[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:00.16,0:00:13.33,Default,,0000,0000,0000,,{\i1}music{\i0}
Dialogue: 0,0:00:13.33,0:00:22.57,Default,,0000,0000,0000,,Herald: so the NSA is spying, and was\Nspying, and we had Snowden, we have a lot
Dialogue: 0,0:00:22.57,0:00:31.67,Default,,0000,0000,0000,,of documents to look at, and there is some\Nnew research on how they used geolocation
Dialogue: 0,0:00:31.67,0:00:38.57,Default,,0000,0000,0000,,methods in mobile networks. It is done by\Nthe University of Hamburg and we have here
Dialogue: 0,0:00:38.57,0:00:46.89,Default,,0000,0000,0000,,Erik who will present this research to you\Nand he has done this for the German
Dialogue: 0,0:00:46.89,0:00:52.08,Default,,0000,0000,0000,,government and for the NSA\NUntersuchungsausschuss which we call "NS
Dialogue: 0,0:00:52.08,0:01:03.16,Default,,0000,0000,0000,,Aua", which means "NS Ouch", kind of. He\Nis a PhD student and holds a master's in
Dialogue: 0,0:01:03.16,0:01:06.43,Default,,0000,0000,0000,,physics so give him a warm applause
Dialogue: 0,0:01:06.45,0:01:14.71,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:01:16.47,0:01:18.28,Default,,0000,0000,0000,,Herald: And for those coming later please
Dialogue: 0,0:01:18.28,0:01:22.55,Default,,0000,0000,0000,,go to your seats and try to be quiet. Yep,\Nthank you.
Dialogue: 0,0:01:22.55,0:01:26.34,Default,,0000,0000,0000,,Erik Sy: Hello. I'm really happy to have
Dialogue: 0,0:01:26.34,0:01:32.03,Default,,0000,0000,0000,,you all here and I welcome you to my talk\Nabout geolocation methods in mobile
Dialogue: 0,0:01:32.03,0:01:39.68,Default,,0000,0000,0000,,networks. My name is Eric Sy and I'm a PhD\Nstudent at the University of Hamburg. So,
Dialogue: 0,0:01:39.68,0:01:47.23,Default,,0000,0000,0000,,at the beginning I want to point out why\NI'm giving this talk. So the German
Dialogue: 0,0:01:47.23,0:01:53.30,Default,,0000,0000,0000,,parliamentary investigative committee\Nwanted to find out about the German
Dialogue: 0,0:01:53.30,0:01:59.91,Default,,0000,0000,0000,,involvement in US drone strikes and then\Nthe German government officials claimed
Dialogue: 0,0:01:59.91,0:02:05.73,Default,,0000,0000,0000,,that they do not know anything or they do\Nnot know any possibility how to use a
Dialogue: 0,0:02:05.73,0:02:11.12,Default,,0000,0000,0000,,phone number for targeting drone strikes\Nand the investigative committee did not
Dialogue: 0,0:02:11.12,0:02:15.85,Default,,0000,0000,0000,,really believe this statement and so they\Nasked our research group at the University
Dialogue: 0,0:02:15.85,0:02:26.25,Default,,0000,0000,0000,,of Hamburg to prepare a report and we\Nhanded in that report to the Bundestag and
Dialogue: 0,0:02:26.25,0:02:31.07,Default,,0000,0000,0000,,it was very soon after what's also\Npublished by netzpolitik.org
Dialogue: 0,0:02:31.07,0:02:32.57,Default,,0000,0000,0000,,thank you for that
Dialogue: 0,0:02:33.80,0:02:39.08,Default,,0000,0000,0000,,{\i1}Applause{\i0}
Dialogue: 0,0:02:39.08,0:02:45.52,Default,,0000,0000,0000,,E: And it contains like technical\Nmethods and approximates the accuracy to
Dialogue: 0,0:02:45.52,0:02:51.74,Default,,0000,0000,0000,,localise mobile phones and it also points\Nout which technical identifiers are
Dialogue: 0,0:02:51.74,0:03:01.53,Default,,0000,0000,0000,,required to conduct such geolocation. Now\NI give you my agenda for today. First I
Dialogue: 0,0:03:01.53,0:03:05.77,Default,,0000,0000,0000,,will speak about the purpose of\Ngeolocation data and then we are looking
Dialogue: 0,0:03:05.77,0:03:11.90,Default,,0000,0000,0000,,into a broad variety of different\Napproaches to conduct such a geolocation
Dialogue: 0,0:03:11.90,0:03:19.27,Default,,0000,0000,0000,,in mobile networks, and then we specify on\Ndrones and look into the technical methods
Dialogue: 0,0:03:19.27,0:03:26.26,Default,,0000,0000,0000,,which can be conducted with drones, and\Nand then I'm going to point out which
Dialogue: 0,0:03:26.26,0:03:34.93,Default,,0000,0000,0000,,technical identifiers we can use for such\Na geolocation. And lastly I'm going to sum
Dialogue: 0,0:03:34.93,0:03:42.90,Default,,0000,0000,0000,,up. So, the purpose of geolocation data:\Nit is a neutral technology, so we can use
Dialogue: 0,0:03:42.90,0:03:49.08,Default,,0000,0000,0000,,it for rescue missions, for example if\Nsomebody got lost in the forest or in the
Dialogue: 0,0:03:49.08,0:03:53.94,Default,,0000,0000,0000,,mountains, we can use geolocation data to\Nfind that person and rescue the person.
