Hi everybody. Good evening. We're going to get started. Good evening. Good evening. A very, very warm welcome on a very, very cold night. Thank you all for coming out. We have a fabulous panel tonight to talk about cyber law and human rights, particularly in the global south. I am Rob Faris. I'm the research director at the Berkman Klein Center, and I have the honor of moderating tonight. But the true maestro, maestro of tonight is Jessica Deere. I'm going to have Jessica kick things off and bring the panel up, and then we'll jump in from there. Oh, we are being webcast, so be careful what you say. Thanks Rob. So as Rob said, and as many of you know, I'm Jessica Deere, and I'm the founder and executive director of SMEX, which is a Beirut-based digital rights organization that conducts research, training, and advocacy to advance digital rights in the Middle East and North Africa. And this year I'm a fellow at the Berkman Klein Center doing research, which I'll introduce in a second, and as the incubating director of something called the Cirilla Collaborative, which you can kind of see a web shot. It's the website here. So the Cirilla Collaborative is a group of six organizations from all over the world who are researching and advocating for human rights, particularly in what we call digitally networked spaces. We've been meeting over the past two days here at the law school, and to initiate our collaborative, we're sort of at the beginning of it, and a database of what we're calling for the moment anyway, digital rights law, global digital rights law. And this is the database right now. You can find it at Cirilla.org, C-Y-R-I-L-L-A.org. So why do we need a global database of digital rights law? In recent years, contrary to John Perry Barlow's vision of an independent cyberspace where governments have no sovereignty, national level legislation as well as national and regional level jurisprudence have been proliferating worldwide. Indeveloped and developing countries alike, creating new legal frameworks and legal challenges for our sort of ever-evolving digital sphere. And it's happening really fast. So fast, in fact, that it can be difficult even in the most developed legal environments to get a grasp on the impacts, trends, and consequences. Sometimes we might see the results as positive as many have done with Germany's GDPR and earlier with Brazil's Marco Civil. Often, however, this proliferation of law can feel reactionary and be associated with negative effects in the closing of civic space. Anti-cybercrime laws, for example, can criminalize online speech and limit the use of encryption thereby jeopardizing rights of free expression and privacy.  Those are just a couple of examples I'm sure you hear a lot more tonight. So one of the problems is there's no easy way to track and monitor the evolution of legal frameworks for digital rights in the digital sphere, at least not yet. There's no way to recognize the trends, yet recognizing the trends before they become bad law is of critical importance for both human rights defenders and policymakers. So the organizations represented, and I'll ask you all to go ahead and come up and take a seat, if you would please, are the Association for Progressive Communications. And Rob, I don't know if you're going to introduce the individuals or if I should. Okay. So, sure, Gayatri Kandadi from the Association of Progressive Communications is here with us. Robert Muturi from Strathmore University in Kenya's Center for Intellectual Property and Information Technology. Holly Johnson from Columbia University's Global Freedom of Expression Case Law Database. And Juan Carlos Lara from Derechos Digitales, which is a digital rights organization in Chile that works across Latin America. And then I will also join the panel representing SMECs. But we're all working to document, organize, exchange and extend legislation, law, evolving legal frameworks for digital rights in their respective regions as a way to make these patterns more observable. And our vision is to help social science researchers, human rights defenders, independent journalists and policy advisors, some of the user personas that we developed today, gain easier access to relevant law and case law without costly subscriptions and with an issue and legal taxonomy that's imminently relevant to them as well as interoperable with others and other data sets. So currently you can see the prototype at serilla.org, which right now contains more than 600, is it 600 or yeah, about 600 laws in their translations, judgments and draft laws from countries in the 22 countries of the Arab League. And the vision is to expand this data set to have a global scope and to add sort of internal connections and references as well as to do some visualizations of those patterns and trends as we further develop the platform both within all the regions that we've mentioned, Latin America, South Saharan Africa and Asia and sort of make this a real global resource. So I just want to thank all of you for coming. I'm really grateful to you for being here on the cold night. As Rob said, I really want to thank all of our panelists for their participation. I also want to thank the law school for giving us a space to have our partner meeting over the last two days and also tomorrow and the Berkman Klein Center and Rob for moderating. So thanks very much. And I'm sure we're about to have a really lively and informative discussion. Just switching hats now. So we have an amazing panel here tonight. I guess what we want to do is we want to hear from the panel, the experts we have assembled and we also want to have a conversation with all of you all. There's a huge amount of material that we could potentially cover but let's see where it takes reminding Nimble along the way. What I'd love to do if you wouldn't mind esteemed panelists is I'd love to hear from you within a few minutes on like kind of where we are, what are the trends you're seeing and how do we feel about it and going with the random order of how you sat down. Would you mind kicking us off, Holly? Sure. I think I'll start with just sort of a bit of background about our project and what we're working on currently. So the name of our project is the Columbia Freedom of Expression Database, Case Law Database. It was started about five years ago by President Bollinger, President of Columbia University. He's a First Amendment scholar but he really felt that there is an area that he would like to focus in a university on which is sort of global problems. Freedom of Expression is clearly a massive issue right now and with his mandate we established a database and we are now after five years we've got almost 1,300 analyses of significant court cases from around the world of like 130 countries and we began to build by building a team of researchers about 20 or so legal researchers from all different countries with different language and area expertise. We've tried first to get a baseline of standards from as many countries as we could and then to try to see if and how national courts are starting to align with international standards. That's really been sort of one of our main areas of focus and then to also see what sort of trends we're seeing. And I think in the digital rights area a lot of the traditional problems of sort of defamation for instance that used to be with the traditional media are now they've taken out a whole new set of problems in the digital sphere and we're also seeing right now a lot of countries that are using national security as an excuse to do internet shutdowns, to take down content, block sites and to that end we've gotten involved with a new organization, a new initiative in the last year so it's called Internet and Jurisdiction Network and they're based out of France. They're bringing together, it's a multi-stakeholder initiative so it's tech companies, it's academia, it's civil society, human rights organizations to look at this problem of online content and get a harmful content and how do you deal with inter-jurisdictional takedowns. And we're seeing sort of a lot of new case law coming to us and that we're starting to analyze and get a handle on. But it's a fascinating and complicated situation and I have some wonderful regional experts here that can kind of talk to what's happening and in their areas I can talk a little bit more later on about sort of what's happening maybe in Europe and in America and kind of get a balance to view of how different jurisdictions are addressing these challenges. So maybe hand that over to my panel. Thank you very much. So our project is very simple in that it's too pronged we're doing this out of Strathmore Law School. I'm part of a think tank called the Center for IP and IT which is a bit, you can see Jacqui there, our colleague and also Paranta, maybe they love this winter more but their colleagues at Strathmore Law School. So basically at the beginning it was about African government kind of grappling with how to deal with the emergence of ICTs and there not being enough data and so my predecessor, Moses Karanja who's actually doing his PhD right now at Toronto, they conceptualized this idea that let's have a database where we can have sort of like a resource portal where governments can be able to go and understand all the legislation and other resources that they may be used, they can be able to use to create policies. You will notice that even in Kenya, a country that is thought to have adopted ICTs to quite a large extent still doesn't have national ICT policy, we still just have drafts coming after drafts. So one of the things is to resource governments and people that advise policy makers on the right resources that they can use. So we created this policy, it's called the Africa Tech Policy Database to do that. Then the other part of the project which is also independent on its own is that there's few opportunities for citizens to engage with government in that process of policy making. So we created a tool called Jadili. Jadili is a Swahili word which actually means let's discuss that same way we're doing it here but can we be able to leverage online tools to do that? So we have an annotation tool which you can use to comment on bills and we get the bill from parliament or from whoever is sponsoring the bill then we'll upload it and from there people can be able to annotate different sections of the law depending on what their reactions are. But the trend is that we've seen that we still need to mediate the complexities of legal language so someone might know what the issue is, they might understand that their privacy might be infringed by a certain provision but they might not be able to locate the article, they might not be