Privacy and surveillance: Jacob Applebaum, Caspar Bowden and more

A long day - with some fascinating insights from Caspar Bowden, Bill Binney and Jacob Appelbaum. We hope you found it as fascinating as we did.

Appelbaum: "We give [NSA and GCHQ] a really hard target [in Tor]. 

Q: when I look at the Tor map there's a big thick green line going to the middle of the US... what is it..?

A: I'll answer a related question - does the NSA run Tor nodes? As far as I can tell that's not the angle they're going for. But there are people with fast internet who care about freedom of speech.

The Tempora program.. there are places which the NSA can't break into. Tor reduces the chance that you get targeted.

A: financial transparency.. Julian Assange wrote an essay called "On The Take and loving it" about academic grants. For Tor we put our sources up. DoD, EFF... 

State interference in Tor.. GCHQ and the White House are targeting Tor and they are failing.

"The fact is that wherever there are unique identifiers the NSA will want to record it. They want it for 100 years, and certainly have it for 15.

"One thing about Facebook was the real name policy. A fascinating notion is that we only have one name, and that it belongs to the state. The only people who get anonymity are those who can create IDs - which are states.

"The Transnational Republic is trying to let us generate our own names - so you could define a pseudonym as yours. Things like that I suspect are worth working on.

"One really important conclusion - IBM's German subsidiary in the second world war knowingly built punch card machines and repaired them in Auschwitz. They knew what they were doing. When these people are killing Muslims with flying robots, things have gone too far. We need to stop the engineers working on these extrajudicial systems. IBM Deutschland knew what it was doing. And the hacker group Gamma is building weaponised systems for the monarchy in Morocco... which is a problem.. the battlefield comes home. We really need to solve these problems.

"There are differences in scale, but not in progression Targeting people for torture or assassination - it's a matter of scale. 

"One last thought - imagine there's a wiretapping system that goes into an internet point. What does the FBI or CIA do when it taps a fibre? Each - NSA, CIA, FBI - gets this data. The problem isn't just the NSA, it's all of these agencies working together, they've subverted our democracy. The last stand is cryptography. If you're an engineer working on crypto.. this is for you. And we can all take a stand politically."

In 2004 Greece had intercepts of phone systems - that attack looks very similar to Belgacom case. Maybe people have these [backdoor] systems built for one set of people but others can use it too. Adding backdoors - we should look at criminalising it. It's like landmines.

"If we're worried about Chinese hackers, which I think is just veiled racism - they're not the problem, with the NSA we had to be told by someone inside, and they're in everything. If these NSA people got arrested when they travelled to Europe that would be interesting. The Guardian doesn't want to release names, and that's good in some cases. But people who commit mass human rights violations, they should be prosecuted.

"The NSA has a slogan internally - 'we track 'em, you whack 'em'. Not a joke. It's really critical that we see the parallels: we're losing due process and we're losing judtice. The number of people killed on the Berlin Wall during its operation was around 180. Number of people killed by drone strikes in the last 10 years is an order of magnitude more.

"Policy is lagging behind technology. Policy should make sure we use crypto .. make it impossible to spy so we are secure in our communications. By marrying technology and policy together."

Appelbaum says that the NSA is likely to be ahead of academic analysis. "I think the NSA may have broken RC4.. something like IPSEC which has a NIST standard may be just as bad or worse. And proprietary environment it may be worse.

"In my computing hardware I drill the microphones out of my laptop." (A pause in the room while people consider that.)

"How do we resist this? If I'm going to meet someone then I need to work on something that's forward-secret... it's called PANDA.. we want a way to have a shared secret and meet in a forward-secret way to do a key exchange. Because we know they look for particular keywords. The moment you connect to the internet then you reveal all your information, your presence."

(Complex explanation follows of how they generate an encrypted tag using Diffie-Helman (encryption) and then go forward and have a key exchange (for SSL) over the Tor network.)

"I'm pretty confident that the way they would and could beat Tor would be via the web browser... " He tails off: doesn't want to describe something there.

"Trying to save email is a lost cause apart from how it's distributed; PGP I trust but the user interface is a nightmare."

His aim is "get rid of plaintext on the internet wherever possible... Google is starting to encrypt its own backbone, the internal fibres.. so even if the NSA was sniffing stuff in there it would get nothing... big networks need to adopt that. 

"I think if you're working on these things.. have one machine which is completely routed through Tor and never use the web browser on that. And then use another machine for browsing. A web browser is a nightmare of code. It's really quite, quite, quite scary. Perhaps transfer URLs via QR codes.

(That's quite a warning from Appelbaum: web browsers are unsafe with the NSA in sight.)

"All the major corporations which control DNSSec.. they're beholden to the NSA. I met a person who works in a security company, and they were told that whatever they do for their customers they're required to turn over their entire work product to the agency, without telling their customer or shareholders. The company has these privacy and non-disclosure agreements - and the state has privatised computer security researchers' work.

