start	end	text
640	7180	Hello, DEF CON. My name is Andrea, and today I'm going to be talking to you about threat models
7180	14380	for patient communities on social networks. I'm not going to spend too much time about me. This
14380	22840	is my second year at DEF CON. I am a BRCA1 community data organizer, a mutant-turned
22840	28880	security researcher. Last year, I presented on a major security flaw in Facebook's group
28880	36700	architecture. I started a nonprofit called Life Collective and enough about me. I want to start
36700	45020	with this photograph of Portland. It is a community under siege. And when we look at this photograph,
45020	51840	depending on your politics, your ideology, your education level, your hopes, your fears,
51840	57860	you might see different things from this photograph. But one thing we might agree on
57860	66960	is that Portland is a community in turmoil. I look at this photo and I see thousands of
66960	73900	beautiful points of light generated from cell phones, from people with varying levels of
73900	81280	technical literacy, and I hope to God they understand how their data at this protest
81280	90340	may be used against them. They are vulnerable, and in raising their voices, their data can be
90340	97960	something that is weaponized. Well, how do we think about this in context of a digital community
97960	107280	for health care or for health? Well, I'd like to start with just a quick framework for what I'm
107280	112360	going to cover today on threat models and health social networks from a community's perspective.
112660	120460	We often think about protecting systems and data and not necessarily about the communities or
120460	127640	digital spaces where we reside. So in this talk, I'll cover how the nature of the adversary,
127640	133000	when we think about threat models, is becoming difficult to detect. I'm going to talk about how
133000	139860	nobody is immune to an infodemic, and especially as this COVID pandemic rages on. I'm going to talk
139960	145920	a little bit about how influence can be deadly or it can save lives. And finally, ask what is
145920	152620	the path forward from here? How do we survive an infodemic? Well, let me start with my village.
152620	160140	This is a quick network graph of my own community, and just like that picture in Portland, I would
160760	166320	kind of explain to everybody who isn't involved in patient communities or
166700	174280	e-patient social networks, we are right now also a community under siege. We are losing access to
174280	181340	care. We are losing access to meds. We are high-risk communities who have adverse or
181340	187040	underlying conditions that make us more at risk to potentially dying from COVID.
187640	196140	And these are work that spans to a much larger scale. In fact, there aren't a lot of statistics
196140	204200	on this in the pandemic, but I'll give you or point you to a survey from 2018 from Hope Lab
204720	213080	that shared 51% of young adults have tried to find people online with health concerns similar
213080	219600	to their own. What we call this phenomenon is peer support, and there's a whole body of evidence
219600	226400	around how peer support and health can have really beneficial effects. It can also have
226400	232180	harmful effects when the tech platforms where we reside or the knowledge that we share can
232180	241740	be weaponized against us. Further, it can be much more difficult when the nature of the adversary
241740	248760	is becoming harder and harder to detect. Well, what has this looked like over the past couple
248760	255320	of months? We have physicians at the steps of the Supreme Court in their white lab coats
256340	263920	advocating for the use of hydroxychloroquine, which we know is not an evidence-based treatment
263920	272580	for COVID-19. We have doctors flocking to TikTok. A lot of ways these doctors have the best of
272580	281180	intentions, but when we encourage the sharing of knowledge in a health community, we are
282000	289520	inevitably exposing the people who engage at that level on these platforms to have those data
289520	296840	weaponized against them. Well, the nature of the adversary is also becoming difficult to detect
297240	304520	because the leaders and scientists who have traditionally been in these positions of power
305000	313500	are in some ways enabling disinformation. This is a picture of George Church who recently launched
313900	321840	a dating app based on genomics and here he is snorting his own vaccine that is not FDA approved.
321840	329320	And it begs the question, how are we replacing science with ideology? How are these disinformation
330280	336360	narratives targeting vulnerable groups? Well, more and more it's starting to feel like no one
336360	347430	is coming to save us. Well, further, no one is immune to ad targeting or disinformation
348410	354570	on these tech platforms where we reside. I highly encourage you to take a look at this
355490	362650	recent news article about Facebook and direct-to-consumer pharmaceutical ads.
362650	368630	Here's just one great example of a direct-to-consumer ad. I have to laugh at this one.
