PassW0rd – 27th July 2016

Speaker A: This program is brought to you by Resonance 104.4 FM. If you like what you hear and want to support our work, please make a donation at fundraiser.resonance.fm.

Speaker B: Hello and welcome to this week’s Password. I’m Peter Warren, and I’m worried. I’m worried about terrorism, about cybercrime, about huge multinational companies exploiting my personal data and preferences, about how to organize and display all the hundreds of articles, podcasts, and radio shows I’ve made in my long career as a technology journalist. I’m so worried that my hair’s falling out. But in the next 27 minutes, I’ll have the answers to all these concerns. So keep listening, and I’ll share them with you. The grisly horror of attacks committed in the name of the so-called Islamic State continues. But while we mourn the victims, we can take some comfort from the research carried out by Flashpoint, a specialist research company.. It shows that while ISIS activists are able to use the deep and dark web to hide their activities, their online capabilities are limited. Flashpoint’s director Laith Alkouri told me what methods they are using.

Speaker C: Sure, Digital Toolbox is meant to express a comprehensive outlook on the variety of technologies that they are using, including browsers, secure browsers that is, instead of the use of Firefox or Safari, which are not as secure as people think. They turn to more secure browsers like the Onion Router or Tor, as well as the Opera browser, which remains one of the most secure browsers today. They have also adopted the use of VPN and proxy services, not only American and European, but others including Asian ones. We’ve also seen them adopt the use of more secure email services and temporary email services. And what those do, considering there is high scrutiny on email communication between jihadists, it allows them to, you know, potentially block any attempt to read their emails. This includes encrypted email addresses such as ProtonMail, for example. Which is Swiss-based, so this allows them the best privacy laws in the world. We’ve also seen them use encrypted messenger services like Threema, which is one of the best out there according to so many online reviews. We’ve also seen them discuss a variety of encrypted messengers that allow them to not only communicate with each other, but also view terror group propaganda much easier on the go, and that’s the use of Telegram. Telegram stands today as Telegram is one of the most favored and one of the primary, essentially, distribution channels for ISIS and for communication by ISIS supporters to date. It gives you end-to-end encryption and allows you to have essentially secret chats between individuals. So if you’re in the process of recruitment and you’re trying to recruit people into your fold and you’re using Telegram, if you’re engaging in secret chat and you delete the conversation on your end, it actually gets deleted as well on the other end receiver. This allows them to obviously obfuscate the conversations that they’re having with untrusted people. So when we look at all of these apps and all of these platforms that they’re tapping into, and I’m of course not mentioning everything here, and they’re trying to, you know, search for more. This is only step one. Likelihood is that in several months from now, there’ll be, you know, an entirely different toolbox that we’ll see them use. There might be similar apps that we’re seeing today being used, but also there’ll be the addition of new apps and new technologies that we, you know, they haven’t tapped into before.

Speaker D: I see. So, I mean, essentially then what we’re seeing is this is just defensive, isn’t it? What they are doing is recruiting people via their websites and then as quickly as they possibly can, switching off into an encrypted chat that they hope that the intelligence agencies and those looking for them can’t have access to.

Speaker C: They’re exactly doing that. And as a matter of fact, Flashpoint analysts, who are subject matter experts, you know, on this field and other illicit activities on the deep and dark web, have seen firsthand— and again, I would repeat, firsthand— attempts at recruitment by English-speaking and Western ISIS recruiters who are going on Telegram and who are engaging in these secret chat conversations with potential recruits. So this is happening as we speak. We’ve seen it happen multiple times, and it will likely continue to happen unless there is, you know, there are more measures in place that would prevent them from doing so.

Speaker D: A lot of people have talked about an ISIS cyber warfare capability.

Speaker C: So we have not seen any indication that ISIS has acquired sophisticated cyber arm. The only indications we’ve seen are individuals who have some hacking skills, not sophisticated ones, organizing together and pledging allegiance to ISIS and launching cyberattacks on their behalf. And the grand majority of those cyberattacks have been essentially low-level defacements and exploitation of vulnerabilities that have existed for a long time, as well as essentially the harvesting of social media-based personally identifiable information of Americans and other Westerners and repackaging that information as hit lists or kill lists and to egg lone actors out there in the West to target those individuals.

Speaker D: Okay, so that’s where we are now. The future, what trends are you expecting to see? Do you expect to see them picking up a cyber warfare or hacking capability?

