(bright music) - A man checks his smartwatch.
- Our modern, digital lives offer limitless
convenience, community, and easy to access everything. - [Speaker] The internet opens
unbelievable opportunities. - [Host] But there's a
trade-off. Your personal data. - [Speaker] Pretty much
everything you do on the web is being tracked and logged. - Who you are, what you're
doing, and where you're going. - This is the mothership. Can you show me what I've
inadvertently given up? And that personal data
is worth a fortune. - People expect it to
grow to $400 billion. - To completely
avoid data collection requires you to
go live in a cave. - [Host] Thankfully,
there are tools to help maintain your
privacy and security online. - Let's create some strong
and unique passwords. - Everything has
privacy settings. We can dial to whatever
level we feel comfortable. - [Host] And some coders are
rewriting the rules of the web. - The decentralized
web is our antidote to the web as we
now think of it. - New technologies
can proliferate without centralized control. - This is about technological
self-determination. - [Host] Secrets in your
data right now on "NOVA." (triumphant upbeat music) ANNOUNCER:
As an American-based supplier to the construction industry, Carlisle is committed to
developing a diverse workplace that supports
our employees' advancement into the next generation
of leaders, from the manufacturing floor
to the front office. Learn more at Carlisle.com. (phone camera clicking) PATEL:
Our world runs on data. When you're shopping online, streaming
your favorite shows... (mouse clicking) posting family pics-- that's all your personal data leaving your device. (on phone):
What's up, everyone? I'm about to head to
the hospital for a night shift... (voiceover):
I'm Alok Patel, a pediatrician, medical journalist, and all-around
social media enthusiast. (on phone):
Just got here at the
children's hospital... (voiceover):
I kinda love our
connected lives, and I haven't been shy at all about sharing mine
pretty publicly. (on phone):
30 million children... (voiceover):
And I know that sharing
personal data can have major upsides. The media's reported on some of
the most dramatic examples. NARRATOR (archival):
...is conducting several studies to see how far wearables can go
in detecting disease. A California man,
rescued yesterday after going missing
credits a social media post for helping save his life. Six out of ten people
with Alzheimer's or dementia will wander away from home, and that's where
this little box comes in. PATEL:
There's no doubt,
our data is out there, but did you ever
wonder where it goes and how it's used? I do. I want to know: what are the
benefits of sharing and the risks? And what can we do to
make our connected world safer and just generally better
for everyone? First, the basics. I want to know: how much personal data
have I been sharing? Meet Hayley Tsukayama,
tech journalist and data privacy advocate. (chuckles) PATEL:
You must be Hayley. Hi, nice to meet you. What is going on? (voiceover):
Okay, hold on,
wasn't expecting this. She's already got
my whole life up on the screen. So this is a data report
gathered about you from social media posts, from the images of you
that may be on the internet, from publicly available
information. This is like
a family business. That's my dad's
cell phone number. Why is this available? (groaning):
Oh, this is my address! This is just available? Just available online. Okay,
you guys are going to blur all this, right?
Please? There's-- oh, okay, cool,
there's my cell phone number. Oh, this is concerning. As a medical doctor, we all have
license numbers and issue dates
and expiration dates. (chuckling):
And it's literally right here. This is so weird, these are the names
of my neighbors from my childhood home. (whispering):
Why do you have
this information? Like, I haven't
seen these names in... years. (voiceover):
Not gonna lie, I expected some of
my data to be out there, but this is... this is just creepy. How is there a report about who my neighbors were
in the '80s? LEVY:
You can be assured that
pretty much everything you do on the web and with a browser is being tracked and logged. Where you go, what you look at, what apps you use. SAFIYA NOBLE:
Modern life has been arranged so that every aspect of what we do and how we live
can be captured. MEREDITH WHITTAKER:
They pick up our faces
as we walk down the street. They track our keystrokes
while we're at work on behalf of our employer. (keys clacking) GALPERIN:
And ad networks use a bunch of creepy and nefarious ways
of figuring out who you are, what you're doing,
and where you're going. PATEL:
What happened to the web
I grew up with? ♪ ♪ I came of age when the internet
was a fun and weird party, and everyone was invited. Remember GeoCities, AOL Instant Messenger, or the dancing "ooga chacka,
ooga chacka" baby? ♪ ♪ Today, it's clear
that innocence is gone. Is the party over? To understand the present,
I want a refresher on the past. (machinery whirring) So I'm visiting
the Computer History Museum in Silicon Valley. (video game music,
Patel chuckling) MARC WEBER:
Okay, I'm headed
straight for the sun... PATEL:
I'm meeting
computer historian Marc Weber. What a maneuver!
