[Script Info]
Title: 
[Events]
Format: Layer, Start, End, Style, Name, MarginL, MarginR, MarginV, Effect, Text
Dialogue: 0,0:00:00.00,0:00:19.24,Default,,0000,0000,0000,,{\i1}35C3 preroll music{\i0}
Dialogue: 0,0:00:19.24,0:00:24.97,Default,,0000,0000,0000,,Herald Angel: All right. It's my very big\Npleasure to introduce Roya Ensafi to you.
Dialogue: 0,0:00:24.97,0:00:31.39,Default,,0000,0000,0000,,She's gonna talk about "Censored Planet: a\NGlobal Censorship Observatory". I'm
Dialogue: 0,0:00:31.39,0:00:36.23,Default,,0000,0000,0000,,personally very interested in learning\Nmore about this project. Sounds like it's
Dialogue: 0,0:00:36.23,0:00:41.49,Default,,0000,0000,0000,,gonna be very important. So please welcome\NRoya with a huge warm round of applause.
Dialogue: 0,0:00:41.49,0:00:42.88,Default,,0000,0000,0000,,Thank you.
Dialogue: 0,0:00:42.88,0:00:48.66,Default,,0000,0000,0000,,{\i1}Applause{\i0}
Dialogue: 0,0:00:48.66,0:00:56.17,Default,,0000,0000,0000,,Roya: It's wonderful to finally make it to\NCCC. I had joined talk with multiple of my
Dialogue: 0,0:00:56.17,0:01:00.22,Default,,0000,0000,0000,,friends over the past years and the visa\Nstuff never worked out. This year I
Dialogue: 0,0:01:00.22,0:01:06.43,Default,,0000,0000,0000,,applied for a conference in August and the\Nvisa worked for coming to CCC. My name is
Dialogue: 0,0:01:06.43,0:01:11.17,Default,,0000,0000,0000,,Roya Ensafi and I'm professor at the\NUniversity of Michigan. My research
Dialogue: 0,0:01:11.17,0:01:18.07,Default,,0000,0000,0000,,focuses on security and privacy with the\Ngoal of protecting users from adversarial
Dialogue: 0,0:01:18.07,0:01:27.80,Default,,0000,0000,0000,,network. So basically I investigate\Nnetwork interference ...and somebody is
Dialogue: 0,0:01:27.80,0:01:55.77,Default,,0000,0000,0000,,interfering right now. Damn it. What the\Nheck. Cool, I'm good. Oh, no I'm not.
Dialogue: 0,0:01:55.77,0:02:07.64,Default,,0000,0000,0000,,{\i1}laughter{\i0} OK. In my lab we develop\Ntechniques and systems to be able to
Dialogue: 0,0:02:07.64,0:02:13.80,Default,,0000,0000,0000,,detect network interference often at a\Nscale and apply these frameworks and tools
Dialogue: 0,0:02:13.80,0:02:20.06,Default,,0000,0000,0000,,to be able to understand the behaviors of\Nthese actors that do the interference and
Dialogue: 0,0:02:20.06,0:02:25.04,Default,,0000,0000,0000,,use this understanding to be able to come\Nup with a defense. Today I'm going to talk
Dialogue: 0,0:02:25.04,0:02:30.03,Default,,0000,0000,0000,,about a project that is very dear to my\Nheart. The one that I spent six years
Dialogue: 0,0:02:30.03,0:02:34.56,Default,,0000,0000,0000,,working on it. And in this talk I'm going\Nto talk about censorship, internet
Dialogue: 0,0:02:34.56,0:02:41.39,Default,,0000,0000,0000,,censorship. And by that I mean any action\Nthat prevents users' access to the
Dialogue: 0,0:02:41.39,0:02:48.72,Default,,0000,0000,0000,,requested content. We have heard an\Nalarming level of censorship happening all
Dialogue: 0,0:02:48.72,0:02:53.98,Default,,0000,0000,0000,,around the world. And while it was\Npreviously multiple countries that were
Dialogue: 0,0:02:53.98,0:03:01.26,Default,,0000,0000,0000,,capable of using deep packet inspections\Nto tamper with user traffic thanks to
Dialogue: 0,0:03:01.26,0:03:08.54,Default,,0000,0000,0000,,commercialization of these DPIs now many\Ncountries are actually messing with users'
Dialogue: 0,0:03:08.54,0:03:16.95,Default,,0000,0000,0000,,data. For the first time that the users\Ntype CNN.com in their browsers, their
Dialogue: 0,0:03:16.95,0:03:22.32,Default,,0000,0000,0000,,traffic is subject to some level of\Ninterference by different actors. First
Dialogue: 0,0:03:22.32,0:03:27.15,Default,,0000,0000,0000,,for example the DNS query where the\Nmapping between the domain and the IP
Dialogue: 0,0:03:27.15,0:03:34.10,Default,,0000,0000,0000,,where the content is, can be manipulated.\NFor example the DNS assets can be a dead
Dialogue: 0,0:03:34.10,0:03:40.90,Default,,0000,0000,0000,,IP where the content is not there. If the\NDNS succeed then the users and the servers
Dialogue: 0,0:03:40.90,0:03:47.50,Default,,0000,0000,0000,,are going to establish a connection, TCP\Nhandshake and that can be easily blocked.
Dialogue: 0,0:03:47.50,0:03:53.84,Default,,0000,0000,0000,,If that succeed then users and servers\Nstart actually sending back and forth the
Dialogue: 0,0:03:53.84,0:04:00.21,Default,,0000,0000,0000,,actual data and there are enough to clear\Ntext to be the traffic encrypted or not
Dialogue: 0,0:04:00.21,0:04:06.13,Default,,0000,0000,0000,,that the DPI can detect a sensitive\Nkeyboard and send a reset package to both
Dialogue: 0,0:04:06.13,0:04:12.99,Default,,0000,0000,0000,,basically shut down the connections.\NBefore I forget let me tell you and
Dialogue: 0,0:04:12.99,0:04:18.15,Default,,0000,0000,0000,,emphasize that it's not just the\Ngovernments and the policies that impose
Dialogue: 0,0:04:18.15,0:04:25.40,Default,,0000,0000,0000,,on the ISPs that lead to censorship.\NActually server side which provides the
Dialogue: 0,0:04:25.40,0:04:31.32,Default,,0000,0000,0000,,data are also blocking users. Especially\Nif they are located in a region that they
Dialogue: 0,0:04:31.32,0:04:39.58,Default,,0000,0000,0000,,don't provide any revenue. We recently\Ninvestigated this issue of dual blocking
Dialogue: 0,0:04:39.58,0:04:49.18,Default,,0000,0000,0000,,in deep and provide more details about\Nwhat role CDNs actually provide. Imagine
Dialogue: 0,0:04:49.18,0:04:57.49,Default,,0000,0000,0000,,now we have how many users, how many ISPs,\Nhow many transit networks and how many
Dialogue: 0,0:04:57.49,0:05:02.83,Default,,0000,0000,0000,,websites. Each of which are going to have\Ntheir own policies of how to block users'
Dialogue: 0,0:05:02.83,0:05:09.86,Default,,0000,0000,0000,,access. More, censorship changes from time\Nto time, region to region and country to
Dialogue: 0,0:05:09.86,0:05:14.76,Default,,0000,0000,0000,,country. And for that reason many\Nresearchers including me have been
Dialogue: 0,0:05:14.76,0:05:20.66,Default,,0000,0000,0000,,interested in collecting data about\Ncensorship in a global way and
Dialogue: 0,0:05:20.66,0:05:29.54,Default,,0000,0000,0000,,continuously. Well, I grew up under severe\Ncensorship. Be it the university,
Dialogue: 0,0:05:29.54,0:05:35.29,Default,,0000,0000,0000,,government, more frustrating the server\Nside. And I genuinely believe that
Dialogue: 0,0:05:35.29,0:05:44.74,Default,,0000,0000,0000,,censorship take away opportunities and\Ndegrade human dignity. It is not just
Dialogue: 0,0:05:44.74,0:05:54.09,Default,,0000,0000,0000,,China, Bahrain, Turkey that does internet\Ncensorship. Actually with the DPIs become
Dialogue: 0,0:05:54.09,0:06:02.50,Default,,0000,0000,0000,,cheaper and cheaper many governments are\Nfollowing their leads. As a result
Dialogue: 0,0:06:02.50,0:06:06.68,Default,,0000,0000,0000,,Internet is becoming more and more\Nbalkanized and the users around the world
Dialogue: 0,0:06:06.68,0:06:09.87,Default,,0000,0000,0000,,are going to soon have a very very\Ndifferent pictures of what this Internet
Dialogue: 0,0:06:09.87,0:06:16.50,Default,,0000,0000,0000,,is. And we need to be able to collect the\Ndata and to be able to know what is being
Dialogue: 0,0:06:16.50,0:06:25.12,Default,,0000,0000,0000,,censored, how it's being censored, where\Nit's being censored and for how long. This
Dialogue: 0,0:06:25.12,0:06:32.51,Default,,0000,0000,0000,,data then can be used to bring\Ntransparency and accountability to
Dialogue: 0,0:06:32.51,0:06:38.78,Default,,0000,0000,0000,,governments or private companies that\Npractice internet censorship. It can help
Dialogue: 0,0:06:38.78,0:06:44.46,Default,,0000,0000,0000,,us to know where the circumvention to,\Nwhere the defense needs to be deployed. It
Dialogue: 0,0:06:44.46,0:06:49.31,Default,,0000,0000,0000,,can help us to let the users around the\Nworld to know what their governments are
Dialogue: 0,0:06:49.31,0:06:59.37,Default,,0000,0000,0000,,up to and more important provide valid and\Ngood data for the policymakers to come up
Dialogue: 0,0:06:59.37,0:07:07.86,Default,,0000,0000,0000,,with the good policies. Existing research\Nalready shows that if we can provide this
Dialogue: 0,0:07:07.86,0:07:17.86,Default,,0000,0000,0000,,data to users they act by their own will\Nto ensure Internet freedom. For many years
Dialogue: 0,0:07:17.86,0:07:22.62,Default,,0000,0000,0000,,my goal has been to come up with a weather\Nmap, a censorship weather map where you
