The Vergecast - Why activists need to think about cybersecurity

Episode Date: June 23, 2020

Verge editor-in-chief Nilay Patel and policy editor Russell Brandom talk to founder of CryptoHarlem and cybersecurity expert Matt Mitchell, who works with activists to develop strategies to leave less data behind and help mitigate threats to their cause. Learn more about your ad choices. Visit podcastchoices.com/adchoices

Support for the show comes from Retool. Too many companies run critical operations on duct taped spreadsheets, Slack workflows, and whatever else they could cobble together. Not because they want to, but because building internal tools means weeks of waiting on someone else's backlog. That's where Retool comes in. Build custom internal tools just by describing what you need. Prompts something like,

Build Me a Revenue Dashboard on our Salesforce data. And Retool actually builds it on your company's data, in your cloud with enterprise security built in. Go to retool.com slash Verchcast. We all need to retool how we build software. What's up, y'all. I'm Skyler Diggins, seven-time WMBA All-Star, Olympic gold medalist, and mom. And I'm Cassidy Hubbard, host and reporter for nearly 20 years covering the biggest names and stories in sports and mom. And this is Am Mom, a community for athletes, game changers, and moms of all kinds.

dropping May 14th. Tap in with us. Hey everybody, it's the United from the Vergecast. On this week's interview episode, Russell Brandem and I talk to Matt Mitchell. He's the founder of Crypto Harlem, an organization in New York City that helps activists protect themselves

from hackers and cyber attacks. Obviously, activists of all kinds want to use digital tools. Matt calls them a force multiplier, but there's a lot of interest in hacking and disrupting those tools, from governments, from rivals, from foreign adversaries.

Matt talks a lot about the FBI and the NSA, When their files get declassified, you can see the amount of interest they have in investigating activist groups. So Matt works with those activists to outline the threats, research new ones, and develop strategies for mitigating those threats. I love this conversation because it's way beyond just like using Signal. Matt talks about the capabilities and methods that attackers use to go after activists and how he works with those activist groups to get more sophisticated and protect themselves. So check it out. It's Matt Mitchell on the Vergecast. Matt Mitchell, you're the founder of Crypto Harlem. You help activists protect themselves, your hacker yourself.

Welcome to the Vergecast. Thank you. It's great to be here. Russell Brandem is joining us, too. Welcome, Russell. Oh, yeah, I'm here. So real quick, tell me, what is Crypto Harlem? Crypto Harlem is a space where we all come together and we learn about over-policing,

surveillance of folks in the inner city, and what we can do to circumvent that surveillance and protect ourselves from it. So it's a thing that I've been doing for like six years now. Wow. And maybe more than that now. I'm losing count. And, you know, normally it takes place in Harlem, hence the name. Kind of weird if it was in the middle of Williamsburg. And we have folks from the inner city. We have grandmas, grandpas. We have cybersecurity professionals. I go through my network and always invite people. And they get a kick out of it. They get a kick out of it. The folks who are there to be like, oh, wow. This is a person I'm learning about. very cool and they actually do this hacking thing. And the cybersecurity professionals, they don't really get to talk to regular folks a lot. So they really enjoy being able to talk to a different kind of audience that's really diverse and a big mix. But, you know, that's what it is. And I think it's a really important effort. And I try to do it as often as I can as my schedule allows. And I've

even thrown them in like one-offs in like Oakland and in Miami and in Chicago and, you know, just trying to do my thing. Yeah. So, Matt, the other thing, you do is you train activists on how to protect themselves. There's a lot of ways activists are in danger, but particularly when you're working online, as so many of us now do, those dangerous spread. What does that work of helping activists protect themselves? What does that look like for you? Well, you know, technology is a force multiplier to use a military term. Technology could allow one podcaster, you know, one person in a basement with a microphone to reach millions and millions of people without needing like distribution networks or media, etc. And activism heavily relies

on technology. And, you know, technology used to be the wheel and fire, but technology now are, you know, encrypted messages, emails, social media, etc. And the first thing I do when I'm talking to activists is explaining to them that while they are actively trying to do this thing, that's why they're an activist, they're active and other people are non-active, right? They're pushing against the status quo. They're trying to create positive change. And they're doing it because they just feel this is the right thing to do. And I explained to them that, look, this thing that you're doing, it's a little bit more complicated. And it's a little bit like a balancing act or a tug of war. And every time you have a small win, those little victories that keep you going, someone else has a

small loss. And every time you have those big, like, you know, headline grabbing wins, the things that you never thought were possible, someone had a huge, huge loss. And it's like an inversely proportional relationship. And it's really complicated. And those people are not used to losing because they made the game. They made the rules. And you become a very popular, you know, more than notorious thorn in their side. And they will come at you with anything they have. If you make someone late to a fancy dinner, that's embarrassing to them. And they don't get embarrassed. And they're going to want to, you know, to end this whole thing that you're doing. And a lot of times, more often than not,

now, it comes through a digital first way. So give me some examples of what that is. There's so many examples. For example, I was just watching this documentary about environmentalist animal rights activist, right? And so it was called the animal people because during their trial, they were called the animal people. These are the bad animal people, right? And the animal people were just a group of kids from the suburbs, right? Seven kids who were like, you know, we're going to go after. this, you know, laboratory in Europe that's doing vivisection and torturing monkeys and beating up puppies and punching dogs in the face and things like that, right? These activists successfully, through nonviolent means, closed this annoying and aggravating

the means, but still nonviolent, forced this lab to close, force them to get delisted from NASDAQ, all kinds of issues for them financially. Long story short, these folks all went to prison, right? And part of the trial, we find out through Freedom of Information Act, many years later was the FBI rolled out a hacking team to hack these activists, get into their computers. They had really good security culture, right? They knew not to say too much, not to do too much, et cetera, all that stuff that, you know, need to know basis, all the stuff that activists will stick to. But they also used PGP encrypted emails, which is a new thing. A lot of people weren't doing that back then, right? This is like basically like the 90s. And the FBI

could not get their keys, could not get their passwords, so used malware and attacks on their laptops and computers to try to get into their machines. And no one even knew what this stuff was back then. Like there's a million examples. I'd use this one because I watched this movie the other day because it came out on Netflix. There's countless examples of this happening. And you'll never know. It's very quiet. And in this particular case, they also had audio surveillance of their plain phone calls because they didn't have apps like Signal at the time for them to use of easy encrypted voice communications. And there are more recordings here than in any other federal investigation.

