Original subtitles

Coffee and a tie rise to the occasion A million tiny

flashlights, I gotta turn it off Coffee and a tie rise

to the occasion A million tiny flashlights, I gotta turn it off

Too much information I gotta turn it off Oh, sleep for a

while Too much conversation Too much information I gotta turn

it off

Just about every time we use the internet, a communication link, or an

agree to some very long terms and conditions.

But what exactly are we agreeing to?

You guys!

You gotta help me. These business casual G -men are trying to kidnap me. What?

It's crazy, dude. They're saying it's because I agreed to the latest terms and

conditions on iTunes.

Why? What did the terms and conditions for the last update say?

I don't know. I didn't read them.

You didn't read them? Who the hell reads that entire thing every time it pops

up?

I do.

Can you tell, can Apple tell how many people actually read it?

Well, they have to say that they agree.

We can't know for sure if they've read.

We try to make it in plain English and very short. If I were trying to make a

user agreement uninviting, I would choose a small font, a thin serif font,

would set it in all caps.

What happens then is that you have type that becomes a texture rather than words

and spaces.

No one has read the terms and conditions. No one in the world.

No one, even the lawyers who wrote it, wrote it like this.

You come to a website and they have a set of rules, usually described in a

of services, and then they have a privacy policy.

And as soon as you start using the service, in essence, you have agreed to

terms of service and the privacy policy.

Do these terms and conditions that we sign up for even apply?

They do. I think if they didn't apply, I think the web would topple over. And so

to the extent there have been contract decisions, they've held that these terms

and conditions are valid.

And this concept is pretty new.

For instance, you never had to sign a user agreement for an old -fashioned

landline, or to watch TV, or to read a book.

But if you use a smartphone, a Kindle, or you watch Hulu, then you do.

Pilot, baby, don't you sign anything there. What's this all about?

In fact,

if you were to read everything you agreed to, it would take one full month

work out of every year.

That's 180 hours you would need to spend every year.

And according to the Wall Street Journal, consumers lose $250 billion

due to what's hidden in fine print.

Here's an example from LinkedIn's term.

So, LinkedIn takes pretty much everything forever.

You'll find this kind of language in Google, Pinterest, Facebook, pretty much

anything that people consider free.

Instagram is finding that pictures are worth much more than a thousand angry

words after the company updated its user agreement to say it would have the

right to sell posted photos without compensation for use in advertising.

And even if you are paying, companies have the ability to make you accept just

about whatever they please.

In 2009, GameStation, a company in the UK, put some pretty sneaky stuff in

terms. They didn't take money or your firstborn child.

But for one day, their terms stated, by placing an order via this website, you

agree to grant us a non -transferable option to claim, now and forevermore,

immortal soul.

The contract was only live for a day, but Game Station happened to rake in the

lives of 7 ,000 immortal souls.

This was, of course, a joke. However, it makes you wonder, what if there were

more serious consequences that might result from not reading terms and

conditions? What if your phone came with these long terms of conditions that

said, well, if you use the phone, the government can wiretap you. That would

insane. But that's the kind of world we're living in. A world where the

government can wiretap you because of terms and conditions?

So if you look at the iPhone user agreement, wiretapping isn't mentioned.

But in AT &T's privacy policy, they say that they can use data to investigate,

prevent, or take action regarding illegal activities.

Prevent?

In 1994, Pizza Hut became the first major chain to accept a delivery online.

Suddenly, the internet needed a way to remember who you were, where you lived,

and how you were going to pay.

My question is, what the hell?

Like, how do they know who you are?

Yeah. Okay, um, there are these things called cookies.

Where, like, if you go to a site and buy something, it'll remember you and then

create ads for other stuff you might want to buy.

So it learns information about me?

Seems like an invasion of privacy.

It wasn't until the late 90s that companies began voluntarily adding

policies to explain what was happening with this data.

Then, in 2000, an online company called ToySmart went bankrupt.

But they had an idea.

They tried to sell their database of 195 ,000 users to another company.

This included names, billing information, shopping preferences, and

profiles. Even though their privacy policy said they would never share

information, people felt like they were being duped.

Lawmakers tell you time and time again that every time they go back to the

district, to their district, people are telling them that they want some

internet privacy laws. They want some protection.

In early 2001, over a dozen bills were introduced in Congress to protect

online.

These acts of mass murder were intended to frighten our nation into chaos and

retreat, but they have failed.

All of the privacy legislation was killed or abandoned, and the Patriot Act

of course, initiated.

The bill before me takes account of the new realities and dangers posed by

modern terrorists.

This new law that I signed today will allow surveillance of all communications

used by terrorists, including emails, the internet, and cell phones.

The Patriot Act expanded the ability of the federal government to do

surveillance in a lot of little ways. You don't need a judge's approval, for

instance, to find out what website someone visited, what search terms they

into Google.

The question of your...

if you will, information being retained by Google is not really at this point a

Google decision. It's really a political or public policy decision enforced by

different governments in different ways.

What if privacy policies weren't about protecting privacy at all, but rather

taking it away?

Let's take a look at Google's privacy policy around this time to see if any

changes were made.

So here's Google's privacy policy from December of 2000.

Google may also choose to use cookies to store user preferences.

A cookie can tell us this is the same computer that visited Google two days

but it cannot tell us this person is Joe Smith or even this person lives in the

United States.

And here's the privacy policy from one year later, in December of 2001.

Google does this by storing user preferences in cookies and by tracking

trends and patterns of how people search.

Google will not disclose cookies to third parties.

except as required by a valid legal process, such as a search warrant,

statute, or court order.

Now, it's important to note the fundamental difference between these two

policies. One says that you're totally anonymous.

The other says, when necessary, you're not.

But here's what's strange.

So the first screenshot you saw of Google's oldest policy was taken by a

-profit internet archival service.

It records what websites used to look like by taking snapshots, and it's been

doing it since the 90s.

Now, Google also lists the history of its privacy policies on its own official

archive page.

In their archives, they state they've got every privacy policy that goes back

the beginning.

But what Google shows as their original privacy policy doesn't match that of the

archive service.

Instead, they show the policy from December of 2001, the one that says that

users are not anonymous.

Google claims this is their first privacy policy, which it isn't. So why

Google not include its original privacy policy on its own archives page?

the one that said you would remain anonymous.

What if the data collection that the Patriot Act required became the

of a whole new business model and the foundation of the modern Internet as we

know it?

