 Our next talk is from Veronica Nada, which is we're going to talk about enough and how journalism can benefit from free software. Hi everybody, and thanks for being here. So as was already introduced, I'm going to present to you a tool that shows a very concrete example of how free software can be applied to benefit modern journalism. Don't worry about the slides because there isn't much to see anyway. You started? I started, yeah. First of all, let me point you towards a problem that many of you will probably be more or less aware of, which is that freedom of expression and independent journalism, which are of course vital elements of free, open and democratic society, are increasingly vulnerable and under threat especially in the digital era. Because on a number of different occasions, we see journalists, free speech activists as well as their sources, who suffer various kinds of retributions for defending the public interests. Among these in the past couple of years were of course the Rating of the Guardian, following their reporting on the Snowden revelations, the seizure of hardware at Germany-based data activism associations. We will find the last year trials and retributions against whistleblowers such as Antoine Del Tour, Fox Leaks, Whistleblower, for example, but many others. And then of course the killings of journalists like Daphne Caruana-Galicia and Malta and Jan Kutziak in Slovenia. So one of the reasons for this development is a lack of political will to strengthen freedom of expression explicitly by actively supporting its advocates, for example through the introduction of effective field laws. And just to give you one example of that is that for example in the European Union, there are about one third of member states that have adequate mechanisms in place that would protect whistleblowers from retribution for disclosing information that is in the public interest. And whistleblowers are of course the most important sources for investigative journalists. And while right now officials here in Brussels are currently trying to negotiate the introduction of a EU directive to protect whistleblowers, this process itself has its roots rather in the protection of workers' rights than in an active strengthening of free speech and access to information. And at the same time while legislative initiatives are of course an important feature of democratic societies, laws relating to freedom of expression such as whistleblower protection laws tend to be rather reactive than proactive. And in addition to that legislative change is always a very slow, international process at the end of which we usually also find a compromise that is unlikely to actually fully cover all occasions in which free speech or other issues can be disturbed or impeded. Which for example happened in the context of the European Trade Secrets Directive which is currently being transposed into national law where under the guise of protecting business interests it actually allows member states to legally curtail free speech. And if we look at the political debates that are accompanying the whistleblowing directive we see that the same might actually happen in this context as well. And then of course there are even more serious political developments in countries like Hungary, Poland, Israel, Australia, you name them, where increasingly strict media laws are being introduced to limit and manipulate public access to information and to consolidate the interests of governments through censorship. And so in short none of these aspects of course signal a political will to actively foster public access to information but rather give the impression that the culture of secrecy increasingly will outweigh a culture of transparency. On top of this the increasing commercialization of communication constitutes a challenge for modern journalism because just like the vast majority of people around the globe, most journalists like their sources. Excuse me. Do you have a problem with the selection? I think we do yes. The question was whether we have a problem with the projector. Oh yes we do. Slightly. Which one were you on? So it's supposed to be the... VGA. It's on the VGA? Yeah. We didn't have slides until now it was fine. Thank you. Oh this is much better. Thank you. I think you can keep going. No but are we on mine or on yours? On mine. Well I'm on mine. If you want a plug. Yes but in fact it's the same thing. I'm also on mine. I have a little bit of source. Okay yeah I will keep going. So sorry sorry sorry. Okay so increasing commercialization and the problem is that considering there's little well established regulation on how companies may actually use data gathered from their users the lack of independence provides a high potential for to put free speech advocates their sources journalists at risk. Now this means that the defense of freedom of expression as a public value has to be supported or facilitated by another kind of social innovation than mere legislative initiatives which would be to empower those who are affected directly. Because that way they are not only to continue doing their work in defense of democratic values but they also put out a statement that current developments will remain well are and will remain unacceptable in the future. And of course one important element to this approach is a fostering of technology that empowers people and in this case especially also privacy enhancing technology as a default for journalistic work. Because it would allow practitioners and their sources in the current environment to protect their data from unregulated access as well as arbitrary attributions by state actors. The problem with this is as we know from our own experience in exchange with journalists is that many journalists in civil society representatives think of privacy enhancing technology but also technology in general as something reserved for experts as the tools that are used by a particular community so the geeks but not something to be used by the general public. And so in response to all of these issues we started working on this tool called enough which is designed to address all of these challenges in one approach and enough itself is many things so I'll just walk you through it step by step. First of all it's a very