:38.450 --> 22:40.890]  So, there's a pretty big ecosystem around it.
[22:41.110 --> 22:45.430]  And what is interesting about it is that compared to something like SecureDrop.
[22:45.610 --> 22:47.310]  SecureDrop really has one use case.
[22:47.470 --> 22:52.490]  And that is to really have a secure environment for one journalistic entity.
[22:52.490 --> 22:55.430]  Whereas GlobalLeaks could be used for all kinds of use cases.
[22:55.650 --> 23:00.630]  For example, you know, WorldLeaks, which is one entity, one kind of activist organization.
[23:01.030 --> 23:02.150]  It's more flexible.
[23:02.450 --> 23:05.290]  You could lower the security or you could improve the security.
[23:06.790 --> 23:09.730]  GlobalLeaks has more lines of code, for example.
[23:10.690 --> 23:24.150]  But it could also be used for all kinds of other purposes as a whistleblowing piece of software and organization within an existing organization like companies like Shell or BP or Axon.
[23:25.570 --> 23:29.810]  So, there's other ways to use the GlobalLeaks software.
[23:30.010 --> 23:37.790]  And I think that's pretty interesting because maybe we don't always want to expose everything to the public.
[23:37.790 --> 23:42.870]  Because what we have been seeing as well by public, for example, when we talk with a journalist today.
[23:43.610 --> 23:48.310]  And they say that sometimes because there's a kind of chat function within the GlobalLeaks software.
[23:48.470 --> 23:53.030]  When a whistleblower uploads material, you could have a one-on-one chat with the whistleblower.
[23:53.230 --> 23:58.570]  And most of the time, the whistleblower is upset because he didn't get a promotion.
[23:59.590 --> 24:03.130]  And his friend within the company, his co-worker, got a promotion.
[24:03.130 --> 24:03.850]  So, he's mad.
[24:04.010 --> 24:07.070]  And he's going to leak information about whatever.
[24:08.530 --> 24:11.370]  And then most of the time, it comes out.
[24:11.510 --> 24:13.230]  And oftentimes, it also doesn't come out.
[24:13.350 --> 24:15.910]  So, that's a bit in flux.
[24:16.930 --> 24:20.410]  But that's kind of the thing that is more flexible in use.
[24:20.410 --> 24:32.990]  And this is why, at that point in time, when we started looking around, we mostly first looked at a piece of whistleblowing software made in Germany by a newspaper called Der Zeit, if I'm right.
[24:33.170 --> 24:38.910]  And they have been working on some kind of remailer kind of system.
[24:38.910 --> 24:45.490]  So, that if you could email a leak, it would get remailed a few times before it reaches the journalist.
[24:46.550 --> 24:50.970]  Well, we thought that wasn't really secure because people don't really use remailers a lot.
[24:51.130 --> 24:52.830]  So, that might be pretty obvious these days.
[24:53.150 --> 25:02.710]  Well, the problem was mostly that the system was designed, I think, also with some legal advice in mind.
[25:02.710 --> 25:07.950]  But it was mostly... the name of the software is Briefkasten, by the way, which means mailbox.
[25:10.030 --> 25:18.670]  But it was mostly designed to... and worked very well for protecting the journalist, but less so for actually protecting the whistleblower.
[25:18.850 --> 25:21.710]  Which was, for us, pretty important, as you can imagine.
[25:22.710 --> 25:23.210]  Right.
[25:23.490 --> 25:31.870]  So, for example, at the Publix website, when you go to the actual leaking site, it will show you...
[25:31.870 --> 25:40.110]  it will show a kind of notification that if you go there without using something like TILS or the Tor Browser Bundle, it will say a warning.
[25:40.530 --> 25:43.850]  And we see that you are not using Tor, and maybe you should use Tor.
[25:44.070 --> 25:47.030]  And here is a link to the Tor Browser Bundle.
[25:47.130 --> 26:00.250]  And here is a link to Security in the Box, which is a kind of write-up by the Tactical Tech Collective, based in Berlin, which shows you how to use digital security.
[26:00.250 --> 26:04.430]  And we give some tips about operational security practices, for example.