Dialogue: 0,0:03:53.94,0:04:03.13,Default,,0000,0000,0000,,Or, if you ever used Google Traffic, there\Nyou you can profit from monitoring traffic
Dialogue: 0,0:04:03.13,0:04:12.27,Default,,0000,0000,0000,,conditions. But we can also use it to\Ninvade the privacy of persons, for example
Dialogue: 0,0:04:12.27,0:04:16.52,Default,,0000,0000,0000,,if we identify people on surveillance\Nfootage, or if
Dialogue: 0,0:04:16.52,0:04:23.96,Default,,0000,0000,0000,,we track the location of a certain\Nindividual over a longer period, and
Dialogue: 0,0:04:23.96,0:04:32.16,Default,,0000,0000,0000,,certainly we can use this data for\Ntargeting drone strikes. However I want to
Dialogue: 0,0:04:32.16,0:04:41.19,Default,,0000,0000,0000,,point out that this data, that they are\Nnot suitable to prove the identity of a
Dialogue: 0,0:04:41.19,0:04:46.74,Default,,0000,0000,0000,,person. So if somebody is conducting a\Ndrone strike based on this data, then he
Dialogue: 0,0:04:46.74,0:04:54.18,Default,,0000,0000,0000,,is actually not knowing who he is going to\Nkill. So, on the right side you see an
Dialogue: 0,0:04:54.18,0:04:59.36,Default,,0000,0000,0000,,image of an explosion site from a Hellfire\Nmissile. A Hellfire missile is usually
Dialogue: 0,0:04:59.36,0:05:06.28,Default,,0000,0000,0000,,used by these drones and you can\Napproximate that the blast radius is
Dialogue: 0,0:05:06.28,0:05:14.34,Default,,0000,0000,0000,,around 20 meters. So we would consider a\Ntargeted drone strike if we have a
Dialogue: 0,0:05:14.34,0:05:21.97,Default,,0000,0000,0000,,geolocation method which can determine the\Nposition of a person more precise than 20
Dialogue: 0,0:05:21.97,0:05:29.82,Default,,0000,0000,0000,,meters in radius. So, the first approach\Nwhich I want to present are time
Dialogue: 0,0:05:29.82,0:05:36.28,Default,,0000,0000,0000,,measurements and the symbol which you will\Nsee down there it's a base station, for
Dialogue: 0,0:05:36.28,0:05:43.45,Default,,0000,0000,0000,,for the next couple of slides. And a base\Nstation... this is the point in a mobile
Dialogue: 0,0:05:43.45,0:05:50.76,Default,,0000,0000,0000,,network where your phone connects to. On\Nthe slides you can certainly interchange
Dialogue: 0,0:05:50.76,0:05:57.57,Default,,0000,0000,0000,,this base station with an IMSI-catcher.\NIMSI-catcher is something like a fake base
Dialogue: 0,0:05:57.57,0:06:04.86,Default,,0000,0000,0000,,station from a third party and you could\Neven build it yourself. So, the method
Dialogue: 0,0:06:04.86,0:06:11.88,Default,,0000,0000,0000,,used to calculate the position of a phone\Nis for time measurements trilateration.
Dialogue: 0,0:06:11.88,0:06:19.02,Default,,0000,0000,0000,,You have to know that that signal is\Nusually traveling with the speed of light,
Dialogue: 0,0:06:19.02,0:06:25.16,Default,,0000,0000,0000,,so when you measure the time you can also\Nmeasure the distance. And here there are
Dialogue: 0,0:06:25.16,0:06:33.80,Default,,0000,0000,0000,,three methods presented. There are "Time\Nof Arrival", where the signal moves from
Dialogue: 0,0:06:33.80,0:06:42.12,Default,,0000,0000,0000,,the hand phone to the three base stations\Nand the accuracy is between 50 and 200
Dialogue: 0,0:06:42.12,0:06:47.69,Default,,0000,0000,0000,,meters. This really depends on the cell\Nsize and they can be more precise or less
Dialogue: 0,0:06:47.69,0:06:55.24,Default,,0000,0000,0000,,precise. So, then we have "Time Difference\Nof Arrival," which is like a round-trip
Dialogue: 0,0:06:55.24,0:07:02.70,Default,,0000,0000,0000,,measurement, and we have an "Enhanced\NObserved Time Difference," where the
Dialogue: 0,0:07:02.70,0:07:09.76,Default,,0000,0000,0000,,mobile phone actually computes the\Nlocation within the cell, and the accuracy
Dialogue: 0,0:07:09.76,0:07:17.93,Default,,0000,0000,0000,,is between 50 to 125 meters.\NSo, and the next method which I want to
Dialogue: 0,0:07:17.93,0:07:25.03,Default,,0000,0000,0000,,present are angular measurements. When you\Nconduct angular measurements, then you
Dialogue: 0,0:07:25.03,0:07:30.41,Default,,0000,0000,0000,,determine the direction of arrival from\Nthe signal and afterwards you do a
Dialogue: 0,0:07:30.41,0:07:35.93,Default,,0000,0000,0000,,calculation which is called triangulation\Nand therefore you have to know the
Dialogue: 0,0:07:35.93,0:07:42.28,Default,,0000,0000,0000,,position of the base station, but also the\Nalignment of your antenna and for this
Dialogue: 0,0:07:42.28,0:07:48.20,Default,,0000,0000,0000,,method there's certainly two base stations\Nor IMSI-catchers sufficient to determine
Dialogue: 0,0:07:48.20,0:07:55.54,Default,,0000,0000,0000,,the position of the mobile phone. The\Naccuracy is usually in field experiments
Dialogue: 0,0:07:55.54,0:08:01.53,Default,,0000,0000,0000,,between 100 and 200 meters and the\Nchallenge for this method but also for the
Dialogue: 0,0:08:01.53,0:08:11.91,Default,,0000,0000,0000,,ones on the previous slides is that on the\Nnormal mobile cells you don't have a line
Dialogue: 0,0:08:11.91,0:08:18.55,Default,,0000,0000,0000,,of sight to each base station from your\Nmobile phone and so the signal gets
Dialogue: 0,0:08:18.55,0:08:27.80,Default,,0000,0000,0000,,disturbed by buildings in the way and then\Nthe accuracy becomes worse. So the next
Dialogue: 0,0:08:27.80,0:08:33.18,Default,,0000,0000,0000,,method I want to show you, I think most of\Nyou will know a little bit about GPS and
Dialogue: 0,0:08:33.18,0:08:41.21,Default,,0000,0000,0000,,how it's calculated. So satellites, GPS\Nsatellites, broadcast their time and their
Dialogue: 0,0:08:41.21,0:08:48.22,Default,,0000,0000,0000,,position, and the mobile phone uses again\Ntrilateration to calculate its position
Dialogue: 0,0:08:48.22,0:08:53.65,Default,,0000,0000,0000,,and the accuracy is usually below 10\Nmeters, but it depends a little bit on the
Dialogue: 0,0:08:53.65,0:09:02.44,Default,,0000,0000,0000,,chipset within the mobile phone, and then\Nthe base station can request the position
Dialogue: 0,0:09:02.44,0:09:09.34,Default,,0000,0000,0000,,of the phone by issuing a radio... or by\Nissuing a request with the radio resource
Dialogue: 0,0:09:09.34,0:09:16.70,Default,,0000,0000,0000,,location service protocol. So another\Nmethod which I want to present is the
Dialogue: 0,0:09:16.70,0:09:21.86,Default,,0000,0000,0000,,mining of Internet traffic. Some\Nsmartphones send GPS coordinates or the
Dialogue: 0,0:09:21.86,0:09:29.58,Default,,0000,0000,0000,,names of nearby Wi-Fi networks, which are\Nalso called SSIDs, to online services, and
Dialogue: 0,0:09:29.58,0:09:36.91,Default,,0000,0000,0000,,usually these allow the determination of\Nthe position around or below 10 meters,
Dialogue: 0,0:09:36.91,0:09:44.60,Default,,0000,0000,0000,,and it is certainly possible to intercept\Nthis traffic and evaluate the geolocation.
