Original subtitles

Welcome to Metro-Optic,

one of Montreal's main telecom centres,

which is a well-kept secret,

a major Internet data centre

serving the province and part of Canada.

This room is located beneath train tracks

in the bowels of Montreal.

About 75% of Internet traffic travels through here.

Here we have more "private" clients, as it were,

with their own exclusive room, who wouldn't want it filmed.

So we'll move on.

- Who are they? - A government agency?

- You can't say? - They... Yeah.

It's very private.

Privacy today no longer exists.

Take a look behind the scenes of the internet,

and you'll see a great surveillance engine

which is continuously amalgamating

billions of data points on all of us.

Surveillance today is no longer

solely the business of states.

The web in its totality is today driven

by the collection of personal data.

Web giants like Google and Facebook,

they know everything about you:

Your travels, your friends, your chronic illnesses,

your financial situation, your political opinions,

your sexual preferences, all your little secrets.

And just think about all of these other

highly sophisticated services that you can use for free.

They are fighting to get access to your data.

But the internet today also includes your televisions,

which are now connected, your smart speakers like Alexa,

who are listening in on you every second of the day,

your new vacuum cleaner which is mapping out your home,

your child's Hello Barbie doll,

which is recording her voice somewhere up in the cloud.

Wherever you go, whatever you do,

you've become a generator of data,

data stored who knows where and used who knows how.

And all of this data, is it secure?

Every month, a new company gets hacked,

leaking all of your personal information,

which then becomes available to the highest bidder.

Bell Canada, 2017, 1.9 million leaked accounts.

Ashley Madison, 2015, 10 million accounts.

LinkedIn, 2016, 117 million leaked accounts.

Equifax, 2017, 143 million accounts.

Yahoo, 2013, three billion accounts.

No one can guarantee that your personal data is safe.

But there is still some hope for privacy,

and hackers are the ones showing us the way.

The internet is their playground.

We must listen to them so they can help us

imagine an internet free from surveillance.

Of course...

the hoodie's a classic.

So trite, huh?

Anonymous mask, a series of ones and zeros,

numbers, hexadecimals...

That's often considered a bad thing,

a crime, that kind of thing.

Not so. There's more to it.

There are different kinds of hackers.

Some do it for the money, some do it professionally,

some do it for fun, some work for the government.

There's no such thing as a typical hacker,

because there are different kinds.

Hackers seen in the movies are just one type.

It's important to make a distinction.

Hackers are part of a global community.

They get together during large and festive gatherings,

where the topic of surveillance and privacy

is on everyone's mind.

First of all, I would like to welcome you all to New York.

I want you all to feel comfortable.

I want to ease your mind.

You are constantly being protected.

First of all, we have thousands of surveillance cameras,

they're only for your safety, only for your safety.

There are, right now, 11,000 cameras, and growing.

In the city, there's about 700,000 cameras.

11,000 of them are linked into law enforcement now.

Not only do these cameras go out 24/7, 365

and film licence plates, 60,000 per hour,

60,000 per hour, but they keep the data,

they share the data with other companies like Vigilant,

which we're gonna talk about.

So far New York has a buffer of four years.

So if you forget where you parked your car,

not a problem, we can help you out.

Your privacy is really dead.

Privacy, there's almost no point in talking about it.

So when I see people sharing their whole lives

on Facebook and on Google and posting a gazillion photos

and putting up 12-year-old kids photos

that I would never get any other way

and that sort of thing, my feeling is,

"Thank you, I appreciate it.

"You've done me a big favour as an investigator."

On the other hand, as a citizen,

this non-stop oversharing of data creeps me out.

You've surrendered that information.

You can't get it back.

You can't put the genie back in the lamp.

This is a custom wearable computer.

It now appears like basically there's an iPad

floating a couple feet in front of me.

You have trends that are going off there

like Facebook Messenger, Amazon Alexa,

that are listening in to everything

that they have to say.

So we've gone off and we've created a solution

that it securely jams all of your microphones

and your cameras inside of your phone

so that your phone is not gonna be used

as a digital eavesdropping device in the world today.

"Hey, how are you doing?"

You can do this, or it's, "Smile, take a selfie,"

or, "Hey Google, make this dinner reservation."

When it goes down from here,

it securely jams each one of the microphones in here

to a level that's never been seen before

that no one will be able to listen in

to your phone whatsoever.

And then we also have a cover over here

that allows you to be able to do...

It's a Verde bag or a Verde cage from here.

So when you slide this over, this blocks your cellphone

so you can be underneath a cellphone tower,

right next to a Wi-Fi hotspot, et cetera.

You are invisible to the world that is out there.

Groups were hacking into NATO.

They were telling the FBI every week to fuck off.

Exactly.

And, you know, I actually, during this period,

was having nightmares that the FBI was gonna visit me

as someone who's studied them, right?

There's very different types of hackers.

There's those precisely who break

into systems to improve systems.

There are those who want to write

free and open source software.

There are those who are into making hardware.

And then there's a group of them who are really involved

in the fight against surveillance and for privacy.

One of the reasons why a lot of hackers

are aware of these issues is precisely

because they know how easy it is to surveil people.