[26:05.190 --> 26:06.470]  So, we have links to that.
[26:06.610 --> 26:11.410]  And if you go there, and then you go on and say, okay, I kind of understand the risks.
[26:11.690 --> 26:20.590]  And then you get a questionnaire where you need to say that, okay, I understand that HTTPS is not secure, but I choose it anyway to upload my documents through it.
[26:21.470 --> 26:27.470]  And if you go there with Tor, it will detect that you will get redirected to the Onion.
[26:29.270 --> 26:33.650]  So, it is as simple as, basically, appgat install global leaks.
[26:33.950 --> 26:40.610]  If you first add the app repository and the PGP key to verify the authenticity.
[26:41.170 --> 26:44.890]  It is mostly based on Python and AngularJS.
[26:45.230 --> 26:47.590]  It has a new 8GPR license.
[26:48.090 --> 26:50.790]  It mostly uses PGP and AIS encryption.
[26:51.090 --> 26:52.750]  AIS encryption for the RAM disk.
[26:52.750 --> 26:56.190]  And it has a pretty well-documented API.
[26:56.430 --> 27:00.110]  So, you could write all kinds of cool applications.
[27:00.470 --> 27:06.850]  Like, for example, they have made this global leaks Android application.
[27:07.690 --> 27:14.290]  But it could also be used to integrate it into other applications, as I said before, like InformaCam from the Guardian project.
[27:16.490 --> 27:19.470]  So, as I said, it has been around for a while.
[27:19.670 --> 27:23.610]  So, it has also been audited by a couple of organizations throughout the years.
[27:23.950 --> 27:29.350]  One of them is ISAC Partners, who has also audited the code of SecureDrop.
[27:31.130 --> 27:44.090]  Q53, which is a really small consulting company based in Europe, who does really good stuff around auditing a lot of browser stuff and web.
[27:44.270 --> 27:46.110]  And they are pretty fantastic in what they do.
[27:46.990 --> 27:59.670]  And then Vericure also did one at the end of 2013, and at least authority people uncovered a few vulnerabilities, which has been patched or mostly patched as of now.
[28:00.450 --> 28:03.090]  So, it has been undergoing some audits.
[28:05.250 --> 28:06.750]  And then we have Tor2Web.
[28:06.970 --> 28:10.890]  So, actually, it is more like Web2Tor.
[28:11.450 --> 28:23.390]  That means that if you go through with a browser to secure the Publix.nl, you get redirected internally at the server side to the actual hidden Tor hidden service.
[28:23.690 --> 28:28.870]  So, you do not actually have to install Tor to resolve the Tor hidden service internally.
[28:29.090 --> 28:30.970]  So, that is what the server side is doing for you.
[28:30.970 --> 28:47.110]  So, of course, it is always better to use the Tor Rails server window, but we also made this decision to try to make the barrier a little bit lower for people to upload the information, because it is not always the nation state that is your enemy.
[28:47.870 --> 28:48.690]  Not always.
[28:50.090 --> 28:51.570]  So, it is mostly based on Python.
[28:52.670 --> 28:55.290]  You pass from the Internet to Tor hidden services.
[28:55.290 --> 28:59.270]  If you don't use Tor, you get redirected.
[28:59.450 --> 29:01.770]  And it will still say secure.public.nl.
[29:01.930 --> 29:07.050]  If you actually use the Tor browser bundle, you get redirected to the actual Tor hidden service address.
[29:07.430 --> 29:19.810]  So, you will see that if you use that, you will go from secure.public.nl to something something.onion, which is the sort of TOD for the Tor hidden services.
[29:21.590 --> 29:24.930]  So, within the GlobalX thing, we...
[29:24.930 --> 29:31.710]  at Publix and also at WildX, everything gets encrypted to a PGP 4096-bit key.
[29:31.710 --> 29:35.350]  And it can only be read on the laptop, running TILS.
[29:35.550 --> 29:37.030]  Or if they...
[29:37.970 --> 29:44.990]  If the journalists are good enough, they could probably also fool the system using the Tor browser bundle, just on a regular computer.
