text:
HomeNewsNews detail
FIFA 23 Beginner's Guide for Getting Started
FIFA 23 has finally released. The much awaited game has, as expected, a plethora of content to dive into. This will be EA's final game in the FIFA game series. Although, with EA Sports FC, things will start once again. In this article, we will be discussing a slew of tips for FIFA 23 game contents. This will be the ultimate guide for FIFA 23 Beginners, so make sure you read everything in this article.
Given the amount of content packed into the game, FIFA 23 should keep players interested until the next instalment, which will be the first to be sold under the new EA Sports FC label. There will also be several updates before then, including a special World Cup game mode that will be available as free DLC. This guide will cover every aspect of the game, from the best players to the formations as well as specific game modes.
For the experienced campaigners, players who have experience with the previous versions of the game modes such as FIFA Ultimate Team, you might have to start all over again. Although, given that you are somewhat familiar with the gameplay, you will have the chance to do better than most of the new players and try not to repeat the mistakes which you made when you were just a beginner.
With the knowledge that experienced players posses, it would be easy for them to start well and win matches, also level up faster and achieve success for a much greater time as compared to the beginners. Keep reading to know what this game offers and whether you know it all that well or not.
Enough about the experienced players, now let's talk about what to do if you are a beginner. The answer is simple, follow our FIFA 23 Beginner's Guide for Getting Started and other article in FIFA 23 series. This article will help you understand the gameplay and prepare you for the ultimate test that you will face in the game. Your club, your team, the tactics you use, how you use them, the combination you play with, everything matters and you will be incharge of these things. So, we advise that you scroll down and read complete article, so that you won't miss anything.
Getting Started with FIFA 23
When you launch the game, you will be asked to sign-up/sign in in order to save the FIFA 23 game progress on the cloud server. So, it is mandatory to have an internet connection while login into the game. Only after you have sign-in you can play the game. There is no requirement to stay connected to the internet while playing the game.
Selecting the Language
When you start with the game, a screen will appear asking you to select a language out of several options. This language will decide the language of the in-game content. It will be based on the region in which you have purchased the game. There is a timer on the screen. After 10 seconds, if you have not chosen a language till now, the default language would be selected as your game language. Our advise would be to select your favourite language as this might affect the language of game's commentary. Although it can be changed later in game settings as well.
Opening Trainings and Matches
You will be offered with a narrative mode just before entering the FIFA 23 title screen. This is a narrative option within the game that includes training drills, a match, and a fresh new Training Centre. Following that, you will be offered the option of playing as either a male or female character. You can simply skip the scenes and leave the Training Centre. However, we urge that you do not skip it. Knowing the tale, playing matches, and conducting exercises will only help you comprehend the gameplay a little more. You will have a better understanding of the controls.
Following the training and tutorials, you will be prompted to choose the difficulty level. The difficulty level will be determined by default depending on your experience, however it may be modified afterwards via game settings.
Selecting your favourite team or club
Before the game, you must choose a club or team to represent as your favourite. Your selection will be displayed on your EA Sports Football Club profile. You will also be asked if you want to receive emails from EA and whether you want to share your account information.
You can agree to EA sending an email with information about your account, including your email address, country, age, and EASFC activity, to clubs, leagues, and organisations such as FIFA, UEFA, the league organisation of your choice (for example, The FA for the Premier League), and the club of your choice (for example, Manchester United). You can opt out of sharing by clicking "No." By checking the box, you agree that EA and the aforementioned organisations may receive information about your account. You will also be emailed to confirm the sharing.
When you're finished, a welcome window displays, displaying the incentives you've earned for joining up. The welcome page may offer you a variety of bonuses and awards. These awards might be depending on your past XP level from earlier versions of the game. You must use the same account you used for the previous editions of the game to do so. FUT packs and EA FCC might be among the prizes. You may obtain them later in the game or via the game's menu.
After the initial rewards comes the Title screen with various tabs. Title screen indicates that you have entered the main menu of the game. There will be tabs and several options available from which you can choose the different game modes that the game provides.
There are four choices you can make:
Volta - the Volta game mode.
Last Played Mode - The most recent game mode you have played is called Last Played Mode.
More Useful/Promotional Option - A small tab that displays a few promotional alternatives or gaming supports.
Promo Tab - An option that displays a promotional event or products.
All of the game modes in FIFA 23 — Practice Arena, Skill Games, Tournaments, Kick off, UEFA Champions League, Career Mode, FUT, and Volta — are accessible through this menu.
FIFA ULTIMATE TEAM or FUT
The FIFA Ultimate Team, or FUT, is a game mode in FIFA that lets you construct and manage your own club to play online and offline matches and win rewards using any FIFA 23 players and managers, as well as a collection of other types of cards including club objects, staff, and consumables. You may gain better players and things by participating in matches and games in the Ultimate Team mode, which will increase the budget and strength of your club.
How to get items for FUT?
In FUT, cards are available for all players, managers, staff, club products, and consumables. These card objects can be obtained as prizes by playing FUT games, unlocked by opening FUT packs, and purchased and sold in the Transfer Market, a section of the FUT online market. You must use FIFA Coins or FIFA Points to purchase packs. You must use Coins to purchase players or any other cards from the Transfer Market. Playing FUT games and completing challenges will earn you coins. Selling your cards to other users in the Market is another way for you to make coins.
FUT is one of the most exciting modes of FIFA 23 and you would want to perform well in it. As mentioned you have to get cards by using FIFA Coins and it might take a while to collect enough coins and make a better team. But with our website you can do it very quickly. You can buy FIFA Coins directly from our website.
Visit our website MMOPixel to purchase FIFA Coins. We offer the cheapest rate and best service on the web.
If you are a beginner, then FUT could prove to be challenging for you. It is surely the most challenging game mode in FIFA 23. Our adivse would be to start off slowly and learn as much as you can through team vs AI games. Diving directly into the tough Competition of online matches wouldn't be easier. You need to have experience before going into the online multiplayer mode. Though the challenge is tough but FUT is quite generous when it comes to rewards. All you need is right guidance and tactics to assemble the Ultimate Team.
Apart from the exciting FUT mode there are various other game modes available in FIFA 23. There is a Career mode where you will be incharge of management side of the game, World Cup mode, and Online Season matches along with Volta modes and others which were discussed already in this article.
This will be all from us in this article. FIFA 23 has been released recently and there are many more aspects of the game which would be revealed later. We will make sure to keep you updated with our articles. FIFA 23 is an exhilarating game with breathtaking graphics. Football lovers are surely going to enjoy it a lot. We will make sure to help you as much as we can. Stay tuned with us and make sure you don't miss anything.
FIFA 23 Beginner's GuideFIFA 23 TipsFIFA 23 Guide
FIFA 23 Career Mode Challenges Guide
We all like taking on challenging tasks in Career Mode, especially when they take us to exotic locations and introduce us to celebrities we've never really heard of.
FIFA 23 Wonderkids - Best Young Players in Career Mode
There is no better joy than seeing your FIFA 23 Wonderkids squad achieve greatness and reach their full potential over several fruitful Career Mode seasons.
FIFA 23 Youth Academy Guide
Young players are frequently overlooked in FIFA 23's manager career mode, but if you know how to look for them in the game's Youth Academy, you can find hidden gems.
FIFA 23 Arsenal Career Mode Guide
This guide will provide you with all the tips and tricks you need to succeed in your Arsenal career mode. Make the most out of your Arsenal career mode experience and build a team that will be the envy of the football world.
News comment
NBA 2K23 Best Overall Teams List
Best Race for Hunter WoW - Play with the Right Hunter Race!
ByMia .|November 2, 2022
Torchlight: Infinite Best Class Guide
BySumant|November 7, 2022
New World Best PvP Builds
ByHimanshu|December 18, 2022
Torchlight Infinite Gemma Build Guide
ByHimanshu|November 28, 2022
Madden NFL 23 Best QB Build for Face of the Franchise
New World GuideNew WorldFFXIV GilLost Ark Final Fantasy XIV Guidebuy ffxiv gilcheap ffxiv gilNew World coinsFinal Fantasy XIVESO Gold


Learning to love yourself is hard. We know you can't just read an inspiring quote or see an influencer in a bikini to find peace with your insecurities. It takes intention and practice. We talked with sytlist, Elizabeth Elias about some of the issues she sees with body image and fashion and how to find more LOVE now.
