Technology Pill

This week we're talking to Gus about his experience being targeted by the Russian government, how it felt at the time, and then how it felt when he found out the government may be trying to undermine the tool he uses to keep himself and his family safe. Read more about Privacy International's challenge against the UK's secret TCN powers.

Join us this week as we discuss stories that have been in the news that we're still wondering about, obsessing about, and are as confused about as you are.Links* 2G phone networks are being shutdown; read the Rest of World story - PI's Low Cost Tech research - Listen to our podcast on connectivity and vertical mergers* Google anti-trust case and potential break up; read the Washington Post story - Google buy Wiz* Impact of USAID cuts; read the NY Times article - UK cuts - PI's work on aid funding surveillance; more of PI's work; even more PI work* Um-ing and Ah-ing; Read the Knowable Magazine story* Israel, data and AI: - AI targeting destruction; read the 972 story and the NPR story- Cellphone data for targeting - LLM tool collating surveillance data; read the Guardian story or the 972 story about this new LLM tool- Facial recognition; read the NY Times article about FRT- Read the BBC article about the US's last Afghanistan attack on an innocent man or find it in the NY Times* Outsourced memory; read The Verge article

This week we're discussing the 2024 incident in which a malformed update of CrowdStrike Falcon caused 8.5 million computers running Microsoft Windows to crash. Links- Read our in-depth article about what happened and what it tells us about the security and robustness of the modern internet- Find more about the 911 outages across several US states- CrowdStrike's own review of the problem- Our podcast on the XZ exploit- Facebook VPN exploitation- The philosopher Caitlin was thinking of was Paul Virilio

This week we're speaking to Eduardo from Transparencia Electoral about modern elections all over the world that they've observed, and Vladimir from R3D about the 2024 elections in Mexico. We find out more about the technologies that are at use in elections all over the world.LinksGeneral- PI's technology, data and elections checklist- Transparencia Electoral's report- Transparencia's index on data protection in LatAm elections- R3D's report: Censura electoralEpisode links- Obama's 2012 targeted social media campaign- Our work on Cambridge Analytica- Deepfake use in elections- Our report with the Carter Center on the Kenyan Presidential elections- Listen to our episode about our work in Kenya (Election Observation: Data, Elections and a trip to Kenya) on our website and where ever you get your podcasts- DemoTech by Transparencia Electoral- Transparencia on the Venezuelan elections- More information on Chinese tech used in Venezuela- Candidate assasinations in Mexico- Ejército Espía

This week we're talking to Peter Bloom from Rhizomatica and Lũa Cruz from IDEC about internet connectivity, what drives social media companies to expand into internet provision, and what an earth is going on with Starlink in the amazon rainforest. Links: - Read PI's research: https://privacyinternational.org/long-read/5409/decoding-vertical-tech-integrations-why-do-they-matter - Learn more about Rhizomatica: https://www.rhizomatica.org/ - Learn more about Lũa and his work on Starlink: https://www.thegreenwebfoundation.org/fellowships/lua-cruz/ - We'd love to hear from you! Share your thoughts, case studies, or ideas about vertical mergers using this survey: https://share.privacyinternational.org/index.php/apps/forms/s/MYipyBZjQMrnq9NmaNm5KJ6S - More about X and Starlinks' legal trouble in Brazil: https://www.theguardian.com/technology/article/2024/sep/04/elon-musk-x-starlink-brazil - Our podcast about competition with Dr Deni Mantzari (No Competition: Big Tech Big Problems): https://privacyinternational.org/video/5148/no-competition-big-tech-big-problems

This week we're talking about facial recognition in the UK. Our research shows that members of parliament (MPs) don't know as much as they should about facial recognition use in the UK. So, what is going on? And what do MPs need to be aware of? Links: Write to your MP: https://pvcy.org/endofprivacypod Our previous research about how much MPs know about facial recognition: https://privacyinternational.org/long-read/5155/uk-mps-asleep-wheel-facial-recognition-technology-spells-end-privacy-public Read more about the responses we got from MPs: https://privacyinternational.org/advocacy/5476/uk-mps-ignore-concerned-constituents-questions-about-facial-recognition-technology Liberty's case: https://www.libertyhumanrights.org.uk/issue/liberty-wins-ground-breaking-victory-against-facial-recognition-tech/More about Liberty's South Wales case: https://www.theguardian.com/technology/2020/aug/11/south-wales-police-lose-landmark-facial-recognition-case Our work on UK retailers' use of FRT https://www.privacyinternational.org/advocacy/5351/joint-letter-uk-retailers-regarding-potenital-use-facial-recognition-technology-frt