So this is real. The amount of time, money, and resources, it doesn't make sense to your average activists. They're like, why would they, we're not even doing anything crazy. We're just trying to do what's right. Why would they spend millions of dollars on hackers, playing close police to follow us around, or video and audio media of like hours and hours, days worth of footage? Why would they do that just for us?

For me, it's true, though. It happens all the time. And when you look at the vaults, FBI vault, which is like a public available, released and declassified videos and audio and things like that, you'll see a lot of stuff there that pertains to activism. So this is, I mean, it's funny because I feel like when it pops in the news, a lot of it is around some particular vendor

that would sell these tools to, like, the company that would then get used on. So, like, I mean, I think Finn Fisher was like, And then we had hacking team and now more of the focuses on NSO group. And they're always sort of these, a lot of times based in Europe and like you never know how many people they're selling to. But then I often, I mean, I don't want to like get discouraged. But it does sort of feel like you pull out one weed and then there are just five more. I mean, are you, do you feel like there is some path towards these tools not being. available to powerful people anymore, or is this just sort of what the landscape is now?

It's an industry. There's money to be made. And it's completely deregulated. And so it does make sense to go after the worst of the worst. But, you know, there's another one behind it. You want to go after the worst industrial polluter? There's another one behind them because there's money to be made. And worse of all, there are nation states that have militarized this hacking situation. and the tools and resources available are now leaked online. So, you know, even our and our being USA, the United States, through the NSA, through the CIA, through the FBI, each of these law enforcement and intelligence entities has their own group of hackers that work there. And then they collect and find major bugs in commercial software and also ways to exploit tools that we use every day.

They say something like 80% in the case of the NSA, they report to the company so they can fix it. But the 20% that really good golden stuff, they keep that and weaponize that. But a lot of times those weapons are not well defended and they leak onto the public internet. And, you know, that's what happened with a lot of these tools. And so therefore the price of these cyber weapons have dropped. Imagine if you could go into the black market and get a machine gun or bazooka for $20. That's basically where we are now. Because those advanced tools leaked onto public domain and you can any,

hacker worth their assault as a copy of it or understands how these things work, the price of committing these cyber attacks has dropped to the point where a lot more companies, a lot more countries, a lot more militaries, a lot more law enforcement, a lot more intelligence agencies and also random people are able to give it a go. So, I mean, that's like pretty scary. It is scary. I guess if you're, you know, when you're meeting these folks and you're telling them this is what you're up against, where do you go with that, right? Like you're not telling them, hey, like, give it up. let DuPont win or whoever it is. You know, how should they operate in a world where this is just out there?

Well, yeah, I don't just start that with a, hey, thanks for taking me to your cool petulsi-smelling coffee shop. I just want to tell you how horrible it is. Yeah. No, I mean, well, first of all, I'm lucky because the audience is not one that's easily discouraged, right? They're not risk-averse. Like, these are people who, they're really to take the next step or whatever, do that thing

that the non-active people are not. That's why they're activists. But I don't start with that. try to keep it really basic and I try to use like community health style of talking to them. I'll just say, like, for example, like, you know, I always tell people, if you're like doctors without borders and you show up in a village of people who don't know what modern Western medicine is and they have their own ideas on how to stay healthy and safe, you can't tell them about, like, this is cancer or let me talk about Ebola on day one. Like, that's just, that's, you're just

going to crush their spirits. It's not helpful at all. So what you want to do as someone who's about harm reduction, and that's what you focus on, harm reduction, right? and minimizing and mitigating risk. That's all you can do. You say, look, there are these invisible monsters, these creatures that live on your hands. They call bacteria, and you've got to use soap and water to get rid of them.

And if you do that, you'll be okay. And if you just get that baseline up where everyone's washing their hands and the chief is washing their hands and the medicine person is washing their hands and little kids, elderly, then you're like, that rules out a lot of problems. So it's the same thing here.

So I'll just talk to them about the different baselines that they need to get to. But I will explain it so, you know, that this is a nonstop effort. You always can, like, level up a little bit. If you go to the gym, you also can get a little more swole, right? So, but it really is like, do you lift or do you not lift? And that's about, that's where it is. So there's like activist stuff, right?

Like, okay, you have founded a group. You're all going to protest de Blasio. That's an easy one. There's the basic stuff, right? Which is don't send unincrypted emails, like move all your stuff to signal. There's like a basic set of, I think, pretty. well-understood stuff. You're teaching them how to use Signal, or are you saying

what I worry about, which is the massive amount of attack surface area that comes just from using the Internet now and buying devices and having that stuff in your life and in your home? Yeah, I mean, I actually don't teach them about Signal and stuff like that. Because like I come at them from

like a, I'm a professional and I'm an expert in this. So I teach them about the capabilities and methods of their adversaries. Like this is what's going to stop you from moving forward. And this is also where every tool you use has a problem and it breaks. And so you just decide so they can be an educated consumer. You might tell people like, hey, use this thing, send these encrypted emails, use signal and you're good. That's for like a normal, boring person, not for activists.

Activists need a different game plan. They need to learn about like, do you have a data retention policy? What data are you creating every day? What's your exhaust of data, your data footprint? And how quickly do you remove it, do you delete it? So, that's a big problem because they usually amass large amounts of data. And I tell them, look, this is going to end not with you, your favorite movie, whether it's like hackers and someone's going to be like hack the planet or whether it's brave heart and someone's like freedom. Like, that doesn't how it ends. This ends with you in a courtroom with a lawyer next to you. And you were talking about deciding whether that lawyer has a folder worth of evidence that you're defending

against or those cardboard boxes upon cardboard boxes upon pallets of evidence that they're defending against. So we're just talking about when you have your day in court, how can we make sure that your sentence is as low as possible? Because that's reality, right? If you're an activist today, there's a huge amount of data that is being collected about you that you do not control. And then there's even more amounts of data that's being collected about you that you do

control. And I just try to get them to get that down to as little as possible. Give me an example of data that activists don't control that you help them get into line or manage more efficiently. Sure. Let's talk about the six people who decided to meet at that Starbucks is about your DeBlasia meeting. They all had to get there. And we all have phones. Some of us have the fanciest, newest iPhone, like you.

