FINISHED FILE

NETTHING 2023
AUSTRALIAN INTERNET GOVERNANCE FORUM
28 AUGUST 2023
2:00 P.M.
BREAKING SECURITY FOR ‘ONLINE SAFETY’: 
WHAT’S AT STAKE FOR ASIA-PACIFIC

	
Services provided by:
Caption First, Inc.
P.O. Box 3066
Monument, CO  80132
719‑941‑9557
www.captionfirst.com

This text, document, or file is based on live transcription.  Communication Access Realtime Translation (CART), captioning, and/or live transcription are provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.  This text, document, or file is not to be distributed or used in any way that may violate copyright law.
 
>> EMILY (Live CART Captioner):  Standing by.

>> Hello, can the Zoom room hear me?

>> Yes, perfectly.

>> Perfect.  Can we do a quick test of audio?  Let's start with the person who's speaking right now.  Oh, no one's speaking.
Can we start with Vanessa Teague, please.

>> Hello, can you hear me?

>> Yes, we can hear you.
And then can we go on to Alexander lynch.

>> Hello, can you hear me?

>> Can we now go to Shruti Shreya.

>> Can you hear me?

>> Your audio is a little shaky.  Can you speak a longer sentence?

>> SHRUTI:  Yes, can you hear me?  Is this better?

>> It's slightly better.  Maybe closer to the mic when you speak later.
Thank you.
Now can we go to Debayan Gupta?

>> Yes, I'm also waiting to be let in on my desktop.  I'm just speaking from my phone so if you could let me in on there that would be super useful.

>> I see.  Okay.  I see you as well.
And I'm admitting you there as well.  So if you want to join via laptop, that would be great.
Should be there.  Yep.  Maybe test your ‑‑ are you going to use the same audio?

>> DEBAYAN:  Is this good?  Can you hear me?

>> We can hear you about there is an echo, yes, maybe just disconnect the audio on your phone would be great.

[PAUSE]

>> NOELLE: Hi, everyone.  I hope you had a good lunch and thank you for joining us today.  Our session is called breaking security for online safety, what's at stake in Asia Pacific, in case you might have walked into the wrong session.  You can edge back to the door, but please, please stay.
Please give us a chance.
So my name is Noelle and I'm with the Internet society.  And please get comfortable.
So if you might have been tracking the discussions around content moderation in recent years or Internet regulation recently, you may notice there's an increased trend towards making intermediaries liable for content that we, users, produce that we share through their platforms ‑‑ on their platforms, rather, through their services.  So this discussion is part of a bigger trend around intermediary liability.  That is another big debate.  So we are not going to go into that in general.  We are going to focus on a specific aspect the new laws coming up in the last two, three, four years that would like ‑‑ that focus rather on.
 or would like to protect users from accessing potentially harmful legal content and we see this in several economies in the U.S. they have what they call the earn it act.  There's online safety bill in the UK.  This is ums being deliberated in the EU and of course we have variations of this in Asia Pacific.  In India we have the revised intermediary liability guidelines that came into place, and in Australia, of course, we have the assistance and access act.  So what these enacted new and proposed laws, what they would like to do essentially and what they have in common is they would require intermediaries to disconnect potentially harmful content, report that content to law enforcement, to government, and also have the ability to block or sensor specific types of content.  So Noble goals, very Noble goals.  But this is becoming impossible and that has to do with the security that we are all enjoying now online.  So we've come to a point where we feel confident enough to reveal details that we don't ‑‑ wouldn't normally reveal to the next ‑‑ person next to us.  You know, these are bank details.  We are confident enough to transact online, so communicate trade secrets, government secrets online without having the fear of somebody spying on us and somebody, you know, potentially defrauding us.  The fear is, you know, still there.  It's still possible but we've come to a level of security where we can be confident enough not to be stopped by that fear, you know, and it makes the Internet more valuable because we can do more things online rather but an essential part of the secure systems and it's something that we don't, I suppose, say enough it's just ‑‑ and we don't appreciate enough, it's just how hard it is to secure the online environment that we've finally gotten to that level of comfort.  At least for now.  It's an evolving threat landscape.  But an essential part of having secure systems is, well, secure tools.  And one of them is encryption.  So we'll get into what encryption is later for the nontechnical audiences in the room.
But essentially ‑‑ and encryption is everywhere.  It's ‑‑ I read once a statistic that says like 96 percent of the systems that we use now use encryption.  So it's very widely used.  And the gold standard for encrypted systems is what's called end to end encryption.  So encryption in general, what it does in a very basic sense, is it scrambles the messages that ‑‑ the message that you time online, it scrambles it so that the people who are not authorized to read that message cannot read the message.  So what they will see is like just a bunch of characters.  In end to end encryption what we have is that if I send a message to you so I am the source of the message and you are the recipient.  So I intended for you to read the message.  So in an end to end encrypted system, the message is garbled so that only I, the source of the message, and you, the recipient of the message or the intended recipient of the message can make sense of the message.  So everyone else who might be, you know, accessing the message can only read ‑‑ well, things that don't make sense., including the service providers that we use.  So for what's app, for example, we ‑‑ a lot of us use what's app.  So meta, the owner of what's app, or the staff of meta cannot read the things that I would send to you through what's app:  So if meta cannot read what I sent you or what anyone sends to anyone else, how can it detect the harmful content that's being said on what's app?  So that's what makes the proposed laws rather difficult because it means that for meta to be able to read what I'm saying to you if say I am saying something potentially harmful, it would need to weaken the system.  It would need what security experts call create a systemic vulnerability.  So these laws, as we know, have a very good intention and one could argue, well, you ‑‑ these laws just want to give law enforcement access to what criminals are saying.  But a vulnerability as a weakness is a weakness.  So once you have a weakness, you can use it for other things.  You can ‑‑ if a government, for example, has an interest in certain conversations, there is little that's stopping them from using it for mass surveillance if that is of interest.  There's little that's stopping ‑‑ I don't want to pick on meta anymore.  There's little stopping a platform from using that to profile us to know our preferences and to monetize this, say share it with the advertisers, et cetera.  And, of course, criminals essentially what these laws are saying, well, look, the systems are weak.  So you are inviting, you're creating a target for the criminals to identify and a target for them to exploit.  And they will do that because, well, many of them are quite ‑‑ so the goals for this session, of course we will touch upon the laws that are being proposed especially in Asia Pacific, but we would also like to discuss are these laws effective?  Can these laws do what they meant to do, which is protect us from harm, to keep us safe?  And what's at stake?  What are the risks that we should expect?  Should these laws come into place?  Some of them already are.  And lastly, of course, we would also like a way forward.  So we would like to explore the alternatives.  Are there solution that is we can pursue that will protect us from harmful content, harmful behavior online without necessarily having to compromise our security.  So with that in mind, I think I've spoken too long.  I will turn over to my co‑moderator, Shruti Shreya.  Shruti Shreya is with the dialogue and she's joining us from India.  And she will introduce our speakers.  Take it away, Shruti Shreya.