able to understand the language on the article, they still have more work to be done to be able to help them to get their message across. And then we usually take these comments, we write a memorandum to parliament and then they're able, the committee that will be considering the issue because we are specializing with the ICT committee in parliament, they're able to take this and it's part of the handset, part of the discussions that go on to inform their work. Thank you so much. I definitely want to come back to the annotation tool at some point. Thank you. I mean there were a lot of questions, I mean what you asked me to do in the next few minutes is quite loaded so I'm going to try and break it up and just talk about the context and the larger context before we go into specific kinds of violations. If you recall at the last Internet Governance Forum which is essentially a place, a gathering, a process for multi-stakeholder groupings to kind of get together and talk about how the internet should be governed. And we had the French president at the last meeting calling for greater participation and a greater role of government in the regulation of the Internet. Well essentially where that came from is to try and find that middle ground between a San Francisco approach of anything goes to a China approach of only what I say goes. Sort of to try and find that middle ground was the basis on which a call for greater participation of government in the regulation of the Internet came forward. And this is not just something that's coming from Europe. Recently in Davos you heard the Japanese premier also calling for a greater role of government in the regulation of the Internet. And all of this kind of reminds me of what the UN Special Rapporteur on Freedom of Expression recently remarked by saying regulation is coming. That's just what it is. And that's not just for private sector. That's also for how users and individuals experience and exercise their rights and existence on the Internet. And one of the reasons, the fundamental reason why we decided to narrow down and not just look at it at violation of rights on the Internet space but rather look at laws in the Internet space is because what we are clearly seeing across Asia and I suspect Africa and elsewhere is that states are having this knee jerk reaction to any new phenomena there, what they're calling as new phenomena on the Internet. It's essentially just a different way of experiencing violations. So there is legislation seems to be the go-to solution for every problem that we are experiencing with people's exercise and also not just exercise, their expression of their opinions in the online spaces. So in India for instance you see laws being given a solution to every sort of problem that's hate speech or disinformation or misinformation, fake news, whatever it is. There's repeatedly laws are being passed off as sort of the solution and what we clearly now notice is that throughout Asia we're going through a norm-setting phase for the Internet and that's not just for Asia across the world. And the reason why it's important for us to get involved in this phase right now is because what states essentially are doing is they are legalizing illegitimate restrictions and that's not just that they're actually legitimizing illegal restrictions. This is why we did a research on six countries in Asia with the help of SMECs from whom we borrowed the methodology and if you could just bring up that research I'll show you. I'd like to go into what findings of this research were some really interesting findings in the research but this particular if you could just go to the front page. So this research looks at six countries trying to look at not only ICT specific laws because what's really happening is that the way our rights are being mediated in online spaces is not just coming from online specific laws it's coming from your traditional penal code and your constitution and other laws even broadcasting telegram laws all of this also feeds into how our rights are being mediated in online spaces and I just wanted to add a last remark for this round and then we can go back into the kinds of expression the kinds of rights that are being mediated online through these laws. Oftentimes we talk about freedom of expression and privacy as the primary rights that get affected or enhanced in online spaces but actually if you look at it there are a whole host of other rights that are impacted by the online spaces but more importantly by laws seeking to govern online spaces freedom of assembly and association is one such group of rights. Now increasingly people use online spaces to protest and to form associations which was not possible through traditional means and these laws are not just impacting how they express but impacting their variability to associate and also assemble in online spaces another way key set of rights that are getting affected by these laws is the right to religion and your freedom of religion or belief. You see increasingly states trying to introduce blasphemy provisions than the ICT laws which is diametrically opposite to what the international community has been calling for which is the decriminalization of blasphemy and of course there are culture related rights gender related rights all of which are being mediated by these laws. Okay in the case of Latin America many of the things that Gaia mentioned about Asia are also applicable and our project has to do a lot with what's going on in a region where we see the tension between the idea of this internet as a space for liberty in a Silicon Valley perspective and that of an internet where government is the one dictating what can go as China was used as an example by Gaia just now and that tension is usually resolved or tried to be resolved through law however legislation is often not something to be considered in the abstract but something that is also a product of their context and I think many examples can be said about that and I think we can go into those restrictions and those effects on fundamental rights a bit further down the conversation but in the case of the things that we are going to try to do through the project we want to identify those trends as they are happening the project that we are bringing into the CERILA work plan is called Red Latam and it was initially a platform where you could see what the current state of each country in Latin America was back when the project was launched five years ago and it was mostly a very superficial analysis of what each country in the region had done in terms of policy and legislation with regards to digital or telecommunications related issues but over back then things were much different and the things that we saw that could be happening were not necessarily something that could be just gathered in that platform in a static form for instance we saw that the things that were happening weekly were much more than we thought possible and our weekly newsletter gives some of that context each week at the same time we yearly produce a report called Latin America in a glimpse where we see the trends that each year presents in the region but as we saw it our possibility and our capacity to be able to influence processes either in Chile where our main offices are or in other countries where many other activists are scattered throughout Latin America many more things could be done if information was updated and it was enough to be part of those processes so some of the things that we are seeing then and that require a high degree of reaction of timely reaction by civil society and by other interested stakeholders in the process like academia, like technical experts, like people who are part of the political process and part of democracy can intervene when that information is available those trends in Latin America in most recent times have to do with many things although the digital law space is much larger than that one has to do with the post GDPR world where many countries in Latin America are starting to enact their own data protection laws just as it's being discussed here in the US but in many countries in Latin America that GDPR influence has become a point where governments have decided to take action to protect personal data especially from abuses by the states and by companies however whether that is the solution that it promises to be is something that remains to be seen and at the same time we still see that there's some pushback by some data operators that oppose that kind of regulation secondly and as a flip side to that governments in Latin America have abused their capacity to build databases and to conduct surveillance on their citizens for a long time and that has continued as a matter of fact some laws have been used to surveil because the procedural safeguards are just not there to prevent some abuses by the state and as we have seen it's not only that they are tapping into phones but that they are sending phishing links for journalists and human rights defenders and even people who are like in the case of Mexico activists for health and against the pressures of the big companies that use highly sugary drinks in order to also affect them and to affect journalists and to infect their devices and surveil them and because in many cases we don't have the restrictions that other countries have or we do not have the procedural safeguards to prevent those abuses they are still being carried out by states and finally something that is very relevant to the global political context freedom of expression is under constant attack in the region and in many cases legislation that is meant to serve against hate speech in the case of Honduras to promote cyber security or promote healthy conversations online is legislation that is actually being used to affect freedom of expression to censor and to prosecute and persecute people who might have things to say about their government so these acts of censorship that have happened in the region throughout time new forms, new shapes and legislation has been a tool that is being used to this day to help governments in those efforts. So I'll put my hat on now as executive director of SMICS which is a as we said an Arab organization and the way that we came to sort of CERILLA and this project in general is post Arab Spring seems like such a long time ago now but it was really after the Arab Spring when governments in the region sort of got wise to what actually could take place in the online space and you started to see a lot more detentions and other kinds of interrogations and prosecutions of activists in the Arab region under a whole host of laws as Guy was mentioning press and publications laws were being used even