Technology Pill Privacy International

Welcome to the last of our short series on encryption. This week we're just talking amongst ourselves, luckily Gus is an expert on encryption - having been working in and around the encryption debate since the '90s.



Links

- Read more about PI's work on encryption here: ⁠privacyinternational.org/learn/encryption⁠

- Matt Blaze and crypto.com: theverge.com/2018/7/6/17540818/crypto-com-domain-matt-blaze-monaco-mco-cryptology-sale; you can now find Matt at mattblaze.org

- More about ITAR and the export of cryptography: en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States

- More about France's ban on encryption ending in this 1999 article from the Register: theregister.com/1999/01/15/france_to_end_severe_encryption/

- More about the Data Encryption Standard: en.wikipedia.org/wiki/Data_Encryption_Standard

- Find out more about the Clipper Chip: gizmodo.com/life-and-death-of-clipper-chip-encryption-backdoors-att-1850177832

- Or take a look at this NY Times article from 1994 (paywalled): nytimes.com/1994/06/12/magazine/battle-of-the-clipper-chip.html

- Matt Blaze's flaw in the Clipper Chip: wired.com/1994/09/clipping-clipper-matt-blaze/

- NSA Data Center: wired.com/2012/03/ff-nsadatacenter/

- NSA holding data: nytimes.com/2013/09/06/us/nsa-foils-much-internet-encryption.html

- An old website that helped you sign up to be an Arms Trafficker: http://online.offshore.com.ai/arms-trafficker/

- Here's some of the RSA illegal tattoos: http://www.geekytattoos.com/illegal-tattoos-rsa-tattoos/

- Phil Zimmerman's release of PGP: mit.edu/~prz/EN/essays/BookPreface.html

- A documentary on this topic: reason.com/video/2020/10/21/cryptowars-gilmore-zimmermann-cryptography/

- The Reply All episode on Minitel: https://gimletmedia.com/shows/reply-all/8whoda

This week we speak to Ioannis, a senior lawyer at PI, about his and his colleague's work on the landmark case protecting encyrption at the European Court of Human Rights: Podchasov v. Russia.



The case dealt with a Russian law obliging telecommunications service providers to indiscriminately retain content and communications data for certain time periods, as well as a 2017 disclosure order by the Russian Federal Security Service requiring Telegram Messenger company to disclose technical information which would facilitate “the decoding of communications”.



Links:


PI case page: https://privacyinternational.org/legal-action/podchasov-v-russia
ECtHR judgment in the Podchasov case: https://hudoc.echr.coe.int/eng?i=001-230854
PI's work on encryption: https://privacyinternational.org/learn/encryption
PI's report on End-to-End Encryption (E2EE): https://privacyinternational.org/report/4949/securing-privacy-end-end-encryption
More information about the Marper case: http://www.genewatch.org/sub-563146

What do you know about cryptography? Have you ever wanted to get a better understanding of some of the maths behind encryption? This week we speak to Ed, a Senior Technologist at PI, about some of the history and basics of encryption.

Find out more about encryption:

- Computerphile on youtube (https://www.youtube.com/@Computerphile) is a computer science professor with a range of useful and accessible videos on encryption

- Cloudflare have a helpful learning centre including this article on how encryption works and why cloudflare use Lava lamps to generate keys: https://www.cloudflare.com/en-gb/learning/ssl/lava-lamp-encryption/

- This is a helpful article on Diffie-Hellman including a diagram of the colours demonstration, which Ed discusses during the podcast: https://www.comparitech.com/blog/information-security/diffie-hellman-key-exchange/

- This article is great for learning more about hashing: https://auth0.com/blog/hashing-in-action-understanding-bcrypt/

- And if you're interested here is the wikipedia page on the Skytale sticks Ed talks about (https://en.wikipedia.org/wiki/Scytale)



Learn more about PI's work on encryption:

- PI's main encryption learn page: https://privacyinternational.org/learn/encryption

- A PI report on the importance of End to End Encryption (E2EE): https://privacyinternational.org/report/4949/securing-privacy-end-end-encryption

This week we speak to Mark Nelson, a car mechanic and father of five, who has been forced to wear a GPS tag by the Home Office for the past 20 months, and his lawyer Katie Schwarzmann of Wilsons Solicitors. The pair have been challenging the Home Office's ongoing imposition of GPS tracking on Mark in the courts and are now awaiting a judgement. We explore the legal case, the ways the tag hasn't worked for long periods of time, and a dubious AI the Home Office has been using in decisions as to whether someone remains on a GPS tag.