>> SHRUTI SHREYA:  Thank you.  Thank you so much Noelle for the talk.  Great context setting and for helping us understand what the expectations are from this session.  I hope I'm clear and audible?
All right.  So just now very quickly introducing our speakers and then we can start the discussion.
So we have the past today professor Dr. Debayan Gupta.  He is a computer science professor here in India.  We have professor Vanessa Teague.  She is also adjunct associate professor with the Australia national university and CEO of thinking cyber security.
We have with us Mr. Pablo Hinojosa, who is a strategic engagement director at APNIC, and Mr. Alex Lynch was a public policy and document affairs manager with Google Australia.  So the idea and the intentions of the session has already been established quite well by Noelle.  So now without wasting any further time, I think it's we should bring in our speakers to share their thoughts.
I'd like to begin with professor.  2021 coming and they introduced the traceability mandate, which now enforces that if the government wants it in and add service provider to disclose the originator of a particular message on an encrypted platform and many technical experts have come on record saying there could be many dire implications of such a traceability mandate for encrypted platforms, so two years down the line what are your views in terms of how this law has played out, what the repercussions have been?  Has there been any scenarios where the law has led to many challenges or what the situation is currently in India with respect to the traceability known data exists and.

>> DR. DEBAYAN GUPTA:  Sure.  How many hours do I have to answer that?

>> SHRUTI SHREYA:  Take two to three minutes.  That should be fine.

>> DR. DEBAYAN GUPTA:  The way I see it, look, I wouldn't get too much into the technical side but I will say generally speaking when the laws of mathematics come in contact with the laws of a country, generally speaking the laws of mathematics tend to win.  However, it's important to understand that most of these countries are coming from ‑‑ these people are not evil, the people who are proposing these laws.  It's coming from a really good place, all right.  So let's try to see this argument and the best we can do.  In India even though the law is on paper I can't say it has work out very well.  People are not actually providing originator tracing.  And I want to focus a little bit more, rather than the technical things which we will discuss I'm sure in the next half an hour, one hour, I want to focus a little bit more on the operational aspects.  Assume there thank there's some sort of magic way in which you can actually do this, right?  Who are the threat actors?  Who's going to get caught?  And what are the downsides and upsides of such a thing?  And what worries me that in a lot of these cases when I've spoken to Indian government officials, I found a very vague sense of who the threat actors actually are.  In some sense they're trying to catch all the stupid criminals out there.
Because, see, if you're a clever criminal, what do you do?  You pay $300 and get a phone number from a different country and then the Indian authorities can't really trace you.
They also seem to have very little understanding of ‑‑ and that might be on purpose of how they're going to handle and store a lot of this data because some of the proposed solutions at least involve the Indian government itself storing a lot of data.  Now, if you think about all of the governments which have stored lots of data that you've heard of, U.S., Australia, India, we regularly lose that data on a vast scale, right?  Like seeing as a large part of the audience is in Australia, y'all along with the U.S. lost large plans of the F35 module lightning not too long ago, right?  Supposedly to China.  Now, if people can't even keep their military secrets secret, right, people are downloading, why should we trust as citizens the government to keep this information secret, right?  Further, think about the operational problem.  And I'll just mention this in two parts.  One, suppose there is an Indian citizen living in Japan sending a message or an e‑mail or whatever to an American citizen living in Australia.  How many governments need to see this message exactly?  Like it quickly becomes complex because other than perhaps global warming the Internet really is humidity's only other planetary scale achievement and now trying to cut that apart is very very difficult.  And the analogy I'd like to put in here are tax law, right?  Our monetary system is also if not perfectly global, it's quite global and when replacing tax laws, new changes in the ways we do commerce, we're very careful.  And that's exactly how careful we feed to be when we meet niece laws restricting or changing information.  That's the level of game you need to bring to the table.  Because if you don't, you're going to get yourself into trouble, right?
The last point I'd like just to make over here is that a lot of these systems, it may feel like the changes that are being suggested are tiny.  It's like come on, you can't even give us this much.  Like why are you being so anytime picky.  The problem is think of your high school hated geometry textbook, all right?  What you're telling us is can't you make like one little tiny change and say you know adjacent angle, doesn't ad up to 60, 61 degrees, just give me 1 degree.  The problem is we've built an entire world on tops of these ‑‑ on top of these summations, right, and even a tiny edit to one of them, it may seem very small but it means we need to rewrite the entire textbook, right?  And even then it may not be enough.  So we need to be really really careful about the upsides and downsides of what we want.  Last point about upsides, I've spoken to many government officials asking them to give me statistics about, okay, suppose you had this, how many criminals would you catch?  Do you have a statistic?  Have you thought what the downsides would be and I can give you some idea of what is the pain we might feel.  And this is without going into chilling effects and so on, all right?  What is the upside?  Can you tell me every year we can solve 1500 cases.  We'll catch 35 terrorists or whatever.  And they don't have those statistics.  So I'm actually not completely averse to these laws.  I'm willing to hear the stuff out but I want to see a clear public cost‑benefit analysis before I talk more.
>> SHRUTI SHREYA:  Thank you so much for that great points that you've made.  Just to also add to what Dr. Debayan Gupta said and give a little more background about what the law is currently and the situation is, so the traceability mandate has in fact been challenged before the constitutional courts of India.  It started with the Geti high court and now it is pending before the supreme court of India.  And now also we have a discussion around the Amendment of the existing information technology act in I understood and very soon we might have a new digital India act.  So building this discourse and having these discussions becomes even more relevant right now.  Now we are thinking of bringing in a new legislation.  It's important to gauge what the challenges exist in the current legislation and the delegated legislations therein and revisit them in this new policymaking process.  So while this goes on, I think we should also understand what's happening in the other jurisdictions and for that Noelle I'll turn back to you to request you to please have a couple of questions from Dr. Vanessa Teague and Pablo Hinojosa while I'll be back in a few minutes.

