34C3 - WTFrance

34C3 preroll music

Herald Angel: Good. I have the pleasure
and the honor of introducing to you two

persons here who are really working at
'La QuadratureDuNet'. Alors, c'est vraiment

quelque chose en Français ! It's an
organization NGO, it's actually working

really on the rights, on freedom of
citizens on the internet. I understood

that Agnes is there responsible for the
coordination mainly about legal issues and

that Okhin - I'll pronounce this well - is
more responsible at the technical side.

He runs as well, I think, a bunch of
volunteers, or helping you around.

Please give them a welcome applause.
Let the show start!

applause

Agnes: Hello, here is Okhin, but he has

already been introduced, the third person
from 'La Quadrature du Net', and I am

Agnes and I work on legal and political
issues at 'LaQuadrature' as well. So

LaQuadrature is an organization that
fights for fundamental rights and freedoms

in the digital area. We are here today to
talk about the danger lying above your

jobs, especially if you're building or
maintaining cryptographic tools. We're

here because we think it's important to
demonstrate that the worst authoritarian

laws don't only come from far right
governments such as Hungaria or Poland,

but mostly from the "social democracy
compatible with market economy", to quote

Angela Merkel. Along with Germany and the
United Kingdom (but with Brexit, exit the

UK), France is one of the biggest forces
within the EU. And if France can rally at

least one of the two others on board it
can obtain what it wants from its European

partners. It works both ways, of course!
But it's important because the problem

with that: France is not only exporting
its knowledge and practice of law

enforcement and anti-riot gear to various
governments such as Tunisia or others.

France is now also shining for its anti-
privacy lobbying as you will see later.

sound issues on Okhin's microphone

Okhin: What is interesting here is to
think about what we can do as technicians,

developers, sysadmins, sysops,
or legal persons

specialised in technology issues.
Because the threats come from legal,

political and technical area and endanger
not only us but also sex workers, abused

women and abused people, who
need to flee their home etc.

We have to think about our role
and to find ways to act, to fight

against the threats against encryption.

We're going to start with a quick but
sadly non-exhaustive history of laws

trying to weaken or circumvent
cryptography in France one way or another.

We are including here everything that
talks about spyware and keyloggers,

because they're a direct threat against
a lot of cryptographic tools.

Agnes: Okay, so let's be clear here, we
are only to talk about very specific

aspects of the digital related law. Access
to the Internet, filtering, censorship can

probably be discussed in other talks with
the same quantity of laws hindering those

rights. But we will focus here on
cryptography only. Before 1998 use of

cryptographic tools for the public was
essentially forbidden. The key length was

limited to 128 bits for asymmetric
cryptography. There were authentication

of communication or for ensuring integrity
of the message a prior declaration

was necessary. For all
other uses, especially

for confidentiality, ex ante authorization
from Prime Minister was required as well.

Okhin: After lengthy negotiations with

intelligence services cryptography has
been freed in 1998. But it still

required that the system used respects one
of those three following limitations.

The cryptography system cannot be used
for confidentiality purposes without

authorisation. Or the cryptography system
is operated by a third party owning a

master key which the police may have
access to. Or the user does not need a

strong confidentiality and can use a
standard encryption solution with a key

lower than 40 bits.

bad sound, subtitles now
from author's transcript

Furthermore: people providing encryption
tools for confidentiality purposes were

required to give the code, decryption
devices or conventions when law required

by them. In 2001 the use of cryptography
is freed, but still requires that the

system used has been first registered at
the Interior Ministry's office. Now it's

one of the ANSSI mission, the French
National Cybersecurity Agency ANSSI that

reports to the Prime Minister. France's
doctrine toward cryptography has always

been dictated by intelligence services and
the army. They want to collect as much

data as possible, multiple times, and to
have the capability to decrypt every

conversation at any given time. This is at
this condition that they consented to give

free access to cryptography for the
general public. That's why, French law

oblige to declare to the ANSSI the supply
or importation of a cryptology tool.