There's a straight line of bullets coming
right at you-- (exploding sound effect,
Patel groans) (voiceover):
...Who just wasted me in the cosmic battlefield of
"Space War," one of the first video games. (laughing) This is actually really fun. ♪ ♪ This is cool. ICBM computer from
a nuclear missile. Woah. Human-computer interaction. PATEL:
Now, this looks fascinating. I can't tell if this is like, this universal clock
apparatus, or what's happening here? This is the first
punch card machine. And this was an invention to make the U.S. census
faster. PATEL (voiceover):
It's kind of wild, but the dawn of automated
personal data collection looks like this-- census info poked into
humble little punch cards. Marc, can you explain
punch cards to me? Because when
I think punch cards, I'm thinking
lottery tickets, or "buy nine cups of coffee,
and your tenth is free." Well, it was the first way to
record machine-readable data. PATEL:
Okay, let's make sense
of the census. This kind of data collection has been going on
for centuries. But starting in 1890, data was recorded
in a pattern of holes "punched" into a census card. So the cards were used to
collect census data. What exact questions
were on there? So things like age, gender,
number of children. PATEL:
When a card passes through
the machine, the holes allow pins to
make electrical connections through the card. A counter keeps a running tally in each census category as more cards pass through. Census data
is how the government allocates resources
for schools and hospitals; draws the lines for districts; and decides
how many representatives each state will send to
congress. It's a reminder of the value of
collecting data, but it's a far cry from having my every move
tracked on the internet. To help connect the dots, Marc shows me
the next surprising step in the evolution
of data collection. ♪ ♪ I look at this
and I'm almost like, "Oh, this looks like a
modern office building to me." WEBER:
Exactly. Each one of those is one of these
giant terminals here. (static hissing) PATEL:
During the Cold War, IBM figured out
how to hook up computers from all across the country
to monitor U.S. airspace in real-time. (rocket blasting off) So, this is a terminal
from SAGE. (beeping, static) PATEL:
It was the first real-time
networked data system. Real-time is just that: instantaneous. And "networked" means connected. Computers from all across
the country were hooked up to each other, so they could share data
in real time, Sort of like the internet. WEBER:
The whole point was to track
incoming Soviet bombers, and they built, arguably, the first computer network
in the world. PATEL:
IBM soon realized that their
aircraft-tracking computers could be used commercially. ♪ ♪ So In 1960,
along came SABRE. (beeping, static) A real-time networked
data system that shared personal data. WEBER:
The story goes that the head of American Airlines
met with IBM, and they decided to do
a partnership, the key idea being real time. They could look at
your age, your name, financial information, what flights
you'd been on before, your dietary preferences
for your meal, all of this right then
in real time. PATEL:
We went from tracking bombs to tracking butts on planes. WEBER:
Exactly. PATEL (voiceover):
Between "Pong," punch cards, and planes... Whoa, whoa, whoa! PATEL (voiceover):
I could see how data started
connecting the world-- the military to our airspace and companies
to their customers. But what if those customers
all over the world were linked up to each other? What would we even call that? Oh yeah,
the World Wide Web. PRESENTER:
The World Wide Web
is a part of our lives and getting bigger every day. But what about the man
who dreamt it all up? PATEL:
News reports opened our eyes to this innovation
and its creator, Tim Berners-Lee. PRESENTER:
He simply wanted to give it away
for the benefit of others. TIM BERNERS-LEE:
When the web started, anybody could make a website. You could make your own style, your own poems, your own blogs, and you could link to
other people. The feeling and the sense
was of tremendous empowerment. (modem dialing up) NOBLE:
Some of us remember
the internet when it was managed
and curated by people. Where it was, you know, bulletin board systems
and chat rooms. ♪ ♪ PATEL:
In the late '90s,
small start-ups were maturing into
big tech companies-- with lots of users
and user data. KAHLE:
As the web grew, we ended up with
a very few companies going and doing
all of the hosting. It wasn't your actual
personal computer doing it. NOBLE:
The large platforms
that have emerged are dependent upon user-generated content and user engagement. The modern internet is a wholly
commercial kind of internet. PATEL:
And as web traffic started
to flow more and more through just a few companies, they began to realize the value
of all this personal data piling up on their servers. ALEKSANDRA KOROLOVA:
Google started to understand the power
of individual's data. They have information about not just how the websites are interconnected, but also information
about the individuals. HILL:
The big technology companies. They're looking at
where you are, They're wanting to know
what your gender is, what your age is, you know,
how much you have to spend, what your political beliefs are. They have a lot of power
to determine what our privacy is. RASKAR:
That's trillions of dollars of economic value
that's out there, and there's a constant struggle between who owns the data. We create the data, but somebody else monetizes it. PATEL:
As big tech was maturing, early data collection on
websites was pretty limited. So what happened
to supercharge it? To create the vast
tracking infrastructure that allowed Hayley
to find out so much about me? It turns out things
really got going when someone invented... Cookies? A cookie is not
actually a tasty snack. When you go to a website, the website sends a small file to your browser. (keys clacking) PATEL:
That small file
allows the websites to collect information
about your visit, and update it every time
you come back. You might have
heard of cookies because a lot of websites pop up with messages
prompting you to accept theirs. But what happens
after you hit "accept"? GALPERIN:
It then uses cookies to track who you are
and what you're doing, including in many cases, all of the other websites
that you go to. RUMMAN CHOWDHURY:
Cookies have the cutest name, but they're actually
a really important piece of information
about you. Every time you click on a menu, every time you look at an item or put it in your cart, every time you
want to buy something and click out of the website
and come back in. A cookie is what's
enabling you to do that. It's a piece of
tracking information. You can impute data
and information about you from the seemingly
innocent behavior online that's tracked via cookies. Do you have certain
lifestyle conditions? What age are you? What gender or race are you? Do you have children? PATEL:
Okay, so I'm starting to get that these tech companies use things like cookies
to keep track of what sites I'm on,
what I'm shopping for, and what I'm watching. ♪ ♪ (doorbell chimes) But do they have other ways of learning the secrets
in my data? To learn more, I'm tracking down
a data security expert in his hacking
high-tech superhero lair... naturally. (door rolling open) Are you Patrick Jackson?