Dialogue: 0,0:07:22.62,0:07:27.20,Default,,0000,0000,0000,,can actually see changes in censorship\Nover time, how some countries are
Dialogue: 0,0:07:27.20,0:07:34.10,Default,,0000,0000,0000,,different from others and do that for a\Ncontinuous duration of time, and for all
Dialogue: 0,0:07:34.10,0:07:41.71,Default,,0000,0000,0000,,over the world. Creating such a map was\Nimpossible with the techniques, Internet
Dialogue: 0,0:07:41.71,0:07:46.92,Default,,0000,0000,0000,,measurement methods that we had at that\Ntime. At the time and even the common
Dialogue: 0,0:07:46.92,0:07:53.78,Default,,0000,0000,0000,,techniques we now use. The measurement\Nmethods to be able to use for measuring
Dialogue: 0,0:07:53.78,0:07:59.08,Default,,0000,0000,0000,,internet censorship is often by deploying\Na software or giving your customized
Dialogue: 0,0:07:59.08,0:08:05.69,Default,,0000,0000,0000,,Raspberry Pi to either a client or a\Nserver and based on that measure what's
Dialogue: 0,0:08:05.69,0:08:12.55,Default,,0000,0000,0000,,happening between client and servers.\NWell, this approach has a lot of
Dialogue: 0,0:08:12.55,0:08:18.05,Default,,0000,0000,0000,,limitations. For example there are not\Nthat many volunteers around the whole
Dialogue: 0,0:08:18.05,0:08:25.41,Default,,0000,0000,0000,,world that are eager to download a\Nsoftware and run it. Second, the data
Dialogue: 0,0:08:25.41,0:08:33.19,Default,,0000,0000,0000,,collected from this approach are often not\Ncontinuous because the user's connection
Dialogue: 0,0:08:33.19,0:08:37.96,Default,,0000,0000,0000,,can die for a variety of reasons or users\Nmay loose interest to keep running the
Dialogue: 0,0:08:37.96,0:08:45.45,Default,,0000,0000,0000,,software. And therefore we end up with\Nsparse data where we cannot have a good
Dialogue: 0,0:08:45.45,0:08:53.45,Default,,0000,0000,0000,,baseline for internet censorship studies.\NMore measuring domains that are sensitive
Dialogue: 0,0:08:53.45,0:08:59.80,Default,,0000,0000,0000,,often create risks for the local\Ncollaborators and might end up with their
Dialogue: 0,0:08:59.80,0:09:09.81,Default,,0000,0000,0000,,government's retaliate. These risks are\Nnot hypothetical. When the Arab Spring was
Dialogue: 0,0:09:09.81,0:09:17.24,Default,,0000,0000,0000,,happening I was approached by many\Ncolleagues to recruit local friends and
Dialogue: 0,0:09:17.24,0:09:24.34,Default,,0000,0000,0000,,colleagues in Middle East to be able to\Ncollect measurement data at the time that
Dialogue: 0,0:09:24.34,0:09:30.01,Default,,0000,0000,0000,,was very interesting to capture the\Nbehavior of the network and most dangerous
Dialogue: 0,0:09:30.01,0:09:36.45,Default,,0000,0000,0000,,for the locals, and volunteers to collect\Nthat. My painting actually expressed what
Dialogue: 0,0:09:36.45,0:09:44.09,Default,,0000,0000,0000,,I felt at the time. I can't just imagine\Nasking people on the ground to help at
Dialogue: 0,0:09:44.09,0:09:54.81,Default,,0000,0000,0000,,these times of unrest. In my opinion,\Nconspiring to collect the data against the
Dialogue: 0,0:09:54.81,0:10:02.45,Default,,0000,0000,0000,,government's interest can be seen as an\Nact of treason. And these governments are
Dialogue: 0,0:10:02.45,0:10:11.77,Default,,0000,0000,0000,,unpredictable often. So it has exposed\Nthese volunteers to a severe risk. While
Dialogue: 0,0:10:11.77,0:10:19.03,Default,,0000,0000,0000,,no one has yet been arrested because of\Nmeasuring internet censorship as far as we
Dialogue: 0,0:10:19.03,0:10:25.74,Default,,0000,0000,0000,,know, and I don't know how we can know\Nthat on a global scale, I think the clouds
Dialogue: 0,0:10:25.74,0:10:34.21,Default,,0000,0000,0000,,are on the horizon. I'm still at awe how\NTurkish government used their surveillance
Dialogue: 0,0:10:34.21,0:10:42.41,Default,,0000,0000,0000,,data at a time of a co-op and tracked down\Nand detained hundreds of users because
Dialogue: 0,0:10:42.41,0:10:49.40,Default,,0000,0000,0000,,there was a traffic between them and by\Nluck a messenger app that was used by co-
Dialogue: 0,0:10:49.40,0:10:57.41,Default,,0000,0000,0000,,op administrators. These things happens.\NBefore I continue, if you know OONI you
Dialogue: 0,0:10:57.41,0:11:08.09,Default,,0000,0000,0000,,might ask how OONI prevents risk. Well,\Nwith a great level of efforts. And if you
Dialogue: 0,0:11:08.09,0:11:12.13,Default,,0000,0000,0000,,don't know OONI, OONI is a global\Ncommunity of volunteers that collect data
Dialogue: 0,0:11:12.13,0:11:20.84,Default,,0000,0000,0000,,about censorship around the world. Well,\Nfirst and foremost they provide their
Dialogue: 0,0:11:20.84,0:11:27.99,Default,,0000,0000,0000,,volunteers with the very honest consent,\Ntelling them that "hey, if you run this
Dialogue: 0,0:11:27.99,0:11:34.56,Default,,0000,0000,0000,,software, anybody who is monitoring your\Ntraffic know what you're up to." They also
Dialogue: 0,0:11:34.56,0:11:39.39,Default,,0000,0000,0000,,go out of their way to give freedom to\Nthese volunteers to choose what website
Dialogue: 0,0:11:39.39,0:11:46.01,Default,,0000,0000,0000,,they want to run, what data they want to\Npush. They establish a great relationship
Dialogue: 0,0:11:46.01,0:11:53.94,Default,,0000,0000,0000,,with the local activist organization in\Nthe countries. Well, now that I prove to
Dialogue: 0,0:11:53.94,0:11:59.25,Default,,0000,0000,0000,,you guys that I am a supporter of OONI and\NI am actually friends with most of them; I
Dialogue: 0,0:11:59.25,0:12:05.30,Default,,0000,0000,0000,,want to emphasize that I still believe\Nthat consistent and continuous and global
Dialogue: 0,0:12:05.30,0:12:12.20,Default,,0000,0000,0000,,data about censorship requires a new\Napproach that doesn't need volunteers'
Dialogue: 0,0:12:12.20,0:12:21.88,Default,,0000,0000,0000,,help. I've become obsessed with solving\Nthis problems. What if we could measure
Dialogue: 0,0:12:21.88,0:12:29.16,Default,,0000,0000,0000,,without a client, in anywhere around the\Nworld, can talk to a server without being
Dialogue: 0,0:12:29.16,0:12:36.29,Default,,0000,0000,0000,,close to a client. Somewhere from here,\Nfrom University of Michigan. And see
Dialogue: 0,0:12:36.29,0:12:42.30,Default,,0000,0000,0000,,whether the two hosts can talk to each\Nother, globally and remotely, off the
Dialogue: 0,0:12:42.30,0:12:50.22,Default,,0000,0000,0000,,path. When I talk to the people about\Nthis, honestly, everybody was like "you
Dialogue: 0,0:12:50.22,0:12:54.19,Default,,0000,0000,0000,,don't know what you're talking about, it's\Nreally really challenging". Well, they
Dialogue: 0,0:12:54.19,0:13:01.37,Default,,0000,0000,0000,,were right. The challenge is there, and\NI'm going to walk you through it. We have
Dialogue: 0,0:13:01.37,0:13:06.76,Default,,0000,0000,0000,,at least 140 million IP addresses that\Nrespond to same packet. This means they
Dialogue: 0,0:13:06.76,0:13:15.53,Default,,0000,0000,0000,,speak to the world, and they follow\Nblindly TCP/IP protocol. So the question
Dialogue: 0,0:13:15.53,0:13:24.40,Default,,0000,0000,0000,,becomes: how can I leverage the subtle\Nproperties of TCP/IP to be able to detect
Dialogue: 0,0:13:24.40,0:13:36.08,Default,,0000,0000,0000,,that two hosts can talk to each other?\NWell, Spooky Scan is a technique that Jed
Dialogue: 0,0:13:36.08,0:13:43.09,Default,,0000,0000,0000,,Crandall from University of New Mexico and\NI developed that uses TCP/IP side channels
Dialogue: 0,0:13:43.09,0:13:49.77,Default,,0000,0000,0000,,to be able to detect whether the two\Nremote hosts can establish a TCP handshake
Dialogue: 0,0:13:49.77,0:13:56.89,Default,,0000,0000,0000,,or not, and if not, in which direction the\Npackets are being dropped. Off the path
Dialogue: 0,0:13:56.89,0:14:03.78,Default,,0000,0000,0000,,and remotely. And I'm gonna start telling\Nyou how this works. First I have to cover
Dialogue: 0,0:14:03.78,0:14:10.81,Default,,0000,0000,0000,,some background. So any connection that is\Nbased on TCP, one of the basic
Dialogue: 0,0:14:10.81,0:14:15.95,Default,,0000,0000,0000,,communication protocols we have, is it\Nneeds to establish a TCP handshake. So
Dialogue: 0,0:14:15.95,0:14:22.73,Default,,0000,0000,0000,,basically you should, you send a SYN and\Nin the packet you send, in the IP header,
Dialogue: 0,0:14:22.73,0:14:30.75,Default,,0000,0000,0000,,you have a field called "identification\NIP_ID", and this field is used for
Dialogue: 0,0:14:30.75,0:14:36.61,Default,,0000,0000,0000,,fragmentation reason, and I'm going to use\Nthis field a lot in the rest of the talk.
