How Can I Sign New York Banking PPT

Can i industry sign banking new york word computer

hello dear casuals this is emmanuel tostevski thanks to switch and board our guest today is john scott railton a senior researcher at the citizens lab we had a great conversation on digital security surveillance disinformation and the misuse of covet related technologies i hope you enjoy it so my name is john scott welton and i'm a senior researcher at the citizen lab which is a research group at the hmong school of global affairs at the university of toronto the citizen lab has been around since the early 2000s and our work focuses on tracking digital threats to civil society so this means online censorship this means attempts at hacking and this also means invasive laws that permit the surveillance of journalists and human rights defenders and political movements so i've been working at the lab for almost a decade and during that time we've been tracking the way that there's been sort of an explosion of the industry of companies selling tracking products to governments to track their citizens and of course whenever you get an explosion of a new technology it's going to get abused and so a lot of our time is spent discovering the many ways that this technology gets abused not to track criminals not to track terrorists but to track reporters food scientists anybody who's potentially upset someone powerful so these are the people you call million dollar dissidents right in in this report because they spend so much time and energy these governments or powers that be on tracking them silencing them you know it's hard i think most people wonder like what is the measure of my life and how do i know if i've had any impact and i submit to you that this is actually a really good measure that you've had some impact which is a government is willing to pay for a really expensive tool in order to track you it may not be the most intuitive measure but you can probably wear it as a badge of pride in your bio it says once upon a time neuropharmac pharmacology right so okay how is this how did this switch happen well it's a great story um when i was uh undergraduate and beyond i was really interested in the mechanics of addiction especially addictive behaviors and so i did some work and published some papers on the brain biology of addiction and the most interesting part of this um is that i had to figure out how to teach rats to become gamblers which i succeeded can they can they give it up or they get completely addicted well just like us right it's awfully hard to give it up but what i was trying to understand was actually a really interesting problem which is why is it that we are susceptible to drugs of addiction it's not enough to just say well the drug is addictive the question is what basic neurological mechanism is this drug hijacking what signal is the drug sending that then causes our behavior to be stuck on something and so part of what we wanted to do was to find addictions that didn't have any drugs involved and then to show that inside the brain they were extremely similar to an addiction to drugs so this allowed us to then say okay the basis is the same and then the question is well if we can get the basis the same without a drug maybe that's the system that the drugs are hijacking but i think the maximum effect of this drug-like behavior happens in the face of uncertainty so you're not really sure just before let's say the dice is being rolled so it's really interesting and uncertainty is a big part of it it turns out that our brains are really bad at making good guesses about probability and so the classic experiment from the biology of addiction is you take pigeons and you separate them into two groups and one group of pigeons gets an average of five pellets for every 20 presses on a little lever but the pellets come at random times the other group of pigeons get the same five pellets but it's you know whatever it would be every four presses it turns out that when you stop giving them pellets the pigeons that have been getting pellets regularly that can predict when they're gonna get the pellets after a bunch of presses they're like you know what [ __ ] this we're done right we're gonna stop pressing but the pigeons who are getting those pellets in an unpredictable way they press that lever until they fall asleep and that is the basis of many people addiction which is intermittent reinforcement intermittent in timing and intermittent in quantity is a tremendously powerful tool for turning a mammal into a little addicted creature what was the connection from this to protecting the dissidents and well it's obvious no so it went through some some iterations but it ended up with me working on the effects of climate change in uh west africa and while i was doing this work i realized that something really interesting was happening in egypt and i had lived in egypt before and what was interesting of course was what was happening in 2011. and what i began to feel was i'm using social media to follow what's going on to keep in touch with my old friends but i'm hearing that the internet is going to be shut down so maybe there's something i can do to address this problem and so i built two projects one in for egypt and then later for libya called the voices project based on getting around the internet shutdowns in those countries while running those projects a big part of it was phone calls to people on the street people who could be verified and who would provide information kind of like a network of citizen journalists and this was a very powerful thing during that time when the government was trying to prevent information from coming back and you can't necessarily put the internet back into a place but you can still use the internet to get the voices of these people out to the world during the course of that work especially on libya i began to realize that the libyan government was hacking the people who i was talking to and you know when you talk to a person you're a journalist and reporter when you have a conversation with a person anonymously and you say okay you know i won't tell people your name that's like a guarantee that you can make to them but if their phone is already hacked you can't really make that guarantee and so the question is ethically are you in a position to really offer them privacy and confidentiality and that became such an interesting problem to me that i decided to focus on it and here we are almost 10 years later well this is basically by accident almost as far as i understand you were actually you were literally just calling them and tweeting on their behalf right so they were they would tell you and that's what tweet theirs yeah and there was an element of verification so um for important parts the goal was to get in touch with people um who were also in the same area or location especially you know in tahrir and other areas where things were happening so that it wouldn't just