*35C3 preroll music* [Filler, please remove in amara]
Herald Angel: And now to announce the speakers. These are Diego Naranjo, who's a
senior policy advisor at EDri and Andreea Belu, who's a campaigns and communications
manager also at EDRi. EDRi stands for European Digital Rights which is an
umbrella organization of European NGOs active in the field of freedom, rights and
the digital sphere. CCC is actually founding member of it. And they will be
talking about "Citizens or subjects? The battle to control our bodies, speech and
communications". The floor is yours. *applause*
Andreea Belu: This one this one here. This is my phone. There are many like it but
this one is mine. My phone is my best friend. It is my life and I should master
it as I master my life. This is my phone. But what makes it mine? I mean it might be
quite obvious right now that I'm holding it for all of you. What is not that
obvious though is that my phone is also holding me. On one hand we use our phones,
we use it to connect to the Internet, get online with our friends, exchange
opinions, coordinate actions. On the other hand, we are used. We are used by third
parties, governmental, private, who through our phones, through our devices,
monitor. They monitor our location, our bodies, our speech, the content we share.
At EU level right now there is a sort of a pattern. There is this tendency, a trend
almost. Certain laws like the ePrivacy, the Copyright Directive, the Terrorist
Regulation, have this very central core that we call the body and speech control.
It looks like it is really the driving force in the moment. So in the next 40
minutes or so, what we will do is give you short updates about these laws. Talk to
you a bit about what their impact is on us, and what do they mean past the Article
X and Y, and hopefully convince you to get involved in changing how they look right
now. Diego Naranjo: While we represent European
Digital Rights as Walter was mentioning before we are 39 human rights
organizations from all across Europe. We work on all sorts of human rights in the
online environments, so-called digital rights. We work on data protection, net
neutrality, privacy, freedom of expression online and so on, and Andreea and I are
glad to be for the very first time here at 35C3.
Andreea: Now to continue that quote, that adapted quote from Full Metal Jacket, my
phone without me is useless. Without my phone I am useless. We spend most of our
seconds of our lifetime around devices that are connected to the internet,
whether a phone, a computer, a fridge or whatnot. This means that these devices
pretty much become attached to our bodies, especially a phone. Tracking these devices
therefore is equal to tracking our bodies. Controlling our bodies. For the purpose of
this presentation, we will talk about online tracking in terms of location
tracking, the tracking of our devices, the behavior tracking of users on websites -
how much do they spend on, I don't know what part of a website, where do they
navigate next, how many clicks they give, and the tracking of communications sent
between two devices. Diego: First location tracking. They are
on average more screens on most of the households than we have people. We carry
some of these devices in our pockets and they have more personal information than
most diaries used to have before. Our phones need to be tracked because they
need to be able to receive and send calls, messages, data. But this opens of course
new ways to use location data for commercial purposes, but also for a state
surveillance. Andreea: When it comes to behavioral
tracking, tracking our behavior online provides a lot more information
than just location. It adds on top of it, right? A user can then be targeted
according to that tracking. And the more this tracking targeting process basically
represents the business model of the Internet nowadays. For this reason the
more complex and detailed someone's profiling is, well, the more accurate the
targeting can be done, the more effective and efficient, most of the times. And
therefore more valuable the data about the profile is. You can see here a really cool
infographic from Cracked Labs, an Acxiom and Oracle profiling of populations. You
see the amount of variables and the amount of information and the depth where it
goes, and you get that business model, a cash flow.
