 Hi, everybody. My name is Dia Kayali, and my pronouns are they, them. So I just want to let you know a little bit about who I am and why I care about this. So I do a lot of street-level work, what I call street-level work in the States. So I have been very involved in doing legal support for things like Black Lives Matter and Occupy. In fact, I was arrested in a big demonstration many years ago. That's a lot of what led me to this work. I've also done a lot of community organizing with the Arab, Muslim, Middle Eastern, and South Asian community, as I'm sure you're aware. They are targeted by surveillance to an incredible degree. And I am Syrian-American, so all of this is very personal to me. So before I start, I just want to talk a little bit about a project, which was the last thing I worked on at Electronic Frontier Foundation, and give thanks to the people I worked with. So this is the Street-Level Surveillance Project, and I especially want to give thanks to Hany Fakuri, Jennifer Lynch, Dave Moss, Jeremy Galula, and Cooper Quentin. These are the folks who helped compile information for this project. And the Street-Level Surveillance Project unites EFF's past and future work on these sorts of law enforcement surveillance technologies into one easily accessible portal. And it is incredibly important right now. I'm gonna talk about why. So for those who are not familiar with the concept of the Panopticon, this comes from the 18th century philosopher, Jeremy Bentham, and it is the perfect prison. So the Panopticon is a central tower with the cells placed around the central tower, and the person in the middle can see everybody, and they know that they're always being watched. They cannot see the observer. And so the idea of the Panopticon is that it will control people's behavior without the guards ever having to actually do anything, simply by knowing that you are constantly being observed, you will change your behavior. So are we there yet? My argument is that today, you certainly don't need to be in a prison to be in a Panopticon, nor do you need to be online, and I'm gonna talk a little bit more about what I mean by that. I would say that the Panopticon is all around us right now. So takeaways that I hope you'll get from this talk, street level surveillance is mass surveillance, and it doesn't affect everybody the same, but we all need to fight it. And what I mean by that is that different communities are affected by surveillance differently. It's not as though a camera has the same impact for a person with light colored skin or a person with dark colored skin, and I'm gonna talk a lot more about that in this talk. And then finally, what are you gonna do about it? We're gonna talk a lot about why this is so bad, but what can we do? And I'm gonna talk about three points, how we can prevent this technology, how we can expose both what it does and its vulnerabilities and where it's being used, and how we can empower the most affected, but also all of ourselves. So who you are matters when it comes to surveillance and particularly when it comes to street level surveillance technologies. And imagine everybody here is familiar with the people in the lower right corner, but if you aren't, that is Martin Luther King Jr. and Malcolm X, and that's a reference, of course, to the incredible degree of surveillance done on the civil rights leaders by the United States, which actually led to the church committee hearings, which created FISA, which is the law that governs surveillance now. So they were subject to an incredible, disturbing degree of surveillance. So the Syrian refugee, I'm gonna talk a little bit about the sort of surveillance that they're experiencing right now, and in the top right corner, those are workers rights activists. They are Latino and Chicano people in Los Angeles who are demonstrating. They are also, again, as people who are activists, who are out in the streets and who are coming into contact with law enforcement, and as people who are not necessarily citizens in the United States, they are subject to an incredible degree of surveillance. So throughout my talk, I'm going to point out places where technology may be experienced differently by different communities. So why street-level surveillance? Why am I talking about this topic? So just to preface this a little bit, particularly after working at EFF for a year, I stopped using the phrase IRL, I stopped saying in real life, because the distinction between, and I'm sure I'm talking to people who probably already feel this, but the distinction between what we do in our everyday lives when we're walking around and what we're doing online is rapidly disappearing. For instance, I have family from Syria who are not on the same continent as me. This is the only connection that I have to many of them is being on Facebook with them. So we know that what we're doing online is absolutely revealing the most intimate details of our life and we need to keep fighting for freedom online. But the fact is that when it comes to what we're doing in our everyday lives offline, the richness of the data that can be captured by street-level surveillance technologies in the physical world is moving ever closer to the richness of the online world. In many ways, the online world is already the perfect panopticon, particularly if you are like many people who are not using encryption, right? But the physical world is also becoming a panopticon in that same way. So the online world and the offline world are both moving towards each other. And in particular, with street-level surveillance technology, the data is often easily analyzable. It often comes with metadata attached. And so these technologies are helping us be turned into data more than ever before and more that only what we do online could achieve. So it's everywhere. We are now numbers and we are now analyzable everywhere. So, you know, when we're talking about these things, IRL doesn't really work, meat space, that's a good one, but maybe not what I would wanna use when I'm talking to lawmakers and policy makers. So street-level surveillance. So as I mentioned, I just wanna touch on the fact that street-level surveillance really is mass surveillance and the reason this matters is that, of course, I'm gonna be talking very particularly about how street-level surveillance technologies affect some specific communities and how it will affect you if you're targeted. But if you're not targeted, this is still going to capture your data. These technologies are still going to capture your data and mass surveillance without ever having any sort of results from the data that's captured, we all know that mass surveillance chills freedom of expression and that's what we want to build our society on, is that right? And so it matters that this kind of technology is also mass surveillance. So if you define mass surveillance as surveillance of big groups of people, usually without suspicion