Join our Love It to Lose It program starting January 7th. Click here to learn more!


Apple Rewards Event is the PUP that uses misleading techniques to prevent removal. Use Reimage to locate malicious components and get rid of them faster than with uninstall instructions. A full system scan blocks virus reappearance and prevents traffic to malicious domains.
Apple Rewards Event is a fake notification which belongs to the hoax or rogue survey scams. It offers Apple users a possibility to win valuable prizes. It is said to be a "thank you" for the loyalty and offer to spin the wheel to find out what gift you might be able to win. However, no prize stands behind Apple Rewards Event scam. These notifications are not caused by your device, browser or the website's publisher. They are triggered by potentially unwanted programs (PUPs) or adware type programs filled with spammy ads.
Removal options An easy way to disable Apple Rewards Event notifications is to run a scan with Reimage. Another way is to eliminate it manually using the instructions given below this article.
The Apple Rewards Event virus can hijack Safari, Google Chrome, Mozilla Firefox, Edge, or any other web browser. Nevertheless, clearing browser cache and restarting the browser won't help to get rid of them. To remove Apple Rewards Event pop-up completely, you have to detect what PUP is causing it and eliminate it right away.
We would like to thank you for your loyalty to Apple – so we offer you the chance to win a special product.
The pop-up locks the screen completely. There's only one option – to click the OK button and proceed with the prize giveaway offer. The page you are redirected to later should contain a short survey consisting of several simple questions related to Apple, Bill Gates or similar. After filling the survey, you will be offered to spin the wheel to find out whether you won iPhone, MacBook, iPad or any other Apple product.
Participating in the Apple Rewards Event survey poses a risk of identity theft or money loss. Scammers who own this pop-up can sell personal information on the black market. However, most frequently they seek to subscribe various services on behalf of your name. Consequently, you may notice an additional fee included in your monthly telephone bill.
Apple Rewards Event survey scam tricks PC users into revealing sensitive data. It can also display intrusive ads and track web browsing activities.
Apart from collecting some pieces of personal information, Apple Rewards Event virus can monitor your web browsing activities and transmit Search Data to its partners. You can also notice an excessive amount of pop-up ads, random text turning into hyperlinks, banner ads, and another type of intrusive content.
To clean up your web browser from unwanted content, you should remove Apple Rewards Event adware from your PC. You can do that automatically with the help of a professional security tool (recommended) or manually by following the instructions given at the end of this article.
Ad-supported web browser extensions and search sites that hijack web browsers can be distributed via hacked websites or infected ads. Nevertheless, the most frequently used distribution strategy is known as "bundling." It is inseparable from freeware and shareware. The scheme of this method is simple: freeware developers gain profit for spreading add-ons, toolbars, and extensions as "optional downloads" of their products.
That's why it's a must to monitor freeware installation from beginning to the end. Opt for Advanced or Custom installation method all the time and look for the window that promotes "useful" tools. Remove ticks saying that you agree to install them and only then click Next.
Apple Rewards Event scam cannot spy on you or harm your PC directly. However, it uses social engineering strategies to trick people into disclosing their details by themselves or installing other unwanted programs without being aware of that.
Due to these reasons, you should not postpone Apple Rewards Event removal. You can get rid of it manually by clearing up unwanted programs and resetting your web browser.
However, avirus.hu along with a group of other cybersecurity experts highly recommend eliminating it automatically using a professional anti-malware tool. It's an easier and more reliable way to fix abnormal PC's behavior.
Here, look for Apple Rewards Event or any other recently installed suspicious programs.
Wait until you see Applications folder and look for Apple Rewards Event or any other suspicious programs on it. Now right click on every of such entries and select Move to Trash.
When in the new window, check Delete personal settings and select Reset again to complete Apple Rewards Event removal.
Once these steps are finished, Apple Rewards Event should be removed from your Microsoft Edge browser.
Here, select Apple Rewards Event and other questionable plugins. Click Remove to delete these entries.
Now you will see Reset Firefox to its default state message with Reset Firefox button. Click this button for several times and complete Apple Rewards Event removal.
Here, select Apple Rewards Event and other malicious plugins and select trash icon to delete these entries.
Click Reset to confirm this action and complete Apple Rewards Event removal.
Here, select Extensions and look for Apple Rewards Event or other suspicious entries. Click on the Uninstall button to get rid each of them.
Now you will see a detailed dialog window filled with reset options. All of those options are usually checked, but you can specify which of them you want to reset. Click the Reset button to complete Apple Rewards Event removal process.
^ Jim Wang. How to tell if a survey company is a scam or legit. Wallet Hack. Advertising tips and tricks.
^ Joe Lazauskas. Article or Ad? When It Comes to Native Advertising, No One Knows. The Content Strategist.
This entry was posted on 2018-03-15 at 11:39 and is filed under Adware, Viruses.
You can quickly scan the QR code with your mobile device and have Apple Rewards Event manual removal instructions right in your pocket.
How did you remove Apple Rewards Event?


text:
How Can Introverts Tap into Their Inner Power and Thrive at Work?
It's been said that we currently live in an extroverted society, and from this introvert's perspective, that seems pretty accurate! But although it may feel like you need to be (or act like) an extrovert to excel in school, work, and life generally, introverts are actually powerful and valuable. Indeed, introverts have unique skills that set them up to succeed and excel at work. So how can we tap into that inner power? We asked Nicole Burgess, an introvert who is committed to helping other introverts in the workplace. She shares her tips in our new podcast.
Do you want to make your introversion work better for you? Watch our interview with Nicole Burgess below:
Nicole Burgess offers empowerment and leadership coaching for introverted and highly sensitive women. She has a master's degree in counseling psychology, is a certified leadership coach and a licensed marriage and family therapist, and she founded the Self-Care Summit to Improve Your Bottom Line and Your Personal Life. Nicole also hosts the podcast, Soulfilled Sisterhood.
She first reveals how introverts differ from extroverts at work and in leadership positions. Both personality types come with their own strengths and weakness, preferred working styles, and unique communication styles. However different, they both have merit, and as long as people are flexible and understanding, we can all work well with each other.
Does fear play into how introverts perform at work and in leadership roles? It's true that fear tends to be a component of shyness, but what about introversion? Nicole talks about the impact of fear and how to overcome it in professional settings.
We mentioned before that introverts may feel like they must pretend to be extroverts in order to succeed. However, trying to behave like an extrovert can actually be counterproductive, causing introverts to burn out. So if that's not a great option, how can introverts perform well and be leaders in ways that work for them? Nicole describes what leadership looks like for an introvert.
We then turn out attention to highly sensitive people (HSPs). How does introversion relate to being highly sensitive, at work and in life more generally? How can you determine whether you're a highly sensitive person? Nicole offers a valuable run-through in our podcast; you can also find out if you're an HSP with the quiz here.
Our conversation ends with some final tips and words of encouragement on how you can play to your strengths as an introvert in the workplace.
Listen to our discussion about introverts with Nicole below!
You can learn about Nicole Burgess and pursue empowerment and leadership coaching at her official website here. You'll definitely want to listen to her Soulfilled Sisterhood podcast here, too. Nicole would also love to connect with you on Facebook, LinkedIn, and YouTube.
To find out if you're a highly sensitive person, take the quiz here.
To learn more about introversion and HSPs, consider reading the following books:
Dr. Elaine Aron – The Highly Sensitive Person: How to Thrive When the World Overwhelms You
Marti Olsen Laney, Psy D – The Introvert Advantage: How Quiet People Can Thrive in an Extrovert World
Barrie Jaeger, PhD – Making Work Work for the Highly Sensitive Person
5 Lucrative Career Paths You Never Knew Existed
The Important Work of Helping At-Risk Women
Your Story of Change: Dance with Your Past to Surge Forward
How to Write Professionally: Follow These Expert Tips
Petite2Queen
Petite2Queen is a virtual mentoring community for women who want more out of life and their careers. We are women who have been there, done that… and women who are in it with you. Our virtual mentoring series, podcasts, blogs, and more provide real-life learning, insights, and transferrable skills. Create your own amazing life!
p2q.flywheelsites.com
Highly Sensitive PeopleHSPsInner PowerinterviewintrovertedIntrovertsLeaderleadershipNicole BurgessPodcastshyWork

redpajama_set_name: RedPajamaCommonCrawl


text:
Read Next:	Record Intl. Growth Sees Netflix Beat Q4 Earnings Forecast
October 14, 2019 10:47PM PT
Help Wanted: Amazon Studios International Execs Talk European Expansion
By Cynthia Littleton
Business Editor @Variety_Cynthia	FOLLOW
Cynthia's Most Recent Stories
Drew Barrymore Hopes to Bring 'Humor and Heart' to Daytime TV
Netflix's Ted Sarandos Talks Oscars, Losing 'Friends' and Their New Appetite for Animated Films
CREDIT: Courtesy of Mipcom
If there's a perfect example of Amazon Studios' strategy with its local-language international TV content, Japan's "Documental" would be it.