Diego: And this business model is quite interesting. I wouldn't imagine a postman
going to my physical mailbox at home going through my letters and then pouring some
leaflets for advertising in there according to what he reads. Right now
Gmail and many other services, that's what they do, they leave out as, you well know,
reading your emails to sell you stuff that you don't really need. Facebook conversations
now through the API are an option, they want to read them, those
conversations in order to find patterns for example for intellectual property and
infringements, especially for counterfeiting but not only, also for
copyright. Now also WhatsApp metadata is used by Facebook in order to know who your
friends are, who you contact, who your family is, in order for that social media
services to gain more and more power, more and more data, and more and more profit of
course. The life of others. Right? I got a good movie. If you haven't seen the movie,
I guess everyone has seen it. If not you should. It's basically about a Stasi agent
who follows the life of an individual through a period of time, and after
there's no other revelations. This movie has changed in a way from drama to soft
comedy because the capabilities of surveillance services, to veil all of
us, to get so much data, also for companies to get so much intimate
information from us, has doubled, tripled or perhaps exponentially grown compared to
what the Stasi would do back then. And all of this... to some extent it's going to be
regulated by this regulation with a very, very long name. I guess half of you will
have fell asleep already by going through it, but I'll go through it quickly to
let you know what is this about. Why do we need to know about ePrivacy Regulation,
why it is important for the control of our bodies and our devices. The ePrivacy is
about online tracking and you might have heard of the cookie directive, that one
bringing all those cookie banners on your screens in part due to a bad
implementation of this directive. It is also about your emails. Who's going to be
able to read your emails or use the data from your emails to sell you advertising
or not. How confidential that information can be. It's also about your chats. How
would you communicate nowadays with your WhatsApp, Signal, Wire, or any other
devices. And finally it's also about location data. Who can track you, why can
they track you and what are the safeguards that that need to be put in place in order
to safeguard your privacy. And I can imagine many of you saying well don't we
have already this GDPR thingy of the emails I received in May. Yes we do have
that. But the GDPR was not enough. After more than four years of discussions to
achieve this General Data Protection Regulation we have achieved a lot, and
GDPR was our best possible outcome in that current political scenario. And there's a
lot to do regarding the implementation though.
We have seen problems in Romania,
in Spain, and we expect that to happen in many other places. But we still need a
specific instrument to cover the right to privacy in electronic communications,
including everything we mentioned before. Metadata, chats, location data, the
content of your communications and so on. Andreea: So ePrivacy is basically meant to
complement GDPR and be more focused on exactly the topics that Diego mentioned.
What did we advocate for and still do? Privacy by design and privacy by default
should be the core principles, the pillars of this regulation. Moreover politicians
need to recognize the value of maintaining and enhancing secure encryption. Cookie
walls--I mean we should be able to visit a website without having to agree to being
tracked by cookies. This is another topic that we strongly advocated for.
Finally, content should be protected together with metadata in storage and in
transit. And we actually succeeded last year in 2017 at the end. The parliament
adopted a very good text, a very strong text. It supported most of the
problems that, no, it addressed most of the problems that we pointed out and
supported the values that we're going through. But, this has been quite a ride.
I mean it wasn't easy. As Diego said we're a network, 39 organizations. They're not
just the legal people or tech people, it's a combination of both. So when we provided
our input in the shape of analysis or recommendations, some bulleted there, all
sorts of skills were combined. And this played a big part of our success, the fact
that we were able to provide a comprehensive yet complex analysis of what
encryption should look like, of what cookies should act like, and also a legal
analysis of existing legislation. The diversity of our skills became productive.
Diego: Did we win? Well, we are on our way. After the EU parliament adopted its
position, now it needs to sort of enter into discussion with the member states in
what is called the Council of the EU. For the Parliament with a strong position is
now to talk with the rest of the member states. Currently there are negotiations
around the ePrivacy are not really moving forward. They are being delayed by their
national governments. They are claiming that there are issues that need to be
tackled. That it is very technical, that we already had the GDPR and we need to see
how it is implemented, and Member States feared that another layer of protection
may impede that some businesses grow in the European Union. And if this was not
enough they also are afraid of getting bad press from the press right now. It depends
to a high extent on behavioural advertising. They say that without
tracking all over the internet they are unable to to sustain their business model.
And of course since the national governments, the politicians, are afraid
of that bad press from the press, then they are quite cautious to move forward.
