0:00:00.000,0:00:14.488 34C3 preroll music 0:00:14.488,0:00:19.939 Herald angel: Today two people from privacy[br]international, one is Eva Blum--Dumontet 0:00:19.939,0:00:25.349 she's a research officer working on data[br]exploitation especially in the global 0:00:25.349,0:00:34.750 south and Millie Wood who's a lawyer and[br]is fighting against spy agencies and 0:00:34.750,0:00:41.070 before that she fought seven years against[br]police cases and they're gonna be talking 0:00:41.070,0:00:46.340 about policing in the the age of data[br]exploitation. Give them a warm welcome. 0:00:46.340,0:00:55.242 Applause 0:00:55.242,0:00:58.440 Millie Wood: Hi I'm Millie as was just said I've been 0:00:58.440,0:01:02.440 at privacy international for two years[br]working as a lawyer before that I spent 0:01:02.440,0:01:08.320 seven years bringing cases against the[br]police and what increasingly concerns me 0:01:08.320,0:01:14.130 based on these experiences is a lack of[br]understanding of what tactics are being 0:01:14.130,0:01:21.000 used by the police today and what legal[br]basis they are doing this on. The lack of 0:01:21.000,0:01:26.780 transparency undermines the ability of[br]activists lawyers and technologists to 0:01:26.780,0:01:31.479 challenge the police tactics and whilst[br]I'm sure a lot of you have a broad 0:01:31.479,0:01:36.990 awareness of the technology that the[br]police can use I don't think this is 0:01:36.990,0:01:43.390 enough and we need to know what specific[br]police forces are using against 0:01:43.390,0:01:50.479 individuals. The reason why is that when[br]you're arrested you need to know what 0:01:50.479,0:01:56.810 disclosure to ask for in order to prove[br]your innocence. Your lawyers need to know 0:01:56.810,0:02:03.010 what expert evidence to ask for in order[br]to defend their client. And increasingly 0:02:03.010,0:02:08.949 as there are invisible ways or seemingly[br]invisible for the police to monitor a scale 0:02:08.949,0:02:14.010 we need to know that there are effective[br]legal safeguards. Now those who are 0:02:14.010,0:02:20.720 affected are not just the guilty or those[br]who understand technology they include 0:02:20.720,0:02:29.730 pensioners such as John Cat a 90 year old[br]man who's a peace protester and he's a 0:02:29.730,0:02:36.260 law-abiding citizen no criminal record and[br]yet he is on the UK domestic extremism 0:02:36.260,0:02:42.980 database and listed here are some of the[br]entries: He took his sketchpad and made 0:02:42.980,0:02:50.220 drawings, he's clean shaven, and he was[br]holding a board with orange people on it. 0:02:50.220,0:02:56.020 So this is the kind of people that they[br]are surveilling. John's case exposes 0:02:56.020,0:03:03.800 unlawful actions by the police but these[br]actions date back to 2005 to 2009 as far 0:03:03.800,0:03:10.170 as I'm aware there are no cases[br]challenging modern police tactics and 0:03:10.170,0:03:14.879 privacy international in the UK and with[br]our partners throughout the world are 0:03:14.879,0:03:20.520 increasingly concerned at the pace this is[br]developing unobstructed because people 0:03:20.520,0:03:28.480 don't know what's going on, and so we've[br]started in the UK to try and uncover some 0:03:28.480,0:03:34.180 of the police tactics using Freedom of[br]Information requests. These laws should be 0:03:34.180,0:03:39.480 available throughout Europe and we want to[br]make similar requests in other countries 0:03:39.480,0:03:44.450 hopefully with some of you. So now I'm[br]going to hand over to my colleague Eva who 0:03:44.450,0:03:47.860 will talk a bit about privacy[br]international, some of the tactics we know 0:03:47.860,0:03:52.030 the police are using, and then we'll speak[br]about some of the things that we found out 0:03:52.030,0:03:54.570 through our initial research. 0:03:54.570,0:03:59.530 Applause 0:03:59.530,0:04:02.919 Thank you so, I'm just going to tell you a[br]little bit more about Privacy 0:04:02.919,0:04:07.150 International for those of you who don't[br]know this organization. We are based in 0:04:07.150,0:04:11.470 London and we fight against surveillance[br]and defend the right to privacy across the 0:04:11.470,0:04:15.519 world. Basically, essentially what we're[br]doing is that we do litigation, we conduct 0:04:15.519,0:04:21.350 research, and we carry out advocacy[br]including at the United Nations, we 0:04:21.350,0:04:26.830 develop policies on issues that are[br]defining modern rights. Now, our work 0:04:26.830,0:04:30.900 ranges from litigations against[br]intelligence services to a wide range of 0:04:30.900,0:04:36.880 reports on issues such as connected cars,[br]smart cities, and FinTech. We've recently 0:04:36.880,0:04:41.610 published an investigation on the role of[br]companies like Cambridge Analytica and 0:04:41.610,0:04:47.990 Harris Media and their role in the latest[br]Kenyan elections. With our network of 0:04:47.990,0:04:52.471 partner organisations across the world we[br]advocate for stronger privacy protection 0:04:52.471,0:04:59.161 in the law and technology and stronger[br]safeguards against surveillance. Now we 0:04:59.161,0:05:04.080 talk about data exploitation and it's[br]actually the title of the talk so what do 0:05:04.080,0:05:10.380 we mean by that? The concept of data[br]exploitation emerges from our concerns 0:05:10.380,0:05:15.720 that the industry and governments are[br]building a world that prioritize the 0:05:15.720,0:05:22.650 exploitation of all data. We observe three[br]prevailing trends in data exploitation. 0:05:22.650,0:05:28.000 One is the excessive data that's generated[br]beyond our control. The second one is the 0:05:28.000,0:05:34.139 fact that this data is processed in a way[br]we cannot understand or influence and the 0:05:34.139,0:05:39.530 lack of transparency around it. The last[br]one is, that at the moment this data is 0:05:39.530,0:05:44.690 used to disadvantage us the ones who are[br]producing this data and it's further 0:05:44.690,0:05:51.270 empowering the already powerful. We hardly[br]control the data anymore that's generated 0:05:51.270,0:05:55.290 from phones or in our computers, but now[br]in the world we live in data just don't 0:05:55.290,0:06:00.130 come just from our phones or computers. It[br]comes from the cars we're driving, it 0:06:00.130,0:06:05.970 comes from our payment systems, from the[br]cities we live in. This is all generating 0:06:05.970,0:06:12.770 data and this data is used by other[br]entities to make assumptions about us and 0:06:12.770,0:06:18.450 take decisions that eventually influence[br]our lives. Are we entitled to a loan? Do 0:06:18.450,0:06:25.060 we qualify for affordable insurance?[br]Should we be sent to jail or set free? Who 0:06:25.060,0:06:31.130 should be arrested? This is at the core of[br]the world that we're building around data 0:06:31.130,0:06:37.630 exploitation. The question of power[br]imbalance between those who have the data 0:06:37.630,0:06:42.490 and who gets to make decisions based on[br]this data and those who are producing the 0:06:42.490,0:06:50.180 data and losing control over it. Now what[br]is policing have to do with data, what 0:06:50.180,0:06:57.020 does data exploitation have to do with[br]policing? The police has always been 0:06:57.020,0:07:04.620 actually using data in the past. To give[br]you one example in 1980 a transit police 0:07:04.620,0:07:10.530 officer named Jack Maple, developed a[br]project called chart of the future, this 0:07:10.530,0:07:16.479 is how he described it: "I call them the[br]chart of the future. On 55 feet of wall 0:07:16.479,0:07:20.740 space, I mapped every train station in New[br]York City and every train. Then I used 0:07:20.740,0:07:25.340 crayons to mark every violent crime,[br]robbery, and grand larceny that occurred. 0:07:25.340,0:07:33.250 I mapped the solved versus the unsolved".[br]Now the system was used by the Transit 0:07:33.250,0:07:41.110 Police and it was credited with reducing[br]felonies by 27% and robberies by 1/3 0:07:41.110,0:07:50.280 between 1990 and 1992. So this generated a[br]lot of interest in his projects and former 0:07:50.280,0:07:56.039 New York Mayor Rudolph Giuliani asked the[br]New York police department to essentially 0:07:56.039,0:08:02.479 take up chart of the future and develop[br]their own project. It became CompStat. 