Would that be something worth covering up?

Even though we don't write checks to Google, and that's one of the reasons we

kind of like the company, it doesn't mean that Google is really free or that

are free in the liberty sense when we use it.

It might feel very different if Google was effectively a $500 a year service

because that's the value of the data that you're providing.

I mean, that was a really critical finding in that advertising could be

based on information that people were somehow supplying about themselves.

Suddenly, you didn't have to wonder, was somebody watching my commercial?

You knew someone clicked on my ad. That meant that they...

paid attention to it. In 2012, Google was one of the most valuable stocks in

world. And Mark Zuckerberg, the founder of Facebook, had become one of the

richest men in America.

My job is to help investors figure out for themselves what this thing's worth.

look at what Facebook has as an asset, which is 900 million people and a ton of

data on those people.

And I say, if they use 10 % of that data, they're going to be the most

company ever. When personal data is worth this much.

Why would Google or any free Internet service be opposed to the data retention

that the Patriot Act required?

Anonymity wasn't profitable.

The people who are willing to give up a little bit of information in exchange

for having access to something that's free or something that's fun or a free

taco.

I don't think that ever changes, right? You always want something free.

And plenty of people are willing to provide information to get that.

And plenty of companies picked up on this fact.

Let me give you some very practical tips.

First of all, I want everybody here to be careful about what you post on

Facebook.

What the default settings are on Facebook. This is how most people use

technology. When these companies are building these systems, they know that.

So why is it default for everything staring, every photo?

When I start Facebook, why isn't it just for my friends?

Why is the default for everybody?

Because it's really confusing for my mom to figure out how to just share to her

friends. The way we've designed the site is that it's a community thing.

So people want to share with just their friends, but a lot of people also want

to share with the community around them. So I want to share with everyone who

works with me at Facebook. I want to share with everyone who went to my

everyone in the village around me.

And those people aren't just my friends.

Even Mark's explanation doesn't make any sense.

He says he wants to share with the school, with the quaint village next to

He doesn't say he wants to share with the entire world.

And yet, that's the default.

The challenge with defaults is that you get comfortable with whatever the

default is.

When the default is public, you actually can adapt really beautifully and deal

with it. When the default is private, you can adapt comfortably and deal with

it. When the defaults change, that's when problems emerge.

And in fact, that's what Facebook did.

In 2009, Facebook made changes to their privacy policy without telling anyone.

Doing a privacy change for 350 million users is really not the type of thing

that a lot of companies would do.

We decided that these would be the social norms now, and we just went for

You might remember the fan page with over a million people who tried to get

policy reversed.

What was the big deal, you might ask?

Well, over the course of a night, Facebook turned what was once private

information into totally public information.

These platforms have an incentive to keep as much information about you and

it as visible as possible.

It's almost the question then becomes, what's the less forgivable sin?

Having this crazy one -night stand?

or not knowing how to use Facebook properly.

Most relationships in your life, it's very good that the other person doesn't

know everything you've ever said or scribbled or thought.

When you share a photo album you go to Facebook and you choose to put those

photos there Opt -in on every single

thing opt -in Opt -in opt -in

I'm okay with Facebook behaving like a

company

But I think we need to treat it like a company and not treat it like some

public utility.

These are the default settings on Facebook in 2005, divided into 12

As time passes, more and more information is shared by default.

In 2009, Facebook began automatically sharing personal information with the

entire Internet.

By 2010, everything was shared by default, except for your contact info

birthday. We could, if you did a search and a Gmail and a YouTube and so forth

yesterday, and you did it from your home, I'll give you the worst case. You

it from your home, and you only have one computer in your home.

In theory, we could cross -correlate those and get all three together.

We don't do that, and we're not likely to do that.

But in January of 2012, Google made changes to their privacy policy, and

did just that.

Google combined all of the information any of their services had collected

a person.

and put them into one single profile.

What Eric Schmidt had said was the worst -case scenario, Google had actually

done.

How can you honestly sit here and tell this committee this is not a growing

problem?

A good deal of what I was trying to say is that I don't think there is evidence

of a market failure or consumer harm from the legal and legitimate use of

personal information in commerce.

I don't think there's evidence of it. There are companies that you've never

heard of, like Actium, that claim to have about 1 ,500 points of data on the

average American citizen.

Everything from, you know, whether you're right -handed or left -handed,

kind of dog you have, what your sort of psychological outlook is, and all of

that can be used to inform decisions that businesses make about us as well.

These are the types of companies that a potential employer would go to to try

and run a background check on somebody before they hired them.

They're able to connect the fact that you went to site A and then later to

B and then eventually to site C and create this detailed history of what

you visit online.

They don't put your name in the cookie. They put a unique serial number in the

cookie that could then be linked to your name in their database.

I don't know if you've ever seen the picture of the ad network ecosystem that

shows all the parties in the ad network ecosystem. It's a bit overwhelming.

The information is valuable to different people for different reasons.

What if you buy a lot of alcohol?

You know, they might want to raise your premiums because they think you're at

risk for alcoholism or something like that. The company might use it in a way

that actually harms you.

For example, in 2008, thousands of people suddenly had their credit limits

reduced, seemingly for no reason.

While on vacation, one wealthy business owner from Atlanta thought his limit

plummeted from 10 ,800.

to just $3 ,800, ruining his vacation.

The letter he received said this.

Other customers who've used their card at establishments where you recently

shopped have a poor repayment history for the American Express.

This means companies like Walmart.

And in Minneapolis, a father came into a Target outraged that they were sending

a teenage daughter pregnancy coupon.

Coupons that were addressed to her.

The man thought the Target was trying to encourage his daughter to get pregnant.

As it turned out, thanks to her shopping habits, Target knew that this high

schooler was pregnant before her own father did.

The father later apologized.

And in the Netherlands, data was being used to harm customers in a whole new

way. Now, while you're driving and using a GPS, that GPS is sending back signals

to tell how fast you're moving.

It's really useful for helping us avoid traffic, but that got a little company

called TomTom wondering who else might be interested in knowing the speed of

traffic. And so in the Netherlands, the data that people were willingly trading

to find a faster way home was being sold to the authority to give those same

drivers tickets.

The reason we don't have any baseline consumer privacy law because of the FBI?

No. That is largely due to lobbying by companies that have built extremely

lucrative businesses around these business activities.