Online we exercise our free speech and in many ways, but one of those ways is the
way we produce, share, or enjoy our content online. Our opinions, the people
with whom we communicate, can be seen as a threat in a given time by certain
governments. We have seen the trend in certain governments such in Poland,
Hungary and to a certain extent as well in Spain. All of these
information can be as well very profitable as we see with the mainstream social media
platforms we were mentioning before. So there are political and economical reasons
to control speech and that's why the best way to control speech is to control the
way that content is shared online. Right now there are two proposals that raise a
huge threat to freedom of expression online. Both propose upload filters by
increasing liability for platforms or making platform companies responsible for
the content which they host. One of them is the famous or infamous Article 13 or
the Copyright Directive proposal. And the second one is the regulation to prevent
the dissemination of terrorist content online. Both of them, as you will see,
they are just another way to make private companies the police and the dad of the
Internet. This is the first one. The proposal for act again with a long name.
Just stick to the short name, the Copyright Directive. And this Copyright
Directive is based on a fable. The fable goes like this. There are a wide range of
lonely and poor songwriters in their attic trying to produce songs for their
audience. Then there are these big platforms, mainly YouTube but also others,
that allow these uploads and gain profit. And these platforms give some pennies,
some small amount of money, for these authors. And the difference between what
they earn and what they should be earning is what they call the value gap. The fable
though conveniently hides the fact that the music industry keeps saying year after
year after year that they increase their revenues to a high percentage every year.
And that keeps growing, especially in the online world. What is the solution to this
problem? Well as you can imagine it's a magical algorithm that will solve this
problem. And this algorithm will filter each and every file that you upload to
these platforms, will identify it and match it against a database, and will
block or allow the content depending if it is licensed or not and if they like you or
not and then according to their terms of service in the end. As we will mention
there are some technical and legal problems with upload filters.
In essence, if they are implemented,
it will mean that YouTube and Facebook will
officially become the police and the dad of the internet. The other big fight that
we have is around terrorism, or to be specific, about terrorist content online.
After the Cold War we needed a new official enemy. Once communism fell.
Terrorism is a new threat. It's very real to some extent. We we lived through it in
Brussels recently, but it has been also exaggerated and inserted in our daily
lives. We see that in the airport controls, surveillance online, and
offline, restrictions to freedom of assembly and expression all over Europe.
And whenever a terrorist attack occurs we see pushes for legislation and measures
that restricts our freedoms. Usually those restrictions stay even though the risk or
the threat has disappeared or has been reduced. Again there we go with a long
name. Let's stick to the short name. TERREG. It's the regulation to prevent
dissemination of content of terrorist content. These proposals allegedly aims at
reducing terrorist content online. Note: not illegal content. Terrorist content. In
order to reduce risks of radicalization. I've always -- and what we have seen
through experience that a lot of radicalization happens outside the online
world, and that radicalization has other causes which are not online content.
It seems that the politicians need to send a strong signal before the EU elections.
We need to do something strong against terrorism, and the way to do that is
through three measures. Three. As we will see in a minute. First, Speedy González
takedowns. My favorite. Platforms will need to remove content which has been
declared terrorist content by some competent authorities. And this definition
of terrorist content is of course vague, and also incoherent with other relevant
pieces of legislation which are already in place but not implemented all across the
EU. This removal needs to happen in one hour. This is sort of fast food principles
applied to online world, to other visual material. And they give you some sort of
complaint mechanism, so do you have any problem with that, your content being
taken down, you can go and say this content is legal please take it back. But
in practice as you read it you will see that it's likely to be quite ineffective.
First of all, also overblocking will not be penalized. So if they overblock legal
content nothing will happen. If they leave one piece of content which is illegal on
their platform they will face a sanction. The second issue is those of measures for
voluntary consideration. According to this second measure, the states will be able to
tell platforms, "I have seen this terrorist content in your platform. This
looks bad. Really really bad. So I really felt I had to ask you, could you be so
kind to have a look, just if you wish? Of course I have no worries.", and the
platform then will decide according to their own priorities how to deal with this
voluntary request. Third. Good old upload filters, that's the third measure they are
proposing. Upload filters, or general monitoring obligations in legal jargon,
are prohibited in EU legislation. But anyway let's propose them. We'll see what
happens. And in order to be able to push them in the legislation, let's give them
an Orwellian twist to our filters, like let's call them in a different way. So we
call them proactive measures. Platforms will need to proactively prevent that
certain content is uploaded. How will they prevent this? Upload filters of course.
