View source for HOPE X - 7/18/2014

July 18-20, 2014

The 10th Hackers on Planet Earth conference was held at the Hotel
Pennsylvania in New York City.

= July 18, 2014 =

== Surveillance, Sousveillance, and Anti-Surveillance ==

''Gregg Horton''

Many artists are using humor and interesting artistic techniques to
talk about surveillance. Take a look at Surveillance Camera Man on
YouTube. This is a guy in Seattle that videotapes people, to capture
their reactions. Some of the reactions are pretty interesting. For
example,
http://www.dailymotion.com/video/x28epbm_surveillance-camera-man-2_creation.

Jeremy Bentham came up with the idea of the "panopticon" as a prison
design.  There's a guard tower in the middle, and the prisoners are
positioned on the outer wall. At a moments notice, the guard could
turn and look at anyone in the prison.  Even though a single guard
couldn't watch all the prisoners all the time, he had the ability to
watch any prisoner at any given time. It had the same effect.

Michelle Foucault used the panopticon as the basis for
panopticism. Panopticism is the use of being watched as a means of
social control. People subjugate themselves because they know someone
might be watching them.  Sousveillance is the act of watching the
watchers. For example, Cop Watch.

Artveillance is art that comments on surveillance. For example, much
of Banksky's work contains surveillance cameras.  The Institute of
Applied Autonomy built a map of all surveillance cameras (in the late
1990s, early 2000s). The also wrote a `directions' application that
would find route of least surveillance; directions the minimized the
number of surveillance cameras you'd pass by.

Sometimes you want to be filmed, in order to make a statement. For
examples, New York's Surveillance Camera Players did a production of
1984 that was entirely filmed on MTA surveillance cameras. See
https://www.youtube.com/watch?v=RILTl8mxEnE.

Ambient Information Systems wrote a "Manifesto for CCTV Film Makers",
http://www.ambienttv.net/content/?q=dpamanifesto. In the UK, you can
obtain CCTV footage that you appear in. Artists would do things in
front of CCTV cameras, request their footage, and edit it into short
movies. For example, Manu Luksch's "Faceless",
http://www.ambienttv.net/content/?q=facelessthemovie.

Sousveillance is based on the idea that watchers can be
watched. Stephen Mann's "Shooting Back" is a good example:
https://www.youtube.com/watch?v=535wOr5OTz0.

McVeillance is the ratio of the number of people being surveilled
vs. the number of people watching back. You can postulate that the
higher the ratio, the more corrupt the society.

Tracking Transience was a project started by Hasan Elahi. Hasan was
detained by the FBI shortly after the 9/11 attacks. He started
contacting local FBI offices whenever he traveled, to report is
whereabouts and what he was doing. Since then, the FBI hasn't stopped
him for questioning.

One group published a "Guide to CCTV Camera Destruction",
http://www.schnews.org.uk/diyguide/guidetoclosedcircuittelevisioncctvdestruction.htm.
The gaze of the surveillance camera does not fall equally upon all
those on the street.

Camover was a response to a police conference in Berlin. A group of
activists made a contest out of taking down and collecting CCTV
cameras. See http://boingboing.net/2013/01/26/berlin-activists-create-cctv-s.html, and
https://www.youtube.com/watch?v=9GCsd2TJKjQ.

Disruptive Fashion can be a form of counter-surveillance. Some hair
styles and patterns of high-contrast makeup will prevent facial
recognition software from recognizing faces.

High powered infrared LEDs can inhibit surveillance cameras. The
cameras see the infrared light, but people do not.


== Barret Brown and Anonymous: Persecution of Information Activists ==

''Kevin Gallagher'', ''Ahmed Ghappour'', ''Gabriella Coleman''

(Gabriella Coleman on anonymous). In many areas of the world,
anonymous has emerged as the global face of dissent. Anonymous started
out with internet trolling.  By 2008, the group had shifted to
activism.

The militant side of anonymous started getting active in 2010. They
defended Wikileaks when governments cracked down on them.

Jeremy Hammond was sentenced to ten years in prison. He was swept up
in the "nerd scare".

(Kevin Gallagher on Barret Brown). I first met Barret at the last HOPE
conference (HOPE IX), and he was arrested a few weeks later. Barrett
is a 31-year old journalist.  In 2011, he started delving into
anonymous.

Barret was denied bail, and charged with posting a link to the
Stratfor documents, and hiding computers during the first FBI raid of
his home. In 2014, the government threatened to seize our defense
fund; fortunately, they didn't succeed. But they got a gag order that
prevented Barrett or his lawyers from talking about the case. Barrett
is still in jail, waiting to be sentenced.

Very few US journalists have been raided for doing journalism. Barrett
is one of them.  The FBI went after Barrett's mom for obstruction of
justice. He won't be the last journalist that's over-prosecuted. It's
very important to set up campaigns for people who've been arrested,
and to help them get adequate defense.

(Ahmed Ghappour). What turns prosecutors into persecutors,
particularly when some part of the indictment is based on protected
free speech? When the government doesn't know what you're up to, they
try to criminalize what you're doing. They go after information
activists much like they go after suspected terrorists. In the
government's case, they alleged that Barrett Brown and anonymous were
trying to take over the world.

Fear is one component of persecution. The government is trying to make
people afraid of "hackers". Right now, cybersecurity is the highest
security priority in the united states. Priority number two is
internal threats (aka whistleblowers). Terrorism is priority number
three. Our government considers cyber attacks to be at the level of
force, which means that kinetic war responses are
acceptable. "Hacktivist" is now listed as a legitimate security
threat.

We've seen anonymous's activity surge at times, but the collective
seems to have gotten weaker. Is this really the case, or is the media
simply not reporting on what they're doing? Anonymous's strength has
always been their adaptability and unpredictability.

This is about criminalizing information activism, or even programming.

Campaigns help. Prosecutors behave differently when they know they're
being watched.

The Department of Justice and Criminal Justice systems are sorely
lacking in technical competence. They're trying to investigate cases
where they have no technical understanding of the facts in the case.

Gabriella has a book coming out in November. It's called Hacker,
Hoaxer, Whistleblower, Spy: the many Faces of Anonymous.

Question: Has Edward Snowden helped Anonymous's views?

Yes, his intervention allowed many people to understand this kind of
politics.



