Privacy Highlight: Keynote with Sherri Davidoff

Sherri Davidoff is the CEO of LMG Security and author of three books, including Data Breaches: Crisis and Opportunity. As a recognized expert in cybersecurity, the New York Times has described her as a tough security woman. Sher is a certified forensic analyst, pentester, and MIT graduate. She was the protagonist of the book Breaking and Entering: The Extraordinary Story of a Hacker Called Alien. Thank you so much, Michelle.

My social security number is 409. I'm just making sure they can hear me. sure they can hear me. Is everyone here? Okay, perfect.

What you see on screen here is not what you are seeing on screen. Can we have the images? Perfect. This is the first coin minted by the United States. It is known as the Fugio penny and was designed by Benjamin Franklin.

And there's something a little different about this coin compared to modern ones, which you'll notice. It does not say "e pluribus unum". It says, "Mind your own business." What a beautiful reminder that privacy has been intertwined with American commerce and values since the very beginning of our country. Very good.

So, as in one of our previous panels, I like to start from the beginning. Um, I was asked today to talk about why privacy is fundamental to security. And I truly believe it is. I've been in security for over 20 years and I'm very passionate about it. So, at some point in my career, I wanted to find out what this thing is that I consider so important.

I looked up the etymology and discovered that it comes from the Latin root "se", which means without, and "cura Latin root "se", which means without, and "cura ", which means care. So, carefree or unconcerned, something like what Kurt mentioned earlier, where there is freedom from anxiety, freedom from fear, where you feel confident in your safety. That's what safety means to me and to many others. Just to give you a small example of how privacy is fundamental to personal security. Um, in China today, surveillance is used to oppress ethnic minorities.

For example, um, we have seen a million Turkish Muslims arbitrarily detained and placed in these terrible re-education camps. And how are they finding them? How are they being selected? How are they being arrested? Well, the entire surveillance network is part of that.

That loss of privacy. You have surveillance cameras everywhere tracking your movements, determining what you do. They have access to your phones. They can see your web browsing habits. If you have applications installed, if you are using Tor, that could be a selection criterion.

They even have the ability to monitor electricity consumption in their homes, when they receive deliveries, and when they open the doors. These are components of that surveillance infrastructure that affect our personal safety. What's terrifying is that these same technologies are used in the United States. Obviously not for the same purposes, but the technological infrastructure is largely in place. For example, the Chinese company Hikvision has millions of surveillance cameras worldwide surveillance cameras worldwide , including hundreds of thousands in the United States.

And if you're worried, so is Congress. They were banned in the federal government, in federal agencies. But they haven't disappeared. As you can see on this map, I looked for it today. This is a map of all Hikvision cameras in the United States.

They are everywhere. The Atlantic journalist Jonathan Hillman had a great quote about it had a great quote about it . The same technology that contributes to the greatest human tragedy of this century could also be monitoring the streets of your city, the buildings in your neighborhood, and the living room next door. Scary. It wasn't always like that, of course.

And I think it's important to give everyone an example of how anonymous communications used to be the norm. That used to be the norm, right norm. That used to be the norm, right ? And we can see it in our payment systems, which are the foundation of the services we use. So, when you were walking down a street in the city last century, or when you were traveling and wanted to make a phone call, you would go to a public phone, and what would you use to pay for that call?

A piece of metal. So, right there , inherent in that communication system, is anonymity, the possibility of anonymity. And people used it without even thinking about it. They didn't have to worry about that. I am an avid collector of telephone tokens.

And for those unfamiliar with telephone tokens, until around 1944, it was popular for telephone owners to use these tokens because it allowed them to change the price without having to reconfigure the telephone. And some of them are absolutely beautiful. They have ads. They have intricate designs. This is one of my favorites.

This is a San Francisco telephone directory. I like that it says on the back: "Is it safe?" I have no idea what that refers to. If you know, please let me know. But as a security professional, I find it fascinating.