And other people have, you know, like some basic boost mobile phones. But we all have phones. Those phones are on. Those phones are connecting to cell towers so they can. maintain service and the location of those phones, you cannot turn off location services of how your cell phone works. So you can say, oh, I put it in a Faraday bag, wrapped it in foil, put in an airplane mode, and I move forward to the, to get to the Starbucks. But then you passed all kinds of cameras, whether they're attached to an ATM or whether they were attached to

a police box that's just surveilling that corner or that street or that block, and you pass through it. And these are pieces of data that you don't control. Right? You might have, you know, like, of course you don't want to have like a home assistant in your house, like an Alexa or an Amazon or something like that. You wouldn't want that in the space. But there's people around you who have data and there's an imprint, an outline that's missing, and that's your movements. Right. So the pictures, the video, all that data that's collected. That's the data that you do not control. You might be getting junk mail. That means that your address, your name first and last, whether it's your actual government or some alias. That's just easily findable. I could search. a data broker's website, or I can pay a data broker to collect and find that information on you. That's very hard for you to control. But then there's the information you do control. That's the words you say, the words you type, you control that. And where you put them and how you manage them, you can control that. You know, so when you go to that Starbucks, did you pay with cash, or do you pay with your credit card? Did you pay with your Starbucks app? So it's about that more

holistic viewpoint, not just the basics that we talk about when you're reading a quick article or things like that because activism, it's different from living in this crazy world that we all live in. We've all seen the great hack or the big hack or whatever that is. We've all understand, you know, from, I get it. Like, they can see my tweets or something, right? So this is deeper. It's another level, right? Because you're actually not just a regular, boring person who has to deal with hackers

who just criminally want to just take your credit card or just create chaos, right? Or a normal person who has to deal with, like, you know, over-policing or has to deal with ridiculous rules against them because of what law enforcement is able to do or what the city is able to do or whatever. Data brokers who make an industry out of, especially the United States, where we don't have a lot of privacy protections if you don't live in California, your data trail and selling and monetizing that. That's a normal person. But now you have to do with that plus it's compounded with your activism. So it's about having that deeper conversation, but also explaining that you can win this and it's a hopeful conversation at the end of the day.

So this is what's so interesting about like this side of cybersecurity to me because it feels like 99% of the time when people are talking about a lot of the same things you're talking about data exhaust, retention, what's your footprint? It's in the context of corporate cybersecurity where, you know, I'm running this app. I'm holding all this user data and I need to make sure that, you know, I promised the person when they signed up for the app, hey, I'm not going to let this sort of get out onto the just whoever wants it. But it's fundamentally sort of maintaining the status quo, right? It's like we have the data and we want to maintain control over everything that happens to it so that these sort of forces of chaos that are coming from, you know, the criminal

parts of the internet can't bust through, right? Whereas, you know, the people you're talking with, they're really kind of going out there into new territory. And it's sort of, of how do I protect myself once I'm on, once I'm on the other guy's turf? Exactly. It's a completely new territory and there aren't a lot of professionals in this area. So the first thing is people do have an idea what the digital risk and threats are, but they actually don't understand what's in the wild. Like what's an actual, you know, capability or method of law enforcement or LaBlazio, you know, or, you know, anything like that. So it's really just guessing, which is not good.

So you want what people say are an evidence-based approach. You want to defend against what's probably likely out there based on past research. So a lot of my work is reading cases, whether the cases are about the worst of the worst, as they say. So that might be people who are in the trade of illegal images or images of child abuse or people who are selling narcotics to folks, you know, things like that, right? it's the same methods that are used to go after those folks or to go after maybe like a terrorist or whatever the bad person of the day is. And people are more likely to speak on those methods, right? Because we all, no matter what your viewpoint is, this is an enemy and this is criminalized behavior that everyone's on board, this is bad. So people tend to get a little bit too much into it and they'll share a lot more information than they will if you research what happened to that person with the green post.

piece placard or something yesterday. Like that case is going to be really tight. It's going to be a lot of lot of information about how evidence was gathered there. But it's the same maybe individual out there that after they're done catching this person, they're going to go after catching the Starbucks anti-Doblasio people, right? So it's about understanding that. And it begins with things like, you know, when you read a privacy statement from a company, let's say it's like, you know, they talk about normal cybersecurity.

A normal kind of like, I understand I want to control my digital. data person might read, how do we sell your data, right? Or what do we, how do we collect your data? While an activist might read that section that says, how do we deal with legal request and government request, right, for information, which may or may not be a subpoena or a warrant, it could just be someone saying, hey, can we look at that user's account? And, you know, when I talk to activists, the first thing I tell them is every technology that you use has to deal and has to work with the people who you're worried about, right? Which is mostly, uh, someone's going to try to paint you as a horrible person for trying to create positive change.

And that is usually could be, you know, there's a force that has power, people who are sitting on the seats of power who do not want to be removed from those seats of power, and they enforce the status quo that you're trying to change. So those folks are involved in this as well. And they're going to use these requests to find out more about you and to criminalize your behavior and eventually stop what you're doing. And that is a, there's a red carpet that technology companies roll out for these people. And you need to know about it. So when I talk to folks, the first thing I'll tell them is like, hey, you use Google and everyone uses Google, right? So then I'm like, look, there's a website that's Google's red carpet, law enforcement request system for Google, right?

