Who is Bruce Schneier

Bruce Schneier an internationally renowned security technologist, is the author of 12 books including; Liars and Outliers: Enabling the Trust Society Needs to Survive, as well as hundreds of articles, essays, and academic papers.

His influential newsletter “Crypto-Gram” and blog “Schneier on Security” are read by over 250,000 people. Schneier is a fellow at the Berkman Center for Internet and Society at Harvard Law School, a program fellow at the New America Foundation’s Open Technology Institute, a board member of the Electronic Frontier Foundation, and an Advisory Board member of the Electronic Privacy Information Centre. He is also the Chief Technolog

Transcript

y Officer of Co3 Systems, Inc.

A conversation with Bruce Schneier, hosted by Eben Moglen, at Columbia Law School NYC on December 12 2013, about what we can learn from the Snowden documents, the NSA’s efforts to weaken global cryptography, and how we can keep free software tools from being subverted. The talk was webcast live via the Internet Society Chapters Webcast Channel.

My favorite part about the NSA story all the NSA document on the code names I the code names are pretty cool I think we don’t have enough code names in our life and we should really think about where we can use code names I give you a few other a muscular a muscular is an essay is programmed to collect Google and Yahoo user data by eavesdropping on the trunk lines between their data centers I this is done probably with the help of level Communications level was their provider for those trunk links a Level ‘s code-named I is one is our little thing as a general rule that if your data supplier has an essay code-named probably screwed from day one this is different from NASA’s program to collect cool in Yahoo user data byte me dropping on the links between the individual users in the web servers on this as many code names depending on which service prior you using which which to where the tap point is and we feel on them Fairview Blarney storm brewing ok star London we don’t know who they’re referring to those to a different from prism which is NASA’s program to collect cooling ya who use the data by asking the companies directly another interesting program %ah codename is quantum quantum is NASA’s program to do real time packet injection from the network so almost cap want you to be passive on now they are are more active this runs on something called turmoil and there some programs here quantum in search in search packets quantum cookie is does something that forces you just to divulge cookies to Deanna the anonymized people on to something else called Quantum hand we don’t know what that is much as some quantum programs up another thing really cool code name is Fox acid fuck Fox acid is known as an again if they called an exploit orchestrator I just think I’ve Metasploit with a budget and this is a server that sits on the neck that you are trick to visiting possibly throughout through a quantum insert and and export to serve to you code names I include validator United rake are know probably worse code-named ever egotistical giraffe me I think at the end of a lunch in the individual draft people sit in the corner while the fact that some people get the main table a one-shot the part a fox acid that determines which exploit you get is called ferret Canon action not making these up although there are several fight on the web that do make these up which is kinda neat are other implants you can get a black art mineralized Highlands vagrant are one night’s talk about my blog I yesterday was called somber native and its its coolness is that a jump their gaps it sits on computers not on the Internet turns the wireless honoree not paying attention send stuff over it and turned it off again a lot of code names for surveillance tools evil olive is the IP location database that kinda monitors wherever on the planet is about a cell phone a lot so their analysis tools are we see Marino we sippin whale main way X ke score a bunch of others unimportant code name is boron Bull Run is the NSA’s program to deliberately subvert the security I love products protocols standards that we all use there’s a lot me no one’s done a code name database yet but we’ve seen hundreds %uh the main takeaway is that the NSA’s turn the Internet into a giant surveillance platform and this surveillance platform is robust is robust politically legally and technically why I started by listing different ways the NSA has it getting at Google and Yahoo user data using three different alliances with companies three different technical means an access and three different legal authorities and that kinda robustness is not an exception by the same is gonna be true for cell phone data for Internet data and everything else I we’re seeing in public is in the NSA continues to lie about its capabilities and a lot of this is hiding behind tortured image interpretations of words like elect or incidentally or target or directed I we see a lot of the same program cloaked in multiple code names to hide what they’re doing and whenever someone testifies the NSA is not something is not being done under this program or under this authority in guarantee you it is done under some other program or someone other authority my dad is a there’s a lot of sharing between organizations and this really has to come out very much now