this venue is amazing i really normally i talk about good and evil in the context of surveillance but i really feel like here i should add some fire and brimstone so i'm going to tell you i'm going to give you a bit of a history lesson in an attempt to tell you a story about how surveillance has evolved and how law enforcement and intelligence agencies are addressing and coping with changes in technology for more than one hundred years the telephone companies have provided assistance to law enforcement agents who wanted to monitor the telephone calls of kind of targets and for the investigations for a hundred years these companies have provided this systems in many cases there have been dedicated teams of employees at the companies today hundreds of employees at each company are there responding twenty four hours a day seven days a week to requests from federal state and local law enforcement agencies and intelligence agencies really for a telephone company at this point surveillance is part of the business it's not a business they intended to go into but it's a business they are now in whether they like it or not and so for one hundred years law enforcement agencies have known that they could turn to these trusted parties these partners the a t m teasin variety of the world who would give them what they want and then eventually would even build once features into the very core parts of their network our phones today are designed first and foremost to be surveilled they're designed to deliver calls and text messages as almost an afterthought but the first feature is the surveillance feature and so what i want to talk to you about today is sort of how governments have responded to changes in technology and in particular how they for spawn into first the possibility freeh was really the first f b i official and first u s government official to raise the threat of encryption technology to the public debate the language there three used was really a big deal at the time this is in the in the mid one nine hundred ninety s when technology that would allow regular people to protect their communications from surveillance was was controlled by a lawyer it was controlled as in use it as a an arms as arms technology and thus not available for export also the united states and i read you some of his quotes uncrackable encryption will allow drug lords spies terrorists and even violent gangs to communicate about their crimes and their conspiracies with impunity this is doomsday scenario that freeh was describing of a world in which encrypted it was available to the masses he added the only acceptable answer is socially responsible encryption that permits timely law enforcement and national security access and decryption pursuant to a court order what freeh was talking about was something that technologists and and those of us in the space call key escrow the idea was that a copy of your encrypted key a copy of your interruption password would be stored by some third party and if you decide if you did something bad and or the government decided to take an interest in you they could go to that third party and get the key and then decipher all your and all of our communications would be encrypted which was a good thing but the encryption could be broken by the government whenever they needed to in case that someone did something bad so the clipper was not a success in the market it turned out that people didn't want this technology particularly once researchers showed that the encryption was broken and couldn't just be broken by the government but could be broken by anyone else and so towards the end of the one nine hundred ninety s this system of controls over technology came down the wall t wall fell down and suddenly people could export this encrypted technology suddenly anyone in the world could download free software or buy commercial software they could protect their e mails they could protect their m allow them to communicate in a way that governments could not read or decipher their communications but p g p which is one of those tools it was never a problem for the f b i it was never a problem for law enforcement and the reason was is that  encryption tools that were available looked something like this and in fact they haven't really changed in their design since then it turns out that the encryption tools that were available in one nine hundred ninety s the encryption tools that the government said everyone could use were so difficult to use were so difficult to use correctly that no one ever used them how many people in this audience have sent an encrypted e mail in the last week and this is a pretty paranoid audience this is these are people who are willing to show up on a wednesday night to come and see me talk these tools have twenty years later they are still not used by regular people and it's not because of legal issues it's because they're a pain in the butt to use and so although these doomsday scenario portrayed by top f b i and other law enforcement officials the doomsday they predicted didn't come about not because of the law but because the technology was difficult to use you could encrypt but realistically you wouldn't and so that brings us to where we are now brings us to where we are now where incursion technology not only is becoming easier to use but is that it is now increasingly being billed to the products that we all use encryption threatens to lead all of us to a very dark place sophisticated criminals will come to count on these means of evading the tax and it's the equivalent of a clause that cannot be opened a safe that cannot be cracked and as an applause them i don't know where that was so the rhetoric really hasn't changed in twenty years the rhetoric is the same they're still predicting doomsday scenarios but what's changed is that people are actually using encryption now   ours your communications are protected by end to end encryption across all your devices when you use i message in face time and we wouldn't be able to comply with a wiretap order even if we wanted to so what this means is that right now if you have an i phone or an i pad and you send text messages or you make a video or audio call with their products to someone else who also has an i pad or an i phone those messages are encrypted and the encrypted in such a way that if you listen to what apple says and you believe what apple says which i think reasonable people can can ask questions about they're not