Speaker C: In the short run, I don’t see ISIS itself picking up cyber capabilities enough to inflict any kind of damage. Also, we don’t expect in the short run to see even its pro-ISIS collectives online picking up, you know, sophisticated hackers or launching really sophisticated attacks. You know, perhaps they might be doing more research on existing vulnerabilities out there, or perhaps learning how to launch more sophisticated attacks by using, you know, Kali Linux, you know, or other courses that would teach them more about hacking. Or you will see them congregating more on Arabic-speaking hacker forums in the deep web to learn more about advanced hacking courses, which exist today as we speak. So we’ll see them picking up, but we will not see them— I have a high degree of certainty we will not see them picking up more sophisticated hackers or advance their skill set to be able to launch critical attacks.

Speaker B: So the threat of cyberterrorism is, at least for now, not severe. What’s more serious for most of us is the risk of hacking by common criminals who’ve moved online. Latest stats from the Office of National Statistics were based on new fraud and computer misuse questions that were added to the survey from October 2015. They show that adults aged 16 and over experienced an estimated 5.8 million fraud and computer misuse incidents in the 12 months prior to interview. 3.8 million of these were fraud incidents and 2 million were computer misuse incidents. The ONS says the British population in June was around 65 million. It’s the police, not the intelligence agencies, who have to tackle this online fraud. Suffolk’s Police and Crime Commissioner Tim Passmore tells me how they’re organising the fight against cybercrime.

Speaker E: The National Crime Agency is like some type of large firewall around the whole of the United Kingdom, so that helps deal with the international threat. The regional dimension is they’re looking, for example, at organised crime groups, be they trading in firearms, drugs, money laundering. They use the technology to launder their ill-gotten gains, if you like. You’ll get local people break into computer systems and steal people’s pension savings, identity theft and so on. So it’s very, very complex and it’s very, very important you have the right communication going right across the various agencies involved because very often picking the intelligence up, it’s rather like a jigsaw and the missing pieces can be found locally and when that happens then you can start to close in on the people who are committing these offences. But it’s a hell of a challenge because as you rightly say, technology does not respect boundaries, international boundaries, countries. It is a global problem and we have to deal with it.

Speaker G: Now, in terms of this awareness issue, I mean, a lot of people don’t realize that quite often this, this comes down to them being a little vigilant on their home computer systems. And a lot of people don’t actually realize that their home computer systems are taken over by people. They’re then used by them to form botnets and they’ll all become part of this crime ecosystem. So in this awareness raising, what would you like to see?

Speaker E: I think we have to use a variety of methods here for any awareness campaign. There’s some very good websites, cybersecurity advisory sites run by the Home Office, but again, it needs to be published. People aren’t aware of it, so campaigns with posters in cinemas, on the telly, newspapers, any medium you can get, obviously using social media is very, very sensible and accessible to many. We need to do that, and you can— I raise this, I do a lot of public engagement talks and discussions right across Suffolk, and that is something I raise continually. This is a huge threat. And one of the other things that we’ve done here in Suffolk, we got a grant from the government I think it was about £40,000 where we’ve got a campaign working with Training Standards here in Suffolk about online security and safety for children in primary schools. So they are aware of it. And very often, you know, youngsters are very good at teaching an old codger like me what you need to do online to keep safe. And I always remember one of our local police officers saying, well, of course, you’ve got to remember the pattern of crime has changed. It’s now moved indoors, but the principles are still the same. So when you finish using your, for example, desktop or iPad, do you turn it off and lock it up? You would lock your house up at night to stop burglars getting in. Do we all shut down our laptops, our desktops and so on? Perhaps not. So there are some very basic things that you can do to try and deal with it. And I think we need that awareness campaign across many forms of media to keep getting that message across. You’ve got to be cyber secure and cyber safe and we’ve got to stick at it and I think this is going to take several years to get there, and we need to try and get a, I suppose, a cultural shift in society where it becomes second nature, rather like you get into a car and put your seat belts on now as a matter of course. Are we doing the same with technology? No, we’re not, but that’s where we need to get to.

Speaker G: It’s an interesting point, isn’t it? Because the other day I was in a local pub in Suffolk and somebody came up to me and said, you’re a cybersecurity expert, my Facebook account keeps on getting Facebook raped, and The people next to him turned around and said, well, that’s because you keep on leaving it logged on when you go away from it.

Speaker E: Yeah, well, there we are, case in point. And this is the problem. And we have to remember that technology is a wonderful resource for society, makes our lives a lot easier in many ways, but of course it’s a huge opportunity for the criminal fraternity. And any new invention provides them with new avenues, so we have to be aware of that and try and be proactive to prevent this activity from happening. But we’re not there yet, so we’ve got a long way to go.