drugs laws were being used and so a lot of us in the sphere sort of started asking ourselves well what is the legal framework here not really realizing I guess the deep problems that we were going to find and so the project kind of started as mapping what the legal frameworks were in about six different countries in the Arab region and sort of looking at at what was there and also what wasn't there in many of the Arab legislation definitions are very vague they are very arbitrarily applied and what we also found by doing this research and sort of starting to catalog is we started to see sort of a proliferation or an uptick in the passage of things like anti-cyber crime laws and also with the ISIS and the sort of terrorist anti-terrorism agenda we started seeing more anti-terror laws and we started seeing that they would be passed sort of in one state and then another state that they would have very similar provisions very similar text and so we started again sort of wanting to see the larger picture one of the questions I remember that was sort of one of the originating questions of the database is sort of like has it gotten worse since 2011 since the Arab Spring I think now we can pretty definitively say especially in places like Egypt yes it has gotten much worse and other countries as well but what we're also starting to see is a lot more sort of sophistication and really a lack of any kind of hesitation in many of these countries to really produce pretty draconian legislation that does govern the internet in places like Egypt and in the Gulf states where what you'll end up seeing and I know this you'll end up seeing that punishments for things that happen in online spaces is actually much greater, far greater both financially and also in terms of imprisonment than it might be for the same kind of act that happens in a public space or in some other kind of offline forum we've also seen lots of data localization provisions and it's interesting particularly because in the Arab region there's really a lack of data protection laws I think maybe there's four or five maybe across the region that are not and then most of those aren't very well either articulated or enforced and there's very few access to information laws as well so we start looking at sort of the whole ecosystem and the whole legal framework of what's available and we started developing a methodology after doing this kind of inductive process of just sort of seeing what's there we decided to go back and learning about others Red Latem which was an inspiration to us so we sort of started saying hey we should do this for our region but then we also started discovering other organizations in other regions who were engaged in the same exercise what are the legal frameworks for human rights in usually network spaces and how can we observe them in a way that's useful for us as advocates or legal reformers or human rights defenders and so I think a lot of what the initiative has evolved into now is sort of it's a collaborative sort of approach because the problem is so large and the challenge that we've sort of set ourselves is so large that no one organization can actually take it on alone so we're trying to standardize things like research methodologies how do you find these laws issue taxonomies how do you categorize them so that we have a shared taxonomy so that we can actually know that we're all looking for the same thing and be able to do better comparative analysis both between countries and from a country perspective to a regional perspective as well as maybe between regions and globally and sort of see okay if the general trend is moving this direction where does my country or where does my legal system sort of position itself according to that. Great great thank you all I hope you're all thinking of questions for our experts here so I'm super impressed with the ambition of what you're trying to take on and I'm also really overwhelmed and daunted by the enormity of the task there's so much to look at and to understand if you were to look at the research from your various organizations and from others the publications of the special wrap up tour at the UN for freedom of expression for example there is a long long list of things that give us great pause and concern and heartburn what are the things that stand out so are there mistakes being made amongst governments who are trying to catch up and apply law to cyberspace that are worse than the others or is it just kind of a big gumbo of wow we wish you weren't doing it that way what are the things that stand out what are there any particular topics is it terrorism is it privacy is it harassment is it hate speech fake news are there things that are being dealt with more awkwardly than others it's just a big morass and we should what do we do with this help me make sense of this okay sure I think sort of a starting space for the whole thing is the broad conclusion that at least from the research we've had so far is that there's absolutely no application of a rights based approach to these laws so that's quite definitive because forget international standards these laws are not even meeting national standards that have been established through jurisprudence that's come out over years so it's not even meeting the constitutional standards so that's definitely one thing that stands out I think they're not even exactly and the other I think the other major issue is the copying of laws from one jurisdiction to another when we started this research the hope was to find good practices in different jurisdictions so that lawyers and activists could use them to cite them in strategic litigation or other such instances but what we really found was a race of bad practices and just bad provisions being replicated in different spaces right perhaps I could give you one example is if you could go to page 28 or 29 we try to do sort of a cross analysis of how certain words are defined in different laws in these countries is that the one can you go up a bit is that the one that says definitions at the top 27 well that's one example what the table you're seeing up here is what Jessica was talking about how online offences are now somehow graver than offline offences what would have fetched you one year in prison is now fetching you five years in prison for what you should have paid $200 is fine you're paying $2000 is fine so these sort of things you can see here but the next table which isn't I think two pages later you see sort of a cross country analysis of what the word definition sorry defamation means in these new laws but the thing is it will all look pretty much the same but that's not the problem how the word definition defamation is being interpreted and applied in online spaces that's what's problematic between the different jurisdictions so that's definitely one the other issue is is all of these laws are being actually enacted from the point of view of political order and public order which could also include terrorism it could include so many different things because one of the things we found in our research is that a form of expression that's clearly targeted as political expression so any sort of criticism not only of state policies but state leaders or public figures is now being treated as offense against state and sedition so that's definitely and you'll see that clearly in India criticizing the prime minister as an offense criticizing a chief minister is an offense singing a song about the chief minister as an offense yesterday someone got picked up for writing a song about Modi and that's sort of the reality in which we exist I would add a bit to that agreeing completely with what Gaia says because in the Latin American region the same thing applies although we have a very strong inter-American human rights system which all Latin American countries are subject to although Cuba and Venezuela are somewhat away from it the standards are out there however they're not necessarily considered for legislation and that's a general thing it doesn't have to be with cyber or no cyber but the problem that adds up with digital and cyber law has to do with first a lack of understanding of the digital spaces and its different implications and the rush to regulate things even when experts in academia do not agree on the consequences even when the consequences by those laws can be quite grave and secondly apart from that lack of knowledge and lack of consultation with experts or with civil society or different stakeholders has to do with the intention to rush with a political purpose as Gaia was saying to react to phenomenon that appear as fashionable many draft bills on fake news were presented throughout the Latin American region in the last few years several of them mentioned the term disinformation or fake news but are actually about silencing voices and in many cases they're just using available legislation to take measures against some people throughout history that's happened not only by national legislation it was famous a case by the Ecuadorian government censoring through DMCA in the US jurisdiction a content from YouTube but other forms of censorship are appearing other forms of legally allowed censorship are appearing because they understand that to hold on to themes or ideas or concepts that might be trendy such as fake news or hate speech and to use those to quickly pass laws that allow for censorship as it happens in Venezuela is a useful tool for them to just enact troublesome laws I could say maybe a few words about it's taking place in Turkey that's something we've been monitoring a lot there you have a country that for a while seemed to be on a semi-democratic path but has taken a terrible turn in recent years with Erdogan and then the coup that took place and at that point there was a massive turning point and actually some of the changes started years before where they started to shift the judiciary remove a lot of judges that came from a more sort of secular background and started to put in more politicized judges and that's really led to extraordinary abuses of the judicial power to crack down on independent media academics online speech profoundly in the name of national security claiming that there's a lot of content online that is being posted by their political enemies they have just wholesale blocked YouTube and Wikipedia and there's an enormous amount of court cases that are now moving from Turkey to the European Court on Human Rights there was a recent constitutional crisis in Turkey where the constitutional court had ordered the release of journalists that had been according to them wrongly imprisoned based upon European standards the lower courts absolutely refused to abide by the