1
00:00:00,620 --> 00:00:02,920
Hey, welcome. Thanks for coming to our session.

2
00:00:03,400 --> 00:00:06,480
We're going to be doing a talk on the Internet censorship

3
00:00:06,480 --> 00:00:08,960
and what governments are doing around the world.

4
00:00:09,320 --> 00:00:13,140
And we're going to stage it to be like a conversation.

5
00:00:13,560 --> 00:00:19,160
So the idea is us three or four with different perspectives are having a conversation.

6
00:00:20,300 --> 00:00:27,280
I'll try to be the moderator and create some runway for the three panelists to have a conversation.

7
00:00:27,280 --> 00:00:33,500
And it's something I think the problem with these is you sit around the speaker room

8
00:00:33,500 --> 00:00:35,960
and you're getting ready and you're having such a great conversation,

9
00:00:36,220 --> 00:00:39,580
you have to constantly be telling yourself, like, stop, save that for the stage.

10
00:00:39,740 --> 00:00:40,260
No, no, no, stop.

11
00:00:40,900 --> 00:00:44,920
So we think we've got some fun things to talk about, or at least we think it's fun.

12
00:00:45,840 --> 00:00:48,880
So to kick it off, I'm going to start on my right with Roger.

13
00:00:49,180 --> 00:00:51,140
And everybody's going to introduce themselves.

14
00:00:51,740 --> 00:00:53,140
And then we'll just jump right on in.

15
00:00:53,660 --> 00:00:54,180
All right?

16
00:00:54,460 --> 00:00:55,240
So thank you.

17
00:00:56,260 --> 00:00:56,680
Thank you.

18
00:01:01,120 --> 00:01:01,620
Okay.

19
00:01:01,840 --> 00:01:02,740
Hi, everybody.

20
00:01:02,900 --> 00:01:04,600
I'm Roger Dingeldine from Tor.

21
00:01:05,040 --> 00:01:07,460
I founded Tor long ago.

22
00:01:07,620 --> 00:01:09,500
I wrote the original Tor code.

23
00:01:09,740 --> 00:01:11,500
And now I wear all sorts of hats.

24
00:01:11,700 --> 00:01:15,400
And I've been paying more attention to the anti-censorship side of things,

25
00:01:15,620 --> 00:01:17,660
the anonymity research side of things,

26
00:01:17,860 --> 00:01:20,900
and the policy side of things, talking to governments

27
00:01:20,900 --> 00:01:24,940
and trying to help them understand that end-to-end encryption is important

28
00:01:24,940 --> 00:01:26,080
and things like that.

29
00:01:26,080 --> 00:01:28,140
And that's how I find myself on a policy panel.

30
00:01:33,460 --> 00:01:34,980
Hey, I'm Chris Painter.

31
00:01:35,300 --> 00:01:38,300
I've been doing cyber stuff for about 33 years now.

32
00:01:38,480 --> 00:01:40,220
I started as a federal prosecutor.

33
00:01:40,400 --> 00:01:43,120
I didn't start life as a federal prosecutor, but I was a federal prosecutor

34
00:01:43,600 --> 00:01:45,800
for a while doing cyber crime cases.

35
00:01:45,940 --> 00:01:49,200
Then I went to the mothership at Maine Justice in D.C.

36
00:01:49,240 --> 00:01:52,800
Then I was at the White House creating the cyber directorate.

37
00:01:52,820 --> 00:01:56,060
And then it was the world's first cyber crime case.

38
00:01:56,080 --> 00:01:57,220
Then I was a cyber diplomat at the State Department.

39
00:01:57,480 --> 00:01:59,780
And now, among other things, I run a foundation

40
00:01:59,780 --> 00:02:02,580
that's devoted to cyber security capacity building.

41
00:02:02,900 --> 00:02:08,020
And Jeff and I share a love for a movie called Colossus the Forbidden Project,

42
00:02:08,200 --> 00:02:10,660
which if you haven't seen it, it's one of the best movies out there.

43
00:02:10,820 --> 00:02:11,960
A little kitschy, but great.

44
00:02:12,380 --> 00:02:17,500
That's the original movie where the intelligent computer takes over the world

45
00:02:17,500 --> 00:02:18,860
to protect humanity from itself.

46
00:02:19,280 --> 00:02:21,960
And all the stories kind of come from that.

47
00:02:22,080 --> 00:02:23,860
It's based on a three series of books.

48
00:02:24,520 --> 00:02:25,260
Colossus the Forbidden Project.

49
00:02:25,260 --> 00:02:25,660
1970.

50
00:02:26,020 --> 00:02:27,840
14 years before war games were terminated.

51
00:02:28,740 --> 00:02:29,360
That's right.

52
00:02:30,320 --> 00:02:31,480
I'm Joel Todoroff.

53
00:02:31,780 --> 00:02:32,600
I'm a fed.

54
00:02:32,800 --> 00:02:34,480
I've been a fed for some time now.

55
00:02:34,860 --> 00:02:37,300
Working on technology issues really all around government.

56
00:02:37,560 --> 00:02:41,300
Right now, I'm working for the office of the national cyber director in the White House.

57
00:02:41,420 --> 00:02:43,980
And some of the projects that I work on relate to this.

58
00:02:44,000 --> 00:02:49,060
Relate to these questions of internet censorship and countering the misuse of authoritarian technologies.

59
00:02:49,700 --> 00:02:51,920
There is one caveat I do have to provide.

60
00:02:52,380 --> 00:02:53,760
They are letting me speak.

61
00:02:53,760 --> 00:02:58,160
But they said I have to put in a plug for ONCD and the work we're doing.

62
00:02:58,300 --> 00:03:03,260
And to tell you all to go to the website and look at the documents we've published.

63
00:03:04,420 --> 00:03:07,380
You actually have some requests for a comment, right?

64
00:03:07,740 --> 00:03:07,800
We do.

65
00:03:08,040 --> 00:03:09,420
It's not just look at the documents.

66
00:03:09,780 --> 00:03:09,860
Yeah.

67
00:03:09,940 --> 00:03:11,880
So there are areas where you can actively contribute.

68
00:03:12,900 --> 00:03:14,520
We'll talk more on this topic later.

69
00:03:14,680 --> 00:03:16,540
But one on open source security.

70
00:03:16,920 --> 00:03:18,200
There's a request for information out.

71
00:03:18,340 --> 00:03:20,520
So if people are interested in that topic, you can look there.

72
00:03:20,920 --> 00:03:23,640
One on workforce and the cybersecurity workforce.

73
00:03:23,640 --> 00:03:26,600
So if you're interested in that, please do give them a look.

74
00:03:27,020 --> 00:03:28,360
There's really a lot on there.

75
00:03:29,240 --> 00:03:29,680
Okay.

76
00:03:29,780 --> 00:03:30,960
So let's kick it off.

77
00:03:31,120 --> 00:03:32,340
Let's get this party started.

78
00:03:33,060 --> 00:03:34,040
You said something.

79
00:03:34,620 --> 00:03:35,700
I'm going to jump on you first.

80
00:03:36,860 --> 00:03:40,440
You said censorship and other authoritarian technologies.

81
00:03:41,220 --> 00:03:43,220
What are authoritarian technologies?

82
00:03:44,340 --> 00:03:45,040
Do we know?

83
00:03:45,340 --> 00:03:45,880
I mean, it's not.

84
00:03:46,020 --> 00:03:46,960
Everything is dual use.

85
00:03:47,200 --> 00:03:52,640
So is it really just the way in which the commercial off the shelf technology is configured?

86
00:03:52,640 --> 00:03:54,500
Like the way the router is filtering?

87
00:03:54,820 --> 00:03:57,320
Or is it we can actually make that distinction?

88
00:03:58,800 --> 00:04:00,980
I feel like we're starting with a really hard question.

89
00:04:01,360 --> 00:04:02,240
And I love it.

90
00:04:02,340 --> 00:04:06,260
So I don't have, I think, a great answer.

91
00:04:06,380 --> 00:04:06,920
But I have a thought.

92
00:04:07,040 --> 00:04:12,100
And the thought is the general sense we come in with is that technology starts as being value neutral.

93
00:04:12,360 --> 00:04:17,680
That we imbue it with values by creating it, by operating it, by owning it.

94
00:04:17,800 --> 00:04:21,900
And so a technology or a protocol is not.

95
00:04:21,900 --> 00:04:26,180
Itself going to be authoritarian or democratic.

96
00:04:26,440 --> 00:04:28,740
And I think there's a sense in which that is certainly true.

97
00:04:28,920 --> 00:04:29,180
Right?

98
00:04:30,980 --> 00:04:35,440
Maybe that's DNS blocking or IP or something like that.

99
00:04:35,540 --> 00:04:38,620
You can certainly imagine a lot of entirely legitimate uses.

100
00:04:38,800 --> 00:04:45,300
And you can also see instances where an authoritarian regime would misuse the same technologies, the same protocols.

101
00:04:45,440 --> 00:04:49,700
To do something like target ethnic minorities or surveil journalists.

102
00:04:49,700 --> 00:04:54,340
Or prevent people from accessing LGBT information on the Internet.

103
00:04:54,560 --> 00:04:54,600
Right?

104
00:04:54,840 --> 00:04:56,360
Those would definitely be problematic.

105
00:04:56,760 --> 00:05:01,380
And we can say, okay, the values that we're ascribing to this are those from the owners and operators.

