1
00:00:00,000 --> 00:00:06,720
Okay guys, we are ready to start. Our first speaker is Justin. The talk is about

2
00:00:06,720 --> 00:00:13,260
surveillance capitalism. We'll continue until morale improves. So give him a big

3
00:00:13,260 --> 00:00:36,320
applause and welcome. Okay. I'll get there. All right. Yes? No? Hear me? Thank you. More or

4
00:00:36,320 --> 00:00:42,020
less. Thank you all for coming out. This is really cool that you're here.

5
00:00:43,260 --> 00:00:55,560
Really cool that Crypto Village is doing this. Okay. Yeah. I'll get started. So really quick,

6
00:00:55,680 --> 00:01:01,740
all my slides are already online. Slides.SecureUtah.org. I'm from Utah. I work in

7
00:01:01,740 --> 00:01:06,520
security. I like to promote security. So as a side project, I'm trying to little bit by bit

8
00:01:07,380 --> 00:01:10,920
teach people about security and increase people's awareness about it.

9
00:01:12,780 --> 00:01:13,240
So I'm going to start with the first slide.

10
00:01:13,260 --> 00:01:18,180
Slides are full of links. There's a huge topic, a lot to cover. So everything I talk about,

11
00:01:18,260 --> 00:01:21,980
it's linked from. You can read yourself. By all means, check my work and form your own

12
00:01:21,980 --> 00:01:28,980
opinions. My name is John. I spoke at the Crypto Village last year on HTTPS. Had a

13
00:01:28,980 --> 00:01:31,940
great time. And so I want to come back this year and talk about something else I've kind

14
00:01:31,940 --> 00:01:37,620
of been just tracking for fun. Surveillance capitalism. The title of the talk is a play

15
00:01:37,620 --> 00:01:42,100
on the phrase, the beatings will continue until morale improves. And what it means essentially

16
00:01:43,260 --> 00:01:45,820
is you're going to be punished, and it's not going to stop, so you might as well get used

17
00:01:45,820 --> 00:01:53,900
to it. And being a bit fatalistic after researching this talk, that's kind of how I feel about

18
00:01:53,900 --> 00:01:57,660
how surveillance capitalism is heading. We're kind of stuck with it. Might as well get used

19
00:01:57,660 --> 00:02:01,660
to it. Maybe not. Maybe someone else can find a way out.

20
00:02:05,560 --> 00:02:10,060
So real quick, for the time being, got my face covered. We'll get to that in a little

21
00:02:10,060 --> 00:02:12,700
bit. But first, I'd like to...

22
00:02:14,140 --> 00:02:20,860
Lay a foundation for the talk. Surveillance capitalism. What is it? It's a term coined

23
00:02:20,860 --> 00:02:25,980
in 2005 by Shoshana Zuboff. She's a professor from Harvard Business School. There's a lot

24
00:02:25,980 --> 00:02:31,540
of meaning and consequence packed into this definition. Professor Zuboff founded the concept

25
00:02:31,540 --> 00:02:36,600
upon and as a reaction to Google's accumulation, management, and processing of immense volumes

26
00:02:36,600 --> 00:02:41,820
of data. So she... It's kind of... This is one way to sum it up, but there's a lot more

27
00:02:41,820 --> 00:02:42,600
to it than that.

28
00:02:43,260 --> 00:02:47,140
I'm not doing her justice, her work justice, by reducing it down to just a few quotes here,

29
00:02:47,280 --> 00:02:52,520
so I encourage you to go read what she's written. But essentially, it's... Surveillance capitalism

30
00:02:52,520 --> 00:02:59,160
is a way to gather information, gather data, and monetize it. Not just to, for money's

31
00:02:59,160 --> 00:03:05,340
sake, but to influence consumers' behavior, to influence market behavior, or market control.

32
00:03:08,140 --> 00:03:13,140
So as I mentioned, she formed this in response to Google. Here are a couple of quotes from

33
00:03:13,140 --> 00:03:17,800
people who work at Google. Amit Singhal was the Senior Vice President of Engineering

34
00:03:17,800 --> 00:03:23,620
in 2012, Hal Varian's Google Chief Economist in 2014. These quotes are about the immense

35
00:03:23,620 --> 00:03:27,720
amount of data that they have to handle. And this is several years ago, so I'm sure

36
00:03:27,720 --> 00:03:29,920
it's gone up by an order of magnitude or two.

37
00:03:34,460 --> 00:03:42,560
20 billion URLs crawl today. You know, 100 billion search queries a month. How do you

38
00:03:42,560 --> 00:03:45,400
search across a trillion records in a few seconds? I mean, there's an amount of data

39
00:03:45,400 --> 00:03:49,840
that we never dealt with before, and Google has been doing this for years.

40
00:03:52,900 --> 00:03:58,900
So from this, her conclusion, data is becoming everything. This big data is plucked from

41
00:03:58,900 --> 00:04:03,100
our lives without our knowledge and without our informed consent. The informed consent

42
00:04:03,100 --> 00:04:05,020
is central to all this.

43
00:04:06,040 --> 00:04:10,620
Her conclusion, it's the Matrix had it close. They thought we were batteries. We're just

44
00:04:10,620 --> 00:04:12,540
apparently data generators in real life.

45
00:04:13,400 --> 00:04:14,680
That's what we're here for.

46
00:04:20,700 --> 00:04:27,300
So Maciej Stoglowski runs a website, Pinboard. He spoke earlier this year, had a talk called

47
00:04:27,300 --> 00:04:32,160
Build a Better Munster. Great speaker, very insightful. He talked about the same topic.

48
00:04:32,860 --> 00:04:37,900
The economic basis of the Internet is surveillance. Every interaction we have leaves a data trail.

49
00:04:38,320 --> 00:04:41,020
Whole industries exist to consume this data.

50
00:04:44,100 --> 00:04:48,800
He talked a lot about Facebook and Google, specifically, they're the leaders in this.

51
00:04:49,180 --> 00:04:53,340
But this is kind of what they want to do. They want to know where their users are. What are

52
00:04:53,340 --> 00:04:56,200
they looking at? Who are they with? Their purchasing habits. Everything about what

53
00:04:56,200 --> 00:05:03,800
you're doing, anything else they can discover. These two companies together, they have, these

54
00:05:03,800 --> 00:05:08,840
numbers have grown more than 65 percent of the online ad market, and I think it's something

55
00:05:08,840 --> 00:05:11,820
like upwards of $60 billion a year.

56
00:05:11,920 --> 00:05:12,220
Yeah.

57
00:05:12,220 --> 00:05:17,580
and why are they doing all this to sell on advertising and to train their

58
00:05:17,580 --> 00:05:28,000
machine learning algorithms so let me go back real quick again look up the chase

59
00:05:28,000 --> 00:05:33,180
talk on this he expands a lot more in detail paints a much broader picture I'm

60
00:05:33,180 --> 00:05:39,000
just summarizing briefly what he's talked about but so perform mass data

61
00:05:39,000 --> 00:05:41,780
collection and understood in order to understand the behavior of people this

62
00:05:41,780 --> 00:05:47,020
is not a new concept 1870s the origin of today's credit bureaus is when they

63
00:05:47,020 --> 00:05:51,700
started to collect data on people so you can make decisions about them in 88

64
00:05:51,700 --> 00:05:56,680
roger clark introduced the term data valence using personal data systems in

65
00:05:56,680 --> 00:06:02,260
investigation or monitoring of the actions of people 2002 the Department of

66
00:06:02,260 --> 00:06:05,320
Defense started their total information awareness program this was in response

67
00:06:05,320 --> 00:06:10,760
to the September 11th attacks collect all the information and use it to

68
00:06:10,760 --> 00:06:11,760
analyze it will analyze it and use it to analyze it and use it to analyze it

69
00:06:11,760 --> 00:06:17,180
for suspicious behavior patterns 2005 Christopher Sillbogen talked about

70
00:06:17,820 --> 00:06:20,760
transactions surveillance the government's could go and law enforcement

71
00:06:20,760 --> 00:06:23,900
can go in and get information about people's financial purchases financial

72
00:06:23,900 --> 00:06:30,360
dealings without a warrant sometimes just asking for it and we all know

73
00:06:30,360 --> 00:06:33,520
about well should know all about snowden's revelations about the NSA's

74
00:06:33,520 --> 00:06:37,920
global surveillance program so there's been lots of cases of obviously collect

75
00:06:37,920 --> 00:06:40,760
data figure out what people are doing why they're doing it

76
00:06:41,760 --> 00:06:42,640
So why is this different?

77
00:06:43,260 --> 00:06:45,780
What makes this new incarnation of data collection analysis

78
00:06:46,680 --> 00:06:47,680
worthy of attention?

79
00:06:48,700 --> 00:06:50,420
So to me, it's three things.

80
00:06:50,540 --> 00:06:52,640
It's the combination of the magnitude, the methods,

81
00:06:52,700 --> 00:06:55,900
and the motivation, magnitude, motivation, and methods

82
00:06:56,420 --> 00:06:57,340
for doing so.

83
00:06:57,400 --> 00:06:59,300
It's the sheer scale of the data collection.

84
00:06:59,740 --> 00:07:03,040
It's achieved via an uncomfortably pervasive penetration

85
00:07:03,040 --> 00:07:06,120
into the previously mundane activities of our lives.

86
00:07:06,580 --> 00:07:08,660
It's the unavoidability of being a data point.

87
00:07:09,160 --> 00:07:10,820
It's the commonality and concealment

88
00:07:10,820 --> 00:07:11,720
of the collection methods.

89
00:07:12,560 --> 00:07:13,760
It's the unashamed application

90
00:07:13,760 --> 00:07:15,600
of incredibly advanced algorithms

91
00:07:15,600 --> 00:07:17,200
that are designed to learn from

92
00:07:17,200 --> 00:07:18,660
and then shape human behavior,

93
00:07:19,200 --> 00:07:20,460
all in the pursuit of profit.

94
00:07:21,700 --> 00:07:23,580
It's not in the pursuit of national security.

95
00:07:23,760 --> 00:07:25,760
It's not to raise the infant mortality rate.

96
00:07:26,020 --> 00:07:28,040
It's just to influence consumers

97
00:07:28,860 --> 00:07:30,320
so they buy what you want them to buy

98
00:07:30,320 --> 00:07:31,320
when they want you to buy it,

99
00:07:31,400 --> 00:07:33,660
and you can be there off them the best deal.

100
00:07:36,020 --> 00:07:37,780
So again, being a bit fatalistic,

101
00:07:39,160 --> 00:07:42,560
to me it seems like a weird offspring

102
00:07:42,560 --> 00:07:44,080
of late capitalism and Moore's Law.

103
00:07:44,240 --> 00:07:47,420
It's an odd outcome of dirt-cheap processing power

104
00:07:47,420 --> 00:07:49,040
in the service of greed.

105
00:07:51,620 --> 00:07:54,780
So for my talk, just remember this.

106
00:07:54,840 --> 00:07:56,080
There's a lot more background to it,

107
00:07:56,160 --> 00:07:57,320
but Google kind of showed the way

108
00:07:57,320 --> 00:07:58,940
that big data accumulation analytics

109
00:07:58,940 --> 00:08:00,060
can be highly profitable,

110
00:08:00,720 --> 00:08:02,160
and since then a flood of other companies

111
00:08:02,160 --> 00:08:04,300
are desperately trying to copy their business model

112
00:08:04,300 --> 00:08:06,560
and collect all the user data that they can

113
00:08:06,560 --> 00:08:07,600
and monetize it.

114
00:08:09,380 --> 00:08:10,680
So in a minute, I'll run through

115
00:08:10,680 --> 00:08:12,040
some of the many current forums

116
00:08:12,040 --> 00:08:13,280
that surveillance capitalism,

117
00:08:13,820 --> 00:08:15,980
or the current methods that it uses,

118
00:08:16,220 --> 00:08:17,880
and offer some defensive options.

119
00:08:19,600 --> 00:08:21,260
But first, I want to talk about privacy.

120
00:08:21,420 --> 00:08:22,840
No talk about surveillance can be had

121
00:08:22,840 --> 00:08:23,900
without talking about privacy.

122
00:08:24,360 --> 00:08:25,420
That's why you're here today.

123
00:08:28,080 --> 00:08:29,560
So, well, yeah.

124
00:08:29,660 --> 00:08:32,560
So Daniel Solove wrote a paper in 2007.

125
00:08:33,520 --> 00:08:35,660
It was a rebuttal to the phrase

126
00:08:35,660 --> 00:08:36,760
I've got nothing to hide.

127
00:08:39,200 --> 00:08:40,460
And we've all heard the phrase

128
00:08:40,460 --> 00:08:41,300
if you've got nothing to hide,

129
00:08:41,340 --> 00:08:42,100
then you have nothing to fear.

130
00:08:42,240 --> 00:08:43,060
What do you have to fear?

131
00:08:43,640 --> 00:08:44,840
And he talks about that.

132
00:08:44,860 --> 00:08:45,480
He dissects it.

133
00:08:45,580 --> 00:08:47,100
The question implies that an individual

134
00:08:47,100 --> 00:08:48,920
engages only in legal activity,

135
00:08:49,160 --> 00:08:50,920
that if you engage in only legal activity,

136
00:08:51,100 --> 00:08:52,020
you have nothing to worry about.

137
00:08:52,500 --> 00:08:53,940
When it comes to the government collecting

138
00:08:53,940 --> 00:08:55,580
and analyzing personal information,

139
00:08:56,120 --> 00:08:58,500
many people contend that a privacy harm exists

140
00:08:58,500 --> 00:09:01,080
only if skeletons in the closet are revealed.

141
00:09:03,300 --> 00:09:05,880
And the way Daniel Solove put it,

142
00:09:05,980 --> 00:09:06,660
he said that the problem, in short,

143
00:09:06,760 --> 00:09:08,280
is not with finding an answer to the question,

144
00:09:08,920 --> 00:09:09,960
if you have nothing to hide,

145
00:09:10,040 --> 00:09:10,800
then what do you have to fear?

146
00:09:10,920 --> 00:09:12,580
The problem isn't the answer.

147
00:09:12,600 --> 00:09:13,640
The problem is the question itself.

148
00:09:14,040 --> 00:09:15,940
It's the underlying assumption of the question

149
00:09:15,940 --> 00:09:18,400
that privacy is about hiding bad things.

150
00:09:20,360 --> 00:09:21,080
And it's not.

151
00:09:21,200 --> 00:09:22,700
And maybe to the older generation,

152
00:09:22,920 --> 00:09:24,840
maybe in the past, privacy was about secrecy,

153
00:09:24,940 --> 00:09:27,700
but privacy now is about control.

154
00:09:27,760 --> 00:09:28,560
It's about consent.

155
00:09:29,380 --> 00:09:30,880
I want to illustrate that a little bit.

156
00:09:32,000 --> 00:09:33,960
First, a quote from Michelle Dinity.

157
00:09:34,100 --> 00:09:36,120
She's a chief privacy officer from Cisco.

158
00:09:37,040 --> 00:09:39,120
She does wonderful work, very pro-privacy.

159
00:09:39,440 --> 00:09:41,960
I highly encourage you, again, to follow her

160
00:09:41,960 --> 00:09:44,000
and follow her work.

161
00:09:44,900 --> 00:09:46,220
But she talks about this specifically.

162
00:09:46,360 --> 00:09:47,300
When you say privacy is dead,

163
00:09:47,520 --> 00:09:49,360
if what you mean is secrecy and hiding away

164
00:09:49,360 --> 00:09:51,860
and not being connected, I agree with that.

165
00:09:51,920 --> 00:09:53,460
That version of privacy is dead.

166
00:09:53,660 --> 00:09:56,040
But privacy as a function of how we define ourselves,

167
00:09:56,180 --> 00:09:58,660
how we live, what we can expect in morality,

168
00:09:58,880 --> 00:10:00,200
respect, ethics, and security,

169
00:10:01,080 --> 00:10:03,520
it's a new version of privacy that's alive and well.

170
00:10:05,500 --> 00:10:06,740
Bruce Schneier wrote about this.

171
00:10:06,740 --> 00:10:09,780
Several years ago, privacy is about control.

172
00:10:10,460 --> 00:10:12,180
We don't mind sharing our lives and thoughts,

173
00:10:12,300 --> 00:10:13,760
but we want to control how and with whom.