Dialogue: 0,0:14:36.61,0:14:42.30,Default,,0000,0000,0000,,After the user received a SYN, it is going\Nto send a SYN-ACK back, have another IP_ID
Dialogue: 0,0:14:42.30,0:14:47.52,Default,,0000,0000,0000,,in it. And then, if I want to establish a\Nconnection I send ACK. Otherwise I send a
Dialogue: 0,0:14:47.52,0:14:56.07,Default,,0000,0000,0000,,RESET (RST). Part of the protocol says\Nthat if you send a SYN-ACK packet to a
Dialogue: 0,0:14:56.07,0:15:01.31,Default,,0000,0000,0000,,machine with a port open or closed, it's\Ngoing to send you a RST, telling you "what
Dialogue: 0,0:15:01.31,0:15:05.22,Default,,0000,0000,0000,,the heck you are sending me SYN-ACK, I\Ndidn't send you a SYN" and another part
Dialogue: 0,0:15:05.22,0:15:09.35,Default,,0000,0000,0000,,said: if you send a SYN packet to a\Nmachine with the port open, eager to
Dialogue: 0,0:15:09.35,0:15:13.88,Default,,0000,0000,0000,,establish connection, it will send you a\NSYN-ACK. If you don't do anything, because
Dialogue: 0,0:15:13.88,0:15:20.04,Default,,0000,0000,0000,,TCP/IP is reliable, it's going to send you\Nmultple SYN-ACK. It depends on operating
Dialogue: 0,0:15:20.04,0:15:30.24,Default,,0000,0000,0000,,system, 3, 5, you name it. Spooky Scan\Nrequires some basic characteristics. For
Dialogue: 0,0:15:30.24,0:15:36.74,Default,,0000,0000,0000,,example, the client, the vantage points\Nthat we are interested, should maintain a
Dialogue: 0,0:15:36.74,0:15:44.06,Default,,0000,0000,0000,,global variable for the IP_ID. It means\Nthat, when they receive the packets and
Dialogue: 0,0:15:44.06,0:15:48.65,Default,,0000,0000,0000,,they want to send a packet out, no matter\Nwho they're sending the packet to, this
Dialogue: 0,0:15:48.65,0:15:53.59,Default,,0000,0000,0000,,IP_ID is going to be a shared resource, as\Nin going to be increment by one. So by
Dialogue: 0,0:15:53.59,0:15:57.90,Default,,0000,0000,0000,,just watching the IP_ID changes you can\Nsee how much a machine is noisy, how much
Dialogue: 0,0:15:57.90,0:16:03.82,Default,,0000,0000,0000,,a machine is sending traffic out. A server\Nshould have a port open, let's say 80 or
Dialogue: 0,0:16:03.82,0:16:08.91,Default,,0000,0000,0000,,443, and wants to establish a connection,\Nand the measurement machine, me, should be
Dialogue: 0,0:16:08.91,0:16:15.36,Default,,0000,0000,0000,,able to spoof packets. It means sending\Npacket with the source IP different from
Dialogue: 0,0:16:15.36,0:16:20.52,Default,,0000,0000,0000,,my own machine. To be able to do that, you\Nneed to talk to upstream network and ask
Dialogue: 0,0:16:20.52,0:16:28.26,Default,,0000,0000,0000,,them not to drop the packets. All of these\Nrequirements I could easily satisfy with a
Dialogue: 0,0:16:28.26,0:16:36.56,Default,,0000,0000,0000,,little bit of effort. A Spooky Scan starts\Nwith measurement machine send a SYN-ACK
Dialogue: 0,0:16:36.56,0:16:41.31,Default,,0000,0000,0000,,packet to one of this client with a global\NIP_ID, at a time let's say the value is
Dialogue: 0,0:16:41.31,0:16:49.01,Default,,0000,0000,0000,,7000. The client is going to send back a\NRST, following the protocol, revealing to
Dialogue: 0,0:16:49.01,0:16:53.88,Default,,0000,0000,0000,,me what the value of IP_ID. In the next\Nstep I'm going to send a spoofed SYN
Dialogue: 0,0:16:53.88,0:17:01.78,Default,,0000,0000,0000,,packet to a server using a client IP. As a\Nresult, the SYN-ACK is going to be sent to
Dialogue: 0,0:17:01.78,0:17:06.29,Default,,0000,0000,0000,,the client. Again, client is going to send\Na RST back, the IP_ID is going to be
Dialogue: 0,0:17:06.29,0:17:11.24,Default,,0000,0000,0000,,incremented by 1. Next time I query IP_ID\NI'm going to see a jump too. In a
Dialogue: 0,0:17:11.24,0:17:17.19,Default,,0000,0000,0000,,noiseless model, I know that this machine\Ntalked to the server. If I query it again,
Dialogue: 0,0:17:17.19,0:17:25.07,Default,,0000,0000,0000,,I won't see any jump. So, Delta 2, Delta\N1. Now imagine there is a firewall that
Dialogue: 0,0:17:25.07,0:17:32.52,Default,,0000,0000,0000,,blocks the SYN-ACKs going from the server\Nto the client. Well, it doesn't matter how
Dialogue: 0,0:17:32.52,0:17:36.86,Default,,0000,0000,0000,,much of the traffic I send, it's not going\Nto get there. It's not going to get there.
Dialogue: 0,0:17:36.86,0:17:44.39,Default,,0000,0000,0000,,So the delta I see is 1, 1. In the third\Ncase when the packets are going to be
Dialogue: 0,0:17:44.39,0:17:49.79,Default,,0000,0000,0000,,dropped from the client to the server:\NWell, my SYN-ACK gets there. The SYN-ACK
Dialogue: 0,0:17:49.79,0:17:55.03,Default,,0000,0000,0000,,gets to the client, the client is going to\Nset the RST back, but it's not going to
Dialogue: 0,0:17:55.03,0:17:59.47,Default,,0000,0000,0000,,get to the server. And so server thinks\Nthat a packet got dropped, so it's going
Dialogue: 0,0:17:59.47,0:18:07.04,Default,,0000,0000,0000,,to send multiple SYN-ACK. And as a result\Nthe RST is going to be plus plus more. And
Dialogue: 0,0:18:07.04,0:18:13.69,Default,,0000,0000,0000,,so what jump I would see is, let's say, 2,\N2. Let me put them all together. So you
Dialogue: 0,0:18:13.69,0:18:19.67,Default,,0000,0000,0000,,have 3 cases. Blocking in this direction.\NNo blocking and blocking in the other. And
Dialogue: 0,0:18:19.67,0:18:25.89,Default,,0000,0000,0000,,you see different jumps or different\Ndeltas. So it's detectable. Yes, yes, in a
Dialogue: 0,0:18:25.89,0:18:31.77,Default,,0000,0000,0000,,noiseless model. I know the clients talk\Nto so many others and the IP_ID is going
Dialogue: 0,0:18:31.77,0:18:37.59,Default,,0000,0000,0000,,to be changed because of a variety of\Nreason. I call all of those noise. And
Dialogue: 0,0:18:37.59,0:18:42.87,Default,,0000,0000,0000,,this is how we are going to deal with it.\NWell, intuitively thinking we can amplify
Dialogue: 0,0:18:42.87,0:18:47.94,Default,,0000,0000,0000,,the signal. We can actually instead of\Nsending one spoofed SYN packet we can send
Dialogue: 0,0:18:47.94,0:18:55.31,Default,,0000,0000,0000,,n. And for a variety of reasons packets\Ncan get dropped. So we need to repeat this
Dialogue: 0,0:18:55.31,0:19:04.36,Default,,0000,0000,0000,,measurement. So here is some data from a\NSpooky Scan where I used the following
Dialogue: 0,0:19:04.36,0:19:13.30,Default,,0000,0000,0000,,probing method. For 30 seconds I spoofed\Nthe, I've sent a query for IP_ID. And then
Dialogue: 0,0:19:13.30,0:19:20.56,Default,,0000,0000,0000,,for another 30 seconds I send these 5\Nspoofed SYN packets. This is machines or
Dialogue: 0,0:19:20.56,0:19:26.68,Default,,0000,0000,0000,,clients in Azerbaijan, China and United\NStates. And we wanted to check whether it
Dialogue: 0,0:19:26.68,0:19:32.98,Default,,0000,0000,0000,,has reached the TOR-relay that we had in\NSweden. You can see there are different
Dialogue: 0,0:19:32.98,0:19:40.28,Default,,0000,0000,0000,,jump or different levels-shift that you\Nobserve in a second phase. And just
Dialogue: 0,0:19:40.28,0:19:45.29,Default,,0000,0000,0000,,visually looking at it or using auto-\Nregressive moving average or ARMA you
Dialogue: 0,0:19:45.29,0:19:51.12,Default,,0000,0000,0000,,can actually detect that. But there is an\Ninsight here, which is that not all the
Dialogue: 0,0:19:51.12,0:19:56.52,Default,,0000,0000,0000,,clients have the same level of noise. And\Nfor which, for some of them, especially
Dialogue: 0,0:19:56.52,0:20:01.63,Default,,0000,0000,0000,,these guys, you could easily detect after\Nfive level of sending IP_ID-query and then
Dialogue: 0,0:20:01.63,0:20:10.77,Default,,0000,0000,0000,,five seconds of spoofing. So in the\Nfollow-up work we tried to use this
Dialogue: 0,0:20:10.77,0:20:16.48,Default,,0000,0000,0000,,insight, to be able to come up with a\Nscalable and efficient technique to be
Dialogue: 0,0:20:16.48,0:20:24.90,Default,,0000,0000,0000,,able to use it in a global way. And that\Ntechnique is called "Augur". Well Augur
Dialogue: 0,0:20:24.90,0:20:32.92,Default,,0000,0000,0000,,adopts this probing method. First, for four\Nseconds it queries IP_ID, then in one
Dialogue: 0,0:20:32.92,0:20:42.16,Default,,0000,0000,0000,,second sends 10 spoofed SYN-packets. Then\Nlook at the IP_ID-acceleration or second
Dialogue: 0,0:20:42.16,0:20:49.60,Default,,0000,0000,0000,,derivative, and see whether we see a jump,\Na sudden jump at the time of perturbation,
Dialogue: 0,0:20:49.60,0:20:55.52,Default,,0000,0000,0000,,when we did the spoofing. How confident we\Nare that that jump is the result of our
Dialogue: 0,0:20:55.52,0:21:02.29,Default,,0000,0000,0000,,own spoofed packet? Well, I'm not\Nconfident, run it again. I think so, run
Dialogue: 0,0:21:02.29,0:21:09.28,Default,,0000,0000,0000,,it again, until you have a sufficient\Nconfidence. It turns out there is a
Dialogue: 0,0:21:09.28,0:21:15.23,Default,,0000,0000,0000,,statistical analysis called "sequential\Nhypothesis testing" that can be used to be
Dialogue: 0,0:21:15.23,0:21:23.30,Default,,0000,0000,0000,,able to gradually improve our confidence\Nabout the case we're detecting. So I'm
Dialogue: 0,0:21:23.30,0:21:28.34,Default,,0000,0000,0000,,going to give you a very, very rough\Noverview of how this works. But for
Dialogue: 0,0:21:28.34,0:21:36.81,Default,,0000,0000,0000,,sequential hypothesis testing we need to\Ndefine a random variable. And we use
Dialogue: 0,0:21:36.81,0:21:42.91,Default,,0000,0000,0000,,IP_ID-acceleration at the time of\Nperturbation, being 1 or 0, based on you
Dialogue: 0,0:21:42.91,0:21:53.57,Default,,0000,0000,0000,,see jump or not. We also need to calculate\Nsome empirical priors, known
Dialogue: 0,0:21:53.57,0:21:59.45,Default,,0000,0000,0000,,probabilities. If you look at everything,\Nwhat would be the probability that you see
Dialogue: 0,0:21:59.45,0:22:08.18,Default,,0000,0000,0000,,jump when there is actually no blocking?\NAnd so on. After we put all this together
Dialogue: 0,0:22:08.18,0:22:16.15,Default,,0000,0000,0000,,then we can formalize an algorithm\Nstarting by run a trial. Update the
Dialogue: 0,0:22:16.15,0:22:20.94,Default,,0000,0000,0000,,sequence of values for the random\Nvariables. Then check whether this
Dialogue: 0,0:22:20.94,0:22:27.32,Default,,0000,0000,0000,,sequence of values belongs to the\Ndistribution of where the blocking happen
Dialogue: 0,0:22:27.32,0:22:32.59,Default,,0000,0000,0000,,or not. What's the likelihood of that? If\Nyou're confident, if we reached the level
Dialogue: 0,0:22:32.59,0:22:39.13,Default,,0000,0000,0000,,that we are satisfied, then we call it a\Ncase. So putting all this together this is
Dialogue: 0,0:22:39.13,0:22:47.72,Default,,0000,0000,0000,,how Augur works. We scan the whole IPv4,\Nfind global IP_ID-machines. And then we
Dialogue: 0,0:22:47.72,0:22:55.87,Default,,0000,0000,0000,,have some constraint that is it a stable\Nmachine? Is it a noisier or have a noise
Dialogue: 0,0:22:55.87,0:23:02.17,Default,,0000,0000,0000,,that you want to deal with? We also need\Nto figure out what website are we
Dialogue: 0,0:23:02.17,0:23:09.29,Default,,0000,0000,0000,,interested to test reachability towards?\NWhat countries we are? So after we decide
Dialogue: 0,0:23:09.29,0:23:18.50,Default,,0000,0000,0000,,all the input then we run a scheduler\Nmaking sure that no client and server are
Dialogue: 0,0:23:18.50,0:23:26.16,Default,,0000,0000,0000,,under the measurement in the same time\Nbecause they mess each other's detection.