be one person's perspective so to try to add an element of again citizen journalism verification so let's then come to today the most urgent let's say project that you're working on and then we can work our way back you know at the end of the day right like we all want to step outside and eat messy sandwiches and handle doorknobs and you know maybe touch strangers uh but the problem of course is that we can't do that right now although we're all sort of having the same experience and the coronavirus crisis has like minted a billion new amateur epidemiologists not everyone is engaged in the same enterprise and there are companies that we have been tracking for years because they sell spy tools who have kind of emerged onto the market and now say that they're selling coronavirus tracking and so we're spending time trying to understand what are these companies selling are these products even legitimate and we're doing broader research as well into the ecosystem of companies and entities that are selling location data one of the things that's the most interesting to me if you read newspapers like at the end of last year 2019 and doesn't that seem like a lifetime ago you would read all these stories about reporters really concerned about the abuse of location data so big exposes you know the shadowy companies using location data from uh app-based advertising selling your data fast forward to march and the new york times did a really big piece using exactly that data to show people's movements around the coronavirus and to try to talk about the effect of social distancing so one of my great anxieties is that we were moving towards a place of accountability and concern around the use and abuse of location data and suddenly we've kind of put all that to the side and said well look this is a crisis and we have to make certain choices during a crisis my concern as a student of history is that often when you make certain choices during a crisis it's very hard to undo those choices when you set up a state of emergency for example and create certain other precedents those things become sticky and it's awfully hard for them to leave and i worry that the same problem is going to repeat itself with location tracking and coronavirus we'll bring in these technologies for the stated goal of helping people get back to their everyday life but pretty quickly intelligence and police services and others will decide actually we like this level of visibility into these citizens and we're going to find a quiet way to keep a version of it going so one of the things that was really fascinating to me about those journalism pieces of new york times specifically is that before that i was thinking well all of this data is anonymized it's kind of like google and because it's anonymized it might be useful i like to live in that world where you know i can technology helps me and as long as they can figure out the traffic patterns uh you know for security purposes for whatever purposes infrastructure purposes that's great but then that piece after reading that i realized that it's so easy to match names actual names and identity information to that kind of location data that it is dishonest to market it as anonymized data exactly so a couple years ago i did some research into fitness trackers and i called the phenomenon fit leaking so basically people would post their fitness tracker tracks of their exercise you know look at me i've had this great run see i begin in my house right and then i go for a run and then i maybe forget to turn it off and i finish at work and what i was able to show is that these tracks that people were uploading feeling like they were being fairly anonymous were actually doing things like showing the homes of people but also identifying the people who worked at the cia or the spies who were jogging in circles at the russian embassy in damascus and it became clear in that moment to me that location data is never something that exists with inside a vacuum it's just designed to be combined with other data and as soon as it's combined it's de-anonymized and so even if someone tells you look we'd like to collect anonymized location data functionally it's never really that the data itself is anonymous it's just that in that one moment there's an indicator that might not be associated with your name this actually i think is the bigger story about privacy in general which is we as we travel around the internet are emitting a constant digital exhaust the thing is that exhaust is most useful when it's combined with other pieces of information about us when our browsing patterns are combined with our credit card history when the television that we view on our smart tv is combined with our search terms and there's an entire industry that makes its primary business the recombination of these disparate threads of data and who are their clients well of course it's marketers who want a perfect picture who want to know if i show this person an advertisement on the youtube at his parents house is he going to go ahead and buy my thing through amazon.com but there's another set of clients too which is banks insurance companies and others who want to decide whether a person is what they would consider a good risk and then you also have the most troubling use of this which is people who do surveillance for governments who sell surveillance and intelligence products have realized my god this is like an nsa in a box we should buy this data too let's actually focus on that journey of that data when i emit this this digital exhaust through my phone or my online behavior where does that data sit again referring to those articles i thought before reading that it's just in these big companies sitting sitting in big companies like google amazon whatever they are saying that no actually there are all these smaller companies that are collecting your location information you don't you're not you haven't even heard of them but they have all this information most so most of the apps that you download if you're like an android user for example show you ads well most of those apps depending on their permissions have access to information about your phone whether it's what other wi-fi devices your phone sees or your phone's location other things that you do on that phone and those advertising companies use that data not only to show you things but actually to siphon the data back and then turn it into a product that can then be sold creating these highly accurate digital profiles of you and so you're right we tend to think of it as am i private from google am i private from apple and it's important because obviously google for example can see many different parts of you at the same time but this doesn't prevent the you know scooter sharing app that you've got on your phone from also working with six or seven different small advertising tracker firms that then market that data and turn it into valuable product for somebody else so for