HAK_MTL (2019) - full transcript

Welcome to Metro-Optic,

one of Montreal's

main telecom centres,

which is a well-kept secret,

a major Internet data centre

serving the province

and part of Canada.

This room is located

beneath train tracks

in the bowels of Montreal.

About 75% of Internet

traffic travels through here.

Here we have more "private"

clients, as it were,

with their own exclusive room,

who wouldn't want it filmed.

So we'll move on.

- Who are they?

- A government agency?

- You can't say?

- They... Yeah.

It's very private.

Of course...

the hoodie's a classic.

So trite, huh?

Anonymous mask,

a series of ones and zeros,

numbers, hexadecimals...

That's often

considered a bad thing,

a crime, that kind of thing.

Not so. There's more to it.

There are different

kinds of hackers.

Some do it for the money,

some do it professionally,

some do it for fun,

some work for the government.

There's no such thing

as a typical hacker,

because there are

different kinds.

Hackers seen in the

movies are just one type.

It's important

to make a distinction.

The pessimist in me thinks

the battle has been

lost for some time.

The mere fact that everyone

carries a cellphone,

the optimal surveillance device,

beyond George Orwell's

wildest dreams

when trying to imagine

an omniscient panopticon.

This is also fuelled

by social media.

I do it, too. Everyone does.

Anything that can be

monitored is monitored,

as well as monetized.

And the prevailing

business model

for all high-tech companies now

is the selling of

personal information.

It remains a cash cow

for these companies.

And all this is based on data

collection, mass surveillance,

and the slow but steady

erosion of privacy.

It's an Orwellian

nightmare of sorts.

And I think I can

help in that regard,

through Crypto.Québec,

what we produce,

with our podcast,

articles, training,

and what we say to the media.

These matters affect everyone,

though people may

not realize it.

They affect everyone,

so this must be addressed.

Welcome to the 37th edition of

Crypto.Quebec's

Watchdogs podcast.

Hosted by Geneviève Lajeunesse,

Luc Lefebvre,

Jean-Philippe Décarie-Mathieu,

And Sophie Thériault.

We have a lot to

talk about today.

I simply wanted to look back

on a little trip

we made last week,

myself, Jean-Philippe and Luc,

to the nation's capital, Ottawa.

We visited CSIS and

CSE headquarters.

- Just to check them out.

- From outside.

- Well, you tried.

- Right.

Can you see the

building back there?

Kinda.

I really didn't expect to

see Canada's cyber elite

across from Loblaws.

For real, it's... Imagine...

Like, a huge, magical airport

next to the Quartier DIX30.

- It's kind of like that.

- That's exactly it.

- With nice bay windows...

- It's awesome.

Bay windows?

Of course.

They're all about transparency.

There they are.

Those who must be stopped.

Those who track your aunt's

metadata when she goes jogging,

because she happens to be

related to a person of interest.

- They work there.

- That's it.

I would tell an ordinary citizen

that they're the cyber

strong arm of the government.

To work there is to be part

of the problem, really.

Because they're really knee-deep

in the global

surveillance network.

I wonder what happens when

we reach the no-filming zone.

If we don't go beyond the

sign, we should be okay.

But we will be there in

about eight seconds.

There you go.

- "Breakin' the law."

- Story of my life.

Wait.

The reason we came to the

march against police brutality

was to see what

kind of surveillance

was conducted on protesters.

Would surveillance methods

be more conventional,

more technological?

So the CryptoPhone is the

device that was used in Ottawa

when IMSI-Catchers were found.

Same device.

I think it's highly

likely the Montreal Police

uses this type of equipment.

Here too, I'd wager.

This is a warning from the

Montreal Police Department.

Some protesters persist

in breaking the law.

Due to offences committed,

protesters are ordered to

disperse and leave the scene.

Otherwise,

we will be forced to step in.

I'm opposed to the

use of IMSI-Catchers,

because it not only affects

the targeted individual,

but everyone within range

of the IMSI-Catcher.

So everyone around

can be overheard,

can be tracked down here.

There isn't much to see,

the readings are not

showing anything abnormal.

Seems IMSI-Catchers

weren't used tonight.

For years,

the police denied using them.

So they were being manufactured

and sold, but to no one.

They caught me and took my cell!

Interesting.

The scenario is a thinly veiled

parody of North Korea, I guess.