>> NOELLE:  Thank you very much.  Very excellent points.
Let me turn now to Vanessa Teague.  Vanessa Teague is also a doctor by the way but I don't want to be too formal to somebody in Australia.
So Australia, it was an early fan or an early proponent of these kinds of laws through its assistance in access act.  Could you tell us more about ‑‑ because this has come into ‑‑ this has been ‑‑ well, it has been enacted.  Could you tell us more about what the implementation has been like and whether you have a sense of how effective it might have ‑‑ it might already be do catching criminals so to speak or just mitigating online harms?  And I do have a follow‑up question that's related to that.  A lot of these laws now say, you know, we don't want to break encryption.  That's actually what they like to emphasize.  We're not breaking encryption.  So there has been, you know, the encryption debate has ‑‑ it's decades long debate and we see now a shift from the explicit request for back doors towards more nuanced ways to get access to our data such as client side scanning.  Could you comment on what risks we can expect from these?  Because another justification that has been made is that it's not strictly speaking it's not really breaking encryption and I will leave you to elaborate on that.
>> VANESSA TEAGUE:  Thank you.  Again t. depends how many hours you've got to listen.  That was a big question.
So I agree very much with basically everything Dr. Debayan Gupta said and I typed out for later the quote about what happens when the laws of mathematics and the laws of countries conflict.  Look, Australia has been on the edge of breaking security in the name of safety for many years now and the answer to your first question is we don't really know either how effective it has been at catching criminals or how much damage it has done to the rest of our security.  We have had in recent years after the passage of the assistance in access act both some spectacular busts in which very, very serious criminals were successfully caught and also some spectacular dudder in which millions of Australians personal information was exposed online.  One of the characteristics of the assistance and access act and various other pieces of legislation along these lines is that they come with no transparency at all.  In fact, they come generally with sort of anti‑transparency measures that say that companies that are targeted with these kinds of orders are not allowed to reveal how many or what exactly was requested.  So we don't know either on the positive side or on the negative side how big the implications of this legislation has been.  So that's the first ‑‑ that's the answer to your first question.  We just don't know.
The second part of your question ‑‑ no, actually, that's not strictly true.  So the one piece of definite ‑‑ I have two definite ‑‑ I have definite knowledge of two specific causal connections on each side of this debate.  One is that there was a significant case very soon after the passage of the assistance in access act in which the Australian federal police claimed that they had used the provisions of that bill and the part that they specifically referred to was the part in which they were allowed to ‑‑ that essentially upped the penalties for suspected criminals who refused to open their phones.  So that bit if they are to be believed, which I do believe them, that part has been specifically used and has served positively in the conviction of very bad people.  So on the one hand that's good.  We don't know anything definite about the other provisions such as the technical capability notices or the capacity to press people with computer knowledges to force them on breaking stuff.  We just don't know.  As far as I'm aware there's no public information.
On the other side, Australia even before the assistance in access act, Australia mandated the compulsory retention of telecommunications meta data.  That included not only what you would regard as metadata about people's phone locations and calls but also the retention of identity documentation associated with getting the phone in the first place, right?  So you can't get a sim code in Australia without handing over a hundred points of ID and the telecommunications provider not only had to ask for it they had to retain it.  As you probably know there was a massive data breach by Optis in which a great deal of that information was left on an authenticated ‑‑ on the Internet, at least that was the story.  So one could say that the legislation merely required them to retain it.  It did not require them to be gob smackingly irresponsible in posting it online but there is nevertheless a direct causal connection between forcing them to retain that information and it winding up insecurely on the Internet.
So I think we have some indication both ways both that sometimes these laws do help in catching criminals and also sometimes these laws do bad things for the security of everybody who's not a criminal.
And then in answer to your next question which is sort of what's happening now and what about the more nuanced approach to breaking security on the Internet, what has happened in some ways the last thing that the coalition government managed to do for Internet security was shift all of this regulation away from the oversight of the parliament into the office of the safety commissioner.  So none of these things now get debated explicitly in parliament anymore.  They're not laws anymore they're just regulations that the safety commissioner makes up and she has gone on the record very recently with this sort of in fact I will read a little quote from her.  She is in the midst of regulating encrypted messaging apps at the moment.  And she has rejected a proposal from industry and her reason for rejection is as follows and I quote, there are privacy preserving tools capable of detecting known transsexual abuse material and known pro Tara material widely available and also frequently used.  These tools often rely on hash matching and operate without reviewing the specific content of messages.  So anybody who can tell me how to compute a hash without reviewing the specific content of messages can make that work on the Internet.  I think we've kind of passed the point where any kind of reason or logic or computer science knowledge gets applied.