example imagine i'm using say a scooter share right little or a little bike share that data can be used to market things to me based on where i go to shop right you can then uh combine it with credit card data and figure out what kind of a purchaser i am but you can also use it to decide well did the billboard that i bought was it really in the right place am i likely to put my pictures in front of people these are all really interesting questions and it's the kind of question that makes marketers dream the flip side though of all of this is that it's not always as accurate as the people selling it but of course marketers would like you to think and so you have two problems on the one hand it is tremendously invasive data but on the other hand it's not really an accurate sample of a population for example we know that smartphone use is very different among different demographics it matches differences in level of education level of salary and income racial and ethnic background and age among many other variables for that reason data that is used about a population that comes out of this data is going to systematically overcount some groups and under count other groups and so even as people look at this data and say wow this could be used in times of coronavirus to really do something exceptional it's like yes and we'll also not know about many of the demographics that are at the highest risk for coronavirus so there are many many limitations limitations to use this technology for coronavirus but just because it gets the headlines right now i guess and i'm wondering if you think that's kind of a trojan horse for some companies to you know get themselves in or their products in to probably install more permanent surveillance systems i think the answer is absolutely my sense is that people who are in the business of tracking and doing location monitoring whether it's spies and companies who sell to spies or somewhat questionable marketing companies have hidden under a kind of a large rock from the public for years because they know just how scary and invasive the god's eye view data that they collect looks and in the times when they've done and when they've gone and shown it in the past few years the backlash is enormous suddenly kovit has flipped that rock over and these folks are discovering hey we can kind of brag about the data that we're collecting and people are going t pat us on the back my favorite example is a location tracking company was tracking a conference and they wanted to say okay there was some coronavirus exposure at this conference where did it go so they used their advertising data they figured out everybody who went to that conference they then tracked their phones as they flew home they then identified the other phones and devices that were co-located with those phones and then tracked them and you can see people driving on roads and so on they published this as a map a year ago this would have been like my god who are these private spies figuring out the identities of everybody who attends a political conference in the united states and tracking them to their houses now the response is oh great now we can really see how to track this problem yeah it isn't just the sort of unscrupulous spies though who are selling this stuff so uh i got quoted in a newspaper recently um referring to the desperation that we're experiencing and how cynical companies are taking advantage of this and so i said you know we're just looking for somebody who will offer us hope the first thing that happened is i got a message in my email from a guy selling another security product saying john you are asking for hope well here it is give me a call and let me demo my project unbelievable it's like a nightmare this is the episode of black mirror that i missed last season but i feel like i keep watching every day it's actually even worse than that because the second level to this is that they are actually openly marketing just to governments whether it's local or federal and then the governments are not trying to hide this like they're using this as hey this is how we are dealing with the virus and norms are powerful so up until this point the conversation has really been what is the danger of these technologies you know this particular technology how invasive is it how privacy problematic it is these are all great questions but there's a bigger question which has to do with how we talk about things in any situation we find this intuitive if a teacher for example doesn't discipline a bully in a classroom that behavior will be mirrored by other students if the rhetoric of a president or a leader is violent that rhetoric will be mirrored and it will take years for that violent discourse to go away i worry about that as perhaps one of the longest tales of the coronavirus pandemic which is this transformation and how acceptable it is to be collecting and trafficking in this kind of location data now it may be the case that the other thing will happen that people will have the personal experience of being tracked discover that the tracking didn't work very well perhaps or feel invaded and want to push back i'm just not sure which way that it will cut right now i think for the moment the industry that does surveillance and tracking is like finally you know civil society has basically disappeared as an opponent to us and we can have really whatever free reign we want it is difficult to predict now in my opinion to you know to see which way it's going to go but the other thing you said this goes back to something you said previously if the governments have this power or if at least in the public perception that threshold is already uh you know exceeded that okay it's a it's the government's right it's like entropy it's always it always increases the government's power like entropy and it's it's this way in a couple senses so there are some rights that when you give them up you can then go back and take them back so for example the right to go outside at some point we're just going to go outside and then we'll have that back again we'll have the being outside right back again the issue with privacy is that it's different once elements of your privacy are out there you can't put them back it's like a person who becomes a public figure they can't become private again and what concerns me is that the volume of data about all of us that will be sloshing around and pushed to all these improbable places and used in all these ways that may be very problematic that can't go back that it's like a breach more than you know some kind of a temporary problem you know in many cases of like investigations that we run at the citizen lab into hackers and malware sometimes very old postings from people who later do bad things are tremendously useful in tracking them down somebody's you know engagement picture posted ten years ago in one case actually helped me identify a particular hacker from my perspective it kind of diverges