we’re seeing the NSA documents but a lot is shared with the CIA FBI in our Odea other five ice countries at i is is a US UK Canada Australia New Zealand kinda rich English language speaking countries club know what we’re seeing some attacks we’re seeing insa sharing day with DEA in telling a lie about it the terms call parallel construction we’re seeing summit the NSA devices for for faking cell phone towers and and grabbing a cell phone data very similar to stingray which the FBI’s program probably the same technology and fundamentally the NSA’s mission is to collect everything and you see those shorts the slogans permeating the documents collected all know it all exploited all in these are what the agency is trying to do and you see it in so the far-flung reaches in the programs programs to collect are internet data from airplanes I programs to collect the chat conversations in virtual world maybe not that’s relation to see the mentality at its most extreme that there can be little pockets upon clicking communication and and to understand that you really have to understand the NSA’s history where that mentality comes from and the NSA was born during the Cold War where r through a voyeuristic interest in the Soviet Union was normal that’s what we did and we collected a lot of data it something useful on a bit not a lot that depended on whether to tackle her sister t-check Lily a lot here learn the capabilities in the new Soviet tank that is to pick up or communism right ones a lot more tactical and mister ubiquitous collection mentality really should I did the cold war but I got a new lease on life get the shit ember because that’s when the intelligent agencies got an impossible mission never again make sure this never happens again and if you think about it if you’re given that goal a making sure something never happens the only way you can’t possibly achieve that is to know everything that does happen and when the enemy change from the Soviet Union over there to the terrorists in this room the giant I A which was looking over there now have to look everywhere and that looking everywhere has been aided by by technology i buy the natural trends about it. and fundamentally data is a byproduct of the information society everything we do on a computer creates a transaction record and so data becomes a byproduct all the internet age socialization we do because everything we do is increasingly mediated by computers and this data is increasingly so restored an increase in a searchable and this is just more law buy data storage drops to free data processing drops to free and becomes easier to save everything in the figure out what to say and the result is were all leading digital footprints everywhere in our life may cloud computing exacerbates this and it has a lot of certain natural properties have come out wholesale surveillance I follow everybody we’ve been possible before surveillance backwards in time follow that guy last month I did the death for the femoral conversation systems that never forget may need something i think is gonna change our society enormously have a really grappled with and none on this is a result on now I’m now say by his part addition just the way computers work so the result is a public-private surveillance partnership and is a fundamental Alliance business and corporate interests and we have built systems that spy on people in exchange for services right surveillance is the business model and the Internet an allotted NSA surveillance piggybacks on corporate survey looks whether it’s getting internet cookies whether it’s using your cell phone as a tracking device either directly up because you have a GPS or through the cell tower or through ap set transmit location up the code name for that one is called Happy what tako danger cool I and everything else is the combination over collection and covert collection which is also came from a cold war me it was pretty often we would go to US companies and say hey you know you’re getting truck communications know what’s up act we we wanna access to them we also had a tap undersea cables in the soviet union cuz we couldn’t ask them nowadays over collection is complex right we see cooperation a AT&T can you jump in everything share purchase stuff in the closet over there don’t tell anybody we see bribery we see threats we see compulsion I’d this is truly the Golden Age our surveillance because everything we do is now serve a little by and it’s not only meta-data I think this is one another the biggest PR losses we got on the president said it’s only met actually show he says he said twice don’t worry nobody’s listening to your phone calls I hate the fact that he’s using the word listening twice in use reporting transcribing analyzing reading I don’t know but it kinda bothers me you like you are listening netted eight equals surveillance medicine easy thought experiment imagine you hire private active to eavesdrop on somebody that detective will put a bug in is nice car his home his office you get a report and the conversation she had US that’s a detective put under surveillance you get a different report where he went who we spoke to what he read when he purchased when he looked at right that tormented fundamentally myd equals surveillance data and in a lot of ways meta data is much more important conversation contact you learn a lot more about what’s going