0:00:00.390,0:00:09.100
preroll music
0:00:09.100,0:00:13.370
Herald: Good evening, thank[br]you for joining us tonight,
0:00:13.370,0:00:18.019
here at the CCC in Hamburg.[br]And also thank you for everyone
0:00:18.019,0:00:20.769
tuning in around the[br]world via our livestream.
0:00:20.769,0:00:26.919
I'm very, very honored and excited[br]to introduce our new... next guest,
0:00:26.919,0:00:29.439
Mahsa Alimardani?[br]laughs
0:00:29.439,0:00:34.620
- it was my attempt to say the name Mahsa[br]Alimardani - she's an Iranian-Canadian
0:00:34.620,0:00:36.989
researcher and activist.
0:00:36.989,0:00:42.280
Mahsa is finishing her master's[br]degree and is a research assistant
0:00:42.280,0:00:45.730
at the Deja Active Lab, both at[br]the university of Amsterdam,
0:00:45.730,0:00:52.199
and her focus is on freedom of[br]expression and access to information
0:00:52.199,0:00:58.589
in Iran. She's also the editor[br]of the Global Voices Iran
0:00:58.589,0:01:02.510
and today she will be sharing some[br]of her research findings with us
0:01:02.510,0:01:08.799
about the censorship situation[br]in Iran on mobile platforms.
0:01:08.799,0:01:14.590
With that I would like to ask you to[br]help me welcome Mahsa Alimardani!
0:01:14.590,0:01:23.380
applause
0:01:23.380,0:01:26.920
Mahsa Alimardani: Thank you Sonia,[br]for the nice introduction,
0:01:26.920,0:01:29.759
and thank you all for[br]coming to this session,
0:01:29.759,0:01:33.890
I know there's a lot of awesome[br]computing sessions happening right now.
0:01:33.890,0:01:40.530
And, so, just to introduce you a little[br]bit to the Iranian internet ecosystem.
0:01:40.530,0:01:46.950
So, there are some realities,[br]you should know about it.
0:01:46.950,0:01:48.439
decent laughter
0:01:48.439,0:01:53.280
Yes, if you're thinking of traveling to[br]Iran I'd tell this to everyone: Do go!
0:01:53.280,0:01:56.219
It's awesome, it's amazing,[br]it's a beautiful country.
0:01:56.219,0:01:59.490
Although, take into consideration[br]the type of work that you do and
0:01:59.490,0:02:02.109
the type of public profile[br]you have when you do go.
0:02:02.109,0:02:05.850
If you do go do set up TOR relays[br]'cause that's really helpful to people
0:02:05.850,0:02:10.410
accessing the internet in Iran.
0:02:10.410,0:02:12.660
And one of the things you should[br]know that the Iranian internet,
0:02:12.660,0:02:16.550
it's often known as the Filter Net.
0:02:16.550,0:02:20.620
And Filter Net sort of has been the name[br]ascribed to the internet
0:02:20.620,0:02:23.209
because of the censorship[br]that happens in Iran.
0:02:23.209,0:02:27.440
I think out of the whole[br]world Iran would come
0:02:27.440,0:02:31.110
second after China in the terms[br]of the pervasiveness of censorship
0:02:31.110,0:02:34.569
and internet controls around the world.
0:02:34.569,0:02:38.120
Something that you might not know is[br]that it is also known as the "Kondnet"
0:02:38.120,0:02:41.450
and "kond" means "slow".
0:02:41.450,0:02:44.970
The fact that the internet[br]is often throttled in Iran,
0:02:44.970,0:02:47.500
and the speeds are very slow,
0:02:47.500,0:02:51.180
and the fact that it can be very[br]frustrating sometimes to upload a page
0:02:51.180,0:02:55.019
it also has the name of "Kondnet".
0:02:55.019,0:03:01.250
So, this talk will sort of describe this,[br]I'll talk on Mobile Censorship
0:03:01.250,0:03:05.230
and how they will focus on that.[br]I just wanna take a sort of broader view
0:03:05.230,0:03:11.769
and to look at more general[br]look at internet policy in Iran
0:03:11.769,0:03:14.140
and just before I sort of delve into it...
0:03:14.140,0:03:16.709
The reason why I really[br]wanted to get this talk at
0:03:16.709,0:03:21.909
a conference like the CCC is[br]because I know this is a community
0:03:21.909,0:03:26.030
full of lots of different[br]expertise in terms of
0:03:26.030,0:03:28.049
Digital Security,[br]in terms of Circumvention.