106
00:05:02,700 --> 00:05:08,340
But different than, say, I don't know, commercial command and control for ransomware.

107
00:05:09,340 --> 00:05:11,920
Or NSO, you know, things that have made it.

108
00:05:12,180 --> 00:05:18,860
There seems to be a threshold that gets you on a sanctions list or on a commerce, you know, arrangement.

109
00:05:19,380 --> 00:05:19,680
Right?

110
00:05:20,940 --> 00:05:22,420
So there are some.

111
00:05:23,260 --> 00:05:23,700
Yeah.

112
00:05:23,780 --> 00:05:28,800
So you can definitely do things that are really problematic with the technology.

113
00:05:29,380 --> 00:05:33,360
And so I know Chris has some specific thoughts on this.

114
00:05:33,500 --> 00:05:40,100
But one of the things that I'll also flag that I think is interesting is this question of our default state of saying technology is value neutral.

115
00:05:41,460 --> 00:05:47,240
One of the things the Biden administration is looking at and you'll see a resurgence in is this focus on things like standards bodies.

116
00:05:47,400 --> 00:05:48,760
Which gets to this idea that.

117
00:05:50,240 --> 00:05:54,260
The value neutrality of technology is a really good first pass.

118
00:05:54,560 --> 00:05:58,140
But then you have to start asking, is that the case always?

119
00:05:58,260 --> 00:06:07,180
Or are there things where really early in the design and implementation you might build something in a way that it's predisposed to be used by an authoritarian regime?

120
00:06:07,460 --> 00:06:13,040
In a way that it's predisposed to enable an anti-democratic or an anti-liberal use of the technology?

121
00:06:13,400 --> 00:06:18,740
And how do we think about ensuring that our values are put into the tech statement?

122
00:06:18,740 --> 00:06:21,540
And how do we think about ensuring that our values are put into protocols or put into standards from the beginning?

123
00:06:22,200 --> 00:06:26,180
And that I think is certainly an area of ongoing interest and an area of ongoing effort.

124
00:06:26,780 --> 00:06:28,020
I think that's right.

125
00:06:28,120 --> 00:06:31,460
I think that the technology is largely value neutral.

126
00:06:31,660 --> 00:06:32,580
And we've always said that.

127
00:06:32,620 --> 00:06:35,140
It's been like a talking point forever that people said.

128
00:06:35,240 --> 00:06:36,140
And I think it's largely true.

129
00:06:37,000 --> 00:06:42,980
There is some technology, some things that are clearly designed for purposes that are to subvert civil liberties.

130
00:06:43,060 --> 00:06:48,720
Or to enable unreviewed and undemocratic sort of policies.

131
00:06:48,720 --> 00:06:50,460
Sort of surveillance of folks.

132
00:06:50,900 --> 00:06:55,540
But the problem is whenever we've talked in the past about, oh, we need to regulate this.

133
00:06:55,620 --> 00:06:56,560
Oh, we need to make this illegal.

134
00:06:57,100 --> 00:07:01,000
That's really problematic because of the dual use issue that Jeff talked about.

135
00:07:01,540 --> 00:07:06,220
And to give you a good example, we tried this years ago now with the Vassanar.

136
00:07:06,380 --> 00:07:11,180
The Vassanar arrangement is this export control issue that's used for lots of different things.

137
00:07:11,300 --> 00:07:17,880
But we tried this with software that could be used to either launch attacks or to surveil.

138
00:07:17,880 --> 00:07:20,140
And, you know, to protect civil liberties.

139
00:07:20,340 --> 00:07:22,640
And the U.S. was a big mover of this.

140
00:07:22,720 --> 00:07:23,220
And we did it.

141
00:07:23,740 --> 00:07:31,020
But the problem was it really didn't work very well because it also inadvertently covered security software.

142
00:07:31,300 --> 00:07:33,700
So this is a tension which I think is very difficult.

143
00:07:33,860 --> 00:07:34,640
But I do agree with you.

144
00:07:34,720 --> 00:07:41,460
I think there's some ways you can architect the tools, the technology that clearly are meant in a bad way.

145
00:07:42,460 --> 00:07:44,740
But at the same time, it's a pretty slippery slope.

146
00:07:44,800 --> 00:07:47,280
So figuring out where that line is I think is very difficult.

147
00:07:47,460 --> 00:07:47,860
Okay.

148
00:07:47,880 --> 00:07:50,720
And I'll disagree so that we get a good panel here.

149
00:07:51,440 --> 00:07:54,860
So I keep hearing that technology is inherently neutral.

150
00:07:55,100 --> 00:07:56,720
It's what you do with it that matters.

151
00:07:56,860 --> 00:07:58,660
But you have to look at the architecture.

152
00:07:58,960 --> 00:08:05,520
Some technology is inherently decentralized that empowers a broad group of people.

153
00:08:05,620 --> 00:08:09,660
Some technology is inherently centralized that ends up centralizing power.

154
00:08:09,920 --> 00:08:14,120
So you might start off thinking the technology side is inherently neutral.

155
00:08:14,260 --> 00:08:16,600
But, no, technology is inherently political.

156
00:08:16,600 --> 00:08:31,140
And you need to think through what people are going to use it for because so if you're going to end up if you're not thinking it through, then you're going to end up reinforcing the existing power structures.

157
00:08:31,460 --> 00:08:35,960
And if you want to build something that changes the power structures, that's political.

158
00:08:36,220 --> 00:08:38,080
And you need to think that through at the architecture.

159
00:08:38,380 --> 00:08:38,400
Wait, wait.

160
00:08:38,420 --> 00:08:40,780
I have to challenge it a little bit.

161
00:08:40,860 --> 00:08:42,620
And I would agree with you it's political.

162
00:08:42,740 --> 00:08:46,260
But I would also say it's inherently now commercial.

163
00:08:46,260 --> 00:08:50,200
And so the commercial pressures are centralized for efficiency.

164
00:08:50,680 --> 00:08:58,060
And the market forces now are essentially creating pools of technology then that it's like an attractive nuisance.

165
00:08:58,340 --> 00:09:04,860
If you only have to provide one subpoena to Gmail and you get half of the email accounts on the planet, boy, that's really convenient.

166
00:09:05,540 --> 00:09:10,980
But if you had to supply subpoenas to 50,000 email providers, that's a pain in the ass.

167
00:09:11,220 --> 00:09:13,600
And so maybe it's not also political.

168
00:09:13,780 --> 00:09:14,600
It's a side effect.

169
00:09:14,600 --> 00:09:19,480
Or the political side sees the market force and say, wow, this is great for us.

170
00:09:19,700 --> 00:09:21,700
Yeah, that centralization is super scary.

171
00:09:21,860 --> 00:09:29,880
And the centralization is a choice made by people when they're building their architecture to centralize the power or decentralize the power.

172
00:09:30,060 --> 00:09:32,880
And that centralization, it's not just one email provider.

173
00:09:33,180 --> 00:09:39,260
It's not enough CDNs, not enough undersea cables between continents, not enough app stores.

174
00:09:41,340 --> 00:09:41,900
Yeah.

175
00:09:41,940 --> 00:09:42,320
I mean, look.

176
00:09:42,320 --> 00:09:45,480
I think decentralization is one area.

177
00:09:45,680 --> 00:09:50,040
But when you get beyond that, I think it's tough to draw that line again and say, okay, you're right.

178
00:09:50,260 --> 00:09:52,420
But then how do you actually get to that next mile?

179
00:09:52,700 --> 00:09:53,960
And look, this is not technology.

180
00:09:54,300 --> 00:09:55,000
It's policy, too.

181
00:09:55,060 --> 00:10:02,320
I remember having a conversation when I was at the State Department with the Chinese and the cyber administration of China.

182
00:10:02,540 --> 00:10:06,780
And for some reason we were talking about public-private partnerships, which seems like a pretty good thing, right, normally?

183
00:10:07,080 --> 00:10:08,720
And they said, oh, you're absolutely right.

184
00:10:08,800 --> 00:10:12,220
We need public-private partnerships because we can't monitor the Internet alone.

185
00:10:12,220 --> 00:10:14,160
We need their help.

186
00:10:14,740 --> 00:10:15,920
Not what I had in mind.

187
00:10:18,280 --> 00:10:40,360
Just to pick up on that quickly, riffing off some work that my colleagues at the State Department have done, if you look at censorship around the world right now, more than two-thirds of the world's population is having their human rights on the Internet infringed based on these repressive regimes surveilling them or censoring them on the Internet.

188
00:10:40,500 --> 00:10:41,540
And they are spending.

189
00:10:41,540 --> 00:10:50,600
Billions of dollars to build out ecosystems that enable surveillance and censorship at scale in real time.

190
00:10:50,920 --> 00:10:51,180
Right?

191
00:10:51,260 --> 00:11:01,660
There is a clear push for I wouldn't I think I would use like the idea of centralization versus decentralization a little differently.

192
00:11:01,960 --> 00:11:10,920
The idea of moving away from a free and global Internet to essentially a series of isolated networks of censorship and surveillance.

193
00:11:11,020 --> 00:11:11,520
That's the idea.

194
00:11:11,540 --> 00:11:15,720
That an individual repressive regime would want to run often against their own citizens.

195
00:11:16,120 --> 00:11:31,580
And they would want it centralized in the sense that they want the authority, but not centralized in the sense that there would be global interconnectivity where they would have to reach out to a different central location to engage in their sort of mass surveillance.