Don't want to do anything to disrupt that.

Under Facebook's terms and conditions, a user must be 13 or older.

Despite this, according to a recent Consumer Reports study, an estimated 7

million users were younger than 13.

First of all, we don't allow people to have accounts under the age of 13.

And my reaction to that is that's just absolutely indefensible. I mean, it's

unbelievable that you would say that.

Senator, I just want to say we really emphatically agree with your points.

say that Facebook sent an army of lawyers with the final privacy

that emerged in 2011 was watered down significantly in a way that wouldn't

affect Facebook's business model.

My name is Alan Davidson, and I am the Director of Public Policy for Google in

North and South America.

My message today is simple.

As we've heard, mobile services create enormous social and economic benefits.

Protection is the enemy of innovation.

It absolutely doesn't have to be and isn't.

It was an expensive year of lobbying for these big companies.

Google spent five times as much as the year before, and Facebook spent four

times as much.

Senate Bill 242 will protect users of social networking Internet sites.

It will protect these users from identity theft and from unwanted

keeping their private information private.

Of course, unless they agree to share it. I know that many members, including

myself, do not want to negatively impact a very important industry for the state

of California.

Individuals involved in this industry don't want to see any regulation

whatsoever. So I think that's really key.

And one of the most interesting things I found in these conversations is that

many members of the legislature don't even have network.

Social network sites because they're concerned about their privacy.

And at the time the bill was being heard, although lobbyists were in the

committee room for the entire hearing, they did not come forward to speak.

So it was sort of an interesting process, sort of a self -killing of the

without the opportunity for the public to really see who was in opposition.

So people like Google and Facebook were in strong opposition, Facebook in

particular.

What did Facebook have to lose?

You know, I really do not understand their logic, and you'd have to ask

them about that. But when I analyze an issue like this... I'd love to ask them

about that. They won't talk to me.

I'm not surprised.

I don't think the rules of law and regulation necessarily apply when it

interacting with a company that wants to sell you something.

Yeah. We should be worried.

But worried about what?

Sure, the data collection allowed by privacy policies had fueled commerce.

was there something more serious we were agreeing to?

Total Information Awareness.

A program initiated by the government in January of 2002.

Its mission? To collect every digital transmission imaginable.

And yes, this was their real symbol, the Eye of the Pyramid, scanning the Earth

with a laser beam.

It actually looks oddly similar to what's inside of Mark Zuckerberg's

Making the world more open and connected.

Oh my God, it's like a secret vault.

Total Information Awareness was a program designed to connect with dots,

banking activities, to flight searches, to...

to online activities.

But the Pentagon is clearly moving to create the largest electronic eye ever

look at any and all Americans.

You're looking for trends and transactions that are associated with

potential terrorist act.

They believe that with enough data that they could predict who would be engaging

in nefarious crimes.

The public was outraged. Congress was outraged. The program was shut down.

The lesson that the government learned after the failure of total information

awareness was that if you're going to create a gigantic spying program, don't

give it a creepy name.

There's nothing to prevent them from developing the same capabilities, just

smarter ways from their standpoint.

A wiretap requires a court order.

Nothing has changed, by the way.

But in reality, lots had changed.

We were told one day in late 2002 that an NSA representative was coming to the

office. Mark Klein came to us at the Electronic Frontier Foundation.

with data and documents that showed that AT &T was engaged in a

wiretapping program.

The NSA is much different from the CIA. First of all, it's about three times the

size. It costs far more. It's tremendously more secret than the...

CIA, and what it does is very different. It's focused on eavesdropping, on

tapping into major communications links. They actually had a secret room in

their facilities, and they were creating a copy of Internet traffic and sending

it to the NSA.

So in a sense, they are vacuuming up, scooping up everything. In a sense, they

are blindly vacuuming up everything going across those links.

And you're certain of that?

I'm certain of that. So President Bush owned up to it.

I authorized the National Security Agency to intercept the international

communications of people with known links to al -Qaeda and related terrorist

organizations.

It's taken less than 24 hours after the Bush presidency ended for former

analysts at the National Security Agency to come forward to reveal new

allegations about how this nation was spied on by its own government.

The National Security Agency had access to all Americans' communications, faxes,

phone calls.

And their computer communications. Is there a recording somewhere of every

conversation I had with my little nephew in upstate New York? Is it like that?

It would be everything, yes.

It would be everything.

But then a beacon of hope arrived in the White House.

Hi, Senator Obama. I appreciate your giving us the opportunity to ask you

questions.

I'm an attorney who represents federal whistleblowers.

And I was very disappointed when I learned that you supported the bill that

phone companies off the hook when they've helped the federal government

without warrant wiretap phones.

I recognize that some people feel like, yeah, well, the phone companies still

were complicit in this. They should be held accountable still. I understand

argument. But the problem was the surveillance program is actually one

believe is necessary for our national security.

So they were immune, but that means that the programs are still shut down,

right?

The programs are shut down?

Yeah, the wiretapping programs.

I have no reason to believe that the wiretapping programs have been shut

No, if the wiretapping programs had been shut down, then I don't believe that

the government and AT &T would still be fighting in court for the legality of

it.

Barack Obama hasn't changed anything. No, Barack Obama did not shut those

programs down after he took office, even though he had threatened to before he

became president.

When we got started just in my dorm room at Harvard, the question that a lot of

people asked was, why would I want to put any information on the Internet at

all? Why would I want to have a website?

And people have really gotten comfortable not only sharing more

different kinds, but more openly and with more people. And that social norm

just something that's evolved over time.

You may have seen the onion take on Facebook, which was the CIA has just

announced its most recent handy invention, Facebook.

According to Department of Homeland Security reports, Facebook has replaced

almost every other CIA information gathering program since it was launched

2004.

After years of secretly monitoring the public, we were astounded. So many

would willingly publicize where they lived, their religious and political

an alphabetized list of all their friends, personal email addresses, phone

numbers, hundreds of photos of themselves, and even status updates

they were doing moment to moment. It is truly a dream come true for the CIA.

You know, the FBI's and the NSA's of the world are appreciative of the fact that

Google and Facebook have built business models around collecting user data

because it makes their jobs much easier.

That article in Time started with this anecdote.

They're sitting in their transparent cubicle in their open space in Facebook.