Hackers get together at events

such as Hackers on Planet Earth,

the Chaos Computer Club conference,

and they give impassioned speeches

about the importance of privacy and fighting surveillance.

We need heroes like Edward Snowden.

Three cheers for Edward Snowden.

Hip, hip, hooray!

Hip, hip, hooray!

Hip, hip, hooray!

I believe that it's fundamentally inadequate

as a solution

to restrict the use of the data once accumulated.

The data will be misused.

It will be misused officially,

because our government's rules for using it

have such loopholes that it can get away

with doing anything it wants.

We need to do more than limit the use of these databases.

We need to prevent them from being made.

The level of surveillance imposed on us today

is more than in the former Soviet Union.

It's so much that there is little room for dissent

or for whistle blowers, and that puts democracy in danger.

We have to reduce the overall general level of surveillance

to the point where the state doesn't know

where each person goes, and the state

doesn't know who talks with whom.

I will never use Uber

unless it's fundamentally changed.

It snoops on people, which means Uber

keeps track of who goes where.

This should be illegal, because it's too threatening

to fundamental freedoms that are needed for democracy.

So, companies like Uber should be told

either allow people to get rides anonymously

and pay with cash

and not have to use any device that tracks them,

or shut down, you're gone.

Because, when it comes to something as important

as maintaining our democracy, we need a stronger defence

than just saying that companies have to ask users

to give up their freedom.

Getting the user's consent for treating users

in a way that threatens democracy

does not excuse it, does not make it legitimate.

And do you yourself

consider yourself a hacker?

Of course.

I enjoy playful cleverness.

That's what it means to be a hacker,

to enjoy playful cleverness.

Everybody's first hack is trying to walk

the wrong way on the escalator,

'cause you've got a system that was designed

to be used one way, and you're trying to make it

do something different, which it wasn't designed for.

That's the hacker spirit.

The pessimist in me thinks

the battle has been lost for some time.

The mere fact that everyone carries a cellphone,

the optimal surveillance device,

beyond George Orwell's wildest dreams

when trying to imagine an omniscient panopticon.

This is also fuelled by social media.

I do it, too. Everyone does.

Anything that can be monitored is monitored,

as well as monetized.

And the prevailing business model

for all high-tech companies now

is the selling of personal information.

It remains a cash cow for these companies.

And all this is based on data collection, mass surveillance,

and the slow but steady erosion of privacy.

It's an Orwellian nightmare of sorts.

And I think I can help in that regard,

through Crypto.Québec, what we produce,

with our podcast, articles, training,

and what we say to the media.

These matters affect everyone,

though people may not realize it.

They affect everyone, so this must be addressed.

Welcome to the 37th edition of

Crypto.Quebec's Watchdogs podcast.

Hosted by Geneviève Lajeunesse,

Luc Lefebvre,

Jean-Philippe Décarie-Mathieu,

And Sophie Thériault.

We have a lot to talk about today.

I simply wanted to look back

on a little trip we made last week,

myself, Jean-Philippe and Luc,

to the nation's capital, Ottawa.

We visited CSIS and CSE headquarters.

- Just to check them out. - From outside.

- Well, you tried. - Right.

Can you see the building back there?

Kinda.

I really didn't expect to see Canada's cyber elite

across from Loblaws.

For real, it's... Imagine...

Like, a huge, magical airport next to the Quartier DIX30.

- It's kind of like that. - That's exactly it.

- With nice bay windows... - It's awesome.

Bay windows?

Of course. They're all about transparency.

There they are.

Those who must be stopped.

Those who track your aunt's metadata when she goes jogging,

because she happens to be related to a person of interest.

- They work there. - That's it.

I would tell an ordinary citizen

that they're the cyber strong arm of the government.

To work there is to be part of the problem, really.

Because they're really knee-deep

in the global surveillance network.

I wonder what happens when we reach the no-filming zone.

If we don't go beyond the sign, we should be okay.

But we will be there in about eight seconds.

There you go.

- "Breakin' the law." - Story of my life.

Wait.

It's no surprise that we're not allowed

to film our Canadian NSA.

What is surprising, however, is the fact that this building

is the priciest piece of public architecture

in the history of Canada.

It cost us $1.2 billion.

This confirms that internet surveillance

does not only concern the United States and its NSA.

Intelligence agencies like CSIS and the CSE

have far more permissive powers to engage in surveillance.

And part of the problem with how those agencies operate

is that a lot of not only their activities

but also the legal frameworks which authorise

those activities exist in secret.

There is a track record of abuse and misconduct

of these types of powers, of overreach,

and of interference with the democratic process

and with lawful advocacy organisations

that I think is well evidenced.

There is really clear material around that.

I mean, we also have recently seen cases in Quebec

where there was government surveillance of journalists.

Here, we're referring to the surveillance

of journalist Patrique Lagacé,

as well as at least nine other journalists

who were placed under surveillance

by the Montreal police as well as

the Quebec provincial police.

But this is just one of many examples

that show how intelligence and law enforcement agencies

frequently abuse their cyber surveillance powers.

Through the Snowden revelations

we also learned of the existence

of numerous mass surveillance programmes in Canada

set up by our intelligence agencies

with little to no legislative oversight.

