1 00:00:00,640 --> 00:00:02,220 Hello, DEF CON. 2 00:00:02,300 --> 00:00:10,520 My name is Andrea, and today I'm going to be talking to you about threat models for patient communities on social networks. 3 00:00:12,040 --> 00:00:14,220 I'm not going to spend too much time about me. 4 00:00:14,220 --> 00:00:16,900 This is my second year at DEF CON. 5 00:00:16,900 --> 00:00:24,240 I am a BRCA1 community data organizer, a mutant-turned security researcher. 6 00:00:24,240 --> 00:00:30,260 Last year, I presented on a major security flaw in Facebook's group architecture. 7 00:00:30,460 --> 00:00:35,060 I started a nonprofit called Life Collective and enough about me. 8 00:00:35,340 --> 00:00:39,100 I want to start with this photograph of Portland. 9 00:00:39,100 --> 00:00:41,960 It is a community under siege. 10 00:00:41,960 --> 00:00:55,660 And when we look at this photograph, depending on your politics, your ideology, your education level, your hopes, your fears, you might see different things from this photograph. 11 00:00:55,700 --> 00:01:03,360 But one thing we might agree on is that Portland is a community in turmoil. 12 00:01:03,540 --> 00:01:23,420 I look at this photo and I see thousands of beautiful points of light generated from cell phones, from people with varying levels of technical literacy, and I hope to God they understand how their data at this protest may be used against them. 13 00:01:24,360 --> 00:01:32,540 They are vulnerable, and in raising their voices, their data can be something that is weaponized. 14 00:01:32,580 --> 00:01:40,880 Well, how do we think about this in context of a digital community for health care or for health? 15 00:01:41,780 --> 00:01:52,360 Well, I'd like to start with just a quick framework for what I'm going to cover today on threat models and health social networks from a community's perspective. 16 00:01:52,660 --> 00:02:03,220 We often think about protecting systems and data and not necessarily about the communities or digital spaces where we reside. 17 00:02:03,680 --> 00:02:11,660 So in this talk, I'll cover how the nature of the adversary, when we think about threat models, is becoming difficult to detect. 18 00:02:11,900 --> 00:02:19,120 I'm going to talk about how nobody is immune to an infodemic, and especially as this COVID pandemic rages on. 19 00:02:19,260 --> 00:02:24,200 I'm going to talk a little bit about how influence can be deadly or it can save lives. 20 00:02:24,200 --> 00:02:27,280 And finally, ask what is the path forward from here? 21 00:02:27,280 --> 00:02:29,440 How do we survive an infodemic? 22 00:02:30,360 --> 00:02:32,620 Well, let me start with my village. 23 00:02:32,620 --> 00:02:52,600 This is a quick network graph of my own community, and just like that picture in Portland, I would kind of explain to everybody who isn't involved in patient communities or e-patient social networks, we are right now also a community under siege. 24 00:02:52,600 --> 00:02:54,860 We are losing access to care. 25 00:02:54,860 --> 00:02:57,000 We are losing access to meds. 26 00:02:57,000 --> 00:03:07,040 We are high-risk communities who have adverse or underlying conditions that make us more at risk to potentially dying from COVID. 27 00:03:07,640 --> 00:03:12,320 And these are work that spans to a much larger scale. 28 00:03:12,320 --> 00:03:34,460 In fact, there aren't a lot of statistics on this in the pandemic, but I'll give you or point you to a survey from 2018 from Hope Lab that shared 51% of young adults have tried to find people online with health concerns similar to their own. 29 00:03:34,460 --> 00:03:45,180 What we call this phenomenon is peer support, and there's a whole body of evidence around how peer support and health can have really beneficial effects. 30 00:03:45,180 --> 00:03:54,380 It can also have harmful effects when the tech platforms where we reside or the knowledge that we share can be weaponized against us. 31 00:03:56,080 --> 00:04:06,020 Further, it can be much more difficult when the nature of the adversary is becoming harder and harder to detect. 32 00:04:06,020 --> 00:04:09,820 Well, what has this looked like over the past couple of months? 33 00:04:10,020 --> 00:04:26,060 We have physicians at the steps of the Supreme Court in their white lab coats advocating for the use of hydroxychloroquine, which we know is not an evidence-based treatment for COVID-19. 