All language subtitles for HAK_MTL.2019.720p.AMZN.WEB-DL.DDP2.0.H.264-NTG

Welcome to Metro-Optic,

one of Montreal's
main telecom centres,

which is a well-kept secret,

a major Internet data centre

serving the province
and part of Canada.

This room is located
beneath train tracks

in the bowels of Montreal.

About 75% of Internet
traffic travels through here.

Here we have more "private"
clients, as it were,

with their own exclusive room,
who wouldn't want it filmed.

So we'll move on.

- Who are they?
- A government agency?

- You can't say?
- They... Yeah.

It's very private.

Of course...

the hoodie's a classic.

So trite, huh?

Anonymous mask,
a series of ones and zeros,

numbers, hexadecimals...

That's often
considered a bad thing,

a crime, that kind of thing.

Not so. There's more to it.

There are different
kinds of hackers.

Some do it for the money,
some do it professionally,

some do it for fun,
some work for the government.

There's no such thing
as a typical hacker,

because there are
different kinds.

Hackers seen in the
movies are just one type.

It's important
to make a distinction.

The pessimist in me thinks

the battle has been
lost for some time.

The mere fact that everyone
carries a cellphone,

the optimal surveillance device,

beyond George Orwell's
wildest dreams

when trying to imagine
an omniscient panopticon.

This is also fuelled
by social media.

I do it, too. Everyone does.

Anything that can be
monitored is monitored,

as well as monetized.

And the prevailing
business model

for all high-tech companies now

is the selling of
personal information.

It remains a cash cow
for these companies.

And all this is based on data
collection, mass surveillance,

and the slow but steady
erosion of privacy.

It's an Orwellian
nightmare of sorts.

And I think I can
help in that regard,

through Crypto.Québec,
what we produce,

with our podcast,
articles, training,

and what we say to the media.

These matters affect everyone,

though people may
not realize it.

They affect everyone,
so this must be addressed.

Welcome to the 37th edition of

Crypto.Quebec's
Watchdogs podcast.

Hosted by Geneviève Lajeunesse,

Luc Lefebvre,

Jean-Philippe Décarie-Mathieu,

And Sophie Thériault.

We have a lot to
talk about today.

I simply wanted to look back

on a little trip
we made last week,

myself, Jean-Philippe and Luc,

to the nation's capital, Ottawa.

We visited CSIS and
CSE headquarters.

- Just to check them out.
- From outside.

- Well, you tried.
- Right.

Can you see the
building back there?

Kinda.

I really didn't expect to
see Canada's cyber elite

across from Loblaws.

For real, it's... Imagine...

Like, a huge, magical airport
next to the Quartier DIX30.

- It's kind of like that.
- That's exactly it.

- With nice bay windows...
- It's awesome.

Bay windows?

Of course.
They're all about transparency.

There they are.

Those who must be stopped.

Those who track your aunt's
metadata when she goes jogging,

because she happens to be
related to a person of interest.

- They work there.
- That's it.

I would tell an ordinary citizen

that they're the cyber
strong arm of the government.

To work there is to be part
of the problem, really.

Because they're really knee-deep

in the global
surveillance network.

I wonder what happens when
we reach the no-filming zone.

If we don't go beyond the
sign, we should be okay.

But we will be there in
about eight seconds.

There you go.

- "Breakin' the law."
- Story of my life.

Wait.

The reason we came to the
march against police brutality

was to see what
kind of surveillance

was conducted on protesters.

Would surveillance methods
be more conventional,

more technological?

So the CryptoPhone is the
device that was used in Ottawa

when IMSI-Catchers were found.

Same device.

I think it's highly
likely the Montreal Police

uses this type of equipment.

Here too, I'd wager.

This is a warning from the
Montreal Police Department.

Some protesters persist
in breaking the law.

Due to offences committed,

protesters are ordered to
disperse and leave the scene.

Otherwise,
we will be forced to step in.

I'm opposed to the
use of IMSI-Catchers,

because it not only affects
the targeted individual,

but everyone within range
of the IMSI-Catcher.

So everyone around
can be overheard,

can be tracked down here.

There isn't much to see,

the readings are not
showing anything abnormal.

Seems IMSI-Catchers
weren't used tonight.

For years,
the police denied using them.

So they were being manufactured
and sold, but to no one.

They caught me and took my cell!

Interesting.