In 2017, the Trudeau government introduced Bill C-59,

supposed to better regulate the powers of these agencies.

But for the critics, this was unconvincing.

The problem is that the framework they've set out

is profoundly permissive.

So I'll give you one example.

There are frameworks that allow for the capture

of what the government has called

"publicly available information" or "publicly available data".

And the definition of that is effectively any data

that could be accessed publicly in any manner at all

or could be purchased.

So if you could imagine every possible bit of data

that could be known or purchased about you

that is in some way justifiably public,

whether that's something that you put on Facebook

or something that you said in a radio interview 20 years ago

or the path you walk to school

'cause there's neighbourhood surveillance cameras everywhere,

this starts to get deeply, deeply invasive.

Another chapter can be added

to this list: IMSI-catchers.

These devices can intercept data from your mobile phones.

And in April 2017, it was reported that at least

eight IMSI-catchers were operating in Ottawa.

The RCMP later admitted it was using IMSI-catchers

all across the country.

An IMSI-catcher is a small box

that mimics a cellphone antenna.

Your phone connects to it automatically

and allows the IMSI-catcher to intercept

your phone's unique identifier

or the IMSI for international mobile subscriber identity.

Some IMSI-catchers can also

intercept calls and text messages.

IMSI-catchers are tremendously invasive

mass surveillance tools, but they are a tiny,

tiny fraction of the range of technologies

available to an agency like CSE,

and I think that we need to put that in context.

So if your question is,

"How can I be surveyed in the world?"

My answer to that is use your imagination.

You know?

The reason we came to the march against police brutality

was to see what kind of surveillance

was conducted on protesters.

Would surveillance methods be more conventional,

more technological?

So the CryptoPhone is the device that was used in Ottawa

when IMSI-Catchers were found.

Same device.

I think it's highly likely the Montreal Police

uses this type of equipment.

Here too, I'd wager.

This is a warning from the Montreal Police Department.

Some protesters persist in breaking the law.

Due to offences committed,

protesters are ordered to disperse and leave the scene.

Otherwise, we will be forced to step in.

I'm opposed to the use of IMSI-Catchers,

because it not only affects the targeted individual,

but everyone within range of the IMSI-Catcher.

So everyone around can be overheard,

can be tracked down here.

There isn't much to see,

the readings are not showing anything abnormal.

Seems IMSI-Catchers weren't used tonight.

For years, the police denied using them.

So they were being manufactured and sold, but to no one.

They caught me and took my cell!

Interesting.

The Montreal hacker scene is alive and well.

Montreal is becoming an important node

in the global hacker network.

Each year, over 400 hackers gather in Montreal

to participate in the largest on-site

hacking competition in North America: NSEC.

The goal is simple: Score points by solving challenges

in bypassing security systems and obstacles.

The scenario is a thinly veiled parody of North Korea, I guess.

Elections are being held in the fictional kingdom of Rao.

It's rather unclear.

Seems we can either help the regime or the rebels.

Now, we're helping everyone to get more points.

Rao is basically a fictional character.

People will think he's North Korean,

but he's really based on Mao, so more Chinese.

Everyone okay?

What are you working on?

Ah, nice!

Nice challenge.

Six points.

Yes!

NorthSec is a somewhat elitist organization.

Since the event was launched,

we're the first to question people's abilities.

They should hone their skills to help,

because cybersecurity is about helping people.

30 to 40% of our challenges are won by all teams.

So about 60% of them go unsolved

by the end of the weekend competition.

So people come here because they know

they're really gonna bust their humps.

They'll really challenge themselves. And it's non-stop.

All hail Rao.

We can only vote once.

All hail Rao.

I think most people with NorthSec

are against the idea of mass surveillance.

Essentially, it's problematic,

giving so much information to people

who have no business having it.

I was what's known as a penetration tester,

a professional hacker,

in the banking world, for several years.

When you work in this field, in cybersecurity,

you realize that every scrap of information is a key.

The more keys you have, the more powerful you are.

And if this information is misused, mishandled,

it can become a weapon for many people.

So, of course, most cybersecurity experts

are troubled by mass surveillance,

because they know the stakes.

Why do it when it's probably pointless?

Surveillance and intelligence agencies already exist.

In Canada, we have one with a relatively decent reputation.

Why do they need more information?

Is it because they're...

...caught short?

Or are they simply really lazy?

Maybe they're lazy.

The Montreal hacker scene

also includes groups like Subgraph and Peerio,

who develop internationally renowned applications

and platforms which aim to protect their users

from surveillance and data collection.

Subgraph is a Linux-based operating system

designed to thwart malicious attacks.

Peerio aims to provide easy to use,

beautiful end-to-end encrypted communications

and collaboration tools for teams.

Our goal is really to be sort of a suite

and a whole environment of tools that teams

and organisations can use in order to secure their work.

There are two kinds of surveillance:

Mass surveillance, dragnets;

And targeted surveillance.

We try to prevent targeted surveillance.

If you're a journalist, if you're a lawyer,

if you're a therapist and you have all this communication

that's highly confidential, we try to make sure that

communications that are understood to be private

between parties are actually private

and they're private from us.

There's very little privacy.

