Why should you know who has been asking about you?
CC Attribution - ShareAlike 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Szymielewicz, Katarzyna
If you want to know what state knows about you and why so much, then we have something in common. In the post-Snowden world we became well aware that data we store on servers belonging to private companies tends to have a second life. It is where secret services and law enforcement meet the Internet. How to prevent bulk transfers from private to public data bases? How to make sure that due process is in place? What do we know about disclosures of our data and how can we learn more?
 Hello to the next session here. Okay, thank you very much for putting on your headphones because this is the silent stage here. And I'm very happy to have a very special person here at our stage. I tried. Katarzyna Czemilewicz. She's from Poland and she is a human rights lawyer and activist and co-founder and president of Pneptikum. And she's also the vice president of the European Digital Rights Movement. And she will tell us about why you should know who has been asking about you. And I'm, yeah, I just give the phone over to you and the stage is yours and I'm very interested in what you are talking about. So go on. Thank you so much. It sounds all very complicated. I hope I will manage to make it easier for you in this 30 minutes we have. I must confess I never, ever had that opportunity of speaking with my headphones on my ears. So it feels really funny. Anyway, before I take you in the topic and before I maybe explain this a bit nasty title, a bit arrogant title, let me take one more minute to explain where I come from. Oops, technical difficulty. Yeah, works. To explain a bit my background and where I come from and why I'm talking about what I will talk here today. So Pneptikum Foundation is a Polish NGO. We work in Poland, but we basically work on international levels because our major mission, our focus is human rights in the context of surveillance. Surveillance as you know perfectly well by now it's something that doesn't really recognize borders. So recently we have been quite busy, but even without Mr. Snowden and his revelations, we have been quite busy doing basically two things. On one hand we work with politicians. We try to influence the laws, be it in Poland or on the EU level in Brussels in order to introduce more safeguards to protect human rights in the context of surveillance, both from public and private players because we don't discriminate, we think that both sorts of surveillance are, well, can be wrong, can be legitimate, but it's complicated. On the other hand, we work with people more directly. We engage in education, in awareness rising, in various campaigns. We promote tools like tactical technology, collective tools. We give them to people and we explain why they should actually take care and take time to protect themselves from surveillance. So that's panopticon. But we're also part of something much bigger which is European Digital Rights, a coalition of modern 30 organizations doing very similar job all around Europe. If you want to hear about any of this later, I'm here to talk to you and feel free to grab me. Today I will tell you only about one small piece of that work. In fact, I would like to take you for a walk to a very weird place, to the place where the internet meets the law enforcement and intelligence. I'm quite sure that you've been to that place, even if you don't realize that. So essentially, state authorities like police, secret services, tax authorities, they have the right to check your online data. They have the right to request data from internet companies. That's legal in most of the countries, if not all the countries I know. But not in every country. These things happen in a transparent way. Not always. They happen for good reasons and not always. They are kept within the boundaries of what we would see as legitimate as citizens. And therefore, I would say this is quite a white place. You can use your own imagination to try to place on that picture where you would see law enforcement, internet users and internet companies. I will not impose anything here. But just one point I want to make is that this is quite uncharted territory. And we still know much less than we think we know. And therefore, there is a lot of space for imagination. Well, I bet that many of you feel that you have actually learned quite a lot about this area through Snowden revelations. These little graphs you see here are from NSA Observatory created by Lacroix-Toudonnet, a very friendly organization from France. And they did an excellent job in data mining the Snowden files in order to identify many programs and many tools used by NSA, like Prism, Temporar, Upstream, Bull Run, all these names I hope ringable to you. We could spend half an hour just bringing up these names. But so having so much data, do you really know what's going on? My feeling and my personal worry is that not really. The key questions still remain unanswered. So even if we know that certain programs exist, we still don't know who is using them exactly. To what extent they are being used by European intelligence, to what extent our governments are involved. What sorts of data in particular are being collected? How deep they go? Who really is the target? All these extremely relevant questions, they remain unanswered. And this is basically why I still prefer the jungle as a metaphor of where we are now, because we are lost in the matrix of surveillance. And we are being left here by both private and public players, not without a reason. My point and what I argue today is that we shouldn't tolerate that, because in fact we do have a right to know much more than we know now, and we should demand that sort of knowledge. Not exactly, I think that we should be asking our governments and the companies that hand over data to them. Essential thing is who? Who are they in the jungle? Because we still don't know. We know that there is some cooperation between US intelligence and European intelligence, but we really don't know who are the observers. We don't know how often they ask. We don't know what they ask for. So is it going very deep? Is it just our IP numbers? Or is it our history of all interactions online? Is it our search queries? Is it our list of contacts? Is it