All language subtitles for HAK MTL [2019]

Welcome to Metro-Optic,

one of Montreal's
main telecom centres,

which is a well-kept secret,

a major Internet data centre

serving the province
and part of Canada.

This room is located
beneath train tracks

in the bowels of Montreal.

About 75% of Internet
traffic travels through here.

Here we have more "private"
clients, as it were,

with their own exclusive room,
who wouldn't want it filmed.

So we'll move on.

- Who are they?
- A government agency?

- You can't say?
- They... Yeah.

It's very private.

Privacy
today no longer exists.

Take a look behind the
scenes of the internet,

and you'll see a great
surveillance engine

which is continuously
amalgamating

billions of data
points on all of us.

Surveillance today is no longer

solely the business of states.

The web in its totality
is today driven

by the collection
of personal data.

Web giants like
Google and Facebook,

they know everything about you:

Your travels, your friends,
your chronic illnesses,

your financial situation,
your political opinions,

your sexual preferences,
all your little secrets.

And just think about
all of these other

highly sophisticated services
that you can use for free.

They are fighting to
get access to your data.

But the internet today also
includes your televisions,

which are now connected,
your smart speakers like Alexa,

who are listening in on you
every second of the day,

your new vacuum cleaner which
is mapping out your home,

your child's Hello Barbie doll,

which is recording her voice
somewhere up in the cloud.

Wherever you go,
whatever you do,

you've become a
generator of data,

data stored who knows where
and used who knows how.

And all of this
data, is it secure?

Every month,
a new company gets hacked,

leaking all of your
personal information,

which then becomes available
to the highest bidder.

Bell Canada, 2017,
1.9 million leaked accounts.

Ashley Madison, 2015,
10 million accounts.

LinkedIn, 2016,
117 million leaked accounts.

Equifax, 2017,
143 million accounts.

Yahoo, 2013,
three billion accounts.

No one can guarantee that
your personal data is safe.

But there is still
some hope for privacy,

and hackers are the
ones showing us the way.

The internet is
their playground.

We must listen to them
so they can help us

imagine an internet
free from surveillance.

Of course...

the hoodie's a classic.

So trite, huh?

Anonymous mask,
a series of ones and zeros,

numbers, hexadecimals...

That's often
considered a bad thing,

a crime, that kind of thing.

Not so. There's more to it.

There are different
kinds of hackers.

Some do it for the money,
some do it professionally,

some do it for fun,
some work for the government.

There's no such thing
as a typical hacker,

because there are
different kinds.

Hackers seen in the
movies are just one type.

It's important
to make a distinction.

Hackers are part of
a global community.

They get together during
large and festive gatherings,

where the topic of
surveillance and privacy

is on everyone's mind.

First of all, I would like
to welcome you all to New York.

I want you all to
feel comfortable.

I want to ease your mind.

You are constantly
being protected.

First of all, we have thousands
of surveillance cameras,

they're only for your safety,
only for your safety.

There are, right now,
11,000 cameras, and growing.

In the city, there's
about 700,000 cameras.

11,000 of them are linked
into law enforcement now.

Not only do these
cameras go out 24/7, 365

and film licence
plates, 60,000 per hour,

60,000 per hour,
but they keep the data,

they share the data with
other companies like Vigilant,

which we're gonna talk about.

So far New York has a
buffer of four years.

So if you forget where
you parked your car,

not a problem,
we can help you out.

Your privacy is really dead.

Privacy, there's almost no
point in talking about it.

So when I see people
sharing their whole lives

on Facebook and on Google and
posting a gazillion photos

and putting up
12-year-old kids photos

that I would never
get any other way

and that sort of
thing, my feeling is,

"Thank you, I appreciate it.

"You've done me a big
favour as an investigator."

On the other hand, as a citizen,

this non-stop oversharing
of data creeps me out.

You've surrendered
that information.

You can't get it back.

You can't put the
genie back in the lamp.

This is a custom
wearable computer.

It now appears like
basically there's an iPad

floating a couple
feet in front of me.

You have trends that
are going off there

like Facebook
Messenger, Amazon Alexa,

that are listening
in to everything

that they have to say.

So we've gone off and
we've created a solution

that it securely jams
all of your microphones

and your cameras
inside of your phone

so that your phone
is not gonna be used

as a digital eavesdropping
device in the world today.

"Hey, how are you doing?"

You can do this, or it's,
"Smile, take a selfie,"

or, "Hey Google,
make this dinner reservation."

When it goes down from here,

it securely jams each one
of the microphones in here

to a level that's
never been seen before

that no one will be
able to listen in

to your phone whatsoever.

And then we also have
a cover over here

that allows you to
be able to do...

It's a Verde bag or a
Verde cage from here.

So when you slide this over,
this blocks your cellphone

so you can be underneath
a cellphone tower,

right next to a Wi-Fi
hotspot, et cetera.

You are invisible to the
world that is out there.

Groups were hacking into NATO.

They were telling the FBI
every week to fuck off.

Exactly.

And, you know, I actually,
during this period,

was having nightmares that
the FBI was gonna visit me

as someone who's studied
them, right?

There's very different
types of hackers.

There's those
precisely who break

into systems to improve systems.

There are those
who want to write

free and open source software.

There are those who are
into making hardware.

And then there's a group of
them who are really involved

in the fight against
surveillance and for privacy.

One of the reasons
why a lot of hackers

are aware of these
issues is precisely

because they know how easy
it is to surveil people.