0:03:28.049,0:03:31.319
So, bringing awareness and sort[br]of knowledge in focus on Iran
0:03:31.319,0:03:34.810
I think is kind of exciting[br]in a community like this
0:03:34.810,0:03:39.530
'cause a lot of help and[br]a lot of aid can go towards
0:03:39.530,0:03:43.420
access to internet in Iran[br]from a group of people like you.
0:03:43.420,0:03:48.819
So: just a broad look at what the internet[br]infrastructure's like in Iran is.
0:03:48.819,0:03:53.340
The Ministry of Information,[br]Communication and Technology (ICT)
0:03:53.340,0:03:55.939
runs the Telecommunications[br]Company of Iran
0:03:55.939,0:04:01.150
and this company is also responsible
0:04:01.150,0:04:05.989
for the main ISP of Iran which is the[br]Data Communication Company of Iran.
0:04:05.989,0:04:11.390
So, in effect they control all[br]internet traffic that goes into Iran
0:04:11.390,0:04:16.269
and all ISP's both private and[br]government are controlled through
0:04:16.269,0:04:19.630
the Data Communication Company of Iran.
0:04:19.630,0:04:24.670
So this company in effect becomes[br]the point where filtering can occur
0:04:24.670,0:04:29.590
and the blocking of pages or[br]the blacklisting of keywords occurs.
0:04:29.590,0:04:33.160
Oftentimes the Telecommunications[br]Company uses proxy servers
0:04:33.160,0:04:39.540
for surveillance by logging all[br]unencrypted internet traffic that goes on
0:04:39.540,0:04:43.600
in Iran which is why it's really important[br]for pages that are being used
0:04:43.600,0:04:47.130
especially by Iranians if not[br]everywhere else in the world
0:04:47.130,0:04:51.440
to have https for all[br]Mobile Applications to be using
0:04:51.440,0:04:54.900
encryption technology[br]and things like that.
0:04:54.900,0:04:58.340
Now, all of these things[br]are really concerning as it is
0:04:58.340,0:05:04.530
the fact that the government has so[br]much access to data over the internet.
0:05:04.530,0:05:08.920
What's even more concerning[br]is looking at this chart here.
0:05:08.920,0:05:14.570
So this is the overall view[br]of the institutions responsible
0:05:14.570,0:05:17.760
for internet policy in Iran.[br]And you see at the very top
0:05:17.760,0:05:22.070
there is the Supreme Leader. Although[br]Iran does have no active president,
0:05:22.070,0:05:25.690
ultimately, the Supreme Leader[br]has the Veto Power
0:05:25.690,0:05:30.680
and is in effect really[br]the official Head Of State.
0:05:30.680,0:05:35.700
And so while the ministry of ICT is part[br]of the elected administration
0:05:35.700,0:05:40.190
the Supreme Leader has ultimate power.[br]And what is particularly
0:05:40.190,0:05:44.770
concerning here is while we have[br]the ministry of ICT here on the right
0:05:44.770,0:05:48.350
and then you have the Telecommunications[br]Company. And then you have
0:05:48.350,0:05:53.410
the ISP provider in Iran. You then[br]have the Revolutionary Guards
0:05:53.410,0:05:57.270
which are a para-military[br]organization in Iran
0:05:57.270,0:06:00.850
who are not accountable[br]to the elected government.
0:06:00.850,0:06:04.400
They're ultimately only accountable[br]to the Supreme Leader.
0:06:04.400,0:06:09.630
They own the largest share of the[br]Telecommunications Company of Iran.
0:06:09.630,0:06:14.000
This is particularly concerning because[br]a group like the Revolutionary Guards
0:06:14.000,0:06:18.350
are the ones who are oftentimes[br]responsible for
0:06:18.350,0:06:23.520
various surveillance programs,[br]for arrests of dissidents.
0:06:23.520,0:06:28.500
One of their offshoots, the Basij[br]were the ones on the streets,
0:06:28.500,0:06:31.810
arresting and beating up protesters[br]during the 2009 Green Movement.
0:06:31.810,0:06:35.910
So the fact that they have access to[br]this kind of data it's very concerning
0:06:35.910,0:06:43.730
in why things like digital security are of[br]the upmost importance in Iran.
0:06:43.730,0:06:47.720
Just a little brief overview of why
0:06:47.720,0:06:51.390
this sort of history started in Iran.[br]It's not always been like this.
0:06:51.390,0:06:57.430
This started during the Reformer's era[br]in Iran which were the late 90ies.