Elections are being held in

the fictional kingdom of Rao.

It's rather unclear.

Seems we can either help

the regime or the rebels.

Now, we're helping everyone

to get more points.

Rao is basically a

fictional character.

People will think

he's North Korean,

but he's really based on

Mao, so more Chinese.

Everyone okay?

What are you working on?

Ah, nice!

Nice challenge.

NorthSec is a somewhat

elitist organization.

Since the event was launched,

we're the first to question

people's abilities.

They should hone their

skills to help,

because cybersecurity

is about helping people.

30 to 40% of our challenges

are won by all teams.

So about 60% of them go unsolved

by the end of the

weekend competition.

So people come here

because they know

they're really gonna

bust their humps.

They'll really challenge

themselves. And it's non-stop.

All hail Rao.

We can only vote once.

All hail Rao.

I think most people

with NorthSec

are against the idea

of mass surveillance.

Essentially, it's problematic,

giving so much

information to people

who have no business having it.

I was what's known as

a penetration tester,

a professional hacker,

in the banking world,

for several years.

When you work in this

field, in cybersecurity,

you realize that every scrap

of information is a key.

The more keys you have,

the more powerful you are.

And if this information

is misused, mishandled,

it can become a weapon

for many people.

So, of course,

most cybersecurity experts

are troubled by

mass surveillance,

because they know the stakes.

Why do it when it's

probably pointless?

Surveillance and intelligence

agencies already exist.

In Canada, we have one with a

relatively decent reputation.

Why do they need

more information?

Is it because they're...

...caught short?

Or are they simply really lazy?

Maybe they're lazy.

Subgraph is a Linux-based

operating system

designed to thwart

malicious attacks.

There are two kinds

of surveillance:

Mass surveillance, dragnets;

And targeted surveillance.

We try to prevent

targeted surveillance.

There's very little privacy.

Even people who are very...

shrewd about their

Internet usage,

their use of technology, even

they have very little privacy.

Among other things,

even if they're careful,

someone they know is posting

information about them

without their knowledge.

Foulab is a hackerspace.

It's really a collective that

offers its members resources,

and, above all, know-how.

So human capital,

in terms of knowledge,

for the sharing of

ideas and techniques.

In hacker culture, access to

information is fundamental,

in order to understand a system.

I call it an

open-source think-tank.

Now we'll rid this computer

of its malicious

piece of software.

The computer comes

with software,

which users are

usually unaware of,

installed by the supplier.

For example,

the NSA and ThinkPad

could have conspired

to install software to

access the computer remotely.

So we'll replace this

with open-source software

to ensure there's no backdoor,

or to simply make changes and

change the computer's features.

There. I have a copy

of the previous BIOS,

so I could configure

a new one here.

So I'll get OpenBIOS

or Coreboot.

I need to know the ins

and outs of a computer,

because I can't...

BIOS is at the

core of a computer.

It controls...

all functions.

So if we don't know how it works

and can't guarantee

its operation,

we can't guarantee the

computer's integrity.

So you can have the most

secure operating system ever,

but if the BIOS isn't secure,

unfortunately,

the rest won't be either.

Let me know if you need help.

Yeah, Mathieu...

if you could... hold it.

- Need help?

- Yeah. Thanks.

It'd be fun - it's

been done before -

to crack WiFi

networks from above.

So build a drone that flies

over and cracks WiFi networks.

Another thing would be - just

to prove it can be done -

to use an aerial cellphone

surveillance device,

like that used by the

police, known as a StingRay.

Essentially,

we do this to detect

critical flaws in

the infrastructure.

That's why most

people would do this.

The issue of what society

considers private and public

will define our generation.

What really worries me

is when neighbours

start pointing fingers.

We may well eventually

reach the point

where someone could

download a program

as powerful as a military weapon

and use it against

their neighbour.

Against their spouse, even.

That's what worries me most.

...3, 4, 5, 6, 7, 8, ground.

A mesh is a distributed network.

The idea is to have

rooftop antennas

to create a network alongside

commercial Internet service

and connect homes directly.

Like, connect

neighbours together.

I'm kind of discouraged.

Honestly.

People must change

their mentality,

but they seem unwilling.

They want "ubiquitous

computing."

They're willing

to be monitored by Amazon

24/7 at home through a device,

which they can order from

at the push of a button.

They use Gmail, Google

knows their every move,

their location, everything.