on from the surveillance data in from the east dropping their something that hasn’t talked about much are they are the analysis tools the NSA has some really sophisticated Altis tools going through this data %uh the good example of this was the Washington Post article on the cellphone location database and they had a few examples so the NSA look to this day to day to day basis for everybody’s movements around the world and they look for pairs are people coming to keep coming near each other turning their phones off and then turn their phones on to get an hour later going way for each other I they look a secret meetings they know the phone numbers I love US agents overseas and they look for phones that are roughly tracking their location look for people had of web tails on are they look for for anonymous phones that get turned on mutual while turned off another phone is turned on in the same place in use for a while look for burner France my and that’s just one database your last week are we so ray research project from the UConn the Canadian an essay from some with the job title tradecraft developer which we should all aspire to and he’s looking at at IP data I’ll people’s loggins and geolocation data IP addresses and trying to tell I if an airport looks like a hotel or office right L Davidson what the IP address was and then if you can find people who don’t want to be found based on who’s logging in where intruding into airport turns out my shop in much the same research and patented it and I schorr where this all stands now but there’s a lot on this and unfortunately a public debate tends to focus on particular collection I dove a rise in cell phone calling record database but it’s never that right its Verizon meta data plus contactless collection from plus a very some data mining techniques orchard drones with cameras plus face recognition plus Facebook tag for a database and anaphase location tracking I love up phones Mikey you start looking putting the things together any she’s in very sophisticated analysis and hopefully more stories about that I another thing this is actually not just about the n/a site or really just even about the US right the US has a very prudent privileged position on the Internet but this is really about general techniques I we get this extraordinary window into the NSA’s activation a stone documents but none in this is something any well-funded nation-state adversary would not do right there the techniques in quantum are pretty much how China runs the Great Firewall I Russia Syria Iran use a lot of these techniques and remember technology spreads today’s NSA programs become tomorrow’s PhD theses the next day’s hacker tools I’d show when we see be a lot easier to say programs what we’re seeing is a three to five year window at the criminals are going to do n/a waterways that fundamentally is the harm I knew we had built an insecure internet for everyone we basically enable the panopticon right all the losses a freedom and liberty and individuality that come with that you know we now have a complete loss of trust in technology and protocols in the institutions that govern the Internet lotta corporations that provide cloud services or infrastructure equipment now unfortunately their allotted details we don’t know these documents are NSA only I don’t think is a thing on US Cyber Command and they are salient only I see nothing on CommSec and company names are very very rare now that prism slide the list the company names we’re all excited because we see company names like the only one a lot of things company names are hidden behind code names and these code names are classified ECRI extremely compartment the deformation near as I can tell that means are not written down so in a lotta cases we’re just not going to know who is compromised how their compromised we just don’t know that a lot of things are compromised yeah in some ways this is might be better if we knew the names we get just chase yesterday’s problems rather than working on tomorrow solutions and really we have a choice we can build an internet that is vulnerable to all attackers for dinner that is secure for all users I basically we have made surveillance too cheap for fill the solution is to make inexpensive again noted that some good news bad news here it is first interview are after he became public and which known talked about it and he talked he said from encryption a set encryption works properly implemented strong cryptosystems or what are the one thing or what are one of the few things that you can rely on and this is an important lesson crypt under feet works by this is the lesson at NASA’s attempt to break tour NSA can’t break to or and it pisses them off this is the lesson I love the NSA’s program to collect up contact list for the backbone I if you look at their art collection data they cloaked in about ten times the data data from Yahoo there from Google which seems odd because Google made at ten times as large as ya ho but at the time Google used SSL by default and ya who did not so is a much more fruitful avenue of attack right this is a lesson that muscular there’s a great hand-written back in the napkin diagram in the moscow presentation which points to the point where the SSL has been removed so the data can be great cryptography works the MathWorks up unfortunately the next sentence a wince known as reply to a