My name's Alok. Yes, I am. Awesome,
I'm in the right place. (door rolls shut) Your phone is sending
this extra data to these people that you don't know exist. PATEL:
Patrick Jackson has been all over the news for
his work as a former NSA research scientist, and is now chief tech officer for the internet security firm
Disconnect. And if anyone can help me understand how
my personal data is leaking, it's him. Patrick,
when I think about the main control of my
work, life, play, what I'm doing at home,
when I'm on the road, this is the mothership. If I were to
relinquish control of this precious device
for a few moments, can you show me, like, what I've
inadvertently given up? Yes, yeah. I can show you what
these data companies know about you and
what they're collecting. PATEL (voiceover):
Using a hacking technique called a
"man-in-the-middle attack," Patrick can intercept
the personal data that's leaving my device, essentially eavesdropping
on a conversation between me and the websites and applications I use. JACKSON:
Contact information, name, phone number,
email address. When you agree to allow them
to have your location, I can see not only where
you're at on a map, but also where you're at
in your house, whether you're
at the back of the house or the front of the house. When you look at the data leaving the phone,
every time you open an app, you send about, maybe, 500 kilobytes of data
to their servers. That is equivalent to
about 125 pages of text that you would print
in a printer. PATEL (voiceover):
It's one thing if the apps
on my phone are collecting data, I chose to download them. But Patrick says
that other companies have even sneakier ways
to get my data. Like something as harmless as a marketing email. To demonstrate,
Patrick sends me a mock promotional email. I have an email that says "Shoe Sale." It says "open
to view the shoe sale," and I want to open it,
so I'm going to. "Hi, Alok, get ready for
upcoming shoe sale." I like this graphic,
and there's like, social media icons.
This looks legit. (voiceover):
It turns out, emails can include
a tracking pixel-- also known as
a spy or invisible pixel. JACKSON:
An invisible pixel is
a type of image you're never intended to see, but it still initiates
a handshake of data from your device
to these data companies. (keys clacking) Most of the emails
that you receive likely have these
tracking pixels in them. Most? Most. This invisible pixel
is actually disguised as the banner in that email. In other cases, the tracking
pixel will be a one-pixel, very, very tiny image that you would never see
with your eyes, and it's not meant to be seen. (zooming in) PATEL:
That little pixel,
that little spy. See it?
Right there. It can hide in images
embedded in an email, like a banner, or even an
"unsubscribe" button. And when you open the email, it contacts a tracking website
to collect data about you. It can suck up
your device model, location, and even
some browsing history. JACKSON:
This is essentially
a digital fingerprint of your device. PATEL:
No! JACKSON:
That fingerprint would
identify you as who you are, and somebody else in
the future could look at
that fingerprint, make you do
a new fingerprint, and they would know that
this is the same person. PATEL:
Companies are snatching copies
of my digital fingerprints wherever I go online. And by following that trail... JACKSON:
Companies are, over time, collecting
everything about you. That's how they
build up this, this digital profile about you. HILL:
The internet is this
data collection machine, and as we're moving
through the internet, there are these companies whose whole job is to reassemble that trail. PATEL:
So now I know how my digital
profile is out there, but why? Who really cares that I take pictures doing
handstands and own way too many
sneakers? Turns out,
there's a whole industry devoted to selling my data. It's the data brokers. ♪ ♪ Data brokers are companies
that are set up to collect information,
repackage it, and resell it or re-share it to other companies
that may want to know information about you. So what do data brokers want
with all our personal data? Why do they care that
I love chicken mole and that "Cool Runnings" is in my top five movies
of all-time? TSUKAYAMA:
They collect all this
information, and then they're really
trying to slice and dice it in ways that are
appealing to customers. You know,
it could be an employer who's doing research on you, it could be a retailer
who wants to know what kind of customers
they can target with ads. That kind of information is really valuable
for advertisers, because they want
to target advertising to a certain type of person. PATEL:
Our data ends up eventually
getting compiled into reports like these, that are then sold to... whoever's interested? TSUKAYAMA:
Data brokers are able to say, "Look,
we have a group of people "that will fit the audience
of your product. "We really are happy to serve