Hackers get together at events

such as Hackers on Planet Earth,

the Chaos Computer
Club conference,

and they give
impassioned speeches

about the importance of privacy
and fighting surveillance.

We need heroes
like Edward Snowden.

Three cheers for Edward Snowden.

Hip, hip, hooray!

Hip, hip, hooray!

Hip, hip, hooray!

I believe that it's
fundamentally inadequate

as a solution

to restrict the use of
the data once accumulated.

The data will be misused.

It will be misused officially,

because our government's
rules for using it

have such loopholes
that it can get away

with doing anything it wants.

We need to do more than limit
the use of these databases.

We need to prevent
them from being made.

The level of surveillance
imposed on us today

is more than in the
former Soviet Union.

It's so much that there
is little room for dissent

or for whistle blowers, and
that puts democracy in danger.

We have to reduce the overall
general level of surveillance

to the point where
the state doesn't know

where each person
goes, and the state

doesn't know who
talks with whom.

I will never use Uber

unless it's
fundamentally changed.

It snoops on people,
which means Uber

keeps track of who goes where.

This should be illegal,
because it's too threatening

to fundamental freedoms that
are needed for democracy.

So, companies like
Uber should be told

either allow people to
get rides anonymously

and pay with cash

and not have to use any
device that tracks them,

or shut down, you're gone.

Because, when it comes
to something as important

as maintaining our democracy,
we need a stronger defence

than just saying that
companies have to ask users

to give up their freedom.

Getting the user's
consent for treating users

in a way that
threatens democracy

does not excuse it,
does not make it legitimate.

And do you yourself

consider yourself a hacker?

Of course.

I enjoy playful cleverness.

That's what it means
to be a hacker,

to enjoy playful cleverness.

Everybody's first
hack is trying to walk

the wrong way on the escalator,

'cause you've got a
system that was designed

to be used one way,
and you're trying to make it

do something different,
which it wasn't designed for.

That's the hacker spirit.

The pessimist in me thinks

the battle has been
lost for some time.

The mere fact that everyone
carries a cellphone,

the optimal surveillance device,

beyond George Orwell's
wildest dreams

when trying to imagine
an omniscient panopticon.

This is also fuelled
by social media.

I do it, too. Everyone does.

Anything that can be
monitored is monitored,

as well as monetized.

And the prevailing
business model

for all high-tech companies now

is the selling of
personal information.

It remains a cash cow
for these companies.

And all this is based on data
collection, mass surveillance,

and the slow but steady
erosion of privacy.

It's an Orwellian
nightmare of sorts.

And I think I can
help in that regard,

through Crypto.Québec,
what we produce,

with our podcast,
articles, training,

and what we say to the media.

These matters affect everyone,

though people may
not realize it.

They affect everyone,
so this must be addressed.

Welcome to the 37th edition of

Crypto.Quebec's
Watchdogs podcast.

Hosted by Geneviève Lajeunesse,

Luc Lefebvre,

Jean-Philippe Décarie-Mathieu,

And Sophie Thériault.

We have a lot to
talk about today.

I simply wanted to look back

on a little trip
we made last week,

myself, Jean-Philippe and Luc,

to the nation's capital, Ottawa.

We visited CSIS and
CSE headquarters.

- Just to check them out.
- From outside.

- Well, you tried.
- Right.

Can you see the
building back there?

Kinda.

I really didn't expect to
see Canada's cyber elite

across from Loblaws.

For real, it's... Imagine...

Like, a huge, magical airport
next to the Quartier DIX30.

- It's kind of like that.
- That's exactly it.

- With nice bay windows...
- It's awesome.

Bay windows?

Of course.
They're all about transparency.

There they are.

Those who must be stopped.

Those who track your aunt's
metadata when she goes jogging,

because she happens to be
related to a person of interest.

- They work there.
- That's it.

I would tell an ordinary citizen

that they're the cyber
strong arm of the government.

To work there is to be part
of the problem, really.

Because they're really knee-deep

in the global
surveillance network.

I wonder what happens when
we reach the no-filming zone.

If we don't go beyond the
sign, we should be okay.

But we will be there in
about eight seconds.

There you go.

- "Breakin' the law."
- Story of my life.

Wait.

It's no surprise
that we're not allowed

to film our Canadian NSA.

What is surprising, however,
is the fact that this building

is the priciest piece
of public architecture

in the history of Canada.

It cost us $1.2 billion.

This confirms that
internet surveillance

does not only concern the
United States and its NSA.

Intelligence agencies
like CSIS and the CSE

have far more permissive powers
to engage in surveillance.

And part of the problem with
how those agencies operate

is that a lot of not
only their activities

but also the legal
frameworks which authorise

those activities
exist in secret.

There is a track record
of abuse and misconduct

of these types of
powers, of overreach,

and of interference with
the democratic process

and with lawful
advocacy organisations

that I think is well evidenced.

There is really clear
material around that.

I mean, we also have
recently seen cases in Quebec

where there was government
surveillance of journalists.

Here, we're
referring to the surveillance

of journalist Patrique Lagacé,

as well as at least
nine other journalists

who were placed
under surveillance

by the Montreal
police as well as

the Quebec provincial police.

But this is just
one of many examples

that show how intelligence
and law enforcement agencies

frequently abuse their
cyber surveillance powers.

Through the Snowden revelations

we also learned of the existence

of numerous mass surveillance
programmes in Canada

set up by our
intelligence agencies

with little to no
legislative oversight.