== Wireless Meshnets: Building the Next Version of the Web ==

''Kevin Carter'', ''Peter Valdez'', ''Kurt Snieckus''

The presenters work with a group called NYC Mesh,
https://nycmesh.net/. They're trying to create community-based
wireless mesh networks in NYC.

The internet is amazing, so why would we want to build a new
one. ARPANET was first developed by academics and hackers, and they
could never have predicted how it would grow. Political and corporate
control has completely changed the character of the Internet. The
corporations use lobbying power to determine how the internet is
regulated. The FCC might allow internet service providers to create
internet "fast lanes". This would create slow lanes for everyone
else. And then, there is the corporate & political surveillance state.

Globally, the US is #29 in terms of internet bandwidth, just after
Estonia, and with an average broadband speed of 25 mbps.

Wireless technology is now ubiquitous and cheap.

Hyperboria is a mesh net win which devices relay data and route
traffic through peers.  It's a decentralized network. Hyperboria uses
cjdns, because cjdns has privacy and security controls built
in. Anyone can participate by adding a node. Meshnets are run by
users, for users.

Decentralization is a way to combat the ISP oligopoly, and various
socio-political factors.

Cjnds uses ipv6 addresses, which are based on public key
fingerprints. All data that flows through the network is encrypted and
signed. It's one big flat address space, and there's no way to derive
geolocation from network addresses.  BATMAN is another meshnet
protocol.

How does one join a meshnet? The first thing you'll need is an
OpenWRT-compatible router. The ubiquity nanostation is a good
choice. Meshberry is a distribution that can be set up on a Raspberry
PI. Meshbox is a project to get CJDNS working on OpenWRT.

DNS doesn't work well on meshnets. We need a good DNS replacement
protocol.  DNS is still an open problem,

https://wiki.projectmeshnet.org/Main_Page has a guide for setting up
your own mesh local.

You can also participate via #cjdns on EffNet.


== Advanced FOIA Workshop ==

''Michael Morrissey'', ''Kel McClennehan'', ''Michael Radnitzsky''

The government likes paper and files; this is what FOIA was written
for. But what about government information contained in databases?
Electronic records work in your favor. If you ask for records in
electronic form, then government agencies must give you the records in
electronic form. Sometimes, this means requesting a copy of the entire
database.

In some cases, you can work with your handler, to minimize the amount
of effort needed to satisfy your request. Say something to the effect
of "I recognize that you have more familiarity with the database, and
I'm willing to work with you to reduce the impact of this request".

Government database systems tend to be built by contract. Ask for a
copy of the contract. The contract should indicate what the system is
required to do (e.g., to support csv export). Some agencies have very
antiquated systems, and extracts might be technically challenging.

You can file a FOIA request in tiers. Ask for the manual that the
agency uses for satisfying FOIA requests. If you have the manual, you
can probably write the request for them. Ask the analyst to provide
the query string (or query parameters) they used, in addition to the
query results. Start with a small request (almost like a test), and
then built up to bigger requests.

Never ask a FOIA officer for their judgment. Their judgment may not be
what you want, and you'll be charged for the time taken to make and
apply that judgment.

Ask for manuals, or a design specification of the database in
question.  A lot of government data is outsourced. They give the data
to a cloud provider, and then lease it back. Sometimes the agency will
say "the data belongs to a private company, and it's no longer subject
to FOIA". This is a big problem.

There aren't many contractors building systems for federal
agencies. Often, many agencies use products from the same vendor, with
small tweaks to meet particular agency needs. http://usaspending.gov/
can help you find contracts that were awarded by individual agencies.

Lots of agencies use mailing list software (listserv), and you can
request copies of these messages. Some agencies make this very
difficult. For example, the CIA will only provide messages matching a
particular set of To:, From:, and Subject: headers.

National Freedom of Information coalition: http://www.nfoic.org/.

At the federal level, FOIA officers often don't have direct access to
the data you're looking for. Often, FOIA officers need to task out
queries, and coordinate with others to satisfy a request. Much of FOIA
is trying to put yourself in a bureaucrat's mind.  What would a filing
cabinet do?

Get familiar with agencies data retention schedules, and data
disposition schedules.  These can provide a good roadmap for what kind
of data exists.

The privacy act cannot be used as a basis for (b)3 denials.

Some agencies post a list of "major information systems" on their
website. FOIA law requires this. (See FISMA:
https://en.wikipedia.org/wiki/FISMA#Inventory_of_information_systems).

If you're facing a large processing fee, offer to show up in
person. By law, you must be allowed to examine records in person, for
free. Most agencies don't want requesters snooping around their
offices.

When records are subject to FOIA requests, an agency cannot purge
those records during FOIA processing.

Often, it's interesting to ask for the "administrative records"
generated in the processing of your FOIA case.


== Lightning Talks ==

People used to collect books in personal libraries. I'd like to
archive everything I look at in my web browser, in a way that
preserves the interactive nature of web sites.  Like archive.org, but
stored on my own computer, and cataloging only the web sites that I
visit.

The FCC is currently considering proposal 12-254, for a new citizens
band radio.

http://phant.io/: FOSS tools for building the internet of things.

https://sparkfun.org/: makers of free hardware that can be used to
build the internet of things. (Their website's certificate was issued
by Comodo; my web browser claims that it cannot verify their
certificate).

http://www.worldcat.org/. A catalog of all books in the world.


== Postprivacy: Life in the Digital Sphere ==

''tante''

Privacy is a social process. It's key to many debates of our
time. Privacy is part of the UN and EU's declaration of human
rights. It's a tool to protect people.  There are many definition of
privacy. One definition is "It's the right to be left alone"; this
definition comes from Judge Brandeis and was prompted by the rise of
cameras in the 1890's. Another definition is "the right to control
access to personal information".

Privacy is not the same thing as having secrets. You share secrets
with the assumption that the receiver won't pass them along. Privacy
allows you to control information that you put out about
yourself. Secrets are information you don't put out at all.

The Nazis used every data gathering tool at their disposal. The
professionalized psychology. The Netherlands had very accurate public
registries, which included individual's religion. The Nazis used these
registries to round up Jews. The Statsi kept (or tried to keep)
records on every observable interaction between people, regardless of
how mundane these interactions were.

At that point in time, only governments and very large companies could
collect large quantities of personal data. They were the only ones
with computers. These factors caused Europe to develop strong privacy
laws.

Privacy allows us to develop our ideas, before we release them to the
world.  In Germany, you have the right to legal
self-determination. You can sue over privacy.

