#rC3 - CIA vs. Wikileaks

rC3 preroll music

Herald: As we said the years before, the
force merged to main. Andy is commonly

known in our scene. His current talk "CIA
vs. WikiLeaks: intimidation, surveillance,

and other tactics observed and
experienced". In this talk Andy aims to

report and show us a collection of his
observations, physical, visual and other

evidences of the last year incidents that
strongly indicate the context of US

Central Intelligence Agency and
potentially other entities of the US

government acting against WikiLeaks and
surrounding persons and organizations.

Please welcome, with a very warm digital
applause, Andy.

Andy: OK, I have no idea how a digital
applause works here, but thanks for it

anyhow. At the beginning, I want to make
and I have to make a few disclaimers, so

that you know which perspective you're
getting here. I'm working as a data

journalist for quite a while around the
topics of surveillance, signal

intelligence, data security. I'm running
this funny buggedplanet, even started that

buggedplanet.info before Snowden came with
all his documents. But I did work a while

with his documents. However, this talk is
a bit different as I'm not talking about

things that I learned, studied or
whatever, but I experienced myself. I'm

describing events here where I was
targeted. So, I might not be the most

neutral person in this scenario, but I'm
trying to be technically as accurate as

possible anyhow. So forgive me if I'm a
bit grumpy about these people. That's just

because of their perspective. Secondly,
while I've also and the CCC, of course,

has been addressing human rights issues in
the digital age for a long time, we, and I

personally, co-founded EDRI, the European
Digital Rights Initiative, to ensure the

enforcement of human rights in the digital
environment. However, what happened here

is slightly beyond digital rights. It goes
into real life. And while I'm a German

citizen, and I know roughly what kind of
laws have been violated here, in respect

to the German environment, I absolutely
would welcome people who help me analyze

and understand it from the perspective of
the universal human rights, because there

is similar cases with people living in
other jurisdictions and so on. Second

slide of disclaimers, sorry that it's so
much, so I'm addressing with this talk

activities against people surrounding and
have been and/or surrounding Julian and/or

WikiLeaks and/or other members of
WikiLeaks. Whatever I describe here, I

have personally observed and experienced
it. So it is for sure very incomplete.

It's at best a fragment of what's gone on.
But you will, in case you haven't heard

about it yet, that Pompeo made some very
clear statements when he was head of CIA.

It's pretty clear where to attribute these
things. And lastly, there is, of course,

other persons mentioned. But I'm keeping
them out here for all kinds of reasons.

But there will be the time when we will
hear more reports and other perspective of

this particular situation. So, here's my
little overview. I want to get you an idea

how to get into such a mess. Just in case,
you know, you want it. The context and the

timeline, a bit of psychology as it's
important because at some point you not

only get paranoid, you have this drive
to... no this can't be true. Right? You

have this cognitive dissonance drive
inside of you that you would like to stay

sane. The new normal of "IT-incidents".
We're all used to that, covert vs. overt.

What I mean with the term intimidation
surveillance, physical events and their

impact about the elephant in the room, the
problem of the missing socks. And at the

end, a little bit of questions. Am I
infectious, how to get out of this mess?

Maybe also. So, how to get into such a
beautiful mess? Wait, it's not beautiful.

Well, there are some ideas we share in the
hacker community usually, and even it's

not far from there to get into the
journalist community. Information should

be free. Free flow of information is a bit
of a requirement for world peace. And we

had this and I personally also had this
type of self conception, self

understanding consciousness. Twenty years
already when WikiLeaks started around

2006. So this is not that I was jumping or
anybody in the scene was jumping onto

something that didn't exist until then.
But WikiLeaks turned out to be an

extremely good concept as a democracy
test. If governments cannot deal with full

transparency, well, that tells you a lot
about them. But, of course, that is

similar to jumping to the last point,
similar to working in journalism. When you

expose things in journalism be it
corruption, be it hypocrisy of

politicians, be it blunt lies or whatever.
It's not always about making friends. It's

yes, partly making friends, and partly
pissing people off. That happens. However,

in this particular environment that Julian
inspired to create. There's some

cultural, even misunderstandings. For
example, the word conspiracy. For us in

Europe, I think many of us indeed German
hacker scene are inspired by Robert and

Wilton's way of saying, oh, a conspiracy
is like the world is full of them and we

should join the best of them. But in the
American context, the word conspiracy is a

legal term, unfortunately. And when you
are with American citizens in a room and

talk about conspiracies, they often get
very nervous. And it's kind of a complete

different attitude. Because it's like the
U.S. term to define people who belong to a

group like, organized criminals or
organized, you know, this T word, this

other type of entities. And of course,
that's absolutely not what we want to get

into involved here. But sometimes, we
mistakenly are misunderstandingly joke

about conspiracies and people listening to
this get it completely wrong. And I fear

that is also what happened and how me and
others got into such a mess. So at the

end, of course, in journalism and that's
similar to dealing with data from a

hackers perspective is about supporting
media with data and information and so on.