[29:45.090 --> 29:49.110]  But we made it really clear that they should always use TILS and keep it up to date.
[29:49.270 --> 29:50.550]  And we show them how to do it.
[29:52.110 --> 29:53.430]  And there is a kind of...
[29:53.430 --> 29:56.530]  So, when you have uploaded the information, there is a way to...
[29:56.530 --> 30:12.370]  So, we choose at the moment that a whistleblower could upload it to seven different media entities because most of the media organizations don't have an investigative team anymore.
[30:12.570 --> 30:16.690]  So, it's mostly freelance journalists who are more or less working on it.
[30:17.530 --> 30:21.390]  So, there's a way to have a one-on-one conversation with the person.
[30:21.830 --> 30:29.750]  So, the whistleblower with the recipient or the receivers and the whistleblower.
[30:29.910 --> 30:37.110]  So, the receivers could all check and see the other chats from the other receivers.
[30:39.070 --> 30:45.330]  And to have a kind of small comparison with SecureDrop, although it's kind of hard to do because...
[30:45.330 --> 30:58.530]  So, I kind of did the comparison using this use case from SecureDrop with GlobalLeaks, which is the one-on-one with one entity.
[31:01.390 --> 31:09.150]  I mean, I guess the GlobalLeaks user experience for both parties, that being the receiver, and the whistleblower is kind of easier.
[31:09.710 --> 31:20.530]  Of course, the SecureDrop thing has things like an air draw and an air gap and some kind of idea system monitoring the server or what's coming in, like 40 traffic.
[31:21.730 --> 31:22.130]  So, that's...
[31:22.130 --> 31:26.170]  Like, SecureDrop has a high security threat model, which is a good thing.
[31:27.950 --> 31:36.130]  Although, the same thing could be applied to GlobalLeaks, although it has more lines of code, so potentially a bigger attack factor being there.
[31:37.110 --> 31:42.290]  While SecureDrop has less lines of code, I think it's less than a couple of thousands of lines.
[31:42.630 --> 31:44.090]  Less than three thousand lines, I guess.
[31:45.730 --> 31:57.670]  And then, I guess the GlobalLeaks has some kind of better security for submitting data, that being the encrypted RAM disk before it actually gets encrypted to PGP and then being put on the disk.
[31:59.330 --> 32:02.810]  And then, I mean, the kind of winner is...
[32:02.810 --> 32:08.930]  I guess that it's not really a winner because it has many different use cases and you should use the use case with this...
[32:08.930 --> 32:12.050]  what you want for that specific platform that you have in mind.
[32:12.430 --> 32:24.970]  If you want something just for one organization with higher security because you are the Washington Post and you expect high profile leaks, then I would totally recommend you to go with SecureDrop.
[32:25.190 --> 32:32.750]  If you want something within a company or using multiple recipients, you should totally use GlobalLeaks.
[32:33.570 --> 32:34.910]  So, there's not really a winner.
[32:36.070 --> 32:41.850]  And I guess with that, I'm going to hand it over to Sascha who's going to take something about the takeaways of that.
[32:42.170 --> 33:00.750]  Yeah, just to come back to who the winner is, I think we are the winner here and that there are now two excellent platforms emerging for whistleblowing, something that we've been all waiting for, I think, after the whole WikiLeaks saga started.
[33:01.510 --> 33:11.910]  We've been waiting for a way to more distribute this because you don't want a single platform taking all the blows because we're still looking at the aftermath of that.
[33:12.590 --> 33:29.570]  So, diversity is great here and I'm really happy that, although it took some time, there are now two projects that are being developed that provide this kind of things and make it possible for people to start their own platforms.
[33:30.950 --> 33:38.370]  So, yeah, as to the takeaways, we can, after your introduction to the platforms, I think we can add two things.
[33:39.710 --> 33:44.930]  And that is, you should choose the technology that best matches your problem.
[33:45.110 --> 33:54.590]  So, look into the softwares, look at the websites and look at the communities and choose the technology that fits the thing you want to do the most.