Governments don't like privacy, especially when it gets in their
way. Secret services are antithetical to a free society, and we have
to get rid of them.

You can be asked to give away your privacy - to get a loan, or to get
a job.

Many people say that privacy is very important, but they don't act
that way. For example, Google's search engine has a 95% market share
in Germany.

Privacy is like DRM. Both involve control of information that's been
released to the public.

Who owns data about the relationships between people. It's not just
one person.

Post-privacy means a change of defaults; making things public by
default.  In the offline space, we've always shared information about
ourselves. Even if just via the clothes we were wearing.

To change public perception, you have to get out there, you have to be
visible, and you have to make a point.

To keep discrimination in check, we need people to be visible.

Post-privacy is a way to step back from privacy as dogma, and see
what's really out there. We should teach other things
instead. Participation. Open and noncommercial platforms for
collecting and aggregating data. Structures that help us redefine
power. Rethinking consent, and how we treat other people. Rethink
ethics and how we treat other people's data. Instead of focusing on
hiding data, focus on how we treat it, and what we can do with it.


== Dark Mail ==

''Ladar Levison'', ''Stephen Watt''

The idea is how to make email "go dark", from the NSA's
perspective. This involves solving server problems. First there's key
management: the process of generating, rotating, obtaining, and
validating keys. We want to make the world a safer place, without
people having to think about it too much. Second, there's the problem
of metadata minimization. Somewhere along the line, we lost freedom of
association. We want to encrypt headers, separate message and envelope
headers, and minimize the amount of header data that a server can
see. Ideally, mail servers would be onions, and wouldn't know the
entire route. Third, we want to engineer a system that's resistant to
advanced threats. Our goal for Darkmail is to make mass surveillance
technologically unfeasible.

Endpoint defenses leave security problems to individual users. Not
many consumer devices can be called "secure".

Darkmail was designed to be flexible. People will deploy and use it
differently, based on their own perceived threat model.

Darkmail's client mode governs how keys are handled. There are three
client modes: trustful, cautious, and paranoid. Trustful mode implies
that you trust the server to handle all encryption on your behalf, and
all encryption is done on the server.  Trustful mode could work like
Lavabit used to work.

If the only thing we get out of the Snowden disclosures is more TLS
for SMTP, then we've lost.

In cautious and paranoid mode, the security comes down to the strength
of your password, and the security of your endpoint device. In
cautious mode, your private keys are encrypted, but stored on the
server, so that they can be accessed anywhere.  In paranoid mode, your
private keys stay on your device.

Users generate keys, which are signed by organization
keys. Organization keys are pinned to DNS.

Only 0.5% of domains use DNSSEC. UDP packets aren't encrypted, which
is a big problem with DNS.

In darkmail, trust requires both a primary and secondary source for
validation.  Darkmail has a "global ledger", which is used to
syndicate public key information.  The global ledger and DNSSEC can be
used to validate keys.

Darkmail keys incorporate the concept of a chain of custody. You can
rotate keys, and key ''n'' is signed with key ''(n - 1)''. This allows
key rotation to be verified.

We'd like to create a DNS resolver that can look up public keys for
email addresses.

Darkmail is based on an architecture called Magma. All mail services
run out of a single multi-threaded process. The system is designed to
cluster, using MySQL for cluster synchronization, and memcached for
fast lookups. There's a dedicated memory allocator for sensitive
information, like passwords and private keys. This memory is pinned
and can't be paged out to disk; it's also wiped on free.

Our first implementation is targeting CentOS on x86 64.

TLS 1.2 is mandatory for client-to-server and server-to-server
communications.  As an end-user client, we're working on a Thunderbird
fork called Volcano.


= July 19, 2014 =

== Bless the Cops and Keep the Far From Us ==

''Alexander Muentz''

This talk could be subtitled "keeping your ass out of the sights of
law enforcement".

Computer crimes have been in the news a lot lately, and this gives
hackers a bad name. We've gone from folk heros, to common criminals,
to national security threats.

For computer crimes, the state has abdicated its role to protect. If
you report $10k of damage due to malware, you'll get a very different
response than if you reported $10k of damage due to vandalism.

If you're caught committing a computer crime, expect to be given
greater scrutiny.  Particularly if you're a white hat security
researcher who's operating openly.

18 USC 1030 is the Computer Fraud and Abuse Act (CFAA). The CFAA
protects any computer involved in interstate commerce, which is
practically any computer that's plugged into the internet and turned
on. The law is very vague, to prevent hackers from skirting (or for
that matter, obeying) the law.

The CFAA has no "good reason" or "self defense" exclusions. There is
also no free speech exclusion. Most CFAA violations carry 3-4 year
prison sentences.  EULAs and Terms of Service define what you're
allows to do with a service; this becomes the CFAA's definition of
"Authorized Access".

Let's consider third-party audit clauses. A stores data with B, and B
subcontracts data storage with C. The third-party audit clause gives A
the ability to audit C.  For penetration testers, this creates
ambiguous system boundaries. Where does your system end, and Amazon's
system begin?

Every computer crime has sentence enhancements (i.e., more severe
punishment), due to the use of "sophisticated means".

If you plan to do white hat security research, protect yourself by
getting authorization first, preferably written authorization.

Be careful about disclosure. Many people are prosecuted not for what
they've done, but for what they've said. Think of how one might take
your words, and disclose them in the word possible light. Your
statements will be used against you. For example, before you say "fuck
shit up" (even in jest), consider how a prosecutor might use those
words against you. "You're not a cop, are you?" is another phrase to
avoid.  To a prosecutor, this phrase shows intent to commit a crime.

Once the bracelets come on, shut the fuck up. Nothing you can say will
make things better. In all likelihood, whatever you say will make
things worse.

If you're prosecuted, expect prosecutors to take everything you've
said online, and try to use those words to show you're an evil
bastard.

Some speculate that one in five people are informants. Think Sabu - he
wasn't a passive participant.

If you get legal attention, shut up and lawyer up.

Comment: On average, computer crimes carry fifteen year sentences, but
rape only carries a five-year sentence.

Under modern sentencing guidelines, you'll get more time for doing
something to a bank than you'll get for putting people in physical
danger.

If you want to use a computer to get back at someone, you're better
off beating them over the head with it. Cyber crimes carry a harsher
sentence than physical assault.