Dialogue: 0,0:09:44.60,0:09:51.20,Default,,0000,0000,0000,,So here I have two quotes for you, and the\Nfirst one it effectively means that anyone
Dialogue: 0,0:09:51.20,0:09:57.38,Default,,0000,0000,0000,,using Google Maps on a smartphone is\Nworking in support of a GCHQ system. This
Dialogue: 0,0:09:57.38,0:10:05.18,Default,,0000,0000,0000,,quote comes from the Snowden archive and\Nwas issued in the year 2008. So we
Dialogue: 0,0:10:05.18,0:10:10.11,Default,,0000,0000,0000,,certainly see that there's\Nsome proof that at least at those days,
Dialogue: 0,0:10:10.11,0:10:16.90,Default,,0000,0000,0000,,that they enter, some third parties\Nintercepted those traffic and use it for
Dialogue: 0,0:10:16.90,0:10:27.15,Default,,0000,0000,0000,,determining the geolocation, and if you\Nwant to work with, or determine the
Dialogue: 0,0:10:27.15,0:10:34.48,Default,,0000,0000,0000,,location with the SSIDs, it is necessary\Nthat you have a map where a certain Wi-Fi
Dialogue: 0,0:10:34.48,0:10:40.26,Default,,0000,0000,0000,,access points are located. And therefore\Nwe have also something like... like a
Dialogue: 0,0:10:40.26,0:10:47.40,Default,,0000,0000,0000,,proof that this has been done by the NSA\Nand this is the mission victory dance,
Dialogue: 0,0:10:47.40,0:10:53.39,Default,,0000,0000,0000,,where they are mapping the Wi-Fi\Nfingerprint in every major town in Yemen,
Dialogue: 0,0:10:53.39,0:10:59.13,Default,,0000,0000,0000,,and in Yemen also a lot of drone strikes\Nare conducted. So, let's go to next
Dialogue: 0,0:10:59.13,0:11:07.21,Default,,0000,0000,0000,,method. Signalling System No. 7 is a\Nprotocol which is used for communication
Dialogue: 0,0:11:07.21,0:11:15.52,Default,,0000,0000,0000,,between network providers, and network\Nproviders need to know where, in which
Dialogue: 0,0:11:15.52,0:11:21.57,Default,,0000,0000,0000,,cell, a mobile phone is located to... to\Nenable the communication, and these
Dialogue: 0,0:11:21.57,0:11:27.88,Default,,0000,0000,0000,,informations are saved in location\Nregisters, and a third party can easily
Dialogue: 0,0:11:27.88,0:11:35.78,Default,,0000,0000,0000,,request these location informations. I\Nwant to refer to the talk by Tobias Engel,
Dialogue: 0,0:11:35.78,0:11:40.71,Default,,0000,0000,0000,,which... he gave a talk two years ago\Nwhich really goes into the details of this
Dialogue: 0,0:11:40.71,0:11:48.31,Default,,0000,0000,0000,,method, and maybe if you like to, there\Nare also commercial services available to
Dialogue: 0,0:11:48.31,0:11:58.43,Default,,0000,0000,0000,,access this data. So, let's talk about\Ndrones. We do not have very solid proofs
Dialogue: 0,0:11:58.43,0:12:05.98,Default,,0000,0000,0000,,that geolocation methods are conducted by\Ndrones, but we have certainly hints. A
Dialogue: 0,0:12:05.98,0:12:15.00,Default,,0000,0000,0000,,hint is this GILGAMESH system, which is\Nbased on the PREDATOR drones, and is a
Dialogue: 0,0:12:15.00,0:12:22.09,Default,,0000,0000,0000,,method for active geolocation, which\Ndescribes an IMSI-catcher so... but if
Dialogue: 0,0:12:22.09,0:12:28.59,Default,,0000,0000,0000,,anybody of you has access to more\Ndocuments... yeah it would be nice to have
Dialogue: 0,0:12:28.59,0:12:37.17,Default,,0000,0000,0000,,a look. So...\N{\i1}applause{\i0}
Dialogue: 0,0:12:39.28,0:12:45.58,Default,,0000,0000,0000,,E: So, the easiest method would be\Ncertainly to request for GPS coordinates,
Dialogue: 0,0:12:45.58,0:12:54.03,Default,,0000,0000,0000,,and there you just replace the base\Nstation with a drone. But the method which
Dialogue: 0,0:12:54.03,0:13:01.05,Default,,0000,0000,0000,,is better, or which I think is the\Npreferred one: Angular measurements.
