Disrupting the Surveillance Ecosystem
CC Attribution - ShareAlike 3.0 Germany:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor and the work or content is shared also in adapted form only under the conditions of this
Higgins, Parker
Zimmermann, Jérémie
MacDonald, Raegan
This session will detail modern government surveillance practices, including their reliance on other governments around the world as well as private companies. It will also explore the challenges and opportunities to oppose these activities, including current proposals to limit data use and transfer. Finally, the panel will highlight the effective practices of anti-surveillance activists worldwide who have begun to hamper surveillance by disrupting these networks.
 Hi, everybody. My name is Parker Higgins. I'm an activist at the Electronic Frontier Foundation, which is a civil liberties organization based in San Francisco. We do work in the U.S. and around the world to protect people's freedom of speech, freedom of association and privacy rights as those people go online and come into contact with technology. I'm U.S.-based and our attorneys at the organization are also based in the U.S. so a lot of our legal work and what I'm going to talk about today primarily affects the U.S. but we also do work around the world and I think that I'll try to explain today why all of the campaigns, even the ones that seem like they're primarily U.S.-oriented, really do work together. And we also do work internationally and we try to collaborate with groups on the ground wherever we can. So that's my very quick introduction to myself. I want to talk a little bit about the group and the discussion we're going to have today. Obviously, everyone's understanding of mass surveillance and the way that this surveillance takes place has changed a lot in the last two years. It's been about two years since the Snowden leak started dropping and it's really changed a lot of people's understandings. In many ways it confirmed our worst fears. I don't want to sound like a privacy hipster here but EFF had been involved in lawsuits about warrantless wiretapping for the better part of a decade by the time the Snowden leaks came out. So this wasn't completely out of left field but we had confirmation and vindication of some of the things that we were alleging. It also, in addition to validating those lawsuits, it provided evidence for new lawsuits and so we found things that we didn't know were happening. And in some ways it exceeded the mainstream guesses of what the worldwide intelligence community was up to. Jeremy will be speaking in a minute about the tech community's response. But one of the real surprises in this is that the NSA and the other intelligence agencies had gone from being an organization that had a split mission of offense and defense to being primarily offensive and that meant weakening everybody's security in the hope that it would make these agencies able to really collect everything. So that's kind of the super high level overview. Obviously there have been a lot of news stories since 2013 about what's going on and so I couldn't possibly get to any of it in any real detail. But I did want to say that the US policy position has developed a little bit. There have been major lawsuits, as I was talking about before. I'll speak about one that we just got a really important ruling in today. And there's also been advocacy around in the last few months a particular section of the law, section 215 of the Patriot Act. And this is the section that the government claims allows them to collect a metadata record about every phone call that has at least one end in the United States. And so this is obviously a huge sweeping surveillance program and it's up for renewal or expiration. So we focused a lot in that area. The ruling that came down today said that actually section 215 does not authorize that program which is a very important legal victory and changes the footing of everyone around that renewal battle. But we'll get into that in more detail. So that's kind of the high level overview of those things and I want to toss it to Reagan to talk about the next part. Thanks, Parker. My name is Reagan McDonald. I'm European policy manager at Access. Access is an international organization that defends and extends digital rights of users at risk around the world. We have offices in the US, in Costa Rica, in Tunisia, and Manila, and in Belgium where I'm based in Brussels. I lead our European activities and I'm essentially a human rights lobbyist. That's how I describe myself. And Access is divided into three arms. So there's a policy arm, which is what I'm in, and we work in judicial legislations to affect long-term systemic change to make sure that laws around technology are in line with human rights standards. And the tech team works to provide direct technical support to civil society and change actors around the world to use security tools like encryption, for instance. And then our advocacy team mobilizes a group of a global movement of individuals to get involved in whether the policy process or to learn about security tools to fight for digital rights around the world. So in Brussels, we work with the EU institutions. So that's the European Parliament, the Council, and the European Commission. We work on a range of issues like data protection, net neutrality, trade, and digital rights, and of course, surveillance reform. So I wanted to talk a little bit about what happened and what changes have occurred since Edward Snowden released the documents unveiling mass government surveillance. And this surveillance isn't only the NSA. The NSA is kind of like the Google of corporations. Everyone always thinks of the NSA and the NSA. There's also the GCHQ, but there's also a number of European countries that are complicit to various levels in this mass government spying. So if you want more details on that, I would recommend, if you did miss Eric King's talk to check it out that was earlier this afternoon, that explains in great detail how this US government spying is going on. But in the EU context on what has changed, I would describe it in three words. One is the good, two is the meh, and three is the bad. So first the good. What happened after the disclosures? Well, the attitude changed. The level of discourse in the European Parliament in particular changed completely. One of the biggest pieces of legislation that we had been working on was a privacy reform effort called the data protection regulation. That was tabled in 2012. The discourse around privacy completely changed after the disclosures. People, policymakers in particular, they sort of changed their mindsets a little bit where before it was a bit like, ooh, data protection, that's boring, I like innovation, and I love my iPad to, wow, this technology might not actually solve all of the world's problems. That maybe human problems need to be solved by humans. And that technology can actually, if it's not done correctly, can lead to significant problems. And so the threat, I think, for a lot of people on the level of discourse became much more tangible. And that shifted the discourse a lot, which was really great. The European Parliament undertook a relatively thorough inquiry on the disclosures, on government mass surveillance. There it was over almost six months, where they brought in technologists, hackers, whistleblowers, technology companies. They of course invited some of the government, the intelligence services, like the GCHQ, who politely declined to participate, but Edward Snowden also partook in that. And the end result was a report providing guidelines on what can be done about this situation. How can we regain trust? How can we actually protect our digital rights, our right to privacy, our right to data protection, our right to free association and free expression? The problem is the Parliament isn't the executive body in the European Union, and national security is not the competence of the EU. So it's a very good report. Now, well, unfortunately, it's not law. But they are a series of great recommendations, and the Parliament is now working on a second report that we hope will be passed soon that will also keep this political momentum. So the meh part of it is that legally speaking, nothing really changed. In the EU, we didn't see any real tangible efforts from any member states yet to reform or to even talk about, frankly, to talk about intelligence services, their powers, their relationship with the corporate sector, how this is all working, and whether or not they can even be brought in. And so very little has changed. And that data protection reform package I told you about still hasn't passed yet. So it still hasn't really led to a lot of concrete changes. The ugly is that political memory, unfortunately, is very short. And a lot of member states, or some member states have actually, and the EU, have started actually expanding surveillance powers. So a few months ago, there was the Shaliliy Abdu attacks, and this completely changed the political climate in the EU, particularly in France. The UK and France have actually expanded surveillance powers. And the EU, the parliament is now debating a completely useless surveillance bill, a surveillance directive called the EU PNR. Brussels is a place full of acronyms. Does anyone know what EU PNR is? Just curious. Okay, a few of you. So if the European passenger name record directive. Now this is a directive that would collect information about passengers flying in, outside, and between, and within the EU. This is kind of like travel metadata. So the idea would be to collect all of this information, because terrorists exist, and apparently we need to do this, and put it into a centralized database in order to profile and to predict, or prevent terrorist acts. The parliament actually voted against this bill last year. But after the attacks in France, this has been retabled. And so this is why I say this is the bad part, because the political memory gets, it's so short term, that once something happens, we need to make sure that the political momentum stays, and that we actually really commit to doing something and pushing for real change and not expansion. And so I'll leave it there for now, to the discussion, to leave to Jeremy before we start talking about activism, and what we can actually do about this situation. Hi, I'm Jeremy Zimmerman. I'm the co-founder of La Quadrature du Net, an organization defending freedoms online based in Paris. I was like Reagan working, well, I was coordinating it full time for a number of years until last year. And like Reagan, I was running around the corridors of the EU institutions until I almost fully lost faith in them. I come from a technological culture, technological background, and got to start hacking law, politics and society in the hacker's way, by reading the fucking manual and just doing it. And when we started La Quadrature du Net, we came together because we had this common background of hacker culture, but also because we were commonly fascinated by the interaction between technology and politics, namely the capacity of governments and members of parliament to vote things they have no clue about. And in front of that, us who had the clue about and were trying to get to make them understand what it was about. So it started with this idea of interacting at the intersection between technology and policy, and also with the idea of empowering citizens to understand and participate in the public debate. And I think that this is what is really fundamental here. We can be a thousand to go to the corridors of Brussels. You can be sure that the next day, the industry will have 2,000. If we get to 3,000, they will get to 5,000, and so on and so on. So it is about making everyone understand how they have capacity to understand and an agency to act upon those issues that I think is absolutely fundamental. And this notion of empowerment, I think, will be discussed further. On a purely technological point of view, it was fascinating to me to see that, of course, the day Snowden appeared in the public and his documents started to be analyzed and published and debated. Of course, like all of you guys, I had 70 phone calls during the day, and for one week I couldn't even put the phone back on the table before it ran again. Of journalists asking, genuinely interested, sometimes a bit scared, what's going on? And I was so impressed to see how much all geeks, hackers, nerds around the world when asked these questions, maybe not all of them, but so many of us, came with the