"I've heard that from two sources but haven't seen any documents about it. But what I see in other things is that that seems to be what they would do. In Bullrun [cryptographic subversion] they're going to want data from companies.. via business record requests.

"Free software is one of the only ways to move forward, but we need verifiable hardware too. And that's really difficult. Intel's random number generator.. I wouldn't really trust that, get lots of sources of entropy [for random number generation]."

"Just following orders isn't the way we should continue.. Another NSA program, Colocation, looks at cell location data - when Gen Alexander talks about how they're not collecting data under S.215, what they're doing is pulling location data for everyone nearby. They find data from people nearby." (Caspar Bowden says he hasn't had a mobile phone for two years.)

Appelbaum says he only has a mobile phone "to mess with peoples' heads.."

Says "it's scary when you consider the wiretapping of the planet. Cybersecurity... imagine there's a global dragnet getting usernames and passwords and pulling them into a database. And they store a lot of cryptographic data from handshakes. From Diffie-Helman handshakes. Imagine if you could watch all that, what could you do with it? They may be able to do mathematical attacks that we would have trouble simulating or imagining."

(Suggestion being that NSA is trying to crack some of the tougher crypto.)

LOVEINT and the surveillance - "you put in an email address for a girlfriend or boyfriend and see what this planetary surveillance system pops up.. and they precompute your social graph, pulling in tax records, voter information, operating system, who your father is, where you work - it all gets tied together and XKeyScore ties it all together.

"XKeyScore isn't just for data sharing - so FiveEyes (the five countries' data sharing) have a ratio - it's like a BitTorrent tracker.... it appears GCHQ has unfettered access to the NSA's database and vice-versa, so they've given up national sovereignty in order to work with each other.

"And now imagine that they've got quantum insertion.. being careful how I phrase this.. there's a system that decides if you're vulnerable, and a system which decides whar to put in.

"This is especially scary when you consider that you can't do forensics on your device - you don't know if the embedded controller on your keyboard is what you think it is, the OS on your computer. As a designer you have to think of the worst it can be, and prepare for it."

"Quantum insertion is a sort of 'man in the middle' attack - a person is targeted, and there may be an analyst doing it live.

"You might visit a website and you're flagged and you become a new node in the graph. So for Belgacom they went after people using Belgacom, they targeted people and - when those people connected to services, those services were MITM exploited - say TCP, where you can inject something, they work on exploiting the computer in the other side. They can see the whole [TCP/IP] conversation and then fingerprint the software on either side. And they owned Belgacom.

"So we see a shift in what GCHQ is doing - this is the new cool, but the social cost of this kind of spying is too low, if someone has access to this kind of quantum insertion system, they would be viewed as pretty cool in some computing circles.

"But we should ask about justice, human rights. Everybody should have a sort of military security training against these extremely advanced military insertion techniques."

"With just census data you can pretty much wipe out a population, and not in a good way.

"It's not just passive - there's a myth of passivity with the NSA - Prism, upstream programs. We need programs because these systems are designed as surveillance systems, where you are the product. Power congeals around these central points. Caspar [Bowden] has written about this - he just needs to throw in the NSA's lies.

"If we look at this and the targeting system, it's the most challenging problem of our generation. We need to ruin graph analysts' work. But that's hard - how do we communicate without revealing metadata? "

"The new threat model ... all communications on the planet are in some way monitored by the NSA. You'll find people put classified program names on LinkedIn.. Mainway must be about telephone metadata because they say they're in telephone surveillance. And every one of those programs is solving one problem.

"Satellites.. cellphones.. and the New York Times revealed something on Sunday - that the US government has data retention for 15 years. Now imagine the pale blue dot [Earth] and the NSA is trying to gather all those communications, and put them into a database.

"They view themselves as an attacker, but the good guys.. and us as the victims.. they are in fact the adversary. And they're the adversary worth defending against. They're building social graphs for everyone." (This is referring back to the NYT piece about social networks, linked below.)

"I send an email, Ari sends an email, he sends an email, there's enough plaintext there [in the headers] to analyse.. which allow you to automatically learn to pull this stuff out, and it starts to pull people out. When I'm in the room with a cellphone and you're in the room, and you're in the [social] graph.

"It's clear it will start to gather lots of innocent people all the time. And when you tie this to the drone strike it means that merely using the phone and having a pattern is enough to have you targeted for murder.

"Shouldn't we be designing as engineers against our systems being misused in this way?

"There are a couple of books I'd encourage everyone to read - Philip K Dick's "A Scanner Darkly" (about a spy who is never sure if the people he's spying on are spies or not) and IBM And The Holocaust (about the collection of data in Hitler's Germany). 

"It talks about the threat models - using census data the Nazis could go from house to house and have this ability - in Holland it was 70% of Jews were eradicated, in France it was 30% because the card punch person was a member of the Resistance.

"That machinery has been built again."

Applebaum is a digital activist... 