In 2017, the Trudeau government
introduced Bill C-59,

supposed to better regulate
the powers of these agencies.

But for the critics,
this was unconvincing.

The problem is that the
framework they've set out

is profoundly permissive.

So I'll give you one example.

There are frameworks that
allow for the capture

of what the
government has called

"publicly available information"
or "publicly available data".

And the definition of that
is effectively any data

that could be accessed
publicly in any manner at all

or could be purchased.

So if you could imagine
every possible bit of data

that could be known
or purchased about you

that is in some way
justifiably public,

whether that's something
that you put on Facebook

or something that you said in
a radio interview 20 years ago

or the path you walk to school

'cause there's neighbourhood
surveillance cameras everywhere,

this starts to get
deeply, deeply invasive.

Another
chapter can be added

to this list: IMSI-catchers.

These devices can intercept
data from your mobile phones.

And in April 2017,
it was reported that at least

eight IMSI-catchers were
operating in Ottawa.

The RCMP later admitted
it was using IMSI-catchers

all across the country.

An IMSI-catcher is a small box

that mimics a cellphone antenna.

Your phone connects
to it automatically

and allows the
IMSI-catcher to intercept

your phone's unique identifier

or the IMSI for international
mobile subscriber identity.

Some IMSI-catchers can also

intercept calls
and text messages.

IMSI-catchers are
tremendously invasive

mass surveillance tools,
but they are a tiny,

tiny fraction of the
range of technologies

available to an agency like CSE,

and I think that we need
to put that in context.

So if your question is,

"How can I be surveyed
in the world?"

My answer to that is
use your imagination.

You know?

The reason we came to the
march against police brutality

was to see what
kind of surveillance

was conducted on protesters.

Would surveillance methods
be more conventional,

more technological?

So the CryptoPhone is the
device that was used in Ottawa

when IMSI-Catchers were found.

Same device.

I think it's highly
likely the Montreal Police

uses this type of equipment.

Here too, I'd wager.

This is a warning from the
Montreal Police Department.

Some protesters persist
in breaking the law.

Due to offences committed,

protesters are ordered to
disperse and leave the scene.

Otherwise,
we will be forced to step in.

I'm opposed to the
use of IMSI-Catchers,

because it not only affects
the targeted individual,

but everyone within range
of the IMSI-Catcher.

So everyone around
can be overheard,

can be tracked down here.

There isn't much to see,

the readings are not
showing anything abnormal.

Seems IMSI-Catchers
weren't used tonight.

For years,
the police denied using them.

So they were being manufactured
and sold, but to no one.

They caught me and took my cell!

Interesting.

The Montreal
hacker scene is alive and well.

Montreal is becoming
an important node

in the global hacker network.

Each year, over 400
hackers gather in Montreal

to participate in
the largest on-site

hacking competition in
North America: NSEC.

The goal is simple: Score
points by solving challenges

in bypassing security
systems and obstacles.

The scenario is a thinly veiled
parody of North Korea, I guess.

Elections are being held in
the fictional kingdom of Rao.

It's rather unclear.

Seems we can either help
the regime or the rebels.

Now, we're helping everyone
to get more points.

Rao is basically a
fictional character.

People will think
he's North Korean,

but he's really based on
Mao, so more Chinese.

Everyone okay?

What are you working on?

Ah, nice!

Nice challenge.

Six points.

Yes!

NorthSec is a somewhat
elitist organization.

Since the event was launched,

we're the first to question
people's abilities.

They should hone their
skills to help,

because cybersecurity
is about helping people.

30 to 40% of our challenges
are won by all teams.

So about 60% of them go unsolved

by the end of the
weekend competition.

So people come here
because they know

they're really gonna
bust their humps.

They'll really challenge
themselves. And it's non-stop.

All hail Rao.

We can only vote once.

All hail Rao.

I think most people
with NorthSec

are against the idea
of mass surveillance.

Essentially, it's problematic,

giving so much
information to people

who have no business having it.

I was what's known as
a penetration tester,

a professional hacker,

in the banking world,
for several years.

When you work in this
field, in cybersecurity,

you realize that every scrap
of information is a key.

The more keys you have,
the more powerful you are.

And if this information
is misused, mishandled,

it can become a weapon
for many people.

So, of course,
most cybersecurity experts

are troubled by
mass surveillance,

because they know the stakes.

Why do it when it's
probably pointless?

Surveillance and intelligence
agencies already exist.

In Canada, we have one with a
relatively decent reputation.

Why do they need
more information?

Is it because they're...

...caught short?

Or are they simply really lazy?

Maybe they're lazy.

The
Montreal hacker scene

also includes groups
like Subgraph and Peerio,

who develop internationally
renowned applications

and platforms which aim
to protect their users

from surveillance
and data collection.

Subgraph is a Linux-based
operating system

designed to thwart
malicious attacks.

Peerio aims to
provide easy to use,

beautiful end-to-end
encrypted communications

and collaboration
tools for teams.

Our goal is really
to be sort of a suite

and a whole environment
of tools that teams

and organisations can use in
order to secure their work.

There are two kinds
of surveillance:

Mass surveillance, dragnets;

And targeted surveillance.

We try to prevent
targeted surveillance.

If you're a journalist,
if you're a lawyer,

if you're a therapist and you
have all this communication

that's highly confidential,
we try to make sure that

communications that are
understood to be private

between parties are
actually private

and they're private from us.

There's very little privacy.

