34C3 - Policing in the age of data exploitation

34C3 preroll music

Herald angel: Today two people from privacy
international, one is Eva Blum--Dumontet

she's a research officer working on data
exploitation especially in the global

south and Millie Wood who's a lawyer and
is fighting against spy agencies and

before that she fought seven years against
police cases and they're gonna be talking

about policing in the the age of data
exploitation. Give them a warm welcome.

Applause

Millie Wood: Hi I'm Millie as was just said I've been

at privacy international for two years
working as a lawyer before that I spent

seven years bringing cases against the
police and what increasingly concerns me

based on these experiences is a lack of
understanding of what tactics are being

used by the police today and what legal
basis they are doing this on. The lack of

transparency undermines the ability of
activists lawyers and technologists to

challenge the police tactics and whilst
I'm sure a lot of you have a broad

awareness of the technology that the
police can use I don't think this is

enough and we need to know what specific
police forces are using against

individuals. The reason why is that when
you're arrested you need to know what

disclosure to ask for in order to prove
your innocence. Your lawyers need to know

what expert evidence to ask for in order
to defend their client. And increasingly

as there are invisible ways or seemingly
invisible for the police to monitor a scale

we need to know that there are effective
legal safeguards. Now those who are

affected are not just the guilty or those
who understand technology they include

pensioners such as John Cat a 90 year old
man who's a peace protester and he's a

law-abiding citizen no criminal record and
yet he is on the UK domestic extremism

database and listed here are some of the
entries: He took his sketchpad and made

drawings, he's clean shaven, and he was
holding a board with orange people on it.

So this is the kind of people that they
are surveilling. John's case exposes

unlawful actions by the police but these
actions date back to 2005 to 2009 as far

as I'm aware there are no cases
challenging modern police tactics and

privacy international in the UK and with
our partners throughout the world are

increasingly concerned at the pace this is
developing unobstructed because people

don't know what's going on, and so we've
started in the UK to try and uncover some

of the police tactics using Freedom of
Information requests. These laws should be

available throughout Europe and we want to
make similar requests in other countries

hopefully with some of you. So now I'm
going to hand over to my colleague Eva who

will talk a bit about privacy
international, some of the tactics we know

the police are using, and then we'll speak
about some of the things that we found out

through our initial research.

Applause

Thank you so, I'm just going to tell you a
little bit more about Privacy

International for those of you who don't
know this organization. We are based in

London and we fight against surveillance
and defend the right to privacy across the

world. Basically, essentially what we're
doing is that we do litigation, we conduct

research, and we carry out advocacy
including at the United Nations, we

develop policies on issues that are
defining modern rights. Now, our work

ranges from litigations against
intelligence services to a wide range of

reports on issues such as connected cars,
smart cities, and FinTech. We've recently

published an investigation on the role of
companies like Cambridge Analytica and

Harris Media and their role in the latest
Kenyan elections. With our network of

partner organisations across the world we
advocate for stronger privacy protection

in the law and technology and stronger
safeguards against surveillance. Now we

talk about data exploitation and it's
actually the title of the talk so what do

we mean by that? The concept of data
exploitation emerges from our concerns

that the industry and governments are
building a world that prioritize the

exploitation of all data. We observe three
prevailing trends in data exploitation.

One is the excessive data that's generated
beyond our control. The second one is the

fact that this data is processed in a way
we cannot understand or influence and the

lack of transparency around it. The last
one is, that at the moment this data is

used to disadvantage us the ones who are
producing this data and it's further

empowering the already powerful. We hardly
control the data anymore that's generated

from phones or in our computers, but now
in the world we live in data just don't

come just from our phones or computers. It
comes from the cars we're driving, it

comes from our payment systems, from the
cities we live in. This is all generating

data and this data is used by other
entities to make assumptions about us and

take decisions that eventually influence
our lives. Are we entitled to a loan? Do

we qualify for affordable insurance?
Should we be sent to jail or set free? Who

should be arrested? This is at the core of
the world that we're building around data

exploitation. The question of power
imbalance between those who have the data

and who gets to make decisions based on
this data and those who are producing the

data and losing control over it. Now what
is policing have to do with data, what

does data exploitation have to do with
policing? The police has always been

actually using data in the past. To give
you one example in 1980 a transit police

officer named Jack Maple, developed a
project called chart of the future, this

is how he described it: "I call them the
chart of the future. On 55 feet of wall

space, I mapped every train station in New
York City and every train. Then I used

crayons to mark every violent crime,
robbery, and grand larceny that occurred.

I mapped the solved versus the unsolved".
Now the system was used by the Transit

Police and it was credited with reducing
felonies by 27% and robberies by 1/3

between 1990 and 1992. So this generated a
lot of interest in his projects and former

New York Mayor Rudolph Giuliani asked the
New York police department to essentially

take up chart of the future and develop
their own project. It became CompStat.