0:06:57.430,0:07:02.680
This was a period where[br]relative to the Iranian context
0:07:02.680,0:07:08.320
which is a Islamic theocracy there was[br]more progressive politics
0:07:08.320,0:07:12.980
and the hardline elements which aren't[br]often accountable to the electorate
0:07:12.980,0:07:18.860
in Iran kind of clashed with the[br]Reformer's Government that was in power
0:07:18.860,0:07:22.430
and so the surge in Reformer's[br]jounalists that were
0:07:22.430,0:07:26.220
in traditional print media meant[br]that they could start migrating online
0:07:26.220,0:07:31.350
in the early 2000's, late 90ies, when[br]blogging was becoming really popular
0:07:31.350,0:07:36.620
and the technology to use Persian unicode[br]was becoming more pervasive.
0:07:36.620,0:07:39.680
During this time the government[br]sort of realized that there's
0:07:39.680,0:07:43.370
this space that's not[br]being controlled at all.
0:07:43.370,0:07:47.460
And so filtering of pages[br]started early on in 2001
0:07:47.460,0:07:52.420
but there was no real systematic[br]procedure for this filtering.
0:07:52.420,0:07:57.070
So they came up with the[br]Cybercrimes Law in 2006.
0:07:57.070,0:08:01.530
But that sort of lay[br]floating around until 2009
0:08:01.530,0:08:05.360
when the internet became[br]a really big deal because,
0:08:05.360,0:08:09.440
I'm sure some of you have[br]heard of the Twitter Revolution
0:08:09.440,0:08:12.919
which sort of came out after 2009[br]Green Movement. And it was at that point
0:08:12.919,0:08:17.390
- when Iranians were coming out en masse[br]onto the streets protesting
0:08:17.390,0:08:21.300
what they claimed to be a fraudulent[br]election - that the Iranian Government
0:08:21.300,0:08:25.760
shut down the internet. And so[br]after this period they codified
0:08:25.760,0:08:31.170
the Cybercrimes Law to sort of ensure[br]a more systematic way of filtering
0:08:31.170,0:08:35.780
various pages including Twitter[br]and Facebook, that came out of it.
0:08:35.780,0:08:38.960
And then following this you[br]had the Revolutionary Guard's
0:08:38.960,0:08:43.770
establishment of Gerdab which is[br]a Cyber Command Center
0:08:43.770,0:08:47.960
which is now responsible for[br]the arrest of many different bloggers
0:08:47.960,0:08:52.860
and activists in Iran. And then in 2011
0:08:52.860,0:08:56.180
because there wasn't enough[br]control over the internet
0:08:56.180,0:09:01.320
they set up the FATA, a police force,[br]from the police forces.
0:09:01.320,0:09:06.020
While they do sort of take care[br]of things like cybercrime
0:09:06.020,0:09:10.320
in terms of banking, in identity theft,[br]they also are responsible
0:09:10.320,0:09:15.680
for the arrests of various bloggers.[br]There was one popular case in 2012
0:09:15.680,0:09:21.690
of Sattar Beheshti, who had public[br]dissident posts against the government.
0:09:21.690,0:09:26.880
And then finally in 2012[br]the Supreme Leader who has
0:09:26.880,0:09:31.580
quite a grand name of its own decided[br]to setup a very Sci-fi-esque body
0:09:31.580,0:09:37.110
- at least in the English language -[br]called the Supreme Council of Cyberspace.
0:09:37.110,0:09:40.150
audience amused
0:09:40.150,0:09:45.690
This body basically would be responsible[br]for all of the Internet Policy
0:09:45.690,0:09:49.920
in Iran. And this really marked[br]a turning point in Iran where
0:09:49.920,0:09:56.710
cyberspace and internet became[br]a key issue of National Security;
0:09:56.710,0:09:59.770
not only were there concerns[br]of cyber attacks from the United States
0:09:59.770,0:10:04.470
and Israel, there was also[br]big concerns of dissidents
0:10:04.470,0:10:08.240
and various movements that could[br]sort of emerge through Social Media
0:10:08.240,0:10:13.400
and the blogs. And so all the[br]decision making would occur through
0:10:13.400,0:10:17.380
the members that they decided to appoint[br]to this council. And it's a mixed bag
0:10:17.380,0:10:25.610
of different ministers as well as[br]unelected officials and experts.
0:10:25.610,0:10:30.080
Over the years they've had various[br]different programs to try to control
0:10:30.080,0:10:34.610
the internet and most recently[br]in last March they came up with
0:10:34.610,0:10:39.680
another grand sounding[br]program called Spider.
0:10:39.680,0:10:45.260
Spider was a project of the Revolutionary[br]Guards where they sort of
0:10:45.260,0:10:50.490
talked about doing blanket surveillance[br]over all Social Media activities,
0:10:50.490,0:10:53.380
activities of Iranians which technically
0:10:53.380,0:10:59.540
- if any of you know anything about[br]how Facebook or how Twitter works -
0:10:59.540,0:11:06.100
it's quite hard. If posts are private[br]it's hard to delve into them.