this list of people to you," or to make a score about
how likely they might be to purchase your product. Okay,
I know people say "Oh, your phones
aren't listening to you," but we were just talking
about retro video games, and here is an ad for home mini-arcade machines-- which looks kind of cool--
but how did it know we were just
talking about that? Is my phone listening? Is it a psychic? What's happening? People always say, "I was talking about
this product, and then I saw an ad for it. "Matt, are they listening
through my phone?" And I'm like,
"Well, they didn't hear you, they didn't listen
to anything." The truth is actually
more frightening. You talked about that thing because they influenced you into having this conversation. It's because the algorithm
took you to this place. And that's the situation
with our data. PATEL:
There have been some outlier
examples of ad tech companies
listening without consent, but that's against the law. For the most part,
advertising algorithms know you so well
that they can predict what you would find interesting. They are so good
because they've studied all the data
gathered about you-- from the data brokers. There's this kind of dossier that's being created
about you as you're wandering around
the internet, and it's being used to, you know,
decide what ad you see. PATEL:
Advertising fuels
the economics of the internet. And advertising is fueled by you, me, us-- our personal data. So how do the algorithms
actually work? You land on a webpage, and that webpage gets your I.P. address. A unique identifier is
returned to a data broker. That data broker looks up all the facts that were ever
gleaned about you. A dossier that describes you. PATEL:
And then advertisers
literally bid, they bid on you,
in a real-time auction based on the only lesson
I remember from Econ 101:
supply and demand. DOCTOROW:
The demand-side platform that the advertiser is on
says, "I have here "an 18- to 34-year-old
man-child "with an Xbox
in Southern California. "Who wants to pay to
cram something nonconsensually
into his eyeballs?" And that takes place in
a marketplace, and you have advertisers
on the other side who have standing orders. They're like,
"I want to advertise to "18- to 34-year-old man-children
in Southern California who own Xboxes," and the marketplace conducts an automated high-speed auction
where it's just like, "I'll pay so many
fractions of a cent," "I'll pay that
plus ten percent." (auction bell rings) The high bidder
gets to show you an ad. PATEL:
All of this happens
nearly instantly. And it's possible
because data brokers sort and cull personal data into super detailed
consumer groups. This is the process
that delivers relevant personalized ads for cute shoes or that new tea club-- if you're into
that sort of thing-- which all the ads
seem to know about you. TSUKAYAMA:
Here we have,
for example, Soccer Mom. PATEL:
Okay. I might be able
to identify with that. A sporting goods retailer could
then go and check out a file on what a Soccer Mom's
online activity is like. TSUKAYAMA:
What are the things that
they tend to spend money on, and do they like to save? Are there
certain times of year where they might
spend more or less? PATEL:
With all this data about
Soccer Mom's consumer habits, retailers can send personalized
ads with uncanny timing. Some people like the results--
soccer moms get deals. Advertisers keep websites
we love in business. But... some consumer categories
can be more concerning. HILL:
Sometimes they'll
have categories that are like, "This person has erectile
dysfunction, "this person
has a gambling problem. "This is a list of, kind of, people that are likely
to fall for frauds." So these can be really powerful
and damaging lists. TSUKAYAMA:
So this one, for example, diabetes. PATEL:
Wow. Okay,
healthcare demographic... The thing about that,
right, is like, when you're thinking
particularly about health data, that indicates
that you're probably in a pretty sensitive
situation. PATEL:
I'm now thinking about
all the patients I take care of. And I shudder to think at the targeted ads
that are deliberately targeting
these individuals. (keys clacking) TSUKAYAMA:
Data brokers have lists
about sexual assault victims, they have lists
about dementia sufferers. Those are some really
concerning types of categories, and you could
definitely see how an advertising company
could take advantage of people on those lists. So I think a lot of
people's first reaction on seeing these
data broker reports is like, where has
all of this come from? There are a lot of places where
data brokers get information. Most commonly apps that you download that have deals with data brokers
to share information. PATEL:
All right, I knew that apps
were getting my data, but I had no idea some were
sharing it with data brokers. How is that even legal? TSUKAYAMA:
How often have you seen
a terms and conditions screen just like this? All the time.