And that's LERS.gov.com. Go there. Look at that thing. See what that looks like. That's what someone just says, hey, I want to know what Russell's searching on a Tuesday night, you know, at home, right? And Twitter has the same thing, Instagram has the same. same thing. Facebook has it as well. Facebook's red carpet is Facebook.com slash records. If you have a domain name that's like NYPD and the DeBlasio case, or maybe it's like, you know, Pakistani intelligence, it doesn't matter. If your domain name matches, it's put in your email, it's on the database of known domains, you'll get a email that's like, hey, if you want to know how to make a request about a Facebook user's profile, fill out this form, tell us what you want, and our legal

team will look at it. And depending on where you are and who you are, depends on whether we'll push back hard or we might just fulfill the service. This is great. When you go to the Facebook one, all you have to do is check a box. It says, I'm an authorized law enforcement agent or government employee investigating an emergency, and this is a request. And you just like check it. Yeah, but then you've got to put in your email. If you're law enforcement, your email isn't at Gmail. But it does, but the problem is maybe that it doesn't matter whether you're day one out of police academy or whether you're a lieutenant on the or someone who's on a special case load that's like looking for certain things, right? So it doesn't matter who you are.

Long as you are law enforcement, you can fill this thing out. So that's problematic. As you talk to activists, that's one side, protect yourself. Do you talk to these platform companies? Of course. About how to better, because, you know, so many of the CEOs of these companies believe that they are helping activists change the world by connecting. them by, you know, giving them a voice. You know, there's a, there's a department in that company that tells you, be yourself, show us, you know, what you're about.

And they'll latch on to movements that are, you know, and commercialize those movements. So, you know, they'll say, like, Twitter is like, oh, Black Lives Matter, you know, like, you know, we're going to wear this, Jack's going to wear a shirt, you know, whatever, right? Jack loves the shirt. Yeah. But that's totally different from the department that's like, oh, yeah, you want to know what this person's doing and you want to read their DMs, okay. you know, totally different.

And they also have the problem of Twitter had these people who were working there, one guy who was on the payroll of United Arab Emirates, working with the Saudis, who then compromised another person who got them on the payroll, right? And then, you know, Twitter's not used to looking at that. So you have many different inroads to these organizations. You have the legal department, which is maybe working against Black Lives Matters, with a Jack's wearing a shirt. And then you have people who are trying to actively get individuals into

the company because they're in positions of trust. They have access to data. And that data, it's like, well, we can buy three million dollars worth of malware, or we could pay this dude some gambling debt from that last trip. He went to Vegas and also lean on him with these videos of what he was doing last night. And boom, give him 30,000 and get the data we want that way. So you got to understand, like, what is actually happening out there. This is a real thing. So Twitter looked into this employee, tried to figure out, like, whether what was going on is really that they were searching people who worked on the tour projects, DMs and what they were doing online

and trying to get data on where their phones were connecting to Twitter from and things like that or whether this is not true. And that employee disappeared, only to pop up in the UAE working for the government. So this is the kind of thing that you'll tell an activist. It's not just install signal. It is weird to have that as part of the threat model

is like probably Facebook can pay the like people with access enough that they're not susceptible. to blackmail, but maybe Twitter can't. Like, rents in San Francisco getting pretty high. She's getting hot. So you were talking about, like, you know, reading the news to find out sort of what tools people are using. I'm curious.

So you, as you're probably aware, like this Clearview app has been a huge sort of wave just rolling through and, you know, essentially saying, I have a picture of this person's face. Is there, can you put a name to this face? Right. And this is very much like we're in the Starbucks. We talked to the Starbucks manager, maybe slipped him $100. He gave us the surveillance video. And we found we have this sort of surveillance footage of this person's face, but we don't know who they are. Can we plug it into Clearview AI and it'll give us a name? And it turned out that there were some really significant sort of companies and just sort of all sorts of, you know, sketchy outfits using this. I guess was that a surprise for you? Was that is that changing the way? you're thinking about, like, controlling the data and everything? No. No, it's not a surprise. But, I mean, like, it's kind of like people are like, Trump is so bad.

It's crazy. Trump stuff. And I'm like, well, it was always bad. Now that you're with me, that's great. So same thing with Claire of UAI. I'm like, that is great. You know, like, I'm so happy that that story broke. And I'm, you know, there's a lot of other people I know who do the work that I do.

And they were involved in, like, helping make that story happen. And I'm like, that's dope. And we should say, Kashmir Hill, New York Times, like, did an amazing job on that. Yes, cash, you did a great job, you know, hit me up. And the people who were able to say, we research what law enforcement is spending their money on. We saw this come up multiple times. We can't find info. Let's hit up cash. So there's people who did that too, right? So that's important too. And, you know, there's a lot of us out here who we have to see what's not there by putting together what is there. You see this weird outlines. And you're like, what is that shape? What is that shape? And it's things like Clearview, A.R. But how did Clearview? view or even work? Well, here's how it worked. It just grabbed your face. It wasn't like, wow, this guy's a genius, no offense, the guy who made Trump here. Like, it grabs your face from the open internet, like just sits there browsing the internet, acting like it's a user of Facebook, acting like it's a user of Google, act like it's user of Flickr, and it just collects and collects

faces. A huge, ridiculous face database. And then it uses facial recognition software that's out there. And you can make a poor man's version of Clearview AI with enough page. And it's. and tensor flows from Google's like, you know, free tech. So the problem isn't that they made this. And if they made it, who else maybe made it before they made it? Collective consciousness is not the most – it's a really simple idea. Even when Google Glass was out there, like, we're not going to make a version of this that can take a face and run it through a search database.

But I can do that today. I can take your face. I could run it through Yandex. I could run it through TenE. I could run it through Google Images. And I'll get my own results. And then that's like a really basic search. That's a five-minute search.

Now you can just use technology and make it run faster, smarter, better, and you'll end up in the best search, right? So is it a surprise to me? No. But it's important that it changes the game and the outside. It changes the game, for one, the average person. It's like, you know what? I don't really have any skin in this game, but that's weird.