that they've committed a specific crime, street-level surveillance technologies do that. And if you define mass surveillance as surveillance that captures data that can be analyzed in the aggregate in particular to determine social networks, street-level surveillance data also does that. So again, this technology is turning the lives of everyone it comes into contact with, regardless of whether or not you are a target into easily quantifiable data. So this is probably a review for some folks but I'm gonna just go through what sort of a typical day in an average city under a street-level surveillance regime is like. So awesome smiles, I imagine people recognize the image in the middle and we've all seen it many times. This is a notice from Berlin that you are being recorded. On the right, we have cameras from the New York Police Department. The upper left corner is a cleverly disguised camera from Helsinki and then in the lower left corner that is mobile CCTV from Glasgow. So really just to walk through it, the second that you leave your house, you're going to start getting captured by cameras. And now your face is getting captured, your movements are getting captured. And it's not just law enforcement cameras, of course. So a really interesting example of this is in San Francisco. The San Francisco District Attorney, this is the prosecuting attorney for all the crimes that happen in the county, has a program where they actually ask private camera owners, so businesses and individuals that might have cameras in their driveways, things like that, they ask people to register these cameras. And once the cameras are registered, that gives them a map of where every single one of these cameras is in the city. So it's not just their network and it's not just their money, it's everybody else's as well. So they have this map and they also have the owner's information. It makes it incredibly easy for them to request information any time that they might want about what's been recorded on those cameras. Now here is the first place where I'm gonna talk a little bit about how this is going to affect you differently depending on who you are. So another example of non-government-owned cameras is, comes from Oakland, California. There is a specific part of the Oakland Police Department that deals with alcohol beverage control. And in some of the work that I did working with the Arab and Muslim community, one of the things that we heard is that these teams that were supposed to go in and check and make sure nobody's selling alcohol to minors and that they have their license displayed, what they would actually do is go into stores owned by Yemeni people or other Arabs. And these are stores that are primarily in Black neighborhoods in Oakland. And they would go into the stores, they would walk around and they would find maybe a can of expired soup. You know, maybe they had their license in the wrong kind of frame, something ridiculous like this. And they would go to the store owner and say, you know, doesn't look like you're complying with the law here. But, you know, we could work with you. We can work something out. If you just give us access to your cameras, you know, you'll be fine. The other thing that they did is in the States, pretty much every local police department in a big city also has at least one or two FBI, Federal Bureau of Investigation officers that, or sorry, one or two police officers that work directly with the FBI. And so they have this very strong collaboration. And so they would threaten people with, you know, I heard that your aunt has a visa application. You know, maybe you could work with us and we could see that she's a good citizen. So not only is this bias against the people in the neighborhood, it's the people who are running the stores. And it's been very effective. They've gotten a lot of video that way. Another example here, and I think this is a very important example to touch on, is that, you know, we are used to seeing cameras in most places, but maybe you're not used to seeing a camera on your front porch facing your door or something like that. People who live in housing projects in the United States, people who live in estates in the UK, people who live in favelas, they are all completely used to having incredibly pervasive surveillance all the time, even beyond the degree that we're used to when we're seeing these notifications everywhere on the subway or on the street. This is really invasive right in their homes. And so I think this is very important because often as an activist or as a technologist, we talk about privacy. We use it as a theoretical concept. But the fact is that for many people in the world, in particular the most marginalized people, the idea of privacy doesn't make any sense. And so this can actually be very destructive to movement building, to not take into account the different circumstances of the people whom you're talking to. So just something to keep in mind if you're an activist and also maybe something to try to do more activism around. The idea of talking about privacy to a Syrian refugee who just crossed the border or a young black man in New York who has been stopped and frisked maybe every other day for months, for years, for his whole life, doesn't always make sense. So once your image has been captured, it is subject to biometrics. So biometrics, work in conduction with these cameras. There are some biometrics that have to be actively collected, of course. This is a fingerprint scanner being used in the West Midlands. And this is, I actually got this picture. They put it on Flickr and it was Creative Commons and they were very excited about their mobile fingerprinting program. This is mobile fingerprinting. It goes directly to a database and they can check it instantly. So they really wanted people to know what good work they're doing for public safety. The photo on the left is an Indian woman who's getting registered using iris recognition. So those are a couple of types of biometrics. Of course, there's also gate recognition. There is hand telemetry. There is scar recognition, tattoo recognition, iris and retina scans up there, and voice recognition. So again, this is another place where you're going to have a very different experience depending on who you are. Anybody who has ever had contact with law enforcement is much more likely to already have their information in a database. Just go back to the previous example. If you are a young black man or a man of color in the United States, the likelihood that you've ever been stopped and hassled by the police, the likelihood that they've taken your picture, the likelihood that they've taken a cheek swab to get your DNA or that you've been fingerprinted is going to be much higher. And the fact that all of these things happen to you doesn't necessarily mean that there was ever any charges filed against you. And I think we all now know that it doesn't necessarily mean that you