>> NOELLE:  Thank you Vanessa Teague.  And you make a very good point there.  A lot of these laws, they don't go into the technical details of implementation.  So he this just say this is what we want to you achieve.  We want you to help us catch the bad guys.  How you will do that, mystery.
So now let's turn to Pablo Hinojosa.
Pablo Hinojosa, you are a well‑known technical expert.  And you're kind of, you know, prominent in APrIGF as well, but you are also a parent.  So could you tell us now as a parent how important has online safety been for your children and your observation of how important it has been for children in general?

>> PABLO HINOJOSA:  Thank you.  Quite fascinating.  It's not necessarily my area of comfort and we're trying hard the other day when we met online and it's very strange because Alex caught a virus and then we met online with Shruti Shreya that caught a virus and they couldn't be here with us today unfortunately.  So I really hope that you're feeling better and I'm now more afraid about my online safety these virus went from Australia to India one way or another.
It's out of my area of comfort because when Noelle and Shruti Shreya talked about intermediary liabilities and regulation around that and then I was trying to make a case about how encryption at the very lower levels of the Internet were in terms of RPKDI or DSNK or these other things I thought that was not a good approach.  So there's something that I have been saying for quite a while and it is that Internet governance starts at home.  And sometimes we see these Internet discussions and when I was just listening to Noelle giving this introductory ‑‑ her introductory remarks, we can see them as very esoteric and abstract until we're faced with the challenge of making decisions at home.  How you configure your router, how to manage your Wifi password and the devices that are connected to your homework and whether it is possible or impossible to control your kids' exposure to harmful, hateful, unlawful content to filter or not to filter, what filters, what parental filter products or firewalls to apply in your homework.  How to prevent children from being scammed or recruited or taken advantage of.  And these are questions that I face everybody day and sometimes I see friends that talk all the time about open free multistakeholder, let's discuss together and have a consensus building approach and then they have a fully controlled environment at home with all these filters and controlled apps and access to browsing history of the kids and kids not being able to take part of those discussions.  And when you see these questions at home, I think it makes us more genuine and realistic in terms of what we're bringing to this forum.  So it's very interesting as well the question now from Dr. Debayan Gupta when he was talking mathematics are unbeatable but regulatory regimes are ‑‑ that goes along with what Noelle was saying.  Because they have not proven or demonstrated that they are solving sort of specific questions.
So I want to talk about a recent paper.  It was published just this week.  The author is Daniel Sitrum, law were ever from the United States.  She published this paper that I recommend fully.  And when I read it I said look this is it, this is what I will bring to this session.  It's called under the eye the surveilled student.  And it explores the topic of surveillance and the costs and benefits of associated with it.  Fact is that many schools, including my children's school here in Brisbane, there is continuous monitoring of students' online activities.  And this is not by law or by regulation as Vanessa Teague was saying.  This is mere product procurement by schools, right?  And there are so many products that are being implemented to really check on every type of behavior that students have and they usually use laptops provided by school as well.  So ten years ago when there was no regulations we went through a process of clear rejection to government's both collection of metadata and Vanessa Teague mentioned that that was necessarily ‑‑ is followed worldwide but the whole question of mass surveillance at the time the arguments in favor of traceability and against encryption had to do with catching terrorists.  And then we have been saying how many terrorists we have been able to caught and whether the regulations were in measure or proportion to the achievements.  And these days the narrative has changed a bit and it is more about protecting children.  Nobody seems to be against this.  So this is a very effective narrative in favor of a lot of security initiatives.  But I think a lot about the situation of young students.  And if you can see sort of how they see these things sort of in the world, this is a generation that has grown with excessive surveillance in their devices and by their parents and in their school.  So professor Citron argues that we live in a golden era of student surveillance and this is not good.  And we should question their effectiveness in preventing violence, bullying or certain harm and whether these products are actually doing that.  So she mentions that these products have mostly led towards disproportionate discipline in terms of actions for minor infractions, like accessing a Web site.  Monitoring systems can just out LGBTQ plus students to teachers and parents who may be unsupportive of that.  Of course this comes with diminished privacy and students surveillance infringes on student intimate privacy which is crucial for theirself development and self expression as well.  It limits personal growth.  It has negative impact on relationships and this is the way that we are bringing students to life.  So I think this goes very much along the questions of online safety that we're talking about and it seems that we need to bring in the Internet governance context safeguards to protect sort of these things.  And this is way before regulatory or laws are being discussed or implemented and we really need to prove sort of these surveillance tools, we need to protect student privacy as well also of our own kids at home who need to shift the burden of proof to companies whether their products really live up to the policy that is we want rather than a blanket sort of filtering out or monitoring systems.  And most importantly, I think we need to bring this discussion of transparency and oversight and be part of those discussions of what products and to what degree those products monitor students and to what degree we as parents are monitoring students.  And this all requires stakeholder input, including and most importantly of the kids.  That's the reflections that I want to bring to this conversation.