Robert Mueller was the one man in the room with a tie on, and he was older, in

suit. And he comes in and he says, I was just in the building and I wanted to

say hello to Mark Zuckerberg. So he says hello to Mark Zuckerberg, a little chit

-chat, and then he leaves. And everybody's saying...

What the hell was that?

Now, nobody asks the question, why was Mueller in the building?

He's the head of the FBI.

On the one hand, Mark Zuckerberg said he wants to create a more open society,

and Facebook is a way to do that.

On the other hand, you know, there's a lot about the way that Facebook uses

information that people don't know.

If only there was a way of knowing how much information these companies were

storing about us.

Well, in the case of Facebook, we learned some pretty interesting things

to one student in Austria.

And unlike the U .S., Europe has a law that requires a company to tell a

customer what data they have stored on them if that customer wants to know.

And Facebook, unlike most major Internet companies, had actually built a

headquarters in Europe.

Apparently we were like the only three people that were like... pushing hard

enough and like asking again and again and again and going through also the

Irish authority to finally where you get at least like a bigger part of our data

set. We still didn't get everything right now.

Got it right there. Just to have like an idea how much it actually is.

That's like just to picture it and to see how much it is.

Wow, this is more than a baby.

Yeah, that's 1 ,222 pages.

I'm a member of Facebook for three years, but I was using it more intense

like, the last one and a half years or so. What's interesting as well is that I

didn't post too much, actually. Like, I'm a person who posts something, like,

once a week or so.

With this giant ream of information in front of me, is it hard to go through it

and actually find specific details about a person?

No, that's super easy because it's PDF. I mean, we just used the search function

in the PDF file.

So you just type in one word, let's say demonstration or sex or political party

or something, and within a second you find the right information.

So within a couple of minutes you can figure out what people voted for, what,

don't know, psychological problems they have, what parties they've been to.

All these information are really easy to find, actually. While using that

service for such a short time, you still had a data file that's bigger than

anything that any CIA, FBI, or, I don't know, Stasi ever had about an average

person. If you hit the remove button, it just means that it's flagged as

deleted. So you hide it actually from yourself.

But anyone like Facebook or any government agency that wants to look at

can still retrieve it and get it back.

And that means that it's there for an indefinite time.

Even though you hit the delete button, it asks you three times if you really,

really want to delete it.

It's not actually gone.

It's not actually gone. It's still there.

So we've ultimately adopted roughly the following rule.

Think of it as we anonymize the information within 18 months.

It might be anonymized after 18 months, but all the searches that we've ever

done are still there. The underlying data is still there to be de -anonymized

some point.

And de -anonymizing search records turns out to be shockingly easy.

That is, taking private searches and finding out whose records they are.

In 2006, AOL turned over a bunch of these anonymized search records of their

users to the public, and it only took a few short hours for a reporter to decode

who user number 4417749 was.

Between searches for things like numb fingers, 60 single men, and dog that

urinates on everything, the reporter uncovered a woman named Thelma Arnold.

She was age 62.

But then there's user 17556639, who looked up how to kill your wife multiple

times. along with decapitated photos, and then in the middle, the user

looks up steak and cheese.

Steak and cheese.

And there were plenty of users online who were quick to judge what was going

here. It was murder.

Hey, old friend.

Let's take a seat, and I'm going to show you something.

What I'm showing you here...

is a list of anonymized search records.

These records were released by AOL.

Are there actually things on this list that you know you've searched for

Sure, yeah. I have definitely looked up car crash photos. I've definitely typed

in decapitated.

I've definitely looked up dead people photos.

I've definitely looked up white killer, yeah. In fact, I've looked up every

single search term I'm looking at here.

You see, Jerome had been a writer on Cold Kick, a TV show where each week

have to solve a murder mystery.

That's always what scared me when I was entering those search terms, was if

there's some sort of automated system that just red flags you based on the

search term, they're not going to look and say, oh, yeah, he was probably

working on a TV show, and that's why he was just Googling how to murder my

cheating wife.

I just wanted to confirm that I had not murdered you and that you were alive.

No, I am allowed to come out of this room.

Okay,

good.

Oh, thank God. So we can rest assured you are not a murderer.

I am not a murderer.

You're a writer. I'm a writer.

Okay.

Glad we can clear that up. Glad we could clear that up.

So what would happen if that red flag system did exist?

If a dad like Jerome might someday have his door knocked on because his search

records became public?

The consensus seems to be that the retention of this kind of information

be greater than zero days.

And the reason it has to do with police action, terrorists, Patriot Act, all

those sorts of things.

It turns out that in this environment, the digital environment, there's a

loophole to the Fourth Amendment, which is if a third party collects a lot of

this information, the government doesn't have to go through those same hoops.

It's called the third party doctrine.

The third party doctrine means that when you...

If consumers share your data with a bank, with an email provider, with a

engine, with any kind of technology company, you have basically given up

what would have been your fourth -rate protections over that data. For the

government to get information from a Google or a Facebook is a lot easier

the government doing it itself and putting a wiretap on our phones.

Large companies like Google and Facebook receive thousands of requests a year.

from government agencies.

Facebook has 25 employees doing nothing but surveillance.

And these companies routinely receive requests.

They process the requests.

You may be surprised to hear that secret searches of email by the government

seem to be commonplace.

A law that governs when the government can get electronic communications,

like emails and things that are stored remotely, was written in 1986.

It can have effects that allow the government to at least claim that they

be able to get location data without a warrant. Or at one point the government

was claiming that it doesn't need a warrant to get emails that you've

Well, in the spring of 2011, the Department of Justice, and in particular

FBI, made several requests.

to Internet companies as part of an investigation relating to individuals

associated with WikiLeaks.

We released 400 ,000 classified documents.

For those of you who don't know who Julian Assange is, he started WikiLeaks.

Now, in the past, WikiLeaks has released secret documents related to the Iraq

War, Guantanamo Bay, and Afghanistan.

And that's, you know, obviously a positive development for those of us who

that information...

should be more accessible almost no matter what, and obviously is a

development to those institutions like corporations, in many cases, that depend

on secrecy.

I condemn the action that WikiLeaks has taken. It puts at risk...

our national security.

Twitter received an order that requested data regarding certain Twitter users.

These were all users that were related to the whistleblower website WikiLeaks.

However, it wasn't just an order. It was actually a de -order, and it came with

a gag order. It required that Twitter never speak publicly about the fact that

they had received this request.