== Ask the EFF - This Year on the Internet ==

''Nate Cardozo'', ''Kurt Opsahl'', ''Ade Kamdar'', ''Peter Eckersley'', ''Eva Galperin''

Last year was very interesting, partly due to things going on with the
National Security Agency. We have three cases against the NSA: Jewel
vs NSA, First Unitarian vs. NSA (focused on the right of association),
and Smith vs. Obama (in conjunction with the ACLU). Other cases
involve national security letters; a court declared them
unconstitutional, the government has appealed, and we're expecting the
appeal to go to court in 5-6 months.

We have an effort to encrypt the web, by furthering HTTPS and
developing HTTPS Everywhere, and the SSL Observatory. We also have an
open wireless router project.

There are journalists, dissidents, activists, and the vulnerable
population outside the US. These are the audiences for our
surveillance self-defense guide. It's a digital first-aid kit.

We have an activist team focused on campaigns, and on getting people
to take action.  For example, patent reform, and open access to
research.

We have FOIA suits against the NSA, and the "Who has your back"
project. We also have the coders rights project.

Question: How does a FOIA request become a FOIA lawsuit?

If an agency doesn't respond within 20 days, you can sue. You can also
sue if you're denied an appeal.

Question: How safe is it to use DDOS as a method of protest?

You're free speech rights are under threat right now, regardless of
where you live, or who's jurisdiction you fall under. The UK recently
expanded the surveillance capabilities of GCHQ. Australia introduce a
law that would make it illegal to report on national security leaks.

Deflect is a non-profit offering DDOS protection for non-profits.

Question: What are some important legal decisions in the US that make
us more (or less) safe in terms of the First Amendment?

Garcia v. Google. Google had to take down "The Innocence of Muslims",
on the basis of a copyright claim by one of the actors.

A greater exception to free speech is the "right of materials". We've
seen efforts to export these ideas to other countries via free trade
agreements, like ACTA and the TPP.

Free speech isn't free. If you're using someone's platform, then they
have free speech rights, and you do not.

Question: How effective are warrant canaries against National Security
Letters?

Some companies and service providers have started using them. Warrant
canaries haven't (yet) been tested in court. Tumbler and Pinterest did
ones we really liked, using a six-month reporting interval, with a
three-month delay. The delay helps lawyers, in case your warrant
canary gets a legal challenge.

Question: Is privacy dead?

The government wants you to think this, because it makes you feel
powerless. There's a reason why you lock your door, draw your
curtains, and don't walk around naked.  Even if you have nothing to
hide, you have an obligation to protect people who do.

Question: Are you doing any work in Canada?

Most of our work there is done in conjunction with Citizen Lab, which
is based out of the University of Toronto. A few of our colleagues
were at a TPP meeting in Canada.  We had signs and banners, it was
great.

Question: The National Strategy for Trust Strategies in Cyberspace is
calling for verified online identities. This has been an open process,
but the EFF hasn't been involved. How do you choose which things to
get involved in?

We have been involved, and we've submitted proposals for anonymous and
pseudoanonymous systems. It's a large bureaucratic process between
government and industry. This is happening all over the world. We
don't have the head count to get involved in everything.

Question: What are some of the difficulties involved in arguing
technical cases in front of a judge?

We have lawyers and technologists, and we work together in writing
briefs.

Do you feel like the judges understand?

Sometimes the court gets it. For example, explaining the invasiveness
of smart phone searches.

Question: In Ecuador, there's a growing Internet Freedom community. Do
you work with these sorts of groups?

One of our folks is doing a tour of Latin America, giving talks. They
influenced the US resolution that mass surveillance is not consistent
with human rights.


== Keynote Address - Daniel Ellsberg ==

Thomas Payne said that nations should have no secrets. The secrets of
courts, like people, are their defects.

There are legitimate secrets in government, such as employee medical
records, and secrets in wartime. Since the government has collected
information on us, it could all be released digitally.

Most whistleblowers tend to know more than they release. Bradley
Manning worked in a compartmentalized information group, meaning that
he had top secret (or higher) clearance. He only released secrets (as
opposed to top secrets). Manning's revelations helped get us out of
Iraq. He revealed atrocities committed by the US armed forces.  Bush
and Obama would likely be indictable on torture, but we never chose to
investigate them. That's illegal. We have an obligation to
investigate.

It's odd that we prosecute people for revealing evidence of
crimes. That's absurd.  Other types of defects deserve to be known,
but will be be kept secret, either by governments or
corporations. Snowen revealed that the NSA knew that what they were
doing in 2001-2005 was illegal.

Bush's invasion of Iraq. People were tried at Nueremberg for this sort
of thing, and hanged as a result.

Most secrets don't need to be retained for very. Only 5% of things
written need to be classified. After a few years, that drops to
0.1%. Very little deserves classification.  Take D-Day for
example. That should have been classified before the invasion. Did it
need to remain classified in August of 1944? By then, the time and
place of the invasion was widely known.

Today, there's no public interest defense for whistle blowers.

When Manning was on trial and asked why he leaked the pentagon papers,
he started to explain his motives. The prosecution objected, and the
judge sustained the objection. This was one of the first cases where a
defendant was not allowed to explain their motive. This is why
requests for Snowden to come back to the US are hollow.  The courts
won't allow him to give his side of the story.

There's no doubt that Snowden, Manning, and I broke secrecy rules,
which are administrative rules in the executive branch. You can't give
classified information to someone who's not authorized to see
it. These are administrative privileges. We took an oath to protect
the constitution from all enemies, foreign and domestic. We didn't
take an oath to secrecy. There are domestic enemies of the
constitution. Dick Cheney is one of them. Cheney believes that the
executive branch is above the law.

We've been in a state of emergency since September 2001; it's been
renewed every six months since then. The continuity orders are
classified.

I know of no one who's been charged with violating their oath to
defend the constitution. We signed a secrecy agreement. It was
essentially like the NDA a corporation might ask you to sign. The US
doesn't have an official secrets act. The British have one, as do many
other countries. We shouldn't have a British-style state secrets act.
It would violate the first amendment.

When I copied the pentagon papers, copying wasn't considered a
crime. That's not the case today.

Official freedom of speech hasn't gotten as much attention as it
should. Secrets are often used as a means to keep the public unaware
of what the government is doing.  Isn't it worthwhile to take a risk
and sacrifice when you see the government doing something wrong and
unconstitutional, and keeping it secret? Is the intelligence community
really independent? Why is there a 6000 page report on CIA torture
that's been bottled up for years?