- What they think.

- Same with Facebook.

They're dominated by computer

technology - unwittingly.

Even when they know, it's: "I

can't do anything about it."

Basically, it's a lot

easier to monitor everyone

when they're in the same room.

We're gonna run about

10 feet of cable down.

Google, Facebook and the like

centralize information,

making surveillance easier.

If services are distributed,

it's more difficult

for a hostile party -

be it the government or

"black hats" - to spy on you.

It doesn't prevent

targeted surveillance of

a particular individual,

or even a group,

but it makes

dragnet surveillance

a lot more complicated.

Monitoring everyone at once,

then targeting

someone in particular.

Okay, the tester's hooked up.

Let's check it again?

- Let's do it.

- 1, 2, 3, 4, 5,

- 6, 7, 8, ground. - Done.

Excellent. It works.

It's all good.

Great. I'll plug into the wall.

The big problem now is

that huge corporations,

the world's most

powerful companies -

like Amazon, Google, Facebook,

Microsoft and Apple -

their goal now, their lobbying,

is geared toward

destroying the Internet.

Facebook's goal is to replace

the Internet... with Facebook.

They want you to go on

Facebook and stay there.

They entice you to

stay on Facebook

and away from ordinary sites.

Google is similar. They...

When you use search engines,

sometimes you're

stuck within Google

instead of going

to the real site.

So there are a lot of

forces at work preventing

us from re-distributing

the Internet

and make it the horizontal

platform it was devised to be.

There it is: Relais.reseaulibre.

It's the original

version of the Internet.

When I first went online in

'96, it was free.

We didn't pay for

Internet access, and...

...Internet access also

meant having a web page.

That was it, really.

It was about checking out

your friends' web pages.

What did he post? "Hi.

I'm Antoine. I play guitar."

With a picture of your guitar.

People had all kinds of stuff.

Then they started sharing

increasingly interesting things.

And it grew,

turning into Wikipedia,

into Google, and so on.

But it started with

someone in their garage.

Google started out

with a web page.

And I've always done that.

It's good enough for me.

That's it.

I don't need to connect with

all my friends on Facebook 24/7,

know the latest news,

the latest opinion,

Trump's latest fake news,

this and that on Facebook.

I don't want to be online 24/7.

For me,

it's something you turn on,

you go online, you're online,

then you turn it off

and you're offline.

I'm not always connected,

and I choose when to go online.

I call the shots.

I'm currently coding...

...what's known as

next-generation hidden services.

It's being completely

re-engineered

to improve security.

The concept of privacy

is extremely important.

Increasingly so.

If people are being monitored...

Today, it's not that

people aren't aware of it.

They know and accept it.

They're not acting in

bad faith or ignorant.

It's just the new normal.

When you know you're

under surveillance,

unconsciously or not,

you change your ways.

It really controls society.

So the beauty of Tor is,

whatever you do online,

your privacy is

protected to some extent.

I requested access

to information

from the federal government,

for all my personal information.

They sent me this letter,

which basically said:

We have your information on

file - maybe, maybe not...

I'm under investigation.

I was kind of proud, because I

must be doing something right.

I'm doing something useful,

and the powers-that-be clearly

aren't too happy about it.

So it's a vindication of sorts.

What's the conference

in Montreal about?

Okay, we're currently holding

our biannual Tor meeting.

We invite everyone -

staff and the community -

to get together, convene,

and over the course of five

days, we problem-solve, rally,

seek to improve Tor.

Any particular reason it's

in Montreal this year?

Yeah, a lot of people refuse

to go to the Five Eyes,

including Canada.

But especially since Trump,

I'd say at least half our

team refuses to go to the U.S.

- Half the team refuses...

- Minimum.

Can you explain why we

can't film the meeting?

Right. I mean,

these people are for privacy.

They don't want to

end up on Facebook,

have anyone know they came.

Some people here

literally can't be filmed,

because they're coming

here at their peril.

So, overall, their

privacy must be respected.

Projects like Tor,

like Subgraph, aren't winning.

This great surveillance machine

is obviously prevailing.

Clearly.

Of course, there's pushback now.

But I think we're 20 years

behind our rival, as it were.

The forces at work

behind this security and

surveillance campaign

are very powerful.

We're talking huge corporations,

governments, and so on.

So it takes tremendous effort

to make a real impact.