B1 Intermediate US 6186 Folder Collection
After playing the video, you can click or select the word to look it up in the dictionary.
Report Subtitle Errors
Ben Wizner: Not a lot of applause for us. Chris Saghoian: I know.
Ben Wizner: Are they ready? Chris Saghoian: I think so.
Ben Wizner: Ok, I think we'll get started. Thank you all so much for being here. There
wasn't a lot of applause when we came on stage so I guess you're here to see somebody else. (( Applause ))
My name is Ben Wizner; I'm joined by my colleague Chris Saghoian from the ACLU. Maybe we can
bring up on screen the main attraction.
Edward Snowden: Hello. Ben Wizner: With his very clever green screen. Please bear with us today, the technology
may have some kinks. The video may be a little bit choppy. Our friend is appearing through
7 proxies so if the video is a little slow.
You're joining us for the event that one member of congress from the great state of Kansas hoped would not occur. He wrote to the organizers
or SXSW urging them rescind the invitation to Mr. Snowden. The letter included this very
curious line, "The ACLU would surely concede that freedom expression for Mr. Snowden has
declined since he departed American soil". No one disputes that freedom of expression
is stronger here than there but if there's one person for whom that's not true, it's
Ed Snowden. If he were here in the United States he would be in a solitary cell, subject
probably to special administrative measures that would prevent him from being able to
communicate to the public and participate in the historic debate that he helped launch.
We're really delighted to be here. One more bit of housekeeping. As I'm sure
most of you know, you can ask questions for Mr. Snowden on twitter using the hash tag
AskSnowden. Some group of people backstage will decide which of those questions we see
here. We'll try to leave at least 20 minutes or so for those questions. As I said, Ed Snowden's
revelations and the courageous journalism of people like Bart Gellman who you just heard,
Glenn Greenwald, Laura Poitras, and others has really launched an extraordinary global
debate. You might think of that debate as occurring over 2 tracks. There is a debate
in Washington in the halls of power about law and policy about what democratic controls
we need to reign in NSA spying that takes place in courts that are considering the legality,
the constitutionality of these programs in the legislature, considering legislation.
There's a very different conversation that you here in conference rooms in technology
companies, particularly among people working on security issues. Those people are talking
less about the warrant requirement for meta data and more about why the hell the NSA is
systematically undermining common encryption standards that we all use. Why is the NSA
targeting telecommunication companies, internet companies, hacking them to try to steal their
customer data, basically manufacturing vulnerabilities to poke holes in the communication systems
that we all rely on? We're hoping to mostly focus on that latter conversation here.
With that in mind, Ed if you're with us, maybe you could say a few words about why you chose
for some of your first public remarks to speak to the technology community rather than say
the policy community in Washington. Edward Snowden: Well thank you for the introduction.
I will say SXSW and the technology community, the people who are in the room at Austin right
now, they're the folks who can really fix things. Who can enforce our rights through
technical standards even when congress hasn't yet gotten to the point of creating legislation
to protect our rights in the same manner? When we think about what's happened with the
NSA in the last decade, in the post 9/11 era... the result has been an adversarial internet,
a sort of global free fire zone for governments that's nothing that we ever asked for. It's
not what we wanted. It's something we need to protect against.
When we think about the policies that have been advanced... sort of erosion of fourth
amendment protections, the proactive seizure of communications, there's a policy of response
that needs to occur. There's also a technical response that needs to occur. It's the makers,
it's the thinkers, it's the development community that can really craft those solutions and
make sure we are safe. The NSA... the sort of global mass surveillance
that's prying at all of these countries not just the US, and it's important to remember
that this is a global issue, they're setting fire to the future of the internet. The people
who are in this room now, you guys are all the firefighters. We need you to help us fix
this. Ben Wizner: So Chris, you heard Ed say that
the NSA offensive mass surveillance programs, the sort of manufacturing of vulnerabilities,
is setting fire to the future of the internet. Do you want to comment on that?
Chris Saghoian: Sure. Many of the communications tools that we all rely on are not as secure
as they could be. Particularly for the apps and services that are made by small companies
and small groups of developers, security is often an afterthought if it's a thought at
all. What that's done is enable global passive surveillance by the US but other governments
too. What I think has been the most lasting impression
for me from the last 8 months is the fact that the real technical problems that the
NSA seems to have are not, "How do we get people's communications" but, "How do we deal
with the massive amounts of communication data that we're collecting?" The actual collection
problem doesn't seem to be a bottleneck for the NSA. That's because so many of the services
that we're all relying on are not secure by default.
I really think for this audience, one of the things that we should be thinking about and
hopefully taking home is the fact that we need to lock things down. We need to make
services secure out of the box. That's going to require a rethink by developers. It's going
to require the developers start to think about security early on rather than later on down
the road. Ben Wizner: Let me pick up on that. Ed, you
submitted written testimony last week to the European parliament. I want to quote a very
short part of that and have you elaborate on it. You said, "In connection with mass
surveillance, the good news is that there are solutions. The weakness of mass surveillance
is that it can very easily be made much more expensive through changes in technical standards".
What kind of changes were you talking about and how can we ensure that we make mass surveillance
more expensive and less practical? Edward Snowden: The primary challenge that
mass surveillance faces from any agency, any government of the world, is not just how do
you collect to communications as they cross the wires, as they sort of find their way
through the global network, but how do you interpret them? How do you understand them?