what we do online? There is so much data out there, and we don't know to what extent this data is being used. But the worst thing is that we don't know why it happens. We don't really know who is targeted and for what reasons. So my point would be that that knowledge is essential, and we should fight for it for one major reason. Namely, there is a lot that can be said about us on the basis of what we do online. How many of you recognize that picture? It's dark, but I can see that quite a few. It's Michael Krell and an open data city project using data given to them by, or basically using data that the German politician Maltes Pitz took from telecom companies a few years back. And that data has been used by this open data community to show how much can be said just on the basis of our telecommunications, so-called metadata. So not really the context of the communications, but the data about with whom we communicated when, where we were. That all combined with publicly available data about that particular politician. Really helped these guys recreate a big piece of his life. Now very similar project by exactly the same people has been done using data from both internet and telecoms for Baltasar, Gletli, Swiss politician. So the point I'm making here is that there is so much knowledge out there, and we cannot really stop that knowledge being generated, because that's where the way we live. But we should definitely work very hard to protect it and not give it away without a fight. And the first safeguard that I can think of is more transparency. If we know more about what's going on, we can probably identify issues, problems, threats, much more effectively than now when we are lost in this deep, deep forest. So the second argument that comes to my mind when I'm asking myself question why we should fight for it is legal argument that we actually have that kind of law already present in European Union. Maybe many of you have heard about the data retention directive. That's exactly the same one that has been declared invalid by European Court of Justice a month ago. This is a wrong instrument. We meaning digital rights organizations, we've been fighting with that for years. But even in that not very nice instrument, European Commission and other European institutions agreed that there has to be some transparency. So if member states use data retention, they have to declare, they have to report to the Commission once a year how many times they did it, for what purposes, in which cases it was used, and with what result. Because without that sort of data, you cannot really say whether a surveillance mechanism that you use works or whether it doesn't work. And this is something that gives us food for thought because online there is nothing similar. Online we are really back to the wild because none such law exists, neither on European nor on national level. And that's something that really should be reconsidered. So back to Poland, to my country, sitting there after snowy revelations, we thought that we might well like to go deeper in this forest and check what is really happening on this intersection of internet and law enforcement. So we did a small survey, a small case study. We decided to ask 10 major internet companies basic questions, basically who asked them for our meaning, citizen data, whether they gave this data or whether they refused, what cases it concerned, who are the authorities, what were the purposes. Basic stuff, still building on that presumption that if it was possible for telecommunication data it should also be feasible for internet data. The same questions, just changing the verbs from receiving to send, we asked to the authorities themselves. So to nine intelligence agencies that we have in Poland and to police. We couldn't ask prosecutions and we couldn't ask courts because there are very many of them and we could never send all these FOIA requests, at least not in six months that we were dealing with this little survey. But we sent some. And well, what have we learned? It was a very interesting experience because after six months we realized that indeed we are going in a very deep forest where nobody, and at least not very many companies, are willing to talk to us because they're too afraid that we will interpret this against them, that users, by discovering more and more what's going on they will lose trust. So only four companies eventually gave us the data we wanted, not even full data. And what we discovered on the face of it you see here, it was quite obvious result just seeing that with every month there is more requests about internet users, probably because more and more of our life is moving online and therefore there are more excuses or more cases to ask. But what was much more interesting when we look deeper were the reactions of these companies. So how many times they responded positively to this request? How many times they actually disclosed our data? And that was something that gave us very different results. As you can see, one company fulfilled almost all requests while another company didn't fulfill even 20%. Why so? How this is possible? Mostly because Polish law and from what I know many other legal regimes does not give a clear standard for the companies where they have to comply and where they have to say yes to such requests coming from reinforcement or coming from intelligence. As a result, it's for the companies to decide what standards they apply. As a matter of fact, it will be the companies defining the level of protection, not the law. This is something we feel that definitely should be changed because it cannot be like that. We cannot trust them so much. Another interesting discovery that will be the last I will talk about now, but you can read more in the report that I left for you on the back or online if you like. It's analysis of who has been asking. We asked, as I said, both the companies and the authorities, and the answers were quite coherent. Everybody agreed or told us that the great majority of the requests came from law enforcement, namely police or persecution, and not from intelligence. The very tiny dot on the left is intelligence. If we can trust this data, it's quite reassuring. Basically saying that we are mostly dealing with law enforcement in Europe or in Poland and not with big scandals like NSA. But that's all what they