I meant, proactive measures. And whether it is copyright or terrorist content, we
see the same trend. We see this one size fits all solution: a filter, an algorithm
that will compare all the content that is uploaded, will match it against a certain
database, and that will block it or not. We will need many filters, not only one
filter. We need filters for audio, for images, for text, and also one
specifically for terrorist content. Whatever that is defined. So this is
basically the principle of law making today. We really want filters, what can we
invent to have them? Andreea: So we've got an issue with
filters, well, quite a few issues. But in big, an issue. First of all, they're
illegal. The European Court of Justice said like this: "A social network cannot
be obliged to install a general filtering covering all of its users in order to
prevent the unlawful use of musical and audio-visual work". In the case SABAM
versus Netlog. Despite this it seems that automated content filters are okay. Not
general filtering covering all of its users. Of course there are the technical
issues. Diego: Yeah, there's some technical
issues. One of my best example of that, the magnificent examples of how filters do
not work. Well James Rhodes the pianist that a few weeks ago tried to upload a
video of himself playing Bach in his living room. Then the algorithm detected
some copyrighted content owned by Sony Music and automatically took down the
content. Of course he complained, he took the content back. But it set a good
example of how filters do not work, because one piece of Bach, who died around
three or four hundred years ago, is of course out of copyright. And if the video
of a famous artist is taken down, we can imagine the same for many of your content.
Andreea: So not only that filters don't recognize what is actually copyrighted and
what is not, but they also don't recognize exceptions, such as remixes, caricatures
or parodies. When it comes to copyright, filters can't tell, and this is why memes
were a central part of the protest against Article 13. And this is why we will show
soon why this filter has huge potential for a political tool. Another issue with
the automated content filter is that they don't even recognize contexts either.
When it comes to hate speech or terrorist content, they can't tell nuances. A girl
decided to share her traumatic experience of receiving a lot of injuries and... not
injuries, insults, insults in her mailbox from this person who was hating her a lot
and threatening her, so she took it and copy-pasted it on her Facebook account,
and made a post, and her profile was taken down. Why? Because the automated solutions
can't tell that she was the victim, not the actual perpetrator, right? And this is
very likely to continue happening if this is the "solution" put forward.
Diego: That is also a problem for SMEs of course, because these tools, these
filters, are very expensive. YouTube spent around $100,000,000 to develop Content ID
which is the best, worst, filter we have now online. So we can imagine how this is
gonna go for European SMEs that will need to copy that model, probably getting a
license for them, I can imagine, in order to implement those filters online. In the
end this will just empower these big companies who already have their filters
in place or they will just keep doing their business as usual and these new
companies that would like to develop a different business model will be prevented
from doing so because they will need to spend a lot of money on these filters.
Andreea: Then there's the issue of privatized law enforcement, the
privatization of law enforcement. Attributes change. Past state attributes
are now shifted over - "Can you take care of it?" - to entities that are not really
driven by the same values that a state should at least be driven by. I'll just
give you one example from a project called Demon Dollar Project, a study commissioned
by the Parliament to look at hate speech definition in different EU member states.
Their conclusion: There are huge disparities between what it means, "hate
speech" - what hate speech means in Germany compared to what hate speech means
in Romania to what it means in the UK. So in this context, how can we ask a company
like Google or Facebook to find *the* definition? I mean, are their terms and
conditions the standard that we should see as the *one* influencing our legal
definitions, am I the only one seeing a conflict of interest here?
Diego: And there's a problem there that once we have these filters for copyright
infringements or any other purposes, like terrorist content, we of course will have
it as a political tool. Once we have these for copyright why are you not going to
look for those dissidents in in every country. These things change very often, I
see that in Spain but I see it all across the EU nowadays. So once we have them in
place over one thing one small thing like copyright, why not for something else,
something more political. Andreea: There is a really interesting
example coming from Denmark some year or a year and a half ago. The Social Democrats
announced their immigration plan. They made the video in which Mette Fredriksen
talked about how great their plan is and so on. Some people were happy some sad.