196
00:11:31,760 --> 00:11:33,080
And that's been going on for a while.

197
00:11:33,160 --> 00:11:41,200
Because Hillary Clinton, when she was the Secretary of State, gave a speech launching the Freedom Online Coalition, a group of a lot of countries that champion freedom online.

198
00:11:41,200 --> 00:11:45,160
And she talked about digital bubbles, authoritarian bubbles around the world.

199
00:11:45,240 --> 00:11:47,120
And that's just been accelerating, I think, since then.

200
00:11:47,340 --> 00:11:51,340
And that's, you know, again, it's hard to stop that from happening.

201
00:11:51,520 --> 00:12:04,720
And we've gone from the promise of the Internet is the greatest thing in the world, the greatest democratizing force in the world, to it's also the greatest way that repressive regimes, and not just repressive regimes, we'll get into this later, can do things that are not great.

202
00:12:04,800 --> 00:12:09,040
Including monitoring and controlling their citizenry in ways they haven't been able to before.

203
00:12:09,740 --> 00:12:10,180
Yeah.

204
00:12:10,280 --> 00:12:10,620
Yeah.

205
00:12:11,200 --> 00:12:13,100
Just one other thought on the centralization.

206
00:12:13,300 --> 00:12:24,720
The thing that really bothers me is the, we have no plan B for, Roger's heard me say this, we have no plan B for certificate authorities.

207
00:12:25,700 --> 00:12:40,880
So if something goes wrong with TLS or certificate authority structure, there's no, like, we'll use DNSSEC and we'll push out Dane, TLS A records, and then the web will keep going, right?

208
00:12:40,880 --> 00:12:41,580
There's no agility.

209
00:12:41,960 --> 00:12:42,980
We're all in.

210
00:12:43,200 --> 00:12:44,660
And the browsers win away.

211
00:12:44,880 --> 00:12:48,860
All the browsers now have removed support for Dane and TLS certificates.

212
00:12:49,220 --> 00:12:52,660
The only thing that's using it now are mail servers.

213
00:12:52,940 --> 00:13:10,860
So I guess if the certificate authority system sort of collapses or is under attack or is subpoenaed or, you know, let's encrypt blows up and that's 90-something percent of all certificates, if let's encrypt goes down, we'll be able to change mail because mail servers use Dane, but not all of them.

214
00:13:10,880 --> 00:13:12,400
Nobody else will be able to browse the web.

215
00:13:12,580 --> 00:13:15,580
That really worries me, that we have no backup plan.

216
00:13:15,680 --> 00:13:16,780
And governments know this.

217
00:13:17,280 --> 00:13:19,820
And governments that want to suppress know.

218
00:13:20,160 --> 00:13:27,080
I just saw a takedown against an onion domain name for, I think, a white supremacist website.

219
00:13:27,520 --> 00:13:35,460
The registrar in Greece pulled the TLS certificate name for, and that's just, that's going to be the start.

220
00:13:35,660 --> 00:13:37,080
I'm happy they did that.

221
00:13:37,220 --> 00:13:40,180
But I'm just saying that soon we'll be seeing subpoenas.

222
00:13:40,880 --> 00:13:42,740
We'll be seeing takedowns on TLS certificates.

223
00:13:43,120 --> 00:13:47,960
And since browsers are now default, that is the gateway, right?

224
00:13:48,120 --> 00:13:53,480
And we don't have these conversations, and we build these technologies that now we have no agility.

225
00:13:54,520 --> 00:13:59,300
So don't be surprised, you know, when the world you describe happens.

226
00:14:01,280 --> 00:14:06,600
And so when I look at my Rolodex of who do I call, what's the backup plan, I get Roger.

227
00:14:07,160 --> 00:14:08,840
I don't get five Rogers.

228
00:14:08,980 --> 00:14:10,220
I get one Roger.

229
00:14:10,880 --> 00:14:12,600
There's one option, kind of, and it's Tor.

230
00:14:12,860 --> 00:14:14,060
And it's not perfect.

231
00:14:14,380 --> 00:14:18,100
But we don't have a thriving ecosystem of five Tors, you know.

232
00:14:18,340 --> 00:14:20,180
That worries me.

233
00:14:20,560 --> 00:14:24,860
I want you to talk now about your unbounded adversaries.

234
00:14:26,120 --> 00:14:26,600
Yeah.

235
00:14:26,800 --> 00:14:33,100
So part of the reason why I am thinking about the policy side of things, and it's fun to have the balance here,

236
00:14:33,220 --> 00:14:38,400
because we've got a policy person saying, yeah, yeah, yeah, we've got the policy stuff under control,

237
00:14:38,480 --> 00:14:40,480
but if only you could build better tech for us,

238
00:14:40,480 --> 00:14:41,720
then we'll be able to keep people safe.

239
00:14:42,040 --> 00:14:46,840
And here I am, the technology side, saying, yeah, yeah, yeah, we've got tools,

240
00:14:46,920 --> 00:14:49,100
and they work pretty well, and millions of people are using them,

241
00:14:49,200 --> 00:14:53,900
but if governments are unbounded, if they're breaking their own laws,

242
00:14:54,180 --> 00:15:00,280
if they're attacking everything at will, if they're putting billions of dollars into harming people,

243
00:15:00,540 --> 00:15:03,140
we can't solve this with technology alone.

244
00:15:03,920 --> 00:15:10,380
Like in China, in the Uyghur province, if they end up sending a person to live in the house,

245
00:15:10,380 --> 00:15:16,440
of each of the families there, I can't, TOR is not going to be what they need.

246
00:15:16,660 --> 00:15:20,420
This is like a social problem, a political problem, a policy problem.

247
00:15:20,700 --> 00:15:24,520
So yeah, the reason why I'm thinking broader than just the technology

248
00:15:24,520 --> 00:15:30,660
is increasingly we're seeing governments that do more than technical attacks,

249
00:15:30,920 --> 00:15:33,100
and we need to tackle that at every layer.

250
00:15:33,620 --> 00:15:39,740
This is your censorship implies surveillance model.

251
00:15:39,840 --> 00:15:40,360
Yeah.

252
00:15:40,380 --> 00:15:40,760
Yes.

253
00:15:40,860 --> 00:15:47,240
So we used to think of this, so TOR started as a way to let you browse the web more safely,

254
00:15:47,460 --> 00:15:50,780
meaning metadata communications, metadata protection,

255
00:15:51,120 --> 00:15:53,720
so people watching you can't learn what you're doing.

256
00:15:53,940 --> 00:15:57,340
And then it morphed into a censorship resistance thing,

257
00:15:57,500 --> 00:16:00,380
and the key to realize is they're actually the same thing.

258
00:16:00,560 --> 00:16:03,580
So when a government is censoring your Internet connection,

259
00:16:03,820 --> 00:16:08,960
they start off by surveilling you to learn who you are and what you're doing,

260
00:16:08,960 --> 00:16:10,960
to decide whether to let you do it.

261
00:16:11,100 --> 00:16:13,480
So it's actually two sides of the same coin.

262
00:16:14,040 --> 00:16:17,940
So if you're only thinking about censorship, you should be thinking about surveillance.

263
00:16:18,260 --> 00:16:22,220
If you're thinking about surveillance, the next step to think about is censorship.

264
00:16:22,460 --> 00:16:26,140
These are both two sides of the same issue.

265
00:16:26,320 --> 00:16:29,700
And that leads me to also think about end-to-end encryption

266
00:16:29,700 --> 00:16:35,500
and other attacks at the policy layer that are related to both censorship and surveillance.

267
00:16:36,740 --> 00:16:37,300
Yeah.

268
00:16:37,300 --> 00:16:42,480
I think the issue is there's policy for liberal democracies

269
00:16:42,960 --> 00:16:44,860
and there's policies for repressive regimes,

270
00:16:45,140 --> 00:16:48,240
and it's much harder to change the policies of repressive regimes.

271
00:16:48,740 --> 00:16:52,920
And so, you know, but there has been some good work that's been done.

272
00:16:52,920 --> 00:16:56,340
But if they're buying the technology designed for a liberal democracy…

273
00:16:56,940 --> 00:16:57,820
Well, that's what I was about to say.

274
00:16:57,900 --> 00:16:59,600
So I think there's been some good work that's been done.

275
00:16:59,700 --> 00:17:04,440
I mean, for instance, the White House issued this anti-commercial spyware executive order,

276
00:17:04,620 --> 00:17:06,380
got ten countries initially.

277
00:17:06,380 --> 00:17:10,860
I think it's up to maybe 15 or so now, maybe more than that, countries have signed on to this.

278
00:17:10,900 --> 00:17:14,160
Now they're all the good people or what we think of as more of the good people.

279
00:17:14,500 --> 00:17:19,060
But there are things you can do to exert pressure on these more repressive countries,

280
00:17:19,180 --> 00:17:21,720
maybe not China or Russia as easily,

281
00:17:21,880 --> 00:17:24,740
but a lot of the countries who are sort of in the middle where you can have an impact.

282
00:17:25,040 --> 00:17:27,460
And you have to use the full suite of policy tools you have.

283
00:17:27,580 --> 00:17:28,600
And that's not just cyber stuff.

284
00:17:28,740 --> 00:17:30,160
That's trade and other things you can do.

285
00:17:30,440 --> 00:17:34,740
And I think there's been much more awareness and movement toward that recently.