Dialogue: 0,0:13:02.20,0:13:08.68,Default,,0000,0000,0000,,Angular measurements, if you have a look\Nin our report, there we approximated that
Dialogue: 0,0:13:08.68,0:13:14.43,Default,,0000,0000,0000,,the accuracy of these methods are between\Nfive and thirty five meters in radius from
Dialogue: 0,0:13:14.43,0:13:20.83,Default,,0000,0000,0000,,an altitude of two kilometers, and if you\Nget closer to the mobile phone it becomes
Dialogue: 0,0:13:20.83,0:13:28.36,Default,,0000,0000,0000,,more accurate. So, it would be, to some\Nextent, sufficient to conduct a targeted
Dialogue: 0,0:13:28.36,0:13:35.55,Default,,0000,0000,0000,,drone strike on this data, and in the\Nmeantime, since this report was handed
Dialogue: 0,0:13:35.55,0:13:42.25,Default,,0000,0000,0000,,over to the Bundestag, I also found other\Nwork which described that they are able to
Dialogue: 0,0:13:42.25,0:13:47.91,Default,,0000,0000,0000,,achieve an accuracy of one meter from\Nthree kilometers altitude for small
Dialogue: 0,0:13:47.91,0:13:55.98,Default,,0000,0000,0000,,airplanes. You have to know that those\Nsensors to measure the angle of arrival,
Dialogue: 0,0:13:55.98,0:14:03.32,Default,,0000,0000,0000,,that they are usually located within the\Nwings and within the front of the plane,
Dialogue: 0,0:14:03.32,0:14:07.42,Default,,0000,0000,0000,,and when the plane becomes larger it's\Nalso easier to have a more accurate
Dialogue: 0,0:14:07.42,0:14:16.44,Default,,0000,0000,0000,,measurement. Then I want to point out that\Na single measurement can be sufficient to
Dialogue: 0,0:14:16.44,0:14:22.29,Default,,0000,0000,0000,,determine the location of a mobile phone.\NIf we can assume that the target is on the
Dialogue: 0,0:14:22.29,0:14:28.21,Default,,0000,0000,0000,,ground. So if you assume that the target\Nis maybe in a building in Yemen, so a
Dialogue: 0,0:14:28.21,0:14:34.16,Default,,0000,0000,0000,,single measurement would be sufficient on\Na low building in Yemen. And a sky scraper
Dialogue: 0,0:14:34.16,0:14:42.18,Default,,0000,0000,0000,,would be more difficult. So, and the big\Nadvantage of these methods is that
Dialogue: 0,0:14:42.18,0:14:48.29,Default,,0000,0000,0000,,environmental parameters have a very low\Ninfluence, since we can have a almost line
Dialogue: 0,0:14:48.29,0:14:59.67,Default,,0000,0000,0000,,of sight, which allows a better accuracy.\NSo now I'm going to talk about the
Dialogue: 0,0:14:59.67,0:15:06.77,Default,,0000,0000,0000,,identifiers which can be used for\Ngeolocation. Certainly the phone number
Dialogue: 0,0:15:06.77,0:15:13.81,Default,,0000,0000,0000,,and each IMSI-catcher or base station can\Nrequest, can issue an identity request to
Dialogue: 0,0:15:13.81,0:15:22.51,Default,,0000,0000,0000,,a mobile phone, and then receive the IMSI\Nor EMI. The IMSI is something like a
Dialogue: 0,0:15:22.51,0:15:31.35,Default,,0000,0000,0000,,unique description for a certain customer\Nin the the mobile network and the EMI is
Dialogue: 0,0:15:31.35,0:15:41.08,Default,,0000,0000,0000,,like a unique serial number for an device.\NSo, when we include those methods of
Dialogue: 0,0:15:41.08,0:15:51.02,Default,,0000,0000,0000,,mining Internet traffic, then we can also\Nadd a lot of more identifiers, for example
Dialogue: 0,0:15:51.02,0:15:59.75,Default,,0000,0000,0000,,an Apple ID or Android ID, MAC address,\Neven cookies or user names. If you are
Dialogue: 0,0:15:59.75,0:16:06.13,Default,,0000,0000,0000,,interested in this, you can have a look at\Nthe link I provided there. That there's a
Dialogue: 0,0:16:06.13,0:16:14.49,Default,,0000,0000,0000,,very interesting paper about this. So I\Ncome to my last slide, my summary. I
Dialogue: 0,0:16:14.49,0:16:21.70,Default,,0000,0000,0000,,showed you multiple, or a lot of different\Nmethods to localize a mobile phone, and I
Dialogue: 0,0:16:21.70,0:16:27.18,Default,,0000,0000,0000,,pointed out that a single drone can\Nlocalize a mobile phone with accuracy
Dialogue: 0,0:16:27.18,0:16:33.18,Default,,0000,0000,0000,,which is sufficient to conduct a targeted\Ndrone strike. Since this document was
Dialogue: 0,0:16:33.18,0:16:39.35,Default,,0000,0000,0000,,handed over to the Bundestag, they also\Nnever denied that these methods can be
Dialogue: 0,0:16:39.35,0:16:51.00,Default,,0000,0000,0000,,used for... or that the accuracy of these\Nmethods... is true. So then I pointed out
Dialogue: 0,0:16:51.00,0:16:58.41,Default,,0000,0000,0000,,that as an identifier the phone number,\Nthe IMSI, and the EMI each can be used for
Dialogue: 0,0:16:58.41,0:17:05.72,Default,,0000,0000,0000,,the geolocation of a mobile phone, and the\Nlast information which I want to give you
Dialogue: 0,0:17:05.72,0:17:11.76,Default,,0000,0000,0000,,is that geolocation methods cannot prove\Nthe identity of a person, and this is
Dialogue: 0,0:17:11.76,0:17:21.28,Default,,0000,0000,0000,,really important to know, that we are\Nnot... yeah. That when we conduct, or when
Dialogue: 0,0:17:21.28,0:17:25.88,Default,,0000,0000,0000,,somebody is conducting these drone\Nstrikes, that they are not aware who is
Dialogue: 0,0:17:25.88,0:17:30.92,Default,,0000,0000,0000,,actually using the phone, and so and I can\Nhappen that they are killing the wrong
Dialogue: 0,0:17:30.92,0:17:39.92,Default,,0000,0000,0000,,person. So I thank you very much, I thank\Nmy colleagues and my family and everybody.