34 00:04:26,260 --> 00:04:29,880 We have doctors flocking to TikTok. 35 00:04:29,880 --> 00:04:52,060 A lot of ways these doctors have the best of intentions, but when we encourage the sharing of knowledge in a health community, we are inevitably exposing the people who engage at that level on these platforms to have those data weaponized against them. 36 00:04:52,400 --> 00:05:09,540 Well, the nature of the adversary is also becoming difficult to detect because the leaders and scientists who have traditionally been in these positions of power are in some ways enabling disinformation. 37 00:05:09,540 --> 00:05:21,840 This is a picture of George Church who recently launched a dating app based on genomics and here he is snorting his own vaccine that is not FDA approved. 38 00:05:21,840 --> 00:05:27,400 And it begs the question, how are we replacing science with ideology? 39 00:05:27,420 --> 00:05:33,520 How are these disinformation narratives targeting vulnerable groups? 40 00:05:33,520 --> 00:05:38,420 Well, more and more it's starting to feel like no one is coming to save us. 41 00:05:41,670 --> 00:05:51,490 Well, further, no one is immune to ad targeting or disinformation on these tech platforms where we reside. 42 00:05:51,850 --> 00:06:02,650 I highly encourage you to take a look at this recent news article about Facebook and direct-to-consumer pharmaceutical ads. 43 00:06:02,650 --> 00:06:06,010 Here's just one great example of a direct-to-consumer ad. 44 00:06:06,010 --> 00:06:08,630 I have to laugh at this one. 45 00:06:08,630 --> 00:06:22,630 For anybody who knows about GINA, the Genetic Information Non-Discrimination Act, here we have a direct-to-consumer ad that is advertising life insurance based on your genome. 46 00:06:22,970 --> 00:06:25,610 Well, there's a problem with that. 47 00:06:28,070 --> 00:06:41,010 GINA, the Genetic Information Non-Discrimination Act, has one loophole that allows companies to discriminate, and that one loophole is for life insurance companies. 48 00:06:41,010 --> 00:07:01,670 So I ask, or it begs the question, how far have we gotten from serving and the people that reside on these platforms with good knowledge in a way that is going to protect them instead of use health or genetic information against people? 49 00:07:03,450 --> 00:07:05,650 Influence can be deadly. 50 00:07:06,030 --> 00:07:08,530 I'm going to give you a couple of examples here. 51 00:07:08,530 --> 00:07:14,170 One is making the round lately in Facebook groups. 52 00:07:14,170 --> 00:07:32,830 It's a black salve treatment, a fake cancer cure, and this is what happens when you apply a snake oil treatment that essentially burns your skin and is being peddled by marketers in these different groups. 53 00:07:32,830 --> 00:07:49,070 Some of them are people joining closed groups under the guise of being a person offering support when really they have an interest in peddling snake oil or other types of treatments. 54 00:07:49,070 --> 00:07:55,710 Parents are poisoning their children with bleach in order to cure autism. 55 00:07:56,250 --> 00:08:01,170 And we could teach the debate all we want on the anti-vax movement. 56 00:08:01,530 --> 00:08:10,130 I'll just offer up this one example of a mom not giving her son Tamiflu, and he later died. 57 00:08:10,130 --> 00:08:17,370 There are more and more examples popping up like this all over the place, and I could go on and on. 58 00:08:18,330 --> 00:08:30,750 So in one aspect, there is a bright spot here when we think about social networks coming together and doing so in a way that is evidence-based. 59 00:08:30,750 --> 00:08:43,870 I want to give this one example of a community within my own ecosystem of breast cancer social networks that actually came together in a good way. 60 00:08:43,870 --> 00:09:09,570 This was a group of women who organized around a rare disorder called BILCL, which is breast implant illness and a rare form of leukemia that was being caused by a certain type of implant that a lot of women who are going through breast reconstruction or bilateral mastectomies were opting to have. 61 00:09:09,570 --> 00:09:21,050 Well, as it turns out, the data on adverse events for this particular type of implant were not being reported back to the FDA. 62 00:09:21,050 --> 00:09:26,230 And so these women banded together on very large Facebook groups. 