same type of answers along those lines that, first of all, trust is forever lost in those companies. The Prism companies, Facebook, Google, Amazon, Apple, Microsoft, but also the Bull Run companies, the one whose technology was actively sabotaged by the NSA, which in total is probably 99.99% of the technologies that we use every day, from Cisco routers to Qualcomm basementships in the phones to Facebook, Google, Gmail, whatever, and so on. And now we have evidence in the face of the world that the US legal system doesn't leave any margin of maneuver for anything else than full access to the data of everyone, anytime, by government agencies and the myriad of their public and private partners. So correct me if I'm wrong, I think in the US alone, that's more than one million persons who have a security clearance of a level comparable or superior to the one of Edwards, so in the US alone, without counting the 5Is, the 11Is, the 14, the 1000Is this beast has, without counting the other, that's one million people who potentially watch you masturbate in front of porn, watch you be alone and talk to your best friend, watch you hit on someone, buy drugs, get information about drugs, or do whatever you want to be, and whatever you want to do in your intimacy. So this notion that trust has been lost forever is something we cannot integrate. It is too big, it is too wide, it is too deep. So we could on day one stop using Google, stop using Facebook, stop using Apple, Microsoft, and the search. So I think here there is a bias in human mind is that when you start seeing, understanding something that is somehow too big, you stop trying to understand it. You build a mental wall, you block yourself from fully understanding that. So I think there is a very strong psychological parameter here, but the most important technical bit here is that we cannot trust those companies anymore. The second bit of the answer that so many of us gave to journalists since then is that, well, is what do we do now? Where do we go from here? We had claimed it for so many years. Richard Stallman said that literally the year Edward Snowden was born, 32 years ago now, I think, Stallman was already explaining to his fellow hackers and hopefully to the masses what free software, free as freedom software was about. But it was a way to collectively build an object from the mind software that will be owned collectively in order to guarantee that humans will control the machines and not the other way around. So this is an essential part of the answer. But now we see that also we need free hardware because all those phones and routers and computers all with the integrated Intel remote administration platform and all of them are owned and we lost control over all of them. Also decentralized services. It's been 15 years that we've been claiming that this concentration of everything in the hands of Google was the seed for abuse of powers. And here we are with blatant evidence of that. So decentralized services indeed. So the third point of this holy technological trinity is end-to-end encryption. Not trust anyone saying, yeah, come and use my service on my computer and it's going to be encrypted therefore it's going to be secure. Never trust those. Do the encryption yourself on your computer with somebody doing the encryption themselves on their computer. It's called end-to-end encryption. Or else there is no way we can trust those products. So my main point here is that we have to not only to build new tools, not only to enhance the existing tools, but we have to rebuild trust which means asking ourselves what is trust, what is the nature of trust. In a world where we've been sold forever that oh, you can trust this company, you can trust this brand, this logo, Google is your friend, do not do evil, Apple makes you feel smart and so on and so on. We fall from the chair realizing that maybe you just cannot trust a company. Maybe the only thing you can trust is another human. Maybe we can invent organizational modes such as the ones of free software where humans together will build a web of trust, a network of trust and maybe this is the only way we can rebuild this trust. Thank you. I think that leads really nicely into talking a little bit about the activism efforts that have happened in the meantime. And some of them certainly have been training people to do their own individual kind of taking privacy and security into their own hands. Some of those efforts began before the Snowden revelations. I'm thinking in particular of the crypto party movement started by the activist Asher Wolfe that started before Snowden released those documents, in fact, he had been involved in hosting a crypto party. And through that sort of thing, the organization I work for, EFF, has re-released our surveillance self-defense guide and we really encourage people to learn how to use encryption and to learn to empower those users to do that sort of thing. At the same time, while we do rely on the centralized services for certain things, we pushed those companies and the organizations that run them to operate in a much more transparent way. And we have gotten, there are reports that we've done evaluating how these companies react to government requests for data when they're explicitly asked. You can see as you look at the charts from 2011, 2012, 2013, 2014, it changes really dramatically as the public opinion changes and these companies recognize that it's a priority to compete on privacy. Now as a model, I don't think that the Googles of the world can compete with the free software of the world, but these companies did realize that at least indicating that privacy was a concern of theirs was something that was very important for them to do. At the same time, we've seen grassroots efforts around policy and legislation. I had the great pleasure in the summer of last year to fly in a blimp over the NSA data center in Utah that had a big arrow pointing down that said illegal spying below. That was to attract attention to a report card of US legislators and where they stood on policy efforts and that's been one part of it. We've also seen that the Snowden documents themselves and the media around them, both Laura Poitras' documentary Citizen 4 and Glenn Greenwald's book have been tremendously popular. There's still absolutely interest in this and people want to do something about that. And then aside from grassroots activism, the lawsuits that I mentioned before continue. And legislation happens really slowly. The closest parallel to our situation today, at least in the US context, was a series of privacy reforms in the 70s that led to the Foreign Intelligence Surveillance Act and the Church Committee era. And that took people forget that it took a very long time. Court decisions can take a long time too, but they're a little faster and they can change things sort of overnight. And you also don't need to make the kind of horse trading compromises that happen at the legislative stage. So we've seen a lot of good come out of court challenges all around the world. And in a lot of places that kind of mass surveillance has been just declared unlawful. It either doesn't follow the statutes as passed in each place or it doesn't comport with the constitutions of the countries that make up the governments that are doing these kinds of spying. So we've talked a lot about government surveillance. But of course, that's just one component. I think that this panel is named for the surveillance ecosystem. We were discussing just before that perhaps ecosystem is not the right word. But there is a lot of give and take in surveillance. And to talk just about what the government conducts is really to miss a major component. So I wanted to turn to you and ask about the role that corporate surveillance has played and what has happened in the last few years or even longer than that in terms of changing the game around corporate surveillance. Right? Okay. So it's true. We were just talking about ecosystem. When we were thinking about it, like, do you really want to disrupt an ecosystem? Like, is that good for the environment? So maybe it's like a web or if you guys have ideas of more ominous metaphors, please do let us know. Quagmire. Quagmire. That's good. So one of the reasons why we find ourselves in the mess that we're in, I think right now, is really in part due to the fact that surveillance and mass surveillance is super cheap and it's super easy. In a lot of ways, I have come from a history background, so sometimes I tried to look at the present as if I was looking at it 100 or 200 years in advance. And I'm hoping from my optimist perspective that people will look back and be like, wow, what a crazy time. Technology exploded. Everyone had mobile phones. Everyone had this. And everyone just went wild undermining rights and surveilling people, whether it's for marketing, whether it's for national security or what have you, that's in the positive way that we would actually get control back. But so Bruce Schneier talks a lot about this, a fellow Canadian security expert. And he calls this situation, this relationship between the governments and the corporates, the public-private surveillance partnership. And this basically explains exactly how and why the surveillance is so cheap and easy. And that really relates to the business model of the internet. And the business model of the internet is basically premised on mass surveillance as well. But it's for different purposes, of course. It's for online marketing, for money purposes. And when you think about it, it's really odd. I think most people, if we're talking about regular citizens, they think, oh, the government, looking at me, the government seeing my dick pics, if you guys see, watch John Oliver, that's really bad. I don't like that. But then everyone has a cell phone, and your location can be tracked. At the same time, if there was a law that the government passed that you would have to give the government updated reports on whenever you made a new friend or what colleagues you have or who you're dating, that would be outrageous. And yet we willingly give that information to social networks like Facebook. It would be the same thing if there was a law that the government said, every time you send something to anyone, whether email or text message, you need to also send a copy to the government. This would be outrageous. And yet we do this all the time with corporations. And one of the most important things that we learn from the Snowden disclosures is that what corporations know, which is a lot, governments can and probably do know. And so this connection is basically, you cannot separate these two issues. And this is a lot why when we talk about what we can actually do and how to fix it, from a policy perspective, this means that we need to really change things from the ground up. And that requires rethinking the economic model of how the internet functions. And so a lot of what Jeremy was saying is completely true. We need to take control of our devices. We need to make better decisions about what companies and what services we're actually using. Maybe it would require doing a little more research or trying different tools, but in the end, it might benefit us. And I think we also need to, from a policy perspective, think about not only security measures like encryption. So AXIS has a campaign called Encrypt All the Things, where we're pushing corporations to raise the bar on basic security, implement HTPBS, use more encryption, use end-to-end encryption, which is really great, but we also need to minimize the data collection. Now, it's really odd that intelligence services and companies have kind of aligning interests, and that's to collect it all for different reasons, but it's to collect it all. Maybe it'll be useful at one time. Maybe we can prevent a crime. Maybe we can make more money. Who knows what will happen? But this is a big problem for individuals and for users. And so we really need to rethink how much companies can do, and that requires putting limitations on what they're allowed to collect and for what purposes. And this is where data protection comes into play and why it's so important for individuals to have control over the information, to have control over the data that they give to these platforms, to understand what happens to it, why is it being collected, who is it being shared with, and what do those profiles about you say? I think if we knew, I think if most people knew what companies can know about us, it would change a lot the situation. I want to address the conference