Loading summary
Transcript88 lines
- [00:03]
Dina Temple Raston
From Recorded Future News and prx, this is. Click here. A few years ago, you may remember this, massive demonstrations broke out in Iran. A young Kurdish woman named Mahsa Amani died in police custody after she was arrested for allegedly not wearing her headscarf properly. And people took to the streets in protest.
- [00:39]
Alex Linton
Women in Iran set their headscarves on fire in fury.
- [00:44]
Dina Temple Raston
Iranian authorities responded to all of this with massive force. They killed hundreds of demonstrators, arrested tens of thousands of others. The government had already blocked Signal, the encrypted messaging app, but then it took aim at another messaging favorite, WhatsApp. People had been using it to organize protests and just to stay in touch, to make sure friends and family were safe, which is where this scrappy little startup app came in, something called Session.
- [01:15]
Session Team Member
And so we saw a huge wave of people who were organizing in country, or even also people who just needed to talk to their families and friends and check in on them.
- [01:25]
Dina Temple Raston
This is Alex Linton, and he's one of the people behind the Session app, which was created in Australia, where Alex is from. And while at first blush Session seemed a lot like Signal or WhatsApp, Alex and the team that built it added an ingenious little tweak, one that makes Session fundamentally different from other encrypted messaging apps. We'll get to that in a minute. Foreign started his career as a journalist, which is what made him passionate about encrypted messaging. Journalists need to keep sources safe, and encrypted messaging protects the privacy of activists, protesters, and just average people, too. Session launched about four years before the Iran protests began. Though the response to it had been.
- [02:15]
Session Team Member
While a little underwhelming, I have to say. I mean, somewhat disappointingly, I think we only have around 20 or 30,000 users in Australia.
- [02:25]
Dina Temple Raston
So the app actually never got much traction until those protests in Iran. The first day, Session was downloaded hundreds of thousands of times, and then the.
- [02:36]
Session Team Member
Next day that doubled. And that kept happening over the course of about a week or two weeks while the protests were really escalating. So it was really surreal, and it's probably still the biggest user acquisition event or user spike I should say that we've ever had.
- [02:54]
Dina Temple Raston
Wow.
- [02:55]
Session Team Member
It was absolutely astounding, to be honest. I mean, obviously the worst of circumstances, but it was really exciting to actually see something that at that point we had been working on for years, really help people and help people in exactly the way that we wanted it to.
- [03:12]
Dina Temple Raston
Alex and the team were thrilled to see their app help people stand up to religious leaders in Iran. So it may have been a bit of an extra gut punch when Session faced an existential threat just a year or two later. Not from an oppressive dictatorship, but from the democratic government of Australia. It began with a knock on the door.
- [03:37]
Session Team Member
An employee was visited at their home by police.
- [03:42]
Dina Temple Raston
This is one of your employees?
- [03:44]
Session Team Member
One of our employees. Correct. Was visited at their home by police. Right. Asking about Session.
- [03:50]
Dina Temple Raston
This knock on the door, it turns out, would vault Session into the middle of a global debate that's still raging to this day. I'm Dina Temple Raston, and this is Click Here. A podcast about all things cyber and intelligence. We tell true stories about the people making and breaking our digital world. And today, a little encrypted app that found itself at the center of a global debate about how to balance individual privacy with national security and how the people behind that app ended up doing something no one expected in response. Stay with us. From Recorded Future News. I'm Dena Temple west and this is Click Here. What came before that knock on the door from the police was a Christmas surprise, but not the good kind. Just weeks before the holiday in 2018, as people were opening presents and making small talk with their weird uncle, Australia's parliament passed one of the world's strictest surveillance laws with basically no warning.
- [05:15]
Session Team Member
I think it was literally the last sitting of Parliament for the year. And the then home Affairs Minister came up and said, look, guys, we have some latent security threats that are going to be a problem over this upcoming Christmas period, and we need to give law enforcement the power now before we all go away, you know, for our Christmas break, basically to address and squash these security concerns.
- [05:46]
Dina Temple Raston
The law was called the Telecommunications and Other Legislation Amendment act, or TOLA for short. It allows government officials to demand tech companies create a backdoor into their systems which could potentially give the government access to things like a person's private messages or where they've been or who they've been talking to.
- [06:07]
Session Team Member
The federal government is facing increasing criticism for trying to rush new laws through Parliament aid.
- [06:12]
Alex Linton
The new bill gives authority to law enforcement to force tech companies to hand over or help them access encrypted communications.
- [06:22]
Dina Temple Raston
When the news came out, it sent shockwaves around the world. And as you might imagine around the session offices, Alex and his colleagues were still at work when the law was passed.