Some of the sad ones decided to criticize the plan and made a video about it.
It was a critique during which they caricatured her, but they used two audio
bits from their announcement video. Social Democrats sent a letter to the NGO
accusing them of copyright infringement and threatening a lawsuit. Obviously the
NGO thought: "Yeah we don't really have enough money to go through a big court
case, so we're just going to take the video down." They took it down. Now, why
is this case important? If an automated content filter for copyrighted material
would have been in place, the Social Democrats wouldn't have to even lift a
finger. The job would be automatically done. Why? Automated content filters can't
tell exceptions, such as parodies. And this is a very clear case on how copyright
infringement can be strategically used to silence any critical voices in the
political sphere. Diego: So we see a few threats to
fundamental rights. First on privacy that we need to scan every piece of content so
they can discard this information. Then we will live in a sort of blackbox society
and that will affect the freedom of speech. We will face also overcensoring,
overblocking, chilling effects and these tools are going to be repurposed as a
political tool. In a nutshell, rights can only be restricted when there is approved
necessity, when the measure is proportional and when this measure is also
effective. This filters are not necessary for the ends they want to achieve. They
are not proportional, as we have seen, and they are not effective, as we have seen as
well. So these in effect these are an unlawful restriction of freedom of
expression and privacy rights. Andreea: Now obviously we were also
unhappy about these and, I mentioned before, how we organize within our network
to fight to get strong a privacy. When it comes to copyright, this fight went out of
our network. It got a lot of people mad, people like librarians, startups, the U.N.
special rapporteur, all of those there, basically. And more. And even YouTube
in the end who thought about endorsing our right to campaign. What we learned from
these fights is that we really need to share knowledge between us. We need to
team up, coordinate actions, be patient with each other. When it comes to
different skills, it is important to unite them. When it comes to different
perspectives, it is important to acknowledge them. If we're separate
individuals, by ourselves we're just many; but if we're together, we're one big
giant. That is where the impact lays. Now, this is basically a call to you. If you're
worried about anything that we've told you today, if you want to support our fight,
if you think that laws aimed at controlling our bodies and our speech
should not be the ones that should rule us and our internet, I think it's time to get
involved. Whether you're a journalist writing about privacy or other topics,
whether you're a lawyer working in a human rights organization, whether you're a
technical mindset, whether you have no clue about laws or anything like that,
come talk to us. We will have two workshops, one on e-privacy, one on
upload filters we'll be answering more questions if you have and you can't ask
them today and try to put together an action plan. We also have a cluster called
"about freedom" that you can see there but is right by the info point in SSL.
And do you have any questions or comments? Thank you. *applause*
Angel: There is ample time for Q and A, so fire away if you have questions. Go to
a microphone, wave your hands. Signal Angel, are there any questions on
the internet? Nope. Uh, mycrophone number one!
*inaudible question from the audience* Diego: So the question is if the content
is encrypted, how companies will be obliged to implement its filters?
Microphone 1: Yes. Diego: Good question, I don't know.
I don't think that's gonna be possible. They got to find a way to do that because
either did they ban the encryption in the channels or they -- it doesn't matter
because they will make you liable. If you have platforms with very encrypted
channels and you have everything on either but by any reason they
find any copyrighted content which is not licensed, which you're not paying money
for, that will make you liable. Perhaps in practice they will not be able to find you
to make you liable because they will not be able to access the content but if they
find a way to do so they will they will make you pay.
M1: Thank you. Angel: Okay, microphone number two.
Microphone 2: Thank you very much for the presentation. You've been talking a
lot about upload filters. A lot of the telcos and lobbyists are saying that the
upload filters don't exist, that trial mechanism for the copyright reform is as
I've heard ending in January and there will be a solution in the European
legislation process. How will we be able to inform this process and influence it to
try and make it better before the European elections?
Diego: Well we still have time, that's why we are here, one of our main goals to be
35C3 apart from enjoying the conference for the very first time is to mobilize all
of those who have not been mobilized yet. Thousands of people have been active they
have been tweeting they have been calling their MEPs, the members of the European
Parliament, they have been contacting the national governments. We still have time.