into two separate fields let's say one is that with this power and technology what's going to happen to our democratic processes what's going to happen to communication social media and the other thing is more targeted surveillance related issues which is i think what if i'm not mistaken that's your original that was your original uh research goal that to focus on these people high-risk individuals specifically targeted our research tends to focus on people in civil society but my conclusion from years of doing it is that these are and i don't know what the expression in turkish would be but these are the canaries in the coal mine in many cases the things that we see targeting these groups it's the same that everyone else will face just in future years in a sense i think what's been interesting about our research is that we've been studying for years the impact of location tracking and surveillance on high risk people what we're now discovering is that many of the things that we saw as the harms to those people are now risks to a general population from this kind of tracking and surveillance and that's exceptionally concerning for me i feel very strongly it is likely that we will need to use certain kinds of technologies to help us crawl out of this pandemic maybe it's tracking maybe it's epidemiological based modeling and we're going to need to use some kinds of things that will involve monitoring the movements of people if a society decides to do that they have to do it in a way that has transparency and the companies that they bring in have to be totally unimpeachable and have to be accountable legally to the jurisdictions where they operate and what scares me the most is that in fear and a rush to show efficacy governments are ignoring all of that and opening doors that they don't have the tools to close and i think what concerns me the most is that politicians have never been particularly well educated about the risks associated with technology unless they themselves are the victim of a hack or a disinformation campaign and what concerns me is that politicians are moving very quickly making lots of executive style decisions about tracking but the things that they're being told about what the tracking can do are often wrong in many cases when we've looked at proposals around tracking technology when i've looked at these proposals it turns out that the technologies couldn't really perform as claimed so even if they couldn't discover whether or not a person has a high risk of getting coronavirus they can perform for other purposes like tracking people for intelligence things and i think once you buy a company's technology like that and you bring it in if it doesn't work for thing a there's going to be a strong tendency for these security services to say well maybe we can use it for thing b but don't tell anyone right i read these um and watch your million dollar dissident uh youtube video it was really interesting the techniques they were using because it's really sophisticated and time consuming right so but now you're saying that they don't have to spend a million dollars anymore they can just do this you know cents on the dollar probably for every one of us so there are different ways to target people and the most expensive way of course in terms of time and effort and sophistication is probably to hack your phone and then monitor through you monitor you through your phone becoming a digital spy in your pocket but of course that takes effort and resources and somebody has to be pointed at you to do that what's happening now with coronavirus tracking is kind of at the other extreme which is the massive tracking of large groups of people but the tracking that is being considered in many cases is based around the location of individuals combined with other information like the health status of these individuals and their identities and their phone numbers and other ways of getting in touch with them that becomes a perfect graph of who interacts with who who talks to who [Music] who's in a political movement who works together who's a co-worker who's a lover who's a friend that kind of information is exactly the information that underpins a society it's information not about individuals but about relationships and it's why in most societies that is the most protected kind of information because it's the most abusable it's like a pandora's box of possibilities for abuse i can learn a tremendous amount about you by who you're standing near by who you're in a car with by who you share a minibus with by who you're taking an uber at night with by where you spend your evenings this kind of information is so sensitive and so private and so revealing it needs to be protected and what scares me is not that it could potentially be used to help us because i think that it very well is the kind of thing that can be used to do things like contact tracing and the identification of possibilities of infection but that it will be collected and reused and re-transmitted and used by all sorts of people who want something from us or who want to do something to us or who want to understand us and the other thing that people sometimes say and i see it almost like a psychological defense mechanism which is like i'm not that interesting you know what you say during a breakup was look it's not it's not you it's it's me right the thing about surveillance is it's not me it's you anybody is as interesting as their most interesting contact because your behavior can be used to find out information about people who are your friends who you may work with or you work for and so your privacy is not just really yours it's community privacy and once you start prying into that you get very valuable information it's no accident for example that when we were investigating around the case of the murder of jamal khashoggi we found that some of his closest contacts were targeted with a piece of spyware called pegasus part of that idea which is called off-center targeting in the intelligence world is that you can often learn a lot about a person by listening to their friends and by tracking what their friends say about them and what they say to their friends you don't need to target the person directly right so for the turkish audience this is jamal khashoggi we use the turkish version of the name and so you're saying that his phone was not necessarily directly monitored but it was his friends so they reached them through we don't know publicly whether jamal's phone was infected but what we know at the citizen lab is that some of his closest confidants including omar abdulaziz who is a dissident of the saudi regime based in canada have been working very closely with jamal was targeted with pegasus and in fact although we didn't learn it until later we published an investigation showing that omar was targeted with pegasus and i think it was the next day that jamal was murdered i think those two things are unrelated but it shows