How do you direct them back out and analyze them? [inaudible 00:08:35] at least on the
easiest, the simplest, most cost effective basis by encryption.
There are 2 methods of encryption that are generally used, one which is deeply problematic.
One of those is what's called key escrow. It's sort of what we're using with Google
type services, Skype type services, right now where I encrypt a video chat and I send
it to Google. Google decrypts it and then re-encrypts it to you guys and we have it.
End-to-end encryption, where it's from my computer directly to your computer, makes
mass surveillance impossible at the network level without a crypto break. They are incredibly
rare and they normally don't work. They're very expensive. By doing end-to-end encryption,
you force what are called threat model global passive adversaries to go through the end
heads, that is the individual computers. The result of that is a more constitutional,
more carefully overseen sort of intelligence gathering model, law enforcement model, where
if they want to gather somebody's communications, they'd have to target them specifically. They
can't just target everybody all the time and then when they want to read your stuff, they
go back in a time machine and they say, "What did they say in 2006?"
They can't pitch exploits in every computer in the world without getting caught. That's
the value of end-to-end encryption and that's what we need to be thinking about. We need
to go, "How can we enforce these protections in a simple, cheap, and effective way that's
invisible to [users 00:10:17]. I think that's the way to do it.
Ben Wizner: So Chris, one of the obstacles to widespread end-to-end encryption is that
many of us get our e-mail service from advertising companies that need to be able to read the
e-mails in order to serve us targeted ads. What are steps that even a company like Google
that's an advertising company or companies like that can do to make mass surveillance
more difficult? Are there things or do we really need new business models to accomplish
what Ed is talking about? Chris Saghoian: In the last 8 months, the
big Silicon Valley technology companies have really improved their security in a way that
was surprising to many of us who have been urging them for years to do so. Yahoo was
kicking and screaming the whole way but they finally turned on SSL encryption in January
of this year after Bart Gellman and Ashkan Soltani shamed them on the front page of the
Washington Post. The companies have locked things down, but
only in a certain way. They've secured the connection between your computer and Google's
server or Yahoo's server or Facebook's server which means that governments have to now go
through Google or Facebook or Microsoft to get your data instead of getting it with AT&T's
help or Verizon's help or Comcast or any party that watches the data as it goes over the
network. I think it's going to be difficult for these
companies to offer truly end-to-end encrypted service simply because it conflicts with their
business model. Google wants to sit between you and everyone you interact with and provide
some kind of added value whether that added value is advertising or some kind of information
mining, improved experience, telling you when there are restaurants nearby, where you can
meet your friends. They want to be in that connection with you. That makes it difficult
to secure those connections. Ben Wizner: Is this the right time for a shout
out to Google that is in this conversation with us right now?
Chris Saghoian: The irony that we're using Google hangouts to talk to Ed Snowden has
not been lost on me or our team here. I should be clear; we're not getting any advertising
support from Google here. The fact is that the tools that exist to enable secure end-to-end
encrypted video conferencing are not very polished. Particularly when you're having
a conversation with someone who's in Russia and who's bouncing his connection through
several proxies, the secure communications tools tend to break.
This I think reflects the state of play with many services. You have to choose between
a service that's easy to use and reliable and polished or a tool that is highly secure
and impossible for the average person to use. I think that reflects the fact that the services
that are developed by large companies with the resources to put 100 developers on the
user interface, those are the ones that are optimized for security. The tools that are
designed with security as the first goal are typically made by independent developers,
activists, and hobbyists. They're typically tools made by geeks for geeks.
What that means is the world... the regular users have to pick. They have to pick between
a service they cannot figure out how to use or a service that is bundled with their phone
or bundled with their laptop and works out of the box. Of course rational people choose
the insecure tools because they're the ones that come with the devices they buy and work
and are easy for people to figure out. Ben Wizner: Let's bring Ed back into this.
In a way, this whole affair began with Glenn Greenwald not being able to use PGP which
is somewhat of a joke in the tech community but really not outside the tech community.
PGP is not easy to install and it's not easy to use. Using Tor, using Tails... I feel like
I need new IT support in my office just to be able to do this work. You're addressing
an audience that includes a lot of young technologists. Is there a call to arms for people to make
this stuff more usable so that not only technologists can use it?
Edward Snowden: There is. I think we're actually seeing a lot of progress being made here.
Whisper Systems, the sort of Moxie Marlinspike of the world, are focusing on new user experiences,
new UIs. Basically ways for us to interact with cryptographic tools which is the way
it should be, where it happens invisible to the user, where it happens by default. We
want secure services that aren't [opt in 00:14:46]. It's got to pass the Glenn Greenwald test.
If any journalist in the world gets an e-mail from somebody saying, "Hey, I have something
that the public might want to know about" they need to be able to open it. They need
to be able to access that information. They need to be able to have those communications
whether they're a journalist, an activist, or it could be your grandma. This is something
that people have to be able to access. The way we interact with it right now is not
good. If you have to go to command log, people aren't going to use it. If you have to go
3 menus deep, people aren't going to use it. It has to be out there. It has to have it
automatically. It has to happen seamlessly. That's [inaudible 15:27].
Ben Wizner: So who are we talking to, Chris? Are we talking now to technology companies?
Are we talking to foundations to support the development of more usable security? Are we