question is an equally important unfortunately endpoint security is so terrifically week that the NSA can frequently find ways around it item after works but Matt has no agency it’s the stuff around the map that is most vulnerable now we do know there exist some piece of crap analysis for the NSA Haus me some peace right we we know this we can guess this because they make a huge investor the mathematics the base we hire the top percent to the country’s mathematicians every year presumably they doing something and enough a document called the Black budget which was also released in August are there’s an introduction by the Director of National Intelligence James clapper and there was one sentence in it and the sentence kinda just went there on a contact so I’ll give it to you I think the words are important we are investing in groundbreaking crypt analytic capabilities to defeat adversarial could talk for free and exploit internet track so that quote doesn’t sound like we’ve hired a bunch a really smart math guys are hoping to get lucky that quote sounds like we’ve got something it’s on the enjoy love engineering practicality and we’re working to build on the massive supercomputer the big memory array the huge interconnection project but nothing we need now we don’t know what that is I have forget this at three but some chechen fourth the first elliptic curves it is a lot American elliptic curves added it’s reasonable to assume that there exists some pretty good crypt analytic techniques inside the NSA that are now outside that either a exploit occurs in general or some unknown to us class elliptic curves we do know that the NSA is attempted to influence curb selection ice that points to that the second is some general advances in factoring run if you look at the academic world factor in gets cheaper factor attend here factor to their factor there Houston the NSA is years had to say the art you to plot the curb and see where they are might probably plausible I third possibility is rc RC force a stream cipher in a fire under their ass to long time ago and it is just on the edge a break ability it’s a beautifully designed site for that we just can’t break but feel like we should be able to in their like im going to lock the reasons why plausible that they have something very commonly used on the lastest some %ah technique to exploit better in a red band random number generators a lot a better image enters out there you can explain when I can do very well and that’s the sort of thing might mean want some large engineering project to build the computing system to the hardware parallel system to do that right but we still we know that most could talk for free gives the NSA trouble at least at scale rightmost how the NSA break script out is by getting around it bad implementations default or we keys sabotaging standards the liberal insuring back doors and products or are as it’s known export Trading keys actual trading equal stealing but we do know that there is a key they wont my son default VPN key that’s being used by this circuit they wanna listen to go and get right stole mostly the NSA relies on on a cryptid steam streams to track right internet data that’s not a cryptid cloud services are in a cryptid cell phone data cell phone meta-data other third-party data right so here’s the problem again we’ve made it too easy to do ball collection where we want is is cal the targeted access operations unit that we want well we don’t want is bull run so the solution is here are are very if they’re complicated and I think that’s necessarily so i the problem is complicated and it’s going to include government self corrections tactical countermeasures legal countermeasures international cooperation adding a major shift and how we think about security privacy globally I thought talk about those one at a time source of Corrections inside the NSA but amazingly as it may seem the NSA had no contingency plans for all their secrets being leaked it took them what six weeks to get a PR firm with the proper clearance to get there messages out i mean that they fix pack but it really is surprising and the political cost-benefit analysis is changed by the political blowback from the NSA surveillance abroad has been enormous and this will limit what the NSA does I politically is a fundamental changing nature secrecy going on i think is a major generation gap here maine use to be when you join Intelligence Agency you were picked from college you enter the club you were there for life is kinda like the movies you taken a to care for you to care for them that kinda love quid pro quo doesn’t exist in a world of contractors it’s known in to work for the NSA he worked for a contractor you know job security a Chelsea Manning was on a four-year tour and these people are looking at this relationship very differently then a career NSA analyst I and the NSA’s gonna have to incorporate the risk exposure into what they’re doing and I have to assume that everything they do will become public in three to five years and that’s important could have Snowden told us the NSA spying on North Korea and the Taliban nobody would care so we wish Brian on belger or I get to the UK with spying on Belgium which is like Connecticut spying on the Braska rightness risk analysis changes I think there are going to be self corrections inside government now this effect in this a bow