theme for a second and find Europe. Do you think that the European approach to these challenges has been more effective or differently effective than the US approach, where in the US we don't have a baseline privacy law basically? And so when you say, like, if people could see what's being collected, in some cases you can. You can request a copy of your, basically, the file on you. Do you think that's been effective or do you think that needs to be expanded or do you think that kind of policy is not the right direction? That's a lot of questions, but if people could understand what I meant by that, if they could understand what happens to their data, not necessarily to access the data that they submit into the platform, but what the platform derives in terms of the meaning of those different data sets. And that's where things get really icky and weird from a privacy perspective. There's a really great study from Cambridge that came out last year that these researchers analyzed a bunch of Facebook likes, only Facebook likes. That's it, one data set. And from those, they were able to distinguish with very shocking, shocking accuracy. Thank you. Shocking accuracy. Very personal things about people, their sexuality, whether or not they're smokers, if their parents have been divorced, if they're promiscuous, like really personal details. And I think that's the creepy bit, that individuals, even under the European system, because we're actually using mostly US companies, which operate primarily in the US framework of privacy, which there is no framework. And so you see the dilemma that we're in. And so, yeah, and that's the thing. And I think if we could get a hold of that and understand what that actually means and what that impact could actually do, then I think we would have a lot of change. Then I think that would mobilize citizens to make that choice, to move to a different platform and not use just the easy ones. I think you guys are quite optimistic somehow. And I'll get back to this. I wanted to add something on what you said about how surprising it is that governments and companies have a common interest here. I would say it's not so surprising. First of all, across 20th century, fascism usually was a perfect agreement between corporations and authoritarian regimes. That was one of the characteristics of the different fascist regimes, that it was always the economic interest of the dominant industries in those countries that in turn backed, supported the authoritarian governments. So it's not something new that we see an alliance between governments and companies towards violating people's fundamental rights. What is new here is that the violation of human rights has been partly outsourced to these companies. They are not just supporting the regime anymore. They're also being part of the violations. And I think this is something new. Also what is new is we don't see the violations of human rights as they were visible in authoritarian regimes before. But if you trace back, the history of Silicon Valley, Silicon Valley basically was an incubator for DARPA. From the beginning, Silicon Valley was researching on all advanced technology that was of interest for the militaries. Then Incutel, this hedge fund linked to the CIA, who was one of the first major founders of Facebook and personally financed, I think it was Sergei Brin, one of the founders of Google, so he could go on with his research. So what we've seen here is a perfect alliance between business models and a state paranoia, considering that the opponent is potentially anyone, anywhere, anytime. And I'm not sure companies are in any, well, those companies are nowhere near to change their business model. I mean, it's nice to ask them for more encryption. It's very nice from them to reply, oh, yeah, yeah, we understand, privacy is a major concern, we'll do something about it. But that's mostly crisis communication. The day communications are truly end to end encrypted through free software, under control of the users to store whatever on Google, Google starts losing money. It goes against Google's interest. What I think we have here is a monoculture of security. And I think it's not even security because it doesn't work against terrorism. We see those kids in the US spitting their rage out of Facebook, getting war weaponry and get and shoot their colleagues and teachers in class, what, every month without being stopped by the NSA? So if those kids are not stopped, how can we claim any efficiency to those schemes? But the only model there is out there under the sun is this hyper security model where you have to trust us, we'll pour more money into the thing and we'll protect you against everyone. This doesn't work and this cannot work because this hyper security model relies on this heavy centralization and totally opaque process. It is about manufacturing ignorance of the users. It is putting them in a shroud of secrecy where they don't know, where they cannot know what is being done to them with technology. I think we indeed have to work towards the political aspects. We have to do it more. We have to be those 2,000 people in the European Parliament doing it every day. And we have to make those people accountable for what they do. We have to work on the technology itself. But maybe the most important part is about changing people's minds. It's about all the cultural and social endeavors we can take in order to make people understand that this is not security, period. This is authoritarianism. And I think we have still to invent or maybe just to theorize alternative models like decentralized security where everybody has more responsibility and more control over his or her own data and communications and security process. This is how we will achieve resilience when everybody will be a bit trained, a bit in control, a bit trusted for what they know and what they can do. This is how we will avoid catastrophes. This is how we will stand up after catastrophes, not by trusting those logos and the grey people working in their basements watching people masturbate. Do you think that the progress towards that has sped or do you think it slowed? I worry that people talk a lot about this kind of surveillance fatigue. And of course, the John Oliver dick pic segment came as he showed Snowden, I don't know if everyone's seen the John Oliver clip, but he showed Snowden should watch it. It's very funny and you should watch it and it's one of the most direct interviews I've ever seen of Snowden. But he showed him footage of kind of man on the street interviews where he was asking people do you know who Edward Snowden is? And largely he says he didn't cherry pick. Most people that he spoke to didn't or they only had a really vague idea of the sorts of things and there were a lot of people, oh, was he that guy who sold secrets? So I wonder, do you think that we're, that we had a window that's closing or do you think that there needs to be something that happens to push that along further? I think that right after June of 2013, people were definitely talking about this. But I wonder if we've lost some of that momentum. Are you asking Jeremy or us? I was looking at Jeremy, but he just spoke. I mean, I can answer. First of all, the mere fact that we saw John Oliver publish this interview and get as much interest, I don't know how many million views on the video, but many more to come, including yours, if you haven't seen him yet, shows that there are still many tactics to invent and many ways to speak about it. And I'm convinced it is about experimenting in the diversity of tactics, writing the story ourselves. I'm sorry for the ones who were at my previous panel fighting the Terminator in All Pockets available in video now. Because I've said some of this already. I think we have to build the story to write the story ourselves because fiction and reality are so much intertwined that we cannot let Hollywood write this story, this history, because it is ours. So we have to reclaim narratives. We have to reclaim narratives. And what Oliver did, and I think it is the way to go, was to find a way to speak about mass surveillance that is not generating fear. When we nerds, hackers, policymakers, social scientists, and others speak about surveillance, we have a view on this, we have studied the issue, we have those background knowledge about it, we usually draw a very scary picture of the world because let's face it, it is scary. But when people are scared, when they're afraid, they would tend to self-censor without even knowing. They will speak less. They will act less. And we want them to speak more and to act more. So first of all, I'm convinced that humor is the best antidote against fear. So we have to use humor more in order to write the story for ourselves. Also, I can't even read what I've written here. I think that we are in control of the sequence and we must remain in control of the sequence. Reagan and I have worked against ACTA for four years. We've written, I think, 250 press releases on ACTA. I've spoken in more than 300 conferences, given 1,000 interviews. Four years before the victory and even six months before the victory, it was impossible to win. Every political analyst in the world was certain about that. Not only we won, but we won by a crushing majority of 478 against 39. It means that, A, battles that are impossible to win can be won. B, that it can be very long and very hard work. And this is where we are right now. We are just at the beginning of the endeavor. And C, it is about keeping control of what I call the V-sequence with an uppercase. So you don't wait for news to come and be processed by the media and react to it or else you will always be in an uphill battle. You have to be the news, to be the media, be the change you want to be in this world. We have to take control of the narratives in order to be able to take control of those agencies in order to be able to take control of our machines. Yeah. And that sounds, I mean, it sounds like an acknowledgement that the odds are long and that they look long, but that there's a reason for hope, I think. Just one quick thing. If you look at it, it took more than 10 years to radically change the course of technology and be where we are right now. 10 years. It's basically since September 11, 2001. So my guess is it will take at least 10 years, if not 20, to go somewhere else from here. Sure. And it can be hard to see where the incremental changes. Maybe we'll be dead when we achieve victory, but we will achieve victory. Reagan, do you think that there's, do you agree that there's reason for hope here? There has to be hope. Or else we have nothing else. So I'm definitely an optimist. But I mean, yeah, we have to keep fighting and keep making this relevant and to go back to like how we can make this movement happen. I think one of the key components of John Oliver's successful campaign is that it made it relevant to people. It's about your private parts, you know? And this really touched people. And I think for privacy, not intended, I'm sorry. And I think especially for privacy activism and anti-surveillance activism, it's really difficult because privacy invasions are very, they seem intangible unlike other human rights violations. And so it's really important for us, I think humor is a really good idea or remixing Hollywood like the Terminator was really cute. But we need to keep thinking about these ways and to move away from the fear discourse. And this will help us and it has to change. We have to take more control over our digital identities. And why I say we have to is because we live in a technologically ubiquitous world. Everything we do is every time we walk down the street or open our laptop or walk with our cell phone in our pocket, our data is being collected and processed and shared. So we have no choice but to take control over our own identities. Thank you. I actually think that's a good place to cut off the presentation. We've got about 12 minutes for questions. And then as the presenter said, we do have to be very punctual because the final, yeah, because it's Germany. We have to be very punctual. Sorry about that. But yeah, so let's take it to questions and you must use the microphone because we're making a video of this. Right. I see the first hand I saw was over there. So I'll run. Yeah, the third one. Okay. Hi there. Okay. So first of all, about the window that was closing, I think that we need a positive, you know, positive proposals because people are interested. I organize crypto parties in Warsaw for the last two and a half year and people