This week we take a deep dive into the issues around the rights and privacy of the global disability community in the digital age. We're joined by Rosemary Kayess - Vice Chair of the UN Committee on the Convention of the Rights for Persons with Disabilities, and the Disability Discrimination commissioner of the Australian Human Rights Commission, Marc Workman - CEO of the World Blind Union (WBU), and Heba Hagrass - UN Special Rapporteur on the rights of persons with disabilities. Links World Blind Union: https://worldblindunion.org/ Learn more about Heba's work: https://www.ohchr.org/en/special-procedures/sr-disability/heba-hagrass Report from the Committee on the Rights of Persons with Disabilies that Rosemary Kayess worked on: https://tbinternet.ohchr.org/_layouts/15/treatybodyexternal/Download.aspx?symbolno=CRPD%2FC%2FGBR%2FFUIR%2F1&Lang=en PI's work so far on this: Submission to the UN CRPD Committee on their inquiry into the UK social protection and rights of persons with disabilities: https://privacyinternational.org/advocacy/5321/un-committee-rights-persons-disabilities-calls-uk-act-ai-human-rights-risks OHCHR Submission and HRC oral statement on the rights of persons with disabilities and digitised social protection schemes: https://privacyinternational.org/advocacy/5107/submission-ohchr-rights-persons-disabilities Long read on the rights of persons with disabilities and digitised social protection schemes: https://privacyinternational.org/long-read/5170/protecting-persons-disabilities-digitised-world Robodebt Royal Commission report: https://robodebt.royalcommission.gov.au/publications/report An update: https://www.theguardian.com/australia-news/2024/sep/16/zero-repercussions-victims-of-robodebt-embarrassed-to-have-believed-justice-would-be-done

This week we're talking to Matthew Hodgson, one of the founders of Matrix - a network for secure, decentralised communication, and CEO/CTO of Element - a communications platform built using Matrix, about the regulatory environment matrix lives in, the difficulty of and the passion for interoperable communications at matrix, and the complications of building an encrypted communications platform both technically and in this day and age. Links for description: - Matrix: https://matrix.org/ - Element: https://element.io/ - Telegram's encryption: https://www.wired.com/story/telegram-encryption-end-to-end-features/ - Blah: https://www.vanillaplus.com/2014/05/22/2663-tim-brasil-deploys-amdocs-unified-communications-for-blah-service/ - Anatel Brazil Whatsapp arrest: https://www.reuters.com/article/technology/facebook-exec-jailed-in-brazil-as-court-seeks-whatsapp-data-idUSKCN0W34WA/ - eEuropean commission 42 point going dark plan: https://www.patrick-breyer.de/en/first-insight-42-key-points-of-the-secret-eugoingdark-surveillance-plan-for-the-new-eu-commission - Clipper chip: Listen to our podcast - https://privacyinternational.org/video/5332/cryptowars-short-history-encryption-politics - Online Safety Act: https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer - Liberty on the Online Safety Act: https://www.libertyhumanrights.org.uk/wp-content/uploads/2022/04/Joint-civil-society-briefing-on-private-messaging-in-the-Online-Safety-Bill-for-Second-Reading-in-the-House-of-Lords-January-2023.pdf - Adam Langley: https://www.imperialviolet.org/ - Pond.org: https://medium.com/@undercomm/secure-communication-pond-4985bfe85a2c - 'We kill people based on metadata' https://abcnews.go.com/blogs/headlines/2014/05/ex-nsa-chief-we-kill-people-based-on-metadata - PI and ICRC report: https://privacyinternational.org/report/2509/humanitarian-metadata-problem-doing-no-harm-digital-era - Matrix P2P tracker: https://arewep2pyet.com/ - Alec Muffett v Matthew Hodgson: https://www.theverge.com/2022/3/28/23000148/eu-dma-damage-whatsapp-encryption-privacy - PI's take on the Digital Markets Act: https://privacyinternational.org/long-read/5356/what-digital-markets-act-and-what-does-it-mean-our-privacy-and-wider-rights - Apple enable RCS: https://www.theverge.com/2024/6/10/24171315/apple-messages-rcs-ios-18-imessage-green-bubble - Chat Control: https://www.patrick-breyer.de/en/posts/chat-control/ - Cyber Resilience Act: https://privacyinternational.org/advocacy/5060/our-position-eu-cyber-resilience-act-cra