"Been thinking about revealing some new programs and wondered do I want to go to prison or not.. I know about things but can't talk freely about those things which affect you all..

"Cryptography is so important because it becomes not possible to break the law.. you can't subvert the maths when the implementation is good. Today I want to describe the new threat model.

"I met someone who said his friend was killed by a drone strike. By a flying robot. By graph analysis that means you're all one hop away [from a bad guy]. These powers.. maybe we should get rid of surveillance, rather like getting rid of landmines. And I think we can do that.

"The person who was killed didn't have a trial by jury... and the only way to build a system so that he could have that would be by having secure systems. If you don't have the right to refuse to give up your passphrase you don't have the right to remain silent."

Q: Caspar Bowden: MLAT (multilateral?) information - the legal basis can be a sham

A: yes, the point is that it's total subversion of the judicial system, not just ours. (Bowden: "This gives us an angle of attack.") 

Q: Jacob Appelbaum: seems like we've lost, need to move to the resistance phase... what advice would you give to the younger generation (Binney's not in the first flush).

A: you're saying you want your Fifth Amendment right not to incriminate yourself.. you have to use encryption and position yourself so they can't get to your system. I think they've lost a lot of their capability. These people [now] are linear thinkers. When you're trying to solve a crypt system or code system you need to be able to do innovative things, see anything for a clue... and they are not audited. The US government does not audit the CIA, NSA, DEA... but they should be. We have to make them acccountable.

Q (Appelbaum): but if we fail.. network analysis is very powerful.. so other than reinventing the internet, are there real avenues for resistance or are we totally screwed?

A: I think we're totally screwed. (Laughs.) I know these people, personally. Not wittingly, but-- 

Q: Why are you able to talk about this here when Snowden's in Moscow?

A: they really pissed me off. If it happens to me.. I'm trying to goad them, to be in their face. (Applause. Standing ovation - Binney is in a wheelchair, so could hardly run if the NSA or others came after him.)

.."but they're being more of a transaction... forensic descriptor. That's not what it's meant to be." (There seems to be a tinge of regret in his tone that the NSA has basically lost its way: that it used to be doing useful work and now isn't.)

Points to "Special Ops Division" (SOD) which works with US Drug Enforcement Agency where it doesn't tell people where information has come from. "That's subverting the fourth Amendment... this subverts the Constitution."

Points to printout of SOD presentation which says "parallel construction" mean "use of normal investigative techniques to recreate the information created by SOD" - that is, doing things that you wouldn't have known to look for if it hadn't been for the information gained by surveillance.

 "This is the threat created by lack of privacy," Binney says, finishing.

(Fascinating talk - he's a former NSA agent who feels that the organisation he used to work for is being used to breach the US Constitution instead of preventing crime.")

Binney slide shows how by going from a "known bad guy" and expanding the view you take, you get to "suspected bad guys" - add in a couple of layers and you can't "focus in on the real problem" because after two layers where you expand by 10 people each layer you're up to 100, then 10,000, and more and more.

He thinks taking in too much data gives you too much to handle - and that creates problems.

"That's why they missed the bombers in Boston, the shooting in Fort Hood.. whatever system you design, people have to be able to make effective decisions from it… as programmers you have to think about what you're taking in, what are the enterprise objectives, and think about the entire program."

Shows a slide about tracking which shows how you can be tracked from "Bob" turning on his computer at 6am through to the end of the evening. How? Tapping cables.

The major carriers including BT all have cable convergences in places like New York and Chicago, Houston, and then internationally in Frankfurt, Hong Kong, Tokyo... (remember the Mastering The Internet story from the Guardian in the summer.)

NSA was monitoring 300,000 out of 300 million US calls, and 3bn calls crossing - and maybe 10bn per day. 

"We had a way to monitor this without violating anyone's privacy... we had no difficulty in finding devices or people anywhere in the world.. you could track them, there were ways to do that... we could find all sorts of things."

Everyone listening hard... "we had some positive things happening in the US.. Congress under Rep Amos are trying to unfund the NSA, tried to pass a bill in late July and August, which only failed because of the President and Gen Alexander.. I look on Snowden as an absolute whistleblower, he has done a service for the entire world. And that's from an NSA perspective." Tongue-in-cheek smile.

"They gave the excuse that we have to use this to stop the terrorists and if you stop this then the terrorists will win. It was all nonsense."

Describes LOVEINT - when analysts would use surveillance data to see what an ex-girlfriend was doing. "Or Snowden could drain it all off. They didn't have any way to monitor the use of this stuff." (Lovely phrase - that Snowden "drained" the data.)

"Collecting the records was unconstitutional... they should have started impeachment proceedings." Suggests Nancy Pelosi (Democrat) was one of the people who was told; she later dismissed idea of impeachment against George W Bush. No capability of oversight of the collection program. Re-approved every 45 days: "this was a cabal inside government, a secret constitution." Decision started soon after 9/11, perhaps on 14 September, and the equipment needed started showing up in early October 2011.