talking just to developers? Who's the audience for this call to arms?
Chris Saghoian: I think the audience is everyone. We should understand that most regular people
are not going to go out and download an obscure encryption app. Most regular people are going
to use the tools that they already have. That means they're going to be using Facebook or
Google or Skype. A lot of our work goes into pressuring those companies to protect their
users. In January of 2010, Google turned on SSL,
the lock icon on your web browser. They turned it on by default for Gmail. It had previously
been available but it had been available through an obscure setting, the 13th of 13 configuration
options. Of course, no one turned it on. When Google turned that option on, suddenly they
made passive bulk surveillance of their users' communications far more difficult for intelligence
agencies. They did so without requiring that their users
take any steps. One day their users logged into their mail and it was secure. That's
what we need. We need services to be building security in by default an enabled without
any advanced configuration. That doesn't mean that small developers cannot play a role.
There are going to be hot new communications tools.
WhatsApp basically came out of nowhere a few years ago. What I want is for the next WhatsApp
or the next Twitter to be using encrypted end-to-end communication. This can be made
easy to use. This can be made useable. You need to put a team of user experience developers
on this. You need to optimize. You need to make it easy for the average person.
If you're a startup and you're working on something, bear in mind that it's going to
be more difficult for the incumbents to deliver secure communications to their users because
their business models are built around advertising supported services. You can more effectively
and more easily deploy these services than they can. If you're looking for an angle here,
we're slowly getting to the point where telling your customers, "Hey, 5 dollars a month for
encrypted communications. No one can watch you" I think that's something many consumers
might be willing to pay for. Edward Snowden: If I could actually take you
back on that real quick, one of the things that I want to say is for the larger company,
it's not that you can't collect any data. It's that you should only collect the data
and hold it for as long as necessary for the operation of the business. Recently EC-Council,
one of the security certification providers intact, they actually spilled my passport,
a copy of my passport and my registration, and posted them to the internet when they
defaced the site. I submitted those forms back in 2010. Why
was that still [inaudible 00:18:20]? Was it still necessary for the business? That's a
good example of why these things need to age [off 00:18:26]. Whether you're Google or Facebook,
you can do these things in a responsible way. You can still get the value out of these that
you need to run your business [inaudible 00:18:38] without [inaudible 00:18:40]
Ben Wizner: We didn't have great audio here that response but what Ed was saying is that
even companies whose business model relies on them to collect and aggregate data don't
need to store it indefinitely once its primary use has been accomplished. His example was
that some company was hacked and they found some of his data from 4 years ago that clearly
there was no business reason for them still to be holding on to.
Let's switch gears a little bit. Last week General Keith Alexander who heads the NSA
testified that the disclosures of the last 8 months have weakened the country's cyber
defenses. Some people might think there's a pot in the kettle problem coming from him
but what was your response to that testimony? Edward Snowden: It's very interesting to see
officials like Keith Alexander talking about damage that's been done to the defense of
our communications. More than anything, there have been 2 officials in America who have
harmed our internet security and actually our national security because so much of our
country' economic success is based on our intellectual property. It's based on our ability
to create, share, communicate, and compete. Those two Officials are Michael Hayden and
Keith Alexander, two directors of the National Security Agency in the post 9/11 era who made
a very specific change. That is they elevated offensive operations, that is attacking, over
the defense of our communications. They began eroding the protections of our communications
in order to get an attacking advantage. This is a problem for 1 primary reason. America
has more to lose than anyone else when every attack succeeds. When you are the one country
in the world that has a vault that's more full than anyone else's, it doesn't make sense
for you to be attacking all day and never defending your full vault. It makes even less
sense when you set standards for vaults worldwide to have a big back door that anybody can walk
into. That's what we're running into today. When
he says these things have weakened national security... these are improving our national
security. These are improving the communications not just of Americans but everyone in the
world. When you rely on the same standard, we rely on the ability to trust our communications.
Without that, we don't have anything. Our economy cannot succeed.
Ben Wizner: So Chris, Richard Clarke testified a few weeks back that it's more important
for us to be able to defend ourselves against attacks from China than to be able to attack
China using our cyber tools. I don't think everybody understands that there is any tension
whatsoever between those 2 goals. Why are they in opposition to each other?
Chris Saghoian: As a country, we have public officials testifying in Washington saying
that cyber security is the greatest threat this country now faces, greater than terrorism.
We've had both the director of the FBI and the director of National Intelligence say
this in testimony to congress. I think it's probably true that we do in fact face some
kind of cyber security threat. Our systems are not as safe as they could be and we are
all vulnerable to compromise in one way or another.
What should be clear is that this government isn't really doing anything to keep us secure
and safe. This is a government that has prioritized for offense rather than defense. If there
were 100% increase in murders in Baltimore next year, the Chief of Police of Baltimore
would be fired. If there was 100% increase in fishing attacks, successful fishing attacks
where people's credit card numbers get stolen, no one gets fired.
As a country, we have basically been left to ourselves. Every individual person is left
to defend themselves online. The government has been hoarding information about information
security vulnerabilities. In some cases, there was a disclosure in the New York Times last