Dialogue: 0,0:23:26.16,0:23:32.50,Default,,0000,0000,0000,,And then we actually use our analysis to\Nbe able to call the case and summarize the
Dialogue: 0,0:23:32.50,0:23:39.19,Default,,0000,0000,0000,,results. I started by saying that the\Ncommon methods have this limitation, for
Dialogue: 0,0:23:39.19,0:23:45.37,Default,,0000,0000,0000,,example coverage continuity and ethics.\NWell, when it comes to coverage there are
Dialogue: 0,0:23:45.37,0:23:52.62,Default,,0000,0000,0000,,more than 22-million global IP_ID-\Nmachines. These are WindowsXP or
Dialogue: 0,0:23:52.62,0:24:02.57,Default,,0000,0000,0000,,predecessors. And FreeBSDs for\Nexample. Compared to the previous board,
Dialogue: 0,0:24:02.57,0:24:07.91,Default,,0000,0000,0000,,one successful project is the RIPE-atlas,\Nand they have around 10000 probes globally
Dialogue: 0,0:24:07.91,0:24:18.97,Default,,0000,0000,0000,,deployed. When it comes to continuity we\Ndon't depend on the end user. So it's much
Dialogue: 0,0:24:18.97,0:24:28.72,Default,,0000,0000,0000,,more reliable to use this. Well, by not\Nasking volunteers to help we were already
Dialogue: 0,0:24:28.72,0:24:34.57,Default,,0000,0000,0000,,reducing the risk. Because there is no\Nusers conspiring against their governments
Dialogue: 0,0:24:34.57,0:24:43.00,Default,,0000,0000,0000,,to collect this data. But our approach is\Nnot also zero risk. If you look you have a
Dialogue: 0,0:24:43.00,0:24:49.86,Default,,0000,0000,0000,,different kind of risk here. The client\Nand server exchanging SYN-ACK and RST
Dialogue: 0,0:24:49.86,0:24:55.81,Default,,0000,0000,0000,,without each of them giving a consent. And\Nwe don't want to ask for consent. Because
Dialogue: 0,0:24:55.81,0:25:01.02,Default,,0000,0000,0000,,if you do, the dilemma exists. We have to\Ngo back and it's just the same that's
Dialogue: 0,0:25:01.02,0:25:06.85,Default,,0000,0000,0000,,asking volunteers. So, to deal with that\Nand cope with that, to reduce the risk
Dialogue: 0,0:25:06.85,0:25:15.38,Default,,0000,0000,0000,,more, we don't use end-IPs. We actually\Nuse 2 hops back, routers which high
Dialogue: 0,0:25:15.38,0:25:21.65,Default,,0000,0000,0000,,probability they are infrastructure\Nmachines and use those as a vantage point.
Dialogue: 0,0:25:21.65,0:25:31.49,Default,,0000,0000,0000,,Even in this harsh constraint we still\Nhave 53000 global IP_ID-routers. To test
Dialogue: 0,0:25:31.49,0:25:38.78,Default,,0000,0000,0000,,the framework to see that whether Augur\Nworks we chose 2000 of these global IP_ID-
Dialogue: 0,0:25:38.78,0:25:45.35,Default,,0000,0000,0000,,machines, uniformly selected from all the\Ncountries we had vantage point. We
Dialogue: 0,0:25:45.35,0:25:52.55,Default,,0000,0000,0000,,selected websites from Citizen Lab\NTestlist. This is the research
Dialogue: 0,0:25:52.55,0:25:57.71,Default,,0000,0000,0000,,organization in Toronto University where\Nthey crowdsourced websites that are
Dialogue: 0,0:25:57.71,0:26:03.07,Default,,0000,0000,0000,,potentially being blocked or potential\Nsensitive. And then we used thousands of
Dialogue: 0,0:26:03.07,0:26:09.64,Default,,0000,0000,0000,,the websites from Alexa top-10k. And then\Nwe get the Augur running for 17 days and
Dialogue: 0,0:26:09.64,0:26:17.05,Default,,0000,0000,0000,,collect this data. One of the challenges\Nthat we have to validate Augur was like:
Dialogue: 0,0:26:17.05,0:26:22.94,Default,,0000,0000,0000,,So, what is the truth? What is the ground-\Ntruth? What would we see that makes sense?
Dialogue: 0,0:26:22.94,0:26:26.27,Default,,0000,0000,0000,,So, and this is the biggest and\Nfundamental challenge for internet-
Dialogue: 0,0:26:26.27,0:26:33.57,Default,,0000,0000,0000,,censorship anyway. But so the first\Napproach is leaning on intuition, which is
Dialogue: 0,0:26:33.57,0:26:40.05,Default,,0000,0000,0000,,like no client should show blocking\Ntowards all the websites. No server should
Dialogue: 0,0:26:40.05,0:26:45.74,Default,,0000,0000,0000,,show blocking for bulk of our clients. And\Nif anything happens like that we just
Dialogue: 0,0:26:45.74,0:26:51.96,Default,,0000,0000,0000,,trash it. And we should see more bias\Ntowards the sensitive domain versus the
Dialogue: 0,0:26:51.96,0:27:01.56,Default,,0000,0000,0000,,ones that are popular. And so on. And also\Nwe hope to replicate the anecdotes, the
Dialogue: 0,0:27:01.56,0:27:08.87,Default,,0000,0000,0000,,reports out there. And we did all of\Nthose. And that's how we validate Augur.
Dialogue: 0,0:27:08.87,0:27:17.69,Default,,0000,0000,0000,,So at the end Augur is a system that is as\Nscalable and efficient, ethical and can be
Dialogue: 0,0:27:17.69,0:27:24.63,Default,,0000,0000,0000,,used to detect TCP/IP-blocking\Ncontinuously. Yes I know that is just
Dialogue: 0,0:27:24.63,0:27:32.31,Default,,0000,0000,0000,,TCP/IP. What about the other layers? Can\Nwe measure them remotely as well? Well,
Dialogue: 0,0:27:32.31,0:27:40.09,Default,,0000,0000,0000,,let me focus on the DNS. You might ask: Is\Nthere a way that we can remotely detect
Dialogue: 0,0:27:40.09,0:27:46.89,Default,,0000,0000,0000,,DNS poisoning or manipulation? Well let's\Nthink it out loud. From now on I'm gonna
Dialogue: 0,0:27:46.89,0:27:54.37,Default,,0000,0000,0000,,give just the highlights of the papers we\Nwork for the lack of the time. Well, if we
Dialogue: 0,0:27:54.37,0:28:06.07,Default,,0000,0000,0000,,scan the whole IPv4 we have a lot of open\NDNS resolvers, which means that they are
Dialogue: 0,0:28:06.07,0:28:14.93,Default,,0000,0000,0000,,open to anybody sending a query to them to\Nresolve. And these open DNS-resolvers can
Dialogue: 0,0:28:14.93,0:28:22.59,Default,,0000,0000,0000,,be used as a vantage point. We can use\Nopen DNS-resolvers in different ISPs
Dialogue: 0,0:28:22.59,0:28:29.83,Default,,0000,0000,0000,,around the world to see whether that DNS\Nqueries are poisoned or not. Well, wait.
Dialogue: 0,0:28:29.83,0:28:35.42,Default,,0000,0000,0000,,We need to make sure that they don't\Nbelong to the end user. So we come up with
Dialogue: 0,0:28:35.42,0:28:42.76,Default,,0000,0000,0000,,a lot of checks to make sure that these\Nopen DNS-resolvers are organizational,
Dialogue: 0,0:28:42.76,0:28:50.61,Default,,0000,0000,0000,,belonging to the ISP or infrastructure.\NAfter we do that then we start sending all
Dialogue: 0,0:28:50.61,0:28:57.98,Default,,0000,0000,0000,,our queries to these, let's say, open DNS-\Nresolvers in the ISP in Bahrain, for all
Dialogue: 0,0:28:57.98,0:29:03.93,Default,,0000,0000,0000,,the domain we're interested. And capture\Nwhat we receive what IPs we receive. The
Dialogue: 0,0:29:03.93,0:29:11.39,Default,,0000,0000,0000,,challenge is then to detect what is the\Nwrong answer. And so we have to come up
Dialogue: 0,0:29:11.39,0:29:19.76,Default,,0000,0000,0000,,with a lot of heuristics. A set of\Nheuristics. For example the response that
Dialogue: 0,0:29:19.76,0:29:28.61,Default,,0000,0000,0000,,we received is that equal to a reply we\Ngot from our control measurements, where
Dialogue: 0,0:29:28.61,0:29:36.50,Default,,0000,0000,0000,,we know the IP is not blocked or poisoned\Nor something. The content is there. Or we
Dialogue: 0,0:29:36.50,0:29:42.06,Default,,0000,0000,0000,,can actually look at the IP that we\Nreceived and see whether it has a valid
Dialogue: 0,0:29:42.06,0:29:50.85,Default,,0000,0000,0000,,http cert, with or without the SNI or\Nservername identification or something.