286
00:17:34,940 --> 00:17:36,360
I think the other problem, though, is…

287
00:17:36,380 --> 00:17:38,080
You know, we think that the world is binary.

288
00:17:38,340 --> 00:17:39,840
There's the bad guys and the good guys.

289
00:17:40,140 --> 00:17:40,800
Well, there's…

290
00:17:40,800 --> 00:17:44,260
Even some of the good guys are starting to come down this path a little bit

291
00:17:44,260 --> 00:17:46,260
because they're worried about terrorism.

292
00:17:46,440 --> 00:17:48,680
They're worried about misinformation and disinformation.

293
00:17:48,920 --> 00:17:51,200
By the way, my suggestion to Jeff earlier was,

294
00:17:51,840 --> 00:17:56,940
next year, the misinformation village should have the sign out in front of a different room.

295
00:17:57,140 --> 00:17:58,220
So that you would…

296
00:17:58,220 --> 00:17:59,380
I think it would be cool.

297
00:18:02,780 --> 00:18:04,340
They did that when the…

298
00:18:04,340 --> 00:18:05,220
When the…

299
00:18:05,220 --> 00:18:06,800
The Soviets invaded Prague.

300
00:18:06,940 --> 00:18:08,380
They changed all the street signs.

301
00:18:08,520 --> 00:18:09,180
So it's good misinformation.

302
00:18:10,200 --> 00:18:11,000
So, you know…

303
00:18:11,000 --> 00:18:14,620
So I think that the problem is you have to target the repressive regimes,

304
00:18:14,820 --> 00:18:17,800
but you also have to think about liberal democracies and where they're going

305
00:18:17,800 --> 00:18:19,440
and what path they're taking on these issues.

306
00:18:19,580 --> 00:18:23,240
And that involves the gnarly debate around encryption and all these other things.

307
00:18:23,360 --> 00:18:23,780
But where…

308
00:18:23,780 --> 00:18:27,740
You know, where can we make sure that we have the kind of transparency rule of law

309
00:18:27,740 --> 00:18:30,040
and they're actually following the laws, as was said, too.

310
00:18:30,180 --> 00:18:31,120
And, you know, that's…

311
00:18:31,120 --> 00:18:33,380
That's not just an issue for the cyber community.

312
00:18:33,880 --> 00:18:35,200
That's an issue for the entire…

313
00:18:35,220 --> 00:18:39,520
You know, policy community and all the tools that we might have that might change behavior.

314
00:18:40,740 --> 00:18:41,240
Yeah.

315
00:18:41,340 --> 00:18:43,320
I largely agree with what everyone was saying.

316
00:18:43,460 --> 00:18:46,720
I think one of the things we're looking at in the Office of the National Cyber Director

317
00:18:46,720 --> 00:18:49,700
is that question of what's the backup plan, right?

318
00:18:49,760 --> 00:18:55,260
Because to some of these points, TOR is an excellent tool in certain instances.

319
00:18:55,500 --> 00:19:00,520
But if a government sends some people with guns to the one cable landing site in a country

320
00:19:00,520 --> 00:19:04,040
and says, turn it off, TOR doesn't help you.

321
00:19:04,040 --> 00:19:09,480
So the question is, what do you use when the censorship model is a man comes in the

322
00:19:09,480 --> 00:19:10,780
room with a weapon, right?

323
00:19:10,880 --> 00:19:12,780
Or a complete internet shutdown.

324
00:19:13,240 --> 00:19:15,540
And there will be things that we can do with technology.

325
00:19:15,820 --> 00:19:17,180
There will be things we can do with policy.

326
00:19:17,380 --> 00:19:20,960
And for us to have efficacious solutions, I think we have to work it together.

327
00:19:21,140 --> 00:19:22,640
That's part of why we're here.

328
00:19:22,760 --> 00:19:24,220
I hope that's part of why we're talking about it.

329
00:19:24,260 --> 00:19:27,580
That's part of why there's going to be a workshop later today to hear from you and

330
00:19:27,580 --> 00:19:28,920
to get and exchange ideas.

331
00:19:29,640 --> 00:19:34,020
But I also think we need to think of this almost from a network stack sort of perspective.

332
00:19:34,020 --> 00:19:39,020
To say, if someone is going after layer one to engage in censorship or surveillance,

333
00:19:39,720 --> 00:19:42,000
how do we ensure that there's security at that layer?

334
00:19:42,140 --> 00:19:46,200
If people are targeting another layer of the stack, how do we ensure there's appropriate

335
00:19:46,200 --> 00:19:47,400
security at each of those layers?

336
00:19:47,680 --> 00:19:50,980
So I guess we didn't talk about this in the ready room.

337
00:19:51,140 --> 00:19:54,240
But maybe just talk about domain fronting.

338
00:19:54,580 --> 00:19:56,760
Maybe first about why it's useful.

339
00:19:56,940 --> 00:20:01,360
But then why now it's people are not supporting it, right?

340
00:20:01,920 --> 00:20:02,680
Vendors are not.

341
00:20:02,960 --> 00:20:04,000
Google, I think, is supporting it.

342
00:20:04,020 --> 00:20:04,540
It's stopping it.

343
00:20:05,400 --> 00:20:07,880
A lot of cloud providers don't domain front anymore.

344
00:20:08,060 --> 00:20:11,240
And that's what Signal Messenger really relied on for some protections.

345
00:20:11,600 --> 00:20:14,620
So we're not a repressive regime so much.

346
00:20:14,720 --> 00:20:18,540
But again, market forces are making it harder.

347
00:20:20,320 --> 00:20:21,360
I'm looking at you.

348
00:20:21,900 --> 00:20:22,420
Okay.

349
00:20:22,540 --> 00:20:22,960
Yeah.

350
00:20:23,020 --> 00:20:27,700
So domain fronting is one of the tricks that we have at the technical level for getting

351
00:20:27,700 --> 00:20:28,340
around censorship.

352
00:20:28,620 --> 00:20:34,000
And the way that it works is you find a cloud provider like Google or Azure or Facebook

353
00:20:34,020 --> 00:20:37,260
or Fastly or Cloudflare, and you do a TLS connection.

354
00:20:37,780 --> 00:20:43,260
And on the outside of the TLS connection in the SNI field, you list a domain that they're

355
00:20:43,260 --> 00:20:43,900
not going to block.

356
00:20:44,160 --> 00:20:48,960
And then once you've done the TLS connection, inside the encrypted channel, you do a host

357
00:20:48,960 --> 00:20:51,480
header for the domain that you'd actually like to go to.

358
00:20:51,700 --> 00:20:56,000
And technically, this is violating some sort of spec somewhere in IETF land.

359
00:20:56,200 --> 00:21:01,920
But it works in most places until a few years ago when Telegram was using it to get around

360
00:21:01,920 --> 00:21:02,980
blocking from Russia.

361
00:21:02,980 --> 00:21:07,240
And then Russia said, hey, Amazon, could you quit that?

362
00:21:07,460 --> 00:21:09,380
And Amazon said, why, yes, Russia.

363
00:21:09,500 --> 00:21:10,420
We will turn that off.

364
00:21:10,580 --> 00:21:11,380
Thank you, Russia.

365
00:21:11,720 --> 00:21:13,360
And so Amazon stopped it.

366
00:21:13,440 --> 00:21:14,980
They convinced Google to stop it.

367
00:21:15,080 --> 00:21:16,760
They convinced Microsoft to stop it.

368
00:21:16,800 --> 00:21:20,120
But Microsoft said they were going to stop it, and then they didn't, which is pretty

369
00:21:20,120 --> 00:21:20,680
cool of them.

370
00:21:20,980 --> 00:21:22,480
But they're eventually going to.

371
00:21:22,720 --> 00:21:27,500
So some CDNs allow it, but many of them don't these days.

372
00:21:27,660 --> 00:21:32,960
And it's one of the better working tricks, though you have to pay cloud prices a lot

373
00:21:32,980 --> 00:21:34,420
less for the bandwidth you send across it.

374
00:21:34,560 --> 00:21:40,220
So some circumvention tools like Tor use domain fronting, not for all of the traffic, but

375
00:21:40,220 --> 00:21:44,980
just for the signaling in order to have a reliable channel to set things up, and then

376
00:21:44,980 --> 00:21:46,380
you fall back to some other channel.

377
00:21:46,580 --> 00:21:53,380
But yes, it's a trick that is closing down as the Western huge companies change their

378
00:21:53,380 --> 00:21:54,440
mind about letting it work.

379
00:21:54,720 --> 00:21:55,020
Right.

380
00:21:55,140 --> 00:21:57,820
And so no fight in the UN necessary.

381
00:21:58,880 --> 00:21:59,400
Right?

382
00:21:59,480 --> 00:22:01,100
That's how much we really...

383
00:22:03,680 --> 00:22:08,080
We care about these technologies and the rights that they can support.

384
00:22:08,440 --> 00:22:08,760
Right?

385
00:22:08,960 --> 00:22:13,880
ITF is not racing to formalize it into a thing to support the human rights aspect.

386
00:22:14,200 --> 00:22:16,600
It's just disappointing.

387
00:22:18,680 --> 00:22:22,660
Although, participating in a lot of UN negotiations, getting consensus, because

388
00:22:22,660 --> 00:22:26,580
consensus is near impossible, because all those repressive regimes are there.

389
00:22:26,780 --> 00:22:27,220
Right.