368630	376150	For anybody who knows about GINA, the Genetic Information Non-Discrimination Act, here we have
376290	383550	a direct-to-consumer ad that is advertising life insurance based on your genome. Well,
383550	391690	there's a problem with that. GINA, the Genetic Information Non-Discrimination Act,
391690	399030	has one loophole that allows companies to discriminate, and that one loophole is for
399030	408670	life insurance companies. So I ask, or it begs the question, how far have we gotten from serving
408670	415750	and the people that reside on these platforms with good knowledge in a way that is going to
415750	421670	protect them instead of use health or genetic information against people?
423450	431290	Influence can be deadly. I'm going to give you a couple of examples here. One is making the round
431290	438090	lately in Facebook groups. It's a black salve treatment, a fake cancer cure, and this is what
438090	447850	happens when you apply a snake oil treatment that essentially burns your skin and is being
448890	456130	peddled by marketers in these different groups. Some of them are people joining closed groups
457030	465170	under the guise of being a person offering support when really they have an interest in
465170	473010	peddling snake oil or other types of treatments. Parents are poisoning their children with bleach
473010	481170	in order to cure autism. And we could teach the debate all we want on the anti-vax movement.
481530	490130	I'll just offer up this one example of a mom not giving her son Tamiflu, and he later died.
490130	497370	There are more and more examples popping up like this all over the place, and I could go on and on.
498330	507130	So in one aspect, there is a bright spot here when we think about social networks coming together
507130	513390	and doing so in a way that is evidence-based. I want to give this one example of a community
513870	523150	within my own ecosystem of breast cancer social networks that actually came together in a good
523150	533510	way. This was a group of women who organized around a rare disorder called BILCL, which is
533510	539810	breast implant illness and a rare form of leukemia that was being caused by a certain type of
539810	546330	implant that a lot of women who are going through breast reconstruction or bilateral
546330	554590	mastectomies were opting to have. Well, as it turns out, the data on adverse events for
555530	562010	this particular type of implant were not being reported back to the FDA. And so these women
562010	570190	banded together on very large Facebook groups. They worked with physicians, and the outcome of
570190	576530	that was allergen was cited, and there was an FDA warning, and more transparency in different
576530	584050	processes around post-approval study requirements for breast implants. So there can be good outcomes
584050	591130	here when we think about how social networks come together. It's just a double-edged sword.
592010	597650	Peer support and the lifelines I've seen over the many years that I've been on social media
598070	606050	can be life-saving. They can change things, but we have to recognize that there are good effects
606050	612910	and bad effects. We have to bolster the good while really acknowledging the harm and asking ourselves,
612910	620610	how do we re-ground in ethics, and how do we first do no harm? Well, what does an infodemic
620610	628650	look like when we zoom out and take a look at how social networks, bots, and disinformation
628650	640770	campaigns target vulnerable communities at scale? Here is a quick snapshot of known conspiracy
640770	648610	theories and disinformation hashtags. And I'm just going to give this one example and move my
648610	657290	cursor over here at the right so you can see QAnon in red. This is a cluster of the QAnon
657290	663530	hashtag tweeting about COVID. This comes from a really great open-source project called Project
663530	671110	Domino. I invite you to reach out to Leo Mayerovich, who is the co-founder of Grasphistory,
671110	678510	and I'm on their COVID hunting team in Project Domino, and it's just a really fantastic group.
679310	685590	Banded together and started visualizing what these disinformation networks, what these bot
685590	694770	networks look like, and thinks about how their behavior can be clustered together in the types
694770	700590	of language that are being used or the number of tweets per day that might be a pattern that
700590	707950	is statistically significant. Well, I look at this and I think, well, my gosh, this is
708230	716550	a snapshot of the infodemic. This is what a biological process looks like on a social network.
716550	724250	To me, it looks like social networks not being able to detect and respond effectively to these
724250	729730	campaigns in a way that's getting ahead of the infodemic, and that's one of the reasons why we're
729730	739090	not flattening the curve. Here's another picture that I think is really important. This is another
739090	746990	one from Project Domino. This is roughly 211,000 tweets from 50 COVID-related misinformation
746990	754530	tag campaigns. I want to give out a shout out to Cody Webb who helped generate this.