174
00:10:14,300 --> 00:10:16,200
Privacy failure is a control failure.

175
00:10:16,420 --> 00:10:19,640
When your health records are leaked or stolen,

176
00:10:19,860 --> 00:10:21,400
that's a privacy failure

177
00:10:21,400 --> 00:10:22,800
because you've lost control of them.

178
00:10:26,180 --> 00:10:27,480
Another way to put the same thing,

179
00:10:27,820 --> 00:10:29,760
privacy is the right to consent.

180
00:10:30,440 --> 00:10:32,060
It's the right also to withdraw consent,

181
00:10:32,300 --> 00:10:33,740
to only provide information to the people

182
00:10:33,740 --> 00:10:36,320
you want to provide it to when you want to provide it.

183
00:10:37,380 --> 00:10:40,280
Sarah Jamie Lewis is a security researcher from Canada.

184
00:10:40,600 --> 00:10:42,140
Also does amazing work.

185
00:10:42,520 --> 00:10:44,080
She just put a book out called

186
00:10:44,080 --> 00:10:46,620
Queer Privacy with stories

187
00:10:46,620 --> 00:10:52,140
about privacy from the margins of society,

188
00:10:52,340 --> 00:10:54,740
the people who aren't normally protected or considered

189
00:10:54,740 --> 00:10:56,360
when privacy solutions are created.

190
00:10:56,960 --> 00:10:58,620
So highly, highly recommend the book.

191
00:10:59,140 --> 00:11:00,400
If you want to come talk to me afterwards,

192
00:11:00,560 --> 00:11:01,940
I have a few copies I can give away also.

193
00:11:04,040 --> 00:11:05,680
But she pushes this a lot, and I totally agree.

194
00:11:05,800 --> 00:11:06,720
Privacy is the right to consent.

195
00:11:06,720 --> 00:11:08,480
It's the right to consent to information

196
00:11:08,480 --> 00:11:09,780
being released and shared.

197
00:11:11,600 --> 00:11:14,020
So privacy is evolving.

198
00:11:14,720 --> 00:11:16,000
Privacy is about control.

199
00:11:16,280 --> 00:11:17,560
It's the right to consent.

200
00:11:18,840 --> 00:11:20,660
And from what I've seen,

201
00:11:20,840 --> 00:11:24,100
it's a battleground that most people aren't aware of.

202
00:11:26,880 --> 00:11:28,580
So a case study, privacy.

203
00:11:29,820 --> 00:11:32,920
This is from 2014.

204
00:11:33,400 --> 00:11:35,800
This woman became the subject of a paparazzi

205
00:11:35,800 --> 00:11:36,700
in a restaurant.

206
00:11:36,720 --> 00:11:37,580
Got lots of media attention

207
00:11:37,580 --> 00:11:42,080
due to her involvement in a situation.

208
00:11:42,140 --> 00:11:42,840
That's not important.

209
00:11:43,520 --> 00:11:45,440
What was interesting to me was that in public,

210
00:11:45,600 --> 00:11:46,800
she had to go to court a few times.

211
00:11:47,120 --> 00:11:48,580
She started wearing a sun visor.

212
00:11:48,660 --> 00:11:50,100
These are sun visors,

213
00:11:50,160 --> 00:11:52,720
kind of a grain of popularity in Asia.

214
00:11:53,740 --> 00:11:54,860
They're UV coating,

215
00:11:54,980 --> 00:11:56,280
keep the sun out of your face when you're outside.

216
00:11:57,400 --> 00:12:00,220
But what was interesting is that she had more than one.

217
00:12:00,400 --> 00:12:01,700
She'd coordinate with her outfit.

218
00:12:01,800 --> 00:12:02,960
She'd go outside in public

219
00:12:02,960 --> 00:12:04,680
when she knew the media was out there.

220
00:12:05,720 --> 00:12:06,700
She wasn't unknown to the public.

221
00:12:06,700 --> 00:12:07,340
She was known before the event.

222
00:12:07,420 --> 00:12:08,560
You can search for her name online,

223
00:12:08,720 --> 00:12:10,540
find photos of her all over the place.

224
00:12:11,440 --> 00:12:13,220
But this article that someone wrote about it

225
00:12:13,220 --> 00:12:14,940
dubbed it the face privatizer,

226
00:12:15,040 --> 00:12:16,940
not to protect herself from the sun's glare,

227
00:12:17,120 --> 00:12:18,300
but rather from the media glare.

228
00:12:18,740 --> 00:12:21,140
She was misusing the visor rather effectively.

229
00:12:22,560 --> 00:12:24,880
I hope that being hackers,

230
00:12:25,360 --> 00:12:26,980
you all can identify with that.

231
00:12:28,180 --> 00:12:30,020
We misuse things in interesting ways

232
00:12:30,020 --> 00:12:30,800
because we can,

233
00:12:30,900 --> 00:12:31,380
because it's interesting,

234
00:12:31,460 --> 00:12:31,900
because it's fun.

235
00:12:34,240 --> 00:12:35,160
But I saw this,

236
00:12:35,160 --> 00:12:36,440
and I'm like, it's totally genius.

237
00:12:36,440 --> 00:12:37,280
It's pretty cool.

238
00:12:38,900 --> 00:12:39,920
So early this year,

239
00:12:39,980 --> 00:12:40,800
I'm from Salt Lake City.

240
00:12:40,940 --> 00:12:41,860
We have a B-Sides there.

241
00:12:42,460 --> 00:12:44,120
I gave an earlier presentation of this talk.

242
00:12:44,620 --> 00:12:48,940
And wearing one of these has been in my mind since 2014.

243
00:12:49,500 --> 00:12:51,680
And I did it as kind of a proof of concept.

244
00:12:52,600 --> 00:12:54,020
It's a surreal experience.

245
00:12:55,660 --> 00:12:56,840
I parked down the street.

246
00:12:57,020 --> 00:12:59,060
I walked up to the con building

247
00:12:59,500 --> 00:13:01,160
with this on my face down the sidewalk.

248
00:13:02,220 --> 00:13:03,620
Walking by, everyone's looking at you.

249
00:13:03,640 --> 00:13:04,280
Like, what is that?

250
00:13:04,340 --> 00:13:04,760
That's weird.

251
00:13:06,640 --> 00:13:08,720
But it's like sunglasses for your face.

252
00:13:08,860 --> 00:13:09,720
I can see everyone else.

253
00:13:09,740 --> 00:13:10,720
They can't see my face.

254
00:13:10,880 --> 00:13:13,220
It's a noticeable shield of privacy.

255
00:13:14,600 --> 00:13:15,780
And a weird way to get it

256
00:13:15,780 --> 00:13:16,500
because everyone's looking at you,

257
00:13:16,540 --> 00:13:17,880
but I still have that sense of a barrier.

258
00:13:19,140 --> 00:13:21,620
So it's kind of interesting to try these.

259
00:13:21,680 --> 00:13:22,500
You can order these online,

260
00:13:22,560 --> 00:13:23,240
like from Amazon.

261
00:13:23,460 --> 00:13:24,600
They're $20 or so.

262
00:13:29,640 --> 00:13:30,800
Yeah, so I'll get that in a second.

263
00:13:31,720 --> 00:13:32,560
So again, afterwards,

264
00:13:33,200 --> 00:13:34,320
I've got a few extra with me.

265
00:13:34,400 --> 00:13:35,840
You're welcome to come meet me outside,

266
00:13:35,840 --> 00:13:37,160
try one on, see what it's like.

267
00:13:37,300 --> 00:13:38,280
They're pretty cool.

268
00:13:39,540 --> 00:13:42,300
And they get a lot of looks.

269
00:13:42,720 --> 00:13:45,960
So real quick, let me take this off.

270
00:13:55,140 --> 00:13:55,500
Okay.

271
00:14:02,740 --> 00:14:03,600
Okay, that's better.

272
00:14:09,360 --> 00:14:10,160
More fun coming.

273
00:14:10,260 --> 00:14:11,560
Oh, let me make sure you can hear me.

274
00:14:14,000 --> 00:14:14,320
Okay.

275
00:14:18,000 --> 00:14:19,120
Okay, I'll try to speak up.

276
00:14:19,180 --> 00:14:19,500
Any good?

277
00:14:20,000 --> 00:14:20,820
Okay, yes, no?

278
00:14:23,900 --> 00:14:25,000
Things aren't the way I want.

279
00:14:28,580 --> 00:14:28,900
Okay.

280
00:14:31,740 --> 00:14:32,060
Okay.

281
00:14:32,060 --> 00:14:32,100
Okay.

282
00:14:35,500 --> 00:14:35,820
Okay.

283
00:14:38,600 --> 00:14:39,500
Okay, I'll give this a try.

284
00:14:42,300 --> 00:14:44,520
So let's talk about surveillance capitalism, the methods.

285
00:14:47,300 --> 00:14:50,100
In the summary for the talk, I outlined some of these.

286
00:14:50,160 --> 00:14:52,160
We'll get to all these, I guess, some examples of each of them.

287
00:14:53,860 --> 00:14:57,020
First one, the most fun one, the most interesting to me, facial recognition.

288
00:14:59,620 --> 00:15:03,780
We'll run through all these and talk a bit more about the defenses with each of them.

289
00:15:04,480 --> 00:15:05,540
So, facial recognition.

290
00:15:05,540 --> 00:15:11,160
Let me, let me, this is a comic that illustrates it really well.

291
00:15:12,020 --> 00:15:12,840
Here's Lois Lane.

292
00:15:12,920 --> 00:15:13,800
She's on her Facebook page.

293
00:15:14,040 --> 00:15:16,020
She just posted a picture of her and Superman.

294
00:15:16,760 --> 00:15:19,680
Right away, Facebook says, hey, do you want to tag Clark Kent?

295
00:15:20,040 --> 00:15:22,660
It matched the face pretty quickly.

296
00:15:23,000 --> 00:15:24,700
Her reaction is quite appropriate.

297
00:15:25,440 --> 00:15:29,460
So the illustrator, Max Karsten, he had an interview about this.

298
00:15:29,580 --> 00:15:32,240
The image gained quite a lot of attention online.

299
00:15:34,300 --> 00:15:35,520
The question in the interview says,

300
00:15:35,540 --> 00:15:40,260
was there an incident that spurred the idea to draw this?

301
00:15:41,760 --> 00:15:46,980
And he said, for him, he posted a photo on Facebook of himself making a rather goofy expression.

302
00:15:47,660 --> 00:15:51,300
And to his surprise, Facebook's recognition system still identified him.

303
00:15:54,680 --> 00:15:57,320
So he thought it was funny that he made this weird face.

304
00:15:57,400 --> 00:15:59,020
He still got identified, so that led to this picture.

305
00:16:01,000 --> 00:16:02,860
But to me, it illustrates it rather well.

306
00:16:02,960 --> 00:16:04,520
But it's kind of funny that in the 21st century,

307
00:16:04,620 --> 00:16:05,520
Facebook has been a little bit different.

308
00:16:05,540 --> 00:16:06,780
It's become more powerful than Superman.

309
00:16:10,840 --> 00:16:14,200
So there are lots of examples of facial recognition being used.

310
00:16:15,260 --> 00:16:18,820
2015, Facebook had a research paper where they could identify people

311
00:16:18,820 --> 00:16:24,820
without seeing their faces by things like their ears, their clothes, their posture.

312
00:16:25,940 --> 00:16:28,080
83% accuracy, I think, is what it was.

313
00:16:28,160 --> 00:16:30,880
When you have a picture of someone and you have this big data set,

314
00:16:30,980 --> 00:16:34,740
you can start to match them even if you can't see their face in subsequent pictures.

315
00:16:37,780 --> 00:16:40,340
FindFace is a startup from Russia.

316
00:16:40,600 --> 00:16:43,680
Vcontact is a social media service in Russia.

317
00:16:43,860 --> 00:16:45,200
Most everyone has a profile there.

318
00:16:45,280 --> 00:16:46,200
It's like the Facebook of Russia.

319
00:16:46,900 --> 00:16:49,620
FindFace developed an app that integrated with Vcontact

320
00:16:49,620 --> 00:16:52,380
where you use the FindFace app, take a picture of someone,

321
00:16:52,620 --> 00:16:54,760
you would find their social media profile pretty quickly.

322
00:16:55,040 --> 00:17:00,160
So you could see the obvious privacy concerns with taking a photo of someone on the subway

323
00:17:00,160 --> 00:17:02,140
and getting their social media profile right away.

324
00:17:04,360 --> 00:17:09,920
And earlier this year, in Russia, there's many protests that are unsanctioned,

325
00:17:09,920 --> 00:17:11,600
that the government doesn't like.

326
00:17:11,800 --> 00:17:14,700
So you go to a protest and you make it home safely.

327
00:17:14,800 --> 00:17:16,680
You aren't arrested. You aren't beat up. Great.

328
00:17:16,860 --> 00:17:19,720
But if someone takes your photo there, well, photos were taken there

329
00:17:19,720 --> 00:17:22,860
and some people started pulling the photos out of the protests,

330
00:17:23,560 --> 00:17:27,940
pulling the faces out of the protest photos and finding their Vcontact profiles.

331
00:17:28,200 --> 00:17:31,320
So you can see very quickly, you thought you were anonymous at a protest.

332
00:17:31,320 --> 00:17:35,340
A picture is taken and you get a social media profile found.

333
00:17:36,140 --> 00:17:37,500
And bad things can happen.

334
00:17:39,380 --> 00:17:43,880
But facial recognition is being used in lots of other mundane or kind of normal ways.

335
00:17:44,720 --> 00:17:47,600
Mostly in the government law enforcement area.

336
00:17:48,340 --> 00:17:52,120
Chicago and New York both wanted to add it to their citywide camera systems.

337
00:17:54,540 --> 00:17:55,680
Oh yeah, Caesar's Palace.

338
00:17:55,980 --> 00:17:59,900
So if you go to their privacy policy and you search for facial recognition,

339
00:18:00,060 --> 00:18:01,300
they got a section there on self-exclusion.

340
00:18:01,320 --> 00:18:03,960
Self-exclusion is if a person has a gambling problem

341
00:18:03,960 --> 00:18:06,660
and they say, hey, I shouldn't be here.

342
00:18:06,800 --> 00:18:08,680
If you see me here, please escort me out.

343
00:18:10,980 --> 00:18:13,640
Caesar's Palace uses facial recognition to identify those people

344
00:18:13,640 --> 00:18:15,000
and help find them quickly.

345
00:18:17,260 --> 00:18:18,640
I've asked some of the security guards here.

346
00:18:18,720 --> 00:18:20,240
They said covering your face is not allowed.

347
00:18:20,420 --> 00:18:22,340
I haven't tested it. I'm not sure I want to.

348
00:18:23,260 --> 00:18:25,380
But I actually found references to back in 2005.

349
00:18:25,520 --> 00:18:30,260
Casinos were using facial recognition to identify people who shouldn't be gambling.

350
00:18:31,320 --> 00:18:33,260
Self-identify as they shouldn't be gambling.

351
00:18:34,420 --> 00:18:39,520
They also say they use it to help police when they're looking for a criminal.

352
00:18:39,680 --> 00:18:42,240
So the capability is there. The technology is there.

353
00:18:42,580 --> 00:18:46,400
Assume your face is being recorded and tracked at casinos.

354
00:18:46,980 --> 00:18:47,960
Lots of other examples.

355
00:18:48,580 --> 00:18:51,120
What's most interesting to me is 2017, earlier this year,

356
00:18:51,180 --> 00:18:56,040
there's a startup in Missouri that sells facial recognition solutions to gas stations.

357
00:18:56,140 --> 00:18:56,820
To jewelry stores.

358
00:18:58,500 --> 00:19:00,620
If you want to go to a gas station after 11,

359
00:19:00,620 --> 00:19:01,840
you have to scan your face.

360
00:19:02,080 --> 00:19:06,680
If you're a known shoplifter, if you're known to have a warrant out for you,

361
00:19:06,740 --> 00:19:08,060
you can't. They won't open the door for you.

362
00:19:08,520 --> 00:19:10,720
It cuts down on crime. It makes lots of sense.