Even people who are very...

shrewd about their
Internet usage,

their use of technology, even
they have very little privacy.

Among other things,
even if they're careful,

someone they know is posting
information about them

without their knowledge.

Platforms that were
meant to provide

some kind of joy
and value for users

are being monetized in a way
that's almost adversarial

to the users that are
actually using it, right?

Like, your user,
who you thought was going to be

your customer,
suddenly became your product.

I find that quite tragic.

As elsewhere,
the Montreal hacker scene

was born in the
1980s and gave rise

to several hacks that
became legendary.

Rob Masse comes
from this period.

So I started in
computers when I was five,

on an Apple II Plus,
and I started telecommunication

and understanding how
phone systems work

when I was about nine.

There's no, necessarily,
rules at that time

about how to use computers
and how to leverage computers.

And my main goal when I was nine

was how do I download
video games for free?

The first component at
that age when I was nine

was phone phreaking.

Back then there was no internet,

but there was other
types of networks

of interconnected systems,

and we would use
the phone phreaking

to kind of get into those
networks and then leverage that.

A lot of the video
games I would play

are like, Dungeons and Dragons,
at the time it was Ultima.

And in those games, the goal
is to kind of explore the land.

Then you'd get into castles and
take gold and fight dragons.

So that's the video game.

It's important to
understand that context.

In the hacking
world at that time,

you would connect to the
X.25 network data pack,

and you'd be able
to go into castles

and take information and
leverage that information.

So for me it was a
question of just, you know,

hacking into systems
just for fun.

There was never any
malicious intent.

It was just a
question of learning.

I started going into
systems around the world.

It just happened to
upset a lot of people.

At the age of
15, Rob Masse connected

to a state network belonging
to the Soviet Union.

The year was 1989.

The Cold War was still ongoing.

The RCMP quickly took
notice of this hack.

So when I was in grade
10, 15 years old,

RCMP came to my house,
did a full raid.

And then,
after that I had to kind of

work with law enforcement.

Ultimately, over that year,

I would go to the
Ottawa police college.

The RCMP would sponsor me.

Other law enforcement
agencies from around the world

would come just to
listen to me speak.

Like, hey,
we caught this hacker.

Come see the hacker,
and he'll tell you

all about what goes
on in the hack world.

Did you work

for the intelligence
agencies after that?

I've been engaged by
various people to help them.

So that's the answer.

Today, Rob Masse
is a professional hacker

working to compromise
systems and individuals.

The traces we leave of
ourselves on the internet

have become one of the main
resources he can leverage.

I would say the two main
components of my background

personally is on the
instant response side

as well as what we call
offensive cyber security,

so breaking into things.

And we have a 100%
success ratio.

Unfortunately,
I don't think it's necessarily

'cause we're that great.

I just think that many of
the organisations right now

have the same challenges
on the business side

and on the security side.

And we're kind of losing the war

on cyber security right now.

My personal opinion on privacy
is that there's almost none.

If you are using social media
or any of those other services

where you're not a paying
customer, you are not

the client or the customer,
you are the product.

And as such, you trade your
personal data for that usage.

To break
free from surveillance,

hackers try to regain
control over computing

and democratise it.

In hackerspaces,
they dismantle and dismember

everything they can to better
understand computer systems.

Here the motto is "programme
or be programmed."

Foulab is a hackerspace.

It's really a collective that
offers its members resources,

and, above all, know-how.

So human capital,
in terms of knowledge,

for the sharing of
ideas and techniques.

In hacker culture, access to
information is fundamental,

in order to understand a system.

I call it an
open-source think-tank.

Now we'll rid this computer

of its malicious
piece of software.

The computer comes
with software,

which users are
usually unaware of,

installed by the supplier.

For example,

the NSA and ThinkPad
could have conspired

to install software to
access the computer remotely.

So we'll replace this
with open-source software

to ensure there's no backdoor,

or to simply make changes and
change the computer's features.

A back door is a point of
entry unknown by the user

that provides secret
access to a computer system

to the person who has the key.

Here, Matthieu knows that
a back door is present

in a component of his
ThinkPad, the BIOS.

The BIOS is the first
set of functions

that the computer
performs at startup.

A back door in the BIOS
would give full access

of the computer
to the key holder.

Several people could
leverage this back door:

IBM, that produces the ThinkPad,

Intel, that produces the BIOS,

the company that bought
all of the ThinkPads

for its employees, the NSA
or CSE, or malicious hackers

who are easily able to
exploit this vulnerability.

There. I have a copy
of the previous BIOS,

so I could configure
a new one here.

So I'll get OpenBIOS
or Coreboot.

I need to know the ins
and outs of a computer,

because I can't...

BIOS is at the
core of a computer.

It controls...

all functions.

So if we don't know how it works

and can't guarantee
its operation,

we can't guarantee the
computer's integrity.

So you can have the most
secure operating system ever,

but if the BIOS isn't secure,

unfortunately,
the rest won't be either.

Let me know if you need help.

Do it yourself.

This often means that things
won't go exactly as planned.

Hackers have become the
masters of trial and error.

Yeah, Mathieu...
if you could... hold it.

- Need help?
- Yeah. Thanks.

Danukeru is building a
drone from top to bottom.

If he can get his drone to fly,

he'll use it to perform
security experiments.

It'd be fun - it's
been done before -

to crack WiFi
networks from above.

So build a drone that flies
over and cracks WiFi networks.