- [06:34]
Session Team Member
It was pretty much just a moment of pure shock. And, I mean, Australians can be pretty aloof and don't necessarily want to catastrophize, but definitely, you know, the first person to see the news come through was like, Whoa. Have you guys seen this?
- [06:52]
Dina Temple Raston
They all huddled around a single screen and read the details out loud. Together.
- [06:57]
Session Team Member
They were frantically scrolling up and down and trying to figure out what was going on.
- [07:01]
Dina Temple Raston
And the more they dug into the details of tola, the more their hearts sank. This idea that the government could compel session to essentially break into its own product, privacy be damned. While it defeated the entire purpose of encrypted messaging, they knew this was not a hypothetical concern, in part because of something that happened halfway around the world in San Bernardino, California. So do you remember where you were in 2015 when the San Bernardino shooting happened?
- [07:35]
Session Team Member
Yeah, I, of course, remember it happening. I mean, for a lot of people, this was their first introduction to the world of encrypted communications. Or even the fact that maybe your phone is encrypted. Ryan.
- [07:48]
Dina Temple Raston
I know a lot about this case because I covered it as NPR's counterterrorism correspondent at the time.
- [07:54]
Tim Cook
We turn now to the unfolding situation in San Bernardino, California. Authorities now say that 14 people have been killed there. NPR's Dina Temple Rastin has been following the story.
- [08:07]
Dina Temple Raston
At its most basic level, what happened is this. A couple walked into an office holiday party and killed 4, 14 people and injured 22 others. The shooters were eventually killed in a car chase, but they left behind a digital trail explaining that they did it for isis. And in a break for the FBI, they found one of the shooter's cell phones. And that's when the nature of the investigation kind of shifted. Farouk left behind his work iPhone, which the FBI hasn't been able to access. If they enter the wrong password 10 times, or all the data could be erased. All of a sudden, this wasn't just about a terrorism case anymore. This became a battle over privacy. That's because the FBI asked Apple to override the phone's password and encryption protections, essentially creating a backdoor into the shooter's phone. With a situation this horrific, you'd probably expect the answer to be, yes, we want to help however we can. But Apple said no and went public to explain why.
- [09:12]
Session Team Member
This case is not about one phone. This case is about the future.
- [09:17]
Dina Temple Raston
This is Apple CEO Tim Cook talking to NBC News at the time.
- [09:21]
Session Team Member
What is at stake here is can the government compel Apple to write software that we believe would make hundreds of millions of customers vulnerable?
- [09:32]
Dina Temple Raston
Apple was essentially saying, there's something bigger at stake here. If we build a tool to unlock this phone, it will also unlock anyone's phone, exposing all the personal details we keep on our phones to not just the FBI, but maybe to hackers or anyone who might find that back door and break in. To hear law enforcement tell it, the pace of technology forced them to do this. As encrypted apps and privacy settings became more sophisticated, they said criminals would use them to hide in plain sight. So after Australia enacted its surveillance law, Alex worried that it was only a matter of time before they got the same kind of request Apple got from the FBI. And because of the new law, they'd have to say yes. But in fact, the situation might be even more dire than Apple's because of.
- [10:31]
Session Team Member
The way TOLA is written in most countries. This might mean, okay, we have a case about this person and you have data about that person, can you please give it to us?
- [10:42]
Dina Temple Raston
But Alex said TOLA made it so officials could demand a tech company to not just create a backdoor and collect data and hand it off to law enforcement, but could actually force them to let officials walk through that back door themselves and freely wander around to see what they can find. And not just for a specific suspect in a defined investigation, but potentially for anyone's data they wanted to browse at.
- [11:08]
Session Team Member
Any time where information about the entire user base or a large subset of a user base of a platform can be extracted. We have a huge problem when it comes to mass surveillance and just general law enforcement overreach. So I think that's where the concern comes. And of course, in our context, right with Session, if that were to happen to us, it's not only people in Australia who would be affected.
- [11:42]
Dina Temple Raston
It could potentially affect those demonstrators in Iran or Hong Kong. Protesters objecting to a new Chinese national security law, or student activists in Myanmar. People whose very lives depend on staying anonymous. These fears simmered in the back of Alex's brain for years, until finally they came into sharp focus with that knock on the door from the police.
- [12:09]
Session Team Member
In 2023, one of our employees was visited at their home by police asking about Session.
- [12:16]
Dina Temple Raston
That's when Alex said it became obvious that if Session was really going to stick to the principles it was built on, they couldn't just sit back and wait. They had to do something, something bold, something that would really make a statement. And that's when we come back. Stay with us.