Program was called "Stellar Wind" - this was for domestic data. 

"This is why we refer to Washington DC as the 'District of Corruption'."

They could have spent $300m then.... or $4bn now. There was a progtamme which could have spotted some of what was happening. He had a team of five people... "we focussed on finding the problem... looking at 20TB/min, most of it we let go by, you calling your spouse, that's not relevant to anything, we let that pass by." 

"Then 9/11 happened.. there was a conspiracy to subvert the constitution of laws of the United States...they had a problem, how to do it and let it happen.. they called this program a 'covert' program'.. meaning they can only notify eight members of Congress." (Audience is hanging on this.)

That's Bill Binney. He's ex-NSA (not current) and he has, he said, left the US. Here's the Wikipedia quickread:

a former highly placed intelligence official with the United States National Security Agency (NSA)[3] turned whistleblower who resigned on October 31, 2001, after more than 30 years with the agency. He was a high-profile critic of his former employers during the George W. Bush administration, and was the subject ofFBI investigations, including a raid on his home in 2007.

Q: (Jacob Applebaum): no metadata protection in ITRs; and China blocks Tor by looking at metadata. Metadata is where the power is. (And he helped write the "necessary and proportionate" part. And doesn't support keyword filtering.) The text hasn't got a clause saying no censorship...

A: ... but there isn't ...

Q: ... but what about spam filtering ...?

A: You can look at a bot ... and interpret the text by saying "we use anti-spam filters". (It's about telling people you're doing it.)

Q: You said knowledgeable people knew spying was going on ... so why did the US go after Snowden with such a vendetta?

A: I think most European parliamentarians did not know what was going on - don't underestimate their lack of technical knowledge. I didn't think they were doing things like XKeyScore - I didn't think they were stupid enough, that it would cost too much. But it's entirely different when it's out in public and then someone puts it on the floor in the United Nations - the US didn't reply. In diplomatic conferences states tend not to attack each other.

Domestic politics ... it's about spying, it raises complications. And it is a trade – if the US can get him they'll put him in jail forever. 'He signed an agreement ... he's a traitor, and there's a long history of people defecting back and forth between the US and Russia'.

Q (Jacob Applebaum): He didn't defect, the US cancelled his passport while he was en route to other democratic countries which he could have gone to. He's not a defector – he's enabled all of us to have information we coudn't have got any other way. We should not use the language of the oppressor - he should be getting asylum here because he has revealed serious crimes against everyone in this room.

And that's the end of the session, with that intervention from Applebaum - who is speaking in about an hour next, in about half an hour. 

- limitation to right to privacy should be limited by law

- limited exceptions to user notification of surveillance

- states should be transparent about surveillance

- there should be public oversight.

Calls on the Swiss government to lead the way in this, especially by revisiting International Telecoms Regulations, and consider the "necessary and proportionate principles" 0f monitoring.

Points out how the international telcos are gently allowing US to tap phone networks. "Media coverage was inaccurate, influenced by well-funded misinformation campaign which served the interests of the US government."

(interlude..)

US President Obama said in May 2009: "Our pursuit of cybersecurity will not include monitoring internet communications." But Prism had started in 2007. Open question: did he not know, or did he think it would be legal?

International Telecomms Regulations (ITRs) need to be regulated. Has to be consistent with human rights.

Telecoms is about 3% of GNP, up to 10% in developing countries. 

Icann couldn't do that... because Dubai is a signatory to ECHR.

"Now, who plays poker?" Almost nobody puts hands up. "Oh, this is different from MIT." 

But poker is a game of skill - though it's never been tested in court whether it is gambling to play or not. US government didn't go to those lengths - it just went after big gambling sites, which caved.

"It took Hitler a year to collect the names of all the Jews in Germany. If he had been around now, it would have taken him just a day."

And now we move on to Dubai - and he recalls the headlines from the Icann meeting of 2012: "UN to take over internet to carry out censorship". (That wasn't our headline.) 

A quick recap of what we learnt from Snowden...widespread surveillance, judicial supervision for US citizens, other nations also do it, and "knowledgeable persons knew" - but not all ordinary people knew.

GSM phone voice encryption code was allegedly weakened at the request of security agencies.

Hill has an Android phone but refuses to sign into Google, so can't sign into Google Play, so can't get apps (so couldn't get app for this conference).

This is going to be more of a legal examination than Schneier's which was more free-form ...

Hill's details are here.

Q: (on a psuedo-random number generator which NIST suddenly recommended against using) ...?

A: we don't know ... we need guidelines to figure out what we can trust today. 

(Cost-benefit question comes up.)

A: We need cost-benefit analysis – nobody ever says "this is too much intelligence". TSA is easier place to start – you know the cost of full body scans, what's the benefit? Reinforcing the cockpit door makes sense; taking off your shoe doesn't.

Q: (Jacob Applebaum, who calls himself an American exile living in Europe): are you horrified by how the US treats people like me?

