PassWord – 27th May 2015

Speaker A: This program is brought to you by Resonance 104.4 FM. If you like what you hear and want to support our work, please make a donation at fundraiser.resonance.fm.

Speaker B: Hello and welcome to Password, the technology program that tells you how technology works and what it means for you, with me, Peter Warren. In a week that has seen the first signs that the US intelligence agencies are beginning to dismantle their massive surveillance network, we investigate just how pervasive everyday surveillance has become. It was once said that from the moment we are born that we leave a footprint, but that was written when those traces were quickly washed away. This week we look at the efforts being made by the UK the Information Commissioner to curb the activities of companies that target children, the battle to reclaim the fundamental human right to be lost, and how making our water systems smart may not be the brightest move. But first, the news stories that have been exciting the net, brought to you by Dolores Williams.

Speaker C: Hi, Peter. In the US, there has been another round of saber rattling against the Chinese for espionage. According to the US and many companies in the West, the Chinese have been engaged in a virtually continuous attempt to steal trade secrets since the beginning of this century. The bitter war of words has already seen the US name several Chinese army officers who it says it aims to arrest for cyber theft. And this week, the US extended that campaign with several actual arrests. 6 Chinese nationals, including Hao Zhang and Wai Pang, 2 professors from Tianjin University who had formerly worked in the US, have been arrested for economic espionage. Jinping Cheng, yet another professor from Tianjin University working for an ROFS Microsystem, a Chinese government-backed mobile phone system concern, was also amongst the 6. 2 former students and a general manager of ROFS Microsystem have also been arrested and are facing 32 charges that could culminatively see them facing up to 50 years in a US prison. Peter, it sounds really serious. What’s behind all this?

Speaker B: Well, the, the Chinese have been engaged in, I suppose, what is considered to be systematic economic espionage since actually probably the beginning of this century. Many people are claiming that the Chinese are actually stealing entire industries, and in fact, according to some of the people who have been investigating this, they see They tell me that they’ve seen entire production plants, entire companies actually built, and that you can actually see them built to the blueprints, even down to rubbish that has actually been left in the bays to get rid of rubbish from. So it’s a very, very big issue as far as the Chinese are concerned and as far as the UK is concerned. And if you actually want to put this into perspective, it It is— if you had another country bombing your industry, then that would be seen as an act of war, whereas what we’re seeing is almost like a ticking time bomb going on that is essentially breaking up industries that we’ve been relying on. So it’s a big issue for governments, but they don’t really know how to handle it.

Speaker C: Neither would I. Finally, researchers at Bristol University are developing handheld robots and short power tools that can learn from you and help you to do the job you want want to do. From drills to saws and, uh, sex toys, the possibilities are endless, and so will be the opportunities for science fiction writers. Though the children’s writers seem to have got there first. I mean, I can distinctly remember Bob the Builder having tools and trucks he could talk to. Back to you, Peter.

Speaker B: Thanks, Dolores. Yeah, and, um, also, I mean, one of the other things that’s been going on, the LA Times have revealed details of this, that the US is dismantling the surveillance network that everybody’s been banging on about forever, the basis of the Snowden revelations. And the reason for that is because the mandate for it is running out. They have until June to get a new mandate for that piece of legislation that means that it’s a legal thing for the intelligence agencies to do. And the big The problem for them with all of this is if that doesn’t happen, then the whole thing starts to unravel. There was a judgment that was made within the last month or so which said that the US intelligence agencies were not doing something that was legal, and that’s opened the doorway for many, many other bits of legislation that can challenge all of this. Now, it’s often said that children are ahead of us in technology, but what that can often mean is that they have developed their own world out of the technology and fashion fads that have been targeted at them. And what that means in the new internet age is that they will adopt a technology without necessarily knowing what it means. Take Facebook, for example. Is it a social media company or an organization that sells information on what you do to other companies? How do companies that provide you with services for nothing achieve huge market capitalizations? There’s a rat in my attic and I’m giving it food for nothing, only it’s either poisoned or there is trap on the other end of it. The same is true for the internet. If it’s free, you are not the customer. With that in mind, the Information Commissioner’s Office has launched a campaign to try and force transparency on companies targeting their technology at children. The ICO’s aim is to make sure that both children and parents know what they’re getting themselves into. Here’s the ICO’s Adam Stevens explaining why the UK Information Commissioner has become part of a global initiative to consider the privacy concerns of children.

Speaker E: OK, so this is a piece of work that we’ve coordinated through the Global Privacy Enforcement Network. So that’s a group of global data protection authorities, in this case 29 authorities, who all share the same common goals and interests. So we decided to look at children’s mobile phone apps and children’s websites, both those popular with children and used by children, to basically see the personal data they’re collecting, see how that’s used, but more importantly, see how the information is relayed to children and to parents around how that personal data is collected and used.