390
00:22:27,320 --> 00:22:28,500
And just for people's awareness...

391
00:22:28,500 --> 00:22:28,820
What do I mean?

392
00:22:28,880 --> 00:22:29,680
It's not even brought up.

393
00:22:29,780 --> 00:22:30,540
We're not even saying...

394
00:22:30,540 --> 00:22:34,280
Is there a letter from the White House saying, hey, Google, don't worry about it, we got

395
00:22:34,280 --> 00:22:34,660
your back?

396
00:22:34,980 --> 00:22:35,220
Yeah.

397
00:22:35,400 --> 00:22:35,840
Right?

398
00:22:35,980 --> 00:22:42,220
Or some, I don't know, 50 states' attorneys general saying, don't worry about it.

399
00:22:42,520 --> 00:22:44,920
We'll tell Russia to go stuff themselves.

400
00:22:45,440 --> 00:22:45,880
No.

401
00:22:46,000 --> 00:22:48,500
There's not a state or a local, tribal territory.

402
00:22:48,860 --> 00:22:49,780
There's nothing.

403
00:22:50,160 --> 00:22:54,840
And I don't know if it's because these are kind of technical things and it just doesn't

404
00:22:54,840 --> 00:23:00,000
reach awareness of policy makers, or is it actually like they thought it through and

405
00:23:00,000 --> 00:23:01,380
said, no, that's not worth a fight?

406
00:23:02,060 --> 00:23:03,460
I mean, I suspect it's part of that.

407
00:23:03,620 --> 00:23:07,140
I suspect that the policy makers just don't understand the technology and what it's doing.

408
00:23:07,620 --> 00:23:11,840
I suspect part of it, too, is when you go to the companies, look, they're there for

409
00:23:11,840 --> 00:23:12,480
profits, right?

410
00:23:12,640 --> 00:23:13,920
So it's much easier...

411
00:23:13,920 --> 00:23:14,440
But the Tories are paying for it.

412
00:23:14,440 --> 00:23:17,960
No, no, but it's much easier now with Russia for them to say no than it is for China.

413
00:23:18,080 --> 00:23:19,480
And so we have to kind of come over that.

414
00:23:19,560 --> 00:23:23,460
We have to figure out how to disincentivize that contract or incentivize the good conduct.

415
00:23:25,240 --> 00:23:29,160
And part of it's government, what governments can do, including our government, but if it's

416
00:23:29,160 --> 00:23:30,860
just our government, that's not going to do it either.

417
00:23:32,040 --> 00:23:36,160
And, you know, just again for people's awareness, there's a lot of discussions in the UN now

418
00:23:36,160 --> 00:23:37,300
on all these different issues.

419
00:23:37,980 --> 00:23:43,400
One is they're now negotiating a cybercrime treaty, which is pretty far in the negotiations.

420
00:23:43,720 --> 00:23:48,480
And these issues, the procedural issues with cybercrime and how you get evidence, some

421
00:23:48,480 --> 00:23:51,580
of these issues are being covered, not in this technical detail, which is part of the

422
00:23:51,580 --> 00:23:52,280
problem, I think.

423
00:23:52,580 --> 00:23:58,060
But, you know, this may be a way to push the more repressive regimes to have more things

424
00:23:58,060 --> 00:24:00,580
that allow them to do stuff or not.

425
00:24:00,840 --> 00:24:06,000
And so I think the West is very concerned about enabling repressive regimes to get more

426
00:24:06,000 --> 00:24:09,340
access, but at the same time trying to get law enforcement access, and that's a difficult

427
00:24:09,340 --> 00:24:09,660
issue.

428
00:24:09,820 --> 00:24:14,560
So, you know, this community, I think, should follow those kinds of things and make sure

429
00:24:14,560 --> 00:24:18,120
that you're at least aware of what's going on, just like you should comment on the documents

430
00:24:18,120 --> 00:24:18,960
that you talked about.

431
00:24:21,840 --> 00:24:27,980
One thing that I'll add is, so in March, there was a big event in D.C., a summit for democracy

432
00:24:28,060 --> 00:24:31,100
where, you know, countries around the world came together.

433
00:24:31,200 --> 00:24:32,240
There was one before.

434
00:24:33,520 --> 00:24:39,040
This year, one of the focuses included countering the authoritarian misuse of technology, and

435
00:24:39,040 --> 00:24:41,840
there was a call to action to the private sector that went out.

436
00:24:41,940 --> 00:24:44,740
Now, that did not talk about any one specific protocol.

437
00:24:45,020 --> 00:24:49,560
It talked about things at a sort of slightly higher layer of abstraction for a lot of reasons.

438
00:24:51,100 --> 00:24:56,460
But certainly there's an administration interest in exactly this, and you are seeing press

439
00:24:56,460 --> 00:24:58,040
coming from the White House saying, you know what?

440
00:24:58,040 --> 00:24:59,560
We need to figure out ways to counter this.

441
00:24:59,720 --> 00:25:05,240
There was specific discussion of things like VPN and ensuring VPN availability, and that

442
00:25:05,240 --> 00:25:11,440
you could connect securely and safely to things like VPNs, along with some other things sort

443
00:25:11,440 --> 00:25:17,480
of explicitly identified, and then otherwise an invitation to engage primarily with our

444
00:25:17,480 --> 00:25:23,100
colleagues at the State Department on how you could do this and how you could work collaboratively

445
00:25:23,100 --> 00:25:28,020
with the government to ensure that people did have freedom to act in a way that was

446
00:25:28,040 --> 00:25:30,380
accessible, securely and safely, like the real Internet.

447
00:25:30,560 --> 00:25:37,220
Do you think the government then could use sort of the power of the purse to sort of set priorities?

448
00:25:37,400 --> 00:25:46,340
So, like, your cloud provider, I don't know, is in alignment with Russia proposal 123 for censorship,

449
00:25:46,620 --> 00:25:52,900
so we're not buying from you until you are not in alignment with authoritarian censorship model 123.

450
00:25:53,640 --> 00:25:57,960
And if the cloud provider wants to have a seal on their home page that says, look, we completely

451
00:25:58,040 --> 00:26:01,980
comply with the, we're not censorship friendly, then, you know what I mean?

452
00:26:02,100 --> 00:26:03,960
Like, it doesn't have to always be a policy.

453
00:26:04,220 --> 00:26:05,140
It can be a choice.

454
00:26:05,500 --> 00:26:07,200
It can be a labeling regime.

455
00:26:07,580 --> 00:26:12,340
It can be a way of the government saying, hey, we only buy from, you know, green energy providers.

456
00:26:14,100 --> 00:26:28,020
I don't feel like I have, like, a fully established answer, but I'll say a microcosm of this that I think is pertinent does circle back to that executive order about commercial spyware and certain commercial spyware entities that were taking actions that were viewed as, you know,

457
00:26:28,040 --> 00:26:34,440
problematic, really divergent from our interest, enabling things like the surveillance of journalists or dissidents.

458
00:26:34,740 --> 00:26:47,320
And the administration pushed out this executive order saying, hey, we're no longer going to be using these technologies that pose a national security risk, that pose these sort of broader risks to us.

459
00:26:47,420 --> 00:26:54,340
And I think that is perhaps an example of this power of the purse of saying we're no longer playing with these entities.

460
00:26:54,440 --> 00:26:57,940
And it was followed up with sort of more discreetly.

461
00:26:58,560 --> 00:27:00,040
With some entity listings.

462
00:27:00,300 --> 00:27:06,100
So that are, those are, the Department of Commerce labels certain entities, making it very hard for them to do business.

463
00:27:06,220 --> 00:27:11,180
That ends up being sort of export restrictions and really just sort of gums up a business.

464
00:27:11,180 --> 00:27:13,940
The combined entities list or what do they call it now?

465
00:27:14,560 --> 00:27:20,080
It used to be you had to watch two or three different lists to see if you were having a personal felony.

466
00:27:21,120 --> 00:27:23,220
Now there's a combined list, I think.

467
00:27:23,420 --> 00:27:24,120
I think that's right.

468
00:27:24,420 --> 00:27:24,820
Yeah.

469
00:27:26,700 --> 00:27:27,580
I mean, I do.

470
00:27:28,140 --> 00:27:30,580
But your idea is an interesting one.

471
00:27:30,700 --> 00:27:32,860
There's two questions about this sort of labeling thing.

472
00:27:33,100 --> 00:27:43,420
The federal government just recently, we've been talking about this for 30 years, maybe 20 years, moved this idea, maybe a good housekeeping seal of approval for cybersecurity and stuff.

473
00:27:44,120 --> 00:27:45,300
Singapore has done that.

474
00:27:45,380 --> 00:27:46,560
It's happened in other parts of the world.

475
00:27:46,620 --> 00:27:47,580
The EU has an act.

476
00:27:48,680 --> 00:27:50,280
And the U.S. is moving forward.

477
00:27:50,380 --> 00:27:51,560
There's been legislation on other things.

478
00:27:51,640 --> 00:27:53,940
So that may be a way to deal with it.

479
00:27:54,080 --> 00:27:57,420
But I wonder how much that's going to actually affect the market.

480
00:27:58,040 --> 00:28:04,280
Are they going to, outside of a smaller group of people, are they going to value software more because they say we're human rights compliant?

481
00:28:04,480 --> 00:28:05,160
Hopefully they would.