Even people who are very...

shrewd about their Internet usage,

their use of technology, even they have very little privacy.

Among other things, even if they're careful,

someone they know is posting information about them

without their knowledge.

Platforms that were meant to provide

some kind of joy and value for users

are being monetized in a way that's almost adversarial

to the users that are actually using it, right?

Like, your user, who you thought was going to be

your customer, suddenly became your product.

I find that quite tragic.

As elsewhere, the Montreal hacker scene

was born in the 1980s and gave rise

to several hacks that became legendary.

Rob Masse comes from this period.

So I started in computers when I was five,

on an Apple II Plus, and I started telecommunication

and understanding how phone systems work

when I was about nine.

There's no, necessarily, rules at that time

about how to use computers and how to leverage computers.

And my main goal when I was nine

was how do I download video games for free?

The first component at that age when I was nine

was phone phreaking.

Back then there was no internet,

but there was other types of networks

of interconnected systems,

and we would use the phone phreaking

to kind of get into those networks and then leverage that.

A lot of the video games I would play

are like, Dungeons and Dragons, at the time it was Ultima.

And in those games, the goal is to kind of explore the land.

Then you'd get into castles and take gold and fight dragons.

So that's the video game.

It's important to understand that context.

In the hacking world at that time,

you would connect to the X.25 network data pack,

and you'd be able to go into castles

and take information and leverage that information.

So for me it was a question of just, you know,

hacking into systems just for fun.

There was never any malicious intent.

It was just a question of learning.

I started going into systems around the world.

It just happened to upset a lot of people.

At the age of 15, Rob Masse connected

to a state network belonging to the Soviet Union.

The year was 1989.

The Cold War was still ongoing.

The RCMP quickly took notice of this hack.

So when I was in grade 10, 15 years old,

RCMP came to my house, did a full raid.

And then, after that I had to kind of

work with law enforcement.

Ultimately, over that year,

I would go to the Ottawa police college.

The RCMP would sponsor me.

Other law enforcement agencies from around the world

would come just to listen to me speak.

Like, hey, we caught this hacker.

Come see the hacker, and he'll tell you

all about what goes on in the hack world.

Did you work

for the intelligence agencies after that?

I've been engaged by various people to help them.

So that's the answer.

Today, Rob Masse is a professional hacker

working to compromise systems and individuals.

The traces we leave of ourselves on the internet

have become one of the main resources he can leverage.

I would say the two main components of my background

personally is on the instant response side

as well as what we call offensive cyber security,

so breaking into things.

And we have a 100% success ratio.

Unfortunately, I don't think it's necessarily

'cause we're that great.

I just think that many of the organisations right now

have the same challenges on the business side

and on the security side.

And we're kind of losing the war

on cyber security right now.

My personal opinion on privacy is that there's almost none.

If you are using social media or any of those other services

where you're not a paying customer, you are not

the client or the customer, you are the product.

And as such, you trade your personal data for that usage.

To break free from surveillance,

hackers try to regain control over computing

and democratise it.

In hackerspaces, they dismantle and dismember

everything they can to better understand computer systems.

Here the motto is "programme or be programmed."

Foulab is a hackerspace.

It's really a collective that offers its members resources,

and, above all, know-how.

So human capital, in terms of knowledge,

for the sharing of ideas and techniques.

In hacker culture, access to information is fundamental,

in order to understand a system.

I call it an open-source think-tank.

Now we'll rid this computer

of its malicious piece of software.

The computer comes with software,

which users are usually unaware of,

installed by the supplier.

For example,

the NSA and ThinkPad could have conspired

to install software to access the computer remotely.

So we'll replace this with open-source software

to ensure there's no backdoor,

or to simply make changes and change the computer's features.

A back door is a point of entry unknown by the user

that provides secret access to a computer system

to the person who has the key.

Here, Matthieu knows that a back door is present

in a component of his ThinkPad, the BIOS.

The BIOS is the first set of functions

that the computer performs at startup.

A back door in the BIOS would give full access

of the computer to the key holder.

Several people could leverage this back door:

IBM, that produces the ThinkPad,

Intel, that produces the BIOS,

the company that bought all of the ThinkPads

for its employees, the NSA or CSE, or malicious hackers

who are easily able to exploit this vulnerability.

There. I have a copy of the previous BIOS,

so I could configure a new one here.

So I'll get OpenBIOS or Coreboot.

I need to know the ins and outs of a computer,

because I can't...

BIOS is at the core of a computer.

It controls...

all functions.

So if we don't know how it works

and can't guarantee its operation,

we can't guarantee the computer's integrity.

So you can have the most secure operating system ever,

but if the BIOS isn't secure,

unfortunately, the rest won't be either.

Let me know if you need help.

Do it yourself.

This often means that things won't go exactly as planned.

Hackers have become the masters of trial and error.

Yeah, Mathieu... if you could... hold it.

- Need help? - Yeah. Thanks.

Danukeru is building a drone from top to bottom.

If he can get his drone to fly,

he'll use it to perform security experiments.

It'd be fun - it's been done before -

to crack WiFi networks from above.

So build a drone that flies over and cracks WiFi networks.