how tightly connected surveillance can be and murder actually it's almost we can think in terms of herd immunity so instead of her herd immunity for privacy oh i like this idea yeah we are a herd and we infect each other as a herd um we also protect each other as a herd and surveillance often seeks to target us and to understand us as a herd because rarely is the objective of surveillance just learning about your private pornography habits mostly it's about understanding who's important in a movement who's important in a group and then how to tear apart the social linkages that exist how to introduce a vaccine of a very perverse kind to try to bring and pull apart um social interactions yeah you're right actually my mind immediately goes to these extreme cases or more juicy stories where oh my god they're going to find out my browsing history and then they're going to blackmail me using that but that's actually very human intensive let's say you know it's an egocentric way of understanding the objectives of surveillance and it's a way that people can understand the invasiveness of it but for the most part as any it person will tell you everybody does things on the internet that they don't want their spouse or their friends to know about this is normal that's much less interesting in most cases than using information um for other purposes it doesn't mean right that there isn't catfishing and blackmail and all that it just means that that's kind of like the cheap version oh yeah it's just the one that's most often portrayed in the in you know in the movies that's why we're familiar with it and the other kind that you're talking about is not only more important but it can actually be automated it seems i could show you some graphics that i created based on tracking hacking groups targeting whole networks of thousands of people and show you how they built these networks of people and then moved around inside the networks to get their real targets and to monitor those individuals this actually this scaling up brings me to this uh topic of messing with uh elections there was a report you mentioned in 2017 one of your speeches you were saying 48 countries showed evidence of systematic disinformation campaigns 30 of those were about elections and they were actually about domestic elections so again the first example that came to my mind was a big bad russians attacking the american democracy but actually a far greater threat is your own government using this domestically you know it's an interesting phenomenon we know the most about the big fights of the big players because it's like in a superhero movie right when king kong fights another monster right like buildings get broken so we hear about it but what we find as researchers is wherever we scratch there are disinformation campaigns some of them are really sophisticated some of them are done by foreign entities and some of them are totally domestic and local i like to think of it like this the internet is a laboratory for marketers and online social platforms are the perfect way to market things because you have a person you can see what they're looking at you can show them something and you can then track whether showing them something results in a behavior i like to think of disinformation as marketing and the product is feeling and the profit is behavior and the internet is a perfect laboratory for conducting disinformation experimentation you show people messages you create feelings in them but the ultimate goal is behavioral and what's interesting is that if you think about it historically it was very hard if you wanted to do global disinformation you'd have to find some susceptible journalist in some disreputable magazine and then promote a story right like it required this tremendous effort at dissemination and even then you had no idea whether anyone bought it especially if you were doing it from abroad pointing into a country now you can actually track down to the person the efficacy of your messaging and refine it and i think it's fair to say the internet knows much more about some of our behaviors and our feelings than we do in certain situations what scares me the most is you know we've had this conversation about russian disinformation people have a mental image of a certain kind of disinformation it's like false stories misleading captions lots of emojis you know this kind of garbage i'm actually less worried about that and i'll tell you why at the end of the day disinformation and fake news are not the same thing the reason is if you apply my little framework disinformation marketing product feeling profit behavior the internet is really good at being used to create feelings and to get at t at in different ways you don't have to put a bunch of factual propositions that happen to be false in front of people and hope that they believe them we know that social media companies have even done experiments on shifting the mood of people just by making minor tweaks in the totally factual information that people are shown saying about their friends what scares me is that as the operators doing marketing and disinformation often as the same people become more sophisticated they will learn ways to shape our feelings that can't be easily observed by researchers and by other people who say well that's obviously demonstrably false what's the consequence of this well imagine i can identify a targeted demographic who's going to vote and for the week before i use my marketing skills to show them material that's totally accurate but that makes them feel less positive if i can make a certain number of marginal voters less likely to go out and vote or less likely to speak publicly about something i've achieved my goal and i could potentially do it without creating a data trail that is as obvious as a bunch of badly photoshopped pictures of eagles with donald trump's face on them my theory is that the conversation about fake news and news verification is actually something that people have settled on in part because it makes a very scary problem feel very tractable also directs attention away from what the platforms really do which is shape your feelings and your behavior and move it towards the content right so as long as we talk about disinformation as content then you can say well you need fact checking to solve that right but if disinformation is really just the manipulation of feelings to produce behaviors how do you fact check that i always felt deep down inside that these fact-checking sites are kind of preaching to the choir i don't buy them have you ever smoked yeah yeah did you smoke cigarettes that had a warning sign on the package oh no i smoked other things sorry i didn't smoke secrets but i know let me ask that question differently have you noticed that people around you who are very rational people smoke cigarettes from packages that have giant pictures of cancerous law yes okay information doesn't change behavior absent motivation