>> NOELLE:  Thank you, Pablo Hinojosa.  A lot of excellent points there and I think we're heading through a very interesting aspect of the discussion which is a user empowerment.  And our next speaker, Alex Lynch, would have something to say to this.  But before I go back to Shruti Shreya, if you have any questions at this point, please note them down because you are next.
Okay.  We will have time for Q&A and participation from participants in the room as well as in our Zoom room.  So with that, back to you, Shruti Shreya.

>> SHRUTI SHREYA:  Thank you.
So coming back online to Alex Lynch.  Alex, we've heard the technical experts here talk about the problems that exist with forcing service providers to enable traceability or solutions like client side scanning.  I just want to understand from you that given that technical experts are seeing that solutions like traceability and client sites can and doesn't work.  Do you think empowering users with the tools they themselves can understand where they want to block a content or whether they themselves can understand what they want to filter, what they want to see is more feasible solution than putting this mandate on service provider?  And also what I'd like to understand from you, like what are the tools or what are the system level designs and Google has claimed it for empowering users in this respect where they themselves can be in control of their safety.  And how are users using it?  Do you guys also engage in some kind of awareness drives towards ensuring that users are able to understand these technologies and techniques better and use them for their safety and security purposes?

>> ALEX LYNCH:  Thank you, Shruti Shreya.  Yes, it's ‑‑ the best threat detection for harmful detection is one that scales and one that is sensitive to people's emerging concerns.  We know that content on the Internet changes overtime and online harms will differ through time as well depending on what people's perceptions of the most pressing concerns are.  That's something that citizens and civil society are best positioned through a robust reporting framework and that can be supported by technology like machine learning, detection systems and hashing systems indeed.  Only can work on public and unencrypted data.  And government collaboration is an important aspect of this as well.  Fundamentally we want people to be safe and have control over their own experiences online.  We want them to be ‑‑ empower them with the tools to protect themselves and create their own digital experience.  And we think that awareness ‑‑ the education that you talked about is critically important, making sure people understand these tools, how to use them, where they can find them.  It's something we do pay a lot of attention to and have drives on through our products and collaboration with governments and civil society and others quite regularly.
Tools to report harassment and inappropriate content can be backed by transparent.  We do think it's important and why it's concerning a number of these new regulations do have anti‑transparency provisions in them.  I think it's good if government and civil society groups can get insight into what is being reported and addressed by us as platforms as well as the requests that we are getting from government for purposes like law enforcement which are an important part of this debate.  In terms of encryption, it is definitely our position that encryption both in transit and at rest is violate to the protection of citizens, businesses and other institutions across society, protect our families and children and if you think about a very simple thing such as the message we send to schedule pickups and drop‑offs for our kids or thousands and thousands of photos we take of our kids can be protected who have might have ill intent towards our families.  Platform safety is one of the reasons that we have been successful over time as a company.  The decades of effort we put into making our systems and platforms secure and safe and the on‑going efforts towards that to give you a basket of ideas and this is ‑‑ I could talk as others have said, you could spend a day talking about these things, but things like safe browsing 4 billion devices probably including the ones that people in this room use, GML blocking over 100 fishing attempts every day.  Google scans about 100 billion apps every day to protect people from things like malware, but we do know that children are growing up with technology in ways that previous generations haven't.  So we're working with ‑‑ directly with experts and educators to help set boundaries, think about the boundaries you want in technology and help build them into our products.  Things like family link which allows people to manage their child's devices so you can set safety controls when they're exploring online.  Screen time limits and things like that.  And special features like smart filters, content ratings, in collaboration with governments and intermediate products across play and YouTube and more to make them more family friendly.  Now, this is something that we've developed over a long period of time to help organizations protect children and we do deal with some of the more pointy ends of the content moderator spectrum, including child abuse material, terrorist material we provide a toolkit for external partners through API, content safety API and CSI match.  Free for partners as part of our contribution to the ecosystem and they use technologies to billions of files every year, evaluating massages for abusive behavior, uses AI to help classify the materials and prioritize them for review.  The higher prioritize the systems give them the more likely the imagines contain abusive material whose job it is both to review this material both at society side and government to prioritize human ‑‑ which can be I think psychologically challenging in a lot of these fields where you're dealing with very harmful content.  And this prioritization is important both to minimize people's having to work through screeds and screeds of this but also to prioritize the most important content.  I think it's important to have a human in the loop because the automated systems we have are not perfect.  This is something we put a lot of effort into as a company and we do think that we have a strong role to play here.  However, I do want to reiterate encryption is violate for our societies both at the individual level and at the organizational level for businesses institutions as well.

>> SHRUTI SHREYA:  Thank you Alex Lynch.  Very important points and definitely violate be it transit are addressed and environment of users and more like collaboration and coordination between private companies and the government important and better innovative techniques and solutions for safety is very important.  And it's great to know that Google is undertaking these efforts and we hope that these efforts help in create ago more safer space in times to come.
Noelle, just coming back to you, I think we should now open it up for audience engagement.