363
00:19:11,140 --> 00:19:14,860
But the fact that the technology is that affordable, that cheap,

364
00:19:15,000 --> 00:19:19,080
that franchise store gas stations are going to install it,

365
00:19:19,160 --> 00:19:20,700
it's pretty commonplace now.

366
00:19:22,400 --> 00:19:27,340
A big explosion this year of airports using it for convenience.

367
00:19:27,440 --> 00:19:29,580
Make boarding faster. Check your bags in faster.

368
00:19:31,360 --> 00:19:33,160
Scan your face and you get on right away.

369
00:19:34,480 --> 00:19:39,100
And in airlines, airports, don't roll this stuff out just for the fun of it.

370
00:19:39,160 --> 00:19:40,820
It's expensive. It takes a lot of time.

371
00:19:41,000 --> 00:19:43,700
The fact that they're testing a few airports means they like it.

372
00:19:43,780 --> 00:19:45,020
They're probably going to go through with it.

373
00:19:45,060 --> 00:19:46,400
It's probably going to expand further.

374
00:19:47,440 --> 00:19:52,440
DHS has a program called Biometric Exit where everyone leaving the country,

375
00:19:52,620 --> 00:19:54,620
if you're not a citizen, you get your face scanned.

376
00:19:54,840 --> 00:19:56,940
You have to have your face scanned. No choice about it.

377
00:19:56,980 --> 00:19:58,960
If you want to fly out, your face is getting scanned.

378
00:20:01,120 --> 00:20:03,640
Lots of examples of law enforcement doing this.

379
00:20:05,040 --> 00:20:09,320
Most, well, I say interesting, but kind of the most uncomfortable one is Taser.

380
00:20:09,540 --> 00:20:13,060
They make the Taser devices. They make body cameras.

381
00:20:13,580 --> 00:20:18,200
One thing they want to do is incorporate live streaming of body cameras

382
00:20:19,120 --> 00:20:22,600
back to the police station so you can watch live what the police officers are seeing.

383
00:20:22,820 --> 00:20:26,980
They want to add live facial recognition to these streams sometime next year.

384
00:20:27,580 --> 00:20:28,700
They have all this data.

385
00:20:28,700 --> 00:20:31,960
All these hours and hours of video of people doing things.

386
00:20:32,140 --> 00:20:37,240
They want to apply machine learning, AI to it, all that fun stuff

387
00:20:38,820 --> 00:20:40,780
to figure out what leads to criminal behavior.

388
00:20:40,960 --> 00:20:42,160
How do you track people across time?

389
00:20:42,340 --> 00:20:43,600
How do you predict future events?

390
00:20:47,440 --> 00:20:50,700
There was an article earlier this year about facial recognition in China.

391
00:20:51,600 --> 00:20:54,200
It's part of daily life there. They gave lots of just mundane examples.

392
00:20:54,920 --> 00:20:56,320
You jaywalk across the street.

393
00:20:56,500 --> 00:20:57,560
Camera takes your picture.

394
00:20:57,560 --> 00:20:58,620
Puts it up on a big screen.

395
00:20:59,340 --> 00:21:01,260
You get shamed for jaywalking.

396
00:21:01,500 --> 00:21:02,440
You go to KFC.

397
00:21:02,760 --> 00:21:04,280
The camera scans your face.

398
00:21:04,360 --> 00:21:05,040
Guesses your age.

399
00:21:07,680 --> 00:21:08,420
We'll go with that.

400
00:21:08,800 --> 00:21:09,700
It guesses your age.

401
00:21:09,800 --> 00:21:10,480
Guesses your gender.

402
00:21:10,740 --> 00:21:14,040
And it serves you a customized meal based on what it thinks you might like.

403
00:21:15,540 --> 00:21:16,740
Stops toilet theft at parks.

404
00:21:17,400 --> 00:21:19,420
It scans your face.

405
00:21:19,600 --> 00:21:25,540
You're limited to two feet of toilet paper every nine minutes to stop toilet paper theft.

406
00:21:27,020 --> 00:21:27,540
According to the law, it's not a problem.

407
00:21:27,540 --> 00:21:28,000
According to the article.

408
00:21:32,000 --> 00:21:36,260
The stated purpose is to influence behavior and identify lawbreakers.

409
00:21:37,520 --> 00:21:42,800
All these worries about facial recognition creeping into daily life and how it's going to play out.

410
00:21:42,940 --> 00:21:44,700
It's already happening in China.

411
00:21:44,820 --> 00:21:49,220
When you have that kind of control, you can implement it everywhere.

412
00:21:51,600 --> 00:21:53,140
Some defense against it.

413
00:21:53,660 --> 00:21:54,940
Don't have a social media profile.

414
00:21:55,220 --> 00:21:55,780
Don't get arrested.

415
00:21:55,780 --> 00:21:56,820
Don't travel by plane.

416
00:21:56,980 --> 00:21:57,520
Don't live in China.

417
00:21:57,660 --> 00:21:58,360
Don't go out in public.

418
00:21:59,280 --> 00:22:00,660
That's kind of where it's heading.

419
00:22:00,980 --> 00:22:02,720
You can wear a mask in the U.S.

420
00:22:02,720 --> 00:22:07,600
Except in 13 states, there's laws against wearing a mask in some cases.

421
00:22:07,680 --> 00:22:08,800
Most of them are like this.

422
00:22:09,120 --> 00:22:11,640
You can't wear it when you're in the commission of a crime.

423
00:22:11,940 --> 00:22:14,180
When you're trying to run away from a crime.

424
00:22:14,300 --> 00:22:15,960
So if you're wearing a mask, it's like an additional charge.

425
00:22:17,260 --> 00:22:22,540
Some states, some laws in the south, they made these laws in response to the KKK.

426
00:22:23,160 --> 00:22:25,060
They always wear the silly hoods.

427
00:22:25,060 --> 00:22:28,060
So they passed laws saying you couldn't cover your face like that out in public.

428
00:22:29,120 --> 00:22:31,920
So there's, I think D.C. has some laws, too.

429
00:22:32,060 --> 00:22:35,640
There's some places you can't cover your face at all in public areas for security concerns.

430
00:22:37,280 --> 00:22:37,980
Oops, sorry.

431
00:22:38,060 --> 00:22:38,620
I'll get to that in a second.

432
00:22:38,820 --> 00:22:41,680
But this is, and some countries have even more restrictive laws.

433
00:22:41,740 --> 00:22:43,620
You can't wear a mask, can't cover your face at all.

434
00:22:45,920 --> 00:22:49,480
So other ways to thwart facial recognition that don't involve masks.

435
00:22:49,980 --> 00:22:53,000
A gentleman by the name of Adam Harvey did some work several years ago.

436
00:22:53,340 --> 00:22:54,660
He looked at how the,

437
00:22:55,060 --> 00:22:57,160
facial recognition software does its thing,

438
00:22:57,220 --> 00:23:00,160
how does it identify a face as a face and match it to another face.

439
00:23:01,060 --> 00:23:03,400
And it's essentially, I want to make sure I get this right.

440
00:23:03,500 --> 00:23:07,760
Yeah, so it's software that's looking at it.

441
00:23:07,800 --> 00:23:08,300
It's not a person.

442
00:23:08,340 --> 00:23:09,520
It doesn't interpret faces like we do.

443
00:23:09,620 --> 00:23:13,620
So it looks for differences in color in the areas of the face.

444
00:23:13,700 --> 00:23:15,640
You know, it goes from an eye to a nose to an eye.

445
00:23:15,700 --> 00:23:19,280
The color changes at such a degree and the two sides are symmetrical.

446
00:23:21,060 --> 00:23:24,900
So he did some experiments with hair and makeup to confuse facial recognition.

447
00:23:25,060 --> 00:23:26,560
You have high contrasting areas.

448
00:23:26,940 --> 00:23:30,020
You have hair, something that comes down and covers the bridge of the nose

449
00:23:30,020 --> 00:23:31,260
and breaks up that symmetry.

450
00:23:32,440 --> 00:23:33,440
And they're all highly effective.

451
00:23:33,640 --> 00:23:34,960
And he spoke earlier this year at a conference,

452
00:23:35,140 --> 00:23:38,260
the 33C3 conference in Berlin.

453
00:23:39,200 --> 00:23:39,880
Watched the video.

454
00:23:39,960 --> 00:23:41,660
He kind of explained how it works, goes through it.

455
00:23:41,680 --> 00:23:44,060
Super interesting to see how it's done.

456
00:23:44,520 --> 00:23:49,200
But this is one way you can wear makeup and not wear a mask but still go out in public.

457
00:23:50,680 --> 00:23:51,760
3D printed face cages.

458
00:23:52,700 --> 00:23:53,620
Same type of concept.

459
00:23:53,620 --> 00:23:54,520
Just a little concept thing.

460
00:23:54,660 --> 00:23:59,780
But again, it's how to make a product that's easy to use, easy to make.

461
00:23:59,900 --> 00:24:00,580
And it does the same thing.

462
00:24:00,660 --> 00:24:02,360
Just break up the image of the face.

463
00:24:04,580 --> 00:24:09,220
These are some researchers that, again, looked at how the facial recognition software works.

464
00:24:09,620 --> 00:24:11,260
What can we do to thwart it?

465
00:24:11,340 --> 00:24:14,300
And they designed these glasses that had a color pattern that wouldn't fool a person.

466
00:24:14,740 --> 00:24:19,460
But the way the algorithm works, it took a picture of the top and it returned the bottom as the match.

467
00:24:22,100 --> 00:24:22,460
Yeah.

468
00:24:24,340 --> 00:24:26,840
And it's not like the same pair of glasses works everywhere.

469
00:24:26,920 --> 00:24:28,640
You have to know how the software works to do it.

470
00:24:28,700 --> 00:24:29,680
But it's just kind of demonstrating.

471
00:24:30,260 --> 00:24:37,100
Something I'll touch on later is feeding bad input into an AI to fool it, to trick it.

472
00:24:39,180 --> 00:24:40,100
Lots of other possibilities.

473
00:24:40,460 --> 00:24:43,880
I was doing some research into how do you thwart facial recognition for this talk.

474
00:24:44,000 --> 00:24:46,400
And I came across just some cool ideas that might work.

475
00:24:47,500 --> 00:24:51,020
All kinds of weird masks, but maybe it would work in some places.

476
00:24:54,000 --> 00:24:55,040
T-shirts you can buy.

477
00:24:56,060 --> 00:24:56,600
Yeah, yeah.

478
00:24:56,620 --> 00:24:57,340
You can buy them on eBay.

479
00:24:57,420 --> 00:24:57,740
They're awesome.

480
00:24:58,500 --> 00:24:59,880
There's like 30 to choose from.

481
00:25:00,180 --> 00:25:03,440
I imagine this would give Facebook fits if you have a picture of you wearing this.

482
00:25:03,520 --> 00:25:04,220
Like 15 bucks.

483
00:25:08,540 --> 00:25:08,900
Yeah.

484
00:25:09,840 --> 00:25:11,320
Build privacy into clothing.

485
00:25:12,140 --> 00:25:13,020
I'm wearing this shirt now.

486
00:25:13,080 --> 00:25:13,540
It's pretty cool.

487
00:25:13,760 --> 00:25:14,680
It's like this.

488
00:25:14,700 --> 00:25:15,120
It's down.

489
00:25:15,180 --> 00:25:17,900
If you want to just pull it up, it pulls right over your head into a hood.

490
00:25:18,760 --> 00:25:20,340
Would that count as wearing a mask?

491
00:25:21,360 --> 00:25:22,260
Wintertime, you're probably okay.

492
00:25:22,260 --> 00:25:23,540
Summertime might be a bit weird.

493
00:25:24,460 --> 00:25:30,500
But I have seen just like a little bit of this, of fashion geared towards privacy or a jacket that's highly reflective.

494
00:25:30,560 --> 00:25:34,740
So when you take a picture, it reflects all the light back into the camera and overexposes it.

495
00:25:34,820 --> 00:25:36,020
You can't see the person's face.

496
00:25:36,360 --> 00:25:41,240
So it's kind of a new and interesting fashion niche.

497
00:25:42,820 --> 00:25:43,220
Okay.

498
00:25:43,280 --> 00:25:51,460
So let's imagine a world where everyone cares about anonymity so much you wear masks out in public all the time.

499
00:25:51,460 --> 00:25:53,380
This is a really cool comic book.

500
00:25:53,520 --> 00:25:54,400
It's called Private Eye.

501
00:25:54,780 --> 00:25:57,360
And it's a detective noir story.

502
00:25:57,760 --> 00:26:04,280
But the world that it's in is in the future when someone's out in public, they're always wearing a mask all the time.

503
00:26:04,420 --> 00:26:05,920
You only take it off in front of your family.

504
00:26:06,480 --> 00:26:07,760
And it's not really central to the story.

505
00:26:07,840 --> 00:26:08,900
It's kind of the background to it.

506
00:26:08,980 --> 00:26:14,400
But it's super interesting just to envision that kind of a future where in public you're always covered.

507
00:26:16,460 --> 00:26:18,920
You can get a PDF copy, pay what you want.

508
00:26:19,000 --> 00:26:20,920
You can order a printed book online.

509
00:26:20,920 --> 00:26:22,360
Again, really cool reading.

510
00:26:23,800 --> 00:26:25,520
Really fun to envision that kind of future.

511
00:26:29,100 --> 00:26:30,820
So, yeah, facial recognition.

512
00:26:31,160 --> 00:26:37,720
That's why I had the other experiments in legally thwarting facial recognition.

513
00:26:37,980 --> 00:26:41,440
These little filter masks you wear in public, you know, to prevent SARS and so on.

514
00:26:42,260 --> 00:26:43,860
They make black ones, blue ones, whatever.

515
00:26:44,520 --> 00:26:45,960
Honestly, I have like 40 of these.

516
00:26:46,040 --> 00:26:47,520
If you want one, come see me afterwards.

517
00:26:48,080 --> 00:26:50,240
I talked to security guys at the casino.

518
00:26:50,380 --> 00:26:50,820
They were like,

519
00:26:50,920 --> 00:26:52,300
Yeah, these are probably okay to wear.

520
00:26:52,420 --> 00:26:54,760
How are you going to tell someone not to stay healthy when you're in public?

521
00:26:57,240 --> 00:26:57,780
Novelty glasses.

522
00:26:58,080 --> 00:26:59,040
I mean, they're kind of silly.

523
00:26:59,140 --> 00:27:02,860
But when I saw these at the store, I held my camera to take a picture.

524
00:27:03,040 --> 00:27:04,020
It couldn't find my face.

525
00:27:04,800 --> 00:27:08,820
The blue and green and black ones, it found my face.

526
00:27:09,040 --> 00:27:09,880
White and gold.

527
00:27:10,180 --> 00:27:11,240
Couldn't find my face at all.

528
00:27:11,380 --> 00:27:17,140
So, again, just the high contrast, the weird lines, throws off basic facial recognition software.

529
00:27:17,640 --> 00:27:18,720
And it's not going to get you arrested.

530
00:27:18,920 --> 00:27:20,780
So, I hope.

531
00:27:20,780 --> 00:27:27,900
If facial recognition spreads, then an awareness of how to get around it and thwart it, research into that spreads.

532
00:27:29,120 --> 00:27:33,300
Also, the legal and policy complications of, do we outlaw masks?

533
00:27:33,620 --> 00:27:34,160
What kind of masks?

534
00:27:34,360 --> 00:27:34,960
When can you wear it?

535
00:27:35,000 --> 00:27:35,760
When can you not wear it?

536
00:27:35,980 --> 00:27:38,480
That may become an issue in the next five, ten years.

537
00:27:40,800 --> 00:27:41,240
Okay.

538
00:27:41,980 --> 00:27:42,640
Moving on.

539
00:27:42,940 --> 00:27:44,680
Geofence content delivery and user identification.

540
00:27:45,120 --> 00:27:45,560
Geofencing.

541
00:27:45,780 --> 00:27:46,960
A quick history of it.

542
00:27:47,980 --> 00:27:50,600
In the 90s and early 2000s.

543
00:27:50,600 --> 00:27:52,360
It was used for very basic stuff.

544
00:27:52,520 --> 00:27:53,860
Location-based tracking.

545
00:27:55,020 --> 00:27:56,120
Monitoring your vehicle fleet.