Speaker B: Okay, so that evidently means, because you’ve embarked on this exercise, that you have some concerns about this.

Speaker E: Oh, well, I think children are more connected now than ever before, and obviously they use smartphones, tablets, and the internet constantly. So I think it was an area that globally, unanimously, data protection authorities thought it was something that we need to understand a bit better and we need to really look into. So I think there is, of course, a lot of information connected— collected out there in relation to children. So we felt we should have a full understanding of how that works and what information is out there so we can then decide next steps in terms of whether we need to support app developers, support website operators,, or ultimately whether we need to take enforcement action to make sure that organisations are going in the right direction.

Speaker B: Well, that was Adam Stevens, team manager of the Information Commissioner’s Intelligence Hub. And as a mark of how serious this is, one of the things that children actually are very, very keen on doing is finding workarounds to their computer games. It was revealed last week that some 31 companies in apps on the Android platform had actually put together apps that were deliberately targeted at stealing children’s information. Now, some parents already take an interest in what their children do online and use technology to do that, an extension of the surveillance culture that we are all slowly drifting into. The only problem with this is that technology is a double-edged sword and is simply a solution creating a problem, as the parents using mSpy recently found out when the application was hacked. Spilling the personal information of the children being remotely monitored onto hacking websites. Here’s Kevin Epstein, the vice president of security company Proofpoint, to tell us more about it.

Speaker F: So the company is known as mSpy, that’s their app, and basically what their app would do is keep track of what was going on on the mobile device, and then the person using that monitoring information, which for the sake of argument, let’s say it’s a child and a parent, the parent would then be able to log in online and, you know, pull up the records of their child’s texting and photos and all that. And unfortunately, it looks like hackers accessed all of that information as well as billing records and made it available in hacker forums. So that’s clearly a problem.

Speaker D: Yeah, sure. And when you say made it available in hacker forums, what sort of things then could the hackers done with that sort of information?

Speaker F: So it’s unclear at this point whether anyone has done anything yet. The usual, you know, what happens to it is identity theft, right? So stepping back from the child aspect for a moment, there are various legitimate reasons one And you can imagine various family members having this on to keep— imagine an elderly relative or whatever, make sure they’re not being preyed upon and so forth. But ironically enough, again, in this case, it was a situation where both the people being monitored and the people paying to do the monitoring, all of their information is exposed. So for the people being monitored, that could include their location, their, again, texts they sent, emails they sent, pictures they took with their mobile device, etc. And with the people doing the, you know, paying for the monitoring to happen, let’s say the parents in this case, their credit card information, billing information, all of that stuff. So usually this type of information would be used either to conduct direct credit card fraud or to create Fake identities.

Speaker B: Now, such data spills might seem inconsequential, but if they result in some personal information about you being posted on websites, you might take things more seriously. Indeed, you might take it even more seriously if the information being posted about you is inaccurate, false, or defamatory— something that, according to Dinah Shiloh, an expert in defamation for the lawyers Mishcon di Reya, is happening more and more. Facebook and LinkedIn may be promoting an airbrushed view of us, but some people, it would seem, are intent on pushing out completely different views of us.

Speaker G: Yes, the European Court basically, I mean, they didn’t go off on a kind of frolic of their own. Someone went to them and said, look, it was a Spanish man, and you probably know the details of it. He said, I am just an individual who is finding that their data is being processed by Google improperly. And he said, every time someone Googles my name, and it inevitably is Google because that’s what 90% of people use, they find this information about me which was the fact that 20-odd years ago my house was auctioned off to cover some debts. And that’s the first thing that people find out about me and it’s really affecting my life. And he went to the European Court because he kept appealing to Google to take it down and they said no. De-index me, he said. Of course it wouldn’t have been removed from, it wouldn’t be forgotten, because it would still be available on the newspaper’s website. If you actually knew this man’s name and knew it had been published in the newspaper, you’d still be able to find it. But what the European Court did that was so revolutionary was say a year ago, actually this is someone’s data that’s being processed. And you Google, your defense that you are just a wall is not good enough. It’s data. You’re processing it and you’re responsible for it. And if someone’s saying they don’t want you to put it up, if they don’t want you to index it, then you should listen to them. And as a result of that, that kind of opened the floodgates for lots of people to apply to say, Google, please take down and de-index my information. That doesn’t mean, as I say, that the original information disappears. So it’s not really a right to be forgotten. I think that’s a really misleading term because, as you say, it can be still seen on Google.com. It can still be seen on the original websites. So it hasn’t gone completely.

Speaker D: I mean, there is an issue here, isn’t there? You know, I mean, one of the problems is that people want to know whether people have actually got some former record of misdemeanors. And Oxford’s Professor Victor Muller-Schönberg has very eloquently argued that if you’re a prisoner and you’ve served your sentence, that should be it.