Speaker G: The thing that we really need to do is be a bit more proactive, use a bit more energy, and use different passwords for different accounts. That is one of the problems at the moment given that we have to rely on passwords.

Speaker E: Now I agree, and of course we all have so many passwords, PINs for credit cards and so on, and it’s a challenge. But there is one little tip I’d like to just share with you before we finish, if I may. If you get contacted by a firm, be it a bank or anyone else, and they ask you for your personal details, be very, very careful. Careful. And one little tip you can give: if they ask you for your date of birth, deliberately give them the wrong one. And if someone says, oh well, that’s fine, you know you’re on to something there.

Speaker G: Something that I always do is I say, okay, um, you’re contacting me, what I’d rather do is ring you back on, on a number that I’ll go and get that I know is the right one.

Speaker E: That’s, that’s another excellent piece of advice. Change the game plan here and try and put it back on them. And, uh, I’m quite sure with these nuisance calls, they’re up to no good. And that’s, that’s 2 or 3 really simple little ideas there for dealing with them, and we all need to do that, we really do.

Speaker B: And the authorities are especially concerned that the middle-aged and older generations are the most vulnerable to cybercrime, yet they are also the ones with potentially the most to gain if they retrain for careers in cybersecurity. Ethical hackers can earn £80,000 a year, almost as much as footballers. People in cyber forensics can earn £1,500 a day. Bob Knoll, former director of technology and engineering at the GCHQ Spy Centre and now the head of the Cyber Security Challenge initiative, says they urgently need new recruits of all ages.

Speaker F: It’s not really an old versus young thing, there’s a mindset thing as well, but I do feel that somewhere between the kids of today and the kids of 40 years ago, there’s a group who came through the education system without enough in terms of science, technology, engineering, maths, and not all of them want to turn around and say, oh, well, I can do that, I’ll get retrained. But I think some of them do. So you’re right that if we then accept that, that there are opportunities and there’s people who could fill the gaps if only they could be retrained, and the retraining issue is in itself a problem to find those mentors and teachers and trainers and so on to make that happen. Of course, none Don’t start, it will never happen. And that’s why I say in things like the Cybersecurity Challenge, which I represent, but obviously we’re not the only game in town, then working with teachers and trainers and careers advisers and companies and departments of government to get this picture done on a scale that actually is big, something that can scale up, is so important.

Speaker G: But I mean, that strikes me though, that one of the areas where there is conspicuous unemployment, one of the areas where people would benefit hugely is, again, you know, I mean, one, there are all of these employment issues highlighted for young people, but also there are older people who, to be perfectly honest, actually unemployable because they are no longer part of the mainstream of development.

Speaker F: [Speaker:DAVID HEATHFIELD] Yeah, well, no, that’s true. There are some people who find the subject inaccessible and it’s difficult to get retrained. I suppose what I think is that because we need, as I say, people in ordinary jobs to be better and more aware of cyber, that that isn’t a lost cause. So people who swallow hard and decide they do want to regrade and retrain and pick up some skills in computing and IT and science, cyber and all of that, security, We need to make sure the opportunities are there. It’s not that people become unteachable or uncoachable, it’s just that the opportunities are hard to find. But if I look in, you know, let’s look at the things that employ loads of people like the health service or things like the armed services or the police, some of the big public sector, local government type world. We all wish that if we’d been defrauded on our credit cards we could pop into a police station, say what the problem is, and the bloke behind the counter would get it and give us some help. Trouble is we’re not quite in that place because your average law enforcement officer probably hasn’t got all the skills we wish they had in cyber. Ditto if you’re in a hospital and you want to have a conversation with a nurse about, you know, is it alright to use my mobile phone next to my pacemaker or something. They may give you a blank look or they’ll look up a rule without really understanding the rule. Or if you are at school and you want careers advice in, hey, is cybersecurity a good thing? Should I go and get a job at GCHQ or whatever? The poor old teacher or career advisor won’t probably know the best advice to give you. So, and I’m repeating myself slightly, but it’s important, I think, that we don’t just focus on those who are looking for change, correct though that is. We’ve got to focus to get the numbers up and to scale this whole thing up. We’ve got to focus on teaching the teachers training the trainers, working with careers advisers and so on as well.

Speaker B: While the authorities struggle to catch up with those who want to steal our data and take over our computers to use for crime or terrorism, Professor Irene Ng of Warwick University has found a new way for us to protect and even profit from our online information. It’s called the Hub of All Things, or HAT for short, and successfully crowdfunded its launch earlier this month. Professor Ng explains how it works.