CompStat was again essentially about
mapping crime to try and make assumptions

about where crime wars are happening. So
this kind of shows the building of this

narrative around this idea that the more
data you have, the more data you generate,

the better you will be at reducing crime.
Now it becomes interesting in the world we

live in that we describe, where we are
constantly generating data, often without

the consent or even the knowledge of those
who are producing this data. So there are

new questions to be asked: What data is
the police entitled to access? What can

they do with it? Are we all becoming
suspects by default? One of the key

elements of the intersection between data
exploitation and policing is the question

of smart cities. It's worth bearing in
mind that data-driven policing is often

referred to as smart policing, so obviously
the word smart has been used generally in

a generic manner by various industry to
kind of describe this trend of using mass

data collection in order to provide new
services. But there is actually a real and

genuine connection between smart cities
and data-driven policing. The first reason

for that is that actually one of the main
reasons for cities to invest in smart city

infrastructure is actually the question of
security. This is something we've explored

in our latest report on smart cities and
this is emerging also from the work we're

doing other organizations including coding
rights in Brazil and DRF in Pakistan. So

actually Brazil is an interesting example,
because before the mega events they

started organizing like the football
World Cup and the Olympics they invested

massively in smart city infrastructure.
Including projects with IBM and precisely

the purpose of what they were trying to
achieve with their smart city

infrastructure, was making the city safer
so it was extremely strongly connected

with the police. So this is a picture for
example of the control room that

was built to control CCTV cameras and to
create graphs in order to showcase where

crime was happening and also in a way the
likeliness of natural disasters in some

areas. In Pakistan there is a whole new
program on investment of smart cities,

which is actually referred to as the safe
city project. Now companies understand

that very well and this is actually an
image from an IBM presentation describing

their vision of smart cities. And as you
see like policing that is very much

integrated into their vision, their
heavily centralized vision of what smart

cities are. So that's no wonder that
companies that offer smart city

infrastructure are actually now also
offering a platform for policing. So those

companies include IBM as I mentioned but
also Oracle and Microsoft. We see in many

countries including the UK where we based
some pressure on budgets and budget

reductions for the police and so there is
a very strong appeal with this narrative,

that you can purchase platform you can
gather more data that will help you do

policing in less time and do it more
efficiently. But little thought is given

to the impact on society, or right to
privacy and what happens if someone

unexpected take the reins of power. Now
we're gonna briefly explain what data-

driven policing looks like, and eventually
Millie will look at our findings. So

the first thing I wanted to discuss is
actually predictive policing, because

that's often something we think of and
talked about when we think about data-

driven policing. I mentioned CompStat
before and essentially predictive policing

works on a similar premise. The idea is
that if you map where crime happens you

can eventually guess where the next crime
will happen. So the key player in

predictive policing is this company called
PREDPOL, I mean I think they describe

pretty much what they do, they use
artificial intelligence to help you

prevent crime, right, predicting when and
where crime will most likely occur. Now

PREDPOL and other companies using
something called a Hawkes process that's

used normally for the prediction of
earthquake tremors, so what Hawkes

originally did is that he was analyzing
how after an earthquake you have after

shakes and usually the after shakes tend
to happen where the original earthquake

happened and in a short period of time
after that. So the Hawkes process basically

is described as when a certain event
happens, other events of the same kind will

happen shortly after in the same in the
same location. Now obviously it actually

works quite well for earthquakes, whether
it works for crime is a lot more

questionable. But that's actually the
premise on which companies that

are offering predictive policing services
are relying. So basically applied to

predictive policing the mantra is
monitoring data on places where crime is

happening you can identify geographic
hotspots where crime will most likely

happen again. Now other companies than
PREDPOL are joining in and they are adding

more data than just simply location of
past crimes. So this data has included

open source intelligence and we talked a
little bit more about this later on.

Weather report, census data, the location
of key landmarks like bars, churches,

schools, data sporting events, and moon
phases. I'm not quite sure what they're

doing with moon phases but somehow that's
something they're using. When predictive

policing first sort of emerged one of the
the key concerns was whether our world was

going to be turning into a Minority Report
kind of scenario where people are arrested

before a crime is even committed and
companies like PREDPOL were quick to

reassure people and say that do not
concern about who will commit crime but

where crimes are happening. Now that's not
actually true because in fact at the

moment we see several programs emerging
especially in the US, where police

departments are concerned not so much with
where crimes are happening, but who's

committing it.,So I'm gonna talk about two
example of this: One is the Kansas City No

