Privacy Highlight: Keynote with Sherri Davidoff

Transcript

Sherry Davidoff is the CEO of lmg security and the author of three books including data breaches crisis and opportunity as a recognized expert in cyber security she has been called a security badass by the New York Times Sherry is a certified forensic analyst and Pen tester and a graduate of MIT she was featured as the protagonist in the book breaking and entering the extraordinary story of a hacker called alien thank you so much Michelle my social security number is four zero not just making sure you can hear me everybody here okay perfect what you're looking at on the screen here is the you're not looking at

on the screen can we get uh the visuals perfect this is the first coin ever minted by the United States it's known as the fujio scent and it was designed by Benjamin Franklin and there's something a little different about this coin compared to Modern coins which you'll notice it doesn't say e pluribus unum it says mind your business what a beautiful reminder that privacy has been intertwined in American Commerce and values since the very Inception of our country all right so like one of our prior panels I like to start at the beginning I was asked today to talk about why privacy is fundamental for security and

I truly believe that it is I've been in security for over 20 years been very passionate about it and so I wanted at some point in my career I wanted to figure out what is this thing that I think is so important so I looked up the etymology the etymology of it and I found that it comes from the Latin roots meaning without and Cura meaning care so without care or Carefree kind of like what Kurt was talking about earlier where it's freedom from anxiety freedom from apprehension where you don't have to you feel confident in your safety that's what security means to me and to many others give you a little example of how privacy is fundamental for personal security in China today surveillance is used to

oppress ethnic minorities for example we've seen an estimated 1 million Turkish Muslims detained arbitrarily and put into these terrible re-education camps and how are they being found how are they being selected how are they being detained well the whole surveillance network is a part of that that loss of privacy you have surveillance cameras everywhere that are tracking your movements that are determining what you're doing we they have access to your phones they can see your web surfing habits if you have apps installed if you're using Tor that might be a selection criteria they even have the ability to monitor the power usage in your homes when you're getting delivery deliveries when you open doors

those are components of that surveillance infrastructure that all affect our personal security what's frightening is that these exact same Technologies are used in the United States obviously not to the same ends but the technological infrastructure to some extent is in place so for example the Chinese company hickvision has millions of surveillance cameras all around the world and including hundreds of thousands of the united in the United States and if you're concerned about it so was Congress they banned these from the federal government from federal agencies but they're not gone as you can see from this map I pulled this up today this is a map of all the hickvision cameras in the United States they are everywhere the journalist Jonathan

Jonathan Hillman from the Atlantic had a great quote on this the same technology that is contributing to the greatest human tragedy of this Century may also watch over the streets of your city buildings in your neighborhood and the living room next door frightening it wasn't always this way of course and I think it's important to give everyone an example of how Anonymous Communications used to be the default it used to be the norm right and we can see that in our payment systems which are the foundation of the services that we use so when you walk down a Street in the city last century or when you were on the go and you were traveling and you wanted to make a phone call you would go to a pay phone and what did you use to pay for that call a piece of metal so

right there inherent in that communication system is anonymity the potential for anonymity and people used it without even thinking about that they didn't have to worry about that I'm a I'm a an avid collector of telephone tokens and for those of you who aren't familiar with telephone tokens up until about 1944 it was popular for owners of telephones to use these tokens because it allowed them to change the price without having to reconfigure the phone and some of them are absolutely beautiful they have advertisements they have intricate designs this is one of my favorite this is a San Francisco telephone token I like that on the reverse it says is it safe I have no idea what that's in reference to if you

know please let me know but as a security professional I just find that fascinating Anonymous movement used to be easy too used to be default you would get on the subway and put a piece of metal into the system or you might take a steamboat a cab a bus and no one could tell when you got on when you got off this wasn't being tracked centrally they don't know who your friends are when you're using that piece of metal and all of that changed without really public input right oh I want to take a little detour here for a sec for a second this is one of my favorite pieces in my Transit collection this is a plane ticket from about 1930. I have a copy of my data breaches book here for anyone

who can answer this what is missing on this that's really important for privacy yes third name that's right come on up afterwards the name is missing can you imagine getting on a plane and being like oh here's my ticket just like here's my ticket like you're going on a ride at the carnival yeah the name wasn't always on your ticket they didn't always care and when this change we didn't always notice most people didn't notice I noticed because I'm a little obsessed with privacy I was in Boston when we switched from the Charlie car or sorry when we switched from the token over to the Charlie card and I did not want to use the Charlie Card because what the Charlie Card did was it kept a history it had a unique identifier and it kept a history of all

your rides and again as if you were here earlier I've been in security for over 20 years and part of my undergraduate education at MIT was I got to do an analysis of all the network traffic at MIT and I was really looking at flows you know where traffic was going who was going to and just looking at the source and destination you can infer oh this person it may be going to the bar this person may be friends with this other human or part of this Social Circle this person stays up late at night this person gets up early all of these things can be used to discriminate to infer things about your habits we'll get back to that in a few minutes so also as Kurt said earlier you don't always know what that data is going to be used for in the

future so I called the MBTA at the time and I said are you guys tracking this are you collecting this in a database and they said yeah and I and they said what's it used for and they said nothing and this was many years ago but you can't trust that the uses of data today are going to be the same as those uses tomorrow so instead of buying a Charlie Card I decided I was going to have a little Act of resistance I was going to flex my privacy muscles and buy a single use ticket every single time I rode the subway and in order to preserve my anonymity I had to buy that in cash right which was a problem because most of the machines did not accept cash I did a talk in 2009 death of an anonymous