So here is a bit of a timeline to give you
a time frame. I'm now after I was a bit

long for about two decades a CCC
spokesperson and board member blah blah

blah, I moved to the board of the Wau
Holland Foundation. Wau Holland Foundation

collects actually money for WikiLeaks
under the aspect of Wau's idea of

supporting Freedom of Information since
2010 or so. I joint a little later.

However, when WikiLeaks started to publish
the Afghanistan, the Iraq war logs and

diplomatic cables that already triggered
legal investigations, and of course, the

arrest of then still Bradley, now Chelsea
Manning, later. So there was always, it

was always clear, more or less right from
the beginning, that there's legal trouble

on the way, that there's a secret grand
jury and that the Americans didn't really

appreciate their war crimes to be exposed
and the diplomatic cables to be in the

Internet, to be understood and readable
for all of us and the media worldwide and

so on. Of course, when people come
together and gather in any project, you

have human beings, you have, they have
characters, they have mistakes. They do

things that are not always great. So I'm
not trying to say here that everything was

always great and it was only the CIA
messing it up. No, humans make mistakes

and these mistakes in such an environment,
of course, get exploited, get amplified

and so on. In 2007, WikiLeaks started
publishing some CIA documents and a whole

series of it, the so-called 'Vault 7'
documents. And those documents describe

technology, exploit programs from the CIA.
You probably, most of you will know them.

If not, you can now look them up. And
these included tools that allowed the CIA

to pretend to be someone else, including
coming from another country, speaking

another language, be from Russia, in
Russia be from Iran and Farsi and so on.

And Pompeo, who was at that moment still
head of the CIA, got very upset. And there's

two references from this, one from April
2017, and another is from February 2018.

In his first public speech as a CIA
director in 13 of April 2017, he made a

speech at a conference working in
Washington and he said things like

WikiLeaks walks like a hostile
intelligence service and talks like an

intelligence service. And called WikiLeaks
a non-state hostile intelligence service.

So for those of you who know a little bit
about information science, there's this

idea of data is actually something you can
technically measure. Information is data

in a context and intelligence is
information processed to a level where you

can make decisions based on it. So being a
public intelligence service, I would say

from that perspective is like an honorable
term. However, the way Pompeo emphasized

it, I think was slightly not that
honorable. He was more comparing it to,

you know, other state actors and evil
forces and so on, because the US

understanding of intelligence service far
away from entities... sorry, I need a

water... Is far away from entities just
collecting information, but as you know,

they also mess up with other people's life
and so on. However, a year later, in

February 2018, he even upgraded this type
of statement. The Zeit, German newspaper,

reported about what he said at the Munich
Security Conference Intelligence

Roundtable, and he said, a really nasty
sentence like that. Most of his time he's

dealing with the non-state actors. And
that's like al-Qaida, Islamic State,

WikiLeaks or Hezbollah. Like what a list.
So I have no idea what he has. What turned

him into comparing these kind of things? I
mean, Hezbollah, I could say we in Berlin,

we know they provide actually yummy
halloumi and some things. But yes, they

are money launderers and are a suspected
terrorist in some areas or whatever, or

have been declared terrorist. But their
hummus is really good, I can say. However,

the point I'm trying to come to. So Pompeo
got very upset. He made all this

comparison and he seems to have allocated
resources to deal with WikiLeaks and

everybody jumping around. And it's no
surprise that as Wau Holland Foundation

finances selected activities of specific
publications there, that we also got in

the focus with us collecting donations
and, you know, talking with the guys and

financing some projects. So before I'm
coming to very concrete events, I want to

get one second into psychology. So, of
course, when things happen to you, from

the intelligence perspective, they always
come with what's called plausible

deniability. When there's a guy standing
in front of the door watching, you know,

if you come in and out, it's not just
someone watching your door. It's someone

reading the newspaper or repairing some
electrical pipes or some water pipe or

whatever. I mean, that's always a good
reason for him to be there that has

nothing to do with what he's doing and
that's a basic principle. Plausible

deniability, how intelligence agencies act
in the so-called field. So meaning in your

home or on the street, following you or
whatever. So over time, of course, if you

have too much of this, you're seeing these
patterns, and that's probably mainly

called paranoia. So you get like, you
know, suspicious of everything that

happens that might be very legitimate, but
you get like the feeling that something is

wrong and so on. And that can be, we could
also instead of paranoia, call it

situational awareness at some points,
because if it really happens, it has

nothing to do with your mind getting
crazy. It's just an accurate observation

of patterns that happen around of you. But
you might know that and your two friends

who experience the same might know that
your girlfriend, your partner, the normal

people you deal with, they might all not
understand this and think that you're

driving nuts. And this driving nuts is, of
course, an element that you always have to

be self-critical, because on the one hand
side, you might indeed see too much things

