Black Code

Subtitles by explosiveskull

We are going through the most profound change

in communication technologies in all of human history right now.

Printing press, radio, telegraph, television. All very important.

But I believe we're going through the most transformative,

purely on the basis of three technologies.

Mobile, social media and cloud computing.

They share one very important characteristic.

And that's the amount of private information.

Information that used to be in our desktops or filing cabinets,

even in our heads,

that we now entrust to third parties.

Data that we are conscious of, and deliberate about,

like the e-mails we send and the tweets we post.

But it also includes a lot of information

that we're completely, or mostly, unconscious about.

So if you take my mobile phone,

even when I'm not using it, it's emitting a pulse,

trying to locate the nearest Wi-Fi router or cell phone exchange,

and within that beacon is the make and model of the phone,

the fact that it's my phone,

because my name is attached to the operating system,

and most importantly, the geolocation of the phone.

We are leaving this digital exhaust

that contains extraordinarily precise information about our lives,

our social relationships reduced to trillions of data points

that form now this new ethereal layer around the planet

that's only growing in all directions.

Capabilities are being put in the hands of policy makers,

five years ago, they'd never imagine that they would have.

This is where big data meets Big Brother.

Should be here.

It is kind of in a rock, I think.

Yeah, the entrance is in a rock.

Or a bunker.

Oh, yeah, the bunker. It is down there!

There is a bunker under here.

- Yeah. - It is between 33 and 39.

Right there. Look at that door.

- Yeah. - Yeah, this is it.

- Bahnhof. - Okay.

Hey, I guess we just go in.

Many people believe that you have this cloud services that are floating around.

People think, "Okay, it's a cloud server."

But this is the actual physical location of the Internet.

It's a constant struggle to protect data.

The Swedish Security Police wanted to install tools

to automatically log in to our data and get out the information.

So I invited them to our facility,

and then I had a microphone

which I was provided by the Swedish Public Service, national radio.

I taped this conversation, and they were so angry.

And they also wanted us to sign a paper

where they said that we could not say anything about it.

It should be total secrecy.

They said, "If a terrorist attack happens, it's your fault."

It's, like, a creepy feeling.

Nobody can say that any facility is safe.

There are always possibilities to go in and find data and take it out.

People say that, "Oh, I don't have anything to hide.

They can read my mail. I don't have anything."

But it's not that which is this problem.

The problem is, without secrecy, there can be no democracy.

Without secrecy, there can be no market economy.

Right.

There is an obvious candidate for the Nobel Peace Prize.

- Really? - And that is Edward Snowden.

I mean, yeah.

Does the public enjoy the same right to privacy that we have in the past?

Are we still private citizens,

and then public officials, where the government knows very little about us,

but we know everything about them?

Why are we, the public, becoming disempowered

at the same time that governments around the world,

corporations around the world, institutions around the world,

are gaining greater and greater leverage over the range of our activities,

their knowledge of what we do?

The Citizen Lab is an unusual place.

We're a research unit at the University of Toronto.

We combine the skills of engineers, computer scientists

with social scientists.

We collaborate with people from all over the world

to do the field research that we do.

And we do this to advance research on global security,

cyberspace and human rights.

The world is a very dangerous place

as we saw recently in... in tragic incidents in Paris,

and you want to have security agencies be well adept at discerning

what those threats are over our horizon.

But is it okay that the government sets up a giant digital X-ray machine

over everything that we do?

Because that's effectively where we're headed right now.

We've been a kind of digital early warning system,

scanning the horizon.

And what we've seen, frankly, has been really disturbing.

Tibetans are watched from every angle and from every corner.

It's in their homes, it's in their offices, it's in the streets.

In Tibet, certainly in central Tibet

and around the capital city of Lhasa,

Chinese authorities, together with Chinese corporations,

telecommunications companies,

they've integrated the ability to spy on people via their mobile phone,

via the last communications they may have had over the Internet.

Down to the closed circuit television camera on the streets.

The Chinese so strictly control access to Tibet,

it's just like a black hole

for media, for independent observers,

for international agencies, for anything.

How I escaped is a secret.

People are incredibly courageous.

People inside Tibet will send out news and information.

And they'll say, "I want this story to be told."

They could be imprisoned.

They could be tortured.

Their family could pay the price.

We on the outside have to decide

how to walk this very, sort of, fine line between protecting people's security

and honoring their wishes about getting news and information out.

And we know for a fact, thanks to Citizen Lab's report,

that we are being successfully targeted.

A new report has been released from a group of digital detectives.

From their computers in Toronto, they've tracked a high-tech spy ring

that reaches around the world.

For the past ten months,

these computer experts have been working as cyber sleuths

hot on the trail of a massive electronic spy network.

They say it has taken control of nearly 1,300 high-level computers

in more than 100 countries.

A discovery that could have major political implications.

They can extract any document they wanted.

They could turn on web cameras, turn on audio devices,

so that they could, in effect, use the computers

as a listening device in the offices.

The web of intrigue started with the Dalai Lama

who thought his computer had been hacked.

Up until about 2007 or 2008, I'd never really heard of malware.

You know, I'd heard of viruses, obviously,

but I hadn't really heard about targeted malware attacks

affecting the human rights community.

First time I heard about it was in the context of the Tibetans.

Gradually we started piecing together, they are under surveillance.

The surveillance comes from groups within China.

They're using malicious software and socially-engineered e-mails.

E-mails that are crafted to get them to open it up

to get inside their devices.

Nart Villeneuve, a computer wiz,

figured out how the operation worked

by getting the attackers to hack into his computer.

We're monitoring these groups

for long periods of time,

and you're essentially waiting for them to screw up, right?

And when they do, you take advantage of that.

Sometimes it takes a long time.

You could be monitoring a group for a year and get nothing.

Then one day, they just use a server that they don't lock down

and all the data's just sitting there.

I was at home. It was pretty late.

Nart was scouring through it,

trying to figure out what actor is responsible

for getting inside the Dalai Lama's office.

And there was a 22 or 24 character string that kept coming up

that he couldn't figure out, "What is the meaning of this?"

So on a whim, he just copied and pasted it into Google.

One website came up, and it was Chinese characters.

So he clicked on it.

To my surprise, what came back was the actual page

that the attackers used to interface with the compromised systems.

So they set up a website where they could monitor their victims.

But they didn't password protect it!

So it was like a window into everything they were doing.

This wasn't just targeted at Tibetan organizations

or human rights organizations.

This was global, a pretty wide range of institutions

that showed that these attackers were... were quite busy.

There was huge pickup in the media. It was all over the world.

And it put us on a different kind of footing in terms of our credibility.

In the cyber security community, we were novices at that time.

We were kind of outsiders.

So we were kind of calling it on the fly.

Like, what do we do? What's the right thing to do?

Who do we notify?

I knew that publishing it was important.

We had to redact a lot of the information to protect people.

Should we notify the government?

Should we notify the Canadian government?

How do we notify other governments that are being victimized?

At the time, you know,

we didn't want to completely disclose everything that we had done,

because we wanted to do it again.

In some of the communities I mentioned, they loved it.

But I got the feeling from, certainly inside my own government,

there was a lot of weirdness.

- Are we allowed to speculate? - Well, I think now we know

because there's a Snowden disclosure that explicitly references the fact

that the Canadians and the Americans,

our signals intelligence agencies,

were piggybacking off the GhostNet network.

So, in publishing the report, we basically broke up their party.

From our initial samples from the office of the Dalai Lama,

they were actually compromised by two distinct groups.