[33:54.890 --> 33:57.030]  And also, work with the developers.
[33:57.330 --> 34:11.950]  Both GlobalLeaks and SecureDrop have a great team of developers who are usually very willing to help out and think with you about what the best solution would be and what security risks you could have.
[34:11.950 --> 34:17.110]  And they also have all more experience with building more of these whistleblowing platforms than just one.
[34:17.450 --> 34:24.110]  So, I think that would be great tips.
[34:24.650 --> 34:34.550]  So, then, to more or less wrap it up before we're taking questions, Jure is going to tell you how you can help.
[34:37.760 --> 34:41.240]  So, you don't always have to run a whistleblowing platform to help, right?
[34:41.400 --> 34:45.080]  So, there's a bunch of ways and there's a bunch of problems that we need to solve.
[34:45.320 --> 35:00.460]  And I think one of these problems is that we need to educate whistleblowers and not potential whistleblowers, but this kind of intersect with teaching people about what a computer is or what the Internet actually is or how you can contract yourself.
[35:00.820 --> 35:12.320]  So, when we talk about, you know, cybersecurity, we talk about offensive security against nation states and people are pretty vulnerable, right?
[35:12.320 --> 35:13.520]  I mean, we all know this.
[35:13.720 --> 35:18.920]  So, we need to protect people in a way that we can say that you should probably use free and open-source software.
[35:19.260 --> 35:28.280]  You should educate people on about, you know, how they can be secure online and all that kind of stuff.
[35:28.500 --> 35:30.140]  And we need laws to make this happen.
[35:30.360 --> 35:40.240]  So, for that, you know, the people from the EFF, the ACLU and ADRI in Europe are doing fantastic work and they need your money to make this kind of things happen.
[35:40.460 --> 35:42.100]  And they are pretty fantastic in what they do.
[35:43.080 --> 35:45.300]  If you're a really good coder or you can...
[35:45.720 --> 35:52.740]  or you really love documenting, documenting stuff or just coding in general, you could contribute...
[35:52.740 --> 35:54.600]  Or a super UX designer.
[35:55.280 --> 35:56.580]  Yes, for example.
[35:57.040 --> 36:03.800]  you could, you know, contribute to projects like GlobalX, SecureDrop, Tor, TILS and OTR.
[36:05.920 --> 36:11.360]  There's a bunch of people, you know, throwing crypto parties, which is a pretty good thing to do.
[36:11.480 --> 36:12.220]  So, thank you for that.
[36:13.480 --> 36:16.180]  There's also a bunch of people, you know, who will train journalists.
[36:17.480 --> 36:21.920]  I think the Press Freedom Foundation is one of these organizations who is doing that.
[36:23.140 --> 36:25.880]  If you're really good in these kind of things, I think you should do that.
[36:27.240 --> 36:30.960]  And, I mean, we need to improve loss pretty badly.
[36:31.820 --> 36:35.260]  Meaning, like, all around the world to make whistleblowing protection better.
[36:36.400 --> 36:48.320]  And, I guess, I didn't put it on it, but I remember now, is that people from the Corex Foundation based in Berlin and in London from Sarah Harrison who helped Edward Snowden escape to Moscow.
[36:49.080 --> 37:03.760]  You know, this is one of the organizations which makes sure that if people have information and their life really is at risk and they want to sacrifice themselves like Edward Snowden did for us or Chelsea Manning, then maybe we should help them.
[37:04.060 --> 37:09.960]  And maybe we should donate to their cause because they have done something fantastic for the most of us.
[37:10.100 --> 37:11.780]  So, maybe we should encourage that.
[37:13.360 --> 37:15.940]  So, that is how you can help.
[37:17.180 --> 37:19.060]  And, yeah, next slide.
[37:19.560 --> 37:19.900]  Okay.
[37:20.280 --> 37:22.140]  So, now the floor is open to questions.
[37:22.780 --> 37:26.460]  If you want to reach us, here is to do it securely.
[37:28.560 --> 37:31.020]  So, if you have any questions, there are mics.
[37:31.600 --> 37:33.600]  I think here, one in the middle.