happening that do not really happen. And
on the other hand side, there's also the

human drive that we don't want these CIA
guys to be in our life. We want everything

to be fine. And to some extent, maybe
that's even healthy to not see the

monsters all the time. But if they are
really there and you start denying them

while they sit in front of you, that's
also not so helpful. So I found myself in

this kind of weird environment where all
these kind of thoughts come up all the

time. And I'm starting with the most
harmless stuff. So Internet attacks or

well Internet incidents. I would... IT-
incidents, I called it here. Due to the

pure volume of it, I will put this into a
separate presentation one day or report

and in the next days or weeks or months.
And you can all have fun with it. But here

is just some basic pattern. So devices you
use as communication terminals or

communication devices, they always have
issues when you start to do encrypted

stuff, and it's always when you do it with
specific people. So that's hm... Then,

mobile phones with data service. At some
point, all of them have start to have

issues. Very high volume of used data,
apps disappear if you use them at all. I

stopped using them at all. High battery
usage. When you did nothing with your

phone over hours and you were wondering
what's going on. OK, yes, we have buried

their bags. We put them somewhere else.
But still, it's a little weird when your

battery is empty half day. On LTE when I
configured my phone to be on LTE only it

worked mainly fine. Next to that, I
couldn't make normal phone calls, but when

I had to do the normal mode, it got
downgraded to 3G and there my encrypted

connections started to have problems. On
my fixed lines, my VPNs when I tried to

build up a VPN shows me certificate errors
and problems. And then of course you deal

with journalists, which I'm doing with my
colleagues all the time. And they are not

technical experts. They all have their
Macs and so on. So they have funny issues

with their PGP keys not working anymore,
with their PGP setup not working anymore.

Yes, it's also because it's open source
software, but there's also something going

on. But this is kind of the world we all
know and we got used to it. You know, this

is like, OK, IT doesn't work. Secure
connections break, well, happens all the

time. From about mid 2017 when I still
regularly, like once or twice a month was

flying over to see Julian in the embassy,
I realized that there was something

changing with my treatment at the border.
That's of course, that's yeah, that's

purely UK border police uncles. And they
like started to ask funny questions like

"Do you live in the UK?", "What's your
occupation?", "How long do you stay?",

"What do you do in the UK?". Before then
there was maybe one question, but not

three or four of them. And the most
important was that I realized that he did

not even listen to my answers. Sometimes
he started the first question after I

answered the third, and it was feeling
like in a limbo, like with a machine who

would randomly ask me things. But I then
realized he was just waiting for the green

light on the screens to let me go. And
that green light probably meant that the

team outside was ready to pick me up and
that's what happened. So I get into the UK

and have people follow me like the whole
fucking day, not only on the way to the

embassy, from the embassy back and so on.
I once spotted one of those persons like

sitting at the street level on the other
side watching the whole time I was in an

office, ground level. And because I had a
bit of experience with that in continental

Europe, like in Germany, if you realized
these guys just go after you and you put

your camera on your table or start even to
make photos of them, they're very quickly

gone because they don't want to be
relocated, they don't like to be exposed

and so on. But the British behaved in this
time, this scenario completely different.

So he was like getting like, you know,
very aggressively body language, try

spotting, looking back and so on. So that
was a little weird. That same day at three

o'clock in the night when my friends drove
me to the place where I was sleeping in a

one way street, there was still a car
following us, even in the one way street.

So actually he had to turn back and so on.
That was no more covert surveillance. That

was already at the edge to intimidation.
And then over the next months, I started

to have new favorites, but not only in
England, also in other countries that I

would see homeless looking like people on
the street level sitting there begging or

leaning to some buildings. And at some
point I had to realize that the cheap

plastic bags that they were wearing were
just a cover for cameras that were

actually with Zoom and digital getting
into my direction. And so that felt a

little, um. And so the idea of this
measures meant, if you look at their

manuals, which you'll find somehow in the
Internet, is that the difference between

discovered surveillance, which is to find
out where you are and to open

surveillance, which I call intimidation
surveillance. The idea is you create in

the person in this case and yeah, for me,
a state of distress. So you like

constantly having this, like, you know,
looking around and you obviously have the

idea that something is going on and they
let you know. They want to let you know

and that's a little weird. So in April
2018, exiting in March 2018, I brought one

of my Cryptophones, in this case a desk
phone based on a SIP phone called Snom 870

back to our workshop here to repair. The
display had been exposed to heat and got a

little melted. It's not so super high
quality LCD display, so I wanted just to

replace the display. So I opened the thing
and I found actually a bug and that bug

turned out to be a very sophisticated
thing. So there was a battery pack, there

was a shielded thing. Behind that shielded
thing there was a module that had been

soldered into. It was based on an FPGA,
some hardware crypto element. 16 GB of

flash ROM. It was completely passive. So I
wouldn't have found it in any sweep

because it just recorded whatever I talked
on that encrypted phone and would be

triggered by high frequency to send out
the recorded stuff, encrypted in a signal.