0:11:06.100,0:11:13.070
Anyways, so what is key to understanding[br]about the internet climate right now
0:11:13.070,0:11:17.920
is that there is a moderate president[br]Rohani who came into power
0:11:17.920,0:11:21.680
on a platform of many[br]different progressive policies
0:11:21.680,0:11:25.140
one of which was Internet Freedom.
0:11:25.140,0:11:29.120
And so they've had many[br]different progressive moments.
0:11:29.120,0:11:35.350
They shut down the hardline judiciary's[br]attempts to block Whatsapp e.g.
0:11:35.350,0:11:40.370
and they've promised not to really[br]shut down any other platform
0:11:40.370,0:11:44.790
or censor anything unless there is[br]a legitimate replacement for them
0:11:44.790,0:11:48.180
and this is a quote by[br]the minister of ICT.
0:11:48.180,0:11:51.960
But at the same time[br]they've been trying to cater to
0:11:51.960,0:11:55.620
some of the hardline elements[br]and try to sort of balance out
0:11:55.620,0:11:59.720
their Internet Freedom policies with[br]programs like intelligent filtering,
0:11:59.720,0:12:04.490
which would mean not blocking[br]entire platforms outright but
0:12:04.490,0:12:08.970
blocking individual pages.
0:12:08.970,0:12:14.800
This program... about 66 Mio. Dollars[br]has been spent on this program
0:12:14.800,0:12:20.650
from the ICT budget. And overall[br]it's been a bit of a failure.
0:12:20.650,0:12:26.010
I worked on a piece of research[br]with Frederic Jacobs that sort of
0:12:26.010,0:12:30.650
underlined how the intelligent filtering[br]on Instagram, which was
0:12:30.650,0:12:35.320
the most tangible,[br]resolved of this form of control.
0:12:35.320,0:12:39.060
was only occuring because[br]Instagram had failed to release
0:12:39.060,0:12:44.980
the https on the Mobile API.[br]So they were able to enable
0:12:44.980,0:12:50.060
intelligent filtering on the mobile[br]application but not on the browser.
0:12:50.060,0:12:53.360
Later on people found out that there was[br]still disruptions and images
0:12:53.360,0:12:58.680
weren't loading to Instagram even[br]after Instagram enabled https
0:12:58.680,0:13:04.000
over the Mobile API. And it turned out that[br]this was just collateral damage
0:13:04.000,0:13:08.020
from the fact that some of the[br]images on Instagram were also hosted
0:13:08.020,0:13:13.630
on Facebook which is[br]outright blocked in Iran.
0:13:13.630,0:13:17.540
So right now we're about to go[br]up to a election in Iran.
0:13:17.540,0:13:20.870
It's in February,[br]it's the Parliamentary Elections.
0:13:20.870,0:13:26.110
And typically during these[br]sensitive moments in Iran
0:13:26.110,0:13:29.840
they start playing around[br]with the internet and
0:13:29.840,0:13:32.730
this happened in 2013. There was
0:13:32.730,0:13:36.990
a significant throttling of the internet[br]leading up to the elections.
0:13:36.990,0:13:40.160
And right now there have been[br]some things spotted although
0:13:40.160,0:13:44.910
it's speculation whether or not[br]it's related to the elections at all.
0:13:44.910,0:13:50.600
Some websites with foreign[br]SSL certificates are being blocked.
0:13:50.600,0:13:54.410
There was one example of a[br]popular blogger based in Iran
0:13:54.410,0:13:58.910
named Jadi who has a[br]SSL certificate from Cloudflare
0:13:58.910,0:14:04.720
and his website was blocked.[br]And you'll notice that local certificates
0:14:04.720,0:14:08.120
won't be blocked because ultimately[br]they're controlled by the government.
0:14:08.120,0:14:13.440
This is a diagram formed by Smallmedia[br]that sort of explains how
0:14:13.440,0:14:17.200
the certificate authorities are ultimately[br]in the hands of the government
0:14:17.200,0:14:21.150
and data could potentially be shared.
0:14:21.150,0:14:26.500
There is also throttling of TLS in[br]November and the best example of this
0:14:26.500,0:14:36.300
was over TOR direct connections which,[br]you see, experienced a significant drop.
0:14:36.300,0:14:41.730
The shift towards mobile applications[br]and the fact that Iranians are
0:14:41.730,0:14:45.490
increasingly accessing the web through[br]their phones means that there's been
0:14:45.490,0:14:50.040
sort of a increased focus by[br]the government on mobile apps.