The series revolves around 10 comedians who battle to make one another laugh in an elimination-style competition. James Farrell, Amazon Studios' head of international originals, said it was a good example of an unconventional idea from a local market that took off. "Documental" ranks high among Amazon Prime Video's most-watched shows in Japan.
"It was just so crazy, we took a flier on it," Farrell said Monday during his keynote address with Georgia Brown, Amazon Studios' head of European originals, on the opening day of the Mipcom confab in Cannes, which runs through Thursday. "It's one of our top shows there."
Amazon's headlong charge into vernacular production in big territories in Europe, Asia and elsewhere was underscored when Farrell and Brown turned their keynote address into a "help wanted" ad for scripted creative executives in Italy and Spain. They went so far as to flash their own email addresses and those of other Amazon executives in the call for job candidates, to the delight of the Mipcom crowd at the Palais.
"We're hiring if anyone is interested," Brown told moderator Peter White, international co-editor of Deadline. "It's a fantastic job. Feel free to email me."
Amazon at present has platforms and budding infrastructure in about 20 major countries. The international outposts of Amazon get about five to 10 shots a year at original series content so they have to be selective and strategic about what they greenlight, Farrell said. "It's not a quantity play. It's a quality play," he said.
The big five markets outside the U.S. for Amazon are the U.K., Germany, Spain, Italy and France. Farrell and Brown said they look for "white space" in each region's content mix where they can insert distinctive twists on familiar formats, like documentary series and reality shows as well as scripted series.
Brown made a point of disputing the myth that algorithms and data drive programming decisions at digital streaming platforms. She said it's as much about going with your gut and realizing that an Amazon show has to be utterly unique if it hopes to compete with well-established traditional networks.
"People talk about 'Oh, where's your Big Red Button of data,' and that's just not how we work," said Brown, who joined Amazon in 2017 from production and distribution powerhouse Fremantle.
The recent success of Phoebe Waller-Bridge's "Fleabag" and other Amazon co-productions in Britain has been a sea change for the U.K. TV industry, Brown and Farrell observed. "Fleabag" and "A Very British Scandal" proved that well-made contemporary content with a British accent travels well, in addition to the period dramas of the Victorian and Edwardian eras.
"The key for co-productions in the U.K. is that we're looking for shows that absolutely have their beating heart in the U.K. and in their DNA feel very British because we know we've got a great customer base for those shows around the world," Brown said.
Farrell noted that it's not just the Brit-TV productions that gain traction in far-flung markets. "'The Marvelous Mrs. Maisel' is our most pirated show in China," he noted. "We're past the point of asking, 'Are we going to make this a global show, are we going to make it a local show?' Now it's just 'Let's make it great.'"
Georgia Brown
James Farrell
Deborah Dugan's ouster from the top job at the Recording Academy, just ten days before the Grammy Awards, was a shock to nearly everyone not directly involved in the decision. But according to multiple sources and the bombshell complaint her attorneys filed on Tuesday, she and the Academy establishment were working at cross purposes almost [...]
The prosecution laid out its rape case against Harvey Weinstein on Wednesday morning, spelling out the allegations in detail for the first time. In her opening argument, Assistant District Attorney Meghan Hast also described the testimony of three "prior bad acts" witnesses. Such testimony was critical in the prosecution of comedian Bill Cosby, and it [...]
Harvey Weinstein's Defense Focuses on Emails in Bid to Discredit Accusers
Harvey Weinstein's defense attorney showed jurors friendly emails between their client and his accusers in an opening statement on Wednesday, arguing that the accusers are trying to "have it both ways." Attorney Damon Cheronis asked the jury to rely on their "God-given New York City common sense," and to find that the women had consensual [...]
Listen: Mark Cuban Is Bullish on AI, 5G, TikTok and ... Movie Theaters!?
As a serial entrepreneur with a taste for tech, Mark Cuban has built a multibillion-dollar career by trusting his well-developed instincts. So when he says it's time to pay attention to any particular innovation, it's best to listen up. On the latest episode of the "Strictly Business" podcast, recorded at CES earlier this month in [...]
Harvey Weinstein Was a 'Predator and a Rapist,' D.A. Tells Jurors
A prosecutor told jurors on Wednesday that Harvey Weinstein wielded his immense power in Hollywood to rape vulnerable young women and then to keep them silent. Assistant District Attorney Meghan Hast gave jurors a vivid recounting of multiple sexual assaults, including the story of Jessica Mann, a witness who has not previously been identified. She [...]
CAA Hires TV Agent Ryan Tracey (EXCLUSIVE)
Creative Artists Agency (CAA) has hired Ryan Tracey as an agent in the television department, Variety has learned exclusively. Tracey comes to CAA from UTA, where he had most recently served as head of TV Production. He has represented an numerous television producers during his career, including Aida Rodgers, Kathy Ciric, Anna Dokoza, Ellen Kuras, Mark Winemaker, [...]


Sven Johann: Welcome to a new conversation about software engineering. Actually, today it's not really software engineering, it's privacy or security in an insecure age. I'm sitting here with Susan Landau. Susan Landau is a cybersecurity expert; she works for the Tufts University and is a visiting professor at the University College London. She testified at Congress, writes for the Washington Post, Scientific American, is frequently on NPR and BBC; she has been a senior staff privacy analyst at Google, and a distinguished engineer at Sun Microsystems.
Sven Johann: I'm really happy to have you here. I was waiting for this interview a long, long time, and now we finally make it. I just want to start with a simple question... What is privacy?
Susan Landau: Privacy is many different things to many different people. Some people view it as the right to be let alone, some people view it as control of the use of one's data, some people view it as the not publication of data, some people view it as the right to be forgotten - this is something quite popular in Europe, at the moment, and trying to impose it on the rest of the world.
Susan Landau: I think of it mostly as the control of use of one's data. Largely, I think of it that way because in the modern era it's very hard to prevent the collection, and what you really want to do is prevent the bad effects of the collection. But of course, that does mean that certain things like harm to one's reputation can happen even if you're controlling use.
Sven Johann: Okay. We will dig deeper on the collection of data. What is security?
Susan Landau: Security is protecting against the taking of one's data. One way to think about the distinction is to think for a moment about a particular company, and it could be Facebook, it could be Google, it could be LinkedIn. Google is a particularly useful example because it's an example that everybody knows, and it has extremely good security. Google's business model is that they take the information from users, that users supply, and then they do things with it to improve services for the users. But in order to do that, they have to have trust of the users.
Susan Landau: Beginning probably earlier than 2010, but certainly in 2010, Google really improved its security process. They know that users won't trust the company with their data, if Google security isn't good. So that's security - protecting attacks of your data from the outside. But on the other hand, Google takes the data and then does various things with it. It serves you ads - some people enjoy the ads, some people like the ads a great deal less, some people try to use Google services without being signed in; it's sometimes a much less good experience... But the point is there is a clear distinction between privacy and security right there. The protection of your data against outside attackers is security, but the use of Google of the data is in many people's minds an attack on their own privacy, even though they've supplied the data to Google.
Sven Johann: In Europe, we have a discussion on corporate surveillance, that Facebook, Google and others -- there are many business models which rely on collecting data. I myself am a little bit scared what happens to my data if an attacker gets it. Do you think I can trust Google, Facebook and all those companies that they don't do any harm?
Susan Landau: Again, it depends on what you mean by trust. For one thing, of course, if your data is being held by a third-party, then other people may have access to it, for example law enforcement or national security may have access to it under a court order... You may choose that "No, I don't want to share my data in that case." I for example am much more comfortable using a cloud service that, of course, like most cloud services, stores my data in the cloud encrypted, but the difference with most cloud services is that this particular one does not hold the key. So if I lose the key, if I lose my copy (or copies) of the key, then I have no way of getting my data back. I can look at it, but it's all encrypted, it doesn't do me any good.