Dialogue: 0,0:17:39.92,0:17:41.74,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:17:41.74,0:17:49.93,Default,,0000,0000,0000,,Herald: Thank you.\N{\i1}applause{\i0}
Dialogue: 0,0:17:49.93,0:17:54.43,Default,,0000,0000,0000,,H: That's great. Thank you very much. It's\Nthe first talk we have here today where we
Dialogue: 0,0:17:54.43,0:18:00.54,Default,,0000,0000,0000,,can have a lot of questions. So come on.\NYou have the microphones, number 1, number
Dialogue: 0,0:18:00.54,0:18:07.08,Default,,0000,0000,0000,,2, number 3, number 4, and ask your\Nquestions. It's the only chance to have
Dialogue: 0,0:18:07.08,0:18:19.61,Default,,0000,0000,0000,,this man answering them. No questions?\NHere's someone. No. Yeah. Sorry!
Dialogue: 0,0:18:19.61,0:18:22.25,Default,,0000,0000,0000,,Microphone: No problem.\NH: Number 4.
Dialogue: 0,0:18:22.25,0:18:28.19,Default,,0000,0000,0000,,Microphone 4: Hello. Do you know why we\Nare located in London right now when we
Dialogue: 0,0:18:28.19,0:18:32.68,Default,,0000,0000,0000,,use Google Maps here?\NH: "Do you know", can you ask me again,
Dialogue: 0,0:18:32.68,0:18:34.59,Default,,0000,0000,0000,,"do you know why we are located in\NLondon?"
Dialogue: 0,0:18:34.59,0:18:35.50,Default,,0000,0000,0000,,M4: Yes.\NH: Here?
Dialogue: 0,0:18:35.50,0:18:38.99,Default,,0000,0000,0000,,M4: When we use Google Maps, we are\Nlocated in London.
Dialogue: 0,0:18:41.33,0:18:47.43,Default,,0000,0000,0000,,H: Do you know that? The Congress is\Nlocated in London. Do you know why?
Dialogue: 0,0:18:47.43,0:18:51.35,Default,,0000,0000,0000,,E: I'm not aware.\NM4: Okay, I thought this was on plan.
Dialogue: 0,0:18:51.35,0:18:53.37,Default,,0000,0000,0000,,H: Okay.\NM4: Thank you
Dialogue: 0,0:18:53.37,0:18:57.95,Default,,0000,0000,0000,,H: Number 1.\NMicrophone 1: Okay, so on slide 12 you
Dialogue: 0,0:18:57.95,0:19:01.61,Default,,0000,0000,0000,,showed this angle of arrival-\NH: Can you please be quiet, we can't
Dialogue: 0,0:19:01.61,0:19:04.45,Default,,0000,0000,0000,,understand the questions unless you're\Nquiet. Sorry.
Dialogue: 0,0:19:04.45,0:19:11.34,Default,,0000,0000,0000,,M1: Okay, so, on slide 12 you showed the\Nangle of arrival method executed by a
Dialogue: 0,0:19:11.34,0:19:18.35,Default,,0000,0000,0000,,drone. Is this a passive method or does it\Nrequire some cooperation by either the
Dialogue: 0,0:19:18.35,0:19:21.04,Default,,0000,0000,0000,,phone company or by the targeted mobile\Nphone?
Dialogue: 0,0:19:21.04,0:19:26.17,Default,,0000,0000,0000,,E: It can be conducted passively. Like, if\Nyou call the phone or page the phone
Dialogue: 0,0:19:26.17,0:19:33.75,Default,,0000,0000,0000,,multiple times and you see which phone is\Nanswering this paging... okay, it needs to
Dialogue: 0,0:19:33.75,0:19:39.62,Default,,0000,0000,0000,,be active in a way that you contact the\Nphone, but you don't need an active IMSI-
Dialogue: 0,0:19:39.62,0:19:45.00,Default,,0000,0000,0000,,catcher for it. You just phone or call the\Nphone, and then you see which phone is
Dialogue: 0,0:19:45.00,0:19:51.69,Default,,0000,0000,0000,,answering, and then you know where the\Nphone is situated.
Dialogue: 0,0:19:51.69,0:19:53.69,Default,,0000,0000,0000,,M1: Thanks.\NE: Yeah.
Dialogue: 0,0:19:53.69,0:19:58.66,Default,,0000,0000,0000,,H: I see that we have a question over\Nthere so can you just ask your question
Dialogue: 0,0:19:58.66,0:20:00.66,Default,,0000,0000,0000,,please?\NM8: Here?
Dialogue: 0,0:20:00.66,0:20:04.52,Default,,0000,0000,0000,,H: Yes, number 8, please.\NM8: Thank you for the talk. I'd like to
Dialogue: 0,0:20:04.52,0:20:11.08,Default,,0000,0000,0000,,ask a question about tracking unpowered\Nmobile phones: I mean you mentioned lots
Dialogue: 0,0:20:11.08,0:20:16.30,Default,,0000,0000,0000,,of methods for phones which are both...\Nwith both have their batteries inserted
Dialogue: 0,0:20:16.30,0:20:21.29,Default,,0000,0000,0000,,and are actively operating. Could you\Nelaborate a bit about the methods of
Dialogue: 0,0:20:21.29,0:20:26.88,Default,,0000,0000,0000,,tracking phones, which seem to be off\Nturned off from the users point of view,
Dialogue: 0,0:20:26.88,0:20:30.42,Default,,0000,0000,0000,,and maybe also something about those who\Nhave their batteries removed?