Dialogue: 0,0:29:50.85,0:29:55.72,Default,,0000,0000,0000,,And so on so forth. So we come up with\Nlots of heuristics to detect wrong
Dialogue: 0,0:29:55.72,0:30:06.84,Default,,0000,0000,0000,,answers. The results of all these efforts\Nended up being a project called
Dialogue: 0,0:30:06.84,0:30:12.21,Default,,0000,0000,0000,,"Satellite", which was started by Will\NScott. I'm sure he is in the audience
Dialogue: 0,0:30:12.21,0:30:16.81,Default,,0000,0000,0000,,somewhere. A great friend of mine and very\Ngood supporter of CensoredPlanet.
Dialogue: 0,0:30:16.81,0:30:24.00,Default,,0000,0000,0000,,Selflessly, he has been a miracle that I I\Nhad the opportunity and fortune to meet
Dialogue: 0,0:30:24.00,0:30:31.89,Default,,0000,0000,0000,,him. We have Satellite. Satellite automate\Nthe whole steps that I told you. For this
Dialogue: 0,0:30:31.89,0:30:37.40,Default,,0000,0000,0000,,work we use science that developed in both\Nof the work. We call it Satellite because
Dialogue: 0,0:30:37.40,0:30:46.42,Default,,0000,0000,0000,,of seniority and sticking with the name. So\Nhow much coverage Satellite has? If you
Dialogue: 0,0:30:46.42,0:30:54.88,Default,,0000,0000,0000,,scan IPv4 you end up with 4.2 million open\NDNS-resolvers in every country in their
Dialogue: 0,0:30:54.88,0:31:01.08,Default,,0000,0000,0000,,territories. We make, we need, we we\Nactually need to make sure there are
Dialogue: 0,0:31:01.08,0:31:08.95,Default,,0000,0000,0000,,ethics for that reason. If we put a harsh\Ncondition. We say that let's only use the
Dialogue: 0,0:31:08.95,0:31:17.71,Default,,0000,0000,0000,,ones that fallow their valid PTR record\Nfollowed this expression. Basically let's
Dialogue: 0,0:31:17.71,0:31:23.20,Default,,0000,0000,0000,,just use the open DNS-resolvers that are\Nname servers or at least their PDR record
Dialogue: 0,0:31:23.20,0:31:29.92,Default,,0000,0000,0000,,suggests that. This is a really harsh\Nconstraint. Actually, my students have
Dialogue: 0,0:31:29.92,0:31:34.43,Default,,0000,0000,0000,,been adding more and more regular\Nexpression for the ones that we are sure
Dialogue: 0,0:31:34.43,0:31:42.61,Default,,0000,0000,0000,,they are organizational. But for now just\Nbeing this harsh we have 40k of DNS-
Dialogue: 0,0:31:42.61,0:31:56.83,Default,,0000,0000,0000,,revolvers in almost 169 countries I guess.\NSo censorship happened in other layers as
Dialogue: 0,0:31:56.83,0:32:00.70,Default,,0000,0000,0000,,well. How do we want to deal with that\Nremote channel, with the remote side
Dialogue: 0,0:32:00.70,0:32:12.52,Default,,0000,0000,0000,,channel? And, especially, like, what about\Nhttp traffic or disruption that can happen
Dialogue: 0,0:32:12.52,0:32:29.81,Default,,0000,0000,0000,,to you know TLS centric. I hate water.\NOh no. Okay. So. So it's {\i1}scratching{\i0}
Dialogue: 0,0:32:29.81,0:32:38.22,Default,,0000,0000,0000,,{\i1}noise{\i0} it's well documented that many DPIs\Nespecially in the Great Firewall of China monitor
Dialogue: 0,0:32:38.22,0:32:43.93,Default,,0000,0000,0000,,the traffic and then they see a key word,\Na sensitive keyword like "Falun Gong".
Dialogue: 0,0:32:43.93,0:32:50.35,Default,,0000,0000,0000,,They act and a drop traffic or send a RST.\NAnd as I mentioned earlier there are
Dialogue: 0,0:32:50.35,0:32:57.33,Default,,0000,0000,0000,,enough clear text everywhere. Even in TLS\Nhandshakes SNI is in clear text. And for a
Dialogue: 0,0:32:57.33,0:33:03.59,Default,,0000,0000,0000,,long time I was trying to come up with a\Nway of detecting application layer using
Dialogue: 0,0:33:03.59,0:33:09.32,Default,,0000,0000,0000,,this fancy side channel. Like, how can I\Ndetect that when the client and server
Dialogue: 0,0:33:09.32,0:33:14.63,Default,,0000,0000,0000,,need to first establish a TCP handshake,\Nhow the side channel can jump in and then
Dialogue: 0,0:33:14.63,0:33:22.72,Default,,0000,0000,0000,,detect the rest? We were lucky enough that\Nthe end pointed to a protocol called
Dialogue: 0,0:33:22.72,0:33:32.90,Default,,0000,0000,0000,,"Echo". It's a protocol designed in 1983\Nand it's for testing reasons, for the
Dialogue: 0,0:33:32.90,0:33:41.14,Default,,0000,0000,0000,,debu..it is a debugging tool, basically.\NIt's a predecessor to ping. And basically,
Dialogue: 0,0:33:41.14,0:33:50.12,Default,,0000,0000,0000,,after you establish a TCP handshake to\Nport 7, whatever you send the Echo servers
Dialogue: 0,0:33:50.12,0:33:57.29,Default,,0000,0000,0000,,on port 7 it's gonna echo it back. Now\Nthink about it. How we can use Echo
Dialogue: 0,0:33:57.29,0:34:04.57,Default,,0000,0000,0000,,servers to be able to detect application\Nlayer blocking? Well, when it's not
Dialogue: 0,0:34:04.57,0:34:08.49,Default,,0000,0000,0000,,available, let's say I have an Echo server\Nin the U.S. and a measurement machine in
Dialogue: 0,0:34:08.49,0:34:13.89,Default,,0000,0000,0000,,the University of Michigan I establish a\NTCP handshake and I send a GET request
Dialogue: 0,0:34:13.89,0:34:19.19,Default,,0000,0000,0000,,to... using a censored keyboard for\Nexample. It's gonna get back to me the
Dialogue: 0,0:34:19.19,0:34:28.27,Default,,0000,0000,0000,,same thing I sent. But now let's put the\NDPI that is gonna be triggered by it.
Dialogue: 0,0:34:28.27,0:34:37.15,Default,,0000,0000,0000,,Well, for sure, either I'm going to\Nreceive a RST first or something else. So
Dialogue: 0,0:34:37.15,0:34:43.61,Default,,0000,0000,0000,,we can actually come up with a algorithm\Nto be able to use Echo servers to detect
Dialogue: 0,0:34:43.61,0:34:47.97,Default,,0000,0000,0000,,disruptions on application layer.\NBasically keyboards blocking, URL
Dialogue: 0,0:34:47.97,0:34:58.53,Default,,0000,0000,0000,,blocking. Results of this is a tool called\NQuack. And Quack actually uses Echo
Dialogue: 0,0:34:58.53,0:35:06.47,Default,,0000,0000,0000,,servers to be able to detect in a scalable\Nway and say if, whether the keywords are
Dialogue: 0,0:35:06.47,0:35:14.38,Default,,0000,0000,0000,,being blocked around the world. So what\Ndid we do is first scan the whole IPv4. We
Dialogue: 0,0:35:14.38,0:35:22.91,Default,,0000,0000,0000,,find 47k Echo servers running around the\Nworld. Then we need to be able to check
Dialogue: 0,0:35:22.91,0:35:27.27,Default,,0000,0000,0000,,whether they or not belong to the end\Nusers. And that was a very challenging
Dialogue: 0,0:35:27.27,0:35:36.53,Default,,0000,0000,0000,,part because there is not a clear signal\Nas it's.. there are 90 percent of them are
Dialogue: 0,0:35:36.53,0:35:40.73,Default,,0000,0000,0000,,infrastructure but there is still some\Nportion of them that we don't know. So
Dialogue: 0,0:35:40.73,0:35:46.61,Default,,0000,0000,0000,,what we do is we look at the FreedomHouse\Nreports and the countries that are
Dialogue: 0,0:35:46.61,0:35:52.93,Default,,0000,0000,0000,,partially open or not open, not free or\Npartially free what they're called. This
Dialogue: 0,0:35:52.93,0:35:58.72,Default,,0000,0000,0000,,is around 50... This is around 50\Ncountries. And for those we use... we
Dialogue: 0,0:35:58.72,0:36:05.46,Default,,0000,0000,0000,,randomly select some that we want and we\Nuse OS detection of Nmap. And if you have,
Dialogue: 0,0:36:05.46,0:36:15.75,Default,,0000,0000,0000,,it will give us back it's a server, it's a\Nswitch and so on. We use those. So with
Dialogue: 0,0:36:15.75,0:36:23.01,Default,,0000,0000,0000,,the help of so many collaborators after\Nalmost six years we end up with three
Dialogue: 0,0:36:23.01,0:36:32.42,Default,,0000,0000,0000,,systems that can capture TCP/IP blocking,\NDNS, and application layer blocking using
Dialogue: 0,0:36:32.42,0:36:43.48,Default,,0000,0000,0000,,infrastructure and organizational\Nmachines. So while it was, it was a dream
Dialogue: 0,0:36:43.48,0:36:47.81,Default,,0000,0000,0000,,or a vision that we can come up with a\Nbetter map to collect this data in a
Dialogue: 0,0:36:47.81,0:36:56.02,Default,,0000,0000,0000,,continuous way, thanks to help of a lot of\Npeople especially my students, Will, and
Dialogue: 0,0:36:56.02,0:37:02.06,Default,,0000,0000,0000,,other collaborators we now have\NCensoredPlanet. CensoredPlanet collects
Dialogue: 0,0:37:02.06,0:37:09.02,Default,,0000,0000,0000,,semi-weekly snapshots of Internet\Ncensorship using our vantage point in all
Dialogue: 0,0:37:09.02,0:37:18.09,Default,,0000,0000,0000,,the layers and provide this data in a raw\Nformat now in our web site. We also
Dialogue: 0,0:37:18.09,0:37:24.53,Default,,0000,0000,0000,,provide some visualization way for people\Nto be able to see how many vantage points