Violence Alliance, which is a program laid
by the local police to identify who will

become the next criminal - basically - and
they're using an algorithm that combines

data from traditional policing as well as
social media intelligence and information

that they have on drug use, based on this
they create graphics generated using

predictive policing to show how certain
people are connected to already convicted

criminals and gang members. Once they've
identified these people they request

meeting with them whether they've
committed crimes or not in the past. And

they would have a discussion about their
connection to those convicted criminals

and gang members and what they tell them
is that they are warned that if a crime

next happened within their network of
people every person connected to this

network will be arrested whether or not
they were actually involved in the crime

being committed. Now there are actually
dozens of police departments that are

using similar programs. The Chicago Police
Department has an index of the 400 people

most likely to be involved in violent
crimes. That sounds like a BuzzFeed

article but actually there is a reality
which is extremely concerning, because

those people who are in this list are for
the most part not actual criminals, they

are purely seen to be connected to people
who've committed crime. So if your next-

door neighbor is a criminal then you may
well find your name on that list. Now

predictive policing is deceptive and
problematic for several reasons: First of

all there's the question of the
presumption of innocence. In a world where

even before you commit a crime you can
find your name on that list or be called

by the police - you know - what happens to
this very basis of democracy which is the

presumption of the of innocence. But also
there's the other question of like can we

really use the math that was originally
designed for earthquakes and apply to

human beings because human beings don't
work like earthquakes. They have their own

set of biases and the biases
start with how we collect the data. For

example, if the police is more likely to
police areas where there is minorities,

people of color, then obviously the data
they will have will be disproportionately

higher on persons of color. Likewise if
they are unlikely to investigate white-

collar crime they will be unlikely to have
data that are reflecting a reality where

crime also happens in wealthier areas. So
basically we are inputting biased datasets

that obviously will lead to biased
results. And what these biased results

mean is that it will continue the already
existing trend of over policing

communities of color and low-income
communities. I'll leave it to Millie for

the next box. So, one of the increasingly
popular technologies we're seeing in the

UK, and is no doubt used around the world
and probably at border points, although we

need more help with the reasearch to prove
this, is mobile phone extraction. The

police can extract data from your phone,
your laptop, and other devices which

results in a memory dump of the extracted
data taken from your device and now held

in an agency database. So for example all
your photos, all your messages, and all

those of people who had no idea they would
end up in a police database because

they're associated with you retained for
as long as the police wish. Now these

devices are pretty user friendly for the
police and if you're interested you can

look on YouTube where Cellebrite one of
the big players has lots of videos about

how you can use them, and so depending on
the device and the operating system some

of the data this is from a police document
but it lists what they can extract using a

Cellebrite UFED is what you might expect:
device information, calls, messages,

emails, social media, and Wi-Fi networks.
But if you look at their website and here

are a few examples they can also collect:
system and deleted data, they can access

cloud storage, and inaccessible partitions
of the device. Now this is data that is

clearly beyond the average users control,
and as the volume of data we hold on our

phones increases so will this list. And
the companies we know the UK police are

using, which includes: Cellebrite, Acceso,
Radio Tactics, MSAB, are all aware of how

valuable this is and as one of them have
stated: "if you've got access to a person

SIM card, you've got access to the whole
of a person's life". They also go on to

note: "the sheer amount of data stored on
mobile phones is significantly greater

today than ever before." There are also no
temporal limits to the extraction of data,

this is from another police document we
obtained and it shows that if you choose

to extract to certain data type you will
obtain all data of a particular type, not

just the data relevant to an
investigation. So all that data on a

police database, indefinitely and even if
you were asked whether you were happy for

your data to be extracted during an
investigation I think it's highly unlikely

you would realize the volume that the
police were going to take. Other targets

for the police that we know about are:
infotainment systems in cars, Smart TVs,

and connected devices in the home. This is
an extract from a tech UK report, where

Mark Stokes head of digital forensics at
the Met Police which the police in London

stated in January, that the crime scene of
tomorrow will be the Internet of Things

and detectors of the future will carry a
digital forensics toolkit that will help

them analyze microchips and download data
at the scene rather than removing devices

for testing. Now I can imagine that the
evidence storage room is going to get a

bit full if they start dragging in
connected fridges, hair dryers, hair

brushes, your Google home, Amazon echo and
whatever else you have. However, their

plans to walk into your home and download
everything, make no mention of needing a

specific warrant and so the only
limitations at the moment are the

protections that may exist on the devices.
The law does not protect us and this needs

to change. So I'm going to be talking a
little bit about open source intelligence

and in particular social media
intelligence, because when I talked about

predictive policing I identified those two
sources as some of the data that's being

used for predictive policing. Now, open
source intelligence is often thought as,

or often assumed to be innocuous, and
there is the understanding that if

information is publicly available then it
should be fair for the police to use. Now

the problem is that among open source
intelligence there's often social media

intelligence that we refer to as
documents. Now there are many ways to

conduct document and it can range from
like the single police officer, who is

just you know using Facebook or Twitter to
look up the accounts of victims or

suspected criminals, but there was also
companies that are scrapping the likes of