collection is being challenged the last two NASA directors general alexander and it before in general high in were both believe in collect everything but there is a contrary belief that this isn’t effective and their fundamental limitations on intelligence this collect everything mentality might not be the smartest their self correction going on inside corporations pain use to be cooperating with the NSA was cost free because the NSA assured you nobody would ever no and now nobody believes that so we’re seeing a lot more fighting back and the public opinion is very much against companies that are cooperating specially overseas we’ve seen lots a public announcement some loss of sales Cisco IBM the Cloud Security Alliance AT&T all talk about losses sales because Ms by there now lobbying for more openness because they need the world to trust them with their data makes reputation matters here a lot which means you gonna get a lot less cooperation and we know Yahoo for a court case and what where we’re happy pick for that so LinkedIn there a lot of technical things to be done me fundamentally the NSA might have a larger budget than every other intelligent Asian the world combined but they are not made of magic night so our goal should be to leverage the economic the physics the math make eavesdropping more expensive whenever girl in a targeted collection we don’t know enough to build computers that are secure from a targeted attack but we can build protocols that a secure against ball collection summit this is redesigning protocols ubiquitous encryption on the internet with solve a lot of this quitting the backbone becomes important I provide real security as both attacks provide cover travel with those idiots they live Warren Christian in the cloud I better forward secrecy week I don’t know what to do here we have to do it me redesigning somehow products and services to build security and unusable securities heart no less than a twenty years a PGP -click encryption is a one-click is too much but we have counter acting lessons from Sunoco TR really easy to use powerful chat caption program or a full disk encryption very easy to use no latency me or even notice it by some were endpoint security more clout encryption especially on phones better anonymity tools better integrated at any tools more open standards more open source for this is the stuff is harder to subvert not impossible but harder target dispersal they were way more secure with a hundred thousand ISP’s that when there are simply because there are more targets and the lab I left one is my hardest is assurance I we need the ability to test whether a program does what we think it does and nothing else anything along the laws those line to be incredibly valuable it is a lot we can do technically but largely I think this is a political problem and it’s a difficult political problem we are now past the point where simple legal interventions can help maybe look at some other things the president is proposing they focus on particular collection programs particular authorities it’s too late for that and the systems are way too robust but we sure don’t know what the political solution kinda looks like I transparency oversight accountability this is fundamentally how we secure ourselves when we have to give institutions power over us and problem is that law some lag technology I’m a quote from from general hide game this coat after he was charge the NSA butter into really good one ace talking about capabilities and that the NSA follows the law and that’s what he says he says given me the box you will allow me to operate in I’m gonna play the very edges up that box which is something you’d probably expect agency to do tell me the rules and I’ll follow them to the absolute limit and the problem here is that technology country makes the box bigger sold the laws here now don’t cover all that new area and the NSA russia’s Philip because their way faster than the loss so the best the best we can do is make laws that attack largely invariant and I we can think up some other bylaws preventing ball collection ammunition Americans in laws prohibiting the NSA from delivered the weakening security products and services again the problem here is robustness but of course it even if we do succeed here reining in the NSA only affects United States it’s probably impossible right now that we’re getting laws passed that protect non-us persons certainly anything we do doesn’t affect the actions of other countries made a friendly or not and you care this argument occasionally if you rain in the NSA then China will do it and China will win and that’s fundamentally an arms race argument and is a zero-sum game here it’s us versus them it’s not us it’ll be there that is a fundamentally flawed frame and we will never solve this as long as we’re in that frame we actually need to get governments to realize that a secure internet is an everyone’s best interest and it doesn’t matter what China does we need to secure the Internet good with that doesn’t turn zero-sum game into a positive sum game you have laws in treated to support that you technology to support the laws you have laws in technology deal with not complain actors state actors non-state actors it doesn’t solve the problem I turns into anyone those other really hard problems like money laundering or nuclear nonproliferation are human trafficking