0:14:50.040,0:14:54.779
In order to sort of talk to this they've been[br]coming up with local alternatives
0:14:54.779,0:14:59.070
like WeChat has Dialog which sort of[br]you can see from the interface
0:14:59.070,0:15:07.290
that this local version is imitating that[br]application. Instagram had Lenzor.
0:15:07.290,0:15:11.300
But you kind of see that it's not[br]working as effectively because
0:15:11.300,0:15:15.250
if you look at the Cafe Bazaar Stats,[br]which is a platform where Iranians
0:15:15.250,0:15:20.430
download their apps, Lenzor[br]only has about 50000 users
0:15:20.430,0:15:24.400
while Instagram has[br]more than 9 Mio.
0:15:24.400,0:15:28.720
Viber had another imitation[br]out called Salam.
0:15:28.720,0:15:34.470
Salam was speculated to be[br]developed by the Basij.
0:15:34.470,0:15:40.170
So popular apps right now have...[br]there's Whatsapp and there's Viber
0:15:40.170,0:15:44.410
and Telegram in terms of[br]chats and communication.
0:15:44.410,0:15:50.180
Telegram is the most popular right now[br]and that's mainly because
0:15:50.180,0:15:53.610
Viber has been heavily[br]tampered with and
0:15:53.610,0:15:58.110
a lot of people don't trust Viber anymore[br]because the media has sort of
0:15:58.110,0:16:02.839
disparaged it in connection with Israel[br]and the Israeli Defense Forces (IDF).
0:16:02.839,0:16:07.970
And Whatsapp the second most[br]popular app has been experiencing
0:16:07.970,0:16:12.370
lots of network disruptions.[br]And so with this increasing shift
0:16:12.370,0:16:17.180
towards Telegram the media[br]has been focusing on also
0:16:17.180,0:16:21.910
highlighting that Telegram is[br]a place of moral corruption.
0:16:21.910,0:16:26.029
This is a picture from a semi-official[br]news source, FARS News,
0:16:26.029,0:16:32.330
sort of depicting how someone could be[br]dramming in Telegram.
0:16:32.330,0:16:37.250
So Telegram in Iran is really[br]controversial not only because
0:16:37.250,0:16:40.050
the government's really[br]concerned about it but
0:16:40.050,0:16:45.670
it had a really confusing[br]and weird relationship with Iran.
0:16:45.670,0:16:50.210
Starting in August, Bots and Stickers[br]started getting censored in Iran.
0:16:50.210,0:16:55.100
And the Bots and Stickers are one of the[br]reasons why Telegram is really popular
0:16:55.100,0:16:59.839
in Iran because the Bots allowed Iranians[br]to access content on the internet
0:16:59.839,0:17:04.270
without using a VPN[br]and the Stickers are oftentimes fun
0:17:04.270,0:17:09.920
and kind of rude and in Persian[br]which not a lot of apps have.
0:17:09.920,0:17:14.079
And so it's really popular.[br]But these got censored in August.
0:17:14.079,0:17:16.140
And the ministry announced that[br]the censorship was occuring
0:17:16.140,0:17:21.920
because of cooperation with Telegram,[br]but Telegram was very quick to deny this.
0:17:21.920,0:17:27.929
Pavel Durov came up and said that they[br]had not entered in to any agreements.
0:17:27.929,0:17:32.490
On top of that there's a respected community[br]of security experts have really
0:17:32.490,0:17:37.270
critizised the cryptography and[br]the security behind Telegram.
0:17:37.270,0:17:40.270
And this is especially worrysome[br]when you hear things like
0:17:40.270,0:17:45.679
30% of Telegram data is now being[br]stored in Iran which was a
0:17:45.679,0:17:49.550
announcement by the ministry of ICT[br]in Iran. But then again
0:17:49.550,0:17:55.080
Telegram was very quick to deny this,[br]again, saying that this is 100% bullshit.
0:17:55.080,0:18:00.670
laughter[br]And so the Telegram story continues.
0:18:00.670,0:18:05.550
I think it was in late November,
0:18:05.550,0:18:09.830
Pavel Durov made a announcement[br]saying that the ministry of ICT
0:18:09.830,0:18:15.820
had come to him demanding spying and[br]censorship capabilities from Telegram
0:18:15.820,0:18:18.850
which is really weird because[br]beforehand they thought they were
0:18:18.850,0:18:22.350
working together. And there's all sorts of[br]conspiracy theories about
0:18:22.350,0:18:26.750
how Pavel Durov got on a plane and went[br]to Tehran to meet with the minister Vaezi.
0:18:26.750,0:18:30.230
Noone really knows what happened,[br]all speculations and rumours.