I don't know why, but I feel like that's wrong. Like, that's important. And then the person who cares about their data who's like, I'm a privacy person. I just like, you know, I'm a paranoid. and I don't like when they're doing that, and that's crazy. It blew my mind. But the activists, they need to already know that this technology exists. And let me tell you who's using that technology before the story dropped, right, and how they're using it. So, like, you know, we're talking

about going back to protest where the law enforcement had airplanes flying in circles, taping videos of individuals. And when the ACLU asked, like, hey, you know, we see that there's these protest, whether it's like a protest in Baltimore, let's say, right? And we think that these planes were picked up by these nerds who were just looking with their basic data solutions to just look at radio signals and see these planes that aren't repeating certain call signs and let's figure out where these things are. And ASU said, hey, FBI, if you have, if these plans exist, we want evidence on these plans. And when they put in that FOIA request, they got back videos of hours and hours of infrared and like high resolution shots of zooming in on protests where you can see people's faces,

things like that. It's on vault. If you go to the FBI vault, you could pull those videos today. So it's like, well, why did they want this video? It looks weird. Why are they scanning this particular way? It's obviously like the face is an important asset here, right? Not just because I could see that face, but I could turn the measurements of where their shadows of their nose is and their eyes and their ears into more information, right? Let me try to play devil's advocate here. I know, that's the right phrase, but I'm going to go with it. Isn't some of this technology also good for the activists?

I think about face recognition a lot. I think the killer app for the AR glasses, you mentioned Google Glass, but the killer app for Apple's AR glasses is you put them on and you never have to have that moment where you recognize a face but don't know the name again in your life. Apple puts out that product, I buy it immediately. No questions asked. I'll have a superpower. I'll know everybody. I remember I got drunk with you six years ago. We talked about these five things. Like, that would be incredible. There's also an element of you're an activist. You're protesting a board meeting. You're seeing the lawyers going in and out. Suddenly you can identify them, right? Suddenly you can, you know who the players are who are talking to this company who are involved in these spaces. You know where you can build other sets of connections. You can do all kinds of things. Is there a value to having it more broadly and democratic?

available as a technology? Or is it, wow, this is getting really creepy. And the cops are overusing it. We should turn it off. That's a good question. And I would say there's zero value, but I'll explain. Because it's basically technology is a beautiful thing. I got into hacking because, you know, I was a kid and I had a computer. I thought this is amazing. And I wanted to share that. You know, I wanted to be able to play chess with someone in the Middle East because of millions of miles away, but felt like it's just milliseconds. That's great. That's the promise of it. But technology, like all other things in science, can be weaponized, right? Like, you know, nuclear power can be used to run a city for pennies or could destroy a city and turn to ashes, right?

So it depends on who you are. Same thing. So if we say surveillance technology, we're going to weaponize surveillance and we're going to weaponize, like this is kind of basic doxing, right? And we're going to use it to help us in our protest. It's kind of like saying, well, they have weapons, like guns and we just have rocks. We're going to start using guns. Well, you're going to start this arms race where there's a ceiling you're going to hit and they don't have one. So it doesn't actually end well when you're using like, hey, they have an NSA.

We're going to start our own NSA. Well, their NSA is sitting in a position that your NSA is not because their NSA is plugged into the people sitting on the seats of power who have disposable income and have everything to lose, right, with having you have a minor win here. Right. So it's not David and Goliath. It's just stupid. So it does not make sense.

The one, Evans, you do see out, you were talking about the Yandex face search, right? Which is if a person has, if you have a photo and you want to know who is in it, or even like a car and you want to find another picture of the car, the Yandex reverse image search is one of the better ways to do that. One of the places you see it use most is the folks at Bellingcat who are doing the open source intelligence. And often, you know, in a very sort of pro-social activisty way of saying like, hey, Russia did this thing. they're trying to say that there aren't these troops in Ukraine, that they weren't involved in this. But we can see that this car was, and really sort of, you know, it is similar to putting together the evidence file, as you're describing. Of course, you know, also as you're saying, like, it's a little difference when the evidence file is like this compelling blog post versus like a legal proceeding to put someone in prison. But it's important.

We need compelling blog post. And, you know, Brown Moses, Elliot, you know, what's up, Bellingat? Yeah, I mean, I've got people who do this work, you know, like Bell and Cat, they're good folks over there. There's many Ocent Open Source Intelligence teams working on stuff. Like, who was that neo-Nazi in that photograph, right? Or who was the person that punched this person in the face or whatever? And I am not saying that that is not important work. And I'm not saying that that's not valuable.

But what I'm saying is these are weapons that are built with a mindset and, by a group that we're not, we shouldn't follow their playbook, right? Their playbook was built on to like oppress and stops and things from happening, not to create this beautiful freedom of awesome possibilities for things happening. And yeah, sometimes it is good to identify, but having like some kind of database of faces search, it's going to burn you more than it's going to assist you. So yeah, OScent makes sense, understanding what you're up against makes sense, intelligence gathering makes sense, all this stuff makes sense.

But it's not like, you know what, there's a good side to this. We're better off if there was none of this technology. If you were to meet Martin Luther King or Gandhi or anybody today, they'd be, you know, a young person trying to organize people on social media and all this other stuff. And that version of them is going to be a lot less successful than the version that was handing out things on paper and just talking to people over some tea and chai, right? And all the tools and wonderful things that we could use as activists, people who want to create positive change, with technology, all the tools we could use it for are not worth what it could be used against us, the ways it could be used against us. But we have to live in today, right? We have to live in the day. So there are people who are active in people who are, you know, like, they're going to say, look, I'm going to take out the power in this place, or I'm going to disrupt or create chaos or I'm going to spread rumors about Oprah or whatever it is, right? Like, you know,

whatever you want to do, you know, like have added. That was QAnon, right? They were saying Oprah was about to strike. That's right. So, and whatever you want to do, like, that's disruptive too, and that does put ripples on the status quo, but in the long game of positive change, like, is this generationally going to make things better for your kids? Probably not.

But we have to deal with what's going on right now. So, you know, that's where I live. And that's how I talk to people. And that's why the work that I do. I'm in service to these folks. And I really idolize and I look up to the people who are willing to really put themselves at a lot of risk to just move the needle a little bit on positive change. So I want to come back. You made this claim these famous activists of the past would have not been as successful if they had tried to use the tools with today.