uh and the marlboro man with a small warning in the lower corner the message is clear and i think your skepticism about fact checking is exactly right i don't think that even in a situation where you're dealing with you know the alleged highly rational information consumer people are going to go to those little fact check things right for many reasons including the fact that often the disinformation is bright it's shiny maybe it even blinks right it could be a video there's a lot of interesting content and then there's sort of a boring bar down at the bottom that warns you that the internet is not safe i think that most people when they navigate the internet overestimate their ability to quickly see through disinformation because you can see a lot of it um the result then is that we have a sort of a vision of our ability to sense what's going on and what's being done to us that may be more artisanal and less representative than we'd like to think we want to believe that there's an authority and authority on you know a final authority on on truth internet the new social media does not have actually that stuff it's almost like these parallel universes existing together with their own set of facts i think the reflex to assert what is true is understandable but it fundamentally misunderstands the problem of disinformation because disinformation is about feelings leading to behavior and the reason that platforms would rather not have that conversation is because what they are selling to advertisers is access to behavior they're not selling the ability to share some content they're sharing access to behavior and as long as platforms exist that make it easy to have access to people's behavior and feelings you will see disinformation and you will see the manipulation of those things whether it's to purchase a new set of tupperware or to make certain voting decisions and so i see fact checking as interesting and in some sense perhaps you know important partly for our academic reflex that truth be spoken somewhere in the context of lies perhaps partly a dead end for actually addressing this okay forget about fact-checking but if i know more about the mechanisms like confirmation bias or precisely the mechanisms by which my emotions are being manipulated if i can be trained you know in those fields and this is kind of an expanded version of critical thinking i guess do you think that would help or training individuals is kind of not so efficient because the platform is built this way and the incentives you just described will always push people to this certain direction so here's a here's a fun analogy that i think can be based on some evidence so there's this problem called fishing and we all know we think we know what fishing looks like right the thing is as we also know it's incredibly hard to train people to be resistant to fishing and the reason is that fishing is just the description of deception it's just a term for deception when you run a fishing campaign and i've done so ethically in the context of investigations of consensual investigations of companies security you're receiving constant feedback about who clicks on what email and so what you do is you revise your deception until people click again fishing trainings where you show people a bunch of pictures of fishing and say here's what it looks like you know looks like this if you see this don't do this the problem is it takes me five minutes to craft a new fishing email but an hour of boring powerpoint and stale coffee to give people a training for last week's fishing and i worry that with the critical thinking stuff we inadvertently put ourselves in a situation where we think okay we're going to teach people to be critical thinking enough that they will recognize things and you know in some sense take the right action but i think in practice what we know is that it's very easy to create feelings in people that cause them to do actions before they stop and think and the issue is it creates an impossible cognitive burden when navigating the internet to stop and think for everything that you do you can't stop and think about every tweet you couldn't possibly stop and think through every email that you received and so i go back and forth because it's like what you want to teach people is mindfulness if you're feeling some strong emotions that make you want to perform an action quickly hold off is it really possible i don't know this said i have a great story so for years the tibetan diaspora in dharmasala in india was heavily targeted they still are by chinese hackers and the chinese hackers were sending them emails bearing malware in attachments and this is a classic way that the entire group like you know the dalai lama and his people this is how they communicate raise an email with an attached file please review the file so the chinese hackers of course figure this out and we're sending a lot of emails bearing attachments and what they would do is once they would hack one person's email account they would use that person's emails change the recipient names and then send it to other people the emails looked really legit it's called the replay attack so the tibetans were like how do we defend against this problem well we need to get people to stop sending attachments it's the only thing that we can do and this could perhaps only work in a context where you have a bunch of tibetan buddhists but they came up with a campaign called detach from attachments [Laughter] works on so many levels detach from attachments and it worked and the chinese hackers were left in the dust because suddenly no one was sending any attachments they had detached right they'd exercised their will it worked until the chinese hackers figured out what they were doing instead which was sending links to google drive files and so then they began sending links to google drive files but this idea was like to be the human antivirus to be the human firewall to detach from attachments and it was successful for a couple years i think in practice there may be in certain situations where everyone's kind of on the same cultural page things that you can promote like that but i think would have to align with like lots of other cultural values and other sets of norms that people have the problem with so much stuff on the internet is that nobody has like a deep formative basis of experience about the internet that's other than from the internet right now it doesn't exist in schools doesn't exist for us as academics you know i was on social media for a couple hours just before you know this interview yeah the number of impressions you know the tweets or the costs that i see it's impossible to stay mindful do you think the only way is to change the platforms make them more transparent i don't know what would be the solution i know sometimes you describe the problem perfectly yeah a few minutes before yeah do you do you see any kind of solution well i'm wary of the karl marx problem