This procedure is an obstacle for the
deployment of such services in France,

mostly because you have to face an
administrative system which refuses to

speak non-French. The delay for the
transportation (?) is at least one month.

For a long time, all administrative
documents were in French only, ANSSI

now provides the translation as
a courtesy, but you're still supposed

to fill the forms in French. You're
supposed to provide your source code, but

since you all develop open software, this
is fine, isn't it? And of course, you have

to send it by regular snail mail, there's
no electronic version of it, in triplicate,

which is much more expensive, especially
if you're not in France. Let's say that

administrative documents are sometimes
very complicated for French-speaking

people, who are supposed
to be used to them.

Agnes: So..
Okhin: How enabling foreign people - not

French speaking ones - to understand them
and to correctly fill them?

proper sound back again
Agnes: Since then cryptography legislation

has not really evolved. However, one
national security or counter terrorism law

after another - we had something like 30
of them in the last 15 years - the

judiciary and repressive arsenal did grow.
For example, police were authorized to

install keyloggers in the LOPPSI 2 law in
2011. Then police were authorized to force

any person or entity they think able
to decrypt or to analyze every kind of

encrypted content they get their hands on
in the counter-terrorism law of 2014, and

the army and intelligence agency of course
can help to do those crypto analysis

if needed.
bad sound, again from author transcript now

Okhin: And now the so-called "Black boxes"
entered the game in the Surveillance Law

of 2015. Those are algorithms collecting
and analysing metadata in order to catch

terrorists. We know they are made by
Palantir and we had the confirmation on

November of their deployment.
The fun fact: the internal intelligence

service signed the agreement with Palantir
but the military intelligence and foreign

intelligence services are quite concerned
about it, because they would rather maintain a

strategic autonomy.

In the same law, the use
of IMSI Catchers is granted to cops

and they can install spyware on your
terminal without prior validation of a

judge. IMSI Catchers and spywares may be
used to gather any information that may

help protect vague interests, such as the
"industrial and economic well being" of

France or the prevention of undeclared
protests. recording audio back to quality

Thanks to the state of emergency since
2015 and now made permanent in last

October, search warrants may now be
delivered on mere rumour and suspicions,

after the fact, without any investigations.
They allow for collection of any data found

on site. And data is kept during three
months, but if they are encrypted the judge

can decide to retain them indefinitely
until they decrypt them.

And without any investigative power.

Agnes: So to conclude this
depressive state of affairs

we need to add that cryptography
is an aggravating circumstance

in a long list of crimes
and felonies linked

primarily to organized crime and terroism,
but also conveniently to aiding refugees

for example. So encrypting things makes
you even more suspect and more guilty.

Okhin: Oh and we almost forgot - if ever
you're operating a cryptographic system

for third parties you have an obligation
to provide either decryption key or plain

text to cops if they ask for it and
you have 72 hours to comply

- which means a lot of pressure
on you. It probably can

apply to yourself if you're being
investigated upon, but it might clash with

the right to remain silent and to not
self-incriminate we do not have a lot of

choice here. But we recently had cases
where cops.., where the law has been used

one of them was to coerce a teenager to
provide decryption key for an encrypted

chat with OTR he was operating and which
had been used by people who were making

fake bomb alert in schools. And for one we
know about, how many of them have gone

unnoticed, people chosing to keep living
their lives instead of risking jails time

and huge fines ?
Agnes: So here it's important to note that

there's difference being made between
cryptography which enforces security

communication and cryptography which
enforces confidentiality. In this

presentation we're addressing the issue of
cryptography in the concept context of

confidentiality only. To illustrate that
this debate goes beyond the classic lines

of left/right politics we like to display
some quotes on the topic by various

ministers, candidates, elected
representatives and prominent political

speakers. For example, Éric Ciotti, he is
a member of parliament from the right-

wing. He wants to fine Apple 1.5 million
euro, if they refuse to give encryption

keys, among other outrageous things he
said, this is one taking hold.