482
00:28:05,280 --> 00:28:06,080
I would hope they would.

483
00:28:06,140 --> 00:28:08,800
But it's more about signaling the values of the government.

484
00:28:09,720 --> 00:28:12,660
And look, no authoritarian cloud provider has that seal.

485
00:28:12,740 --> 00:28:13,780
What a shocker.

486
00:28:14,260 --> 00:28:14,660
Right?

487
00:28:14,720 --> 00:28:21,160
You've got to draw some bright lines between the difference between team rule of law and team authoritarian.

488
00:28:21,520 --> 00:28:23,460
Because if you don't, they're just going to be bled together.

489
00:28:23,600 --> 00:28:25,660
They're all sitting in the same room in the IETF.

490
00:28:25,960 --> 00:28:26,360
Right?

491
00:28:26,360 --> 00:28:28,140
They're all sitting in the same room wherever.

492
00:28:28,520 --> 00:28:30,140
They're all whistling when they have standards.

493
00:28:30,620 --> 00:28:34,120
So you need a way to say, look how we are different.

494
00:28:34,800 --> 00:28:37,340
I think labeling is an important step here.

495
00:28:37,480 --> 00:28:41,380
But more and more we're seeing a shift in how the arms race goes.

496
00:28:42,000 --> 00:28:49,000
So it used to be Western companies sell deep packet inspection tools to repressive regimes.

497
00:28:49,280 --> 00:28:51,300
And they use them to harm their citizens.

498
00:28:51,940 --> 00:28:55,620
And so it would be a technology like they look for this header.

499
00:28:55,620 --> 00:28:57,700
We change it to this and go back and forth.

500
00:28:57,820 --> 00:29:02,500
But here are two examples that we've seen recently where we're shifting how the arms race goes.

501
00:29:02,760 --> 00:29:05,360
One of them is in Turkmenistan over the past few months.

502
00:29:05,560 --> 00:29:12,340
So the Ministry of Censorship in Turkmenistan is basically block listing the whole Internet.

503
00:29:12,580 --> 00:29:13,760
They block Fastly.

504
00:29:13,900 --> 00:29:15,120
They block Cloudflare.

505
00:29:15,260 --> 00:29:16,360
They block Akamai.

506
00:29:16,560 --> 00:29:18,500
They block most hosting providers.

507
00:29:19,060 --> 00:29:23,440
And so we've been running some tour bridges on residential IP addresses.

508
00:29:23,600 --> 00:29:24,940
And it kind of works sort of.

509
00:29:24,940 --> 00:29:30,000
But it turns out that they're taking bribes to unblock certain people in Turkmenistan.

510
00:29:30,120 --> 00:29:35,040
So if you're a company or whatever, you pay them $1,000 U.S. and now you get real Internet.

511
00:29:35,300 --> 00:29:37,980
So this is not something I can solve at a technical level.

512
00:29:38,160 --> 00:29:41,720
Another challenge that we're seeing in China recently is it's not.

513
00:29:41,840 --> 00:29:44,860
So China has a policy to censor the Internet, sure.

514
00:29:45,060 --> 00:29:50,000
But they also have accidental like economic byproducts of how they're growing.

515
00:29:50,880 --> 00:29:53,320
So there you are in China.

516
00:29:53,440 --> 00:29:54,700
You want to use a website.

517
00:29:54,940 --> 00:29:55,180
You're in China.

518
00:29:55,680 --> 00:29:56,960
Everybody wants to do that.

519
00:29:57,060 --> 00:29:58,240
So they buy more bandwidth.

520
00:29:58,380 --> 00:29:59,280
They make the pipes bigger.

521
00:29:59,420 --> 00:30:01,300
They make the bandwidth inside China really good.

522
00:30:01,460 --> 00:30:04,940
But nobody's adding pipes from China to the rest of the world.

523
00:30:05,080 --> 00:30:15,060
And that means that if you're in China trying to get to Google, even if they didn't explicitly block it, you've got 15% packet loss because too many people are trying to use too small pipes.

524
00:30:15,260 --> 00:30:19,300
And for economic reasons, they're not bothering to add that bandwidth.

525
00:30:19,520 --> 00:30:23,200
So that's a case where it doesn't matter what code I write.

526
00:30:23,380 --> 00:30:24,920
There's not enough bandwidth for people.

527
00:30:24,940 --> 00:30:26,620
There's not enough bandwidth for people to do what they're trying to do.

528
00:30:26,940 --> 00:30:29,100
And that goes back to the economic challenge.

529
00:30:31,060 --> 00:30:35,040
There's a sort of a comment maybe.

530
00:30:35,180 --> 00:30:37,600
Or maybe we can look at it just briefly from the other lens.

531
00:30:37,800 --> 00:30:39,880
Who are the people that are being censored?

532
00:30:40,140 --> 00:30:44,080
Because when we say that, we don't necessarily mean bad guys.

533
00:30:44,300 --> 00:30:50,520
What are these people just exploring the Internet and the regimes are afraid they're going to learn about equal rights or something?

534
00:30:50,780 --> 00:30:54,920
Like what is the danger in these conversations you're having that justifies that?

535
00:30:54,920 --> 00:30:58,140
Like what is the danger in these conversations you're having that justifies this level of intervention and billions of dollars spent?

536
00:30:58,300 --> 00:30:59,220
What is the fear?

537
00:31:00,900 --> 00:31:02,860
I mean, there are lots of vulnerable groups.

538
00:31:02,940 --> 00:31:07,420
And depending on the country, they could be religious groups or often political groups that are being targeted.

539
00:31:08,280 --> 00:31:10,240
Back to what you said about the State Department.

540
00:31:10,460 --> 00:31:19,040
Part of the State Department, the Democracy and Human Rights Bureau, has for a long time funded a lot of projects, including yours, among others, to try to get around censorship.

541
00:31:19,880 --> 00:31:21,940
And it is kind of country-specific.

542
00:31:21,940 --> 00:31:29,860
But it's not just, you know, a lot of the countries don't have the capability or the bandwidth to censor everything or to look at everything.

543
00:31:30,040 --> 00:31:31,180
China may be a little different.

544
00:31:32,680 --> 00:31:38,920
So they target a lot of these groups who they view as threats to their own political stability often.

545
00:31:39,000 --> 00:31:40,580
And those are the groups that are most at risk.

546
00:31:40,700 --> 00:31:41,220
But not only those.

547
00:31:41,360 --> 00:31:42,160
I mean, it could be LGBT.

548
00:31:42,700 --> 00:31:50,080
There's a whole wide range of groups, depending on the country, depending on the authoritarian regime you're in, that are targeted.

549
00:31:50,120 --> 00:31:51,260
And, you know,

550
00:31:52,580 --> 00:31:54,580
But they don't justify it that way.

551
00:31:55,120 --> 00:31:58,540
They justify it on the basis of security.

552
00:31:58,780 --> 00:31:59,880
It's the security of the state.

553
00:32:00,100 --> 00:32:01,720
That's the overarching justification.

554
00:32:02,240 --> 00:32:10,920
One of the things they thought was a big advance at the State Department, I was there, and it's continued in the new bureau they created, is to integrate human rights with security.

555
00:32:11,240 --> 00:32:15,680
And a lot of times, when we go to other countries and talk about cyber security, they say, oh, that's great.

556
00:32:15,720 --> 00:32:17,520
That's a way for us now to control our citizens.

557
00:32:17,680 --> 00:32:18,340
No, no, no.

558
00:32:18,440 --> 00:32:19,960
You have to think about the human rights aspect.

559
00:32:19,960 --> 00:32:22,020
You have to look at them together rather than in silos.

560
00:32:23,340 --> 00:32:28,860
So, yeah, you know, I think it's, and, again, it goes back to the point of, like, well, how do you change that?

561
00:32:29,260 --> 00:32:38,900
You can change it by using the tools you have, economic and other tools, to try to change that country's view because, basically, the regime that's in power kind of likes to stay in power.

562
00:32:39,140 --> 00:32:43,520
And so it's hard to tell them don't do that because they're going to do it anyway.

563
00:32:43,700 --> 00:32:45,060
And so how can you exert pressure?

564
00:32:45,480 --> 00:32:46,860
And some of it's commercial pressure.

565
00:32:46,980 --> 00:32:48,700
Some of it's not just governments but companies, too.

566
00:32:48,700 --> 00:32:49,940
As we've seen with Russia.

567
00:32:51,360 --> 00:32:59,600
Yeah, so in our experience, it isn't that the censorship ministry sits down and makes categories and goes to find websites that match the categories.

568
00:32:59,900 --> 00:33:07,160
It's more about the job of the censorship ministry is to never get noticed by the authoritarian leaders in charge.

569
00:33:07,380 --> 00:33:17,440
So every time something goes wrong, they're embarrassing the head dude, and they need to react and start blocking the things that are embarrassing at that time.

570
00:33:17,440 --> 00:33:24,560
So it grows organically where maybe some particular activity is in the news, and then they have to shut that down.

571
00:33:24,940 --> 00:33:30,620
And this same pattern happens not only in China where they have to guess what they should try to block next.

572
00:33:30,940 --> 00:33:47,420
But it also ends up happening in Denmark and Australia and Sweden and so on where they don't have a censorship ministry but whatever they call their online security group ends up deciding that they need to block Pirate Bay or wherever it is.

573
00:33:47,440 --> 00:33:54,960
And then it starts and then it bleeds into blocking more things based on reacting to whatever is politically embarrassing at the time.