Dialogue: 0,0:37:24.53,0:37:29.56,Default,,0000,0000,0000,,we have in each country and so on. Of\Ncourse, this is the beginning of
Dialogue: 0,0:37:29.56,0:37:34.16,Default,,0000,0000,0000,,CensoredPlanet. We launched this at August\Nand we have been collecting data for
Dialogue: 0,0:37:34.16,0:37:39.88,Default,,0000,0000,0000,,almost four months and we have a long way\Nto go. We have users right now through
Dialogue: 0,0:37:39.88,0:37:45.13,Default,,0000,0000,0000,,organizations using our data and helping\Nus debug by finding things that doesn't
Dialogue: 0,0:37:45.13,0:37:51.95,Default,,0000,0000,0000,,make sense pointing to us and any of you\Nthat ended up using these data, please
Dialogue: 0,0:37:51.95,0:37:56.93,Default,,0000,0000,0000,,share your feedback with us and we are\Nvery responsive to be able to change it,
Dialogue: 0,0:37:56.93,0:38:03.94,Default,,0000,0000,0000,,not as much as you need. They have a\Ncollective of very well dedicated people
Dialogue: 0,0:38:03.94,0:38:10.94,Default,,0000,0000,0000,,participating. So, now that we have this\NCensoredPlanet let me give you how it can
Dialogue: 0,0:38:10.94,0:38:19.35,Default,,0000,0000,0000,,help when there is a political situation\Ngoing on. You all must remember around
Dialogue: 0,0:38:19.35,0:38:25.41,Default,,0000,0000,0000,,October there Jamal Khashoggi, a\NWashington Post reporter, disappeared,
Dialogue: 0,0:38:25.41,0:38:34.53,Default,,0000,0000,0000,,killed at the Saudi Arabian embassy in\NTurkey. At the time of this happening
Dialogue: 0,0:38:34.53,0:38:40.54,Default,,0000,0000,0000,,there was a lot of media attention and\Nthis, this news especially two weeks in
Dialogue: 0,0:38:40.54,0:38:46.98,Default,,0000,0000,0000,,become very internationally spread.\NCensoredPlanet didn't know this event was
Dialogue: 0,0:38:46.98,0:38:52.75,Default,,0000,0000,0000,,going to happen. So we have been\Ncollecting this data semi-weekly for 2000
Dialogue: 0,0:38:52.75,0:38:57.66,Default,,0000,0000,0000,,domain or so. And so we went back and we\Nchecked the Saudi Arabia. Did we see
Dialogue: 0,0:38:57.66,0:39:04.83,Default,,0000,0000,0000,,anything interesting? And yes, we saw for\Nexample at two weeks in, around October
Dialogue: 0,0:39:04.83,0:39:12.68,Default,,0000,0000,0000,,16, the domains that we were that was news\Ncategory and media category, the
Dialogue: 0,0:39:12.68,0:39:18.50,Default,,0000,0000,0000,,censorship related to those doubled. And\Nlet me emphasize, we didn't see like a
Dialogue: 0,0:39:18.50,0:39:23.44,Default,,0000,0000,0000,,block or not block over the whole country\Nnot all the countries have a homogeneous
Dialogue: 0,0:39:23.44,0:39:28.43,Default,,0000,0000,0000,,censorship happening. We saw it in\Nmultiple of the ISPs that we had vantage
Dialogue: 0,0:39:28.43,0:39:34.77,Default,,0000,0000,0000,,point. Actually I freaked out when one of\Nthe activists in Saudi Arabia told us that
Dialogue: 0,0:39:34.77,0:39:41.87,Default,,0000,0000,0000,,"I don't see this". And we said "What ISP\Nyou are in?" And this wasn't the ISPs that
Dialogue: 0,0:39:41.87,0:39:49.16,Default,,0000,0000,0000,,we had vantage point in. So we were\Nlooking for hints that "Is anybody else
Dialogue: 0,0:39:49.16,0:39:55.72,Default,,0000,0000,0000,,seeing what we were seeing?". And so we\Nended up seeing there was a commander
Dialogue: 0,0:39:55.72,0:40:03.56,Default,,0000,0000,0000,,lab project that also saw around October\N16 the number of malwares or whatever they
Dialogue: 0,0:40:03.56,0:40:10.22,Default,,0000,0000,0000,,are testing is also doubled or tripled. I\Ndon't know the other. So something was
Dialogue: 0,0:40:10.22,0:40:17.18,Default,,0000,0000,0000,,going on two weeks in when the news broke.\NLet me emphasize this news media that I am
Dialogue: 0,0:40:17.18,0:40:22.30,Default,,0000,0000,0000,,talking about or the global news media\Nthat we check like L.A. Times, Fox News
Dialogue: 0,0:40:22.30,0:40:30.97,Default,,0000,0000,0000,,and so on. But we also checked Arab News\Nwhich is as the activists told us is a
Dialogue: 0,0:40:30.97,0:40:38.49,Default,,0000,0000,0000,,Saudi Arabia's propaganda newspaper. That\Nin one of the ISPs was being poisoned. So
Dialogue: 0,0:40:38.49,0:40:49.91,Default,,0000,0000,0000,,again, censorship measurement is very\Ncomplex problem. So where we're heading?
Dialogue: 0,0:40:49.91,0:40:55.58,Default,,0000,0000,0000,,Well, having said that about side channels\Nand the techniques that help us remotely
Dialogue: 0,0:40:55.58,0:41:01.90,Default,,0000,0000,0000,,collect this data I have to also say that\Nthe data we collect doesn't replicate the
Dialogue: 0,0:41:01.90,0:41:06.95,Default,,0000,0000,0000,,picture of the internet censorship. I mean\Nhaving a root access on a volunteers
Dialogue: 0,0:41:06.95,0:41:17.64,Default,,0000,0000,0000,,machine to do a detailed test is powerful.\NSo in the next step, in the next year, one
Dialogue: 0,0:41:17.64,0:41:27.72,Default,,0000,0000,0000,,of our goal is to join force with OONI to\Nintegrate the data and from remote and
Dialogue: 0,0:41:27.72,0:41:37.80,Default,,0000,0000,0000,,basically local measurements to provide\Nthe best of both worlds. Also, we have
Dialogue: 0,0:41:37.80,0:41:43.99,Default,,0000,0000,0000,,been thinking a lot about what would be a\Ngood visualization tools that doesn't end
Dialogue: 0,0:41:43.99,0:41:51.39,Default,,0000,0000,0000,,up to misrepresent internet censorship. I\Nliterally hate that one. Hate it. The
Dialogue: 0,0:41:51.39,0:41:56.86,Default,,0000,0000,0000,,number of vantage point in countries are\Nnot equal. We don't know whether all the
Dialogue: 0,0:41:56.86,0:42:00.98,Default,,0000,0000,0000,,vantage points that the data has resulted\Nfrom it is from one ISP or all of our
Dialogue: 0,0:42:00.98,0:42:08.11,Default,,0000,0000,0000,,ISPs. And then we test domains that are\Nlike benign and like I don't know defined
Dialogue: 0,0:42:08.11,0:42:13.65,Default,,0000,0000,0000,,based on some western values of the\Nfreedom of expression. I believe in all of
Dialogue: 0,0:42:13.65,0:42:19.33,Default,,0000,0000,0000,,them but still culture, economy might play\Nsomething red. And then we put colors on
Dialogue: 0,0:42:19.33,0:42:25.03,Default,,0000,0000,0000,,the map, rank the countries, call some\Ncountries awful and not giving full
Dialogue: 0,0:42:25.03,0:42:30.85,Default,,0000,0000,0000,,attention to the others. So something\Nneeds to be changed and it's in our
Dialogue: 0,0:42:30.85,0:42:37.70,Default,,0000,0000,0000,,horizon too. Think about it more deeper.\NWe want to be able to have more statistic
Dialogue: 0,0:42:37.70,0:42:44.32,Default,,0000,0000,0000,,tools to be able to spot when the patterns\Nchange. We want to be able to compare the
Dialogue: 0,0:42:44.32,0:42:49.58,Default,,0000,0000,0000,,countries when for example Telegram was\Nbeing blocked at Russia. If you remember
Dialogue: 0,0:42:49.58,0:42:54.91,Default,,0000,0000,0000,,millions of IPs being blocked. If you\Ndon't, know go to my friend Leonid's talk
Dialogue: 0,0:42:54.91,0:43:00.02,Default,,0000,0000,0000,,about Russia. You're going to learn a lot\Nthere. But anyway. So when the Russia was
Dialogue: 0,0:43:00.02,0:43:06.52,Default,,0000,0000,0000,,blocking Telegram, I said to everyone I\Nbet in the following some other
Dialogue: 0,0:43:06.52,0:43:10.37,Default,,0000,0000,0000,,governments are going to jump to block\NTelegram as well. And that's actually what
Dialogue: 0,0:43:10.37,0:43:15.32,Default,,0000,0000,0000,,we heard, rumors like that. So we need to\Nbe able to do that automatically. And
Dialogue: 0,0:43:15.32,0:43:26.47,Default,,0000,0000,0000,,overall, I want to be able to develop an\Nempirical science of internet censorship
Dialogue: 0,0:43:26.47,0:43:36.72,Default,,0000,0000,0000,,based on rich data with the help of all of\Nyou. CensoredPlanet is now being
Dialogue: 0,0:43:36.72,0:43:43.37,Default,,0000,0000,0000,,maintained by a group of dedicated\Nstudents, great friends that I have and
Dialogue: 0,0:43:43.37,0:43:49.96,Default,,0000,0000,0000,,needs engineers and political scientists\Nto jump on our data and help us to bring
Dialogue: 0,0:43:49.96,0:43:57.32,Default,,0000,0000,0000,,meaning to what we are collecting. So if\Nyou are a good engineer or a political
Dialogue: 0,0:43:57.32,0:44:07.25,Default,,0000,0000,0000,,scientist or a dedicated person who wants\Nto change the world, reach out to me. For
Dialogue: 0,0:44:07.25,0:44:11.50,Default,,0000,0000,0000,,as a reference for those of you\Ninterested: these are the publications
Dialogue: 0,0:44:11.50,0:44:19.72,Default,,0000,0000,0000,,that my talk was based on.\NAnd now I am open to questions.