Okhin: François Molins, Paris Prosecutor,
wrote about that in the New York Times

against cryptography. The title is quite
explicit it states: "When Phone Encryption

Blocks Justice" And he talks about the
importance of privacy rights of the

individual in the same paragraph of the
"marginal benefits of full disk

encryption". He signed this bullshit with
his colleague Cyrus Vance Jr, District

Attorney of Manhattan, Adrian Leppard,
commissioner of London City Police and

Javier Zaragoza, chief prosecutor of the
national court of Spain. I let you read

the full quote in all its splendor.
Agnes: So we have also Guillaume Poupard

from the ANSSI we talked about before. He
said just before the Bataclan attack in

2015 that backdoors and key sequestrations
is a bad idea and that he instead proposes

to work on "points of cleartext". Whatever
it means it probably stands for transport

security and against confidentiality of
communications.

Okhin: Emmanuel Valls, then Prime
Minister, used the term "legal

cryptography" in interviews where the
official discourse for the last 20 years

was that all cryptography was legal.
Agnes: Here the digital national council,

then chaired by Mounir Mahjoubi, who is
now Secretary of State for digital issues,

did oppose the ideas of backdoors and did
advocate for the use and development of

end-to-end encryption just before the
presidential electoral race - you'll see

later why it's important.
Okhin: Bernard Debré, another elected

representative from the right wing he
actually ordered drugs online, cocaine for

80 euros a gram on onion-services to prove
how dangerous it is. He also said you can

buy body parts and guns there and that
it's easier than ordering shoes online. He

also bought a lot of drugs from a non-
identified website in Netherlands, so

surely the encryption is at fault here.
Agnes: So Jean-Jacques Urvoas who was

Minister of Justice said he wants to
access computers, Skype communications and

so on and to put all suspects and their
entourage under permanent recording.

Between the first and second turn of the
last presidential elections he broke the

professional secret and sent to Thierry
Solère who is a member of parliament from

the white ring the information that he was
investigated upon. He sent a message by

Telegram and the note was saved on Thierry
Solère's phone and found during a police

search at his house later on.
Okhin: In August 2016 there was a joint

declaration of Thomas de Maizière and
Bernard Cazeneuve, interior ministers of

Germany and France respectively about
European internal security and they stated

that: "At the european level, it will
require to force the non cooperatives

operators to remove illegal content or to
decrypt messages during investigation."

Agnes: However, so it was a joint
communication but French written version

of the joint declaration was different
than Germans. Only France kept the part

about how it would be so great to have
back doors or golden keys. So either

Germany did not want to publicly advocate
for backdoors or they had a different

strategy, but unfortunately very recently
the same de Maizière announced that he

wanted to force tech and car companies to
provide the security services with hidden

digital access to all devices and
machines. He probably did not know that if

you lowered the security of cars you
dramatically increase the risk of accident

among others.
Okhin: All this was before Macron was

elected last spring. It's like an actual
photo. It's not a Photoshop. During his

presidential campaign Emmanuel Macron said
that we should put an end to cryptography

by forcing the biggest companies to
provide encryption keys or to give access

to the complete content stating that "one
day they'll have to be responsible of

terror attacks complicity".
Agnes: So Mounir Mahjoubi again. He was

then concealing the candidate and he is
now internet minister. He has been forced

to backpedal and to explain that messing
with end-to-end cryptography was out of

question and that they'd rather force
companies to cooperate faster with police

forces. He specifically emphasized the
importance of cryptography by companies to

protect trade and industrial secrets and
since then Mounir Mahjoubi has become

totally silent on this topic. So it seems
that encryption for confidentiality is a

real problem for them. Would you be
surprised to know that to communicate with

his political party and representatives
Emmanuel Macron, now president, uses

telegram? An application regularly
described by a lot of representatives as

an enabling terrorism tool and which
should be banned. Their words, not ours.