The vote will be some time around January February. We still don't know. We. We are
afraid there's gonna be sooner than expected, but this is the last push, the
last push to say no to the entire directive and say no to upload filters.
And that's why we are here because we still have time. Worst case scenario:
We'll go to the implementation phase, of course, we go to a national member state
and say "Do not do this. This goes against the Charter of Fundamental Rights and then
we will stop it there. Better either now, which is my my hope, or in the worst case
scenario we will stop it for sure, in member states.
*applause* Angel: Microphone number one.
Microphone 1: You talked about voluntary measures that companies are
somehow asked to implement. What are the incentives for the companies to do so?
Diego: What do the companies have to do with that?
M1: Why should they do that, because it's voluntary, you said.
Diego: Well they could do that for different reasons because they could get
bad PR. Imagine you are a small company in Hungary and then goes Orban and tells you
"You need to block this because I think that this is terrorism. It comes from a
human rights organization." What would you do, if you understand me? That depends on
perhaps not on the government, but on the general structure. You could get bad PR
from the government, you could be, perhaps too because you're not acting promptly on
on these serious content, but it's true that is only for your voluntary
consideration. Angel: Again microphone number one.
Microphone 1: Thanks for the talk. So, I also think, when I see a problem, oh
there is a technical solution. So it's hard for me to admit, maybe not. But it
does look like it's the case but also when you mention in the workshop maybe more
with a... I mean anybody can come, but more eventually with a legal background. I
don't have it. I'm a developer, but I want to understand how a system is working and
I understand a little bit about the European process and the regulatory
process but not so much. So what's the most efficient way for me as a developer
to get a better grasp of how this system, all those laws and regulation, are getting
implemented and all the different steps. Diego: Well yeah. We didn't come to the
Lawyers Computer Congress,we came to the Chaos Computer Congress, so we can
make chaos out of it. We need developers, we need lawyers, we need journalists, we
need graphic designers, we need people with all sorts of skills. As Andreea was
saying before, and we need developers to develop tools that work so we are capable
of developing any calling tool, any tweeting or any sort of tool that we can
use to transport our message and take it to Brussels, take it to the members of the
European Parliament, take to the national member states. We really need you, if we
need something, it's developers. We have enough lawyers in this world. I think we
have too many with myself already, so we need you tomorrow and the day after
tomorrow. Angel: Okay. Any other questions? In that
case, I'll ask one myself. Andreea, what will be a good start at the member state
level to start campaigning if you've never campaigned before? Andreea: What, what?
Can you please repeat? Angel: What would be a good start. If you
wanted to campaign at the member state level ... ?
Andreea: ...and never campaigned before. Angel: Yes. Campaigning for Dummies.
Andreea: Well we've got a lot of organizations in EU member states. So, as
a person who has never campaigned before and was looking for someone to campaign
with two years ago in Denmark, I was advised to look for the Danish EDRi
member. So I did and we managed to organize a lot of great workshops in
Denmark when nothing existed, because IT- Pol, the Danish member, had a very complex
grasp of the political environment and most of EDRi members understand how this
is, how the dynamic is working, both politically, but also journalists, also
what the the interests of certain nationalities are. So I would say that:
find your first EDRi organization, that is the first step and then unite with the
rest. Diego: And there's another way. Remember
you can always contact consumer organizations. You can contact directly
your members of the parliament. You can organize yourself with two or three
friends and make a few phone calls, that's also already enough you can do, there are
many ways for you to help out. Andreea: Of course, make sure you contact
your country's MEP at the European level. We are being represented and we get to
actually elect the parliamentaries, they're the only ones who are elected by
us and not just proposed by governments or other politicians. So if we want to be
connected to our country member state but influence a law at the European level like
the ones we talked about, it is very important to let our EU parliamentaries
know that we are here and we hear them and they came from our country to represent us
at EU level. Angel: Thank you. Any other questions?
Signal Angel, do we have questions from the Internet?
Signal Angel: Unfortunately not. Angel: Well in that case we're finished.
Thank you all for your attention.
*applause*
subtitles created by c3subtitles.de in the year 2020. Join, and help us!