Another thing would be - just
to prove it can be done -

to use an aerial cellphone
surveillance device,

like that used by the
police, known as a StingRay.

Essentially,
we do this to detect

critical flaws in
the infrastructure.

That's why most
people would do this.

If he is able, alone and
with his limited resources,

to compromise
residential Wi-Fi routers

using a drone pieced
together with styrofoam,

it's because there are
important security flaws

in our infrastructure.

We need hackers to
seek out and find

these flaws that
threaten our privacy

so they can be quickly patched.

The issue of what society
considers private and public

will define our generation.

What really worries me

is when neighbours
start pointing fingers.

We may well eventually
reach the point

where someone could
download a program

as powerful as a military weapon

and use it against
their neighbour.

Against their spouse, even.

That's what worries me most.

...3, 4, 5, 6, 7, 8, ground.

Resolib is a group trying
to rebuild the internet

one antenna at a time.

This is called a mesh network.

Someone who puts up an antenna

can connect with
other antennas nearby.

These users can connect
whatever they want

to their antennas: A hard drive,

a local internet site,
or other services,

and all of this without the need

for an internet service provider

or for costly
fibre optic cables,

simply by connecting people
directly to one another.

Each antenna acts as a relay.

A person can connect to
another, more distant person

by tracing a route through
all of the antennas.

As it grows, the mesh network
can cover an entire city

or even an entire
region, as is the case

with the Guifinet
mesh network in Spain,

which is now 35,000
antennas strong.

We can call this
a local grass-roots

and totally distributed network.

A mesh is a distributed network.

The idea is to have
rooftop antennas

to create a network alongside
commercial Internet service

and connect homes directly.

Like, connect
neighbours together.

So you can just buy metal
bands that go around.

Yeah.

Yeah, at some point.

I mean, it wouldn't be hard

to get back up on
the roof and do that.

Right.

Just so you can have
a clear conscience

that this is not a
permanent solution.

I'm kind of discouraged.

Honestly.

People must change
their mentality,

but they seem unwilling.

They want "ubiquitous
computing."

They're willing
to be monitored by Amazon

24/7 at home through a device,

which they can order from
at the push of a button.

They use Gmail, Google
knows their every move,

their location, everything.

- What they think.
- Same with Facebook.

They're dominated by computer
technology - unwittingly.

Even when they know, it's: "I
can't do anything about it."

So...

done!

Isn't that fucking beautiful?

Yeah, like I said, I gotta...

There's a plan,
there's a phase two.

There's a phase two here, yeah.

Basically, it's a lot
easier to monitor everyone

when they're in the same room.

We're gonna run about
10 feet of cable down.

Google, Facebook and the like
centralize information,

making surveillance easier.

If services are distributed,

it's more difficult
for a hostile party -

be it the government or
"black hats" - to spy on you.

It doesn't prevent
targeted surveillance of

a particular individual,
or even a group,

but it makes
dragnet surveillance

a lot more complicated.

Monitoring everyone at once,

then targeting
someone in particular.

Okay, the tester's hooked up.
Let's check it again?

- Let's do it.
- 1, 2, 3, 4, 5,

- 6, 7, 8, ground. - Done.

Excellent. It works.
It's all good.

Great. I'll plug into the wall.

The big problem now is
that huge corporations,

the world's most
powerful companies -

like Amazon, Google, Facebook,
Microsoft and Apple -

their goal now, their lobbying,

is geared toward
destroying the Internet.

Facebook's goal is to replace
the Internet... with Facebook.

They want you to go on
Facebook and stay there.

They entice you to
stay on Facebook

and away from ordinary sites.

Google is similar. They...

When you use search engines,

sometimes you're
stuck within Google

instead of going
to the real site.

So there are a lot of
forces at work preventing

us from re-distributing
the Internet

and make it the horizontal
platform it was devised to be.

There it is: Relais.reseaulibre.

It's the original
version of the Internet.

When I first went online in
'96, it was free.

We didn't pay for
Internet access, and...

...Internet access also
meant having a web page.

That was it, really.

It was about checking out
your friends' web pages.

What did he post? "Hi.
I'm Antoine. I play guitar."

With a picture of your guitar.

People had all kinds of stuff.

Then they started sharing
increasingly interesting things.

And it grew,

turning into Wikipedia,
into Google, and so on.

But it started with
someone in their garage.

Google started out
with a web page.

And I've always done that.

It's good enough for me.

That's it.

I don't need to connect with
all my friends on Facebook 24/7,

know the latest news,
the latest opinion,

Trump's latest fake news,
this and that on Facebook.

I don't want to be online 24/7.

For me,
it's something you turn on,

you go online, you're online,

then you turn it off
and you're offline.

I'm not always connected,

and I choose when to go online.

I call the shots.

But we are not about
to collectively disconnect.

Quite the opposite.

So how can we make sure our
privacy is protected on the web?

For many hackers,
encryption is the best,

if not the only, solution.

The first hackers who made
encryption a political issue

were called the cypherpunks.

Montreal made an
important contribution

to the history of
the cypherpunks,

and it was in great part
because of this man.

So the cypherpunks,
particularly in the mid-'90s,

were a group of people
who believed that

security and privacy should
come through technology,

through the laws of mathematics,

not through the legal system.

And the reason is that
legal systems change

from place to place
and time to time.

And one of the main
mottoes of the cypherpunks

was that cypherpunks write code.

And the point was to actually

not just talk about these things

but to produce
software that protected

people's privacy and security.

And a lot of what I
did over those years

was produce software like that.