come, but they are interested not only in being scared but also being given positive proposals. So that's something I think it's important. But I do have a question. So the question is, for example, I believe that the only way we can win is by working together, you know, free culture movement, free software movement, open access movement. We have to like join the wagons and work together. And one way to do that is not to have users, you know, users of, for example, decentralized social networks being cut off of being able to participate, for example, in this conference. Right. So the question is, do you see a way of making all those decentralized social networks more accessible to NGOs? Because there are many of those social networks. I understand why NGOs, for example, have a hard time being available on all those social networks. That's a lot of work. That's a lot of tedious work and being responsive on all those social networks. So on the other hand, as a software developer, I know that if I try to write software that will make it possible for me to work with Twitter, Facebook and something else, at some point Twitter and Facebook will change their terms of service, they will change the API. This work will have to be done again. And then there has to be an organization that kind of defends this work that's been done once. For example, by putting pressure on Facebook not to change APIs, not to shut off such apps. So my question is, do you see a way of doing that? Do you see a way of helping such endeavors? Thank you. I do. I think that there's, especially in the sort of free software vegan world, which I dip into, people who, not literal veganism, although I dip into that as well, people who are willing to make a lot of personal sacrifices to use free software in terms of convenience and usability, there's a tendency to think, well, you get all these benefits of security and of decentralization and so that should be enough for other people. That narrative hasn't really panned out too frequently. So I do think that instead of using the sort of stick of fear of saying you have to get away from these services because they're spying on you and all valid arguments, what seems most likely to win to me is to offer something better. And that's really hard and that's hard for a lot of reasons, including the business models that currently exist. But the free software world has done that before. And there are plenty of areas where free software has displaced an existing proprietary tool just by being better. And so I do think that there's a role for people to understand why to use free software even when it's not better but that it gets much easier to do it when it is. And if I can just add using open source software, there's a certain community about it that is really great. But it's true that it's not as easy as the out of the box software. So I know Jeremy's going to get mad at me. But speaking personally, having bought a brand new computer and using Ubuntu, it's complicated but then it's really worth it. And being part of that community and having total control over your device is really empowering. But at the same time, I don't know if we can really expect that of the two billion people that are on Facebook. So I don't know. This is why we say that it's an ecosystem. There is no silver bullet to fixing this problem. That will take several, like, multiple parallel efforts. I think one of them is certainly making sure that individuals and NGOs have the ability to find these communities and to grow these communities. And I also think from a policy perspective, governments should actually be investing not in, you know, surveillance but actually in open source software making these tools and security things much easier so you can buy a computer out of the box that will be as pretty and easy as a Mac but it will actually be in full control, in your control. And this is totally possible but again, the political will needs to be there and that has to come from the grassroots community from us, essentially. As you understood, I have to react to that. It looks more complicated. It may be more complicated but in the end what it means is it has to be learned to be appropriated by the user. And I think there is, of course, we can make all free software better and it is important to do so and we can improve the interfaces and so on. But there is a barrier, a threshold under which you will never go, like to make it as easy as a Mac because Mac holds your keys for you and don't ask you to care about your keys but until you care about your keys, you will never be safe. So you have to understand the value of privacy. Then you have to understand how crypto works at least a bit to understand the notion of what a key is before you care about your keys. Making people believe that they will never have to care about holding their keys is probably a way and only a way of screwing them and stealing the trust away from them. So of course we should improve them but people have to learn. It's like saying, oh, if language had only 20 words, it would be so easier, so much more convenient. Yes, but we could say much less things and people don't consider silly to spend years in a school to learn how to read and write. What I'm saying here is that using a Mac with Facebook and not understanding the realities of the techno-political architecture is like signing a contract without knowing how to read. And somebody telling you, it's too complicated. I don't want to learn how to use something that will make me free. It's like somebody telling you, I don't want to learn how to read and write. Just give me the contract already. I mean, that's obviously an app. But you said it, Regan. You said it is about empowerment. And this feeling of empowerment you have when you control your machine is exactly precisely what we need to share. And I'm a bit more optimistic than you about our capacity to do it with 2 billion people because it is about our intelligence, our imagination, the way we use them, and the way we share them together. And so it's a bet on humankind. Well, and I think also that to focus only on the endpoints is really to miss a big picture. There are a lot of, when I say that there are things that displaced proprietary alternatives, most all of the infrastructure that between your Mac and Facebook, the HTTP, the... Outdoors? Yeah. So much of that does come with that, the freedom guarantees. And so I do think that we can get the endpoints. And I think actually, I'm going to out-optimistic you. I think actually that if you look at the whole picture, we're further along than it looks like. It's not the... To look at the desktop Linux penetration is not really the metric to look at. It's GNU Linux by the way. Sorry. We still got a minute or two. Okay. All right. Make it quick. Hi, I'm Alex. I'm an online editor from Cologne. And I have a question and I'm also going to let you in on a secret very quickly. So about 10 years ago, I first learned how to encrypt emails and I used it and I talked to everybody about it and there were workshops and so on. And out of the say 100 private and business contacts I had at the time, like two or three people were eventually ready to use it and they were willing to use it. So eventually I gave it up. So that was before Snowden, of course. So 10 years down the road, there's the huge surveillance scandal and we all know about that. And free software, open source, encryption tools, whatever have become incredibly easy to use. And just this morning we talked about a fantastic app which is called Text Secure and there's also Signal. I think the developer is even here. And I did some sort of private PR for it and suggested people should use it and it got excellent ratings. I think the EFF gave you like 10 out of 10 points, like making it the best messenger out there and so on. So right now I have about 200 contacts and keep in mind this app is incredibly easy to use and install and it's free. Out of the 200 contacts, maybe six or seven people are willing to use it. And the other say, oh, no, it's just another messenger and WhatsApp is so convenient. What's your reaction to that? So WhatsApp is now using some of the, there are problems with the implementation but it's using the same encryption algorithm that was developed for Text Secure in the background in some cases. So I do think that a combination of these are really important that you should continue to convince your friends. I berate all my friends. I basically, once Signal came out and this is now cross-platform, I basically don't really talk to people who don't use Text Secure. That's kind of hard. Yeah. As a privacy activist I run in those circles. But then also in parallel to have that happening and to have WhatsApp implementing to an extent end-to-end encryption really gets the next billion people doing that. So I think that that's an example where we're actually not as, again, we're doing better than it might look like if you just consider. And you know WhatsApp is a Facebook thing and it's not, there are problems but it is using that end-to-end encryption in some circumstances. I'll have to be the nosy one on this again. Because WhatsApp implementing Text Secure protocol still gives WhatsApp the ability, I don't know how the client is built or how it is distributed, but gives WhatsApp control over how this protocol is used and also maybe means that WhatsApp still knowing who you are talking with at what time is already better for them and for the NSA than not knowing that if everybody went to decentralized services. So it may be seen as a step in the right direction but still doesn't fix it because unless, in my opinion, you have free software and hardware, decentralized services and communications and end-to-end encryption all together, if you miss one of those, then you cannot get this level of trust. Same, and that's a problem I have. I think Text Secure, don't get me wrong, is an excellent piece of software. I really love the way you authenticate your body using those QR codes even if those could be, you know, intercepted compromise if you have hand on the software and all. Except there was a conflict between Moxie and a few others and Moxie doesn't want his software to be distributed in any other way than by using Google Play. And I don't want to use Google Play. Therefore, I cannot use Text Secure. I think this is still something left to fix and there are a few technical details around this. But yes, I think the intellectual, psychological and cultural barriers blocking people from appropriating technology are probably way more important to work on and maybe easier to work on and to fix than the technological and the political ones. And when we work those, when we progress on those, we'll have an impact on the others as well. So keep talking to your friends about it. And talk them about their dick pics maybe. Unfortunately, I think we're out of time. That's true. Sadly enough. Thank you for this very interesting panel, was the last one for today. But actually, the closing event begins just now. So whoever wants to go there has like one minute left. So one... Ron! Heavy applause for them. Thank you so much. Thank you so much. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. you