declare, what they give to us. We cannot have the guarantee that something is not hidden behind. The same questions asked to public authorities give us, as I said before, similar results. But the big question mark comes from the fact that police refused to give its data. So we could only interpret this correlation from just comparing the numbers. That in both cases, talking about intelligence, we had quite small numbers, not the big numbers we expected or we feared that we might have them. But interestingly enough, it was the intelligence that gave us more data when asked than police. Well, okay. So we got some numbers. And it was quite exciting process of collecting it, analyzing and discovering how many obstacles there were inside of this process. But do we really understand the world better having these numbers? For me, this little experiment was all the more interesting, that I came to conclusion that not really. We still, obviously, we still don't have the answers to the most relevant questions, the same ones that I asked when we were still in the jungle. We still don't know what's happening behind the scenes. Why these people are asking? Why these authorities are asking these questions? How deep these questions go inside of our privacy? What kind of cooperation mechanisms are behind it? All this was secret. All this was refused to us by both the companies and the public authorities. So my point is that we shouldn't really let them fool us with the numbers. We shouldn't really feel much more comfortable having all these names of programs used by NSA and having all these numbers that are coming up from various transparency reports or collecting these numbers ourselves. Because the key questions are still hidden from us. For our reports, the one that I gave you here focuses less on data and more on the problems. The problems that we actually know, that we have known them before, we know them now, and they don't change. They don't really change since I started my work in this field. When I speak to all their colleagues, they also talk about the same, about lack of oversight, lack of mechanisms that would allow us citizens to verify whether we are under surveillance, lack of mechanisms that enable parliamentarian commissions or DPAs, data protection authorities, or ombudsmen, or anybody else, go inside of the surveillance matrix to check what's going on there. This is something that has to be repaired not only Europe, but beyond. There are also loopholes, very interesting loopholes that can be used and abused, not only by state, but also by private actors. I'm sure that you heard of copyright strolling, or maybe even you received letters from loopholes that claim that you downloaded illegally or allegedly you downloaded something illegal from the net. On the base of your IP number, they claim that you should pay them money. This is all done on the base of this data. At least in Poland, they use police and prosecution to get this sort of data about internet users and then abuse this data in order to blackmail us into paying money that we shouldn't pay. All these safeguards are missing. This is something we have to face as citizens, not getting stuck with the numbers and the nice things you can do with them. The question that I want to ask to you, basically, is, are there any real solutions that we can think of together? Where do we start? When I've read the speaker's guidelines for this conference, the organizers said solutions are something we look for, of course, but this is the trickiest issue. Does anyone have the answer? This is tricky, isn't it? Maybe this is the time where we could talk if we still have some time. Where do we start? Do we start with companies? Do we expect more from companies, more transparency, less cooperation, maybe less data collection in the first place? Or do we start with changing our governments? Can we change them? Do you think that if we change governments, law enforcement and intelligence will stop working the way it works now, will be more transparent? Or is it something that doesn't change regardless of political power? What do you think? I invite you to talk. This is your time now. Thank you. Any questions from the audience? Comments, please. Did you just hear that? No? So if there's a question, we definitely have a microphone. What? What? Can you hear me? Yes. It's this weird, doesn't it? I think it's probably too late to get all the data back, because it's already in the wild, as it's called. So I think we as the public should demand for the data to be made open, so we can see them and read them, and maybe influence what is done with them. I see another problem there, and that is not only the collection of data, but what you can do with the data, you know, all the algorithms that maybe companies or governments or other organizations have developed to work with our data. And I really don't know what, I don't even know what to ask for about this kind of stuff. But I think the first step should be that everybody should publish which data they have. That is something that we maybe have to work for in NGOs or as voters or publishers, whatever. Thank you. It's an interesting comment. There is even this concept of fighting surveillance with more transparency. Can you hear me? Yeah, it's an interesting point of view, and there is even this concept of fighting surveillance with more data. I mean, if everybody knows basically everything about everybody, then we might have less surveillance, at least less power, more power balance, so to say. To some extent, I like this idea, and I do think we should always, and therefore I'm speaking today about this particular topic, we should always demand more transparency from those who have data on us. That goes without saying. There is because this is the only way for us to discover potential abuses or potential problems that are hidden there. But whether our transparency would help that process, here I'm not sure. We will always have much less ability to deal with this data than, say, Google or NSA or any other government. And therefore, this is only theoretical balance if everybody knows everything. The processing power and the algorithms that we have at hand do differ. Hi. Can you hear me? Yes. OK. I can see you, though. Listen, I'm here. Thank you for raising these issues and giving your talk. I've appreciated it. I've