The 1990s was
the decade of the crypto wars.

The U.S. government
had made it illegal

for cryptographers
to freely distribute

their encryption software,
under penalty of imprisonment.

To avoid legal issues,
many cypherpunks fled the U.S.

Many of them came to Canada.

This was definitely
one of the major reasons

that, when I finished
my PhD at Berkeley,

I returned to Canada.

So what brought me to Montreal
was Zero Knowledge System.

When we're on the
internet with email,

we say personal things.

We talk about things we might
not say in other places.

The internet is the worst
place to do that right now,

because that email is
not private at all.

So what Zero Knowledge
has done is gone back

and said,
"Let's make that private.

Let's give you all the benefits

of being able to communicate

and still have your privacy."

So we wrap your messages in
strong, cryptographic envelopes,

and we make sure
that the delivery

of those envelopes is private.

Privacy is going to be the
most fundamental battle

in the next hundred years.

It will be the battle
over your personal space,

the ability to say, "Although
I exist in a global community,

this belongs to
me, this is private.

You don't get to see
this part of my life."

And if we don't lay
that groundwork now,

the ability to say that,
to make that statement

20 years from now won't exist.

They sought me out, and
they wanted to build a product

based on the ideas I
had in my PhD thesis.

So I said, "Okay, I am gonna
help make the internet better,

help make it so that
people can communicate

privately online," and thus
started the Freedom Network.

The Freedom Network.

It was developed
here in Montreal.

For the first time, it was
possible to use the internet

with privacy built in.

There should be
no way to communicate

in an insecure fashion.

The network should just provide

the security and
privacy for you.

The Freedom
Network was short-lived,

but many of its
technical innovations

were integrated into what became

the most important
anonymity tool in the world:

The Tor network.

Tor stands for The Onion Router.

Basically, it's a web
browser that allows you

to use the internet anonymously.

Normally,
when you access a website,

the connection goes
from your computer

to your internet provider,

and then to the server where
the website is located.

It's easy for anyone who
wants to keep an eye on you

to know which sites
you visit at what time

and what neighbourhood
you live in.

But, by going through
the Tor network,

the signal has to go
through three relays

before reaching the
desired website.

Each relay only sees the
immediate source of the signal

and the immediate destination
of the next signal,

and all of this is
encrypted, of course.

Using Tor,
it becomes extremely difficult

to know who is accessing what.

But Tor also runs what are
called hidden services.

These are websites
ending with .onion.

They can only be reached
through the Tor browser.

Often, news outlets like
Fox News give a bad image

of onion sites,
describing them like this:

It's a secret world
used by criminals

to buy and sell
drugs, guns, sex,

just about anything
you can imagine.

But this
blanket criticism

suggests that all .onion
websites are used by criminals,

when, in fact, many
activists, journalists,

and community
groups heavily rely

on these services
to do their work.

And guess what?

The code that maintains these
services is made possible

by the work of only
two Tor employees,

including one who
lives here in Montreal.

I'm currently coding...

...what's known as
next-generation hidden services.

It's being completely
re-engineered

to improve security.

The concept of privacy
is extremely important.

Increasingly so.

If people are being monitored...

Today, it's not that
people aren't aware of it.

They know and accept it.

They're not acting in
bad faith or ignorant.

It's just the new normal.

When you know you're
under surveillance,

unconsciously or not,
you change your ways.

It really controls society.

So the beauty of Tor is,
whatever you do online,

your privacy is
protected to some extent.

I requested access
to information

from the federal government,

for all my personal information.

They sent me this letter,
which basically said:

We have your information on
file - maybe, maybe not...

I'm under investigation.

I was kind of proud, because I
must be doing something right.

I'm doing something useful,

and the powers-that-be clearly
aren't too happy about it.

So it's a vindication of sorts.

What's the conference
in Montreal about?

Okay, we're currently holding
our biannual Tor meeting.

We invite everyone -

staff and the community -
to get together, convene,

and over the course of five
days, we problem-solve, rally,

seek to improve Tor.

Any particular reason it's
in Montreal this year?

Yeah, a lot of people refuse
to go to the Five Eyes,

including Canada.

But especially since Trump,

I'd say at least half our
team refuses to go to the U.S.

- Half the team refuses...
- Minimum.

Can you explain why we
can't film the meeting?

Right. I mean,
these people are for privacy.

They don't want to
end up on Facebook,

have anyone know they came.

Some people here
literally can't be filmed,

because they're coming
here at their peril.

So, overall, their
privacy must be respected.

Some of the hackers and
volunteers who support Tor

want to maintain a certain
level of discretion,

but that doesn't make
them hooded paranoids.

Quite the contrary.

This is a community
that has understood

that change is only possible
through public debate.

So my name is Jennifer Helsby,

and I am the lead
developer of Secure Drop,

which is a whistle-blowing
platform that uses Tor.

Hi, my name is Arturo Filastò.

I'm a Tor developer,
I guess, from Italy.

We monitor the internet
and measure when

and how internet censorship
occurs around the world.

That is our Quatro,
as we call him,

which is our mascot,
the uni-octopus.

Yes, my name is Patrick.

I live in San Francisco,
but I'm originally from Ireland.

And I run some exit
capacity on the Tor network

as part of an organisation
called Noise Tor

with some volunteers.

My name is William Budington,
and I am a technologist

and security engineer at the
Electronic Frontier Foundation.

Well,
we're at the point now where

many major governments have
mass surveillance systems.