 Hi, everybody.  My name is Parker Higgins.  I'm an activist at the Electronic Frontier Foundation, which is a civil liberties organization  based in San Francisco.  We do work in the U.S. and around the world to protect people's freedom of speech, freedom  of association and privacy rights as those people go online and come into contact with  technology.  I'm U.S.-based and our attorneys at the organization are also based in the U.S. so a lot of our  legal work and what I'm going to talk about today primarily affects the U.S. but we also  do work around the world and I think that I'll try to explain today why all of the campaigns,  even the ones that seem like they're primarily U.S.-oriented, really do work together.  And we also do work internationally and we try to collaborate with groups on the ground  wherever we can.  So that's my very quick introduction to myself.  I want to talk a little bit about the group and the discussion we're going to have today.  Obviously, everyone's understanding of mass surveillance and the way that this surveillance  takes place has changed a lot in the last two years.  It's been about two years since the Snowden leak started dropping and it's really changed  a lot of people's understandings.  In many ways it confirmed our worst fears.  I don't want to sound like a privacy hipster here but EFF had been involved in lawsuits  about warrantless wiretapping for the better part of a decade by the time the Snowden leaks  came out.  So this wasn't completely out of left field but we had confirmation and vindication of  some of the things that we were alleging.  It also, in addition to validating those lawsuits, it provided evidence for new lawsuits and so  we found things that we didn't know were happening.  And in some ways it exceeded the mainstream guesses of what the worldwide intelligence  community was up to.  Jeremy will be speaking in a minute about the tech community's response.  But one of the real surprises in this is that the NSA and the other intelligence agencies  had gone from being an organization that had a split mission of offense and defense to  being primarily offensive and that meant weakening everybody's security in the hope that it would  make these agencies able to really collect everything.  So that's kind of the super high level overview.  Obviously there have been a lot of news stories since 2013 about what's going on and so I  couldn't possibly get to any of it in any real detail.  But I did want to say that the US policy position has developed a little bit.  There have been major lawsuits, as I was talking about before.  I'll speak about one that we just got a really important ruling in today.  And there's also been advocacy around in the last few months a particular section of the  law, section 215 of the Patriot Act.  And this is the section that the government claims allows them to collect a metadata record  about every phone call that has at least one end in the United States.  And so this is obviously a huge sweeping surveillance program and it's up for renewal or expiration.  So we focused a lot in that area.  The ruling that came down today said that actually section 215 does not authorize that  program which is a very important legal victory and changes the footing of everyone around  that renewal battle.  But we'll get into that in more detail.  So that's kind of the high level overview of those things and I want to toss it to Reagan  to talk about the next part.  Thanks, Parker.  My name is Reagan McDonald.  I'm European policy manager at Access.  Access is an international organization that defends and extends digital rights of users  at risk around the world.  We have offices in the US, in Costa Rica, in Tunisia, and Manila, and in Belgium where  I'm based in Brussels.  I lead our European activities and I'm essentially a human rights lobbyist.  That's how I describe myself.  And Access is divided into three arms.  So there's a policy arm, which is what I'm in, and we work in judicial legislations to  affect long-term systemic change to make sure that laws around technology are in line with  human rights standards.  And the tech team works to provide direct technical support to civil society and change  actors around the world to use security tools like encryption, for instance.  And then our advocacy team mobilizes a group of a global movement of individuals to get  involved in whether the policy process or to learn about security tools to fight for  digital rights around the world.  So in Brussels, we work with the EU institutions.  So that's the European Parliament, the Council, and the European Commission.  We work on a range of issues like data protection, net neutrality, trade, and digital rights,  and of course, surveillance reform.  So I wanted to talk a little bit about what happened and what changes have occurred since  Edward Snowden released the documents unveiling mass government surveillance.  And this surveillance isn't only the NSA.  The NSA is kind of like the Google of corporations.  Everyone always thinks of the NSA and the NSA.  There's also the GCHQ, but there's also a number of European countries that are complicit  to various levels in this mass government spying.  So if you want more details on that, I would recommend, if you did miss Eric King's talk  to check it out that was earlier this afternoon, that explains in great detail how this US  government spying is going on.  But in the EU context on what has changed, I would describe it in three words.  One is the good, two is the meh, and three is the bad.  So first the good.  What happened after the disclosures?  Well, the attitude changed.  The level of discourse in the European Parliament in particular changed completely.  One of the biggest pieces of legislation that we had been working on was a privacy reform  effort called the data protection regulation.  That was tabled in 2012.  The discourse around privacy completely changed after the disclosures.  People, policymakers in particular, they sort of changed their mindsets a little bit where  before it was a bit like, ooh, data protection, that's boring, I like innovation, and I love  my iPad to, wow, this technology might not actually solve all of the world's problems.  That maybe human problems need to be solved by humans.  And that technology can actually, if it's not done correctly, can lead to significant  problems.  And so the threat, I think, for a lot of people on the level of discourse became much more  tangible.  And that shifted the discourse a lot, which was really great.  The European Parliament undertook a relatively thorough inquiry on the disclosures, on government  mass surveillance.  There it was over almost six months, where they brought in technologists, hackers, whistleblowers,  technology companies.  They of course invited some of the government, the intelligence services, like the GCHQ,  who politely declined to participate, but Edward Snowden also partook in that.  And the end result was a report providing guidelines on what can be done about this situation.  How can we regain trust?  How can we actually protect our digital rights, our right to privacy, our right to data protection,  our right to free association and free expression?  The problem is the Parliament isn't the executive body in the European Union, and national security  is not the competence of the EU.  So it's a very good report.  Now, well, unfortunately, it's not law.  But they are a series of great recommendations, and the Parliament is now working on a second  report that we hope will be passed soon that will also keep this political momentum.  So the meh part of it is that legally speaking, nothing really changed.  In the EU, we didn't see any real tangible efforts from any member states yet to reform  or to even talk about, frankly, to talk about intelligence services, their powers, their  relationship with the corporate sector, how this is all working, and whether or not they  can even be brought in.  And so very little has changed.  And that data protection reform package I told you about still hasn't passed yet.  So it still hasn't really led to a lot of concrete changes.  The ugly is that political memory, unfortunately, is very short.  And a lot of member states, or some member states have actually, and the EU, have started  actually expanding surveillance powers.  So a few months ago, there was the Shaliliy Abdu attacks, and this completely changed  the political climate in the EU, particularly in France.  The UK and France have actually expanded surveillance powers.  And the EU, the parliament is now debating a completely useless surveillance bill, a  surveillance directive called the EU PNR.  Brussels is a place full of acronyms.  Does anyone know what EU PNR is?  Just curious.  Okay, a few of you.  So if the European passenger name record directive.  Now this is a directive that would collect information about passengers flying in, outside,  and between, and within the EU.  This is kind of like travel metadata.  So the idea would be to collect all of this information, because terrorists exist, and  apparently we need to do this, and put it into a centralized database in order to profile  and to predict, or prevent terrorist acts.  The parliament actually voted against this bill last year.  But after the attacks in France, this has been retabled.  And so this is why I say this is the bad part, because the political memory gets, it's so  short term, that once something happens, we need to make sure that the political momentum  stays, and that we actually really commit to doing something and pushing for real change  and not expansion.  And so I'll leave it there for now, to the discussion, to leave to Jeremy before we  start talking about activism, and what we can actually do about this situation.  Hi, I'm Jeremy Zimmerman.  I'm the co-founder of La Quadrature du Net, an organization defending freedoms online  based in Paris.  I was like Reagan working, well, I was coordinating it full time for a number of years until last  year.  And like Reagan, I was running around the corridors of the EU institutions until I almost fully  lost faith in them.  I come from a technological culture, technological background, and got to start hacking law,  politics and society in the hacker's way, by reading the fucking manual and just doing  it.  And when we started La Quadrature du Net, we came together because we had this common  background of hacker culture, but also because we were commonly fascinated by the interaction  between technology and politics, namely the capacity of governments and members of parliament  to vote things they have no clue about.  And in front of that, us who had the clue about and were trying to get to make them  understand what it was about.  So it started with this idea of interacting at the intersection between technology and  policy, and also with the idea of empowering citizens to understand and participate in  the public debate.  And I think that this is what is really fundamental here.  We can be a thousand to go to the corridors of Brussels.  You can be sure that the next day, the industry will have 2,000.  If we get to 3,000, they will get to 5,000, and so on and so on.  So it is about making everyone understand how they have capacity to understand and an agency  to act upon those issues that I think is absolutely fundamental.  And this notion of empowerment, I think, will be discussed further.  On a purely technological point of view, it was fascinating to me to see that, of course,  the day Snowden appeared in the public and his documents started to be analyzed and published  and debated.  Of course, like all of you guys, I had 70 phone calls during the day, and for one week  I couldn't even put the phone back on the table before it ran again.  Of journalists asking, genuinely interested, sometimes a bit scared, what's going on?  And I was so impressed to see how much all geeks, hackers, nerds around the world when  asked these questions, maybe not all of them, but so many of us, came with the same type  of answers along those lines that, first of all, trust is forever lost in those companies.  The Prism companies, Facebook, Google, Amazon, Apple, Microsoft, but also the Bull Run companies,  the one whose technology was actively sabotaged by the NSA, which in total is probably 99.99%  of the technologies that we use every day, from Cisco routers to Qualcomm basementships  in the phones to Facebook, Google, Gmail, whatever, and so on.  And now we have evidence in the face of the world that the US legal system doesn't leave  any margin of maneuver for anything else than full access to the data of everyone, anytime,  by government agencies and the myriad of their public and private partners.  So correct me if I'm wrong, I think in the US alone, that's more than one million persons  who have a security clearance of a level comparable or superior to the one of Edwards, so in the  US alone, without counting the 5Is, the 11Is, the 14, the 1000Is this beast has, without  counting the other, that's one million people who potentially watch you masturbate in front  of porn, watch you be alone and talk to your best friend, watch you hit on someone, buy  drugs, get information about drugs, or do whatever you want to be, and whatever you  want to do in your intimacy.  So this notion that trust has been lost forever is something we cannot integrate.  It is too big, it is too wide, it is too deep.  So we could on day one stop using Google, stop using Facebook, stop using Apple, Microsoft,  and the search.  So I think here there is a bias in human mind is that when you start seeing, understanding  something that is somehow too big, you stop trying to understand it.  You build a mental wall, you block yourself from fully understanding that.  So I think there is a very strong psychological parameter here, but the most important technical  bit here is that we cannot trust those companies anymore.  