Anytime I download anything, basically. (both chuckle) I download apps
all the time for work, play, life,
convenience. I just scroll all the way down
and hit accept. because I'm over it. Right. And I think that's how most people feel about it. PATEL:
"By accepting these terms, you allow the platform
to freely..." "...content for demonstration,
promotion, and..." TSUKAYAMA:
Terms and conditions
are really long. Cool, I'm in a commercial and don't even know about it. TSUKAYAMA:
Carnegie Mellon once did a study
that said it would take days for somebody to get through
all of the terms and conditions. They actually
use the word exploiting. "You represent and warrant..." TSUKAYAMA:
That puts people in
a really difficult position when we're supposed
to manage our own privacy, but we're also supposed
to use all these things that are products that
will make our lives better. (papers rustling,
teacup clatters) Data brokers
are a big industry. It's about a $200 billion
industry right now. I think a lot of people
expect it to grow to, you know, $400 billion
in the next few years. NOBLE:
That level of data
from our past, all the things
we've done being used and put into systems to help predict our futures, that's unprecedented, and that's rife with the
potential for discrimination, for harm,
for exclusion. PATEL:
Okay, I know I said that I'm not the type
to log in to... (voiceover):
Look, I love being online. I like sharing what I'm up to
on social media, and I'm not afraid to
share my thoughts. Okay, bugs, I don't bite you, you don't bite me. It's that easy. But some of
this personal data is, well, personal. So, now I need to know: What can I do
to make my digital life more private and secure? GALPERIN:
Privacy and security
are not the same thing. For example, uh, Facebook is extremely interested in protecting your security. They want to make sure
that it is always you logging in to your account. They will go through
a great deal of trouble to keep your account secure. But you enter all kinds
of data into that account. You tell it
where you are located. You send it all
of your pictures. You send messages and Facebook collects
all of that data. They don't want you
to keep it private. They want you to hand it to them
so that they can use it in order to serve you targeted ads
and make them money. PATEL (voiceover):
My accounts are mostly secure when I control access to them. But that doesn't mean
the data I put in them stays private, far from it. Privacy and security
are not the same. But they are two sides
of the same coin, and I have to understand both if I'm gonna protect my personal data. MITCHELL:
When your privacy
is taken from you, your agency is taken from you. Privacy is that whisper. When you think you're whispering
to your friend, but you're shouting
in a crowded elevator, you're robbed of something. And that's why privacy
is so important. PATEL:
What can I do right now
to protect my privacy and my security? To learn tips and tools to
preserve my data on both fronts, I'm chatting with hacker
and educator Matt Mitchell and cybersecurity
expert Eva Galperin. First up: privacy. Sorry. (whispering):
Privacy. Matt is a privacy advocate at CryptoHarlem,
as in cryptography, the process of hiding
or coding information. Hey. I'm Matt. Thanks for coming
to CryptoHarlem. MITCHELL (voiceover):
CryptoHarlem is
anti-surveillance workshops for the Black community and all marginalized communities
around the world. And our mission is to develop
people's digital skills so they can actually
help us in the fight to push back on digital harms. MITCHELL:
Privacy is not secrecy. Privacy is just a door. A door in your home. There's a sense of, like, I want to control
what can be seen, what can't be seen just for me. PATEL (voiceover):
And I want to close that door. So how do I do this? Even just a little? PATEL:
Okay, what do I do to make all this safer for me? What do I do, who do I talk to,
how do I start? You have to ask yourself, "Is this a problem
that needs to be fixed?" Privacy isn't a switch. It's a dial. You get to control
how much you share with who and with what. PATEL (voiceover):
Let's start with a big one, something I use all the time,
every day, and I bet you do, too. Have you ever used
this website called Google? I've heard of it. Yeah. Well, let's check this out. Well, if we go here to myactivity.google.com... ...it'll show us all the things
that you've been doing. So for example, when we go here, we see all the different
Google services that you use. I don't think they make
a service you don't use. PATEL (voiceover):
These platforms are so deeply
embedded in many of our lives and for good reason. They make products
that can be really useful. It's hard for me to imagine going a single day
without searching the web or using a navigation app. But they also suck up
a lot of our data. It's a trade-off
that I'm comfortable making, within reason. I've used literally everything
Google has ever offered. And it knows what you've used. And it records everything
you've ever used and how you've used it. Every search term you've used, every, uh, you know,
shopping item you've used. But this is the dashboard
to delete it. PATEL (voiceover):
I didn't know this,
but I can literally just delete huge amounts of data
that Google is storing about me. And the same is true
for a lot of other services. We can dial to whatever
level we feel comfortable. For example, on LinkedIn, you would just click on me, and then you would go to
your settings and privacy. Here, when we go to
manage your activity, it tells you that, you know, you started sharing
your LinkedIn data with a permitted application. PATEL (voiceover):
Treating privacy like a dial
means it's not all or nothing. You can have your data cake
and eat it, too. Like now I'm thinking I want
to log into everything-- all my social media, my email,
my LinkedIn, everything-- regularly and look to
see who is using these. Exactly, it is about awareness. Furthermore, the companies, they know how many people
actually use the privacy controls. And by you even
peeking in it, you're saying
I believe privacy matters. At the Electronic
Frontier Foundation, Eva shows me how I can take
my privacy game to the next level... learning some
Surveillance Self-Defense. Although, apparently not
that kind of self-defense. GALPERIN:
So, the next step in
your privacy journey is fighting back against types of corporate surveillance. I-- and one of the things that websites really like
to do when, uh, is not just to track what
you are doing on their website, but to track all the other
websites that you go to. And they do this using cookies. There's some companies I trust, and I'm like, fine,
you have these cookies. They're chocolate chip.