754530	764090	And once again, you know, this is what pollution of information in social networks when people are
764090	770610	going through trauma looks like at scale. When we have bot networks, when we have sock puppets
770610	779270	attacking and just spewing out the wrong information to vulnerable people who are
779270	784470	seeking knowledge, evidence-based knowledge, and they don't know who and what to believe anymore.
787480	794920	So where does this leave us? It leaves us leading the world in not flattening the curve.
794920	803280	Here is daily confirmed cases, a five-day moving average of new cases where we are
804040	812620	hitting between 60 and 70,000 on our five-day moving average of new cases. Users really don't
812620	818380	have rights when it comes to health privacy on social networks, and that in of itself is a
818380	824680	threat model we need to think about. Health information can be used to deny jobs, can be used
824680	836100	to deny health care, and the one agency that we have put a complaint forth to is the FTC. Well,
836100	842140	I think it's important to think about this really great paper from Nature Medicine called Privacy in
842140	850960	the Age of Medical Big Data. It shows or paints a picture of the big data policy landscape as an
850960	859140	iceberg. Above the water, at the tip of the iceberg, we have all HIPAA-covered entities where so much in
859140	864980	cybersecurity, when we talk about protecting devices, when we talk about health data breaches,
864980	874820	that's above the iceberg. Well, below the iceberg is a lot more. Not only has the FTC failed
875280	880440	to enforce or protect the health privacy on social networks, and I know I'm blocking this,
880440	889640	so I'm going to move over here. There we go. The FTC had a settlement back in 2019, a $5 billion
889640	897640	settlement, and we brought a complaint to the FTC under this PHR breach notification rule.
897640	904340	It's the one rule in the one agency outside of Health and Human Services that has authority to
904340	913720	enforce any kind of consumer protection for health information. And so we went to them and said,
913720	919040	you know, Facebook has a major data breach that has to do with health information, and there was
919780	923040	basically no response in this $5 billion settlement.
924620	930680	Meanwhile, health insurers are vacuuming up details about us. It can raise our rates.
931300	937680	Any health information that you share on a social network can be used by data aggregators and
937680	946660	packaged up to basically be used to discriminate against you, and I want everybody just to be very
946660	952920	careful about that. For me, as somebody who's been on social media for 10 years, the genie is already
952920	959540	out of the bottle. And I recognize that when people go through a new diagnosis, they're seeking
960240	965540	support and information, but we don't have any safe harbors. We don't have any safe spaces
966380	973340	anymore to talk about our health, and that's a problem. Where do we go from here?
974060	980580	I think we need to lock arms, and I'm going to take a page from I Am the Cavalry and say,
980580	987780	no one is coming to save us. I've tried. Nobody's coming to save us. The only people who are coming
987780	993940	to save us are the ones directly affected, and I really hope that I can give a meaningful call
993940	1001640	to action to the folks who are listening today. I need the cybersecurity community. I need the
1001640	1008780	national security community. I need healthcare leaders and experts to come and lock arms with
1008780	1014800	these patient communities and lift our voices up. If we don't do that, if we don't meet people
1014800	1021680	where they are and start giving them meaningful rights and protections, this harm and damage is
1021680	1026780	going to continue, and we are not going to flatten the curve. Well, what does that look like, and how
1026780	1032520	are we doing this through the Light Collective? We have a very ambitious roadmap. We are working
1032520	1038400	on a framework for collective self-governance that is driven by patient communities that
1038400	1044560	reside on social networks. We are developing best practices to protect patient support groups
1045490	1052360	that already exist on Facebook and Twitter and asking ourselves, well, if we are in such a
1052360	1058520	hostile environment, maybe we need to leave the platform. How do we do that? We're looking at
1058520	1065210	legal frameworks like a data trust. We're looking at cyber hygiene best practices, onboarding mentors,
1065210	1072330	and I invite you to get involved, to donate. We have weekly events, and we would love to see you
1072330	1080690	there. Finally, thank you for your time. Join us. You know where to find me. Come follow Be Like
1080690	1088110	Light, and we will see you on the internet. Bye for now.