[37:35.500 --> 37:40.440]  So, if you have any questions or whatever, please line up.
[37:41.140 --> 37:43.860]  A couple of comments and then a couple of questions.
[37:44.160 --> 37:47.320]  One, you know, thank you for all your work.
[37:47.600 --> 37:59.860]  I think we all heard yesterday that using technology to solve these kinds of issues, increase transparency, is probably one of the greatest ways that this community can get back to a better world.
[38:02.140 --> 38:16.420]  Second one is, I think it's great that everybody is using the same kind of tour-type infrastructure and interface simply because that makes traffic analysis to any of these sites more difficult for the bad guys.
[38:18.980 --> 38:22.240]  A question, and, well, one other comment.
[38:22.760 --> 38:27.480]  Personally, I get upset about hearing secure drop versus so-and-so and who's the winner.
[38:27.680 --> 38:33.800]  You know, these are all efforts toward a great contribution to the world and don't feel like winners and losers.
[38:34.260 --> 38:37.220]  Like you said, different drop cases and use cases and so forth.
[38:38.020 --> 38:38.480]  When...
[38:39.840 --> 38:45.320]  There was an interesting thing that was mentioned in the secure drop presentation the other day.
[38:45.380 --> 38:46.900]  And again, I'm not trying to go compare.
[38:47.140 --> 38:48.360]  It just sparked something in my brain.
[38:48.500 --> 38:53.840]  They talked about a server being located in the press room simply because the U.S.
[38:53.940 --> 38:57.480]  courts had decided that that was protected just like the journalist.
[38:57.480 --> 39:07.580]  And the only issue that brought up to me was, wow, the technology solution has to address different laws, different courts, different jurisdictions.
[39:08.180 --> 39:11.620]  That must complicate tremendously your jobs.
[39:11.840 --> 39:13.160]  I wonder if you could comment on that.
[39:13.340 --> 39:24.500]  And the second question is, traffic analysis is, you know, a big threat to any users of this newspaper report or whatever journalist.
[39:25.340 --> 39:29.140]  When you do support to these people, do you do it all through tour?
[39:30.360 --> 39:31.920]  Or is it public?
[39:32.140 --> 39:41.820]  Because aren't the officials going to be able to trace that a news reporter from somewhere sent something to globalleaks.com and so forth?
[39:42.000 --> 39:43.040]  Those are my two questions.
[39:43.940 --> 39:44.420]  Okay.
[39:44.420 --> 40:06.380]  To start with your comment on SecureDrop versus globalleaks, I think that was also a bit of a joke in that we wanted to make clear to you that we don't see a one is better than the other, but just wanted to show you that both have their different use cases.
[40:06.380 --> 40:07.740]  And both should exist.
[40:08.260 --> 40:09.320]  And they complement each other.
[40:09.660 --> 40:09.760]  Yeah.
[40:10.160 --> 40:14.900]  I think it's great that there are two platforms that provide a lot more robustness than one.
[40:15.020 --> 40:16.620]  I think there's space enough for that.
[40:17.460 --> 40:22.460]  As to the press room and law comment question.
[40:23.000 --> 40:23.620]  Yeah.
[40:24.880 --> 40:39.780]  I would recommend everybody who's starting a platform to really look into legal but also political situations of where you're working and make decisions based on that.
[40:39.980 --> 40:51.540]  So if the law is in such a way that you could use this pulling the stuff into a press room in protecting it more then that's a great way of doing it.
[40:51.740 --> 41:02.100]  It's in a way hacking the legal and the political system for the means of what you want to achieve as a project.
[41:03.920 --> 41:08.100]  And then I'll leave you with a traffic question.
[41:09.020 --> 41:09.300]  Yeah.
[41:09.560 --> 41:09.980]  So...
[41:11.200 --> 41:13.220]  Traffic analysis and Tor...
[41:18.870 --> 41:44.770]  Like I guess the kind of thing is is that if everybody or a lot of more people will use Tor and make it so that if you download the Tor Rails Hub on that you start it up every once in a while you create cover traffic for a lot of different people and then we have the other side is that if Tor would only be used by activists and journalists that it would be really easy to spot these people.