able to monitor and thus the government is not able to easily monitor now that's a really big change that's a sea change from where we were just a few years ago when if you were making a call with your eighty into your horizon phone those companies could and would hand over your telephone communications they could and would record copies  messages and hand them over to government agents at a later date what's fascinating about what apple has done isn't that they have made encryption available to users but that they have turned it on by default and so even if you don't think about it you're now using and gaining the protections of this and corruption technology apple isn't the only player i don't know how many of you in this room use what's out but this is an extremely popular service particularly in the global south and many many non u s countries quote i grew up in a society where everything you did was eavesdrop on recorded snitched on nobody should have the right to eavesdrop or you become a tallit tarion state the kind of state i escaped as a kid to come to this country pretty bold statement from a tech company c e o and the again this is a company whose product is used by hundreds of millions of people people who are downloading it not because it's an encryption out people who are downloading it because it's easy it's free it's the  friends are already using and this is a company who in november of last year turned on extremely strong encryption technology that makes the old fashioned wire taps difficult if not impossible now if you don't trust apple and you don't trust what's out which is now owned by facebook and you have the ability to convince your friends and loved ones and colleagues to download other software there's a tool that i really like it's called signal it's available in the is also available for android phones and using this app you can make free encrypted telephone calls and sending cryptic text messages doesn't cost any money and this is made by a team of widely respected researchers there are no hidden back doors in the service the problem is your friends and loved ones are probably not using it already so you have to sort of convince them to download this whereas with a message or or what's out probably people are already using it and so it's the availability of services like this it's the fact that suddenly hundreds of millions of people now have access to encryption technology and are now using encryption technology that is causing a freak out in law enforcement and national security circles so i'm speaking in seattle microsoft's hometown employer going to go so what's the deal with microsoft's technology right we know that apple and whatsapp which is facebook are doing this what about microsoft so microsoft bought skype i assume everyone in the audience knows that skype is a microsoft service according to an article that glenn greenwald published in two thousand and thirteen microsoft has has modified their services to make them more amenable to wire tapping by the u s government quote skype was served with a directive to comply by the attorney general and after they received that order they decided they made modifications to the service that will allowed the n s a to be able to monitor people's skype text messages and also skype audio and video calls this is brad smith who is microsoft's general counsel fairly outspoken guy has criticized the actions of the u s government in forcing microsoft to hand data on its dublin based servers dublin ireland based service to the us government this is him in an interview last year we assume that all calls the weather over the internet or by fixed line or mobile phone will offer similar similar levels of privacy and security so that's brad smith saying that the degree of security that microsoft intends to deliver to customers is the same that you get from your cell phone which isn't very much so you know if you're deeply concern privacy if you don't want the state to be able to wiretap your communications i'm afraid that i can't really recommend skype but there are plenty of other tools that you can use that will make surveillance much more difficult  tools are on your phone today if you have an i phone if you have an android phone you can download either watson or you can download signal or you can download other services these tools are available today how our government agency is go respond they're not going to just pack up their luggage and go home they'd they want to be able to wiretap the communications of interesting individuals individuals who they believe are doing things that are bad how they respond so in two thousand twelve i started researching the question of hacking by governments there's been a number of stories showing that the governments around the world were buying off the shelf hacking software that governments  ethiopia and vietnam and other places were buying commercial surveillance technology that they could use to hack into people's computers and take over their web cams and microphones and that kind of thing and i thought well hang on the f b i has a lot of money they're probably doing it too right so i stumbled on this document that another civil liberties group the electronic frontier foundation if af had been able to to to get from the government through foyer and as you can see most of it's redacted but there was this one line in the document this remote operations unit that i saw and i thought well that sounds interesting and so i started to google stalking the remote operations unit of the f b i to see what i could find out and i i looked at the link ten pages of contractors who did work there i found th unit chief of the r o u in his university fraternity alumni magazine described what he did at his day job and so i was eventually able to take all this information and give it to the wall street journal and they were able to confirm that the f b i has a dedicated team of agents in quantico virginia and all they do every day is hack into people's computers they have the ability to activate microphones and webcams the most fascinating thing is the the light next to your webcam isn't controlled by hardware so they can turn the micro the the the camera on with out the light also going on the light is sort of through your for your benefit but not if the f your computer and so this team has existed and it turns out in one form or another since two thousand and two the first court order the first