travel and you can see the whole picture there was just a bank of machines four or five machines that all said no cash on them so I had to wait in line longer than most people and budget for that it took time and there was a 30 surcharge for every ride if you were using a single use ticket so all of a sudden overnight in December of 2006 privacy had a cost privacy was 30 cents more per ride and it took time away from me as well so all of that changed without the public really having a say in it I also wanted to mention that when organizations collect this data there are enormous risks data is hazardous

material and when it spills you don't know what it could be used for so even if you 100 trust the Boston MBTA or the NSA or the FBI or whoever it is that doesn't necessarily mean we can guarantee that that information will remain in perfect control a really good example of this was fly clear how many of you signed up for fly clear in the early 2000s probably actually probably not this audience which is good this is the predecessor to today's clear and they collected a ton of information about Travelers in order to expedite processing when you were getting on a plane and then in 2008 roughly they lost a laptop containing 300 000 members information and that was a big part of

the demise of fly clear and a good example of the fact that again you can't always when you collect this data you can't always guarantee that it will be used for the purposes you expect or that it will stay secure another example Edward Snowden who's been talked about several times today in addition to leaking documentation Edward Snowden took some samples of communications to prove that this was being collected he took 160 000 Americans emails and instant Messengers he took 7 000 documents from 11 000 people's online accounts and he said that these were easily accessible to any analyst in his position and what did he do them do with him he showed them to

reporters and we don't really know what happened to them from there I don't know about you but I've never heard a statement about this from the American government I don't know of anybody who was notified that unfortunately their data was involved in a breach of the federal government and that makes me really concerned about oversight of these extremely powerful surveillance systems has this happened before has someone gotten a hold of this data and no one said anything has it happened since how would we know we need transparency and oversight and accountability when this hazardous material is being collected all right this is not China and so when you lose your privacy the impacts on

your security both at a personal level and a community level can be more subtle than you ex you might expect and a good example of this is your credit score I read a surprising research paper by the IMF the international monetary fund about the growing use of alternative data when calculating credit scores so more and more lenders are excited about the idea and fintech firms are excited about the idea of scraping your social media of getting analytic information and using that to calculate your credit score we're seeing things like location information used the types of device you have how many of you are Android users raise your hand okay you are less likely to get a bank loan yep some uh some financial institutions today are

actually using the type of device that you're coming from as part of their calculation of whether or not you're a good risk for them which is concerning we already mentioned social media data your travel records even your SAT scores can be used in these calculations oh my God they might come back to haunt you and all of this information is this profile is built from childhood so this has real world implications your social media information the type of device that you use may impact your ability to buy a house to get a job because sometimes employers can request your credit score to start a business it may even affect your dating life whether

or not you get a date so it impacts our personal sense of security in these very subtle ways now I think there's a misconception that we have to choose between personal privacy and National Security these are the same thing because our nation is made up of people when we lose our personal thank you we are people when we lose our personal privacy it means that there's a risk that people can be extorted at a political level intelligence agents corporations it means we can be manipulated so you look at the Russian interference in our elections they were for example targeting African Americans

in certain types of communities and how do they identify how do they target these people they were leveraging Facebook's analytics the analytics of different social media companies you can see a nice chart right here so even though they didn't have access to all that big data they weren't crunching it these companies were they had extensive volumes of personal data and Russia was piggybacking off of that and using it to ends that may not have been expected and finally of course when you have intelligence information think about all the different sensitive matters that so many people handle when you have access to that intelligence you can gain economic advantages you can gain military advantages and more personal privacy is fundamental for National Security

personal data in general information that most of us want to be private can be leveraged to number one change your behavior to manipulate you as we talked about to block your Communications to interfere with your ability to coordinate to collaborate and to assemble one of our fundamental rights here in the United States it can be also used to affect decisions people make about you and it can be used to affect perceptions of you so it can interfere with your ability to get public office to uh to start a business as we talked about and it can undermine us economically as a nation and weaken our leadership we have lost the battle for everyday privacy this is a little bit depressing

this slide but I think it's really important for all of us to look each other in the eye and say we are starting from scratch we do not have personal privacy in our everyday Communications in our everyday purchases in our everyday movements anymore and that pleases us at risk most people don't know how to make a truly private phone call most people either don't don't know or can't use anonymous methods to make purchases it's just not supported in our everyday habits that's where we're starting so to conclude how can we fix this that doesn't mean we should give up it means we have to work harder

I like to tell my kids rights are like muscles you have to exercise them or you you lose them and everything that every one of you does when you make a purchase using cryptocurrency when you take that extra moment and use signal to make a call you are exercising that privacy muscle helping to make it more common and helping to integrate it into the everyday fabric of Our Lives so all of us need to be working to integrate privacy into everything we do in order to improve our security ultimately privacy and security are literally two sides of the same coin the front of the fujio sent our first coin

here in the United States said mind your business I love the back it says we are one with an unbroken chain it's a visual reminder of the fact that privacy is deeply interconnected with unity and security and with that feel free to keep in touch I'm on Mastodon I'm on LinkedIn drop me a line afterwards thank you so much and enjoy the rock band [Applause]