This week we're talking about a backdoor inserted into a popular Linux file compression tool, which had the potential to massively undermine the security of vast swathes of the internet. What happened? How did it happen? And how was it thwarted? Links - Andres Freund's Mastodon - where he revealed the backdoor: https://mastodon.social/@AndresFreundTec - Read more in Ars Technica's article about it: https://arstechnica.com/security/2024/03/backdoor-found-in-widely-used-linux-utility-breaks-encrypted-ssh-connections/ - Read more in the verge's article about it https://www.theverge.com/2024/4/2/24119342/xz-utils-linux-backdoor-attempt- Read more in Wired's article about it https://www.wired.com/story/jia-tan-xz-backdoor/ - Check out this excellent and very helpful diagram: https://twitter.com/fr0gger_/status/1775759514249445565 - The XKCD comic we mention: https://xkcd.com/538/

Welcome to the last of our short series on encryption. This week we're just talking amongst ourselves, luckily Gus is an expert on encryption - having been working in and around the encryption debate since the '90s. Links - Read more about PI's work on encryption here: ⁠privacyinternational.org/learn/encryption⁠ - Matt Blaze and crypto.com: theverge.com/2018/7/6/17540818/crypto-com-domain-matt-blaze-monaco-mco-cryptology-sale; you can now find Matt at mattblaze.org - More about ITAR and the export of cryptography: en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States - More about France's ban on encryption ending in this 1999 article from the Register: theregister.com/1999/01/15/france_to_end_severe_encryption/ - More about the Data Encryption Standard: en.wikipedia.org/wiki/Data_Encryption_Standard - Find out more about the Clipper Chip: gizmodo.com/life-and-death-of-clipper-chip-encryption-backdoors-att-1850177832 - Or take a look at this NY Times article from 1994 (paywalled): nytimes.com/1994/06/12/magazine/battle-of-the-clipper-chip.html - Matt Blaze's flaw in the Clipper Chip: wired.com/1994/09/clipping-clipper-matt-blaze/ - NSA Data Center: wired.com/2012/03/ff-nsadatacenter/ - NSA holding data: nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html - An old website that helped you sign up to be an Arms Trafficker: http://online.offshore.com.ai/arms-trafficker/ - Here's some of the RSA illegal tattoos: http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos/ - Phil Zimmerman's release of PGP: mit.edu/~prz/EN/essays/BookPreface.html - A documentary on this topic: reason.com/video/2020/10/21/cryptowars-gilmore-zimmermann-cryptography/ - The Reply All episode on Minitel: https://gimletmedia.com/shows/reply-all/8whoda

This week we speak to Ioannis, a senior lawyer at PI, about his and his colleague's work on the landmark case protecting encyrption at the European Court of Human Rights: Podchasov v. Russia. The case dealt with a Russian law obliging telecommunications service providers to indiscriminately retain content and communications data for certain time periods, as well as a 2017 disclosure order by the Russian Federal Security Service requiring Telegram Messenger company to disclose technical information which would facilitate “the decoding of communications”. Links: PI case page: https://privacyinternational.org/legal-action/podchasov-v-russia ECtHR judgment in the Podchasov case: https://hudoc.echr.coe.int/eng?i=001-230854 PI's work on encryption: https://privacyinternational.org/learn/encryption PI's report on End-to-End Encryption (E2EE): https://privacyinternational.org/report/4949/securing-privacy-end-end-encryption More information about the Marper case: http://www.genewatch.org/sub-563146

What do you know about cryptography? Have you ever wanted to get a better understanding of some of the maths behind encryption? This week we speak to Ed, a Senior Technologist at PI, about some of the history and basics of encryption. Find out more about encryption: - Computerphile on youtube (https://www.youtube.com/@Computerphile) is a computer science professor with a range of useful and accessible videos on encryption - Cloudflare have a helpful learning centre including this article on how encryption works and why cloudflare use Lava lamps to generate keys: https://www.cloudflare.com/en-gb/learning/ssl/lava-lamp-encryption/ - This is a helpful article on Diffie-Hellman including a diagram of the colours demonstration, which Ed discusses during the podcast: https://www.comparitech.com/blog/information-security/diffie-hellman-key-exchange/ - This article is great for learning more about hashing: https://auth0.com/blog/hashing-in-action-understanding-bcrypt/ - And if you're interested here is the wikipedia page on the Skytale sticks Ed talks about (https://en.wikipedia.org/wiki/Scytale) Learn more about PI's work on encryption: - PI's main encryption learn page: https://privacyinternational.org/learn/encryption - A PI report on the importance of End to End Encryption (E2EE): https://privacyinternational.org/report/4949/securing-privacy-end-end-encryption