constitutional court of a first that's really what they're supposed to be doing so this came a bit of a showdown and so now the European Court of Human Rights is being completely overwhelmed by literally tens of thousands of cases that they have to now here and they're putting them to emergency measures and the Europeans are now trying to use these institutions that were built many years ago to prevent these sorts of sort of like democracy is sort of unraveling in Turkey and can these institutions actually write Turkey and kind of get it back on course or what direction is this ultimately going to go in and that's an extreme case but you start to see that in other countries that even Hungary potentially it's more subtle but those are definitely trends that are emerging can I just add a short comment which is recently I was involved with many other groups in sort of drafting responses to the anti-terrorism directive that's been proposed recently and one of the most troubling parts of it is that it's actually encouraging the Silicon Valley companies that we're talking about to implement algorithmic and sort of black box content moderation in ways that the policy makers really don't understand most people in this room understand that there is no understanding exactly how that would work but yet there feels to be such a push to make this happen despite the fact that there are so many civil society and technical expert voices out there saying it shouldn't because of these sorts of agendas of the anti-terrorist agenda and quite frankly one of the things that I'm concerned about it's always on my mind is as we start to see more I start to see what's happening in the same way that in the early days of the internet and social media we felt that there was this asymmetrical advantage for the people versus the governments that didn't know how to use these technologies what we're now seeing is that there's an asymmetrical advantage from governments with less developed legal systems and frameworks to be able to impose their sort of policy decisions and norms on to what we want to be a more democratic global order so you start to see sort of the policies of very repressive states like in the Middle East, like in the UAE repressive but rich states sort of somehow flowing back into more democratic processes and I have not had the time to really trace that in a way that would be 100% satisfying to me but I woke up this morning reading about Reuters about a surveillance operation that had been taken place that had been in the Emirates where it was basically X was it X? U.S. intelligence people yes going to work for the UAE to spy on people and so there's these insane kinds of parallel things happening and Khashoggi just since you mentioned Turkey and I know what your executive director is doing now is sort of doing the investigation of Khashoggi's murder where you know what is the dominant policy force in the world is not necessarily as given as it once was I want to ask it's probably a very difficult question but is there a way to separate out kind of the opportunities and challenges in the digital space from the rest of things I mean in some ways it's harder perhaps or sometimes it's easier to make better laws and promote good governance or is it just harder across the board so there is an example so Turkey there's general democratic and governance backsliding across the board Turkey's not alone some of us live in places where that occurs in other realms as well there are particular challenges and opportunities of lawmaking in the digital realm that is a very loaded and complex question but I'm not a lawyer I can ask those questions and I am a lawyer and I can give you an answer that says nothing in a lot of words but from what we have seen in our experience at the religious and I think it's a common thing for many of the organizations that are part of our formal and informal networks many of the things that we are seeing are not necessarily something that has to do with technology of course technology needs some degree of specially constructed rules and norms yes it does however we cannot escape the context within which that regulation appears whether it's regulation by states or by international norms or by international relations and that has to do with the fact that the prevalence of digital network spaces is so ingrained in our lives it's something so part of it that all of the social problems that we see are manifested through technology technology is not necessarily the cause rather than the symptom for many of societal problems in the case of Latin America we see that mostly in the forms of democracy that appear with what we see as effects on freedom of expression or freedom of assembly or even access to the internet those are in the manifestations of the problems that we have also for economic inclusion when we see that policies to connect people are not there or in the case of one specific country where policies are basically to omit taking action towards maintaining telecommunications infrastructure and that has political ramification and that has ramifications for the exercise of economic social cultural rights apart from civil and political rights so it is a very complex question because what we see in online spaces is basically a reflection of what happens for all of society but in terms even though that seems like a daunting challenge it is still an opportunity for those of us working in the digital realm and in digital regulation because we have still the opportunity to switch course and to hopefully when we try to influence policy processes to reflect human rights and human rights values and principles to also manifest that society in general and the manifestation of the democratic will through law can go in a different direction that has gone this far. Just before we address that but it's a very interesting question but before we address that I just wanted to add to your previous question of what is the basis on which these states are enacting beyond and besides terrorism and national security the newest genre of excuses and explanations for regulating rights online has been developed and now states are now I had to give you a classic example it's the case of Aadhar in India which is the biometric ID system and the reasoning for a really poor idea was to make the functioning of the state more efficient and to make sure that development without answering the question of development for whom or how that welfare schemes are better implemented and that's also the basis for which we have the credit system in China is to selling this idea of regulating you so that you will be better off that's one thing but in terms of challenges I think the case of Bangladesh is sort of on point in this relation because Bangladesh has ICT tribunal presided by judges who don't understand ICTs and the cases that they are dealing with are so complex but then they are so politically motivated so you see the challenge there being that you've created an institution but you've really not created a backbone for that institution or really a basis for that institution to function so that's one significant challenge the second significant challenge is that when you try to regulate the internet the internet is going to be used against you as well so you see mass movements happening online and offline as push backs against internet regulation if I had to give you two classic examples it's the net neutrality law that they try to introduce in India there was such a huge push back that they had to roll it back in less than I think a month and last year they introduced they actually put out a public tender called the state called for technologists to develop a 360 degree surveillance tool that not only looks at your social media activities but also tries to listen into your emails to get a sense of public sentiment on state policies there was such a huge push back against that they had to apologize to the public I think there have been really important movements like that which is also positive with the sense that people are pushing back and in the case of Pakistan the Pakistan electronic crimes bill in its original form was truly bad in its current form as an act is still bad but not as bad as before because civil society was able to rally behind it and bring about significant changes so I think the internet itself is actually a great opportunity to push back against internet legislation I think I can say that apart from development oriented ways of controlling the legislative process there is also national security interests which we always have to balance with digital rights so in my country you will see that every time unfortunately having terrorist attacks you end up with more extreme security measures security laws that then end up infringing rights and then end up being challenged in court and suspended and I feel like it's an expensive iteration that is unnecessary and there is the appropriation of the legislative process and when you find that you know the constitutional court has declared that you can't criminalize libel and then you still end up doing it again and then again this is a problem so actually one of the projects I'm about to close a deal on is to study how to balance national security clauses with the digital rights but then you have to ask yourself what are digital rights and usually people will challenge the question of is there anything like digital rights and I find that question redundant because it's the same thing 10 years ago we were asking is there anything like technology law right now we're asking I was teaching social media law trust me and guys my students were like is there anything like that I'm like let's bother ourselves with finding the distinguishing characteristics that are actually unique online than bothering whether this is a form of law or not because now it's settled tech law is being taught all over the world as a master's program as a bachelor it's established so we have to immediately start thinking what does the digital right of access look like because then we can start seeing how to safeguard it against misappropriation when it comes to the legislative process and we can start then writing serious academic papers that can inform that kind of process yeah so I think there's many forms of information control I'm finishing up report on a Ford project that we've had since 2016 that was studying internet shutdowns in the Kenyan elections and the Zimbabwe elections so we were looking to see whether the internet will be shut down in Kenya wasn't shut down Zimbabwe eventually was shut down and not even shut down someone defaced it so it wasn't even the government that people were looking to shut down