The second bit of the answer that so many of us gave to journalists since then is that,  well, is what do we do now?  Where do we go from here?  We had claimed it for so many years.  Richard Stallman said that literally the year Edward Snowden was born, 32 years ago now,  I think, Stallman was already explaining to his fellow hackers and hopefully to the masses  what free software, free as freedom software was about.  But it was a way to collectively build an object from the mind software that will be  owned collectively in order to guarantee that humans will control the machines and not the  other way around.  So this is an essential part of the answer.  But now we see that also we need free hardware because all those phones and routers and computers  all with the integrated Intel remote administration platform and all of them are owned and we  lost control over all of them.  Also decentralized services.  It's been 15 years that we've been claiming that this concentration of everything in the  hands of Google was the seed for abuse of powers.  And here we are with blatant evidence of that.  So decentralized services indeed.  So the third point of this holy technological trinity is end-to-end encryption.  Not trust anyone saying, yeah, come and use my service on my computer and it's going to  be encrypted therefore it's going to be secure.  Never trust those.  Do the encryption yourself on your computer with somebody doing the encryption themselves  on their computer.  It's called end-to-end encryption.  Or else there is no way we can trust those products.  So my main point here is that we have to not only to build new tools, not only to enhance  the existing tools, but we have to rebuild trust which means asking ourselves what is  trust, what is the nature of trust.  In a world where we've been sold forever that oh, you can trust this company, you can trust  this brand, this logo, Google is your friend, do not do evil, Apple makes you feel smart  and so on and so on.  We fall from the chair realizing that maybe you just cannot trust a company.  Maybe the only thing you can trust is another human.  Maybe we can invent organizational modes such as the ones of free software where humans  together will build a web of trust, a network of trust and maybe this is the only way we  can rebuild this trust.  Thank you.  I think that leads really nicely into talking a little bit about the activism efforts that  have happened in the meantime.  And some of them certainly have been training people to do their own individual kind of  taking privacy and security into their own hands.  Some of those efforts began before the Snowden revelations.  I'm thinking in particular of the crypto party movement started by the activist Asher  Wolfe that started before Snowden released those documents, in fact, he had been involved  in hosting a crypto party.  And through that sort of thing, the organization I work for, EFF, has re-released our surveillance  self-defense guide and we really encourage people to learn how to use encryption and  to learn to empower those users to do that sort of thing.  At the same time, while we do rely on the centralized services for certain things, we  pushed those companies and the organizations that run them to operate in a much more transparent  way.  And we have gotten, there are reports that we've done evaluating how these companies react  to government requests for data when they're explicitly asked.  You can see as you look at the charts from 2011, 2012, 2013, 2014, it changes really  dramatically as the public opinion changes and these companies recognize that it's a  priority to compete on privacy.  Now as a model, I don't think that the Googles of the world can compete with the free software  of the world, but these companies did realize that at least indicating that privacy was  a concern of theirs was something that was very important for them to do.  At the same time, we've seen grassroots efforts around policy and legislation.  I had the great pleasure in the summer of last year to fly in a blimp over the NSA data  center in Utah that had a big arrow pointing down that said illegal spying below.  That was to attract attention to a report card of US legislators and where they stood  on policy efforts and that's been one part of it.  We've also seen that the Snowden documents themselves and the media around them, both  Laura Poitras' documentary Citizen 4 and Glenn Greenwald's book have been tremendously  popular.  There's still absolutely interest in this and people want to do something about that.  And then aside from grassroots activism, the lawsuits that I mentioned before continue.  And legislation happens really slowly.  The closest parallel to our situation today, at least in the US context, was a series of  privacy reforms in the 70s that led to the Foreign Intelligence Surveillance Act and  the Church Committee era.  And that took people forget that it took a very long time.  Court decisions can take a long time too, but they're a little faster and they can change  things sort of overnight.  And you also don't need to make the kind of horse trading compromises that happen at the  legislative stage.  So we've seen a lot of good come out of court challenges all around the world.  And in a lot of places that kind of mass surveillance has been just declared unlawful.  It either doesn't follow the statutes as passed in each place or it doesn't comport with  the constitutions of the countries that make up the governments that are doing these kinds  of spying.  So we've talked a lot about government surveillance.  But of course, that's just one component.  I think that this panel is named for the surveillance ecosystem.  We were discussing just before that perhaps ecosystem is not the right word.  But there is a lot of give and take in surveillance.  And to talk just about what the government conducts is really to miss a major component.  So I wanted to turn to you and ask about the role that corporate surveillance has played  and what has happened in the last few years or even longer than that in terms of changing  the game around corporate surveillance.  Right?  Okay.  So it's true.  We were just talking about ecosystem.  When we were thinking about it, like, do you really want to disrupt an ecosystem?  Like, is that good for the environment?  So maybe it's like a web or if you guys have ideas of more ominous metaphors, please do  let us know.  Quagmire.  Quagmire.  That's good.  So one of the reasons why we find ourselves in the mess that we're in, I think right now,  is really in part due to the fact that surveillance and mass surveillance is super cheap and it's  super easy.  In a lot of ways, I have come from a history background, so sometimes I tried to look at  the present as if I was looking at it 100 or 200 years in advance.  And I'm hoping from my optimist perspective that people will look back and be like, wow,  what a crazy time.  Technology exploded.  Everyone had mobile phones.  Everyone had this.  And everyone just went wild undermining rights and surveilling people, whether it's for marketing,  whether it's for national security or what have you, that's in the positive way that  we would actually get control back.  But so Bruce Schneier talks a lot about this, a fellow Canadian security expert.  And he calls this situation, this relationship between the governments and the corporates,  the public-private surveillance partnership.  And this basically explains exactly how and why the surveillance is so cheap and easy.  And that really relates to the business model of the internet.  And the business model of the internet is basically premised on mass surveillance as  well.  But it's for different purposes, of course.  It's for online marketing, for money purposes.  And when you think about it, it's really odd.  I think most people, if we're talking about regular citizens, they think, oh, the government,  looking at me, the government seeing my dick pics, if you guys see, watch John Oliver,  that's really bad.  I don't like that.  But then everyone has a cell phone, and your location can be tracked.  At the same time, if there was a law that the government passed that you would have  to give the government updated reports on whenever you made a new friend or what colleagues  you have or who you're dating, that would be outrageous.  And yet we willingly give that information to social networks like Facebook.  It would be the same thing if there was a law that the government said, every time you  send something to anyone, whether email or text message, you need to also send a copy  to the government.  This would be outrageous.  And yet we do this all the time with corporations.  And one of the most important things that we learn from the Snowden disclosures is that  what corporations know, which is a lot, governments can and probably do know.  And so this connection is basically, you cannot separate these two issues.  And this is a lot why when we talk about what we can actually do and how to fix it, from  a policy perspective, this means that we need to really change things from the ground up.  And that requires rethinking the economic model of how the internet functions.  And so a lot of what Jeremy was saying is completely true.  We need to take control of our devices.  We need to make better decisions about what companies and what services we're actually  using.  Maybe it would require doing a little more research or trying different tools, but in  the end, it might benefit us.  And I think we also need to, from a policy perspective, think about not only security  measures like encryption.  So AXIS has a campaign called Encrypt All the Things, where we're pushing corporations  to raise the bar on basic security, implement HTPBS, use more encryption, use end-to-end  encryption, which is really great, but we also need to minimize the data collection.  Now, it's really odd that intelligence services and companies have kind of aligning interests,  and that's to collect it all for different reasons, but it's to collect it all.  Maybe it'll be useful at one time.  Maybe we can prevent a crime.  Maybe we can make more money.  Who knows what will happen?  But this is a big problem for individuals and for users.  And so we really need to rethink how much companies can do, and that requires putting  limitations on what they're allowed to collect and for what purposes.  And this is where data protection comes into play and why it's so important for individuals  to have control over the information, to have control over the data that they give to these  platforms, to understand what happens to it, why is it being collected, who is it being  shared with, and what do those profiles about you say?  I think if we knew, I think if most people knew what companies can know about us, it  would change a lot the situation.  I want to address the conference theme for a second and find Europe.  Do you think that the European approach to these challenges has been more effective or  differently effective than the US approach, where in the US we don't have a baseline privacy  law basically?  And so when you say, like, if people could see what's being collected, in some cases  you can.  You can request a copy of your, basically, the file on you.  Do you think that's been effective or do you think that needs to be expanded or do you  think that kind of policy is not the right direction?  That's a lot of questions, but if people could understand what I meant by that, if they could  understand what happens to their data, not necessarily to access the data that they submit  into the platform, but what the platform derives in terms of the meaning of those different  data sets.  And that's where things get really icky and weird from a privacy perspective.  There's a really great study from Cambridge that came out last year that these researchers  analyzed a bunch of Facebook likes, only Facebook likes.  That's it, one data set.  And from those, they were able to distinguish with very shocking, shocking accuracy.  Thank you.  Shocking accuracy.  Very personal things about people, their sexuality, whether or not they're smokers, if their parents  have been divorced, if they're promiscuous, like really personal details.  And I think that's the creepy bit, that individuals, even under the European system, because we're  actually using mostly US companies, which operate primarily in the US framework of privacy,  which there is no framework.  And so you see the dilemma that we're in.  And so, yeah, and that's the thing.  