And you see here a URL to find more
pictures online. To give you an idea this

is the thing I found. This is how it
looked like at the beginning. The phone

itself has to PCB's one for the keyboards
and one for the connectors, processing and

so on. This was the modified version of
the keyboard PCB with this battery pack

in blue, the shielded module. And here
you get an idea of what was in there.

That's pretty high tech. We did, of
course, look into what exactly do we have

here, when were this chips produced, what
does it do and so on. But it's pretty

obvious that this is like for those who
have read the Snowden documents intensely,

it's what's called special collection
service. Inside there, there's a group

called a target access operations TAO, and
they work together with a thing called

PAG, the Physical Access Group because
someone and that was the thing, it was not

only built into this phone, that phone had
been, of course, in a locked room. And I

had to ask myself, OK, what happened here?
Here you see how they grabbed the audio

with a glued mini PCB from the other main
controller into their little technology.

And here you see a comparison picture, to
the right you see the original PCB

keyboard, which has almost nothing on it.
And to the left, you see the modified

version. A friend of mine made a bit of a
diagram and yeah, I'll just leave it for

you. You can review it later. I'll upload
these PDF slides, of course. So here's

some aspects of what was going through my
head over the time. Of course, the first

question was: How long was this there? No
idea. Could be years. Um, the components

we identified were produced around, oh no,
not earlier than April 2013. So if you

remember, Snowden came with his revelation
mid of 2013 roughly. And I've been working

for the Spiegel with others on the Snowden
documents next to that phone and

coordinating a lot of it in the year 2013.
So in theory, it could be even related to

that. Who knows. The dimensions such as
Kadian nonmetric origin, the antenna

would, you know, work in the range of 800
MHz. So you find a mentioning of a PDF

that tells you something about these
groups. But I did talk to some people who

do professional sweeping, meaning, looking
for audio bugs and so on in devices and

rooms. And they told me from the
experience of the Cold War until today,

the operation to bring something into a
room, into a device, that's quite an

effort because you need to secure, you
need to ensure you don't get caught and so

on. And so what you normally do is,
because technology can fail, is you do not

install one bug, you install at least two.
And the Cold War people told me, from the

elder generation, that the relationship
was one to eight, so that because

technology failed a lot back then.
However, that made me, of course, think,

OK, what else could there be? You know,
what can I do to find the rest and so on.

Does it even make sense? Can I secure all
the rooms that I use to work here and

there in such a way that I could be sure.
And of course, I can't be. So this was the

first hard confrontation with my own
cognitive dissonance, because all that

surveillance theater where I said, OK,
Julian has some trouble, I don't think I

had something to do with it. And when I
traveled to England, OK, they follow me,

you know, you get used to that kind of
things, but like something you can have in

your hand and that's outside of IT
incidents. That means that all your

encrypted communications have been
listened to. Well, that feels shitty. So

that's what I call a hot confrontation
with my own cognitive dissonance. The next

thing I want to talk about is very recent.
It's about one and a half months old now.

When here in Berlin, um, I went out
actually very early in the morning to get

some stuff from a grocery in a time of
pandemic when no one is in the shop at

seven or something in the morning. I come
back half an hour later and the key to my

apartment door does not fit in the
cylinder anymore. That felt a bit shitty.

Um, it was not a normal cylinder. It was a
so-called stealth cylinder. You might want

to look in the Internet what it is. It's a
Swiss company, it's doing nice keys that

you cannot photograph and copy because it
has inner elements with a sophisticated

mechanical, a way of opening. I did,
however, when I bumped into my door and

had to first I called my locksmith dude or
my friend from the lock picking industry,

I could say, who had advised me to buy
that cylinder. I talked with my lawyer and

we agreed it's a good idea to call the
police, to put it on the other list of

things they had collected until then. I
then realized that I had been followed

that morning, but I didn't take any
attention to it because I was just

walking, you know in half-automatic mode to the
grocery and there was a couple talking

such a bullshit. They will probably listen
to this talk and will remember the dialog.

It was just not making any sense, but I
was too polite to point it out. And they

were very closely. So it was not about
where I was going. It was about that I was

not at home. So they ensured that in the
time frame that I was there, the other

guys could operate and so on. Yeah, that
is an ongoing investigation. But I can

tell you, this is the next incident where
like cognitive dissonance and the illusion

you want to give this of, you know, I'm
not important in this game. Yeah. This

guy is following me here and there. And this
feels kind of different. This is no more

nice. Um, here's a little bit to get the
idea of the cylinder. You cannot really

see the object that was inserted. But at
the end, we didn't get it out. For

forensic reasons. We had to drill. Police
went through the apartment and so on.