546
00:27:56,320 --> 00:27:58,840
Sending out emergency notifications to everyone inside of an area.

547
00:27:59,620 --> 00:28:03,760
Geofencing is basically, you put an imaginary circle around GPS coordinates.

548
00:28:04,080 --> 00:28:08,920
And any phones, any devices in that circle get some kind of special notice.

549
00:28:08,940 --> 00:28:09,780
Some kind of special activity.

550
00:28:10,280 --> 00:28:13,460
So, when someone enters a circle, maybe they get a text message.

551
00:28:13,580 --> 00:28:15,260
When you're leaving, maybe you get a text message.

552
00:28:15,560 --> 00:28:18,960
When a fleet vehicle drives out of that circle, the company gets a warning.

553
00:28:19,020 --> 00:28:20,340
Hey, this vehicle just left.

554
00:28:20,340 --> 00:28:20,820
Your area.

555
00:28:22,040 --> 00:28:24,900
So, very utilitarian origin.

556
00:28:26,600 --> 00:28:29,920
2002 was first started to be used as a way to identify mobile device users.

557
00:28:30,240 --> 00:28:31,880
And let's send them a custom content.

558
00:28:32,000 --> 00:28:32,500
Let's send them a message.

559
00:28:32,580 --> 00:28:36,520
Hey, Bob's Pizza has a special right down the road from you.

560
00:28:36,560 --> 00:28:36,900
Come on by.

561
00:28:38,880 --> 00:28:42,380
And only the past five, eight, well, seven years.

562
00:28:42,420 --> 00:28:42,960
Five, seven years.

563
00:28:43,260 --> 00:28:44,900
It's becoming something more.

564
00:28:44,960 --> 00:28:45,640
An enhancement feature.

565
00:28:45,840 --> 00:28:48,280
Your apps do something extra when you're nearby a location.

566
00:28:48,420 --> 00:28:49,080
An area.

567
00:28:49,980 --> 00:28:53,440
Businesses can do really focused targeting to people who come by where they are.

568
00:28:56,100 --> 00:29:03,520
But there is this example of how it can be, well, depending on what you feel about abortion,

569
00:29:03,740 --> 00:29:08,940
whether it's used or misused, but certainly a controversial use case for geofencing.

570
00:29:09,940 --> 00:29:12,720
In 2015, an advertising executive had an idea.

571
00:29:13,000 --> 00:29:16,980
Instead of using his mobile surveillance techniques to figure out which consumers might be interested

572
00:29:16,980 --> 00:29:18,420
in buying shoes or cars,

573
00:29:19,080 --> 00:29:23,840
what if you could use the same technology to figure out which women were potentially contemplating abortion

574
00:29:23,840 --> 00:29:27,340
and send them ads on behalf of anti-abortion organizations?

575
00:29:29,060 --> 00:29:33,260
The targeting of women seeking abortion presents a serious, well, I'm sorry, I'm getting ahead of myself.

576
00:29:35,340 --> 00:29:37,580
So Guy runs an advertising technology company.

577
00:29:37,700 --> 00:29:42,840
He can target people, send ads to people in a certain area because apps on your phone are free

578
00:29:42,840 --> 00:29:45,560
and they send data back to an ad company.

579
00:29:45,920 --> 00:29:47,400
This person has this phone.

580
00:29:47,460 --> 00:29:48,500
They're at this GPS location.

581
00:29:49,920 --> 00:29:53,680
And they tie that in with other information to build an advertising profile.

582
00:29:54,260 --> 00:29:59,020
So they can say, hey, there's a woman inside the GPS coordinates around this abortion clinic.

583
00:29:59,300 --> 00:30:00,620
She's there. She's sitting there.

584
00:30:00,980 --> 00:30:02,560
She might be there considering abortion.

585
00:30:03,380 --> 00:30:07,700
So Guy realized, I'm going to sell ads to anti-abortion groups

586
00:30:08,360 --> 00:30:11,340
so that this woman, when she's on her phone looking at web pages,

587
00:30:11,600 --> 00:30:16,800
she gets ads to go see the anti-abortion clinic in her city.

588
00:30:16,960 --> 00:30:17,080
You know?

589
00:30:19,200 --> 00:30:22,520
So it's a very creepy thing to do, a very targeted thing to do,

590
00:30:22,580 --> 00:30:23,540
where you're sitting there.

591
00:30:24,300 --> 00:30:25,040
I'm not a woman.

592
00:30:25,120 --> 00:30:30,600
I can't imagine what it would be like to sit there and be in that kind of situation.

593
00:30:31,100 --> 00:30:33,520
And you're getting ads targeted to try to tell you to go do something else.

594
00:30:33,560 --> 00:30:34,140
You're vulnerable.

595
00:30:34,440 --> 00:30:37,880
You're there for something medical and personal and emotional.

596
00:30:38,920 --> 00:30:40,480
And you get that kind of messaging.

597
00:30:42,560 --> 00:30:44,380
So it was legal but ethically questionable.

598
00:30:49,520 --> 00:30:52,440
So he got called out on it.

599
00:30:52,460 --> 00:30:53,200
They stopped doing it.

600
00:30:55,120 --> 00:31:00,160
There wasn't really any ramifications for it other than just kind of some bad publicity for them.

601
00:31:00,480 --> 00:31:04,780
But he showed it was certainly possible to target people in specific ways at certain locations.

602
00:31:05,440 --> 00:31:08,820
The Attorney General of Massachusetts didn't investigate him.

603
00:31:09,040 --> 00:31:10,580
She did something proactive.

604
00:31:10,800 --> 00:31:15,280
She said, you know what, this activity is not allowed in our state.

605
00:31:16,120 --> 00:31:20,400
Consumers are entitled to privacy in their decisions and medical conditions, decisions and conditions.

606
00:31:20,980 --> 00:31:23,980
And they had a settlement with a company saying, you can't do this.

607
00:31:24,140 --> 00:31:28,140
You can't specifically target people going through medical procedures in our state.

608
00:31:28,260 --> 00:31:29,280
And the company agreed to do that.

609
00:31:29,540 --> 00:31:30,540
So it wasn't punitive.

610
00:31:30,660 --> 00:31:32,020
It was just a proactive thing.

611
00:31:32,180 --> 00:31:34,360
And I think they're the only state that's done anything like that.

612
00:31:37,400 --> 00:31:37,840
Okay.

613
00:31:39,100 --> 00:31:41,540
So other examples of using geofencing.

614
00:31:42,120 --> 00:31:45,140
Uber has had a bad year for a number of reasons.

615
00:31:45,280 --> 00:31:46,640
A bad press year.

616
00:31:47,040 --> 00:31:51,540
But one thing they got called out for doing was using, trying to identify city regulators.

617
00:31:52,380 --> 00:31:55,780
The people who go in and investigate is Uber following good business practices or not.

618
00:31:56,080 --> 00:31:59,220
So Uber wanted to know when these regulators were using their app.

619
00:31:59,460 --> 00:32:01,200
So they had a variety of techniques to do it.

620
00:32:01,280 --> 00:32:02,980
One was geofencing government offices.

621
00:32:03,320 --> 00:32:08,920
When someone in this government office called an Uber car, they're probably someone who works for the city.

622
00:32:09,140 --> 00:32:11,240
Let's look at a few more things to see if they're a regulator.

623
00:32:11,480 --> 00:32:15,260
And Uber did things like matching the owner of the credit card to a city official.

624
00:32:15,280 --> 00:32:15,480
The organization.

625
00:32:17,980 --> 00:32:20,080
The city regulators have city budgets.

626
00:32:20,280 --> 00:32:25,160
So if they want to get a phone to use Uber, they would go out to the nearest store and buy the cheapest Android phone.

627
00:32:25,420 --> 00:32:31,000
So Uber sent people out to say what Android phones are being sold at the stores near their offices.

628
00:32:31,640 --> 00:32:33,460
And it collected a list.

629
00:32:33,640 --> 00:32:42,200
So when someone installed Uber on one of these devices, again, another red flag for Uber saying, okay, cheap phone available near the city regulator office.

630
00:32:42,360 --> 00:32:44,900
They just called an Uber car from this geofencing area.

631
00:32:45,880 --> 00:32:46,860
They're probably a regulator.

632
00:32:47,100 --> 00:32:54,680
So we're going to do our service differently for them so we don't raise any red flags for them and so we fly under the radar.

633
00:32:57,920 --> 00:33:04,040
So with geofencing, it hasn't used a lot, but I certainly see some malicious potential there.

634
00:33:05,700 --> 00:33:07,680
Spearfencing, geofishing, choose the term you like.

635
00:33:08,160 --> 00:33:12,580
But, again, kind of playing off the advertiser who targeted women at abortion clinics.

636
00:33:12,760 --> 00:33:14,660
You can easily take that a few steps further.

637
00:33:15,280 --> 00:33:22,880
And target people at a polling station, rehab centers, domestic abuse shelter, a church of whatever kind of church you don't like.

638
00:33:23,560 --> 00:33:28,140
And not just serve them advertising, but serve them malicious advertising.

639
00:33:28,380 --> 00:33:30,120
Serve them phishing websites.

640
00:33:31,440 --> 00:33:32,340
Target journalists.

641
00:33:32,440 --> 00:33:33,100
Target your legislators.

642
00:33:33,420 --> 00:33:39,320
Put a geofence around the capital and serve it whatever kind of ads you want when ads are in session.

643
00:33:39,520 --> 00:33:41,980
All your legislators are on their phone.

644
00:33:42,760 --> 00:33:44,960
The chance that any of them are using ad blockers.

645
00:33:45,280 --> 00:33:46,240
Probably very, very low.

646
00:33:47,840 --> 00:33:49,120
Unfortunately, we should educate them.

647
00:33:49,180 --> 00:33:49,860
But that's another argument.

648
00:33:50,180 --> 00:33:51,500
So anyway, there's lots of potential here.

649
00:33:51,560 --> 00:33:52,800
I haven't seen any examples of this.

650
00:33:53,320 --> 00:33:56,160
Maybe one of you all can do this for a talk next year at DEF CON.

651
00:33:59,040 --> 00:34:00,260
So defense for this.

652
00:34:02,220 --> 00:34:04,280
Disabled location services, don't install the free apps.

653
00:34:04,440 --> 00:34:07,600
If it's free and it's a game you're playing, woohoo, you might see ads.

654
00:34:07,760 --> 00:34:10,480
But it's usually collecting information on you about your phone.

655
00:34:10,760 --> 00:34:12,520
You can turn off the permissions if you want.

656
00:34:12,740 --> 00:34:14,440
You can install an ad blocker on browsers.

657
00:34:16,640 --> 00:34:20,420
Ublock Origin is kind of the running suggestion in the infosec world.

658
00:34:20,660 --> 00:34:21,420
I use it.

659
00:34:21,620 --> 00:34:24,380
I suggest it.

660
00:34:25,080 --> 00:34:25,960
Or just be aware.

661
00:34:26,260 --> 00:34:28,080
Hey, I'm getting a weird ad I haven't seen before.

662
00:34:28,580 --> 00:34:29,860
It's related to where I am.

663
00:34:29,980 --> 00:34:30,320
Okay.

664
00:34:30,480 --> 00:34:31,860
Well, let me not click on that.

665
00:34:35,580 --> 00:34:35,980
Okay.

666
00:34:37,260 --> 00:34:38,060
Device fingerprinting.

667
00:34:40,500 --> 00:34:44,720
So this is something, again, well, identify.

668
00:34:44,720 --> 00:34:46,700
Identify a device over and over again.

669
00:34:47,460 --> 00:34:50,760
Collect information on the hardware, the software, how it connects to your web server.

670
00:34:52,020 --> 00:34:53,260
Mostly used to prevent fraud.

671
00:34:54,520 --> 00:34:58,280
It's really, some of the research I've seen about this comes out of India.

672
00:34:58,640 --> 00:35:02,500
But I know companies in the U.S. and elsewhere use it to identify when fraudulent transactions are happening.

673
00:35:02,820 --> 00:35:04,200
How do we know it's the same person?

674
00:35:04,300 --> 00:35:05,960
How do we know it's fraudulent?

675
00:35:06,140 --> 00:35:09,180
You have to have some kind of warning or trigger or red flags.

676
00:35:09,740 --> 00:35:11,880
One way they do it is to identify a device.

677
00:35:11,980 --> 00:35:13,720
It's the same device being used over and over again.

678
00:35:16,800 --> 00:35:19,080
Extension of that is browser fingerprinting.

679
00:35:21,280 --> 00:35:23,560
Identify the same person coming back to the same website.

680
00:35:23,760 --> 00:35:27,820
If they can't, there's two ways to do this.

681
00:35:28,360 --> 00:35:30,980
You can, you go to a website.

682
00:35:31,240 --> 00:35:35,480
It runs HTML5 code that maybe in the background you can't see it.

683
00:35:35,540 --> 00:35:37,860
But it tells the browser to draw a small image.

684
00:35:38,920 --> 00:35:39,980
Every computer is different.

685
00:35:40,160 --> 00:35:41,140
Every GPU is different.

686
00:35:41,620 --> 00:35:42,540
Graphics driver is different.

687
00:35:42,660 --> 00:35:43,980
All these small differences.

688
00:35:43,980 --> 00:35:46,400
Can make the image be rendered differently.

689
00:35:46,860 --> 00:35:49,240
And the website measures how that image is rendered.

690
00:35:49,440 --> 00:35:53,400
And it says, okay, this browser renders this image this way and it has these characteristics.

691
00:35:53,860 --> 00:35:55,820
And we also saw those characteristics a week ago.

692
00:35:55,900 --> 00:35:58,420
We think it's the same browser, the same person coming back.

693
00:36:01,860 --> 00:36:02,720
Another way to do it.

694
00:36:02,740 --> 00:36:06,980
Let's say you use Firefox for some tasks and Chrome for other tasks, i.e. for other stuff.

695
00:36:07,820 --> 00:36:11,440
How does an advertising company correlate those three browsers to one person?

696
00:36:12,420 --> 00:36:13,280
Same type of thing.

697
00:36:13,280 --> 00:36:16,280
All these browsers are running on the same computer.

698
00:36:16,700 --> 00:36:17,980
They're all using the same hardware resources.

699
00:36:18,460 --> 00:36:23,460
So, again, they're all going to have the same kind of signature once you understand how browsers work and how they render images.

700
00:36:23,820 --> 00:36:32,880
You can, again, do some complicated coding and correlation to find out, hey, yes, we think these two or three browsers are the same person, actually, on the same device.

701
00:36:34,840 --> 00:36:39,220
And I say unblockable because, I mean, it used to be erase your cookies.

702
00:36:39,380 --> 00:36:41,180
Then it was erase the super cookies.

703
00:36:41,180 --> 00:36:43,680
And then clear your flash settings.

704
00:36:44,600 --> 00:36:46,840
And then it was, you know, use a proxy.

705
00:36:46,920 --> 00:36:47,760
Use a VPN.

706
00:36:47,960 --> 00:36:53,740
But it's definitely a cat and mouse game of websites and advertisers trying to identify the same people coming back.

707
00:36:53,860 --> 00:36:54,660
That's their business model.

708
00:36:54,740 --> 00:36:56,200
They want to identify who's using it.

709
00:36:56,560 --> 00:37:02,000
So it's gotten, I mean, there's, these are just a few small examples of websites we can go to.

710
00:37:02,260 --> 00:37:06,080
And they'll demonstrate what can a website learn from your browser.

711
00:37:06,220 --> 00:37:07,600
What kind of information can it collect?

712
00:37:07,680 --> 00:37:08,460
What is your browser leaking?

713
00:37:08,460 --> 00:37:11,280
And there's just hundreds of hundreds of data points on here.

714
00:37:11,660 --> 00:37:13,160
And you can block some.

715
00:37:13,480 --> 00:37:18,000
You can, and there's still enough they can collect on you to make a correlation.

716
00:37:20,180 --> 00:37:21,960
Faking it is not an option.

717
00:37:22,080 --> 00:37:28,380
You have to understand how it works before you can provide data that actually looks fake and can fool them.

718
00:37:28,840 --> 00:37:33,540
The last website, click, click, click, dot, click, is a gamified version of this.