574
00:33:55,100 --> 00:34:06,120
But it's also the multiplying effect of not just the state doing it but creating policies that are so vague that the companies, the ISPs and the others, and this is what China does, doesn't know where the line is.

575
00:34:06,240 --> 00:34:07,000
So they over enforce.

576
00:34:07,280 --> 00:34:10,020
They go further than they need to do and it's even worse.

577
00:34:10,200 --> 00:34:14,120
And the state is fine with that because they're like over enforcement is better than under enforcement.

578
00:34:14,660 --> 00:34:15,100
Yeah.

579
00:34:17,440 --> 00:34:25,340
So then how do we, going forward then, I guess in your sort of utopian vision, give us, give me a, where are we at in five years?

580
00:34:25,420 --> 00:34:26,300
Where are we at in ten years?

581
00:34:26,560 --> 00:34:38,660
I mean, if the team rule of law undecided and authoritarian, if this continues to sort of metastasize, do we have sort of, what, three buckets of the internet?

582
00:34:38,860 --> 00:34:39,040
Right?

583
00:34:39,060 --> 00:34:41,320
Your model of where does this leave us?

584
00:34:41,400 --> 00:34:47,420
Because what I don't see is any forces that are, oh, everybody's going to have to use the exact same technology.

585
00:34:47,440 --> 00:34:49,960
We're going to have to use the exact same technology with no censorship built in.

586
00:34:50,040 --> 00:34:51,540
That's not a thing.

587
00:34:51,720 --> 00:34:55,460
So that means censorship will continue to evolve.

588
00:34:56,300 --> 00:35:09,680
And so it's important that we have policies to either make technology instead of being neutral, let's make the technology, at least if we're going to, the federal government's going to buy it, it has a bias toward good, whatever good values are.

589
00:35:09,780 --> 00:35:16,960
It's transparent or accountable or, so maybe one side we have to shift the bias toward good.

590
00:35:17,500 --> 00:35:19,680
Because we know the bad is going to continue.

591
00:35:21,280 --> 00:35:23,580
So when you look in your crystal ball, tell me what you see.

592
00:35:24,460 --> 00:35:25,020
Do you want to start?

593
00:35:26,420 --> 00:35:30,480
Yeah, so I don't have as much optimism as Jeff hopes I do.

594
00:35:31,260 --> 00:35:33,120
I'll bring you a bit more pessimism.

595
00:35:34,140 --> 00:35:39,460
So the Iran thing that I've been watching, so Iran's goal is to build a halal internet.

596
00:35:39,640 --> 00:35:40,920
They want to isolate themselves.

597
00:35:41,080 --> 00:35:43,580
They want to cut off all the outside internet connections.

598
00:35:43,780 --> 00:35:45,800
And to do that, they need their own Facebook.

599
00:35:45,800 --> 00:35:48,540
They need their own Google, Gmail, their own everything.

600
00:35:48,760 --> 00:35:53,560
And they're not big enough as a country, as an ecosystem, as a software ecosystem to have that.

601
00:35:54,160 --> 00:36:02,800
But it gets worse than that because, so for a while they would block Gmail and everybody in Iran would say, screw you, you blocked Gmail, I don't like you, stop blocking.

602
00:36:03,240 --> 00:36:11,100
And then a previous administration in the U.S. called up Google and said, hey, can you like sanction Iran?

603
00:36:11,260 --> 00:36:14,700
Can you like turn off all the Gmail accounts for people who speak Farsi?

604
00:36:14,700 --> 00:36:16,800
Anybody coming from Iran, just shut them off.

605
00:36:17,140 --> 00:36:22,940
And that means that when people in Iran tried to get to their Gmail, Google was the one that blocked them.

606
00:36:23,100 --> 00:36:24,420
And that was a sanction.

607
00:36:25,100 --> 00:36:33,700
But the result was it's easier for Iran to end up with their isolated halal internet because there's nobody complaining anymore.

608
00:36:33,800 --> 00:36:36,820
You blame Google for trying to turn off your Gmail account.

609
00:36:37,020 --> 00:36:38,720
You don't blame your own government anymore.

610
00:36:39,000 --> 00:36:43,980
And we're seeing the same thing in Russia where various telecommunication providers in the West are like,

611
00:36:43,980 --> 00:36:45,360
we're going to sanction Russia.

612
00:36:45,580 --> 00:36:47,600
We're turning off their telephone connections.

613
00:36:47,700 --> 00:36:50,040
We're turning off their ISP, their internet connections.

614
00:36:50,360 --> 00:36:53,120
That'll show them they'll have to stop the war now.

615
00:36:53,440 --> 00:36:57,740
And the result is that they're letting Russia isolate itself in the same way.

616
00:36:57,940 --> 00:37:01,560
So are we going to end up with one amazing internet that everybody's on?

617
00:37:02,040 --> 00:37:04,640
Or are we going to end up with each of these countries?

618
00:37:05,140 --> 00:37:10,380
China is doing great at not building the rest of the bandwidth for people to get to the rest of the internet.

619
00:37:10,660 --> 00:37:12,820
Russia is going to try to isolate itself.

620
00:37:13,980 --> 00:37:15,000
China is excited to do so.

621
00:37:15,040 --> 00:37:15,980
They haven't succeeded yet.

622
00:37:16,100 --> 00:37:22,720
So that's where we're going unless we figure out something at the not only technical level to fix it.

623
00:37:22,940 --> 00:37:27,420
So I'm a recovering lawyer, so I'm usually a glass half full sort of person.

624
00:37:27,620 --> 00:37:30,420
But I think there are some good signs and bad signs.

625
00:37:30,660 --> 00:37:33,060
I agree with everything you said.

626
00:37:33,220 --> 00:37:39,640
If you also look at the Freedom House report, it reports every year on the state of freedom on the internet.

627
00:37:39,800 --> 00:37:42,220
And it's gotten progressively worse and continues to get worse.

628
00:37:42,300 --> 00:37:43,240
So that's not a great sign.

629
00:37:44,340 --> 00:37:49,220
And I do think there's more and more countries who are turning to this more.

630
00:37:49,380 --> 00:38:00,860
There's also a lot of political churn where more right-wing parties are winning larger and they're more predisposed toward this kind of activity.

631
00:38:01,100 --> 00:38:02,040
And so that's not good either.

632
00:38:02,940 --> 00:38:10,180
And I do think you're seeing this kind of balkanization, which I wasn't allowed to use that word in state because I could say splintered at the time.

633
00:38:11,940 --> 00:38:13,100
You're seeing this happen.

634
00:38:13,100 --> 00:38:14,540
I think that's going to accelerate too.

635
00:38:14,640 --> 00:38:20,360
The good things, though, the positive things, I think there's more awareness of this trend now.

636
00:38:20,540 --> 00:38:30,320
I think there's more desire and ability and actual political will to use tools that we wouldn't use before to try to counteract this.

637
00:38:30,600 --> 00:38:34,240
And that's true both with cyber threats but also with these threats as well.

638
00:38:34,940 --> 00:38:39,260
I'm really heartened by the executive order on commercial spyware.

639
00:38:39,400 --> 00:38:41,740
I'm heartened by the fact that a lot of countries signed on to that.

640
00:38:41,880 --> 00:38:43,080
I'm heartened by the fact that a lot of countries signed on to that.

641
00:38:43,080 --> 00:38:45,440
I'm heartened by the fact that a lot of those countries said we're going to work together to promote this.

642
00:38:45,680 --> 00:38:54,440
When I go to these negotiations with the U.N. on the cyber crime treaty, I'm heartened that there are lots of countries who are banding together and saying human rights has to be a core part of this treaty.

643
00:38:54,820 --> 00:39:07,480
Now, there's other countries that say no, enough of the human rights already, but it's good that you have these countries do that because if it's a process where these countries are strong enough in pushing back, you're not going to get the kind of repressive language and instrument that's global.

644
00:39:08,260 --> 00:39:09,720
But I acknowledge the challenges.

645
00:39:09,860 --> 00:39:11,640
And, look, I wish it was going to get better.

646
00:39:11,640 --> 00:39:15,720
I think it's got a long way to go before we get there.

647
00:39:15,820 --> 00:39:18,520
But I do think there's more policy awareness than there ever has been.

648
00:39:18,620 --> 00:39:19,580
And so that will help.

649
00:39:20,880 --> 00:39:22,180
It's definitely going to be hard.

650
00:39:22,360 --> 00:39:24,040
There's no doubting that it's going to be hard.

651
00:39:24,180 --> 00:39:32,200
But I think it's important that we start with the vision for where we want to go and that we aggressively try to move towards that.

652
00:39:32,340 --> 00:39:36,940
And I think you're seeing some of that, the executive order, the national cybersecurity strategy.

653
00:39:37,100 --> 00:39:40,220
Just look at the introduction from President Biden.

654
00:39:40,220 --> 00:39:45,840
It talks about this idea of an affirmative vision where everyone has access to this open, free, secure Internet.

655
00:39:46,020 --> 00:39:59,520
You're seeing from the Summit for Democracy to all of these interactions in the United States and with a cluster of allies around the world a push towards saying, hold on, we are realizing this is a big problem.

656
00:39:59,760 --> 00:40:01,700
We're seeing the trend line is in the wrong direction.

657
00:40:01,880 --> 00:40:03,780
And we need to do something as a government.