0:08:02.479,0:08:10.360 CompStat was again essentially about[br]mapping crime to try and make assumptions 0:08:10.360,0:08:19.360 about where crime wars are happening. So[br]this kind of shows the building of this 0:08:19.360,0:08:25.570 narrative around this idea that the more[br]data you have, the more data you generate, 0:08:25.570,0:08:31.780 the better you will be at reducing crime.[br]Now it becomes interesting in the world we 0:08:31.780,0:08:36.379 live in that we describe, where we are[br]constantly generating data, often without 0:08:36.379,0:08:42.059 the consent or even the knowledge of those[br]who are producing this data. So there are 0:08:42.059,0:08:48.339 new questions to be asked: What data is[br]the police entitled to access? What can 0:08:48.339,0:08:54.490 they do with it? Are we all becoming[br]suspects by default? One of the key 0:08:54.490,0:09:00.449 elements of the intersection between data[br]exploitation and policing is the question 0:09:00.449,0:09:06.119 of smart cities. It's worth bearing in[br]mind that data-driven policing is often 0:09:06.119,0:09:12.029 referred to as smart policing, so obviously[br]the word smart has been used generally in 0:09:12.029,0:09:17.699 a generic manner by various industry to[br]kind of describe this trend of using mass 0:09:17.699,0:09:26.689 data collection in order to provide new[br]services. But there is actually a real and 0:09:26.689,0:09:34.670 genuine connection between smart cities[br]and data-driven policing. The first reason 0:09:34.670,0:09:43.709 for that is that actually one of the main[br]reasons for cities to invest in smart city 0:09:43.709,0:09:48.910 infrastructure is actually the question of[br]security. This is something we've explored 0:09:48.910,0:09:54.320 in our latest report on smart cities and[br]this is emerging also from the work we're 0:09:54.320,0:10:00.890 doing other organizations including coding[br]rights in Brazil and DRF in Pakistan. So 0:10:00.890,0:10:06.009 actually Brazil is an interesting example,[br]because before the mega events they 0:10:06.009,0:10:10.350 started organizing like the football[br]World Cup and the Olympics they invested 0:10:10.350,0:10:16.850 massively in smart city infrastructure.[br]Including projects with IBM and precisely 0:10:16.850,0:10:20.250 the purpose of what they were trying to[br]achieve with their smart city 0:10:20.250,0:10:25.850 infrastructure, was making the city safer[br]so it was extremely strongly connected 0:10:25.850,0:10:32.420 with the police. So this is a picture for[br]example of the control room that 0:10:32.420,0:10:39.109 was built to control CCTV cameras and to[br]create graphs in order to showcase where 0:10:39.109,0:10:45.860 crime was happening and also in a way the[br]likeliness of natural disasters in some 0:10:45.860,0:10:51.649 areas. In Pakistan there is a whole new[br]program on investment of smart cities, 0:10:51.649,0:10:58.799 which is actually referred to as the safe[br]city project. Now companies understand 0:10:58.799,0:11:05.249 that very well and this is actually an[br]image from an IBM presentation describing 0:11:05.249,0:11:11.189 their vision of smart cities. And as you[br]see like policing that is very much 0:11:11.189,0:11:16.790 integrated into their vision, their[br]heavily centralized vision of what smart 0:11:16.790,0:11:22.829 cities are. So that's no wonder that[br]companies that offer smart city 0:11:22.829,0:11:28.379 infrastructure are actually now also[br]offering a platform for policing. So those 0:11:28.379,0:11:34.820 companies include IBM as I mentioned but[br]also Oracle and Microsoft. We see in many 0:11:34.820,0:11:39.600 countries including the UK where we based[br]some pressure on budgets and budget 0:11:39.600,0:11:44.379 reductions for the police and so there is[br]a very strong appeal with this narrative, 0:11:44.379,0:11:51.120 that you can purchase platform you can[br]gather more data that will help you do 0:11:51.120,0:11:58.109 policing in less time and do it more[br]efficiently. But little thought is given 0:11:58.109,0:12:03.230 to the impact on society, or right to[br]privacy and what happens if someone 0:12:03.230,0:12:13.439 unexpected take the reins of power. Now[br]we're gonna briefly explain what data- 0:12:13.439,0:12:20.499 driven policing looks like, and eventually[br]Millie will look at our findings. So 0:12:20.499,0:12:26.339 the first thing I wanted to discuss is[br]actually predictive policing, because 0:12:26.339,0:12:30.740 that's often something we think of and[br]talked about when we think about data- 0:12:30.740,0:12:37.759 driven policing. I mentioned CompStat[br]before and essentially predictive policing 0:12:37.759,0:12:43.319 works on a similar premise. The idea is[br]that if you map where crime happens you 0:12:43.319,0:12:50.859 can eventually guess where the next crime[br]will happen. So the key player in 0:12:50.859,0:12:54.989 predictive policing is this company called[br]PREDPOL, I mean I think they describe 0:12:54.989,0:12:58.230 pretty much what they do, they use[br]artificial intelligence to help you 0:12:58.230,0:13:06.249 prevent crime, right, predicting when and[br]where crime will most likely occur. Now 0:13:06.249,0:13:10.929 PREDPOL and other companies using[br]something called a Hawkes process that's 0:13:10.929,0:13:17.019 used normally for the prediction of[br]earthquake tremors, so what Hawkes 0:13:17.019,0:13:23.269 originally did is that he was analyzing[br]how after an earthquake you have after 0:13:23.269,0:13:28.660 shakes and usually the after shakes tend[br]to happen where the original earthquake 0:13:28.660,0:13:35.940 happened and in a short period of time[br]after that. So the Hawkes process basically 0:13:35.940,0:13:40.910 is described as when a certain event[br]happens, other events of the same kind will 0:13:40.910,0:13:45.470 happen shortly after in the same in the[br]same location. Now obviously it actually 0:13:45.470,0:13:50.790 works quite well for earthquakes, whether[br]it works for crime is a lot more 0:13:50.790,0:13:56.290 questionable. But that's actually the[br]premise on which companies that 0:13:56.290,0:14:02.119 are offering predictive policing services[br]are relying. So basically applied to 0:14:02.119,0:14:08.730 predictive policing the mantra is[br]monitoring data on places where crime is 0:14:08.730,0:14:13.309 happening you can identify geographic[br]hotspots where crime will most likely 0:14:13.309,0:14:20.819 happen again. Now other companies than[br]PREDPOL are joining in and they are adding 0:14:20.819,0:14:26.259 more data than just simply location of[br]past crimes. So this data has included 0:14:26.259,0:14:30.629 open source intelligence and we talked a[br]little bit more about this later on. 0:14:30.629,0:14:35.699 Weather report, census data, the location[br]of key landmarks like bars, churches, 0:14:35.699,0:14:40.089 schools, data sporting events, and moon[br]phases. I'm not quite sure what they're 0:14:40.089,0:14:50.209 doing with moon phases but somehow that's[br]something they're using. When predictive 0:14:50.209,0:14:56.179 policing first sort of emerged one of the[br]the key concerns was whether our world was 0:14:56.179,0:15:00.999 going to be turning into a Minority Report[br]kind of scenario where people are arrested 0:15:00.999,0:15:05.490 before a crime is even committed and[br]companies like PREDPOL were quick to 0:15:05.490,0:15:10.199 reassure people and say that do not[br]concern about who will commit crime but 0:15:10.199,0:15:15.800 where crimes are happening. Now that's not[br]actually true because in fact at the 0:15:15.800,0:15:21.100 moment we see several programs emerging[br]especially in the US, where police 0:15:21.100,0:15:25.509 departments are concerned not so much with[br]where crimes are happening, but who's 0:15:25.509,0:15:30.920 committing it.,So I'm gonna talk about two[br]example of this: One is the Kansas City No 0:15:30.920,0:15:37.850 Violence Alliance, which is a program laid[br]by the local police to identify who will 0:15:37.850,0:15:42.579 become the next criminal - basically - and[br]they're using an algorithm that combines 0:15:42.579,0:15:48.189 data from traditional policing as well as[br]social media intelligence and information 0:15:48.189,0:15:53.569 that they have on drug use, based on this[br]they create graphics generated using 0:15:53.569,0:16:01.609 predictive policing to show how certain[br]people are connected to already convicted 