application for a court order seeking permission to use this capability was not made public till two thousand and seven and it wasn't until last year that the f b i finally started to be least a little bit open about their use of this technology they they went to this obscure body in washington d c a body run by the courts and they said we have this problem that right now we need to go to a judge in the district where the crime is happening to get a court order and if we don't know where the bad guy is we don't know which judge to go to so we want permission to get a judge in any part of the country to authorize hacking in any other part of the country so that was our opportunity the first time ever for anyone in the civil liberties community to say hang on a second maybe we should have a conversation about hacking before we give the f b i these powers and so i in preparation for the hearing i started reading everything that i could about hacking by law enforcement and i read thousands of pages of documents and it was in doing that that i read only didn't deny it they defended the practice and so they thought it was perfectly appropriate so the problem is they have this surveillance software they need to get it onto your computer somehow they have to trick you into downloading it or hack into your browser or something and so it turns out  trickery is a pretty common method that they use so that was the big news last november it's all odd for me to come here to seattle where this you know in in the region where this thing actually happened and again this  the biggest terrorism threat in the world this was a student calling in a bomb threat because he or she didn't want to take their exam on time this is a really powerful surveillance tool being used in that case so the f b i has a lot of money and when agencies have lots of money they buy really powerful tools but not all not all agencies have the same resources and the same tools and so what we find is that other law enforcement  agencies that have the same needs but don't have the same budgets have to get lesser quality cut price tools and luckily there is a thriving industry of commercial surveillance companies who are quite happy to sell sophisticated surveillance technolog them i mean marketing is not shy they say that they can get encrypted voice location web browsing the works so i've been tracking this company for several years their software has shown up on the computers of activists and reporters in morocco in ethiopia in vietnam in use by some governments there really have no respect for human rights this company doesn't care about who they sell to and so i've seen that for the last few years they've been coming to washington d c and have been speaking out and exhibiting at this surveillance industry trade show where law enforcement agencies show up and see what the cool tools are that year and i actually went to this conference i snuck in and twenty twelve and i put on a a suit i don't know how many of you been to washington d c but the uniform and washington d c is ugly ill fitting suits and so i bought this cheap suit from the first store and i put it on and i went to the conference and i snuck in and i secretly recorded what i saw and this company was there and they were giving out their flyers and mints in the fridge magnets and so i learned about them there it turns out they don't just go to that conference they actually go to the association of law enforcement intelligence units and you conference this is larger police departments have dedicated teams that just do surveillance and this is the annual u s conference for these law enforcement agencies surveillance teams  only this hacking team go to the conference not only speak at the conference this is from the program in twenty thirteen but they actually pay for the coffee break the conference so i've been hunting down hacking team for a while because i'm convinced that they sell their stuff in the united states they have an office in washington d c and i think it's only a matter of time before their stuff is used by state and local agencies so the problem with this technology and not just the hacking software but in fact many kinds of surveillance technology is that it's expensive i mean not like millions and millions of dollars but like two hundred thousand three hundred thousand dollars that's too much money for a local law enforcement agency they have stretched budgets particularly you know in these current economic times they don't have the money for these cool toys or cool tools or other and so luckily there are nice bureaucrats in washington d c who are happy to give grant money to local law enforcement agencies and so where you've seen surveillance technology is spreading into your community here in in washington state in tacoma where they purchased sting ray technology it was with grants from the h s when you guys got a mesh network web camera thing here in seattle money from washington d c if there have been you know surveillance cameras in your streets money from washington d c where it's been drones armored personnel carriers money from washington d c bear cats the armored personnel carriers that i think many people saw in the wake of ferguson money from v h s money from the o j and surplus from the o d drones making their way into small town communities money from washington d c and this thing that tool that i've been hunting for for years the sting ray this is a tool that allows law enforcement agents to track and identify every cell phone in an area money from washington d c so what's fascinating about the sting ray and i guess similarly to the hacking stuff in the drones and the other things these were tools that were designed for the military and for the intelligence community and the problem is that the raytheon's in the booz allen zone the bowings that sell this technology they can only say well so much for the military eventually they've saturated that market and so they're looking for additional markets  law enforcement is a happy market these tools make law enforcement's job easier so the tools sell themselves the only question is well how do we pay for them and that's where washington d c comes in they write blank checks to pay for the gear so you know i think reasonable people can have a debate about whether these technologies are appropriate in iraq or afghanistan or yemen and i'm sure that my views maybe aren't in line with everyone's but i think many