were doing anything. It means that you're in an area that's crawling with police and they're more likely to arrest you, stop you, hassle you based on the way that you look. And so another example here, and this is one that I would love to get more information on is refugees. So Iris Guard recognition technology as of June, and I wasn't able to find any more recent numbers, has enrolled over 1.6 million Syrian refugees at this point. We're now, the EU is now also fingerprinting refugees. So in Germany, they're using fingerprint scanners to create a database of every refugee in their fingerprint. Another example of how this may affect you, this is less about a characteristic and more about your activities, is if you are an activist who's out there in the street demonstrating. So a very disturbing example of this comes from New York during the Occupy demonstrations. Protesters were arrested and there's sort of a dance that you do when you're a protester. You get arrested, they process you, they usually release you without bail if it was for something minimal. Instead, what the New York Police Department did is they refused to release Occupy demonstrators without an iris scan. So this is, again, before anybody has been charged, specifically, they're not necessarily specific charges, there's a police report, but they are simply because of the fact that they were arrested, they're getting their iris scanned. So you're walking around, you're dealing with all these cameras, you're dealing with biometrics. If you wanna go anywhere either driving or public transit, you're going to increase the amount of surveillance that you're experiencing and automated license plate readers are something that if you're in a vehicle, you should be concerned about. So automated license plate readers, they have a couple of different names, also automated number recognition, they're called different things, but these are cameras and they can be mobile or mounted that can detect when a license plate enters the camera's field, capture an image of the car and the surroundings, including the plate, and then convert the image of the license plate into alphanumeric data. This also will get some sort of basic metadata, like the time that it was captured as well. So to give you an example of how powerful this technology is, Los Angeles Police Department, which Jennifer Lynch at the EFF has been suing to try to get some basic data about how they use this technology, they do extensive ALPR collection. They collect combined and on average, data on nearly three million cars per week. So that is half of all the registered vehicles in Los Angeles. So they're collecting an incredibly huge amount of data and then they store that data for two to five years, whether or not the plates are ever linked to any sort of criminal activity and they share it with nearly 30 other law enforcement agencies around the region. And just side note there that this kind of information sharing, it's very US centric, so I didn't wanna focus on it, but just to say that in the United States, the idea that there's sort of barriers between different law enforcement agencies if you move from one jurisdiction to another or that you might not be affected, that they might not know what happened a couple states over, that that's just not the case anymore. All of this data is shared. In the Bay Area, for instance, all of the license plate reader information that is captured in the nine Bay Area, nine counties that make up the Bay Area all goes to a centralized location. This is the Northern California Regional Intelligence Center, it's a fusion center that combines all of these different levels of information. So when we're talking about this data as mass surveillance and we're talking about how it can be analyzed in the aggregate, you don't just wanna think about the local agency that's collecting it if it is a local agency and not border patrol or something like that. It's also about how the information is getting shared and combined. And automated license plate readers are particularly concerning because it very rapidly becomes clear what they can reveal about you. Even without aggregating the data, having your car parked outside of a psychiatrist's office or an abortion clinic or a demonstration, a church, this reveals a lot. But then think about taking all of that data and taking it for a city like Los Angeles, a huge city and the amount of information that they're capturing and aggregating that and being able to see movements and being able to see associations between different vehicles. This is revealing in the same way that a phone call metadata is revealing. The law enforcement is able to collect an incredible amount of information. So a couple of examples of how this is used in a discriminatory way. So this is a heat map from Jeremy Galula and Dave Moss at EFF. They did some great work with the week's worth of automated license plate reader data that they got from Oakland, local police department. So the neighborhoods shown here are the places where automated license plate reader use is the heaviest. So North Oakland, and for those who are familiar with Oakland, this says North Oakland, but it's the area a little bit south. So this is sort of Northwest Oakland and East Oakland. These are two of the biggest concentrations of people of color in Oakland. Not only that, there are neighborhoods that currently have a lot of housing fights going on because they sort of have, like people are getting pushed out. So as you can see, the heat maps overlaid onto the heat map, or the heat map overlaid onto the census data shows that the use is heaviest in communities that are already incarcerated at incredibly disproportionate rates. And this sort of street level surveillance is going to help put them into prison, help tear their families apart, and is hardly going to make the community safer. So that's Oakland. Another example is New York police department. So New York police department in 2011, the Associated Press revealed this wholesale surveillance of Muslims and people who were from countries perceived to be predominantly Muslim. This was the New York police department's demographics unit, and it literally mapped out where all of these populations were. No suspicion, but it mapped out the populations. So street by street, there's mapped out the locations people spent time in. So looking at street by street, here's a cafe, here's a mosque, here's a block that has this many Moroccans living on it. So very detailed mapping out. They also used informants in churches and mosques. And of course, they also used automated license plate readers. And I should say for the New York police department's surveillance that I would be curious what it would look like now because it happened several years ago. But they took these automated license plate readers and they literally put them on police cars and drove up and down the street in front of mosques and captured