0:16:01.609,0:16:06.169 criminals and gang members. Once they've[br]identified these people they request 0:16:06.169,0:16:11.479 meeting with them whether they've[br]committed crimes or not in the past. And 0:16:11.479,0:16:16.420 they would have a discussion about their[br]connection to those convicted criminals 0:16:16.420,0:16:21.910 and gang members and what they tell them[br]is that they are warned that if a crime 0:16:21.910,0:16:27.109 next happened within their network of[br]people every person connected to this 0:16:27.109,0:16:33.319 network will be arrested whether or not[br]they were actually involved in the crime 0:16:33.319,0:16:38.379 being committed. Now there are actually[br]dozens of police departments that are 0:16:38.379,0:16:46.100 using similar programs. The Chicago Police[br]Department has an index of the 400 people 0:16:46.100,0:16:50.359 most likely to be involved in violent[br]crimes. That sounds like a BuzzFeed 0:16:50.359,0:16:56.389 article but actually there is a reality[br]which is extremely concerning, because 0:16:56.389,0:17:02.069 those people who are in this list are for[br]the most part not actual criminals, they 0:17:02.069,0:17:08.019 are purely seen to be connected to people[br]who've committed crime. So if your next- 0:17:08.019,0:17:16.679 door neighbor is a criminal then you may[br]well find your name on that list. Now 0:17:16.679,0:17:21.480 predictive policing is deceptive and[br]problematic for several reasons: First of 0:17:21.480,0:17:26.519 all there's the question of the[br]presumption of innocence. In a world where 0:17:26.519,0:17:32.519 even before you commit a crime you can[br]find your name on that list or be called 0:17:32.519,0:17:37.899 by the police - you know - what happens to[br]this very basis of democracy which is the 0:17:37.899,0:17:42.529 presumption of the of innocence. But also[br]there's the other question of like can we 0:17:42.529,0:17:47.720 really use the math that was originally[br]designed for earthquakes and apply to 0:17:47.720,0:17:53.049 human beings because human beings don't[br]work like earthquakes. They have their own 0:17:53.049,0:17:59.870 set of biases and the biases[br]start with how we collect the data. For 0:17:59.870,0:18:07.640 example, if the police is more likely to[br]police areas where there is minorities, 0:18:07.640,0:18:11.769 people of color, then obviously the data[br]they will have will be disproportionately 0:18:11.769,0:18:18.490 higher on persons of color. Likewise if[br]they are unlikely to investigate white- 0:18:18.490,0:18:24.200 collar crime they will be unlikely to have[br]data that are reflecting a reality where 0:18:24.200,0:18:29.040 crime also happens in wealthier areas. So[br]basically we are inputting biased datasets 0:18:29.040,0:18:35.030 that obviously will lead to biased[br]results. And what these biased results 0:18:35.030,0:18:41.600 mean is that it will continue the already[br]existing trend of over policing 0:18:41.600,0:18:48.440 communities of color and low-income[br]communities. I'll leave it to Millie for 0:18:48.440,0:18:55.667 the next box. So, one of the increasingly[br]popular technologies we're seeing in the 0:18:55.667,0:19:00.586 UK, and is no doubt used around the world[br]and probably at border points, although we 0:19:00.586,0:19:06.450 need more help with the reasearch to prove[br]this, is mobile phone extraction. The 0:19:06.450,0:19:10.680 police can extract data from your phone,[br]your laptop, and other devices which 0:19:10.680,0:19:16.431 results in a memory dump of the extracted[br]data taken from your device and now held 0:19:16.431,0:19:23.331 in an agency database. So for example all[br]your photos, all your messages, and all 0:19:23.331,0:19:28.330 those of people who had no idea they would[br]end up in a police database because 0:19:28.330,0:19:34.549 they're associated with you retained for[br]as long as the police wish. Now these 0:19:34.549,0:19:38.600 devices are pretty user friendly for the[br]police and if you're interested you can 0:19:38.600,0:19:42.559 look on YouTube where Cellebrite one of[br]the big players has lots of videos about 0:19:42.559,0:19:48.929 how you can use them, and so depending on[br]the device and the operating system some 0:19:48.929,0:19:54.419 of the data this is from a police document[br]but it lists what they can extract using a 0:19:54.419,0:20:01.820 Cellebrite UFED is what you might expect:[br]device information, calls, messages, 0:20:01.820,0:20:08.970 emails, social media, and Wi-Fi networks.[br]But if you look at their website and here 0:20:08.970,0:20:14.750 are a few examples they can also collect:[br]system and deleted data, they can access 0:20:14.750,0:20:20.580 cloud storage, and inaccessible partitions[br]of the device. Now this is data that is 0:20:20.580,0:20:26.490 clearly beyond the average users control,[br]and as the volume of data we hold on our 0:20:26.490,0:20:31.749 phones increases so will this list. And [br]the companies we know the UK police are 0:20:31.749,0:20:39.059 using, which includes: Cellebrite, Acceso,[br]Radio Tactics, MSAB, are all aware of how 0:20:39.059,0:20:44.750 valuable this is and as one of them have[br]stated: "if you've got access to a person 0:20:44.750,0:20:50.500 SIM card, you've got access to the whole[br]of a person's life". They also go on to 0:20:50.500,0:20:56.070 note: "the sheer amount of data stored on[br]mobile phones is significantly greater 0:20:56.070,0:21:04.149 today than ever before." There are also no[br]temporal limits to the extraction of data, 0:21:04.149,0:21:09.149 this is from another police document we[br]obtained and it shows that if you choose 0:21:09.149,0:21:16.159 to extract to certain data type you will[br]obtain all data of a particular type, not 0:21:16.159,0:21:21.280 just the data relevant to an[br]investigation. So all that data on a 0:21:21.280,0:21:28.429 police database, indefinitely and even if[br]you were asked whether you were happy for 0:21:28.429,0:21:32.789 your data to be extracted during an[br]investigation I think it's highly unlikely 0:21:32.789,0:21:37.630 you would realize the volume that the[br]police were going to take. Other targets 0:21:37.630,0:21:44.179 for the police that we know about are:[br]infotainment systems in cars, Smart TVs, 0:21:44.179,0:21:51.230 and connected devices in the home. This is[br]an extract from a tech UK report, where 0:21:51.230,0:21:56.700 Mark Stokes head of digital forensics at[br]the Met Police which the police in London 0:21:56.700,0:22:03.200 stated in January, that the crime scene of[br]tomorrow will be the Internet of Things 0:22:03.200,0:22:08.450 and detectors of the future will carry a[br]digital forensics toolkit that will help 0:22:08.450,0:22:15.020 them analyze microchips and download data[br]at the scene rather than removing devices 0:22:15.020,0:22:20.081 for testing. Now I can imagine that the[br]evidence storage room is going to get a 0:22:20.081,0:22:24.840 bit full if they start dragging in[br]connected fridges, hair dryers, hair 0:22:24.840,0:22:32.570 brushes, your Google home, Amazon echo and[br]whatever else you have. However, their 0:22:32.570,0:22:38.240 plans to walk into your home and download[br]everything, make no mention of needing a 0:22:38.240,0:22:43.509 specific warrant and so the only[br]limitations at the moment are the 0:22:43.509,0:22:50.220 protections that may exist on the devices.