>> NOELLE:  We should indeed.  So are you ready with your questions?
Well, before we go to that, I'm curious, how many, and show of hands, in this room are using ‑‑ and Zoom room as well, are using what's app or Signal or any other applications or services that we are using because we know they are secure or we believe they are secure?
Quite a lot of people.  That explains why you're in this session.
And, oh, I shouldn't have asked to you take that hand down because I was going to ask now how many, if you knew that there are third parties, if you knew that government can read what you're saying, how likely are you to continue using these services?

[PAUSE]

>> NOELLE:  A few.  You have nothing to hide.

>> (Away from microphone).

>> NOELLE:  That's true.  Pablo Hinojosa, would you elaborate on that.

>> PABLO HINOJOSA:  Well, if I was going to ask when Google messages are going to be end to end encrypted because currently they are not all those android users using text SMS that's the Google messaging and I really hope that you can stand up to the trend.  That would be awesome.
And secondly, I mean, again, this was a very easy experiment just in the room and if you see those that said like yeah, I don't mind, you know, government sufficient valance, that's okay.  They were all probably sort of 1997, 2003 generation.  That's because you most likely have lived most of your school years in this type of regime, you know?

>> KNOW WELT:  So now we turn to you, our participants to see if you have any comments or questions about the session.  If there are any representatives here or anyone who works for government or law enforcement, we would very much like to hear from you as well.  We are conscience that we don't have a government or law enforcement representative in the panel and it's very important to hear your perspective as well because I'm sure it would enrich our discussion.  Do we have any hands for questions?
Oh, yes.

[PAUSE]

>> Hi, everyone.  So I'm just going to reiterate what you said that Internet government starts at home but I also believe that privacy also includes your home.  So personally where do you think should parents and guardians alike should draw the line between content, moderation for children?  Because I personally cannot define it by myself and I don't think ‑‑ I don't know how.  Because we want children to develop on their own, grow personally, express themselves, but we also don't want them to access harmful content.  But in doing so, similarly, the problem with a global nation that we are actually violating some of their human rights and children have rights too.  So where do we draw the line at home?
Thank you.

>> VANESSA TEAGUE:  I'd be happy to have a go at that but happy to hand it back to Pablo Hinojosa who have obviously thought about it a lot.

>> Noelle: Go ahead.

>> VANESSA TEAGUE:  I'm also a parent.  I have three children, one of whom is an adult now and I had minimized surveillance of my kids.  First of all, I think the analogy between the surveillance of children and the surveillance of adults is a bit wrong because, of course, it is appropriate for very small children to have their environments controlled by somebody else, right?  You don't let them run on the road and certainly you don't let them cruise the Internet freely on their own.  I think that the role of platforms in pushing I am motive material at everybody is a big part of the picture that deserves to be discussed when we're talking about children browsing online.  I think if there was better regulation of unsolicited serving of stuff at people, then kids wouldn't be in as much danger browsing YouTube as they are, right?  That's a decision by YouTube or by Facebook or by whatever to be pulling eyeballs by serving increasingly emotive content at people.  Maybe the Internet would be a safer place if advertising eyeballs were not the primary design goal around which it was organized.  So I think it's hard like any other part of parenting.  I agree very strongly that the rights of children, particularly the rights of older children to have privacy from their parents as well as from third parties on Internet are critically important.  And I have never run any of that creepy spy ware on my kids and I never will.  Maybe I'm watching what they're doing some of the time but I'm never showing their stuff to third parties and I have refused all consent for the school to do so to the extent that I could.

>> NOELLE:  Thanks, Vanessa Teague.
Pablo Hinojosa.

>> PABLO HINOJOSA:  Oh, this is good because I like good debate and thank you Vanessa Teague for pushing back and I think it goes along where's the line and who draws the line and whether you need to expect sort of the school to draw the line for you and then we're seeing that probably not or whether the government to draw the line for you and probably not.  And then there is this question about bottom up or top down, right?  And to what degree sort of you can do whatever you want at home and they face a different reality in their community and how do you reconcile that?  And I do think that we need to ‑‑ I mean, I want to push back on Vanessa Teague in terms of they need a little surveillance but not a lot and then where you draw the line or you need to control that especially for small kids, et cetera, et cetera.  But at the same time it is very very likely that these kids will sort of find content that they are not supposed to find.  And it is more likely that they will do it regardless of whatever sort of product imposed to them at home.  So I think the conversation has more to do on how you have that conversation with your kids assuming that they will be connected one way or another.  They will see things that they shouldn't be seeing because it's everywhere, right?
So that's exactly why I think you need to have those conversations as early as possible at home.  And for them to create discernment.  Because all of these at the end is about discernment, right?  It's not about safety.  It's about discernment.  And that is something that I would like to sort of stress very much because you can say, yes, top down surveilled monitored to some degree but where will they get the discernment and it is most likely they will need to get that from home, starting at home.

>> NOELLE:  Thank you, pope.  We have a question online and, Shruti Shreya, I hope you don't mind.  Jen has offered to ‑‑ very kindly offered to read it out.

>> SHRUTI SHREYA:  Yes, please.

>> JEN:  So this is a question from an online participant Fred Goddard.  The question is Apple made an attempt to monitor CSAM but it got a lot of back lash and the ‑‑ and they pulled that attempt.  Can anyone explain what they tried to do, why there was such a back lash, and is there a system like that that would work?

>> NOELLE:  Do we have any volunteers.