Dialogue: 0,0:20:34.31,0:20:39.06,Default,,0000,0000,0000,,E: Actually, if you really turn off your\Nphone over a long period, let's say a
Dialogue: 0,0:20:39.06,0:20:45.01,Default,,0000,0000,0000,,couple of months, I think you are safe,\Nbut... {\i1}laughter{\i0} Buf if you...
Dialogue: 0,0:20:45.01,0:20:52.53,Default,,0000,0000,0000,,M8: That's good to know.\NE: But, actually, like if you have a base
Dialogue: 0,0:20:52.53,0:20:57.49,Default,,0000,0000,0000,,station and somebody is switching off his\Nphone and maybe he is meeting somebody
Dialogue: 0,0:20:57.49,0:21:02.98,Default,,0000,0000,0000,,else at that point and somebody else is\Nalso switching off his phone, then it can
Dialogue: 0,0:21:02.98,0:21:09.47,Default,,0000,0000,0000,,be suspicious, but it really depends\Nwhether somebody is looking into this data
Dialogue: 0,0:21:09.47,0:21:15.20,Default,,0000,0000,0000,,or not.\NH: Thank you. Number 8 again.
Dialogue: 0,0:21:15.20,0:21:24.56,Default,,0000,0000,0000,,M8: I had a short question: As you\Ndescribed, we are somehow dependent on the
Dialogue: 0,0:21:24.56,0:21:33.22,Default,,0000,0000,0000,,good winning of the NSA, for instance, and\NI wanted to ask if there's some way to
Dialogue: 0,0:21:33.22,0:21:40.23,Default,,0000,0000,0000,,avoid geolocation or use Google Maps\Nwithout sending identity to location
Dialogue: 0,0:21:40.23,0:21:45.42,Default,,0000,0000,0000,,services.\NE: That is fairly difficult. I would
Dialogue: 0,0:21:45.42,0:21:51.60,Default,,0000,0000,0000,,assume that GPS phones are a little bit\Nbetter to avoid geo-locationing,
Dialogue: 0,0:21:51.60,0:21:58.18,Default,,0000,0000,0000,,especially if you add additional GPS\Nspoofing, because they are... The network
Dialogue: 0,0:21:58.18,0:22:04.05,Default,,0000,0000,0000,,cells are really large and so it's more\Ndifficult to track you within the network
Dialogue: 0,0:22:04.05,0:22:10.62,Default,,0000,0000,0000,,cell, but if you have a drone right above\Nyou and you emit a physical signal, then
Dialogue: 0,0:22:10.62,0:22:17.64,Default,,0000,0000,0000,,the drone will always be able to localize\Nwhere the signal came from. So it's
Dialogue: 0,0:22:17.64,0:22:19.82,Default,,0000,0000,0000,,difficult, because it's physically\Ndifficult.
Dialogue: 0,0:22:19.82,0:22:23.39,Default,,0000,0000,0000,,M8: Okay.\NH: Thanks. Number 1, please.
Dialogue: 0,0:22:23.39,0:22:28.69,Default,,0000,0000,0000,,M1: So, I have a question about the\Nphysicalities of receiving a... or
Dialogue: 0,0:22:28.69,0:22:35.49,Default,,0000,0000,0000,,localizing or making angular measurement\Nof a phone within a densely populated
Dialogue: 0,0:22:35.49,0:22:40.53,Default,,0000,0000,0000,,area, where there's possibly tens of\Nthousands of phones within the receptional
Dialogue: 0,0:22:40.53,0:22:48.14,Default,,0000,0000,0000,,area of a 3-kilometer-high drone. That\Nwould obviously require you to be more
Dialogue: 0,0:22:48.14,0:22:54.58,Default,,0000,0000,0000,,sensitive on one hand than this cell tower\Nand on the other hand also receive at the
Dialogue: 0,0:22:54.58,0:22:58.24,Default,,0000,0000,0000,,same time and sort out all kinds of\Ninterference.
Dialogue: 0,0:22:58.24,0:23:06.06,Default,,0000,0000,0000,,E: You usually a cell can be between,\Nlet's say 200 meters, and 3 or 30
Dialogue: 0,0:23:06.06,0:23:11.56,Default,,0000,0000,0000,,kilometers in size, so 3 kilometers in\Naltitude it's not very high.
Dialogue: 0,0:23:11.56,0:23:18.33,Default,,0000,0000,0000,,M1: So you assume that the drone does a\Npre-selection. We are digital beamforming
Dialogue: 0,0:23:18.33,0:23:24.96,Default,,0000,0000,0000,,on the ground path and only looks at a\Ncell of interest, because it knows from
Dialogue: 0,0:23:24.96,0:23:31.96,Default,,0000,0000,0000,,the network, the suspect is in that cell.\NE: It depends on the area: In an urban
Dialogue: 0,0:23:31.96,0:23:37.77,Default,,0000,0000,0000,,area you have to reduce the size of the\Ncell, otherwise you would receive too many
Dialogue: 0,0:23:37.77,0:23:45.21,Default,,0000,0000,0000,,signals, but in a countryside you can have\Nlarger cells or you can cover a larger
Dialogue: 0,0:23:45.21,0:23:49.23,Default,,0000,0000,0000,,area.\NM1: Regarding covering larger areas: Did
Dialogue: 0,0:23:49.23,0:23:53.31,Default,,0000,0000,0000,,you take, considering that these drones\Naren't really like our quadcopter size,
Dialogue: 0,0:23:53.31,0:24:01.36,Default,,0000,0000,0000,,they're more airplane-sized, proper\Nairplanes, did you take the classical
Dialogue: 0,0:24:01.36,0:24:06.83,Default,,0000,0000,0000,,synthetic aperture radar techniques of\Nobserving something for a long time while
Dialogue: 0,0:24:06.83,0:24:11.64,Default,,0000,0000,0000,,flying straight over it and then\Nintegrating over it into account? Because
Dialogue: 0,0:24:11.64,0:24:16.65,Default,,0000,0000,0000,,that's usually where we get our high-\Nresolution radar imagery of the earth.