fall revealing the NSA has been partnering with US technology companies to intentionally
weaken the security of the software that we all use and rely on.
The government has really been prioritizing its efforts on information collection. There
is this fundamental conflict. There's a tension which is that a system that is secure is difficult
to surveil and a system that is designed to be surveiled is a target waiting to be attacked.
Our networks have been designed with surveillance in mind. We need to prioritize cyber security.
That's going to mean making surveillance more difficult. Of course the NSA and their partners
in the intelligence world are not crazy about us going down that path.
Ben Wizner: So Ed, if the NSA is willing to take these steps that actually weaken security,
that spread vulnerabilities that make is sometimes easier not just for us to do surveillance
but for others to attack, they must think there's an awfully good reason for doing that.
Their bulk collection programs that these activities facilitate, the collected mentality,
that it really works. This is a very, very effective surveillance method in keeping us
safe. You sat on the inside of these systems for
longer than people realize. Do these mass surveillance programs do what our intelligence
officials promise to congress that they do? Are they effective?
Edward Snowden: They're not. That's actually something that I'm a little bit sympathetic
to because we got to turn back the clock a little bit and remember that they thought
it was a great idea but no one had ever done it before, at least publically. They went,
"Hey, we can spy on everybody in the world all at once. It'll be great. We'll know everything".
The reality is when they did it, they found out it didn't work. It was such [inaudible
00:24:58]. It was so successful in securing funding and so great at getting [inaudible
00:25:02]; it was so great at winning new contracts that nobody wanted to say no.
The reality is now, we have reached a point where the majority of Americans' telephone
communications are being recorded. We got all this meta data that's being stored for
years and years and years. Too many White House investigations have found it has no
value at all. It's never helped us. Beyond that, we've got to think about what are we
doing with those resources? What are we getting out of it?
As I said in my European parliament testimony, we actually had tremendous intelligence failures
because we're monitoring the internet. We're monitoring everybody's communications instead
of suspects' communications. That lack of focus has caused us to miss leads that we
should have had, Tamerlan Tsarnaev of the Boston bombers. The Russians had warned us
about it but we did a very poor effort investigating [inaudible 00:26:04]. We had people looking
at other things. If we hadn't spent so much on mass surveillance, if we followed the traditional
models, we might have caught that. Umar Farouk Abdulmutallab, the underwear bomber,
same thing. His father walked into a US embassy, he went to a CIA officer, he said, "My son
is dangerous. Don't let him go to your country. Get him help". We didn't follow up. We didn't
actually investigate this guy. We didn't dedicate a team to figure out what was going on because
we all this money, we spent all of this time, hacking into Google and Facebook's back ends
to look at their data center communications. What did we get out of it? We got nothing
and 2 White House investigations that confirmed that.
Ben Wizner: Chris, if as Ed says these bulk collection programs are not all that effective,
that the resources that go into this would be better directed at targeted surveillance,
why are they dangerous? Chris Saghoian: Because the government has
created this massive database of everyone's private information. In an NSA building somewhere
probably in Maryland, there is a record of everyone who's called an abortion clinic,
everyone who's called an alcoholics anonymous hotline, everyone who's called a gay bookstore.
They tell us, "Don't worry, we're not looking at it" or "We're not looking at It in that
way. We're not doing those kinds of searches" but I think many Americans would have good
reason to not want that information to exist. Regardless of which side of the political
spectrum you are, you probably don't want the government to know that you're calling
an abortion clinic, a church, or a gun store. You may think quite reasonably that that is
none of the government's business. I think when you understand that the government can
collect this information at this scale, they can hang onto it and figure out uses for it
down the road, I think many Americans are quite fearful of this slippery slope, this
surveillance that happens behind closed doors. Even if you trust this administration we have
right now, the person who sits in the oval office changes every few years. You may not
like the person who's going to sit there in a few years with that data that was collected
today. Ben Wizner: Ed we lost you for a moment but
can you still hear us? Edward Snowden: I can hear you.
Ben Wizner: Ok. Just before this began, I got an e-mail from Sir Tim Berners-Lee, the
creator of the World Wide Web who asked for the privilege of the first question to you.
I think I'm willing to extend that to him. He wanted to thank you. He believes that your
actions have been profoundly in the public interest. That was applause if you couldn't
hear it. He asks if you could design from scratch an
accountability system for governments over national security agencies, what would you
do? It's clear that intelligence agencies are going to be using the internet to collect
information from all of us. Is there any way that we can make oversight more accountable
and improved? Edward Snowden: That's a really interesting
question. It's also a very difficult question. Oversight models, [inaudible 00:29:41] models,
these are things that are very complex. They've got a lot of moving parts. When you add in
[inaudible 00:29:47], when you add in public oversight, it gets complex. We've got a good
starting point and that's what we have to remember. We have an oversight model that
could work. The problem is when the overseers aren't interested in oversight, when we've
got 7 intelligence committees, house intelligence committees that are cheerleading for the NSA
instead of holding them to account. When we have James Clapper the Director of
National Intelligence in front of them and he tells a lie that they all know is a lie
because they're briefed on the program because they got the collections a day in advance
and no one says it, allowing all the American people to believe that this is a true answer,
that's an incredibly dangerous thing. That's the biggest [inaudible 00:30:36]. When I would
say, "How do we fix our oversight model? How do we structure an oversight model that works?"