which is a great diagnosis followed by a questionable prescription but um i think that i have a lot of hope about younger people and education and i feel like we're all in a situation where not to just beat this parallel but where our intellectual immune systems have never really seen this particular kind of pathogen before and so we're all developing immunity in different ways and it will look like a herd process it's going to look like us pushing norms around each other it'll mean changing i think probably how we talk to each other in public forums it will probably mean a lot of change in education around how information is sought and used i don't see any magic bullets instead i see this as a multi-generational problem where it's like we have this new technology about information it's more rapid than anything we've ever seen and we and it are going to evolve together and our survival is going to be dependent on us figuring out solutions so i have confidence in that in the long term and just like anything else with evolution i'm just not sure of exactly what new you know third eye or arm coming out of our ear is actually going to be evolved into to help us deal with this problem that said in the language that is tractable to us now i think that shifts in the norms that we have around this and the educational norms are probably a good start in practice the other thing in the the elephant in this giant internet room is that as long as these platforms are effectively in an arms race with our own intellectual defenses it's going to be very hard for us to solve this problem because if you think about what what goes on the survival of the platforms is structured around them continuing to deliver access to our behavior that's their function and as long as we are coming up with adaptations that can be identified by the platforms using machine learning they will work out adaptations to our adaptations and so i see a long evolutionary arms race as platforms mature and respond to pressure from governments and regulators they often begin to implement content moderation and lots of other balancing tools right so the initial free-for-all of any given platform over the course of five years kind of goes down as it does though the people who for various reasons feel or need that they they need to be free in their action or looking for something new and different will then slosh to another platform and then the cycle of control repeats itself not that all this control is good a lot of it is states trying to claw back access and control to these populations it does mean however that i think that seeing a given platform as sort of the target for your advocacy is very short-sighted i was reading a report that u.n was recommending a moratorium on the export of privately developed surveillance tools we kind of lost this battle on uh social media platforms there's no way we can control it maybe we shouldn't even try to control it as you're saying but at least limit or ban these commercial surveillance tools until we figure out how to regulate them which countries should access what not and that does not even track right nobody listens to that because that commission as far as i know does not have any teeth that you encounter commission do you have any thoughts on that so i believe you're referring to a statement by the un special rapporteur david k on uh breed room expression i think that kaye's concern is very valid and he diagnosed the problem accurately which is there's been a global proliferation of these technologies for hacking and surveillance and we have just seen with this proliferation an absolute epidemic of abuse cases with these things and we can see that right now governments don't seem to have the ability to control this proliferation even if they want to some don't have the will and others try and fail i think that kaye's point is this calls for a moratorium until we can solve it now whether such a moratorium can be implemented obviously it's a different question of real politic and each state will make its own decisions i think what he highlighted though is something very important which is politicians shouldn't open the door but they can't close and those doors are being opened everywhere and i worry that the coronavirus crisis has accelerated the opening of some of those doors these deep packet inspections happening in turkey with the turkish telecom infrastructure so they've deployed these devices um and they're targeting certain people and they're sending them to some you know i guess it's a phishing attempt right there's actually malware not what it points to is something interesting which is a device for surveillance can also become sort of passive surveillance just for monitoring can also in blocking can be turned into a device to hack people and a device to to target them in a much more invasive way so this is actively used it is being used in turkish telecom according to your research so our research was from sometime in 2018 what it suggests um for your listeners is that and this is probably something that they already know intuitively which is if a government that's well resourced and controls its telecommunication sector wants to hack your telephone or your laptop they can do that and they can do that without tricking you into entering your password they can do that really without you doing much of anything just going about your normal daily business and i think that this points to a bigger set of questions which is okay so this is a very serious power for a government to have do we trust our governments with this power have they shown that they use it in ways that are following values that we have or do they use it in ways that are abusive and part of the problem is that most societies right now are in a situation where their governments have the ability to hack and surveil way out beyond their laws and way out beyond any capacity for judicial oversight and this creates a problem where if the people who are handling and using that technology can't be trusted or have their own agendas you will see abuses it seems to me almost like a principle that if you put a sufficiently sophisticated technology for surveillance into the hands of anybody and don't provide oversight it'll be abused in fact we saw this even with um the software nsos pegasus so there's recently a story recently last week that uh the software was used by one of its employees to stalk a woman not exactly a terrorist or criminal there but a totally predictable outcome of providing people with unaccountable and highly invasive surveillance these mundane cases let's say all those i don't think stalking a woman would be considered mundane but relatively mundane cases would actually the number of those would overwhelm government abuses even i think we know that they do i think that the volume of cases where there is uh intimate partner um hacking and surveillance is very high we had something called neapolitan ice cream and