Anonymous movement also used to be easy. It used to be the norm. You would get on the subway and put a piece of metal into the system, or you could take a boat into the system, or you could take a boat , a taxi, or a bus, and nobody could know when you got on or off. This was not tracked centrally. They don't know who your friends are when you wear that piece of metal.

And all that changed without real public participation, right? Oh, I want to make a small digression here for a second. This is one of my favorite pieces from my transportation collection. It's an airline ticket from around 1930. Uh, I have a copy of my book on data gaps here for anyone who can answer this.

What's missing from this that's really important for privacy really important for privacy ? Yes, the name. That's how it is. Come when you're finished. The name does not appear.

Can you imagine getting on a plane and saying, "Oh imagine getting on a plane and saying, "Oh , here's my ticket"? Like simply saying: here's my ticket. Like you were getting on a fairground ride. Yes, the name wasn't always on the ticket. They didn't always care.

And when this changed, we didn't always realize it. Most people didn't notice. I do, because I'm a little obsessed with privacy. I was in Boston when we changed the token, or, sorry, when we changed from the token to the Charlie Card. And I didn't want to use the Charlie Card because all it did was keep a record.

It had a unique identifier and kept a history of all your trips. And again, as if you were here before, uh, I've been in security for over 20 years. And part of my undergraduate education at MIT was that I was able to do an analysis of all the network traffic at MIT. And I was really observing the flows, you know, where the traffic was going, who it was directed to, and just by looking at the origin and the destination, you can infer: " origin and the destination, you can infer: " Oh, this person might be going to the bar; this person may be friends with this other human being or part of this social circle; this person stays up late; this person gets up early." All these things can be used to discriminate, to infer things about your habits.

We'll come back to that in a few minutes. So, as Kurt said before, you don't always know what that data will be used for in the future. So I called the MBTA at that point and said, "Are you guys recording this?" "Are you compiling this in a database?" And they told me, "Yes."

And I, and they said, "What is it used for?" And they said, "Not at all." And this was many years ago. But you can't rely on the uses of data today being the same as they will be tomorrow. So, instead of buying a Charlie card, I decided I would have a small act of resistance.

I was going to exercise my privacy muscles and buy a single-use ticket every time I traveled on the subway. And to preserve my anonymity, I had to buy it with cash, right? Which was a problem because most of the machines did not accept cash. I gave a talk in 2009, "The Death of Anonymous Travel," and you can see the full picture. There was simply a row of machines, four or five machines that all said they did not accept cash.

So I had to wait in line longer than most and budget for that. It took time and there was a 30% surcharge on each trip if you used a single-use ticket. Then, suddenly, overnight in December 2006 overnight in December 2006 , privacy came at a cost. Privacy cost 30 cents more per trip, and it also took up my time. So all of that changed without the public really having a say in it.

I also wanted to mention that when organizations collect this data, there are enormous risks. Data is dangerous material, and when it's leaked, you don't know what it might be used for. So, even if you trust the MBTA in Boston, or the NSA, or the FBI, or whoever, 100%, that does n't necessarily mean we can guarantee that that information will remain under perfect control. A very good example of this was FlyClear. How many of you registered with FlyClear in the early 2000s FlyClear in the early 2000s ?

Probably not this audience, actually, which is a good thing. This was the predecessor of today's Clear. And they collected a lot of information about travelers to speed up processing when boarding a plane. And then, around 2008, they lost a laptop computer that contained the information of 300,000 members. And that was a big part of FlyClear's demise and a good example of the fact that, again, when you collect this data, you can't always guarantee that it will be used for the purposes you expect or that it will remain secure.

Another example is that it will remain secure. Another example is Edward Snowden, who has been mentioned several times today. Well, in addition to leaking documents, Edward Snowden took some samples of communications to prove that this was being collected. It took 160,000 emails and instant messages from Americans. He took 7,000 documents from the online accounts of 11,000 people and said they were easily accessible to any analyst in his position.