Speaker B: What do you think?

Speaker G: Well, I think in this country, I’m sure there’s a different but similar legislation in all the other European countries.. We have our own rules and one of them is called, for example, the Rehabilitation of Offenders Act 1974. And that says that following a specified period of time, if you’ve had, for example, if you had some kind of conviction for something, it should be spent. It kind of is wiped from your record and it’s clean. I don’t think that includes things like sex offenders. It does mean though that people, you know, there’s a concept that’s been a very well thought out line that judges have ruled on and how, you know, it’s a statute here, so the House of Commons has decided, people have thought about it and debated it, and the law has decided, you know, this is the right way to go, that if someone has some kind of minor conviction, it should be spent after a while. And I think that’s right. It means that, giving the example of the Spanish man who had to go to the European Court to try to pursue this, it shouldn’t be the first thing that people find out about you. It’s disproportionate. I mean, I know you do, and I always do, Google people. Everyone does it. We all want to find out information about people, and you look at the first page, you look at the first few hits, don’t you? If that’s one of the first things that comes up about you, isn’t it a disproportionate way of looking at that person’s life and everything that’s happened to them? If what you find out is that 20 years ago they had a, you know, they had to auction their house to pay off some debt, it’s not right, is it?

Speaker B: Well, what do you think? Is it right? That was Dinah Shiloh of the lawyers Mishcon de Reya. That the issue is beginning to climb up the agenda is clear, as EU proposals to introduce penalties for online defamation that can include sentences of up to 6 years are now being debated. And in fact, they’re actually being opposed by journalists who say that they will inevitably be used by powerful people to prevent journalists from doing things and saying things about them. And thus gagging rules will be introduced. However, the issue as ever is that there is a yin and yang on the internet, and that yin and yang is: do you want defamation or do you want press freedom? The beginnings of this appreciation that the internet and the technology world that it is spawning is not quite the brave new world of innocence and bliss that we once thought of it was it thought it was, is now reaching everywhere. And in fact, the debate about what we want to see on the internet is beginning to pick up speed. Even now we are finding out that places we once thought too banal to talk about, such as a sewage system and water systems, have now become battlegrounds. Here is Fred Royan, an expert on water networks for Frost Sullivan, to tell us more.—

Speaker D: which is more towards a smart grid that we highlighted in the water network market. So what are the— I mean, obviously everybody’s talking about smart this, smart that, smart cities. How far are we towards developing that water industry smart grid, and what are the obstacles?

Speaker H: How far we are, I would say significantly. I think the main reason being utilities are relatively conservative and very regulated. So they are pretty much— their hands are strapped up. So even though they have the intention or the ambition to pursue a smart water grid solution, they are kind of restrained to a certain extent.

Speaker B: But having said that,[No speech] The file seems to have thrown a wobbler. Essentially what’s happening is that the water network loses some 40% of water through the network itself. The only way to prevent that and to make the water, make water, which many of us see as a human right, is to actually put more intelligence into the network so that we know where the water is being lost from. The problem for the water companies is that they will have to raise the revenue to do that and to put all of those sensors into the network. Because the industry is regulated, there is a lot of reticence amongst the general public to pay for something that it considers to be a human right. As a result of that, what we’re seeing is a huge range of technology companies seeing the water network as a potentially extremely lucrative opportunity. That means that they will suggest introducing large amounts of technology into the water network with And that water technology will be paid for as a return on investment from the water companies on what they’ve actually achieved. The problem with that is it’s all very, very wonderful in principle. It means that we will have intelligence on all of the water pumping systems. It means that we will have intelligence within the pipes themselves. It means that we will also have intelligence within systems called programmable logic controllers, which are the foolproof heart of the entire system. All very, very, very good. But inevitably, what it will mean is that there will be problems by— with the security of the network because it will have been put online. That means that if you wanted to do the unspeakable, which would be to turn off the water network, then you could do. And there have been examples already of people attacking water networks. The most celebrated was in Australia some 15 years ago, where a disgruntled employee of the water network flushed large amounts of waste into the desert and attempted to poison large amounts of the desert. While that may seem to have been an isolated incident, many other examples have been found very recently of intelligence agencies or of hacking organizations attempting to steal the settings on the parts of these networks which are known as the critical national infrastructure. The, um, reason for them wanting to do that is, as General Keith Alexander recently pointed out, that the A terrorist organization could wreak havoc and panic by attacking a critical national infrastructure. The critical national infrastructure is not just water. It is transport networks. It is electricity networks. It is telecommunication networks. In fact, it is everything that makes our lives run. Now, What that can actually mean is very, very cogently put out, explained now by the F-Secure security expert Sean Sullivan.