the key factor is accountability. We can't have officials like James Clapper
who can lie to everyone in the country, who can lie to the congress, and face not even
a criticism. Not even a strongly worded letter. The same thing with courts. In the United
States we've got open courts that are supposed to decide [inaudible 00:31:06] constitutional
issues to interpret and apply the law. We also have the FISA court, which is a secret
rubber stamped court, but they're only supposed to approve warrant applications. These happen
in secret because you don't want people to know the government wants to surveil. At the
same time, a secret court shouldn't be interpreting the constitution when only NSA's lawyers are
making the case about how it should be [inaudible 00:31:40]. Those are the 2 primary factors
that I think need to change. The other thing is we need public advocates.
We need public representatives. We need public oversight. Some way for trusted public figures,
sort of civil rights champions, to advocate for us and to protect the structure and make
sure it's been fairly applied. We need a watchdog that watches congress. Something that can
tell us these guys didn't tell you that you were just lied to. Otherwise, how do we vote?
If we're not informed, we can't consent to these policies. I think that's damaging.
Ben Wizner: For what it's worth, my answer to Sir Tim is Ed Snowden. Before these disclosures,
all 3 branches of our government had gone to sleep on oversight. The courts had thrown
cases out, as he said. Congress allowed itself to be lied to. The executive branch did no
reviews. Since Ed Snowden and since all of us have been read in to these programs, we're
actually seeing reinvigorated oversight. It's the oversight that the constitution had in
mind but sometimes it needs a dusting off. Ed has been the broom.
Chris Saghoian: I just wanted to also note that without Ed's disclosures, many of the
tech companies would not have improved their security either at all or at the rate that
they did. The prism story, although there was a lack of clarity initially about what
it really said, put the names of billion dollar American companies on the front page of the
newspaper and associated them with bulk surveillance. You saw the companies doing everything in
their power publically to distance themselves and also show that they were taking security
seriously. You saw companies like Google, Microsoft, and Facebook rushing to encrypt
their data centers with data center connections. You saw companies like Yahoo! finally turning
on SSL encryption. Apple fixed a bug in its address book app that allowed Google users'
address books to be transmitted over networks in an unencrypted form. Without Ed's disclosures,
there wouldn't have been as much pressure for these tech companies to encrypt their
information. There are going to be people in this audience
and people who are listening at home who think that what Ed did is wrong. Let me be clear
about one really important thing. His disclosures have improved internet security. The security
improvements we've gotten haven't just protected us from bulk government surveillance. They've
protected us from hackers at Starbucks who are monitoring our Wi-Fi connections; they've
protected us from stalkers, identity thieves, and common criminals.
These companies should have been encrypting their communications before and they weren't.
It really took, unfortunately, the largest and most profound whistle blower in history
to get us to this point where these companies are finally prioritizing the security of their
users' communications between them and the companies. We all have Ed to thank for this.
I cannot emphasize enough. Without him, we would not have Yahoo! users getting SSL, we
would not have this data going over the network in encrypted form.
It shouldn't have taken that. The companies should have done it by themselves. There should
be regulation or privacy regulators who are forcing these companies to do this. That isn't
taking place so it took Ed to get us to a secure place.
Ben Wizner: Great. Remember the hash tag is AskSnowden. We'll take our first question,
please forgive pronunciations, from Max [Zerk-an-tin 00:35:36]. The question for Ed and Chris to,
why is it less bad if big corporations get access to our information instead of the government?
Ed, did you hear it? Edward Snowden: Yes, I did. This is something
that's actually been debated. We see people's opinions, people's responses to this evolving
which is good. This is why we need to have these conversations. We don't know. Right
now my thinking, and I believe the majority's thinking, is that the government has the ability
to deprive you of rights. Governments around the world, whether it's the United Stated
Government, whether it's the Yemeni government, whether it's Zaire, any country, they have
police powers, they have military powers, they have intelligence powers. They can literally
kill you. They can jail you. They can surveil you.
Companies can surveil you to sell you products, to sell your information to other companies,
and that can be bad but you have legal [inaudible 00:36:41]. First off, it's typically a voluntary
contract. Secondly, you've got court challenges you use. If you challenge the government about
these things, and the ACLU itself has actually challenged some of these cases, the government
throws [inaudible 00:36:58] and says, "You can't even ask about this". The courts aren't
allowed to tell us whether this is legal or not because we're just going to do it anyway.
That's the difference and it's something we need to watch out for.
Ben Wizner: Chris do you want to address it or should we take the next question?
Chris Saghoian: Sure, just quickly. I'm not crazy about the amount of data that Google
and Facebook collect. Of course everything they get, the government can come and ask
for too. There's the collection the government is doing by itself, and then there's the data
that they can go to Google and Facebook and force them to hand over. We should remember
that the web browser that you're likely using, the most popular browser right now is Chrome.
The most popular mobile operating system is now Android. Many of the tools that we're
using, whether web browsers or operating systems or apps, are made by advertising companies.
It's not a coincidence that Chrome is probably a less privacy-preserving browser. It's tweaked
to allow data collection by third parties. The android operating system is designed to
facilitate disclosure of data to third parties. Even if you're ok with the data that companies
are collecting, we should also note that the tools that we use to browse the web and the
tools that ultimately will either permit our data to be shared or prevent it from being
shared are made by advertising companies. This makes the NSA's job a lot easier. If