or small arms trafficking but at least in those we all know where we’re headed I would not be able to solve the problem we can know where the solution is smelled a special place looks like we aren’t even up to that point with surveillance but we can do this the NSA has a dual mission it was from the cold war protect our communications attack their communications works really well when ours and theirs were different works less well when Arsene there’s the same when we both use microsoft windows and TCP IP in PDF files Ryan Dell hardware right that dual mission was very unbalanced after / an e rebalanced my me again the surveillance here’s robust it’s politically robust it’s legally robust is technically robust and we need to solve this not just for the NSA but for everybody other governments cybercriminals rogue actors but we have to believe that a secure internet is vital to our society in the near term I don’t think we’re gonna win the stop doing this argument I did the best we can do right now is the tell us what you’re doing argument but eventually I do think we’re gonna win the protecting is more important any shopping and that just because everyone else is building a national line we shouldn’t do it too and if you think about it this problem is bigger than surveillance this is fundamentally a problem about data about data sharing about surveillance is a business model about the final benefits a big data personal risk for personal data and we have a lot on those issues I behavioral data for advertising I Health Day i think is the cleanest formulation if we took the medical data everybody in the country put in a large database the research benefits would be an enormous yet it’s incredibly personal how do we do that and mean that the same thing we see with Google Maps maybe let Google surveilling you everybody they’ll give you better traffic data you can get home faster yet hey this appealing everybody it this problem comes up again and again how do we design systems that benefit society as a whole while the same time protecting people individually so I think this issue is the fundamental issue the information inside this is the one that we will struggle with solving for decades this is the one that our grandchildren look back at us how bad we were at solving it and this is the one that’s important and we have to start thank you here somehow they take questions there’s a microphone there there’s a microphone there and people will stand behind them and not hold up their hands like that I will call on them one after the other and we will have minutes %uh find Questions is expert in MIT ever been with that question for you herbal was leaking documents am I knew this was the blackberry head given the NSA difficulty when they started putting their traffic and Skype was also to confer immunity to break a rule to break the bush communications but not the text via video communications I notice also the regenerator PGP key after you for seeing the documents before been RCA’s was a for those bit RC subkey but you kept this Jenner default am excuse me algorithms in the PDP set so my question is given it suggested there some kinda differential attack against metre key cryptography this person on plane test texter statistically based do you really trust des AES in your PGP key I trust as and very much I so I don’t believe there are those cabal attacks think primarily what’s going on are Rd fourth I’m not having access to the keys badelain tations that has not been there the math does fundamentally work I think this is a big issue because there’s a lot of utility out there as a lot of no we can’t do anything so why bother we have to fight that and there’s a lot we can do and fundamentally I think pgp works and I i moved it to the highest default because why not driving them out care about the latency when encrypting email sold her does it’s prudent to do that but I do not believe they’re they’re breaking tripled as and breaking as on the fly I think I just don’t think the math I don’t mess a port that based I there my name’s Peter Rainer GM from MIT a question about National Security Letters so this but on this discussion about whether I corporations are permitted to report on the number vessels they received in the number that they complied with my question is this is there any reason why we should believe that corporations are being served with an S l’s and not simply their employees behind their managers backs if I’m running in it for me in information company I’m running an Internet company how can I even trust my employees not to hand over my you know certs to the NSA under an SL so that’s true it’s so I’m less worried about NFL’s I think they are sent through the front door but I actually the NFL’s are just legal cover for the essay got the date already somewhere else and they want that process to make it more legal para la I wouldn’t worry much more about individual engineers cooperating that if someone comes to you as a patriotic employees up got some company and says hey look this is going on obviously you want to help the mine you’re just turning on this main sport and looking the other way and you do it and you nobody knows I’m mucho worried about collusion at low levels than I am with Neil compulsion to level I think once you’re doing legal compulsion it goes to the legal office and that’s my guess but II that is a worry