the plate data for everybody who was attending their religious services. So they did this without any particular suspicion about any of the people or places surveilled. And I should say again, coming from my work in the community that Muslims in America have made it very clear that they feel intimidated from going to church. They're scared to practice their religion and of course it's even worse now. But that is the kind of impact that this type of surveillance is having on that community. So even if you are, oh, and actually one other point about Oakland, Oakland has a tiny rich town in the middle of it called Piedmont. I wish I should have included a map of this. It is literally a town that is surrounded on all sides by Oakland, California. And this town essentially is seceded from Oakland because they were rich and they wanted to have a rich town. And so they created their own borders. And at the only entrances into this town, it's called Piedmont. There are automated license plate readers. So what does that mean? That means that everybody who's coming from Oakland into Piedmont at Oakland, which is less and less so predominantly black but still a large community of color. Everybody who's coming from a community which Piedmont considers undesirable is getting their license plate captured. So not only can it be used by law enforcement in a way to track people and do criminal investigations, it also, because people know that this is happening, it also can be used as a way to sort of repeat the theme here, keep communities gated. So I also just wanted to mention automatic ticketing and tolls just because they are, even if they're not law enforcement, sometimes going through an automated toll system is the only way to get somewhere. On the Golden Gate Bridge in San Francisco, you're either going to go through an automated toll system or you're going to have a picture. And actually, at all of these, they're also capturing your license plate. And of course, electronic ticketing systems, again, well, they may not be operated by law enforcement. They are completely willing, at least in the United States and Canada and South Africa, and I imagine elsewhere, they are completely willing to hand over that information to law enforcement agencies on a voluntary basis, meaning without even any sort of court order. Cell site simulators. So, cell site simulators, also known as MC catchers, also known as Stingrays. These are, for those who don't know, these are devices that masquerade as cell phone towers and they trick your phone into connecting with them in order to capture the location of your phone. Now, in the United States, law enforcement insists that they only do this to collect location, but of course, cell site simulators can also intercept content. They can jam communications. There's been some research into the use of cell site simulators to remotely inject malware, so they can do a lot. And the location information that they are capturing, again, very easily susceptible to aggregate analysis. And if you are, these are perfect example of mass surveillance in that one of the ways that law enforcement uses them is to figure out if they know, if they have a suspect and they're trying to determine what phone they are using, so they know the suspect, they don't know the phone or the IMSI for the phone. So they will turn on this cell site simulator in areas where they know that the suspect will be and they do this several times and they capture the data of everybody there and then they sift through it to find the number that comes up repeatedly. So by necessity, they cannot use this technology without capturing everybody's information. And cell site simulators in particular are a concern for activists. Black Lives Matter activists have reported all sorts of suspicious things happening with their phones that they can't explain. They feel very certain that cell site simulators are being used at demonstrations, but they can't get the information. And in the United States, the image that I have up here is of a Stingray. This is the device manufactured by Harris Corporation. This is the company that manufactures most of the devices, at least the devices that are getting attention in the United States. And the Harris Corporation has been totally complicit in forcing local, state, and federal government to not reveal any information. And their argument is that it's trade secrets. You can't know how the device works. But in effect, what it has done has made it impossible to get information about these devices. And some of that has changed, and we know some, but we don't know everywhere they're being used. And another thing to point out here about cell site simulators is that again, in the States, they are often used for fraud cases, but they are also often used for drug cases. And drug cases disproportionately are targeting people of color, even when we know that use of drugs among white people, higher, but it is people of color who are often being affected by this. And also, this is of course, in addition to the incredible ease by which the government can obtain locational data directly from your cell phone provider. I don't know if people have seen the article that just came out earlier this week, or last week, about Hyde Park tracking visitors via Bluetooth, so Bluetooth is another way that people can be tracked. But there are myriad ways to obtain, at the very least, your location data, cell site simulators can do more. So this is sort of at a baseline what you would see on any given day in the city. So what do we do about it? Can you encrypt the street? Well, we've got some answers here, not really very practical. One of the things that is helpful that I like to tell people about, of course, when it comes to cell site simulators, if you're using end-to-end encryption, that's helpful. There's also, of course, been some fantastic research on detecting them, so Security Research Labs app, Snoop Snitch, that's a fantastic app, and knowing that it's there is part of protecting yourself. But typically, the advice that activists get is just don't bring your phone. That's really completely impractical, particularly for people like Black Lives Matter activists who, the only reason people started paying attention is because people were there on the street with their cell phones, tweeting, sending videos, and communicating really instantly with the outside world. So the idea that somebody can't bring their cell phone doesn't really make sense. There are anti-drone hoodies, probably not something that you would wear every day. They're like a, couldn't put up pictures of them because they're copyrighted, but these are like reflective hoodies that sort of cover your shoulders. There's also anti-facial recognition makeup, and well, I would totally wear that every day because I think it looks awesome. Probably not the case for everybody. There's also reflective coating on your license plate in order