>> VANESSA TEAGUE:  I read the paper.  I can have a go.
I read the protocol and it's another use of the hashing algorithms.  So the idea was that there would be some kind of authority that supplied a list of hashes of targeted material of whatever kind.  And then there was a very clever, nifty protocol with the property that the device would hash the massages that the person was about to send and then there was a very clever multi party computation protocol for assessing whether the hashes that ‑‑ of the pictures that the person was about to send matched a threshold number of the hashes that were in the database of targeted photographs.  And if the matches exceeded a certain threshold then the ‑‑ that would be brought to the attention of Apple and then they would review the pictures.  And then if the pictures were indeed targeted massages of whatever kind then they would contact the relevant authorities.
So as a crypto graphic protocol I don't think anyone disputes it had the properties it was supposed to have which were approximately that nothing about the contents of your phone would be communicated unless the threshold number of matches was met.  My concern about protocol is who chooses the hashes, right?  Because it's marketed as catching pedophiles and terrorists but exactly the same technology can catch people sharing pictures ‑‑ or people who have leaked embarrassing pictures of the U.S. military ‑‑ so the technology does a thing but there's very little transparency about exactly what it's detecting.
I'll go to Dr. Debayan Gupta.

>> Dr. Debayan Gupta:  I agree with everything Vanessa Teague said there's technology that can do stuff but at the end of the day all it's providing leverage to a certain group and as long as there isn't sufficient oversight there you're just getting yourself into trouble.  I also want to say that I have an inherent ‑‑ call it a bias, all right?  Any time anybody comes and sells me something that tells me it's going to help my liver reduce my ache in pie foot and help me something else, I think they're selling me snake oil.  When someone comes to me says it's going to reduce terrorism reduce pedophiles and solve a drug crime.  Okay, seems suspicious.  When I look deeper I find that the main thing they're doing is giving a small group of people more power and I get even more suspicious, right?  The problem with a lot of these protocols again they're coming from a good place very often but almost all of the time what the they end up doing is moving the decision somewhere else, right?  About what is good and what is bad?  And I think that decision needs to be devolved as far as possible.  I'll also just mention a couple of different things about the prior questions that were submitted.  One is another problem with the children scenario is that very often the teenager is the most technically adept person in the home.  So, you know, using technology to prevent your child, you know, your 13‑year‑old from say porn or whatever, good luck with that.  There is also a difference between what is legal and what is prudent.  And I think a huge problem with us is that, you know, how do you deal with a generation who is not angry that the NSA looked at their private posts, they're angry that the NSA didn't hit like.  How do you deal with that sort of oversharing mind‑set?  And again, I want to really emphasize that the government that we're afraid of is not a particular government.  What we're afraid of is not sort of a shield style if you're an avenger's fan, sort of super competent group of people who are sort of surveilling everyone, these are not the greatest crayons in the box.  Why do we think the intelligence officials and the police are any clever error than the most incompetent department that you've seen in the U.S. that would be the department of motor vehicles, for example.  Someone was talking about the terrorists that work on, I was just looking up in 2015 there was a great Rebecca article written about this.  They had looked at what had happened under the Bush administration after the 2001 attacks and the increased surveillance thereafter and there was a senate intelligence committee this, that, and the other.  And the N SA has publicly speaking after the stellar protocol and whatever, they've spoken about exactly four cases.  Four after spending tens of billions of dollars of public money if not more.  They've spoken publicly of only four cases where surveillance was actively used and of those there was only one case where this mass surveillance that they were doing actually helped them make an arrest.  That was the case of a taxi driver who sent $8,500 to his brother in Somalia.  That's the best example of cost‑benefit analysis we have till today.  So as a public sort of tax payer, my question is even deeper.  I'm like look you're asking me to spend all this money, come up with new protocols, hop on one leg, dance under the full moon, whatever.  Let's say we come up with this, what is the benefit that I'm getting?  And the answer to that I get are woefully vague.  That's my problem.

>> NOELLE:  So thank you very much, Dr. Debayan Gupta.  We can take one more.  We were given a very small time extension.  So we can take one more question in the room and then another ‑‑ I think the gentleman was ‑‑ who was first?
Oh, so the gentleman was first.  I'm very sorry.  Then we have another online question, I believe?
One more comment.  Can we do this question quickly?
So we take all that and then speakers can have one minute each to answer and wrap up and then we'll turn it over (Away from microphone).

>> Just very quickly.  I just wanted to actually go back to the point that Vanessa Teague made about accountability of the platforms, the responsibility of the platforms for targeting content.  It's very clear.  I'm a parent too.  When my kids watch YouTube, they are targeted with specific content, which is very hard for them to push back or turn off because it's been designed to engage them and grab their attention.  I'd love to hear responses from the panel about this issue of holding platforms more accountable to what they serve us, the users.

>> Should I ask the question now?

>> Yes, we can hear you, Amrita, please go ahead.

>> Thank you.  Interesting discussion.  One question was in the room we are talking about parents who are educateed and understand, you know, how they need to protect their children online.  However, we should not for get that there are many parents in our region who are not even Internet literate or tech savvy.  How do you expect them to guide their children?  That's one comment.
And that's a question.
And my comment was yes, we are wary of governments trying to surveil us or tech trying to surveil ‑‑ you know, big tech trying to survey us.  However there is an issue on the table which is that there is a growing CSAM, there is growing terrorist content et cetera.  So things have to be done.  If what they say in terms of data encryption is an issue which even I have an issue what are the alternatives we are giving them so this narrative closes.  So I think the discussion needs to move there.
Thank you so much.