And I think if we could get a hold of that and understand what that actually means and  what that impact could actually do, then I think we would have a lot of change.  Then I think that would mobilize citizens to make that choice, to move to a different  platform and not use just the easy ones.  I think you guys are quite optimistic somehow.  And I'll get back to this.  I wanted to add something on what you said about how surprising it is that governments  and companies have a common interest here.  I would say it's not so surprising.  First of all, across 20th century, fascism usually was a perfect agreement between corporations  and authoritarian regimes.  That was one of the characteristics of the different fascist regimes, that it was always  the economic interest of the dominant industries in those countries that in turn backed, supported  the authoritarian governments.  So it's not something new that we see an alliance between governments and companies towards  violating people's fundamental rights.  What is new here is that the violation of human rights has been partly outsourced to  these companies.  They are not just supporting the regime anymore.  They're also being part of the violations.  And I think this is something new.  Also what is new is we don't see the violations of human rights as they were visible in authoritarian  regimes before.  But if you trace back, the history of Silicon Valley, Silicon Valley basically was an incubator  for DARPA.  From the beginning, Silicon Valley was researching on all advanced technology that was of interest  for the militaries.  Then Incutel, this hedge fund linked to the CIA, who was one of the first major founders  of Facebook and personally financed, I think it was Sergei Brin, one of the founders of  Google, so he could go on with his research.  So what we've seen here is a perfect alliance between business models and a state paranoia,  considering that the opponent is potentially anyone, anywhere, anytime.  And I'm not sure companies are in any, well, those companies are nowhere near to change  their business model.  I mean, it's nice to ask them for more encryption.  It's very nice from them to reply, oh, yeah, yeah, we understand, privacy is a major concern,  we'll do something about it.  But that's mostly crisis communication.  The day communications are truly end to end encrypted through free software, under control  of the users to store whatever on Google, Google starts losing money.  It goes against Google's interest.  What I think we have here is a monoculture of security.  And I think it's not even security because it doesn't work against terrorism.  We see those kids in the US spitting their rage out of Facebook, getting war weaponry  and get and shoot their colleagues and teachers in class, what, every month without being  stopped by the NSA?  So if those kids are not stopped, how can we claim any efficiency to those schemes?  But the only model there is out there under the sun is this hyper security model where  you have to trust us, we'll pour more money into the thing and we'll protect you against  everyone.  This doesn't work and this cannot work because this hyper security model relies on this heavy  centralization and totally opaque process.  It is about manufacturing ignorance of the users.  It is putting them in a shroud of secrecy where they don't know, where they cannot know  what is being done to them with technology.  I think we indeed have to work towards the political aspects.  We have to do it more.  We have to be those 2,000 people in the European Parliament doing it every day.  And we have to make those people accountable for what they do.  We have to work on the technology itself.  But maybe the most important part is about changing people's minds.  It's about all the cultural and social endeavors we can take in order to make people understand  that this is not security, period.  This is authoritarianism.  And I think we have still to invent or maybe just to theorize alternative models like decentralized  security where everybody has more responsibility and more control over his or her own data  and communications and security process.  This is how we will achieve resilience when everybody will be a bit trained, a bit in  control, a bit trusted for what they know and what they can do.  This is how we will avoid catastrophes.  This is how we will stand up after catastrophes, not by trusting those logos and the grey people  working in their basements watching people masturbate.  Do you think that the progress towards that has sped or do you think it slowed?  I worry that people talk a lot about this kind of surveillance fatigue.  And of course, the John Oliver dick pic segment came as he showed Snowden, I don't know if  everyone's seen the John Oliver clip, but he showed Snowden should watch it.  It's very funny and you should watch it and it's one of the most direct interviews I've  ever seen of Snowden.  But he showed him footage of kind of man on the street interviews where he was asking  people do you know who Edward Snowden is?  And largely he says he didn't cherry pick.  Most people that he spoke to didn't or they only had a really vague idea of the sorts of  things and there were a lot of people, oh, was he that guy who sold secrets?  So I wonder, do you think that we're, that we had a window that's closing or do you think  that there needs to be something that happens to push that along further?  I think that right after June of 2013, people were definitely talking about this.  But I wonder if we've lost some of that momentum.  Are you asking Jeremy or us?  I was looking at Jeremy, but he just spoke.  I mean, I can answer.  First of all, the mere fact that we saw John Oliver publish this interview and get as much  interest, I don't know how many million views on the video, but many more to come, including  yours, if you haven't seen him yet, shows that there are still many tactics to invent  and many ways to speak about it.  And I'm convinced it is about experimenting in the diversity of tactics, writing the story  ourselves.  I'm sorry for the ones who were at my previous panel fighting the Terminator in All Pockets  available in video now.  Because I've said some of this already.  I think we have to build the story to write the story ourselves because fiction and reality  are so much intertwined that we cannot let Hollywood write this story, this history,  because it is ours.  So we have to reclaim narratives.  We have to reclaim narratives.  And what Oliver did, and I think it is the way to go, was to find a way to speak about  mass surveillance that is not generating fear.  When we nerds, hackers, policymakers, social scientists, and others speak about surveillance,  we have a view on this, we have studied the issue, we have those background knowledge  about it, we usually draw a very scary picture of the world because let's face it, it is  scary.  But when people are scared, when they're afraid, they would tend to self-censor without even  knowing.  They will speak less.  They will act less.  And we want them to speak more and to act more.  So first of all, I'm convinced that humor is the best antidote against fear.  So we have to use humor more in order to write the story for ourselves.  Also, I can't even read what I've written here.  I think that we are in control of the sequence and we must remain in control of the sequence.  Reagan and I have worked against ACTA for four years.  We've written, I think, 250 press releases on ACTA.  I've spoken in more than 300 conferences, given 1,000 interviews.  Four years before the victory and even six months before the victory, it was impossible  to win.  Every political analyst in the world was certain about that.  Not only we won, but we won by a crushing majority of 478 against 39.  It means that, A, battles that are impossible to win can be won.  B, that it can be very long and very hard work.  And this is where we are right now.  We are just at the beginning of the endeavor.  And C, it is about keeping control of what I call the V-sequence with an uppercase.  So you don't wait for news to come and be processed by the media and react to it or  else you will always be in an uphill battle.  You have to be the news, to be the media, be the change you want to be in this world.  We have to take control of the narratives in order to be able to take control of those  agencies in order to be able to take control of our machines.  Yeah.  And that sounds, I mean, it sounds like an acknowledgement that the odds are long and  that they look long, but that there's a reason for hope, I think.  Just one quick thing.  If you look at it, it took more than 10 years to radically change the course of technology  and be where we are right now.  10 years.  It's basically since September 11, 2001.  So my guess is it will take at least 10 years, if not 20, to go somewhere else from here.  Sure.  And it can be hard to see where the incremental changes.  Maybe we'll be dead when we achieve victory, but we will achieve victory.  Reagan, do you think that there's, do you agree that there's reason for hope here?  There has to be hope.  Or else we have nothing else.  So I'm definitely an optimist.  But I mean, yeah, we have to keep fighting and keep making this relevant and to go back  to like how we can make this movement happen.  I think one of the key components of John Oliver's successful campaign is that it made  it relevant to people.  It's about your private parts, you know?  And this really touched people.  And I think for privacy, not intended, I'm sorry.  And I think especially for privacy activism and anti-surveillance activism, it's really  difficult because privacy invasions are very, they seem intangible unlike other human rights  violations.  And so it's really important for us, I think humor is a really good idea or remixing Hollywood  like the Terminator was really cute.  But we need to keep thinking about these ways and to move away from the fear discourse.  And this will help us and it has to change.  We have to take more control over our digital identities.  And why I say we have to is because we live in a technologically ubiquitous world.  Everything we do is every time we walk down the street or open our laptop or walk with  our cell phone in our pocket, our data is being collected and processed and shared.  So we have no choice but to take control over our own identities.  Thank you.  I actually think that's a good place to cut off the presentation.  We've got about 12 minutes for questions.  And then as the presenter said, we do have to be very punctual because the final, yeah,  because it's Germany.  We have to be very punctual.  Sorry about that.  But yeah, so let's take it to questions and you must use the microphone because we're  making a video of this.  Right.  I see the first hand I saw was over there.  So I'll run.  Yeah, the third one.  Okay.  Hi there.  Okay.  So first of all, about the window that was closing, I think that we need a positive,  you know, positive proposals because people are interested.  I organize crypto parties in Warsaw for the last two and a half year and people come, but  they are interested not only in being scared but also being given positive proposals.  So that's something I think it's important.  But I do have a question.  So the question is, for example, I believe that the only way we can win is by working  together, you know, free culture movement, free software movement, open access movement.  We have to like join the wagons and work together.  And one way to do that is not to have users, you know, users of, for example, decentralized  social networks being cut off of being able to participate, for example, in this conference.  Right.  So the question is, do you see a way of making all those decentralized social networks more  accessible to NGOs?  Because there are many of those social networks.  I understand why NGOs, for example, have a hard time being available on all those social  networks.  That's a lot of work.  That's a lot of tedious work and being responsive on all those social networks.  So on the other hand, as a software developer, I know that if I try to write software that  will make it possible for me to work with Twitter, Facebook and something else, at some  point Twitter and Facebook will change their terms of service, they will change the API.  This work will have to be done again.  And then there has to be an organization that kind of defends this work that's been done  once.  For example, by putting pressure on Facebook not to change APIs, not to shut off such apps.  