to avoid a license plate reader. Doesn't work, it's been tested, it doesn't work. And it's also, even though it doesn't work, it's actually illegal in some states to do, which is kind of funny. So what do we do? That's why I'm here. I'm hoping that you're all gonna help me out, or at least a couple of you. You don't have to if you're here, but. But what we wanna do is prevent the adoption of these technologies, expose their vulnerabilities and expose where they are, and we want to empower ourselves and particularly the most affected communities to fight these technologies. So prevention. When I'm talking about prevention, I mean actually convincing lawmakers not to adopt this technology. And this absolutely goes hand in hand with exposing it. So it's kind of a hard decision, what do I put first? But this is just, my examples all come from the US from very local grassroots movements and I would be really curious to hear at the sort of city level or things like that, what other people are doing. But there are a lot of activists in the Bay Area, in Chicago, in New York, in LA that are doing work on this. So preventing the adoption of this technology, this is an example from San Mateo County, California. This is part of the Bay Area. They were considering getting a cell site simulator and they immediately had activists who sent them letters and who showed up at their meetings. And there was one person on the board of supervisors, just one lawmaker who really became a thorn in the side of the process to getting this. And I should say in the US, a lot of the money for purchasing this technology comes from the federal level. So it comes directly from the Department of Homeland Security and it's funneled down to local law enforcement and they get huge chunks of money and they have almost no conditions on the money. Really the conditions are this as the kind of technology that you can purchase. The conditions aren't, you can't invade people's rights with this, if we get a certain number of complaints we'll take the technology back. It's nothing like that. It's really just, you can buy these things, there you go, have fun. Like big brother just giving pocket money to little brother. So it's very easy for law enforcement agencies to get this and I think talking about the monetary issues with this technology, it's a whole other talk. But this was a case where the county already had the money. So to lawmakers, it's like free money, you're gonna turn down free money, but they were convinced after hearing from activists who said once you get this technology, Harris Corporation is not gonna let you respond to Public Records Act requests and it's gonna be used to violate our rights. We don't support it. And then with the help of that one lawmaker, they were actually able to prevent the purchase of the system. Of course, another example is the Domain Awareness Center in Oakland. This is a project that was going to take all of the different cameras in Oakland and all of the information at the port and going to combine that with just like the system that law enforcement uses to get updates, with weather updates, with shot spotter, which is little microphones placed in the street that are supposed to turn on when they hear gunshot. It was going to combine an incredible amount of information and of course as I just showed this ALPR map in Oakland and the experience of store owners in Oakland, it's clearly a city that has lots of problems with biased policing and the community was pissed off. They were so angry and this was really incredible. I mean, people showed up at city council meetings and they would stay for these city council meetings would last for like eight or nine hours and people would just be sitting there waiting for their chance to talk and they would just wait it out and they would argue with the lawmakers. So what ultimately happened with the Domain Awareness Center is that it was supposed to be Oakland wide and it got pushed to only the port of Oakland so it was made smaller. This actually cost the city money because they had to take out the traffic cameras that had been integrated into the system and the number of times when you can actually convince a government agency to spend money to fix rights, doesn't happen very often. So this was really a huge success in the shrinking of the system. Now, most community members who came to these demonstrations made it clear they didn't want the technology at all. They just didn't want to have it. But what ended up happening is that it was still there for the port and there was a very extensive and specific privacy policy put into place. I was on the committee that helped create that privacy policy with another member of the committee in the audience and it was a very difficult process but it is the first sort of privacy ordinance like that that has existed really, very comprehensive. So knowing how the technologies are vulnerable, this is one of the things that activists really need to be talking to technologists more on. There has been great research and there definitely needs to be more. Some of the really great examples that we see are for instance in 2012 at Black Hat, there was a demonstration of how you can fake an iris scan quite easily. Also in 2012, a researcher at the University of Texas showed how you can spoof GPS signals that for satellite-controlled drones and was able to take over a drone. He actually did it well, well people from the Department of Homeland Security were watching because he was trying to demonstrate to them why the technology was vulnerable that really didn't stop them from wanting to use it and spread the technology everywhere and pay cities to use it. And then of course, a wonderful example. In 2013, KS Computer Club hacked an iPhone 5S and for those who don't know about this hack, incredibly simple. To somebody like me, I'm not a technologist and FYI when we get in the Q&A session, if you ask me really specific technological questions, I'll bet somebody else in the audience can answer that. So they hacked an iPhone 5S simply by taking a photograph of a user's fingerprint, converting that to a mold by printing it out and then using pre-coded photosensitive boards and a little bit of wood glue, and that was it. Incredibly simple. And this is technology that people are still using. People are still locking things with their fingerprint. Companies are still using fingerprint access, but we know that it is vulnerable. So that's exposing the technical vulnerabilities, but we also need to be waging public information warfare. So this is an example from Los Angeles. Fantastic work from a community group called Stop LAPD and Spying. And so what they did is there is an Inspector General for the Los Angeles Police Department. They're supposed to investigate Special Order One, which is, we won't get into it, but it's a specific type of surveillance that the LAPD does that they report directly to the Fusion Center