0:18:30.230,0:18:35.230
Anyways, he comes out with this[br]announcement and then a few weeks later
0:18:35.230,0:18:40.120
it's like: "Oh, that was a fake email",[br]which is really odd and concerning
0:18:40.120,0:18:45.740
and no other internet company has ever[br]had anything happen like this.
0:18:45.740,0:18:49.960
He said that he received the fake email,[br]the ministry didn't actually contact him.
0:18:49.960,0:18:54.470
He never released the email.[br]It's all very strange and it led to
0:18:54.470,0:19:01.150
several advocacy organizations asking[br]for more transparency from Telegram.
0:19:01.150,0:19:06.580
But Telegram continues to be one of the[br]most popular apps in Iran.
0:19:06.580,0:19:09.710
What's notable about Telegram is that that[br]sort of sets a precedent for other
0:19:09.710,0:19:14.300
internet companies inside of Iran[br]especially as we move towards the removal
0:19:14.300,0:19:19.740
of sanctions. And companies like Facebook[br]and Twitter will be able to do business
0:19:19.740,0:19:24.850
with Iran potentially. And so noting these[br]kinds of behaviours and sort of holding
0:19:24.850,0:19:29.890
them to account is really important.
0:19:29.890,0:19:33.540
One last application that sort of[br]gaining ground in Iran and that
0:19:33.540,0:19:38.040
highlights one of the sort[br]of habits of Iranians is
0:19:38.040,0:19:47.030
Bisphone. Bisphone is this local app and[br]Security Researcher Kevin Miston
0:19:47.030,0:19:50.250
who I don't know if he's here [in the[br]hall] or not, but he's somewhere here
0:19:50.250,0:19:55.380
in the venue, has done some really cool[br]work into looking what exactly Bisphone is
0:19:55.380,0:20:01.980
'cause it's sort of this rising app[br]that's gaining a lot of popularity.
0:20:01.980,0:20:05.580
It apparently has connections, the[br]developers are loosely connected to
0:20:05.580,0:20:12.770
the government. It turns out that the[br]actual data collection over the ISPs is
0:20:12.770,0:20:18.450
connected to Iran's Telecommunications[br]Company. Which is very concerning but
0:20:18.450,0:20:25.920
Smallmedia recently did a report asking[br]Iranians what they thought about the
0:20:25.920,0:20:30.340
security of the apps that they use and the[br]tendency is that they either don't know
0:20:30.340,0:20:34.460
or it doesn't really[br]factor in as a big issue.
0:20:34.460,0:20:40.640
So security is a very low[br]priority for Iranians even though
0:20:40.640,0:20:43.760
it should be higher on their list.[br]They generally tend to go for
0:20:43.760,0:20:48.740
usability and fun features.[br]This kind of brings me
0:20:48.740,0:20:52.500
to the take aways of this talk which is:[br]Internet control in Iran is
0:20:52.500,0:20:58.660
quite pervasive, but it's not as[br]sophisticated as they would like.
0:20:58.660,0:21:00.900
It's especially important now[br]'cause there's been more arrests
0:21:00.900,0:21:05.660
of various bloggers, various people[br]who work in the Tech industry in Iran.
0:21:05.660,0:21:08.910
This might be particularly[br]problematic as we move towards
0:21:08.910,0:21:13.730
the Parliamentary Elections.
0:21:13.730,0:21:17.809
If you do particular research,[br]if you do any collection of data
0:21:17.809,0:21:23.260
and circumvention tools I think this is a[br]very exciting time to be looking at Iran's
0:21:23.260,0:21:27.109
internet ecosystem. Thank you!
0:21:27.109,0:21:38.230
applause
0:21:38.230,0:21:42.970
Herald: Thank you, we have 5[br]minutes now for question/answers.
0:21:42.970,0:21:51.380
So if you have questions for Mahsa[br]please go to one of the 4 microphones.
0:21:51.380,0:21:55.320
And I would like to ask you to[br]please say your question slowly
0:21:55.320,0:21:58.090
into the microphone because[br]it's being recorded.
0:21:58.090,0:22:00.390
audience mumbles amused
0:22:00.390,0:22:08.610
Question: Shall I start?[br]H: Ok we'll start with, yes, that microphone.
0:22:08.610,0:22:15.929
Q: So one thing first as a statement[br]not a question. If you are in Iran, do not
0:22:15.929,0:22:20.540
ever use your banking, whatever banking...[br]Mahsa: whispering Who's talking?
0:22:20.540,0:22:24.480
Q: ...without VPN. And then... because[br]they're gonna block it. You're gonna
0:22:24.480,0:22:29.820
have to go back to your bank and reopen[br]it. But the question is: Do you know...