easy to use secure data sharing platform which is modeled after more commonly used commercial services such as Jockbox and Google Drive but based on the free software cloud service NextCloud which we're going to hear about later like I think just right after where data is stored encrypted and now you should actually see a picture of the interface just to make a point about that it's very easily accessible and that a user using NextCloud is probably, I'm pretty sure all of you know this anyway but don't have to give up on a familiar and user friendly interface because the problem with journalists is as they are no technical experts they need to work with tools that they can actually understand and that look familiar to them as well because there's also this psychological aspect that something that looks familiar is much more accessible. The second element of enough is the fact that it is a function also as a leaking platform because journalists who use the service can provide a link to their enough folder publish it on their website and then sources who would like to make information available to them can access that link and simply drop their documents because in many cases sources have no time, they need to act very very quickly and need something very easy where they can just say drop it and the documents are gone now there should be a screenshot of the link but we don't have that so never mind and on that source interface sources can also be invited to contact journalists or human rights defenders through secure communication channels such as signal or wire to ensure follow-up communication because in many cases just having access to the data doesn't really provide context for the journalists if you take an artifact and you don't look at the surroundings and you don't know actually what it tells you so following up and continuing communication with the source is vital for journalists but should happen in a way that doesn't put the source at risk thirdly enough is a community and network because every user of the tool automatically also becomes a member of an online community which again I'm guessing more and most of you are much more familiar with than many non-developer, non-tech people with a short where we have a shared forum which is governed by a code of conduct and this community provides a platform to exchange experiences and ideas and using the tool but only in the manner members of the community see fit so there is no obligation to engage with others and part of this community are a number of developers who contribute to enough as volunteers because what we've seen is that while journalists and again for that many other people who aren't developers see privacy enhancing tools as something reserved for experts and there are actually quite a few developers out there who would gladly support people who are less knowledgeable on these kind of issues to become more so and so the enough community is basically an attempt to create a network between journalists who lack the technological skills and developers or other tech volunteers who can and want to provide support in acquiring that kind of knowledge and on top of this the volunteers also provide infrastructural support in terms of server capacity and that kind of thing so as a result this decentralized community replaces the centralized company running a service which makes technologically inexperienced people very independent from commercial solutions which brings us to enough last element which is also the most innovative which would be that enough teachers and adapts because when we started working on the tool the main name was to make secure drop so I'll let Aaron Schwartz's highly complex whistleblower submission system easier to use because our experience had shown that due to its complexity in use only very few media outlets and journalists that employ secure job actually maintain it properly which makes it rather dangerous for sources especially if they're under the impression that people know what they're dealing with on the other side but then it became also apparent that for many practitioners and journalists this high level security solution isn't actually necessary often the simple use of an encrypted data storage provider a certain level of independence from commercial services but especially also increased knowledge about alternative encrypted tools whether it's stuff that works on their phone or on their computers and some tech support in setting up PGP or how to use Tor is mostly enough to keep sources safe and also contribute to like a change in thinking and these kind of things and so it mainly depends on the issues that people work on which means that ideally they are able to rely on a tool that adapts to the issues they work on but also to their respective skill set and so enough answers to this by being adaptable to the level of security required which means that users can activate to factor authentication or start using additional tools but also by providing them with a platform in the community where they can inform themselves, seek support ask questions and learn about how to make technological solutions benefit their own work and this cannot obviously go up to learning how to set up your own server your own domain or to ideally how to use SecureDrop properly in case you ever should need it and so to conclude let me summarize the benefits of the tool NY we think that this is a good application of free software solutions to mitigate challenges of modern day journalism firstly it provides a very quick and simple solution for sources to drop their material anonymously which makes them immediately safer at least as if they were to send it through Gmail unencrypted secondly by encouraging learning it demystifies the use of privacy and ending tools and technology in general which empowers journalists to take better care of their digital hygiene and contributes to an increase in digital independence and awareness it also allows them to stay on top of social and cultural changes that affect their work in the digital era and not kind of be victims of changes that they may not be fully understanding thirdly it contributes to strengthening freedom of expression because by empowering defendants of free speech we also signal objection