We need more whistle blowers in government. Folks need to develop
things like secure drop, so that people can do this without spending
the rest of their lives in jail.  Congress passed an official secrets
act at the end of 2000. Clinton vetoed it.

Oil, gas, and coal companies certainly have plenty of documents
showing that they know perfectly well that fossil fuels are causing
climate change. These documents deserve to be leaked, and leakers will
need help with anonymity.


== A Conversation with Edward Snowden ==

Edward Snowden thanks Dan Ellsberg for all his service, both in and
out of government.  Question: What were you feeling the first time you
heard about Edward Snowden?

Dan Ellsberg: I felt hope. I felt the same about Manning. How often do
you need a massive dump of dump of documents?

Ed Snowden: You touched on technology. To gather public information,
you need to know about technology. Technology powers dissent, and not
just recently. Photocopies allowed the pentagon papers to come
out. Technology empowers people. The government does their best to
discredit and destroy whistleblowers.

Executive orders are being used to monitor many people, and many US
citizens.  This was news in the Washington Post, from a former State
Department Official. It should be a front page story, but it's just an
op-ed, because of a lack of overwhelming evidence.

The government calls whistleblowers "bad", and claims they're
spies. The intelligence community uses these cases to create
examples. We didn't fight a revolution to have a set of internal
policies. People should know at least the broad outline of government
policies that affect their lives.

Dan Ellsberg: Obama was asked if Manning was like me. Obama said no;
the two were classified differently. What Manning put out was secret
info. Everything I put out was top secret. That's the difference.

I immediately identified with Manning and Snowden. We were all willing
to take a very big risk. I would have put out more recent documents,
but I didn't have access to them. I was trying to end a war.

Snowden: You acted to end a war; to correct policies that were costing
people their lives. The journalists and editors who worked on these
stories are really trying to make sure they fit into the public
interest. The intelligence community is doing a lot of things behind
closed doors. They're not accountable to the public. There's very
little accountability, even to congress.

Eight senate intelligence committee members all get a lot of funding
from private intelligence companies. We need to know what governments
do, in order to decide how much to scrutinize them.

Section 215 says "we can collect call records of everyone in the
country". That's not about surveilling individuals; it's about
surveilling everyone, collectively, and their associations. It's a
violation of the first amendment's right to free association, the
fourth amendment's right to privacy, and the fifth amendment's right
to due process.  We have the ability to protect our rights, by coding
protection into the programs we use every day.

Question: What can designers and developers do?

Snowden: It depends on the threat model. Encryption is an important
first step, but encryption doesn't protect the right to
associate. Secure drops help. Phones are not very good tools for
this. The same tools that the government uses to find spies are also
being used to track journalists. We need obfuscation, mixed routing,
and unattributed internet access. This is a worldwide problem. How are
the worst people on earth going to damage your systems? And by "worst
people", I mean governments.

Ellsberg: We've talked a lot about helping informants, and getting
information to journalists, and even to congress. But we also have to
consider the press. We have to be concerned about news outlets that
only publish "approved" stories. The government hasn't (yet) gone to
the extent of prosecuting journalists outright. I believe this is
coming next; charging journalists with aiding and abetting, and making
an assumption that they're criminals.

Snowden: That's a really complex topic. Politically, I'm almost
Stallmanesque. Software is a way of expressing and defending our
freedom. We need to enshrine our rights in the software we use. That
would prevent mass collection, but wouldn't shut the government out of
specific, targeted investigations.

Journalists that advocate policies of limiting what the public knows
are not acting in our best interests.

Today's sysadmins and hackers have a civic duty to each people around
the world how to safely interact with technology.

Ellsberg: Every one of us has seen things that were wrong, that should
be exposed.  But we turned our backs because we were intimidated. But
there comes a time when the level of wrongness is so great that you
have to cross the line and tell the truth, even at your own risk. Many
people never see that line: renewing an unlawful ware, the tobacco
industry, GM. I hope that more people will be inspired to take
significant risks. Bismark said "courage on the battlefield is very
common, but civil courage is very rare".

We got into Vietnam to support French colonialism. I think that every
death in Vietnam was an unjustified homicide.

Courage isn't just something you do for the commander in
chief. Snowden was the only person in the whole fucking NSA that did
what they were supposed to do.

Snowden: Politically, I'm very moderate. Greenwald called me a
radical; it was the first time I've ever been called that. Lots of
people in government want to do the right thing, but there's a stigma;
you have a family and you have kids. We can't judge people for human
nature. This is not about wiping out government, this is about the
public knowing what government does, and holding them accountable for
their actions. We can't allow secret things to happen behind the
scenes. The only way we stop that is with transparency.

Ellsberg: I came to feel that I was asking too much; that only some
people had a limit. But many people complain internally, and they're
taking risks too. I think it's essential to make the process less
risky. The public needs to know the embarrassing things about their
government. We can mitigate risk, but I don't think it will ever
become riskless.

If Snowden went back to the United States, I think he'd spend the rest
of his life in a solitary isolation cell. You'd never get a chance to
make your case to the public. But you can do that in exile. Chelsea
Manning has never been interviewed by a reporter, since the day she
was arrested.

Snowden: Being a patriot does not mean obedience to authority. Oaths
to authority are very dangerous. We should encourage oaths to
values. If our leaders can't uphold their oaths to the Constitution,
then they shouldn't ask us to. Our government asks people to protect
the government's interest, to the detriment of people around us.  If
they can trample the first, fourth, and fifth amendments, then they
can trample anything.

Ellsberg: We fundamentally agree here. There is risk, even if you
don't get prosecuted.  The constitution is the next beginning and end
of this. The fugitive slave act was upheld by very brave people. Rosa
parks broke a law that the Alabama Supreme court ruled
constitutional. We may have to resort to civil disobedience.

Snowden: Look at everyone in the room. It's a broad
cross-section. People from the NSA are in the room. To the NSA people
in the room, you have to figure out what you believe, and the world
you want to live in.


== Lightning Talks ==

One group is taking the idea of HTTPS everywhere, and applying it to
Tor. Instead of converting HTTP to HTTPS, they'd like to go from HTTPS
to Tor hidden services.  The challenge is identifying Tor hidden
services that correspond to public websites.