of us should be able to agree that technologies that are designed for use in a hostile war zone may not necessarily be appropriate for main street but here in the united states and the sting ray is an example of this this is a technology that sends signals into people's living rooms this is not a surgical technology that tracks one phone this is technology this sends signals into every house in a neighborhood identifies every phone that's nearby creates a list of every phone that's nearby and then provide that to the agent that's using the device this is a technology that was built for the for the intelligence services just this week the wall street journal had a story talking about the relationship between the cia and the marshals the marshals put these things on airplanes and fly them over cities and it described the relationship between the cia technology unit and the marshals technology unit as a as a marriage that's how close they are presumably a happy marriage not an unhappy one but this is a technology that is now trickling down to state and local law enforcement agencies around the country and we know that they're in use here in washington state these are technologies that have been put into use in your community without any debate because the money came from washington they didn't have to go to the city council and have a thorough debate about how these technologies were going to be used they didn't have to explain how they would work they wouldn't have to explain the collateral damage or the fact that they would collect information about innocent people who've done nothing wrong they go to the city council and they say hey we got this grant from fema or from d o j can we accept the money you know this will help those who help law enforcement will keep us safe and of course the city councils always say yes because who's going to turn down free money free training free tools so these tools are put into our communities without any oversight from our city councils from our state legislative bodies or even even in congress there have been no hearings at the federal level and there's only been hearings on sting rays in the last year in michigan and texas and i and and here in washington state these are technologies that are put into use in communities where out with out in the bay and it's not it's not like that's an oversight that's purpose the argument the law enforcement agents use is that they have to put this technology into use secretly because if they told the public how how it worked it would tip off the bad guys we see these quotes time and time again from the local police chief saying look you know we're using this in the right way we're using in an appropriate way but we can't tell you anything more you have to trust us because if we told people how the bad guys would figure out how to avoid it right and that's this conflict in the area of surveillance they don't want to tell us how it works because someone in this room is going to commit a crime so the rest of us have to be kept in the dark so that one person doesn't know how it works so and then in addition to not having any debate means we also don't have any oversight legislative bodies don't know and more importantly the courts don't know so here in washington state the courts have been kept in the dark around the country courts have been kept in the dark to the extent that law enforcement agencies get orders get court orders for this the applications for the court orders don't say what they're planning on doing and so for example in two thousand and seven when the f b i hacked into that teenager's computer and timberline they didn't say what they were planning on doing they didn't say in the application for the court order by the way we're going to impersonate the associated press they didn't say we're going to hack into the computer they said we have some software that will identify this person's location can we use it and the judge didn't get to  cide you know is this an appropriate use of technology are these circumstances and is the method by which they'll use this appropriate does it meet these constitutional limits because the police never told law enforcing the federal agents never told  lid on the use of the stinger a surveillance technology by the police in tacoma so journalists have been writing about sting rays since probably two thousand and twelve kate did something special so it's a really really insightful move on her part so it in local jurisdictions around the country when questioned by reporters the police chief would say we always get court orders and what  so you had on one side the police say we always get court orders and then the people issue in the corner is saying i have no idea what you're talking about and it turned out yes they were getting court orders but the court orders didn't mention what was going on what they were planning on doing with it how they collected information by innocent third parties the fact that when they use this technology it jamas phone calls and people in the neighborhood want you to make incoming or outgoing calls in nothing was being told to judges that because of this transparency that's coming from local media because of organizations like the a c l u that have been forcing this stuff into the sunlight it's starting to change and so in tacoma we're now seeing that judges  have instituted a new protocol they now demand that the police change the way they get permission for this technology that judges demand information from the police and all it took was a few front page  so as i said we've now had hearings in i think three states three or four states about sting rays there are there are several states where legislation has been introduced in virginia where i live there's a bill sitting on the governor's desk that would require a warrant for sting rays i know here in washington your state house has passed a bill and will be a hearing tomorrow morning at eight am for the senate to look at that legislation and then hopefully it will reach the governor's desk in utah they require a warrant for el al tracking so bit by bit we're getting some oversight over these invasive cell phone tracking technologies but what we're not getting just yet is similar oversight and action from legislative bodies about how king technology i think one of the reasons for that is that right now we only know that federal agencies are using it we haven't caught any state or local law enforcement