Denouncing the move, Assange said he believes other American Internet

such as Facebook and Google may also have been ordered to disclose

Companies like Amazon, Yahoo, Dropbox, even Facebook will

be capable of handing data to the government without first informing

Even if you think what the people are doing is wrong, that's why the First

Amendment exists, to protect.

Unpopular people engaging in unpopular speech.

But Twitter fought back.

They released the information to the users and let them know ahead of time,

they were successful in getting the gag order overturned.

Meanwhile, Amazon, PayPal, MasterCard, and Visa, they all gave in to the

pressure regarding their users.

You know, a culture of loyalty to not you, but a greater cause is important to

be successful, it seems like to me, and is disloyal, in this case, to the

country. While President Bush might think it's disloyal, thanks to Twitter

standing up for the privacy of activists like Julian Assange, you can now be

shown this.

Today, we released over 287 files documenting

the reality of the international mass surveillance industry.

An industry which now sells equipment to dictators and democracies alike

in order to intercept...

entire populations.

9 -11 has provided a license for European countries, for

United States, Australia, Canada, South Africa, and others

to develop spying systems that affect all of us.

The spy files show the massive industry that's around selling to the U .S.

government. and governments around the world.

Instead of having something called the Total Information Awareness Act with

big symbol with the eye of the pyramid looking at everybody and scanning the

world with its sinister laser beams, instead they just have a bunch of

that exist that are providing bits of those capabilities that are provided

different contracts that go up to the same agency, the same people.

One of the most popular is called Massive Intercept, and basically what

governments are trying to do with this is get as much information as possible

from our communications so they can analyze that and detect patterns in

It's interesting, you know, in your article you really talk about the

nature of the business, that they sell through trade shows which are not open

the media.

But we actually went to one of these conventions.

It was pretty easy.

called and asked for a pass.

So we talked to the representative from one of these companies, a firm called

Celebrite. They were included in the spy files.

They're a company that sells cell phone extraction tools to every major

government sector in the U .S.

So my name is Christopher Shin. I'm the vice president of engineering for

Celebrite USA.

Today I'm presenting to you the Celebrite UFED system. It's my right

It is a device used to extract...

Countless information from mobile devices, so text messages, pictures,

audio, call logs, that kind of thing. It's used by agencies across the United

States and the world.

Yeah, the iPhone specifically stores a lot of information, more than your

handset. It really is a digital store of your personal life, your business life,

and this is why the field is actually, it's been growing exponentially over the

last couple of years. So as the devices get more complex, they can hold more

information.

one of the most personal devices to you today, even more than your laptop.

We think of ourselves as basically a tool manufacturer, just like Glock or

Beretta is producing a firearm.

We're producing a tool that does a certain task, and we're marketing that

only towards, just like you can't go out and just buy a handgun without

credentials, we're not just selling it to everybody.

But could you possibly sell it, or is it a lockout?

There are no laws against selling this to someone that's not in law enforcement

or government, something like that. If someone was to dump my phone tomorrow,

they might get a good laugh out of the content in it, but I don't think I'd be

put in jail.

So I think that it really depends on how you look at it. I mean, there are

privacy concerns, but I'm a little bit more on the, I guess, the liberal side

my privacy being exposed. I mean, other people, of course, that's a completely

different, completely personal view.

My phone itself, I mean, I actually take that back. I have a lot of work

-related information on my BlackBerry. So if this information did get out, I

probably would be pretty concerned.

The surveillance vendors target two types of customers.

They target governments directly, and then they also target Internet service

providers and telecommunications carriers who are tasked with the

of spying on their own customers.

For example.

there was a little piece of software that had been installed on every phone

America. This software was called Carrier IQ.

And thanks to a little video that a systems administrator from Connecticut

posted on YouTube, the world now knows that this software had been monitoring

our every keystroke.

553, and so on and so forth.

According to Carrier IQ's chief marketer, they're aware this information

sensitive and call it a treasure trove.

It became big enough of a deal that Al Franken decided to take this issue to

Congress.

Mr. Director, millions of Americans have smartphones with pre -installed

software designed by a company called Carrier IQ.

Recent research has shown that it captures a broad range of sensitive

information. Let me start off by saying we have neither sought nor obtained any

information from Carrier IQ in any one of our investigations.

Not directly from Carrier, but what about from the wireless carriers?

No, I don't believe so. If you're specifying the use of the Carrier IQ

in a wireless carrier, have we?

I sought that. I do not know any information we seek from wireless

what have you.

And I'm not talking about carrier IQ. I'm talking about wireless carriers that

may obtain information that in some way carrier IQ may have been involved with.

Why would the FBI need carrier IQ to send them all of this information?

After all, they could be using any of these services that were included in the

spy files.

Take this product, for instance, Scan and Target.

which claims that it can search through the SMS, the IM, Twitter, emails,

Facebook, blogs and forums, all while analyzing huge volumes of information in

real time.

Or Finn Fisher, which demonstrates how police can infiltrate anyone's system

through a variety of videos that used to be available on their website.

They even show the agent hacking into Google and Facebook in their demo.

Massive interception equipment is sold by surveillance vendors around the

So it's really up for grabs for anyone who wants it and can pay the price.

The Thin Fisher system was sold to Egypt to monitor people who oppose their

leader. These are the actual documents.

It even includes training for two to four people for the low, low price of

11 grand.

Or the Hacking Teams project, which advertises that it can track hundreds of

thousands of cell phones all on one system.

Or software like Kapow that analyzes all social networks with features like the

ability to search out keywords and phrases.

Everything happens on Facebook, and it shows the frequency of conversations

between one person and another and that kind of thing. That allows for a lot of

profiling. It creates massive databases for law enforcement to exploit and often

misread. With hundreds of companies offering these services, why would the

need to use Carrier IQ?

Everything coming from a cell phone, everything coming from a computer,

that's going over the Internet out of the country or even internal within the

country. and be monitored using this kind of equipment.

If you look at news stories now about what they call big data, big data is

really looking up the question of how can government and corporations work

that data in order to look for anomalies and predict when you're going to do

something so they can stop you from doing it. And the government isn't even

secretive about it.

If you visit their business website, there's an application there looking for

developers to create better tools for mass surveillance for online activity.

Examples for surveillance include, but are not limited to, Fox News, CNN,

Twitter, Facebook, etc.

Which brings us back to that word you'll find in many user agreements.

It's the word that sent us down this whole path in the first place.