to the current political and economical developments rather than strengthen cultures of secrecy and censorship and finally it also contributes to fostering the overall communal exchange that has been advocated for in the free software and open collaboration movement for decades so I'm hoping when thinking in the bigger picture that at least optimists, if not most of you will appreciate the idea of providing practical tool that feeds into a culture of trust rather communal exchange in addressing global challenges in general and so this would be it from my end if you have questions I'll be more than happy to take it and whoever wants to check out the tool is more than welcome to join the community and of course feedback is very very welcome as well Again I will ask you to stay seated during the question session Okay, two questions here Let's start with this guy My question is how do you ensure source protection against, I don't know, service seizures or real life threats to security seizing the hard drives when it becomes real what kind of serious protection are you offering the sources who accept to use the platform I don't know the infrastructure so I don't know what this entails we can't really, I mean, if someone goes and takes the hard drive that's usually, sorry, the question was did everybody hear the question? So I am a source, I drop some information and then I don't know if the servers are in Germany but then the German authorities seize the hard drives and they just check everything is there any kind of protection against that? Would you like to answer to this? I'm near you, so can you hear me? Yes, so it's a rather technical question I guess I'm participating in enough community He's a mastermind, I'm just talking No, no, I'm a technical guy in the basement He's very humble It depends on what you fear really and the first part of the dialogue with the journalist is to assess what they actually need So say you need absolute security because like Jean-Marc Manac, a French journalist who specializes in French intelligence agencies are going wild, then you need high level security so we would set up a secret drop, a real one So actually in the US it's in the newsroom the hardware is located in the newsroom but in Europe we prefer to hide it because we feel it's more secure and there is less chance of it being discovered So we offer this maximum level of security to that kind of guy Now there are other journalists All they need is something that does not obviously reveal the identity of the person who sends the document in which case we use NextCloud with encrypted files, server side located in France and there is no need for the person who drops the document to log in So it's not as secure as SecureDrop but for this kind of user we figure maybe that's enough for them So you see it's really wide range Thank you Thank you And how do you compare with platforms like GlobalX for example if you compare So to technical level I believe and it's not a very popular view that GlobalX is more in fighting corruption in organizations like governments or big companies it offers a platform that the employees or civil servants can use to report on wrongdoing of their organization and it could be used for journalist and leaks production but not so much So there is a kind of different use case I think for GlobalX versus SecureDrop or the enough community where we specialize in human right defenders and journalists Well and as I understand it it's also the element that like it's meant to guide people towards using technological tools much more independently and have this the learning element to it which as far as I know GlobalX doesn't do Like GlobalX basically runs a service and provides infrastructure but it's a rather closed system Hi, just a question Do you have or plan to have technologies for example to fight the water marketing documents because as you stated previously often the whistleblower does not have time and the journalist does not have the knowledge and water marketing is a terrifying tool in that kind of transaction to bust out the leaker as we've seen with reality winner for example So there is a wide range of tools to fight that The key is the person who use these tools they must understand the metadata that are leaking, what is water marketing what kind of tool they need so you can know to made it to some degree but not all of it So in the case of for instance we could propose a journalist to use MAT MAT or there is a second version published recently where it's designed to you take a document, you run it through MAT and it's cleaner but you still have to think about it and so yes we provide tools but we also provide some kind of technical exchange because it's not just the tool Thank you So just a minute there was another question at the other side of the room My five minutes of sports I just only did one question that if I have a clue about technical stuff this one website, this project would be my way to help journalists so it's on all of us to secure the journalists Yes, I understood that right So it's more the talking and teaching and enabling and empowering stuff And also the other thing is that journalists also need to be more aware of their own responsibility and kind of So it's basically the idea is to create a bridge between these two so that people can learn how to better make use of their skills in order to help the other one A bit of a less technical question So I'd like to know what is the role Last one What is the role of governments and social media companies regarding this protection for journalists Are they interested to provide tools infrastructure They come to you, they help you They think that it's a good thing Have they come to us? Not yet Well, I wonder why that may be No, I mean from my own experience I've been working in policy consultancy on these kind of issues mainly on whistleblower protection It's like the same, it's one environment I don't see a big movement of governments to foster a stronger stronger support for journalism and freedom of expression in general The experiences that I made is that wherever you can curtail them especially in the context of protecting business interests this is rather happening than anything else No, they haven't come Thank you Thank you