Facebook and Twitter to allow the police
to monitor social media. Now social medias

have like blurred the lines between public
and private, because obviously we are

broadcasting our views on this platform
and at the moment the police has been

exploiting this kind of unique space, this
blured line, ithey are accessing this

content in a completely unregulated
manner, as long as the content is publicly

available like for example you don't need
to be friend or to have any already

established connection with the suspected
criminal or the police or the victim

anything that's available to you it's
completely unregulated there are no rules

and I mentioned earlier the question of a
budget restriction and so the police is

benefiting hugely from this because it
doesn't really cost anything to use social

media so at the moment SOCMINT is kind of
like the first and easy step in a police

investigation because there is no cost and
because there is no oversight. Now,

SOCMINT actually isn't so innocent in the
sense that it allows the police to

identify the locations of people based on
their post, it allows them to establish

people's connection, their relationships,
their association, it allows the

monitoring of protest and also to identify
the leaders of various movement, and to

measure a person's influence. Now, in the
UK what we know is that the police is

largely using marketing products, so this
is an anonymous quote from a report by

academics that have been doing research on
SOCMINT and what someone said was that: "A

lot of stuff came out of marketing because
marketing were using social media to

understand what people were saying about
their product... We wanted to understand

what people were saying so it's almost
using it in reverse". Now again, this is

not considered like surveillance device
this is purely a marketing project that

they're using and for that reason law
enforcement agencies and security agencies

are often arguing that SOCMINT has
basically no impact on privacy. But

actually when your post reveals your
location or when the content of your post

reveal what used to be considered and is
still considered actually as sensitive

private information like details about
your sexual life, about your health, about

your politics, can we really minimize the
impact of the police accessing this

information. Now obviously we may not have
a problem with the average twitter user or

with a friend reading this information but
when the ones who are reading the

information and taking actions on this
information have power over us like the

police does, you know, what does it
actually mean for our right to privacy?

That's not to say that people should stop
using social media but rather what kind of

regulation can we put in place so that
it's not so easy for the police to access.

The absence of regulations on SOCMINT has
actually already led to abuse in two cases

both in the US that we've identified: One
is Raza v. the City of New York which is a

case from the ACLU where we knew that we
found out that the city of New York,

sorry, the New York Police Department was
systematically gathering intelligence on

Muslim communities, and one of the ways
they were gathering this intelligence was

essentially by surveilling social media
accounts of Muslims in New York. The

second case is a company called ZeroFOX.
So what ZeroFox does is social media

monitoring. Now, during the the riots that
followed the funeral of Freddie Gray,

Freddie Gray was a 25 year old black man
who had been shot by the police, so after

his funeral there had been a series of
riots in the UK and ZeroFOX produced a

report that they shared with the Baltimore
Police to essentially advertise for their

social social media monitoring tool and
what the company was doing was again like

browsing social media and trying to
establish who were the threat actors in

these riots and among the 19 threat
actors that they identified two of them

were actually leaders of the black lives
matter movement. Actually at least one of

them was a woman definitely not a physical
threat but this is how they were

essentially labeled. So these two examples
actually show that again it's still sort

of the same targets, it's people of
colors, it's activists, it's people from

poor income backgrounds, that are singled
out as likely criminals. And it's very

telling when we realize that SOCMINT is
actually one of the sources of data that's

eventually used for predictive policing
and then again predictive policing leading

to people being more surveiled and
potentially exposed to more police

surveillance based on the fact that they
all singled out as as likely criminal. Now

social media is a fascinating place
because it's a mix between a private and a

public space as I said we are broadcasting
our views publicly but then again it's a

privately owned space where we follow the
rules that is set up by private companies.

Now, if we want to protect this space and
ensure that like free expression and

political organization can still happen on
the spaces we need to fully understand how

much the police have been exploiting the
spaces and how we can limit and regulate

the use of it. Now, I'll talk to Millie
about what we can do next. So I'm going to

briefly look at some of our initial
findings we've made using Freedom of

Information requests, broadly: the lack of
awareness by the public, weak legal basis,

and a lack of oversight. Now, sometimes
the lack of awareness appears intentional

- we asked the police about their plans to
extract data from connected devices in the

home and they replied neither confirm nor
deny. Now this is kind of a bizarre

response given that Mark Stokes who's a
member of the police had already said that

they plan to do this, in addition the UK
government Home Office replied to us

saying the Home Office plans to develop
skills and capacity to exploit the

Internet of Things as part of criminal
investigations. They also said that police

officers will receive training in relation
to extracting, obtaining, retrieving, data

from or generated by connected devices. So
we wrote back to every police force in the