0:22:29.820,0:22:33.590
how much do you know about the[br]relationships with other governments like
0:22:33.590,0:22:38.460
foreign governments or foreign companies[br]on the filters, there were... and like
0:22:38.460,0:22:41.790
further developments. Because I know from[br]Rohde&Schwarz like a year ago,
0:22:41.790,0:22:48.440
when I was there, they were talking about[br]the relationship with the filters in
0:22:48.440,0:22:54.840
I-don't-know Syria, maybe. And that they're[br]not officially related but they were used?
0:22:54.840,0:23:02.480
Mahsa: Yeah, I'm not a particular expert[br]on Syria but I do know that they have
0:23:02.480,0:23:06.390
exchanged technology and knowledge with[br]the Syrian Government 'cause they are
0:23:06.390,0:23:10.210
very close with the Assad Regime.
0:23:10.210,0:23:16.110
Q: I meant more specifically like[br]companies in Europe and in the US.
0:23:16.110,0:23:19.929
M: Yeah, so because of sanctions[br]I know the US don't really...
0:23:19.929,0:23:26.160
I do know Europe... is...[br]does work, but I know
0:23:26.160,0:23:31.600
the country that they turn to most for[br]censorship technology would be China.
0:23:31.600,0:23:36.040
And I know that in the past that they[br]heavily relied on Chinese technology
0:23:36.040,0:23:40.460
for censorship and surveillance material[br]but recently they've been shifting towards
0:23:40.460,0:23:45.679
local vendors and using more[br]locally grown technology.
0:23:45.679,0:23:50.179
Although it's hard to say. I don't have[br]direct insight into what technology
0:23:50.179,0:23:56.410
and where it's coming from. Maybe you[br]have more insight and can tell me.
0:23:56.410,0:24:00.980
H: Thank you, next question, please.
0:24:00.980,0:24:05.700
Q: Thank you to bring us the awareness[br]that we have to fight for our freedom
0:24:05.700,0:24:08.540
in internet or also to fight[br]leaders which try to...
0:24:08.540,0:24:14.400
H: Could you get a little closer to[br]the microphone, please!
0:24:14.400,0:24:19.130
Q: My question was: When you go back to[br]Iran, do you have any repression or
0:24:19.130,0:24:20.900
problems?[br]M: Do I personally?
0:24:20.900,0:24:27.770
Q: Yes. personally.[br]M: I haven't gone back to Iran since 2010
0:24:27.770,0:24:31.070
because I do things like come and[br]talk here on a recorded video
0:24:31.070,0:24:37.430
audience amused[br]I generally don...
0:24:37.430,0:24:45.140
applause
0:24:45.140,0:24:50.000
Q: It was my question exactly, and you[br]should be aware that it's no democratic
0:24:50.000,0:24:52.809
there so if they catch you they do[br]whatever they want with you.
0:24:52.809,0:24:57.679
It's not, like, we control the police...[br]M: Yeah, I mean that's also another point
0:24:57.679,0:25:02.820
I wanna make: There's a lot of[br]awesome unknown people doing work
0:25:02.820,0:25:08.120
and doing research and activism on the[br]Iranian internet that remain anonymous
0:25:08.120,0:25:13.260
and use pseudonyms and can't do[br]things like come here and talk, so
0:25:13.260,0:25:16.780
that's a decision I've made. There's other[br]people doing really amazing work that you
0:25:16.780,0:25:21.750
probably will never see[br]on a platform like this.
0:25:21.750,0:25:28.669
applause
0:25:28.669,0:25:33.529
H: Okay, may I ask on the next[br]question, please. Thank you.
0:25:33.529,0:25:37.540
Q: Yeah, thanks for the great talk! I have[br]a question about the certificate authorities
0:25:37.540,0:25:43.049
there in the Iranian State. You said that[br]foreign certificate authorities are
0:25:43.049,0:25:48.720
blocked by the governmental filters.[br]With your demonstration of one site...
0:25:48.720,0:25:55.720
of this blogger. Are there any certificate[br]authorities in Iran not connected to
0:25:55.720,0:26:00.760
the government, or not... are forced to[br]giving the private key to the government,
0:26:00.760,0:26:06.330
so that maybe foreign sites could just[br]adjust their certificate to an Iranian
0:26:06.330,0:26:12.570
free or libre CA and so could do an[br]access for the people there?