For just a few million
dollars you can set up

a mass surveillance
system in your country,

and we need to take
steps to protect

civil liberties
in this situation.

So, if you're at danger
in a repressive regime,

for instance,
then you can access the web

and access the internet in
a way that doesn't put you

under the danger
by your government.

It's useful for people doing
research, even domestically,

that they don't want necessarily
associated with their name.

I personally don't want
all of my search history

to be associated
with my identity,

because you never know how that
might come back to bite you.

Tor is the best way to
protect people's anonymity.

Without it, we couldn't
do the work that we do,

making sure that sources
can talk to journalists

in a secure and anonymous way.

So, what is the future
of internet privacy

when we all have things to hide

in an age of big surveillance?

Please join me in
welcoming Roger Dingledine.

How many people here know
the phrase "the dark web"?

Okay,
so there's this really cool,

from the journalist perspective,

thing where you get people
all excited and scared,

and they don't understand,
but there's this dark web.

So, basically they end up
with this terrible picture

of an iceberg,
where they're like,

"You didn't know, but there are
99 other internets out there,

and they're all other things."

And that's true; A lot of
the web pages on the internet

are things that
Google can't get to.

But approximately 0% of them

have anything to do
with Tor in any way.

Nonetheless,
Time Magazine was like,

picture of Tor,
picture of spiderweb,

picture of iceberg,
you should be scared.

And facts have very little
to do with any of this.

I think people are very
interested in privacy today.

People also feel,
to a certain extent,

that privacy can
be a lost cause.

We see private
information about people

being collected, and not
only collected and sold,

which is the primary business
of most of the data collectors,

but also collected and lost,

misused,

abused,

generally treated as though
it were an abundant resource

that there's no need to protect.

But I think there's
also a lot of hope.

I think more people
are using encryption

to talk to each other
now than ever before.

I think if you want to
have a private conversation

with someone on the
other side of the world,

there has never been a better
time in history to do it.

Who here knows the
phrase "lawful intercept"?

A couple.

Okay, more hands
than for "blue coat".

Okay, more hands
than for "blue coat".
So, lawful intercept
is the phrase they use

So, lawful intercept
is the phrase they use

for the back doors in all
the telephony infrastructure

and the internet
routers and so on.

And the goal is,
if somebody does a bad thing,

then we should be
able to tap them,

and there should be judges
involved, and so on.

And maybe that's okay
in the Western world,

but exactly the
same infrastructure

gets sold to Saudi Arabia.

And the guy in Saudi Arabia is
like, "What's that port for?"

And the answer is, "Oh, that's
the lawful intercept port."

And he says, "Well,
I am the law, plug it in."

The internet is more
centralised than you think.

There are only so many cables
that go underneath oceans.

If you're in Peru
and you want to send

an internet
connection to Ecuador,

it's gonna go through Miami.

That's just how the
internet is built.

And that means that there
are so many bottlenecks,

there are so many places where
large intelligence agencies

can go in order to grab traffic,
compared to what you think.

You might imagine the internet
is kinda like the world,

where there are a lot
of different countries,

and everything's spread out.

And I'd like an internet
that's built that way,

but that's not
how we built ours.

Writing software is a fun
and easy way to help the world.

If you're good at
writing software,

then there's lots
of things you can do

that aren't collecting
data on people

and helping people
control each other.

You could help people be free.

And it's a good thing
to do with your talent

if it's a talent you have.

And it's a good life to live.

Tor is one of
the most important tools

in the fight against
surveillance,

but it's far from
being the only one.

For almost every application
and platform you use daily,

there are alternatives that
protect your privacy online.

For messaging, replace
Facebook Messenger with Signal.

For your emails, use ProtonMail

or instal GnuPG and
encrypt emails yourself.

Replace Skype by Jitsi,

and Google by
DuckDuckGo or StartPage.

The alternatives already exist,

and their numbers are
constantly growing.

Most of these tools
are free software

or open source software.

Free software is developed

by online communities
of volunteers.

They freely publish and
tinker with the source code

of the software and usually
distribute it for free.

For Richard Stallman,
free software

is the main solution
to surveillance.

The alternative to
proprietary software is free,

"libre" software, software that
is controlled by its users,

that therefore respects
those users' freedom.

If you're using
a free programme,

you, as one of a
community of users,

are collectively
exercising control also.

If people are enthusiastic
about removing the snooping,

which they probably
are, they will spread

that version around,
and you will eventually get it

just in the normal course of
upgrading from time to time.

This is how free software
creates a defence

against malicious
functionalities,

for instance snooping,

and it's the only known defence.

And what Opid's
first projects do

is give you the source code,
and that's why it's free,

so you can take the source code.

And that really matters,
precisely because

it allows outsiders to
vet that source code

and let people know
you can trust this.

Facebook is not
open source at all.

And you don't know precisely
what their software is doing.

You don't know how their
algorithms are functioning,

so you don't know why
you see what you see.

If it was open source,
if it was open source

the way that Tor
was open source,

you could really
to an audit of it,

and you could
understand how it works,

and you could pick it apart.

It's a black box. Open
source is a transparent box.

Light.

It's only 1.1 kilos in weight.

This is a fully
functioning computer.

This is a laptop 3-D printed

so you can turn the
computer card into a laptop.

All right?

You have the right to
repair as well as modify.

So, 3-D printed,
you can just go down

to your local maker centres
and repair your own laptop.