[41:45.590 --> 42:03.290]  So, you know, like I guess that law enforcement and other kind of scary people should also use this tool because it creates diversity in the kind of traffic that is being put out by either the Tor network as a whole or the accent notes or...
[42:03.290 --> 42:11.250]  and in this case most of the time it stays within the Tor network so it doesn't go out on the Internet.
[42:11.590 --> 42:14.610]  It stays within the network because it's a Tor hidden service.
[42:15.050 --> 42:47.010]  So, I guess you could still do traffic analysis but we tried to beat that problem by trying to pollute the data retention logs in the Netherlands even though data retention has been declared illegal in Europe the Dutch government tends to ignore that for the time being and goes on with the data retention stuff even though for example at Greenhost we don't log a lot of things and if we don't log a
[42:47.010 --> 42:48.530]  lot of things we don't...
[42:48.530 --> 42:50.350]  we can't give the logs anyway.
[42:51.850 --> 42:53.830]  It's called data retention, right?
[42:53.970 --> 42:55.750]  So, if you don't have it you can't keep it.
[42:56.810 --> 43:03.610]  Yeah, so the less you log the better it is so there are ways to make it harder for them.
[43:03.730 --> 43:05.750]  Not impossible but definitely more harder.
[43:06.030 --> 43:09.490]  I think security is all about raising the bar and the cost.
[43:11.730 --> 43:13.510]  Many, many thanks for everything you're doing.
[43:13.610 --> 43:14.990]  This is an exciting presentation.
[43:15.330 --> 43:27.290]  The big problem for whistleblowers and I'm a whistleblower is on the client end because Tor does not do you a damn bit of good if there's some sort of key logging device on your PC or everything you're doing.
[43:27.510 --> 43:40.210]  And if you were the major bank and they're worried about what you might say you don't even have to blow the whistle but if they're worried about you you're being tracked and probably by the same contractors that are supporting systems for the NSA.
[43:40.690 --> 43:47.870]  So that's what you're faced with and where do you go to access these wonderful systems you're developing.
[43:48.310 --> 44:10.510]  And one of the things that I would really love to see would be something like tails running on a raspberry pie a stripped down system where people could walk into a room you have a bunch of pies sitting there a bunch of SD cards everybody swaps them you only put a Wi-Fi nipple in when you need it and nobody knows who's on the other end.
[44:11.050 --> 44:23.730]  And then you're always using public Wi-Fi because it's great you have all these things but it's the client end that we really have to strengthen and find a way to make it completely anonymous.
[44:24.310 --> 44:24.610]  Thank you.
[44:24.750 --> 44:25.070]  Right.
[44:25.370 --> 44:25.650]  Yeah.
[44:26.190 --> 44:28.390]  Thank you for your comment.
[44:28.990 --> 44:42.770]  I think that's a great comment and I think there are some projects out there actually to use hardware devices which makes it a lot easier for people to work with things like Tor.
[44:42.770 --> 44:44.910]  so for instance there's...
[44:44.910 --> 44:48.770]  I think it's called a Tails pie which is...
[44:49.930 --> 44:56.890]  Tails doesn't work on ARM devices it only works on x86 and x86_64 devices.
[44:57.210 --> 44:58.050]  They only have that kernel...
[44:58.390 --> 44:58.530]  Oh, sorry.
[44:58.790 --> 44:59.290]  Tails...
[44:59.290 --> 45:01.470]  Tor pie, excuse me.
[45:01.610 --> 45:02.130]  Onion pie.
[45:02.570 --> 45:02.730]  Yeah.
[45:02.970 --> 45:12.330]  There is a device that actually routes that you could plug into your laptop and that routes the traffic over Tor even without anything installed.
[45:13.490 --> 45:15.210]  But that still makes you unique.
[45:15.390 --> 45:16.710]  That stands you out from the crowd.
[45:16.710 --> 45:18.770]  If you're caught with one you have one in your desk.
[45:19.110 --> 45:21.890]  You want something where you can be completely anonymous and look...