got one comment, and I'm coming from it from a slightly different angle rather than demand, that we demand transparency. I don't think the nature of modern information, storage and flow allows for that anymore. And what I mean by that is organizational motives now want data. They want to churn data. They want to analyze it. They want to profile big data over large assumptions being made in all sorts of areas. So I don't think demands of transparencies are going to work anymore. But on the positive side, I'd like to start to suggest an alternative. But this is going to involve a cultural change. One of the things we should start thinking about is everyone is going to have to start to be, and excuse the metaphor, their own private firewall. They are going to have to be their own data managers. And I like the idea of flipping technology around, enabling, from the media revolutions with PCs allowing everyone to make films now, everyone can be their own security infrastructure as well as the corporations who hide these databases from the people and certainly hide what analyses they do with it. One interesting project and might be related as well that is open source is a project called Maltigo. Maltigo is a data, you may have heard of it, great, fantastic. It's a data analysis engine and I promote everyone to start analyzing data to themselves. In other words, I wonder whether there's a cultural change and a shift that can happen in the way that we handle and manage our own information and start to search back and correlate back ourselves in the way that we can. We will never have the resources of the NSA individually and we will never have the resources of large governments whether good or bad in nature. But maybe, maybe if we just realize what we can do both individually and collectively in data management ourselves, we can start to address some of these issues. So you would go up for individual strategists rather than trying to change the law or introduce more? Individuals and groups I think because, you know, like a lot of the other topics in this conference from crowdfunding to others, individuals all doing this and starting to go down this journey, starting to forge a track through that wilderness. At least realize how much wealth you give out. Exactly, yeah. No, I completely agree. There may be other measures as well but that's one I want to bring to the table. Yeah, no, thank you so much. Just don't get me wrong, I would never ever make the point that transparency solves the thing. I even somehow attacked this illusion that having more data solves any of the problems because it does not. We do need, in my opinion, we do need both. We need strong legal safeguards, so legal solutions that will prevent these abuses from happening and bring more transparency for us but that's the state or our company is doing for us. But on the other hand, I'm completely with you. On that page, we should work individually but that's, say, Jake and Jillian who were just speaking about PGP next door. This is the kind of tactics that I use personally and I recommend everybody to use because there's no other way, nobody will do it for us. That's for sure. Any further comments? Yes, hello. My name is Mike, I'm from Poland. About the transparency voice and I would just like to say something about using the word transparency with regard to private data. This feels really weird with this thing, sorry. I think that we should not use the word transparency in the context of our private data. The word transparency and the word accountability are extremely important in the context of government, in the context of institutions, in the context of corporations, in the context of anything that is big, powerful and institutionalized, right? But as soon as we start using the word transparency or accountability with regard to private data, we are starting to muddy the waters between two different discussions, between the discussion of being able to hold accountable institutions, corporations, governments, et cetera, and the discussion of us being able to defend ourselves against those kinds of entities, right? So I would, this is something that shows up sometimes and I'm not saying that it was on purpose, of course, right? But I'm just saying that we should be very careful not to muddy the waters and mix the two discussions because they are very different. And if we let those two discussions mix, we will end up in a situation where we will not be able to argue in either of those discussions the way we would want, right? The way that would make our private data private and on the other hand, that would make corporate government, et cetera, data available for us to look into and make those, make their decisions, make their actions transparent. Thank you. Cannot agree more. Thanks for that great comment. Well, actually, I'm really, really sorry. I saw this, there's one more question and there was another one, but we have the problem that right now, maybe in the next two minutes, the next session will be here on the stage. Maybe just the last one. And then the final I will take at the door. No, I would really, I would really, I'm very sorry. I'm really sorry for this because it's really, you know, our timetable is incredible. So, but you are still here and you wanted to give to give something to the listeners. And so you might maybe answer the questions outside. I'm so sorry. You can grab me there and there are these reports I mentioned are sitting behind you. So if you feel like taking them or finding them online, it's all available, but you can also grab me while I'm here in person. Thank you so much for the good discussion. Thank you.