658
00:40:03,960 --> 00:40:09,440
We need to do something in partnership with the people making the technology to stop it and reverse it.

659
00:40:09,440 --> 00:40:12,920
So, okay, I want to go back to something.

660
00:40:13,040 --> 00:40:14,520
I agree with something you said.

661
00:40:14,780 --> 00:40:21,360
One of the problems is if you try to restrict those countries, you're absolutely right, they develop their own capability.

662
00:40:21,680 --> 00:40:22,500
They become more isolated.

663
00:40:22,880 --> 00:40:24,700
And that's true with the technology generally.

664
00:40:24,980 --> 00:40:30,580
We've seen this with, you know, chips and other things where China is now, like, developing this stuff because they can't get it.

665
00:40:30,660 --> 00:40:33,820
So you have to figure out where that balance is and how you can influence it.

666
00:40:34,120 --> 00:40:38,240
So you mentioned something about, oh, no, I'm totally forgetting it.

667
00:40:38,320 --> 00:40:39,240
What in the world?

668
00:40:40,000 --> 00:40:44,860
So the companies are essentially saying, oh, we'll just disconnect Russia.

669
00:40:44,940 --> 00:40:46,960
We want to make life more miserable for them.

670
00:40:47,060 --> 00:40:54,000
And partially that's because there's no kind of coordinated message from the government saying, okay, IT providers, please help us block.

671
00:40:54,400 --> 00:40:57,940
They're doing it a lot of times because they think it's the right thing.

672
00:40:58,380 --> 00:41:05,480
And so it seems like maybe there's a role for government to say, no, we need very specific targeting against sanctioned individuals.

673
00:41:05,680 --> 00:41:07,220
Not all of us telecom.

674
00:41:07,420 --> 00:41:09,420
We just need to do it in these sort of ways.

675
00:41:09,420 --> 00:41:14,640
We don't want to be sort of net blocks or, you know, not the education ministry or whatever, but the arms ministry.

676
00:41:15,000 --> 00:41:18,840
And so does it just mean you're going to have to get more precise?

677
00:41:19,220 --> 00:41:21,660
Because the alternative is a giant blunt block.

678
00:41:22,940 --> 00:41:23,500
Yes.

679
00:41:23,940 --> 00:41:37,800
I know this isn't a perfectly satisfactory answer, but I think this is hitting on this really important topic of how the government messages when we might want something blocked or when we might want something enabled.

680
00:41:37,940 --> 00:41:39,400
Even if that's counterintuitive.

681
00:41:39,400 --> 00:41:40,520
It's counterintuitive to a business.

682
00:41:40,760 --> 00:41:45,900
And so later this afternoon, you all here at DEF CON, the policy space, there's a workshop.

683
00:41:46,260 --> 00:41:50,680
State Department is going to be there, along with ONCD, along with Roger and some others.

684
00:41:50,820 --> 00:41:56,660
And we're going to be able to talk about that when there aren't cameras in some more detail.

685
00:41:56,860 --> 00:42:03,900
And so I would encourage those of you who are interested in this very particular topic to come down and we'll have more conversations about that.

686
00:42:04,980 --> 00:42:09,180
But it is certainly an area that the government is actively thinking about.

687
00:42:09,200 --> 00:42:09,380
And it's something that we need to be thinking about.

688
00:42:09,380 --> 00:42:11,880
It's something that the government is actively sort of trying to work through some of the nuances on.

689
00:42:12,180 --> 00:42:17,140
But where at this point, there's not comfort talking to a camera.

690
00:42:17,420 --> 00:42:21,780
And that workshop is this afternoon at 2 o'clock in the policy at DEF CON area.

691
00:42:23,020 --> 00:42:23,420
Okay.

692
00:42:23,500 --> 00:42:25,540
We're rolling into the final four minutes, four or five minutes.

693
00:42:25,700 --> 00:42:28,860
So I'm going to just start on my right with Roger for any final thoughts.

694
00:42:29,080 --> 00:42:30,780
Anything you want to leave the audience with?

695
00:42:31,940 --> 00:42:32,340
Yes.

696
00:42:32,400 --> 00:42:34,000
So we gave you a bunch of pessimism today.

697
00:42:34,160 --> 00:42:39,360
But there's also optimism because here we are all working on the project from the technical and the policy side.

698
00:42:39,360 --> 00:42:42,460
And here all of you are learning about this.

699
00:42:42,520 --> 00:42:44,440
Please spread this all with your friends.

700
00:42:44,700 --> 00:42:51,620
I'm going to, after this session, answer whatever tour questions you may have over at the tour booth in the vendor area.

701
00:42:51,900 --> 00:43:00,280
And as a last thought, EFF launched a campaign a few days ago to try to get more tour relays at universities in particular.

702
00:43:00,600 --> 00:43:02,380
So it doesn't have to be an exit relay.

703
00:43:02,520 --> 00:43:03,760
It could be a non-exit relay.

704
00:43:03,940 --> 00:43:09,000
So if you're connected to a university, please consider running a relay for EFF's campaign.

705
00:43:11,500 --> 00:43:16,840
And my positive thought is that, you know, like I said, there's more awareness of this.

706
00:43:16,960 --> 00:43:19,620
And I really think that this debate needs all of you.

707
00:43:19,740 --> 00:43:26,780
I mean, it needs people to be weighing in to raise these issues because a lot of times policymakers think, oh, that's too technical.

708
00:43:26,920 --> 00:43:28,380
You know, I don't know what the implication is.

709
00:43:28,440 --> 00:43:34,780
So explaining what the real implications of this are and what this is going to mean is important because it flags this as an issue.

710
00:43:34,920 --> 00:43:37,340
And that's the beginning of any kind of real policy debate.

711
00:43:37,460 --> 00:43:39,340
But you can only be in that conversation.

712
00:43:39,340 --> 00:43:40,300
If you're in the room.

713
00:43:40,500 --> 00:43:45,260
So it's really incumbent on the people having that conversation to spit out these RFIs.

714
00:43:45,580 --> 00:43:46,640
Give us feedback.

715
00:43:46,900 --> 00:43:47,740
And I was going to say that.

716
00:43:47,840 --> 00:43:49,840
And that doesn't necessarily mean you being in the room.

717
00:43:49,940 --> 00:43:53,940
But it means that the people who are having these conversations, and increasingly they are.

718
00:43:54,100 --> 00:44:01,280
You know, we talk about this multi-stakeholder model, which means, you know, not just government people, but they should be talking to other stakeholders, including this community.

719
00:44:02,040 --> 00:44:03,780
And they're trying to develop mechanisms.

720
00:44:03,780 --> 00:44:05,360
Some countries are better at that than others.

721
00:44:05,600 --> 00:44:07,460
The U.S. is trying to do a lot more of that.

722
00:44:07,560 --> 00:44:09,160
And I think trying to take advantage of those.

723
00:44:09,340 --> 00:44:12,540
And frankly, a lot of the U.S. people were here at DEF CON for exactly this purpose.

724
00:44:12,680 --> 00:44:14,700
So making sure that there's that connection.

725
00:44:15,060 --> 00:44:16,400
And you're at least aware of it.

726
00:44:16,480 --> 00:44:20,300
And then you can raise the alarm bells in your own circles, too.

727
00:44:20,380 --> 00:44:21,060
And I think that helps.

728
00:44:23,200 --> 00:44:32,300
I think for me, one of the big points that I'd like to get across is the idea that security and human rights are actually two sides of the same coin.

729
00:44:32,400 --> 00:44:34,640
That they are not opposite sides of a scale.

730
00:44:34,820 --> 00:44:38,240
And if you are architecting a system, you're building something out.

731
00:44:38,240 --> 00:44:49,360
Thinking about the security is not just going to be good for your users here, but can potentially enable people around the world to circumvent a censorship regime.

732
00:44:49,640 --> 00:44:58,240
That if you build and architect your system with in the back of your mind the idea that an authoritarian may be looking at this, may be trying to use it for a malicious purpose,

733
00:44:58,480 --> 00:45:05,280
that you might be able to build it or architect it in a way that enables someone to reach out and report government corruption.

734
00:45:05,540 --> 00:45:08,220
That enables someone to reach out and talk about it.

735
00:45:08,220 --> 00:45:16,740
And if you build a system where you can talk about human rights abuses going on in their country, that is good, I think, for business and also good for all of us, for the world, for human rights.

736
00:45:16,920 --> 00:45:23,540
And that is something that we can do as we ensure that our products are secure sort of from the get-go, that encryption is strong.

737
00:45:23,900 --> 00:45:30,640
That the protocols don't have a button to say, you know, mass surveillance, click here, and you just click here.

738
00:45:31,000 --> 00:45:34,620
Those are things that we need to think about from a technological perspective.

739
00:45:35,960 --> 00:45:38,160
And I know you all are in that space.

740
00:45:38,220 --> 00:45:39,320
We're in a policy space.

741
00:45:39,480 --> 00:45:40,640
You all are actually building.

742
00:45:40,880 --> 00:45:43,540
And building with that idea of human rights in mind I think is really important.

743
00:45:44,720 --> 00:45:45,240
All right.

744
00:45:45,280 --> 00:45:48,340
Thank you so much for being at our panel on Internet censorship.

745
00:45:49,140 --> 00:45:50,740
And hope to see you around DEF CON.

746
00:45:50,900 --> 00:45:51,380
Thank you.