Yeah. Another interesting day you can
have. Um, so here's some aspects that I

asked myself. Um, so was it even my
cylinder that I couldn't open? Maybe they

could not lockpick the original stealth cylinder
I had. They had to open it in a violent way.

They were in the apartment to whatever put
another bug in there. Um, but as they

couldn't replace it with the original
cylinder as they had destroyed it, like

they put another one in. And that's why my
key wasn't fitting. It's an option. Next

option: Was it maybe a trap to make me
replace the broken cylinder with a cheaper

one with a more simple one that they could
open then afterwards, when I was gone. The

next option, or maybe was it not about the
door at all? Was it maybe just to freak me

out? Um, of course it feels not so great
if you can't open your own apartment door

and so on. And the first question was, of
course: How much time did I spend that day

with, you know, with the police, drilling
open the door with all that kind of

things? It more or less cost me a day. And
what maybe happened to my machines,

meaning my computers, my other things,
maybe? Where was my attention not in that

time frame? Because it could be, was a
pure distraction thing. It would freak him

out a little bit. And while he's freaking
out, we do other things in his office or

whatever, I can't rule it out. And then of
course, I mean, the police sent me some

funny questions. I'm still working on
that, like, yeah, should I name Pompeo as

a suspect? Not sure, but maybe I should.
Discussing it with my lawyer and so on.

And also is it maybe related to the date?
This was the 3rd of November, just in case

to have it said the 3rd of November is the
election day, or was the election day in

the United States. And there were some
accusation that had something to do with

the election some years ago. Um, so
however, the next event, incident number

three, has to do with something that
happened in between, because on Monday,

the day before they messed up with my
door, I had shipped some documents to

Spain, I realized then. That was legal
documents that required me and a friend

going to the Spanish embassy. We gave
power of attorney and so on because we are

also accusing this company, UC Global,
which I talked about last year, which was

the company running the surveillance or
the protections/surveliance at the

beginning on behalf of the Ecuadorians in
that embassy and later turned out to be

working, for (inaudible)'s company or at
least having a site arrangement there,

which is still subject to an ongoing
lawsuit. And we participate in that

lawsuit because not only Julian was spied
on, everybody was spied on, who was

visiting him and so on. So I had shipped
documents on that Monday, almost six

o'clock on the local post office here by
DHL Express. I put that documents in a

sealed bag, that's like a bag was a serial
number and so on. That went together with

the describing list what's inside the bag
into a white envelope that again, I sealed

with, you know, seal tape. Then I gave
that to the post office. But they insisted

that it gets in a DHL Express back. That's
what you get for the 70 Euro to be

arriving within two days. So, yeah, the
stuff arrived on Wednesday, but all opened

and the Spanish lawyers freaked completely
out. They were very sure that this was a

meddling. You would see that it was sliced
open and so on. Yes. You see this funny

duct tape here called Zoll. But why would
the German customs open a document

shipment within Europe? That just not
makes a lot of sense. It's still on the

way to be checked. In theory, they could
do that. But also this incident has some

aspects. It's a breach of attorney client
privilege. That's why the Spanish lawyers

insisted as we bring this to a criminal
complaint. They did on their end right

when they received it and they made those
photos. So was German customs even

involved or was just their duct tape used
by some funny people. Why when I emailed

all this to my lawyer with the picture
sent to one, why did he not receive the

email until he realized on Monday that it
somehow ended in his trash? He also

freaked out. And then I talked with DHL of
course, I made a big fuss there and they

were like, no, we cannot tell you on which
legal grounds the shipment was opened. We

cannot tell you who did it. But if you
have an inquiry, why don't you send it to

the customs? So without giving me even
which customs entity it would be or

whatever. And again, of course, this is
kind of an interesting story, but I have

normally other priorities in my life. So
I'm asking myself, oh gosh, how many days

shall I waste here with finding out who
opened the fucking shipment. But, you

know, this is, again, the state of
distress. This is, again, the effort. And

it's, again, a reminder. We are after you.
We check your things. We don't like

your're suing the CIA, a suspected company
and so on and so on. So coming to a bit of

a conclusion of this talk, as we also want
to have time for questions and so on. I

want to talk about three aspects. The one
is the elephant in the room and the

problem of the missing socks. So at some
point, I don't want to say that I have

been completely not in a state of
distress. And so I don't know how this

affects my sanity and those people
surrounding me. So your cognitive systems

get kind of otherwise triggered and you
start to see these things everywhere. And

when then you wash some socks and it turns
out there's a sock missing. The other

person in my life was like, OK, CIA.
However, I did suspect the bed sheets and we

found one of the socks in a bed sheet. So
when you know, the problem is socks get in

the drum sometimes, Hanging, then you wash
something different then like a bed sheet

and a bed sheet is an excellent place to
hide things that have been in the drum.