 Hello to the next session here.  Okay, thank you very much for putting on your headphones because this is the silent stage  here.  And I'm very happy to have a very special person here at our stage.  I tried.  Katarzyna Czemilewicz.  She's from Poland and she is a human rights lawyer and activist and co-founder and president  of Pneptikum.  And she's also the vice president of the European Digital Rights Movement.  And she will tell us about why you should know who has been asking about you.  And I'm, yeah, I just give the phone over to you and the stage is yours and I'm very  interested in what you are talking about.  So go on.  Thank you so much.  It sounds all very complicated.  I hope I will manage to make it easier for you in this 30 minutes we have.  I must confess I never, ever had that opportunity of speaking with my headphones on my ears.  So it feels really funny.  Anyway, before I take you in the topic and before I maybe explain this a bit nasty title,  a bit arrogant title, let me take one more minute to explain where I come from.  Oops, technical difficulty.  Yeah, works.  To explain a bit my background and where I come from and why I'm talking about what  I will talk here today.  So Pneptikum Foundation is a Polish NGO.  We work in Poland, but we basically work on international levels because our major mission,  our focus is human rights in the context of surveillance.  Surveillance as you know perfectly well by now it's something that doesn't really recognize  borders.  So recently we have been quite busy, but even without Mr. Snowden and his revelations, we  have been quite busy doing basically two things.  On one hand we work with politicians.  We try to influence the laws, be it in Poland or on the EU level in Brussels in order to  introduce more safeguards to protect human rights in the context of surveillance, both  from public and private players because we don't discriminate, we think that both sorts  of surveillance are, well, can be wrong, can be legitimate, but it's complicated.  On the other hand, we work with people more directly.  We engage in education, in awareness rising, in various campaigns.  We promote tools like tactical technology, collective tools.  We give them to people and we explain why they should actually take care and take time  to protect themselves from surveillance.  So that's panopticon.  But we're also part of something much bigger which is European Digital Rights, a coalition  of modern 30 organizations doing very similar job all around Europe.  If you want to hear about any of this later, I'm here to talk to you and feel free to grab  me.  Today I will tell you only about one small piece of that work.  In fact, I would like to take you for a walk to a very weird place, to the place where  the internet meets the law enforcement and intelligence.  I'm quite sure that you've been to that place, even if you don't realize that.  So essentially, state authorities like police, secret services, tax authorities, they have  the right to check your online data.  They have the right to request data from internet companies.  That's legal in most of the countries, if not all the countries I know.  But not in every country.  These things happen in a transparent way.  Not always.  They happen for good reasons and not always.  They are kept within the boundaries of what we would see as legitimate as citizens.  And therefore, I would say this is quite a white place.  You can use your own imagination to try to place on that picture where you would see  law enforcement, internet users and internet companies.  I will not impose anything here.  But just one point I want to make is that this is quite uncharted territory.  And we still know much less than we think we know.  And therefore, there is a lot of space for imagination.  Well, I bet that many of you feel that you have actually learned quite a lot about this  area through Snowden revelations.  These little graphs you see here are from NSA Observatory created by Lacroix-Toudonnet,  a very friendly organization from France.  And they did an excellent job in data mining the Snowden files in order to identify many  programs and many tools used by NSA, like Prism, Temporar, Upstream, Bull Run, all these names  I hope ringable to you.  We could spend half an hour just bringing up these names.  But so having so much data, do you really know what's going on?  My feeling and my personal worry is that not really.  The key questions still remain unanswered.  So even if we know that certain programs exist, we still don't know who is using them exactly.  To what extent they are being used by European intelligence, to what extent our governments  are involved.  What sorts of data in particular are being collected?  How deep they go?  Who really is the target?  All these extremely relevant questions, they remain unanswered.  And this is basically why I still prefer the jungle as a metaphor of where we are now, because  we are lost in the matrix of surveillance.  And we are being left here by both private and public players, not without a reason.  My point and what I argue today is that we shouldn't tolerate that, because in fact we  do have a right to know much more than we know now, and we should demand that sort of  knowledge.  Not exactly, I think that we should be asking our governments and the companies that hand  over data to them.  Essential thing is who?  Who are they in the jungle?  Because we still don't know.  We know that there is some cooperation between US intelligence and European intelligence,  but we really don't know who are the observers.  We don't know how often they ask.  We don't know what they ask for.  So is it going very deep?  Is it just our IP numbers?  Or is it our history of all interactions online?  Is it our search queries?  Is it our list of contacts?  Is it what we do online?  There is so much data out there, and we don't know to what extent this data is being used.  But the worst thing is that we don't know why it happens.  We don't really know who is targeted and for what reasons.  So my point would be that that knowledge is essential, and we should fight for it for  one major reason.  Namely, there is a lot that can be said about us on the basis of what we do online.  How many of you recognize that picture?  It's dark, but I can see that quite a few.  It's Michael Krell and an open data city project using data given to them by, or basically  using data that the German politician Maltes Pitz took from telecom companies a few years  back.  And that data has been used by this open data community to show how much can be said just  on the basis of our telecommunications, so-called metadata.  So not really the context of the communications, but the data about with whom we communicated  when, where we were.  That all combined with publicly available data about that particular politician.  Really helped these guys recreate a big piece of his life.  Now very similar project by exactly the same people has been done using data from both internet  and telecoms for Baltasar, Gletli, Swiss politician.  