Latest / CyberPodcast / The Limits of Anonymization: Privacy vs. State Surveillance | Paper Breakdown #14 | CyberPodcast

Transcript

The Limits of Anonymization: Privacy vs. State Surveillance | Paper Breakdown #14 | CyberPodcast · CyberPodcast

• 0:00
  Welcome to this explainer. Today we're diving deep into the
• 0:03
  fascinating technical mechanics and legal frameworks of
• 0:06
  government spyware, and we're doing this by relying entirely
• 0:10
  on real world source material and documented research.
• 0:13
  We're going to unpack exactly how state sponsored surveillance
• 0:17
  operates under the hood and the really complex legal tightrope
• 0:20
  it walks. Let's kick things off with a
• 0:23
  pretty provocative question. When you're using encrypted
• 0:25
  services to communicate online, how can authorities actually
• 0:28
  listen in? You know, we usually think of
• 0:30
  encryption as this impenetrable digital fortress.
• 0:33
  But as we're about to see, if you can't break down the walls
• 0:35
  of the fortress, you just have to find a clever way to sneak
• 0:38
  inside before the doors even lock.
• 0:40
  OK, here's our road map for today.
• 0:42
  We'll start with state interests versus privacy, then look at
• 0:45
  combating global cybercrime, explore the Trojan horse
• 0:48
  concept, see how encryption is bypassed, dissect the Bundes
• 0:51
  Trojan air, and finally wrap up with its security flaws.
• 0:54
  Section 1. State interests versus privacy.
• 0:58
  So from a governmental perspective, the Internet just
• 1:00
  can't exist completely outside the scope of the law.
• 1:03
  States essentially argue that total digital anonymity ends up
• 1:06
  shielding perpetrators of some really horrific acts.
• 1:09
  For instance, authorities point to the tragic 2011 extremist
• 1:12
  attacks in Norway, where the perpetrator actually operated
• 1:15
  online using pseudonyms for years.
• 1:17
  They also cite the 9/11 hijackers who used Internet
• 1:19
  anonymity for their communications, plus
• 1:22
  decentralized hacker groups like Anonymous who actively mask
• 1:25
  their IP addresses to breach massive corporate databases.
• 1:28
  State's fundamental argument here is that their duty to
• 1:30
  protect citizens sometimes absolutely requires piercing
• 1:33
  that veil of anonymity. Section 2.
• 1:36
  Combating global cybercrime To actually combat these
• 1:40
  transporter threats, governments need a highly coordinated
• 1:43
  approach. And because of that, the
• 1:45
  international community has built several massive
• 1:47
  frameworks. You've got the International
• 1:49
  Telecommunication Union rolling out the Global Cybersecurity
• 1:52
  Agenda to draft model legislation.
• 1:54
  Then there's the Council of Europe's 2001 Convention on
• 1:57
  Cybercrime, often called the Budapest Convention, which is
• 2:00
  all about harmonizing laws around hacking and data piracy.
• 2:03
  And of course, various European Union framework decisions
• 2:05
  targeting digital fraud and terrorism.
• 2:07
  The crucial take away from all these international treaties?
• 2:10
  Not a single one of them explicitly guarantees a right to
• 2:13
  absolute digital anonymity. In fact, they mostly exist to
• 2:16
  facilitate law enforcement access to our digital data.
• 2:19
  But against that broad international backdrop, domestic
• 2:23
  laws sometimes push back hard. Back in 2008, the German Federal
• 2:27
  Constitutional Court introduced a really fascinating
• 2:30
  counterbalance. They officially recognized a
• 2:32
  fundamental right protecting the confidentiality and integrity of
• 2:35
  your private computer. They ruled that secretly
• 2:38
  infiltrating a citizen's IT system is a direct infringement
• 2:41
  of general personality rights. They basically treated a
• 2:43
  personal computer almost exactly like a private physical home.
• 2:47
  So any infiltration would require a severe concrete danger
• 2:50
  to the state or human life, plus a very strict court order.
• 2:54
  Section 3. The Trojan Horse concept, right?
• 2:57
  So if international laws demand cyber vigilance, but
• 3:01
  constitutional rights demand digital privacy, what is the
• 3:04
  actual technical explanation for how states bridge this gap when
• 3:08
  they finally do secure a warrant?
• 3:10
  Well, just like the Greek warriors hiding inside that
• 3:12
  wooden horse to sneak past the gates of Troy, Trojan software
• 3:16
  sneaks past the gates of a user's operating system totally
• 3:20
  undetected. It might show up via a deceptive
• 3:22
  e-mail attachment, or it could even be physically installed
• 3:25
  during a secret physical search of a proper.
• 3:28
  Now, technically speaking, a Trojan is not a computer virus.
• 3:32
  A virus self replicates. It's designed to cause chaotic
• 3:35
  damage or corruption to a system.
• 3:37
  A Trojan, on the other hand, is a highly targeted payload.
• 3:40
  It's essentially a Digital Spy designed to silently pry open a
• 3:43
  back door. This grants an operator remote
• 3:46
  access to extract data without ever tipping you off that
• 3:48
  something is wrong. Section 4.
• 3:50
  Bypassing encryption via wiretapping.
• 3:54
  Think about programs like Kye for a second.