And I just want to push on that a little bit. There have been some remarkably effective activist movements that are primarily digital. I don't know they're as effective as we want them to be. But you brought up Black Lives Matter. Black Lives Matter went from a hashtag to a cultural phenomenon that is like shorthand for a lot of things for a lot of people now. That only happened because of the power of social platforms. And, you know, hopefully one day it's even more successful at its goals. It's going to take some times.

It's not that old. But how do you square that, that idea that the previous kind of activism may have been more successful over a time? time, but the new tools put sort of a limit or a cap on how successful activists might be. I wouldn't say a cap. I would say a danger. I mean, like the FBI was all over Dr. King, right? Yeah, but it took some time. And there's a lot that when you look at the FBI files that are public, they didn't have, that they would have had in seconds, right, if he was on Facebook doing that. So that's like his entire social network of thousands of other religious leaders in five minutes would have been drinked up by geophilia or data miner and plotted and mapped and searched and, you know,

sentiment analysis on everything they said. And, you know, it's just a completely different ballgame. And, you know, when you bring up organizations, like, for example, the movement for Black Lives where I worked to do digital safety training and working with the founders of a lot of these organizations. And, you know, there's 60 organizations plus in that coalition, that umbrella group. And we know whether it's in B.YP. 100 or Black Lives Matter and Million Hoodies, groups you might know, groups you might not know, you know, there's the commercials and TV and like, you know, a Kardashian wants to throw you a Pepsi. There's that version, right? And then there's the reality, the real version. And what we can in the Move for Black Lives, we have made real change happen,

right? But real, but there's an effort, let's not confuse real change with commercial change, right? There's an effort to let the steam out, right? When people are angry and they don't like their mayor, and they're like, de Blasier has to go. If you said no protest, no one could say anything bad, there is steam, and that would lead to pressure. And that pressure would lead to a high enough level that it would be higher pressure than the container that was holding it, and it would blow. But so, I mean, are you saying like the real change is like not actually international, like, consciousness of the thing, but it's local organizations putting pressure on local governments, right? I mean, especially for the movement for Black Lives, it's a police.

thing. It's not about like setting federal policy necessarily. It is really like, you know, I live in Ferguson. The police chief in Ferguson is the problem. And I'm going to get a bunch of people in Ferguson and sort of in the area to sort of make this hyperlocal change. Well, it's a lot of change. It's a whole like if you can read, they're like, hey, this is what we're, this is our platform. This is what we want to change. And globally, nationally, but it actually goes all the way down to to right outside. Right. So. and it does begin with, hey, you know, who's the district attorney here in Ferguson, things like that? And, you know, just to say, like, you know, I am lucky to work with these people who are in their history books when we look back.

They're going to be the people who we read about who are really making positive change happen. And, you know, I remember, like, I was in Ferguson and I was looking at things. And there's, it's just, it's really complicated. We have to use technology because those are the tools that are available to us, right? But they're also the tools. They're the master's tools, right? And the technology we use tends to be the commercial technology that's weaponized against us as more than it's like, yeah, for every benefit of being able to get, like you say, like how many likes and follows and people retweet in my message? That's great. But how many people are putting requests in through the back door, through that red carpet against me? So yeah, it's like it's real change happens with real people, real lives in the real world. It's not that the people on the other side of the planet can read about me and know that I. I wanted something.

Well, and so this is the Audrey Lord quote you're like referencing, like, you can't use the master's tools to tear down the master's house. And it's like, for you, these technology things are, are those tools. 100%. So those are the tools that are in our technologies that we can't use, but we have to understand how to exploit, right? Like, we don't abolish and stand away from them. They're there.

And there's ways you can use them. So when I'm speaking to activists, the first thing I'll tell them is, look, it's great the things you're doing. please understand how every little thing positive you do is going to is there's a backlash there there's blowback there and you can mitigate that understand the technology is wonderful and amazing that's why you're talking to me i'm a tech person right and so everything i tell you is going to be how you can use technology in a good way but there's a negative side to that too there's a dark part of that technology you got to prevent and protect yourself from and some technologies are better

than others so the technologies that are those commercial technologies where you're going to get them non-active people to activate them and reach them, there's a price for reaching in, right? But then there's other technologies like, you know, open source technologies and surveillance, circumvention technologies that are, they're going to be protecting you. They're going to, there's less of that. And how to make those measurements is most of what we talk about. Support for this show comes from Shopify. Starting something new isn't just hard.

It can be really scary, too. So much work goes into this thing that you're not entirely sure will even work. But here's a better thought. What if it did all work? What if your instincts were actually right all along? Shopify wants to help you get there. They're the commerce platform behind millions of businesses worldwide and nearly 10% of all e-commerce in the U.S.,

from established brands like Allbirds and Heinz to companies just getting started. Their design tools make it simple to create the exact online presence you're envisioning with hundreds of ready-to-use templates available. And with built-in marketing tools, you can launch full email and social campaigns in just a few clicks. So you can connect with customers wherever they are. It's time to turn those what-ifs into with Shopify today.

You can sign up for your $1 per month trial today at Shopify.com slash vergecast. You can go to shopify.com slash vergecast. That's Shopify.com slash vergecast. Support for the show comes from Upwork. The days of doing it all, yourself are over. There's no romance in burning out while you're trying to scale. Instead, you can check out Upwork. Upwork helps grow your business by giving you fast access to specialize talent across more than 125 categories so you can fill skill gaps, launch projects faster,

and scale without committing to full-time headcount. And finding the right talent is easy. You can browse profiles, review past work, and get help scoping the role so you can get started quickly. Seriously, you could connect with the right freelancer in just a few hours, especially when you sign up with Business Plus. Their AI powered shortlisting pairs you with the top 1% of talent in under six hours. No endless search are required. You can visit upwork.com right now to post your job for free. That's upwork.com to connect with top talent ready to help your business grow. That's upw-w-rk.com. Upwork.com. home. So if I pull back from this a little bit, there's the sense that, okay, you can't use

Twitter and Facebook and YouTube to really foment the movement because they have these red carpets for law enforcement, for big business, for whoever. What are the alternatives? Is there a decentralized open source set of tools that helps people gather, organize, make change that are not subject to, because there was an older internet in which there were a lot of those tools. We are constantly talking about how the big platforms have taken those tools away. What I will say to that is you have to use both. And that other suite of tools are, I explain that instead of there being a silver bullet tool or a silver bullet Microsoft Office suite for activists, understand that there's a drugstore,

you know, whether it's like Walgreens or CBS, depends on where I am, what country I'm in, It might be the apricique or whatever it is, right? I do this work globally. It's understand that there's a difference between aspirin. You might, like, signals like aspirin, right? You just discovered aspirin. You're going to use it for everything. You get a bullet wound.