63 00:09:26,230 --> 00:09:42,030 They worked with physicians, and the outcome of that was allergen was cited, and there was an FDA warning, and more transparency in different processes around post-approval study requirements for breast implants. 64 00:09:42,030 --> 00:09:49,150 So there can be good outcomes here when we think about how social networks come together. 65 00:09:49,150 --> 00:09:51,130 It's just a double-edged sword. 66 00:09:52,010 --> 00:09:59,710 Peer support and the lifelines I've seen over the many years that I've been on social media can be life-saving. 67 00:09:59,930 --> 00:10:06,910 They can change things, but we have to recognize that there are good effects and bad effects. 68 00:10:06,910 --> 00:10:17,710 We have to bolster the good while really acknowledging the harm and asking ourselves, how do we re-ground in ethics, and how do we first do no harm? 69 00:10:19,030 --> 00:10:33,410 Well, what does an infodemic look like when we zoom out and take a look at how social networks, bots, and disinformation campaigns target vulnerable communities at scale? 70 00:10:34,910 --> 00:10:45,930 Here is a quick snapshot of known conspiracy theories and disinformation hashtags. 71 00:10:46,070 --> 00:10:53,610 And I'm just going to give this one example and move my cursor over here at the right so you can see QAnon in red. 72 00:10:53,610 --> 00:10:59,830 This is a cluster of the QAnon hashtag tweeting about COVID. 73 00:10:59,830 --> 00:11:04,510 This comes from a really great open-source project called Project Domino. 74 00:11:04,510 --> 00:11:18,510 I invite you to reach out to Leo Mayerovich, who is the co-founder of Grasphistory, and I'm on their COVID hunting team in Project Domino, and it's just a really fantastic group. 75 00:11:19,310 --> 00:11:43,190 Banded together and started visualizing what these disinformation networks, what these bot networks look like, and thinks about how their behavior can be clustered together in the types of language that are being used or the number of tweets per day that might be a pattern that is statistically significant. 76 00:11:43,190 --> 00:11:50,450 Well, I look at this and I think, well, my gosh, this is a snapshot of the infodemic. 77 00:11:50,670 --> 00:11:56,550 This is what a biological process looks like on a social network. 78 00:11:56,550 --> 00:12:11,930 To me, it looks like social networks not being able to detect and respond effectively to these campaigns in a way that's getting ahead of the infodemic, and that's one of the reasons why we're not flattening the curve. 79 00:12:15,630 --> 00:12:18,470 Here's another picture that I think is really important. 80 00:12:18,470 --> 00:12:21,090 This is another one from Project Domino. 81 00:12:21,350 --> 00:12:29,610 This is roughly 211,000 tweets from 50 COVID-related misinformation tag campaigns. 82 00:12:29,610 --> 00:12:34,530 I want to give out a shout out to Cody Webb who helped generate this. 83 00:12:34,530 --> 00:12:47,230 And once again, you know, this is what pollution of information in social networks when people are going through trauma looks like at scale. 84 00:12:47,230 --> 00:13:04,470 When we have bot networks, when we have sock puppets attacking and just spewing out the wrong information to vulnerable people who are seeking knowledge, evidence-based knowledge, and they don't know who and what to believe anymore. 85 00:13:07,480 --> 00:13:10,020 So where does this leave us? 86 00:13:10,020 --> 00:13:14,920 It leaves us leading the world in not flattening the curve. 87 00:13:14,920 --> 00:13:31,060 Here is daily confirmed cases, a five-day moving average of new cases where we are hitting between 60 and 70,000 on our five-day moving average of new cases. 88 00:13:31,260 --> 00:13:40,260 Users really don't have rights when it comes to health privacy on social networks, and that in of itself is a threat model we need to think about. 89 00:13:40,420 --> 00:13:55,720 Health information can be used to deny jobs, can be used to deny health care, and the one agency that we have put a complaint forth to is the FTC. 90 00:13:55,720 --> 00:14:05,840 Well, I think it's important to think about this really great paper from Nature Medicine called Privacy in the Age of Medical Big Data. 91 00:14:05,840 --> 00:14:11,920 It shows or paints a picture of the big data policy landscape as an iceberg. 