agencies using it i'm sure they're using it and i hacking team has an office in maryland they're sending their sales people out there buying coffee at conferences i'm sure that someone bought this stuff but until we catch them red handed until we get a front page story in a small town paper we're not going to get reform but this technology is so invasive the idea that the police can turn on your webcam on your microphone without your knowledge and listen to what's happening in your bedroom or in your office or you know in your psychiatry office this is terrifying the capability and there's been absolutely no oversight and so we need to get over over this technology over the use of these tools we need to make sure that our state legislative bodies and ultimately that congress takes a close look at this but it all starts here in small communities and even big cities like seattle it all starts with your local u affiliate it all starts with your local press who are hounding police and getting questions from judges and finding out what your law enforcement agencies are doing thank you for your time but in terms of the topic reigning in i mean what you've shown us tonight is probably just the tip of the iceberg and so surely us knowing about what app or signal is is like us trying to face down a tank with a b b gun so so that's sort of one of my questions what really can we do to prevent this and rage that is why is it a big deal today hundred years ago i mean i'm against it but one hundred years ago you know the telephone operator with the headphone plugging in the cords could listen to every one of our verbal conversations literally we didn't get upset about that so what's changed about our society but the real question is this question is this oh yeah  fairness just that was reflection of your presentation my real question i came forth tonight is i have a sense that there's no uproar in our society about this because we're somewhat buying into the message that all this is done to keep us safe and so unless we can turn the tide of our beliefs that in fact this intrusive and this is a danger to our democracy and a danger to our society there really won't be more of an uproar about it so that's if you only choose one of the questions that address and i thank you i think we can do all three and i think it's a problem look so i'm not going to come here and give a talk that that scares that scares you for no reason and leaves you without feeling like you can do something about it i don't know want to tell you here are these token small things that you can do that will really do anything but at least make you feel good i want to give you concrete advice that will actually make a difference and the issue is surveillance at the at the it's core it comes down to the economics if the government really really cares about you and they think that you're really bad person or you're a particularly interesting person they will burn all the resources they have to get you and there's nothing you can really do to stop that if they really care about you they will send people to your house and put microphones under your bed and hack into your camera they'll do everything but most of us aren't that important and i suspect that no one in this room is important enough that the government would spend a million dollars to spy on you so the question is well are you interesting enough that they would spend ten dollars to spy and or fifty dollars or hundred dollars and so if we can raise the cost of surveillance so that it cost a thousand dollars or ten thousand dollars or a hundred thousand dollars for this buy a new well agencies have a limited budgets they don't have the resources to spy on every american one surveillance is expensive but right now surveillance is so damn cheap  it's really a question of collective now and filter it later and so when you use tools like signal or watts or i message and you know i personally would prefer that you use something like signal because it's open source and i think open source is important when it comes to trust and security but even if you just use the tool that's built into your i phone you make surveillance more difficult you make it more expensive and suddenly you know you might be too expensive for them to spy on because they don't you know because you're not going to be you're not going to be shining in that pile of data and then the third question i forgot what it was because this was a question about uproar and why isn't there more uproar and i think i think that it's a really valid concern alternately you know a lot of what you think of when you think about surveillance is fairly abstract the impact it has on our community is it's hard to quantify i know there are certainly things you can point to impacts on free speech in people's willingness to engage in controversial issues but you know i think the reality is that people tend to respond to these things when there are tangible effects that they have i was talking with chris earlier about how red light cameras are something that there's a lot of uproar about because there is this tangible impact of a i got this ticket for this thing and there was you know no person saw me do it it just happened a camera on a street corner in the same way if she's in hacking i think for a lot of people are intangible but then we you have stories about you know schools installing spyware on the on the computers that they give to kids all the sudden you know there's a pro or and parents get involved and concerned so it's really a matter of kind of finding those those good stories to illustrate these issues and distilling the kind of large abstract concepts into ones that you know people can grasp easily and it's  observation and the algorithms that sort out that information very cost effectively have nothing to do with the government but the government uses that data to further their ends so there is a law professor whose work i really like his name is paul he's a georgetown law school and he talks about this idea of the database of ruin he says that there's a database somewhere that has information about all of us that if it were revealed to the world if our loved ones or our colleagues saw that information it would be disastrous to us and for all intents and purposes these databases of ruin have existed for decades but we had tried to pull security because they were too difficult to collect into coley and the link to us what identifier