UK had refused to reply to us and
presented the evidence but they maintained

their stance so we will be bringing a
challenge against them under the Freedom

of Information Act. Now, Eva has also
identified the huge risks associated with

predictive policing yet in the UK we've
found out this is set to increase with

forces either using commercial tools or
in-house ones they've developed or

planning trials for 2018. There has been
no public consultation, there are no

safeguards, and there is no oversight. So
when we ask them more questions about the

plans we were told we were 'vexatious' and
they won't respond to more requests so it

seems like we have yet another challenge,
and what about mobile phone extraction

tools here are some of the stats that have
been found out and I would say these

aren't completely accurate because it
depends on how reliable the police force

are in responding but roughly I'd say it's
probably more than 93 percent now of UK

police forces throughout the country are
extracting data from digital devices. We

know they plan to increase, we've seen in
their documents they plan to train more

officers, to buy more equipment, and to
see extraction as a standard part of

arrest, even if the devices had absolutely
nothing to do with the offense and so

these figures are likely to increase
exponentially, but in the UK not only to

the police not need a warrant in documents
we've read they do not even need to notify

the individual that they have extracted
data, for example, from their mobile phone

or that they're storing it. If this is
being done without people's knowledge how

on earth can people challenge it, how can
they ask for their data to be removed if

they're found innocent? Turning to social
media monitoring which the police refer to

as open source research. This is Jenny
Jones she's a member of the House of Lords

in the Green Party and next to her photo
is a quote from her entry on the domestic

extremism database, and so, if a member of
the House of Lords is being subject to

social media monitoring for attending a
bike ride then I think it's highly likely

that a large number of people who
legitimately exercise their right to

protest are being subject to social media
monitoring. Now, this hasn't gone

unnoticed completely although they're
slightly old these are quotes from two

officials: the first the UK independent
reviewer of terrorism who notes that the

extent of the use of social media
monitoring is not public known, and the

second is the chief surveillance
commissioner who is and this is a very

strong statement for a commissioner is
saying that basically social media should

not be treated as fair game by the police.
So now I'll move on to a weak or outdated

legal basis. For most of the technologies
we've looked at it's very unclear what

legal basis the police are using even when
we've asked them. This relates to mobile

phone extraction - so the legislation
they're relying on is over 30 years old

and is wholly inappropriate for mobile
phone extraction this law was developed to

deal with standard traditional searches,
the search of a phone can in no way be

equated to the search of a person, or the
search of a house, and despite the fact

that we have repeatedly asked for a
warrant this is not the case and we

believe that there should be a warrant in
place not only in the UK but in the rest

of the world. So if you think that either
you or your friends have had their data

extracted when they're arrested or your
phone has been in the possession of the

authorities you should be asking
questions, and very briefly something on

lack of oversight, so we reported in
January this year about documents that

were obtained by The Bristol Cable's
investigation into Cellebrite and one

report said that in half of the cases
sampled the police noted the police had

failed to receive authorization internally
for the use of extraction tools. Poor

training undermined investigations into
serious offences such as murder, and

inadequate security practices meant that
encryption was not taking place even when

it was easy to do and they were losing
files containing intimate personal data.

So why does this matter? Here are some key
points: In relation to information

asymmetry - it's clear as Eva has
explained that the police can now access

far more data on our devices than the
average user. In relation to imbalance of

power - it's clear they can collect and
analyze sources that are beyond our

control whether it's publicly placed
sensors, cameras, and other devices. There

is also unequal access and if lawyers
don't know what's being gathered they

don't know what to ask for from the
police. All in all this puts the

individual at a huge disadvantage. Another
impact is the chilling effect on political

expression now I'm sure many of you maybe
think that the police monitor your social

media but the average person is unlikely
to, and so if they start to know about

this are they going to think twice about
joining in protesting either physically or

using a hashtag, and what about who your
friends are? If they know you attend

protests are they really want to have
their data on your phone if they know that

potentially that could be extracted and
end up on a police database? It's far

easier to be anonymous face among many
people than a single isolated person

standing up to power but these new forms
of policing we have been discussing

redefine the very act of protesting by
singling out each and every one of us from

the crowd. So, what can we do? Many of you
will be familiar with these technologies,

but do you know how to find out what the
police are doing? In the UK we've been

using Freedom of Information requests, we
want to do this with people throughout

Europe and you don't need to be a lawyer
so please get in touch. We also want to

dig into the technology a bit more, I want
someone to use a Cellebrite UFED on my

phone and show me exactly what can come
out of it, and we want to tell lawyers and

activists about these new techniques. Many
lawyers I speak to who are experts in

actions against the police do not know the
police are using these tools. This means

they don't know the right questions to ask
and so it's fundamental you speak to

people who are bringing these cases and
tell them about what they can do or what

questions they should be asking, and
finally we want you to also raise the

debate, to share our research, and to
critique it, thank you.