0:26:12.570,0:26:17.110
M: That's a really good question. I don't[br]think I have the knowledge or expertise
0:26:17.110,0:26:22.950
to fully answer it. But I will point you[br]towards the Smallmedia report that
0:26:22.950,0:26:27.600
really delved into this. They did like[br]months of research. I think the person
0:26:27.600,0:26:31.490
you would probably wanna talk to[br]would be Amin Sabeti. I could only
0:26:31.490,0:26:38.040
sort of guess and I'm not sure if[br]it's broadly done on every website,
0:26:38.040,0:26:42.080
'cause there's obviously a lot of websites[br]using foreign SSL certificates that
0:26:42.080,0:26:47.020
are not blocked, but if it's sensitive[br]it's more likely to get blocked in Iran.
0:26:47.020,0:26:52.090
Q: Thank you very much.[br]H: Thank you, are there any questions
0:26:52.090,0:26:56.530
from the internet?[br]looking out for Signal Angel
0:26:56.530,0:27:01.290
Yes? Aah, ok. The internet, please![br]Signal Angel: So, question.
0:27:01.290,0:27:04.760
Since there seems to be a lot[br]of trouble politically-wise,
0:27:04.760,0:27:09.520
is there a hacker scene in Iran? Like[br]there is in Europe or in the USA?
0:27:09.520,0:27:15.710
M: Yeah, yeah there is a hacker scene[br]and there's a, like an emerging
0:27:15.710,0:27:20.610
open source community doing a lot of[br]cool work. Yeah, totally the scene exists.
0:27:20.610,0:27:24.789
I'm sure a lot of them would[br]have loved to have been here.
0:27:24.789,0:27:30.630
H: And the internet, again![br]S: A lot of people in Iran, I know,
0:27:30.630,0:27:34.660
use VPNs. Have you heard of VPN providers[br]cooperating with the government?
0:27:34.660,0:27:42.429
M: Yeah, that's another big security[br]concern that I didn't cover in this talk,
0:27:42.429,0:27:47.250
w hich is like using VPNs is ubiquitous,[br]basically, in Iran. Even
0:27:47.250,0:27:51.600
members of the government use it.[br]I think there was even a photo of...
0:27:51.600,0:27:55.730
someone in one of the ministries, they[br]had Psiphon on their desktop and
0:27:55.730,0:27:59.530
it was pictured on a famous photo that[br]went viral. But one of the concerns is
0:27:59.530,0:28:04.090
like, the government is actually providing[br]their own VPN so they can access data
0:28:04.090,0:28:08.850
and what people are connecting to[br]through their own backdoored VPNs.
0:28:08.850,0:28:16.799
H: We have one more question, and that's[br]here in the back, please. You, yeah.
0:28:16.799,0:28:22.020
Q: Hi, so I have... I was wondering[br]if you have concrete cases
0:28:22.020,0:28:27.559
about government monitoring data or
0:28:27.559,0:28:32.960
using that as evidence in court cases.
0:28:32.960,0:28:37.770
Because we have always been[br]speculating that these guys
0:28:37.770,0:28:43.350
will go through the messages that we send[br]and then they're gonna use it against us.
0:28:43.350,0:28:46.960
But we have never been able[br]to prove it. Do you have
0:28:46.960,0:28:50.809
any kind of cases study on that?[br]M: There is the one really famous one that
0:28:50.809,0:28:56.259
I'm sure you've heard of,[br]the Sony-Ericsson case
0:28:56.259,0:29:00.809
- I think I'm getting the company right -[br]back in 2009 where they tracked
0:29:00.809,0:29:05.280
through the cell phone company.[br]So that's the most concrete case.
0:29:05.280,0:29:09.419
But I suppose there aren't[br]that many known,
0:29:09.419,0:29:15.990
and that's one of the problems with[br]installing sort of a culture of digital
0:29:15.990,0:29:20.000
security in Iran. Because most people[br]are afraid of physical surveillance,
0:29:20.000,0:29:24.210
this thing that if they're arrested and[br]they take their computers physically
0:29:24.210,0:29:30.419
- that's the actual concern, not so much[br]using encrypted email or encrypted chat.
0:29:30.419,0:29:35.500
So that might be part of it.[br]I'm sure there are. I couldn't
0:29:35.500,0:29:39.340
name them to you right now but the most[br]famous would be from 2009 when they were
0:29:39.340,0:29:45.110
working with Ericsson.[br]Q: Thank you.
0:29:45.110,0:29:54.200
H: Ok, thank you![br]applause
0:29:54.200,0:29:58.280
H: And with that one more warm applause[br]for Mahsa. Thank you so much for
0:29:58.280,0:30:01.390
coming today, Mahsa, thank you!
0:30:01.390,0:30:05.900
postroll music
0:30:05.900,0:30:08.350
created by c3subtitles.de in 2016