Get into the bed sheet and you just try it
with it and you don't even realize it and

so on.. So while I'm a complete, I for
entertainment reasons and also for, you

know, you need to relax your brain in such
a situation once in a while, I'm totally

OK to say the CIA is responsible for
everything, including the missing socks,

but I suspect the bed sheet first and
realize that yes, this is a joke and this

is escapism and it helps you maybe to stay
sane for a little moment. But in the long

term, I don't know. So and that's the I
don't know part is the other two slides

that are coming now. So what should I do?
And I should invite some friends and

declare my office here like a laboratory
for surveillance. Yeah, it has been

before. I looked at one technology, but
this case is surveillance technology,

looking at me and my friends. So it's
slightly different. And it's maybe also

important to not get into some kind of
auto response mode when things happen.

Because I was thinking also, what the
fuck? Why are they doing all these things?

It cost them money. It costs them effort.
Is it to freak me out? Is it that they

think that like like like I'm seriously in
such an evil mode organization that, you

know, they will escalate things and I will
start to throw bombs at the U.S. Embassy

or I don't know. I have no idea what their
idea is, but I just try to stay like slow

motion and think about it. The next aspect
is how ever do I infect other people? And

now I'm not talking about my paranoia or
my situational awareness, as I would call

it, which, of course, at some point it's
ongoing and it's no more sometimes. But

when I talk with normal people, with other
journalist, with people I deal with for

normal things, and they visit me and we do
whatever kind of social things, like

normal things, like having food. And
afterwards, the way they call me a day

later and say, oh, finally my phone
started rebooting twice yesterday and

these kind of things so that you think,
OK, it's not my paranoia that is

infectious. It's actually they obviously
want to not only know what kind of people

I'm dealing with and look into their
technology, they also want to freak them

out. So this is not cool. And it also
means that the type of ignorance you could

normally apply and say, well, ignorance is
a bliss. Come on, let's have have a nice

day and forget about all this. That's kind
of limited. That's no more an option. Um,

and also while I've been dealing with that
type of stress and that type of thing for

a while now, and I can say, yeah, well,
that's how it is. And, um, it doesn't mean

that everybody dealing with you can do
that. There's people that are seriously

freaked out by such a situation and it
creates fear, it creates anger, stress and

so on. So that's not cool. So, um, my last
slide that ends up with a question to you

guys is how to get out of this mess. So,
you know, option one, I managed to get

proper authorities to make the CIA stop
acting illegal. OK, I heard the laughing.

I know this is ridiculous, but, you know,
it would be so beautiful. Justice

prevails. The German authorities, the
European ones pick it up. I finally

managed to escalate it to the
Generalbundesanwaltschaft. And I do not

have to talk with the German intelligence
services as I'm not sure they would be

helpful in this game. And they make the
stop, the CIA stop acting illegal and

against me and the other person
surrounding beautiful dream. But OK, not

very realistic. Maybe option two, Pompeo
realizes Jesus loves WikiLeaks and

whatever shall become true will become
true. He reads it on the Bible. Pompeo

seems to me if you look at his Twitter
account, reasonable believe in Jesus

Christ and all that thing. So he realizes
it's all wrongdoing against Julian,

WikiLeaks and all the people targeted in
that context and stops it. I know. OK,

shit happens. What? But if that's
realistic, I don't know. You tell me. And

the third option. I don't know. Maybe you
have some ideas. And that's my question to

you at the audience and that's the end of
my prepared part of the talk.

Herald: And with these words. Thank you,
Andy, for the brilliant talk. In the

meantime, I received some messages. A
third option would be to have a great

vinyard, vinyard. Sorry, I personally
Andy: Yes, yes it's completely right. I

considered actually maybe I should do
something with goats, become a farmer or,

you know, yeah, there's these options. But
I thought before I give it up and find my

way on the countryside, I outsource the
problem to the community and see what they

think.
Herald: In the meantime, I think there is

plenty of time for a great white wine, but
to our questions, we have indeed plenty of

questions. The first question would be: How
would you compare the surveillance of the

CIA or other to surveillance of the DDR?
So for the Deutsche Demokratische

Republik.
Andy: Well, I'm born in Hamburg in West

Germany. I lived in East Germany when the
government was already falling into

pieces. It was technically still there. So
I'm not the best person to compare it. But

I did talk with a person I know who worked
for the foreign intelligence services

because there was, you know I simplified
here, of course, the incidents a little

bit. There was one scene when later I went
into my kitchen that day when my door lock

got tampered with and I found a blue
plastic glove and I don't have blue

plastic gloves. And I asked my locksmith
guy, he was like, no, it's not for me. And

the police had black ones. So I thought,
what the fuck? Maybe the guys have been

inside the apartment, which I didn't
thought earlier because of a second look

and the police checked and so on. Um, and
then I talked to discuss it with this

person I know. He's a quite friendly man,
was working in the foreign intelligence of

that country. And so and he was like, you
know, you have to look at it from a cost

effectiveness point of view, like that
piece of plastic costs you ten cents,

nothing, and it freaks you out three
months. So see how much how cost effective

it is. And I mean, that's a good aspect.
That's a good point. And so I think that

the East German Stasi, the guys, the East
intelligence guys, they also they knew

very well the difference. And they had
both instruments in there, you know, in

their program to either do covert
surveillance really like not let you know.