The scenario is a thinly veiled
parody of North Korea, I guess.

Elections are being held in
the fictional kingdom of Rao.

It's rather unclear.

Seems we can either help
the regime or the rebels.

Now, we're helping everyone
to get more points.

Rao is basically a
fictional character.

People will think
he's North Korean,

but he's really based on
Mao, so more Chinese.

Everyone okay?

What are you working on?

Ah, nice!

Nice challenge.

NorthSec is a somewhat
elitist organization.

Since the event was launched,

we're the first to question
people's abilities.

They should hone their
skills to help,

because cybersecurity
is about helping people.

30 to 40% of our challenges
are won by all teams.

So about 60% of them go unsolved

by the end of the
weekend competition.

So people come here
because they know

they're really gonna
bust their humps.

They'll really challenge
themselves. And it's non-stop.

All hail Rao.

We can only vote once.

All hail Rao.

I think most people
with NorthSec

are against the idea
of mass surveillance.

Essentially, it's problematic,

giving so much
information to people

who have no business having it.

I was what's known as
a penetration tester,

a professional hacker,

in the banking world,
for several years.

When you work in this
field, in cybersecurity,

you realize that every scrap
of information is a key.

The more keys you have,
the more powerful you are.

And if this information
is misused, mishandled,

it can become a weapon
for many people.

So, of course,
most cybersecurity experts

are troubled by
mass surveillance,

because they know the stakes.

Why do it when it's
probably pointless?

Surveillance and intelligence
agencies already exist.

In Canada, we have one with a
relatively decent reputation.

Why do they need
more information?

Is it because they're...

...caught short?

Or are they simply really lazy?

Maybe they're lazy.

Subgraph is a Linux-based
operating system

designed to thwart
malicious attacks.

There are two kinds
of surveillance:

Mass surveillance, dragnets;

And targeted surveillance.

We try to prevent
targeted surveillance.

There's very little privacy.

Even people who are very...

shrewd about their
Internet usage,

their use of technology, even
they have very little privacy.

Among other things,
even if they're careful,

someone they know is posting
information about them

without their knowledge.

Foulab is a hackerspace.

It's really a collective that
offers its members resources,

and, above all, know-how.

So human capital,
in terms of knowledge,

for the sharing of
ideas and techniques.

In hacker culture, access to
information is fundamental,

in order to understand a system.

I call it an
open-source think-tank.

Now we'll rid this computer

of its malicious
piece of software.

The computer comes
with software,

which users are
usually unaware of,

installed by the supplier.

For example,

the NSA and ThinkPad
could have conspired

to install software to
access the computer remotely.

So we'll replace this
with open-source software

to ensure there's no backdoor,

or to simply make changes and
change the computer's features.

There. I have a copy
of the previous BIOS,

so I could configure
a new one here.

So I'll get OpenBIOS
or Coreboot.

I need to know the ins
and outs of a computer,

because I can't...

BIOS is at the
core of a computer.

It controls...

all functions.

So if we don't know how it works

and can't guarantee
its operation,

we can't guarantee the
computer's integrity.

So you can have the most
secure operating system ever,

but if the BIOS isn't secure,

unfortunately,
the rest won't be either.

Let me know if you need help.

Yeah, Mathieu...
if you could... hold it.

- Need help?
- Yeah. Thanks.

It'd be fun - it's
been done before -

to crack WiFi
networks from above.

So build a drone that flies
over and cracks WiFi networks.

Another thing would be - just
to prove it can be done -

to use an aerial cellphone
surveillance device,

like that used by the
police, known as a StingRay.

Essentially,
we do this to detect

critical flaws in
the infrastructure.

That's why most
people would do this.

The issue of what society
considers private and public

will define our generation.

What really worries me

is when neighbours
start pointing fingers.

We may well eventually
reach the point

where someone could
download a program

as powerful as a military weapon

and use it against
their neighbour.

Against their spouse, even.

That's what worries me most.

...3, 4, 5, 6, 7, 8, ground.

A mesh is a distributed network.

The idea is to have
rooftop antennas

to create a network alongside
commercial Internet service

and connect homes directly.

Like, connect
neighbours together.

I'm kind of discouraged.

Honestly.

People must change
their mentality,

but they seem unwilling.

They want "ubiquitous
computing."

They're willing
to be monitored by Amazon

24/7 at home through a device,

which they can order from
at the push of a button.