Herald: So we've got ample enough time for
Q&A are there any questions in the hall,

yes, there's one over there.
Question: You mentioned the problem of

when they do physical extraction from the
Celebrite device it's going to get all of

the photos, all of the emails, or whatever
maybe rather than just what the

investigator needs. What is the solution
to that from your eyes is there a

technical one that these companies are
gonna have to implement - which they're

not going to - or a legal one, because on
the other side a mobile phone is a crucial

part in a any criminal investigation in
2017. So what's the workaround or the

solution to that?
Answer: I think it's both, I think the

fact that there isn't any law looking at
this and no one's discussing can there be

a technical solution or does it need to be
one where there's better regulation and

oversight so you extract everything, can
you keep it for a certain period to see

what's relevant then do you have to delete
it? The trouble is we don't see any

deletion practices and the police have
publicly stated in the media that they can

just keep everything as long as they like.
They like data you can kind of see why but

that doesn't mean they should keep
everyone's data indefinitely just in case

it's useful so I think there may be tech
solutions there may be legal ones and I

think perhaps both together as is one of
the answers. Herald: The next question

from microphone one please.
Q: I'm just wondering how those laws on

action and power given to the cops are
being sold to the UK people is it because

to fight terrorism as I said or to fight
drugs or this kind of stuff, what's the

argument used by the government to sold
that to the people.

A: I think actually one thing that's
important is to bear in mind is that I'm

not sure most of the of the public in the
UK is even aware of it, so I think unlike

the work of intelligence services an
agency where terrorism is used as the

excuse for ever more power and especially
laws that have become increasingly

invasive, actually with policing we don't
even fall in that kind of discourse

because it's actually hardly talked about
in UK. Yeah, and the mobile phone

extraction stuff we've been looking at is
low-level crimes, so that's like you

have, it could be you know a pub fight,
it could be a robbery, which that's more

serious, it could be an assault, so they
want to use it in every case. For all the

other techniques we have no idea what
they're using for that's one of the

problems.
Herald: The next question from the

internet please.
Q: When you say that there's a lack of

laws and regulations for police concerning
us in extraction and data from devices are

you talking just about UK and/or USA or do
you have any examples of other countries

who do better or worse?
A: I don't know of any country that has a

regulation on publicly available
information on social media.

Herald: Microphone number four.
Q: Thank you again for a great talk. In

terms of data exploitation an element that
I didn't hear you talk about that I'd like

to hear a little bit more is when there
are questions around who is doing the

exploitation, I know in the U.S. some FOIA
researchers get around how difficult it is

to get data from the feds by going after
local and state police departments, is

that something that you're doing or do you
have a way of addressing confusion when

people don't know what agency has the
data?

A: Yeah, I think actually what one of the
things the data exploitation program at

Privacy International is doing is actually
looking into the connection between the

private sector and governments because
obviously at the moment there's the whole

question of data brokers which is an
industry that's hardly regulated at all,

that people don't necessarily know about,
we don't, the companies that are doing it

are familiar household name. I'll let
Millie talk a lot more about the

government aspects of it. I guess the
question is again a country-by-country

basis, we work in many countries that
don't have any data protection regulations

at all so there is this first difficulty
as how do we regulate, how do we limit the

power of the state when you don't even
have the basic legislation around

data protection? One thing to bear in mind
is like the problem with companies is like

how do you also hold companies accountable
whereas with the state there is the whole

challenge of finding the right legal
framework to limit their power, but maybe

I'll let Millie talk a little bit more
about this. Yeah, with our with our FOIA

request we tend to go after everyone so
with the example of the Home Office saying

something that the other police didn't
that was because we went to all the

different state bodies and I think that
there's a good example in in the states

where there's far more research done on
what the police are doing, but they're

using the same product in the UK I think
it's axiom and they're a storage device

for body-worn camera videos, and a lawyer
in the states said that in order to access

the video containing his client he had to
agree to the terms and condition on Axioms

website which basically gave them full use
of his clients video about a crime scene.

So that's a private company having use of
this video so given that we found they're

using it in the UK we don't know if those
kind of terms and conditions exist but

it's a very real problem as they rely
increasingly on private companies.