A: we're living in a world where if it's immoral, as long as it's legal it's UK. But writing for US audience, the idea that EU citizens are "lesser" is pervasive. That's just the way the system is built. "It's not illegal, therefore it's OK."

Q: (Caspar Bowden): Anything in the Snowden documents relating to PGP?

A: I believe the maths is robust. But we know they have done stuff because they're crowing about it. But - something with Elliptic Curve; or factoring logs; or RC4. Other than that - they break a lot of crypto, by hacking around the crypto, on the random number generators, or getting keys, or compromising root certificates – to get that so they can do it in human time ... is hard.

Q: Metadata ... Europe ... a lot of this technological determinism comes from the US where our regulators don't see them the same way.

A: The cost of saving data is so cheap that you're going to save it just in case ... But companies like Facebook and Microsoft are really pissed off that they're losing business because of this NSA stuff. Though for more people this is not an issue.

"Privacy has always been a balancing act ... we either learn or we handle it through law. Technology determines what's feasible, law determines what's allowable. 

"Data is the pollution of the information age ... we're arguing about how to dispose of it, we're arguing about secondary uses.. we'll look back in a few generations, like we do to Victorian age, and marvel at how we ignore data pollution.

"The people who brag that they don't use email need to retire. And the people who grew up on the internet need to take over."

One of the lessons of these leaks is that surveillance is robust - given the choice of doing A or B, the NSA does both.

US has a three-day warning via its intelligence of the Syrian chemical attack. Lots of possibilities for why nothing was done: perhaps nothing was done because collecting it meant that it was collected, and to reveal it would mean that sources might be compromised. "We've seen nothing of a cost/benefit analysis from the NSA. But we've seen nothing from the TSA either.

"How do we know if this is worth it? We never see a cost/benefit analysis of this work. 

"We need to reject the security v privacy debate - it's a false dichotomy. When someone says security v privacy, say "a fence. A doorlock." Neither affects privacy.

"ID cards affect privacy, but not security. The only thing that has made flying safer is locking cockpit doors and allowing passengers to fight back - that's not privacy."

Fundamentally a liberty v control debate: "privacy increases power, so when you have forced openness in government, it increases liberty; force it in people and it decreases their liberty. IF you go to a doctor and he says 'take off your clothes' you can't say 'you first'. If a police officer demands your ID, it doesn't help if you see their ID first. There's an imbalance."

"It's good we're having this debate now, because I think it might fade into the distance. In the US you get ID checks all the time, where 30-40 years ago it would have been abhorrent. In ten years' time the cameras will be everywhere and they'll know who you are based on the devices you're wearing, your facc, everything about you."

"...and they'll look at you like you're weird. But you know that they have one." (We think of what we regard as private and what we share.) "It's only because of computer mediation that we have to write it down and make it explicit." Same with our backup policy, he suggests.

Survey found that if you put a big paragraph about privacy policies in front of people when they first log on to a site, they disclose less.

The more you think people are sharing, the more you will share. Privacy levels are set locally. If you start asking public questions to much more personal ones, people block off answering sooner than if you go in the opposite direction (start with a very personal question, make it more general).

"This is because people have conflicting privacy policies.. and companies play on this. Sites are designed so that you will share more. It's not breaking the law, it's basic psychological manipulation."

"...but you, Gmail account holder, aren't a customer. You're a product. Google doesn't have great product service." In other words, its customers (advertisers) get great service - dedicated customer agents. However, products (you, the people) don't get so well treated.

"We're moving towards a world where we can't forget. A world where nothing is ever ephemeral is going to be different in all sorts of ways. There's no such thing as a throwaway conversation. Maybe the world will be like a giant airport security zone where nobody can ever make a joke."

Corporations use government rules to protect themselves, and vice-versa. Eg US companies not releasing information because they claim there's a national security interest - eg about pollution records (detailing pollution might give clues to a Sikrit Plant).

"Metadata = surveillance. If you hired a private detective to put someone under surveillance, they'd see who they spoke to, where they went, what they bought. That's metadata. When the president says 'it's just metadata', he's saying "it's surveillance".

"This isn't malice.. it's just what happens. And cloud computing exacerbates this. We're leaving this on someone else's computer, that's what cloud computing is - your data on someone else's hard drive. And cloud is probably the endpoint - access from wherever you are, so likely this is the end - we're going to have our data where it makes commercial sense, and that's on someone else's machine because it's too expensive to maintain myself."

Now looking at the legal side. 

"There's been a libertarian bent to the internet.. laws shouldn't mess with the internet.. that data belongs to the people who have it. Gmail with email, data brokers, phone records with carriers... there's not much protection in the US. Different in Europe,which I like. But national intelligence operates in a grey area."

He says that technology "grows the box" of legal regulation - rather like a gas expanding, keeping ahed of the laws holding them back."Legal can't keep up."

Schneier says that he still uses POP (Post Office Protocol) for his email - for many techies that went out in around 2003.