Susan Landau: When you talk about trust, it really depends on what your threat model is. For many of us, the threat model is we don't really care who has the data, as long as it's not criminals, and then a company like Google or Facebook, because they rely on user trust, really go to strong lengths to protect the data. For others, maybe it's a human rights worker, maybe it's a journalist concerned that governments might try to access the data under court orders in their country, that the journalist or human rights worker feels are inappropriate, then they would choose not to use those services. Maybe they don't want to leave tracks of whom they've communicated with, or tracks of what was actually said. So it all depends on what you're protecting against.
Sven Johann: I'm just wondering, why is it important that not everybody - especially governments - can know what we are doing? With Facebook, Google, all these sensors on a mobile phone, you can create perfect profiles of a person, which the governments... I mean, governments sell that as a good thing, because they can protect us from the evil.
Susan Landau: It depends how you define evil, and I'll go back to the 1950's to 1970's in the United States, which are examples that I know quite well, and I'll describe two different sets of examples. One is in the 1950's and 1960's in the United States we had a very active civil rights movement because, of course, black Americans were being prevented from voting, they were being prevented from seating at lunch counters, and so on. It was a very active segregation, but segregation by law, and prevention of their rights by law or by efforts; when they would go to register to vote, they would be tested on things that white Americans were not tested on.
Susan Landau: So there were groups active in changing this in the United States in the 1950's and 1960's, and one of them was the National Association for the Advancement of Color People. In the state of Alabama there was a requirement that any organization active in this state had to register its membership with the state. Well, that was very dangerous in Alabama if you were trying to register black Americans to vote or to exercise other civil rights... So the NAACP fought that, and the case went all the way to the Supreme Court, which said that our amendments that protect individual rights, the Bill of Rights in the U.S. are applicable to the state governments as well, under what we call the 14th Amendment. So the state of Alabama couldn't require that information. Freedom of association was protected. That was one set of things.
Susan Landau: We discovered in the 1970's as a result of the Watergate break-in that in fact the Army and other American military institutions, including the NSA, had been collecting information about Americans that many Americans felt they weren't legally entitled to. There was a committee in the Congress, in the Senate, called the Church Commission, that investigated these at depth... And there were many changes put it about when the NSA, for example, could collect against Americans. That became part of the Foreign Intelligence Surveillance Act.
Susan Landau: So we built in those legal protections, but what we've discovered recently - and this has been the press in the United States - is that the FBI has decided that black activists are a real threat, and they are collecting against black activists who are involved in peaceful demonstrations... Not violent demonstrations, peaceful demonstrations. There were arrests during the inauguration of Americans protesting Trump's inauguration that the American Civil Liberties Union is fighting, because it appears that the arrests happened for -- the people were not protesting violently. So now, when you think about all that data collection, you can understand why at a time that may be two years ago we didn't think that the government was collecting against us in the United States; there were reasons to say "Well, there's information that I would wanna protect, like who I'm communicating with, that our phones are in the same area", and so on.
Susan Landau: That's very well said, and I want to go back to the Church Committee, which had a very trenchant observation... It said that when a government collects against its people, what it does is it silences the people in the middle. The people on the extremes are still willing to demonstrate, to speak, to write, but the people in the middle, who are the ones who seek compromise and help move the society forward, rather than having radical outbreaks - the people in the middle get silenced if there is collection against them. They're afraid of losing their homes, they're afraid of losing schooling capabilities, they're afraid of harm to their children, and they fall silent, and that's very unhealthy for a democracy.
Susan Landau: Sure. So let me actually answer the Snowden disclosures first, because I think that there was a lot more heat than there should have been, and there were also places where the NSA was clearly doing things wrong... Two of them, to my mind, was that there was a secret interpretation of the law that allowed bulk collection of communications metadata in the United States, and when you have a secret interpretation of a law, then you have a secret law, which has no place in a democracy.
Susan Landau: The other thing that happened that came out in September of 2013 is that the NSA had - and I wanna put "interfered" in quotes - "interfered" with the process for recommending a cryptographic algorithm. It was one that had encouraged the National Institute of Standards and Technology to issue as a recommendation for picking random numbers, Dual EC DRBG, and it seems that the NSA had a back-door into this algorithm, so that it could actually predict what the random numbers were, and those random number were used to generate keys.
Susan Landau: On the other hand, the fact that you had a U.S. Signals Intelligence Agency collecting broadly across the world - that's what Signals Intelligence agencies do, and so I think there was a lot made of that, but some of the objections were more about protectionism that they were about anger about the actual collection of data. Some of the complaints that I've heard in France and in Germany - it turned out that the French government and the German government were actually handing data over at the same time that they were complaining.
Sven Johann: Yes, exactly. That made a lot of people really mad, that the German government doesn't -- that they actually cooperate with international security agencies and do not protect our data.
Susan Landau: One of the things I have to say - and I've many times complained about certain NSA activities, but one of the things I have to say is that the U.S. has a more transparent view of what's happening about collection, that is the Foreign Intelligence Surveillance Act... Parts of what's called USSID 18 about signals intelligence collection abroad, various processes are more public, certain details are not... Certain details of the process and policy are not; I'm not even talking about methods of collection. But the U.S. has been more transparent, and I think that's a very good thing, and a great thing for other countries to adopt, as well.
Sven Johann: How did that happen? Were they forced to be more transparent?
Susan Landau: So a part of it was the Church Committee hearings of the 1970's showed, for example, that the NSA had been collecting copies of all telegrams coming into the United States, from the 1940's on; there were other types of collections by the Army, and so on. When these things happened, we had the Foreign Intelligence Surveillance Act, which had certain requirements... NSA embarked on a process of education of its own people, and following the law -- now, they may go right up to the edge the law, but following the law became very important. There was a change in the early 2000's after the September 11th attacks, and that's when President Bush ordered bulk metadata collection, and there were various methods under which it was done... That is various legal methods under which it was done. But as I said, that was a secret interpretation of the law, so I don't want to say that everything is perfect; it's not perfect. Then as technology changes, it's sometimes hard to know how to interpret the law.
Sven Johann: Yes, of course. I mean, if you say it's the job of intelligence agencies to do that, right...? That means even if there is a law, they maybe break it... I remember a conference -- I do remember the country, it wasn't Germany, but there was a representative from a cyber crime division of the country and he said "Please work for us, because if you work for us, you are allowed to break the law. It's just our job to break the law."
Susan Landau: It's not the job of the United States of Law Enforcement to break the law; if you have to bring a case in court and you've broken the law, in most cases the case gets thrown out.
Susan Landau: So it may be that what the person was saying - and it's hard to know, because I wasn't there to ask - is that maybe the warrant allows you to circumvent a different law... For example the Computer Fraud and Abuse Act, which prevents against breaking into other people's systems, except for law enforcement, and there is a specific exemption for law enforcement, which is appropriate, but that doesn't mean law enforcement doesn't need a search warrant; of course it does.
Susan Landau: I certainly don't want to live in a country that doesn't have a rule of law.
Sven Johann: Now that I know it's the work of an intelligence agency to bulk collect all kinds of data, how can I protect myself, that I'm not too open about what I'm doing?
Susan Landau: The question I always have when I'm thinking about my own security protections - and while I'm originally trained as a geek, I'm not a security geek; I'm trained as a theoretical computer scientist, so I can understand the mathematical algorithms better than I can think about system configuration... The thing that I always think about is "What's my threat model? Who is it that might detect me, and what resources might they bring to bear?" For a long time I didn't use Tor, for example. Then I was teaching a class on privacy, and I decided I wanted the students to use Tor. Tor anonymizes a web connection; it does it through using public key cryptography and a series of servers that have the Tor software on it.
Sven Johann: So maybe if you use Tor - you have to use a certain Tor browser, I think...?
Susan Landau: You have to download software onto your device and use a Tor browser, and what it does is it encrypts three times with a public key, and then you connect to a Tor server... So the Tor server knows who you are, knows your IP address; that connects to another Tor server, which only knows that you've connected to a Tor server, but it doesn't know your IP address, it decrypts a second time. Then there's a third server which knows where you're exiting to.