I know where they were made. I know what
you're doing with them. But then there's
these third party companies, I don't want them
around me. You can use a
browser extension to eat these cookies, uh, and fight back against
this kind of tracking and keep those websites from
seeing where else you're going. PATEL (voiceover):
Browser extensions are
add-ons for your web browser that give it extra features
and functionality, like eating cookies. I'm imagining this, like, digital Cookie Monster
that's eating up all these pieces
of my online activity so that companies don't know
what I'm doing online. And it reduces the amount
of privacy tracking. Am I understanding that? What these
browser extensions do is they get rid of,
uh, the tracking cookies that these websites use to see all the other sites
that you're going to, which is none of their business. (knuckles crack) PATEL (voiceover):
My personal digital world
is starting to feel comfy, controlled
and a lot more private. I've learned how to close
the doors and blinds. But still, someone could
open them right back up. I could get hacked. How do I lock my doors? Time to talk about security. MITCHELL:
The tragedy of this recent pandemic teaches us that we're all
pretty vulnerable. And without that herd immunity, without that community response, you can't just say,
"I'm okay, and therefore I don't
have to worry about this." This is the first time
that I've ever heard someone compare data privacy to epidemiology
and herd immunity. All you need is one person
to make a mistake and it's game over. That's what happens to so many
other corporations, businesses, even hospitals during
a ransomware attack that'll freeze all machines
and stop them from working until someone pays
a bunch of hackers. My one error could
compromise the security of my entire institution. MITCHELL:
Human beings will make mistakes. Folks won't wash
their hands sometimes, right? But we try to teach best
practices to prevent the worst. Okay, Matt, you have
my wheels spinning. I do not want
to be patient zero in this, like, massive
infectious data leak. What can I do to start
pulling it back and better protecting
my information? Well, I got something
for that, okay? Oh, you have, like,
a bag of tricks. I've got a bag. I thought you were just gonna
say, like, change your password. We got to go all the way. This is a privacy screen. And this will keep
people from being able to look over your shoulder. Shoulder surfers beware. Can't look through that. This is for like,
using my computer in a public space,
the airplane. Everywhere. This is a Faraday bag. You got to keep
your phone in here. This blocks RF signals. It's basically aluminum foil... PATEL (voiceover):
Yo, Matt? Can we slow this down
a little bit? You can't get hacked when
you're not attached to anything. Is this really necessary,
a Faraday bag? PATEL (voiceover):
Okay, this looks a little more
complicated than I expected. I guess I just have to become
Dr. 007. We also have a Wi-Fi pineapple. This is a portable access point. And we also could
use it to detect and stop access points
from going bad. PATEL (voiceover):
Okay, Matt,
now you've just gone rogue. MITCHELL:
Let's say you
have a hard drive with some important
files from work in it. What happens if you lose it? Someone can plug that
in and have access to all your stuff. Not if it's an
encrypted hard drive. I understand-- There's more. How do you know that
you're not being bugged? This is nuts. This is something
I could use to find out if there is a
audio bug in the room. (beeping) I can find Wi-Fi signals... (device beeps) Oops, something's here,
right? PATEL (voiceover):
Honestly, I thought being
a spy would be more fun. But I'm starting
to feel shaken, not stirred. How am I supposed to keep track
of all this stuff? I'm no hacker genius like Matt. What if I just left all
of this behind and just quit. Goodbye, digital world. (clock ticking) (yawning) Do you know if there's
breaking news? (cat meows) Look in my eyes and tell me. What are we doing here? What are we doing? Like, I don't even know how many steps I've taken today. Because my step counter
is not on my hand. I'm technically disconnected,
this isn't cheating, but can someone tell me
what the Suns score is? CREW MEMBER:
Uh, down by 11 at the half. (groans) (cat purring) Oh, I am supposed to
pick up my daughter. How long do
I have to do this for? (voiceover):
All right,
maybe it's not that easy. But there's got to be
some middle ground between Inspector Gadget
and Fred Flintstone that's right for me. Instead of going completely
off the grid, I'm checking back in with Eva for some more surveillance
self-defense. And the best place to start is
with the basics: passwords. I'll be honest, my current password is basically a combination of my first pet's name
plus my birthday or a favorite
video game or song. I don't think any hacker's
really gonna guess that. But you're telling me that there
is still a vulnerability there. Yes. Hackers can go
find out information about you from data brokers, including, you know, the name
of the street you grew up on or the city where
you went to college. So you wouldn't want a password
like the name of your pet. Or password123. Well, I did have a pet fish,
and his name was Password123. So, I guess that
kind of, like, hits both boxes and
makes me more vulnerable. Let's start by, uh, creating
some strong and unique passwords for all of your, uh,
your different accounts. And that will make them
much more hacker-proof. I'm all ears. Fantastic. Well, we're going to start
by rolling these five dice. GALPERIN (voiceover):
There are easy ways
to create passwords that are long and strong and easy to remember that
are not based on information that attackers
can easily find about you. And the way that we do that
is we use word lists and dice. The word list is essentially
just a long list of dictionary words
with numbers attached. So what we're going
to do is we're going to write down the
numbers on this dice. 45263, my new lucky numbers. Okay. And now we are
going to look up 45263 in this book. So there are words that
correlate to the numbers that I just randomly rolled. Yes. Okay. I want a cool
word like "tiger." The word is
"presoak." "Presoak?" "Presoak." 34115. "Henna." Okay, I like this. PATEL (voiceover):
The idea behind this dice game is that
it's both random and long. Hackers using fast,
powerful computers and sophisticated
password-cracking software are able to try many,