"Apple has much tighter control of what's allowed on the iPhone than on its desktop, or is on Windows. And Windows 8 is heading in that direction. There are good business and consumer reasons why that's happening. But we are losing control of our data."

Audience is fed and watered, and Bruce Schneier, longtime security and privacy advocate, is speaking. 

"Audio surveillance.. phone calls... video surveillance from CCTV or even Google Glass... Wi-Fi surveillance, Bluetooth surveillance.. there's a lot going on."

Automatic face recognition; voice recognition (Spanish telecoms company uses voice recognition - which meant that Jacob Applebaum won't call you if you're in Spain.)

"In the US we have Infinity cards... [loyalty cards].. tie you to what you've purchased.. I think the trends are important because they point to what's happening. Data is a byproduct of the information society. Everything done on a computer creates a transaction record. Your mobile phone creates records - location, call.. that new iPhone with the motion sensor will know when you're holding it, asleep... any kind of commerce, EZPass in the US for paying for tolls, everything produces that data. Data is a byproduct of almost all our socialisation now because it's mediated by computers, except for incidents when we're in the same room.

"When I talk to my wife, we talk by email. Even if we're in the same house. Because we're in different rooms." (Intriguing insight into the Schneier home life..)

European Council having hearings on privacy and internet tomorrow - Duncan (Zircon) Campbell is going there.

Emmanuel Barraud, who convened the conference and is running the day: "Can everyone who does not have a Facebook account raise their hand?" (Quite a lot do – at least a third of the audience?) "You can have lunch."

Q: This is like environmental protection, isn't it?

A: Understanding the problem is vital... in the debate.. what are the incentives? Why is this happening? It's not counterterrorism, or cyberattack prevention... it's something else. We're still trying to figure out why this is happening.

Q: (Jacob Applebaum): NSA isn't passive - Belgacom - GCHQ has broken into the telco and exploited them. Isn't that illegal? It seems illegal. Are we living in post-democratic times? It seems that way in the US.

A: I would have to say that national security exceptionalism is big.. Belgacom, should challenge before the courts. Maybe these revelations will annoy judges. It's vital not to give up on legal solutions. It's good that [Liberty and Privacy International] have taken this action.

UK has some big getouts in its law: "information could be listened to or read if the secretary of state considered this was required for national security… or the protection of the UK economy".

It's unclear whether there's a moral or legal obligation under the ECHR (Human Rights act).

(Basically, we seem to be concluding that there's no clear case law, but that ECHR lets you leak.)

"Everybody is complicit.. who's going to bring the case? Is the UK going to sue the US?" Arnbak doesn't see that happening. 

But Liberty has launched a case... and in Europe the existence of a law which allows you to be surveilled can be argued as indicating that you've been harmed. And it's not just personal data, but all data on a server that's protected under European law - at least, that's the argument.

5 million people have security clearances, each has two staff - that suggests 15m of 136 million in the US workforce are in it. Though you can't get the numbers. Classified.

"Dubious role of academia". Possibly 10 years behind the NSA.

So can law and policy stop it? In Netherlands found that the Dutch medical records were being built by a US company; they raised question about whether that could be shared with the US. Dutch minister said that "we have medical secrecy!" Arnbak suspects that the NSA probably knows all the details it needs.

Hardly any chance of reform of US laws, especially relating to foreigners. "No chance".

Three certificate authorities sell 75% of all certificates, and five sell 95%. "Markets tend towards concentration which makes access to data very easy." (Implication is that cert authorities have been subverted.)

Intelligence sharing means that you get a race to the bottom. Like cycling - if all but one stops doping, then that one will keep winning. The race to the bottom in intelligence is to collect everything so you have more to share so you can get more in a sharing arrangement with other nations.

But: nobody gets fired. (A good point. Not a single head has rolled - that we know of - over this whole affair.)

Points to the NYT/ NSA / social connections article (mentioned below). "Able to take in 20bn record events daily and make them available to NSA analysts within 60 minutes." And that data is collected about US persons for up to five years online, and an additional 10 years offline for 'hostorical searches'." So that's 15 years - "US citizens aren't that much better off."

Total Information Awareness - was given up as too expensive in 2003, but it's back in 2013, even if not under that name. 

$600m - Amazon and the CIA signed a deal where the CIA would lease cloud computing capacity. Points back to Vogels in October 2012 talking of "fearmongering" - and suggesting that Vogels "already knew" about the CIA deal coming down the track when he made that statement.

Elsewhere on the Guardian site, Phil Zimmermann - inventor of PGP - says that email just can't be made safe, because of its use of headers, which can be scooped up. (See earlier linking to the New York Times.)

Arnbak says the question is: can law address total international surveillance?

(Wearing a t-shirt saying "Yo, where are my bits at?" which could be the slogan for the entire conference.)

Points to Werner Vogels, Amazon cloud CEO, saying that questions about cloud security and privacy was "fearmongering". 