the web browsers we were using were locked down by default, the NSA would have a much
tougher time but advertising companies are not going to give us tools that are privacy
preserving by default. Ben Wizner: Let's take another question from
[Jodi Se-ra-no 00:38:31] to Snowden from Spain. Do you think the US surveillance systems might
encourage other countries to do the same? Edward Snowden: Yes. This is actually one
of the primary dangers not just of the NSA's activities but in not addressing and resolving
these issues. It's important to remember that Americans benefit profoundly on this because
again, as we discussed, we've got the most to lose from being hacked. At the same time,
every citizen in every country has something to lose. We all are at risk of unfair, unjustified,
unwarranted interference in our private lives. Through ought history, we've seen governments
sort of repeat the trend where it increases and it gets to a point where they crossed
the line. If we don't resolve these issues, if we allow the NSA to continue unrestrained,
every other government, the international community, will accept that sort of as the
green light to do the same. That's not what we want.
Chris Saghoian: I think there's a difference between surveillance performed by the NSA
and surveillance performed by most other governments. It's not really illegal when it's more of
a technical one and that is the whole world sends their data to United States. Americans
are not sending their e-mail to Spain; Americans are not sending their photographs to France.
This means that the US, because of silicon valley, because of the density of tech companies
in this country, the US enjoys an unparalleled intelligence advantage that every other government
just doesn't have. If we want the rest of the world to keep using
US tech companies, if we want the rest of the world to keep trusting their data with
the United States, then we need to respect them. We need to respect their privacy in
the way that we protect the privacy of Americans right now. I think the revelation to the last
8 months have given many people in other countries a very reasonable reason to question whether
they should be trusting their data to United States companies.
I think we can get that trust back through legal changes but I think tech companies can
also do a lot to earn that trust back by employing encryption and other privacy protecting technologies.
The best way to get your user's trust is to be able to say when the government comes to
you, "Sorry, we don't have the data" or "Sorry, we don't have the data that's going to be
in a form that will be of any use to you. That's how you win back the trust of people
in Brazil, in Germany, and people around the world.
Ben Wizner: Let me just cut in with a question here because I do think that a certain degree
of perhaps hopelessness may have crept in to the global public with this constant barrage
of stories about the NSA's capabilities, the GCHQ's capabilities and their activities,
all the ways that they're able to get around defenses. I hear, Chris, you and Ed both coming
back to encryption again and again as something that still works. Maybe we could just take
a moment, Ed, after the discussions that we've had about has NSA has worked to weaken encryption.
Should people still be confident that the basic encryption that we user protects us
from surveillance or at least mass surveillance? Edward Snowden: The bottom line, and I've
repeated this again and again, is that encryption does work. We need to think about encryption
not as this sort of arcane black art but sort of a basic protection. It's the defense against
the dark arts of the digital world. This is something we all need to be [inaudible 00:42:21].
Not only implemented, but actively researching and improving on the academic level. The grad
students of today, tomorrow, need to keep today's [inaudible 00:43:33] online to inform
tomorrow's. We need all those brilliant [inaudible 00:43:38]
cryptographers to go, "All right, we know that these encryption algorithms we're using
today work. Typically it's the random number generators that are attacked is if they were
to be encryption algorithms themselves. How can we make them [fool proof 00:42:52]? How
can we test them? This is [inaudible 00:42:54]. It's not going to going to go away tomorrow
but it's the steps that we take today, it's the moral commitment, the philosophical commitment,
the commercial commitment to protect and enforce our liberties through technical standards
that's going to take us through [tomorrow 00:43:11] and allow us to reclaim the open
and trusted [inaudible 00:43:15]. Ben Wizner: Chris very briefly, you hand out
with cryptographers. They're not happy campers these days.
Chris Saghoian: No. Of all the stories that have come out, the one that has really had
the biggest impact in the security community is the news that the NSA has subverted the
design of cryptographic and random number generator algorithms. I think it's fair to
say that there is a group within the cryptographic community now who have become radicalized
as a result of these disclosures. Cryptographers actually can be radicals. They're not just
mild mannered people. We should remember that regular consumers
do not pick their own encryption algorithms. Regular consumers just use the services that
are provided to them. The people who pick the crypto, who pick the particular algorithms,
who pick the key sizes; they are the security engineers at Google and Facebook and Microsoft.
The cryptographers who are working with open source projects, those people are all really
pissed. I think that's good. Those people should be mad. Those people can make a difference.
The fact that these disclosures have so angered the security community is a really good sign
because ultimately the tools that come out in 6 months or a year or 2 years are going
to be far more secure than they were before. That's because that part of the tech community
feel like they were lied to. Ben Wizner: Let's take a couple more questions
from Twitter. Melissa [nick sick 00:44:40] I hope. What steps do you suggest the average
person take now to ensure a more secure digital experience? Is there anything we can do at
the individual level to confront the issues of mass surveillance that we're talking about
today? Ed, it's ok if the answer is no. Edward Snowden: There are basic steps. It's
a really complicated subject matter today and that's the difficulty. Again, it's the
Glenn Greenwald test. How do you answer this? [inaudible 00:45:11] For me, there are a couple
of key technologies. There's full disc encryption to protect your actual physical computer and
devices in case they're seized. There's network encryption which are things like SSL but that
happens sort of transparently, you can't help that.
You can install a couple browser plugins, NoScript to block active exploitation attempts