And the department for "we let him know
and see how he reacts" or "we let him know

because he's ongoing doing things that we
want him to, you know, stop it and get

intimidated". And so on, and get scared
maybe or his wife gets scared or this kind

of thing. So I think it is comparable.
Herald: Cool. Well, not cool. Speaking of

covert versus overt civilians.
As you now know, does it still

bother you emotionally?
Andy: Um, well, what bothers me sometimes

is, you know, it's also it has a sometimes
it's nice to be alone and it's sometimes

nice to not think about the CIA guys being
in the apartment next door or in my case,

an apartment under me or in the
surrounding environments. Um, but thinking

about normal things like playing a puzzle
or seeing some funny spy movies. Oh,

that's almost relaxing. No, seriously, at
some point it sucks a little bit. I get my

kind of deal with it. But I mean, this
20/20 era has of course, complicated or

has made it almost impossible to travel.
So normally I escape my intensity of my

work situation with travels. Maybe I can
do that this year. So it feels a little

more intense and annoys a little bit.
And I would like to get these guys out of

my life and do something useful with their
life or whatever.

Herald: Now, the next question, he or she
or the person or creature probably missed

it: Do you dissemble all your devices on a
regular basis?

Andy: No, I usually do just regular and
seal them. In this case, the seal had

an issue with with the heat as well. So,
and I was lousy on checking it. I have to

say so. Yes, that's something. I mean, if
you have one office, you can do that. I

tend to work on different continents even,
and that turned out to be a bit of an

issue. So, yes, you need to have safes
everywhere and seals and duh, duh, duh,

duh. But even then, you know, Pompeo
seems to have justified or have given

orders to do these things no matter the
costs. And my expectation to have like a

"private" or "secure" encrypted channel so
is very limited for a while, watching that

effort. The encryption of the cryptophone
obviously was good. Otherwise they

wouldn't have had the effort to, you know,
build something in. But at the end of the

day, for me, it has the same impact. It's
like, well, you know, it's a phone, it's a

piece of device, it's in a room. The room
has windows. We've seen what they've done

with the embassy windows and so on. So
it's like, yeah, security. What a nice

idea, but it doesn't really exist.
Herald: Yeah. Do you try giving a few

coins to the homeless looking people to do
either some reverse intimidation or good

deed if they are not CIA?
Andy: Yeah, that's, I mean, I had this one

particular situation where I was waiting
for someone on kind of a shopping street,

and I just said something is wrong with
the guy. But when I saw the camera and saw

and he also rushed away. So, no, I didn't
give them the money. The second

scenario... No, but it's a good idea. Um,
the thing is, what I started to do is to

always have a camera with me. That turns
out for me to be important, to be able to

document things. And also most of them,
except the British, don't like it when

they are being photographed. And you
either, they, it's very interesting

because normal people do realize when they
are being photographed. But these guys are

either pretending, no, I don't see that
you photograph me. You know, they look a

little bit with too much energy away from
it or they are seriously disturbed and go

away.
Herald: So the best solution would be to

have the boldest, biggest, largest camera
always in hand.

Andy: Yeah, let me say it like this. I
mean, I've not been a fan of surveillance

technology and for sure not of CCTV for a
long part of my life. But I start to like

the idea of CCTV at some places in my own
environment. I'm sorry to say that, but

there's compromises you can make like
surveil feet, you know, other parts you

don't always need the faces. If you need
the faces , yeah there's options.

Herald: And still, analog photography is a
great thing. But that's my personal

opinion. Um. You maybe you want to, you
can talk, maybe you cannot talk about: Do

you use other counter measurements you
want to talk about or can talk about?

Andy: You know, I obviously don't want to
talk about it. But I mean, I've been, um.

But I was wondering myself how, um, why I
had this rather intense things going on. I

mean, I was wondering, is it the time
frame? Is it me as a person? It might have

to do with actually being in this funny
scene? Of course, I've learned. I mean, I

know lock picking persons, I've always had
an eye on having good locks based on their

advice, and understanding how easy it
would be otherwise. And using encryption

was also not always about, like, hiding
something. It was just good practice of

having privacy and operational security.
So for me, that was very normal for many

years to do that. And maybe, you know,
compared to other persons, that made me

more interesting. I don't know. I'll find
out one day. But I think it's a good idea

for everybody involved to think about
these three aspects: physical security,

encryption, and also what kind of ways do
you have to realize if something is being