- [12:48]
Tim Cook
You come to the New Yorker Radio Hour for conversations that go deeper with. With people you really want to hear from, whether it's Bruce Springsteen or Questlove or Olivia Rodrigo, Liz Cheney, or the godfather of Artificial intelligence, Geoffrey Hinton, or some of my extraordinarily well informed colleagues at the New Yorker. So Join us every week on the New Yorker Radio Hour, wherever you listen to podcasts.
- [13:17]
Dina Temple Raston
From recorded future news. This is Click here. I'm Dina Templerest. That's how it all started, with a knock. And then when the Session employee saw police on his doorstep, he was so rattled, he just invited them in. We asked to talk to him directly, and Sessions said they were protecting his identity for his safety.
- [13:50]
Session Team Member
Police wanted to know, you know, were we worried about quote, unquote, bad people using the application, or did we know that they were using the application, which to me feels like they're feeling out of. What is the point of this app? Why did they make it, and who are they making it for? Because obviously, the only context that they're going to hear about it is a criminal context. Right.
- [14:18]
Dina Temple Raston
So they want to see if you guys were in on it.
- [14:20]
Session Team Member
I think so. I mean, there are other cases that now we know were ongoing in Australia at that time that were criminals that were in on the building of an encrypted application. And I think this meeting, it could have been trying to just get some kind of social understanding of who we were, what we were, like, whether we were criminal types.
- [14:51]
Dina Temple Raston
We asked the Australian Federal police about that 2023 visit, like, what prompted it, what's their version of events, and they told us they had no comment. Given the law, you could understand why the police might be trying to understand not just how Session worked, but who was using it. On the other hand, the way they went about it felt unnecessarily aggressive.
- [15:15]
Session Team Member
So this is where speculation can start to run really wild. Right. If you wanted to just be briefed about the technology, it would be really easy to get that without going to somebody's house.
- [15:27]
Dina Temple Raston
But also, the whole thing felt a little slapdash. For starters, Alex couldn't understand why the police decided to question this specific employee.
- [15:37]
Session Team Member
Why did they go there? What was the purpose of the visit? Why did they visit that particular employee? If they were trying to get a back door, they got the wrong person. Completely.
- [15:49]
Dina Temple Raston
Wasn't a tech guy.
- [15:50]
Session Team Member
Not a tech guy. So it doesn't really make sense.
- [15:53]
Dina Temple Raston
What does your Spidey sense tell you this was about? Which is very scientific Spidey sense.
- [15:58]
Session Team Member
I think they were testing the waters to see what kind of relationship could be built and if we were going to play ball with them.
- [16:07]
Dina Temple Raston
For Alex and the team at Session, the police visit sparked a long list of existential questions.
- [16:14]
Session Team Member
If we were asked to build a backdoor and we actually went ahead with that, well, what's the point? You know, why are we doing this? Why are we here?
- [16:23]
Dina Temple Raston
They found themselves tiptoeing toward paranoia. A surprise visit from the cops can have that kind of effect.
- [16:30]
Session Team Member
It really changed the day to day for the office. It was like if you were going to talk about some things, leave your phone at your desk and don't talk about things, just in open rooms with 50 computers in them, for example.
- [16:47]
Dina Temple Raston
So you thought you were being watched.
- [16:49]
Session Team Member
That's certainly within the realm of reason. And it triggers you to have a question in your head too, of like, have we done something wrong? Are we in trouble? Or are we about to be in trouble? In the end, of course we weren't, and we haven't done anything wrong. We hadn't done anything wrong. Which in the end just makes that original visit all the more bizarre.
- [17:12]
Dina Temple Raston
The thing was, even if law enforcement did ever show up with a specific request, Alex felt like they'd be protected. As far as Alex was concerned, even if the people at Session wanted to respond to a specific request, they couldn't because Session didn't ask users for any information, like their phone number when they signed up. And Session was built on a very specific kind of technology system as well. A way of masking communications that had an initially caught Alex's eye back when he was a journalist.
- [17:45]
Session Team Member
I became a journalist and then became very interested in decentralized technology. Actually, to be honest, that then led me down the rabbit hole of messaging.
- [17:59]
Dina Temple Raston
Decentralized technology is as much about a philosophy as it is some kind of hardware. It's rooted in the belief that systems can run better and be safer and more transparent when no one actually controls them. So instead of the fortress mentality of a tech company wielding total control, decentralized technology is a kind of digital town square approach where there's no mayor, no police chief, instead just a community coming together to keep the square safe. Session was built on that idea. They actually publish their code so anyone can deputize themselves to help administer the service.