many passwords a second. A recent study
by a security firm showed that a seven-character
password can be cracked in just a few seconds. But a 12-character password with uppercase letters
and symbols is much more difficult to break. Studies show
it could take hackers well over 100 years to crack. That's safe. But also more difficult
to type or remember. Eva's six-word random passphrase is easier to remember than a
random string of 12 characters and practically
impossible to break. "Stinging." "Ignition." Six is "Clutch." "Clutch," okay. "Presoak Henna Stinging
Ignition Clutch Handbrake." (bell dings) Fantastic. Now you have a passphrase. These six words. It is long. It's unique. It's difficult to guess. And it's relatively
easy to remember, considering how long it is. It is a very good way of
creating random passwords, but a lot of password managers
will automatically do this for you. PATEL (voiceover):
Once you have a passphrase,
you can use this to unlock a password manager
that generates strong random passwords
and stores them securely. Now I have this beautiful
random password or passphrase, but what happens
if someone steals this? Is it just game over,
efforts are gone? No, it is not. Uh, that leads us to the
next step on your surveillance self-defense journey, and that
is two-factor authentication. PATEL (voiceover):
This may sound
like a hacker ninja term, but it's just
an added layer of security, requiring an additional method
of confirming your identity. Most of the time,
it's just a simple text message. GALPERIN:
Because it requires that you have two things in order to log
into your account. You will need both your password
and also this code, so the site
will send you a text message. There is also
an authenticator app. The site will ask you to take
a photo of and then go to the site in a QR code. The best way to be
a security superhero is to find the stuff
that works for you and implement it
as sort of smoothly and seamlessly as you can. PATEL (voiceover):
These data self-defense
tweaks are great for me and my own data. But what about everyone else? I'm wondering, is there a way
for all of us to share data and get all the sweet benefits, without sacrificing
privacy and security? At M.I.T.'s Media Lab, I'm meeting up
with Ramesh Raskar, who is working on a way
to access the benefits of personal health data-- finally, a topic I understand-- without compromising
our private information. At Ramesh's Camera Culture Lab, they're building
some data collecting tools that seem straight out of
a science fiction movie. PATEL:
Love when a sign says
"Danger: Laser." You know important things
are happening in here. (voiceover):
They've got cameras that can
literally see around corners. PATEL:
Get out! (both laughing) RASKAR:
We are not violating
the laws of physics. PATEL (voiceover):
And cameras that can see
inside our own bodies. That's about as personal
as it gets. For Ramesh, protecting
patient privacy is paramount. But he's found a drawback
in how we do that. Since data is locked up
for privacy, advancement in medical science
is not as fast as it could be. Because, think about it, access
to tons of personal health data could help researchers make
major medical breakthroughs. But today, researchers have
to ask for your consent to peek at your data
in order to learn from it. RASKAR:
When we talk about consent, someone's still peeking
into your data. A no-peek privacy,
on the other hand, is where nobody
can peek at your data. PATEL (voiceover):
No-peek privacy? But how could
researchers learn anything? RASKAR:
There are many ways to create no-peek privacy. First one is the notion
of smashing information. PATEL (voiceover):
No, not literally
smashing your phone. But I'm not gonna lie... ...that was really fun. Smashing is basically
the idea of taking raw data and smashing it
into just the wisdom. PATEL (voiceover):
According to Ramesh,
smashing data is simply the process of extracting
the useful information, which he calls the "wisdom," while obscuring
the private data. In other words, a collection
of private health records contains two kinds of data. One kind is the personal data-- the names,
conditions, and histories, the stuff we absolutely
want to protect. But collectively, the records
may contain valuable information about patterns in health care. The wisdom. I'm thinking about
examples in health care, and the individual data,
the patient data is protected, and
you can't reverse engineer it. Let's take a concrete example
of COVID. Imagine during the early days
of the pandemic, we could have sent
medical experts from here in Boston
to China, to Korea, to Italy, and embedded them in
those hospitals to understand what COVID pneumonia looks like
on a chest X-ray. And they could have
come back to Boston, all those medical experts, and said, "Hey, together,
we can figure out what this is." PATEL (voiceover):
So, the experts would return
back with just the wisdom, an understanding of COVID derived from being exposed
to large data sets. But they wouldn't come back
with specific patient info. None of the raw, sensitive,
and private data. But of course,
that would require initially sharing patient data; a non-starter. Because of privacy,
because of regulations, because of national security
issues, they couldn't. PATEL (voiceover):
This is where A.I.,
Artificial Intelligence, comes in. Instead of sending
experts to each hospital, Ramesh is working on a way
to send A.I. to learn instead. An A.I. model could be trained
on patients' lung X-rays to learn what signs of COVID
look like. The private health data
would never be copied and would never leave the
hospital or the patient's file. The A.I. would only
transmit its conclusions, the wisdom, the smashed data. RASKAR:
It's not enough to just remove the name
from the chest X-ray, but make sure
that you don't send any of the pixels
of the chest X-ray at all. PATEL (voiceover):
The A.I. can learn patterns
and gain knowledge without having to keep hold
of everyone's data. So the "wisdom"
from one hospital can be combined
with the "wisdom" of others. RASKAR:
Achieving privacy and benefits
of the data simultaneously, it's like having a cake and
eating it, too; it's available. And it's just a matter of
convincing large companies to play along those rules. PATEL:
Smashed data is one way
we can learn to stop worrying and love sharing
our personal data. But every corporate network
would have to agree to smash our raw data. I'm not convinced