Animal Farm is back: We are all equal with
the use of cryptography, but some are more

equal than the others. Coupled with this
focus on protecting companies' secrets

this confirms that the Start Up Nation
doesn't care about protecting citizens but

only about business and powerful friends.
This becomes blatantly obvious when you

look at Macron's social and economy's
policies.

Okhin: Last but not least, successive
French government put pressure to add in

the law possibility for cops to ask you
for all of your online handles, including

that all Yahoo mailboxes, ICQ numbers,
your Twitter or Facebook account, all the

weird nicknames you use on IRC and stuff
like that. That's why mine is currently a

fork-bomb embedded into a shellshock, but
I think we can get more creative and find

a way to be more destructive for a system
when cops would have to enter it into

their systems. Two attempts have been made
already and rejected at some point. This

kind of registration already exist in the
UK in the US and we hope the government

won't succeed in France to put this kind
of limitation in law.

Agnes: So, as demonstrated France is one
of the very active power against

cryptography within the EU. Even if some
of other member states did express some

concerns namely Poland, Croatia, Hungary,
Italy, Latvia, and other countries, those

concerns have been prompted by other
member states and probably France. Each

new bill is a risk to reduce the use of
cryptography especially with the criminal,

digital or judiciary laws that are coming
soon. For instance France is pushing hard

for avoiding any obligation on end-to-end
encryption in the ePrivacy regulation.

They explicitly ask to gain access to any
communication or metadata, which is what

is written here in French. Sorry, we
didn't translate it. The government also

pushes to obtain EU legislation on
encryption which would limit end to end

encryption, of course. The government
intends then to use this EU legislation

for justifying its position while it did
create this proposal at the first place.

In the next month the discussions
eEvidence will start at the EU level. They

will probably be a lot of talks about
cryptography in the next "counter-

terrorist package" expected in 2018.
Counterterrorism is always a good way for

the governments to make some provisions to
enhance security and to lower the rights

and freedoms. They threaten the Parliament
to be responsible of the next attacks and

the members of parliament thus vote
anything just because they don't want to

be responsible.
Okhin: So as technician, what can we do?

From a technical perspective we think we
should operate communication

infrastructure and systems in an illegal
and clandestine way. It is important to

build undetectable and encrypted
communication systems that break the link

between your online communications and
yourself. Making those tools available to

the general public and mass adopted by
them is a critical and non trivial issue

to address. Especially as French legal
registration system might block access to

high-quality privacy preserving encryption
tools. For instance, Apple requires you to

fill the ANSSI form and obtain a
certificate from them to put your software

on the Apple App Store already.
Moreover it is paramount to think wider,

because if your encrypted communication
relies on centralized infrastructure at a

highly identifying piece of information
such as for instance a phone number, then

a passive listener such as an IMSI catcher
can get your phone number from a protest

you were at for instance and then guess
what your account is and then, they got

your phone number, so they can ask to
deploy key loggers and spyware on your

phones. And this defeating all the
security based on your phone number. At a

time where more and more governments want
to hinder encryption and secret of

communications, it is critical to have
access to communication systems that are

free, pseudonymous, decentralised and
distributed to the widest audience

possible, meaning user-friendly, yes, and
to think about way to push those tools

everywhere. It is also important to lead
political battles. We need all available

help to slow down this attack at the
national and European levels. We need to

get out of the security discourses and to
break the link between encryption and

security for the state and to control the
argument that only people committing

crimes and felonies do use cryptography.
We need a positive discourse about

cryptography: how it helps people with
their daily lives, how it impr

oves social structures, how it protects
the identity of queers, how it helps

abused women to seek help and to escape
their home, how it enables a positive

change in the society, as main change
often comes from activities not approved

by the society. If you want more concrete
steps and ways to help we're currently

running a support campaign so you can help
us there at support.laquadrature.net.