Dialogue: 0,0:24:16.65,0:24:22.45,Default,,0000,0000,0000,,E: You can conduct multiple measurements\Nor you just conduct one, if you know that
Dialogue: 0,0:24:22.45,0:24:26.71,Default,,0000,0000,0000,,the target is on the ground.\NM1: So, did that account for your
Dialogue: 0,0:24:26.71,0:24:31.47,Default,,0000,0000,0000,,estimated accuracy?\NE: It's not necessary to integrate.
Dialogue: 0,0:24:31.47,0:24:36.02,Default,,0000,0000,0000,,M1: Okay, thanks.\NH: Thank you. We have a question from the
Dialogue: 0,0:24:36.02,0:24:39.59,Default,,0000,0000,0000,,internet.\NSignalangel: Yes, the internet wants to
Dialogue: 0,0:24:39.59,0:24:43.50,Default,,0000,0000,0000,,know if there are attributes, which you\Ncan change of the phone, to stop
Dialogue: 0,0:24:43.50,0:24:47.01,Default,,0000,0000,0000,,surveillance. Attributes like the email,\Nfor example.
Dialogue: 0,0:24:47.01,0:24:51.73,Default,,0000,0000,0000,,E: Can you please repeat the question?\NS: Are there attributes of the phone,
Dialogue: 0,0:24:51.73,0:24:53.56,Default,,0000,0000,0000,,which you can change, to stop\Nsurveillance?
Dialogue: 0,0:24:53.56,0:24:58.74,Default,,0000,0000,0000,,E: Yes, certainly you can fake the IMEI\Nor the IMSI. That is also another reason why
Dialogue: 0,0:24:58.74,0:25:06.30,Default,,0000,0000,0000,,it's not sufficient to prove the identity,\Nbecause any phone can just take these
Dialogue: 0,0:25:06.30,0:25:09.26,Default,,0000,0000,0000,,data.\NS: And we have a second question, which
Dialogue: 0,0:25:09.26,0:25:18.09,Default,,0000,0000,0000,,is: Does the GSM network have a feature\Nwhich allows anyone to get the GPS data
Dialogue: 0,0:25:18.09,0:25:29.10,Default,,0000,0000,0000,,from the phone?\NE: Yeah..., it would be..., that.., and
Dialogue: 0,0:25:29.10,0:25:32.53,Default,,0000,0000,0000,,the radio resource location service\Nprotocol.
Dialogue: 0,0:25:32.53,0:25:38.23,Default,,0000,0000,0000,,S: So, thank you.\N{\i1}laughter{\i0}
Dialogue: 0,0:25:38.23,0:25:39.12,Default,,0000,0000,0000,,E: Yeah.\NH: Okay, number five.
Dialogue: 0,0:25:39.12,0:25:46.26,Default,,0000,0000,0000,,Microphone 5: Hello, you delivered you\Nwork to the NSA Untersuchungsausschuss and
Dialogue: 0,0:25:46.26,0:25:51.92,Default,,0000,0000,0000,,they, the Bundestag did not say anything\Nabout it, but is there a statement from
Dialogue: 0,0:25:51.92,0:25:56.54,Default,,0000,0000,0000,,the NSA Untersuchungssausschuss?\NE: And the government said something about
Dialogue: 0,0:25:56.54,0:26:04.50,Default,,0000,0000,0000,,it. They said that, that they washed their\Nhands and said we did everything nicely
Dialogue: 0,0:26:04.50,0:26:09.30,Default,,0000,0000,0000,,because we added also a disclaimer to the\Ndata we provided and that the disclaimer
Dialogue: 0,0:26:09.30,0:26:18.37,Default,,0000,0000,0000,,says that the NSA is forced to, to stick\Nto the German law and that they are not
Dialogue: 0,0:26:18.38,0:26:20.72,Default,,0000,0000,0000,,allowed to do whatever they want with this\Ndata.
Dialogue: 0,0:26:23.12,0:26:29.64,Default,,0000,0000,0000,,M5: Thank you.\NH: Very nice, number 6, please.
Dialogue: 0,0:26:29.64,0:26:38.27,Default,,0000,0000,0000,,M6: Hello, on slide 12, you got, you\Nspecify the accuracy of about five meters
Dialogue: 0,0:26:38.27,0:26:44.27,Default,,0000,0000,0000,,for two drones. So how does it scale if\Nyou would use more than two drones? For
Dialogue: 0,0:26:44.27,0:26:49.15,Default,,0000,0000,0000,,example 10 or whatever.\NE: I think that there was a small
Dialogue: 0,0:26:49.15,0:26:52.91,Default,,0000,0000,0000,,misunderstanding. Actually, one drone is\Nsufficient.
Dialogue: 0,0:26:52.91,0:26:57.14,Default,,0000,0000,0000,,M6: Okay, so could you use more than one\Ndrone?
Dialogue: 0,0:26:57.14,0:27:00.80,Default,,0000,0000,0000,,E: Yeah, you can use as many as you want\Nbut one is sufficient.
Dialogue: 0,0:27:00.80,0:27:05.45,Default,,0000,0000,0000,,{\i1}laughter{\i0}\NM6: Yeah, but that, of course. But does
Dialogue: 0,0:27:05.45,0:27:09.98,Default,,0000,0000,0000,,the accuracy increase by using more than\None?
Dialogue: 0,0:27:09.98,0:27:16.14,Default,,0000,0000,0000,,E: Yeah if you go closer to the target and\Nthen their accuracy increases.
Dialogue: 0,0:27:16.14,0:27:22.99,Default,,0000,0000,0000,,M6: Okay, but with the same distance but\Nmore than one drone?
Dialogue: 0,0:27:22.99,0:27:27.47,Default,,0000,0000,0000,,E: Actually not.\NM6: Okay, thank you.