Susan Landau: What happens is now if an adversary compromises the entire network, if an adversary can watch traffic over the entire network, they can say "Oh, I'm watching this traffic traverse, and I know the IP address from where it came, and I know the IP address where it exited the Tor network, so I can see." But most adversaries don't have quite that capability... So the entry point knows where you came in, the exit point knows where you're going to, but nobody else has insight into anything.
Susan Landau: The onion router (that's what Tor stands for) was developed by the Naval Research Labs in the '90s and has had many improvements since then. I wanted my students to use the Tor browser to see how usable it was, to see what problems it had and so on. I couldn't give them this assignment without actually using Tor myself, so I began using Tor more often. I feel that two-factor authentication is important, so I use two-factor authentication. So I have gone to using various of these tools, in part because I teach privacy and security and it's important for me to experience the value and the problems... But in all of this, you need to think "What's your threat model?" When I'm traveling, I won't order anything online, when I'm in a hotel, unless I use my phone as a hot spot, because I don't trust the hotels as an ISP. That's because of a criminal threat.
Sven Johann: Can you trust the phone connection?
Susan Landau: Yes, I think we can trust the phone connection. Again, what I have to worry about is am I specific target or a general target?
Sven Johann: Yes, that's true. Okay. I usually don't use the Starbucks network, or airport, or something... But somehow I trust a hotel network; I don't know why.
Susan Landau: Well, it depends what I'm doing. I'm certainly not going to sit at the hotel, at the airport Starbucks and order items. When I'm sitting in my hotel at night and thinking about my next trip, I might want to do a flight, and then I say "Okay, I'm going to do this." That's more a matter of -- it's disruptive at a Starbucks, so I don't do those kinds of things. But if I get to the point that I'm not trusting the phone network, I'm really thinking of myself as a specific target, and at that point I'm probably not doing anything online, except maybe reading the New York Times.
Sven Johann: Okay, good to know. I was a bit scared that I cannot fully trust the phone network.
Susan Landau: Well, again, I'm thinking about it in the context of U.S. law and U.S. requirements, which is what I know thoroughly.
Susan Landau: Yes, but then again, that was a specific attack. So would I do this kind of communication if I were in Russia? Absolutely not. Would I do this kind of communication if I were in Spain or Germany? Sure. I don't see the Spanish or German government as seeing me as a threat or a target.
Sven Johann: Okay. So two-factor authentication... I rarely used it, until I read your book. After like 20% of the book I enabled it everywhere.
Susan Landau: Good for you.
Sven Johann: So why does that help us?
Susan Landau: Because if you're not using two-factor authentication, if you're using just your password to connect, then somebody takes your password - you don't know that happened... It could happen one day when you're at a cafe, it could happen one day when you're at home, and three weeks later your whole e-mail file is published online... Whereas if you have two-factor authentication, you're securing against a device being able to get into your account. The point is that when somebody takes your phone, you know about it.
Susan Landau: Now, if it's a very sophisticated attack, if it's a government-enabled attack where they take your phone, they knock you down, you're completely unconscious, you're in the hospital, they take everything - that's a different kind of threat. I'm not talking about people facing those kinds of threats. They, of course, have to do much fancier things to protect themselves. But if you're the head of personnel of a hospital, if you're the head of security at a company, then two-factor authentication -- if you're in fact even at a low level, two-factor authentication is very important.
Susan Landau: For example, what happened in the Ukraine in 2015 is that six months before three power distribution companies were attacked in December 2015, six months before hackers got into the business network, and from the business network accessed the power distribution network. So maybe the business network needed two-factor authentication; maybe, or maybe not. I would tend to do it everywhere... But certainly, the power distribution network of each of the three companies needed second-factor authentication.
Susan Landau: What you have there is once the hackers were in, they were able to figure out all sorts of things about the three different power distribution companies worked, and then able to shut all three of them down within a half hour of each other. Two-factor authentication would have prevented that from happening.
Sven Johann: Okay, so it's a good advice for all kinds of companies to protect mails, all kinds of logins to sensitive company data, with a two-factor authentication?
Susan Landau: And if you're sure that the company does not have -- if you're convinced that the sensitive parts of the company are kept really separate from the non-sensitive parts of the company, then maybe you can get away with passwords. But if there are connections - and there are always connections; nobody maps out everything completely... If there are connections to the sensitive parts of the company, then you want two-factor authentication.
Sven Johann: Good. Let's switch the topics... Maybe it's not a big switch, but I was just wondering about wiretapping in the backdoors. What is wiretapping?
Susan Landau: Wiretapping is simply the ability to listen into an electronic communication. Of course, if you put a bug into a phone receiver - for those of us who remember what phone receivers look like - that is wiretapping, but it's accomplished through an electronic bug, because it's a physical bug placed in. Wiretapping can happen at the device; you can place a wiretap through software on a smartphone, you can wire-tap through the phone switch, you can wire-tap in many different places.
Susan Landau: Backdoor is the idea that if somebody tries to encrypt a communication end-to-end, so that you and I talking on the phone - the conversation is decrypted on my phone, it's decrypted on your phone, but anybody else listening in hears an encrypted communication; a backdoor is a way of being able to get into that communication, even though it's encrypted for anybody else.
Susan Landau: If you're end-to-end encrypted and a wiretap is not on your device, if you have an encryption system where you and I have exchanged the key and it's a strong encryption system, then if the wiretap is not on one of the end points, there's nothing they can do. All they get is noise.
Susan Landau: But it had been previously the case, before all of us carried computers with us - we call them smartphones - that there were many places along the path to put a wiretap in. The most common place was at what was called the phone central station. If you have a wire line phone, there's a wire that goes from your house to an office within a couple of miles, a few kilometers, and the phone lines come in in order, 5129-5130-5131, and the wiretap was put right there, where the communication would be in clear text and then move on.
Susan Landau: You can do a similar thing at a cell tower, because phone communications are encrypted between you and the cell tower.
Susan Landau: Back about 25 years ago there was a big fight in the United States and in other places about the whole idea of encrypted communications, and law enforcement wanted to backdoor. One of the ways this was prevented from happening was that in 2000, for a number of reasons, the United States government changed its control on exports of encryption. It had been the case that if U.S. companies wanted to sell communication or computer devices abroad with encryption in it, they needed an export license. This was slow, and very hard to get, and if the device had strong encryption, you might be told "Well, we're still working on the export license. Well, we're still working on the export license...", and by the third time you heard that, if you're in Silicon Valley, you say "Forget it", and you put in weak encryption, and you sell the device.
Susan Landau: Now, that was for selling it abroad, but if you're a company in the United States and you're trying to sell things abroad, you don't want to say "We're selling you weak encryption. We have strong encryption for communication for devices we sell in the United States, so you have weak encryption everywhere."
Susan Landau: Kuwait, right. When Iraq invaded Kuwait, the U.S. put together an ad-hoc military coalition, and these are partners that maybe the U.S. doesn't want to share its secure communications techniques; it's countries that maybe won't be its friends in three years, so being able to buy commercial, off-the-shelf equipment is very useful... Commercial, off-the-shelf equipment that has strong encryption. This was one of many reasons of the growth of internet, and e-commerce was another. So the U.S. substantially loosened its export controls, and we expected to see lots of devices with strong encryption. It took another 8-10 years before that happened in commercial devices, and during this time the FBI was unhappy, but became quite unhappy beginning in the late 2000's, early 2010's, and began talking about going dark... And it knew that backdoors was no longer an approved term; it was something that people thought was really yookie and so it said "We want frontdoors", and then it said "We want exceptional access. We get access only when we have a court order. Only when there's a legal authorization to come in, and otherwise the encryption is really strong.
Susan Landau: Then they changed the term to "responsible encryption", but all of it is the same thing - it's a way of getting in even when the device is encrypted.
Sven Johann: So just a nicer term for backdoor.
Susan Landau: Well, I would say it's actually what we call 1984 speak; it's double speak... Because what they're calling "responsible encryption" I would call "irresponsible security."
Sven Johann: Why is backdoor problematic? You could think, "Well, you know, if there is a backdoor and only (I don't know) the FBI or whoever has the key to open the backdoor, what could go wrong...?"
Susan Landau: Right, but I am talking at a broadcast where people are actually scientists and engineers, so point one - when you build complexity in, things break down. Point two - and some of this is due to a paper I did with a dozen other colleagues (15 other colleagues) called Keys Under Doormats... Point two is that it breaks all types of security protections we've come up with. One is called Forward Secrecy, which is the idea that each communication carries with it its own key. That means if an adversary has been scooping up communication over a long time, then if it wants to break the communications, it has the job of breaking it for each key, as opposed to breaking it once... And that's a very important security protection.