Dialogue: 0,0:44:19.72,0:44:26.18,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:44:26.18,0:44:31.44,Default,,0000,0000,0000,,Herald: Allright, perfect. Thank you so\Nmuch, Roya, so far. We have some time for
Dialogue: 0,0:44:31.44,0:44:35.50,Default,,0000,0000,0000,,questions so if you have a question in the\Nroom please go to one of the room
Dialogue: 0,0:44:35.50,0:44:40.10,Default,,0000,0000,0000,,microphones one, two, three, four, and\Nfive in the very back. And if you're
Dialogue: 0,0:44:40.10,0:44:44.49,Default,,0000,0000,0000,,watching the stream you can ask questions\Nto the signal angel via IRC or Twitter and
Dialogue: 0,0:44:44.49,0:44:49.36,Default,,0000,0000,0000,,we'll also make sure to relay those to the\Nspeaker and make sure those get asked. So
Dialogue: 0,0:44:49.36,0:44:52.04,Default,,0000,0000,0000,,let's just go ahead and\Nstart with Mic two please.
Dialogue: 0,0:44:52.04,0:44:57.35,Default,,0000,0000,0000,,Question: Hey, great talk. Do you worry\Nthat by publishing your methods as well as
Dialogue: 0,0:44:57.35,0:45:02.69,Default,,0000,0000,0000,,your data that you're going to get a\Nresponse from governments that are
Dialogue: 0,0:45:02.69,0:45:05.87,Default,,0000,0000,0000,,censoring things such that it makes it\Nmore difficult for you to monitor what's
Dialogue: 0,0:45:05.87,0:45:08.68,Default,,0000,0000,0000,,being censored? Or has\Nthat already happened?
Dialogue: 0,0:45:08.68,0:45:14.63,Default,,0000,0000,0000,,Roya: It hasn't happened. We have control\Nmeasures to be able to detect that. But
Dialogue: 0,0:45:14.63,0:45:19.26,Default,,0000,0000,0000,,that has been... it's a really good\Nquestion and often comes up after I
Dialogue: 0,0:45:19.26,0:45:25.49,Default,,0000,0000,0000,,present. I can tell you based on my\Nexperience it's really hard to synchronize
Dialogue: 0,0:45:25.49,0:45:31.49,Default,,0000,0000,0000,,all the ISPs in all the countries to act\Nto the SYN-ACK and RST that I'm sending.
Dialogue: 0,0:45:31.49,0:45:36.15,Default,,0000,0000,0000,,Like, for example for Augur, this is\Nunsolicited packets and for governments to
Dialogue: 0,0:45:36.15,0:45:41.85,Default,,0000,0000,0000,,block that they are going to be a lot of\Ncollateral damage. You might say that
Dialogue: 0,0:45:41.85,0:45:45.61,Default,,0000,0000,0000,,well, Roya, they're going to block the IP\Nof the University of Michigan. They're a
Dialogue: 0,0:45:45.61,0:45:50.77,Default,,0000,0000,0000,,spoofing machine. We have a measure for\Nthat. I have multiple places that I
Dialogue: 0,0:45:50.77,0:45:56.19,Default,,0000,0000,0000,,actually have a backup if that case\Nhappened. But overall this is a global
Dialogue: 0,0:45:56.19,0:46:02.80,Default,,0000,0000,0000,,scale measurement, and even in one city or\Nlike multiple ISPs you know of it's really
Dialogue: 0,0:46:02.80,0:46:06.92,Default,,0000,0000,0000,,hard to synchronize being like blocking\Nsomething and maintaining. So it is
Dialogue: 0,0:46:06.92,0:46:13.63,Default,,0000,0000,0000,,something that's in our mind thinking\Nabout. But as as of now it's not a worry.
Dialogue: 0,0:46:13.63,0:46:16.47,Default,,0000,0000,0000,,Herald: All right then let's\Ngo over to Mic one.
Dialogue: 0,0:46:16.47,0:46:20.51,Default,,0000,0000,0000,,Question: Thank you. I wondered, it's kind\Nof similar to this question. What if you
Dialogue: 0,0:46:20.51,0:46:24.92,Default,,0000,0000,0000,,are measuring from a country that is\Nblocking? Do you also distribute the
Dialogue: 0,0:46:24.92,0:46:29.97,Default,,0000,0000,0000,,measurements over several countries?\NRoya: Absolutely. Every snapshot that we
Dialogue: 0,0:46:29.97,0:46:37.28,Default,,0000,0000,0000,,collect is from all the vantage point we\Nhave in like certain countries and portion
Dialogue: 0,0:46:37.28,0:46:42.10,Default,,0000,0000,0000,,of vantage point in like China or like US\Nbecause they have millions of vantage
Dialogue: 0,0:46:42.10,0:46:46.22,Default,,0000,0000,0000,,points or like thousands of vantage\Npoints. So basically at each snapshot,
Dialogue: 0,0:46:46.22,0:46:52.34,Default,,0000,0000,0000,,which takes us three days, we collect the\Ndata from all of all of the vantage point.
Dialogue: 0,0:46:52.34,0:46:57.58,Default,,0000,0000,0000,,And so let's say that somebody is reacting\Nto us. We have a benign domain that we
Dialogue: 0,0:46:57.58,0:47:03.25,Default,,0000,0000,0000,,check as well like for example a domain\Nexample.com or random.com. So if we see
Dialogue: 0,0:47:03.25,0:47:09.38,Default,,0000,0000,0000,,something going on there we actually\Ndouble check. But good point, because now
Dialogue: 0,0:47:09.38,0:47:14.72,Default,,0000,0000,0000,,our efforts is very manual labor and we're\Ntrying to automate everything so it's
Dialogue: 0,0:47:14.72,0:47:18.90,Default,,0000,0000,0000,,still a challenge. Thank you.\NHerald: All right then let's go to Mic
Dialogue: 0,0:47:18.90,0:47:22.86,Default,,0000,0000,0000,,three.\NQuestion: Hi. Have you measured how much
Dialogue: 0,0:47:22.86,0:47:28.14,Default,,0000,0000,0000,,does IP-ID randomization\Nbreak your probes?
Dialogue: 0,0:47:28.14,0:47:35.35,Default,,0000,0000,0000,,Roya: Oh. This is also really good. Let me\Ngive a shout out to [name]. He's the guy
Dialogue: 0,0:47:35.35,0:47:45.99,Default,,0000,0000,0000,,at 1998 discovered IP-ID or published\Nsomething that I ended up reading. So like
Dialogue: 0,0:47:45.99,0:47:54.44,Default,,0000,0000,0000,,for example Linux or Ubuntu in the U.S.\Nversion they randomized it but it still
Dialogue: 0,0:47:54.44,0:47:59.42,Default,,0000,0000,0000,,draws this legacy operating system like\NWindowsXP and predecessors and FreeBSD
Dialogue: 0,0:47:59.42,0:48:04.75,Default,,0000,0000,0000,,that still have global IP-ID. So one\Nargument that often come up is, what if
Dialogue: 0,0:48:04.75,0:48:09.34,Default,,0000,0000,0000,,all these machines get updated to the new\Noperating system where it doesn't have a
Dialogue: 0,0:48:09.34,0:48:13.78,Default,,0000,0000,0000,,maintain global IP-ID? And I can tell you\Nthat, well, we'll come up with another
Dialogue: 0,0:48:13.78,0:48:20.13,Default,,0000,0000,0000,,side channel. For now, that works. But my\Ngut feeling is that if it didn't change
Dialogue: 0,0:48:20.13,0:48:25.23,Default,,0000,0000,0000,,from 1998 until now with all the things\Nthat everybody says that global IP-ID
Dialogue: 0,0:48:25.23,0:48:30.44,Default,,0000,0000,0000,,variable is a horrible idea, it's not going\Nto change in the coming five years so
Dialogue: 0,0:48:30.44,0:48:33.23,Default,,0000,0000,0000,,we're good.\NQuestion: Thank you.
Dialogue: 0,0:48:33.23,0:48:36.52,Default,,0000,0000,0000,,Herald: Okay, then let's just\Nmove on to Mic four.
Dialogue: 0,0:48:36.52,0:48:41.48,Default,,0000,0000,0000,,Question: Thank you very much for the\Ngreat talk. When you were introducing
Dialogue: 0,0:48:41.48,0:48:46.91,Default,,0000,0000,0000,,Augur I was wondering, does the detection\Nof the blockage between client server
Dialogue: 0,0:48:46.91,0:48:52.19,Default,,0000,0000,0000,,necessarily indicate censorship? So,\Nbecause you were talking about validating
Dialogue: 0,0:48:52.19,0:48:59.13,Default,,0000,0000,0000,,Augur I was wondering if it turns out that\Nthere is like a false alarm. What do you
Dialogue: 0,0:48:59.13,0:49:04.53,Default,,0000,0000,0000,,think could be the potential cause?\NRoya: You're absolutely right. And I tried
Dialogue: 0,0:49:04.53,0:49:11.63,Default,,0000,0000,0000,,to emphasize on that that what we end up\Ncollecting is can be seen as a disruption.
Dialogue: 0,0:49:11.63,0:49:17.20,Default,,0000,0000,0000,,Something didn't work. The SYN-ACK or RST\Ngot disrupted. Is that there is a
Dialogue: 0,0:49:17.20,0:49:22.25,Default,,0000,0000,0000,,censorship or it can be a random packet\Ndrop. And the way to be able to establish
Dialogue: 0,0:49:22.25,0:49:28.29,Default,,0000,0000,0000,,that confidence is to check whether\Naggregate the results. Do we see this
Dialogue: 0,0:49:28.29,0:49:33.67,Default,,0000,0000,0000,,blocking between multiple of the routers\Nwithin that country or within that AS .