Another thing would be - just to prove it can be done -

to use an aerial cellphone surveillance device,

like that used by the police, known as a StingRay.

Essentially, we do this to detect

critical flaws in the infrastructure.

That's why most people would do this.

If he is able, alone and with his limited resources,

to compromise residential Wi-Fi routers

using a drone pieced together with styrofoam,

it's because there are important security flaws

in our infrastructure.

We need hackers to seek out and find

these flaws that threaten our privacy

so they can be quickly patched.

The issue of what society considers private and public

will define our generation.

What really worries me

is when neighbours start pointing fingers.

We may well eventually reach the point

where someone could download a program

as powerful as a military weapon

and use it against their neighbour.

Against their spouse, even.

That's what worries me most.

...3, 4, 5, 6, 7, 8, ground.

Resolib is a group trying to rebuild the internet

one antenna at a time.

This is called a mesh network.

Someone who puts up an antenna

can connect with other antennas nearby.

These users can connect whatever they want

to their antennas: A hard drive,

a local internet site, or other services,

and all of this without the need

for an internet service provider

or for costly fibre optic cables,

simply by connecting people directly to one another.

Each antenna acts as a relay.

A person can connect to another, more distant person

by tracing a route through all of the antennas.

As it grows, the mesh network can cover an entire city

or even an entire region, as is the case

with the Guifinet mesh network in Spain,

which is now 35,000 antennas strong.

We can call this a local grass-roots

and totally distributed network.

A mesh is a distributed network.

The idea is to have rooftop antennas

to create a network alongside commercial Internet service

and connect homes directly.

Like, connect neighbours together.

So you can just buy metal bands that go around.

Yeah.

Yeah, at some point.

I mean, it wouldn't be hard

to get back up on the roof and do that.

Right.

Just so you can have a clear conscience

that this is not a permanent solution.

I'm kind of discouraged.

Honestly.

People must change their mentality,

but they seem unwilling.

They want "ubiquitous computing."

They're willing to be monitored by Amazon

24/7 at home through a device,

which they can order from at the push of a button.

They use Gmail, Google knows their every move,

their location, everything.

- What they think. - Same with Facebook.

They're dominated by computer technology - unwittingly.

Even when they know, it's: "I can't do anything about it."

So...

done!

Isn't that fucking beautiful?

Yeah, like I said, I gotta...

There's a plan, there's a phase two.

There's a phase two here, yeah.

Basically, it's a lot easier to monitor everyone

when they're in the same room.

We're gonna run about 10 feet of cable down.

Google, Facebook and the like centralize information,

making surveillance easier.

If services are distributed,

it's more difficult for a hostile party -

be it the government or "black hats" - to spy on you.

It doesn't prevent targeted surveillance of

a particular individual, or even a group,

but it makes dragnet surveillance

a lot more complicated.

Monitoring everyone at once,

then targeting someone in particular.

Okay, the tester's hooked up. Let's check it again?

- Let's do it. - 1, 2, 3, 4, 5,

- 6, 7, 8, ground. - Done.

Excellent. It works. It's all good.

Great. I'll plug into the wall.

The big problem now is that huge corporations,

the world's most powerful companies -

like Amazon, Google, Facebook, Microsoft and Apple -

their goal now, their lobbying,

is geared toward destroying the Internet.

Facebook's goal is to replace the Internet... with Facebook.

They want you to go on Facebook and stay there.

They entice you to stay on Facebook

and away from ordinary sites.

Google is similar. They...

When you use search engines,

sometimes you're stuck within Google

instead of going to the real site.

So there are a lot of forces at work preventing

us from re-distributing the Internet

and make it the horizontal platform it was devised to be.

There it is: Relais.reseaulibre.

It's the original version of the Internet.

When I first went online in '96, it was free.

We didn't pay for Internet access, and...

...Internet access also meant having a web page.

That was it, really.

It was about checking out your friends' web pages.

What did he post? "Hi. I'm Antoine. I play guitar."

With a picture of your guitar.

People had all kinds of stuff.

Then they started sharing increasingly interesting things.

And it grew,

turning into Wikipedia, into Google, and so on.

But it started with someone in their garage.

Google started out with a web page.

And I've always done that.

It's good enough for me.

That's it.

I don't need to connect with all my friends on Facebook 24/7,

know the latest news, the latest opinion,

Trump's latest fake news, this and that on Facebook.

I don't want to be online 24/7.

For me, it's something you turn on,

you go online, you're online,

then you turn it off and you're offline.

I'm not always connected,

and I choose when to go online.

I call the shots.

But we are not about to collectively disconnect.

Quite the opposite.

So how can we make sure our privacy is protected on the web?

For many hackers, encryption is the best,

if not the only, solution.

The first hackers who made encryption a political issue

were called the cypherpunks.

Montreal made an important contribution

to the history of the cypherpunks,

and it was in great part because of this man.

So the cypherpunks, particularly in the mid-'90s,

were a group of people who believed that

security and privacy should come through technology,

through the laws of mathematics,

not through the legal system.

And the reason is that legal systems change

from place to place and time to time.

And one of the main mottoes of the cypherpunks

was that cypherpunks write code.

And the point was to actually

not just talk about these things

but to produce software that protected

people's privacy and security.