Susan Landau: Another security protection it breaks is authentication encryption. One of the things we've learned over time is it's not the mathematics that breaks encryption, and it's not the protocols that usually break an encryption; most often it's the implementations, far and away. Sometimes it's the protocols, and very occasionally it's the mathematics... But it's really implementation, protocol, mathematics, in that order, with orders of magnitudes difference between them.
Susan Landau: If you think about authenticated encryption, when we talk electronically, as opposed to you and I facing in person, there's this whole business of authenticating. When you do it over the telephone, often you can recognize the person's voice, although as we get better on all sorts of electronic imitations, that may disappear as well... But you authenticate the person's voice. But what happens when you get an e-mail? Well, you'd like a way to authenticate that it really is coming from you, as opposed to somebody else. As we heard earlier today in Richard Clayton's talk, you want to know that the piece of mail coming from the company that you're buying coal from, if it tells you to switch banks, you wanna know that it's really coming from the company you're buying the coal from, and not from some other company.
Susan Landau: So what we did is we put together the idea of authentication and encryption in one step. We called it authenticated encryption, and use the same key for both. Well, if you take the idea of backdoors or exceptional access or responsible encryption, you have to separate the authentication step from the encryption step, because the law enforcement will allow authentication, but it doesn't want the confidentiality in the same way... Once you create that separation, you've gotten back to "We have more complexity, more likelihood for error."
Sven Johann: I think that's an important sentence that I want to repeat - more complexity, more error.
Susan Landau: Every software engineer knows this... Every software engineer knows it.
Susan Landau: So maybe what you're telling me is we should take all the policy folks at the FBI who are arguing for this and put them through a course in software engineering and the problem would go away. I've never thought about that solution, but maybe that's it. There's also the issue of who would hold the keys. Who would hold the keys?
Susan Landau: I take my phone, I travel from the U.S. to Germany for a conference, last week I went to Canada... Does my phone stop working when I go to Germany because only U.S. law enforcement has access to the keys? Or are we going to have a really fast multilateral legal authorization treaty in which as soon as German police decide they need to get into my phone, they get an immediate response from the U.S.? That's not going to happen as a matter of policy. Does that mean that I need a different system for traveling in Germany, a different system for traveling in the U.K., let alone in other parts of the world? That complexity is also unreasonable.
Sven Johann: Is that the reason why there are no backdoors implemented?
Susan Landau: Well, there are plenty of backdoors implemented. When you work at a financial firm in the United States there's a requirement that your conversations are taped, and anytime you call a financial firm, a stockbroker and so on, it says "This conversation is being recorded."
Sven Johann: But is the communication itself encrypted?
Susan Landau: Well, it's recorded at the broker's end. So you're speaking to the broker, the broker understands you in English, it's speaking to you back in English, and that English conversation at the broker's end (at the endpoint) is recorded. Financial institutions are one place where this is a requirement. Various companies where you work - if you're working for a defense company - it will say that your communications are open to the company, and they will have software on the device and so on to enable that, and that's part of their security model. But that's different from everybody's devices being recorded in that way.
Sven Johann: If I have a cell phone, I don't want responsible encryption, irresponsible security. Actually, there was a case - was it the San Bernadino attack, or...?
Susan Landau: Right. There were two attackers... The San Bernadino Health Department - they killed (I believe) 14 people and injured many more; they fled, they were found by police a few hours later... They had destroyed their computers and their phones, but they'd left behind one locked iPhone, and there was an 18-minute gap where the police didn't know, based on cell phone data and so on, where the attackers had been, and they wanted to know if they'd communicated with anybody, they wanted the phone opened. Now, the "communicated with anybody" seems a bit weird, because if they communicated with anybody, it would have been picked up by the towers.
Sven Johann: So they refused because they thought it would harm their business model, or...?
Susan Landau: I'm going to be very careful here; my interpretation of why Apple refused - I'm not speaking for Apple in any way. What Apple said in court and also in the congressional hearing in which I participated - they said the government doesn't have a legal right to request this. The government was relying on a law from the 1700's about companies providing assistance in these types of cases. Apple said what the FBI was requesting went well above and beyond the type of assistance envisioned.
Susan Landau: Apple also said - and I'm not a lawyer, I'm not going to comment on the first part... But the second part, which is about security, I very much agree and support Apple. In fact, they used some of my arguments in the briefs to the court - they say it creates a security problem. The FBI originally had been saying they had a single phone that they wanted updated in this way; once they went to Congress, they said "Well, we actually have another eleven or dozen", and then the state of New York said that they had several hundred, and by now the law enforcement has several thousand, I think it's up to about several thousand.
Susan Landau: Right. They have to be individualized for the phone... Not in terms of new software, but they have to be specific to a phone so that they don't get used and sent somewhere else. So now you have a lawyer and an engineer looking at each phone as they come in, the lawyer looks at the legal contract, the engineer makes sure it's the right phone, that it hasn't been tampered with in any way, and they apply this update.
Susan Landau: The problem is you've now introduced - when you have several thousand over a year and a half's time of collection - many more people to the process of doing an update... And we all know in security the more people you have in such a situation, the less likely that you can keep the security of the update system safe.
Susan Landau: Yes, but here you're introducing people, which is a completely new variable that's complicated.
Susan Landau: Well, you already do the updates individualized to a phone, and that's partially because they want to be sure that when they are getting a request for an update, that they are updating the phone correctly, and not rolling back and giving a previous update.
Susan Landau: That's right, because you want to make sure that you're doing it to the right phone when you're doing this insecurity update; it's not a security update, it's an insecurity update... So that's why you have the people involved, but the people create the risk. And now you think about the risk that gets created in the update process. When I think about the best things that we've done for security over the last decade or so, to me the most important one is automatic updates.
Sven Johann: The best one...?
Susan Landau: Yes, automatic updates.
Sven Johann: I think it's totally interesting, I also think "Automatic updates - totally cool", but security departments of companies I work for as a consultant, they say "We don't want to have automatic updates."
Susan Landau: Because it breaks systems. On the other hand, their job should be to figure out how to deal with the update quickly, and maybe we need better communication between the providers of systems like Apple and Windows and so on, better earlier communication that says "This is what this update is going to do. We're not quite ready to roll it out, but here are the things you should be aware of, so that you can update your systems." But yes, automatic updates, especially for consumers, are critically important.
Susan Landau: If you get to the point where automatic updates are not trusted because maybe somebody has corrupted the Apple update system one time, or maybe people are worried that they're going to be snooped on, then we're moving very badly backwards in security at a time when we cannot afford to do so.
Sven Johann: Okay. Talking about end-to-end encryption, I was really surprised when I read in your book that a positive example of end-to-end encryption is WhatsApp. In Germany, WhatsApp and Facebook are seen very critically; I know people who don't use WhatsApp because they say "I don't trust it. I don't want to give my data to Facebook." Why do you make a positive case out of WhatsApp?
Susan Landau: Sure. So to my regret, I didn't use WhatsApp before Facebook bought it, because now in order to use WhatsApp, I have to register at Facebook, and I don't have a Facebook account.
Sven Johann: But I used WhatsApp for a long time, and I didn't register at Facebook; I don't use Facebook.
Sven Johann: Signal is a similar software, like WhatsApp.
Susan Landau: Yes. They use the same algorithm, with one distinct difference. To communicate securely, you have to do a one-time out-of-band communication, in which the two users, Alice and Bob, exchange a piece of information, to assure themselves there's no man in the middle. If Bob goes and gets a new SIM card, if Bob gets a new phone, they have to do that one-time exchange of information again.When Alice sends a message to Bob and Bob has updated in some way, Signal requires that they do this one-time exchange before the message is received. WhatsApp doesn't. So that's less secure. That's the one difference. But WhatsApp has a billion users, Signal doesn't. WhatsApp was working for convenience, and for almost all their users, that's the right choice. They're providing end-to-end encryption in a convenient way, which really matters to their users. Signal is providing end-to-end encryption for users who care more about security than they care about convenience, so Signal made a different choice.