So my question is, do you see a way of doing that?  Do you see a way of helping such endeavors?  Thank you.  I do.  I think that there's, especially in the sort of free software vegan world, which I dip  into, people who, not literal veganism, although I dip into that as well, people who are willing  to make a lot of personal sacrifices to use free software in terms of convenience and  usability, there's a tendency to think, well, you get all these benefits of security and  of decentralization and so that should be enough for other people.  That narrative hasn't really panned out too frequently.  So I do think that instead of using the sort of stick of fear of saying you have to get  away from these services because they're spying on you and all valid arguments, what seems  most likely to win to me is to offer something better.  And that's really hard and that's hard for a lot of reasons, including the business models  that currently exist.  But the free software world has done that before.  And there are plenty of areas where free software has displaced an existing proprietary tool  just by being better.  And so I do think that there's a role for people to understand why to use free software  even when it's not better but that it gets much easier to do it when it is.  And if I can just add using open source software, there's a certain community about it that  is really great.  But it's true that it's not as easy as the out of the box software.  So I know Jeremy's going to get mad at me.  But speaking personally, having bought a brand new computer and using Ubuntu, it's complicated  but then it's really worth it.  And being part of that community and having total control over your device is really empowering.  But at the same time, I don't know if we can really expect that of the two billion people  that are on Facebook.  So I don't know.  This is why we say that it's an ecosystem.  There is no silver bullet to fixing this problem.  That will take several, like, multiple parallel efforts.  I think one of them is certainly making sure that individuals and NGOs have the ability  to find these communities and to grow these communities.  And I also think from a policy perspective, governments should actually be investing not  in, you know, surveillance but actually in open source software making these tools and  security things much easier so you can buy a computer out of the box that will be as  pretty and easy as a Mac but it will actually be in full control, in your control.  And this is totally possible but again, the political will needs to be there and that  has to come from the grassroots community from us, essentially.  As you understood, I have to react to that.  It looks more complicated.  It may be more complicated but in the end what it means is it has to be learned to be  appropriated by the user.  And I think there is, of course, we can make all free software better and it is important  to do so and we can improve the interfaces and so on.  But there is a barrier, a threshold under which you will never go, like to make it as  easy as a Mac because Mac holds your keys for you and don't ask you to care about your  keys but until you care about your keys, you will never be safe.  So you have to understand the value of privacy.  Then you have to understand how crypto works at least a bit to understand the notion of  what a key is before you care about your keys.  Making people believe that they will never have to care about holding their keys is probably  a way and only a way of screwing them and stealing the trust away from them.  So of course we should improve them but people have to learn.  It's like saying, oh, if language had only 20 words, it would be so easier, so much more  convenient.  Yes, but we could say much less things and people don't consider silly to spend years  in a school to learn how to read and write.  What I'm saying here is that using a Mac with Facebook and not understanding the realities  of the techno-political architecture is like signing a contract without knowing how to  read.  And somebody telling you, it's too complicated.  I don't want to learn how to use something that will make me free.  It's like somebody telling you, I don't want to learn how to read and write.  Just give me the contract already.  I mean, that's obviously an app.  But you said it, Regan.  You said it is about empowerment.  And this feeling of empowerment you have when you control your machine is exactly precisely  what we need to share.  And I'm a bit more optimistic than you about our capacity to do it with 2 billion people  because it is about our intelligence, our imagination, the way we use them, and the way we share  them together.  And so it's a bet on humankind.  Well, and I think also that to focus only on the endpoints is really to miss a big picture.  There are a lot of, when I say that there are things that displaced proprietary alternatives,  most all of the infrastructure that between your Mac and Facebook, the HTTP, the...  Outdoors?  Yeah.  So much of that does come with that, the freedom guarantees.  And so I do think that we can get the endpoints.  And I think actually, I'm going to out-optimistic you.  I think actually that if you look at the whole picture, we're further along than it looks  like.  It's not the...  To look at the desktop Linux penetration is not really the metric to look at.  It's GNU Linux by the way.  Sorry.  We still got a minute or two.  Okay.  All right.  Make it quick.  Hi, I'm Alex.  I'm an online editor from Cologne.  And I have a question and I'm also going to let you in on a secret very quickly.  So about 10 years ago, I first learned how to encrypt emails and I used it and I talked  to everybody about it and there were workshops and so on.  And out of the say 100 private and business contacts I had at the time, like two or three  people were eventually ready to use it and they were willing to use it.  So eventually I gave it up.  So that was before Snowden, of course.  So 10 years down the road, there's the huge surveillance scandal and we all know about  that.  And free software, open source, encryption tools, whatever have become incredibly easy  to use.  And just this morning we talked about a fantastic app which is called Text Secure and there's  also Signal.  I think the developer is even here.  And I did some sort of private PR for it and suggested people should use it and it got  excellent ratings.  I think the EFF gave you like 10 out of 10 points, like making it the best messenger  out there and so on.  So right now I have about 200 contacts and keep in mind this app is incredibly easy to  use and install and it's free.  Out of the 200 contacts, maybe six or seven people are willing to use it.  And the other say, oh, no, it's just another messenger and WhatsApp is so convenient.  What's your reaction to that?  So WhatsApp is now using some of the, there are problems with the implementation but it's  using the same encryption algorithm that was developed for Text Secure in the background  in some cases.  So I do think that a combination of these are really important that you should continue  to convince your friends.  I berate all my friends.  I basically, once Signal came out and this is now cross-platform, I basically don't really  talk to people who don't use Text Secure.  That's kind of hard.  Yeah.  As a privacy activist I run in those circles.  But then also in parallel to have that happening and to have WhatsApp implementing to an extent  end-to-end encryption really gets the next billion people doing that.  So I think that that's an example where we're actually not as, again, we're doing better  than it might look like if you just consider.  And you know WhatsApp is a Facebook thing and it's not, there are problems but it is  using that end-to-end encryption in some circumstances.  I'll have to be the nosy one on this again.  Because WhatsApp implementing Text Secure protocol still gives WhatsApp the ability,  I don't know how the client is built or how it is distributed, but gives WhatsApp control  over how this protocol is used and also maybe means that WhatsApp still knowing who you  are talking with at what time is already better for them and for the NSA than not knowing  that if everybody went to decentralized services.  So it may be seen as a step in the right direction but still doesn't fix it because unless, in  my opinion, you have free software and hardware, decentralized services and communications  and end-to-end encryption all together, if you miss one of those, then you cannot get  this level of trust.  Same, and that's a problem I have.  I think Text Secure, don't get me wrong, is an excellent piece of software.  I really love the way you authenticate your body using those QR codes even if those could  be, you know, intercepted compromise if you have hand on the software and all.  Except there was a conflict between Moxie and a few others and Moxie doesn't want his  software to be distributed in any other way than by using Google Play.  And I don't want to use Google Play.  Therefore, I cannot use Text Secure.  I think this is still something left to fix and there are a few technical details around  this.  But yes, I think the intellectual, psychological and cultural barriers blocking people from  appropriating technology are probably way more important to work on and maybe easier  to work on and to fix than the technological and the political ones.  And when we work those, when we progress on those, we'll have an impact on the others  as well.  So keep talking to your friends about it.  And talk them about their dick pics maybe.  Unfortunately, I think we're out of time.  That's true.  Sadly enough.  Thank you for this very interesting panel, was the last one for today.  But actually, the closing event begins just now.  So whoever wants to go there has like one minute left.  So one...  Ron!  Heavy applause for them.  Thank you so much.  Thank you so much.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  Thank you.  you
re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_0_16031.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_16032_21623.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_21624_22595.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_22596_25739.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_25740_32099.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_32100_33371.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_33372_35183.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_35184_35555.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_35556_37511.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_37512_50339.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_50340_50771.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_50772_50819.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_50820_55943.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_55944_57011.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_57012_57239.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_57240_59555.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_59556_59915.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_59916_62639.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_62640_63095.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_63096_63155.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_63156_63503.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_63504_65207.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_65208_65891.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_65892_66599.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_66600_73655.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_73656_81347.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_81348_83303.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_83304_83363.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_83364_84095.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_84096_84239.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_84240_85259.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_85260_85619.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_85620_85799.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_85800_86219.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_86220_86759.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_86760_87179.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_87180_89759.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_89760_90083.png re_publica_2015___Parker_Higgins__Jeremie_Zimmermann_et_al__Disrupting_the_Surveillance_Ecosystem_bk_90084_90105.png