neapolitan ice cream was one box of ice cream that had three flavors strawberry vanilla in the middle and chocolate i think of hacking as neapolitan ice cream your uh strawberry is governments that have a lot of science and technology capacity universities people with cryptographic and mathematics backgrounds who can develop their own technologies for hacking you don't need to go to the market and buy it they can do it at home and this is france israel russia the united states maybe sometimes turkey you know then your vanilla is governments that don't have that kind of background but they can use a checkbook to pay for it so this might be like saudi arabia or the united arab emirates who want to buy their way into very sophisticated hacking and then the chocolate is the like you know my cousin knows computers approach to hacking and you might say well that that chocolate approach you know how sophisticated and how effective is that going to be and the answer is it's surprisingly effective because it turns out right you can patch software to fix bugs but you cannot patch human behavior and so much good hacking whatever form it takes still leverages vulnerabilities in us our brains and our behavior to drink us into clicking on things and otherwise performing actions we shouldn't and what you see is in each of those bands of ice cream you see the same kinds of abuses right so the chocolate the my cousin knows computers approach like how do you hack someone with that well you go under the dark web and you find a remote access trojan or rat and you use it you you know trick a person into clicking on a link and you've infected them and are watching them from your janky desktop computer a lot of that stuff gets used for by mean by men hacking women in the um department of vanilla right so stuff sold to countries we know that the uh government of panama the former panamanian president martinelli had pegasus and he was using it to spy on his mistress every day he would receive a dvd his driver would bring a dvd he's listening to his mistress we know this because panama sought his extradition from the united states to face charges about the abuse of this so i'm referring to his stuff from court papers from an extradition hearing but then in the nation-state side we know that employees at the national security agency were using their techniques to follow women around and what it just shows is that whatever the technological sophistication whoever the claimed user is whoever the claim developer is it'll be abused by the same people for the same patterns of things and if you don't have robust oversight abuse is guaranteed um every time i feel bad i tell myself the same mantra which is everything is like everything else and if you think about the internet and what we talk about when we talk about hacking we're actually talking about is the use of deception and manipulation to exercise power this is something that's always been true everything that happens on the internet has a parallel in real life in terms that we can understand but because it's in digital clothing i think from lawmakers to individuals we find it hard to recognize those parallels and so it feels like a new and scary world and our first reaction is to fall back on our defense mechanisms i don't fully understand it or maybe i'm completely monitored anyways etc but none of that is accurate in fact security on the internet is just like everything else how many locks are on your door of your apartment one if someone was really determined they had a battering ram would they be able to break into your apartment oh sure of course and the same is true technologically if a person has sufficient resources they can break into your phone and so what you need to think about is how to raise the cost to an attacker to penetrate your digital life and the same analogy should be true with disinformation it's not that anybody can do disinformation it's that you want to take measures that make it more expensive and more costly to run disinformation operations and to access human behavior i don't know i'm trying to think some practical ways that this could happen let me give you an example ban political advertising on social media i'm not saying do it but i'm saying if you do that then you create a situation where in order to do you know a manipulative political advertising campaign you need to register a false organization it needs to pass certain checks you need to make an investment into doing it it doesn't mean that it won't be done it just means that it's harder to be done which means that you're pricing out certain actors the same is true for hacking for example people often ask me oh my god i'm so vulnerable what do i do to protect myself you told me about all these terrifying threats and the simplest answer is two-factor authentication that simple step that you can take using a recovery key or um a a phone app paired with your online account prices out many many attacking groups the same is true for whatsapp use a pin code on your whatsapp it makes it a lot harder for some third party to hack you there are lots of simple steps that we can take to claw back a feeling of agency and control they're not perfect but we're not fort knox either and you know a team of oceans 11 burglars is not coming to our digital house next week but somebody might rattle the door looking to steal our television if we can protect against the one it's already a first star it doesn't have to be perfect the perfect is the enemy of good right so we can't be good at least as we're talking about surveillance in times of coronavirus people are tempted to give up whatever they need to give up in order to be able to get back to the life as they wanted it and that's totally normal we all feel that way the concern is just we want to make sure that when we go back to our new life although there may be hundreds of thousands of people-sized tears in our society we want to go back to the society that we recognize which is a society that protects and respects the individual and that protects our privacy otherwise we run the risk of losing that feeling of safety and privacy in our personal communications with people who are most intimate with us and i actually think the time of coronavirus is a good time to have a conversation about privacy because for so many of us we're having our most intimate conversations digitally and it's so important that we are able to keep our society and keep our relationships connected and to have that we need to feel like we can speak freely to security once again thanks to john scott railton you can follow him on twitter at jsrailton this talk was made possible by switching board podcast studios a washington dc based production company trying to make quality podcasting as accessible as possible casual intellectual is the english language counterpart to a popular turkish podcast slash blog called fular zentalik follow us for more english language content you