[45:21.890 --> 45:28.270]  Oh, you could have it in your favorite robot and just pull the pie out and use it for your communications when you needed it.
[45:29.730 --> 45:30.610]  I mean...
[45:30.610 --> 45:31.510]  Yes, but...
[45:32.110 --> 45:41.390]  I guess we are now really talking about kind of nation-state adversary whereas I guess most of the whistleblowers don't have...
[45:41.390 --> 45:46.450]  I mean, not all the whistleblowers are working for the NSA or contractors for the NSA.
[45:46.810 --> 45:56.330]  But I mean, it's hard enough for people oftentimes to install something like a Tor browser bundle than having a kind of special device to make that happen.
[45:56.330 --> 46:00.130]  I guess we are years away from making that happen.
[46:00.270 --> 46:14.690]  I would like to see TILs being made more easier to install on USB sticks and not being tracked by the NSA key score and then being called an extremist, I take offense, of the NSA.
[46:17.670 --> 46:25.410]  You mentioned that the German remailer solution was much more secure for the receiver than the sender.
[46:26.250 --> 46:33.510]  So just looking at some of the techniques you talked about with the encrypted RAM and so forth and so on.
[46:33.970 --> 46:37.310]  I guess the idea of creating some kind of secure sandbox.
[46:38.890 --> 46:40.650]  Do you have that on both ends?
[46:40.850 --> 46:44.910]  Do you try to maintain the same level of security security on both sides?
[46:45.230 --> 47:05.230]  Because in a lot of use cases, what you call the leaker, the sender may be collaborating with another person who's the receiver and then maybe that's the lawyer in the middle who is providing the protection and might then redact the information and, Richard,
[47:05.450 --> 47:06.830]  send it back to the leaker.
[47:07.090 --> 47:13.010]  You know, the two of them are cooperatively doing an investigation with whatever you want to call it, Chinese walls.
[47:13.010 --> 47:17.670]  So do those two parties have the same similar capabilities?
[47:17.670 --> 47:19.530]  Or does one have less or more?
[47:19.930 --> 47:21.750]  Because I think they'll be the same person.
[47:21.910 --> 47:22.790]  That's why I asked it.
[47:23.330 --> 47:27.330]  So I would say that it's usually...
[47:27.330 --> 47:34.950]  It's a lot easier to have better security on the receiving end than on the sending end.
[47:34.950 --> 47:42.370]  Because on the receiving end, we can do things like mandatory training, right?
[47:42.530 --> 47:47.290]  We say you have to receive a training as a journalist to become part of this platform.
[47:47.410 --> 47:49.910]  And this is for multiple reasons, right?
[47:50.030 --> 47:53.890]  It's also to have a better protection for the one who is leaking the information.
[47:55.610 --> 47:57.770]  But we cannot...
[47:57.770 --> 48:04.570]  It's very hard, other than through the PubLeaks website itself, in providing information there and pointing people to the right resources.
[48:04.570 --> 48:10.310]  It is very hard to upfront training to whistleblowers.
[48:10.310 --> 48:19.130]  So, yeah, I'm not going to say that it is the same because it's impossible to have it the same.
[48:19.290 --> 48:28.430]  Okay, because when you talked about multiple use cases, I was listening to an NGO saying, you know, I get worried when I collect information in this country.
[48:28.950 --> 48:40.190]  And maybe a use case for them is they collect the information, leak it, treat it as if it's a leak, pop it up, someone redacts it, cleans it up, ships it back, they open it up and they're secure.
[48:42.230 --> 48:43.650]  There are use cases for that.
[48:43.770 --> 48:57.990]  For example, I think there have been platforms which have been doing this as the kind of like whitewashing information is that they get information through another source, through another way, and they upload it through this platform and say, I don't know where it came from,
[48:58.130 --> 49:00.250]  I don't know the whistleblower, but I got it through this platform.
[49:01.230 --> 49:03.070]  No point in kidnapping that person.
[49:03.190 --> 49:04.390]  Yeah, it's like possible deniability.
[49:05.010 --> 49:05.130]  Thank you.