Prevent. So this might make you wonder, what potential threats would all of the

surveillance we agreed to actually prevent?

Basically, January the 3rd, 20 days before I go on holiday, I tweet, are you

free this week for a gossip slash prep before I go destroy America?

Ended the tweet with a kiss.

As threatening as that is.

20 days later, I get on a flight, go to LAX. We had a hotel in Hollywood

Boulevard. We were just going to party around for a week, just looking around,

just being tourists.

Got off the plane, went through the passport control, fight my passport

and they're like, can you come this way? And I was like... Because I got an

Irish passport, I thought maybe Irish people would stereotype IRA bombers.

They went through my suitcase and I was like, what are you doing?

And then when they pulled me into the holding room, I was questioning me for

five hours about whether I had a Twitter account.

And I was like, are you being serious?

Are you actually holding me because of a tweet?

And they were like, what do you mean by destroy America?

And I was like, it's a party. It means go wild, get drunk.

Any moron that could read that tweet can see what it's meant as. It ends with a

kiss. I'm sure, like, Hitler doesn't end his memoirs with a kiss or whatever he

did. And then they moved us to a holding room.

But then at midnight, the staff changed over, and they weren't aware of what we

were there for, so they handcuffed us, stuck us in the back of a police van,

then took us to a downtown, like, prison detention center.

Innocent people shouldn't be treated like absolute dirt. And they were

us around, pushing us into walls.

Sounds like a horrible vacation.

Is the government refunding you at least?

No, they won't comment on what happened.

Well, if I'd put I was going to paint the town red, they'd have me done for

graffiti as well, wouldn't they?

When I go to other countries, this is going to show up that I got refused from

America, so more than likely I'm now going to get dragged off at every

and questioned about what happened, and I have to explain to them that it was a

tweet.

I'm Italian, Irish, French.

Portuguese, Native American, Black, I'm leaving my 118th avatar.

This is Joe Lopari.

Joe Lopari had had a rough day at the Apple Store.

He had been forced to wait in line for four hours before finally leaving.

So I get home from the Apple Store, feel a little irritated, smoke a little

dope, turn on Fight Club, just trying to relax, go on Facebook.

And this button down, Oxford Clock, I go, Mike, Joe, now.

and then saw from office to office with an arm of light, AR -10, and I said the

same thing, but except the apple. Pumping round after round. And, you

basically word for word except for where.

Hanging out on Facebook, getting ready to go to yoga class, and there's a shave

and a haircut.

Two -bit knock on my door.

So I was like, hey, maybe somebody's here to watch Fight Club with me.

Open it up.

Boom.

NYPD slot.

their bulletproof vests on, their guns drawn, and they tear the place apart.

You know, they really go through everything.

When the one cop, you know, finds the box that has all my, like, military

awards, he comes bringing it down. He's like, oh, you were in the military?

And we start talking, like, you know, Army talk. He sees that I speak the

language. And that's when he asked me, he's like, so do you know what an

AR -10?

And I was like, that's why you're here, guys. You're here because I made a bad

joke on Facebook.

Like, I, you know.

It blew my mind.

It's the ultimate buzzkill, really. Your Facebook page has brought SWAT to your

house. They told me not to go far from New York because I'm going to be needed

for all these court cases for a year. They claim one of my Facebook friends

called 911, which is another thing I think is bogus.

So I asked for the 911 tape, which they keep on file. They have to.

And it's my right, it's my stuff. They have to give me my mug shots if I want

it. So they come back and say, oh, it turns out it wasn't someone that called

911. It was someone that just walked into the police station, and that's

something we don't keep a record of.

And how did you get my address? I lived there for like 10 days.

I didn't update my mailing address yet. All my banking stuff was still going to

my old apartment.

There was nothing saying I lived there except for a verbal agreement.

Three minutes after being done with my lunch, I was told to go up to the

And then I would sit down inside the vice principal's office, and I wasn't

told what was going on until maybe ten minutes later. My phone rings, I look at

it, and it was the number to his school, and I answer it, and it's the school

security guard just giving me a FYI.

You know, for your information, just to give you a heads up, the Secret Service

is here with the Tacoma Police Department, and they have veto, and

talking to him. A man walked in in a suit and left, and he said

that he was part of the Secret Service, and he told me it was because of a post

that I made, and it indicated as a threat towards the president.

Yes, a 7th grade boy was visited by our FBI because of a red flag that came up.

in their spy system.

I was saying how Osama's dead and for Obama to be careful because there might

suicide bombers.

It didn't consider his age or that his comments about Obama needing to watch

was one of concern.

The machine simply determined that based on a series of words, veto was a

potential threat.

Pre -crime, their belief, this potential breach of the peace, their

belief that you might cause a crime.

There's pre -crime arrests in minority reports.

Mr. Marks, I mandated the District of Columbia Pre -Crime Division.

I'm placing you under arrest for future murder of Sarah Mark and Donald Dubin.

It must take place today, April 22nd, 0800 hours, 4 minutes. I didn't do

anything. The arrest that happened on the royal wedding day when I attended a

zombie flash mob wedding picnic.

Right. And myself and four other zombies were arrested preemptively for

potential breach of the peace.

Even if you dressed up as a zombie, it seems to me that the crime isn't really

committed until you eat some brain.

Yep. To be fair, we did have some brain cake.

Oh. So there's that.

How did they know that you were going to be dressing up as a zombie this day?

There couldn't have been emails or anything, really? There could have been.

hard to know. Yeah.

I think that's the tough thing, right? That's the scary thing, yeah. Yeah.

The indication that they were monitoring private social networks came in the way

they were reacting to certain things and asking about certain things. So they

were asking about maggots and asking about climbing gear, which they must

heard about through some exchanges on the internet, neither of which was true.

Nobody had maggots or climbing gear.

And not something that was itself posing a hazard to the royal wedding

celebrations. We were nowhere near the royal wedding celebrations, and we had

plan of going near the royal wedding celebrations.

Anything that wasn't part of the official, ostentatious, joyous,

celebrations of this wedding of two strangers was prevented from happening.

And that seems deeply disturbing.

You can see that surveillance measures are being used to silence protests

they even happen.

This was, of course, the royal wedding.

We'd all help pay for the royal wedding. It wasn't just a private wedding.

You're arresting a professor of anthropology that runs a street theatre

We couldn't believe this was happening.

We were so obviously a street theatre troupe.