And a lot of what I did over those years

was produce software like that.

The 1990s was the decade of the crypto wars.

The U.S. government had made it illegal

for cryptographers to freely distribute

their encryption software, under penalty of imprisonment.

To avoid legal issues, many cypherpunks fled the U.S.

Many of them came to Canada.

This was definitely one of the major reasons

that, when I finished my PhD at Berkeley,

I returned to Canada.

So what brought me to Montreal was Zero Knowledge System.

When we're on the internet with email,

we say personal things.

We talk about things we might not say in other places.

The internet is the worst place to do that right now,

because that email is not private at all.

So what Zero Knowledge has done is gone back

and said, "Let's make that private.

Let's give you all the benefits

of being able to communicate

and still have your privacy."

So we wrap your messages in strong, cryptographic envelopes,

and we make sure that the delivery

of those envelopes is private.

Privacy is going to be the most fundamental battle

in the next hundred years.

It will be the battle over your personal space,

the ability to say, "Although I exist in a global community,

this belongs to me, this is private.

You don't get to see this part of my life."

And if we don't lay that groundwork now,

the ability to say that, to make that statement

20 years from now won't exist.

They sought me out, and they wanted to build a product

based on the ideas I had in my PhD thesis.

So I said, "Okay, I am gonna help make the internet better,

help make it so that people can communicate

privately online," and thus started the Freedom Network.

The Freedom Network.

It was developed here in Montreal.

For the first time, it was possible to use the internet

with privacy built in.

There should be no way to communicate

in an insecure fashion.

The network should just provide

the security and privacy for you.

The Freedom Network was short-lived,

but many of its technical innovations

were integrated into what became

the most important anonymity tool in the world:

The Tor network.

Tor stands for The Onion Router.

Basically, it's a web browser that allows you

to use the internet anonymously.

Normally, when you access a website,

the connection goes from your computer

to your internet provider,

and then to the server where the website is located.

It's easy for anyone who wants to keep an eye on you

to know which sites you visit at what time

and what neighbourhood you live in.

But, by going through the Tor network,

the signal has to go through three relays

before reaching the desired website.

Each relay only sees the immediate source of the signal

and the immediate destination of the next signal,

and all of this is encrypted, of course.

Using Tor, it becomes extremely difficult

to know who is accessing what.

But Tor also runs what are called hidden services.

These are websites ending with .onion.

They can only be reached through the Tor browser.

Often, news outlets like Fox News give a bad image

of onion sites, describing them like this:

It's a secret world used by criminals

to buy and sell drugs, guns, sex,

just about anything you can imagine.

But this blanket criticism

suggests that all .onion websites are used by criminals,

when, in fact, many activists, journalists,

and community groups heavily rely

on these services to do their work.

And guess what?

The code that maintains these services is made possible

by the work of only two Tor employees,

including one who lives here in Montreal.

I'm currently coding...

...what's known as next-generation hidden services.

It's being completely re-engineered

to improve security.

The concept of privacy is extremely important.

Increasingly so.

If people are being monitored...

Today, it's not that people aren't aware of it.

They know and accept it.

They're not acting in bad faith or ignorant.

It's just the new normal.

When you know you're under surveillance,

unconsciously or not, you change your ways.

It really controls society.

So the beauty of Tor is, whatever you do online,

your privacy is protected to some extent.

I requested access to information

from the federal government,

for all my personal information.

They sent me this letter, which basically said:

We have your information on file - maybe, maybe not...

I'm under investigation.

I was kind of proud, because I must be doing something right.

I'm doing something useful,

and the powers-that-be clearly aren't too happy about it.

So it's a vindication of sorts.

What's the conference in Montreal about?

Okay, we're currently holding our biannual Tor meeting.

We invite everyone -

staff and the community - to get together, convene,

and over the course of five days, we problem-solve, rally,

seek to improve Tor.

Any particular reason it's in Montreal this year?

Yeah, a lot of people refuse to go to the Five Eyes,

including Canada.

But especially since Trump,

I'd say at least half our team refuses to go to the U.S.

- Half the team refuses... - Minimum.

Can you explain why we can't film the meeting?

Right. I mean, these people are for privacy.

They don't want to end up on Facebook,

have anyone know they came.

Some people here literally can't be filmed,

because they're coming here at their peril.

So, overall, their privacy must be respected.

Some of the hackers and volunteers who support Tor

want to maintain a certain level of discretion,

but that doesn't make them hooded paranoids.

Quite the contrary.

This is a community that has understood

that change is only possible through public debate.

So my name is Jennifer Helsby,

and I am the lead developer of Secure Drop,

which is a whistle-blowing platform that uses Tor.

Hi, my name is Arturo Filastò.

I'm a Tor developer, I guess, from Italy.

We monitor the internet and measure when

and how internet censorship occurs around the world.

That is our Quatro, as we call him,

which is our mascot, the uni-octopus.

Yes, my name is Patrick.

I live in San Francisco, but I'm originally from Ireland.

And I run some exit capacity on the Tor network

as part of an organisation called Noise Tor

with some volunteers.

My name is William Budington, and I am a technologist

and security engineer at the Electronic Frontier Foundation.