Another speaker was attempting to quantify the effects of the Snowden
revelations.  They used Google trends to look at the frequency of
searches that involved "privacy sensitive" terms. Surprisingly, the
frequency went down 5% after Snowden's leaks started coming out in the
media. There are also fewer searches for terms that might get you in
trouble with the Government. The presenter's paper is called
"Government Surveillance and Internet Search Behavior".

Tahoe LAFS (least authority file system) is a storage service that
uses end-to-end encryption. You can make Tahoe available as a Tor
hidden service.

I'm doing a movie about computer hacking. I've interviewed a number of
people. We want to hear your stories, and we want to put you in our
movie.

Ethereum is a new use of block chain technology. It expands the idea
of block chains beyond financial transactions, to general
contracts. The goal is to have "smart contracts", where one can verify
that agreed-upon conditions have been satisfied.


== Electric Waste Orchestra ==

''Colton Jackson''

Most of the things presented were built at a makerspace in Urbana.
E-waste tends to pile up, because you have to pay someone to dispose
of it. If you want to make things out of e-waste, it's easy to find
material to work with.

The presenter built a musical instrument out of hard drives. It was
kind of cool looking; shaped like a guitar, with a bunch of exposed
hard drive platters. Spinning a patter creates a sine wave, and the
waves can be used to produce music.

On the software side, MaxMSP and PureData were helpful in turning the
electrical signals into music. PureData takes an analog voltage and
digitizes it. The digitized signal can be passed to other functions.


== A Sea of Parts ==

''Per Sjoborg''

This presentation was about self-configuring modular robotics.

Each module should be "minimally viable", as simple as possible. The
power of modular robotics comes from putting the modules together.

We have the notion of a "universal physical machine". The goal is to
have modules that can be combined to form any kind of machine. Modules
can be pooled and shared. Use what you need when you need them; return
the modules when you're done. It's like sharing a power drill with
your neighbor. Modules and sharing create a low barrier to entry.

Reconfigurable devices can be replaced without throwing away the old
parts. You reconfigure the old parts instead.

As designs get more complex, involving more and more modules, it
becomes harder to reconfigure the robots. The mathematics is very
challenging. Someone recently built a kilobot (using 1024 modules). He
said that the last 200 modules were very difficult to incorporate.


== Social Engineering Panel ==

''Emmanuel Goldstein and friends''

A big part of social engineering involves learning what doesn't
work. You have to know when the jig is up, and learn from it.

Social engineering is based on the idea of establishing rapport. Don't
let your mood fail that. It's all about empathy, and being able to
listen.

It's important to think about control, and controlling your outer
persona. Social engineering is like method acting. It's a confidence
scheme, designed to gain the trust of a target, and getting them to
divulge something they shouldn't divulge.


= July 20, 2014 =

== Cyber Security in Humanitarian Projects ==

''Lisha Sterling''

Cyber security is a problem for everyone. Malicious criminal attacks
are getting more sophisticated. Governments do stupid things. Privacy
is a growing concern. We need to make security tools easier for
users. We need to build systems that, by default, enforce human
rights.

Think like a n00b. How do your designs work for someone who's not a
techie? This stuff is scary and incomprehensible to most people. Even
more importantly, we're talking about vulnerable
populations. Populations who've experienced disasters or crises are
especially vulnerable - people who've lost their homes, who've
experienced natural disasters, or who live in war zones.

There are two kinds of humanitarian projects: (1) those attached to
large government agencies or NGOs (for example, FEMA and Doctors
without Borders); and (2) small projects run by passionate people,
which aren't attached to a larger organization.  Both groups have
things in common. They serve vulnerable populations, they store
sensitive information, and they lack security skills. Both struggle to
find funding.  These two groups have different problems: too much
bureaucracy vs. having no structure at all. Existing infrastructure vs
no infrastructure. They have different ways of handling money and
volunteers.

Projects that weren't built for security usually have security as an
afterthought. This won't change unless security-focused people get
involved right from the start. You don't know anything about security
code until you've spent a bunch of time breaking things.

SANS holiday hack can be a lot of fun.

Don't just break things for yourself. It's much more fun to break
things with friends.  Have security-focused hackathons. Set up a pen
testing lab, take an existing project, and try to break it. Try to get
people from the project involved, so they can receive feedback.

Non techies are very important. We need people who will use our stuff,
and aren't proficient in command line-ese.

What can you do? Help sponsor a hackathon. Have your company sponsor
Geeks Without Bounds (http://gwob.org/), volunteer, mentor, organize
your own events, donate.

Question: How do you balance security with the need to get things
done?

Treat security as any other feature set. You don't implement every
single feature in the 0.1 version, but you still keep them in mind.

Question: Have you seen attacks on humanitarian projects?

Scammers scraping personal information, and using it for phishing
attacks. Many attacks are aimed at getting information out of people,
especially dissidents.


== Ethical Questions and Best Practices for Service Providers ==

''Nicholas Merrill'', ''Ladar Levison'', ''Declan McCullagh''

We're not here to denounce warrantless surveillance. Instead, we're
here to talk about how service providers can conduct themselves
ethically.

What's changed since the Snowden releases? The market has certainly
changed.  Privacy has become a market differentiator that consumers
pay attention to. As a business, where do you draw the line between
protecting users, and obeying (unjust) laws?

The bugs recently found in OpenSSL and GnuTLS emphasize the importance
of layering protocols. For example, layering TLS + OTR + Tor. If one
protocol becomes broken, you still have the other protocols to protect
you.

I draw the line at the constitution. When there's a warrant issued by
a judge, that's not overly broad, for a specific thing, then I think
it's right to turn over the information and help law
enforcement. Asking for access to everyone's data is way over the
line. Gag orders make those requests villainous.

When you're served with a secret warrant, you have to clear your
lawyer with the FBI, to make sure that they have the appropriate
clearances. It's hard to find lawyers that have these clearances. I
felt like I was being denied an inalienable right - the right to
consult an attorney.

If you're starting a new business, you have to avoid being put in the
position of handing over data on your users. If your users are the
only ones with keys to their data, then you can't hand their data
over.

Some are starting to kick around the idea of using separate legal
entities for software development and service providers. They
providers don't write the software, so they can't be forced to modify
it.

Judges have free reign in the courtroom; they're like little
kings. They can issue unreasonable orders, and your only option is to
appeal them.

Warrant canaries are an interesting legal idea. Some attorneys believe
you'll be charged with contempt for using a warrant canary.

Some people have used incriminating information as their password,
then claimed they can't disclose it, due to the fifth amendments
prohibition on self-incrimination.