[br]The law does not protect us and this needs 0:22:50.220,0:22:59.409 to change. So I'm going to be talking a[br]little bit about open source intelligence 0:22:59.409,0:23:05.470 and in particular social media[br]intelligence, because when I talked about 0:23:05.470,0:23:10.830 predictive policing I identified those two[br]sources as some of the data that's being 0:23:10.830,0:23:17.470 used for predictive policing. Now, open[br]source intelligence is often thought as, 0:23:17.470,0:23:23.409 or often assumed to be innocuous, and[br]there is the understanding that if 0:23:23.409,0:23:29.440 information is publicly available then it[br]should be fair for the police to use. Now 0:23:29.440,0:23:34.270 the problem is that among open source[br]intelligence there's often social media 0:23:34.270,0:23:40.509 intelligence that we refer to as[br]documents. Now there are many ways to 0:23:40.509,0:23:45.900 conduct document and it can range from[br]like the single police officer, who is 0:23:45.900,0:23:54.009 just you know using Facebook or Twitter to[br]look up the accounts of victims or 0:23:54.009,0:23:58.620 suspected criminals, but there was also[br]companies that are scrapping the likes of 0:23:58.620,0:24:04.580 Facebook and Twitter to allow the police[br]to monitor social media. Now social medias 0:24:04.580,0:24:10.580 have like blurred the lines between public[br]and private, because obviously we are 0:24:10.580,0:24:17.909 broadcasting our views on this platform[br]and at the moment the police has been 0:24:17.909,0:24:25.059 exploiting this kind of unique space, this[br]blured line, ithey are accessing this 0:24:25.059,0:24:30.809 content in a completely unregulated[br]manner, as long as the content is publicly 0:24:30.809,0:24:37.620 available like for example you don't need[br]to be friend or to have any already 0:24:37.620,0:24:43.470 established connection with the suspected[br]criminal or the police or the victim 0:24:43.470,0:24:48.610 anything that's available to you it's[br]completely unregulated there are no rules 0:24:48.610,0:24:56.700 and I mentioned earlier the question of a[br]budget restriction and so the police is 0:24:56.700,0:25:01.749 benefiting hugely from this because it[br]doesn't really cost anything to use social 0:25:01.749,0:25:07.019 media so at the moment SOCMINT is kind of[br]like the first and easy step in a police 0:25:07.019,0:25:14.470 investigation because there is no cost and[br]because there is no oversight. Now, 0:25:14.470,0:25:19.420 SOCMINT actually isn't so innocent in the[br]sense that it allows the police to 0:25:19.420,0:25:25.519 identify the locations of people based on[br]their post, it allows them to establish 0:25:25.519,0:25:30.669 people's connection, their relationships,[br]their association, it allows the 0:25:30.669,0:25:37.380 monitoring of protest and also to identify[br]the leaders of various movement, and to 0:25:37.380,0:25:45.880 measure a person's influence. Now, in the[br]UK what we know is that the police is 0:25:45.880,0:25:52.019 largely using marketing products, so this[br]is an anonymous quote from a report by 0:25:52.019,0:25:58.029 academics that have been doing research on[br]SOCMINT and what someone said was that: "A 0:25:58.029,0:26:01.620 lot of stuff came out of marketing because[br]marketing were using social media to 0:26:01.620,0:26:05.190 understand what people were saying about[br]their product... We wanted to understand 0:26:05.190,0:26:11.549 what people were saying so it's almost[br]using it in reverse". Now again, this is 0:26:11.549,0:26:16.350 not considered like surveillance device[br]this is purely a marketing project that 0:26:16.350,0:26:23.309 they're using and for that reason law[br]enforcement agencies and security agencies 0:26:23.309,0:26:30.140 are often arguing that SOCMINT has[br]basically no impact on privacy. But 0:26:30.140,0:26:36.640 actually when your post reveals your[br]location or when the content of your post 0:26:36.640,0:26:40.080 reveal what used to be considered and is[br]still considered actually as sensitive 0:26:40.080,0:26:45.090 private information like details about[br]your sexual life, about your health, about 0:26:45.090,0:26:50.120 your politics, can we really minimize the[br]impact of the police accessing this 0:26:50.120,0:26:56.190 information. Now obviously we may not have[br]a problem with the average twitter user or 0:26:56.190,0:27:00.880 with a friend reading this information but[br]when the ones who are reading the 0:27:00.880,0:27:06.460 information and taking actions on this[br]information have power over us like the 0:27:06.460,0:27:17.717 police does, you know, what does it[br]actually mean for our right to privacy? 0:27:17.717,0:27:26.610 That's not to say that people should stop[br]using social media but rather what kind of 0:27:26.610,0:27:32.960 regulation can we put in place so that[br]it's not so easy for the police to access. 0:27:32.960,0:27:41.720 The absence of regulations on SOCMINT has[br]actually already led to abuse in two cases 0:27:41.720,0:27:48.159 both in the US that we've identified: One[br]is Raza v. the City of New York which is a 0:27:48.159,0:27:55.840 case from the ACLU where we knew that we[br]found out that the city of New York, 0:27:55.840,0:28:00.179 sorry, the New York Police Department was[br]systematically gathering intelligence on 0:28:00.179,0:28:04.799 Muslim communities, and one of the ways[br]they were gathering this intelligence was 0:28:04.799,0:28:11.509 essentially by surveilling social media[br]accounts of Muslims in New York. The 0:28:11.509,0:28:17.320 second case is a company called ZeroFOX.[br]So what ZeroFox does is social media 0:28:17.320,0:28:23.150 monitoring. Now, during the the riots that[br]followed the funeral of Freddie Gray, 0:28:23.150,0:28:30.500 Freddie Gray was a 25 year old black man[br]who had been shot by the police, so after 0:28:30.500,0:28:36.549 his funeral there had been a series of[br]riots in the UK and ZeroFOX produced a 0:28:36.549,0:28:41.360 report that they shared with the Baltimore[br]Police to essentially advertise for their 0:28:41.360,0:28:47.929 social social media monitoring tool and[br]what the company was doing was again like 0:28:47.929,0:28:52.970 browsing social media and trying to[br]establish who were the threat actors in 0:28:52.970,0:28:58.659 these riots and among the 19 threat[br]actors that they identified two of them 0:28:58.659,0:29:04.499 were actually leaders of the black lives[br]matter movement. Actually at least one of 0:29:04.499,0:29:09.550 them was a woman definitely not a physical[br]threat but this is how they were 0:29:09.550,0:29:17.570 essentially labeled. So these two examples[br]actually show that again it's still sort 0:29:17.570,0:29:24.240 of the same targets, it's people of[br]colors, it's activists, it's people from 0:29:24.240,0:29:30.179 poor income backgrounds, that are singled[br]out as likely criminals. And it's very 0:29:30.179,0:29:34.029 telling when we realize that SOCMINT is[br]actually one of the sources of data that's 0:29:34.029,0:29:38.740 eventually used for predictive policing[br]and then again predictive policing leading 0:29:38.740,0:29:45.409 to people being more surveiled and[br]potentially exposed to more police 0:29:45.409,0:29:51.169 surveillance based on the fact that they[br]all singled out as as likely criminal. Now 0:29:51.169,0:29:56.890 social media is a fascinating place[br]because it's a mix between a private and a 0:29:56.890,0:30:02.210 public space as I said we are broadcasting[br]our views publicly but then again it's a 0:30:02.210,0:30:07.679 privately owned space where we follow the[br]rules that is set up by private companies. 0:30:07.679,0:30:13.779 Now, if we want to protect this space and[br]ensure that like free expression and 0:30:13.779,0:30:18.619 political organization can still happen on[br]the spaces we need to fully understand how 0:30:18.619,0:30:23.460 much the police have been exploiting the[br]spaces and how we can limit and regulate 0:30:23.460,0:30:29.879 the use of it. Now, I'll talk to Millie[br]about what we can do next. So I'm going to 0:30:29.879,0:30:33.460 briefly look at some of our initial[br]findings we've made using Freedom of 0:30:33.460,0:30:39.539 Information requests, broadly: the lack of[br]awareness by the public, weak legal basis, 0:30:39.539,0:30:45.429 and a lack of oversight. Now, sometimes[br]the lack of awareness appears intentional 0:30:45.429,0:30:54.740 - we asked the police about their plans to[br]extract data from connected devices in the 0:30:54.740,0:31:01.679 home and they replied neither confirm nor[br]deny. Now this is kind of a bizarre 0:31:01.679,0:31:06.659 response given that Mark Stokes who's a[br]member of the police had already said that 0:31:06.659,0:31:13.509 they plan to do this, in addition the UK[br]government Home Office replied to us 0:31:13.509,0:31:18.269 saying the Home Office plans to develop[br]skills and capacity to exploit the 0:31:18.269,0:31:23.929 Internet of Things as part of criminal[br]investigations. They also said that police 0:31:23.929,0:31:29.920 officers will receive training in relation[br]to extracting, obtaining, retrieving, data 0:31:29.920,0:31:35.399 from or generated by connected devices. So[br]we wrote back to every police force in the 0:31:35.399,0:31:40.970 UK had refused to reply to