Well, we're at the point now where

many major governments have mass surveillance systems.

For just a few million dollars you can set up

a mass surveillance system in your country,

and we need to take steps to protect

civil liberties in this situation.

So, if you're at danger in a repressive regime,

for instance, then you can access the web

and access the internet in a way that doesn't put you

under the danger by your government.

It's useful for people doing research, even domestically,

that they don't want necessarily associated with their name.

I personally don't want all of my search history

to be associated with my identity,

because you never know how that might come back to bite you.

Tor is the best way to protect people's anonymity.

Without it, we couldn't do the work that we do,

making sure that sources can talk to journalists

in a secure and anonymous way.

So, what is the future of internet privacy

when we all have things to hide

in an age of big surveillance?

Please join me in welcoming Roger Dingledine.

How many people here know the phrase "the dark web"?

Okay, so there's this really cool,

from the journalist perspective,

thing where you get people all excited and scared,

and they don't understand, but there's this dark web.

So, basically they end up with this terrible picture

of an iceberg, where they're like,

"You didn't know, but there are 99 other internets out there,

and they're all other things."

And that's true; A lot of the web pages on the internet

are things that Google can't get to.

But approximately 0% of them

have anything to do with Tor in any way.

Nonetheless, Time Magazine was like,

picture of Tor, picture of spiderweb,

picture of iceberg, you should be scared.

And facts have very little to do with any of this.

I think people are very interested in privacy today.

People also feel, to a certain extent,

that privacy can be a lost cause.

We see private information about people

being collected, and not only collected and sold,

which is the primary business of most of the data collectors,

but also collected and lost,

misused,

abused,

generally treated as though it were an abundant resource

that there's no need to protect.

But I think there's also a lot of hope.

I think more people are using encryption

to talk to each other now than ever before.

I think if you want to have a private conversation

with someone on the other side of the world,

there has never been a better time in history to do it.

Who here knows the phrase "lawful intercept"?

A couple.

Okay, more hands than for "blue coat".

Okay, more hands than for "blue coat". So, lawful intercept is the phrase they use

So, lawful intercept is the phrase they use

for the back doors in all the telephony infrastructure

and the internet routers and so on.

And the goal is, if somebody does a bad thing,

then we should be able to tap them,

and there should be judges involved, and so on.

And maybe that's okay in the Western world,

but exactly the same infrastructure

gets sold to Saudi Arabia.

And the guy in Saudi Arabia is like, "What's that port for?"

And the answer is, "Oh, that's the lawful intercept port."

And he says, "Well, I am the law, plug it in."

The internet is more centralised than you think.

There are only so many cables that go underneath oceans.

If you're in Peru and you want to send

an internet connection to Ecuador,

it's gonna go through Miami.

That's just how the internet is built.

And that means that there are so many bottlenecks,

there are so many places where large intelligence agencies

can go in order to grab traffic, compared to what you think.

You might imagine the internet is kinda like the world,

where there are a lot of different countries,

and everything's spread out.

And I'd like an internet that's built that way,

but that's not how we built ours.

Writing software is a fun and easy way to help the world.

If you're good at writing software,

then there's lots of things you can do

that aren't collecting data on people

and helping people control each other.

You could help people be free.

And it's a good thing to do with your talent

if it's a talent you have.

And it's a good life to live.

Tor is one of the most important tools

in the fight against surveillance,

but it's far from being the only one.

For almost every application and platform you use daily,

there are alternatives that protect your privacy online.

For messaging, replace Facebook Messenger with Signal.

For your emails, use ProtonMail

or instal GnuPG and encrypt emails yourself.

Replace Skype by Jitsi,

and Google by DuckDuckGo or StartPage.

The alternatives already exist,

and their numbers are constantly growing.

Most of these tools are free software

or open source software.

Free software is developed

by online communities of volunteers.

They freely publish and tinker with the source code

of the software and usually distribute it for free.

For Richard Stallman, free software

is the main solution to surveillance.

The alternative to proprietary software is free,

"libre" software, software that is controlled by its users,

that therefore respects those users' freedom.

If you're using a free programme,

you, as one of a community of users,

are collectively exercising control also.

If people are enthusiastic about removing the snooping,

which they probably are, they will spread

that version around, and you will eventually get it

just in the normal course of upgrading from time to time.

This is how free software creates a defence

against malicious functionalities,

for instance snooping,

and it's the only known defence.

And what Opid's first projects do

is give you the source code, and that's why it's free,

so you can take the source code.

And that really matters, precisely because

it allows outsiders to vet that source code

and let people know you can trust this.

Facebook is not open source at all.

And you don't know precisely what their software is doing.

You don't know how their algorithms are functioning,

so you don't know why you see what you see.

If it was open source, if it was open source

the way that Tor was open source,

you could really to an audit of it,

and you could understand how it works,

and you could pick it apart.

It's a black box. Open source is a transparent box.

Light.

It's only 1.1 kilos in weight.

This is a fully functioning computer.

This is a laptop 3-D printed

so you can turn the computer card into a laptop.

All right?

You have the right to repair as well as modify.

So, 3-D printed, you can just go down

to your local maker centres and repair your own laptop.