719
00:37:33,660 --> 00:37:38,440
You go there and it has a scrolling screen, kind of, and a voice that reads out loud what you're doing.

720
00:37:38,440 --> 00:37:40,540
Oh, you've moved the mouse to the top right.

721
00:37:40,780 --> 00:37:42,040
You've been there for five seconds.

722
00:37:42,200 --> 00:37:42,660
Very good.

723
00:37:43,040 --> 00:37:44,080
You've clicked five times.

724
00:37:44,240 --> 00:37:44,640
Very good.

725
00:37:45,100 --> 00:37:46,300
And it has, like, this little score.

726
00:37:46,400 --> 00:37:47,600
Like, it has achievements on it, too.

727
00:37:47,720 --> 00:37:50,960
So, again, it just, it's click a hundred times.

728
00:37:51,120 --> 00:37:52,600
Click five times in less than a second.

729
00:37:53,240 --> 00:37:58,160
And it's just a way to demonstrate how websites collect everything you're doing, what you're doing on the page.

730
00:38:01,960 --> 00:38:03,140
So, defense for this.

731
00:38:03,860 --> 00:38:05,100
You can try to play the game.

732
00:38:05,240 --> 00:38:07,440
You know, compartmentalize even further.

733
00:38:07,440 --> 00:38:10,800
Have different browsers and different VMs and a different VPN for each one.

734
00:38:11,240 --> 00:38:14,000
And switch up your configuration of your VMs.

735
00:38:14,740 --> 00:38:16,040
Try to figure out what they're measuring.

736
00:38:16,600 --> 00:38:20,000
And this is all, again, so you're not going to be tracked by advertisers.

737
00:38:22,420 --> 00:38:26,700
You can, there's a few extensions that are kind of built for this.

738
00:38:26,740 --> 00:38:28,000
EFS Privacy Badger.

739
00:38:28,560 --> 00:38:30,840
Again, uBlock Origin, which does a lot more than blocking ads.

740
00:38:31,640 --> 00:38:36,940
It blocks all kinds of trackers and lead generation sites and other stuff, as well,

741
00:38:36,940 --> 00:38:40,040
that makes just web pages a whole lot cleaner, a whole lot faster.

742
00:38:41,000 --> 00:38:42,100
You can block JavaScript.

743
00:38:42,240 --> 00:38:43,000
You can use a Tor browser.

744
00:38:43,840 --> 00:38:46,740
You can also visit your local library and use their computers for your activity.

745
00:38:47,000 --> 00:38:49,840
Lots of people use the same computer, so your activity is going to get lost.

746
00:38:50,820 --> 00:38:53,360
Plus, local public libraries are very cool.

747
00:38:58,040 --> 00:38:58,480
Okay.

748
00:38:58,980 --> 00:39:00,540
Cross-device user tracking.

749
00:39:00,700 --> 00:39:03,900
Extension of identifying, a different way to identify people.

750
00:39:06,160 --> 00:39:08,960
Instead of just trying to identify different browsers on one device,

751
00:39:09,160 --> 00:39:11,320
you want to track the same person across multiple devices.

752
00:39:12,300 --> 00:39:18,880
A lot of us have a phone, a laptop, a second laptop, a TV, a camera,

753
00:39:19,100 --> 00:39:23,700
all kinds of devices that are connected and we use in different ways.

754
00:39:23,940 --> 00:39:27,700
Advertisers want to track that same person across all the devices they use at work,

755
00:39:27,760 --> 00:39:30,060
at home, on their work phone, on their home phone.

756
00:39:31,120 --> 00:39:32,680
So a couple ways that they go about this.

757
00:39:33,140 --> 00:39:33,880
Probabilistic and deterministic.

758
00:39:33,900 --> 00:39:39,920
You collect large amounts of data and you say this device was coming from this IP address

759
00:39:39,920 --> 00:39:41,320
and has this browser fingerprint.

760
00:39:42,680 --> 00:39:47,700
And it's probable that this person used this laptop on a home IP address

761
00:39:47,700 --> 00:39:51,320
and their phone on the same IP address and it went to some of the same websites,

762
00:39:51,500 --> 00:39:53,960
so we think this phone and this laptop are the same people.

763
00:39:55,480 --> 00:39:57,040
The other way is deterministic.

764
00:39:57,400 --> 00:39:59,700
I log in with my email address at site A.

765
00:39:59,800 --> 00:40:01,660
I log in with the same email address at site B.

766
00:40:02,120 --> 00:40:03,880
It's obviously determined that it's the same person.

767
00:40:03,880 --> 00:40:06,180
On the same website, or on the two websites.

768
00:40:06,660 --> 00:40:10,540
Even if one was on the laptop and one was on the public library computer.

769
00:40:15,440 --> 00:40:18,880
One way cross-device tracking is done is ultrasound beaconing.

770
00:40:19,700 --> 00:40:22,840
A device, usually a TV, has ultrasonic audio signal.

771
00:40:23,140 --> 00:40:24,480
They're an advertisement that plays.

772
00:40:24,620 --> 00:40:28,360
It's audio that we can't hear, but an app installed on your phone

773
00:40:28,820 --> 00:40:31,740
or code that's part of an app on your phone

774
00:40:33,020 --> 00:40:35,260
is sitting there waiting and listening for.

775
00:40:35,540 --> 00:40:38,780
And the app hears the ultrasonic signal

776
00:40:38,780 --> 00:40:40,580
and sends a message back to the advertising company.

777
00:40:40,880 --> 00:40:43,500
Yep, this person with advertising ID such and such

778
00:40:44,120 --> 00:40:46,400
heard this ad at this time on TV.

779
00:40:46,760 --> 00:40:48,140
So we're going to wait to show

780
00:40:48,540 --> 00:40:50,920
we know this person is watching this show at this time.

781
00:40:51,000 --> 00:40:52,160
We're going to add it to the advertising profile

782
00:40:52,160 --> 00:40:54,380
and we can better sell our advertising services.

783
00:40:55,060 --> 00:40:57,960
So we can paint a fuller picture of who you're selling to.

784
00:40:59,760 --> 00:41:01,720
2015, the Center for Democracy in Texas.

785
00:41:01,740 --> 00:41:02,060
It's a technology.

786
00:41:02,140 --> 00:41:03,660
A whole bunch of really cool and smart people

787
00:41:03,660 --> 00:41:06,120
called attention out to a company called Silverpush

788
00:41:07,060 --> 00:41:08,220
that did this.

789
00:41:08,340 --> 00:41:11,420
And this is kind of the news story that broke this activity.

790
00:41:13,360 --> 00:41:16,980
FTC produced a big long letter warning against it.

791
00:41:18,180 --> 00:41:19,280
Silverpush is the name of the company,

792
00:41:19,380 --> 00:41:21,740
but this kind of technology, from what I've read,

793
00:41:21,800 --> 00:41:23,540
hasn't caught on much in the U.S.

794
00:41:24,280 --> 00:41:26,400
because of the FTC and others.

795
00:41:26,560 --> 00:41:29,000
But here it's pretty popular in other countries.

796
00:41:29,040 --> 00:41:30,040
In India, it's used elsewhere.

797
00:41:30,040 --> 00:41:33,200
So other countries don't have the same protections that we do

798
00:41:33,200 --> 00:41:35,020
or the same concern about this kind of tracking.

799
00:41:36,440 --> 00:41:38,600
So that kind of, as a quick aside,

800
00:41:38,740 --> 00:41:39,860
a lot of the stuff I talk about,

801
00:41:39,980 --> 00:41:42,780
a lot of the defense and the collection methods

802
00:41:42,780 --> 00:41:45,280
are really U.S.-centric, Western European-centric.

803
00:41:45,700 --> 00:41:48,020
There's not a lot of data on how collection methods are done

804
00:41:48,020 --> 00:41:49,220
in other parts of the world

805
00:41:49,220 --> 00:41:53,940
or what kind of defenses and technology people there have.

806
00:41:56,380 --> 00:41:57,180
It's really interesting.

807
00:41:57,320 --> 00:41:59,680
The website Ubixec goes a lot into the privacy

808
00:42:00,040 --> 00:42:01,060
and security research

809
00:42:01,060 --> 00:42:03,260
and to the ultrasound tracking ecosystem.

810
00:42:06,240 --> 00:42:08,080
The FTC put out a report earlier this year.

811
00:42:08,760 --> 00:42:11,460
Again, looking at cross-device user tracking

812
00:42:12,040 --> 00:42:13,940
and just user tracking in general.

813
00:42:14,140 --> 00:42:16,060
And their conclusion is kind of obvious

814
00:42:16,060 --> 00:42:17,160
to anyone who's been paying attention.

815
00:42:17,540 --> 00:42:19,600
A lot of tracking takes place without our knowledge.

816
00:42:19,840 --> 00:42:21,980
We have limited choices to control that tracking.

817
00:42:22,280 --> 00:42:24,180
And the collection of all this data

818
00:42:24,180 --> 00:42:26,720
results in more and more sensitive data

819
00:42:26,720 --> 00:42:27,860
that needs to be protected.

820
00:42:29,520 --> 00:42:30,020
So, yeah.

821
00:42:30,040 --> 00:42:30,920
There's an article,

822
00:42:31,060 --> 00:42:31,940
How Much Is Your Consent Worth?

823
00:42:32,020 --> 00:42:33,560
There's a company that says,

824
00:42:33,640 --> 00:42:36,940
Hey, we will pay you if you install this device on your TV

825
00:42:36,940 --> 00:42:39,040
and let us track what you watch.

826
00:42:39,140 --> 00:42:40,200
It's not a Nielsen company.

827
00:42:40,360 --> 00:42:41,220
Nielsen's kind of...

828
00:42:42,100 --> 00:42:44,020
Their tracking is not as effective anymore.

829
00:42:44,700 --> 00:42:45,740
So this company said,

830
00:42:45,860 --> 00:42:46,880
We'll install this device

831
00:42:46,880 --> 00:42:48,860
and we'll pay you $5 to $12 a month

832
00:42:48,860 --> 00:42:50,420
to record everything you're watching.

833
00:42:50,640 --> 00:42:52,280
So that's, I guess, the going rate

834
00:42:52,280 --> 00:42:53,580
for allowing yourself to be...

835
00:42:53,580 --> 00:42:55,200
to give consent to be tracked.

836
00:43:00,680 --> 00:43:01,640
Defense against this.

837
00:43:01,920 --> 00:43:03,180
Again, ad blocking.

838
00:43:03,500 --> 00:43:04,720
U-block origin is the way to go.

839
00:43:05,740 --> 00:43:06,580
If you want to,

840
00:43:06,640 --> 00:43:08,380
you can add some background audio noise to your life,

841
00:43:08,520 --> 00:43:09,340
ultrasound audio.

842
00:43:09,540 --> 00:43:10,720
I don't know how effective that's going to be.

843
00:43:11,300 --> 00:43:12,860
There's been some talk for phone manufacturers

844
00:43:12,860 --> 00:43:14,920
to disable these frequencies.

845
00:43:15,080 --> 00:43:16,880
Why should your phone catch ultrasonic frequencies?

846
00:43:17,760 --> 00:43:19,400
But that's up to the hardware manufacturers.

847
00:43:19,840 --> 00:43:21,440
You can also give the earbuds,

848
00:43:23,580 --> 00:43:25,020
the mic in them, but just disable the mic.

849
00:43:25,240 --> 00:43:26,000
That way your phone says,

850
00:43:26,140 --> 00:43:27,340
Hey, earbuds are plugged in with the mic.

851
00:43:28,100 --> 00:43:29,660
All audio goes through that mic.

852
00:43:29,840 --> 00:43:31,360
Then you break the mic physically

853
00:43:31,360 --> 00:43:34,200
and then your phone can't catch these signals anymore.

854
00:43:34,880 --> 00:43:37,080
I've heard you can buy devices that do the same thing.

855
00:43:42,400 --> 00:43:42,800
Okay.

856
00:43:43,140 --> 00:43:45,200
Retailer and municipal location tracking.

857
00:43:47,080 --> 00:43:47,940
Wi-Fi tracking.

858
00:43:49,660 --> 00:43:51,480
We have sensors spread across an area

859
00:43:51,480 --> 00:43:53,180
and you record the MAC address.

860
00:43:53,180 --> 00:43:54,400
That's broadcasted from your phone,

861
00:43:54,480 --> 00:43:56,180
from your laptop as it moves around an area,

862
00:43:56,320 --> 00:43:58,180
a building, a subway station,

863
00:43:58,700 --> 00:43:59,660
the public city.

864
00:44:00,380 --> 00:44:02,180
It records the MAC address and the signal strength

865
00:44:02,660 --> 00:44:05,100
and it does this to map a device's movement.

866
00:44:06,040 --> 00:44:06,440
Imagine,

867
00:44:07,440 --> 00:44:08,940
well, I'll have some examples here,

868
00:44:09,000 --> 00:44:10,960
but essentially a store wants to know

869
00:44:10,960 --> 00:44:11,920
where you move through a store,

870
00:44:12,040 --> 00:44:14,080
where you're moving through Nordstrom, for example.

871
00:44:14,600 --> 00:44:15,920
Where do you stop and look at?

872
00:44:16,060 --> 00:44:18,180
Where's your attention? How long are you at a certain display?

873
00:44:18,260 --> 00:44:19,400
Which displays do you skip?

874
00:44:19,400 --> 00:44:21,520
They care about that stuff

875
00:44:21,520 --> 00:44:23,040
so they can make their displays better

876
00:44:23,040 --> 00:44:26,160
and make their selling more effective.

877
00:44:28,160 --> 00:44:29,480
Not a lot of examples of these,

878
00:44:29,540 --> 00:44:30,440
but it definitely happens.

879
00:44:30,500 --> 00:44:31,640
Some kind of good and bad.

880
00:44:31,760 --> 00:44:34,780
London Subway Authority did this at 54 locations.

881
00:44:35,180 --> 00:44:36,740
They put up signs, full disclosure,

882
00:44:36,900 --> 00:44:38,120
that let people know what they were doing.

883
00:44:38,940 --> 00:44:41,120
But this kind of use, it makes sense.

884
00:44:41,200 --> 00:44:42,800
How are people moving through our subway stations?

885
00:44:42,980 --> 00:44:44,980
Where are they stopping? What services do they use?

886
00:44:45,780 --> 00:44:47,080
They didn't track websites.

887
00:44:47,340 --> 00:44:49,000
They didn't track usage or anything.

888
00:44:49,400 --> 00:44:50,700
They just wanted to map people's locations.

889
00:44:50,920 --> 00:44:53,660
There are some definitely useful applications

890
00:44:53,660 --> 00:44:54,940
of this kind of technology.

891
00:44:57,440 --> 00:44:58,320
Ah, 2016.

892
00:44:58,880 --> 00:45:01,160
This is interesting.

893
00:45:01,380 --> 00:45:02,180
It's not Wi-Fi tracking.

894
00:45:02,340 --> 00:45:04,500
It's tracking via your phone.

895
00:45:04,740 --> 00:45:07,100
The light bulbs in a store would flicker very quickly.

896
00:45:07,300 --> 00:45:08,520
Our eyes couldn't pick it up,

897
00:45:08,620 --> 00:45:11,780
but a cell phone's camera could.

898
00:45:12,000 --> 00:45:13,140
If you have an app installed

899
00:45:13,140 --> 00:45:15,080
that has access to the camera

900
00:45:15,080 --> 00:45:17,120
and is looking for those fast flickers,

901
00:45:17,240 --> 00:45:18,760
it can track where someone's moving

902
00:45:19,400 --> 00:45:19,700
from a grocery store.

903
00:45:20,460 --> 00:45:22,300
Again, to see how consumers use your store

904
00:45:22,300 --> 00:45:23,100
and how to make it better.

905
00:45:23,740 --> 00:45:25,020
There's a really cool book about this

906
00:45:25,020 --> 00:45:26,120
called The Isles Have Eyes,

907
00:45:26,860 --> 00:45:28,880
How Stores Track and Profile Customers.

908
00:45:29,600 --> 00:45:31,740
It just expands on this topic a whole lot.

909
00:45:34,560 --> 00:45:36,720
The defense to this is pretty obvious.

910
00:45:36,980 --> 00:45:38,660
Turn off your Wi-Fi when you're out at a store,

911
00:45:38,740 --> 00:45:39,340
when you're out in public.