that collects all these things and you know i'm now in a loving relationship but you know a couple years ago i was single and i had an online dating profile and you know every once in a while maybe someone a colleague from work would stumble across my profile but for the most part i had my work personality and i had my online dating personality and they were separate and were rapidly moving into a direction where you know you're browsing the web and you're looking at a dating site and you see some i understand you right click on their photo say who is this and it suddenly tells you their name and their address and where they work and how much they are and all the research papers they wrote when they were undergrads and all this other stuff and i don't think our society is wired right now we don't have we're not preparing ourselves for protecting ourselves with that kind of technology in mind and i think many of us are going to be in for a really unpleasant unpleasant surprise when all this data from disparate databases is linked through the through the unique identifier that you cannot change and cannot run away from which is your face right i have a twitter question so what do you expect from social media or cloud companies with regards to avoidance of i think this is particularly interesting because of some of the work you've done in terms of poking and prodding companies to bolster their security mechanisms so i have a love hate relationship with many of the companies and many of their lawyers  there we go you know it's really difficult to get the companies to do things that are not aligned with their business interests i can pressure companies to row on corruption i can pressure companies to update and upgrade their security because ultimately i just it's just a question of money but getting them to keep less data ultimately hit to their business model and so getting a company like facebook to retain less data getting a company like google to provide encrypted communications that they themselves cannot access that's a really tough ask and i've not been successful in that area you know right now the dominant business model with the exception of a few companies is you get these services for free and in exchange you get these great and tools and you know the way they make money is by collecting  mining data and realistically i don't think that we can expect those companies to change their their data collection practices and thus their surveillance practices because if you have it the government can ask for it i don't think we can expect that to change until these companies find another way to make money you know in google's case you know google is trying to find a million different ways to make money whether it's you know solar power or self or even cars or space one of the the  that are flying over confidence google is clearly looking for other ways to make money but as long as google's lifeblood is advertising i think we can only expect them to go so far again google has done probably more than any tech company in the last two years to secure themselves but that's been secure the connection between the customer and google and the connection between google and google that they haven't locked themselves out of our conversations and that's really a question of business models more than more than anything else i think we're at left now what if we're going to try to get information from that we're going to try to find out what local agencies are getting money what agencies do we write to in the federal government for your requests to find well as health and other issues so on the first question the main agencies the issue rats are d h us the part of homeland security and the o j within the h s it's fema that is the grand giving agency not because female is a surveillance agency but fema is the most equipped agency within the h s to write large checks very quickly after an emergency they're really good at giving out money and so they are they defied grad giver at the h s and then you also have the the the military who provide surplus you will find that all of those agencies take a long long time to respond to foyer requests and so i actually encourage you to file your state level equivalent request with your own local agencies who are the recipient of the grant funds because they will results and then on the smart meter question because i know there are people in the audience who care really deeply about smart meters you know traditionally the police could go to the power company and find out some information  could get information on a monthly basis to figure out you know whether you are using more electricity than your neighbors but it was monthly it was an hourly or on the on at a minute by minute level you know obviously the marijuana is legal here i guess you guys don't have as much of a concern about the police trying to figure out who's using more power than the neighbors but power data doesn't just reveal whether you have a bunch of grow lamps and your house there's some fantastic research by a professor at  university of washington here showing that individual appliances in homes have unique fingerprints electronic fingerprints that if you have the same if you have two models of the same television someone watching the power usage outside the home can actually tell which of those two t v s was turned on i mean crazy crazy stuff i think but you know the courts have not done enough to protect our data because i mean there are categories of data they get the lowest protection under the law so banking records and power sort of traditional things that been obtained with subpoenas which law enforcement in these in many parts of the country can do is write themselves i think the power data can reveal activities inside the home and i think that what takes place in the home should receive the highest protection under the law that's not happening right now and so i would like to see more protections for that particularly as computer scientists and engineers reveal just how useful and sensitive th actually is and echoing some of that i think that there's also very serious concerns about collaboration between public utilities and private companies and sharing the state i mean talking about link ability of information nuanced information about what goes inside your home in the hands of google obviously need something very different than just your utility company having that information so you know