Dialogue: 0,0:49:33.67,0:49:38.88,Default,,0000,0000,0000,,Because if one of this is for accident\Nthat just didn't make sense or didn't get
Dialogue: 0,0:49:38.88,0:49:43.90,Default,,0000,0000,0000,,dropped, what about the others? So the\Nwhole idea and this is another point that
Dialogue: 0,0:49:43.90,0:49:50.39,Default,,0000,0000,0000,,I'm so so concerned about: Most of this\Nreport and anecdotes that we read is based
Dialogue: 0,0:49:50.39,0:49:55.87,Default,,0000,0000,0000,,on one VPN or one man touch points in the\Ncountry. And then there are a lot of lot
Dialogue: 0,0:49:55.87,0:50:00.77,Default,,0000,0000,0000,,of conclusion out of that. And you often\Ncan ask that well this vantage point might
Dialogue: 0,0:50:00.77,0:50:05.64,Default,,0000,0000,0000,,be subject to so many different things\Nthan a government's censorship. Also I
Dialogue: 0,0:50:05.64,0:50:11.98,Default,,0000,0000,0000,,emphasized that the censorship that I use\Nin this talk is any action that stops
Dialogue: 0,0:50:11.98,0:50:17.18,Default,,0000,0000,0000,,users' access to get to the requested\Ncontent. I'm trying to get away from a
Dialogue: 0,0:50:17.18,0:50:23.48,Default,,0000,0000,0000,,semantic where of the intention applied.\NBut great question.
Dialogue: 0,0:50:23.48,0:50:26.24,Default,,0000,0000,0000,,Herald: All right, then let's go back to\NMic one right.
Dialogue: 0,0:50:26.24,0:50:29.74,Default,,0000,0000,0000,,Question: Hi Roya. You mentioned that you\Nhave a team of students working on all of
Dialogue: 0,0:50:29.74,0:50:33.89,Default,,0000,0000,0000,,these frameworks. I was wondering if your\Nframeworks were open source are available
Dialogue: 0,0:50:33.89,0:50:37.76,Default,,0000,0000,0000,,online for collaboration? And if so, where\Nthose resources would be?
Dialogue: 0,0:50:37.76,0:50:45.04,Default,,0000,0000,0000,,Roya: So the data is open. The code hasn't\Nbeen. For one reason is I'm so low
Dialogue: 0,0:50:45.04,0:50:49.09,Default,,0000,0000,0000,,confident in sharing code, like I'm\Nfriends with Philipp Winter, Dave Fifield.
Dialogue: 0,0:50:49.09,0:50:54.17,Default,,0000,0000,0000,,These people are pro open source and they\Nconstantly blame me for not. But it really
Dialogue: 0,0:50:54.17,0:51:00.72,Default,,0000,0000,0000,,requires confidence to share code. So we\Nare working on that at least for Quack. I
Dialogue: 0,0:51:00.72,0:51:06.39,Default,,0000,0000,0000,,think the code is very easily can be\Nshared. For Augur, we spent a heck amount
Dialogue: 0,0:51:06.39,0:51:12.11,Default,,0000,0000,0000,,of time to make a production ready code\Nand for Satellite I think that is also
Dialogue: 0,0:51:12.11,0:51:17.42,Default,,0000,0000,0000,,ready. I can share them personally with\Nyou but before sharing to the world I want
Dialogue: 0,0:51:17.42,0:51:21.56,Default,,0000,0000,0000,,to actually give another person to audit\Nand make sure we're not using a curse word
Dialogue: 0,0:51:21.56,0:51:26.42,Default,,0000,0000,0000,,or something. I don't know. It's just\Ncompletely my mind being a little bit
Dialogue: 0,0:51:26.42,0:51:31.03,Default,,0000,0000,0000,,conservative. But happy if you send me an\Ne-mail I send you to code.
Dialogue: 0,0:51:31.03,0:51:35.64,Default,,0000,0000,0000,,Question: Thank you.\NHerald: All right then move to Mic two.
Dialogue: 0,0:51:35.64,0:51:39.93,Default,,0000,0000,0000,,Question: Thanks again for sharing your\Ngreat vision. I find it really
Dialogue: 0,0:51:39.93,0:51:47.47,Default,,0000,0000,0000,,fascinating. Also I'm not really a data\Nscientist but my question is: did you find
Dialogue: 0,0:51:47.47,0:51:56.10,Default,,0000,0000,0000,,any any usefulness in your approaches in\Nthe spreading of the Internet of Things? I
Dialogue: 0,0:51:56.10,0:52:06.96,Default,,0000,0000,0000,,understood that you used routers to make\Nqueries but did you send and maybe receive
Dialogue: 0,0:52:06.96,0:52:11.26,Default,,0000,0000,0000,,back any data from\Nwashing machines, toasters,...?
Dialogue: 0,0:52:11.26,0:52:17.48,Default,,0000,0000,0000,,Roya: I mean, I know, being ethical and\Ntrying to not use end user machine limits
Dialogue: 0,0:52:17.48,0:52:22.59,Default,,0000,0000,0000,,your access a lot. And but but but that's\Nour goal. We are going to stick with
Dialogue: 0,0:52:22.59,0:52:28.24,Default,,0000,0000,0000,,things that don't belong to the end users.\NAnd so it's all routers, organizational
Dialogue: 0,0:52:28.24,0:52:31.94,Default,,0000,0000,0000,,machines. So I want to make sure that\Nwhatever we're using belong to the
Dialogue: 0,0:52:31.94,0:52:35.35,Default,,0000,0000,0000,,identity that can protect themselves if\Nsomething went wrong. They can just say
Dialogue: 0,0:52:35.35,0:52:39.64,Default,,0000,0000,0000,,"Hey this is a freaking router, it\Nreceives and sends so many things. I mean,
Dialogue: 0,0:52:39.64,0:52:44.74,Default,,0000,0000,0000,,look, let me give you show you a TCP (?),\Nfor example. A volunteer might not be able
Dialogue: 0,0:52:44.74,0:52:49.29,Default,,0000,0000,0000,,to defend that because it's already\Nconspiring and collecting this data. But
Dialogue: 0,0:52:49.29,0:52:53.55,Default,,0000,0000,0000,,good questions, I wish I could\Nbut I won't pass that line.
Dialogue: 0,0:52:53.55,0:52:57.38,Default,,0000,0000,0000,,Herald: All right. I don't see any more\Nquestions in the room right now. But we
Dialogue: 0,0:52:57.38,0:53:01.08,Default,,0000,0000,0000,,have one from the internet\Nso please, signal angel.
Dialogue: 0,0:53:01.08,0:53:06.51,Default,,0000,0000,0000,,Signal Angel: Yes. Actually a question\Nfrom koli585: I was in an African
Dialogue: 0,0:53:06.51,0:53:10.01,Default,,0000,0000,0000,,country where the internet has been\Ncompletely shut down. How can I quickly
Dialogue: 0,0:53:10.01,0:53:14.71,Default,,0000,0000,0000,,and safely inform others\Nabout the shut down?
Dialogue: 0,0:53:14.71,0:53:21.47,Default,,0000,0000,0000,,Roya: So while I think local users' values\Nare highly highly needed they can use
Dialogue: 0,0:53:21.47,0:53:27.51,Default,,0000,0000,0000,,social media like Twitter to send and say\Nwhatever, there is a project called IODA.
Dialogue: 0,0:53:27.51,0:53:36.87,Default,,0000,0000,0000,,It's a project at CAIDA UCSD University in\NU.S. and Philipp Winter, Alberto
Dialogue: 0,0:53:36.87,0:53:43.16,Default,,0000,0000,0000,,[Dainotti] and Alistair [King] are working\Non that. They basically remotely keep
Dialogue: 0,0:53:43.16,0:53:51.54,Default,,0000,0000,0000,,track of shutdowns and push them out. If\Nyou look at the IODA on Twitter you can
Dialogue: 0,0:53:51.54,0:54:02.62,Default,,0000,0000,0000,,see their live feed of how the shutdowns\Nwhere the shutdowns happen. So I haven't
Dialogue: 0,0:54:02.62,0:54:09.26,Default,,0000,0000,0000,,thought about how to reach to the users\Ntelling them what we see or how we can
Dialogue: 0,0:54:09.26,0:54:18.61,Default,,0000,0000,0000,,incorporate the users' feedback. We are\Nworking with a group of researchers that
Dialogue: 0,0:54:18.61,0:54:27.00,Default,,0000,0000,0000,,already developed tools to receive this\Ndata from Tweeters and basically use that
Dialogue: 0,0:54:27.00,0:54:31.89,Default,,0000,0000,0000,,as some level of ground truth, but OONI\Ndoes such a great job that I haven't felt
Dialogue: 0,0:54:31.89,0:54:37.22,Default,,0000,0000,0000,,a need.\NHerald: Alright. Unless the signal angel
Dialogue: 0,0:54:37.22,0:54:43.75,Default,,0000,0000,0000,,has another question? No?\NRoya: And let me, can I add one thing? So
Dialogue: 0,0:54:43.75,0:54:52.94,Default,,0000,0000,0000,,I was listening to a talk about how\NIranian versus Arabs were sympathetic
Dialogue: 0,0:54:52.94,0:55:01.04,Default,,0000,0000,0000,,towards Boston bombing in United States\Nand there were a lot of assumptions and a
Dialogue: 0,0:55:01.04,0:55:05.82,Default,,0000,0000,0000,,lot of conclusions were made that, oh\Nthis, I'm completely paraphrasing. I don't
Dialogue: 0,0:55:05.82,0:55:09.90,Default,,0000,0000,0000,,remember. But this Iranian doesn't care\Nbecause they didn't tweet as much. So
Dialogue: 0,0:55:09.90,0:55:17.06,Default,,0000,0000,0000,,basically their input data was a bunch of\Ntweets around the time of Boston bombing.
Dialogue: 0,0:55:17.06,0:55:21.60,Default,,0000,0000,0000,,After the talk was over I said: you know\Nthat in this country Twitter has been
Dialogue: 0,0:55:21.60,0:55:28.93,Default,,0000,0000,0000,,blocked and so many people couldn't tweet.\N{\i1}applause{\i0}
Dialogue: 0,0:55:28.93,0:55:33.49,Default,,0000,0000,0000,,Herald: Alright. That concludes our Q&A,\Nso thanks so much Roya.
Dialogue: 0,0:55:33.49,0:55:35.44,Default,,0000,0000,0000,,Roya: Thank you.
Dialogue: 0,0:55:35.44,0:55:41.15,Default,,0000,0000,0000,,{\i1}applause{\i0}
Dialogue: 0,0:55:41.15,0:55:45.97,Default,,0000,0000,0000,,{\i1}postroll music{\i0}
Dialogue: 0,0:55:45.97,0:56:04.00,Default,,0000,0000,0000,,Subtitles created by c3subtitles.de\Nin the year 2020. Join, and help us!