Speaker I: If you gave it back to me, I can share my own data with myself. I can mix and match with the location, the people, the events. If I had a powerful enough information system, make it searchable, indexable, clusterable, I’ll use it and maybe I’ll make better purchase decisions. 65% of GDP are purchases from within the home. If we had better information, data on what we have and what we match to what we buy, that’s a huge impact on GDP.

Speaker B: Okay.

Speaker D: Does that though also then make something else happen? Does that mean that I can actually start to maybe make some value out of my own data, not just in terms of those better purchase decisions, but say, look, I’ve improved my data, it’s now better for me to buy things with.

Speaker B: And I’ll sell that back to you.

Speaker E: Exactly.

Speaker I: Yes, that’s what the hack does.

Speaker E: You can—

Speaker I: if under Freedom of Information Act or data protection, you can go get your data back from Tesla, you can sell it to Facebook. Now it’s really disruptive, you can imagine, which is what I don’t want to say too much about. But it is possible. If you had a way to take it back, you can sell it. And it’s worth something. We as individuals— that the only problem is, as individuals, we are such high in variety, We’re so heterogeneous. But if you had a platform that could let you retain the uniqueness of your value of your data and the content, but yet had a standardized way of having protocols, the way it’s exchanged, the way the data is moving in and out, then we as a collective become very powerful, even as buyers of purchases, buyers of data services.

Speaker B: It’s not going to make you very popular though, with some of the large data companies, is it?

Speaker I: Oh, I think we will be incredibly popular. Because one of the biggest problems with the data company, and I’m not talking about the Googles of the world, I’m talking about the marketing, advertising marketing of the world, which is a $30 billion industry, is on the race to the bottom. I remember when I first got on the internet back in 1991, the click-through rate of a banner was 98% because everybody was curious what a banner was doing. It brought you to another website. Today, a click-through rate on the banner is 0.1%. We have ad blockers as many as we have ads. It’s not reaching out. It’s not getting the right conversations with us as individuals. And so, instead of trying to pound us with things and guessing what we are, if we had our own data, like if I had my shopping basket, you could tell me which supermarket around me is the cheapest today.

Speaker B: This is really interesting, isn’t it?

Speaker D: Last week on the program, we had somebody who was talking about putting together an application that allowed you to find out what things were near you in shops, because they were pointing out that the local shops are not searchable, and as a result, we make purchases online. So we’re doing all of this stuff remotely that we don’t necessarily need to do.

Speaker B: Most of the stuff that you want is only 5 minutes away.

Speaker D: And that’s right, it’s just been announced that Google have entered into— oh, sorry, Amazon have entered into an agreement with the British government to come up with drones that are flying stuff to you from 30 minutes away.

Speaker B: You don’t even need that either, really.

Speaker D: I mean, what you’re sort of saying is that we’re coming up with a, uh, a problem to a solution, really.

Speaker B: Exactly.

Speaker I: And if you think about— just imagine if I had, um, a book my cupboard inventory. You are also going beyond the financial economy. You can say, for example, I need a cup of— I mean, back in those days when we need a cup of sugar, for example, you could just, you know, if we had our kitchen inventories with our neighbors, we could share things that would be perishable tomorrow or we don’t mind sharing. So, we create a different kind of economy with data sharing that could have a huge impact on the financial economy, but it also has a huge impact on the way society shares and engages That’s HAT, currently at its beta stage, offering a way to organise our own data.

Speaker B: Incoming data is another headache, but as always, tech provides a cure. There’s Flipboard, which lets you curate online magazines based on your own personal tastes, and a new system called Wakelet has been proving its worth at the European City of Science Festival in Manchester. Inventor Jamil Khalil.

Speaker H: They’ve been using it to create lots of cool information around healthy populations, material dimensions, sustaining the environment, living in the future— really great scientific topics that they want to share with people. So they’ve pulled in articles and videos and blogs in all these amazing collections and orchestrated all this information in a way which their users would consume and enjoy. On top of it, they’ve collated stuff around different scientists. So for example, Professor Brian Cox has got a wealth of information online about him. And they’ve organized all this information into basically amazing, beautiful-looking collections. So his interviews, and his stories, and the shows he’s been involved in, it’s all there in a very easy, simple way for people to pick it up. And the last thing they’ve used it for is during the conference itself, every single day they’ve collated videos, and tweets, and Instagram posts, and articles that have come out around the events that happened, and they recirculate and we share this with people who didn’t have a chance to go to the conference or maybe were tied up in one of the sessions and couldn’t get around to the other session.

Speaker D: Okay, so, and that’s going off in Manchester this week, but you’re also being used by a whole host of other organizations, aren’t you?