912
00:45:39,440 --> 00:45:40,040
Turn off your Bluetooth.

913
00:45:40,360 --> 00:45:41,020
They aren't on.

914
00:45:41,200 --> 00:45:42,420
They aren't emitting any signals.

915
00:45:42,620 --> 00:45:43,180
You can't be tracked.

916
00:45:43,180 --> 00:45:44,920
You can turn off your camera as well.

917
00:45:46,100 --> 00:45:47,420
Don't use a store's free Wi-Fi.

918
00:45:49,940 --> 00:45:52,260
I go to stores,

919
00:45:52,440 --> 00:45:54,140
Target, Nordstrom, Macy's, whatever.

920
00:45:54,440 --> 00:45:55,540
Use our free Wi-Fi.

921
00:45:56,200 --> 00:45:58,100
Read their terms of service.

922
00:45:58,200 --> 00:45:59,080
Read their privacy policy.

923
00:45:59,340 --> 00:46:00,840
They're going to say that they're going to

924
00:46:00,840 --> 00:46:01,700
monitor it in some way,

925
00:46:01,720 --> 00:46:02,700
collect the data in some way.

926
00:46:06,080 --> 00:46:07,760
Some people think Mac randomization

927
00:46:07,760 --> 00:46:08,440
is the way to go.

928
00:46:08,720 --> 00:46:11,580
There's a research paper on it

929
00:46:13,180 --> 00:46:14,140
where Mac randomization is done.

930
00:46:14,280 --> 00:46:15,440
It is kind of broken.

931
00:46:15,620 --> 00:46:16,640
It's not truly random.

932
00:46:18,340 --> 00:46:19,740
You record long enough,

933
00:46:19,820 --> 00:46:22,160
you can figure out which device is which.

934
00:46:24,160 --> 00:46:24,940
Other options,

935
00:46:25,100 --> 00:46:26,560
wear a hat or a disguise when you go in a store.

936
00:46:26,740 --> 00:46:27,740
Don't go to the same store again.

937
00:46:28,000 --> 00:46:28,720
Don't even go in.

938
00:46:28,860 --> 00:46:30,900
Choose to boycott it and buy everything online at Amazon.

939
00:46:31,120 --> 00:46:32,280
But then Amazon tracks you,

940
00:46:32,320 --> 00:46:33,440
so what are you going to do?

941
00:46:36,380 --> 00:46:37,580
So behind all this,

942
00:46:37,640 --> 00:46:39,320
all this data is collecting in all different ways.

943
00:46:40,560 --> 00:46:41,880
We have the data brokers.

944
00:46:43,180 --> 00:46:45,360
These are companies that do business in data.

945
00:46:47,420 --> 00:46:48,740
This really cool paper,

946
00:46:48,880 --> 00:46:50,140
Data Brokers in an Open Society.

947
00:46:51,060 --> 00:46:56,280
Let me make sure I get this right.

948
00:46:56,520 --> 00:46:57,940
I believe the company is called Upturn.

949
00:46:58,780 --> 00:46:59,880
I don't have it in my notes here.

950
00:47:00,000 --> 00:47:00,080
Okay.

951
00:47:00,180 --> 00:47:01,240
So a really great report,

952
00:47:01,700 --> 00:47:03,300
but they define data brokers this way.

953
00:47:03,360 --> 00:47:04,220
A company or business unit

954
00:47:04,220 --> 00:47:05,460
that earns its primary revenue

955
00:47:05,460 --> 00:47:08,300
by supplying data or inferences about people

956
00:47:08,780 --> 00:47:09,980
gathered mainly from sources

957
00:47:09,980 --> 00:47:11,700
other than the data subjects themselves.

958
00:47:12,000 --> 00:47:13,160
So it's not a quote-unquote

959
00:47:13,180 --> 00:47:14,060
questionnaire you fill out.

960
00:47:14,180 --> 00:47:15,640
It's data gathered about you

961
00:47:16,520 --> 00:47:17,720
by someone else,

962
00:47:18,160 --> 00:47:19,640
and it's identified to you,

963
00:47:19,720 --> 00:47:21,220
and it's then sold to someone else

964
00:47:21,220 --> 00:47:22,040
who wants to use it.

965
00:47:25,140 --> 00:47:26,700
One application of this is

966
00:47:26,700 --> 00:47:27,820
micro-targeting.

967
00:47:28,960 --> 00:47:30,340
This article talks about it,

968
00:47:30,400 --> 00:47:31,920
but it kind of just summarizes

969
00:47:31,920 --> 00:47:32,780
everything I've been talking about.

970
00:47:32,880 --> 00:47:35,500
The marketing industry is trying to profile and classify us

971
00:47:35,500 --> 00:47:38,120
so that advertising can be customized and targeted.

972
00:47:39,920 --> 00:47:41,020
Thousands of other companies,

973
00:47:41,200 --> 00:47:42,380
Google, Facebook, and so on,

974
00:47:43,180 --> 00:47:44,040
advocate their policy and business

975
00:47:44,040 --> 00:47:44,940
to profile us,

976
00:47:45,060 --> 00:47:47,000
just to make a better sales pitch.

977
00:47:47,160 --> 00:47:49,520
Again, this is all just to sell us better stuff

978
00:47:49,520 --> 00:47:50,800
and increase their profits.

979
00:47:53,580 --> 00:47:54,920
Which isn't necessarily bad,

980
00:47:55,060 --> 00:47:56,160
I'm just saying that's their motivation

981
00:47:56,160 --> 00:47:57,580
for doing so and should be considered.

982
00:47:58,700 --> 00:48:00,860
A few examples of this.

983
00:48:01,040 --> 00:48:01,400
Target.

984
00:48:01,840 --> 00:48:03,580
This article came out in 2012,

985
00:48:04,540 --> 00:48:05,020
and

986
00:48:06,760 --> 00:48:08,700
actually the story starts back in 2002.

987
00:48:09,140 --> 00:48:10,320
Some marketers at Target

988
00:48:10,320 --> 00:48:12,100
went to one of Target's statisticians

989
00:48:13,400 --> 00:48:14,040
and said,

990
00:48:14,220 --> 00:48:15,780
if we want to figure out if a customer is pregnant,

991
00:48:16,280 --> 00:48:17,600
even if she doesn't want us to know,

992
00:48:17,880 --> 00:48:18,740
can you do that?

993
00:48:18,820 --> 00:48:19,680
Can you tell us that information?

994
00:48:23,060 --> 00:48:25,100
The Target statistician starts to work on it.

995
00:48:26,740 --> 00:48:27,400
Target collects

996
00:48:27,400 --> 00:48:28,680
obviously vast amounts of data

997
00:48:28,680 --> 00:48:29,380
on their customers.

998
00:48:29,600 --> 00:48:31,460
They want to know which ads

999
00:48:31,460 --> 00:48:32,400
do we show at which time

1000
00:48:32,400 --> 00:48:33,680
to get people to come into the store.

1001
00:48:36,220 --> 00:48:37,720
Target and the statistician there

1002
00:48:37,720 --> 00:48:40,420
created a pregnancy prediction model

1003
00:48:41,340 --> 00:48:42,780
where if someone is buying

1004
00:48:43,180 --> 00:48:43,980
these items,

1005
00:48:44,100 --> 00:48:45,260
we think they're pregnant.

1006
00:48:46,540 --> 00:48:48,640
Prenatal vitamins, diapers, baby clothes,

1007
00:48:48,700 --> 00:48:49,300
stuff like that.

1008
00:48:49,600 --> 00:48:51,260
You all buy those items in a short time,

1009
00:48:51,360 --> 00:48:52,560
that's a big red flag for Target.

1010
00:48:52,840 --> 00:48:53,780
They're probably pregnant.

1011
00:48:55,260 --> 00:48:56,640
This is important to Target because

1012
00:48:57,220 --> 00:48:58,640
there's a few times in our lives

1013
00:48:58,640 --> 00:49:00,840
when we're really open to switching brands,

1014
00:49:00,980 --> 00:49:01,780
to trying new things.

1015
00:49:03,000 --> 00:49:04,980
Pregnancy is one, marriage is another one,

1016
00:49:05,140 --> 00:49:06,280
might be one or two more,

1017
00:49:06,460 --> 00:49:07,400
but most times we go to the store

1018
00:49:07,400 --> 00:49:08,960
and buy the same stuff over and over again.

1019
00:49:13,180 --> 00:49:13,800
It's something kind of big.

1020
00:49:14,340 --> 00:49:15,600
That's why Target cared about

1021
00:49:15,600 --> 00:49:17,160
why we want to know when people are pregnant

1022
00:49:17,160 --> 00:49:19,420
so we can send them the flyers in the mail,

1023
00:49:19,440 --> 00:49:21,960
the emails that sell them the new baby stuff

1024
00:49:21,960 --> 00:49:22,940
that we want them to buy.

1025
00:49:23,160 --> 00:49:24,260
We want it to be appropriate.

1026
00:49:24,560 --> 00:49:26,500
There's no sense in selling me prenatal vitamins,

1027
00:49:28,100 --> 00:49:28,500
obviously,

1028
00:49:28,640 --> 00:49:29,700
so they want to know who the women are

1029
00:49:29,700 --> 00:49:30,500
and when they're pregnant.

1030
00:49:33,300 --> 00:49:34,500
They did this model.

1031
00:49:34,600 --> 00:49:35,900
They started rolling out these ads

1032
00:49:37,040 --> 00:49:38,860
and it backfired horribly.

1033
00:49:40,100 --> 00:49:41,660
About a year after they did them all

1034
00:49:43,180 --> 00:49:44,180
they went to Target outside Minneapolis

1035
00:49:44,180 --> 00:49:45,680
and demanded to see the manager.

1036
00:49:46,280 --> 00:49:48,100
He was clutching coupons that had been sent

1037
00:49:48,100 --> 00:49:50,120
to his teenage daughter and he was angry.

1038
00:49:50,520 --> 00:49:52,000
My daughter got this in the mail.

1039
00:49:52,140 --> 00:49:53,100
She's still in high school.

1040
00:49:53,400 --> 00:49:55,900
You're sending her coupons for baby clothes and cribs.

1041
00:49:56,100 --> 00:49:57,880
Are you trying to encourage her to get pregnant?

1042
00:49:58,700 --> 00:50:00,340
The manager had no idea what was going on.

1043
00:50:00,380 --> 00:50:01,540
He apologized profusely.

1044
00:50:01,780 --> 00:50:03,100
He said he'd find out what happened.

1045
00:50:04,900 --> 00:50:06,160
Turns out a few days later

1046
00:50:06,160 --> 00:50:07,620
the man comes back to the store

1047
00:50:07,620 --> 00:50:08,840
and he apologizes to the manager.

1048
00:50:09,160 --> 00:50:11,280
Turns out there's some things in my house that have been going on

1049
00:50:13,900 --> 00:50:14,780
and I don't know what's going on.

1050
00:50:14,780 --> 00:50:16,460
The teenage girl had been pregnant.

1051
00:50:16,540 --> 00:50:18,280
She had been buying some things at Target.

1052
00:50:18,900 --> 00:50:20,940
I think it's with her parents' card.

1053
00:50:21,760 --> 00:50:23,160
She gets the ads in the mail

1054
00:50:23,160 --> 00:50:24,640
because Target said this person is pregnant

1055
00:50:25,120 --> 00:50:26,380
without realizing it's a teenager.

1056
00:50:27,440 --> 00:50:29,460
Target knew the teenager's daughter was pregnant

1057
00:50:29,460 --> 00:50:30,220
before the dad did.

1058
00:50:30,780 --> 00:50:33,060
That's obviously not the way you want those things to happen.

1059
00:50:34,180 --> 00:50:35,700
The article goes on to say

1060
00:50:35,700 --> 00:50:36,740
that the reporter

1061
00:50:37,400 --> 00:50:39,080
when he was talking to the statistician

1062
00:50:39,080 --> 00:50:39,460
at Target,

1063
00:50:39,460 --> 00:50:41,240
Target cut off his access to them

1064
00:50:41,240 --> 00:50:42,840
partway through his research.

1065
00:50:43,960 --> 00:50:45,680
Once he got to this stage

1066
00:50:45,680 --> 00:50:47,040
I found out this part of the story.

1067
00:50:48,460 --> 00:50:49,460
At Target, since then,

1068
00:50:49,520 --> 00:50:50,060
they've made some statements.

1069
00:50:50,220 --> 00:50:52,660
They've changed the way they advertise.

1070
00:50:52,920 --> 00:50:53,940
They've refined their algorithm.

1071
00:50:55,140 --> 00:50:56,880
For example, they'll send a flyer in the mail.

1072
00:50:56,940 --> 00:50:57,860
It won't be all just baby stuff.

1073
00:50:58,000 --> 00:51:00,520
It'll be a bottle of wine, baby shoes,

1074
00:51:02,000 --> 00:51:03,040
lawnmower, stuff like that.

1075
00:51:03,100 --> 00:51:04,660
They'll mix it in so it's not as obvious.

1076
00:51:11,440 --> 00:51:12,580
That's kind of the fallout for that.

1077
00:51:13,180 --> 00:51:14,660
It's just a horrible example

1078
00:51:14,660 --> 00:51:16,860
of micro-targeting gone wrong.

1079
00:51:19,720 --> 00:51:20,620
A few more examples.

1080
00:51:21,060 --> 00:51:22,040
There's lots more out there.

1081
00:51:22,200 --> 00:51:23,300
One problem I had with this talk

1082
00:51:23,300 --> 00:51:24,220
was trying to fit in everything

1083
00:51:24,220 --> 00:51:25,420
that I wanted to talk about.

1084
00:51:26,080 --> 00:51:27,200
Snapchat came out this year

1085
00:51:27,200 --> 00:51:28,560
and made a statement.

1086
00:51:28,820 --> 00:51:29,980
Data from offline purchases

1087
00:51:30,520 --> 00:51:31,900
like the status of a loyalty card,

1088
00:51:32,000 --> 00:51:33,220
the grocery store card that you swipe

1089
00:51:33,220 --> 00:51:33,920
to get a discount,

1090
00:51:34,120 --> 00:51:37,000
those companies sell that data.

1091
00:51:39,460 --> 00:51:40,540
Google buys this thing with this thing

1092
00:51:40,540 --> 00:51:41,260
and that thing usually.

1093
00:51:42,040 --> 00:51:43,380
Snapchat buys that up.

1094
00:51:43,620 --> 00:51:46,380
They can use that data to better target

1095
00:51:46,380 --> 00:51:48,500
their advertising when they sell ads

1096
00:51:48,500 --> 00:51:50,460
to the people who advertise on Snapchat.

1097
00:51:52,020 --> 00:51:54,040
Again, it's just this weird roundabout way

1098
00:51:54,040 --> 00:51:57,160
of how is Snapchat going to sell better ads?

1099
00:51:57,340 --> 00:51:58,700
It needs better data on people.

1100
00:51:58,960 --> 00:52:00,540
It gets that data from the things you buy

1101
00:52:00,540 --> 00:52:01,540
and combines it in.

1102
00:52:01,680 --> 00:52:03,080
You get better Snapchat ads.

1103
00:52:03,300 --> 00:52:04,760
You buy what you like, apparently,

1104
00:52:04,940 --> 00:52:05,760
and everyone's happy.

1105
00:52:09,460 --> 00:52:11,760
A couple other examples of micro-targeting.

1106
00:52:12,320 --> 00:52:13,200
Gizmodo and both

1107
00:52:13,200 --> 00:52:15,380
of the Press Foundation earlier this year

1108
00:52:15,380 --> 00:52:17,040
made ads targeted to federal employees.

1109
00:52:22,260 --> 00:52:23,080
Gizmodo, what they did,

1110
00:52:24,920 --> 00:52:26,800
Facebook has a way to choose

1111
00:52:27,380 --> 00:52:29,540
to select the demographics you want to target.

1112
00:52:29,720 --> 00:52:30,620
I want to sell ads to

1113
00:52:31,560 --> 00:52:33,620
these people in this area with this kind of income

1114
00:52:33,620 --> 00:52:34,660
and so on.