You can start rubbing aspirin in there. You know, it's just not always perspective. So, yeah, signal is great. It's a secure messenger, and it's wonderful. And I have an article that I wrote about how to create an online persona. And it's about like, look, but the weakness of signal, the first weakness is it has to decrypt the message so you could read it, right? So anyone looking over your shoulder can see your, your message. But the second weakness is it's your phone number and your phone over is linked to a lot

of data about you. Like, I can take your phone number, do a reverse search on it and tell you who pays that bill, right? And tell you what carrier it's on and tell you what address that bill gets mailed to. And so it might be good to maybe put a Google Voice number or virtual number as your signal number because that doesn't work anymore. So it's about mitigating the harms of these good tools as well because everything, you have to make design decisions when you roll out security tools and software. And some of the design decisions are, it needs to be good at this. It'll be weak over here. So just explaining that to folks and giving them the ability to now understand that. So they can, they don't need to be technical, but now they can shop correctly and get the correct medicine for them.

And so they're like, oh, I get it now. So like maybe you want to use this thing called wire from one of the founders of Skype. It's good for some things and then it falls down in other areas, right but if you wanted to have a conference call don't use uber conference a free conference call you know maybe you're having an encrypted group call on WhatsApp but then you hit the size limit and you want to have a bigger call you use wire then it is a size limit then you guys decide what to do after that so then maybe you use zoom but then zoom they're not so good on the privacy side of thing so it's just about explaining that like understand what to look for so just real quick it it's like if this thing is built someone had to write it that person has to feed themselves

and pay their rent. And if they're basically doing it for free, that's not good for you. It's not good for your safety and security long term, right? So they need to be, like, so how is it funded? Where do they make their money? How do they monetize and how do they maintain it? How large is the team that builds this and where are they located? What laws can they not fight? They have to abide by. Like if I'm in India, in India, the law is like, look, if we're doing forensic analysis on your phone, you have to give us the password. If I'm like, hey, I need to decrypt this email. I must have your GP. password, you legally have to give it. So understand like how where these groups are, how that affects their viewpoint on the tool that they built and how, and then as legal requests come in, what can they and can they not provide? That's very important, right? So and then when in the privacy side of things like how do they deal with the government requests and law enforcement requests, that's important too. So it's completely different criteria for shopping for what tool to use. And you could just ask people. You could ask support. You could email the people who write the thing. You can put it up on Twitter. Infosec Twitter loves battling on going back and forth about

what the number one tool is all day. I'm like, we could have built a better tool in the time you went this flame war started on. Oh, but that's how you end up with 45 tools. I'm pretty sure this is Google's entire messaging strategy you just described. Exactly. But I feel like, you know, at the end of the day, there should be different medicines for different things. And there's, you just need to understand, like, for everything, there's a side effect and there's a negative side effects and you balance it and then you can just decide based on that. And then you can say we can have a meeting without people tracking where we are. And if they do check where we are, we did it in a way that disrupts that. And now they think that there's 50 meetings when there's

only one or something like that. So sometimes you also understand how to use the data creatively. You know, you brought up Zoom. And this moment, I think in American cultural history, is bizarrely mediated. We're on a Zoom right now as it happens. But like everyone's using Zoom for all kinds of things. Zoom was not built for this. They're not ready. I mean, this is enterprise software built for bosses to use to talk to their employees. And I think the call that Zoom should be more aggressively monitoring what happens on Zoom calls pairs with the Zoom is pretty bad at privacy. Like, that is exactly the clash that all the software has, right? Right. But at the end of the day, like, you know, you got to know, like, well, who made Zoom? If I'm using my criteria for measurement,

Right. Homey was just like, I work at WebEx. It's the number one streaming video for conferences, but I can't use WebEx to talk to my girl. And she's in China and I'm in China and I'm trying to talk to her. Like, that's what happened. So this guy was just like, I'm going to make the best software because I'm lonely and horny. You know, so. That's that's Facebook too. That's all great inspiration. Yeah. I mean, nerds need social contact and they'll try to find a way to make it. But you were talking before about like the law enforcement portal stuff. doesn't even have, I think because they never, they've sort of been thrust into the spotlight and all this, but they don't do a transparency report in the way that you can go and look to see how many law enforcement requests Google got last quarter or Facebook got last quarter. And, you know, they don't break the data down as intricately as we might like, but they're sort of out there publishing these reports. And Zoom, because they were mostly an enterprise product, because, you know, a couple months ago, no one really thought that they were going to be using it for anything sensitive, or at least not personally sensitive.

They've just never sort of disclosed any of that. And so now they're getting more pressure to do it. But it really is this question of like, how much are these tools getting held to this higher standard? Yeah, I mean, transparency reports are such a pain. Like, you know, Dropbox, I love their transparency report, but there's no standard on what they're supposed to look like. It's the first problem. And if you look at the evolution of the Google transparency report, it used to have a lot more information than it does now, but they update that every six months.