So the point I'm making here is that there is so much knowledge out there, and we cannot  really stop that knowledge being generated, because that's where the way we live.  But we should definitely work very hard to protect it and not give it away without a  fight.  And the first safeguard that I can think of is more transparency.  If we know more about what's going on, we can probably identify issues, problems, threats,  much more effectively than now when we are lost in this deep, deep forest.  So the second argument that comes to my mind when I'm asking myself question why we should  fight for it is legal argument that we actually have that kind of law already present in European  Union.  Maybe many of you have heard about the data retention directive.  That's exactly the same one that has been declared invalid by European Court of Justice  a month ago.  This is a wrong instrument.  We meaning digital rights organizations, we've been fighting with that for years.  But even in that not very nice instrument, European Commission and other European institutions  agreed that there has to be some transparency.  So if member states use data retention, they have to declare, they have to report to the  Commission once a year how many times they did it, for what purposes, in which cases  it was used, and with what result.  Because without that sort of data, you cannot really say whether a surveillance mechanism  that you use works or whether it doesn't work.  And this is something that gives us food for thought because online there is nothing similar.  Online we are really back to the wild because none such law exists, neither on European  nor on national level.  And that's something that really should be reconsidered.  So back to Poland, to my country, sitting there after snowy revelations, we thought  that we might well like to go deeper in this forest and check what is really happening on  this intersection of internet and law enforcement.  So we did a small survey, a small case study.  We decided to ask 10 major internet companies basic questions, basically who asked them  for our meaning, citizen data, whether they gave this data or whether they refused, what  cases it concerned, who are the authorities, what were the purposes.  Basic stuff, still building on that presumption that if it was possible for telecommunication  data it should also be feasible for internet data.  The same questions, just changing the verbs from receiving to send, we asked to the authorities  themselves.  So to nine intelligence agencies that we have in Poland and to police.  We couldn't ask prosecutions and we couldn't ask courts because there are very many of  them and we could never send all these FOIA requests, at least not in six months that  we were dealing with this little survey.  But we sent some.  And well, what have we learned?  It was a very interesting experience because after six months we realized that indeed we  are going in a very deep forest where nobody, and at least not very many companies, are  willing to talk to us because they're too afraid that we will interpret this against  them, that users, by discovering more and more what's going on they will lose trust.  So only four companies eventually gave us the data we wanted, not even full data.  And what we discovered on the face of it you see here, it was quite obvious result just  seeing that with every month there is more requests about internet users, probably because  more and more of our life is moving online and therefore there are more excuses or more  cases to ask.  But what was much more interesting when we look deeper were the reactions of these companies.  So how many times they responded positively to this request?  How many times they actually disclosed our data?  And that was something that gave us very different results.  As you can see, one company fulfilled almost all requests while another company didn't  fulfill even 20%.  Why so?  How this is possible?  Mostly because Polish law and from what I know many other legal regimes does not give  a clear standard for the companies where they have to comply and where they have to say  yes to such requests coming from reinforcement or coming from intelligence.  As a result, it's for the companies to decide what standards they apply.  As a matter of fact, it will be the companies defining the level of protection, not the  law.  This is something we feel that definitely should be changed because it cannot be like  that.  We cannot trust them so much.  Another interesting discovery that will be the last I will talk about now, but you can  read more in the report that I left for you on the back or online if you like.  It's analysis of who has been asking.  We asked, as I said, both the companies and the authorities, and the answers were quite  coherent.  Everybody agreed or told us that the great majority of the requests came from law enforcement,  namely police or persecution, and not from intelligence.  The very tiny dot on the left is intelligence.  If we can trust this data, it's quite reassuring.  Basically saying that we are mostly dealing with law enforcement in Europe or in Poland  and not with big scandals like NSA.  But that's all what they declare, what they give to us.  We cannot have the guarantee that something is not hidden behind.  The same questions asked to public authorities give us, as I said before, similar results.  But the big question mark comes from the fact that police refused to give its data.  So we could only interpret this correlation from just comparing the numbers.  That in both cases, talking about intelligence, we had quite small numbers, not the big numbers  we expected or we feared that we might have them.  But interestingly enough, it was the intelligence that gave us more data when asked than police.  Well, okay.  So we got some numbers.  And it was quite exciting process of collecting it, analyzing and discovering how many obstacles  there were inside of this process.  But do we really understand the world better having these numbers?  For me, this little experiment was all the more interesting, that I came to conclusion  that not really.  We still, obviously, we still don't have the answers to the most relevant questions, the  same ones that I asked when we were still in the jungle.  We still don't know what's happening behind the scenes.  