1115
00:52:35,640 --> 00:52:37,320
Gizmodo bought Facebook ads

1116
00:52:37,320 --> 00:52:39,440
for federal employees in the D.C. area

1117
00:52:39,460 --> 00:52:40,980
specifically targeting them,

1118
00:52:41,160 --> 00:52:42,840
saying, hey, please leak us information

1119
00:52:42,840 --> 00:52:44,060
about President Trump.

1120
00:52:45,620 --> 00:52:46,660
Freedom of the Press Foundation

1121
00:52:47,160 --> 00:52:48,260
wanted to do the same thing,

1122
00:52:48,360 --> 00:52:51,720
so they did it on Twitter.

1123
00:52:52,280 --> 00:52:53,400
Twitter offers the same thing.

1124
00:52:53,480 --> 00:52:55,100
You can really use some fine-grain advertising

1125
00:52:55,100 --> 00:52:57,240
about which market you want to target.

1126
00:52:58,180 --> 00:52:59,800
They wanted to be even more specific.

1127
00:53:00,500 --> 00:53:02,100
Employees in the EPA and the NOAA,

1128
00:53:02,300 --> 00:53:03,820
we want to target just them.

1129
00:53:03,940 --> 00:53:05,860
They tried to find out

1130
00:53:05,860 --> 00:53:08,040
who their Twitter accounts were

1131
00:53:08,040 --> 00:53:09,440
and they wanted to serve ads

1132
00:53:09,460 --> 00:53:10,340
just to them,

1133
00:53:10,360 --> 00:53:11,820
to target them to leak information

1134
00:53:12,640 --> 00:53:13,780
to the Freedom of the Press Foundation.

1135
00:53:15,320 --> 00:53:17,420
Whether you agree with their methods or not,

1136
00:53:17,540 --> 00:53:18,580
the fact that you can target ads

1137
00:53:18,580 --> 00:53:20,880
that specifically in just an area,

1138
00:53:21,760 --> 00:53:23,300
again, can be used for good,

1139
00:53:23,360 --> 00:53:24,600
for bad, or for whatever,

1140
00:53:24,720 --> 00:53:26,680
but it's happening and it's possible.

1141
00:53:27,700 --> 00:53:29,560
These aren't even that new

1142
00:53:29,560 --> 00:53:30,960
of an example of this going on.

1143
00:53:36,160 --> 00:53:37,360
One topic of discussion

1144
00:53:37,360 --> 00:53:39,340
after the election last year was

1145
00:53:39,460 --> 00:53:40,540
a Muslim registry.

1146
00:53:41,960 --> 00:53:43,280
Should the government build it or not?

1147
00:53:44,480 --> 00:53:45,420
Can they do it?

1148
00:53:45,500 --> 00:53:46,140
Is it legally allowed?

1149
00:53:48,420 --> 00:53:49,620
The government doesn't have to,

1150
00:53:49,660 --> 00:53:50,300
it's already been done.

1151
00:53:50,800 --> 00:53:51,700
It's a company that,

1152
00:53:52,880 --> 00:53:54,200
exactdata.com, you go to it,

1153
00:53:54,260 --> 00:53:54,960
you sign up to it,

1154
00:53:55,540 --> 00:53:56,960
they've already collected data

1155
00:53:56,960 --> 00:53:58,920
on 200 million US people.

1156
00:53:59,960 --> 00:54:02,000
You can filter down by 450 terms

1157
00:54:02,000 --> 00:54:03,240
to get specifically the kind of people

1158
00:54:03,240 --> 00:54:03,820
you want to target.

1159
00:54:04,640 --> 00:54:06,040
1.8 million names

1160
00:54:06,040 --> 00:54:08,000
at a price of $140,000.

1161
00:54:09,220 --> 00:54:10,620
I think it was Amnesty International

1162
00:54:10,620 --> 00:54:12,160
that did the research and went in

1163
00:54:12,160 --> 00:54:13,100
and said,

1164
00:54:13,180 --> 00:54:15,820
we wanted to advertise

1165
00:54:16,820 --> 00:54:18,460
to people who identify as Muslim.

1166
00:54:18,820 --> 00:54:20,000
Well, that's the price to get

1167
00:54:20,000 --> 00:54:21,180
a list of Muslim people in the US

1168
00:54:21,180 --> 00:54:22,080
and advertise to them.

1169
00:54:22,140 --> 00:54:23,340
There's no need for the government to do it.

1170
00:54:23,520 --> 00:54:25,360
Companies have already done it.

1171
00:54:26,160 --> 00:54:27,380
For years they've had this information.

1172
00:54:31,560 --> 00:54:33,360
And this type of collection is happening

1173
00:54:34,620 --> 00:54:36,000
in all industries,

1174
00:54:36,180 --> 00:54:36,860
all verticals.

1175
00:54:37,200 --> 00:54:38,460
Identify who owns a phone number.

1176
00:54:39,420 --> 00:54:40,780
You also need people search websites

1177
00:54:40,780 --> 00:54:43,000
that you can't escape from.

1178
00:54:43,900 --> 00:54:45,180
It's happening with medical data,

1179
00:54:45,280 --> 00:54:46,800
with insurance, children's toys,

1180
00:54:46,980 --> 00:54:47,740
your porn viewing habits,

1181
00:54:47,940 --> 00:54:50,480
Facebook profiles, scraping Twitter.

1182
00:54:52,700 --> 00:54:53,580
Data's being collected

1183
00:54:53,580 --> 00:54:55,500
and lumped together

1184
00:54:55,500 --> 00:54:57,780
and cross-correlated across services

1185
00:54:58,440 --> 00:54:59,660
again, just to sell you things.

1186
00:55:01,280 --> 00:55:02,920
So, if you don't like it, what do you do?

1187
00:55:03,820 --> 00:55:04,160
Buy free apps.

1188
00:55:04,400 --> 00:55:06,460
I'm repeating myself at this point.

1189
00:55:07,560 --> 00:55:08,720
Restrict what your apps can do.

1190
00:55:08,900 --> 00:55:09,860
Use an ad blocker.

1191
00:55:10,560 --> 00:55:11,700
Buy everything with cash.

1192
00:55:11,900 --> 00:55:12,560
Don't install apps.

1193
00:55:12,880 --> 00:55:14,300
Live in a cave. Just deal with it.

1194
00:55:14,340 --> 00:55:16,540
This is the fatalistic part I'm talking about.

1195
00:55:16,860 --> 00:55:18,160
It's been going on for years.

1196
00:55:18,380 --> 00:55:19,180
It's legal.

1197
00:55:20,640 --> 00:55:22,580
There's not much oversight into it.

1198
00:55:23,280 --> 00:55:24,540
It's just kind of here.

1199
00:55:26,100 --> 00:55:27,680
A few more examples I'll try to run through.

1200
00:55:28,420 --> 00:55:28,880
Biometrics.

1201
00:55:29,260 --> 00:55:31,340
It's easy to extract biometrics from a photograph.

1202
00:55:33,820 --> 00:55:35,040
The bottom example, HSBC.

1203
00:55:35,080 --> 00:55:35,900
They had this big ad.

1204
00:55:36,120 --> 00:55:38,000
You can use your voice to sign into

1205
00:55:38,840 --> 00:55:39,760
for phone calls.

1206
00:55:40,160 --> 00:55:41,640
They've obviously never seen the movie Sneakers.

1207
00:55:43,380 --> 00:55:44,320
Anyone get that reference?

1208
00:55:44,480 --> 00:55:45,480
My voice is my passport.

1209
00:55:46,300 --> 00:55:47,660
They say your voice is your password.

1210
00:55:48,200 --> 00:55:49,840
Voice is not hard to fake.

1211
00:55:50,480 --> 00:55:52,240
UGA is a university in Georgia.

1212
00:55:52,340 --> 00:55:55,040
They add iris scanning to the cafeteria.

1213
00:55:55,380 --> 00:55:56,120
You go in the cafeteria.

1214
00:55:56,220 --> 00:55:57,260
Instead of scanning your card,

1215
00:55:57,300 --> 00:55:58,560
which takes 10, 15 seconds,

1216
00:55:59,160 --> 00:56:02,120
you now scan someone's eyes to make the payment.

1217
00:56:03,820 --> 00:56:07,340
What was interesting to me was that

1218
00:56:07,340 --> 00:56:09,260
it's a cost of like $78,000.

1219
00:56:09,540 --> 00:56:11,560
A university will invest in iris scanning

1220
00:56:11,560 --> 00:56:14,140
just to make the cafeteria line go a little bit faster.

1221
00:56:14,360 --> 00:56:16,680
That's how technology has progressed.

1222
00:56:16,780 --> 00:56:18,720
That's how easy it is to use it and access it.

1223
00:56:22,160 --> 00:56:22,600
IoT.

1224
00:56:22,740 --> 00:56:24,280
The P in IoT stands for privacy.

1225
00:56:24,640 --> 00:56:26,020
There is no P in IoT.

1226
00:56:27,160 --> 00:56:27,600
Yes.

1227
00:56:29,280 --> 00:56:30,280
Thank you for laughing.

1228
00:56:32,820 --> 00:56:33,700
This topic.

1229
00:56:33,820 --> 00:56:34,420
That means no introduction.

1230
00:56:34,620 --> 00:56:35,780
It's something we can all...

1231
00:56:36,900 --> 00:56:37,860
We're all familiar with.

1232
00:56:37,980 --> 00:56:41,260
The newest example is Roomba selling maps to your home

1233
00:56:41,260 --> 00:56:42,360
to IoT manufacturers

1234
00:56:42,360 --> 00:56:44,360
so they can better design the devices

1235
00:56:44,360 --> 00:56:45,460
to use your home better.

1236
00:56:46,260 --> 00:56:48,100
The fact that Roomba makes maps to your house

1237
00:56:48,100 --> 00:56:49,020
and can sell that data,

1238
00:56:49,100 --> 00:56:50,020
there's a market for that data,

1239
00:56:50,100 --> 00:56:52,300
just kind of illustrates the silliness of it all.

1240
00:56:55,140 --> 00:56:56,440
This is just a big wall of text.

1241
00:56:56,540 --> 00:56:58,180
There's links for articles that come out this year

1242
00:56:58,180 --> 00:56:59,660
talking about the data economy,

1243
00:56:59,920 --> 00:57:02,120
the surveillance capitalism,

1244
00:57:03,920 --> 00:57:06,060
all the things that the AI is going to learn from us,

1245
00:57:06,200 --> 00:57:07,480
all the stuff that is relevant

1246
00:57:07,480 --> 00:57:09,000
but I just couldn't get to, couldn't talk about.

1247
00:57:09,100 --> 00:57:11,080
There's just so much research, so much talk about it,

1248
00:57:11,080 --> 00:57:12,780
so much developing in this space right now

1249
00:57:13,800 --> 00:57:15,440
that all I can do is link to it and say,

1250
00:57:15,500 --> 00:57:17,300
here, drown yourself in it

1251
00:57:17,300 --> 00:57:19,760
and see what's coming.

1252
00:57:22,860 --> 00:57:24,320
Good news is it's not entirely bad,

1253
00:57:24,500 --> 00:57:25,740
but not 100% bad.

1254
00:57:25,920 --> 00:57:27,220
A few fun examples of

1255
00:57:28,640 --> 00:57:30,500
this technology being used in cool ways.

1256
00:57:30,600 --> 00:57:31,040
Syrian refugees.

1257
00:57:31,380 --> 00:57:33,280
Well, the UN distributes money to refugees.

1258
00:57:33,820 --> 00:57:34,580
How does it track that money?

1259
00:57:34,660 --> 00:57:36,120
How does it audit to make sure the same person

1260
00:57:36,120 --> 00:57:37,400
is getting the same amount of money?

1261
00:57:38,040 --> 00:57:40,000
With ATMs and debit cards it's hard to do so,

1262
00:57:40,100 --> 00:57:40,860
but with iris scanning,

1263
00:57:41,060 --> 00:57:43,080
the same person can scan their eyes.

1264
00:57:43,440 --> 00:57:45,540
UN knows this person is getting these funds,

1265
00:57:45,640 --> 00:57:48,740
we can track it, we can account for it.

1266
00:57:49,000 --> 00:57:50,880
So it's a pretty cool use of iris scanning

1267
00:57:50,880 --> 00:57:52,300
to do something good.

1268
00:57:55,740 --> 00:57:56,720
Toaster that burns your toast.

1269
00:57:56,780 --> 00:57:57,640
The toaster connects to the internet,

1270
00:57:57,740 --> 00:57:59,280
checks your clout reputation,

1271
00:57:59,420 --> 00:58:00,260
online reputation.

1272
00:58:04,400 --> 00:58:06,840
It makes your coffee really weak or something.

1273
00:58:09,040 --> 00:58:10,260
There's not a lot of these good examples.

1274
00:58:10,380 --> 00:58:11,880
There's kind of some fun silly ones,

1275
00:58:11,980 --> 00:58:13,620
but there's unfortunately not too many of them.

1276
00:58:15,620 --> 00:58:16,640
Collection and misuse.

1277
00:58:16,880 --> 00:58:17,680
Are they inevitable?

1278
00:58:17,820 --> 00:58:18,800
Some people don't think so.

1279
00:58:19,840 --> 00:58:21,400
What's really cool I've seen in the past year

1280
00:58:21,400 --> 00:58:22,300
is people talking about

1281
00:58:22,300 --> 00:58:23,600
how to avoid this type of stuff.

1282
00:58:23,740 --> 00:58:24,380
You do things like,

1283
00:58:24,420 --> 00:58:25,880
it's privacy by design,

1284
00:58:26,120 --> 00:58:26,880
privacy engineering.

1285
00:58:27,180 --> 00:58:28,680
You build into the product from the beginning

1286
00:58:28,680 --> 00:58:30,460
because you care about that as the outcome.

1287
00:58:31,580 --> 00:58:32,220
Privacy tech

1288
00:58:32,220 --> 00:58:33,500
is getting some investment.

1289
00:58:34,380 --> 00:58:36,040
There's terms like data ethics,

1290
00:58:36,280 --> 00:58:38,040
data protection, data avoidance

1291
00:58:38,040 --> 00:58:40,040
that are being talked about by people in the space.

1292
00:58:40,200 --> 00:58:41,140
I mentioned Michelle Diney,

1293
00:58:41,260 --> 00:58:43,940
the vice president of Cisco.

1294
00:58:44,020 --> 00:58:45,940
She talks a lot about this and pushes this a lot.

1295
00:58:47,540 --> 00:58:48,520
So there definitely are people

1296
00:58:48,520 --> 00:58:50,380
who care about this and are trying to change it.

1297
00:58:50,540 --> 00:58:51,500
And this is one of you,

1298
00:58:52,000 --> 00:58:52,920
if you're one of them,

1299
00:58:53,880 --> 00:58:54,880
please read up on it.

1300
00:58:55,720 --> 00:58:57,540
I mentioned earlier adversarial input.

1301
00:58:58,680 --> 00:59:00,960
This is feeding bad data into the AI

1302
00:59:00,960 --> 00:59:02,260
and machine learning

1303
00:59:02,260 --> 00:59:04,240
in order to fool it.

1304
00:59:04,760 --> 00:59:05,820
Optical illusions for machines.

1305
00:59:07,320 --> 00:59:08,400
Instagram has a filter.

1306
00:59:08,520 --> 00:59:09,300
You can't show nipples.

1307
00:59:09,640 --> 00:59:11,100
So this person started an account,

1308
00:59:11,360 --> 00:59:12,200
genderless nipples.

1309
00:59:12,440 --> 00:59:14,120
It's just a close-up of just a nipple

1310
00:59:14,120 --> 00:59:15,820
and you can't tell if it's a man or a woman.

1311
00:59:16,240 --> 00:59:17,260
Man nipples are okay,

1312
00:59:17,440 --> 00:59:18,780
woman nipples are not okay on Instagram.

1313
00:59:19,100 --> 00:59:21,400
So Instagram's filter doesn't know how to block it or not.

1314
00:59:22,260 --> 00:59:24,580
So kind of a fun, silly example

1315
00:59:24,580 --> 00:59:25,360
but just a way to,

1316
00:59:28,680 --> 00:59:28,900
if there's a choice,

1317
00:59:28,920 --> 00:59:30,640
there's people who are going to subvert it

1318
00:59:30,640 --> 00:59:32,200
and put bad information in.