there, so this state, local, federal information clearinghouse. So the Stop LAPD Spying group, they saw the Inspector General's report and they said, you know, this doesn't really seem right to us. We're gonna go ahead and file our own Public Records Act requests and we're going to analyze that data. And we're also, and this is what's really important, we're going to include the stories of the community. We're going to include stories from people who have been stopped for no apparent reason, who have had these experiences that seem, you know, if you don't know what sort of surveillance is happening, it just seems like a very scary experience to somebody who's getting stopped in Skid Row in LA, getting asked these questions and they don't understand why. So they put together a People's Audit and they have used, they've used this People's Audit, I've used this People's Audit. It's an incredibly detailed report about the surveillance that LAPD is doing and it actually, they compare the report to the report from the Inspector General from the police agency themselves. So that's also exposing sort of how these internal bureaucracies do or more likely don't actually look into technologies very extensively. So this is another example of research and how these technologies work and this is from EFF. This is an automated, this is a publicly accessible feed from an automated license plate reader. So Jeremy Galula and Dave Moss and Corporal Quentinall looked at how they looked at vulnerabilities that have previously been found by researchers and when I say vulnerabilities, it's maybe not even the right word. I mean, maybe just stupidity is the right word because these are publicly accessible feeds. Like literally if you can find the right webpage, you can view an ALPR. These are publicly viewable configuration webpages and this is easily accessible telnet access. So why does this matter? This is a perfect example of how expose and prevent work together. They responsibly disclosed their findings to the police departments involved and they actually got some police departments to improve their systems. And I wanna make a note here about exposing vulnerabilities and about doing this research. What I am really encouraging you to do is not to just find the vulnerabilities but politicize them. If you're just finding the vulnerabilities, you're giving them a chance to fix the vulnerabilities and maybe giving them free help. But instead, politicize them. Talk about why it matters. So this is another example of exposure. This is a camera map from, and I'm gonna have to speed through because I'm almost done and wanna get to questions. So this is a map from Tampa, Florida. This is a project that was done for the Republican National Convention. The Republican National Convention and the Democratic National Convention are always huge demonstrations in the US. Lots of people getting arrested, usually tear gas, rubble bullets, all of that fun stuff. And so somebody actually just created a project to map where all the cameras were prior to the demonstrations. Some of these cameras were installed specifically as security for the demonstrations. They were left in place, which is always what happens. It's what happens with the Olympics. It's what happens whenever we have any big events. So this page is still up. There's also a similar page for the New York Police Department surveillance cameras which has not always been maintained. So something that you're interested in. Something to think about. So we need to let people know what's happening. We need to expose these technologies. But if we just do that, it's very frustrating. So finally, we want to empower. We can't just talk amongst ourselves. Those of us who understand this technology can't just have a conversation and say, well, you know, I'm not too worried about cell-sized simulators because like I always use signal and I don't care if they know my location. That's not helpful. What we need to do is educate people and work with them, especially the most marginalized. This can be technological. It could be know-your-rights if you're an activist or attorney who has that information. But we need to be working with people. And a great example of this. So this is a picture from the NATO protests that happened in Chicago a few years ago. I was there doing legal support. It was very disturbing. Some very disturbing violence that happened with law enforcement. And in Chicago, there's a technologist, Freddie Martinez, who has been working with activists to deploy MC catchers. So he actually gave activists phones that already had Snoop's niche installed. He did all of the work of installing it and explaining to them how to use it. And they went around Chicago and they figured out where MC catchers or cell-sized simulators were being used. But he didn't just do that. He also gave them security trainings. He also taught them sort of what to be on the lookout for. And as a result, activists who previously never knew about cell-sized simulators are now doing things like listening to police scanners and saying, wow, we just heard something really weird and it sounds like they're using a cell-sized simulator. This is knowledge that they wouldn't have had. This is knowledge that we want to have. But it doesn't happen unless we're working together. So how can we defend from the technologies we already know about? How can we make things better? That's for me to work on, but it's also for you to answer. And with that, I am open for questions. Thank you very much. We have slightly over 50 minutes for questions. And the first two questions go out to the internet. Yes. Have you actually run into many companies that do it? Like, do you know that Mall of America or something is actually giving their surveillance cameras access to the police? Can you repeat the question? Do you know of many companies that actually do give their surveillance camera data to the authorities? Well, if you're talking about... It depends on what level you're talking about, but absolutely. I mean, at the level of the cities that I've worked in, the sort of program that I mentioned with the district attorney in San Francisco, there are programs like that all over the US and I can't imagine that that's not happening in Europe either. And so I don't know if you're referring to people who actually have these cameras right now, but yes, certainly there are specific examples. And can you get information about that using something like the Freedom of Information Act or whatever is applicable in your country? Yes. So the People's Audit that I was mentioning, that the Stop LAPD Spying Group did, that was through stories and interviews, but it was also through Public Records Act requests. And actually, EFF, Street Level Surveillance Project, one of the really exciting pieces of it was that it had a, there was a partnership with Muckreck in order to do PRAs about biometrics. So they just had a, and actually it's