Speaker B: What are they doing?

Speaker H: It’s also being used by Premier League football clubs, it’s used by cricket clubs, it’s used by people like the ITV, we’ve got a number of brands on the platform, athletes on the platform, and they’re using it all to organize different things from the internet into all nice stories. So for example, if I give you Swansea Football Club, they’ve been using it to organize every single match day last year. They’ve recorded every single game, they’ve added the articles and the videos and the pre- and post-match interviews and the tweets on each single game and kept them all so they can share them at the end of the game with people and fans, and they can actually share them again before the next time they play the same team again. Okay, continue using a very diverse way.

Speaker B: So where do you go in the future then?

Speaker D: I mean, do you think this is the future of the internet, or do you think that this is something that will be developed into something completely different?

Speaker H: I definitely believe that the future of the internet is around having more structured, more organized pieces of information. There’s just so much now online that it’s not really scalable anymore. So for us, it’s around improving our product, improving the features and listening to our users so we can improve this and make it more stickier and more better. And then basically going across into the States something that we’re really interested to do. It’s a great market for us, and hopefully making this very successful.

Speaker B: That’s Jameel Khalil of Wakelet.com. I’m Peter Warren, and this is Password on Resonance FM, where Kitchen Magic Time follows after this show on Wednesday. After hearing all these new ideas for making the online world safer and more beautiful, I’m feeling reassured. But still, I’ve lost a certain amount of hair from the front of my head, and it would be wonderful if technology could restore it. The man who says it can is Randy Veliki, Chief Technology Officer of HairMax. His system uses a laser-like beam of light.

Speaker J: Well, what we have done through our research is we have found the type of light energy that can actually stimulate the hair follicle. You know, over time with DHT and poor blood flow, that hair follicle becomes weakened. We can give it the energy to come back to life and produce a big, thick, full, beautiful hair again.

Speaker D: But does that, does that mean though that you’re also increasing the blood flow to the scalp, or is this, is this just going to be a temporary, uh, solution?

Speaker J: Well, it is, and that is not a temporary solution. The hair loss is very close to permanent. You will continue to lose hair like every healthy scalp should, but we’re going to encourage the hair to grow back after it’s shed through the normal process. So what we are doing is we’re providing, like I said, stimulation of the hair follicle as well. And there are clinical studies out there that show that this same type of light therapy can increase microcirculation around the hair bulb. Bringing in that oxygen and nutrients that are required for good hair growth.

Speaker D: So just to go to your point about your hair being protective on top of the head, is this perhaps a response of your scalp saying, oh, I’m getting a lot of light here, I should really put on a bit more hair?

Speaker J: Yeah, very well could be, very well could be. Now keep in mind though, the bad light that comes from the sun is called UV light.

Speaker C: Right?

Speaker J: We’re all familiar with UVA and UVB and how that can potentially cause skin cancer. The nice thing about our product is we use a very, very specific laser that does not contain any UV light whatsoever, so it’s completely safe.

Speaker D: I mean, would this mean that for an old person with, you know, no hair, who’s had, who’s had no hair for a long time, that they could use it?

Speaker J: Unfortunately, it is intended for mild to moderate stages of hair loss. So if somebody, if a gent is completely bald and hasn’t had hair on the top of his head for many years, there’s really nothing we can do. Those hair follicles have moved beyond the stage of being able to be resuscitated. They have expired, and there’s nothing that will bring them back to life that I’m aware of.

Speaker B: So what results are you getting then?

Speaker D: Well, what we, you know, you say that this is the first time that It’s been clinically proven that you can get hair to grow back again. What sort of results are you getting?

Speaker J: We’ve done a total of 7 clinical studies with 460 men and women, and in those clinical studies, over 90% of the men and women saw hair regrowth. So that’s really, really great results. And the results that we’re seeing are over 129 new hairs per square inch, which equates to about 20 new hairs per square centimeter. Growth. So if you think about how many square inches or square centimeters are on your scalp and you multiply that out, that’s thousands and thousands of new hairs growing back.

Speaker B: That’s the claim from HairMax. I’ve no way of testing it. And that’s all for this edition of Password. I’ll be back after the summer break with more technology news. And in the meantime, I’ll be launching the new Cybersecurity Research Institute website. Find it online in the coming weeks. At csri.info. And who knows? I may have tracked down a HairMax and got some more hair. Thanks for listening.

Speaker A: Goodbye. This program has been brought to you by Resonance 104.4 FM. If you liked what you heard and want to support our work, please make a donation at fundraiser.resonance.fm.