Links
- Read more from Katie's law firm, Wilsons Solicitors, about the case:
https://www.wilsonllp.co.uk/news/high-court-hears-first-challenge-to-the-governments-policy-of-gps-tagging-migrants

- PI's Complaint to the ICO (the UK's Data Protection Authority):
https://privacyinternational.org/legal-action/ico-complaint-against-uks-gps-tagging-migrants

- Read more about relevant cases in which PI has filed witness evidence:

https://privacyinternational.org/legal-action/uk-migrant-gps-tracking-challenges

- The five companies at the heart of the UK's GPS tagging system:
https://privacyinternational.org/long-read/5063/who-profits-uks-247-tracking-migrants

- We tested GPS ankle tags, read how our experiment went:
https://privacyinternational.org/long-read/5064/life-under-247-gps-surveillance-gps-ankle-tag-experiment

- Listen to our last podcast discussing GPS ankle tags:
https://privacyinternational.org/video/5074/gps-tracking-migrants-uk-who-profits

This week we talk about good things (or good-ish things) that you might have missed from 2023!



Links



Companies getting disciplined

- Ovulation Tracking App Premom Will be Barred from Sharing Health Data for Advertising Under Proposed FTC Order https://www.ftc.gov/news-events/news/press-releases/2023/05/ovulation-tracking-app-premom-will-be-barred-sharing-health-data-advertising-under-proposed-ftc

- Facebook getting fined for data exploitation in Norway: https://dig.watch/updates/meta-fined-98500-daily-over-user-privacy-breach-in-norway

- CNIL fines Criteo: https://privacyinternational.org/press-release/5075/global-adtech-company-criteo-fined-eu40-million-france-unlawfully-collecting

- CNIL fines Doctissimo: https://edpb.europa.eu/news/national-news/2023/health-data-and-use-cookies-french-sa-fines-doctissimo_en

- Worldcoin (aspires to be World ID) has been getting some pushback from some countries: https://www.citizen.digital/news/data-protection-office-says-worldcoin-likely-to-tamper-with-data-from-kenyans-seeks-courts-intervention-n325472



Governments abandoning plans, or at least held to account

- Kenya drops Huduma Numba and replaces it with new systems (it’s not any better and advocacy under way) but it’s still a sense of victory that they dropped Huduma Numba that caused some much controversy as highlighted by CSOs in particular through advocacy, research and litigation (which we supported led by Kenyan organisations like Nubian Rights Forum, amongst others) https://www.biometricupdate.com/202303/kenya-huduma-namba-funding-almost-entirely-cut-as-upi-digital-birth-registration-begins

- MI5 win: https://privacyinternational.org/press-release/5027/press-landmark-ruling-exposes-years-rule-breaking-mi5

- UK Supreme Court rules against Rwandan policy https://www.ft.com/content/c040946a-c294-4a89-808e-46c8b2f2f414

- Colombia at the UN Human Rights Committee https://privacyinternational.org/advocacy/5080/pis-submission-un-human-rights-committee-regarding-colombias-compliance-iccpr

- USA at the UN Human Rights Committee: https://ccprcentre.org/ccprpages/united-states-under-the-microscope-vast-participation-of-american-civil-society-organizations

- Brazil at the UN Human Rights Committee: https://tbinternet.ohchr.org/_layouts/15/treatybodyexternal/Download.aspx?symbolno=CCPR%2FC%2FBRA%2FCO%2F3&Lang=en



Legal protections emerging

- Proposed US Privacy Act: https://www.wired.com/story/government-surveillance-reform-act-2023/

- New data protection laws adopted (they are not perfect but they exist) in India https://www.techradar.com/computing/cyber-security/india-approves-new-privacy-law-but-is-it-really-a-win-for-citizens and Nigeria: https://kpmg.com/ng/en/home/insights/2023/09/the-nigeria-data-protection-act--2023.html



Innovations

- Apple deciding right to repair actually matters https://www.theverge.com/2023/10/24/23930762/apple-right-to-repair-white-house-iphone

This week we have a think about generative AI. After a concerning Guardian article about deep fake scams, we ask the question: did we really understand the risks when we started a podcast?

The audio clips featured in this podcast episode are the intellectual property of Smart Energy GB (Clip 1), Kim Kardashian (Clip 2), the Hollywood Reporter (Clip 3) and Lucasfilm Ltd (Clip 4). All rights are reserved to their copyright owners.

Other links:
- Experience: scammers used AI to fake my daughter’s kidnap:
https://www.theguardian.com/lifeandstyle/2023/aug/04/experience-scammers-used-ai-to-fake-my-daughters-kidnap
- 23 and Me hack:
https://www.bankinfosecurity.com/23andme-investigating-apparent-credential-stuffing-hack-a-23267
- Deepfakes Can Help Families Mourn—or Exploit Their Grief:
https://www.wired.com/story/deepfake-death-grief-hologram-photography-film/