Dialogue: 0,0:27:27.47,0:27:32.56,Default,,0000,0000,0000,,H: Number four, please.\NM4: Also referring to the accuracies, you
Dialogue: 0,0:27:32.56,0:27:37.52,Default,,0000,0000,0000,,were talking about field experiments and\Nso on. Did you conduct those yourself or
Dialogue: 0,0:27:37.52,0:27:39.60,Default,,0000,0000,0000,,where did you get all the information\Nfrom?
Dialogue: 0,0:27:39.60,0:27:43.76,Default,,0000,0000,0000,,E: These are some references, there you\Ncan find the field experiments.
Dialogue: 0,0:27:43.76,0:27:46.70,Default,,0000,0000,0000,,M4: Thank you very much.\NH: Number two, please.
Dialogue: 0,0:27:46.70,0:27:50.64,Default,,0000,0000,0000,,M2: Thank you very much for the\Ninteresting talk. My question is regarding
Dialogue: 0,0:27:50.65,0:27:56.25,Default,,0000,0000,0000,,the fingerprint which you can use on many\Nphones to unlock the phone. Is there
Dialogue: 0,0:27:56.25,0:28:01.37,Default,,0000,0000,0000,,currently and if not will there, do you\Nthink there will be a possibility that for
Dialogue: 0,0:28:01.37,0:28:05.29,Default,,0000,0000,0000,,example an app which requires the\Nfingerprint identification on the phone
Dialogue: 0,0:28:05.29,0:28:10.27,Default,,0000,0000,0000,,that this is also passively read and by\Nthat you increase the identification of
Dialogue: 0,0:28:10.27,0:28:19.12,Default,,0000,0000,0000,,persons? Did you understand the question?\NE: Yeah, but I think this is like based on
Dialogue: 0,0:28:19.12,0:28:25.96,Default,,0000,0000,0000,,the GSM network and the other I think that\Nthat's based on the operating system.
Dialogue: 0,0:28:25.96,0:28:30.09,Default,,0000,0000,0000,,M2: So currently using this technology,\Nthere they couldn't be, there, it's not
Dialogue: 0,0:28:30.09,0:28:33.24,Default,,0000,0000,0000,,possible to link this?\NE: No.
Dialogue: 0,0:28:33.24,0:28:37.52,Default,,0000,0000,0000,,M2: Ok, thank you.\NH: Ok, number one, please.
Dialogue: 0,0:28:37.52,0:28:40.80,Default,,0000,0000,0000,,M1: My question is actually about the\Ncivil use of geolocation service not so
Dialogue: 0,0:28:40.80,0:28:44.66,Default,,0000,0000,0000,,much about phones. So, you mentioned that\Nevery time you use an online service that
Dialogue: 0,0:28:44.66,0:28:51.37,Default,,0000,0000,0000,,use geolocation you send the SSids of\Nnearby Wi-Fi networks and with every
Dialogue: 0,0:28:51.37,0:28:57.76,Default,,0000,0000,0000,,request you actually enrich a Wi-Fi map,\NWi-Fi database of either Google, if it's
Dialogue: 0,0:28:57.76,0:29:04.22,Default,,0000,0000,0000,,on Android, or Apple if it's on iOS. Now,\Nthere was a talk at CCC here in 2009 when
Dialogue: 0,0:29:04.22,0:29:09.42,Default,,0000,0000,0000,,this technology was still nascent and that\Nback then was called Skyhook but then the
Dialogue: 0,0:29:09.42,0:29:15.63,Default,,0000,0000,0000,,speaker had this provocative question:\NShouldn't this Wi-Fi map be public domain
Dialogue: 0,0:29:15.63,0:29:21.41,Default,,0000,0000,0000,,instead of just a belonging proprietary\Nand belonging either to Apple or Google
Dialogue: 0,0:29:21.41,0:29:25.91,Default,,0000,0000,0000,,nowadays? So, haven't we lost that\Nstruggle? I mean we can't keep our SSids
Dialogue: 0,0:29:25.91,0:29:31.04,Default,,0000,0000,0000,,private, so shouldn't it be public domain?\NE: Yeah it would be a good idea to make it
Dialogue: 0,0:29:31.04,0:29:35.66,Default,,0000,0000,0000,,public domain I said since also a lot of\Npositive things can be created with this
Dialogue: 0,0:29:35.66,0:29:40.15,Default,,0000,0000,0000,,technology, like helping people in\Nemergency situations.
Dialogue: 0,0:29:42.75,0:29:48.47,Default,,0000,0000,0000,,H: Okay ...\NM1: I wanted to take the chance to say
Dialogue: 0,0:29:48.47,0:29:51.50,Default,,0000,0000,0000,,thanks for this talk. I'm one of the\Npeople who actually commissioned the
Dialogue: 0,0:29:51.50,0:29:57.18,Default,,0000,0000,0000,,analysis because I work in the inquiry,\Nand it was extremely helpful for us to
Dialogue: 0,0:29:57.18,0:30:02.00,Default,,0000,0000,0000,,have the analysis done because we, like\Nyou said, keep being confronted with
Dialogue: 0,0:30:02.00,0:30:07.56,Default,,0000,0000,0000,,Secret Service people who tell us that no\Nway can mobile phone numbers help in the
Dialogue: 0,0:30:07.56,0:30:12.04,Default,,0000,0000,0000,,secret war. So yeah I just wanted to say\Nthanks.
Dialogue: 0,0:30:12.04,0:30:20.12,Default,,0000,0000,0000,,{\i1}applause{\i0}\NH: Yeah, thank you very much.
Dialogue: 0,0:30:20.12,0:30:26.41,Default,,0000,0000,0000,,H: Great, so thank you also very, very\Nmuch for your work and keep on going with
Dialogue: 0,0:30:26.41,0:30:26.99,Default,,0000,0000,0000,,that.
Dialogue: 0,0:30:26.99,0:30:31.74,Default,,0000,0000,0000,,{\i1}music{\i0}
Dialogue: 0,0:30:31.74,0:30:52.00,Default,,0000,0000,0000,,subtitles created by c3subtitles.de\Nin the year 2018. Join, and help us!