we should wait around for big tech companies
to do this. HILL:
The big technology companies, they have built
the infrastructure of the whole internet. You're not just interacting
with these companies when you know you're interacting
with them. PATEL:
Even if it seems like you're on a totally independent website,
big tech still sees you. For example, tons of websites, like some of the ones owned
by NASA, Pfizer, BMW, even PBS,
use Amazon Web Services, which means Amazon gets
some data when you visit them. Or when you visit
any app on your iPhone, Apple knows. Also, every time
you've been to a webpage that has
a Facebook "like" button, Facebook gets to gobble up
your personal data. KAHLE:
So it may seem like the web is decentralized because it comes from
many different places. But in fact, there's centralized points
of control. CHOWDHURY:
Right now, for example, when
you are in a social media app, you're sort of locked in, right? All your information
is on there. It's hard to leave a social
media app because you're like,
"All my friends are there, all my photos are there. "If I move to another app, I have to rebuild
that community." GALPERIN:
Those social media websites
are controlled by a very small
number of companies. And the rules about
using those websites, who has access to them and what
kind of behavior is acceptable on them, are set by
the websites themselves. PATEL:
This centralized data monopoly,
how do we start to dismantle it? That's exactly what
proponents of an idea called the decentralized web
want to do. GALPERIN:
The decentralized web
is sort of our antidote, the antithesis of the web
as we now think of it. CHRISTINE LEMMER-WEBBER:
The decentralized web
can be seen in contrast to the centralized web,
of course. Instead of what has become, on the internet, of a few big
players kind of controlling a lot of the web
and the internet space, we're really kind of
rolling things back to kind of what
the vision of the internet was. PATEL:
I'm wondering
what a decentralized web would look and feel like? So I'm meeting up with coder
Christine Lemmer-Webber, who is working on writing
the standards and rules for how social media could work
on a decentralized web. LEMMER-WEBBER:
Most people are familiar with social networks:
you know, they've used, you know, X-slash-Twitter; they've used Facebook;
they've used Instagram. The decentralized social web is like that, but no one company, no one gatekeeper
controls the thing. We want to be able to have all of our different
social media sites, all of our different
online communication tools be able to talk to each other. DOCTOROW:
A decentralized web is one that is focused on the self-determination of users. You're not locked in. So you find a service,
and you like it. (duck quacks) And then you and they
start to part ways. The art you made,
the stories you told are there. In a decentralized web,
you go somewhere else. You go somewhere else,
and you don't lose any of that. PATEL (voiceover):
But imagine, instead of having
one Facebook-type company, we each had our own data
live on our own devices, and it was easy to join
or merge with others, or disconnect from them. Leaving one group
and joining another wouldn't mean rebuilding
everything from scratch because
your data moves with you. It sounds like a tech fantasy. But it's actually something
we've already proven works online. Consider something you may use
every day, or if you're like me,
every minute: email. LEMMER-WEBBER:
So what a lot of people
don't realize is that they use decentralized
networks every day. It doesn't matter
if somebody's on Gmail, or if they're on Hotmail, they're on
their university email. They don't even
have to think about it. They type an email
to their friend, and they send it off,
and it gets there, right? At the heart of it,
that's kind of the basics of what we're doing. PATEL:
In other words, you can get
an email sent from Hotmail even if you have
a Gmail account. Or you can create your own
email server, for that matter. It doesn't matter what
email service you use because the protocol,
the rules, are written to allow the email servers
to talk to one another. LEMMER-WEBBER:
That's because there's
a shared protocol that says, here's how we get the messages
from place to place. Social networks
could just work like email. PATEL:
And in fact, there are plenty
of decentralized projects out there like Mastodon and Blue Sky putting the user's
profile and data back into the users' hands. LEMMER-WEBBER:
In the systems we're
moving towards that will be much more the case where private communication
is much more private. They're, by default,
secure in that type of way. We're building new foundations for the internet
that allow for healthier, safer, more decentralized
systems, gatekeeper-free. That's the vision and the future
we're trying to build. PATEL:
No doubt,
there are secrets in your data. NOBLE:
Everything we touch
is increasingly datafied, every dimension of our lives. CHOWDHURY:
All of this data
goes into feed algorithms. And algorithms make predictions about how long you will live, or your health,
or your lifestyle. PATEL (voiceover):
And while I learned
how to protect my personal privacy
and security, there's only so much
I can do myself. HILL:
There are things
that individuals can do to protect their privacy. Ultimately, in order to avoid a huge crisis,
it requires systemic change. GALPERIN:
There are limits to
what we can do as individuals. There are also things
that need to be addressed through regulation,
through litigation, and through legislation in
order to make all of us safer. PATEL:
It's comforting to know
there are techies out there trying to protect us
and our data, designing new ways to enjoy
the fun and convenience of the digital world
without being exploited. KAHLE:
New technologies,
new games can proliferate without centralized
points of control. That's the excitement
of the decentralized web. LEMMER-WEBBER:
I can't wait for people
to see this vision we're building for
collaborative, more consensual, decentralized social networks. That's going to be
really exciting. PATEL:
The future we're building
might not look too different from the internet of today. But it could be much more
private and secure, if we get it right. DOCTOROW:
This is about how technological
self-determination and regulation work together to make a world that is
more safe for human habitation. ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪ ♪