us and[br]presented the evidence but they maintained 0:31:40.970,0:31:45.679 their stance so we will be bringing a[br]challenge against them under the Freedom 0:31:45.679,0:31:51.929 of Information Act. Now, Eva has also[br]identified the huge risks associated with 0:31:51.929,0:31:57.769 predictive policing yet in the UK we've[br]found out this is set to increase with 0:31:57.769,0:32:02.070 forces either using commercial tools or[br]in-house ones they've developed or 0:32:02.070,0:32:09.049 planning trials for 2018. There has been[br]no public consultation, there are no 0:32:09.049,0:32:14.279 safeguards, and there is no oversight. So[br]when we ask them more questions about the 0:32:14.279,0:32:21.370 plans we were told we were 'vexatious' and[br]they won't respond to more requests so it 0:32:21.370,0:32:27.299 seems like we have yet another challenge,[br]and what about mobile phone extraction 0:32:27.299,0:32:32.570 tools here are some of the stats that have[br]been found out and I would say these 0:32:32.570,0:32:36.821 aren't completely accurate because it[br]depends on how reliable the police force 0:32:36.821,0:32:42.940 are in responding but roughly I'd say it's[br]probably more than 93 percent now of UK 0:32:42.940,0:32:48.379 police forces throughout the country are[br]extracting data from digital devices. We 0:32:48.379,0:32:53.080 know they plan to increase, we've seen in[br]their documents they plan to train more 0:32:53.080,0:32:58.690 officers, to buy more equipment, and to[br]see extraction as a standard part of 0:32:58.690,0:33:04.009 arrest, even if the devices had absolutely[br]nothing to do with the offense and so 0:33:04.009,0:33:09.769 these figures are likely to increase[br]exponentially, but in the UK not only to 0:33:09.769,0:33:15.610 the police not need a warrant in documents[br]we've read they do not even need to notify 0:33:15.610,0:33:21.139 the individual that they have extracted[br]data, for example, from their mobile phone 0:33:21.139,0:33:27.590 or that they're storing it. If this is[br]being done without people's knowledge how 0:33:27.590,0:33:32.220 on earth can people challenge it, how can[br]they ask for their data to be removed if 0:33:32.220,0:33:39.590 they're found innocent? Turning to social[br]media monitoring which the police refer to 0:33:39.590,0:33:44.330 as open source research. This is Jenny[br]Jones she's a member of the House of Lords 0:33:44.330,0:33:50.730 in the Green Party and next to her photo[br]is a quote from her entry on the domestic 0:33:50.730,0:33:57.249 extremism database, and so, if a member of[br]the House of Lords is being subject to 0:33:57.249,0:34:04.659 social media monitoring for attending a[br]bike ride then I think it's highly likely 0:34:04.659,0:34:08.830 that a large number of people who[br]legitimately exercise their right to 0:34:08.830,0:34:14.429 protest are being subject to social media[br]monitoring. Now, this hasn't gone 0:34:14.429,0:34:20.399 unnoticed completely although they're[br]slightly old these are quotes from two 0:34:20.399,0:34:24.899 officials: the first the UK independent[br]reviewer of terrorism who notes that the 0:34:24.899,0:34:29.690 extent of the use of social media[br]monitoring is not public known, and the 0:34:29.690,0:34:33.679 second is the chief surveillance[br]commissioner who is and this is a very 0:34:33.679,0:34:38.949 strong statement for a commissioner is[br]saying that basically social media should 0:34:38.949,0:34:47.649 not be treated as fair game by the police.[br]So now I'll move on to a weak or outdated 0:34:47.649,0:34:52.649 legal basis. For most of the technologies[br]we've looked at it's very unclear what 0:34:52.649,0:34:58.359 legal basis the police are using even when[br]we've asked them. This relates to mobile 0:34:58.359,0:35:03.940 phone extraction - so the legislation[br]they're relying on is over 30 years old 0:35:03.940,0:35:11.310 and is wholly inappropriate for mobile[br]phone extraction this law was developed to 0:35:11.310,0:35:16.680 deal with standard traditional searches,[br]the search of a phone can in no way be 0:35:16.680,0:35:22.300 equated to the search of a person, or the[br]search of a house, and despite the fact 0:35:22.300,0:35:26.901 that we have repeatedly asked for a[br]warrant this is not the case and we 0:35:26.901,0:35:31.270 believe that there should be a warrant in[br]place not only in the UK but in the rest 0:35:31.270,0:35:35.550 of the world. So if you think that either[br]you or your friends have had their data 0:35:35.550,0:35:39.369 extracted when they're arrested or your[br]phone has been in the possession of the 0:35:39.369,0:35:45.650 authorities you should be asking[br]questions, and very briefly something on 0:35:45.650,0:35:52.420 lack of oversight, so we reported in[br]January this year about documents that 0:35:52.420,0:35:58.000 were obtained by The Bristol Cable's[br]investigation into Cellebrite and one 0:35:58.000,0:36:04.020 report said that in half of the cases[br]sampled the police noted the police had 0:36:04.020,0:36:10.320 failed to receive authorization internally[br]for the use of extraction tools. Poor 0:36:10.320,0:36:15.809 training undermined investigations into[br]serious offences such as murder, and 0:36:15.809,0:36:20.940 inadequate security practices meant that[br]encryption was not taking place even when 0:36:20.940,0:36:26.849 it was easy to do and they were losing[br]files containing intimate personal data. 0:36:26.849,0:36:33.490 So why does this matter? Here are some key[br]points: In relation to information 0:36:33.490,0:36:37.760 asymmetry - it's clear as Eva has[br]explained that the police can now access 0:36:37.760,0:36:43.670 far more data on our devices than the[br]average user. In relation to imbalance of 0:36:43.670,0:36:47.420 power - it's clear they can collect and[br]analyze sources that are beyond our 0:36:47.420,0:36:54.320 control whether it's publicly placed[br]sensors, cameras, and other devices. There 0:36:54.320,0:36:58.890 is also unequal access and if lawyers[br]don't know what's being gathered they 0:36:58.890,0:37:03.660 don't know what to ask for from the[br]police. All in all this puts the 0:37:03.660,0:37:10.410 individual at a huge disadvantage. Another[br]impact is the chilling effect on political 0:37:10.410,0:37:16.850 expression now I'm sure many of you maybe[br]think that the police monitor your social 0:37:16.850,0:37:21.859 media but the average person is unlikely[br]to, and so if they start to know about 0:37:21.859,0:37:27.110 this are they going to think twice about[br]joining in protesting either physically or 0:37:27.110,0:37:32.380 using a hashtag, and what about who your[br]friends are? If they know you attend 0:37:32.380,0:37:38.540 protests are they really want to have[br]their data on your phone if they know that 0:37:38.540,0:37:44.460 potentially that could be extracted and[br]end up on a police database? It's far 0:37:44.460,0:37:49.380 easier to be anonymous face among many[br]people than a single isolated person 0:37:49.380,0:37:55.119 standing up to power but these new forms[br]of policing we have been discussing 0:37:55.119,0:38:00.339 redefine the very act of protesting by[br]singling out each and every one of us from 0:38:00.339,0:38:08.309 the crowd. So, what can we do? Many of you[br]will be familiar with these technologies, 0:38:08.309,0:38:12.720 but do you know how to find out what the[br]police are doing? In the UK we've been 0:38:12.720,0:38:16.610 using Freedom of Information requests, we[br]want to do this with people throughout 0:38:16.610,0:38:21.910 Europe and you don't need to be a lawyer[br]so please get in touch. We also want to 0:38:21.910,0:38:26.660 dig into the technology a bit more, I want[br]someone to use a Cellebrite UFED on my 0:38:26.660,0:38:31.809 phone and show me exactly what can come[br]out of it, and we want to tell lawyers and 0:38:31.809,0:38:37.329 activists about these new techniques. Many[br]lawyers I speak to who are experts in 0:38:37.329,0:38:42.210 actions against the police do not know the[br]police are using these tools. This means 0:38:42.210,0:38:46.700 they don't know the right questions to ask[br]and so it's fundamental you speak to 0:38:46.700,0:38:50.920 people who are bringing these cases and[br]tell them about what they can do or what 0:38:50.920,0:38:56.640 questions they should be asking, and[br]finally we want you to also raise the 0:38:56.640,0:39:18.034 debate, to share our research, and to[br]critique it, thank you. 0:39:18.034,0:39:24.220 Herald: So we've got ample enough time for[br]Q&A are there any questions in the hall, 0:39:24.220,0:39:28.670 yes, there's one over there.