Herald: Number two please.
Q: Thank you for your work perhaps you've

already answered this partially from other
people's questions but it looks like we

have a great way to start the process and
kind of taking the power back but you know

the state and the system certainly doesn't
want to give up this much power, how do we

actually directly, what's kind of the
endgame, what's the strategies for making

the police or the government's give up and
restore balance, is it a suit, is it

challenging through Parliament and in the
slow process of democracy, or what do you

think is the right way of doing it?
A: I never think one works on its own,

even though I'm a litigator I often think
litigation is quite a weak tactic,

particularly if you don't have the public
on side, and then again if you don't have

Parliament. So we need all of them and
they can all come through different means

so we wouldn't just focus on one of the
different countries it might be that you

go down the legal route or the down the
parliamentary route but in the UK we're

trying all different routes so for example
on mobile phone extraction in the

beginning of next year we're going to be
doing a video we're going to be doing

interviewing the public and speaking to
them about it, we're going to be going to

Parliament, and I've also been speaking to
a lot of lawyers so I'm hoping some cases

will start because those individual cases
brought by local lawyers are where also

you see a lot of change like the John Cat
case, that's one lawyer, so I think we

need all different things to see what
works and what sticks.

Herald: We haven't had number three yet.
Q: Hi, thanks for the talk, so I have a

question regarding concerning the solution
side of things because one aspect I was

missing in your talk was the economics of
the game actually because like you are

from the UK and the private sector has
like stepped in also and another public

domain the NHS to help out because funds
are missing and I would like to ask you

whether or not you think first of all the
logic is the same within the police

departments because it might also be like
cost driven aspect to limit the salaries

or because you have the problem with
police force coming in because you have to

pay their rents and automated things
especially when I'm given to the private

sector which has another whole logic of
thinking about this stuff is cost saving

and so maybe it would be a nice thing
whether if you could talk a bit about the,

I'm sorry, the attempt to maybe like get
economics a bit more into the picture when

it comes to solutions of the whole thing.
A: So I think yeah, your very right in

pointing actually the relation, well that
you compare what's happening with the NHS

and what's happening with the police
because in both the economics of

companies offering policing services arise
from the same situation there's a need of

doing more efficient policing because of
budget cuts, so the same way the NHS is

being essentially privatized due to the
budget cuts and due to the to the needs

that arise from being limited in your
finance, again there's a similar thing

with the police when you when you're
understaffed then you're more likely to

rely on on technologies to help you do
your work more efficiently because

essentially with predictive policing the
idea behind this is that if you know where

and when crime will happen then you can
focus the limited resources you have there

and not sort of look at a more global
larger picture. So I mean I'm not gonna be

here on stage advocating for more funds
for the police, I'm not gonna do that, but

I think that there is there is a desperate
need to reframe actually the narrative

around how we do policing actually and
then definitely also look at a different

perspective and a different approach to
policing because as I've tried to show

it's been a really long time since this
narrative has developed of more data leads

to crime resolution but actually what I
didn't have the time to get into in this

talk is actually all the research that are
showing that those product actually don't

work like PREDPOL is actually basically
gaslighting a lot of police officers with

their figures, the kind of figures that
are pushing and suggesting are just like

plain inaccurate, it's not accurate to
compare a city on the one year to what a

city is becoming in another year so it's
not even clear that a lot of this

project are even like properly functioning
and in a sense I don't want them to

function I'm not gonna say if we had
better predictive policing then the

problem will be solved no that is not the
question, the question is how do we have

regulation that force the police to look
differently into the way they are

conducting policing.
Herald: Number four please.

Q: So, thank you for your presentation I
have a question about SOCMINT, my opinion

SOCMINT might violate the terms of
services of for example Twitter and

Facebook have you tried to cooperate with
these companies to make them actually

enforce their TOS?
A: So actually there is two things as I

said like all companies that are doing
scraping of data and you're right in this

case they violate the terms of services of
Facebook and Twitter. Now, the other

problem is that there is already a loop to
this and actually the marketing company I

was talking about that's being used by the
UK police what they essentially do is that

they purchase the data from Facebook and
Twitter, so this is why it's interesting

because when Facebook's say we don't sell
your data, well essentially actually with

marketing tools that are there to monitor
what people say about products essentially

what you're doing is selling your data,
they're not selling necessarily like your

name or your location or things like that
but whatever you're going to be posting

publicly for example in like groups or
public pages is something that they are

going to be trying to sell to those
companies. So I think you're right and

maybe Millie will have more to say about
this. I think those companies have a role

to play but at the moment I think the
challenge we face is actually this loop

that we're facing where by purchasing the
data directly from the company they don't

face any they don't violate the terms of
services. Yeah, we've spoken a bit to the

some of the social media companies, we've
been told that one of their big focuses is

the problems of the social media
monitoring at the U.S. border and so

because there's a lot known about that
they're looking at those issues so I think

once we show more and more the problems
say in the UK or in other countries I

think it would be very interesting to look
at what's happened over the Catalan

independence vote period to see how social
media was used then. I think the companies

aren't going to react until we make them
although they probably will meet with us.

A slightly different aspect we revealed in
a different part of our work that the

intelligence agencies were gathering
social media that's probably not

groundbreaking news but it was it was
there in plain fact and so they all got a

bit concerned about how that was
happening, whether some of them knew or

some of them didn't, so the better our
research the more people speaking about it

I think they will engage, or we'll find
out are they are the police getting it

lawfully or unlawfully.
Herald: Number one please.