And what did he do with them? He showed them to reporters and we really do n't know what happened to them after that . I don't know about you, but I've never heard a statement about this from the US government. I don't know anyone who has been notified that, unfortunately, their data was involved in a federal government breach . And that worries me a lot about the oversight of these extremely powerful surveillance systems.

extremely powerful surveillance systems. Has this happened before? Has someone obtained this data and no one said anything? Has it happened since then? How would we know?

We need transparency, oversight, and accountability when this hazardous material is collected . Okay, this isn't China . Okay, this isn't China . So, when you lose your privacy, the impacts on your security, both personally and as a community, can be more subtle than you might expect. And a good example of this is your credit score.

I read a surprising research paper from the IMF, the International Monetary Fund, about the increasing use of alternative data when calculating credit scores. So more and more lenders are excited about the idea, and fintech companies are excited about the idea of ​​tracking your social media, gathering analytics, and using it to calculate your credit score. We're looking at things like location information used and the types of devices you have. How many of you are Android users? Raise your hand.

Good. They are less likely to obtain a bank loan. Yes. Some financial institutions today are using the type of device you connect from as part of their calculation of whether or not you are a good risk for them, which is worrying. We already mentioned that social media data, your travel records, and even your SAT scores can be used in these calculations.

Oh my God, they might come back to haunt you. And all this information, this profile, is built from childhood. So this has real-world implications. Your social media information, the type of device you use, can impact your ability to buy a house, get a job, because sometimes employers may request your credit score, or start a business. It could even affect your love life, whether or not you get a date.

So it impacts our personal sense of security in these very subtle ways. I believe there is a misconception that we must choose between personal privacy and national security. They are the same, because our nation is made up of people. When we lose our personal privacy...Thank you.

We are people. When we lose our personal privacy, it means there is a risk that people will be politically extorted. Intelligence agents, corporations; It means we can be manipulated. If we observe Russian interference in our elections. They were, for example, targeting African Americans in certain types of communities.

And how did they identify them? How were these people selected? They were taking advantage of Facebook analytics, analytics from different social media companies. You can see a good chart right here. So, even though they did n't have access to all that big data, they weren't processing it.

These companies had extensive volumes of personal data, and Russia took advantage of that and used it for purposes that perhaps were not expected. And finally, of course, when you have intelligence information, think about all the different sensitive issues that so many people handle. When you have access to that intelligence, you can gain economic advantages, military advantages, and more. Personal privacy is fundamental to national security. Personal data, in general, information that most of us want to keep private, can be used to, first, change your behavior, manipulate you, as we said, block your communications, interfere with your ability to coordinate, collaborate and meet, one of our fundamental rights here in the United States .

It can also be used to influence the decisions others make about you. And it can be used to affect how others perceive you. It can interfere with your ability to obtain public office, to start a business, as we said, and it can undermine us economically as a nation and weaken our leadership. We have lost the battle for everyday privacy. This slide is a bit depressing.

But I think it's very important that we all look each other in the eye and say that we're starting from scratch. We no longer have personal privacy in our daily communications, in our daily purchases, in our daily movements. And that puts us at risk. Most people don't know how to make a truly private phone call. Most people don't know or can't use anonymous methods to make purchases.

It's simply not supported by our daily habits supported by our daily habits . That's where we're starting. So, to conclude, how can we solve this? That doesn't mean we should give up. It means we have to work harder.

I like to tell my children that rights are like muscles. You have to exercise them or you'll lose them. And everything that each of you does when making a purchase with cryptocurrency, when taking that extra moment to use Signal to make a call, you are exercising that privacy muscle, helping to make it more commonplace and helping to integrate it into the everyday fabric of our lives. So we all need to work to integrate privacy into everything we do to improve our security. Ultimately our security.

Ultimately , privacy and security are literally two sides of the same coin. The obverse of the Fugio coin, our first coin here in the United States, read: "Mind your own business." I love the reverse side. It says: "We are one with an unbroken chain." It is a visual reminder of the fact that privacy is deeply interconnected with unity and security.

And with that said, feel free to stay in touch. I'm in Mastodon. I'm on LinkedIn. Write to me later. Thank you very much and enjoy the rock band Thank you very much and enjoy the rock band .