- [18:39]
Session Team Member
So anybody can run a server for Session. And currently a lot of people do. We have over 2000 different decentralized servers around the world which are operated by ordinary community members.
- [18:53]
Dina Temple Raston
And if this sounds familiar, it should. That's kind of how the Onion route or Tor is set up.
- [18:59]
Session Team Member
So we similar to Tor, there's a free hop system. So and that mainly exists to protect your IP address from being are revealed to the person that you're talking to, or for a node in the network to understand who you're talking to, instead.
- [19:14]
Dina Temple Raston
Of just sending a Message from point A to point B. Session is putting your message in an envelope, then sealing it in another envelope and then another one. Kind of like a digital Russian nesting doll. And each envelope is hiding a little bit of information, like where it's going or where it came from. And in the case of Session, it goes through a number of these volunteer run servers, each of which opens just one layer of the envelope. The result? Nobody knows exactly who you are or where your letter is really headed. So while Session doesn't exactly offer an invisibility cloak, it does provide a slice of privacy. Or at least it would if it wasn't for the Tola law. Alex said Session eventually decided to set up a courtesy call with the police just to make all this clear. And while Sessions own lawyers assured Alex they'd be just fine, they still felt a little unsettled. And then the final shoe dropped. Australia released new rules for what they call high risk services. Services that sounded very familiar to Alex and his team.
- [20:25]
Session Team Member
High risk services such as end to end encrypted messaging apps.
- [20:29]
Dina Temple Raston
The regulations include a new clause which basically said tech companies can't offer a service to someone unless they have some identifying information, like their phone number. It was like telling a vegan restaurant it now had to serve steak.
- [20:44]
Session Team Member
Which basically said that Session can't be in Australia if it continues as it is.
- [20:52]
Dina Temple Raston
At this point, even if Sessions swore up and down that they would never hand off user data, the very existence of the Aussie law, the company being headquartered there, well, it planted some reasonable doubt.
- [21:06]
Session Team Member
Australia was a toxic wasteland for an encrypted messaging product. Right. Why would you do that? Why would you do that to yourself?
- [21:16]
Dina Temple Raston
Suddenly, the theoretical threat of Tola became a lot more material.
- [21:21]
Session Team Member
And it was at that moment that we thought, okay, well, maybe it's a good idea for us to start reconsidering whether Australia is the right place. People had been saying you got to get out, basically you got to leave Australia. It's got all of these anti encryption bills that keep passing. You just can't be there. But to us, we thought, well, the technology, we're not running the servers anyway. It's all open source. And if anything was to change, somebody would notice.
- [21:56]
Dina Temple Raston
Is it a domicile thing that you're domiciled in Australia, therefore you are subjected to those laws?
- [22:02]
Session Team Member
Exactly, exactly. And this is something that applies obviously to any company that's domiciled in Australia or has a branch in Australia which is, you know, a different business entity. But nonetheless, I think if you have an Australian branch, then you're probably going to be subject to this stuff.
- [22:22]
Dina Temple Raston
So they had to leave. And late last year, Alex did just that. He left the only home he'd ever known and moved to Switzerland. It turns out that the place best known for chocolate and yodeling has some of the strictest privacy safeguards in the world.
- [22:41]
Session Team Member
So it's really not as neat as. Okay, well, Session has moved to Switzerland. I mean, the foundation has, of course, but the app and the network are very much global and they're not in any one place.
- [22:57]
Dina Temple Raston
What Alex didn't expect to come out of this was that Session, this scrappy little app, would find itself becoming a kind of privacy hero. A little old David of privacy standing up to the Goliath Draconian Tola law. Session suddenly was an encrypted messaging service that took a stand against forces determined to rework the rules of privacy as we know them. And while he feels safe now and thinks Session can continue its mission, he's starting to be concerned about something much, much bigger. Whether Australia's law is a harbinger of things to come. Because Australia is part of something called the Five Eyes, a kind of intelligence sharing coalition that includes Australia, the U.S. new Zealand, the U.K. and Canada. So theoretically, whatever Australia might be able to knock loose with those TOLA regulations could or would be shared with a WHO whole host of partners. And that's what worries Alex.
- [23:57]
Session Team Member
The atmosphere around the world is shifting. I mean, the US election is going to change things dramatically. We're seeing policy all around the world changing and advancing when it comes to how we deal with encryption. And in some really important jurisdictions, we're seeing things trend in the wrong direction. And even though Session isn't domiciled in those places, seeing encryption weakened at all in any place is a really negative thing.
- [24:31]
Dina Temple Raston
This is. Click here.