state level regulations that prevent utility companies from sharing this this information for commercial purposes or wholesale is obviously something that is that is critical to preserving some of the balance of privacy here what is what is is what is the a c l u doing now one with smart meters so at the national level i don't think we're doing much i think this is a state level issue because it s rules are very different in states i know where there has been the most success has actually been in california where they sell you an e f work together to institute data security rules for smart meters and one of the things we were able to get was mandatory reports published by the power companies every year revealing how many requests they got from law enforcement agencies and for some reason the people at the police in san diego submitted an order of magnitude more law enforcement requests than any other law enforcement agency in this in the state of california why we don't know but at least we met we now have that data but that's where we've seen the most success i don't know you know what's happening here thank you so i have another twitter question so perfect content cryptography does little if they haven't how it's your phone they shouldn't be able to learn what you're saying but if you call the if you call an abortion clinic someone can probably guess what you're what you're calling them about if you call a suicide hotline and you're on the phone for an hour it doesn't really matter what you say it's the fact that you're calling suicide hotline for an hour that sensitive and you know the technical community the computer security and privacy community we don't have great tools for protecting medicare with the exception of services that hide your information by routing you through other servers there's a great service that i recommend called tor that you can use to browse the web anonymously but tor is a bit slow it's fine for browsing the web but it's not is no way that we know right now for your cell phone to communicate with a cell tower such that the cell tower won't know where you are and so over time we're probably going to move in a direction where we have more and more interruption which means th police are going to get less and less information about what you're saying but they're still going to have a huge amount of data about who you're talking to when you're talking to them how often you're talking to them how long the conversation lasted and where you were when you said that and that's enough data to hang lots of people minute there is a small chip this smaller than a postage stamp and most of your cell phones and holds an encryption key that only your phone and the cell phone company is supposed to know and increasingly modern  the calls and one of the stories that the intercept which has been greenwald organization put out a few weeks ago revealed that g c h q which is the british intelligence agency how to into the largest manufacturer of these sim cards and stole hundreds of thousands if not millions of sim cards sim card incorruption keys and so this is hundreds of thousands of keys in somalia and other countries but this company jim also provides some cards for eighty and t and t mobile and sprint and verizon and they also have the hundred seventy five million dollar contracts for the smart pos bortz that we have in the u s you know though antenna thing in your passport that you're not able to bend and so there are some really interesting and troubling open questions right now about how secure your phone calls are and whether it's the in c and t mobile and verizon and sprint are going to recall the sim cards and issue new ones or whether they're going to leave us all out in the lurch that's you know yet another reason why i don't think we should trust the phone networks to provide us with confidentiality i think we should use apps that go over the data connection like i message and face time and what's happened signal because i don't trust the phone companies and they have a really bad track record in protecting privacy and security and  other kind of foreign intelligence agencies that have access to your keys the keys to your communications it could also theoretically be federal and local law enforcement thank you so much for all the work that you're doing here especially exposing the transport or making it transparent what's going on i'm really concerned about the solutions though as i don't think that hiding it's enough it appears that the e u may be well ahead of us with things like the e u data directive our u s laws really enough or do we need proactive user rights that give us unalienable rights to view data to correct data to have data deleted and removed even from private corporations and not used against us i mean if you're asking me what i would like in an ideal world so i think all of those things are fantastic i live in washington d c which is one of the least productive cities in the united states nothing gets done or i live and so you know if you're waiting for congress to pass legislation that will give you european style rights i mean waiting for a while that's why you know so they sell you has a lobbying office in washington d c and we have full time lobbyists who are in congress every day trying to convince members to pas legislation that would protect your emails protect your location data after to rein in the n s a and they work really hard and then i get paid enough money but realistically it's not going to happen any time soon and what's probably going to happen is that there's the  authority that the n s a used to collect everyone's cell phone call detail records is going to expire this year and what's probably going to happen is they're going to wait until at midnight the night before they expire as they all my goodness terrorists we got over knew this thing it's an emergency and then they'll  get what they want i don't want them i don't want that to happen but that looking by what's happened in previous years they do very little until it's absolutely like the last minute and then they just rush something through but it's for that reason the reason you know the and the political process in d c is so paralyzed that you know that's why i believe in technology technology has the potential to provide basic privacy protections where law and policy lagged behind and you know it when a company ro out the fall and to encryption to five hundred million