[br]Question: You mentioned the problem of 0:39:28.670,0:39:33.110 when they do physical extraction from the[br]Celebrite device it's going to get all of 0:39:33.110,0:39:37.710 the photos, all of the emails, or whatever[br]maybe rather than just what the 0:39:37.710,0:39:42.059 investigator needs. What is the solution[br]to that from your eyes is there a 0:39:42.059,0:39:45.740 technical one that these companies are[br]gonna have to implement - which they're 0:39:45.740,0:39:51.140 not going to - or a legal one, because on[br]the other side a mobile phone is a crucial 0:39:51.140,0:39:56.890 part in a any criminal investigation in[br]2017. So what's the workaround or the 0:39:56.890,0:40:00.020 solution to that?[br]Answer: I think it's both, I think the 0:40:00.020,0:40:04.000 fact that there isn't any law looking at[br]this and no one's discussing can there be 0:40:04.000,0:40:08.520 a technical solution or does it need to be[br]one where there's better regulation and 0:40:08.520,0:40:12.660 oversight so you extract everything, can[br]you keep it for a certain period to see 0:40:12.660,0:40:16.859 what's relevant then do you have to delete[br]it? The trouble is we don't see any 0:40:16.859,0:40:22.290 deletion practices and the police have[br]publicly stated in the media that they can 0:40:22.290,0:40:27.280 just keep everything as long as they like.[br]They like data you can kind of see why but 0:40:27.280,0:40:31.240 that doesn't mean they should keep[br]everyone's data indefinitely just in case 0:40:31.240,0:40:35.062 it's useful so I think there may be tech[br]solutions there may be legal ones and I 0:40:35.062,0:40:40.510 think perhaps both together as is one of[br]the answers. Herald: The next question 0:40:40.510,0:40:45.349 from microphone one please.[br]Q: I'm just wondering how those laws on 0:40:45.349,0:40:50.280 action and power given to the cops are[br]being sold to the UK people is it because 0:40:50.280,0:40:56.510 to fight terrorism as I said or to fight[br]drugs or this kind of stuff, what's the 0:40:56.510,0:41:00.490 argument used by the government to sold[br]that to the people. 0:41:00.490,0:41:05.170 A: I think actually one thing that's[br]important is to bear in mind is that I'm 0:41:05.170,0:41:10.630 not sure most of the of the public in the[br]UK is even aware of it, so I think unlike 0:41:10.630,0:41:15.330 the work of intelligence services an[br]agency where terrorism is used as the 0:41:15.330,0:41:22.450 excuse for ever more power and especially[br]laws that have become increasingly 0:41:22.450,0:41:26.130 invasive, actually with policing we don't[br]even fall in that kind of discourse 0:41:26.130,0:41:30.980 because it's actually hardly talked about[br]in UK. Yeah, and the mobile phone 0:41:30.980,0:41:34.880 extraction stuff we've been looking at is[br]low-level crimes, so that's like you 0:41:34.880,0:41:40.750 have, it could be you know a pub fight,[br]it could be a robbery, which that's more 0:41:40.750,0:41:45.550 serious, it could be an assault, so they[br]want to use it in every case. For all the 0:41:45.550,0:41:48.170 other techniques we have no idea what[br]they're using for that's one of the 0:41:48.170,0:41:53.599 problems.[br]Herald: The next question from the 0:41:53.599,0:41:57.400 internet please.[br]Q: When you say that there's a lack of 0:41:57.400,0:42:04.460 laws and regulations for police concerning[br]us in extraction and data from devices are 0:42:04.460,0:42:09.790 you talking just about UK and/or USA or do[br]you have any examples of other countries 0:42:09.790,0:42:13.500 who do better or worse?[br]A: I don't know of any country that has a 0:42:13.500,0:42:18.520 regulation on publicly available[br]information on social media. 0:42:18.520,0:42:25.849 Herald: Microphone number four.[br]Q: Thank you again for a great talk. In 0:42:25.849,0:42:31.920 terms of data exploitation an element that[br]I didn't hear you talk about that I'd like 0:42:31.920,0:42:35.940 to hear a little bit more is when there[br]are questions around who is doing the 0:42:35.940,0:42:40.410 exploitation, I know in the U.S. some FOIA[br]researchers get around how difficult it is 0:42:40.410,0:42:44.640 to get data from the feds by going after[br]local and state police departments, is 0:42:44.640,0:42:48.450 that something that you're doing or do you[br]have a way of addressing confusion when 0:42:48.450,0:42:50.880 people don't know what agency has the[br]data? 0:42:50.880,0:42:56.580 A: Yeah, I think actually what one of the[br]things the data exploitation program at 0:42:56.580,0:43:00.330 Privacy International is doing is actually[br]looking into the connection between the 0:43:00.330,0:43:06.050 private sector and governments because[br]obviously at the moment there's the whole 0:43:06.050,0:43:09.950 question of data brokers which is an[br]industry that's hardly regulated at all, 0:43:09.950,0:43:14.130 that people don't necessarily know about,[br]we don't, the companies that are doing it 0:43:14.130,0:43:19.900 are familiar household name. I'll let[br]Millie talk a lot more about the 0:43:19.900,0:43:24.920 government aspects of it. I guess the[br]question is again a country-by-country 0:43:24.920,0:43:29.470 basis, we work in many countries that[br]don't have any data protection regulations 0:43:29.470,0:43:36.609 at all so there is this first difficulty[br]as how do we regulate, how do we limit the 0:43:36.609,0:43:40.920 power of the state when you don't even[br]have the basic legislation around 0:43:40.920,0:43:45.710 data protection? One thing to bear in mind[br]is like the problem with companies is like 0:43:45.710,0:43:53.220 how do you also hold companies accountable[br]whereas with the state there is the whole 0:43:53.220,0:43:58.119 challenge of finding the right legal[br]framework to limit their power, but maybe 0:43:58.119,0:44:02.069 I'll let Millie talk a little bit more[br]about this. Yeah, with our with our FOIA 0:44:02.069,0:44:06.270 request we tend to go after everyone so[br]with the example of the Home Office saying 0:44:06.270,0:44:08.990 something that the other police didn't[br]that was because we went to all the 0:44:08.990,0:44:14.680 different state bodies and I think that[br]there's a good example in in the states 0:44:14.680,0:44:17.690 where there's far more research done on[br]what the police are doing, but they're 0:44:17.690,0:44:22.600 using the same product in the UK I think[br]it's axiom and they're a storage device 0:44:22.600,0:44:29.119 for body-worn camera videos, and a lawyer[br]in the states said that in order to access 0:44:29.119,0:44:32.799 the video containing his client he had to[br]agree to the terms and condition on Axioms 0:44:32.799,0:44:38.140 website which basically gave them full use[br]of his clients video about a crime scene. 0:44:38.140,0:44:42.750 So that's a private company having use of[br]this video so given that we found they're 0:44:42.750,0:44:47.120 using it in the UK we don't know if those[br]kind of terms and conditions exist but 0:44:47.120,0:44:54.673 it's a very real problem as they rely[br]increasingly on private companies. 0:44:54.673,0:44:58.370 Herald: Number two please.[br]Q: Thank you for your work perhaps you've 0:44:58.370,0:45:03.450 already answered this partially from other[br]people's questions but it looks like we 0:45:03.450,0:45:08.539 have a great way to start the process and[br]kind of taking the power back but you know 0:45:08.539,0:45:13.250 the state and the system certainly doesn't[br]want to give up this much power, how do we 0:45:13.250,0:45:18.190 actually directly, what's kind of the[br]endgame, what's the strategies for making 0:45:18.190,0:45:24.770 the police or the government's give up and[br]restore balance, is it a suit, is it 0:45:24.770,0:45:27.859 challenging through Parliament and in the[br]slow process of democracy, or what do you 0:45:27.859,0:45:32.170 think is the right way of doing it?