the internet that actually did it the thing is there's many people that can control the internet so I had to expand the scope of my research to look at information controls not just technical but other forms so in Africa there's a trend to use either taxation laws or other forms of law registration procedures so for instance in Tanzania now bloggers have to register with some organization they have to pay $480 for a three-year license they have to pay $400 every year in Uganda you have to pay I think it's five cents per day to browse the internet which is about 15% above the what do you call it the living wage or something so there's many other forms of control that you can come to exert on the internet and we have to start understanding what these are and that will tell us what the challenges really are in legislative processes also there's I mean judiciaries are rising up to the occasion so like in Kenya now really trust our judiciary to rise up to the occasion and just say no and we have the cyber crimes act 26 sections of the cyber crimes act past last year have been suspended Zimbabwe also the constitutional court reversed the decision by the minister to shut down the internet recently when they had a protest over I think it was fuel prices so there's many ways that also people are tackling the challenges that's great I appreciate thank you all for adding good experiences to this as well and one of the things that I'm pondering as we move forward is like how can we switch the norm from copying perhaps bad experiences and bad laws to good laws and the experience of the people pushing back and restraint by governments as well help us push the conversation forward who has a question an observation preferably a question please thank you thank you so much for really impressive and somewhat depressing opening of this conversation let me frame the question a little bit I'm worried as a lawyer as a law professor about the reputation of law generally not only in the context of tonight's conversation and it seems a paradox because on the one hand side here in the US in particular especially for a European living here there's been a dominant some sort of narrative that in the technology space keep the lawyers out and things will be wonderful we see all this innovation we will see great transformations that are enabled through technology, through entrepreneurship so that's been some sort of one of the dominant narratives pushed by Silicon Valley proponents now on the other hand side we listen to you and the experiences you document and somehow arrive at a similar yet for different reasons a conclusion that law is creating all sorts of really bad outcomes and problems and it does so I'm wondering how can we deal with that tension because of course there's also another way to look at law and you made several references already to human rights laws to frameworks that protect people that open up spaces for human flourishing that safeguard us at a particular moment in time where maybe law or this type of law may become more important than ever as we think about shifts in autonomy away from humans to machines Dennis has done terrific research over there on documenting the emergence of Bill of Rights and some sort of a digital constitutionalism again a different version of law that is arguably very positive for the world and for well-being and for individuals so my question is how do we deal with this rhetorical problem and how can we take be mindful that somehow we not end up trashing law for very different reasons but are more precise or find a new vocabulary so that we don't end up suggesting for very different reasons oh keep the law away because one problem that we then face is well if we do that who are the actors filling the vacuum and some of the problems of course we face today are already the result of this vacuum so thank you I'll go first I'll go first just because I'm not a lawyer I mean I don't have the answer I think one of the things that I'm a non-lawyer that for some reason has gotten myself involved in this incredibly intensely legal project and I have to say when I first started researching the laws from the Arab region in 2013 2014 it was the first time I'd really ever considered law and reading laws and sort of understanding what they are and have over the years developed an understanding of the structure and I was in this session today being very authoritative on things that I shouldn't probably have been so authoritative about but I only bring that up because I think one of the challenges is that law has become inaccessible in many ways and has been and especially when we're in this digital sphere where it's all of a sudden it's become so relevant in something that feels like we know the lay person or the citizen or the normal person or the ordinary person however we describe it we're dealing with all these tools and yet at the same time there are all these policies that are much more immediate to us now because they're restricting very in our interpersonal space or in our impersonal space what we can and can't do and so one of so I think one thing that our project is trying to do is make law more accessible so making law more accessible is one of the things that I think needs to be done but I think making it more accessible and understandable is one of them I think also what we've talked about a lot over the past couple of days is the need for better and I think Bergman attempts to do this and maybe the legal technology sort of programs that you're talking about Robert but to have I think you said it Robert this week that we need more lawyers who understand technology and more technologists who understand the law and more opportunities for them to meet and to really understand what the implications of a certain policy and codes are on certain codes and policies I don't know that there's no I in my mind there's no silver bullet I certainly and I've gone through this like well is the as things the worry one of the worries I have is as algorithms become more powerful and artificial intelligence and I think others are asking this question what will the need for law be when everything's just encoded right and we don't want to lose that because within law and within is so much humanity as well and if within law is really justice because can an algorithm be just I mean I think we're all sort of asking ourselves that question then there is certainly a need for law and a law that is implemented by people and not machines so I don't want to get rid of it but as a recovering lawyer what I might add to that is that what we see in these spaces is that we want some degree of protection we want protection for our interests not only for our interests themselves but the enabling conditions for those interests and the idea of having agency to decide what rules govern our spaces and to decide what we do with our information and to be safe from abuse and those efforts from the towards digital constitutionalism paper brilliant one recommended for every lawyer who hasn't read it and every non-lawyer as well has shown is that that effort exists but to bridge what lawyers can do and what technologists can do and the important to for every technology user or person possibly affected by technology can have from that space is that the effort to bridge the gaps between those in power those who make the decisions and rules either states or companies and the people who are affected are of at most importance and I think that's one of the reasons why many of us came into the internet policy space to try to promote rules not only with regards to government but also with regards to companies and the rights that through law or through policy people have to defend their rights and that's why also so many of us have slightly moved from thinking about technology law for the public interest to speaking directly about human rights law because we see that those standards first they are global secondly they might get usually ignored by people who are thinking about the law or the immediate interests rather than the idea that there are already principles and rules in place to defend those interests and as such those can be wielded by users so bridging those gaps and providing the information for people about what is relevant to defend those rights and to defend those interests is that projects like ours appear and why activities of organizations like advocacy organizations like mine and others too become so important and that's why we gathered here also as well I think the answer to that is sort of in trying to understand what the internet has brought in the decentralized nature of the internet should have ideally led to decentralization of power and economic power as well right but what we are actually seeing is result of internet has been the centralization of power but decentralization of labor if you look at how Google or Facebook really function they essentially we are the workers for them and it's just our data through which they monetize our data right so all of that is essentially going to lead to regulation there's no way to escape that and I'm saying this because these platforms are touching on key democratic processes like elections like democracy itself so there's no way that they are not going to get regulated because the impact of that is serious it's not just personal harm but it's political harm in sort of a much broader sense and I don't I'm not sure of course I can't speak for the other organizations I don't think in any way we are advocating because that's essentially what we are saying we are saying that these not only platforms but the way states function and regulate our rights is problematic but what I'm essentially trying to convey is that in most cases offline laws are anyway being used in online spaces penal codes are anyway being extended to online spaces then do you really need to have specific provisions that are suddenly creating newer categories of crimes and offences which did not exist which have been interpreted in a certain fashion and as a result of these new laws you're reinterpreting re-inventing the wheel so I think the first problem is to try to sort of standardize what's being applied in offline to online in any case the second I think significant issue to get past is to look at what are the newer forms or problems that the internet and technology use of technology creates regulating that space is what's important for not only technicians, technologists and lawyers to talk about it's important for users to talk about because ultimately it's their rights that are being mediated by states and not only states by private sector as well I think in that regard jurisprudence that's coming from the global