Phones are tracking devices. Is there any informed consent there? Or,
Facebook's manipulation of data as a social experiment. There's a
continuum of ethics, but a lot of these things play out in back
rooms. As a consumer, it's hard to tell what's going on.

If you're serious about privacy, the business model of mining consumer
data has to be thrown out the window. We may need to go back to a
fee-for-service model.

Being ethical could mean informing users when their data is given
out. If my bank gives my personal information to a credit agency, then
I deserve to be notified.  There are many warrants for surveillance,
but very few arrests coming from these warrants. Those under
surveillance never have the opportunity to face their accusers.

I'm still fighting a gag order from 2004. I can finally talk about it
because the FBI admits there was no underlying investigation. But I
can't talk about the types of data the FBI wanted me to collect. The
FBI eventually withdrew their National Security Letter. I think that
was a tactical move, to prevent the Supreme court from ruling on the
legality of the Patriot Act. Whenever someone is willing to take an
NSL to court, the FBI always withdraws.

The vast majority of NSLs go to large service providers. If these
large providers don't challenge the NSLs in court, we may never have a
ruling on their legality.

Question: I've moved my email to a VPS in Iceland. Am I still subject
to CALEA?

Yes, if you transmit data via the phone service. I'd favor a limit on
surveillance. Say, after 60 days, you should be able to notify the
targeted user, so they can start looking for a lawyer. The FBI has
been trying to expand CALEA for years. "Going Dark" is the name of
their latest effort to expand CALEA.

Question: What about a pro-se defense?

If your two options are "give the government what they want", and "go
to jail", you don't need an attorney for those options.

Comment: You can't take a hypothetical dispute into court. You need
something concrete in order to show standing.

In 2004, the government issued over twelve thousand National Security
Letters. Only one person was willing to take them to court.

Question: What happens if the FBI forces you to make your service
insecure, and won't allow you to remove the word "secure" from your
marketing materials. Is that a problem with the FTC (federal trade
commission)?

Yes, and the FTC hates the FBI. But guess who wins: the group
protecting consumers, or the group protecting the state?

Comment: We like the convenience of technology, and that forces us to
give up some privacy. But we're giving up more privacy than we should
need to.


== Teaching Electronic Privacy to Government ==

''Greg Conti''

Is it possible to protect cyberspace without destroying democracy?
Yes, but we have to do it carefully.

Many decisions are made in back rooms, with little or no
transparency. When you're making security decisions, it's good to have
a hacker in the room.

Our world has become increasingly instrumented. Once upon a time, this
was moderated by the human workload required. Now, we've removed the
human effort.

Different groups have different viewpoints on security; for example,
the EFF, law enforcement, policy makers, and business. Most policy
makers are trying to do a good job, and they like actionable
ideas. But their abilities are limited.

Thee communities value patriotism, they understand threats, and they
want to prevent bad things from happening. But their abilities are
limited. There's a trust that things being built won't be abused.

If the department of defense defended the land like they defend
cyberspace, then a land invasion would have to be fought by civilians
and business entities.  We want solutions the provide effective
security, are non-intrusive, and protect privacy.

West Point just hired an ethics fellow. This is a new thing. The DoD
also has a privacy research group.

In a large organization, the set of available tools are crude. You
have posters, pamphlets, professional reading lists, conferences, and
required annual training. Organization leaders have to use indirect
means of changing attitudes. Changing attitude requires the support of
senior leaders.

To get change in communities, we need to build allies, and develop
mutual respect.  Convey why privacy and civil liberties are
important. Provide concrete examples.  Tie your examples to our
instrumented world. Freedom of thought and freedom of expression are
important to democracy.

Question to consider: if you were running a training session for
government officials, what would you teach them?

Comment: People in the military often have a good knowledge of
history. Use the metaphor of "the people we will be". For example, we
didn't fight the cold war to have a police state here.

Comment: We seem to be moving towards a militarized state. You can't
have dissent when protesters are kettled. Much of our military
recruitment is done among low-income communities. The danger is that
we have a military and a police force that's invested in oppression
for the benefit of the elite. Resistance to authority is a big
difference between people in the military and people here (in this
room). You have to get past their laser focus on security, and get
them to look at the broader perspective.

Question: How did you get your position?

I worked with West Point. West Point is an academic institution, and
you can do a lot with educational freedom.

Comment: My concern is around the phrase "humanitarian
militarism". Data is the new oil. Data is new research for
exploitation. Privacy and security trickles down to government
contractors and NGOs. Contractors are responsive to opportunities, and
to how contracts are written. If you write security and privacy into
the contract, then the contractor will care.

Question: We see lots of negative reinforcement, but little positive
enforcement.  How can we do more positive enforcement?

The military is responsible to civilian authority. Focus your praise
to civilian authorities. Follow the chain of authority.

Comment: I'm concerned about the rule of the military vs. the rule of
local law enforcement. Perhaps the military could consider an open
house, where civilians could come and meet them.

Comment: The military's job is to defend civilization. My job is to
create a civilization that's worth defending. The military focuses on
procedures: what did you do? Civil rights law focuses on why you did
it, and what the outcome was.

Comment: The first step in negotiation is finding common ground. The
military is very focused on security, and many of us are
too. Likewise, we both value freedom.


== The Science of Surveillance ==

''Johnathan Mayer''

The NSA didn't provide many facts to the agency's overseers. Are there
ways to inject computer science into law?

Surveillance orders include privacy safeguards (for US persons). These
safeguards are designed by lawyers, based on their assumptions about
technology.

The bulk email metadata collection (which ran from 2001-2011) required
a reasonable articulable suspicion. This comes from section 214 of the
US Patriot Act. Metadata is not protected by the fourteenth amendment.

Internet traffic collection (2001-current). Most internet traffic gets
routed through the United States, so the NSA is in a good position to
intercept it. UPSTREAM and PRISM are two of the programs
involved. These come from Section 702 of the FISA Amendments act.

Phone metadata collection (2001-current). This comes from Section 215
of the US Patriot Act; the "business records" provision. It also
requires reasonable articulable suspicion for collection.

The CIA has a program to collect financial records.

Collection of phone location data (2010-2011). This was also done
under the guise of Section 2015.

There's been very little transparency on the legal theories used to
justify these programs.