- [24:40]
Zach Hirsch
If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up the day's most interesting and important cyber stories from our sister publication the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to the Record Media and click on Cyber Daily to get all you need to know about the world of cybersecurity right in your inbox.
- [25:14]
Dina Temple Raston
Today is Tuesday, January 21st, and here are some of the top cyber and intelligence stories of the past week.
- [25:21]
Session Team Member
In his final days before leaving office, President Joe Biden is making a big move to protect federal networks from overseas hackers.
- [25:28]
Dina Temple Raston
President Biden left a cyber parting gift on his way out of the White House. It came in the form of an executive order requiring software companies doing business with the federal government to prove that they have security features that can thwart a host of adversaries, everyone from Chinese intelligence agencies to Russian ransomware groups. The order, which came just four days before the end of Biden's term, is part of a broader campaign to secure American infrastructure against armies of hackers. The new order essentially seeks to expand federal authority over the software supply chain. Anne Neuberger, the outgoing deputy national security advisor for cybersecurity and emerging technologies, hinted last year that this was in the offing when we sat down with her on the sidelines of the Munich Security Conference. Companies who are, as you know, key digital infrastructure in this country, we expect a lot because they carry a lot of national risk as government we use their technology and because as elements of American innovation and tech they should do so, is certainly a conversation. The new requirements could set up conflicting priorities for the new Trump administration. It has promised to slash regulations while defending against adversaries seeking to crack into the nation's critical networks.
- [26:50]
Session Team Member
I want to welcome everyone to this hearing on President Trump's nomination of Mr. Ratcliffe to be our next Director of Central of the Central Intelligence Agency.
- [26:58]
Dina Temple Raston
Trump's pick to head the CIA, John Radcliffe, told lawmakers in the Senate Intelligence Committee that he believed a FISA law known as section 702 needs to be renewed. The law allows the government to collect without a warrant the messages of Americans who are in communication with targeted foreigners abroad. Though Radcliffe voiced his support, other Trump nominees, like Cash Patel, who's slated to head the FBI, and Tulsi Gabbard, in line for the director of National Intelligence job, have criticized the 702 program. Radcliffe, during his testimony, said he opposes requiring a warrant for these 702 searches. He said it could lead to delays in responding to national security threats. The program is currently set to expire in 2026. Last Wednesday, the Supreme Court heard arguments on Texas law requiring age verification for online porn access.
- [27:57]
Session Team Member
The case centers on a Texas measure requiring sites with adult consent to implement a system to check a user's digital identification or government issued id.
- [28:07]
Dina Temple Raston
The argument's focused on whether age gating actually violates free speech. The case could have significant privacy implications because sites will have access to users personal data. In the meantime, pornhub has already pulled up stakes in textbook and other states with similar laws. Justice Elena Kagan made clear she believes states have the power to regulate who has access to porn. The case could end up reshaping the free speech protections for adult content. Some privacy advocates say the law could potentially sweep up sex education and LGBTQ content as well. And finally, the US Government is launching a new voluntary program it's calling the US Cyber Trust Mark Initiative. Think of it as a Good Housekeeping seal for smart device manufacturers. It's a labeling system meant to help consumers identify products that are more secure against hacking. Manufacturers can add a shield logo and QR code to products like baby monitors, fitness trackers and other smart appliances, certifying that they meet federal cybersecurity standards. Amazon, Google and Samsung are just some of the companies participating in the initiative. Their label products are expected to hit the shelves this year. According to Deputy National Security Advisor Ann Neuberger, the average American home now has 21 Internet connected devices, and each one of them could provide cybercriminals entree into home networks. The program aims to both inform consumers and encourage manufacturers to improve device security.
- [29:59]
Alex Linton
Today's episode was produced by Zach Hirsch, Megan Dietri, Erica Ga, Sean Powers and Dina Temple Rastin. It was edited by Karen Duffin, Fact Checked by Darren Ankrum, and contains original music by Ben Levingston with some other music from Blue Dot sessions. Our staff writer is Lucas Riley and our illustrator is Megan Gough. Martin Peralta is our sound designer and engineer. Click Here is a production of Recorded Future News and prx. Tune in on Friday for Mic Drop, which features our favorite interview of the week. We'll have a new episode of Click Here on Tuesday. We'll see you then.
- [30:46]
Zach Hirsch
If you're looking for a daily guide to cybersecurity news and policy, sign up for the Cyber Daily from Recorded Future News. It serves up the day's most interesting and important cyber stories from our sister publication the Record, and then aggregates all of the big cyber stories you might have missed from news outlets around the world. Just go to the Record Media and click on Cyber Daily to get all you need to know about the world of cybersecurity right in your inbox.