south is extremely important I think for a while now we've been repeatedly looking to Europe and America to sort of set the standards on what's acceptable and what's not acceptable but if you really look at it there has been fantastic jurisprudence that's come out from Asia and there's of course extremely problematic jurisprudence that's also come out from the same courts and sometimes the same judges even on issues touching upon technology I mean recently sorry Islamabad High Court held that internet shutdowns are unconstitutional something that well established courts in India could not achieve but of course that's a challenge now and we're hoping that the Supreme Court would take the same view and if we look at the dissenting opinion that came out in the other judgment which is the biometric ID system it's a fabulous dissenting opinion of course they ultimately upheld the constitutionality of the program but the dissenting opinion really lays out what many of us have still not been able to articulate so I think the key is to keep an eye out for the significant jurisprudence that's coming from that region and I would just add that after reading a lot of cases over the last few years I have to say a few positive things that particularly coming from Europe the courts are getting more sophisticated in their understanding of technology so some of the earlier ones you could tell it was very grey area they would come up with sort of general principles but they weren't really engaging the specifics of the technology and so now there was a just a for instance it was a right to be forgotten case in Spain and it went through various levels of courts but the conversations that the courts were having about the different rights was on a very very more technical level than I had ever seen before so I think in a certain sense that's a positive trend at least the outcome of that particular case was generally more positive than some of the things we've seen but we're also seeing now is that a lot of the social media platforms are realizing that they are just overwhelmed with requests for content takedown there has to be some sort of regulation if they can't go to the courts because they're getting millions of requests daily, weekly and just in the last couple of weeks Facebook in fact just this week Facebook has come out with a statement that they are putting forth a proposal to create a council that would be effectively an appeals council that would be established by a group of international experts they would fund it but they're trying to find a way of making sure that they're able to maintain independence for this particular group and they would be the ones that would be doing the transparent appeals process of all of these different content takedown requests article 19 which is freedom of expression organization based in the UK they have an alternate model that they're putting forth for online regulation of content theirs is more based on the press council approach where it would be industry people getting together they would be selected or elected into a council to review these things and so that at least brings the whole industry together whereas Facebook is looking for a council that would be specific to Facebook issues and there's some back and forth about what is the best model on that Facebook has said that they feel for time constraints and out of like this pressing need they need to move forward as quickly as they can to establish this and you know make the councils as representative internationally as they can but there's obviously limitations to that so now there's this tension going on of we have corporations that are involuntarily acting as public squares they are really profit making institutions and they've got all of these users who are very concerned about the content that's up there and they now have to take on these regulatory functions that they're not comfortable doing so they don't want to relinquish all of control but they do need to have some sort of independence they've got to take it off the courts and we'll just have to kind of see how all of this shakes out. It was of course inevitable and necessarily that we get to Facebook at some point I'm really impressed that we made it as far as we did it's like I don't know if there's an equivalent to Godwin's law about when you bring up Facebook anytime you're talking about the internet but anyway we made it pretty far other thoughts questions Nikki and then so first of all thank you this is a really cool project and I'm looking forward to the final product I met GNI and we have a project called a country legal framework that's basically just websites with a lot of text on them so I really appreciate the notion of something searchable and comfortable so Juan Carlos you noted the trendiness around certain issues and how that can prompt legislation or topics, bills that come up for debate and so I think an example of that might be the EU's draft terrorist content online regulation which happens to coincide with upcoming elections in the European Parliament in May so I think generally in the advocacy space there's not a lot of optimism that there's going to be many changes to that bill though it is and everyone kind of agrees it's pretty problematic so my question is with kind of the increasing politicization politicization of many topics in the digital space where they maybe once weren't alongside kind of increasing polarity of politicians and politics do you see kind of those having effects on the cyber law that is being created or discussions or around it so okay question being how is increasing polarity and increasing politicization of digital rights issues particularly since 2016 the election in the US perhaps then becoming more public in a way that they haven't been before how is that having an effect on cyber law in your regions but also kind of in the flow of legislation from one region to another because I was mentioned I will answer first I think the examples from Latin America are many not only in law but also in policy and policy actions especially with I think Venezuela is an example of so many things that we see as wrong with the world that it's not surprising that they have passed laws against certain forms of speech based on the idea of that insulting or offending certain public officials should be treated as a special form of harmful speech so that opportunity has been taken there and that was a draft bill still discussed in Honduras and that has been taken into Congress also in places like Brazil and Chile even though it might not it wasn't it didn't pass in those cases but that increasing polarization has been seen in all of those countries Nicaragua also shut down a few media outlets and jailed a few people also who were protesting against the government and those policy actions were also based on what people were saying online one civil society organization in Ecuador was shut down because of one retweet by their account in a particularly oppressive government that is not an authoritarian, totalitarian government but still has shown signs of being against freedom of expression so when we see the influence of political polarization and politicization of the regulation of cyber law is yet again an example of governments becoming aware of the impact that they can have by regulating technology which means that they can thus regulate some especially sensitive forms of social manifestation and social organization so although examples can be seen all throughout the world I think that in the case of Latin America they are also taking advantage of the fact that we are in a post-2016 world where even though we have a longer history of politicization and coup d'etat here and there and everywhere that those kinds of regulations and rules and norms that have affected social life in the past are being also being adopted into the digital realm whether that will remain the case or not is something that remains to be seen but so far advances have not been so encouraging and I would add to that that some laws years ago or decades ago did reflect some rather positive view of the internet and an example was given by Jessica about the Marcos de Vilda internet in Brazil the net neutrality law in Chile a few laws about repositories for open access literature in Peru Argentina and something in Mexico as well but those things remain in the past where things were seen from the cyber law perspective but politicization has indeed been taken as a form of either exerting higher levels of control or in some cases also to either propose support or opposition based on governments that are promoting those laws so yes it has an effect and it's not a great effect so far but still the opportunities to influence those processes remain open so as some of you briefly mentioned that in some countries for example South Korea traditional laws criminal defamation provisions and national security laws are used to regulate expression and speech online particularly to silence critics, government critics and I wonder whether any of you have can comment on recent trends in this area in particular how civic organizations dealing with related situations I mean that's sort of that's the clear trend right I think a political expression along with artistic expression, religious expression and sexual expression I had to think of four broad categories these are the four broad categories that are particularly targeted in online spaces there have been very important movements that civil society has been engaged in to push back one would be the whole movement that ultimately led to the supreme court that was down a provision in India 66A of the IT Act saying it's unconstitutional because it doesn't there were two women who were picked up for saying that the traffic situation as a result of a political leader's death is unacceptable that's all she said she was picked up and charged under the under the IT Act and there was a big movement behind that that resulted in the supreme court saying this is unacceptable so I think that is an important but what you clearly are now facing is that opposition parties are trying to promise to democratize the internet you take Malaysia as an example they introduced the anti-fake news law couple of years ago and the opposition has now come into power after 60 years the first time there's been a regime change in Malaysia they've pretty much repealed the anti-fake news law so and that's the same thing in India you see the opposition promising to democratize spaces so there is sort of an excess that's now building between civil society and political opposition that is political opposition today I'm quite confident the situation will change once the opposition is