Why these people are asking?  Why these authorities are asking these questions?  How deep these questions go inside of our privacy?  What kind of cooperation mechanisms are behind it?  All this was secret.  All this was refused to us by both the companies and the public authorities.  So my point is that we shouldn't really let them fool us with the numbers.  We shouldn't really feel much more comfortable having all these names of programs used by  NSA and having all these numbers that are coming up from various transparency reports  or collecting these numbers ourselves.  Because the key questions are still hidden from us.  For our reports, the one that I gave you here focuses less on data and more on the problems.  The problems that we actually know, that we have known them before, we know them now,  and they don't change.  They don't really change since I started my work in this field.  When I speak to all their colleagues, they also talk about the same, about lack of oversight,  lack of mechanisms that would allow us citizens to verify whether we are under surveillance,  lack of mechanisms that enable parliamentarian commissions or DPAs, data protection authorities,  or ombudsmen, or anybody else, go inside of the surveillance matrix to check what's going  on there.  This is something that has to be repaired not only Europe, but beyond.  There are also loopholes, very interesting loopholes that can be used and abused, not  only by state, but also by private actors.  I'm sure that you heard of copyright strolling, or maybe even you received letters from loopholes  that claim that you downloaded illegally or allegedly you downloaded something illegal  from the net.  On the base of your IP number, they claim that you should pay them money.  This is all done on the base of this data.  At least in Poland, they use police and prosecution to get this sort of data about internet users  and then abuse this data in order to blackmail us into paying money that we shouldn't pay.  All these safeguards are missing.  This is something we have to face as citizens, not getting stuck with the numbers and the  nice things you can do with them.  The question that I want to ask to you, basically, is, are there any real solutions that we can  think of together?  Where do we start?  When I've read the speaker's guidelines for this conference, the organizers said solutions  are something we look for, of course, but this is the trickiest issue.  Does anyone have the answer?  This is tricky, isn't it?  Maybe this is the time where we could talk if we still have some time.  Where do we start?  Do we start with companies?  Do we expect more from companies, more transparency, less cooperation, maybe less data collection  in the first place?  Or do we start with changing our governments?  Can we change them?  Do you think that if we change governments, law enforcement and intelligence will stop  working the way it works now, will be more transparent?  Or is it something that doesn't change regardless of political power?  What do you think?  I invite you to talk.  This is your time now.  Thank you.  Any questions from the audience?  Comments, please.  Did you just hear that?  No?  So if there's a question, we definitely have a microphone.  What?  What?  Can you hear me?  Yes.  It's this weird, doesn't it?  I think it's probably too late to get all the data back,  because it's already in the wild, as it's called.  So I think we as the public should  demand for the data to be made open,  so we can see them and read them,  and maybe influence what is done with them.  I see another problem there, and that is not only  the collection of data, but what you can do with the data,  you know, all the algorithms that maybe companies or governments  or other organizations have developed to work with our data.  And I really don't know what, I don't even  know what to ask for about this kind of stuff.  But I think the first step should be that everybody should  publish which data they have.  That is something that we maybe have  to work for in NGOs or as voters or publishers, whatever.  Thank you.  It's an interesting comment.  There is even this concept of fighting surveillance  with more transparency.  Can you hear me?  Yeah, it's an interesting point of view,  and there is even this concept of fighting surveillance  with more data.  I mean, if everybody knows basically everything  about everybody, then we might have less surveillance, at least  less power, more power balance, so to say.  To some extent, I like this idea, and I do think we should  always, and therefore I'm speaking today  about this particular topic, we should always  demand more transparency from those who have data on us.  That goes without saying.  There is because this is the only way for us  to discover potential abuses or potential problems that  are hidden there.  But whether our transparency would help that process,  here I'm not sure.  We will always have much less ability  to deal with this data than, say, Google or NSA  or any other government.  And therefore, this is only theoretical balance  if everybody knows everything.  The processing power and the algorithms that we have at hand  do differ.  Hi.  Can you hear me?  Yes.  OK.  I can see you, though.  Listen, I'm here.  Thank you for raising these issues and giving your talk.  I've appreciated it.  I've got one comment, and I'm coming from it  from a slightly different angle rather than demand,  that we demand transparency.  I don't think the nature of modern information, storage  and flow allows for that anymore.  And what I mean by that is organizational motives now  want data.  They want to churn data.  They want to analyze it.  They want to profile big data over large assumptions  being made in all sorts of areas.  So I don't think demands of transparencies  are going to work anymore.  But on the positive side, I'd like  to start to suggest an alternative.  But this is going to involve a cultural change.  One of the things we should start thinking about  is everyone is going to have to start to be,  and excuse the metaphor, their own private firewall.  They are going to have to be their own data managers.  And I like the idea of flipping technology  around, enabling, from the media revolutions with PCs  allowing everyone to make films now,  everyone can be their own security infrastructure  as well as the corporations who hide these databases from the  people and certainly hide what analyses they do with it.  