Susan Landau: So we have now three different things you're asking about - there's the difference between Signal and WhatsApp, and there's the difference between WhatsApp and Facebook. One can communicate via WhatsApp and not share other information with Facebook, and then your communication is end-to-end encrypted. And the only thing you've done if you get a WhatsApp account now is that you've shared a little bit of information with Facebook, and perhaps they know how much you used the WhatsApp application, but aside from that, they don't have other data.
Susan Landau: That's right. It's the same algorithm as Signal, it's just that they made a choice about convenience, which for their user body is probably the appropriate choice.
Sven Johann: Okay. But still, Facebook and attackers of all sorts, governments - they know the metadata of conversations... What are metadata?
Susan Landau: Sure. Communications metadata, if you go back to phones, the phones that sat on your grandmother's hallway table, those big, black phones with a real, physical bell inside - they would say that a phone call occurred between this number and that number at this time, and lasted this many minutes. Phones didn't move back until sometime in the '90s. That was very useful for trying to establish, for example, that two criminals had talked to each other just before they went out and committed a robbery, or they talked to each other and then you notice that one of them charged Nitric Acid they bought for a bomb, and then they talk to each other and the other one went out and bought fuses for the bomb, and so on. That was very useful.
Susan Landau: As people began using cell phones and smartphones, the metadata became much richer, because now you knew not that this phone line called that phone line, but you know that this individual call that individual; few people share cell phones. You might share it with your wife, I might share it with my husband when we're out hiking and I didn't bring my phone, but typically a cell phone is tied to an individual.
Susan Landau: They know where you are, and so on... So it's very rich for evidential purposes. That's a situation where the data that previously the two people on the phone knew they had talked to each other, but the phone company only knew which phone number talked to which phone number. Now we're in a completely different situation. I talk to you on the phone - I know I'm talking to you, and the phone company knows I'm talking to you, but the phone company knows where I am and where you are, whereas I might tell you I'm in New York when actually I'm in Berlin and I don't wanna tell you because I don't have time to see you, and I'm embarrassed, and all of that.
Susan Landau: So the phone company knows more about certain things than you and I do, and it's a real transfer of richness of information. But that evidentiary value of being able to track a person is really important for law enforcement and it's really important for national security, and very heavily used by both.
Sven Johann: You say it's important... Is there any risk to society or individuals?
Susan Landau: Sure, so what you want to do - this is a case where you really want to control the use of the data. Let me give you an example with a different kind of data, and then we can go back to phones for a second. We all use, whether it's metro cards to be on the subway, or E-ZPass or a version in Europe to go and use toll roads where we no longer pay the toll, but it's just automatically deducted from whatever account we set up, by something that reads something from your car. We all find that very convenient. It saves money, it's convenient, we use less gas because we don't have to slow down as we go through... But if a divorce lawyer proves that one part of the couple was always leaving work at four, stopping somewhere along the way at a particular time - simply by tracking the husband's route, let us say, and show that in fact there was an affair going on, that changes what the wife might collect under alimony, or whatever, or the wife may get to keep the children more of the time... All of those kinds of issues.
Susan Landau: So you want protection of that data. You want that data to only be stored for a certain amount of time. We never had that data before - is there a reason that that data should be kept more than a month, more than three months and so on? Under what circumstances should it be released?
Sven Johann: ...something, and they may think "Okay, we quit his contract for some made-up reason."
Susan Landau: Right. So that's again a case where you really want to control use - who gets to use that data, what are the controls on what an insurance company could do... And if you go back to the 1970's in the United States, in the 1960's banks and other financial institutions began sharing data about people who were taking loans out, and all of a sudden you had this transfer of power from the individuals who had a pretty good sense about whether or not they could pay the loan - maybe not the perfect sense, but a reasonable sense - to all of a sudden the banks knew a lot more about you than you knew about yourself... So we got the Fair Credit Reporting Act, which said "Alright, you can have these institutions that collect information about your financial situation, how many credit cards accounts you have, how high their limits are, how quickly you pay, whether you're paying interest on it and so on... You can have this data collection, but that data cannot be shared with a bank without your permission." That's the Fair Credit Reporting Act, and that's an example of the kind of thing where you put controls on use, so what you're talking about here is controls on use.
Sven Johann: And if maybe the bank requires me or asks me to hand out the data, but that's probably not -- I can sue them for that.
Susan Landau: But now, if you go back to communications metadata, if you talk about IP communications, voice over IP, there's some nice work by Fabian Monrose, Charles Wright and a few others that says if you looked at encrypted voice over IP, because we have a lot of redundancy in speech - it's just the way human beings are built - when you go to voice over IP, there's compression in the speech, and if you look at the packet length in voice over IP, that's actually very revelatory. It can reveal whether it's a man or a woman speaking, it can reveal what language they're speaking, and in some cases it can reveal the actual words that they're saying, simply by the packet length.
Susan Landau: Now, who would have thought that packet length is revelatory of content? So we all of a sudden, in this world that's much richer with metadata, have a real mess about how do we handle that data? Do we count it? Should we count location, the way we counted location back when phones didn't move, as part of communications metadata that law enforcement, at least in the United States, can get, if it's relevant to an ongoing investigation, or because it really reveals a lot about somebody? You notice that every day they come home at five from the factory, and one day they leave the factory at three, they go to a bar, they sit there till nine PM, they get home and they don't go to the factory again - you know they've been fired.
Susan Landau: So now do we treat location information as a different kind of information because it's so much richer? We have to figure that out of the societies, and we haven't gotten to that yet.
Susan Landau: Absolutely, absolutely. For example, there's a Privacy Legal Scholars Conference in the U.S., and I believe there's no one that happens in Holland, that was an outgrowth of the one in the United States. The scholars publish all these theoretical papers about what could happen if, and what could happen later, and you can certainly track certain of the privacy cases that happen in the U.S. We do law in two ways in the U.S. - Congress and state legislators pass laws, but you also have reaction to the laws or reaction to cases happening in the courts, where the courts will say "This is a violation of due process, this is a violation of rights, and the law is too loose, or the police did not act within the law", and you get changes based on that. So sometimes the academic papers influence law, sometimes they influence court cases, and that then changes how the law is interpreted or new laws are passed.
Sven Johann: Switching again a little bit - it's not actually a switch, but... So these things - we can secure ourselves, there are laws which protect us, but are there attacks we cannot prevent?
Susan Landau: Of course, of course.
Sven Johann: I think of like large-scale Stuxnet attacks or something like that.
Susan Landau: There are many kinds -- well, Stuxnet was not large-scale, it was very, very targeted.
Sven Johann: Yes, okay, okay... But nobody can prevent it.
Susan Landau: We can stop using software and hardware, and then you could prevent those kinds of attacks. Short of that, I don't think you can. The analogy that people in security like to use is that you put locks on doors to prevent the common criminal, the street criminal from breaking into your house, and as long as your lock is at least as good as everybody else on the street, or maybe a little bit better, you're in good shape.
Susan Landau: If you have a Picasso on the walls, then you don't have big plate glass windows for everybody to see the Picasso and break the window and go in and get it. If you practice reasonable security, you don't go to a Wi-Fi network at a cafe or the hotel lobby or the airport lounge and do important financial transactions. If you actually look where the mail came from, if you don't open attachments at random, then you are reasonably safe.
Susan Landau: We have become as a society however -- increasingly, we've built our society upon fragile networks, fragile systems. Five years ago I would have said "Well, we have to worry about a concerted attack against critical infrastructure", but on the other hand, an attack against critical infrastructure like the attack against Ukraine power distribution companies - that's an attack that it might take a certain amount of time to establish attribution, but you can establish that attribution with a pretty high probability of knowing who did it, and then you can attack them.
Susan Landau: We've seen in the last couple of years a real shift to going after the soft underbelly of civil society. In the case of North Korea it was pretty weird to go after some picture entertainment as a way of stopping them from showing a film that the North Korean government objected to.
Susan Landau: Of the interview.
Sven Johann: Yes, exactly. What was the movie like? I actually didn't see the movie.
Susan Landau: It got terrible reviews.
Sven Johann: What was the movie about?
Susan Landau: It mocked Kim Jong-un, the current leader of North Korea, and the North Koreans did not want the movie to be shown, and they threatened Sony Pictures Entertainment... Which for a while thought it wouldn't show the film.
Sven Johann: They threatened, or they actually did something...?