[49:07.150 --> 49:13.990]  I have a couple of comments on the question that the lady over there posed earlier, and then a question for you guys as well.
[49:14.150 --> 49:19.350]  I used to work for a bank, so I have an idea of what you're talking about.
[49:19.530 --> 49:38.680]  And you mentioned raspberry pies, but if you're concerned about keeping a low profile, I think walking into a bank with a raspberry pie, well, I think in our culture going anywhere right now with a raspberry pie outside to some place like this attracts attention.
[49:38.960 --> 49:42.800]  I think a better alternative would be to repurpose a smart phone.
[49:43.760 --> 49:51.640]  Basically rip off, you know, completely wipe out the Android platform, just use the hardware, and stick something on top of that.
[49:51.980 --> 49:53.700]  It looks like an everyday item.
[49:53.700 --> 49:59.620]  A raspberry pie may be normal to us, but it's not an everyday item outside of this room.
[50:00.260 --> 50:04.260]  I think it would be better to repurpose something like a smart phone or something that looks like a camera.
[50:04.700 --> 50:09.420]  Something that really looks more harmless than a raspberry pie.
[50:10.020 --> 50:17.180]  The other thing to be concerned about, especially if you're in a large corporation like a bank, it's not just the,
[50:25.780 --> 50:29.740]  it looks a little bit more suspicious than this, I just think.
[50:29.820 --> 50:47.800]  The other thing is, in addition to key logging software, you also have to be concerned about data leakage prevention software, which isn't just, which is not just capturing your keystrokes, but is keeping track of what you're looking at, and what you're doing with it,
[50:47.900 --> 50:49.780]  which is another discussion entirely.
[50:49.780 --> 51:04.160]  My question for you is, are you aware of any comprehensive or attempt to build a comprehensive OPSEC, like a training course for journalists that isn't platform specific?
[51:04.480 --> 51:18.780]  Like just, you know, you mentioned a couple of platforms here and how they have their own training material and how to use the platform, but are you aware of any attempt to develop like a, almost like a college course, an OPSEC training course that's more comprehensive?
[51:19.700 --> 51:45.060]  I think there's something by the committee of protecting journalists, the CPG, which has been doing something similar, not about only digital security, but also about physical security and what kind of things you need to watch out for, and going into more dangerous areas like war zones and that kind of stuff.
[51:45.240 --> 51:52.480]  And then we have the kind of guides like security in the box, which is a kind of digital security thing.
[51:53.760 --> 52:04.860]  So these things kind of exist, but they don't really complement each other, because most of the time there are like 10 different organizations are doing the same thing and are doing the same work without contributing to existing guides.
[52:04.860 --> 52:07.440]  So there's a lot of, you know, weird stuff.
[52:07.620 --> 52:12.920]  I also think that the problem there is the best place where you want to have this is actually in schools of journalism.
[52:13.240 --> 52:15.960]  And there has been a... it's very hard.
[52:16.080 --> 52:25.180]  I have contacted some people and some schools are doing it, but usually if you get something in the curriculum, then something else has to get out.
[52:25.180 --> 52:30.620]  So this is going to be a long way.
[52:30.800 --> 52:35.220]  But we've been trying to work on it locally, so in the Netherlands, to get this kind of stuff in.
[52:35.400 --> 52:40.200]  And I hope other people are also trying to do that with their local schools of journalism.
[52:40.200 --> 52:53.120]  Yeah, they are actually doing something at the Centre of Investigators Journalism in London, where they have been writing a similar kind of guide, which is being given at the University in London, if I'm right.
[52:53.600 --> 52:53.920]  Geffen.
[52:54.260 --> 52:54.480]  Yeah.
[52:56.300 --> 52:57.200]  Oh, we're done?
[52:57.600 --> 52:58.120]  Oh.
[53:01.310 --> 53:02.210]  Sorry, Geffen.
[53:02.410 --> 53:02.650]  Sorry.
[53:03.930 --> 53:05.350]  Okay, well, thank you.
[53:05.450 --> 53:05.930]  Thank you.
[53:06.050 --> 53:06.370]  For coming.