So even then, you're looking into a crystal ball of the past, and it's pretty vague. And they only do it because of pressure. So you have to put pressure on companies to do it. Like Zoom Enterprise, they're dirtier than regular. So you think of regular consumer-finsic product? There's mad cases about industrial espionage, sexual harassment, like Zoom calls where they said this and this happened. It's purposely designed, why would we have our legal team build it up to write these

reports and make it beautiful design a website? And that's a real hassle. So it really has to come from pressure. And not every company will bow down and be like, okay, we'll do that for you. There's not, like, there's no regulations that they have to do it or it has to be correct. So I think that there's a lot behind the motivation of a company to add more insight and transparency and how they deal with these things than others. And it has to do with the founder and the attitude, the corporate culture of that company, because they're human beings inside this company. They're like, you know, there's no good or bad company in my eye, right? There's no like, this company's evil, that company's right. There's a rumor that someone from that company walks

into people are happy to see them no matter how much of a horrible person we might think they are. So some companies don't care about privacy. They don't, they never will. Some companies don't care about legal request, and they do the very least. Some companies, if you just tap them on the shoulder, they'll give you everything. And that'll never change. And it's about understanding what the motivations are and how to tell what companies what. So if you don't see a transparency report, it's more about there's a lot more behind it than you might just think.

It's not just because nobody asked them or there wasn't enough pressure. they might just not care at all. All right, Matt, so we've been, I think, talking at a high level. This is the work you do. You've been doing it. But let me bring it to now. Everyone's a home. Everyone's communicating on digital platforms all the time.

There is some shady business happening in our government and we see it. How should people think about these platforms right now from the perspective of activism, from the perspective of even just basic stuff? If you've got a candidate coming up in the election, you want to organize that candidate, you want to have a town. Like, how do you think about it now when we're forced to communicate online? Well, I think now is the time to sit, like, know the privacy policy of the tools that you're using. If you're lazy, not to blow up a free service and make it not free anymore, but there's visual search, like visual difference software out there, like change tower or visual ping. if you're lazy, just have it watch the privacy policy of your cable provider or your favorite software that you need to use every day for work.

And just watch for when it changes if it changes because we're in a day and age of uncertainty. And people maybe with the best intentions want to know everyone you talk to and you might have been around by looking through your cell phone records. Like that's real talk right now. And in a moment of desperation, that's when people are less likely to fight for their civil liberties. But once you give something up now, it's there forever, right? So we have to be really careful about these rules. So if you work at a company, watch their agreement to people that you signed, like dust off that contract you signed when you got the job.

You're so excited or ask HR for a copy of it and make sure that you can check for deltas and differences in it because that's where the civil liberty encroachments and things that will hurt you, that's where they come from. Also understand that when you're on the internet 24 hours. a day, you're creating more data exhaust and more trackable information about yourself than ever now, right? So take more precautions and think about it. So, you know, you might clear the history when you're on a browser or use incognito mode to the original history, but when you visit a website, because it has to look up the DNS, unless you're using some browser that has DNS security on it,

but let's not get into that. Your cable provider is through their hardware, they're the default look up for all of your everything that's going on on your phone. on your laptop, every app, every tool, right? So they're getting what sites your apps are using, like Tinder.com all day, right? And they can see what time you're visiting them, and that paints a picture about who you are, what websites you're on.

And even if those websites are H-S-E-TPS encrypted, you get the domain name of that website. So you're on ESPN, and then you're on this other side, and then you're on Tinder, and I can see that and it paints a picture. But if you're using a VPN, that picture is blurred because the cable provider doesn't get it.

you're giving that list, which has to exist technically, to someone who promises to throw it out. So I would recommend, like, use a VPN, like BitMask where you can use it anonymously for free, right? Or use Proton VPN with an email that you just made throw away, right? Or, you know, install tunnel bear and use the free 500 megabytes of encryption on it on the VPN. Just so you have a virtual private network that you can use. And yeah, it might disrupt your email speed. You might be a little blurrier on your video conference, but thus is the price of privacy. So it's just about understanding, like, now more than ever that you're home feeding all your data through one source, it's not compartmentalized.

You're not like, this is the data that I create when I'm at work. This is the data I create when I'm in my bedroom. This is the data I create when I'm on the subway or on the street, right? It's now all in one, easy to read, easy to drink straw, right? Pool. So now more than ever, use privacy protecting software to blur that in. image. Yeah, that's really smart. All right, Matt, thank you so much for joining us today. I know it's a weird, a weird time, and I know that everyone's real busy. It is a weird time, but the positive thing from this

time is that biologically, we're being forced to realize that everything that we do affects our friends, our family, our enemies, every human being, whether you identify as male, female, gender non-conforming, you have a biological system, and we're all in this together. And I try to think of it's like, we're all United and we can help each other by small sacrifices. And that's what activism is all about, right? Just taking those small sacrifices to help for the greater good. So, you know, be an activist by just sitting your ass at home. That's right. It feels like this is the beginning. So there's just there's a lot of panic and chaos. But on the other end of it, it feels like a lot of assumptions, a lot of attitudes might be reset by all of America taking a break for some time. And I'm interested

to see we're to spend a lot of time tracking how that works with our, they're online and digital lives because having the entire country mediated by the internet for almost all interaction is unlike anything that's ever happened. It's never, never happened before. Yes, you all can work from home if you got that kind of job. But there are a lot of people who can, a lot of people who are not working from home. Like, homies bagging groceries for you, there's no, there's no Zoom version of that. Yeah.

Let's also remember those folks. Yeah, for sure. But even that, like the, your entertainment now, you know, Disney's shipping. their movies to streaming. Yeah, Universal is like, we're dropping movies on streaming instead of theaters because there are no theaters, right? Yeah, and just that, just that alone. Like, okay, now my, all the entertainment that I consume happens over one pipe.

Yeah, there's a lot of people who are excited by that because now more than ever, they can get it all from one place, right? Like, that's the, the detail of who you are through your data have never been this crystal clear. Yeah, all right, I got to go install the VPN. So I got to run. Do it. Matt, thank you so much.

I would love to have you back sometime soon. This was an amazing conversation. Thank you. Russell, you were also good. Well, I thank you. All right, my thanks to Matt Mitchell, founder of Crypto Harlem, and as always to Russell Brandem for joining me. We'll be back on Friday with the chat show, Tuesday with the interview show.

Tweet at me on Matt Reckless. I love your feedback. Love hearing who you want me to talk to. We'll talk to you soon.