still up. There's just a little form you can fill out. They'll do the PRA for you. Of course, what we see is that unsurprisingly, you get denials all the time. You deal with companies who are actually colluding with the government to try to keep things private by arguing that they have trade secrets. But most of what we know is through Public Records Act requests. Before we move to the room itself, may I remind you that questions are short sentences that aren't with question marks and do not include extensive expressions of your gratitudes. First question over there. In Sweden this year, we actually looked at telephones. You briefly mentioned telephones, mobile phones. So what we did was that there was this company that collected Wi-Fi, Mac addresses and SSIDs to measure the flow of people in the city centers. So we actually got our regulatory agencies to consider Mac addresses as personal identifiers. So that was all of a sudden regulated. That is fantastic. So it sounds like you actually worked on pointing out to them why this is a problem. That sort of surveillance of Mac addresses, this happens all along the US-Canada border and over and over government officials just say, well, it's just Mac addresses. So that's exactly the kind of strategic intervention that we need everywhere. Why do you find it difficult to get information about these products and their features? Because there are trade fairs everywhere. I go there, they talk about whoever they can offer. It's easy. So just as I mentioned how these technologies affect people differently depending on the color of their skin or what they look like, I can tell you that I would never be let into, at least in the States, I've actually tried. There's something that happens in Alameda County called Urban Shield and it is partly really just a marketplace for this technology. Even if I put on a suit, they're not gonna let me in. So if you have a list of publicly accessible trade fairs, please come talk to me after because I would love, I would love. And actually some of the best information that we have does come from that source. I mean, there was a fantastic, there's been a couple of fantastic articles from journalists who have gone to these trade fairs and talked about what they found. And I would like to add that there's a project in Holland where we are combining the data, the video surveillance data of a couple of organizations to surveil the whole area in one go, except instead of setting cameras everywhere. So we're doing it. Excellent. Anybody, if you, I would love, anybody who has any of these projects, talk to me after so I can write your information down because I want to know more. First off, thank you very much for doing this talk. I wanted to ask about your techniques for reaching out to the communities who are most affected by this. How do you, what's in your mind when you're trying to find allies in this space and what works the best for you? And the second is a little bit of a confirmation question because I think we all know that about gentrification in San Francisco and in the Bay Area, the second question is what is the reaction of the tech community that it's coming into this area and do they know about it and have you seen anybody? My gut instinct is no, they're not aware and they're not a part of this. But what would you say? So those are two excellent questions. To the first, it is definitely important how you reach out and how you try to work with people. Again, I know I've mentioned Black Lives Matter a lot of times, but I think it's an incredible example of activism in the United States and it's also a community that is very used to having people come in from outside and say, you know, you don't know about this and you don't know about that and I think I better explain it to you. That's definitely not the way to do it. I think the way to do it is to seek out individuals, to reach out through your networks, to reach out to somebody individually and say, hey, this is the knowledge that I have. I think it might be helpful, but I'm curious what you think. So it's about not like presenting to somebody a fully formed package of this is what you need from me. It's about actually finding out. So I think that's one important thing. I've actually done door knocking in Oakland, like in specific areas where things are happening. There's a lot of pitfalls to that and I'm happy to talk to anybody about it afterwards. But it does require some humility, some sensitivity. I'm sure that here, if you wanna work with refugees, it's not like they're gonna say, oh great, I wanna work with you and I don't have any suspicions. So I think that's a lot of it. And there is just so much to that and to that kind of community organizing that that could be a whole series of talks. Now when it comes to sort of tech workers in the Bay Area, so in Oakland at least, I know that with the activism that was happening, because Oakland, again, also getting very rapidly gentrified, with the activism that was happening, there were some tech workers that were involved, but for the most part, not. And the impression that I get is that there's not, I don't know, it's not totally my community, but they haven't been prominently involved in any of this, certainly. And they're helping to capture data, so it's not surprising that they wouldn't be. I was wondering if in your research, you mentioned the interconnectivity between law enforcement agencies sharing their data. Are the companies who collect, say, pictures from the street working with people who do mobile ticketing to share their information, to create a picture of someone's day-to-day life? So mobile ticketing and what was the first? Like just cameras? Are they particularly sharing data with, say, the people who capture camera feeds on the street? It's obviously independent companies. Are they connected as law enforcement agencies or connected to really expose someone's day-to-day life? So I haven't done as much research into that. I mean, instinctively, I would say the answer is yes. And one thing to keep in mind is that, but I can't say, has not been my focus. One thing I can say is that once your data is collected, it can be considered valuable in the same way that online data could be considered valuable. But I'm not certain, and I think that that's an area that needs to be looked at more. Thank you. Next question is for the internet. So how do we find out about our local governments adopting these technologies beforehand? So this very much depends on where you are. I can mostly only speak to the states. And this is one of the sort of pitfalls of dealing with these types of technologies and why it's so important to be talking about it here because we get a chance to all talk to each other. But in the states, it's usually three things. One, people who are on the streets will notice something weird happening, or they'll notice that they're getting it, they're getting, that police are