Speaker I: Yeah, I think that was the case when we were looking at the malware that had the vendors for the industrial control system devices that had their software trojanized, and so there were different customers of those companies who had installed trojanized version— trojanized installers into their networks. And so these were like regular sort of companies, but I’m sure everybody then realized, okay, the purpose of this malware was to map out industrial control systems within different organizations. So, you know, whether it was— whether or not it was critical infrastructure, it must be very unnerving for the governments in those European countries to know that there’s some entity mapping everything out. And it— then in the real world, if you’re talking about like, should we apply sanctions, you know, with a tough stance, probably weakens your stance.

Speaker B: So there you go. That’s the position. You have a network that could be vulnerable. Are we going to go ahead and actually introduce the the, these networks. Well, Fred Royan from Frost Sullivan seems to have got back online.

Speaker D: Let’s see what his thoughts are on this. There is, however, to use an expression that is a bit of a cliché now, and I’ve heard it so many times this week, there is an elephant in the room about all of this, isn’t there? Because obviously the thing that you need for what you’re talking about is very good information. You need to get good information out of the networks to be able to respond in an extremely efficient way. You have an aging programmable logic chip network. One of the, the issues, if you open these networks up even more, is security. There will become umpteen different ways to sabotage this network. We’ve seen several times attacks on water networks already, and they’ve become extremely sensitive in terms of computer security.

Speaker H: Absolutely. I mean, security is a key issue, and that’s an area as well which was highlighted at the recent conference. We had a person from Waterfall, and, you know, he was explaining the exact things you were mentioning, the sensitivity, especially for critical infrastructure like water treatment, especially, and the need for IT security. So I think that’s something which will also parallelly need to be undertaken by utilities as they embark on this smart water journey.

Speaker D: I mean, doubly so given that General Keith Alexander, the former head of the National Security Agency, has only warned in the last 2 weeks that he thinks that the critical national infrastructure will be a target for fundamentalist terrorists..

Speaker H: And the water would seem to be one of the key areas that you could go for with that. Yeah, it’s rather unfortunate. It’s just the times that we live in. But it is a soft target. You know, but I think that’s one thing which utilities need to make sure as they embark, as I said. It’s not just making sure that they have a smart water grid to improve the efficiencies, but also to make sure that, you know, it’s not prone for, um, terrorist attacks.

Speaker B: Well, according to the experts, disruption to water supply is one of the two things that can cause instant public disorder and panic, which is why it would seem to make some sense to keep that particular network separate from the rest. It would also seem to make a lot of sense for the politicians and the legislators to actually start to say that if we are going to make the water grid smart then it would be a very, very good idea to make sure that there was some very, very, very good security in there. Now, one of the other topics that has been exercising people this week is robots. A year or so ago, there was a debate at the Royal Institute of International Affairs on whether we should call a halt to robot armies. This week there have been calls for the introduction of ethics into robots and whether it is actually the right thing to allow robot armies to fight between themselves, particularly given that people might get in the way. The issue here is what are the rights of people in a roboticised world? Now, that’s a debate that has gone on and on and on. For many years. The essential issue has been led by Professor Cummings from MIT, who is a former US Navy fighter pilot. Professor Cummings believes this is a timely and necessary debate because she claims that there is a worrying level of technological illiteracy Protest movements against drones, she says, are misguided and claims that most people just don’t get it. The real invasion is done by ourselves to ourselves by carrying around with us a mobile phone or a tablet that’s connected to the internet and also unintentionally to the authorities. The debate is not about robots and robot armies. The debate is actually about the pervasion of technology into our lives. One of the issues that was debated in Chatham House was whether people could turn, could turn roboticised vehicles into weapons. This again is something that everybody will have to think about. The rollout of Google’s driverless car might seem to be a very, very, very good idea, but one of the issues is that it’s been connected to the world of the internet and big data. A discussion is going on in private at the moment about whether you could extract information from the big data network about individuals so that in the event of a robot car needing to have a crash, that it could select the individual to run into based on their value to society. So, given that you could be a patient facing a terminal illness, that you’ve been selected by a robot car to crash into might not actually make you feel particularly good about life. And it could be seen as really another element of how unfair the world had become. But these are all issues that have to be dealt with. With if we are going to enter into this world. Similarly, we have to think about the fact that there are algorithms that control all of these entities, and there are no ethics in all of those. Still, that’s a conversation that we will have next week. You’re listening to Password on Resonance FM with me, Peter Warren, and If you’ve just tuned in, you’ve missed it.

Speaker A: Resonance 104.4 FM. This program has been brought to you by Resonance 104.4 FM. If you liked what you heard and want to support our work, please make a donation at fundraiser.resonance.fm.