tampered with.
Herald: Yeah -

Andy: And that's not necessarily
monitoring. I mean, monitoring can help,

but on the other hand side, yeah, with
monitoring systems, they can also deal

with.
Herald: Like physical checksums(?), kind

of. Our next question: Do you ask the
police at the border if everything is

prepared now?
Andy: You know, the British border,

probably that's a reference to, I don't
travel to the UK anymore. I decided, you

know, after they dealt with Julian there,
I don't like that place anymore. I never

felt so well there. And actually, maybe I
forgot to mention that, after this kind of

treatment at the border started I also
started avoiding sleeping in the UK. So I

made day trips sometimes, in order to get
the last plane out of the country. I was

flying to Zürich first, because it was a
late flight to Zürich and then the next

morning to Berlin. I felt in Zürich better
at the bar of a shitty hotel than in

London Central City with, yeah, this
special relationship, as it's called,

between the intelligence of the UK and
those of the US.

Herald: I see. Speaking of sleeping, or in
this case concerning your apartment, the

question would be: Would some home
surveillance system bring some relief, for

example?
Andy: Well, that's like, that's like

exchanging the devil with the other dude,
right? I mean, no, I'm not really a fan of

that. But yes, of course, I had to at the
end of the day, at least check with my

door and so on, what I can do to detect
and record things and so on. But it's not

a pleasure. It's not like, I don't know. I
mean, yes, you end up doing that kind of

shit. But that's not how life on planet
Earth should be.

Herald: Yeah, yeah. It's, it's a kind of a
trade off, for what return. And yeah -

Andy: I mean, the thing is, I mean, look,
I'm a German citizen. What I'm doing is

constitutionally protected. I live in the
governmental district of Berlin. It's

fairly safe here. But, you know, I have
friends in other places, other situations,

their life is completely different there,
and that is more what worries me. That I'm

in a relatively cool position, secure
position. That's why I can talk about

these things. But I have friends who have
a more severe situation and they are not

sure they should talk about it, to not
escalate things. And that's a very tricky

choice to make, maybe.
Herald: Yes, indeed. Um, that brings us to

another question. And I think this is a
perfect point to mention that. Can we do -

What can we do to support you in getting
out of this mess? And what can we do in

general for this?
Andy: While I really appreciate the

question, I don't have a good answer. But
I think, yes, I would like to discuss more

with people about what can be done. I
mean, for the moment, I'm dealing with

police, with lawyers, the Spiegel guys I'm
working with, they also find some ways

maybe to address it. Um, but it seems like
at least if it comes to Julian's

situation, things are, yeah, badly
escalated and it's all a bit interrelated.

So I don't have a good answer at this
moment, but I think it's a good idea to

discuss it more and also maybe identifying
other people who are in some kind of a

risk situation because these things
happened. And so maybe, hopefully was able

to show it's not that difficult to get
into such a mess. It's - it happens.

Herald: Yeah, and speaking of discussing,
you mentioned earlier, there is a Big Blue

Button to discuss any further. You will
find it in the 2D area, in the 2D world in

the Whistleblower Wiki. Is that right?
Andy: Yes. In the tent, actually, I was

told. In the tent is the URL to the Big
Blue Button or somehow it's interlinked

there.
Herald: So again, please go out, explore

the 2D world. And of course, the
whistleblower tent. We still have some

minutes left. How do you do mentally? Did
you use any method to keep your head clean

or clear and, did you freak out?
Andy: Yeah, that's a good question. Um. I

drink too much vodka, but I try to keep
it with good quality. Um, let me say it

like this. The real trouble is maybe that
while in this scene here, people have a

rough understanding of this type of things
already. Um, I also liked to have, to be

around with people who have nothing to do
with IT, with security, with all these

kind of things. So-called normal people.
Sometimes it's refreshing to be with them,

but their ability to understand this mess
is a little bit limited. So it's, I think

others judge better how I'm doing
mentally. I'm trying to keep my head up

and finding a good way out. But if anyone
has a good idea, I am really all for

listening and see what's possible.
Herald: In this case. I can can come back

to the vineyard and it's pretty relaxing
to have work in the late autumn.

Andy: All right. Even during a pandemic.
OK, you just find a way there. Yeah.

Herald: It's outside and it's a lot of
distance between the people. I think this

will work. So the last question: Red or
white wine?

Andy: Red, red wine.
Herald: Red.

Andy: Yeah, definitely. And I mean, thanks
for all this. Just to point out, please,

we also have to work on to getting Julian
out there and others who are in this mess

who can't even talk about it. I really
appreciate the opportunity to talk to you

guys, but it's also about the others. And
let us get Julian out here, please. Out

that shit there.
Herald: With these great words, Andy,

thanks for your time. Thanks for being
here at the remote chaos. As mentioned, we

still have the opportunity to ask you some
questions in the whistleblower tent. And

with this, have a nice evening. Try to
relax and see you latest - next time.

Andy: Goodbye.

postroll music

Subtitles created by c3subtitles.de
in the year 2020. Join, and help us!