>> NOELLE:  Thank you, Amrita.
We have one minute each for the speakers or just wrap up, okay.
So the speakers who want to comment on that please do on the two questions and then I'll turn to Shruti Shreya to wrap the discussion up.

>> VANESSA TEAGUE:  I'd like to hear from Alex, when is Google messaging going to be end to end crypted and stops pushing buttons that the kid didn't ask for.

>> ALEX LYNCH:  Bear in mind I work in Google Corps but does include a kids function and the pulses there have been developed by in collaboration with external specialists child development children's media digital learning.  For example –

>> VANESSA TEAGUE:  This.  Is a different thing, right?  It's one thing to have surveillance and restriction.  It's a different thing to just have a button that says I'm going to search for a particular thing don't push at me anything else I didn't ask for.

>> ALEX LYNCH:  You do have a kids ‑‑ YouTube kids that you can switch across to which doesn't surveil people.  The content there is moderated such it is appropriate for children.

>> VANESSA TEAGUE:  But are kids pushing stuff that the kid didn't ask for.

>> ALEX LYNCH:  There are things that you can say to say report content that you don't think is appropriate, right?  Like it does have those content reporting things.  We do have automatic filters by human engineering got human review and we do rely on on feedback from parents is your child being served something that's being inappropriate please do provide feedback that it's a user generated platform but it's usually to get that particularly in the modern era where we have slight reinforcement for AI systems which will have been those over time as we get feedback from parents.  That's something we do think about when it comes to YouTube.  I'm sure my YouTube colleague could probably have more deeper comments on that but that is something I know –

>> VANESSA TEAGUE:  Is there a serious proposal to have a button that says don't push at me I didn't ask for.

>> ALEX LYNCH:  I haven't seen any kind of button but then again I don't ‑‑ my kids aren't at the age where they use YouTube kids yet so I'm not sure.

>> PABLO HINOJOSA:  Well, I find this panel quite interesting but it was just a start of a lot of things that need to be impact.  It's clear for me there are technological answers than there are products and policies and regulations and then there are parents that we struggle every day to find that and neither the technological solutions nor the products nor the regulations are enough for our children to be safe.  So we need to put our effort into promoting more discernment.  That is technologically neutral and doesn't require a lot of digital skills.

>> NOELLE:  Thanks very much.  Just to quickly answer, there is ‑‑ so some of you might have read there's a new ‑‑ there's a proposal ‑‑ proposed framework on ‑‑ coming from New Zealand on online safety and that has a provision that would require platforms to be accountable for promotion algorithms, which is I think something that ‑‑ yeah.  So something to look into.  With that, let me turn over to Shruti Shreya to wrap up the discussion.

>> SHRUTI SHREYA:  Thank you.  Thank you so much and the discussion was quite enriching.  It's sad that we have to now wrap up because we are five minutes in fact above the time limit.  So thank you so much for all the insightful comments and the insightful discussion that we had here this morning and afternoon in Australia.  Thank you to all the speakers for sharing their insightful thoughts.  I'd very quickly like to just sum up the key points that have come up with the discussion.  As the discussion evolved around encryption and how there has been a lot of considerations by law enforcement and governments towards maybe diluting the encryption security in the ways of enhancing online safety.  The recommendations from our experts here is that it's not a good solution towards safety and security because encryption itself be it encryption at best or encryption in transit is nonnegotiable technique or tech no logical advancement which is inclusion ensuring safety and security and privacy of users online.  So any proposal towards diluting the security this protocol is going to undermine the secure Internet infrastructure.  Child safety has been an important issue and that has been one of the critical reasons for law enforcement agencies to come up with the anti‑encryption legislations, however, our experts believe that child safety even for child safety encryption is a crucial tool and by breaking encryption we are not going to make children more safer.  There are tools, there are techniques that's being developed by companies like Google, meta, and they are invested towards having better design solutions to ensure that users are empowered with the right tools and techniques.  They themselves can be in control of what they want to see, what they watch so focusing on these device and techniques is a ‑‑ awareness tools and techniques rather than coming up with solutions that compromise the security infrastructure of the Internet.  It's important that the stakeholders, the law enforcement agencies, the government works with the platforms better.  They come up with solutions that are more secure and that do not need to come to productive results.  In fact, statistics also show and there is no data to support as one of our experts said that's encryption ‑‑ breaking encryption is of any help.  So it's important that we think of better solutions which are more feasible and which are in sync with the digital rights of the users across the world.  So thank you so much for this conversation and I think we can wrap up but thanks for the dialogue and Internet society for joining us today and for sharing your thoughts.  We are indebted for this and he with also will be sharing recommendation document from this session a two week summary which will highlight what has been shared here and we hope to use that to build greater discourse on this issue.

>> NOELLE:  Thank you everyone.  Thank you very much.  I know you ‑‑
[APPLAUSE]

>> We ate into some of your tea time.  Please enjoy your tea time and thank you to the speakers.

>> Up next in the plenary hall after you take your tea and coffee, it will begin at 3:30 local time.  It is the town hall session.  Please do come.  All the good discussion you've had today, please do take the mic and speak up.  Everything that you heard in this session should also be spoken at the town hall to make sure we encapsulate it our synthesis document for this year.  So thank you very much and please enjoy the tea.
3:30 in the plenary hall.   

This text, document, or file is based on live transcription.  Communication Access Realtime Translation (CART), captioning, and/or live transcription are provided in order to facilitate communication accessibility and may not be a totally verbatim record of the proceedings.  This text, document, or file is not to be distributed or used in any way that may violate copyright law.