I worry about with with the more informal ways of cooperating you know %ah why don’t you just the you know put this mask on the ID and don’t tell anybody or early get over here and don’t tell anybody right at that time a bit much easier to do without anybody’s approval plea is there any reason to be concerned that on like a piecemeal effort to secure some he’s a data will actually draw more attention to their data you know like if I encrypt only one email to like one particular person then is that worse than simply sending in cleartext so it’s better or worse right we do know that the NSA does flag and shave encrypt the data because it’s not much in it seem as though say that all could you might find useful Sunday right you might get the key somehow so yes using encryption does flag you which is why I think the solution is not to not use at their discretion to use it for you to use encryption you provide cover for those who need it and that’s a good thing but we do know that using encryption is a flag yes my name is Lee Nikki cm from Harvard Law School and we similarly have discussions about anything what to do about it but they’re completely devoid any technical knowledge about what’s actually going on and I’m curious if you think that there should be a push a mine lawyers and policy makers who are interested in this and discussion to inform themselves a bit or if we should just work on their transparency oversight general quality of solutions and my Mitu people think about other stuff change you know I think the more techies impossible to talk to each other the better tech and that a policy we get a and this makes it hard understanding these issues is difficult very technical and I don’t think we can craft policy without understanding how these systems work how robust they are i think is critical and in general we get better tech policy if policy people understand tech mean it just works out that way I’m chuck on I work at Nuance Communications on when you talked about the big four things you think the NSA might have a sleeve house price didn’t mention quantum computing do you think there any closer to building wind and universities are now II require computing I mean that the media went to town over this i think is largely media going to town no I me I’m me of course the NSA has a research arm doing this link why wouldn’t they and they have reached on everything but now I I don’t think wanna get his anything to worry about in in our lifetimes may eventually share but it nowhere near near-term I don’t get any closer now I you measure saying line before you got there enough hi I’m a Alex Marty them the national charity restore the forge a coalition I am works do you think that is part all the short term legal efforts to constrain the USA it would be useful for Congress to pass the USA freedom act the main anything reform bill so I think the freedom act does some useful things I think in the general scheme of things is largely irrelevant on my fear is Congress passes it passes on the back and goes home but it is something and I think it is worth doing it’s really worth doing for the statement that acts there are excesses IDX so yes now I am in favor it but kinda reluctantly and then I’ll go there okay Peter when we have our say on curious up restraining we’ve heard a lot about what the indices doing arm from stone leaks and so on and so forth but the fact is every intelligence service and world news does this for wants to do this we’re trying to do this arm I find myself wondering if full legal constraints are really the appropriate thing to spend our efforts on rather than trying to work on technical solutions that make it so the couldn’t gather today to start with rather than just reading doing so may I think we have to do both if we just a technical if we just approach is technically we run the very real risk the NSAC sends webcam company a secret letter saying don’t implement that correctly and we’re stock at some deep hardware level right hey Intel no break your number generator in this way that we just described that’s impossible to find out I really think both have to work together that you need tech because yes there always will be bad actors but you need policy because policy can always Cybertech and nothing will be perfect but I’m trying to build a resilient system that is hard to subvert from either action well that’s good cuz at the moment if you like in a very septic environment computing lies it’s pretty bad out there please i am. question article I read buddy you’re goin’ wired before the snowed in revelations I seem to recall the article talking about the bottle facilities in Yutan and some there is some speculation that going back to you too early about possible grimly breakthroughs there there may be some to be going on at Oakridge an enemy be harnessing Bluffdale to decent makes a break the as the nose on TV anything to save about so we don’t know about the facility in a lot to be learned been in calculating how big they are and became capacity based on a square footage based on power requirements its own indirectly trying to our figure out what they are my guess is is there giant storage and analysis facilities that they’re less breaking things and more analyzing a massive trove on the crib today there goes through their doors every millisecond and that should therefore we don’t know been there