Some of us had actually got the costume on, you know.

So we were locked away in Lewisham Police Station for 25 hours.

Once the whole wedding was safely over, we were let out.

For the first time, as far as I'm aware in this country, a number of us,

something like 50 of us, were arrested and in most cases incarcerated for

thinking about protest, for thinking about, in this case, some streets yet.

A lot of life is based upon trust.

I mean, if you have a conversation with your inner circle on a key strategic

decision that is vital to your company, and you read about it in the newspaper

before the decision is implemented, in other words, you get preempted from

acting because somebody inside your company has talked, you're not going to

it, and it'll hurt.

The activist didn't need to commit any crime.

They just needed to text, to email, and to call each other about potentially

protesting.

But I think that the answer is not to take away the capacity of looking at the

public actions of citizens and keeping a record of them.

The solution is to make sure that we elect better governments.

So one of the things I hear a lot is, who cares if they're collecting all of

this information about me? I don't have anything to hide, so why does it matter?

I know this argument, and it is not very new.

It's old -fashioned, saying we are a...

complying with rules, and so what happens?

Between leading the sinful life I would like to lead and hoping that governments

will protect my privacy, or assuming that no one's going to protect my

and leading a less sinful life, I'll go with the latter. It's simply just the

odds of success seem higher to me.

I congratulate the people who say they have nothing to hide. I don't believe

them. And I also say that they're probably hiding something from someone.

do. You have nothing to hide till you do.

And you are not necessarily going to know what you have to hide or not.

You might remember the case of Millie, a teenage girl in Britain who disappeared

in 2002.

Police in Surrey say they're growing increasingly concerned about the safety

a 13 year old girl who hasn't been seen since Thursday afternoon.

Before the police found her body, her parents were holding on to hopes that

might still be alive.

Why is that, you might ask?

Well, because according to phone records, Millie had checked and deleted

voicemail.

As it turned out, members of Rupert Murdoch's corporation had been hacking

Millie's phone, trying to be the first to reveal details of this national news

story.

I think this is the watershed moment when finally the public start to see and

feel, above all, just how low and how disgusting this particular...

newspapers methods were this was a murdered school girl and the thought

very tight -knit circle of very senior politicians linked up very closely

intimately with the police and with the media mogul rupert murdoch

for 30 years as british prime ministers came and most certainly went a constant

character in their worlds was rupert murdoch

The billionaire media mogul who's... For years, celebrities and individuals like

Millie had the voicemails they thought were hidden and private, accessed by

Rupert Murdoch's corporation, at the expense of people like Millie's parents.

And it took nearly a decade to expose the misuse of this highly personal data.

Transparency, which bonds us together and gives us all so many friends that we

didn't know before, but all these friends that are connected, gives the

absolutely unparalleled in the history of humanity ability to know what's going

on in the citizens, to find out who the dissenters are.

The government is making whistleblowing a crime.

They are making dissent a crime.

especially when it embarrasses the government and calls the government to

account. If sources are going to get discovered, and if whistleblowers cannot

securely and anonymously provide that information to journalists, we as a

society won't know when our rights are being silently violated.

Of course, the president has defended his administration.

The only way he knows how.

If we can root out folks who have leaked, they will suffer consequences.

If you

look at a

technical perspective, the technologies of maintaining privacy are actually

running ahead.

of the technologies that break it. For example, encryption, which can maintain

your privacy, is running ahead of decryption.

But what if there was a way to store information until it could be decrypted?

US intelligence officials will soon be allowed to keep information on US

citizens much longer than they used to, even if those citizens have no known

ties to terrorism.

Under new rules, the government can store data it gathers for five years.

up from the current limit of six months.

If Dick Cheney were elected president and wanted to detain and incessantly

waterboard every American who sent an email making fun of his well -known

hunting mishaps, what I'd like to know is does the NSA have the technological

capacity to identify those Cheney bashers based upon the

content of their emails?

In the United States, we would have to go through an FBI process, a warrant, to

get that and serve it to somebody to actually get it.

But you do have the capability of doing it. But not in the United States.

There are new questions about the National Security Agency's massive spy

under construction in the desert of Utah.

Once finished, it'll be five times the size of the U .S. Capitol building. The

NSA is not allowed to spy on Americans, but now a whistleblower has come forward

saying that the agency is doing it anyway.

This massive agency that's collecting a tremendous amount of information every

day by satellites and tapping the cell phones and data links and your computer

email links and so forth.

Then it has to store it someplace, and that's why they built Bluffdale. It's

going to cost $2 billion.

It's being built in this area on a military base outside of Salt Lake City

Bluffdale. As I said, they had to actually extend the boundary of the town

would fit into it.

And the whole purpose of this is the centerpiece of this massive

this network that was created after 9 -11.

The reality of information technology is it progresses exponentially, only

information technology.

Exponential growth starts out very slow, looks like nothing's happening, you're

doubling tiny little numbers, and suddenly it takes off. And we've seen

with paradigm after paradigm, like social networks in recent times.

In 1984, to store one gigabyte of data, cost $85 ,000.

By 2012, it cost about $0 .05.

In the city of Chongqing, there are about 500 ,000 cameras.

In 2012, the cost of permanently recording a high -resolution feed was

million. By the year 2020, the projected cost is less than $3 million.

The UK, being one of the cultures that introduced cameras most ubiquitously and

most quickly, so far the population seems fine with it.

If they weren't, I...

They know who to call.

There are 2 ,000 cameras, and soon there will be 3 ,000, all of which feed into

this control center housed in a secret location.

And I can call up in real time all instances where a camera caught someone

wearing a red shirt. This is the shape and the size of a potentially suspicious

unattended package.

Many police departments set to use controversial new devices capable of

people's faces, then checking that information against a criminal database.

When we're at war, when you're protecting your society against people

to come in and kill civilians, you have to be able to defend what we're doing.

You have to be able to defend our way of life, and you have to put these powers

into somebody's hand. According to the Brookings Institution, This kind of

pervasive monitoring will provide what amounts to a time machine, allowing

authoritarian governments to perform retrospective surveillance.

For example, if an anti -regime demonstrator previously unknown to

services is arrested, it will be possible to go back in time to

demonstrator's phone conversations, automobile travels, and the people he or

met in the months and even years leading up to the arrest.

The government is using the existence of terms of service.

to justify the surveillance state that we now live in.