in the browser, Ghostery to block ads and tracking cookies. But there's also Tor. Tor,
t-o-r, is a mixed routing network which is very important because it's encrypted from
the user through the ISP to the end of a cloud, a network of routers that you go through.
Because if this, your ISP, your telecommunications provider can no longer spy on you by default.
The way they do now, today, when you go to any website. By using Tor, you shift their
focus to either attacking the Tor cloud itself which is incredibly difficult, or to try to
monitor the exits from the Tor and the entrances to Tor, and then try to figure out what fits.
That's very difficult. [inaudible 00:46:31] those basic steps. You encrypt your hardware
and you encrypt your network communication. You're far, far more hardened than the average
user. It becomes very difficult for any sort of a mass surveillance to be applied to you.
You'll still be vulnerable to some targeted surveillance. If there's a warrant against
you, if the NSA is after you, they're still going to get you. Mass surveillance, this
untargeted collect it all approach, you'll be much safer.
Ben Wizner: When there's a question about average users and the answer is Tor, we failed,
right? Chris Saghoian: Yeah, I mean ill just add
to what Ed said in saying that a privacy preserving experience may not be a secure experience
and vice versa. I'm constantly torn. I personally feel like Firefox is the more privacy preserving
browser but I know that Chrome is the more secure browser. I'm stuck with this choice...
am I more worried about passive surveillance of my communications and my web browsing information
or am I more worried about being attacked? I go back and forth on those.
I think until we have a browser or a piece of software that optimizes for both privacy
and security, I think users are going to be stuck with 2 bad choices. I'll just not that
in addition to what Ed said, I really think that consumers need to rethink their relationship
with many of the companies to whom they entrust their private data. I really think what this
comes down to is if you're getting the service for free, the customer isn't going to be optimizing
the experience with your best interest in mind. I'm not going to say if you're not paying
for the product, you are the product because we pay for our wireless service and those
companies still treat us like crap. If you want a secure online backup service,
you're going to have to pay for it. If you want a secure voice or video communications
product, you're going to have to pay for it. That doesn't mean you have to pay thousands
of dollars a year but you need to pay something so that that company has a sustainable business
model that doesn't revolve around collecting and monetizing your data.
Ben Wizner: We have another question about encryption from Sean. Isn't it just a matter
of time before NSA can decrypt even the best encryption? Ed, I'm particularly interested
in your answer to this in light of your confidence that data that you were able to take is secure
and has remained secure. Edward Snowden: Well, let's put it this way.
The Unites States Government has assembled a massive investigation team into me personally,
into my work with the journalists, and they still have no idea what documents were provided
to the journalists, what they have, what they don't have because encryption worked. The
only way to get around that even over Tor is either have a computer that's so massive
and so powerful you convert the entire universe into the energy powering this crypto breaking
machine and it's still might not have enough to it, or you can break in a computer disc
and try to steal the keys and bypass that encryption.
That happens today. That happens every day. That's the way around it. There are still
ways to protect encrypted data that no one can break. That's by making sure the keys
are never exposed. The key itself cannot be observed. They key can't be stolen. It can't
be captured. The encryption can't be [inaudible 00:50:13]. Any cryptographer, any mathematician
in the world will tell you that the math is sound.
The only way to get through encryption on a targeted basis, particularly when you start
layering encryption, you're not using one algorithm, you're using every algorithm You're
using key splitting, you're using all kinds of sort of sophisticated techniques to make
sure that no one person, no single point of failure exists. There's no way in. There's
no way around it. That's going to continue to be the case until our understanding of
mathematics and physics changes on a fundamental level.
Actually if I could follow up on that, I would say the US government's investigation actually
supports that. We've had both public and private acknowledgements that they know at this point
neither the Russian government, nor the Chinese government, nor any other government has possession
of any of this information. That would be easy for them to find out. Remember, these
are the guys who are spying on everybody in the world.
They've got human intelligence assets embedded in these governments. They've got electronic
signals assets in these governments. Suddenly, if the Chinese government knew everything
the NSA was doing, we would notice the changes. We would notice the chatter. We would see
officials communicating and our assets would tell us, "Hey, suddenly they got a warehouse.
They put a thousand of their most skilled researches in there". That's never happened
and it's never going to happen. Chris Saghoian: I'll just add that I think Ed's right. If the government really
wants to get into your computer, if they want to figure out what you're saying and who you're
saying it to, they will find a way. That won't involve breaking the encryption. That will
involve hacking into your device. Whether your phone or your laptop, they'll take advantage
of either vulnerabilities that haven't been patched or vulnerabilities that no one knows
about. Hacking technologies don't scale. If you are
a target of the NSA, it's going to be game over no matter what unless you are taking
really, really sophisticated steps to protect yourself but for most people that will be
beyond their reach. Encryption makes bulk surveillance too expensive. The goal here
isn't to blind the NSA. The goal isn't to stop the government from going after legitimate
surveillance targets. The goal here is to make it so they cannot spy on innocent people
because they can. Right now so many of our communications, our
telephone calls, our e-mails, our text messages, our instant messages, are just there for the
taking. If we start using encrypted communication services, suddenly it becomes too expensive
for the NSA to spy on everyone. Suddenly they'll need to actually have a good reason to dedicate
those resources to either try and break the encryption or to try and hack into your device.