Q: Thanks for your talk, I have a question
on predictive policing because German

authorities in the last two years piloted pre-cops
PREDPOL projects in three states I think

and they claimed that they would never use
these techniques with data on individuals

but only aggregate data like the new
repeat stuff you presented and they

presented as just an additional tool in
their toolbox and that if use responsibly

can lead to more cost effective policing,
do you buy this argument or would you say

that there's inevitably slippery slope or
kind of like a path dependency to more

granular data assessment or evaluation
that would inevitably infringe on privacy

rights?
A: I think this goes back to the question

of like you know are we using per
listening to identify where crime is

happening or who it is who's committing a
crime but actually I think even if we if

we stick to this even if we stick to
identifying where crime is happening we

still run into problems we still run into
the fundamental problem of predictive

policing which is we only have data on
crime that have already been reported ever

or already been addressed by the police,
and that's by essence already biased data.

If we have police in some areas then we're
more likely to, you know, further police

because the solution of those companies of
those algorithm will be leading to more

suggestions that crime is is happening
more predominantly in those areas. So, as

we've seen so far is that we fall into
these fundamental problems of just

overpolicing communities that are already
overpoliced. So in a sense in terms of

well the right to privacy but also the
question of the presumption of innocence I

think purely just having trying to
cultivate data on the where crime is

happening it's not efficient policing
first of all but it's also causing

challenges for fundamental rights as well.
Yeah, I guess it's not a great comparison

but what a lot of what they're bringing in
now is a program to assist you with the

charging decision, so you've got someone
you've arrested do you charge them or not?

The police say oh well of course it's only
advisory you only have to look at how busy

a police station is to know how advisory
is that going to be and how much is it

going to sway your opinion. So the more
you use these tools the more it makes your

job easier because rather than thinking,
where are we going to go, what areas

things going to happen, who are we going
to arrest, well the computer told us to do

this so let's just do that.
Herald: Thank you and microphone number

three please.
Q: Thank you, do you think that there are

any credible arguments to be made for
limiting the police's abilities under acts

in the UK that incorporate EU level
restrictions on privacy data protection

human rights or fundamental rights and if
so do you anticipate that those arguments

might change after brexit?
A: Well they they're bringing in GDPR and

the Law Enforcement Directive now and
they're not going to scrap those once

brexit comes in. We'll still be part,
hopefully, of the European Court of Human

Rights, but not the European Court of
Justice. I think there are going to be

implications it's going to be very
interesting how they play it out they're

still going to want the data from Europol,
they want to be part of Interpol, policing

operates at a different level and I think
if they have to comply with certain laws

so that they can play with the big boys
then they probably will, but they may do

things behind the scenes, so it depends
where it works for them, but certainly the

politicians and definitely the police
wanna be part of those groups. So we'll

have to see, but we will still use them
and we'll still rely on European judgments

the force they have in a court of law may
be more difficult.

Herald: Does the internet have any
questions, nope, well then number two

please.
Q: So you've mentioned that they don't

have really good operational security and
sometimes some stuff that should not leak

leaked now within the last year we had
major data leaks all across the world like

Philippines, South Africa, just to mention
a few, now if the, security, OPSEC is so

bad in the police in Great Britain it's
not unlikely that something will happen

in Europe of a similar kind what kind of
impact do you think such a huge data leak

of private information which the police
legally stored has even if it was not

leaked by the police and it would be leaked
by a private company that had some way

access to it?
A: I I guess it depends what it what it

is, if it's a database with serious
criminals and only the bad people, then

people will think when it's
good they have that information but they

need to make it more secure. If
somehow databases which held all sorts of

information say from people's mobile
phones, innocent people's pictures, all

that kind of thing then we might see a
much wider public reaction to the tools

that are used and the safeguards, the
legal safeguards, will come a lot quicker

than probably we will achieve in the way
we're trying to go now because there'll be

a bigger public outrage.
Herald: Okay one last and hopefully short

question from microphone one.
Q: Hi, thanks for the talk was really

interesting, it's actually quite a short
question how much is a Cellebrite, and can

we buy one?
A: I did look to buy one, I think there

were some on eBay but I'm sure if they
were like the right things but a couple of

thousand pounds, but I think you have to
actually be a police force to get those

ones, maybe there are other types but
it's expensive but not unobtainable, but

I'm trying to find universities that might
have them because I think that a lot of

forensic schools I'm hoping that they
will, I know they do extractions of

laptops but I haven't found one yet that
does phones but I probably haven't asked

enough people.
Herald: So thank you very much.

34C3 Music

subtitles created by c3subtitles.de
in the year 2020. Join, and help us!