users it doesn't matter what the rules are doesn't matter whether the police need a warrant or a lesser court order a higher court order now those communications are effectively off limits to not just the u s government not just the f b i and local law enforcement the n s a but to every ten part of territory and regime that doesn't respect human rights everywhere in the world and so technology is just such a major game changer but we don't decide the technology that we use in many cases where reliant on these mega corporations the provide the instant messaging apps in the communications tools in the smart phones and so you know we've got to get these folks to play along and we've got to pressure them and there has been some some state legislation that's moved the needle as well as cali and california in particular where so many of these companies are in all of them have major presences there have been kind of industry or sector specific laws that have said hey you have to using corruption in this context or you have to provide users with the right to delete you know their profiles in this context and and that's actually had a fairly large impact because when california says it or another prominent state says it even is companies just do it for everyone right they roll out features that comply with the law and you have that technological impact for all their users thank you so over here thanks for all the work you're doing i just wanted to ask again if you can talk a little bit more about amazon multiple times about a multibillion dollar agreement that they have with the c and then just secondly can you address the argument that you mentioned that the f b i and others make that they are only going after bad guys and that all of this technology all of the surveillance is targeted specifically to bad people and therefore it doesn't affect everyone else when i talk to a few i spokesperson about the impersonating an a p reporter her response was incredibly flip it was basically well we impersonate anyone if we were trying to get a bad guy this pert this kid was calling in bomb threats you know we could have just impersonated it done toast in order to get him to install this spyware on his computer so how how do you respond to that  set on the part of all these agencies so those are excellent questions so i i regularly communicate with the lawyers all the big tech companies and i've hit a wall with amazon it's just really difficult to reach the right people there in the last you know couple years particular post snowden companies that were never transparent like apple have been much more transparent and published reports now every twice a year revealing how many surveillance requests they get yahoo face microsoft all are publishing transparency reports zero from amazon and you know it's not just requests for user data it's requests for data stored by amazon's cloud computing clients right why would you go to some think you start up when you can go to amazon and get data about the services that are being provided through their cloud computing services and so you know i think amazon has really escaped the spotlight i think you know maybe we dropped the ball in that maybe we should been focusing more of our attention on them i think it's about time that amazon publishing transparency report i think that they they should do that we'd love to see them follow the lead of other companies and adopt progressive policies like notifying users about surveillance requests unless they're prohibited from doing so via cia that doesn't really terrify me i mean that you know dell sells laptops and computers to government agencies that doesn't make the most surveillance company but i definitely think amazon could be more upfront about the kinds of surveillance requests they receive you know for the second question about what we're just spying on bad guys i think it's important their friendship between the mastic law enforcement and for intelligence in the domestic law enforcement front there are several technologies like the sting ray that although they say they're only using them to catch bad guys the technologies are overbroad it by their very nature you cannot turn on a sting ray and identify one phone you turn it on and you get the cell phone signal was there everyone in the room and their response is well you know we don't really save that information we might collect it we might send signals into your living room into your car into your purse but don't worry we're not looking at it after and you know my response to that is well you know if they put a video camera in your bedroom and said well don't worry it's not turned on or want to turn it on if you're a bad guy i don't think many of us would be comfortable with that that's not an excuse on the foreign intelligence surveillance side it's actually worse because you know i think post snowden the response from the government has been well look there are these really bad people out there you know we need to spy on them terrorists you know that kind of thing but what the snowden documents have shown is in fact a lot of the surveillance that the u s government does and its partners like the british in the canadians do isn't aimed at terrorists it's aimed at people who are interesting and interesting is it way broader that can be you know we want to spy on you know the opposing negotiators in some trade treaty we want to listen to the telephone calls of foreign leaders we want to hack into the computers of engineers of com not because we believe this belgian phone company is a terrorist outfit but because they provide telephone service to people who are interesting and so the logic of the n basically means that any engineer any computer any system administrator or someone who does technology at any global infrastructure company anyone that makes any technology that interesting people might use is fair game and i think that's really messed up and i mean i used to be a sad man so this is like a personal thing but i don't think it's cool i don't think i don't think we signed up i certainly never saw the bay where the n s a said oh yeah by the way we're going to start engineers on line we're going to follow their every communication line and then deliver malware targeting them because we want to get into their employers i didn't sign up for that and i didn't agree to that and the congress certainly never pos legislation approving that and i think those kinds of activities