If you get fed up
with the fact that

this is not fast enough
in a couple of years,

you just buy a
replacement computer card.

It upgrades, double the
RAM, double the speed,

double the processing,
et cetera.

Instead of throwing away
the whole $500 laptop,

you buy a $50 computer card.

So it's eco-conscious,
as well as saving money,

and blah blah blah, et cetera.

Now, the other thing is
that we've researched

the processors on here
so that the source code

for everything,
for the entire boot process,

is available online.

So there's no NSA back
doors in their processor

like there are in Intel ones.

It's full source code. So...

Facebook just won a
court case in Belgium.

They spent millions and
millions and millions of euros

to maintain their right to
build profiles on every Belgian.

You're worth money. You're
worth a lot of money.

You may have a right
to be forgotten,

but you're not
gonna be forgotten.

If privacy is an
illusion and it's dead

and everything,
what do we do now?

Okay. There has to be a sea
change in public attitude.

There has to be some...

I hate to say this, because
I am the most libertarian,

free commercial activity
believing type guy

on the planet,

but there has to
start being regulation

on Facebook and on Google.

The problem is you
and everybody else

look at them as if
they're a public utility.

We have water,
we have electricity,

we have the telephone,
we have Google.

They're a private company.

They own your data,
they sell your data,

they sell the essence
of who you are.

And there is zero regulation.

There's no regulation.

There's not a single
law in the United States

that allows you to say no,
or not that, or too much.

Google and Facebook
really don't give a damn.

They have the vast bulk of
all information out there.

Private entities.

Google, Facebook, Axiom,

Information USA,
Microsoft, Apple.

There's about 20 companies
that have the bulk

of the world's PII, personally
identifiable information,

and all the related stuff.

And there is no law
and no regulation,

nothing that governs
how they use it.

In May
2018, the European Union

implemented the General
Data Protection Regulation,

which aims to better regulate
the use of our personal data

by major service providers.

Meanwhile, in the U.S.,
Congress became interested

for the first time in
Facebook's business model.

It's clear now that
we didn't do enough

to prevent these tools from
being used for harm as well,

and that goes for fake news,

for foreign interference in
elections, and hate speech,

as well as developers
and data privacy.

We didn't take a broad enough
view of our responsibility,

and that was a big mistake,
and it was my mistake,

and I'm sorry.

This is
also true for Canada.

Our laws have to change
to better protect us

against abusive data collection.

But why isn't this
already the case?

Government doesn't
have the technical skills

or the resources to build a
Facebook and make you adopt it.

But they're perfectly
happy to take advantage

of the fact that
a Facebook exists,

and they can use it
to harvest information

for investigative and
intelligence purposes.

So I think that it's
right to acknowledge

that there is a bit of
a symbiotic relationship

between these corporate
actors and the state.

I don't think it's
right to think about it

in some sort of
conspiratorial way,

but just to say that I
think that government,

when they see these
private actors

having access to this
kind of personal data,

they want to get their cut too.

So, yeah, that's probably
part of the reason

there isn't a huge amount
of political willpower

to reign those kinds
of behaviours in.

Projects like Tor,
like Subgraph, aren't winning.

This great surveillance machine
is obviously prevailing.

Clearly.

Of course, there's pushback now.

But I think we're 20 years
behind our rival, as it were.

The forces at work
behind this security and

surveillance campaign
are very powerful.

We're talking huge corporations,
governments, and so on.

So it takes tremendous effort

to make a real impact.

A new world is
unfolding right before our eyes,

a world in which all our actions
and thoughts are monetized,

and where it becomes
truly impossible

to be hidden from view
and to be truly alone.

But the internet
could not have turned

into this surveillance
machine without our help.

This internet that
monitors everything,

we made it happen all together.

It's up to us to invent the
internet that will replace it.

A lot of people,
when they think of privacy,

they just think of, "Oh,
what do I have to hide?"

And that's not what
privacy is at all,

or it's the tiniest
part of privacy.

Privacy is about freedom,
privacy is about autonomy,

privacy is about
self-determination.

Privacy is about
being able to think

the thoughts for yourself
and not be coerced

into behaving or thinking
in a certain way.

It's about growing as a person,
especially for young people,

and it's about
growing as a society.

The fundamental thing is
the willingness to say no.

When you're offered something

and the price is your
freedom, say no.

The willingness to
do that is crucial.

It's a sacrifice that I
make to keep my freedom.

It's worth it.

More than anyone
else, Edward Snowden,

in his willingness
to come forward

with very concrete details
about surveillance,

has helped us grasp
the bigger picture.

He has helped us sharpen
our understanding

of the harms of
pervasive surveillance

and helped us see
how new technologies

facilitate ubiquitous spying.

These issues are
vitally important,

and this is why I
want you to join me,

not just in welcoming,
but in thanking,

Edward Snowden for
opening up the space

to discuss and
debate these topics.

Thank you.

The days where they could
monitor everyone, everywhere,

all the time, simply
what the government calls

by means of bulk collection,

which is the government
euphemism for mass surveillance.

They say, "We just want to
collect everything and store it

in case we want to
search it later."

Those days are numbered.

We are going to move towards
a freer and fairer future,

rather than simply the one

that has already
been laid out for us.

We are at a decision point,

and we could have
a very dark future

or a very bright future,
but the ultimate determination

of which fork in
the road we take

won't be my decision, it won't
be the government's decision,

it will be your
generation's decision,

and I'm looking forward
to seeing what it is

that you guys actually decide.