The messages are free to use, and most importantly, they're encrypted, so the

police can't actually get in there to encrypt what's happened. So that's

prompted calls to shut down the entire network.

It's easy to justify using these technologies to stop a riot.

But shouldn't we be concerned when the government is able to read our emails,

text messages, phone calls, search history, to track our movements and

free speech?

What crime did that 7th grade boy really commit?

Is having zombies at a row wedding really so bad?

What about Millie's parents?

And what happens when these technologies are used to watch peaceful protesters,

like all of the people that occupy Wall Street or the Tea Party folks?

What happens if the government doesn't like tents being set up?

Despite all of this,

it was starting to seem like, so what?

So what if the government can acquire all of this information?

Maybe it's good they can keep the peace when riots are happening.

And besides, maybe it was already too late.

Do you think privacy is dead?

I mean, it's certainly dying.

Whether or not it...

Privacy is going to remain dead unless there's a really fundamental shift in

the dynamics by which that's decided, by which I mean the only real effective

response is to monitor and to change the behavior, the tendencies of the

intelligence industry and law enforcement and all that, and even

And that's very, very unlikely.

I don't know exactly who the us is, but I'm very critical of us.

I think that this is an area in which we have allowed ourselves to be smitten.

We want this technology to grow and grow, and we don't want anything to rain

our parade.

And we have woken up to the privacy concerns, in

my view, at least four years too late.

Yeah,

without question.

Without question private, yeah.

It's safe to work under the assumption that nothing's private.

You know, anything that's been digitized is not private.

And that is terrifying.

When this becomes a sign of a blood cell, and I can just send them into my

and my body through the bloodstream, this will become quite ubiquitous, and

really will be part of who we are. And people say, well, okay, that's going to

be a real threshold.

to move beyond, but I don't think so. It's a very smooth continuum from, you

know, when I was a student and had to take my bicycle to get to the computer

having it in my pocket to having it in my body.

It's a convenient place to put it. I won't lose it that way.

But they say if you put a frog in a pot of water and slowly turn up the heat,

the frog will just die because it doesn't realize it's boiling.

And I think that...

Like anything else, I think we're opting in a centimeter at a time.

And, you know, pretty soon you're pretty far down the road. You look behind you

and you sort of wonder how you got where you were.

I think that's true.

It's just completely out of control. I mean, it's just sky's the limit, you

know. They know everything about us now.

It takes someone who's in charge of laws having what is being done to American

citizens done to their email account, done to their Facebook profile.

All these powerful institutions, they're not subject to the same evasions of

privacy as the rest of us are.

Eric Schmidt, the CEO of Google, once said, If you have something that you

want anyone to know, maybe you shouldn't be doing it in the first place.

Then he got very angry.

when CNET, which is owned by CBS, published a picture of his house?

Well, when you ask Google about Do Not Track, they claim we have to understand

how to define that before we can implement any technology.

Do Not Track is pretty simple. It means we don't want to be tracked.

The only reason Google doesn't understand it... is because Google

to implement it.

Someone comes and makes it no longer practical for them to engage in that

of activity.

Pressure is put upon CEOs of the companies.

They're going to engage in it.

Dawn.

We're going by the Facebook campus right now.

Really have no idea what to expect.

We've not had breakfast.

He'll know that I checked in here, too. That's good. He'll know that I'm right

next to his house.

Here's the exact quote from Mark.

So, having two identities for yourself is an example of a lack of integrity.

Lack of integrity.

They just did a knockup on his door, so it seems very likely that we might get a

Mark Zuckerberg sighting today.

I mean, you might not be wrong, Vince. You might actually have... Ben might

actually have a tunnel.

Mr.

Zuckerberg?

Hey, I'm working on a documentary.

I have a little blog here, but I'm wondering if I could just ask you a

questions.

Sorry.

Really?

Mark Zuckerberg had asked me to please not record him, so we shut off the main

camera.

But since Mark doesn't seem to mind storing our data after we think it's

deleted, this... only seemed fair.

There's a major difference here.

Mark loosens up after he thinks we've stopped recording.

And do you see that? That right there.

That's a smile.

Mark Zuckerberg smiled at me.

And you know why?

because he thought I had stopped recording, and he was relieved.

Imagine what a relief it would be if all of these companies and the government

stopped recording everything we do, if we could just make a simple request to

them, something that Mark Zuckerberg knows how to ask for.

Can you please not?

Can you please not record us, monitor us, and share our information, unless we

ask first?

We need terms and conditions that are reasonable.

And we need privacy policies to promote the most basic principles of our

democracy, rather than taking them away.

Or, as a young senator once said, back before he became president, We need to

find a way forward to make sure that we can stop terrorists while protecting

privacy and liberty of innocent Americans.

We have to find a way to give the president the power he needs to protect

while making sure that he doesn't abuse that power.

And that simple principle that...

There's somebody watching the watcher, whether that's on an issue of freedom

of the press or it's an issue of warrantless wiretaps. That simple

one that we can't give up, and we don't have to give up.

Well, Mr. President, we are watching.

And I guess we have to ask ourselves one simple question.

Do we agree?

Cold feet and a tie rise to the occasion A million tiny

flashlights, I gotta turn it off Cold feet and a tie rise

to the occasion A million tiny flashlights, I gotta turn it off

For a while

Washington is caught in its very own episode of spy versus spy. The tactics

employed by top intelligence gathering teams at the CIA, sifting through IP

addresses, emails, and fake drop boxes, have now been turned against the

intelligence community's top officials.

The FBI uncovered evidence

of an affair between Petraeus and his biographer Paula Broadwood. That's

Petraeus had an affair with the author of his fawning biography, All In.

These did not implicate criminal activity.

These did not implicate national security.

These were not a threat to David Petraeus, the person, or to General

the director of the Central Intelligence Agency.

Those are not my words. Those are the FBI's words.

But instead of actually sending those emails, in many cases, they wrote them

drafts in a Gmail account they both had access to. And that way they could both

log on and check the draft folder, never having to actually hit send.

It's very embarrassing for the Obama administration and for its national

security command.

It's troubling because there are laws that the FBI has to follow and he has

right to be protected from an unwarranted, unjustified investigation

or anyone. People don't really know how they're being monitored and they think,

well, hey, if it's working, if we keep stopping another 9 -11, then it's,

worth it.

The greatest fear that I have regarding the outcome for

America of these disclosures is that nothing will change.