• 3:56
  They use endtoend encrytion. If law enforcement intercets the
• 3:59
  data while it's traveling over the open Internet, literally all
• 4:02
  they get is scrambled, unreadable noise.
• 4:04
  So they have to bypass the encryption entirely.
• 4:06
  Here is the technical breakdown of how that happens. 1st, the
• 4:09
  suspect initiates an Internet call. 2nd, and honestly this is
• 4:13
  the dark genius of the Trojan, the malware intercepts the audio
• 4:16
  data right at the source. It literally taps directly into
• 4:18
  the computer's microphone driver and records the raw audio before
• 4:21
  the Skype application even gets a chance to encrypt it.
• 4:24
  Only after the Trojan has secretly captured that raw audio
• 4:27
  does step three happen, where the local program encrypts the
• 4:29
  call and sends it out over the Internet as normal.
• 4:32
  Section 5. Dissecting the Bundes Trojier.
• 4:35
  And this isn't just theory, by the way.
• 4:37
  Back in October 2011, a prominent German hacker
• 4:39
  association known as the Chaos Computer Club, or CCC, managed
• 4:44
  to get their hands on a piece of lawful interception malware that
• 4:47
  was actively being used by German state authorities.
• 4:50
  They famously dubbed it the Bundestro genre, or Federal
• 4:53
  Trojan. The CCC took the binary files,
• 4:55
  completely reverse engineered the code, and published a highly
• 4:58
  detailed technical report on exactly what the government
• 5:01
  software was doing behind the scenes.
• 5:03
  The crucial point here is the massive technical gap between
• 5:06
  what the law actually allowed and what this software was
• 5:09
  actually built to do. The official legal scope of this
• 5:13
  malware was strictly limited to recording Internet telephone
• 5:16
  calls and taking occasional screenshots to help with
• 5:19
  wiretapping. But when the CCC dissected the
• 5:21
  code, they found entirely different hidden capabilities.
• 5:25
  The Bundestro genre had built in key loggers to record every
• 5:29
  single keystroke and password. It could remotely activate the
• 5:32
  computer's camera and microphone to surveil the physical room.
• 5:35
  And honestly, most alarmingly, it had a backdoor functionality
• 5:39
  allowing the operator to silently install and execute
• 5:41
  arbitrary code. That means the government could
• 5:44
  just silently upgrade the malware's capabilities on the
• 5:46
  fly after it was already planted on a target's machine.
• 5:50
  Section 6. Security flaws and legalities.
• 5:54
  Yeah, having these sweeping hidden capabilities is one
• 5:56
  thing, but the actual technical execution of how this malware
• 6:00
  was built introduced severe security complications that
• 6:03
  completely shocked the cybersecurity community.
• 6:06
  During their reverse engineering, the CCC found that
• 6:08
  the Trojan was programmed to send its stolen data to exactly
• 6:11
  1 location. All intercepted data from these
• 6:13
  highly sensitive German criminal investigations was first routed
• 6:16
  to a single hard coded server located in a computer center in
• 6:20
  Columbus, OH in the United States, before it was ever
• 6:22
  bounced back to the German authorities.
• 6:24
  And it gets worse. The Bundes Trojaner was just
• 6:26
  riddled with vulnerabilities. Track data was passing through
• 6:29
  unsecured networks. But the absolute most
• 6:32
  devastating technical flaw, The inbound commands telling the
• 6:35
  Trojan what to do were completely unauthenticated.
• 6:38
  It literally didn't check if the instructions were actually
• 6:40
  coming from the German police or just a random teenager in a
• 6:43
  basement somewhere. By opening this unauthenticated
• 6:45
  back door on a citizen's computer, the state basically
• 6:48
  built a massive security loophole that theoretically
• 6:50
  allowed any third party hacker on the Internet to entirely
• 6:53
  hijacked the suspect's machine. Because it flagrantly violated
• 6:57
  basic data protection principles, routed digital
• 6:59
  evidence through foreign servers, and technically
• 7:02
  exceeded the scope of a standard wiretap by installing
• 7:04
  unauthenticated back doors, The technical reality of this
• 7:07
  malware crashed head on into the legal protections of that 2008
• 7:11
  constitutional ruling we discussed earlier.
• 7:14
  The state's attempt to use technology to enforce the law
• 7:17
  ended up creating a tool that was legally highly questionable,
• 7:20
  which sparked a massive national debate about the strict limits
• 7:23
  of digital surveillance. So to wrap up this explainer, I
• 7:26
  want to leave you with this crucial thought.
• 7:28
  As surveillance technology becomes infinitely more capable,
• 7:31
  stealthy, and complex, how can society safely balance a state's
• 7:35
  legitimate duty to protect its citizens from cybercrime with
• 7:38
  our fundamental human right to digital integrity and privacy?
• 7:42
  It's a technical and legal puzzle that we are absolutely
• 7:45
  still trying to solve today. Thanks for joining me and I
• 7:48
  encourage you to always keep questioning the technology
• 7:51
  operating silently in the background of our lives.