certainly could be part to that that are doing something then script analysis when we really just speculating active clerk are you made the distinction between surveillance and eavesdropping which i think is a very important distinction and you’re talking a lot about encrypting data which actually gets at the issue love he’s dropping this gigantic massive unencrypted data but I agree with your point that the surveillance or traffic analysis in one framework is a incredibly revealing thing is I think about the architecture the Internet in the architecture the underlying layers the cell system the cellular system and so forth it’s really hard to understand how bring crypto to bear to bury some other basic facts like where I am and so forth so when you begin to think about redesigning networks to reduce the the revelations associated with meta-data they have some serious about the right way to go at that were how weak and how we can bring basic tools like crypto to bears to solve that cuz Indian decryption as you understand that but then is all this black underneath and other asian problem and i think is less crypto and more designing protocols to be more peer to peer maybe we should learn this for file sharing good have centralized file-sharing system we can have a peer to peer system that is more resilient to attack I it means some stuff I think you never get away from and myself on have to know where I am the ways you can’t give me phone calls by but is there some way design that so that the home network doesn’t know that maybe just on locally up some other the meta data is could be in cryptid the the data that’s cent up from on my phone acts which we know the NSA is granting location date another thanks that kinda stuff can be equipped so that I like a sitting week adequate many acres is not needed in the network some stuff we can’t and I’m hoping that with some smart redesign we can minimize or and not in my eyes the meta-data we can’t encrypt alleged a quick follow-up yes the disadvantages peer to peer is that it reveals that I’m talking to you a countervailing argument could be that if we have a secure server in the center of the net and we somehow believe that that’s resistant to attack then I talk to the server you talk to the survey all the NSA knows everybody talks to the server so it’s not clear to me that peer to peer actually Asia reduces the the that the traffic analysis remains and doing it properly is fundamentally the weight or works read a lot to servers and so I I think this is I don’t have answers here but my guess is they’re smart redesign we can do some taking out last question and that there just a couple quick ones just broadly do you think snowed in as a traitor & lexer on the whole so I’m I I really I really dislike the question grace many with fundamentally were in the middle of it and I think that question will be for history to decide okay that no way that in the middle when we don’t know the outcome this everything what are the outcomes I love this public debate I when the outcomes are these ik these and SAXS is are I I will they be determined to be legal or not tell history decide their legal I what he did was was very was very individually moral and he fundamentally betrayed the NSA because he added he felt he had a greater allegiance to the nation as a whole and that’s a very powerful argument and I am right now I agree with it but I don’t think you the answer question for another dozen years okay and its it you know it’s an important one in the media but I’m much more interested in the documents then the moral history of how they came in front of me okay and then just one through a follow-up given did I mean everyone hears clearly very interested in this topic in passionate about security its a limited part applies for the general public %um a message that you know you would recommend we take to our friends and colleagues on why we should care why we should go towards encryption and do something that probably people have never even heard of to make the internet better for everyone else and this is a hard question and I think up if we fail to be right there that the counter are you can arm its easy by terrorists will kill your children that’s the argument anything about that argument is is it stops all rational conversation me I can discuss the in Africa see a ball collection I could discuss the expense both and money in Liberty’s in our legal system in our economic system I can talk about the abuses and the harms like I’m at a loss a privacy but those are all pretty theoretical against terrorists will kill your children, I really think that it’s going to take some years before the craziness of / for their subsides that we can look at this rationally are the the counter-argument to fear isn’t on the ability made that we are stronger than this that we are better than this that we don’t have to sit stoop to this kind of stuff I did we can respect our laws our country our liberty is our ideals and still beat the bad guys that we don’t have to subvert everything that we that we hold order to beat them the store hard targets I had the the good arginine be making it left to right center so anyone in communications shower Kiana thank you very much

Please leave this field empty

DON’T MISS A BEAT

There aren’t any tricks here, only treats!

Check your inbox or spam folder to confirm your subscription.