Encryption technology, even if imperfect, has the potential to raise the cost of surveillance
to the point that it no longer becomes economically feasible for the government to spy on everyone.
Ben Wizner: Can we get another question on the screen from Twitter? Please? Thanks. Good
question from David Meyer. Is it possible to reap the benefits of big data on a societal
level while not opening ourselves to constant mass surveillance? How do we enjoy the scientific
benefits, even some of the commercial benefits of this without turning ourselves into a dystopian
surveillance state? In 2 minutes or less. Ed?
Edward Snowden: This is a really difficult question. There are a lot of advancements
and things like encrypted search that make it possible for the data to be an unreadable
format, until [inaudible 00:54:10] or something. In general, it's a difficult problem. The
bottom line is data should not be collected without people's knowledge and consent. If
data is being clandestinely acquired and the public doesn't have any way to review it and
it's not legislatively authorized, it's not reviewed by courts, it's not [constant 00:54:33]
with our constitution, that's a problem. If we want to use that, it needs to be the
result of a public debate in which people's [inaudible 00:54:43].
Ben Wizner: Chris, do you want to take on that question?
Chris Saghoian: No. Ben Wizner: We have another question that
is about every day users. Maybe you can give us another one because I think we've answered
this one. Friends backstage? Ok, from Tim [Sho-ruck 00:55:04]. Wasn't NSA mass surveillance
the solution... Chris can you read that? Chris Saghoian: Wasn't NSA's mass surveillance
solution to the internet driven by privatization and handling of our signals intelligence analysis
to SCIC, Booz Allen so... Ben Wizner: I don't understand.
Chris Saghoian: Tim is basically saying, "Isn't this a result of letting the contractors in
to run the show?" Edward Snowden: The problem is when the NSA
gets a pot of money, they don't typically develop the solutions themselves. They bring
in a bunch of contractors. The Booz Allens, the SCICs, the [khakis 00:55:42], and they
go, "Hey, what can you guys do for us? What solutions are you working on?" These guys
get a gigantic [inaudible 00:55:50] song and dance. I actually used to do it professionally,
I know how it works. The problem is you got contractors and private companies at that
point influencing policy. It was not uncommon for me at the NSA as a
private employee to write the same point papers and sort of policy suggestions that I did
as an official employee of the government at the CIA. The problem with that is you got
people who aren't accountable, they've got no sort of government recourse against them
who are saying, "Let's do this. Let's do that. Let's put all this money in mass surveillance
because it'll be great. We'll all get rich" but it doesn't serve the public interest.
One thing you've seen recently is the government's gone and changed its talking points. They
moved their verbiage away from public interest into national interest. We should be concerned
about that because when the national interest, talking about the [sake 00:56:51] becomes
distinct from the public interest, what benefits the people, we are at a point where we have
to marry those up where it gets harder and harder to control and we risk losing control
of a representative democracy. Ben Wizner: So Ed, maybe let me ask you what
will turn out to be a final question. In your early interviews with Glenn Greenwald and
Laura Poitras, you said that your biggest fear was that there would be little or no
reaction to these disclosures. Where you sit now, how satisfied are you with the global
debate that you helped to launch and do you feel that it was worth the price that you
paid in order to bring us to this moment? Edward Snowden: One of the things that I told
Bart Gellman was when I came public with this, it wasn't so I could single handedly change
the government, tell them what to do, and sort of override what the public thinks is
[inaudible 00:57:59]. What I wanted to do was inform the public so they could make a
decision, they could provide the consent for what we should be doing. The results of these
revelations, the results of all the incredibly responsible, careful reporting that by the
way has been coordinated with the government. The government's never said any single one
of these stories have risked a human life. The result is that the public has benefitted.
The government has benefitted. Every society in the world has benefitted. We live in a
more secure place, we have more secure communications, and we're going to have a better civic interaction
as a result of understanding what's being done in our name and what's being done [inaudible
00:58:52]. When it comes to "Would I do this again?" the answer is "absolutely yes." Regardless
of what happens to me, this is something we had a right to. I took an oath to support
and defend the constitution and I saw that the constitution as violated on a massive
scale. The interpretation of the fourth amendment
had been changed [inaudible 00:59:14]. Thank you. The interpretation of the constitution
had been changed in secret from no unreasonable search and seizure to "Any seizure is fine,
just don't search it." That's something the public ought to know about.
Ben Wizner: You can see behind Ed is a green screen of... is that Article 1 of the Constitution?
Edward Snowden: That's correct. Ben Wizner: "We the people"... There's also
another organization here that is also interested in the Constitution. I'd be [re-missed 01:00:07]
if I didn't say to all of you that the ACLU has a table 1144. I promise that it will not
be all about surveillance. Please come and say hi to us. If you're not members of the
ACLU, it's cheap to sign up. We have ACLU whistles, we have t-shirts that you can get
with membership, you can talk to me and Chris a little bit more about the other work that
we are going and our ACLU colleagues. With that, I'd like all of us to thank Ed Snowden
for choosing this venue for this kind of conversation. Edward Snowden: Thank you all very much. Thank
you Austin
    You must  Log in  to get the function.
Tip: Click on the article or the word in the subtitle to get translation quickly!


Edward Snowden and ACLU at SXSW

6186 Folder Collection
Kiki Chen published on August 24, 2014
More Recommended Videos
  1. 1. Search word

    Select word on the caption to look it up in the dictionary!

  2. 2. Repeat single sentence

    Repeat the same sentence to enhance listening ability

  3. 3. Shortcut


  4. 4. Close caption

    Close the English caption

  5. 5. Embed

    Embed the video to your blog

  6. 6. Unfold

    Hide right panel

  1. Listening Quiz

    Listening Quiz!

  1. Click to open your notebook

  1. UrbanDictionary 俚語字典整合查詢。一般字典查詢不到你滿意的解譯,不妨使用「俚語字典」,或許會讓你有滿意的答案喔