talking to them, they're not exactly sure why. So they'll notice something and they may actually go to an organization like Electronic Frontier Foundation and they may go to people who they know are already doing this work and they'll actually go analyze. So like with cell site simulators, people will actually go analyze and say, okay, we're seeing all of these discrepancies. Looks like this is maybe in use here. That's one way. The other way, and this is very frustrating, but there are people who do it, there are people who do it incredibly well in Oakland, is actually, if you, if there are requirements that before your city council or the police department or anything, if there are requirements that they notify you about what they're going to be discussing. So this is in the States, before any city council meeting or before any county board of supervisors meeting, there's some sort of notice requirement about what they'll be discussing. And there are people who just continually pay attention to these announcements, because they hide things in there and they expect that nobody will ever see them. So before it ever gets adopted, the lawmaker's worst nightmare is having like 40 angry people outside their door saying, are you kidding, you're gonna give cops this technology when they're already harassing people. So paying attention. And then of course the third is doing public information requests. So public records act requests, paying attention and seeing what you get in there. And really reaching out to get help, because sometimes you'll get requests and if the right person is looking at it, they'll notice one thing that will then lead them to make further requests so you can sort of follow the breadcrumbs to the technology. So societies have a tendency to penalize and criminalize many things over time. So first we catch the murderers and the thieves and then the people who do, who speed with their cars. It's a tendency we have. We create more and more laws. What is your question? We create more and more crime to go ahead. Sorry, what is your question? My question is, is our answer to society accept a certain level of criminality and stop the surveillance? Or is our answer, hire many, many more policemen who do manual work and stop the surveillance? I mean, I think it depends on who you are. You're talking to me. So my answer is that we have all sorts of structural problems. Ultimately, I think we should be in a society without police. Until we get there, until we get there, this, my strategy is harm reduction. Particularly as an anarchist who does sort of policy work. It's about changing the effects of this technology right now for people who are being affected by it. I will go, I will argue all day long with lawmakers about the crappy technology that they're adopting, even though I think they shouldn't have the right to adopt it in the first place. And that's harm reduction. You can have as many ideals as you want, but that's not fair to the people who right now are getting sent to jail. So get rid of the cops. In the meantime, reduce the harm that they can do. Curious in your research and in your experience, what the reaction is from the police when people try to protect themselves and each other using things like makeup or reflective hoodies, like you mentioned. And then maybe I have a fantasy about someone rigging up a bunch of burner cell phones and making some kind of fancy DDoS attack against these cell simulators. Where do they draw the line when they start to say you're impeding police progress and now you're arrested? Well, I think with the sort of physical barriers, they've always been, they always get aggressive in the face of that. And of course, now if you wanna put a mask on your face, at least in the United States, automatically you're gonna say you're black block and you're about to break some windows. But even regardless of that, if you have your face covered, the reality is, and this comes from my work doing legal support, the reality is that even if it's not legal for police to tell you to take a mask off, they'll still do it and they'll still arrest you. Later, you can sort out the details of the fact that they weren't allowed to do the arrest, but they will be aggressive about it. And so those physical barriers, now the makeup I haven't actually ever been at a demonstration where I saw somebody using that so I don't know, I think they would probably just think that it's weird makeup. But yeah, I mean they are certainly going to react aggressively. And I will tell you, law enforcement shows up every single time I go to any sort of meeting to talk about this technology and they are very aggressive and they lie about the technology, they lie about its capabilities and they call me a liar. It's pretty ridiculous. Next question is for the internet. So what's the range of these stingray devices? That is a great question, one that I wish I knew the answer to. In my research, the last thing that I did on EFF street level surveillance site was put up a frequently asked questions about cell site simulators, which if you're interested in them, I gotta say by the end of my research, I wanted to like throw my phone away. I was so disturbed. So just from various sources and from marketing materials, there are stingrays that are so strong, they're so called dirt boxes, that they can read cell phones from a plane. So that sort of gives you an idea. The smaller ones, they've said like in hearings before the House Judiciary Committee, the Department of Homeland Security and the DOJ has said, I believe that the range is something like a couple of city blocks. I wouldn't trust any of these companies as to what they say publicly. I would love to see their marketing materials. Okay, last question over there. Thank you very much for the talk at first. I was wondering about facial recognition and CCTV images. Everyone knows that technology exists, but my question would be if you have knowledge about in how far is it used as a default? And how far images are processed automatically to where to create movement profiles and so on? So in some places, law enforcement is adopting facial recognition ready cameras. So these are cameras that do automatically process data. And there are also in the States, there are some company, some actual local law enforcement that have their own facial recognition databases. So it's not just that they're capturing the information, they're processing it, preparing it for the analysis of the points of what they're looking at on everybody's face, and it's easily accessible to them. And this is at the local level. I mean, this is like a city police department that has this database. So I think more and more that technology is getting integrated. So everybody should be scared. Almost happy note. Thank you all. When you do leave this room, please do take your trash, but not only your trash, but also the trash that other people have left behind. Thank you.