This week we speak to Mark Nelson, a car mechanic and father of five, who has been forced to wear a GPS tag by the Home Office for the past 20 months, and his lawyer Katie Schwarzmann of Wilsons Solicitors. The pair have been challenging the Home Office's ongoing imposition of GPS tracking on Mark in the courts and are now awaiting a judgement. We explore the legal case, the ways the tag hasn't worked for long periods of time, and a dubious AI the Home Office has been using in decisions as to whether someone remains on a GPS tag. Links - Read more from Katie's law firm, Wilsons Solicitors, about the case: https://www.wilsonllp.co.uk/news/high-court-hears-first-challenge-to-the-governments-policy-of-gps-tagging-migrants - PI's Complaint to the ICO (the UK's Data Protection Authority): https://privacyinternational.org/legal-action/ico-complaint-against-uks-gps-tagging-migrants - Read more about relevant cases in which PI has filed witness evidence: https://privacyinternational.org/legal-action/uk-migrant-gps-tracking-challenges - The five companies at the heart of the UK's GPS tagging system: https://privacyinternational.org/long-read/5063/who-profits-uks-247-tracking-migrants - We tested GPS ankle tags, read how our experiment went: https://privacyinternational.org/long-read/5064/life-under-247-gps-surveillance-gps-ankle-tag-experiment - Listen to our last podcast discussing GPS ankle tags: https://privacyinternational.org/video/5074/gps-tracking-migrants-uk-who-profits

This week we talk about good things (or good-ish things) that you might have missed from 2023! Links Companies getting disciplined - Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc - Facebook getting fined for data exploitation in Norway: https://dig.watch/updates/meta-fined-98500-daily-over-user-privacy-breach-in-norway - CNIL fines Criteo: https://privacyinternational.org/press-release/5075/global-adtech-company-criteo-fined-eu40-million-france-unlawfully-collecting - CNIL fines Doctissimo: https://edpb.europa.eu/news/national-news/2023/health-data-and-use-cookies-french-sa-fines-doctissimo_en - Worldcoin (aspires to be World ID) has been getting some pushback from some countries: https://www.citizen.digital/news/data-protection-office-says-worldcoin-likely-to-tamper-with-data-from-kenyans-seeks-courts-intervention-n325472 Governments abandoning plans, or at least held to account - Kenya drops Huduma Numba and replaces it with new systems (it’s not any better and advocacy under way) but it’s still a sense of victory that they dropped Huduma Numba that caused some much controversy as highlighted by CSOs in particular through advocacy, research and litigation (which we supported led by Kenyan organisations like Nubian Rights Forum, amongst others) https://www.biometricupdate.com/202303/kenya-huduma-namba-funding-almost-entirely-cut-as-upi-digital-birth-registration-begins - MI5 win: https://privacyinternational.org/press-release/5027/press-landmark-ruling-exposes-years-rule-breaking-mi5 - UK Supreme Court rules against Rwandan policy https://www.ft.com/content/c040946a-c294-4a89-808e-46c8b2f2f414 - Colombia at the UN Human Rights Committee https://privacyinternational.org/advocacy/5080/pis-submission-un-human-rights-committee-regarding-colombias-compliance-iccpr - USA at the UN Human Rights Committee: https://ccprcentre.org/ccprpages/united-states-under-the-microscope-vast-participation-of-american-civil-society-organizations - Brazil at the UN Human Rights Committee: https://tbinternet.ohchr.org/_layouts/15/treatybodyexternal/Download.aspx?symbolno=CCPR%2FC%2FBRA%2FCO%2F3&Lang=en Legal protections emerging - Proposed US Privacy Act: https://www.wired.com/story/government-surveillance-reform-act-2023/ - New data protection laws adopted (they are not perfect but they exist) in India https://www.techradar.com/computing/cyber-security/india-approves-new-privacy-law-but-is-it-really-a-win-for-citizens and Nigeria: https://kpmg.com/ng/en/home/insights/2023/09/the-nigeria-data-protection-act--2023.html Innovations - Apple deciding right to repair actually matters https://www.theverge.com/2023/10/24/23930762/apple-right-to-repair-white-house-iphone

This week we have a think about generative AI. After a concerning Guardian article about deep fake scams, we ask the question: did we really understand the risks when we started a podcast? The audio clips featured in this podcast episode are the intellectual property of Smart Energy GB (Clip 1), Kim Kardashian (Clip 2), the Hollywood Reporter (Clip 3) and Lucasfilm Ltd (Clip 4). All rights are reserved to their copyright owners. Other links: - Experience: scammers used AI to fake my daughter’s kidnap: https://www.theguardian.com/lifeandstyle/2023/aug/04/experience-scammers-used-ai-to-fake-my-daughters-kidnap - 23 and Me hack: https://www.bankinfosecurity.com/23andme-investigating-apparent-credential-stuffing-hack-a-23267 - Deepfakes Can Help Families Mourn—or Exploit Their Grief: https://www.wired.com/story/deepfake-death-grief-hologram-photography-film/