[br]A: I never think one works on its own, 0:45:32.170,0:45:36.670 even though I'm a litigator I often think[br]litigation is quite a weak tactic, 0:45:36.670,0:45:40.920 particularly if you don't have the public[br]on side, and then again if you don't have 0:45:40.920,0:45:44.220 Parliament. So we need all of them and[br]they can all come through different means 0:45:44.220,0:45:49.090 so we wouldn't just focus on one of the[br]different countries it might be that you 0:45:49.090,0:45:53.540 go down the legal route or the down the[br]parliamentary route but in the UK we're 0:45:53.540,0:45:57.460 trying all different routes so for example[br]on mobile phone extraction in the 0:45:57.460,0:46:00.900 beginning of next year we're going to be[br]doing a video we're going to be doing 0:46:00.900,0:46:04.120 interviewing the public and speaking to[br]them about it, we're going to be going to 0:46:04.120,0:46:08.960 Parliament, and I've also been speaking to[br]a lot of lawyers so I'm hoping some cases 0:46:08.960,0:46:15.280 will start because those individual cases[br]brought by local lawyers are where also 0:46:15.280,0:46:19.859 you see a lot of change like the John Cat[br]case, that's one lawyer, so I think we 0:46:19.859,0:46:25.901 need all different things to see what[br]works and what sticks. 0:46:25.901,0:46:31.150 Herald: We haven't had number three yet.[br]Q: Hi, thanks for the talk, so I have a 0:46:31.150,0:46:39.020 question regarding concerning the solution[br]side of things because one aspect I was 0:46:39.020,0:46:45.569 missing in your talk was the economics of[br]the game actually because like you are 0:46:45.569,0:46:51.510 from the UK and the private sector has[br]like stepped in also and another public 0:46:51.510,0:46:58.799 domain the NHS to help out because funds[br]are missing and I would like to ask you 0:46:58.799,0:47:03.299 whether or not you think first of all the[br]logic is the same within the police 0:47:03.299,0:47:12.720 departments because it might also be like[br]cost driven aspect to limit the salaries 0:47:12.720,0:47:18.589 or because you have the problem with[br]police force coming in because you have to 0:47:18.589,0:47:24.099 pay their rents and automated things[br]especially when I'm given to the private 0:47:24.099,0:47:30.779 sector which has another whole logic of[br]thinking about this stuff is cost saving 0:47:30.779,0:47:43.930 and so maybe it would be a nice thing[br]whether if you could talk a bit about the, 0:47:43.930,0:47:49.359 I'm sorry, the attempt to maybe like get[br]economics a bit more into the picture when 0:47:49.359,0:47:56.130 it comes to solutions of the whole thing.[br]A: So I think yeah, your very right in 0:47:56.130,0:48:02.309 pointing actually the relation, well that[br]you compare what's happening with the NHS 0:48:02.309,0:48:07.799 and what's happening with the police[br]because in both the economics of 0:48:07.799,0:48:14.940 companies offering policing services arise[br]from the same situation there's a need of 0:48:14.940,0:48:23.380 doing more efficient policing because of[br]budget cuts, so the same way the NHS is 0:48:23.380,0:48:30.079 being essentially privatized due to the[br]budget cuts and due to the to the needs 0:48:30.079,0:48:34.799 that arise from being limited in your[br]finance, again there's a similar thing 0:48:34.799,0:48:38.880 with the police when you when you're[br]understaffed then you're more likely to 0:48:38.880,0:48:44.329 rely on on technologies to help you do[br]your work more efficiently because 0:48:44.329,0:48:51.210 essentially with predictive policing the[br]idea behind this is that if you know where 0:48:51.210,0:48:56.380 and when crime will happen then you can[br]focus the limited resources you have there 0:48:56.380,0:49:02.640 and not sort of look at a more global[br]larger picture. So I mean I'm not gonna be 0:49:02.640,0:49:06.599 here on stage advocating for more funds[br]for the police, I'm not gonna do that, but 0:49:06.599,0:49:11.660 I think that there is there is a desperate[br]need to reframe actually the narrative 0:49:11.660,0:49:19.170 around how we do policing actually and[br]then definitely also look at a different 0:49:19.170,0:49:22.680 perspective and a different approach to[br]policing because as I've tried to show 0:49:22.680,0:49:28.010 it's been a really long time since this[br]narrative has developed of more data leads 0:49:28.010,0:49:32.789 to crime resolution but actually what I[br]didn't have the time to get into in this 0:49:32.789,0:49:37.490 talk is actually all the research that are[br]showing that those product actually don't 0:49:37.490,0:49:42.770 work like PREDPOL is actually basically[br]gaslighting a lot of police officers with 0:49:42.770,0:49:47.650 their figures, the kind of figures that[br]are pushing and suggesting are just like 0:49:47.650,0:49:53.671 plain inaccurate, it's not accurate to[br]compare a city on the one year to what a 0:49:53.671,0:49:59.230 city is becoming in another year so it's[br]not even clear that a lot of this 0:49:59.230,0:50:05.460 project are even like properly functioning[br]and in a sense I don't want them to 0:50:05.460,0:50:09.250 function I'm not gonna say if we had[br]better predictive policing then the 0:50:09.250,0:50:14.869 problem will be solved no that is not the[br]question, the question is how do we have 0:50:14.869,0:50:20.820 regulation that force the police to look[br]differently into the way they are 0:50:20.820,0:50:25.597 conducting policing.[br]Herald: Number four please. 0:50:25.597,0:50:31.980 Q: So, thank you for your presentation I[br]have a question about SOCMINT, my opinion 0:50:31.980,0:50:37.359 SOCMINT might violate the terms of[br]services of for example Twitter and 0:50:37.359,0:50:41.000 Facebook have you tried to cooperate with[br]these companies to make them actually 0:50:41.000,0:50:46.360 enforce their TOS?[br]A: So actually there is two things as I 0:50:46.360,0:50:51.270 said like all companies that are doing[br]scraping of data and you're right in this 0:50:51.270,0:50:58.700 case they violate the terms of services of[br]Facebook and Twitter. Now, the other 0:50:58.700,0:51:03.049 problem is that there is already a loop to[br]this and actually the marketing company I 0:51:03.049,0:51:08.289 was talking about that's being used by the[br]UK police what they essentially do is that 0:51:08.289,0:51:13.559 they purchase the data from Facebook and[br]Twitter, so this is why it's interesting 0:51:13.559,0:51:19.900 because when Facebook's say we don't sell[br]your data, well essentially actually with 0:51:19.900,0:51:25.970 marketing tools that are there to monitor[br]what people say about products essentially 0:51:25.970,0:51:29.599 what you're doing is selling your data,[br]they're not selling necessarily like your 0:51:29.599,0:51:34.400 name or your location or things like that[br]but whatever you're going to be posting 0:51:34.400,0:51:41.109 publicly for example in like groups or[br]public pages is something that they are 0:51:41.109,0:51:45.329 going to be trying to sell to those[br]companies. So I think you're right and 0:51:45.329,0:51:50.839 maybe Millie will have more to say about[br]this. I think those companies have a role 0:51:50.839,0:51:56.260 to play but at the moment I think the[br]challenge we face is actually this loop 0:51:56.260,0:52:00.960 that we're facing where by purchasing the[br]data directly from the company they don't 0:52:00.960,0:52:07.420 face any they don't violate the terms of[br]services. Yeah, we've spoken a bit to the 0:52:07.420,0:52:12.840 some of the social media companies, we've[br]been told that one of their big focuses is 0:52:12.840,0:52:17.710 the problems of the social media[br]monitoring at the U.S. border and so 0:52:17.710,0:52:22.609 because there's a lot known about that[br]they're looking at those issues so I think 0:52:22.609,0:52:27.000 once we show more and more the problems[br]say in the UK or in other countries I 0:52:27.000,0:52:31.869 think it would be very interesting to look[br]at what's happened over the Catalan 0:52:31.869,0:52:37.410 independence vote period to see how social[br]media was used then. I think the companies 0:52:37.410,0:52:42.380 aren't going to react until we make them[br]although they probably will meet with us. 0:52:42.380,0:52:49.990 A slightly different aspect we revealed in[br]a different part of our work that the 0:52:49.990,0:52:53.190 intelligence agencies were gathering[br]social media that's probably not 0:52:53.190,0:52:57.779 groundbreaking news but it was it was[br]there in plain fact and so they all got a 0:52:57.779,0:53:01.480 bit concerned about how that was[br]happening, whether some of them knew or 0:53:01.480,0:53:05.950 some of them didn't, so the better our[br]research the more people speaking about it 0:53:05.950,0:53:11.030 I think they will engage, or we'll find[br]out are they are the police getting it 0:53:11.030,0:53:17.350 lawfully or unlawfully.