no more the opposition but I think another very important way in which civil society is trying to grapple with the situation is in terms of how electoral laws are not catching up with the internet if there is one field of law that's really failed to catch up with the internet is electoral laws because you see how political parties not only their official political parties but the cyber armies they have in online spaces how they violate people's rights by not only their ability to express themselves but their privacy as well I think that's another very significant way in which civil society is starting to expose some of these organized ways in which the United States represses individuals it's wonderful, one of the things that surprises me about this conversation is how everything seems to apply to the United States today but I just want to say that it's not 2016 the repression of people didn't start of 2016 because we've had terribly repressive leaders for many years so I just want to take the credit back because Philippines and India are up there so we just have a couple minutes left if there's any I'd like to just collect a couple remaining questions and then we can wrap things up so my question is for Gayathri, thank you very much for your stimulating comments when we hear of things such as social media companies monetizing our data or serving as facilitators for spread of fake news our instant reaction is that there should be laws that prevent such issues but then the manner in which particularly in India the government has stepped in with regulation and has also created concerns you mentioned the Aadhar case also in December the government of India released a five line executive order stating that any investigation agency has full authority to intercept and monitor and decrypt any information exchanged through a computer device which actually received pushback from WhatsApp which refused to introduce a decryption backdoor in its system so since there are issues about the ability of corporations or the willingness of corporations to regulate themselves and also concerns about the government exceeding its authority or excessively restricting rights and freedom what would you think is a better model for regulating these new technology issues self-regulation by the technology industry or proactive legislation by the government or is it actually a choice between the devil and the deep blue sea that's a big big question if we can answer that one in the next five minutes we'll have done well I don't think it's really possible to answer that any other questions we want to throw in Ellery hey I wondered if you could talk anybody could talk for a minute about state of emergency because I work at global voices we had this like joke going for a while so many of our editors were living in countries that were in a state sort of ongoing state of emergency and it it led to a lot of silly stuff just internally but it was kind of this state of exception or whatever it is where the law doesn't really matter that much or you use it only the government uses it only the way exact way that it is useful and if there isn't a law to use it doesn't matter because it's the state of emergency I'm just kind of curious in the context of this project how do you think about those kinds of circumstances or do you or are you should we go down the road if you have thoughts we haven't heard as much from Holly and Robert as others what comes to mind for me is Turkey and we've been monitoring the complete dismantling of the judiciary there and so much of that happened during these states of emergencies where they could really do just about anything and they were rounding up thousands of judges and journalists and academics and throwing them into jail another thing that they did is they it was almost like a vigilante law that they put forth where citizens who could track down and find people allegedly coup plotters they could then take action against them and there really wasn't much that Europe could do now we had the Venice Commission and a lot of statements coming out and people going over and talking to them and kind of wagging the finger but they were not all that effective and that was one of the things I think that's been very sort of distressing there's an enormous amount of hope that the European institutions and particularly the European court would be able to intervene on a level that would kind of reign in Erdogan and what he was up to and it hasn't worked out all that well so that's kind of a scary place to be and again as I said there's like tens of thousands of court cases now before the European court and we don't know how that's all going to come off. So I'll say there's not always a nexus so I was doing with this study on information controls we were trying to look at the nexus between legal frameworks and technical forms of control controlling the internet and we didn't always find a nexus so a government will just do what they want sometimes and just yeah but we have to go back to Lawrence Lessig and these four models for regulating the internet it's not always the law it could be the infrastructure and so we can't ignore his question which we actually have because digital rights are not absolute rights sorry guys but we do have to balance them we have to think in that situation in India where people were being murdered from this whatsapp fake news phenomenon and we have to tackle directly the issue ahead of us and it is if self-regulation doesn't work and state regulation is extreme what co-regulatory model can we apply those are also principles we know from early on regulating the internet because western jurisdictions as well Australia is well on headed towards an encryption anti-ecryption law and it's going to be there we have to start thinking about what end product do we want do we start thinking about balance right now what does that look like or should we just you know all stay stuck to our guns so I do have a solution right now but I do have as I said I have this project that I want to start and we have to actually finish it within six months that we will go to parliament and try to have workshops with parliament and judiciary on legislative drafting and to see how to bring in a new a theory of regulating the internet because what I feel is there's a gap in legal theory I mean even it was only halfway through my PhD when I realized I have no understanding of legal theory although I thought I did because I'm a lawyer but it was shocked on me it's an entirely different practice and I had to study it for nine months actually I had to extend my PhD on nine months because I was also studying regulation of emerging technologies and so I am usually confronted with gaps in the law and for me that's normal but it's not it's maybe not normal in other circles so we have to think about what does a balance look like in that perspective I'm glad you addressed that question because I was trying to figure out how to answer that question and I think the answer lies in many different things that we as individuals would also have to do beyond legal and legal frameworks and the courts and the most important thing is decentralizing the internet in a real way, decentralizing not just monopolies that exist within the internet but decentralizing the very infrastructure of internet promoting community networks promoting smaller internet providers I think that is actually sort of lies at the heart of the problem that we are facing today when comes the question of trying to adopt not only open source as technology we use but open source as a philosophy and a political framing I think that sort of goes back to the heart of how to fight big corporations in that sense but this whole thing that Holly and Robert were talking about in terms of self-regulation from the private sector I guess one other way of looking at it is also to look at the UN principles on business and human rights and I am not convinced that private sector is getting enough pushback though they look like they are getting enough pushback I don't think they are getting enough pushback so that also comes back to civil society and individuals and in how we use private sector mass produced sort of technologies that is shoved in our faces right but when it comes to regulation I think what I am going to say is going to sound too simplistic but really the problem is that there is no rights based approach to ICT laws right now there is no rights impact assessment either by private sector or by the state when they introduce new provisions or tweak existing provisions to apply to the internet but I think the most important thing is adopting things like privacy by default whether it is by for private sector or for state sponsored undertakings like ADAR or any other major ID system so I think it is also making that a default that matters but this is going to be evolving it is just sort of not even the start so I think it is about us remaining vigilant and agreeing on basic principles that approach law and how we are regulated on the internet I want to briefly answer some of the questions posed by the idea of states of emergency because in the context of this project one thing that is very important for us is to identify and document cases where state of emergency situations have presented themselves with impacts on the internet and that has been the case in Venezuela and Nicaragua throughout 2018 as well but second I think it is key also to understand that within the context of this project we have the opportunity to go into the laws that would allow that and we have not really seen them operate but that could allow that which is the case for instance of the Colombian state of emergency in Venezuela that in the case of an emergency they can just shut down telecommunication services and legally allowed shutdown that would be so against international human rights law then would become something that the state itself state allows itself to enact and to produce but apart from the idea of states of emergency I think we also need to understand that regulations by states also are a way to do things that would otherwise be considered against law against human rights law against the constitution because it is understood that some special cases like combating organized crime, drug trafficking and so on and terrorism also allow for extra powers by the states so as much as we can identify those as has been done in the past but also to highlight those and how those are not up to either standards from international human rights law or by standards simply said by other jurisdictions I think we also can identify things that we can advocate against when those abuses are allowed and I'm not even touching about self-regulation because in the absence of regulation we see that the rule could be some level of abuse by private actors as well just well my last word is anyway I'm going to say thank you to everyone because it's already 7.35 and I really have nothing to add that would enhance your statements so and I'm going to say thank you to you Rob for moderating us and thank you to all of you for coming you've been a great audience and thank you very much