After the Q&A, because we have some time
left, you can come drink some tea at the

teahouse in the CCL building and have some
tea and chat with us. Thank you all for

listening and if you have any question I
think we have some time.

applause
Herald Angel: Alright we have 5 minutes

for questions. Are there people out there,
maybe on the internet? No, are there some

people here who have questions for this
lovely organization? Well I have a

question actually: So you gave us some
advice regarding using avatars, alter

egos. You know what, I'm teaching as well
and my colleagues teachers even in that

kind of digital age that we live in are
always wondering why I am using several

avatars, several devices. It seems like
it's not accepted actually because they're

looking at you like "Are you a criminal or
what? What did you do wrong?" Don't you

get that kind of questions as well from
your audience?

Ohkin: Yes, we got that a lot. The thing
is, a lot of people commit crimes using

their real name and IDs and stuff like
that. Most of the people are asking people

online, for instance, to not use a
pseudonymous account or something like

that, they want to be known as our same
people and stuff like that. So it's like

we need to get out of this kind of
discourse and say: "I can do whatever I

want with my online identities. It's not
your business. And if I'm doing something

wrong, you have to prove it, like with due
process of law and stuff like that.

Herald: Ok, I see there's a question
raised in here. Microphone number two.

Mic2: What counts in practice as import
and export of cryptography. I mean, if I'm

in France and I download open SSL, do I
have to fill out the ANSSI form?

Okhin: Not for open SSL, because it's not
protocol that have a goal to provide

confidentiality of communication which is
end-to-end encryption.

Mic2: So GPG?
Okhin: Yeah, GPG is supposed to have an

important certificate and I think they
have it.

Mic2: For individuals or for
organizations?

Okhin: For the organization which provides
you the access to the tool. Like Google is

supposed to provide that, Apple,
Microsoft, Debian. Debian I think filled

the paperwork. Each Linux distribution
should do it.

Herald: Question here, microphone number
one?

Mic1: Okay, thanks so much for the talk.
I'd really love to hear a little bit more

about the very crunchy in-depth bits about
encryption policy in France. Now might not

be the right time, but building off of the
last question: What kinds of laws or

policy are around taking encryption
technology outside of France, like across

a border?
Agnes: Well for exporting to closed

encryption technology there is the
Wassenaar Arrangement signed by several

countries, so I don't know by heart
everything in there, but for example a

system that can use for war and for other
use. Then you have it's forbidden or you

have to declare that you're exporting such
tools etc. So for exporting you have this

Wassenaar agreement and I think there is
nothing else if it's not a double use

system.
Mic2: Thank you!

Herald: Okay, one last question, please
there, mister three.

Mic3: It seems to me that all of these
laws are mostly falling under national

security. Are there any laws way to
challenge any of this in the European

level? So on the European level there's
wonderful direct data protection

directives and all the stuff. But my
understanding is that all of these

directives any state can kind of opt out
of them for national security reasons. So

is there anything that can be done on any
level without invoking a national security

exception?
Agnes: Yeah well all data protection

regulation policies at the EU level and
especially the GDPR, general data

protection regulation, has a specific
provision that enable member states to

say: okay, it doesn't apply because it's a
national security issue. What I said, what

I showed here, is that in in the ePrivacy
regulation, which is currently under

negotiation at the EU level, the EU
Parliament has already adopted a position

which promotes encryption as soon as it's
possible to have end-to-end encryption.

And that's why the French government is
trying to push it away, there will be

negotiation between the Council, the
European Parliament and the European

Commission. The Council represents all
member states, so there will be a

negotiation with all the institutions,
beginning this summer probably. Or just

after the summer, but maybe a little bit
before. And then the French government is

going to try to push it away. As we saw
in the document which we showed in

French, the government is trying to get to
gain access to all communications and

data. It's very clear in the French
communication we showed.

Herald: May I make a suggestion?
They have a fantastic tea house.

You have to continue this discussion
later on there with a cup of tea,

and some massage maybe. I have
one last call for you both, you know,

and the audience: « Indignez-vous ! »
[i.e.“Time for Outrage!”]

Ca, c'est! That's why we wanna hear you! (?)
Indignez-vous !

applause

postroll music

Subtitles created by c3subtitles.de
in the year 2018