One interesting project and might be related as well  that is open source is a project called Maltigo.  Maltigo is a data, you may have heard of it, great, fantastic.  It's a data analysis engine and I promote everyone  to start analyzing data to themselves.  In other words, I wonder whether there's a cultural change  and a shift that can happen in the way that we handle  and manage our own information and start to search back  and correlate back ourselves in the way that we can.  We will never have the resources of the NSA individually  and we will never have the resources of large governments  whether good or bad in nature.  But maybe, maybe if we just realize what we can do  both individually and collectively in data management  ourselves, we can start to address some of these issues.  So you would go up for individual strategists rather than  trying to change the law or introduce more?  Individuals and groups I think because, you know,  like a lot of the other topics in this conference  from crowdfunding to others, individuals all doing this  and starting to go down this journey,  starting to forge a track through that wilderness.  At least realize how much wealth you give out.  Exactly, yeah.  No, I completely agree.  There may be other measures as well  but that's one I want to bring to the table.  Yeah, no, thank you so much.  Just don't get me wrong, I would never ever make the point  that transparency solves the thing.  I even somehow attacked this illusion  that having more data solves any of the problems  because it does not.  We do need, in my opinion, we do need both.  We need strong legal safeguards, so legal solutions  that will prevent these abuses from happening  and bring more transparency for us  but that's the state or our company is doing for us.  But on the other hand, I'm completely with you.  On that page, we should work individually  but that's, say, Jake and Jillian  who were just speaking about PGP next door.  This is the kind of tactics that I use personally  and I recommend everybody to use  because there's no other way, nobody will do it for us.  That's for sure.  Any further comments?  Yes, hello.  My name is Mike, I'm from Poland.  About the transparency voice  and I would just like to say something  about using the word transparency  with regard to private data.  This feels really weird with this thing, sorry.  I think that we should not use the word transparency  in the context of our private data.  The word transparency and the word accountability  are extremely important in the context of government,  in the context of institutions,  in the context of corporations,  in the context of anything that is big, powerful  and institutionalized, right?  But as soon as we start using the word transparency  or accountability with regard to private data,  we are starting to muddy the waters  between two different discussions,  between the discussion of being able  to hold accountable institutions, corporations,  governments, et cetera,  and the discussion of us being able to defend ourselves  against those kinds of entities, right?  So I would, this is something that shows up sometimes  and I'm not saying that it was on purpose, of course, right?  But I'm just saying that we should be very careful  not to muddy the waters and mix the two discussions  because they are very different.  And if we let those two discussions mix,  we will end up in a situation where we will not be able  to argue in either of those discussions  the way we would want, right?  The way that would make our private data private  and on the other hand, that would make corporate government,  et cetera, data available for us to look into  and make those, make their decisions,  make their actions transparent.  Thank you.  Cannot agree more.  Thanks for that great comment.  Well, actually, I'm really, really sorry.  I saw this, there's one more question  and there was another one, but we have the problem  that right now, maybe in the next two minutes,  the next session will be here on the stage.  Maybe just the last one.  And then the final I will take at the door.  No, I would really, I would really, I'm very sorry.  I'm really sorry for this because it's really,  you know, our timetable is incredible.  So, but you are still here and you wanted to give  to give something to the listeners.  And so you might maybe answer the questions outside.  I'm so sorry.  You can grab me there and there are these reports  I mentioned are sitting behind you.  So if you feel like taking them or finding them online,  it's all available, but you can also grab me  while I'm here in person.  Thank you so much for the good discussion.  Thank you.
re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_0_2195.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_2196_2291.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_2292_2351.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_2352_2855.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_2856_4115.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_4116_4247.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_4248_4415.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_4416_4763.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_4764_7139.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_7140_7763.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_7764_8123.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_8124_10619.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_10620_10703.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_10704_14987.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_14988_18767.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_18768_19487.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_19488_19751.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_19752_21803.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_21804_23651.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_23652_31559.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_31560_31895.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_31896_37883.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_37884_41015.png re_publica_2014_-_Katarzyna_Szymielewicz__Why_should_yo____EvfTQKHmDdE_41016_42250.png