Wrote a paper about threats of clouds and decided on a Pink Floyd album name - "Obscured by Clouds". And on the day they published, the Snowden disclosures began. "So we should have called it 'Dark Side Of The Moon'." (The audience liked that.)

Q: how different is eg Facebook privacy from any consent form eg for an operation? And which are the best countries for data privacy? 

A: European concept of data protection differs from medical consent.. but some of the ideas from clinical trials can be used for better implementation. And we don't know which laws work best - that would need empirical analysis which we don't have because of lack of transparency- you can't ask secret services what they're doing; they're called 'secret' for a reason. 

And ideas of computer security differs in law between eg UK and Spain - one is precise, one is abstract.

Points to Euro Commission which shows that top five sites viewed in EU member states: Google, Facebook, YouTube, eBay... very rarely do you get a European company in them.

Quoting EU digital agenda data: economy means it's about infrastructure. (His argument seems to be that Europe needs to design its own cloud infrastructure.) Points to article about "Google knows nearly every Wi-Fi password in the world".

(The implication being that Europeans need to roll their own. Points to "made in Germany" email services. Quotes the suggestion that NSA fallout could cost Silicon Valley up to $35bn in annual revenues in lost overseas business.)

Points to survey of EU police authorities and various hacking strategies (eg man-in-middle, DNS poisoning) - where many refused to say if they were using particular tactics at all.

Mentions Guardian article from last Friday on data protection law changes.

He isn't particularly hopeful that EU changes to data protection will be much of an improvement. Hedged around with phrases like "having regard to the state of the art and the cost of implementation". 

"Right to be forgotten": Stanford Law Review was scathing about it, saying "Europeans have a long track record of declaring abstract rights which they then don't enforce."

Mentioned previously, the full report is here.

Just a reminder that this is about real people and topics: the New York Times on Saturday said that the NSA is gathering data on social connections of US citizens.

The spy agency began allowing the analysis of phone call and email logs in November 2010 to examine Americans’ networks of associations for foreign intelligence purposes after NSA officials lifted restrictions on the practice, according to documents provided by Edward J Snowden, the former NSA contractor.

Forgo goes into article 8 of EU privacy law - covering data: "It's a very general and broad clause."

But he points to article 2: that data needs to be processed fairly for "specified purposes"' He points out that this goes against some big data uses. (At least, if you do it without permission.) It is illegal if you don't have informed consent, or some other legitimate use.

Facebook conditions says "We require everyone to provide their real names, so you always know who you're connecting with. This helps us keep our community safe." (Not that it does, but he pointed out that this isn't helpful for dissidents.)

Cites the Randi Zuckerberg photo (private photo posted on FB which then escaped to Twitter): "You reposting it to Twitter is way uncool," Ms Zuckerberg says. 

Forgo: "In Europe we'd probably say 'illegal' not 'uncool'." And points out that the picture appeared in the Twitter-passer's FB feed – so, she said, "I thought it was public."

Cites an April Fools Joke where Gamestation changed its Ts+Cs so that it could claim the souls of anyone who signed up - though if you read it and objected then they would send a £10 voucher. 7,500 sold their souls; about 10 claimed the voucher. (That's remarkable that as many as 10 actually got that far.)

Facebook's full use data policy is scrolling past quite quickly: "it takes about a minute". 

Europeans would say that "including" - which is in the first sentence in the FB terms - isn't sufficient: that you need to specify what you're actually going to collect and what you're going to do with it. Points out that this stuff is all too vague: "Sometimes we get data... an advertiser may tell us information about you including... We also put together data from the information we already have about you and your friends... We may access, preserve and share your information in response to a legal request.... if we have a good faith belief that the law requires us to do so." Emphasis added by Forgo: he points out that they're not saying that there actually is a legal requirement, only that they believe there's one.

"Facebook use reminds me of people who smoke - they know it's not healthy, but they do it anyway."

Forgo is head of the Belgian Center for Data Protection.

Says that we're living in "interesting times" (which isn't actually a Chinese curse, but serves well enough). Reminds us that "if the product is for free, you are the product". And Zuckerberg's assertion that "privacy is a social norm of the post"; and Eric Schmidt that "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place." (Such as buying a penthouse in New York, Mr Schmidt?)

And "volenti non fit iniuria" - if you agree to something, there's no harm in law. Cites Facebook: "did you read the privacy policy? And did you understand it?" Very rarely do people read what they agree with.

Questioner says that free software has been subverted too - so what do you do?

Bowden: at least it's the least worst. (Bruce Schneier agrees.) 

General agreement from the front row (the speakers) that free software is the best place to start if you're trying to escape surveillance.

(There's a break now before the next session.)

Bowden: "Snowden probably only had basic access to NSA details ... CIA is building its own $600m data centre ... and gets its own copy of data which can be analysed under its own missions and authorities. And we don't know anything about that – we need to pay attention to that."