92 00:14:12,420 --> 00:14:26,720 Above the water, at the tip of the iceberg, we have all HIPAA-covered entities where so much in cybersecurity, when we talk about protecting devices, when we talk about health data breaches, that's above the iceberg. 93 00:14:27,020 --> 00:14:31,120 Well, below the iceberg is a lot more. 94 00:14:31,500 --> 00:14:42,140 Not only has the FTC failed to enforce or protect the health privacy on social networks, and I know I'm blocking this, so I'm going to move over here. 95 00:14:42,200 --> 00:14:43,380 There we go. 96 00:14:43,660 --> 00:14:57,640 The FTC had a settlement back in 2019, a $5 billion settlement, and we brought a complaint to the FTC under this PHR breach notification rule. 97 00:14:57,640 --> 00:15:11,860 It's the one rule in the one agency outside of Health and Human Services that has authority to enforce any kind of consumer protection for health information. 98 00:15:12,040 --> 00:15:23,040 And so we went to them and said, you know, Facebook has a major data breach that has to do with health information, and there was basically no response in this $5 billion settlement. 99 00:15:24,620 --> 00:15:28,960 Meanwhile, health insurers are vacuuming up details about us. 100 00:15:28,960 --> 00:15:30,680 It can raise our rates. 101 00:15:31,300 --> 00:15:48,100 Any health information that you share on a social network can be used by data aggregators and packaged up to basically be used to discriminate against you, and I want everybody just to be very careful about that. 102 00:15:48,100 --> 00:15:54,160 For me, as somebody who's been on social media for 10 years, the genie is already out of the bottle. 103 00:15:54,660 --> 00:16:03,780 And I recognize that when people go through a new diagnosis, they're seeking support and information, but we don't have any safe harbors. 104 00:16:03,780 --> 00:16:10,860 We don't have any safe spaces anymore to talk about our health, and that's a problem. 105 00:16:11,620 --> 00:16:13,340 Where do we go from here? 106 00:16:14,060 --> 00:16:22,840 I think we need to lock arms, and I'm going to take a page from I Am the Cavalry and say, no one is coming to save us. 107 00:16:22,880 --> 00:16:24,460 I've tried. 108 00:16:24,460 --> 00:16:26,040 Nobody's coming to save us. 109 00:16:26,040 --> 00:16:37,720 The only people who are coming to save us are the ones directly affected, and I really hope that I can give a meaningful call to action to the folks who are listening today. 110 00:16:37,720 --> 00:16:40,540 I need the cybersecurity community. 111 00:16:40,540 --> 00:16:43,300 I need the national security community. 112 00:16:43,300 --> 00:16:51,980 I need healthcare leaders and experts to come and lock arms with these patient communities and lift our voices up. 113 00:16:51,980 --> 00:17:04,580 If we don't do that, if we don't meet people where they are and start giving them meaningful rights and protections, this harm and damage is going to continue, and we are not going to flatten the curve. 114 00:17:05,160 --> 00:17:09,020 Well, what does that look like, and how are we doing this through the Light Collective? 115 00:17:09,180 --> 00:17:11,660 We have a very ambitious roadmap. 116 00:17:11,660 --> 00:17:20,320 We are working on a framework for collective self-governance that is driven by patient communities that reside on social networks. 117 00:17:20,320 --> 00:17:35,280 We are developing best practices to protect patient support groups that already exist on Facebook and Twitter and asking ourselves, well, if we are in such a hostile environment, maybe we need to leave the platform. 118 00:17:35,280 --> 00:17:36,820 How do we do that? 119 00:17:36,980 --> 00:17:40,340 We're looking at legal frameworks like a data trust. 120 00:17:40,340 --> 00:17:49,250 We're looking at cyber hygiene best practices, onboarding mentors, and I invite you to get involved, to donate. 121 00:17:49,370 --> 00:17:53,090 We have weekly events, and we would love to see you there. 122 00:17:54,470 --> 00:17:56,810 Finally, thank you for your time. 123 00:17:57,110 --> 00:17:57,710 Join us. 124 00:17:57,710 --> 00:17:59,470 You know where to find me. 125 00:17:59,490 --> 00:18:05,910 Come follow Be Like Light, and we will see you on the internet. 126 00:18:06,410 --> 00:18:08,110 Bye for now.