[br]Herald: Number one please. 0:53:17.350,0:53:21.200 Q: Thanks for your talk, I have a question[br]on predictive policing because German 0:53:21.200,0:53:28.700 authorities in the last two years piloted pre-cops[br]PREDPOL projects in three states I think 0:53:28.700,0:53:33.630 and they claimed that they would never use[br]these techniques with data on individuals 0:53:33.630,0:53:38.870 but only aggregate data like the new[br]repeat stuff you presented and they 0:53:38.870,0:53:42.940 presented as just an additional tool in[br]their toolbox and that if use responsibly 0:53:42.940,0:53:48.240 can lead to more cost effective policing,[br]do you buy this argument or would you say 0:53:48.240,0:53:55.020 that there's inevitably slippery slope or[br]kind of like a path dependency to more 0:53:55.020,0:54:01.010 granular data assessment or evaluation[br]that would inevitably infringe on privacy 0:54:01.010,0:54:05.319 rights?[br]A: I think this goes back to the question 0:54:05.319,0:54:08.740 of like you know are we using per[br]listening to identify where crime is 0:54:08.740,0:54:14.369 happening or who it is who's committing a[br]crime but actually I think even if we if 0:54:14.369,0:54:18.910 we stick to this even if we stick to[br]identifying where crime is happening we 0:54:18.910,0:54:23.650 still run into problems we still run into[br]the fundamental problem of predictive 0:54:23.650,0:54:28.599 policing which is we only have data on[br]crime that have already been reported ever 0:54:28.599,0:54:35.809 or already been addressed by the police,[br]and that's by essence already biased data. 0:54:35.809,0:54:41.430 If we have police in some areas then we're[br]more likely to, you know, further police 0:54:41.430,0:54:51.579 because the solution of those companies of[br]those algorithm will be leading to more 0:54:51.579,0:54:57.880 suggestions that crime is is happening[br]more predominantly in those areas. So, as 0:54:57.880,0:55:04.459 we've seen so far is that we fall into[br]these fundamental problems of just 0:55:04.459,0:55:11.329 overpolicing communities that are already[br]overpoliced. So in a sense in terms of 0:55:11.329,0:55:18.069 well the right to privacy but also the[br]question of the presumption of innocence I 0:55:18.069,0:55:23.040 think purely just having trying to[br]cultivate data on the where crime is 0:55:23.040,0:55:29.660 happening it's not efficient policing[br]first of all but it's also causing 0:55:29.660,0:55:35.020 challenges for fundamental rights as well.[br]Yeah, I guess it's not a great comparison 0:55:35.020,0:55:39.481 but what a lot of what they're bringing in[br]now is a program to assist you with the 0:55:39.481,0:55:43.910 charging decision, so you've got someone[br]you've arrested do you charge them or not? 0:55:43.910,0:55:48.319 The police say oh well of course it's only[br]advisory you only have to look at how busy 0:55:48.319,0:55:52.660 a police station is to know how advisory[br]is that going to be and how much is it 0:55:52.660,0:55:56.740 going to sway your opinion. So the more[br]you use these tools the more it makes your 0:55:56.740,0:56:01.260 job easier because rather than thinking,[br]where are we going to go, what areas 0:56:01.260,0:56:04.250 things going to happen, who are we going[br]to arrest, well the computer told us to do 0:56:04.250,0:56:08.700 this so let's just do that.[br]Herald: Thank you and microphone number 0:56:08.700,0:56:13.111 three please.[br]Q: Thank you, do you think that there are 0:56:13.111,0:56:19.940 any credible arguments to be made for[br]limiting the police's abilities under acts 0:56:19.940,0:56:25.130 in the UK that incorporate EU level[br]restrictions on privacy data protection 0:56:25.130,0:56:29.650 human rights or fundamental rights and if[br]so do you anticipate that those arguments 0:56:29.650,0:56:35.140 might change after brexit?[br]A: Well they they're bringing in GDPR and 0:56:35.140,0:56:39.670 the Law Enforcement Directive now and[br]they're not going to scrap those once 0:56:39.670,0:56:44.299 brexit comes in. We'll still be part,[br]hopefully, of the European Court of Human 0:56:44.299,0:56:49.130 Rights, but not the European Court of[br]Justice. I think there are going to be 0:56:49.130,0:56:51.960 implications it's going to be very[br]interesting how they play it out they're 0:56:51.960,0:56:57.420 still going to want the data from Europol,[br]they want to be part of Interpol, policing 0:56:57.420,0:57:02.309 operates at a different level and I think[br]if they have to comply with certain laws 0:57:02.309,0:57:06.029 so that they can play with the big boys[br]then they probably will, but they may do 0:57:06.029,0:57:12.160 things behind the scenes, so it depends[br]where it works for them, but certainly the 0:57:12.160,0:57:16.019 politicians and definitely the police[br]wanna be part of those groups. So we'll 0:57:16.019,0:57:20.809 have to see, but we will still use them[br]and we'll still rely on European judgments 0:57:20.809,0:57:26.865 the force they have in a court of law may[br]be more difficult. 0:57:26.865,0:57:32.319 Herald: Does the internet have any[br]questions, nope, well then number two 0:57:32.319,0:57:35.839 please.[br]Q: So you've mentioned that they don't 0:57:35.839,0:57:41.609 have really good operational security and[br]sometimes some stuff that should not leak 0:57:41.609,0:57:47.869 leaked now within the last year we had[br]major data leaks all across the world like 0:57:47.869,0:57:54.710 Philippines, South Africa, just to mention[br]a few, now if the, security, OPSEC is so 0:57:54.710,0:58:00.160 bad in the police in Great Britain it's[br]not unlikely that something will happen 0:58:00.160,0:58:05.299 in Europe of a similar kind what kind of[br]impact do you think such a huge data leak 0:58:05.299,0:58:11.750 of private information which the police[br]legally stored has even if it was not 0:58:11.750,0:58:16.539 leaked by the police and it would be leaked[br]by a private company that had some way 0:58:16.539,0:58:19.329 access to it?[br]A: I I guess it depends what it what it 0:58:19.329,0:58:25.340 is, if it's a database with serious[br]criminals and only the bad people, then 0:58:25.340,0:58:29.480 people will think when it's[br]good they have that information but they 0:58:29.480,0:58:35.920 need to make it more secure. If[br]somehow databases which held all sorts of 0:58:35.920,0:58:39.589 information say from people's mobile[br]phones, innocent people's pictures, all 0:58:39.589,0:58:44.820 that kind of thing then we might see a[br]much wider public reaction to the tools 0:58:44.820,0:58:51.039 that are used and the safeguards, the[br]legal safeguards, will come a lot quicker 0:58:51.039,0:58:55.599 than probably we will achieve in the way[br]we're trying to go now because there'll be 0:58:55.599,0:59:02.030 a bigger public outrage.[br]Herald: Okay one last and hopefully short 0:59:02.030,0:59:06.619 question from microphone one.[br]Q: Hi, thanks for the talk was really 0:59:06.619,0:59:10.320 interesting, it's actually quite a short[br]question how much is a Cellebrite, and can 0:59:10.320,0:59:14.760 we buy one?[br]A: I did look to buy one, I think there 0:59:14.760,0:59:21.319 were some on eBay but I'm sure if they[br]were like the right things but a couple of 0:59:21.319,0:59:24.319 thousand pounds, but I think you have to[br]actually be a police force to get those 0:59:24.319,0:59:30.529 ones, maybe there are other types but[br]it's expensive but not unobtainable, but 0:59:30.529,0:59:34.779 I'm trying to find universities that might[br]have them because I think that a lot of 0:59:34.779,0:59:38.369 forensic schools I'm hoping that they[br]will, I know they do extractions of 0:59:38.369,0:59:41.725 laptops but I haven't found one yet that[br]does phones but I probably haven't asked 0:59:41.725,0:59:45.808 enough people. [br]Herald: So thank you very much. 0:59:45.808,0:59:50.990 34C3 Music 0:59:50.990,1:00:07.000 subtitles created by c3subtitles.de[br]in the year 2020. Join, and help us!