In this set of slides, we will look into network scans. We have seen in this week introduction that the basic mechanism behind a network scan is engaging the target to answer and probe packet. The type of answer or the lack of an answer can provide valuable information to the scanner. For example, based on the behavior of TCP, the scanner can try to infer if a port is open, in other words, if a service is active on that host, or vice versa if a port is closed and no service is running. Let's now have a look into some different types of scans. Depending on the type of scan, different information can be gathered. The simplest type of information one might want to gather is which hosts are active. To do this, a scanner will progressively contact all hosts in a target set. It can be a target network or a list of IP addresses and probe them. There are several ways to do this, in the sense that several protocols can be used for an host scan and give you information about which hosts are alive. A very simple scan, in this case, is a so-called ping-zweep, in which the scanner sends ICMP echo packets to the targets and wait for a request. The advantage is that such a scan is really simple. The disadvantage is that ICMP echo packets can be ignored at the target or can be filtered by a firewall, so such a scan might be unreliable. A different type of information one might want to gather using a scan is which ports are open on a host. This information can be considered a good approximation of which services are active on a host. One can use both TCP or UDP for a port scan. In a nutshell, there are pro and cons for choosing either of these protocols. TCP scan uses TCP responses, like SIM packets or Reset packets, for inferring if a port is open or closed. It is considered a quite reliable way of scanning because TCP is connection-oriented, but it might be expensive for the scanner to initiate a TCP connection with multiple destinations. UDP port scanning, on the other hand, is simpler but more unreliable. It needs more guessing for identified open ports because it will either wait for an error message, for example an ICMP destination and beachable message, or for a legit response for a certain service, DNS, for example, if a DNS request was sent. If no message was sent, it will assume that a UDP service is running on the probe port. It has received the probe, but not knowing what to do with it, it has simply thrown it away. Of course, several things could go wrong during this inference process. ICMP might be filtered and UDP probes or responses might get lost. In the following, we focus on a couple of examples of TCP port scanning. The simplest way of scanning announced using TCP is to rely on the operative system network functions, as to say, use the regular implementation of TCP. A scanner can, for example, use a regular TCP handshake to check if a port is open. It will send a SIM packet, receive a Sineq answer if the port is open, and then complete the handshake with an act. Alternatively, the scanner will receive a Reset packet if the port is closed. So far, this is the regular TCP behavior. You might have noticed, however, that the scanner does not actually need to complete a TCP handshake to have all the information it needs. From the scanner perspective, receiving a Sineq or a Reset packet is always needed. If the scanner interrupts the TCP handshake after receiving an answer from the target, we talk of a SIM scan or half-open scan. The scanner will interrupt the handshake with the Reset packet. The disadvantage here is that the scanner needs an undocumented implementation of TCP. A scanner can also try to engage a negative answer. For example, in a Christmas tree scan, the scanner sends packet with a thin, urgent and patch-like set. The packet will trigger a Reset answer if the port is closed, or it will be ignored by the operative system if the port is open. When performing a scan, you can either search for a specific open port in a set of IPs, or vice versa, trying to identify all open ports in a single host. In the first case, we talk about an horizontal scan, while in the second, about a vertical scan. Vertical and horizontal scan can also be combined in a block scan. Scans are typically the first steps of a more articulated attack, and in practice, a scan and a different type of attack, like password guessing, are often combined. Let's see an example. In this picture, you have a representation over time of an SSH dictionary attack that we have measured at the University of Toronto campus. On the X-axis, there is time. On the Y-axis, we have a numerical identifier of the IP addresses. A dot indicates that there has been a communication between the attacker and the host. An SSH dictionary attack aims at finding SSH accounts with an easy-to-guess username-passer combination. To do this, the first step is to identify hosts with an active SSH service. This is a scan on port 22, which can be clearly seen in this picture as a line. Then, the attack directly progresses to brute-force username-passer combinations. This is what happened in this second part of the picture. Scans can be quite noisy from a traffic pattern point of view. This can make them quite easy to detect. And since the scanner will most likely use one or a small set of hosts to perform the scan from, scans can also be easily filtered. Scanner can apply several techniques to try to remain under the radar, like scanning at a very slow rate or distributing the scan. Sometimes, more complex techniques are in use. Let's see an example. This picture is a planner representation of a slash 8 network block used for this specific measurement. The representation uses the so-called Hilbert curve. By using a Hilbert curve, IPs that are closed in an address sense will also be closed in a Euclidean sense. Each point on the picture represents an IP address. The colored points are IP addresses that have been contacted by during a distributed scan on the super protocol performed by the Solity Botnet. The scan seems random. However, analysis of the traffic generated during the scan shows that the scan was actually performed in a sequential manner, but in reverse IP sequential order. If you reverse the order of the bytes in the IP addresses, the scan appears to progress in a sequential manner, and it is highly structured. In this case, scanning in reverse byte order is used for obfuscating the scan and distributing the probes in a seemingly random way. So far, we have somehow assumed that a scan is an attack. This was considered true in the past, but it is nowadays a too restrictive definition of such a mechanism. In truth, there are legitimate reasons to perform a scan, like for example, a network administrator that needs to test connectivity to end hosts. Scans are also often used as a data source for research. In this respect, network scans fall into the category of active measurements. For example, a project by among others, the University of Southern California, uses pink sweeps to map which parts of the IPv4 address space are in use. Researchers at the University of Michigan have developed ZMAP, a tool that allows efficient internet wide scans that is used for gathering information about cellular protocols. For example, they use it for studying the impact of the heart bleed SSL vulnerability in 2014. It might seem that the malicious or alleged nature of a scan is then only a matter of intention. I do not believe this is the case. The fact that one can scan the internet does not imply one should. The research community is constantly reflecting about the ethical implication and the possible consequences of active measurements. It is in addition considered best practice to adhere to a few rules. For example, limiting the network hindrance both at the source as well as the destination and be as clear as possible about the goal of your study and in stating that this is done for research purposes. Despite this, some targets might not want to be part of the scan. A proper study should then include the opt-out mechanism, allowing networks to be excluded from the scan. Last, once the data are collected, researchers need to put care in deciding if and how data can be shared with others. Data sharing is crucial for the research community, but it might endanger the targets and measures like responsible disclosure should be taken such that it does not happen.


We're at Comossum College right now. It's a funding announcement of $800,000 for Comossum for their health care assistance, health care, and addictions programs here. So it's it's giving an opportunity for this college to put another 96 positions in for the kind of short-term educational programs that are needed in the community in that short-term period. Well it's a great day for Comossum College. As the minister announced we're going to be able to provide another 96 seats to students in in our health care programs and you know these programs are in high demand and we know that there's an anticipated skills shortage so what this is doing really is allowing us to train more people and get them out into the workforce as quickly as possible so the impact really is very significant. Infrastructure is amazing everything is current and the biggest thing for me is the tuition is reasonable and it's just a great place to to be. It's the nice thing too is that given the current environment with all of the baby boomers we've all got employment for the next 20 years. It's an amazing program to have. I was kind of searching for something to do a little bit more specific than the social work that I was going for originally and having a 10-month program that completely starts off a student from the beginning levels if that's where they're at and really kind of transforms them into positive mental health workers in the community is such a great program to have. It's an analysis of the kind of health care assistance that are needed health care and mental and addiction kind of students that are needed across the province and it's to provide that short-term funding which implies these programs are seven month or ten month or one year in duration so in one year if you start now you will have a category about 221 new positions across the province that are funded as of today's announcement.