Duncan "Echelon" Campbell asking about intra-EU threats - eg GCHQ tapping into fibre networks, other EU countries including Sweden and others in "Five Eyes" (US, UK, Australia, New Zealand, Canada intelligence sharing). Bowden: report coming out next month. Update: here's the link to his report.

EU was doing to have a "political" warning - but article 42 of the data regulation was dropped. 

Says we need an "EU cloud" - an Airbus to match the US's Boeing.

He's put up a report (link to come). Thinks that "there should be a warning when you log on to US services that 'you're putting your data within the surveillance range of a foreign government. Do you agree?'"

(Audience laughs and applauds that one.)

"If you want information security buy an exercise book and a biro. Because we don't know what's being collected. If you put your data online it's like putting it in a privacy Guantanamo Bay."

(Quite a flourish to end.)

The US political debate has all been around Americans and their rights; the rights of non-Americans just don't exist in this context. Ex-NSA director Hayden says that "the Fourth Amendment [guaranteeing privacy] is not an international treaty" and that there's a "home field advantage" having data go across the US.

It's a big question: might there be other s.702 programmes - for business cloud computing? 

The cookie that Facebook drops on your to watch you might be used for surveillance -there's no difference between business and government surveillance.

Mentions XKeyscore and Bullrun. And the James Clapper agreement that Prism was about s.702 of the FISA. "I thought, 'wow'."

Mentions Guardian publication on 20 June of how NSA targets non-US citizens: confirms zero substantive privacy protection outside the US.

Points to contracts with odd clauses from Microsoft/Google/etc, which the data protection adviser [DPA] must accept - and where "questions of mass surveillance disappear in a puff of audit". 

He point out that "lawful" access for national security is not part of auditors' threat model. And that the contracts and laws allow for "mandatory requirement under national laws that conflicts [with DPAs' roles of auditing threats to the data integrity]."

(Side note: Bowden is doing his presentation with LibreOffice 3.6, not PowerPoint. As he said earlier, he's using free software now.)

Bowden describes efforts to get people interested in the European parliament report about how privacy for EU citizens doesn't apply in the cloud. Ryan Gallagher at Slate wrote about it: EU annoyed; US reaction "well, who's going to stop us?"

Then there was "Cloudwsh", where US organisations attempted to suggest that there was "no problem" with US cloud computing. Describes Business Software Alliance as "US organisation which has been trying to do down European privacy regulations for 15 years."

Slide shows "NSA surveillance octopus" - how stuff is acquired.

But cloud computing is too useful to be disinvented. Unlike Echelon, though, which was only interception, potentially all EU data is at risk. FISA (Foreign Intelligence Surveillance Act) can grab data after it's stored, and decrypted.

You can find the full image here.

"2008 FISA Amendment Act: authorised for a year, is meant to minimise access on US persons after collection, provides all facilities and information in secret, and has punishment for non-compliance."

(That "after" is quite telling. Means NSA can grab all sorts of stuff.)

FISA 2008 also quietly added "remote computing services" - meaning any data sent to the US for processing lawfully could also be brought into NSA. "Designed for mass surveillance."

But it's also "completely unlawful" under the EC's Human Rights Act.

"Approached many of the European authorities with my concerns and they shrugged. Then we had Edward Snowden and ever since then I've been busy.

"I didn't know about Prism when I was at Microsoft and I don't trust Microsoft now. I'm completely free software now."

Telling story of AT&T's deep packet inspection and Room 641A; New York Times didn't write story until 2005, despite being told before 2004 election. In 2007 "Protect America Act" gave retrospective protection to US telcos for cooperating with US government in wiretapping without proper warrants.

"This law started a new paradigm of trying to collect all the data all the time from US citizens." Before this US law had strong guarantees for privacy of citizens; now Foreign Intelligence Surveillance Court (FISC) shifts towards authorisation for broad scanning of traffic.

This all goes back to 1978. (Bowden is digging into roots of NSA spying, which comes from Richard Nixon and his desire to spy on Americans, without reference to the US Constitution's 4th Amendment - which protects privacy.)

(Bowden was director of FIPR from 1998 to 2002, and chief privacy adviser for Microsoft in 40 countries (though not the US) from 2002 to 2011.

"In about 2009 the whole industry turned on a dime and turned to cloud computing - massively parallel computation sold as a commodity at a distance."

The schedule for today's event is available online - note that the times are all CET (Central European Time), so subtract an hour if you're on UK BST (and subtract six if you're on the US East Coast). 

First is Caspar Bowden, ex-Microsoft; then Nikolas Forgo; and then Axel Arnbak. Then we have the break for lunch, so we'll look at the other speakers after that.

The EPFL (École Polytechnique Fédérale de Lausanne), or Swiss Federal Institute of Technology, is the venue for this all-day conference, and we're here - with an audience of a few hundred people. The speakers include Caspar Bowden, formerly of Microsoft, and Jacob Applebaum. The conference starts at 9am Swiss time (8am UK).