They use Gmail, Google
knows their every move,

their location, everything.

- What they think.
- Same with Facebook.

They're dominated by computer
technology - unwittingly.

Even when they know, it's: "I
can't do anything about it."

Basically, it's a lot
easier to monitor everyone

when they're in the same room.

We're gonna run about
10 feet of cable down.

Google, Facebook and the like
centralize information,

making surveillance easier.

If services are distributed,

it's more difficult
for a hostile party -

be it the government or
"black hats" - to spy on you.

It doesn't prevent
targeted surveillance of

a particular individual,
or even a group,

but it makes
dragnet surveillance

a lot more complicated.

Monitoring everyone at once,

then targeting
someone in particular.

Okay, the tester's hooked up.
Let's check it again?

- Let's do it.
- 1, 2, 3, 4, 5,

- 6, 7, 8, ground. - Done.

Excellent. It works.
It's all good.

Great. I'll plug into the wall.

The big problem now is
that huge corporations,

the world's most
powerful companies -

like Amazon, Google, Facebook,
Microsoft and Apple -

their goal now, their lobbying,

is geared toward
destroying the Internet.

Facebook's goal is to replace
the Internet... with Facebook.

They want you to go on
Facebook and stay there.

They entice you to
stay on Facebook

and away from ordinary sites.

Google is similar. They...

When you use search engines,

sometimes you're
stuck within Google

instead of going
to the real site.

So there are a lot of
forces at work preventing

us from re-distributing
the Internet

and make it the horizontal
platform it was devised to be.

There it is: Relais.reseaulibre.

It's the original
version of the Internet.

When I first went online in
'96, it was free.

We didn't pay for
Internet access, and...

...Internet access also
meant having a web page.

That was it, really.

It was about checking out
your friends' web pages.

What did he post? "Hi.
I'm Antoine. I play guitar."

With a picture of your guitar.

People had all kinds of stuff.

Then they started sharing
increasingly interesting things.

And it grew,

turning into Wikipedia,
into Google, and so on.

But it started with
someone in their garage.

Google started out
with a web page.

And I've always done that.

It's good enough for me.

That's it.

I don't need to connect with
all my friends on Facebook 24/7,

know the latest news,
the latest opinion,

Trump's latest fake news,
this and that on Facebook.

I don't want to be online 24/7.

For me,
it's something you turn on,

you go online, you're online,

then you turn it off
and you're offline.

I'm not always connected,

and I choose when to go online.

I call the shots.

I'm currently coding...

...what's known as
next-generation hidden services.

It's being completely
re-engineered

to improve security.

The concept of privacy
is extremely important.

Increasingly so.

If people are being monitored...

Today, it's not that
people aren't aware of it.

They know and accept it.

They're not acting in
bad faith or ignorant.

It's just the new normal.

When you know you're
under surveillance,

unconsciously or not,
you change your ways.

It really controls society.

So the beauty of Tor is,
whatever you do online,

your privacy is
protected to some extent.

I requested access
to information

from the federal government,

for all my personal information.

They sent me this letter,
which basically said:

We have your information on
file - maybe, maybe not...

I'm under investigation.

I was kind of proud, because I
must be doing something right.

I'm doing something useful,

and the powers-that-be clearly
aren't too happy about it.

So it's a vindication of sorts.

What's the conference
in Montreal about?

Okay, we're currently holding
our biannual Tor meeting.

We invite everyone -

staff and the community -
to get together, convene,

and over the course of five
days, we problem-solve, rally,

seek to improve Tor.

Any particular reason it's
in Montreal this year?

Yeah, a lot of people refuse
to go to the Five Eyes,

including Canada.

But especially since Trump,

I'd say at least half our
team refuses to go to the U.S.

- Half the team refuses...
- Minimum.

Can you explain why we
can't film the meeting?

Right. I mean,
these people are for privacy.

They don't want to
end up on Facebook,

have anyone know they came.

Some people here
literally can't be filmed,

because they're coming
here at their peril.

So, overall, their
privacy must be respected.

Projects like Tor,
like Subgraph, aren't winning.

This great surveillance machine
is obviously prevailing.

Clearly.

Of course, there's pushback now.

But I think we're 20 years
behind our rival, as it were.

The forces at work
behind this security and

surveillance campaign
are very powerful.

We're talking huge corporations,
governments, and so on.

So it takes tremendous effort

to make a real impact.