Susan Landau: Well, they did several things. First of all, they sent a threatening mail, which nobody paid attention to. Then they published e-mails, they published human resources information about individuals, they showed some of the films that Sony Pictures Entertainment had had available on their internal networks, they destroyed various machines electronically... So they did a number of bad things, and then they said "If you show the film in movie theaters despite all this, we will bomb the theaters". Now, they didn't say it as the North Korean government, they said it as a group, but it was clear who was behind this.
Susan Landau: At this point, the U.S. government and others pointed out that it's one thing to attack electronically on wires going under the Pacific or other ways, it's another thing to move actual bombs into movie theaters, and that was not a serious threat. But that was one example of going after civil society, and I think President Obama - it's hard to know exactly the reasons that he viewed it as a national security threat, but I think the idea that you can shut down speech in another nation by doing an electronic attack of this sort is a very disturbing idea.
Susan Landau: The much more disturbing attacks on civil society are the ones that we saw in France, against the Macron campaign, in the United States in our presidential election... In Germany there was the incident of the German-Russian teenager who ran away and then there was all sorts of -- and I don't even want to give it the name "false news."
Sven Johann: But the Russian teenager - it wasn't a made-up story.
Susan Landau: The French government.
Susan Landau: Would do the same thing. And in fact, in the last couple of days the British government has said that there was a concerted effort in the last couple of days before the Brexit election two years ago to influence people who are likely to vote against staying in the European Union, to vote against it... And that those ads were Russian influence.
Sven Johann: The same is going on in the U.S., right? It's not only U.K.
Susan Landau: Absolutely. We don't vote in Brexit, but yes, the same type of effort. These attacks on civil society are very scary, and the question is how you react to it, what you do. There are both computer security protections you want to do, of the sort that you increase the security of accounts, you keep certain data offline, you make certain communications ephemeral; there's no reason to keep communications.
Susan Landau: We have a tendency as a communicating species to imagine that when I speak to you, what I say may influence you, but the words drift away, because they were just said between us. But when we put them in an e-mail, they don't drift away, and we don't have a history of saying "Hah, the thing I said to you that was nasty about this third-person, and that I just said to you, and I figured you heard it and that was it - now you can prove that I said it, or somebody else can prove that I said it." We don't have those mechanisms unless we use ephemeral communications, end-to-end encryption and so on.
Susan Landau: Then there's the whole issue of how do you deal with disinformation campaigns within electronic social media that make accountability very difficult to establish.
Sven Johann: Is it possible to do something against fake news?
Susan Landau: Oh, sure, it's possible. You could do lots of things about news feeds, that would not be what Facebook wanted to do, and would involve much more people involvement. Whether you could do it legally in the United States, under the First Amendment, depends on how you view social media. There's regulation of speech in the United States on radio broadcasts and television broadcasts in the sense that political ads have to be labeled "Political ads." There hasn't been similar regulation on social media. That one is easy to do. The more complicated one is what you do about communications that are political in nature but are not political ads, and how do you label something as political speech when it's not and that becomes First Amendment issues. But we haven't even thought about Facebook or Google or other social media as falling within that regulatory framework, and it may be that that's what we need to think about, at least for pieces of what they offer.
Sven Johann: Since you worked for Google and Sun Microsystems, what can we as software developers learn in terms of security and privacy from Google, Sun and those firms.
Susan Landau: Sure. So I'm really impressed by both Sun and Google in terms of security. I still remember the weekend I was working for Sun, and we became aware of a vulnerability and I watched this conversation of our security interest mailing list as it was getting patched... It still took a day or two to roll out and process after the weekend was over, but I was watching people work all weekend, and we didn't have anything like a patch every fourth Thursday of the month or whatever it might be... We patched when we became aware there was a vulnerability. I was and remain really impressed with Sun's security Ethos.
Susan Landau: Google in 2010 got attacked by the Chinese, who took some software and did other things - I'm reporting this not as a Google employee, but as something I read in the press... And Google got very serious about security. It had been serious before, but it got much more security-serious, and I find there's security protections, whether it's Chrome, which is probably the most secure browser, or the fact that it does red teaming inside the company.
Sven Johann: Why is Chrome probably the most secure browser? What are they doing to make it more secure?
Susan Landau: Now we're getting past my expertise level, aside from sandboxing in the right ways, protecting against cross-site scripting, and so on. There are other parts to the fact that you're using Chrome, because of course, the data is shared with Google, and that's a different issue. But on the security side, Chrome appears to be the best.
Susan Landau: Absolutely. The other part is that Google does a lot of red teaming.
Susan Landau: Red teaming - using Google employees to attempt to attack Google systems to find holes in them, and then improve the protections. Google has Google Authenticator, which is a way of doing two-factor authentication. It's a piece of software you download on your device... I have two different pieces of software on my phone for two-factor authentication - Google Authenticator, which I use for a couple of sites, and Duo, which is from a company in Michigan, which I use for other sites.
Susan Landau: On privacy, the issues are somewhat less clear. First of all, Sun was never in the business of collecting consumer information, it wasn't in that business space at all. Scott McNealy famously said "You don't have any privacy, get over it."
Susan Landau: Scott McNealy, the CEO of Sun.
Susan Landau: No, it was Scott McNealy, but both his view of privacy and the company's view of privacy was in fact a great deal more nuanced... But it was in a different business than Google is. Google views good privacy as good security, and they certainly have a good security story. They do use some forms of privacy-enhancing technologies to protect user data (that includes multi-party computation) to enable Google to learn certain information in the aggregate - certain very private information about users - while not learning information about individuals.
Sven Johann: In the aggregate?
Susan Landau: Learning about who is responding to certain types of ads, and what percentage of people are responding to certain types of ads, but a group of them, not about each individual. So aggregate means learning about a group, without learning about individuals. Using other forms of differential privacy to learn things about how users are responding to URL's and to search items. I think that that's a great step in the right direction, but most of Google's response on privacy is really about security, rather than privacy per se.
Sven Johann: In terms of learning all about individual users, to me that sounds a little bit like anonymization. Is that true?
Susan Landau: Well, Google doesn't do anonymization in the sense that Google is trying to provide you with personalized service, and it's hard to anonymize if you're trying to provide personalized service. So I don't think Google is going in the direction of anonymization, although you certainly can use Google services without being a signed-in user.
Sven Johann: But can a Google employee - I'm not sure if you're allowed to answer the question, but is it possible for a Google employee to see individual...?
Susan Landau: In fact, I'm really allowed to answer that question. Absolutely not! The fastest way to get fired at Google is to try and snoop on an individual Google user, and you are out the door before you finish typing, essentially. So while I'm not allowed to comment on things I learned at Google, that particular thing I'm sure I'm allowed to comment on. That is a complete violation of Google policy.
Susan Landau: What I was going to say about anonymization is if you're trying to provide individualized service - and that's what Google is trying to provide - then you're not going to go down the path of anonymization. That's different from allowing a Google employee to snoop on what a user is doing. That's absolutely not permitted, at all, period. The end.
Sven Johann: Why I'm asking - I work with insurances, health insurances, this data is really sensitive, of course. I as a software developer need (banking is the same, but let's take healthcare) test data to work on, which can be easily shared; it should be easy not to make mistakes, and for that reason, they need to be anonymized... But somehow that seems to be a very hard problem.
Susan Landau: An important thing to do is to frame the problem right at the beginning. "What kind of data am I going to be allowed to test on?" "What kind of data do you need to have?" "This is what I need." "Can we anonymize it in this way? Would that suffice for your program?" "No, because I have these constraints." So well before the program is architected, well before you're in final coding stages, well before you're ready to deliver to the company, you have conversations about "Here's what I want to be able to test on." "Well, we want to give you this kind of data. Will it work? This is sufficiently anonymized in these ways."
Susan Landau: It's just the same way we should think about security, from the beginning. We should think about privacy from the beginning, including in terms of what kind of test data will I be able to have.
Sven Johann: Yes, if you create software architecture, of course there are those security and privacy things you have to take -- the same with reliability... So you cannot build them in afterwards, you have to think about it up-front.
Susan Landau: That's right. But your question really makes me think about how important it is to be teaching software engineers within a software engineering course the kinds of questions they should be asking about the test data that they will be receiving, and that they need to ask it early, so that there's a good dialogue and they get to the point where they're testing against reasonable data, but that's also privacy-protective with users.
Susan Landau: But if you're thinking about privacy, you have to.
Susan Landau: Thanks very much.