1319
00:59:32,420 --> 00:59:33,960
And adversarial input is kind of,

1320
00:59:33,960 --> 00:59:35,600
it's a really cool interesting field

1321
00:59:35,600 --> 00:59:36,920
that's just now developing

1322
00:59:36,920 --> 00:59:38,060
because we've only gotten to the point

1323
00:59:38,060 --> 00:59:40,840
of where AI and machine learning is actually functional

1324
00:59:40,840 --> 00:59:43,560
so now the developers have to start caring about,

1325
00:59:43,680 --> 00:59:44,180
okay, it works,

1326
00:59:44,200 --> 00:59:45,520
now we have to worry about people breaking it.

1327
00:59:47,360 --> 00:59:48,720
And of course Calvin and Hobbes

1328
00:59:49,720 --> 00:59:51,660
fill out a reader survey for Chewing Magazine.

1329
00:59:52,520 --> 00:59:54,180
He fills out the little survey card.

1330
00:59:54,660 --> 00:59:56,560
Salary is, I spent $500 on gum.

1331
00:59:58,680 --> 00:59:59,260
Garlic and curry.

1332
01:00:00,380 --> 01:00:00,740
Gum.

1333
01:00:01,560 --> 01:00:03,600
This magazine should have some amusing ads soon

1334
01:00:03,600 --> 01:00:04,760
and Calvin, of course,

1335
01:00:04,820 --> 01:00:05,680
I love messing with data.

1336
01:00:06,960 --> 01:00:08,080
Hopefully all of you do too.

1337
01:00:08,180 --> 01:00:09,220
Let's find some new ways to do so.

1338
01:00:12,500 --> 01:00:12,860
Okay.

1339
01:00:14,520 --> 01:00:14,880
So,

1340
01:00:16,120 --> 01:00:17,380
yeah, so I want to talk,

1341
01:00:17,480 --> 01:00:18,760
wrap this up really soon.

1342
01:00:19,420 --> 01:00:21,540
I'll talk a bit about fears versus wants

1343
01:00:21,540 --> 01:00:22,800
and kind of the future.

1344
01:00:22,960 --> 01:00:24,800
You've seen all the madness that's happening

1345
01:00:24,800 --> 01:00:25,820
and things going on out there.

1346
01:00:28,680 --> 01:00:29,520
There's lots of reactions I've had

1347
01:00:29,520 --> 01:00:31,380
as I go through this and prepare for this.

1348
01:00:32,020 --> 01:00:33,800
Here's the first world reaction to it.

1349
01:00:33,880 --> 01:00:34,880
I didn't install an ad blocker

1350
01:00:34,880 --> 01:00:37,620
so I'm seeing ads for shoes on Facebook

1351
01:00:37,620 --> 01:00:39,200
that I shouldn't see.

1352
01:00:41,360 --> 01:00:42,780
I felt a lot of this going through.

1353
01:00:42,880 --> 01:00:44,060
All these concerns about being tracking

1354
01:00:44,060 --> 01:00:45,380
are first world problems.

1355
01:00:45,500 --> 01:00:46,500
So what if someone tracks us

1356
01:00:46,500 --> 01:00:47,680
and tries to sell us something better?

1357
01:00:47,780 --> 01:00:48,920
Is that something we've got to worry about

1358
01:00:49,500 --> 01:00:51,340
when there's much bigger concerns out in the world?

1359
01:00:54,580 --> 01:00:56,160
You take a philosophical approach to it.

1360
01:00:56,220 --> 01:00:57,740
You care about the privacy violation of it,

1361
01:00:58,680 --> 01:00:58,820
no matter.

1362
01:00:59,680 --> 01:01:00,960
It's bit by bit.

1363
01:01:01,100 --> 01:01:04,160
Our privacy is being violated and released

1364
01:01:04,160 --> 01:01:06,300
and eventually it's going to cause some major damage.

1365
01:01:08,220 --> 01:01:08,660
Likewise,

1366
01:01:08,860 --> 01:01:09,740
you worry about government surveillance.

1367
01:01:10,240 --> 01:01:12,420
We're here. We're the government. Trust us.

1368
01:01:12,600 --> 01:01:13,400
We're going to watch everything.

1369
01:01:13,620 --> 01:01:14,440
Don't worry. It's okay.

1370
01:01:15,560 --> 01:01:17,480
These are all things that we worry about.

1371
01:01:19,300 --> 01:01:20,520
But here's the reality

1372
01:01:20,520 --> 01:01:23,100
of what we want.

1373
01:01:23,300 --> 01:01:24,440
I want to make sure I get this story right.

1374
01:01:29,120 --> 01:01:29,920
Okay, so.

1375
01:01:30,740 --> 01:01:31,740
This is a story from Utah.

1376
01:01:32,500 --> 01:01:34,940
A five-year-old child reported being sexually assaulted

1377
01:01:34,940 --> 01:01:36,500
after entering a bathroom at a library.

1378
01:01:36,940 --> 01:01:38,240
Surveillance video shows a man

1379
01:01:38,240 --> 01:01:40,840
whom library employees say frequents the building,

1380
01:01:41,120 --> 01:01:42,260
followed the boy into the restroom.

1381
01:01:42,660 --> 01:01:44,360
A few minutes later, the man leaves the bathroom.

1382
01:01:44,440 --> 01:01:46,140
The boy comes out and tells his sister and his mother

1383
01:01:46,140 --> 01:01:47,940
what happens. Absolutely horrible.

1384
01:01:48,280 --> 01:01:50,920
And this is a case where 99% of people

1385
01:01:50,920 --> 01:01:52,220
are saying, yes, we want cameras there.

1386
01:01:52,240 --> 01:01:54,580
We want to identify his face. We want to identify his gait.

1387
01:01:55,000 --> 01:01:56,100
Who bought those clothes?

1388
01:01:56,100 --> 01:01:57,900
Let's find this guy right away.

1389
01:01:58,380 --> 01:01:59,800
We want the surveillance, the data,

1390
01:01:59,880 --> 01:02:02,000
so we can find it, so we can stop situations

1391
01:02:02,000 --> 01:02:03,160
and prevent stuff like this.

1392
01:02:03,760 --> 01:02:05,260
So we've got these two extremes

1393
01:02:05,260 --> 01:02:07,800
of worrying about ads, surveillance,

1394
01:02:08,060 --> 01:02:09,020
but then we want surveillance

1395
01:02:09,020 --> 01:02:10,720
to help us in situations like this.

1396
01:02:12,280 --> 01:02:13,760
We've got this spectrum.

1397
01:02:15,100 --> 01:02:16,340
What are we okay with?

1398
01:02:18,300 --> 01:02:20,040
So you've got the two ends to it.

1399
01:02:20,180 --> 01:02:20,900
Where are we right now?

1400
01:02:21,840 --> 01:02:23,100
The reality of our world is

1401
01:02:23,100 --> 01:02:25,640
the online world forces us to make irrevocable decisions

1402
01:02:26,100 --> 01:02:26,640
about the online footprint.

1403
01:02:27,100 --> 01:02:28,700
What you put online stays online.

1404
01:02:28,860 --> 01:02:29,520
The Internet remembers.

1405
01:02:30,300 --> 01:02:32,760
The choices teenagers make now follow them

1406
01:02:32,760 --> 01:02:34,440
for years and years in ways that

1407
01:02:34,440 --> 01:02:36,460
teenagers from the 80s and 90s

1408
01:02:36,460 --> 01:02:37,720
don't have to deal with.

1409
01:02:39,000 --> 01:02:41,720
The surveillance economy works on information asymmetry.

1410
01:02:41,900 --> 01:02:43,160
Companies know everything about us.

1411
01:02:43,200 --> 01:02:44,360
We know very little about them.

1412
01:02:44,720 --> 01:02:47,160
There are hundreds, maybe thousands of companies

1413
01:02:47,160 --> 01:02:49,040
of all sizes involved in this space,

1414
01:02:49,160 --> 01:02:51,020
collecting data, reselling it, trying to find ways

1415
01:02:51,020 --> 01:02:53,480
to gather data that are unheard of

1416
01:02:53,480 --> 01:02:54,580
or are known of to most everyone.

1417
01:02:56,100 --> 01:02:57,540
There's a small chunk of it doing the research for this.

1418
01:02:57,820 --> 01:02:59,940
But there's just huge economy out there

1419
01:02:59,940 --> 01:03:00,860
that people don't know about.

1420
01:03:02,340 --> 01:03:04,400
I mentioned DHS's biometric exit.

1421
01:03:04,640 --> 01:03:07,580
This is a quote from the privacy impact report

1422
01:03:07,580 --> 01:03:10,900
that they did to assess necessity for this service.

1423
01:03:12,000 --> 01:03:13,820
The only way for an individual to ensure here

1424
01:03:13,820 --> 01:03:16,220
is not subject to the collection of biometric information

1425
01:03:17,000 --> 01:03:18,360
is to refrain from traveling.

1426
01:03:18,840 --> 01:03:20,520
So if you don't want to fly out of the country,

1427
01:03:20,600 --> 01:03:21,680
you don't want to leave the country,

1428
01:03:21,840 --> 01:03:22,420
oh, sorry,

1429
01:03:22,540 --> 01:03:25,580
if you don't want your face scanned by DHS,

1430
01:03:25,880 --> 01:03:26,080
you don't want to leave the country,

1431
01:03:26,100 --> 01:03:26,980
you don't leave the country.

1432
01:03:27,100 --> 01:03:28,200
You have no choice in the matter.

1433
01:03:28,280 --> 01:03:29,020
It's just happening.

1434
01:03:29,360 --> 01:03:30,520
That's actually not true.

1435
01:03:30,700 --> 01:03:33,520
When you are entering the United States,

1436
01:03:33,660 --> 01:03:35,660
they direct you to these kiosks

1437
01:03:35,660 --> 01:03:37,380
and you are supposed to put in your information.

1438
01:03:38,000 --> 01:03:39,600
They take a picture of your face.

1439
01:03:39,800 --> 01:03:40,820
But it's actually very different.

1440
01:03:41,220 --> 01:03:44,700
You have the option to get the old-style paper form

1441
01:03:44,700 --> 01:03:47,440
and fill it out and they don't take a picture of you.

1442
01:03:50,260 --> 01:03:52,420
This is specific to leaving the country.

1443
01:03:54,820 --> 01:03:56,080
I could be misremembering,

1444
01:03:56,100 --> 01:03:58,200
but I thought it said when non-citizens

1445
01:03:58,200 --> 01:04:00,300
want to leave the country, their face has to be scanned.

1446
01:04:00,400 --> 01:04:01,560
Oh, I don't know about non-citizens.

1447
01:04:01,900 --> 01:04:03,320
Okay. Yes, I should be able to speak about that.

1448
01:04:03,440 --> 01:04:05,540
Thank you. Yes, this applies to non-citizens.

1449
01:04:06,920 --> 01:04:08,240
Again, please check me on this.

1450
01:04:08,280 --> 01:04:08,520
Correct me.

1451
01:04:08,560 --> 01:04:10,300
But the point I'm trying to make is

1452
01:04:11,420 --> 01:04:12,720
government authorities are putting

1453
01:04:12,720 --> 01:04:14,380
these collection methods in place

1454
01:04:14,380 --> 01:04:17,500
and making them mandatory with very little knowledge

1455
01:04:17,500 --> 01:04:19,580
and input from the rest of us.

1456
01:04:19,620 --> 01:04:21,240
This is kind of the reality of the position

1457
01:04:21,240 --> 01:04:22,120
where we're at right now.

1458
01:04:23,620 --> 01:04:24,800
I've encountered that one.

1459
01:04:26,160 --> 01:04:26,520
Please.

1460
01:04:28,940 --> 01:04:30,860
Yes, that's where I'm quoting from.

1461
01:04:31,680 --> 01:04:34,420
Okay, so maybe I'm mischaracterizing it.

1462
01:04:34,500 --> 01:04:35,520
They do go through an assessment.

1463
01:04:36,580 --> 01:04:38,040
But how many people here know about

1464
01:04:38,760 --> 01:04:39,480
DHS's PIA?

1465
01:04:40,420 --> 01:04:41,620
A handful, a small handful.

1466
01:04:41,800 --> 01:04:43,760
So how many of our legislators

1467
01:04:43,760 --> 01:04:44,560
know about it

1468
01:04:45,300 --> 01:04:46,600
and give input to it?

1469
01:04:46,680 --> 01:04:49,440
Do we feel this is correct and this is our country, right?

1470
01:04:49,560 --> 01:04:51,220
Is this something we want for our country to do?

1471
01:04:52,160 --> 01:04:53,480
And I'm not here to pass judgment.

1472
01:04:53,480 --> 01:04:54,780
I'm just saying this is the reality

1473
01:04:56,100 --> 01:04:58,260
and this is the path that we're on.

1474
01:05:00,540 --> 01:05:01,840
Zeynep Tufekci is

1475
01:05:01,840 --> 01:05:02,820
I hope I say her name right.

1476
01:05:02,980 --> 01:05:04,920
Zeynep is from Turkey.

1477
01:05:05,900 --> 01:05:06,800
Talks a lot about

1478
01:05:07,580 --> 01:05:08,620
social media use

1479
01:05:08,620 --> 01:05:10,300
and how it affects revolutions

1480
01:05:10,300 --> 01:05:12,420
and how technology affects our lives.

1481
01:05:12,960 --> 01:05:15,620
And this quote was in response to

1482
01:05:15,620 --> 01:05:17,320
Amazon's new camera,

1483
01:05:17,420 --> 01:05:19,120
the camera where you stand in front of it.

1484
01:05:19,280 --> 01:05:21,040
Amazon takes a picture and it recommends

1485
01:05:21,040 --> 01:05:22,000
new clothes for you.

1486
01:05:24,140 --> 01:05:25,700
I didn't talk about it much, but earlier

1487
01:05:26,100 --> 01:05:27,040
in the talk I kind of alluded to it.

1488
01:05:27,460 --> 01:05:29,040
You can get a lot from a photograph.

1489
01:05:29,440 --> 01:05:31,580
You can get someone's age, their mood,

1490
01:05:31,700 --> 01:05:33,380
their demeanor, maybe a medical condition,

1491
01:05:34,620 --> 01:05:35,760
what's in the room next to them.

1492
01:05:36,680 --> 01:05:37,780
AI and the

1493
01:05:37,780 --> 01:05:39,840
algorithms can identify what else is

1494
01:05:39,840 --> 01:05:41,360
the objects in the space.

1495
01:05:41,680 --> 01:05:43,480
So there's a lot of information you can capture from a photograph

1496
01:05:44,000 --> 01:05:45,880
that can be, a lot of data conclusions that can be

1497
01:05:45,880 --> 01:05:47,200
teased out from just a photograph.

1498
01:05:48,120 --> 01:05:49,640
So her take on this was

1499
01:05:49,640 --> 01:05:51,580
we're sleepwalking into surveillance capitalism.

1500
01:05:51,740 --> 01:05:54,040
We're just walking into it without noticing what's going on.

1501
01:05:54,620 --> 01:05:55,840
And it's evolving into

1502
01:05:56,820 --> 01:05:57,920
data and computation

1503
01:05:57,920 --> 01:05:59,940
driven authoritarianism.

1504
01:06:00,460 --> 01:06:01,800
One cool service at a time.

1505
01:06:01,900 --> 01:06:03,340
We buy these things, we use them because they're neat,

1506
01:06:03,460 --> 01:06:04,860
because they're fun, because it's convenient.

1507
01:06:05,660 --> 01:06:07,240
But we don't realize the implications

1508
01:06:07,240 --> 01:06:08,320
and what it could lead to.

1509
01:06:10,860 --> 01:06:12,560
So that's kind of it.

1510
01:06:12,600 --> 01:06:13,200
Here's what's happening,

1511
01:06:13,860 --> 01:06:14,600
here's where we are,

1512
01:06:14,680 --> 01:06:16,860
and where we're going to go from here.

1513
01:06:17,720 --> 01:06:19,820
I don't know, but it's interesting.

1514
01:06:20,840 --> 01:06:22,160
And thank you all for coming out.

1515
01:06:22,360 --> 01:06:23,240
Hope it made sense.

1516
01:06:28,120 --> 01:06:29,680
Thank you.