Lawyers assume that most people don't send data outside the US, or
that they're aware when they are sending data outside the United
States. Many people send data outside the US, without ever realizing
that it's leaving the country. For example: many domestic websites
included content that's not hosted in the United States. The US House
of Representatives website had a widget that was hosted in
London. That's one end foreign. It's likely that 10% of US websites
include content from a foreign host.

US companies sometimes have IT facilities outside the United
States. For example, General Motors has website hosting in Frankfurt,
Germany.

Traffic also leaves the united states because of routing.

Many people in the US use services located in foreign countries. For
example, Doodle and is.gd.

In summary, many Americans send (or access) data outside of the united
states. The "one end foreign" criteria doesn't make sense with the
internet's architecture.

Lawyerly assumption: metadata does not identify individual persons,
and it's not densely interconnected. We crowdsourced some phone
metadata. Our crowdsourcing effort involved 825 recipients and 250k
text messages. We found that it was pretty easy to correlate phone
numbers with people. We were able to match 91% of the phone numbers
using a commercial phone database.

We studied the structure of call graphs. The NSA stores raw phone
data, and has a database of subjects for whom reasonable articulable
suspicions exist. These two datasets are joined, and matching records
are moved to the NSAs corporate store.  We wanted to know, "how much
stuff could make its way into the corporate store".

We thought our call graph would be very scattered, and we were
completely wrong about that. This highest degree hub was T-Mobile's
voicemail number. Using two hops, you can connect any pair of people
that use T-Mobile voicemail. Likewise for calls to Comcast customer
service. Again, any pair of people that call Comcast customer service
are only two hops away from each other. Ditto for telemarketers: if a
telemarketer calls two people, they're two hops away from each other.
The participants in our study were 90% connected. 60% were connected
within four hops, and 50% were connected within three hops.

If someone using Skype (routing calls through Skype's hub) called
Comcast customer service (using Comcast's hub), then everyone who used
either hub is connected by three hops.

Moving the raw data out of the NSA doesn't help much. The NSA
collected numbers within three hops: that's a lot of data going into
their corporate store.

Another experiment: we tried to infer if pairs of people were in a
relationship. Turns out that this is pretty easy to do with phone
metadata. It's also not challenging to infer medical conditions, or
specific firearms that people owned. Phones are commonly used in
sensitive contexts.

The government needs your help. The hacker community can help provide
these kinds of facts to law makers.

Question: Why has the government made such a massive surveillance
investment right now? What's the political rationale?

Question: What about inferring data from Skype?

We don't know of any bulk surveillance program that collects data from
Skype. But Skype data might be collected through targeted
surveillance.

Question: What does call graph connectivity look like if you remove
the hub numbers?

The NSA could remove hub numbers, but there's incentive for them not
to do so.  Leaving hub numbers in allows them to put more data in
their corporate store. There's also a long tail to hubs. You've got
T-Mobile voicemail, but you've also got the local pizza shop.


== Blinding the Surveillance State ==

''Christopher Soghoian''

This that the ACLU has worked on: getting a warrant requirement for
police to search your cell phone; getting a warrant requirement for
access to cell phone location data; working with and advising Edward
Snowden.

In 2009 all browsers supported HTTPS, but most web sites used HTTP by
default.  Mass bulk surveillance is easiest when performed
passively. The wealth of unencryption has meant a wealth of data for
the NSA to collect. We're slowly putting the NSA on a diet. Large
companies are starting to lock things down. Aside from monitoring
traffic between users and data centers, the NSA was also monitoring
traffic between corporate data centers.

Until January of this year, Yahoo! didn't use HTTPS at all. In 2014, a
bunch of IM servers started to force encryption for jabber
clients. Google published a transparency report, listing companies
that didn't support STARTTLS for email delivery; now those companies
are starting to support STARTTLS.

Qualys labs gives letter grades to companies for their implementation
of HTTPS.

At first, US companies denied participation in the NSAs bulks
surveillance. They, the hemmed and hawed. Then, they started pushing
back.

It's rare for politicians to grandstand against surveillance. Pamela
Jones Harbour (from the FTC) gave a speech where she advocated for the
use of HTTPS by default.  Chuck Schumer wrote a letter to websites,
asking them to use HTTPS by default.

How do we get politicians to advocate for better security? Our
politicians have been worried about hackers using Starbucks wi-fi
connections, the threat of ID theft, stalking, and petty crimes. We
may not be able to get our politicians to thwart the NSA, but we can
lobby for protection against identity theft, fraud, and crime.  When
Google enabled HTTPS by default, they framed it as a response to
Chinese hacking.

FTC activities don't extend to surveillance by government
agencies. the FTC forced carriers to implement CALEA.

In 2013, the DNI (director of national intelligence) identified cyber
as the primary threat. Prior to that, it had been terrorism.

After leaving the NSA, Keith Alexander started offering consulting
services for a million dollars a month. Cyber is the only part of the
defense industry that's going up. Many lobbyists previously worked for
the military, but have little knowledge of technology.

Technologies that prevent data theft are the same technologies that
would protect privacy and civil liberties. Tor is a security service
that protects US information.  Silent Circle is a security system that
prevents the theft us US data. We should push for cybersecurity over
civil liberties. We need to develop an affirmative cybersecurity
agenda.

When addressing CISPA and similar legislation, point out the risks
inherent in data retention. Push an agenda: a list of things we want
government to fix to make the internet more secure.

Question: There used to be an office of tech advisers. Should we lobby
for its reinstatement?

It would be great to have technology experts in Washington, advising
policymakers.

Question: Isn't this about protecting American technology?

To the extend that security will prevent IP theft, we should push it.

Comment: We should advocate for citizen voices in identifying
solutions to problems.


== Closing Ceremony ==

For this conference, we had a 10GB internet connection from Hurricane
Electric. We got the 10GB fiber connection activated within seven
days, which is almost unheard of. Our network equipment came from
Yellow Fiber, Cisco, and NOC pool.

All IP addresses were public. NAT doesn't scale to the number of
addresses we'd need for conference attendees.

We got one DMCA notice from Sony. Apparently somebody was downloading
a copy of Spiderman 2.

Next conference, bring your servers, and hook them up to our 10GB
network!  The Snowden talk used Google hangouts for videoconferencing.

Over 20,000 people from six continents and 140 countries watched the
live streams from the conference. A group called Internet Society
handle the live streaming. We used Livestream (the company) as a
streaming service. According to Livestream, we were one of the
top-watched streams this weekend.