If you get fed up with the fact that

this is not fast enough in a couple of years,

you just buy a replacement computer card.

It upgrades, double the RAM, double the speed,

double the processing, et cetera.

Instead of throwing away the whole $500 laptop,

you buy a $50 computer card.

So it's eco-conscious, as well as saving money,

and blah blah blah, et cetera.

Now, the other thing is that we've researched

the processors on here so that the source code

for everything, for the entire boot process,

is available online.

So there's no NSA back doors in their processor

like there are in Intel ones.

It's full source code. So...

Facebook just won a court case in Belgium.

They spent millions and millions and millions of euros

to maintain their right to build profiles on every Belgian.

You're worth money. You're worth a lot of money.

You may have a right to be forgotten,

but you're not gonna be forgotten.

If privacy is an illusion and it's dead

and everything, what do we do now?

Okay. There has to be a sea change in public attitude.

There has to be some...

I hate to say this, because I am the most libertarian,

free commercial activity believing type guy

on the planet,

but there has to start being regulation

on Facebook and on Google.

The problem is you and everybody else

look at them as if they're a public utility.

We have water, we have electricity,

we have the telephone, we have Google.

They're a private company.

They own your data, they sell your data,

they sell the essence of who you are.

And there is zero regulation.

There's no regulation.

There's not a single law in the United States

that allows you to say no, or not that, or too much.

Google and Facebook really don't give a damn.

They have the vast bulk of all information out there.

Private entities.

Google, Facebook, Axiom,

Information USA, Microsoft, Apple.

There's about 20 companies that have the bulk

of the world's PII, personally identifiable information,

and all the related stuff.

And there is no law and no regulation,

nothing that governs how they use it.

In May 2018, the European Union

implemented the General Data Protection Regulation,

which aims to better regulate the use of our personal data

by major service providers.

Meanwhile, in the U.S., Congress became interested

for the first time in Facebook's business model.

It's clear now that we didn't do enough

to prevent these tools from being used for harm as well,

and that goes for fake news,

for foreign interference in elections, and hate speech,

as well as developers and data privacy.

We didn't take a broad enough view of our responsibility,

and that was a big mistake, and it was my mistake,

and I'm sorry.

This is also true for Canada.

Our laws have to change to better protect us

against abusive data collection.

But why isn't this already the case?

Government doesn't have the technical skills

or the resources to build a Facebook and make you adopt it.

But they're perfectly happy to take advantage

of the fact that a Facebook exists,

and they can use it to harvest information

for investigative and intelligence purposes.

So I think that it's right to acknowledge

that there is a bit of a symbiotic relationship

between these corporate actors and the state.

I don't think it's right to think about it

in some sort of conspiratorial way,

but just to say that I think that government,

when they see these private actors

having access to this kind of personal data,

they want to get their cut too.

So, yeah, that's probably part of the reason

there isn't a huge amount of political willpower

to reign those kinds of behaviours in.

Projects like Tor, like Subgraph, aren't winning.

This great surveillance machine is obviously prevailing.

Clearly.

Of course, there's pushback now.

But I think we're 20 years behind our rival, as it were.

The forces at work behind this security and

surveillance campaign are very powerful.

We're talking huge corporations, governments, and so on.

So it takes tremendous effort

to make a real impact.

A new world is unfolding right before our eyes,

a world in which all our actions and thoughts are monetized,

and where it becomes truly impossible

to be hidden from view and to be truly alone.

But the internet could not have turned

into this surveillance machine without our help.

This internet that monitors everything,

we made it happen all together.

It's up to us to invent the internet that will replace it.

A lot of people, when they think of privacy,

they just think of, "Oh, what do I have to hide?"

And that's not what privacy is at all,

or it's the tiniest part of privacy.

Privacy is about freedom, privacy is about autonomy,

privacy is about self-determination.

Privacy is about being able to think

the thoughts for yourself and not be coerced

into behaving or thinking in a certain way.

It's about growing as a person, especially for young people,

and it's about growing as a society.

The fundamental thing is the willingness to say no.

When you're offered something

and the price is your freedom, say no.

The willingness to do that is crucial.

It's a sacrifice that I make to keep my freedom.

It's worth it.

More than anyone else, Edward Snowden,

in his willingness to come forward

with very concrete details about surveillance,

has helped us grasp the bigger picture.

He has helped us sharpen our understanding

of the harms of pervasive surveillance

and helped us see how new technologies

facilitate ubiquitous spying.

These issues are vitally important,

and this is why I want you to join me,

not just in welcoming, but in thanking,

Edward Snowden for opening up the space

to discuss and debate these topics.

Thank you.

The days where they could monitor everyone, everywhere,

all the time, simply what the government calls

by means of bulk collection,

which is the government euphemism for mass surveillance.

They say, "We just want to collect everything and store it

in case we want to search it later."

Those days are numbered.

We are going to move towards a freer and fairer future,

rather than simply the one

that has already been laid out for us.

We are at a decision point,

and we could have a very dark future

or a very bright future, but the ultimate determination

of which fork in the road we take

won't be my decision, it won't be the government's decision,

it will be your generation's decision,

and I'm looking forward to seeing what it is

that you guys actually decide.